Re: [PATCH v3 1/2] s390/zcrypt: Guard domain index uses against speculative bypass

[Holger Dengler <dengler@linux.ibm.com>]

On 10/6/26 17:46, Harald Freudenberger wrote:
> The previous array_index_nospec() placement only covered the admin
> permission check, leaving ap_test_config_usage_domain() and
> ap_test_config_ctrl_domain() in the CCA path exposed to speculative
> execution.
> 
> Move the sanitization to before all permission and config checks in
> both the CCA and EP11 paths. Hold the sanitized domain value in
> another variable so that the later use can choose to use either the
> original value (subject to speculative execution) or the sanitized
> value (which may in case of AUTOSEL_DOM reflect the wrong
> value). Before that, check the domain value to be either AUTOSEL_DOM
> or in range 0...AP_DOMAIN-1 and return with -EINVAL in case this check
> does not pass.
> 
> Fixes: e935cd525af4 ("s390/zcrypt: Close speculative mem read possibility")
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
> Cc: stable@vger.kernel.org

Reviewed-by: Holger Dengler <dengler@linux.ibm.com>

> ---
>  drivers/s390/crypto/zcrypt_api.c | 35 +++++++++++++++++++++++---------
>  1 file changed, 25 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
> index ec6a4c2f9f04..625578b3fabe 100644
> --- a/drivers/s390/crypto/zcrypt_api.c
> +++ b/drivers/s390/crypto/zcrypt_api.c
[...]> @@ -877,10 +877,17 @@ static long _zcrypt_send_cprb(u32 xflags,
struct ap_perms *perms,
>  	print_hex_dump_debug("ccareq: ", DUMP_PREFIX_ADDRESS, 16, 1,
>  			     ap_msg.msg, ap_msg.len, false);
>  
> +	/* Check domain for either AUTOSEL_DOM or in range 0...AP_DOMAIN-1 */

typo in comment: AP_DOMAIN-1 --> AP_DOMAINS-1 (missing S)

[...]
> @@ -1078,10 +1086,17 @@ static long _zcrypt_send_ep11_cprb(u32 xflags, struct ap_perms *perms,
>  	print_hex_dump_debug("ep11req: ", DUMP_PREFIX_ADDRESS, 16, 1,
>  			     ap_msg.msg, ap_msg.len, false);
>  
> +	/* Check domain for either AUTOSEL_DOM or in range 0...AP_DOMAIN-1 */

Same here.
typo: AP_DOMAIN-1 --> AP_DOMAINS-1 (missing S)

[...]

-- 
Mit freundlichen Grüßen / Kind regards
Holger Dengler