Re: [PATCH] s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] The sysfs `report_error` binary attribute does not verify that the user-provided write buffer size (`count`) is large enough to cover the embedded payload length (`report->length`). This leads to reading uninitialized kernel heap memory which is then sent to the SCLP hardware.
--

--- Patch [1]: [PATCH] s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting ---
commit 320785563461e373b0db5b021ac2e04f40ee8406
Author: Niklas Schnelle <schnelle@linux.ibm.com>

s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting

Add SCLP Action Qualifiers used by the Spyre stack for reporting of the
card's initialization status, recoverable errors, and telemetry data.

> diff --git a/drivers/s390/char/sclp_pci.c b/drivers/s390/char/sclp_pci.c
> index d61a7fc0dd610..b79ef7006e46f 100644
> --- a/drivers/s390/char/sclp_pci.c
> +++ b/drivers/s390/char/sclp_pci.c
> @@ -99,6 +99,9 @@ static int sclp_pci_check_report(struct zpci_report_error_header *report)
>  	case SCLP_ERRNOTIFY_AQ_INFO_LOG:
>  	case SCLP_ERRNOTIFY_AQ_OPTICS_DATA:
>  	case SCLP_ERRNOTIFY_AQ_NVME_SMART_LOG:
> +	case SCLP_ERRNOTIFY_AQ_ADAPTER_INITIALIZED:
> +	case SCLP_ERRNOTIFY_AQ_RECOVERABLE_ERROR:
> +	case SCLP_ERRNOTIFY_AQ_TELEMETRY_DATA:

[Severity: Medium]
This is a pre-existing issue and was not introduced by the patch under review,
but could this code leak uninitialized kernel heap memory to the SCLP
hardware?

Looking at how report_error_write() handles the sysfs write, it verifies the
buffer is at least as large as the header struct:

arch/s390/pci/pci_sysfs.c:report_error_write() {
	if (off || (count < sizeof(*report)))
		return -EINVAL;
}

However, it does not check if the user-provided count is large enough to cover
the embedded payload length (report->length).

Later, when sclp_pci_report() processes this report, it copies report->length
bytes:

drivers/s390/char/sclp_pci.c:sclp_pci_report() {
	memcpy(sccb->evbuf.data, report->data, report->length);
}

If a user writes a small payload length but specifies a large report->length
in the embedded header, will memcpy() read past the end of the sysfs buffer
and send uninitialized heap data?

>  		break;
>  	default:
>  		return -EINVAL;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724-sclp_allow_aqs_spyre-v1-1-569acfe11385@linux.ibm.com?part=1