[PATCH v2 0/1] Fix wrong domain value verification with EP11 cards

[PATCH v2 0/1] Fix wrong domain value verification with EP11 cards

[Harald Freudenberger]

There is a wrong upper limit check for the domain value when an EP11
CPRB is processed for sending to a crypto card. This check is only
active on custom device nodes but may lead to access heap memory
behind perms->adm when an administrative CPRB is sent.
Add correct limit (AP_DOMAINS = 256) checking to fix this.

v1: initial version
v2: Resend without any code changes, just Finn's reviewed by added.

Harald Freudenberger (1):
  s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

 drivers/s390/crypto/zcrypt_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.43.0

[PATCH v2 1/1] s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

[Harald Freudenberger]

There is a wrong upper limit check for the domain value when an EP11
CPRB is processed for sending to a crypto card. This check is only
active on custom device nodes but may lead to access heap memory
behind perms->adm when an administrative CPRB is sent.
Add correct limit (AP_DOMAINS = 256) checking to fix this.

Fixes: cfd68b33094e ("s390/zcrypt: Filter admin CPRBs on custom devices")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Cc: stable@vger.kernel.org
---
 drivers/s390/crypto/zcrypt_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index f57189c2b839..81eefdeae248 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -1077,7 +1077,7 @@ static long _zcrypt_send_ep11_cprb(u32 xflags, struct ap_perms *perms,
 	print_hex_dump_debug("ep11req: ", DUMP_PREFIX_ADDRESS, 16, 1,
 			     ap_msg.msg, ap_msg.len, false);
 
-	if (perms != &ap_perms && domain < AUTOSEL_DOM) {
+	if (perms != &ap_perms && domain < AP_DOMAINS) {
 		if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
 			if (!test_bit_inv(domain, perms->adm)) {
 				rc = -ENODEV;
-- 
2.43.0

Re: [PATCH v2 1/1] s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The administrative permission (`perms->adm`) check can be completely bypassed by supplying a domain >= AP_DOMAINS (such as AUTOSEL_DOM), allowing unauthorized administrative commands to be executed on queues where the user only has usage access.
--

--- Patch [1]: [PATCH v2 1/1] s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs ---
commit bde27d2c3d10843f1570c9d533dc3ccd2e17bf0f
Author: Harald Freudenberger <freude@linux.ibm.com>

s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

There is a wrong upper limit check for the domain value when an EP11
CPRB is processed for sending to a crypto card. This check is only
active on custom device nodes but may lead to access heap memory
behind perms->adm when an administrative CPRB is sent.

> diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
> index f57189c2b839e..81eefdeae2485 100644
> --- a/drivers/s390/crypto/zcrypt_api.c
> +++ b/drivers/s390/crypto/zcrypt_api.c
> @@ -1077,7 +1077,7 @@ static long _zcrypt_send_ep11_cprb(u32 xflags, struct ap_perms *perms,
>  	print_hex_dump_debug("ep11req: ", DUMP_PREFIX_ADDRESS, 16, 1,
>  			     ap_msg.msg, ap_msg.len, false);
>  
> -	if (perms != &ap_perms && domain < AUTOSEL_DOM) {
> +	if (perms != &ap_perms && domain < AP_DOMAINS) {

[Severity: Critical]
This is a pre-existing issue, but does this logic allow an unauthorized
administrative command to bypass the perms->adm check entirely if a user
supplies a domain value greater than or equal to AP_DOMAINS, such as
AUTOSEL_DOM (0xFFFF)?

If domain >= AP_DOMAINS, this condition evaluates to false, completely
skipping the administrative permissions check. The driver then proceeds to
autoselect a queue using zcrypt_check_queue(), which only verifies the usage
mask (perms->aqm), ignoring whether the queue is being targeted by an
administrative command.

For example, if a user issues an ioctl with an admin command and sets the
domain field to AUTOSEL_DOM, the driver bypasses the perms->adm verification.
Then, as seen in paths like zcrypt_msgtype6_send_cprb() for CCA, the
AUTOSEL_DOM value is overwritten with the selected queue's real domain ID
before dispatch, converting the bypassed command into an executable hardware
command. The same bypass exists here in the EP11 request path.

Can a user with only usage permission on a custom zcrypt device node use this
to execute arbitrary hardware administrative commands?

>  		if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
>  			if (!test_bit_inv(domain, perms->adm)) {
>  				rc = -ENODEV;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722143831.109929-2-freude@linux.ibm.com?part=1