Re: [PATCH v3 2/2] s390/uv: Prevent potential out-of-bounds read
"Christoph Schlameuss" <[email protected]>
| Newsgroups | org.kernel.vger.linux-s390,org.kernel.vger.kvm,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Wed Aug 12, 2026 at 5:55 PM CEST, Steffen Eiden wrote:
> When the system has more than 85 secrets, the uv_secret_list struct
> array only holds up to 85 items per page, resulting in an out of bounds
> read in find_secret_in_page if the targeted secret is in the next page
> or not stored at all.
>
> Fix this by looping over the number of stored secrets which is the
> per sub-list count of stored secrets and not the overall count.
>
> Fixes: 7c9137af2042 ("s390/uv: Retrieve UV secrets support")
> Signed-off-by: Steffen Eiden <[email protected]>
Reviewed-by: Christoph Schlameuss <[email protected]>
> ---
> arch/s390/kernel/uv.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
> index d970b15ef126..e70acad09cd5 100644
> --- a/arch/s390/kernel/uv.c
> +++ b/arch/s390/kernel/uv.c
> @@ -760,7 +760,7 @@ static int find_secret_in_page(const u8 secret_id[UV_SECRET_ID_LEN],
> {
> u16 i;
>
> - for (i = 0; i < list->total_num_secrets; i++) {
> + for (i = 0; i < list->num_secr_stored; i++) {
> if (memcmp(secret_id, list->secrets[i].id, UV_SECRET_ID_LEN) == 0) {
> *secret = list->secrets[i].hdr;
> return 0;