commit 6f6c9333efaf43d5a6f435266444aa2c51ac11b2
author Janosch Frank <frankja@linux.ibm.com> Fri Sep 27 15:33:21 2019 +0200
committer Christian Borntraeger <borntraeger@de.ibm.com> Mon Sep 30 13:51:50 2019 +0200
tree bcbdd6347b1b03bda62496fe7b4a663b90987d0e
parent 679b844756e4eaa1b94bb82f52ec9f999dc4f851

s390x: sclp: boundary check

All sclp codes need to be checked for page boundary violations.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Message-Id: <1569591203-15258-3-git-send-email-imbrenda@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

hw/s390x/sclp.c

diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 95ebfe7..73244c9 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -234,6 +234,11 @@
         goto out_write;
     }
 
+    if ((sccb + be16_to_cpu(work_sccb.h.length)) > ((sccb & PAGE_MASK) + PAGE_SIZE)) {
+        work_sccb.h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION);
+        goto out_write;
+    }
+
     sclp_c->execute(sclp, &work_sccb, code);
 out_write:
     cpu_physical_memory_write(sccb, &work_sccb,