On 8/14/26 8:58 AM, Christian Borntraeger wrote: > From: Christian Borntraeger <[email protected]> > > With variable length and EXTENDED_LENGTH_SCCB, some callbacks might > change the length field. For example read SCP info might write a new > length into the SCCB header. We must not use that new length for the > buffer copy, since the buffer was allocated with the original length. > Only the length field in the work SCCB is changed, to indicate the > "necessary" size. Using the new length reads past the allocation, so > tools like ASAN might detect a buffer overrun. > > Secure guests do not have EXTENDED_LENGTH_SCCB, and the ultravisor checks > and sanitizes the length field, so no qemu heap contents are exposed to > the guest and the non pv-path already has the same header.length. > > Fixes: 0f73c5b30b8b ("s390x: protvirt: SCLP interpretation") > Signed-off-by: Christian Borntraeger <[email protected]>
Reviewed-by: Matthew Rosato <[email protected]>
