uefi-ref/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu.git synced 2026-08-26 22:23:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

s390x/ipl: validate num_comp against iplb length before iterating

Browse source 
In ipl_valid_pv_components(), the upper bound of the for loop,
ipib_pv->num_comp, is read from guest memory. Before iterating, verify
that its value will not cause a read beyond the end of the
IplParameterBlock.

Fixes: c3347ed0d2 ("s390x: protvirt: Support unpack facility")
Cc: qemu-stable@nongnu.org
Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260727115052.24289-3-borntraeger@linux.ibm.com
[farman@linux.ibm.com: Added qemu-stable]
Signed-off-by: Eric Farman <farman@linux.ibm.com>
(cherry picked from commit df607fd056)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Joshua Daley 2026-07-27 13:50:49 +02:00 • committed by Michael Tokarev
parent 869b11b96a
commit bde7951687
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hw/s390x/ipl.h
View file

@ -124,6 +124,12 @@ static inline bool ipl_valid_pv_components(IplParameterBlock *iplb)
return false;
}
if (offsetof(IplParameterBlock, pv.components) +
ipib_pv->num_comp * sizeof(IPLBlockPVComp) >
be32_to_cpu(iplb->len)) {
return false;
}
for (i = 0; i < ipib_pv->num_comp; i++) {
/* Addr must be 4k aligned */
if (ipib_pv->components[i].addr & ~TARGET_PAGE_MASK) {