Re: [PATCH 01/20] KVM: selftests: Use MEM_REGION_PT memslot instead of '0' for s390 regions/segments

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds write (buffer overflow) when initializing guest page tables in `virt_alloc_region`.
--

commit a213aecc3a3df3f801c303737240f0d76e5332fa
Author: Sean Christopherson <seanjc@google.com>

KVM: selftests: Use MEM_REGION_PT memslot instead of '0' for s390 regions/segments

This commit updates the s390 virtual memory allocator to use MEM_REGION_PT
to indirectly specify the memslot instead of hardcoding it to 0. This is a
step toward taking the allocation type instead of the exact raw memslot in
the physical memory allocator.

> diff --git a/tools/testing/selftests/kvm/lib/s390/processor.c b/tools/testing/selftests/kvm/lib/s390/processor.c
> --- a/tools/testing/selftests/kvm/lib/s390/processor.c
> +++ b/tools/testing/selftests/kvm/lib/s390/processor.c
> @@ -39,7 +39,8 @@ static u64 virt_alloc_region(struct kvm_vm *vm, int ri)
>  	u64 taddr;
>  
>  	taddr = vm_phy_pages_alloc(vm,  ri < 4 ? PAGES_PER_REGION : 1,
> -				   KVM_GUEST_PAGE_TABLE_MIN_PADDR, 0);
> +				   KVM_GUEST_PAGE_TABLE_MIN_PADDR,
> +				   vm->memslots[MEM_REGION_PT]);
>  	memset(addr_gpa2hva(vm, taddr), 0xff, PAGES_PER_REGION * vm->page_size);

[Severity: High]
This is a pre-existing issue, but does this memset cause a buffer overflow
when ri == 4?

When ri == 4, vm_phy_pages_alloc() allocates 1 page, but the memset blindly
clears PAGES_PER_REGION * vm->page_size (4 pages) with 0xff. 

Since virt_arch_pg_map() unconditionally loops from ri = 1 to ri = 4, would
calling virt_alloc_region() with ri == 4 write 3 pages past the end of the
allocation every time a page table is allocated on s390x, potentially
corrupting adjacent memory or causing a segmentation fault in the test process?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826230511.972824-1-seanjc@google.com?part=1