From: Eric Farman <farman@linux.ibm.com>
To: "Marc-André Lureau" <marcandre.lureau@redhat.com>, qemu-devel@nongnu.org
Cc: "Brian Cain" <brian.cain@oss.qualcomm.com>,
"Pierrick Bouvier" <pierrick.bouvier@oss.qualcomm.com>,
"Michael S. Tsirkin" <mst@redhat.com>,
"Stefano Garzarella" <sgarzare@redhat.com>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Zhao Liu" <zhao1.liu@intel.com>,
"Peter Maydell" <peter.maydell@linaro.org>,
"Philippe Mathieu-Daudé" <philmd@oss.qualcomm.com>,
qemu-arm@nongnu.org, "Ani Sinha" <anisinha@redhat.com>,
"Gerd Hoffman" <kraxel@redhat.com>,
"Fabiano Rosas" <farosas@suse.de>,
"Laurent Vivier" <lvivier@redhat.com>,
"Jared Rossi" <jrossi@linux.ibm.com>,
"Zhuoying Cai" <zycai@linux.ibm.com>,
"Christian Borntraeger" <borntraeger@linux.ibm.com>,
"Jason Herne" <jjherne@linux.ibm.com>,
"Richard Henderson" <richard.henderson@linaro.org>,
"Ilya Leoshkevich" <iii@linux.ibm.com>,
"David Hildenbrand" <david@kernel.org>,
"Halil Pasic" <pasic@linux.ibm.com>,
"Matthew Rosato" <mjrosato@linux.ibm.com>,
"Cornelia Huck" <cohuck@redhat.com>,
qemu-s390x@nongnu.org
Subject: Re: [PATCH 9/9] hw/s390x/ipl: fix short SCSI loadparm buffer over-read
Date: Tue, 8 Sep 2026 20:03:23 -0400 [thread overview]
Message-ID: <94afad6a-7d75-4e57-9e35-11215a730eed@linux.ibm.com> (raw)
In-Reply-To: <20260906-nohmp-next-v1-9-2b21e63974f3@redhat.com>
On 9/6/26 4:53 AM, Marc-André Lureau wrote:
> s390_build_iplb() initially points lp at the eight-byte CCW loadparm
> array. For SCSI devices, it can replace lp with a variable-length string
> returned by object_property_get_str().
>
> The following memcmp() still reads eight bytes. ASan reports
> buffer-overflow on value "3", when running test_scsi_loadparm
> func-s390x-boot_4k test.
>
> Check the fixed-size CCW loadparm for the 8-zero before the SCSI
> property can replace lp.
>
> Fixes: 429442e52d94 ("hw: Add "loadparm" property to scsi disk devices for booting on s390x")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
> hw/s390x/ipl.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
Reviewed-by: Eric Farman <farman@linux.ibm.com>
prev parent reply other threads:[~2026-09-09 0:04 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-06 8:53 [PATCH 0/9] Various ASAN & tests fixes Marc-André Lureau
2026-09-06 8:53 ` [PATCH 1/9] tests: fix qemu:func-hexagon-linters Marc-André Lureau
2026-09-06 22:30 ` Brian Cain
2026-09-06 8:53 ` [PATCH 2/9] tests/test_vhost_user_bridge: skip when running ASAN Marc-André Lureau
2026-09-07 12:02 ` Michael S. Tsirkin
2026-09-07 13:22 ` Marc-André Lureau
2026-09-07 13:34 ` Michael S. Tsirkin
2026-09-06 8:53 ` [PATCH 3/9] hw/misc/bcm2835_powermgt: free wdog timer on finalize Marc-André Lureau
2026-09-06 8:53 ` [PATCH 4/9] tests/launchupdate-test: correct g_auto usage Marc-André Lureau
2026-09-06 8:53 ` [PATCH 5/9] tests/launchupdate-test: correctly release qs Marc-André Lureau
2026-09-06 8:53 ` [PATCH 6/9] tests/launchupdate-test: fix fw_cfg leak Marc-André Lureau
2026-09-06 8:53 ` [PATCH 7/9] igvm: release found memory region on success Marc-André Lureau
2026-09-06 8:53 ` [PATCH 8/9] igvm: make IgvmMemoryRegion a QOM Marc-André Lureau
2026-09-06 8:53 ` [PATCH 9/9] hw/s390x/ipl: fix short SCSI loadparm buffer over-read Marc-André Lureau
2026-09-08 13:55 ` Jared Rossi
2026-09-09 0:03 ` Eric Farman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=94afad6a-7d75-4e57-9e35-11215a730eed@linux.ibm.com \
--to=farman@linux.ibm.com \
--cc=anisinha@redhat.com \
--cc=borntraeger@linux.ibm.com \
--cc=brian.cain@oss.qualcomm.com \
--cc=cohuck@redhat.com \
--cc=david@kernel.org \
--cc=farosas@suse.de \
--cc=iii@linux.ibm.com \
--cc=jjherne@linux.ibm.com \
--cc=jrossi@linux.ibm.com \
--cc=kraxel@redhat.com \
--cc=lvivier@redhat.com \
--cc=marcandre.lureau@redhat.com \
--cc=mjrosato@linux.ibm.com \
--cc=mst@redhat.com \
--cc=pasic@linux.ibm.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=philmd@oss.qualcomm.com \
--cc=pierrick.bouvier@oss.qualcomm.com \
--cc=qemu-arm@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=richard.henderson@linaro.org \
--cc=sgarzare@redhat.com \
--cc=zhao1.liu@intel.com \
--cc=zycai@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox