Re: [PATCH v7 04/10] s390/vfio_ccw: ensure first IDAW remains constant

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `get_guest_idal()` calculates the length of the guest IDAL incorrectly for 32-bit (Format-1) IDAWs, resulting in an out-of-bounds DMA read from guest memory that can cause valid channel programs to be rejected.
--

--- Patch [4]: [PATCH v7 04/10] s390/vfio_ccw: ensure first IDAW remains constant ---
commit aa8d48cf11f4cace4871ca597e3aa07dec1573e4
Author: Eric Farman <farman@linux.ibm.com>

s390/vfio_ccw: ensure first IDAW remains constant

This patch ensures the first IDAW in a list is unchanged between reads to
maintain a consistent set of IDAWs.

> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> index af632f9d54535..6275794751cb4 100644
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
> @@ -523,6 +523,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct channel_program *cp, int
>  		&container_of(cp, struct vfio_ccw_private, cp)->vdev;
>  	dma64_t *idaws;
>  	dma32_t *idaws_f1;
> +	u64 first_idaw;
>  	int idal_len = idaw_nr * sizeof(*idaws);

[Severity: High]
This is a pre-existing issue, but does this calculate the guest IDAL length
incorrectly for 32-bit (Format-1) IDAWs?

Since idaws is a dma64_t pointer, sizeof(*idaws) is 8 bytes. If the guest is
submitting a channel program with Format-1 32-bit IDAWs (cp->orb.cmd.c64 == 0),
this calculates idal_len as idaw_nr * 8 instead of idaw_nr * 4.

When vfio_dma_rw() is later called with this inflated idal_len, could it
perform an out-of-bounds DMA read from guest memory? If the guest's 32-bit
IDAL ends at a memory boundary, the over-read could fail with -EFAULT or
-EINVAL, causing valid channel programs to be unnecessarily rejected.

>  	int idaw_size = idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE;
>  	int idaw_mask = ~(idaw_size - 1);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727192230.2715207-1-farman@linux.ibm.com?part=4