From: Matthew Rosato <[email protected]> Ensure SEI commands that are received are of the appropriate length and format before handling.
Cc: [email protected] Fixes: 8cba80c3a0 ("s390: Add PCI bus support") Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Farhan Ali <[email protected]> Reviewed-by: Eric Farman <[email protected]> Signed-off-by: Matthew Rosato <[email protected]> Signed-off-by: Christian Borntraeger <[email protected]> Message-ID: <[email protected]> Signed-off-by: Cornelia Huck <[email protected]> (cherry picked from commit 386268daea86e53d90baf99df5c7b8e2727ea783) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c index a944f16c254..2f94a29ac27 100644 --- a/target/s390x/ioinst.c +++ b/target/s390x/ioinst.c @@ -601,13 +601,27 @@ static int chsc_sei_nt2_have_event(void) #define CHSC_SEI_NT0 (1ULL << 63) #define CHSC_SEI_NT2 (1ULL << 61) +#define CHSC_SEI_0_FMT 0x0f000000 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res) { uint64_t selection_mask = ldq_be_p(&req->param1); + uint32_t param0 = be32_to_cpu(req->param0); uint8_t *res_flags = (uint8_t *)res->data; + uint16_t len = be16_to_cpu(req->len); + uint16_t resp_code; int have_event = 0; int have_more = 0; + if (len != 0x0010) { + resp_code = 0x0003; + goto out_err; + } + + if (param0 & CHSC_SEI_0_FMT) { + resp_code = 0x0007; + goto out_err; + } + /* regarding architecture nt0 can not be masked */ have_event = !chsc_sei_nt0_get_event(res); have_more = chsc_sei_nt0_have_event(); @@ -634,6 +648,12 @@ static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res) res->code = cpu_to_be16(0x0005); res->len = cpu_to_be16(CHSC_MIN_RESP_LEN); } + return; + + out_err: + res->code = cpu_to_be16(resp_code); + res->len = cpu_to_be16(CHSC_MIN_RESP_LEN); + res->param = 0; } static void ioinst_handle_chsc_unimplemented(ChscResp *res) -- 2.47.3
