Re: [PATCH v4 2/4] KVM: s390: Remove cond_resched() calls

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check on `user_data_len` allows an out-of-bounds read of kernel memory by the Ultravisor.
--

--- Patch [2]: [PATCH v4 2/4] KVM: s390: Remove cond_resched() calls ---
commit 6586b58419c33753e59827884fdaa5a7f473b641
Author: Heiko Carstens <[email protected]>

KVM: s390: Remove cond_resched() calls
    
Since [1] cond_resched() is a no-op on s390. Remove all calls.

This also entirely removes uv_call_sched() and replaces all call sites
with uv_call(), since both functions are identical after the removal
of cond_resched().
    
[1] commit 7dadeaa6e851 ("sched: Further restrict the preemption modes")

> diff --git a/drivers/s390/char/uvdevice.c b/drivers/s390/char/uvdevice.c
> index e6a264c996ce3..4d274a2ee84dd 100644
> --- a/drivers/s390/char/uvdevice.c
> +++ b/drivers/s390/char/uvdevice.c
[ ... ]
> @@ -224,7 +224,7 @@ static int uvio_attestation(struct uvio_ioctl_cb *uv_ioctl)
>  	if (ret)
>  		goto out;
>  
> -	uv_call_sched(0, (u64)uvcb_attest);
> +	uv_call(0, (u64)uvcb_attest);

[Severity: High]
This is a pre-existing issue, but does get_uvio_attest() validate the size of
user_data_len?

Looking at uvio_attestation(), it calls get_uvio_attest() to populate
uvio_attest, but there appears to be no bounds check on
uvio_attest->user_data_len. Then in uvio_build_uvcb_attest(), this unvalidated
length is copied to uvcb_attest->user_data_len before making this Ultravisor
call.

Since uvcb_attest is allocated in kernel memory, could a malicious user
provide a large user_data_len (up to 65535) and cause the Ultravisor firmware
to read beyond the bounds of the uvcb_attest allocation? This might lead to a
system crash if it accesses unmapped physical memory, or it could leak
adjacent kernel heap contents by incorporating them into the cryptographic
measurement returned to the user.

>  
>  	uv_ioctl->uv_rc = uvcb_attest->header.rc;
>  	uv_ioctl->uv_rrc = uvcb_attest->header.rrc;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2