s390_build_iplb() initially points lp at the eight-byte CCW loadparm
array. For SCSI devices, it can replace lp with a variable-length string
returned by object_property_get_str().
The following memcmp() still reads eight bytes. ASan reports
buffer-overflow on value "3", when running test_scsi_loadparm
func-s390x-boot_4k test.
Check the fixed-size CCW loadparm for the 8-zero before the SCSI
property can replace lp.
Fixes: 429442e52d94 ("hw: Add "loadparm" property to scsi disk devices for
booting on s390x")
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/s390x/ipl.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index d59ed36c7839..e249d50b1ce3 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -549,6 +549,11 @@ static bool s390_build_iplb(DeviceState *dev_st,
IplParameterBlock *iplb)
if (ccw_dev) {
lp = ccw_dev->loadparm;
+ /* If the device loadparm is empty use the global machine loadparm */
+ if (memcmp(lp, NO_LOADPARM, 8) == 0) {
+ lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
+ }
+
switch (devtype) {
case CCW_DEVTYPE_SCSI:
sd = SCSI_DEVICE(dev_st);
@@ -583,11 +588,6 @@ static bool s390_build_iplb(DeviceState *dev_st,
IplParameterBlock *iplb)
break;
}
- /* If the device loadparm is empty use the global machine loadparm */
- if (memcmp(lp, NO_LOADPARM, 8) == 0) {
- lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
- }
-
s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
iplb->flags |= DIAG308_FLAGS_LP_VALID;
--
2.55.0.543.g5ebe2ebe4ea8
