From: Christian Borntraeger <borntraeger@de.ibm.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: KVM <kvm@vger.kernel.org>, Cornelia Huck <cohuck@redhat.com>,
Christian Borntraeger <borntraeger@de.ibm.com>,
linux-s390 <linux-s390@vger.kernel.org>,
Janosch Frank <frankja@linux.vnet.ibm.com>,
David Hildenbrand <david@redhat.com>,
Thomas Huth <thuth@redhat.com>
Subject: [PULL 05/12] s390x: sclp: fix error handling for oversize control blocks
Date: Fri, 31 Jan 2020 16:02:00 +0100 [thread overview]
Message-ID: <20200131150207.73127-6-borntraeger@de.ibm.com> (raw)
In-Reply-To: <20200131150207.73127-1-borntraeger@de.ibm.com>
From: Janosch Frank <frankja@linux.ibm.com>
Requests over 4k are not a spec exception.
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Message-Id: <1569591203-15258-4-git-send-email-imbrenda@linux.ibm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
---
hw/s390x/sclp.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 73244c938b10..abb6e5011f9c 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -213,8 +213,7 @@ int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code)
cpu_physical_memory_read(sccb, &work_sccb, sccb_len);
/* Valid sccb sizes */
- if (be16_to_cpu(work_sccb.h.length) < sizeof(SCCBHeader) ||
- be16_to_cpu(work_sccb.h.length) > SCCB_SIZE) {
+ if (be16_to_cpu(work_sccb.h.length) < sizeof(SCCBHeader)) {
r = -PGM_SPECIFICATION;
goto out;
}
--
2.21.0
next prev parent reply other threads:[~2020-01-31 15:02 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-31 15:01 [PULL 00/12] s390x qemu updates 20190930 Christian Borntraeger
2020-01-31 15:01 ` [PULL 01/12] MAINTAINERS: Update S390 PCI Maintainer Christian Borntraeger
2020-01-31 15:01 ` [PULL 02/12] s390: PCI: fix IOMMU region init Christian Borntraeger
2020-01-31 15:01 ` [PULL 03/12] s390x: sclp: refactor invalid command check Christian Borntraeger
2020-01-31 15:01 ` [PULL 04/12] s390x: sclp: boundary check Christian Borntraeger
2020-01-31 15:02 ` Christian Borntraeger [this message]
2020-01-31 15:02 ` [PULL 06/12] s390x: sclp: Report insufficient SCCB length Christian Borntraeger
2020-01-31 15:02 ` [PULL 07/12] configure: Remove s390 (31-bit mode) from the list of supported CPUs Christian Borntraeger
2020-01-31 15:02 ` [PULL 08/12] kvm: extract kvm_log_clear_one_slot Christian Borntraeger
2020-01-31 15:02 ` [PULL 09/12] kvm: clear dirty bitmaps from all overlapping memslots Christian Borntraeger
2020-01-31 15:02 ` [PULL 10/12] kvm: split too big memory section on several memslots Christian Borntraeger
2020-01-31 15:02 ` [PULL 11/12] s390: do not call memory_region_allocate_system_memory() multiple times Christian Borntraeger
2020-01-31 15:02 ` [PULL 12/12] s390/kvm: split kvm mem slots at 4TB Christian Borntraeger
2020-01-31 15:03 ` [PULL 00/12] s390x qemu updates 20190930 Christian Borntraeger
-- strict thread matches above, loose matches on Subject: below --
2019-09-30 13:19 Christian Borntraeger
2019-09-30 13:19 ` [PULL 05/12] s390x: sclp: fix error handling for oversize control blocks Christian Borntraeger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200131150207.73127-6-borntraeger@de.ibm.com \
--to=borntraeger@de.ibm.com \
--cc=cohuck@redhat.com \
--cc=david@redhat.com \
--cc=frankja@linux.vnet.ibm.com \
--cc=kvm@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).