Re: [GIT PULL v1 16/23] KVM: s390: Fix leaking of PGM_ADDRESSING to userspace

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] 1-bit kernel stack memory leak to userspace via uninitialized bitfield in union skey.
--

--- Patch [16]: [GIT PULL v1 16/23] KVM: s390: Fix leaking of PGM_ADDRESSING to userspace ---
commit 74696629bd13e2265747961c02030c7ac8a442d4
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>

    KVM: s390: Fix leaking of PGM_ADDRESSING to userspace
    
    If kvm_s390_set_cmma_bits() is asked to set CMMA values outside of a
    memslot, PGM_ADDRESSING (5) is returned, instead of a negative error
    value. Fix by returning -EFAULT whenever the return value would be > 0.

Link: https://lkml.kernel.org/r/20260803124040.126471-7-imbrenda@linux.ibm.com

> diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
> index 21574f57be72e..e162efaa35b8f 100644
> --- a/arch/s390/kvm/kvm-s390.c
> +++ b/arch/s390/kvm/kvm-s390.c
[ ... ]
> @@ -571,7 +571,7 @@ static int kvm_s390_keyop(struct kvm_s390_mmu_cache *mc, struct kvm *kvm, int op
>  	switch (op) {
>  	case KVM_S390_KEYOP_SSKE:
>  		r = dat_cond_set_storage_key(mc, asce, gfn, skey, &skey, 0, 0, 0);
> -		if (r >= 0)
> +		if (r == 0 || r == 1)
>  			return skey.skey;

[Severity: High]
This isn't a bug introduced by this patch, but does returning skey.skey here
leak uninitialized kernel stack memory to userspace?

Looking at dat_cond_set_storage_key() in arch/s390/kvm/dat.c, a local union
skey prev is declared without initialization:

	union skey prev;

When ptep->h.i is true, it assigns values to 4 of the 5 bitfields in prev,
but the zero bitfield remains uninitialized and retains kernel stack garbage:

	} else {
		prev.acc = old.acc;
		prev.fp = old.fp;
		prev.c = old.gc;
		prev.r = old.gr;
	}

This prev union is then copied to *oldkey:

	if (oldkey)
		*oldkey = prev;

Since oldkey points to the local skey variable here in kvm_s390_keyop(),
does returning skey.skey eventually leak this uninitialized zero bitfield to
userspace when the result is copied via copy_to_user()?

>  		break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803160924.236807-1-imbrenda@linux.ibm.com?part=16