Merge tag 's390-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Heiko Carstens:

 - Use jiffies instead of jiffies_64 to address a data-race reported by
   KCSAN

 - Unpoison cpacf instruction results to address KMSAN reports

 - Drop unused member from ap_device_id

 - Fix potential NULL pointer dereferences in IPL code

 - Add missing length check to SCLP error report handling

 - Add missing length check to zcrypt CCA code

 - Fix return code handling in diag324 code

 - Handle multiple PMU stop callback invocations in perf pai code
   correctly

 - Reduce excessive debug feature size in perf pai code from 32 MiB to
   4KiB

 - Switch to common CPU capacity code in topology code to get rid of few
   lines of code

 - Address various bugs in corner cases in boot code

 - Simplify/Rework crst_table_upgrade() to address a potential NULL
   pointer dereference in case of an allocation failure

 - Initialize padding bytes in CRT key structure in zcrypt code

* tag 's390-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/zcrypt: Fix uninitialized padding in CRT key structure
  s390/mm: Simplify crst_table_upgrade()
  s390/boot: Bound command line facility ranges
  s390/boot: Avoid IPL parameter append past command line
  s390/boot: Fix physical memory search range
  s390/topology: Switch to common cpu capacity code
  s390/pai: Reduce excessive debug feature size
  s390/pai: Handle multiple PMU stop callback invocations
  s390/diag324: Preserve -EBUSY return code
  s390/zcrypt: Validate length in reply before using it
  s390/pci: Fix leak of uninitialized kernel data in SCLP report
  s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
  s390/ipl: Fix NULL deref in kdump without re-IPL parm block
  s390/ap: Drop unused member from ap_device_id
  s390/cpacf: Unpoison instruction results
  s390/time: Use jiffies instead of jiffies_64

2 files changed, 15 insertions, 1 deletions

diff --git a/drivers/s390/crypto/zcrypt_cca_key.h b/drivers/s390/crypto/zcrypt_cca_key.h
index f5907b67db29..8a69eed75040 100644
--- a/drivers/s390/crypto/zcrypt_cca_key.h
+++ b/drivers/s390/crypto/zcrypt_cca_key.h
@@ -219,6 +219,7 @@ static inline int zcrypt_type6_crt_key(struct ica_rsa_modexpo_crt *crt, void *p)
 	    copy_from_user(key->key_parts + 2 * long_len + 2 * short_len,
 			   crt->u_mult_inv, long_len))
 		return -EFAULT;
+	memset(key->key_parts + 3 * long_len + 2 * short_len, 0, pad_len);
 	memset(key->key_parts + 3 * long_len + 2 * short_len + pad_len,
 	       0xff, crt->inputdatalength);
 	pub = (struct cca_public_sec *)(key->key_parts + key_len);
diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
index d4ce6352b5b2..19909bf43dc9 100644
--- a/drivers/s390/crypto/zcrypt_ccamisc.c
+++ b/drivers/s390/crypto/zcrypt_ccamisc.c
@@ -1158,8 +1158,21 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
 
 	/* do not check the key here, it may be incomplete */
 
-	/* copy the vlsc key token back */
+	/*
+	 * Copy the vlsc key token back.
+	 * The available space in the destination (key_token) and the source
+	 * (t) buffer is always larger as the valid range of prepparm->kb.len.
+	 * Validate t->len by comparing it with the length information in the
+	 * param block of the request (prepparm->kb.len)
+	 * The value range of prepparm->kb.len has been checked above.
+	 */
 	t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token;
+	if (t->len != prepparm->kb.len - 3 * sizeof(uint16_t)) {
+		ZCRYPT_DBF_ERR("%s reply with invalid key_token length %u\n",
+			       __func__, t->len);
+		rc = -EIO;
+		goto out;
+	}
 	memcpy(key_token, t, t->len);
 	*key_token_size = t->len;