From nobody Mon Sep 28 02:05:47 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1785153168; cv=none; d=zohomail.com; s=zohoarc; b=Spn2EIxhi9ULmya740nXeBthTE1tzX2cKdLtx8MNZHxaQJRrAdM/dyU+AQgR6Ed/SyDu6dWbhw5q9kWSj4lxa5C2NBWRhNTRlbpkSMAg3qayzIwIF4bS1kzq0GTPcuuyphx3IPLxLs6qrwAN5wl2/3OOKIXDk9f5Ib5s3t0iiUc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785153168; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Yv1VW1giWluFfcs0T+1cYIFBlcFRoUOf0MrCLZR6ruk=; b=cEtRgnIPC29KSSPfZjKKsxm+2J5ifNZKtbEaZfAH1jxMO38WR4CxB4QRrlFkqA4z/KmxUR5xGWT3PNcKFaebLmK7eIzp59hntITnyb1ZKRV2VnmX+l6SkBWXRhpmIbAb9XkEZegG/Cl4ixTXrf7dRNh0tlELQ0OE8e0b+Yq32/8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785153168504867.4247157454109; Mon, 27 Jul 2026 04:52:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woJrk-0004zz-Fk; Mon, 27 Jul 2026 07:51:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJrP-0004wB-AH; Mon, 27 Jul 2026 07:51:09 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJrN-0003ae-Mg; Mon, 27 Jul 2026 07:51:07 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66RAIRAT061215; Mon, 27 Jul 2026 11:51:01 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuyc7sf0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:01 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66RBfQf5016292; Mon, 27 Jul 2026 11:51:00 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fn9pg510m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:00 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (smtpav03.dal12v.mail.ibm.com [10.241.53.102]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66RBoxcT2425344 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Jul 2026 11:50:59 GMT Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A866458063; Mon, 27 Jul 2026 11:50:59 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 14D6458056; Mon, 27 Jul 2026 11:50:57 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav03.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 27 Jul 2026 11:50:56 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Yv1VW1giWluFfcs0T +1cYIFBlcFRoUOf0MrCLZR6ruk=; b=JCfEXzuh0kNV9nVkv1UvhW9kEE6sDgyxV 6/eutDabCVi0nTNPKtF4RmQKk+ZQYtgxPI87EloERPUmihsjyB2kR9XZOSXhqq9T Gte8CGV2OgxGf4ilSoY5BKoFr+FsYCYA+yB89I4lg/r8491QCxK1grczgb6YRHom BgNP0qbgdf8ouFpOgGHUedrPj9AusBwqR50ebAYEjdDnsiEnn4nIR2acWt4BPtzd k/ZNgX5IwQLGBuJyO8NFF94mZ/RAP9At3wUU0+RIrDeY2E5IjIApGr4G3prcmL8Y /l9HJI/jDfpklaW87+QBM0bLLo1wvNgoAdBiH5zs0Gl9KYNwTSb6A== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , Joshua Daley , Paolo Bonzini , Jared Rossi , Zhuoying Cai , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH 1/5] hw/char/sclpconsole-lm: avoid guest triggerable assert Date: Mon, 27 Jul 2026 13:50:48 +0200 Message-ID: <20260727115052.24289-2-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260727115052.24289-1-borntraeger@linux.ibm.com> References: <20260727115052.24289-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: _y8OI0Y4ymTTiBftnTJJ6o1OLMwy7Iiu X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfX8qYngBzY7dsd 5BdYfaHImgj6ktjJPEzfv9dVg5LcTFA5b+LgrDlHDH+p9sqa2VF4+J+PrQAWAX4vNoTJZN5Sikf jcBv1Cugc5/gdSOFj0PMnrlkzxnbybTliKuCzVJlsWNHY8LZQwUMAMV6bA1WogOrk/nmk8JAe/Y mMrPlxJpQQQJnWSbSmSLPSoDWTSOIbJKEaCRe9+EepYaep46taqqTjXi9cZV6txyvrk04c/AYiM fZd1YmeRwhZF142+QP7WAvZrJLgul9opw+dsEx3NyoMOEET5UJBpHppsA0wC1CGahfoWTgHZRSR rPksotxpbynlW4KH4qlOXR5m8mhkkqpzCXioZPRARb590+G6ZTgZs7dKvXYBmlsk4gqGfyNqfL1 1wvOZqdnATR0s+LL93bsA9ZO8qUn8IErB4YNHMyNkqr+t/hHZ+N25Zj68MgOtiwpdAb88uRjv2E uSaC+pxde6wSoEGCSGw== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfX65uIIBhcaXIu WDP/noh3MbktpXVGspmqXjFFlRAyTmjscCvZZFpCiikkOpqJK8JehEd3ks2pP6Qca6VQV20CTwC NHYoeNSG/g9u/KZ4H1MiKtezGmVsNrA= X-Authority-Analysis: v=2.4 cv=AZeB2XXG c=1 sm=1 tr=0 ts=6a674625 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=g1diX7UtM1YA1248a64A:9 X-Proofpoint-GUID: _y8OI0Y4ymTTiBftnTJJ6o1OLMwy7Iiu X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-27_03,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 priorityscore=1501 phishscore=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607270116 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=borntraeger@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1785153168659158500 Content-Type: text/plain; charset="utf-8" If a guest uses incorrect message length it can trigger an assert in process_mbd which kills the guest instead of reporting an error. Fix this by adding the correct length check. Fixes: 6a444f8507 ("s390/sclplmconsole: Add support for SCLP line-mode cons= ole") Signed-off-by: Christian Borntraeger Reviewed-by: Eric Farman Reviewed-by: Matthew Rosato --- hw/char/sclpconsole-lm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c index 9a16896d22..f6ed282f1b 100644 --- a/hw/char/sclpconsole-lm.c +++ b/hw/char/sclpconsole-lm.c @@ -243,7 +243,8 @@ static int write_event_data(SCLPEvent *event, EventBuff= erHeader *ebh) SCLPConsoleLM *scon =3D SCLPLM_CONSOLE(event); =20 len =3D be16_to_cpu(data->mdb.header.length); - if (len < sizeof(data->mdb.header)) { + if (len < sizeof(data->mdb.header) || + len > be16_to_cpu(data->header.length) - sizeof(EventBufferHeader)= ) { return SCLP_RC_INCONSISTENT_LENGTHS; } len -=3D sizeof(data->mdb.header); --=20 2.53.0 From nobody Mon Sep 28 02:05:47 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1785153184; cv=none; d=zohomail.com; s=zohoarc; b=a8dbfNcouQLb2lN+sh++ws8BGqGpawJOX8732pAOzfzHTQK2GgIgnD4jwOfu6wkZ1rMxiaKu+/1OQIxp6diJaIF3vjdcz8jfHg1pyxunF9BVO29EtOoZB8QMeB0LNMab68HJjukEISxbcKMuvYkekjd9khMe2JzCbOVj9jW8jj8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785153184; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=cinOn7EZUswlo4m4ESBe3xqFp5wap0QF3wBx+OjvrGI=; b=U8tY+e7vsOOMkhM7zQS/w7x6QWKge/xKCx7/IKGJUrfqyXSdpRN+MdNHnB0zeaec8WPGg5KhOifLw0Mt3ShofXHynv1iulOduiPFUJiYT6e/bPm4huurR4iLR6tRy95pHNyyhuw8vsrGFowAkBvc39djZCKhmktmhQoutUtg+A0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785153184532196.6728754987272; Mon, 27 Jul 2026 04:53:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woJrk-0004zt-4P; Mon, 27 Jul 2026 07:51:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJrU-0004wn-2J; Mon, 27 Jul 2026 07:51:14 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJrR-0003bY-Kw; Mon, 27 Jul 2026 07:51:11 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66RAIRon1921906; Mon, 27 Jul 2026 11:51:05 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuw77t5y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:05 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66RBfJhL016262; Mon, 27 Jul 2026 11:51:04 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fn9pg510x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:04 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (smtpav03.dal12v.mail.ibm.com [10.241.53.102]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66RBp2HJ31523480 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Jul 2026 11:51:02 GMT Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 87E305803F; Mon, 27 Jul 2026 11:51:02 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EA3CD58056; Mon, 27 Jul 2026 11:50:59 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav03.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 27 Jul 2026 11:50:59 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=cinOn7EZUswlo4m4E SBe3xqFp5wap0QF3wBx+OjvrGI=; b=sTa19WlvyAqVDrzYBs82M0xqpNpo1GSR8 oXD4D6o3ZfEyJkAkQ5xNZ3L4TdV+tizRM28NDY3520dOCSdLb96glnLFAy1m7c2y Ez29ElygV00oD7UjhobupywobV8yHv+g8xlJPhfloa8fwNz4g8pkfn0XCY35zCJ2 zYcmPvmRvYZPz7Df7uRW4ziwu+CIVmpWMv/dobyskXyuI1R5Ett6YyH0KV4gnQ2M m1vdhO0zAMNua8rbad8rIdS34GPMSgXVygfLRoG3BlZguIqS2pgJud4hYkhc4RwO qoicNGyPjwQPfOh0K/NPNqRpLcObsN0U9Rqr6MhXN7+YmHgLpRfyw== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , Joshua Daley , Paolo Bonzini , Jared Rossi , Zhuoying Cai , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH 2/5] s390x/ipl: validate num_comp against iplb length before iterating Date: Mon, 27 Jul 2026 13:50:49 +0200 Message-ID: <20260727115052.24289-3-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260727115052.24289-1-borntraeger@linux.ibm.com> References: <20260727115052.24289-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 7krlJ-0RR7aSYbWViqpd66Hih9cmGFow X-Proofpoint-ORIG-GUID: 7krlJ-0RR7aSYbWViqpd66Hih9cmGFow X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfXyOyOIC7K//E4 jLUvQiTPqWdlWGbU+zbe2KAb6TTcJM7J25H1C0dQBRnt0nqAXopZQTStUPRTDZlM++g5IwkFhZU wsw4l45F9wCw5ZQrym4X59AlVoflklKnnN74w3u6vnpGP74M25rB1uEkcSlxeCKjFkBVkGwQZYy osircfqsZT7fdMkisosRhf/fo+mJFrLOemyces2Wv7S/B+lMdMvWInA6pl/yzKyZB0dPhdHrAxO rqiEDA308dFXUbPowfIrhs93qNnfkRJZYGgEhV50D6zbrxJeb5GjIiRZWEXS0/o96NIrYtscPTr EzXTRr9RnEkP//T4gjnaqVgDz5hG60sPHsTQkU5oh29Xgia7uRJFpBCJ74PX8OD7xR48Mx7DbgS uDJDkuyd6PEWgKcJOR+JN9yAdBkPwE4jJDG1SJe+0v2u+LAN+Xx6JFRWgFl598p2DJ0x4vTpYBY DllaY9PRRuabFEg3ttw== X-Authority-Analysis: v=2.4 cv=SKFykuvH c=1 sm=1 tr=0 ts=6a674629 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=--xg8yz4SgT6yQT1UFEA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfXzUAS4Suk2KcY VwK8Qliw3ifypgUupez12auWVgth7hR7TQEnSQX25hM/Gsqa8jqspB2upxMFmOLdbfmAuiOYTxY 67OlP2WRGmpqZ0FDReWYHUWY9fhQ9Fk= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-27_03,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607270116 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=borntraeger@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1785153184767158500 Content-Type: text/plain; charset="utf-8" From: Joshua Daley In ipl_valid_pv_components(), the upper bound of the for loop, ipib_pv->num_comp, is read from guest memory. Before iterating, verify that its value will not cause a read beyond the end of the IplParameterBlock. Fixes: c3347ed0d2ee42a7 ("s390x: protvirt: Support unpack facility") Signed-off-by: Joshua Daley Reviewed-by: Christian Borntraeger Reviewed-by: Eric Farman Reviewed-by: Matthew Rosato --- hw/s390x/ipl.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index fac30763df..ef9c063d90 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -124,6 +124,12 @@ static inline bool ipl_valid_pv_components(IplParamete= rBlock *iplb) return false; } =20 + if (offsetof(IplParameterBlock, pv.components) + + ipib_pv->num_comp * sizeof(IPLBlockPVComp) > + be32_to_cpu(iplb->len)) { + return false; + } + for (i =3D 0; i < ipib_pv->num_comp; i++) { /* Addr must be 4k aligned */ if (ipib_pv->components[i].addr & ~TARGET_PAGE_MASK) { --=20 2.53.0 From nobody Mon Sep 28 02:05:47 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1785153130; cv=none; d=zohomail.com; s=zohoarc; b=m3+AbvMSb4XUAmlDQbE5kwFMc2Xu11FsatoZAs/iRz4Fvr+SC4uFOoHqO9cmsnco+GRHafcaaBWDTwcoZ8LwoDig9Z+EMgaB7jgRmfvwkPn/cWI9pDqmrvFRZvlBEY38fyAkIKN3SD8LMxrXchy5dqjF5iNR9ePEu3+e7x8r5Fc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785153130; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=V/28EiZE6z19dCHIw2j/qKd+LNXHAt5Ltm+KpalEMOA=; b=hWy5Zhfz+PR+DQQPUPCqjhgfs79SdTX+jqU5bXSg38XwN6IQWkBi7pIPKK50dgVk93Z2muW94pADv98IixMJlLIjCNxv3UlCnRSEvc31vRRj9V0E+cAmtVHkiEtBADF6YR4CGlODfpwwWv58+URBL516nJawBqwJdgwTlJQS6To= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785153130790754.8913423535671; Mon, 27 Jul 2026 04:52:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woJrm-00052X-Su; Mon, 27 Jul 2026 07:51:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJrX-0004xA-86; Mon, 27 Jul 2026 07:51:20 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJrU-0003bq-LN; Mon, 27 Jul 2026 07:51:14 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66RAIYZW1956044; Mon, 27 Jul 2026 11:51:09 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmv0xft3w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:08 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66RBfNIr007068; Mon, 27 Jul 2026 11:51:08 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fna5xvxkb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:07 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (smtpav03.dal12v.mail.ibm.com [10.241.53.102]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66RBp5sK52560198 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Jul 2026 11:51:05 GMT Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8A32C5803F; Mon, 27 Jul 2026 11:51:05 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C95B558056; Mon, 27 Jul 2026 11:51:02 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav03.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 27 Jul 2026 11:51:02 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=V/28EiZE6z19dCHIw 2j/qKd+LNXHAt5Ltm+KpalEMOA=; b=S5VOTJtvL9GWjQv9tbv+qrX8+UzmJ9Ops yGA5tryMUcKZnmHBx4xcecQ5J4xwua5cPCVy6sWYYoWlfhxNJCWWLM1l89QOG4nF ER6G3Rdd0VmpqFMpzYqSG9KvtT54PbcX9s83HLbxEQ+WaJxhVjsGFVYyhU0GNcsG MEQUe5XNf5P3CBvQuERsPnfXLSAPejxAV/G1CacLRaqGrJz5F9yYir6X4Lg3VY2C 81J/dCpuporMHDwO262FnTdo/TpiErfbk4V7BdI0XXVNMdj7fFJrn+as4nw8BYvV DsJ3Imfdusj+9xmiDcixUj3ssky8fi3rumF9yzqVyD62aWVFxLo8Q== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , Joshua Daley , Paolo Bonzini , Jared Rossi , Zhuoying Cai , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Christian Borntraeger Subject: [PATCH 3/5] pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size() Date: Mon, 27 Jul 2026 13:50:50 +0200 Message-ID: <20260727115052.24289-4-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260727115052.24289-1-borntraeger@linux.ibm.com> References: <20260727115052.24289-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: XdjniAPU2_-qWApazUZjTFi6-mxTU2HX X-Proofpoint-ORIG-GUID: XdjniAPU2_-qWApazUZjTFi6-mxTU2HX X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfXy3b7d8e3YjcO N5rc3g0doaWIs5mRdqXjaazlSDm30nZ9mvu8Y4Y75WHV0aHLsrcf/eeqkhCZN7C/XUa4svYQQiu AvC4FLN9bU6Z1Pdygur4qeh8XupRqpc= X-Authority-Analysis: v=2.4 cv=dYuwG3Xe c=1 sm=1 tr=0 ts=6a67462c cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=V9O40ZNVcsgYW_DuhdMA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfX6C6rLLObqoFm KpN9/1ltMEc0yRZvEjIXs8Vb4EU+9xrvLWTFrOk8gxOSaQrXLwRE01l5wwwtSlQ58ojmqXPz9DM e81nIssGQM0KaC0Wi3GbrhD7ywJqR3RFc/B4voqzyEpE5gaR5YVLspIvcEiLdvDBmx0BI/SxkKt s8geU83DCK9GdpXf2DvqExbL0bLsa2pGHXGWTmlxg/i0uVZBwBjjIJrSOdSQofoh5tyJeyqmYZk BA5bmuPKQDGViuWT/OOKt8Aw4EvemqofT2y07fzbEZPhSqrvcbyM5daVUKd3LhfUuCmMjJFNBee 5vsr861+p67tg0DYy+eA76oULBrIDAF717rAlNRMQNCeOy57mqDL/nU2yYge73nPRcHhcnb8qN6 OYis09D5MqMZrSgsjCbhrA7RS/EXj17avSrykR34RT9y4M8Vek0Y/tJbChq8Q3rtcDMkE/Y6kPw 00dD76JiDJqWYbEiv/Q== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-27_03,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 clxscore=1015 phishscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607270116 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=borntraeger@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1785153132593158500 Content-Type: text/plain; charset="utf-8" From: Joshua Daley In the dir_rem[level] =3D=3D 0 case, level is decremented, then a virtio_read() is issued on sec_loc[level]. If level is -1, then the 4 bytes before the static sec_loc array are read, and the virtio_read() is issued on that garbage block number. Guard the call to virtio_read() against the value of level to prevent this. Fixes: 869648e87eeb ("pc-bios/s390-ccw: El Torito 16-bit boot image size fi= eld workaround") Signed-off-by: Joshua Daley Reviewed-by: Christian Borntraeger Reviewed-by: Eric Farman Reviewed-by: Matthew Rosato --- pc-bios/s390-ccw/bootmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index 420ee32eff..ed6e8cbbc7 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -902,7 +902,7 @@ static inline long iso_get_file_size(uint32_t load_rba) if (dir_rem[level] =3D=3D 0) { /* Nothing remaining */ level--; - if (virtio_read(sec_loc[level], temp)) { + if (level >=3D 0 && virtio_read(sec_loc[level], temp)) { puts("Failed to read ISO directory"); return -EIO; } --=20 2.53.0 From nobody Mon Sep 28 02:05:47 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1785153131; cv=none; d=zohomail.com; s=zohoarc; b=lsc17llEfnnNXUrXtCYPOy5PxCW2BolETKlC6VQMP2igFsqZeiI6hu9bFQzsaBlX+6taoCGcTwYQP6mfCZ7BNK9PHIHZIbi9CuMVxm7aX/EKKLbijs8/0P3IUJOcDqM08G27X9XwrvEUSaJrsnoxUJBP7uE4daPcK0qnDD//y6M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785153131; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pO114JuJig7GPSmaekx2bsmKmz9EMCnMJdi1KUVBtxk=; b=eAvk48i19hlJibBY/4r3WDU71Vl5CKA1N8z9rCBSVpFnaMUPsFKBdpo/ViVHCtaLbaYPPNEBhIgHhF4hh/26ZKGK79jmZpRUcoSPnhZJlmnkt4lq5Z0Ngp8y8lmVNMUimzhbMscs1uJ/Y93r145ycZopQGovrm5VqILzVrEwIxI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785153131469603.5438445653606; Mon, 27 Jul 2026 04:52:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woJrn-00053w-DF; Mon, 27 Jul 2026 07:51:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJrX-0004x6-7w; Mon, 27 Jul 2026 07:51:20 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJrV-0003c4-Co; Mon, 27 Jul 2026 07:51:14 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66RAImln1844841; Mon, 27 Jul 2026 11:51:10 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuyhycxb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:10 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66RBfIbJ016254; Mon, 27 Jul 2026 11:51:09 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fn9pg511b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:09 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (smtpav03.dal12v.mail.ibm.com [10.241.53.102]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66RBp86R20316896 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Jul 2026 11:51:08 GMT Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 606055805A; Mon, 27 Jul 2026 11:51:08 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CB95958056; Mon, 27 Jul 2026 11:51:05 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav03.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 27 Jul 2026 11:51:05 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=pO114JuJig7GPSmae kx2bsmKmz9EMCnMJdi1KUVBtxk=; b=sSR2RYmmjBQFfAX88PeV9TW9v5okRlfer tGvxKW6qgreUgQg8FbxkLW0dQmSm1LTqiJnCLCAngH1L6fKCiAgfdJ0Q8hXR1+kG TCqtrcz1GY39MsGteHydFa2X+nyKbwhaDY/t/xlwWN+22rvStg5+gS6pcfuXSanT FiGoXmHH47KZL90388NZMj4hUJ43LVzQmUta5oyWu/XITdh9ogrw3JLf+N5Pj0Sl QtsSmqWws3VL8q1gb7y/Easnur9cwO0HoS8TOJsAF+niHOu7R0jNKOONv254rFm9 WcgfwPTIGzCt911mEkKqo7oSn5860vwVaPqICuf+p7bus4aBO5qnw== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , Joshua Daley , Paolo Bonzini , Jared Rossi , Zhuoying Cai , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH 4/5] pc-bios/s390-ccw: bounds-check zipl menu entry index before array write Date: Mon, 27 Jul 2026 13:50:51 +0200 Message-ID: <20260727115052.24289-5-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260727115052.24289-1-borntraeger@linux.ibm.com> References: <20260727115052.24289-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfXyhNqmpu3xGtB 8Vf4PuApjypT1fnGn7cTe2Ie9gEWPKF58XBRoE6UpegkkOzT7U1Eg5z+NePxNVFeEOKc78AmMFt +txnDFw6ekocmIWPK4xvT92sKyVoubA= X-Proofpoint-GUID: IGuIm0YIDJkj0I2SLX0RjrjeOlzQDr0_ X-Proofpoint-ORIG-GUID: IGuIm0YIDJkj0I2SLX0RjrjeOlzQDr0_ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfXzIgmz2ciDFcs UDepXUfLJ2zLGbNzssFHZvv/fyoZf4dKz7Hd5oWs4YDR6aXMeYgztKn2eeJb3Fi0mHore374or/ fcNOepyL2ngJOODJ1JYFCh/wpGfRtVTuPfq9JHCdLqvlnp+i063qsr8zo0bS3HSwAe4xWONsoxZ 7z1Zr+ppn/p9HYFgz2aC0HZhj2VTupVnSggVhSD/mc0eYWj9XUkNJDuCmyiSaz0tvF/ROLq4Aen eH08GFmUTfYrO97WkZx6tH1IIxx9KCccry3VUTomGnOGlIkRjCEmnoCsjJhHpznxl0l7xoeDxWG guepA7NsTgPQ0Jlk+D6sSYTcv0PCFB1Rey/A3ki8659zF0ORTt2gK92PrLsLlSDO1QhU4GSdMil NtI7sbJd0ONMnMrXzdpjVAGAKMcl/jAHpJ9gkYH6Y5P6cFiVB3fmLD0UarNLFuigVriRyX/eSB7 NH56H4/6t294HIQzTcg== X-Authority-Analysis: v=2.4 cv=X5Vi7mTe c=1 sm=1 tr=0 ts=6a67462e cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=K1TfFEnDoUzuEk3QFlUA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-27_03,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 phishscore=0 priorityscore=1501 malwarescore=0 spamscore=0 suspectscore=0 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607270116 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1785153132617158500 Content-Type: text/plain; charset="utf-8" From: Joshua Daley menu_get_zipl_boot_index() iterates NUL-separated strings from the zipl stage-2 boot-menu block, passes each to zipl_print_entry() which converts EBCDIC to ASCII and returns atoi(), then writes true into valid_entries[entry]. valid_entries is a MAX_BOOT_ENTRIES element stack array, but entry was never bounds-checked, so a crafted on-disk value could index arbitrarily beyond the array. Fix this in two places: - zipl_print_entry() now validates that the first significant character (after an optional leading space) is a digit. Entries that fail this check return -1 without printing. - menu_get_zipl_boot_index() skips any entry whose index is outside [0, MAX_BOOT_ENTRIES) before writing to valid_entries[]. Fixes: 7385e947fc65 ("pc-bios/s390-ccw: fix non-sequential boot entries (ec= kd)") Signed-off-by: Joshua Daley Reviewed-by: Eric Farman Reviewed-by: Matthew Rosato --- pc-bios/s390-ccw/menu.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/pc-bios/s390-ccw/menu.c b/pc-bios/s390-ccw/menu.c index eeaff78f87..b6a9a56d46 100644 --- a/pc-bios/s390-ccw/menu.c +++ b/pc-bios/s390-ccw/menu.c @@ -176,18 +176,24 @@ int menu_get_boot_index(bool *valid_entries) return boot_index; } =20 -/* Returns the entry number that was printed */ +/* Returns the entry number that was printed, or -1 on invalid entry */ static int zipl_print_entry(const char *data, size_t len) { char buf[len + 2]; + const char *p; =20 ebcdic_to_ascii(data, buf, len); buf[len] =3D '\n'; buf[len + 1] =3D '\0'; =20 + p =3D (buf[0] =3D=3D ' ') ? buf + 1 : buf; + if (!isdigit((unsigned char)*p)) { + return -1; + } + printf("%s", buf); =20 - return buf[0] =3D=3D ' ' ? atoi(buf + 1) : atoi(buf); + return atoi(p); } =20 int menu_get_zipl_boot_index(const char *menu_data) @@ -216,6 +222,9 @@ int menu_get_zipl_boot_index(const char *menu_data) entry =3D zipl_print_entry(menu_data, len); menu_data +=3D len + 1; =20 + if (entry < 0 || entry >=3D MAX_BOOT_ENTRIES) { + continue; + } valid_entries[entry] =3D true; =20 if (entry =3D=3D 0) { --=20 2.53.0 From nobody Mon Sep 28 02:05:47 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1785153129; cv=none; d=zohomail.com; s=zohoarc; b=acrz04Eft5nHTA/Vvu4dIdkRGYhqY8yQMs1niWacBXecJt6I+TCAytlAuBuexUpxqtBuFX1nQkOXKyXPcPITDdtsl2/4Tc9jARZFoXaBQb8rOwMa8zkK9k+sbh5Q3TAYC0nyzcxg0RNgiV6e9D3G+b9j8tB20AjfcsIswTMw51M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785153129; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zCCqF9QkeF7m5UQsNya4VUGxJR0nDrFUU2qwq7p3eSo=; b=GnO8HI5+QyL5J7lg+sCrHOntQUxAlvmiNWUhVSl/4zokfDSaXE/Q8WyKaYorpaHz3dAuXQVshbj8OWQMtOqyR8/dz0MWqi3PQIgMsouWT19Tl78VFl6dt3rtvJXgpkVEfPqOmEWSaYMAPVD7s4bLqwGRyZi7WfwVjup0VMLOeRg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785153129394575.9493806983251; Mon, 27 Jul 2026 04:52:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1woJrk-000508-TF; Mon, 27 Jul 2026 07:51:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJra-0004xN-5g; Mon, 27 Jul 2026 07:51:20 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1woJrY-0003cW-E7; Mon, 27 Jul 2026 07:51:17 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66RAIbgK1960009; Mon, 27 Jul 2026 11:51:13 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuwcqdbq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:13 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66RBfMx6005889; Mon, 27 Jul 2026 11:51:12 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fn8yh551x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 11:51:12 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (smtpav03.dal12v.mail.ibm.com [10.241.53.102]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66RBpB9A18022942 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Jul 2026 11:51:11 GMT Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 34EEF5803F; Mon, 27 Jul 2026 11:51:11 +0000 (GMT) Received: from smtpav03.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A15C158064; Mon, 27 Jul 2026 11:51:08 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav03.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 27 Jul 2026 11:51:08 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zCCqF9QkeF7m5UQsN ya4VUGxJR0nDrFUU2qwq7p3eSo=; b=cUpc/3x+aDiG/HvEl6DRLhC49l6NQiA7w bnVECX2JDo7dZ7A0RqYvlpLM1UXnANlDb4PgW5hCkO6XnrcQT2rUQij/955KT1// UEFGeP62/qe+ySAuCDPY3K0x30/KA6JMj6LoF7QT6ksO1PslEo6KpRGgxK2bx3Sa ctwboDuR7c8uITbNQGdR06V09CpFid8uGs4wDqmH7S4b71rc1hrX1XH/K2GaDb+E zpV12oe+rIEnm73n2AWp0OMggR3fQyM+J7yUEaOI0SZzCfQlr7VT1k29GXK1hJIb G/AQNdmhB5gBvT4GwoGI+nJaS9U8a8/ZSCHhonXAILsZvs3ShJJiw== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , Joshua Daley , Paolo Bonzini , Jared Rossi , Zhuoying Cai , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH 5/5] pc-bios/s390-ccw: bound zipl menu strlen and replace VLA in zipl_print_entry Date: Mon, 27 Jul 2026 13:50:52 +0200 Message-ID: <20260727115052.24289-6-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260727115052.24289-1-borntraeger@linux.ibm.com> References: <20260727115052.24289-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: tbqra_HqRr4Wq6XzxM1vD5Ab-sOQP1bF X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfX9171Q8V2LSYS 90BuQ/fwXi7nKbCxZAnyusfEXIZ1WDPtmIv8F8uzNRqXhi1uV1sKX+ApMfKmri66k6vYbF675Fg 34Ia/Pyr1lNLzWCxFXNLqosEYkGsVHk= X-Authority-Analysis: v=2.4 cv=E/z9Y6dl c=1 sm=1 tr=0 ts=6a674631 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=OmDNG2-DsvkCiAtxb_cA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI3MDExNiBTYWx0ZWRfXy2RBPrMuq7eX YeATD1XWcMKm/jcfLRy6cAEdY+aoD4xrPFpOSLfyTbXwfOZ32yR7C++HfnE9SFq114LVUmMaEBz kdnlHFeG3ETixijPQT8aM5cAsaDTHHWSvDwOnYJjq/i7b761cxGFzsU0RyJzdkeJ835oPKz4+Ov BmK/S4DrAZ8cTeFkt6GpqSFR5Fec4CXQMBZm1leLeusY72vRWZ6amRJt3dx2//jBFMlh3WOfei6 Xl5mAuVq6E9WMqbWRV3hcs7s3s7OzQ8V8Fyc0UISy5Vp1U70pSUEN1iWSF5uL5BUTA/bI8CXwpU Dh5pdE9qHFA7gYBPKX0X++2UbtFt8UCvgjr8VB9fX4PoplET9hjHr3SrFNKyGUKziEnd6X8MXFs EEBHt6uW3r3tq9ilKCaoZyy/YKJfi0VVohgrpx5ziv5jch09K2n4vEwQdWSpdjOwSWn4C1pFc1X I1ez9+K9cu7Mq9ELY5A== X-Proofpoint-GUID: tbqra_HqRr4Wq6XzxM1vD5Ab-sOQP1bF X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-27_03,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 phishscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 impostorscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607270116 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1785153130512158500 Content-Type: text/plain; charset="utf-8" From: Joshua Daley menu_get_zipl_boot_index() calls strlen() on a pointer into the middle of _s2 with no upper bound, so a stage-2 image whose blocks contain no NUL bytes causes strlen() to walk beyond _s2. The resulting length is then used to size a stack VLA in zipl_print_entry(), risking a stack overflow. Fix by: - Implementing strnlen(), a bounded version of strlen(). - Adding a menu_data_end parameter to menu_get_zipl_boot_index() and replacing both strlen() calls with strnlen() bounded by the remaining buffer space. The loop guard also checks that the pointer has not reached menu_data_end. For robustness, the function returns 0 (boot default) if somehow menu_data is initially >=3D menu_data_end. - Replacing the VLA char buf[len + 2] in zipl_print_entry() with a fixed ZIPL_ENTRY_MAX + 2 (82-byte) buffer and truncating len before use. - Passing s2_end (_s2 + sizeof(_s2)) as menu_data_end at the one call site in eckd_get_boot_menu_index(), so the bound is exactly the end of the buffer. Fixes: f7178910845a ("s390-ccw: print zipl boot menu") Signed-off-by: Joshua Daley Reviewed-by: Eric Farman --- pc-bios/s390-ccw/bootmap.c | 4 +++- pc-bios/s390-ccw/helper.h | 10 ++++++++++ pc-bios/s390-ccw/menu.c | 23 ++++++++++++++++++----- pc-bios/s390-ccw/s390-ccw.h | 2 +- 4 files changed, 32 insertions(+), 7 deletions(-) diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c index ed6e8cbbc7..81512265ce 100644 --- a/pc-bios/s390-ccw/bootmap.c +++ b/pc-bios/s390-ccw/bootmap.c @@ -61,6 +61,7 @@ static uint8_t _s2[MAX_SECTOR_SIZE * 3] __attribute__((__= aligned__(PAGE_SIZE))); static void *s2_prev_blk =3D _s2; static void *s2_cur_blk =3D _s2 + MAX_SECTOR_SIZE; static void *s2_next_blk =3D _s2 + MAX_SECTOR_SIZE * 2; +static void *s2_end =3D _s2 + sizeof(_s2); =20 static inline int verify_boot_info(BootInfo *bip) { @@ -308,7 +309,8 @@ static int eckd_get_boot_menu_index(block_number_t s1b_= block_nr) } } =20 - return menu_get_zipl_boot_index(s2_cur_blk + banner_offset); + return menu_get_zipl_boot_index(s2_cur_blk + banner_offset, + s2_end); } =20 prev_block_nr =3D cur_block_nr; diff --git a/pc-bios/s390-ccw/helper.h b/pc-bios/s390-ccw/helper.h index 8e3dfcb6d6..d9b7da444a 100644 --- a/pc-bios/s390-ccw/helper.h +++ b/pc-bios/s390-ccw/helper.h @@ -45,4 +45,14 @@ static inline void sleep(unsigned int seconds) } } =20 +static inline size_t strnlen(const char *s, size_t maxlen) +{ + size_t len =3D 0; + + while (len < maxlen && s[len]) { + len++; + } + return len; +} + #endif diff --git a/pc-bios/s390-ccw/menu.c b/pc-bios/s390-ccw/menu.c index b6a9a56d46..af96a83de9 100644 --- a/pc-bios/s390-ccw/menu.c +++ b/pc-bios/s390-ccw/menu.c @@ -16,6 +16,7 @@ #include "s390-ccw.h" #include "sclp.h" #include "s390-time.h" +#include "helper.h" =20 #define KEYCODE_NO_INP '\0' #define KEYCODE_ESCAPE '\033' @@ -26,6 +27,9 @@ #define ZIPL_TIMEOUT_OFFSET 138 #define ZIPL_FLAG_OFFSET 140 =20 +/* Max printable chars for a zipl boot menu entry */ +#define ZIPL_ENTRY_MAX 80 + #define TOD_CLOCK_MILLISECOND 0x3e8000 =20 #define LOW_CORE_EXTERNAL_INT_ADDR 0x86 @@ -179,9 +183,13 @@ int menu_get_boot_index(bool *valid_entries) /* Returns the entry number that was printed, or -1 on invalid entry */ static int zipl_print_entry(const char *data, size_t len) { - char buf[len + 2]; + char buf[ZIPL_ENTRY_MAX + 2]; const char *p; =20 + if (len > ZIPL_ENTRY_MAX) { + len =3D ZIPL_ENTRY_MAX; + } + ebcdic_to_ascii(data, buf, len); buf[len] =3D '\n'; buf[len + 1] =3D '\0'; @@ -196,7 +204,7 @@ static int zipl_print_entry(const char *data, size_t le= n) return atoi(p); } =20 -int menu_get_zipl_boot_index(const char *menu_data) +int menu_get_zipl_boot_index(const char *menu_data, const char *menu_data_= end) { size_t len; int entry; @@ -212,13 +220,18 @@ int menu_get_zipl_boot_index(const char *menu_data) timeout =3D zipl_timeout * 1000; } =20 + if (menu_data >=3D menu_data_end) { + return 0; + } + /* Print banner */ puts("s390-ccw zIPL Boot Menu\n"); - menu_data +=3D strlen(menu_data) + 1; + len =3D strnlen(menu_data, menu_data_end - menu_data); + menu_data +=3D len + 1; =20 /* Print entries */ - while (*menu_data) { - len =3D strlen(menu_data); + while (menu_data < menu_data_end && *menu_data) { + len =3D strnlen(menu_data, menu_data_end - menu_data); entry =3D zipl_print_entry(menu_data, len); menu_data +=3D len + 1; =20 diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h index 1e1f71775e..f6030a6071 100644 --- a/pc-bios/s390-ccw/s390-ccw.h +++ b/pc-bios/s390-ccw/s390-ccw.h @@ -76,7 +76,7 @@ void jump_to_low_kernel(void); =20 /* menu.c */ void menu_set_parms(uint8_t boot_menu_flag, uint32_t boot_menu_timeout); -int menu_get_zipl_boot_index(const char *menu_data); +int menu_get_zipl_boot_index(const char *menu_data, const char *menu_data_= end); bool menu_is_enabled_zipl(void); int menu_get_enum_boot_index(bool *valid_entries); bool menu_is_enabled_enum(void); --=20 2.53.0