From d88cd8f5570f4d6e08d62e098a8b7f53cdc75536 Mon Sep 17 00:00:00 2001 From: Christian Borntraeger Date: Tue, 7 Jul 2026 09:07:24 +0200 Subject: [PATCH] s390x/sclp: reject invalid write event data headers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If a guest submits an sccb with a tiny header length but a large number of event mask entries, the write_event_mask handler will 1. return the wrong RC (ok instead of error) 2. write to memory after the allocated sccb in qemu host memory. Add the necessary checks. Cc: qemu-stable@nongnu.org Reviewed-by: Hendrik Brueckner Reviewed-by: Matthew Rosato Reviewed-by: Eric Farman Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Christian Borntraeger Message-ID: <20260707070728.147203-2-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck --- hw/s390x/event-facility.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c index fee286ea63..184c469bd3 100644 --- a/hw/s390x/event-facility.c +++ b/hw/s390x/event-facility.c @@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB *sccb) static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb) { WriteEventMask *we_mask = (WriteEventMask *) sccb; + uint16_t sccb_length = be16_to_cpu(sccb->h.length); uint16_t mask_length = be16_to_cpu(we_mask->mask_length); sccb_mask_t tmp_mask; @@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb) return; } + if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) { + sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH); + return; + } + /* * Note: We currently only support masks up to 8 byte length; * the remainder is filled up with zeroes. Older Linux