s390x/ioinst: Require strict length and format for SEI CHSC handler
Ensure SEI commands that are received are of the appropriate length and format before handling. Cc: qemu-stable@nongnu.org Fixes: 8cba80c3a0 ("s390: Add PCI bus support") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Farhan Ali <alifm@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Message-ID: <20260707070728.147203-5-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Matthew Rosato committed
Jul 7, 2026 at 09:07 UTC
386268daea86e53d90baf99df5c7b8e2727ea783
1 file changed
+20
target/s390x/ioinst.c
+20
@@ -609,13 +609,27 @@ static int chsc_sei_nt2_have_event(void)
609
610
#define CHSC_SEI_NT0 (1ULL << 63)
611
#define CHSC_SEI_NT2 (1ULL << 61)
612
+#define CHSC_SEI_0_FMT 0x0f000000
613
static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
614
{
615
uint64_t selection_mask = ldq_be_p(&req->param1);
616
+ uint32_t param0 = be32_to_cpu(req->param0);
617
uint8_t *res_flags = (uint8_t *)res->data;
618
+ uint16_t len = be16_to_cpu(req->len);
619
+ uint16_t resp_code;
620
int have_event = 0;
621
int have_more = 0;
622
623
+ if (len != 0x0010) {
624
+ resp_code = 0x0003;
625
+ goto out_err;
626
+ }
627
+
628
+ if (param0 & CHSC_SEI_0_FMT) {
629
+ resp_code = 0x0007;
630
+ goto out_err;
631
+ }
632
+
633
/* regarding architecture nt0 can not be masked */
634
have_event = !chsc_sei_nt0_get_event(res);
635
have_more = chsc_sei_nt0_have_event();
@@ -642,6 +656,12 @@ static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
656
res->code = cpu_to_be16(0x0005);
657
res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
658
}
659
+ return;
660
+
661
+ out_err:
662
+ res->code = cpu_to_be16(resp_code);
663
+ res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
664
+ res->param = 0;
665
}
666
667
static void ioinst_handle_chsc_unimplemented(ChscResp *res)