On 7/27/26 7:50 AM, Christian Borntraeger wrote: > If a guest uses incorrect message length it can trigger an assert in > process_mbd which kills the guest instead of reporting an error. Fix
Typo, s/process_mbd/process_mdb/ Maybe can just be fixed when applying? Reviewed-by: Matthew Rosato <[email protected]> > this by adding the correct length check. > > Fixes: 6a444f8507 ("s390/sclplmconsole: Add support for SCLP line-mode > console") > Signed-off-by: Christian Borntraeger <[email protected]> > --- > hw/char/sclpconsole-lm.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c > index 9a16896d22..f6ed282f1b 100644 > --- a/hw/char/sclpconsole-lm.c > +++ b/hw/char/sclpconsole-lm.c > @@ -243,7 +243,8 @@ static int write_event_data(SCLPEvent *event, > EventBufferHeader *ebh) > SCLPConsoleLM *scon = SCLPLM_CONSOLE(event); > > len = be16_to_cpu(data->mdb.header.length); > - if (len < sizeof(data->mdb.header)) { > + if (len < sizeof(data->mdb.header) || > + len > be16_to_cpu(data->header.length) - sizeof(EventBufferHeader)) { > return SCLP_RC_INCONSISTENT_LENGTHS; > } > len -= sizeof(data->mdb.header);
