From nobody Sun Jul 26 10:07:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783607397; cv=none; d=zohomail.com; s=zohoarc; b=DEsmUgnOdfnEO4yrE2abFt9zABL2sVC9Wk5XAvI+K+Pk6JnGmFNZumtjr/MZ3/S4F9NBdDgHOh8rKLai9T84Ta80Rgd6iddOnnIy76dnfq+3G7M16K/TuSZDO+l48KH9OrojxOR32I9BKW/YnKxFRcXcJOkxssRLJivDKLOZqSY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783607397; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DYcDtNnpeNvDzkmsM3jRXgTazJtvdn25dCb/i75fLTw=; b=UpvOWWmfUN9RIoIpbGz+0NgNO0Dx4QAXikDwLqR10pMhHOKc0oFTUgLuRu7KIQMg5zAx3RC6J+WDFSTI3Jl+8LUonbt6H3SeDsph3cJH7n7TEl/WZPe1uv6E5ECJnla5UIK6FgBIDrKZLsj3FksPAe5NMRVbDAfg7ZJMA2HNlds= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783607397649974.5124226983706; Thu, 9 Jul 2026 07:29:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1whpkh-0004gV-MA; Thu, 09 Jul 2026 10:29:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1whpkf-0004eN-0A; Thu, 09 Jul 2026 10:29:21 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1whpkd-00009t-Bl; Thu, 09 Jul 2026 10:29:20 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 669EIJxP2914112; Thu, 9 Jul 2026 14:29:15 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6sur1vec-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 09 Jul 2026 14:29:15 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 669EJbhN009803; Thu, 9 Jul 2026 14:29:14 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f7e0hndbh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 09 Jul 2026 14:29:14 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 669EScEd22741578 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 9 Jul 2026 14:28:38 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A203B5805F; Thu, 9 Jul 2026 14:29:12 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 732615805A; Thu, 9 Jul 2026 14:29:10 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Thu, 9 Jul 2026 14:29:10 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=DYcDtNnpeNvDzkmsM 3jRXgTazJtvdn25dCb/i75fLTw=; b=fkVVPxcPUFs4Z1B9v3vTd5UvPT4iBL7+Z W8UwweqLtfCU59uHpFO6FwOuBDhGowqcipZdZb1ZOdxr+01jNsdn242oUpTu1qpe 2Vey7UfN0SzmrICUg9TFgnZjFkvu/DqYojqjtMshup1D0Ok6WfyxR8bOpOen+hqE Q/kr62WXhgk+oYMYD8hGBJ8IcPeOelj5/DumycUtQL2JAn1PY+zz/mxEMGWpZDmz RODriwtDyDgR7N9N44W2itKiTZ6d8sJw7E4AAT0QLdB5Mrrn8WwqOSulBipxzpnN QIkxK4akoJ50gcU9/vSJdv1A+QI+IlRAMkmhYRWTM47XxmdrQHxaA== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , Janosch Frank , qemu-stable@nongnu.org Subject: [PATCH 1/2] s390x/sclp: prevent re-reading the sclp header Date: Thu, 9 Jul 2026 16:29:05 +0200 Message-ID: <20260709142906.197474-2-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260709142906.197474-1-borntraeger@linux.ibm.com> References: <20260709142906.197474-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA5MDE0MSBTYWx0ZWRfX2enrX6IJP0jD uKaV3b1mbG+t37bTYKoCqlMDopZ2yDwDy3ahaSEd6r1ZRQ6S9Tuqd0b65f5Rzx8zXXBle15xOsd 1RgxfU3pyW21vgUGYgwobq7mPun2Zpg= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA5MDE0MSBTYWx0ZWRfX+1G+1zvR1W7o VFTE7tvBFHuHE/UG7IcELy3D4fCWtitpH5+KXZWAwNXQJ5O20LFAYqu2uogrNSZAe52hwKOxz45 C/XIfmOwB1YDx2u3k/a6ugx+XkS2JfydCQy9Dz2JD7W3bDVgwOlkZHO1l2EFINeqPkWw+ysM2II ikO/FDT5eqBu+CcWU1umtpZmxXhJq5dHJrTWb+pLnnrC5VShx8grMrsf8CdsHSwGxOBbDvoksOa yish0N72ZdL5g+EUwsPyJmqpFQtMghRtQ60/mD4pmUsLHOOk3wNyxW7RINdZXqZEx1A137RnRkZ DxDJOtsT0DFbVjXiDdk7doUFKFyEURB6HfSveG9ASW2f3qaqKevfhgAoOQjotUrk19+A0Wlp9w5 xRsjouykFrMZGYDamjF2Ck7wbAp/d99M6Ad/055Uw6CplGkrAWnbZV4XWWp9SVfp1b9uDQg4HBF v3bVMnitwPppRNKySKw== X-Proofpoint-GUID: EFTXvyH3xcyZYMLhkqm8a123i1Lx1UXL X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a4fb03b cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=69wJf7TsAAAA:8 a=VnNF1IyMAAAA:8 a=U3GCA_YXEp6Erz6r9jEA:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-ORIG-GUID: EFTXvyH3xcyZYMLhkqm8a123i1Lx1UXL X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-09_03,2026-07-09_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607090141 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=borntraeger@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783607399043158500 Content-Type: text/plain; charset="utf-8" We verify the sccb length and then allocate based on that length. The following access re-reads the sccb again. This can race against other vCPUs overwriting the length field. sclp_service_call_protected does not need a change as the ultravisor provides a consistent snapshot. Fixes: c1db53a5910f ("s390/sclp: read sccb from mem based on provided lengt= h") Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger Reviewed-by: Matthew Rosato Reviewed-by: Collin Walling Reviewed-by: Eric Farman --- hw/s390x/sclp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index 2d2cde7803..3c8cb16488 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -329,7 +329,8 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint= 32_t code) /* * we want to work on a private copy of the sccb, to prevent guests * from playing dirty tricks by modifying the memory content after - * the host has checked the values + * the host has checked the values. + * Reuse the previously fetched header */ work_sccb =3D g_malloc0(be16_to_cpu(header.length)); ret =3D address_space_read(as, sccb, attrs, @@ -337,6 +338,7 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint= 32_t code) if (ret !=3D MEMTX_OK) { return -PGM_ADDRESSING; } + work_sccb->h =3D header; =20 if (!sclp_command_code_valid(code)) { work_sccb->h.response_code =3D cpu_to_be16(SCLP_RC_INVALID_SCLP_CO= MMAND); --=20 2.53.0 From nobody Sun Jul 26 10:07:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783607396; cv=none; d=zohomail.com; s=zohoarc; b=KTVxx3b3VoxZHNh3hg9NB+nuqcfFW2ILtRgbQQHm6+IOHHOmDyZgx9UDOHouHvEPcF1ymBcbet1h/qv8uDvW1c+cfaUrvdDza6QtSYVSQcjWP/mZac5fMsQm5gcB1bnuRKSCt3z0TZOpJcphLrtYIgVvo7dsDnLmSO3MptPEgIc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783607396; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=x3AJ18j2Gu791GLdK33hU/MZSQ5eZMj/Nt1cSxjj1WU=; b=LmLzeNnzHGoO8Sg4D05NVxJ1jYSOc9iYXSpNYD2J64yj4vVKyP8Ux6tLupMats4NOxCtfxiK6GgT9MGXPP77usPcgbxMAmYU+YPibLh0SPCAQt0RAcksFIxwdViOY+Hw4JlDhQmGuHYoO21uBHFcsa1E8cCNCEVdjxcpUJf5Gz8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783607396041345.1520296147296; Thu, 9 Jul 2026 07:29:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1whpki-0004gx-JI; Thu, 09 Jul 2026 10:29:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1whpkg-0004fW-7J; Thu, 09 Jul 2026 10:29:22 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1whpke-0000A4-K9; Thu, 09 Jul 2026 10:29:21 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 669EIDDe2171228; Thu, 9 Jul 2026 14:29:17 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6sw525ec-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 09 Jul 2026 14:29:16 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 669EJaew026466; Thu, 9 Jul 2026 14:29:16 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f7eqgd9xc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 09 Jul 2026 14:29:16 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 669ETFBr28508868 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 9 Jul 2026 14:29:15 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 27EF35805C; Thu, 9 Jul 2026 14:29:15 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E3C1858051; Thu, 9 Jul 2026 14:29:12 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Thu, 9 Jul 2026 14:29:12 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=x3AJ18j2Gu791GLdK 33hU/MZSQ5eZMj/Nt1cSxjj1WU=; b=Va6GdkL1hmsO6tIH/CusDcjSBJNMJW7Eo Vq0fIT3nqh5mkeQ/H/SAHn7LliwukUNOX7w7qrFHlgg6iyZpwJCr4dca1qWK7ozg RpePEuE0HPkTnpCIWYL86jg7KB0WKYKLcoFlLEzJX2HC1HoCbfMc1AZ4mOn/FDIp Ylx0A1XIr8OxPset/SWjBmbeA6y28gYfJigtcd6pxdXbQ6/dGMg6S5z6DwgN9cXy ZI70ZQOqgINCqKW5oZJlL5S/jswD7iAmYoMbh3jB3dZ0Vkt7DWx3wG39z6jdMmZq WvaPkTRpeItx3CMbxeK1H/TQjXy+EE4zW7JA0qdz6VSwyabbI1o6w== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , Janosch Frank , qemu-stable@nongnu.org Subject: [PATCH 2/2] s390x/sclpcpi: check event length field before reading from buffer Date: Thu, 9 Jul 2026 16:29:06 +0200 Message-ID: <20260709142906.197474-3-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260709142906.197474-1-borntraeger@linux.ibm.com> References: <20260709142906.197474-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: kH4vn3WgIYkGjuGVYGFFU-i_B9Hp0AM9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA5MDE0MSBTYWx0ZWRfX4iyTxQMvasSL bK6XOgxNPdhvkif4FcQ7mi+nAq21lNrsvLtL8hDEDbxh1/UVJtBEZxt5jDYrmt0lLWR+9jwroSB YWcAecPB9foBEvrMRi3B1haXs0SCutNSW3HVH9lgu3By2WIkOVCZzcf39nBYr1qajgfbFQFaIQu bzh6Is20BfHSFfITmYmeSxRx1pHhcOI5jrOCAMPVyDqf4zVt6dni2I3+Z+owXWQ7vJJ5fnbYOfP SezwBpsNtemNDwCtMck/VgrNSfG1bzC4rRb0fFMITH09qvfoqezy2jQoLMTulwdyaM9RmTp5c5q TXysh6zfugC9boR4NuOzkQY+FkaoZWXnbBG7eJVvPXNC+4AI+Du7Qz7qqco9BFxQnMY8EDk2sT6 B63ySja4AjKS6bXsmBkjo2XPw+j0FOjNBPjsOYsLqmmPNRYEJvsUpY2lMGRPViercRnnt9s6xZ+ p56QwUQBxQ8ru6v5K2A== X-Proofpoint-ORIG-GUID: kH4vn3WgIYkGjuGVYGFFU-i_B9Hp0AM9 X-Authority-Analysis: v=2.4 cv=FqQ1OWrq c=1 sm=1 tr=0 ts=6a4fb03d cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=69wJf7TsAAAA:8 a=VnNF1IyMAAAA:8 a=LL4VAQpvL9dv9tmx0-kA:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA5MDE0MSBTYWx0ZWRfXwFI5YS/t1g/j 5MtBE3tXFch2cYzLSHEOYj9UXWNusqTCvV02vN07hLEgyMYWXPN0reJuWAcNxOPEAFLg2/kejeW LczJqfclSouNClP1wFpcVx3yHBkoSx0= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-09_03,2026-07-09_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607090141 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=borntraeger@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783607397020158500 Content-Type: text/plain; charset="utf-8" A guest might send a too short SCCB with SCLP_EVENT_CTRL_PGM_ID. QEMU would fill its data structures with garbage data. Check for the precise length of the CBI data structure and reject otherwise. Fixes: f345978f24be ("hw/s390x: add Control-Program Identification to QOM") Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger Reviewed-by: Matthew Rosato Reviewed-by: Janosch Frank Reviewed-by: Eric Farman --- hw/s390x/sclpcpi.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/s390x/sclpcpi.c b/hw/s390x/sclpcpi.c index 68fc1b809b..ec4bdf2350 100644 --- a/hw/s390x/sclpcpi.c +++ b/hw/s390x/sclpcpi.c @@ -97,6 +97,11 @@ static int write_event_data(SCLPEvent *event, EventBuffe= rHeader *evt_buf_hdr) ebh); SCLPEventCPI *e =3D SCLP_EVENT_CPI(event); =20 + /* Caller checks sccb length, buffer header checking is our duty */ + if (be16_to_cpu(evt_buf_hdr->length) !=3D sizeof(ControlProgramIdMsg))= { + return SCLP_RC_INCONSISTENT_LENGTHS; + } + ascii_put(e->system_type, (char *)cpim->data.system_type, sizeof(cpim->data.system_type)); ascii_put(e->system_name, (char *)cpim->data.system_name, --=20 2.53.0