s390x/sclp: reject invalid write event data headers
If a guest submits an sccb with a tiny header length but a large number of event mask entries, the write_event_mask handler will 1. return the wrong RC (ok instead of error) 2. write to memory after the allocated sccb in qemu host memory. Add the necessary checks. Cc: qemu-stable@nongnu.org Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Message-ID: <20260707070728.147203-2-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Christian Borntraeger committed
Jul 7, 2026 at 09:07 UTC
d88cd8f5570f4d6e08d62e098a8b7f53cdc75536
1 file changed
+6
hw/s390x/event-facility.c
+6
@@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB *sccb)
286
static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb)
287
{
288
WriteEventMask *we_mask = (WriteEventMask *) sccb;
289
+ uint16_t sccb_length = be16_to_cpu(sccb->h.length);
290
uint16_t mask_length = be16_to_cpu(we_mask->mask_length);
291
sccb_mask_t tmp_mask;
292
@@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb)
295
return;
296
}
297
298
+ if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) {
299
+ sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
300
+ return;
301
+ }
302
+
303
/*
304
* Note: We currently only support masks up to 8 byte length;
305
* the remainder is filled up with zeroes. Older Linux