Re: [PATCH v5 3/4] s390/sclp_ocf: Fix computation of length of GDS values

[Peter Oberparleiter <oberpar@linux.ibm.com>]

On 17.09.2026 08:58, Alexander Egorenkov wrote:
> There is a potential invalid read memory access while extracting
> the HMC network and the CPC name from event buffers sent by OCF.
> 
> Both, the HMC network and the CPC name, are sent as a GDS subvector.
> A value stored in the length field of the header of a GDS (sub)vector
> includes not only the size of a GDS value but also the size of the GDS
> header. Therefore, to obtain the size of the GDS value only, the size of
> the GDS header must be first subtracted from the total GDS (sub)vector
> length.
> 
> If the length of the HMC network or the CPC name is less than 6,
> then the total length of the GDS subvector carrying it will be less than 8
> (length of value plus 2 bytes for GDS subvector header). In that case
> the memcpy() call in sclp_ocf_handler() will read extra 2 bytes following
> the GDS subvector.

Completely subjective comment that you can safely ignore, but this could
be shortened to something like:

Fix length calculation for HMC-network and CPC names in OCF event data
by excluding the GDS subvector header size. This prevents a potential
invalid read access beyond the available GDS name data.

> Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>

Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>

-- 
Peter Oberparleiter
Linux on IBM Z Development - IBM Germany R&D