diff options
| -rw-r--r-- | hw/s390x/sclp.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index 95ebfe7bd2..73244c938b 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -234,6 +234,11 @@ int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code) goto out_write; } + if ((sccb + be16_to_cpu(work_sccb.h.length)) > ((sccb & PAGE_MASK) + PAGE_SIZE)) { + work_sccb.h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION); + goto out_write; + } + sclp_c->execute(sclp, &work_sccb, code); out_write: cpu_physical_memory_write(sccb, &work_sccb, |