[Stable-11.1.1 16/42] hw/char/sclpconsole-lm: avoid guest triggerable assert

From: Christian Borntraeger <[email protected]>

If a guest uses incorrect message length it can trigger an assert in
process_mdb which kills the guest instead of reporting an error.  Fix
this by adding the correct length check.

Fixes: 6a444f8507 ("s390/sclplmconsole: Add support for SCLP line-mode console")
Cc: [email protected]
Signed-off-by: Christian Borntraeger <[email protected]>
Reviewed-by: Matthew Rosato <[email protected]>
Reviewed-by: Eric Farman <[email protected]>
Link: https://lore.kernel.org/qemu-devel/[email protected]
[[email protected]: Fixed typo in commit message, added qemu-stable]
Signed-off-by: Eric Farman <[email protected]>
(cherry picked from commit 4e994ebb01442d90e97e2f94f53f61b1b0b34f62)
Signed-off-by: Michael Tokarev <[email protected]>

diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c
index 9a16896d228..f6ed282f1bc 100644
--- a/hw/char/sclpconsole-lm.c
+++ b/hw/char/sclpconsole-lm.c
@@ -243,7 +243,8 @@ static int write_event_data(SCLPEvent *event, EventBufferHeader *ebh)
     SCLPConsoleLM *scon = SCLPLM_CONSOLE(event);
 
     len = be16_to_cpu(data->mdb.header.length);
-    if (len < sizeof(data->mdb.header)) {
+    if (len < sizeof(data->mdb.header) ||
+        len > be16_to_cpu(data->header.length) - sizeof(EventBufferHeader)) {
         return SCLP_RC_INCONSISTENT_LENGTHS;
     }
     len -= sizeof(data->mdb.header);
-- 
2.47.3