[PATCH v7 1/5] s390/sclp: Make parsing of received event buffers more robust

[Alexander Egorenkov <egorenar@linux.ibm.com>]

Validate header fields of SCCB and event buffers to protect from potential
out-of-range memory accesses which might be caused by malformed hardware
responses.

Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
---
 drivers/s390/char/sclp.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index 98e334724a62..5a4e4001dfa8 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -532,8 +532,7 @@ EXPORT_SYMBOL(sclp_add_request);
 
 /* Dispatch events found in request buffer to registered listeners. Return 0
  * if all events were dispatched, non-zero otherwise. */
-static int
-sclp_dispatch_evbufs(struct sccb_header *sccb)
+static int sclp_dispatch_evbufs(struct sccb_header *sccb)
 {
 	unsigned long flags;
 	struct evbuf_header *evbuf;
@@ -542,14 +541,25 @@ sclp_dispatch_evbufs(struct sccb_header *sccb)
 	int offset;
 	int rc;
 
+	/* Check for malformed hardware response */
+	if (sccb->length > PAGE_SIZE)
+		return -EINVAL;
+
 	spin_lock_irqsave(&sclp_lock, flags);
 	rc = 0;
 	for (offset = sizeof(struct sccb_header); offset < sccb->length;
 	     offset += evbuf->length) {
-		evbuf = (struct evbuf_header *) ((addr_t) sccb + offset);
 		/* Check for malformed hardware response */
-		if (evbuf->length == 0)
+		if (offset + sizeof(struct evbuf_header) > sccb->length) {
+			rc = -EINVAL;
 			break;
+		}
+		evbuf = (struct evbuf_header *) ((addr_t) sccb + offset);
+		if (evbuf->length < sizeof(*evbuf) ||
+		    offset + evbuf->length > sccb->length) {
+			rc = -EINVAL;
+			break;
+		}
 		/* Search for event handler */
 		reg = NULL;
 		list_for_each(l, &sclp_reg_list) {
-- 
2.53.0