From d7937e341b9798e7283a17d2ca4955c5b56338dc Mon Sep 17 00:00:00 2001 From: Collin Walling Date: Tue, 15 Sep 2020 15:44:10 -0400 Subject: [PATCH 2/8] s390/sclp: rework sclp boundary checks Rework the SCLP boundary check to account for different SCLP commands (eventually) allowing different boundary sizes. Signed-off-by: Collin Walling Reviewed-by: Cornelia Huck Reviewed-by: Thomas Huth Acked-by: Janosch Frank Reviewed-by: Claudio Imbrenda Message-Id: <20200915194416.107460-3-walling@linux.ibm.com> Signed-off-by: Cornelia Huck (backported from commit: db13387ca01a69d870cc16dd232375c2603596f2) Signed-off-by: Collin Walling --- hw/s390x/sclp.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index 1f3eaec0a1..4069080dd0 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -33,6 +33,18 @@ static inline SCLPDevice *get_sclp_device(void) return sclp; } +static bool sccb_verify_boundary(uint64_t sccb_addr, uint16_t sccb_len) +{ + uint64_t sccb_max_addr = sccb_addr + sccb_len - 1; + uint64_t sccb_boundary = (sccb_addr & PAGE_MASK) + PAGE_SIZE; + + if (sccb_max_addr < sccb_boundary) { + return true; + } + + return false; +} + static void prepare_cpu_entries(MachineState *ms, CPUEntry *entry, int *count) { uint8_t features[SCCB_CPU_FEATURE_LEN] = { 0 }; @@ -245,7 +257,7 @@ int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code) goto out_write; } - if ((sccb + be16_to_cpu(work_sccb.h.length)) > ((sccb & PAGE_MASK) + PAGE_SIZE)) { + if (!sccb_verify_boundary(sccb, be16_to_cpu(work_sccb.h.length))) { work_sccb.h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION); goto out_write; } -- 2.25.1