From: Philippe Mathieu-Daudé <[email protected]> If address_space_read() fails, return PGM_ADDRESSING. In the unlikely case address_space_write() fails (we already checked the address is readable), return PGM_PROTECTION.
Signed-off-by: Philippe Mathieu-Daudé <[email protected]> Reviewed-by: Thomas Huth <[email protected]> Reviewed-by: Jason J. Herne <[email protected]> Message-Id: <[email protected]> (cherry picked from commit d39ac36fe298400eac7e9272c950bedca29490c0) (Mjt: pick this one up for 10.0.x so subsequent changes apply cleanly) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index ce31bf8b0c0..3a7302f760c 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -305,6 +305,7 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code) g_autofree SCCB *work_sccb = NULL; AddressSpace *as = CPU(cpu)->as; const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED; + MemTxResult ret; /* first some basic checks on program checks */ if (env->psw.mask & PSW_MASK_PSTATE) { @@ -319,7 +320,10 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code) } /* the header contains the actual length of the sccb */ - address_space_read(as, sccb, attrs, &header, sizeof(SCCBHeader)); + ret = address_space_read(as, sccb, attrs, &header, sizeof(SCCBHeader)); + if (ret != MEMTX_OK) { + return -PGM_ADDRESSING; + } /* Valid sccb sizes */ if (be16_to_cpu(header.length) < sizeof(SCCBHeader)) { @@ -332,7 +336,11 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code) * the host has checked the values */ work_sccb = g_malloc0(be16_to_cpu(header.length)); - address_space_read(as, sccb, attrs, work_sccb, be16_to_cpu(header.length)); + ret = address_space_read(as, sccb, attrs, + work_sccb, be16_to_cpu(header.length)); + if (ret != MEMTX_OK) { + return -PGM_ADDRESSING; + } if (!sclp_command_code_valid(code)) { work_sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND); @@ -346,7 +354,11 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code) sclp_c->execute(sclp, work_sccb, code); out_write: - address_space_write(as, sccb, attrs, work_sccb, be16_to_cpu(header.length)); + ret = address_space_write(as, sccb, attrs, + work_sccb, be16_to_cpu(header.length)); + if (ret != MEMTX_OK) { + return -PGM_PROTECTION; + } sclp_c->service_interrupt(sclp, sccb); -- 2.47.3
