An invalid length in an SCCB header correctly generates a specification exception for the regular (non-PV) codepath that processes an SCLP instruction intercept. The PV case doesn't, because the UV enforces a valid length before getting to this point. The length is used to allocate storage later down the line, so doublecheck the length here in the (unlikely) case it is too short.
Cc: Janosch Frank <[email protected]> Cc: [email protected] Fixes: c1db53a591 ("s390/sclp: read sccb from mem based on provided length") Reviewed-by: Matthew Rosato <[email protected]> Acked-by: Christian Borntraeger <[email protected]> Link: https://lore.kernel.org/qemu-devel/[email protected] [[email protected]: Updated commit/comment text, per Janosch] Signed-off-by: Eric Farman <[email protected]> --- hw/s390x/sclp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index d8b655efcc..ebd5e859c5 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -277,6 +277,11 @@ int sclp_service_call_protected(S390CPU *cpu, uint64_t sccb, uint32_t code) s390_cpu_pv_mem_read(env_archcpu(env), 0, &header, sizeof(SCCBHeader)); + /* We should never end up here due to UV checks, but lets be sure */ + if (be16_to_cpu(header.length) < sizeof(SCCBHeader)) { + goto out_no_write; + } + work_sccb = g_malloc0(be16_to_cpu(header.length)); s390_cpu_pv_mem_read(env_archcpu(env), 0, work_sccb, be16_to_cpu(header.length)); @@ -290,6 +295,7 @@ int sclp_service_call_protected(S390CPU *cpu, uint64_t sccb, uint32_t code) out_write: s390_cpu_pv_mem_write(env_archcpu(env), 0, work_sccb, be16_to_cpu(header.length)); +out_no_write: sclp_c->service_interrupt(sclp, SCLP_PV_DUMMY_ADDR); return 0; } -- 2.55.0
