Re: [PATCH v5 05/10] s390/vfio_ccw: calculate idal length based on idaw type

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Guest IOVAs are passed untranslated to the host channel subsystem for skipped I/O operations, allowing physical memory probing.
--

--- Patch [5]: [PATCH v5 05/10] s390/vfio_ccw: calculate idal length based on idaw type ---
commit 8013df87ffdce265ecd327b26da1e700483c050d
Author: Eric Farman <farman@linux.ibm.com>
Subject: s390/vfio_ccw: calculate idal length based on idaw type

The patch fixes the length calculation of IDAL in get_guest_idal() so it
doesn't unconditionally assume Format-2 IDAW sizes. Input IDALs can be
Format-1 (31-bit) or Format-2 (64-bit), requiring dynamic size calculation.

Link: https://lore.kernel.org/r/20260720203400.7328E1F000E9@smtp.kernel.org/

> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> index 6275794751cb4..5ef082b8289af 100644
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
[ ... ]
> @@ -524,7 +525,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct channel_program *cp, int
>  	dma64_t *idaws;
>  	dma32_t *idaws_f1;
>  	u64 first_idaw;
> -	int idal_len = idaw_nr * sizeof(*idaws);
> +	int idal_len = idaw_nr * get_idaw_size(cp);

[Severity: High]
This is a pre-existing issue, but I have a question about how we handle
skipped I/O operations. Is it possible for untranslated guest IOVAs to
be leaked to the host hardware if the CCW has the SKIP flag set or if
count is 0?

When get_guest_idal() populates the idaws array, it copies the IDAL
directly from the guest. Later, if ccw_does_data_transfer() returns
false, ccwchain_fetch_ccw() skips pinning and sets pa->pa_nr = 0:

drivers/s390/cio/vfio_ccw_cp.c:ccwchain_fetch_ccw() {
	...
	if (ccw_does_data_transfer(ccw)) {
		ret = page_array_pin(pa, vdev, idal_is_2k(cp));
		if (ret < 0)
			goto out_unpin;
	} else {
		pa->pa_nr = 0;
	}
	...
}

This then causes page_array_idal_create_words() to perform zero iterations
because its loop is bounded by pa->pa_nr:

drivers/s390/cio/vfio_ccw_cp.c:page_array_idal_create_words() {
	...
	for (i = 0; i < pa->pa_nr; i++) {
		idaws[i] = virt_to_dma64(page_to_virt(pa->pa_page[i]));
	}
	...
}

Would this result in the guest IOVAs remaining in the idaws array,
leaving the untranslated guest addresses exposed to the host hardware?

Since the hardware still validates physical addresses even for skipped
operations, could a malicious guest use this to probe host physical
memory and bypass KASLR?

>  	int idaw_size = idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE;
>  	int idaw_mask = ~(idaw_size - 1);
>  	int i, ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260726040129.2946151-1-farman@linux.ibm.com?part=5