On 6/7/26 11:19, Christian Borntraeger wrote:
If a guest submits an sccb with a tiny header length but a large number
of event mask entries, the write_event_mask handler will
1. return the wrong RC (ok instead of error)
2. write to memory after the allocated sccb in qemu host memory.
Add the necessary checks.
Cc: [email protected]
Reviewed-by: Hendrik Brueckner <[email protected]>
Signed-off-by: Christian Borntraeger <[email protected]>
---
hw/s390x/event-facility.c | 6 ++++++
1 file changed, 6 insertions(+)
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
