Commit 1b70cdf938 for qemu.org

commit 1b70cdf9387e09dbd246f8cff4991e9cab1fdeff
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sat Sep 5 01:28:20 2026 +0400

    hw/s390x/ipl: fix short SCSI loadparm buffer over-read

    s390_build_iplb() initially points lp at the eight-byte CCW loadparm
    array. For SCSI devices, it can replace lp with a variable-length string
    returned by object_property_get_str().

    The following memcmp() still reads eight bytes. ASan reports
    buffer-overflow on value "3", when running test_scsi_loadparm
    func-s390x-boot_4k test.

    Check the fixed-size CCW loadparm for the 8-zero before the SCSI
    property can replace lp.

    Fixes: 429442e52d94 ("hw: Add "loadparm" property to scsi disk devices for booting on s390x")
    Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
    Reviewed-by: Eric Farman <farman@linux.ibm.com>
    Tested-by: Gerd Hoffmann <kraxel@redhat.com>
    Acked-by: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 1add11ad7b..fe107af84d 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -570,6 +570,11 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
     if (ccw_dev) {
         lp = ccw_dev->loadparm;

+        /* If the device loadparm is empty use the global machine loadparm */
+        if (memcmp(lp, NO_LOADPARM, 8) == 0) {
+            lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
+        }
+
         switch (devtype) {
         case CCW_DEVTYPE_SCSI:
             sd = SCSI_DEVICE(dev_st);
@@ -605,11 +610,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
             break;
         }

-        /* If the device loadparm is empty use the global machine loadparm */
-        if (memcmp(lp, NO_LOADPARM, 8) == 0) {
-            lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
-        }
-
         s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
         iplb->flags |= DIAG308_FLAGS_LP_VALID;