)]}'
{
  "commit": "d7913fac774706a02faef0dc1c4c19df65a5a379",
  "tree": "45a863861e89fbd10cd66635fc1620a7c23505b4",
  "parents": [
    "fe11f459f640cd08f35c21f9d403517951bfd671"
  ],
  "author": {
    "name": "Christian Borntraeger",
    "email": "borntraeger@linux.ibm.com",
    "time": "Fri Aug 14 14:58:57 2026 +0200"
  },
  "committer": {
    "name": "Eric Farman",
    "email": "farman@linux.ibm.com",
    "time": "Wed Aug 26 06:52:19 2026 -0400"
  },
  "message": "s390x/sclp: pv: only copy the original SCCB buffer\n\nWith variable length and EXTENDED_LENGTH_SCCB, some callbacks might\nchange the length field. For example read SCP info might write a new\nlength into the SCCB header. We must not use that new length for the\nbuffer copy, since the buffer was allocated with the original length.\nOnly the length field in the work SCCB is changed, to indicate the\n\"necessary\" size. Using the new length reads past the allocation, so\ntools like ASAN might detect a buffer overrun.\n\nSecure guests do not have EXTENDED_LENGTH_SCCB, and the ultravisor checks\nand sanitizes the length field, so no qemu heap contents are exposed to\nthe guest and the non pv-path already has the same header.length.\n\nFixes: 0f73c5b30b8b (\"s390x: protvirt: SCLP interpretation\")\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nReviewed-by: Matthew Rosato \u003cmjrosato@linux.ibm.com\u003e\nReviewed-by: Eric Farman \u003cfarman@linux.ibm.com\u003e\nLink: https://lore.kernel.org/qemu-devel/20260814125857.1729543-1-borntraeger@de.ibm.com\nSigned-off-by: Eric Farman \u003cfarman@linux.ibm.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3c8cb164888f222ab44908b40674da5ee2845adf",
      "old_mode": 33188,
      "old_path": "hw/s390x/sclp.c",
      "new_id": "b452f2ce54d05c21da86d55770a9f9f543fc3cf2",
      "new_mode": 33188,
      "new_path": "hw/s390x/sclp.c"
    }
  ]
}