[PATCH v2 0/1] Close speculative mem read possibility

[PATCH v2 0/1] Close speculative mem read possibility

[Harald Freudenberger]

The domain value is extracted from a given CCA or EP11 ioctl struct
when a CPRB is about to be sent. Thus this is a user controlled value.
Under some special conditions (custom device node used, administrative
load) this value is used as an array index after bounds checking, but
without speculation barrier.

Add the missing array_index_nospec() call to prevent speculative
execution where this domain value is used.

Changelog:
v1: initial version
v2: Rephrased patch header text, added Finn's Reviewed-by, no code changes.

Harald Freudenberger (1):
  s390/zcrypt: Close speculative mem read possibility

 drivers/s390/crypto/zcrypt_api.c | 2 ++
 1 file changed, 2 insertions(+)

-- 
2.43.0

[PATCH v2 1/1] s390/zcrypt: Close speculative mem read possibility

[Harald Freudenberger]

The domain value is extracted from a given CCA or EP11 ioctl struct
when a CPRB is about to be sent. Thus this is a user controlled value.
Under some special conditions (custom device node used, administrative
load) this value is used as an array index after bounds checking, but
without speculation barrier.

Add the missing array_index_nospec() call to prevent speculative
execution where this domain value is used.

Fixes: cfd68b33094e ("s390/zcrypt: Filter admin CPRBs on custom devices")
Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Cc: stable@vger.kernel.org
---
 drivers/s390/crypto/zcrypt_api.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index f57189c2b839..593aace5fc48 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -879,6 +879,7 @@ static long _zcrypt_send_cprb(u32 xflags, struct ap_perms *perms,
 
 	if (perms != &ap_perms && domain < AP_DOMAINS) {
 		if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
+			domain = array_index_nospec(domain, AP_DOMAINS);
 			if (!test_bit_inv(domain, perms->adm)) {
 				rc = -ENODEV;
 				goto out;
@@ -1079,6 +1080,7 @@ static long _zcrypt_send_ep11_cprb(u32 xflags, struct ap_perms *perms,
 
 	if (perms != &ap_perms && domain < AUTOSEL_DOM) {
 		if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
+			domain = array_index_nospec(domain, AP_DOMAINS);
 			if (!test_bit_inv(domain, perms->adm)) {
 				rc = -ENODEV;
 				goto out;
-- 
2.43.0

Re: [PATCH v2 1/1] s390/zcrypt: Close speculative mem read possibility

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] In `_zcrypt_send_ep11_cprb`, `array_index_nospec()` is used without a prior bounds check against `AP_DOMAINS`, silently aliasing out-of-bounds domains to domain 0 and bypassing administrative permission checks.

Pre-existing issues:
- [High] Administrative CPRBs with domain == AUTOSEL_DOM completely bypass the perms->adm permission check in `_zcrypt_send_cprb` and `_zcrypt_send_ep11_cprb`.
--

--- Patch [1]: [PATCH v2 1/1] s390/zcrypt: Close speculative mem read possibility ---
commit de8272723358b7baff06b29b44fe219b26350d5e
Author: Harald Freudenberger <freude@linux.ibm.com>
s390/zcrypt: Close speculative mem read possibility

This patch addresses a speculative execution out-of-bounds read by adding
array_index_nospec() to the domain value extracted from user-controlled
CPRB structs before it is used as an array index.

> diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
> index f57189c2b839e..593aace5fc484 100644
> --- a/drivers/s390/crypto/zcrypt_api.c
> +++ b/drivers/s390/crypto/zcrypt_api.c
> @@ -879,6 +879,7 @@ static long _zcrypt_send_cprb(u32 xflags, struct ap_perms *perms,
>  
>  	if (perms != &ap_perms && domain < AP_DOMAINS) {

[Severity: High]
This is a pre-existing issue, but does this logic allow administrative
CPRBs with domain == AUTOSEL_DOM to bypass the perms->adm permission
check entirely?

If a user submits a CPRB request with an administrative command code and sets
the target domain to AUTOSEL_DOM, this condition evaluates to false.

The perms->adm evaluation is skipped, and the kernel later selects a queue
based solely on the user's usage permissions in zcrypt_check_queue().

>  		if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
> +			domain = array_index_nospec(domain, AP_DOMAINS);
>  			if (!test_bit_inv(domain, perms->adm)) {
>  				rc = -ENODEV;
>  				goto out;

[ ... ]

> @@ -1079,6 +1080,7 @@ static long _zcrypt_send_ep11_cprb(u32 xflags, struct ap_perms *perms,
>  
>  	if (perms != &ap_perms && domain < AUTOSEL_DOM) {

[Severity: High]
This is a pre-existing issue, but does this similarly skip the admin check
for EP11 CPRBs if domain == AUTOSEL_DOM?

>  		if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
> +			domain = array_index_nospec(domain, AP_DOMAINS);

[Severity: High]
Does this use of array_index_nospec() map out-of-bounds domains to domain 0?

The guard condition for this block in _zcrypt_send_ep11_cprb() checks
domain < AUTOSEL_DOM, but array_index_nospec() bounds against AP_DOMAINS.

If a user provides a domain value between AP_DOMAINS and AUTOSEL_DOM - 1, the
array_index_nospec() call will forcefully mask the out-of-bounds domain to 0. 

Will this result in checking perms->adm for domain 0 instead of the requested
domain, potentially allowing an authorization bypass if the user has admin
privileges for domain 0?

>  			if (!test_bit_inv(domain, perms->adm)) {
>  				rc = -ENODEV;
>  				goto out;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722152025.119391-2-freude@linux.ibm.com?part=1

Re: [PATCH v2 1/1] s390/zcrypt: Close speculative mem read possibility

[Heiko Carstens]

On Wed, Jul 22, 2026 at 05:20:25PM +0200, Harald Freudenberger wrote:
> The domain value is extracted from a given CCA or EP11 ioctl struct
> when a CPRB is about to be sent. Thus this is a user controlled value.
> Under some special conditions (custom device node used, administrative
> load) this value is used as an array index after bounds checking, but
> without speculation barrier.
> 
> Add the missing array_index_nospec() call to prevent speculative
> execution where this domain value is used.
> 
> Fixes: cfd68b33094e ("s390/zcrypt: Filter admin CPRBs on custom devices")
> Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
> Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
> Cc: stable@vger.kernel.org

...

> @@ -1079,6 +1080,7 @@ static long _zcrypt_send_ep11_cprb(u32 xflags, struct ap_perms *perms,
>  
>  	if (perms != &ap_perms && domain < AUTOSEL_DOM) {
>  		if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
> +			domain = array_index_nospec(domain, AP_DOMAINS);

This hunk doesn't make sense, and it depends on the other patch you sent:
"s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs".
Please send them as a series of two.