@samitouri / QOSamiQemu / commits / a57e4612b6

s390x/kvm: clamp stsi 3.2.2 size

The stsi 3.2.2 page is being prepared by the kvm module and the size is clamped by the kernel. As the memory is mapped in the guest, another guest VCPU could race and overwrite the count and messing up the move operation. For any out of bound count, fall back to the kernel buffer. Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Message-ID: <20260622092035.400959-1-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>

Christian Borntraeger committed Jun 22, 2026 at 11:20 UTC a57e4612b61da20ddab196502c76b4dc05da1de8
1 file changed +9
target/s390x/kvm/kvm.c
+9
@@ -1765,6 +1765,15 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 addr, uint8_t ar)
1765 } else if (s390_cpu_virt_mem_read(cpu, addr, ar, &sysib, sizeof(sysib))) {
1766 return;
1767 }
1768 +
1769 + /*
1770 + * The memory was filled by the kernel but mapped into the guest.
1771 + * If something is fishy, do not touch the buffer.
1772 + */
1773 + if (sysib.count == 0 || sysib.count > ARRAY_SIZE(sysib.ext_names)) {
1774 + return;
1775 + }
1776 +
1777 /* Shift the stack of Extended Names to prepare for our own data */
1778 memmove(&sysib.ext_names[1], &sysib.ext_names[0],
1779 sizeof(sysib.ext_names[0]) * (sysib.count - 1));