From nobody Sun Jul 26 12:31:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1782120088; cv=none; d=zohomail.com; s=zohoarc; b=muaOkS/9tiRzMz/gTUU+xhDMrLPJenUam10l9PsotapZV43bpmgM+gR1tUSDt/HJUgjrWDs7QXfwaQk4J1qG5bqobJbX07zUv30VCV1hydZW3N65LasmnQ9XmzkXHGbFhw0IbNa+dS8RwS9li6qZXH2LjbIGAbDHYAj+pXFV2aw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782120088; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hkbW0eHSV8gBVq1aeSo6vFvh7L2GT4SfaVKcCjiTh7E=; b=cIp2FsCNimJjKBSWq8wNdziDLcSSwL4/8IQXunyRJ9I+PH0ha70hx8JM6c3DckYtgmrCCwhsMbSCk/Ng8GV69DdCxOoWkXMCNr92PCz5rbpcWATs3CdomGDVE17CnGlYepONJljMvgtgqbVJtpvhea/Q7gzkpBIuogoOP/w8lU8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782120088037982.3471555261184; Mon, 22 Jun 2026 02:21:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wbapp-0005KT-NG; Mon, 22 Jun 2026 05:20:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wbapn-0005Jx-Or; Mon, 22 Jun 2026 05:20:51 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wbapm-0003Hn-1T; Mon, 22 Jun 2026 05:20:51 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65M5IVaA1602673; Mon, 22 Jun 2026 09:20:47 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4ewh9g8bm0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 22 Jun 2026 09:20:46 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 65M9Jb0g004545; Mon, 22 Jun 2026 09:20:46 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4ex66jweku-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 22 Jun 2026 09:20:46 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (smtpav03.dal12v.mail.ibm.com [10.241.53.102]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 65M9KjWV3932774 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 22 Jun 2026 09:20:45 GMT Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3ABB05803F; Mon, 22 Jun 2026 09:20:45 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C837358056; Mon, 22 Jun 2026 09:20:43 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav03.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 22 Jun 2026 09:20:43 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:message-id:mime-version :subject:to; s=pp1; bh=hkbW0eHSV8gBVq1aeSo6vFvh7L2GT4SfaVKcCjiTh 7E=; b=W33oNh/rt9e5iInty0IcLXBRW1lD8oWWjwitd2X1yRHWkh9XGoA9FP2pv jZYtLGgV1cSbwdqdmEevDWTr925yYF4nVaMpyh/25SpCpK7OSr7zlmpRsS60J9Un 2i+BrEpe5QGvoWaydou/puRbmA3chSYdb3C/eMiFfSf4Tz6nx/g85PXUNF7mcAHA fCHpgcEruT+h48MtTlTd24dHax8R+0MpwLz961h7CK2zpZZ9AONJYmIr0oUBrUd+ f8oaVTGdgguISFAuAiEOAbVrFzSU7fOAPfQ9ebQS60VRMMEAVs/g+Hee7EESD+DN BBHl8SLJc+FUd3l45zvvJ1G6GP2wg== From: Christian Borntraeger To: qemu-devel , Cornelia Huck Cc: qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , qemu-stable@nongnu.org Subject: [PATCH] s390x/kvm: clamp stsi 3.2.2 size Date: Mon, 22 Jun 2026 11:20:35 +0200 Message-ID: <20260622092035.400959-1-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: mP1WVK6LfXFtCv7ClVBnJ13D2kAQl0um X-Proofpoint-Spam-Info: AW1haW4tMjYwNjIyMDA5MSBTYWx0ZWRfX2swHsqFXoTGG drNL1XHQMOCg7bnNZm+ZqtHxE8AWMfJz+yRtFVz+ZYRY4MTnCGud6XlD7/z3K8DW7Av+fn+mOUl b8bQ8XdyakBfTC3go9LF33MTlGEwK0I= X-Authority-Analysis: v=2.4 cv=c62bhx9l c=1 sm=1 tr=0 ts=6a38fe6f cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=FelO9ux0wxsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=69wJf7TsAAAA:8 a=VnNF1IyMAAAA:8 a=Sg5gpWOPNxpWzqQs3-0A:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjIyMDA5MSBTYWx0ZWRfXwZ3ph/fB/Hbn CBIwWQ9eNwwzDA/zwQa1sgNtjtTZ0PPL0QftrqUWIOVUiCgJPn4FQg3eIxeI5SiORCO6phJZafN 4JqFOfkPb7Dk6oHUo6rr/orJnCe+9oIBVuf4CRb/SLIV2VyAA3JjmSRmsX9MUCNA8/7uK9HZg17 gTem1AXRzP+VmIDDb3w2/rANImUOJu4f0L/qIXDcyfuQ0jtU3CQdgGXChTUYfc6XjfAYt4T/Dm4 P3oOb4os6wXxP6RCOWHA+YA6eHXlYN/fIWGDVbvrU4WSGgGeJDPB2JlWU3V/ugpb5+eKH/51epn bAZjkYuboqFfjLZxaPiLSzl+blweR1PR5C8SRcqCBOP/kp4waKujR/0RrFe5AI5LYb9RjWJz2pT b6yiYdtOj5XJMf63tGFhBf9IfYaMqkG00oKGeOQA8MKK39QI6HK+wvi+YBQzVDDJY37TODZLuVp rMu2GpCNHsZQnkEWh8Q== X-Proofpoint-ORIG-GUID: mP1WVK6LfXFtCv7ClVBnJ13D2kAQl0um X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-22_01,2026-06-18_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 impostorscore=0 adultscore=0 clxscore=1015 suspectscore=0 priorityscore=1501 phishscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606220091 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1782120091318158500 Content-Type: text/plain; charset="utf-8" The stsi 3.2.2 page is being prepared by the kvm module and the size is clamped by the kernel. As the memory is mapped in the guest, another guest VCPU could race and overwrite the count and messing up the move operation. For any out of bound count, fall back to the kernel buffer. Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger Reviewed-by: Eric Farman --- target/s390x/kvm/kvm.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index ed8cd6b410..a3835573bb 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -1791,6 +1791,15 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 ad= dr, uint8_t ar) } else if (s390_cpu_virt_mem_read(cpu, addr, ar, &sysib, sizeof(sysib)= )) { return; } + + /* + * The memory was filled by the kernel but mapped into the guest. + * If something is fishy, do not touch the buffer. + */ + if (sysib.count =3D=3D 0 || sysib.count > ARRAY_SIZE(sysib.ext_names))= { + return; + } + /* Shift the stack of Extended Names to prepare for our own data */ memmove(&sysib.ext_names[1], &sysib.ext_names[0], sizeof(sysib.ext_names[0]) * (sysib.count - 1)); --=20 2.53.0