Re: [PATCH v5 04/10] s390/vfio_ccw: ensure first IDAW remains constant

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The function get_guest_idal over-reads the guest's IDAL buffer when processing 32-bit (Format-1) IDAWs, potentially causing spurious I/O failures if the read crosses into unmapped memory.
--

--- Patch [4]: [PATCH v5 04/10] s390/vfio_ccw: ensure first IDAW remains constant ---
commit 9c17ea86e465307c28b3fca8602d9a6e74a2028b
Author: Eric Farman <farman@linux.ibm.com>

s390/vfio_ccw: ensure first IDAW remains constant

This commit verifies that the first IDAW read remains unchanged between reads
to ensure a consistent set of IDAWs is used for the channel program.

> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
> @@ -523,6 +523,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct channel_program *cp, int
>  		&container_of(cp, struct vfio_ccw_private, cp)->vdev;
>  	dma64_t *idaws;
>  	dma32_t *idaws_f1;
> +	u64 first_idaw;
>  	int idal_len = idaw_nr * sizeof(*idaws);

[Severity: High]
This is a pre-existing issue, but does calculating idal_len using
sizeof(*idaws) (which is 8 bytes for dma64_t) cause an out-of-bounds
read when processing 32-bit Format-1 IDAWs?

Since vfio_dma_rw() is called with this idal_len further down in 
get_guest_idal():

    ret = vfio_dma_rw(vdev, dma32_to_u32(ccw->cda), idaws, idal_len, false);

Could this over-read cross into unmapped or unpinned memory pages and cause
spurious I/O failures if a guest happens to place its Format-1 IDAL near the
end of a mapped page?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260726040129.2946151-1-farman@linux.ibm.com?part=4