diff options
| author | Janosch Frank <frankja@linux.ibm.com> | 2019-09-27 15:33:21 +0200 |
|---|---|---|
| committer | Christian Borntraeger <borntraeger@de.ibm.com> | 2019-09-30 13:51:50 +0200 |
| commit | 6f6c9333efaf43d5a6f435266444aa2c51ac11b2 (patch) | |
| tree | bcbdd6347b1b03bda62496fe7b4a663b90987d0e /hw/s390x | |
| parent | 679b844756e4eaa1b94bb82f52ec9f999dc4f851 (diff) | |
| download | qemu-6f6c9333efaf43d5a6f435266444aa2c51ac11b2.zip qemu-6f6c9333efaf43d5a6f435266444aa2c51ac11b2.tar.gz qemu-6f6c9333efaf43d5a6f435266444aa2c51ac11b2.tar.bz2 | |
s390x: sclp: boundary check
All sclp codes need to be checked for page boundary violations.
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Message-Id: <1569591203-15258-3-git-send-email-imbrenda@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Diffstat (limited to 'hw/s390x')
| -rw-r--r-- | hw/s390x/sclp.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index 95ebfe7..73244c9 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -234,6 +234,11 @@ int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code) goto out_write; } + if ((sccb + be16_to_cpu(work_sccb.h.length)) > ((sccb & PAGE_MASK) + PAGE_SIZE)) { + work_sccb.h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION); + goto out_write; + } + sclp_c->execute(sclp, &work_sccb, code); out_write: cpu_physical_memory_write(sccb, &work_sccb, |