Re: [PATCH] s390/mm: Add missing vm_start <= addr check to do_secure_storage_access()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing !mm check in do_secure_storage_access allows kernel threads faulting on user-space accesses to trigger a NULL pointer dereference.
--

--- Patch [1]: [PATCH] s390/mm: Add missing vm_start <= addr check to do_secure_storage_access() ---
commit 925b56344e2c328b11b68034f7f630693a6c6b31
Author: Heiko Carstens <hca@linux.ibm.com>

s390/mm: Add missing vm_start <= addr check to do_secure_storage_access()

This patch converts do_secure_storage_access() to use lock_mm_and_find_vma() 
to ensure the faulting address is properly checked against the VMA boundaries.

Link: https://lore.kernel.org/all/20260717093904.E4A421F00A3E@smtp.kernel.org/

> diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
> index 028aeb9c48d6f..d6c58d78edc5a 100644
> --- a/arch/s390/mm/fault.c
> +++ b/arch/s390/mm/fault.c
> @@ -456,10 +456,9 @@ void do_secure_storage_access(struct pt_regs *regs)
>  		if (faulthandler_disabled())
>  			return handle_fault_error_nolock(regs, 0);
>  		mm = current->mm;
> -		mmap_read_lock(mm);
> -		vma = find_vma(mm, addr);
> +		vma = lock_mm_and_find_vma(mm, addr, regs);

[Severity: High]
This is a pre-existing issue, but does this lack of a NULL check on mm lead 
to a crash if a kernel thread faults on a user-space access?

When a kernel thread (which has current->mm == NULL) triggers a secure
storage access exception (for instance, via a copy_from_user() mapped to a
secure page), it enters this branch. The mm pointer is set to NULL and then
passed to lock_mm_and_find_vma():

vma = lock_mm_and_find_vma(mm, addr, regs);

Inside lock_mm_and_find_vma(), it unconditionally calls mmap_read_lock(mm):

mm/mmap_lock.c:lock_mm_and_find_vma() {
        ...
        mmap_read_lock(mm);
        ...
}

Could this result in a NULL pointer dereference? The do_page_fault() path
handles this gracefully with an explicit !mm check and exception fixups, but
do_secure_storage_access() appears to be missing this check.

>  		if (!vma)
> -			return handle_fault_error(regs, SEGV_MAPERR);
> +			return handle_fault_error_nolock(regs, SEGV_MAPERR);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717131407.855327-1-hca@linux.ibm.com?part=1