On Mon, 2026-07-06 at 11:19 +0200, Christian Borntraeger wrote: > If a guest submits an sccb with a tiny header length but a large number > of event mask entries, the write_event_mask handler will > 1. return the wrong RC (ok instead of error) > 2. write to memory after the allocated sccb in qemu host memory. > > Add the necessary checks. > > Cc: [email protected] > Reviewed-by: Hendrik Brueckner <[email protected]> > Signed-off-by: Christian Borntraeger <[email protected]> > --- > hw/s390x/event-facility.c | 6 ++++++ > 1 file changed, 6 insertions(+)
Reviewed-by: Eric Farman <[email protected]>
