From: Christian Borntraeger <[email protected]>
If a guest uses incorrect message length it can trigger an assert in
process_mdb which kills the guest instead of reporting an error. Fix
this by adding the correct length check.
Fixes: 6a444f8507 ("s390/sclplmconsole: Add support for SCLP line-mode console")
Cc: [email protected]
Signed-off-by: Christian Borntraeger <[email protected]>
Reviewed-by: Matthew Rosato <[email protected]>
Reviewed-by: Eric Farman <[email protected]>
Link:
https://lore.kernel.org/qemu-devel/[email protected]
[[email protected]: Fixed typo in commit message, added qemu-stable]
Signed-off-by: Eric Farman <[email protected]>
---
hw/char/sclpconsole-lm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c
index 9a16896d22..f6ed282f1b 100644
--- a/hw/char/sclpconsole-lm.c
+++ b/hw/char/sclpconsole-lm.c
@@ -243,7 +243,8 @@ static int write_event_data(SCLPEvent *event,
EventBufferHeader *ebh)
SCLPConsoleLM *scon = SCLPLM_CONSOLE(event);
len = be16_to_cpu(data->mdb.header.length);
- if (len < sizeof(data->mdb.header)) {
+ if (len < sizeof(data->mdb.header) ||
+ len > be16_to_cpu(data->header.length) - sizeof(EventBufferHeader)) {
return SCLP_RC_INCONSISTENT_LENGTHS;
}
len -= sizeof(data->mdb.header);
--
2.55.0
