starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-07-08 17:46:10 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity

s390x/ioinst: Require strict length and format for SEI CHSC handler

Browse Source 
Ensure SEI commands that are received are of the appropriate length and
format before handling.

Cc: qemu-stable@nongnu.org
Fixes: 8cba80c3a0 ("s390: Add PCI bus support")
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Message-ID: <20260707070728.147203-5-borntraeger@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
This commit is contained in:
Matthew Rosato
2026-07-07 09:07:27 +02:00
committed by Cornelia Huck
parent b8c8ec1d75
commit 386268daea
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
target/s390x/ioinst.c
View File

@@ -609,13 +609,27 @@ static int chsc_sei_nt2_have_event(void)
#define CHSC_SEI_NT0 (1ULL << 63)
#define CHSC_SEI_NT2 (1ULL << 61)
#define CHSC_SEI_0_FMT 0x0f000000
static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
{
uint64_t selection_mask = ldq_be_p(&req->param1);
uint32_t param0 = be32_to_cpu(req->param0);
uint8_t *res_flags = (uint8_t *)res->data;
uint16_t len = be16_to_cpu(req->len);
uint16_t resp_code;
int have_event = 0;
int have_more = 0;
if (len != 0x0010) {
resp_code = 0x0003;
goto out_err;
}
if (param0 & CHSC_SEI_0_FMT) {
resp_code = 0x0007;
goto out_err;
}
/* regarding architecture nt0 can not be masked */
have_event = !chsc_sei_nt0_get_event(res);
have_more = chsc_sei_nt0_have_event();
@@ -642,6 +656,12 @@ static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
res->code = cpu_to_be16(0x0005);
res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
}
return;
out_err:
res->code = cpu_to_be16(resp_code);
res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
res->param = 0;
}
static void ioinst_handle_chsc_unimplemented(ChscResp *res)