From bde79516870ee8a2b71d34d3433f3780f10a3397 Mon Sep 17 00:00:00 2001 From: Joshua Daley Date: Mon, 27 Jul 2026 13:50:49 +0200 Subject: [PATCH] s390x/ipl: validate num_comp against iplb length before iterating In ipl_valid_pv_components(), the upper bound of the for loop, ipib_pv->num_comp, is read from guest memory. Before iterating, verify that its value will not cause a read beyond the end of the IplParameterBlock. Fixes: c3347ed0d2ee42a7 ("s390x: protvirt: Support unpack facility") Cc: qemu-stable@nongnu.org Signed-off-by: Joshua Daley Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Reviewed-by: Eric Farman Link: https://lore.kernel.org/qemu-devel/20260727115052.24289-3-borntraeger@linux.ibm.com [farman@linux.ibm.com: Added qemu-stable] Signed-off-by: Eric Farman (cherry picked from commit df607fd056044e40352a43f0b4422b9a5cb015c8) Signed-off-by: Michael Tokarev --- hw/s390x/ipl.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index 8e3882d506..1a029e0e5c 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -124,6 +124,12 @@ static inline bool ipl_valid_pv_components(IplParameterBlock *iplb) return false; } + if (offsetof(IplParameterBlock, pv.components) + + ipib_pv->num_comp * sizeof(IPLBlockPVComp) > + be32_to_cpu(iplb->len)) { + return false; + } + for (i = 0; i < ipib_pv->num_comp; i++) { /* Addr must be 4k aligned */ if (ipib_pv->components[i].addr & ~TARGET_PAGE_MASK) {