s390x/sclpcpi: check event length field before reading from buffer
A guest might send a too short SCCB with SCLP_EVENT_CTRL_PGM_ID. QEMU would fill its data structures with garbage data. Check for the precise length of the CBI data structure and reject otherwise. Fixes: f345978f24be ("hw/s390x: add Control-Program Identification to QOM") Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Message-ID: <20260709142906.197474-3-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Christian Borntraeger committed
Jul 9, 2026 at 16:29 UTC
8a116a28535c34b001e68b52f85d6be3acb75350
1 file changed
+5
hw/s390x/sclpcpi.c
+5
@@ -97,6 +97,11 @@ static int write_event_data(SCLPEvent *event, EventBufferHeader *evt_buf_hdr)
97
ebh);
98
SCLPEventCPI *e = SCLP_EVENT_CPI(event);
99
100
+ /* Caller checks sccb length, buffer header checking is our duty */
101
+ if (be16_to_cpu(evt_buf_hdr->length) != sizeof(ControlProgramIdMsg)) {
102
+ return SCLP_RC_INCONSISTENT_LENGTHS;
103
+ }
104
+
105
ascii_put(e->system_type, (char *)cpim->data.system_type,
106
sizeof(cpim->data.system_type));
107
ascii_put(e->system_name, (char *)cpim->data.system_name,