Re: [PATCH 9/9] hw/s390x/ipl: fix short SCSI loadparm buffer over-read

[Jared Rossi]

On 9/6/26 4:53 AM, Marc-André Lureau wrote:

s390_build_iplb() initially points lp at the eight-byte CCW loadparm
array. For SCSI devices, it can replace lp with a variable-length string
returned by object_property_get_str().

The following memcmp() still reads eight bytes. ASan reports
buffer-overflow on value "3", when running test_scsi_loadparm
func-s390x-boot_4k test.

Check the fixed-size CCW loadparm for the 8-zero before the SCSI
property can replace lp.

Fixes: 429442e52d94 ("hw: Add "loadparm" property to scsi disk devices for booting 
on s390x")
Signed-off-by: Marc-André Lureau <marcandre.lur...@redhat.com>
---

Reviewed-by: Jared Rossi <jro...@linux.ibm.com>

  hw/s390x/ipl.c | 10 +++++-----
  1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index d59ed36c7839..e249d50b1ce3 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -549,6 +549,11 @@ static bool s390_build_iplb(DeviceState *dev_st, 
IplParameterBlock *iplb)
      if (ccw_dev) {
          lp = ccw_dev->loadparm;

+ /* If the device loadparm is empty use the global machine loadparm */

+        if (memcmp(lp, NO_LOADPARM, 8) == 0) {
+            lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
+        }
+
          switch (devtype) {
          case CCW_DEVTYPE_SCSI:
              sd = SCSI_DEVICE(dev_st);
@@ -583,11 +588,6 @@ static bool s390_build_iplb(DeviceState *dev_st, 
IplParameterBlock *iplb)
              break;
          }

- /* If the device loadparm is empty use the global machine loadparm */

-        if (memcmp(lp, NO_LOADPARM, 8) == 0) {
-            lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
-        }
-
          s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
          iplb->flags |= DIAG308_FLAGS_LP_VALID;