[PATCH] s390/mm: Add missing vm_start <= addr check to do_secure_storage_access()

[PATCH] s390/mm: Add missing vm_start <= addr check to do_secure_storage_access()

[Heiko Carstens]

do_secure_storage_access() uses find_vma() without verifying that the
faulting address is within the returned vma. Add this missing check by
converting to lock_mm_and_find_vma().

This is not a critical fix, since the worst that could happen is
WARN_ON_ONCE() in folio_walk_start().

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260717093904.E4A421F00A3E@smtp.kernel.org/
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/mm/fault.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 028aeb9c48d6..d6c58d78edc5 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -456,10 +456,9 @@ void do_secure_storage_access(struct pt_regs *regs)
 		if (faulthandler_disabled())
 			return handle_fault_error_nolock(regs, 0);
 		mm = current->mm;
-		mmap_read_lock(mm);
-		vma = find_vma(mm, addr);
+		vma = lock_mm_and_find_vma(mm, addr, regs);
 		if (!vma)
-			return handle_fault_error(regs, SEGV_MAPERR);
+			return handle_fault_error_nolock(regs, SEGV_MAPERR);
 		folio = folio_walk_start(&fw, vma, addr, 0);
 		if (!folio) {
 			mmap_read_unlock(mm);
-- 
2.53.0

Re: [PATCH] s390/mm: Add missing vm_start <= addr check to do_secure_storage_access()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing !mm check in do_secure_storage_access allows kernel threads faulting on user-space accesses to trigger a NULL pointer dereference.
--

--- Patch [1]: [PATCH] s390/mm: Add missing vm_start <= addr check to do_secure_storage_access() ---
commit 925b56344e2c328b11b68034f7f630693a6c6b31
Author: Heiko Carstens <hca@linux.ibm.com>

s390/mm: Add missing vm_start <= addr check to do_secure_storage_access()

This patch converts do_secure_storage_access() to use lock_mm_and_find_vma() 
to ensure the faulting address is properly checked against the VMA boundaries.

Link: https://lore.kernel.org/all/20260717093904.E4A421F00A3E@smtp.kernel.org/

> diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
> index 028aeb9c48d6f..d6c58d78edc5a 100644
> --- a/arch/s390/mm/fault.c
> +++ b/arch/s390/mm/fault.c
> @@ -456,10 +456,9 @@ void do_secure_storage_access(struct pt_regs *regs)
>  		if (faulthandler_disabled())
>  			return handle_fault_error_nolock(regs, 0);
>  		mm = current->mm;
> -		mmap_read_lock(mm);
> -		vma = find_vma(mm, addr);
> +		vma = lock_mm_and_find_vma(mm, addr, regs);

[Severity: High]
This is a pre-existing issue, but does this lack of a NULL check on mm lead 
to a crash if a kernel thread faults on a user-space access?

When a kernel thread (which has current->mm == NULL) triggers a secure
storage access exception (for instance, via a copy_from_user() mapped to a
secure page), it enters this branch. The mm pointer is set to NULL and then
passed to lock_mm_and_find_vma():

vma = lock_mm_and_find_vma(mm, addr, regs);

Inside lock_mm_and_find_vma(), it unconditionally calls mmap_read_lock(mm):

mm/mmap_lock.c:lock_mm_and_find_vma() {
        ...
        mmap_read_lock(mm);
        ...
}

Could this result in a NULL pointer dereference? The do_page_fault() path
handles this gracefully with an explicit !mm check and exception fixups, but
do_secure_storage_access() appears to be missing this check.

>  		if (!vma)
> -			return handle_fault_error(regs, SEGV_MAPERR);
> +			return handle_fault_error_nolock(regs, SEGV_MAPERR);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717131407.855327-1-hca@linux.ibm.com?part=1