Re: [PATCH 3/3] s390/diag: Add diag204 IOCTL to diag misc device

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] s390/diag: broken copy_to_user() error check in diag204_buf()
--

commit bc2db0b15c4152f85ed3a637d54a7ba9099ebe1e
Author: Mete Durlu <meted@linux.ibm.com>

s390/diag: Add diag204 IOCTL to diag misc device

This commit adds the DIAG204_GET_LEN and DIAG204_GET_BUF ioctl commands
to the /dev/diag misc device to allow userspace with CAP_SYS_ADMIN to
query and retrieve diag204 data.

> diff --git a/arch/s390/kernel/diag/diag204.c b/arch/s390/kernel/diag/diag204.c
> index 8e1909e6caf90..967b6e0bc667a 100644
> --- a/arch/s390/kernel/diag/diag204.c
> +++ b/arch/s390/kernel/diag/diag204.c

[ ... ]

> +long diag204_buf(unsigned long arg)
> +{
> +	struct diag204_request __user *udata;
> +	int rc, allow_busy, allow_busy_wait;
> +	u64 address;
> +	void *buf;
> +
> +	if (!diag204_is_available())
> +		return -EOPNOTSUPP;
> +	udata = (struct diag204_request __user *)arg;
> +	if (get_user(address, &udata->address))
> +		return -EFAULT;
> +	if (get_user(allow_busy, &udata->allow_busy))
> +		return -EFAULT;
> +	if (get_user(allow_busy_wait, &udata->allow_busy_wait))
> +		return -EFAULT;
> +	buf = diag204_allocate_buffer();
> +	if (!buf)
> +		return -ENOMEM;
> +	rc = diag204_store(buf, allow_busy, allow_busy_wait);
> +	if (rc < 0) {
> +		diag204_free_buffer(buf);
> +		return rc;
> +	}
> +	rc = copy_to_user((void __user *)address, buf,
> +			  diag204_get_buf_size());
> +	if (rc < 0)
> +		rc = -EFAULT;

[Severity: Medium]
Since copy_to_user() returns the positive number of uncopied bytes on a
fault rather than a negative error code, will this check miss faults when
copying to address in diag204_buf() via diag_ioctl() (DIAG204_GET_BUF) and
return a positive byte count instead of -EFAULT?

Should this check if (rc) (or if (copy_to_user(...))) instead?

> +	diag204_free_buffer(buf);
> +	return rc;
> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021-diag204ioctl-v1-0-25645b97bf4e@linux.ibm.com?part=3