[PATCH v6 1/5] s390/sclp: Make parsing of received event buffers more robust

[Alexander Egorenkov <egorenar@linux.ibm.com>]

Ensure that
* an event buffer does not cross the end boundary of the SCCB buffer it is
  part of
* the total length of an event buffer is not smaller than the size of
  its header

Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
---
 drivers/s390/char/sclp.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index 98e334724a62..7be4acec9d6e 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -532,8 +532,7 @@ EXPORT_SYMBOL(sclp_add_request);
 
 /* Dispatch events found in request buffer to registered listeners. Return 0
  * if all events were dispatched, non-zero otherwise. */
-static int
-sclp_dispatch_evbufs(struct sccb_header *sccb)
+static int sclp_dispatch_evbufs(struct sccb_header *sccb)
 {
 	unsigned long flags;
 	struct evbuf_header *evbuf;
@@ -544,11 +543,13 @@ sclp_dispatch_evbufs(struct sccb_header *sccb)
 
 	spin_lock_irqsave(&sclp_lock, flags);
 	rc = 0;
-	for (offset = sizeof(struct sccb_header); offset < sccb->length;
+	for (offset = sizeof(struct sccb_header);
+	     offset < sccb->length && (sccb->length - offset >= sizeof(struct evbuf_header));
 	     offset += evbuf->length) {
 		evbuf = (struct evbuf_header *) ((addr_t) sccb + offset);
 		/* Check for malformed hardware response */
-		if (evbuf->length == 0)
+		if (evbuf->length < sizeof(*evbuf) ||
+		    offset + evbuf->length > sccb->length)
 			break;
 		/* Search for event handler */
 		reg = NULL;
-- 
2.53.0