On Thu, 2026-07-09 at 16:29 +0200, Christian Borntraeger wrote:
> We verify the sccb length and then allocate based on that length. The
> following access re-reads the sccb again. This can race against other
> vCPUs overwriting the length field.
>
> sclp_service_call_protected does not need a change as the ultravisor
> provides a consistent snapshot.
>
> Fixes: c1db53a5910f ("s390/sclp: read sccb from mem based on provided length")
> Cc: [email protected]
> Signed-off-by: Christian Borntraeger <[email protected]>
> Reviewed-by: Matthew Rosato <[email protected]>
> ---
> hw/s390x/sclp.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Reviewed-by: Eric Farman <[email protected]>
