Re: [PATCH v2 1/1] s390/zcrypt: Close speculative mem read possibility

[Heiko Carstens <hca@linux.ibm.com>]

On Wed, Jul 22, 2026 at 05:20:25PM +0200, Harald Freudenberger wrote:
> The domain value is extracted from a given CCA or EP11 ioctl struct
> when a CPRB is about to be sent. Thus this is a user controlled value.
> Under some special conditions (custom device node used, administrative
> load) this value is used as an array index after bounds checking, but
> without speculation barrier.
> 
> Add the missing array_index_nospec() call to prevent speculative
> execution where this domain value is used.
> 
> Fixes: cfd68b33094e ("s390/zcrypt: Filter admin CPRBs on custom devices")
> Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
> Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
> Cc: stable@vger.kernel.org

...

> @@ -1079,6 +1080,7 @@ static long _zcrypt_send_ep11_cprb(u32 xflags, struct ap_perms *perms,
>  
>  	if (perms != &ap_perms && domain < AUTOSEL_DOM) {
>  		if (ap_msg.flags & AP_MSG_FLAG_ADMIN) {
> +			domain = array_index_nospec(domain, AP_DOMAINS);

This hunk doesn't make sense, and it depends on the other patch you sent:
"s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs".
Please send them as a series of two.