On 19/8/26 13:06, Eric Farman wrote:
On 8/14/26 8:58 AM, Christian Borntraeger wrote:
From: Christian Borntraeger <[email protected]>
With variable length and EXTENDED_LENGTH_SCCB, some callbacks might
change the length field. For example read SCP info might write a new
length into the SCCB header. We must not use that new length for the
buffer copy, since the buffer was allocated with the original length.
Only the length field in the work SCCB is changed, to indicate the
"necessary" size. Using the new length reads past the allocation, so
tools like ASAN might detect a buffer overrun.
Secure guests do not have EXTENDED_LENGTH_SCCB, and the ultravisor checks
and sanitizes the length field, so no qemu heap contents are exposed to
the guest and the non pv-path already has the same header.length.
Cc: [email protected]
Fixes: 0f73c5b30b8b ("s390x: protvirt: SCLP interpretation")
Signed-off-by: Christian Borntraeger <[email protected]>
---
hw/s390x/sclp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Thanks! Applied for 11.2
