From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783329744; cv=none; d=zohomail.com; s=zohoarc; b=cW95cA+qOgCQM40Aba9M3Zv1A/eGDnAvPMzY0PsI7FJ8/ZDYaNP5ZzdvA6Dnhq2YlNtLOom4gMKXD6k2BUEHjLT8RtMSWh5jkhuS6Jw2lbjA0PPJgSmGY97gBnl/6obpFXpM/f7cTGyK1zwgxzM5tej0HGHaZcBySt0iFcv5w7k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783329744; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=B8VoXBgb9KAwjXV1GlontgqPsYaxn5b2Lq6Xc4Hd1xE=; b=n0umXMz7TKOp8lSQkpmwTK836BP84W7O6ZDUOBILVEgm8RVNFfElS67d94zswu6eJ0RoWa/TGXsoHBv00azerdJqGKW2+jGEH5ijRzsdbaGI5YEMjFys37rLXO5PRt+QU29SsdW/pZvDyvhbrd+ifW2T5MUL7UEZ3UjtGsi+E/0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783329744527513.3947781225094; Mon, 6 Jul 2026 02:22:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgfWF-0005aL-CZ; Mon, 06 Jul 2026 05:21:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfW0-0005WN-88; Mon, 06 Jul 2026 05:21:26 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfVx-00061h-A3; Mon, 06 Jul 2026 05:21:22 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6669IG8d3133832; Mon, 6 Jul 2026 09:21:18 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsh67b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:17 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6669JdCb005484; Mon, 6 Jul 2026 09:21:17 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f7eqfvpnm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:17 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6669LFUa9634498 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 6 Jul 2026 09:21:16 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C86535805B; Mon, 6 Jul 2026 09:21:15 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5D0605805C; Mon, 6 Jul 2026 09:21:13 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 6 Jul 2026 09:21:13 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=B8VoXBgb9KAwjXV1G lontgqPsYaxn5b2Lq6Xc4Hd1xE=; b=scwu2JfyiueB54NvI6cV9MLV1I4TWysNp w4ATSUVF9bm11nF1oa1aOdk4nFuvFpmZsUCRKGggXWmPJuTf4qrBLoynPBLX8jQJ yAZw5Jkab2Gpo2nNXdDp3+TtEqZ3TZHNbtXtAsYUB+46paPTKiP9XMP0gOtZ6YBL 8/XIWJwp0KPK3zayLR27Ca2u6REEYNvhNFKA2VQ+AjN9jEP6AG11fgUj1FmRUBy1 I+AupmhTXATTMF+kDsB1aKWX4S+48ww0gxIAWqAlrG1i4Eyfpht8d38gvkKdM58H 4RpHJelEYcN6Ib0mYdOOjOhEdiaz9L9OSUD7xiTcaGkeu80GR1Sng== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , qemu-stable@nongnu.org, Hendrik Brueckner Subject: [PATCH 1/5] s390x/sclp: reject invalid write event data headers Date: Mon, 6 Jul 2026 11:19:05 +0200 Message-ID: <20260706091909.864405-2-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260706091909.864405-1-borntraeger@linux.ibm.com> References: <20260706091909.864405-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 8NXXMbMDjJ0fr-5x1a5JYxHD3-6KwQsu X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfXzwxstqGyHWRM V/jYPS3+wb0VNc4dfwa3xIR2Nd9s1dflzfvd0CiZi+C8KVUrw9Afxc+JmqvfPbLyng2QPbsWNeb b5/WtorAT/k+oOVLD/oTbLlorf3RubU= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a4b738d cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=69wJf7TsAAAA:8 a=VnNF1IyMAAAA:8 a=kbmgJ76JzREG6MJ5-XUA:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-GUID: 8NXXMbMDjJ0fr-5x1a5JYxHD3-6KwQsu X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfX/kjTffvrnnml ByZ2ikrVGCDrsoVxj7kpl1zH3Ur0RVGrlSGiIpPTIfIv+4AnOi6LOrvYrs3hLXY+AfrN66p4XJO 4/KbT19EkbJp4bKqBon6BwbLBdDWvjB9EE5PP8ZpYSNQP8aUXn00RAb+WdsYu9KGxJfOFbBUgM1 G7LEoHtajXbY3oad5xbs6b4qUCpI/3IAE8Yfczruor/WKckdw9xRp649zSbTlDCGg8TGy4KUdRa kQ1V7dHKTnr7nKFufZ39nXfkOYV4XFJqfiz904bCgA+/P0uKaaaIRORxlwn3/Lp+1cu1KJIpn1i vylELcSSpsbSixJQ/xvj7WAGXjCpFFCPZNddtE0WFRrBh2uGULPGL+pRFEhXVaX0NcYcreZ+a0O B0BWVrE4tFDn9zRWlVS1RxruTN6hk6wCuyjynCFbmEr7DVPlVjUQIc8FpivSpJLSQQTLWkDeKcZ yiBp5Hj49TaDbCII/tQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-06_01,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1011 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607060094 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783329745279158500 Content-Type: text/plain; charset="utf-8" If a guest submits an sccb with a tiny header length but a large number of event mask entries, the write_event_mask handler will 1. return the wrong RC (ok instead of error) 2. write to memory after the allocated sccb in qemu host memory. Add the necessary checks. Cc: qemu-stable@nongnu.org Reviewed-by: Hendrik Brueckner Signed-off-by: Christian Borntraeger Reviewed-by: Eric Farman Reviewed-by: Matthew Rosato Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/s390x/event-facility.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c index fee286ea63..184c469bd3 100644 --- a/hw/s390x/event-facility.c +++ b/hw/s390x/event-facility.c @@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB= *sccb) static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb) { WriteEventMask *we_mask =3D (WriteEventMask *) sccb; + uint16_t sccb_length =3D be16_to_cpu(sccb->h.length); uint16_t mask_length =3D be16_to_cpu(we_mask->mask_length); sccb_mask_t tmp_mask; =20 @@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SC= CB *sccb) return; } =20 + if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) { + sccb->h.response_code =3D cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LE= NGTH); + return; + } + /* * Note: We currently only support masks up to 8 byte length; * the remainder is filled up with zeroes. Older Linux --=20 2.53.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783329783; cv=none; d=zohomail.com; s=zohoarc; b=YyupE86roI2VRR9qP1KNdUQRotTsbstgVDqZ3A2S6MSG3drgqLejTHl3qSjA2VmNcd1itjOtvBSD6JI67qoUovRfqkUf4XZ5OySIMSLm5v8AQ6kiFIrZWnByRGJna22qT8dbAMjaJarR9ozUI46BjK6+wn+RwFgmNeRKPpIuAH4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783329783; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0v/yIu6Ab9rKiu9cil+k60ybrHOk1CXioCDN+6+85Ks=; b=UUsKtMmFtiMGQug2EKyBIDLe78SG4qr8v+3haK2zk7NwiDZUi8VMu0HmuQsVUwVvPEHhaCCFlZ22oHzx3QIKnE23nu8o+NlwbTF+NrCx6tDUvi9rkOwl+GbkmDvK5Pfl0Gjj3Y/oksTMEm8x1cMoP0YUFyHZk03WJkIQYCDGnoI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783329783561920.1764283357647; Mon, 6 Jul 2026 02:23:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgfWK-0005ex-Co; Mon, 06 Jul 2026 05:21:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfW6-0005XX-A6; Mon, 06 Jul 2026 05:21:32 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfW0-00062H-H7; Mon, 06 Jul 2026 05:21:27 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6669IV5F3134150; Mon, 6 Jul 2026 09:21:20 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsh67f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:20 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6669JhhE005757; Mon, 6 Jul 2026 09:21:19 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f7eqfvpnt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:19 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6669LIbx1376898 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 6 Jul 2026 09:21:18 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 665CD58060; Mon, 6 Jul 2026 09:21:18 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 229095805D; Mon, 6 Jul 2026 09:21:16 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 6 Jul 2026 09:21:15 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=0v/yIu6Ab9rKiu9ci l+k60ybrHOk1CXioCDN+6+85Ks=; b=MuWGqyOUjV26Z2xVXv262rv8U+MTBy0JU l1RCSHjLHckS8/QLKezvgmJRQIw1WnZ5tuslxDrd2nZhPy/RqPnSmPcYYgBl2Gd0 UtY3jGNy3fn6DNtGgoOc48kcmhZoQg5Uw8jenB+9OwqkH3FEDyDcFsEV20YaMmti FKYW2s3egx8d/TyHEfQuQJEOSwtUBi8B6jFLEytOT8N80ZvpiAOjN4tWMulUkECO 5bCdV1laS1PyQ1HDEKmOBixmnjuJX5jRTyFMHzS/ARyfQMMS12e/bIZJsqM1EiBA QeuqPb2L9VDf8bjwotWvJwcaTfggZdbyX0/BGaF/YJW5busk/NGdw== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , qemu-stable@nongnu.org Subject: [PATCH 2/5] s390x/pci: Tighten region detection for BAR read/write Date: Mon, 6 Jul 2026 11:19:06 +0200 Message-ID: <20260706091909.864405-3-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260706091909.864405-1-borntraeger@linux.ibm.com> References: <20260706091909.864405-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 9CoSatzLjg4eQl6ZZcsV82w-qP5L99BW X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfX/iztJYaVBcg3 d7GgkMJAU+T3/fcS9keqoKblsH2kGY+YM9V5lPnfLcL3uG7wGLGv7QrtTol7cP33Opgd/71yjtj 5rCVvYmCxCI2tnUFX+0IVsNzfmqQHik= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a4b7390 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=69wJf7TsAAAA:8 a=1miPxOOkSzPv5N0FEC4A:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-GUID: 9CoSatzLjg4eQl6ZZcsV82w-qP5L99BW X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfX2eWx0Pt6GpdL H7niOAYNVEh+W2Z/8kN4tx9z63U5UI3bzRnvJowMivpAaL07FnZpu6hZ2EU5FW7Ix+1FOpFWRCw pasM84AFyqkRqW4Ryzfd+mZiLARG3RxKcAqJMUk5f+Y/nERWOysTHmlyg6JHpj66O8H9E5MbQmN aOklqXqK/yxo664WtrKtjkmJSmJukoq4/nKXhOvqqbL9V4Q6XpdrjHceep8WGKgmBLZk7AgwD4u qWgOTGQREGSAnVYgFPxoiVZ7/z09Uoe9TW4/zJfTbdquCSnaiO10WMUwCccSiKjBLIeK7b+Di+s Mar9KktTRWdEql8odSrzQhCLJKfIfWT/2FqlHXZsf6LaVH61LbovYvQH0JPiJA/dgTE+cMzithE 4BgY0qhy5Xc9nmSaoSoDyCyl9DJOqMa8PRPgcQ7o3FApox3JDzzUNEactjMgdelo9RVpvggWvsV W4KluwfdTd3muTGyA8g== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-06_01,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1011 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607060094 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783329785844158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato For PCISTG/PCISTB/PCILG instruction emulation, ensure that the offset and length provided by the guest does not overflow, and only return a memory region when the specified offset+length combination matches an existing subregion or the parent region. Cc: qemu-stable@nongnu.org Fixes: 4f6482bfe3 ("s390x/pci: search for subregion inside the BARs") Reviewed-by: Christian Borntraeger Signed-off-by: Matthew Rosato Reviewed-by: Farhan Ali --- hw/s390x/s390-pci-inst.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index 10066ca618..ef20f7645e 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -392,13 +392,22 @@ static int zpci_endian_swap(uint64_t *ptr, uint8_t le= n) static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset, uint8_t len) { + uint64_t last =3D offset + len; MemoryRegion *subregion; uint64_t subregion_size; =20 + /* + * Ensure the region is valid, the calculated address cannot wrap and = that + * it falls within this region. + */ + if (!mr || offset > last || last > memory_region_size(mr)) { + return NULL; + } + QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) { subregion_size =3D memory_region_size(subregion); if ((offset >=3D subregion->addr) && - (offset + len) <=3D (subregion->addr + subregion_size)) { + (last) <=3D (subregion->addr + subregion_size)) { mr =3D subregion; break; } @@ -413,6 +422,10 @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbd= ev, uint8_t pcias, =20 mr =3D pbdev->pdev->io_regions[pcias].memory; mr =3D s390_get_subregion(mr, offset, len); + if (!mr) { + return MEMTX_ERROR; + } + offset -=3D mr->addr; return memory_region_dispatch_read(mr, offset, data, size_memop(len) | MO_BE, @@ -513,6 +526,10 @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pb= dev, uint8_t pcias, =20 mr =3D pbdev->pdev->io_regions[pcias].memory; mr =3D s390_get_subregion(mr, offset, len); + if (!mr) { + return MEMTX_ERROR; + } + offset -=3D mr->addr; return memory_region_dispatch_write(mr, offset, data, size_memop(len) | MO_BE, @@ -900,6 +917,11 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint= 8_t r3, uint64_t gaddr, =20 mr =3D pbdev->pdev->io_regions[pcias].memory; mr =3D s390_get_subregion(mr, offset, len); + if (!mr) { + s390_program_interrupt(env, PGM_OPERAND, ra); + return 0; + } + offset -=3D mr->addr; =20 for (i =3D 0; i < len; i +=3D 8) { --=20 2.53.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783329726; cv=none; d=zohomail.com; s=zohoarc; b=RKv19VlYeHRj1AdmGdlS6koG9KrRqtHcOvSSmu0seWBMsM3JtcgrvnoKsZm/MYqEVBqdx0Drx4cFlC9+2YlmrvlSJ05DAmt9YiyE4E4jdsydxoWO6ivZvx/MXfa8rMq3rngmHNt/XTJ2t5zK8L0f7Ev9zezs4aUZRTrteMYRm5U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783329726; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wU6/MMjwjB0BkBCx1IfFQAJuEoWaRUMgU9dhKWG3AUM=; b=ZvcN+rpI93TDWsXAzhTVC3M3IAobcYvjBaTACdR5JgxECLO9P1pcTInvMLbud7xH73kk29j8vpTJKOWB8WUdZ4HVfVGFDJRRj+PdJkfo2x5lpafsLMNQnZXics1aVjv1BECfFrLg+7na670q3VYpLFIojkln2xmXlZJOkOUaElQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783329726432406.062423678697; Mon, 6 Jul 2026 02:22:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgfWF-0005bZ-QB; Mon, 06 Jul 2026 05:21:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfW6-0005XY-AN; Mon, 06 Jul 2026 05:21:32 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfW2-00062m-R4; Mon, 06 Jul 2026 05:21:29 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6669IeQp3151957; Mon, 6 Jul 2026 09:21:23 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6rkdhakk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:22 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6669JaQ5023092; Mon, 6 Jul 2026 09:21:22 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f7cvvw2x4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:22 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6669LLJm15597948 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 6 Jul 2026 09:21:21 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0387C5805F; Mon, 6 Jul 2026 09:21:21 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B4F5E5805C; Mon, 6 Jul 2026 09:21:18 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 6 Jul 2026 09:21:18 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=wU6/MMjwjB0BkBCx1 IfFQAJuEoWaRUMgU9dhKWG3AUM=; b=cBO/INllvkzI3oMnLHcL/ezcOBn+/mUmy tZYjhhMRdnX8PXZxjRWRNv8N6af/ombZFpCGfG2+pQCTuEMX7bY33soe3OEPZghM Y/wGtOeS8ZSiKmtOLQOI6nzMWgiTITmHJIYA/GXY2nMgD3DTIw3S9ESFfSitNaU5 h/GfiaE2DX91atUKHR8GzYnAVAUERN+8kV8HchJJqr1RJlLvEkPweAHtAWvZo4Nx +DeXqByrumkJA2u6+CAxEtgidzgARMnJoZbQL5fUAJCnzpVlm0tkQnnK6IISLOJO DlslTDEMbuCp6J8tCsLEtZn5jpGeOaDs5Be5gVY2ibCTVXFbTsuEw== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , qemu-stable@nongnu.org Subject: [PATCH 3/5] s390x/pci: Shrink RPCIT ranges to registered window Date: Mon, 6 Jul 2026 11:19:07 +0200 Message-ID: <20260706091909.864405-4-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260706091909.864405-1-borntraeger@linux.ibm.com> References: <20260706091909.864405-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=M7J97Sws c=1 sm=1 tr=0 ts=6a4b7392 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=69wJf7TsAAAA:8 a=Ky1VarMbmfzgHUieTBwA:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfX2pasrzLcnqP2 vF+NbNMWNbSliM3p8FVIzOYL9bzI3ohW7y8kmI+RJXzrWGW/08NjQBPtwTu7G3CBKWISsDSCc6+ 5xpF/LYyn26aWrRHdLF1xaVS8up81S0wllwUZzeHKJ5J8Ax+v/E61P1JO1lZFvhiZsz/IPbDHJD LM7VpPya5qYUIt5XpQZuiTO9xJ3RmvwxIjQoc6ubTDCa4x9qnRWjb57a0wqwpRhTXgpoSPyH5YR T0oyUYMKXwCACC45OvPsB6efMqXX1yYyP3NBpLfsP0TMfCJIxREWWGF1LTQRyqsfmDlTSRHSteW D/JqRsLLPBO8typodAR7qAYIKpcXYxe+zEimW3XWEfhq+R7RtVpaygWccDJC6S+qEk8z5yA05WV DFcJEK88Z90kcOHKphSxaKT26MtUEHKKeov+UZ4zJTN7kr0iEidQKQG24iEgVHXWiN5GW6/2Nbe H4gOk4NRZulaGHQaVuA== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfX8ufeRTxpwAJk JMfjLeDjgoMLiKiVxa5lAvlBFZg7bzowqKzbkf2ojx+gEEBO25IDnLcZwRqNmvaz7xSwG1ZSB+w AjM6oDml+krsMgutE0t2LAE7gAqiDHs= X-Proofpoint-GUID: km2QphYQS93sYXzaiQORMWG4oYVSVMoU X-Proofpoint-ORIG-GUID: km2QphYQS93sYXzaiQORMWG4oYVSVMoU X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-06_01,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1011 adultscore=0 priorityscore=1501 bulkscore=0 spamscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607060094 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783329727654158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato Today, if a RPCIT instruction is presented from the guest whose range exceeds the previously-registered IOAT, QEMU will process the range so long as 1) the specified range at least partially overlaps with what was previously registered and 2) the guest has valid IOAT entries in its table. If the entries are not present (invalid), then the RPCIT will unnecessarily spend time reporting the invalid region/segment entries. Optimize this path by exiting immediately if the requested range falls completely outside of the previously-registered range or if the requested range ends before it starts (which would only occur if the guest-specified address + length would overflow a u64). Otherwise, clamp the request to only the portion of the range that overlaps with what was previously registered, effectively ignoring the portion outside of the registered range. Cc: qemu-stable@nongnu.org Fixes: 5d1abf2344 ("s390x/pci: enforce zPCI state checking") Reviewed-by: Christian Borntraeger Signed-off-by: Matthew Rosato Reviewed-by: Farhan Ali --- hw/s390x/s390-pci-inst.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index ef20f7645e..b7de23c7d2 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -770,10 +770,16 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint= 8_t r2, uintptr_t ra) goto err; } =20 - if (end < iommu->pba || start > iommu->pal) { + if (end < start || end < iommu->pba || start > iommu->pal) { error =3D ERR_EVENT_OORANGE; goto err; } + /* + * If the specified range at least partially overlaps the registered + * aperture, clamp the request to the aperture and ignore the rest. + */ + sstart =3D MAX(start, iommu->pba); + end =3D MIN(end, iommu->pal + 1); =20 retry: start =3D sstart; --=20 2.53.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783329783; cv=none; d=zohomail.com; s=zohoarc; b=eFiGIzZ6YR/mCKRqpSbJt/4izo1BeYWGQ9Rg8o/MyF8yRtH8jvLwCa2IqEPz8RSpAG5kAWXO2MK1bzCW4PGj55Ew9vVdPHU4eCzsWQRRQMrOHs1oneVygdH07yXxZsunWVx3oZhsQqokW4CJC+fOzdzFjWcGpkmMe6MJqY6Ue0U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783329783; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FbuJ2rJLVzdvqjlSI/azXZHPJJgG3my3AaOVOYwxWk8=; b=Qgm9O1/6w54jH/lhf9HiO9gSEYI8ItwR1r+z/E7utIZAfhf2XXyCmRSTc2IwjChml3vviF4jelas5NSNvlZuSEr+c6YJJxWYvg+Hvkt+exZUdfEdq04R72R7ojaKo70mY7/hjTJyfVb1ti4znhE3KRIOkVzyycEO/GiDEKouhyw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783329783290334.7821226269547; Mon, 6 Jul 2026 02:23:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgfWL-0005fb-M8; Mon, 06 Jul 2026 05:21:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfWC-0005Zs-1f; Mon, 06 Jul 2026 05:21:36 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfW6-00063K-Kq; Mon, 06 Jul 2026 05:21:33 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6669IQeD3133979; Mon, 6 Jul 2026 09:21:26 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsh67q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:26 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6669Jexd014746; Mon, 6 Jul 2026 09:21:25 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f7f6xvke6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:25 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6669KnSe48234932 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 6 Jul 2026 09:20:49 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9486D5805B; Mon, 6 Jul 2026 09:21:23 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 51D075805D; Mon, 6 Jul 2026 09:21:21 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 6 Jul 2026 09:21:21 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=FbuJ2rJLVzdvqjlSI /azXZHPJJgG3my3AaOVOYwxWk8=; b=aJd5SIlJYNewOwI/mJ4tcZwTmxpRA6F7n 1J+eqN2SekRdNW7CtpSsDK2VlJpbS6nnvzr05q67RjJg3+1jOFsLu5cg87JOFRg2 GeFMOv9nVKWZ9O+8g2M1F3m5/eqV6yJpEmiDnAnhZ2Ezb32kFYf467Zd+oyr1h7U KtQd4Th/1EQtJeTl2qe72qpEjujv0RdL2K15QZPyM5Yb74ZSmwfT9RZX75ONWCYp JoVyj7blvRbB4zfMPxWSWXzIuy/aCX0/iJD3DUZcybmrVxX2lpSuILFOAo3aMTop fPQQ8Ucs4cOj3WZUUa0lgjLV5MEnocpk1DWE8PuejbFS0jG8Zw//g== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , qemu-stable@nongnu.org Subject: [PATCH 4/5] s390x/ioinst: Require strict length and format for SEI CHSC handler Date: Mon, 6 Jul 2026 11:19:08 +0200 Message-ID: <20260706091909.864405-5-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260706091909.864405-1-borntraeger@linux.ibm.com> References: <20260706091909.864405-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: bQ0cIfI8YeKMzvBYOAK16YoFD-Fl34Wf X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfX31Woul3+hHQA SYR/REzO9UIdsiD+GXN8VFGtnx7V8k4q7ajGbjCeH/6SdnoXyca9Ex3MzgY4R6TGy5Q9EV2MVfN qHHKmU/H+xpfbGCxCuKGg3gIqXkDM2M= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a4b7396 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=69wJf7TsAAAA:8 a=VZH3qDeYady0DpGU8aQA:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-GUID: bQ0cIfI8YeKMzvBYOAK16YoFD-Fl34Wf X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfX8TZUCMTjbCSx 9sddmQEz0NyLQt2Xq+q71FcdYIjPRTjcGBAGgbVxMmB9dIpaH5h29EQUWlbRgMf9+RsYr9Pu4zG ElT+0U/nZqpbvlixTwDbqp9j1u5TdtGEO4luWH2cJYjaq5mROAqKtNMPr3A4DjODux8Q52FYpzO pqoTZFSw12w1g34Gm0Q0xLf1Xr8roQ11FvjRDfIJjaJbJ+icdxq8MHYeb7+BeQz3/VlJw9C65Lu OXCQVuU7vlYgmzcqbRFd2x2qepkGU4I7b5fINmn/U16GAP9bRzac4IIzdlswnpswMatom/W0Ac7 i0+97lpkCISlK2jArrQ473+UmPQAJT72EyfYx2ct5knPFCMrNjs4nNTjv+Tz4QxFuty9qFx304D QXwLBoLqgj8n+wWUeSPgpOFcHwgHvwFK9olfiHu4kqxyZhemGBIOCXqybmE/N+nkfC2uDd0qowc KH5vUpSe6840m4fPKkQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-06_01,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607060094 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783329785803158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato Ensure SEI commands that are received are of the appropriate length and format before handling. Cc: qemu-stable@nongnu.org Fixes: 8cba80c3a0 ("s390: Add PCI bus support") Reviewed-by: Christian Borntraeger Signed-off-by: Matthew Rosato Reviewed-by: Eric Farman Reviewed-by: Farhan Ali --- target/s390x/ioinst.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c index 2320dd4c12..94619f9215 100644 --- a/target/s390x/ioinst.c +++ b/target/s390x/ioinst.c @@ -609,13 +609,27 @@ static int chsc_sei_nt2_have_event(void) =20 #define CHSC_SEI_NT0 (1ULL << 63) #define CHSC_SEI_NT2 (1ULL << 61) +#define CHSC_SEI_0_FMT 0x0f000000 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res) { uint64_t selection_mask =3D ldq_be_p(&req->param1); + uint32_t param0 =3D be32_to_cpu(req->param0); uint8_t *res_flags =3D (uint8_t *)res->data; + uint16_t len =3D be16_to_cpu(req->len); + uint16_t resp_code; int have_event =3D 0; int have_more =3D 0; =20 + if (len !=3D 0x0010) { + resp_code =3D 0x0003; + goto out_err; + } + + if (param0 & CHSC_SEI_0_FMT) { + resp_code =3D 0x0007; + goto out_err; + } + /* regarding architecture nt0 can not be masked */ have_event =3D !chsc_sei_nt0_get_event(res); have_more =3D chsc_sei_nt0_have_event(); @@ -642,6 +656,12 @@ static void ioinst_handle_chsc_sei(ChscReq *req, ChscR= esp *res) res->code =3D cpu_to_be16(0x0005); res->len =3D cpu_to_be16(CHSC_MIN_RESP_LEN); } + return; + + out_err: + res->code =3D cpu_to_be16(resp_code); + res->len =3D cpu_to_be16(CHSC_MIN_RESP_LEN); + res->param =3D 0; } =20 static void ioinst_handle_chsc_unimplemented(ChscResp *res) --=20 2.53.0 From nobody Sun Jul 26 11:01:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783329804; cv=none; d=zohomail.com; s=zohoarc; b=Y/WmfLSxNkfAMcP/PLt0PsELgQUMlyUIpYIkOvtiiA0wfbK2GoaXEaCbxM5DHi/7MiNJMAgoDxpKYngQFIKS6V+S/6VP4A6GgZKQ+xCOXY7OKXa6T3SzdjuFiKamtORoISv3X3qcmvhNXrq3/CojLMLrr9O0J0tgfatTv7zQVes= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783329804; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=56pydjf83ON+u/iG1HDD+ibNtZnQ0adUhpl1mkJg5+Q=; b=FsewWgleDUBKKj58/FlYzNrhv9Wvqaofz4TiKVcl9ZouhOT01nf1W1npoevdHLPXRUSBJ3Bv9PQcxlfPzNifvppUecRZzSRpq9zbHJlBe6n8nrVB6oaGHZ6YRzGzQGVXR6UfWUZurXDfhVmCxmg2FzDx844EAoaf1ryoeBIxByE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783329804634246.55878841791866; Mon, 6 Jul 2026 02:23:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgfWG-0005d5-M8; Mon, 06 Jul 2026 05:21:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfWC-0005Zt-6h; Mon, 06 Jul 2026 05:21:36 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgfW7-00063z-3w; Mon, 06 Jul 2026 05:21:33 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6669J4xg3152755; Mon, 6 Jul 2026 09:21:28 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6rkdhakv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:27 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6669JcdX023101; Mon, 6 Jul 2026 09:21:27 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f7cvvw2x8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2026 09:21:27 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 6669LQNV12452352 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 6 Jul 2026 09:21:26 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3282B5805C; Mon, 6 Jul 2026 09:21:26 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E367E5805B; Mon, 6 Jul 2026 09:21:23 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 6 Jul 2026 09:21:23 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=56pydjf83ON+u/iG1 HDD+ibNtZnQ0adUhpl1mkJg5+Q=; b=qtKUr70YHczhz5UUcciyxNiJkiXOyKt+q WZDBJjywMZSO9XqmCt0v4tVBq6tXf8mLv/TUc5V65aRCQC3jp0sKH31QA9lDs8g9 uFVCMNeGZuNhYl7bh+C6jEFt9gBra3OnxiHK2oTFfKsya8WS9kGCOBccyH2llenh IKaovPy+ClPhyKsTxxpsQrUDKeKLSk5ekjClmEkztq7w55IOcrxZXUBM6yCJ+q1Y V2J/hNh546/kflB4mRi3VvJBzxkmvc4ZwvBiqQ8ZwylCmrWSMKS5m2RdaWBwuIna J6fb4PdFpGgMWIbjh2OHng9tx0TfndKkfvp7soKpqwLHWVtOhZLNQ== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , qemu-stable@nongnu.org Subject: [PATCH 5/5] s390x/css: limit number of CHPIDs in description Date: Mon, 6 Jul 2026 11:19:09 +0200 Message-ID: <20260706091909.864405-6-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260706091909.864405-1-borntraeger@linux.ibm.com> References: <20260706091909.864405-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=M7J97Sws c=1 sm=1 tr=0 ts=6a4b7397 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=69wJf7TsAAAA:8 a=taQyAogG0pZaN8zP0A4A:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfXz60ptpdJaeXW IGGlOw/kB8Vrg+wMz9vrOq0rtpq5uPMH1KKE5U19kZj5GLmt6uEIcP6HQ/blhw1zv2QHxDAYriR b52pJeboQMNMZu7NckSmgcepMAgjCKBihtC5YcoNj6I6QfwUx0J9t7Kp7U/As/e7InGthGvDeQN I8ufxEkFdE7i0+vkmhRPxcQ++zs5zlZL15Eo/tBPUj0h4eSkgCgHjTUrzFUTpypkRgj5tAKdfbn pMsxVozLqfsdvqIK9xS9Whq10KKwZdwAWANrrbXESur+8xiJtwP7bIdW2mgTHa9y5tPWgYf3Bn1 Hjobkpm/MqxGQfvOQ9dMmkEQRKQRxjuNSnJlBnLOA65zjuFr+92cE6EN0mKGobdkOp+ZLY+sPPz Wc5ieAsMk3h23clQgzNL3xlTwEAuB4du+QV6PzSyUbRAPELfDI/3YnoXx3qmB2txSPMFOILqsdQ yu+boJMpFBQO0m+PWjQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA2MDA5NCBTYWx0ZWRfX073dw7UQ6pYI NvYtDQW5AoUYHGo/2MsegHpQWabFr0dFogK2XVQACrSf3NgHtTXmkjgenbKkTegW11ZJ22MGcnN VWARsoZ4Ss66HVuvOVfJ8N0kQfQhrrU= X-Proofpoint-GUID: akebyfqCLnx1TuxhZrrHpM333PbJoVw1 X-Proofpoint-ORIG-GUID: akebyfqCLnx1TuxhZrrHpM333PbJoVw1 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-06_01,2026-07-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 adultscore=0 priorityscore=1501 bulkscore=0 spamscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607060094 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783329805523158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman virtio-ccw uses a single virtual CHPID for all devices and device-types, but vfio-ccw (passthrough) shares real CHPID information with the guest. A sufficiently large passthrough configuration would exceed the defined response payload. Fix this by limiting the number of CHPID descriptions that are returned based on the given response format. Cc: qemu-stable@nongnu.org Reviewed-by: Christian Borntraeger Signed-off-by: Eric Farman Reviewed-by: Matthew Rosato --- hw/s390x/css.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 96d5378f3c..29ba39f79e 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -1872,6 +1872,7 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_= t f_chpid, uint8_t l_chpid, int i, desc_size; uint32_t words[8]; uint32_t chpid_type_word; + uint32_t max_chpids, chpid_count =3D 0; CssImage *css; =20 if (!m && !cssid) { @@ -1882,9 +1883,25 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8= _t f_chpid, uint8_t l_chpid, if (!css) { return 0; } + + if (rfmt =3D=3D 0) { + max_chpids =3D 256; + } else if (rfmt =3D=3D 1) { + max_chpids =3D 127; + } else { + /* Should be rejected by caller */ + return 0; + } + desc_size =3D 0; for (i =3D f_chpid; i <=3D l_chpid; i++) { if (css->chpids[i].in_use) { + /* Limit number of CHPIDs sent back */ + if (chpid_count =3D=3D max_chpids) { + break; + } + + chpid_count++; chpid_type_word =3D 0x80000000 | (css->chpids[i].type << 8) | = i; if (rfmt =3D=3D 0) { words[0] =3D cpu_to_be32(chpid_type_word); --=20 2.53.0