@samitouri / QOSamiQemu / commits / a9f1e84c6b

pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size()

In the dir_rem[level] == 0 case, level is decremented, then a virtio_read() is issued on sec_loc[level]. If level is -1, then the 4 bytes before the static sec_loc array are read, and the virtio_read() is issued on that garbage block number. Guard the call to virtio_read() against the value of level to prevent this. Fixes: 869648e87eeb ("pc-bios/s390-ccw: El Torito 16-bit boot image size field workaround") Cc: qemu-stable@nongnu.org Signed-off-by: Joshua Daley <jdaley@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260727115052.24289-4-borntraeger@linux.ibm.com [farman@linux.ibm.com: Fixed typo on Christian's tag, added qemu-stable] Signed-off-by: Eric Farman <farman@linux.ibm.com>

Joshua Daley committed Jul 27, 2026 at 13:50 UTC a9f1e84c6b8213fb1bfc664b1ffa1a8d975a69b6

1 file changed +1 -1

pc-bios/s390-ccw/bootmap.c

+1 -1

@@ -902,7 +902,7 @@ static inline long iso_get_file_size(uint32_t load_rba)

902 if (dir_rem[level] == 0) {

903 /* Nothing remaining */

904 level--;

905 - if (virtio_read(sec_loc[level], temp)) {

905 + if (level >= 0 && virtio_read(sec_loc[level], temp)) {

906 puts("Failed to read ISO directory");

907 return -EIO;

908 }