Re: [PATCH v9 04/10] s390/vfio_ccw: ensure first IDAW remains constant

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] When processing Format-1 IDALs (32-bit IDAWs), get_guest_idal() computes idal_len using the size of a 64-bit host IDAW structure (idaw_nr * 8) rather than the actual 32-bit size of the guest IDAWs (idaw_nr * 4), causing an over-read of guest memory.
--

--- Patch [4]: [PATCH v9 04/10] s390/vfio_ccw: ensure first IDAW remains constant ---
commit befdc53db29630758bc9d091cedca02c65d65181
Author: Eric Farman <farman@linux.ibm.com>

s390/vfio_ccw: ensure first IDAW remains constant

The first IDAW in a list is read separately to calculate the needed
buffer size. This patch verifies that the address found in the first
IDAW remains unchanged between reads to ensure a consistent set of IDAWs.

Cc: stable@vger.kernel.org

> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> index af632f9d54535..6275794751cb4 100644
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
> @@ -523,6 +523,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct channel_program *cp, int
>  		&container_of(cp, struct vfio_ccw_private, cp)->vdev;
>  	dma64_t *idaws;
>  	dma32_t *idaws_f1;
> +	u64 first_idaw;
>  	int idal_len = idaw_nr * sizeof(*idaws);

[Severity: High]
This is a pre-existing issue, but does this calculate an oversized length
for 32-bit Format-1 guest IDAWs?

When processing Format-1 IDALs, idaws is a dma64_t pointer (8 bytes).
Using sizeof(*idaws) means idal_len evaluates to idaw_nr * 8. Later in
get_guest_idal(), vfio_dma_rw() uses this oversized length:

	if (ccw_is_idal(ccw)) {
		/* Copy IDAL from guest */
		ret = vfio_dma_rw(vdev, dma32_to_u32(ccw->cda), idaws,
				  idal_len, false);

Could this cause valid I/O operations to fail with an error if the 32-bit
IDAL is located near the end of a mapped guest page, resulting in an
over-read into an unmapped DMA region?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260728033022.2658232-1-farman@linux.ibm.com?part=4