On 7/6/26 5:19 AM, Christian Borntraeger wrote: > If a guest submits an sccb with a tiny header length but a large number > of event mask entries, the write_event_mask handler will > 1. return the wrong RC (ok instead of error) > 2. write to memory after the allocated sccb in qemu host memory. > > Add the necessary checks. > > Cc: [email protected] > Reviewed-by: Hendrik Brueckner <[email protected]> > Signed-off-by: Christian Borntraeger <[email protected]> > ---
Reviewed-by: Matthew Rosato <[email protected]> > hw/s390x/event-facility.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c > index fee286ea63..184c469bd3 100644 > --- a/hw/s390x/event-facility.c > +++ b/hw/s390x/event-facility.c > @@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB > *sccb) > static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb) > { > WriteEventMask *we_mask = (WriteEventMask *) sccb; > + uint16_t sccb_length = be16_to_cpu(sccb->h.length); > uint16_t mask_length = be16_to_cpu(we_mask->mask_length); > sccb_mask_t tmp_mask; > > @@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SCCB > *sccb) > return; > } > > + if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) { > + sccb->h.response_code = > cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH); > + return; > + } > + > /* > * Note: We currently only support masks up to 8 byte length; > * the remainder is filled up with zeroes. Older Linux
