Re: [PATCH v2 01/20] KVM: selftests: Use MEM_REGION_PT memslot instead of '0' for s390 regions/segments

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Out-of-bounds memory write in s390 `virt_alloc_region` due to mismatched allocation and initialization sizes when setting up a page table.
--

commit 6a3a77e3cef84a1f8a83db6921ea5e3f5b11c1ed
Author: Sean Christopherson <seanjc@google.com>

KVM: selftests: Use MEM_REGION_PT memslot instead of '0' for s390 regions/segments

This commit updates s390's virtual memory allocator to use MEM_REGION_PT
instead of hardcoding memslot '0'. This acts as a preparatory step for
allowing the physical memory allocator to take the allocation type rather
than the raw memslot.

> diff --git a/tools/testing/selftests/kvm/lib/s390/processor.c b/tools/testing/selftests/kvm/lib/s390/processor.c
> index a9adb3782b352..fb9dab92d4d18 100644
> --- a/tools/testing/selftests/kvm/lib/s390/processor.c
> +++ b/tools/testing/selftests/kvm/lib/s390/processor.c
> @@ -39,7 +39,8 @@ static u64 virt_alloc_region(struct kvm_vm *vm, int ri)
>  	u64 taddr;
>  
>  	taddr = vm_phy_pages_alloc(vm,  ri < 4 ? PAGES_PER_REGION : 1,
> -				   KVM_GUEST_PAGE_TABLE_MIN_PADDR, 0);
> +				   KVM_GUEST_PAGE_TABLE_MIN_PADDR,
> +				   vm->memslots[MEM_REGION_PT]);
>  	memset(addr_gpa2hva(vm, taddr), 0xff, PAGES_PER_REGION * vm->page_size);

[Severity: Medium]
This is a pre-existing issue, but does this memset cause an out-of-bounds write
when allocating a page table?

When ri == 4, exactly 1 page is allocated by vm_phy_pages_alloc(), but this
memset() unconditionally clears PAGES_PER_REGION (4) pages. This overwrites
3 adjacent physical pages, which may corrupt other page tables, guest code,
or test data during s390 guest page table setup in virt_arch_pg_map().

>  
>  	return (taddr & REGION_ENTRY_ORIGIN)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902164123.2546762-1-seanjc@google.com?part=1