s390x/ipl: validate num_comp against iplb length before iterating
In ipl_valid_pv_components(), the upper bound of the for loop, ipib_pv->num_comp, is read from guest memory. Before iterating, verify that its value will not cause a read beyond the end of the IplParameterBlock. Fixes: c3347ed0d2ee42a7 ("s390x: protvirt: Support unpack facility") Cc: qemu-stable@nongnu.org Signed-off-by: Joshua Daley <jdaley@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260727115052.24289-3-borntraeger@linux.ibm.com [farman@linux.ibm.com: Added qemu-stable] Signed-off-by: Eric Farman <farman@linux.ibm.com>
Joshua Daley committed
Jul 27, 2026 at 13:50 UTC
df607fd056044e40352a43f0b4422b9a5cb015c8
1 file changed
+6
hw/s390x/ipl.h
+6
@@ -124,6 +124,12 @@ static inline bool ipl_valid_pv_components(IplParameterBlock *iplb)
124
return false;
125
}
126
127
+ if (offsetof(IplParameterBlock, pv.components) +
128
+ ipib_pv->num_comp * sizeof(IPLBlockPVComp) >
129
+ be32_to_cpu(iplb->len)) {
130
+ return false;
131
+ }
132
+
133
for (i = 0; i < ipib_pv->num_comp; i++) {
134
/* Addr must be 4k aligned */
135
if (ipib_pv->components[i].addr & ~TARGET_PAGE_MASK) {