[PATCH] s390/cpacf: Unpoison query results

[PATCH] s390/cpacf: Unpoison query results

[Ilya Leoshkevich]

Stop KMSAN from complaining about query results being uninitialized.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
 arch/s390/include/asm/cpacf.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/s390/include/asm/cpacf.h b/arch/s390/include/asm/cpacf.h
index a83683169d98d..d4128d3fd5138 100644
--- a/arch/s390/include/asm/cpacf.h
+++ b/arch/s390/include/asm/cpacf.h
@@ -301,6 +301,7 @@ static __always_inline void __cpacf_query(unsigned int opcode,
 					  cpacf_mask_t *mask)
 {
 	__cpacf_query_insn(opcode, mask, CPACF_FC_QUERY);
+	kmsan_unpoison_memory(mask, sizeof(*mask));
 }
 
 static __always_inline int __cpacf_check_opcode(unsigned int opcode)
@@ -370,6 +371,7 @@ static __always_inline int cpacf_query_func(unsigned int opcode,
 static __always_inline void __cpacf_qai(unsigned int opcode, cpacf_qai_t *qai)
 {
 	__cpacf_query_insn(opcode, qai, CPACF_FC_QUERY_AUTH_INFO);
+	kmsan_unpoison_memory(qai, sizeof(*qai));
 }
 
 /**
-- 
2.55.0

Re: [PATCH] s390/cpacf: Unpoison query results

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch resolves KMSAN false positives for CPACF query instructions by unpoisoning the fixed-size query outputs, but fails to implement the same fix for the primary CPACF data processing wrappers (e.g., `cpacf_km`, `cpacf_kmc`, `cpacf_kmctr`, `cpacf_kma`, `cpacf_prno`). These functions execute CPU instructions (like `.insn rre`) that write to output buffers directly. Because the inline assembly clobbers "memory" but does not explicitly bind the destination memory as an output operand (it only binds the register holding the pointer), KMSAN is unaware that the buffer is initialized. If an uninitialized buffer is passed for out-of-place encryption or PRNG generation, later reads from the buffer will trigger false-positive use-of-uninitialized-value warnings.
--

--- Patch [1]: [PATCH] s390/cpacf: Unpoison query results ---
commit a5de23eacfba57cb30b8dc14f4c7ed05cf2e259d
Author: Ilya Leoshkevich <iii@linux.ibm.com>

s390/cpacf: Unpoison query results

Stop KMSAN from complaining about query results being uninitialized.

> diff --git a/arch/s390/include/asm/cpacf.h b/arch/s390/include/asm/cpacf.h
> index a83683169d98d..d4128d3fd5138 100644
> --- a/arch/s390/include/asm/cpacf.h
> +++ b/arch/s390/include/asm/cpacf.h
[ ... ]
> @@ -370,6 +371,7 @@ static __always_inline int cpacf_query_func(unsigned int opcode,
>  static __always_inline void __cpacf_qai(unsigned int opcode, cpacf_qai_t *qai)
>  {
>  	__cpacf_query_insn(opcode, qai, CPACF_FC_QUERY_AUTH_INFO);
> +	kmsan_unpoison_memory(qai, sizeof(*qai));
>  }

[Severity: High]
This is a pre-existing issue, but should we also unpoison the buffers in the
other CPACF data processing wrappers?

The primary CPACF data processing wrappers (such as cpacf_km(), cpacf_kmc(),
cpacf_kmctr(), cpacf_kma(), and cpacf_prno()) execute CPU instructions that
write to output buffers directly. Because the inline assembly clobbers memory
but does not explicitly bind the destination memory as an output operand, KMSAN
remains unaware that the buffer was initialized.

If an uninitialized buffer is passed for out-of-place encryption or PRNG
generation, later reads from the buffer might trigger false-positive
use-of-uninitialized-value warnings.

Would it be helpful to add kmsan_unpoison_memory() to these functions as well
to prevent further false positives?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806190223.3292580-1-iii@linux.ibm.com?part=1

Re: [PATCH] s390/cpacf: Unpoison query results

[Ilya Leoshkevich]

On 8/6/26 21:14, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] The patch resolves KMSAN false positives for CPACF query instructions by unpoisoning the fixed-size query outputs, but fails to implement the same fix for the primary CPACF data processing wrappers (e.g., `cpacf_km`, `cpacf_kmc`, `cpacf_kmctr`, `cpacf_kma`, `cpacf_prno`). These functions execute CPU instructions (like `.insn rre`) that write to output buffers directly. Because the inline assembly clobbers "memory" but does not explicitly bind the destination memory as an output operand (it only binds the register holding the pointer), KMSAN is unaware that the buffer is initialized. If an uninitialized buffer is passed for out-of-place encryption or PRNG generation, later reads from the buffer will trigger false-positive use-of-uninitialized-value warnings.
> --
> 
> --- Patch [1]: [PATCH] s390/cpacf: Unpoison query results ---
> commit a5de23eacfba57cb30b8dc14f4c7ed05cf2e259d
> Author: Ilya Leoshkevich <iii@linux.ibm.com>
> 
> s390/cpacf: Unpoison query results
> 
> Stop KMSAN from complaining about query results being uninitialized.
> 
>> diff --git a/arch/s390/include/asm/cpacf.h b/arch/s390/include/asm/cpacf.h
>> index a83683169d98d..d4128d3fd5138 100644
>> --- a/arch/s390/include/asm/cpacf.h
>> +++ b/arch/s390/include/asm/cpacf.h
> [ ... ]
>> @@ -370,6 +371,7 @@ static __always_inline int cpacf_query_func(unsigned int opcode,
>>   static __always_inline void __cpacf_qai(unsigned int opcode, cpacf_qai_t *qai)
>>   {
>>   	__cpacf_query_insn(opcode, qai, CPACF_FC_QUERY_AUTH_INFO);
>> +	kmsan_unpoison_memory(qai, sizeof(*qai));
>>   }
> 
> [Severity: High]
> This is a pre-existing issue, but should we also unpoison the buffers in the
> other CPACF data processing wrappers?
> 
> The primary CPACF data processing wrappers (such as cpacf_km(), cpacf_kmc(),
> cpacf_kmctr(), cpacf_kma(), and cpacf_prno()) execute CPU instructions that
> write to output buffers directly. Because the inline assembly clobbers memory
> but does not explicitly bind the destination memory as an output operand, KMSAN
> remains unaware that the buffer was initialized.
> 
> If an uninitialized buffer is passed for out-of-place encryption or PRNG
> generation, later reads from the buffer might trigger false-positive
> use-of-uninitialized-value warnings.
> 
> Would it be helpful to add kmsan_unpoison_memory() to these functions as well
> to prevent further false positives?

Fair point, will do.