Re: [PATCH v3 2/2] s390/uv: Prevent potential out-of-bounds read

[Christoph Schlameuss]

On Wed Aug 12, 2026 at 5:55 PM CEST, Steffen Eiden wrote:
> When the system has more than 85 secrets, the uv_secret_list struct
> array only holds up to 85 items per page, resulting in an out of bounds
> read in find_secret_in_page if the targeted secret is in the next page
> or not stored at all.
>
> Fix this by looping over the number of stored secrets which is the
> per sub-list count of stored secrets and not the overall count.
>
> Fixes: 7c9137af2042 ("s390/uv: Retrieve UV secrets support")
> Signed-off-by: Steffen Eiden <seiden@xxxxxxxxxxxxx>

Reviewed-by: Christoph Schlameuss <schlameuss@xxxxxxxxxxxxx>

> ---
>  arch/s390/kernel/uv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
> index d970b15ef126..e70acad09cd5 100644
> --- a/arch/s390/kernel/uv.c
> +++ b/arch/s390/kernel/uv.c
> @@ -760,7 +760,7 @@ static int find_secret_in_page(const u8 secret_id[UV_SECRET_ID_LEN],
>  {
>  	u16 i;
>  
> -	for (i = 0; i < list->total_num_secrets; i++) {
> +	for (i = 0; i < list->num_secr_stored; i++) {
>  		if (memcmp(secret_id, list->secrets[i].id, UV_SECRET_ID_LEN) == 0) {
>  			*secret = list->secrets[i].hdr;
>  			return 0;