Re: [PATCH v3 06/10] KVM: s390: Fix overclearing ESCA in case of error

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] For UCONTROL VMs, the ESCA block CPU array is accessed out of bounds because vCPU IDs up to 254 are permitted, exceeding the array's size of 248.
--

--- Patch [6]: [PATCH v3 06/10] KVM: s390: Fix overclearing ESCA in case of error ---
commit 711c5a0b8c8ac3214d997bede21c76e30e58d712
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>

KVM: s390: Fix overclearing ESCA in case of error

This commit modifies vCPU destruction to skip clearing the ESCA entry if
the vCPU was not successfully initialized.

> diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
> index 9e3e6b0d72ad6..2acdff130fa6c 100644
> --- a/arch/s390/kvm/interrupt.c
> +++ b/arch/s390/kvm/interrupt.c
> @@ -86,7 +86,7 @@ static void sca_clear_ext_call(struct kvm_vcpu *vcpu)
>  	struct esca_block *sca = vcpu->kvm->arch.sca;
>  	union esca_sigp_ctrl *sigp_ctrl = &sca->cpu[vcpu->vcpu_id].sigp_ctrl;
>  
> -	if (!kvm_s390_use_sca_entries())
> +	if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized)
>  		return;
>  	kvm_s390_clear_cpuflags(vcpu, CPUSTAT_ECALL_PEND);
>  
>  	WRITE_ONCE(sigp_ctrl->value, 0);

[Severity: High]
This is a pre-existing issue, but does this code write past the bounds of
the esca_block allocation for UCONTROL VMs?

Looking at kvm_arch_vcpu_precreate() in arch/s390/kvm/kvm-s390.c, the
bounds check for ESCA CPU slots is explicitly bypassed for UCONTROL VMs:

    if (!kvm_is_ucontrol(kvm) && !sca_can_add_vcpu(kvm, id))
        return -EINVAL;

This allows vCPU IDs up to 254. However, the ESCA block CPU array only has
248 slots, and the block itself is allocated as exactly 4 pages.

When destroying a vCPU with an ID >= 248, the write operation in this
function appears to access memory past the end of the esca_block.

A similar situation seems to happen in sca_inject_ext_call() when
processing external calls:

arch/s390/kvm/interrupt.c:sca_inject_ext_call() {
    ...
    union esca_sigp_ctrl *sigp_ctrl = &sca->cpu[vcpu->vcpu_id].sigp_ctrl;
    ...
    rc = cmpxchg(&sigp_ctrl->value, old_val.value, new_val.value);
    ...
}

Could this lead to kernel memory corruption if a UCONTROL VM is created
with large vCPU IDs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727150254.236021-1-imbrenda@linux.ibm.com?part=6