hw/char/sclpconsole-lm: avoid guest triggerable assert
If a guest uses incorrect message length it can trigger an assert in process_mdb which kills the guest instead of reporting an error. Fix this by adding the correct length check. Fixes: 6a444f8507 ("s390/sclplmconsole: Add support for SCLP line-mode console") Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260727115052.24289-2-borntraeger@linux.ibm.com [farman@linux.ibm.com: Fixed typo in commit message, added qemu-stable] Signed-off-by: Eric Farman <farman@linux.ibm.com>
Christian Borntraeger committed
Jul 27, 2026 at 13:50 UTC
4e994ebb01442d90e97e2f94f53f61b1b0b34f62
1 file changed
+2
-1
hw/char/sclpconsole-lm.c
+2
-1
@@ -243,7 +243,8 @@ static int write_event_data(SCLPEvent *event, EventBufferHeader *ebh)
243
SCLPConsoleLM *scon = SCLPLM_CONSOLE(event);
244
245
len = be16_to_cpu(data->mdb.header.length);
246
- if (len < sizeof(data->mdb.header)) {
246
+ if (len < sizeof(data->mdb.header) ||
247
+ len > be16_to_cpu(data->header.length) - sizeof(EventBufferHeader)) {
248
return SCLP_RC_INCONSISTENT_LENGTHS;
249
}
250
len -= sizeof(data->mdb.header);