From nobody Sat Jul 25 18:53:16 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8BB0242DA29; Tue, 14 Jul 2026 23:22:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071339; cv=none; b=qmuigXfEInOIDOAz5rrl1vZVA6P52mwinKaJ4oxU+nkN9R+2/+nDyVui3WIsCKFkgal9mEEiJBnde5t30PnZynXJc30I85oRArvahn8I3K6Qd+F4kunNBL+pzy/5RrraACNx8edaX0nPEDuViIewkKx6mrGWi1NAR0i/lbnFeAI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071339; c=relaxed/simple; bh=n0LzOgDMKKopcnoAa2Witr0UJS29Rj+2RrqDEKY2eIM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=X4cbucXoIhaOr2v2VHVYldAl0cSoifhWU49hmcwkkgu+cD2YLFVDUe3d7e2/TVxlBSexUrPOncRoZ0z+8utJkFbAfvoXNA0kDh5+pcETISW/55651+0nIm/0tocPGgP3zPZE4WVjh+GOMSG3JTV8XgFfb2W2PTavct9PZ87XdlY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=pSFYx1HA; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="pSFYx1HA" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66EJBmpx2116371; Tue, 14 Jul 2026 23:22:17 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=xrfGuHNduIxh00NuU +zcXAaLn9SOXoYXyRh+TxevBu0=; b=pSFYx1HAi7J6myw+pEPuEaPfmatfqPbJx OaGVGOva1WQ7Ksj5nnBSrPmR+uPFp7bAt+YjrE8CSt/iV+ZChn/WwIqV/Nu2WyYA 00zRA5GFZyxJ9+qnjoTii4lDeFpU/A+cnhkwy2AQiD3zb/oExVXAy2ZJ43U14Qin HNTCUiTVNRrx0dgLlSM4XeYRJGyMIyuSXLKVSQ8Ku4pCy8igIj1K16NNZU864duJ 86T8EhhlrGjoroEqlXi+NctBWN8O9JX9Je4/duKqJp0x7gQAre59Lj49l2OaQNhQ XExjAHU8A1ydyU7YKJmH8DVauqnR0dLtqrNty//fl9KCGByQXQNkA== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbf2a86dw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:17 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66ENJg5F000379; Tue, 14 Jul 2026 23:22:16 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fc1nhd3nq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:16 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66ENMCYG21889312 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Jul 2026 23:22:12 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5ED5120049; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3FE9420040; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav06.fra02v.mail.ibm.com (Postfix) with SMTP; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 1E6BD16260D; Wed, 15 Jul 2026 01:22:12 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v1 1/6] s390/vfio_ccw: fix out of bounds check on CCW array Date: Wed, 15 Jul 2026 01:22:03 +0200 Message-ID: <20260714232208.1683788-2-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260714232208.1683788-1-farman@linux.ibm.com> References: <20260714232208.1683788-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfX9fR7JOnIjWFc 57O2WLU1tiLmG/PmmeKzf0csH8aKBQcG1cNL5vOZ4OrBP4pkGlSKB79BWgDRGZpdGtS7zKm2C8J ObGMw6dqbKPyv7Q9T+lFjXO7iu1pBW8= X-Proofpoint-GUID: gEChmZ9XFlrYps8-XIgC-kkpwze5kw5b X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfX5pVNQ202t3x8 tFGz1ciPrDQ3a126yJeLVCgUHau6XAnoZRQ9naGKEqN+p9ufBu4Hr22Ph0EfJl5548c0zdiC86K pXFkezGBSJEhGqVIjVpMzs/xtI+S0b0vciUPyV+jYfzZxHBZzPFg1MoQQ8ISZRviTz8n7lBx+q1 bK1lvdhZRFsQDHlFpbWYxyU6KcoqCqzV6vRMYv9FhYpwa/eFjg/My0eTGIV47JSh/Wn+aHeoy0O oLuq/WNZz7hPo5N3cifQOR1FXobkmPBQaSLv17gVdwUZnV6cR+HMnAmSQL3g/IgiMFpgqckaEdO h4/sKoayHbwLBoxJT/LI+vdCOD8LOsRGgiRw0xcGq3HdL6AMSJi4J6zWuC+tXNv786z0mJvUFTJ brQXH8TjLfwLsdZl5vMZ2X4Vq/41YNpDqfzdD29YaKaKWrfjQePFPrbeB8fsJVmDrvmwPojZwvo M4ZSxpb2sj+OtHe7Xsg== X-Proofpoint-ORIG-GUID: gEChmZ9XFlrYps8-XIgC-kkpwze5kw5b X-Authority-Analysis: v=2.4 cv=PvajqQM3 c=1 sm=1 tr=0 ts=6a56c4a9 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=Ztfy0_AA8xUuwmIluScA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-14_05,2026-07-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 bulkscore=0 impostorscore=0 adultscore=0 clxscore=1015 lowpriorityscore=0 spamscore=0 suspectscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607140240 Content-Type: text/plain; charset="utf-8" The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs. The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error. Fix this by limiting the loop to 256 CCWs such that only indexes 0-255 are examined. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 7561aa7d3e01..80c3d87f5482 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -393,9 +393,9 @@ static int ccwchain_calc_length(u64 iova, struct channe= l_program *cp) break; =20 ccw++; - } while (cnt < CCWCHAIN_LEN_MAX + 1); + } while (cnt < CCWCHAIN_LEN_MAX); =20 - if (cnt =3D=3D CCWCHAIN_LEN_MAX + 1) + if (cnt >=3D CCWCHAIN_LEN_MAX) cnt =3D -EINVAL; =20 return cnt; --=20 2.53.0 From nobody Sat Jul 25 18:53:16 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DA1842BE95; Tue, 14 Jul 2026 23:22:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071339; cv=none; b=H3WiHr0IypJAWCxkllnFCreMDTptNp27EJZX6oKDFsPyXZAAFYq5gobMv1lTdxd/nLCL6uAYpjxkMiUAWSfRzaCRleuCTeSKsjxlkrDEQKEXPQexCWQHV1g/pdZ0LLf3Cr/zcgFCYhgQJ3Spp7Xq0/7QQLysDJk/AVWhKgKXgeE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071339; c=relaxed/simple; bh=PVFcPV7a8IiGyZusUfGwMSC8/Qgs0elyNRsO6J94NS0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=t8lKavol8COV913wduVfNnqY+u0HWybv4ZZ7BexWuzNgndarCllQWDtSv21NZCnTPUT4Dt2ajXqc90TJmqestpjhjsYmUm4nJdKTWTjIhPWJlCAokapl2jIhubRgK1TOpBqPJ44IjZbE4u2DaUrQlXw0vkNKZ4DrG4lOihXG1GQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=c3xqPRQH; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="c3xqPRQH" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66EJBjW82198619; Tue, 14 Jul 2026 23:22:17 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=RvX3wjFVBiIFnX0eT yYT1jCPxHd6yorYubpelkCZmQ0=; b=c3xqPRQHV0QYu3pBeQUky66nlea7aqKFq vthgkXh6TcrAgp75HiQdbPZLgBYasLeDxDkpbOSkHJYS7ai+GO+E0pjZm2jIktW4 2dFHKExx5dIGVLmlecFEkcilic2soSmUCzLYqFFuYnx8JxiT3j2UunIKVwXhgRQc MgT6fofb6JB4uYvnnVWhuu5/CkI2YfUcHPLR2K+mgISuTPMeZCLLt5AmRjeHwNYt mm4Dq0FxY54oLznvweMujlYWgGqGhTcIwutiu81egNhz6SY0je8u0tba5EybFlHx dqHPTWgdadcw6wxOglIlk4jsH6w18ExfmPGEEBZyQwW/qA/DTpM/Q== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbepxgrq5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:17 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66ENJfYF012337; Tue, 14 Jul 2026 23:22:16 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fc2cgcyjr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:16 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66ENMCGq30998854 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Jul 2026 23:22:12 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 64E5C2004B; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 44BF820040; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav03.fra02v.mail.ibm.com (Postfix) with SMTP; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 25F2016267D; Wed, 15 Jul 2026 01:22:12 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v1 2/6] s390/vfio_ccw: limit the number of channel program segments Date: Wed, 15 Jul 2026 01:22:04 +0200 Message-ID: <20260714232208.1683788-3-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260714232208.1683788-1-farman@linux.ibm.com> References: <20260714232208.1683788-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: eHsTBQ8hmANsyNGgMB2SdWyhJnwqAZ_9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfXw5cyF8xOiRS2 avp3X5RC2VfsbN4LgZueytcIXjhvUVHxkx2pbyAkWxFb6vo8Xt7lqhzrND4IW+UKB5BelMHbwVa 8CmvchElmk0Qq/D+pBRHrcc7WmhIhkU= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfX4KvJinxMHbu7 P1dbyhQt/oGv7rUROwhI1u+8ItYbbd5OxLXqVwrGvqS0Qd360cFm/ViYYvBn70JJ1vnvlONQvBU eMfgkJ2KUx+j8Q3wOje68oIW3sPRcf4OGL8b+5kR1m7ZkLQ4nJtfaQCetMhWi4K75LKO3Zg7Ngu 2v8qSxoUBr15ayhE3uVgU1kHyfIFEvTZySWMXN9oGHklo7/KaFiucfVlZkdbrzaEkBkSyMaiYBl DHO5vts4ryYVCm9EMdPrL5vv+5zRtzo6dF95viWzwFEkIY/4VJ5OhqrO9+gYeRcyYOY9WMoJSAW F0cULeS8WG/Ax7J0hJc09PnvRi5gOzdbU/aoUIeWHDhdPQ4PphhhFPBDSavHUavCvGXRDNmY4Oi PkBfnJJSCIRe5OrCkYNnbwwNmGu5/T/dYHf8rIyn5FWoiddepBaLsJSE9I44bZi+OShG3xaGOiG 26XrVTZxCOP7eM8lQEA== X-Authority-Analysis: v=2.4 cv=XbS5Co55 c=1 sm=1 tr=0 ts=6a56c4a9 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=OzPGupj-Brq4hERWPoIA:9 X-Proofpoint-ORIG-GUID: eHsTBQ8hmANsyNGgMB2SdWyhJnwqAZ_9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-14_05,2026-07-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1011 suspectscore=0 spamscore=0 phishscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 malwarescore=0 impostorscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607140240 Content-Type: text/plain; charset="utf-8" The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 5 +++++ drivers/s390/cio/vfio_ccw_cp.h | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 80c3d87f5482..76632b18fc37 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -319,6 +319,9 @@ static struct ccwchain *ccwchain_alloc(struct channel_p= rogram *cp, int len) { struct ccwchain *chain; =20 + if (cp->ccwchain_count >=3D CCWCHAIN_COUNT_MAX) + return NULL; + chain =3D kzalloc_obj(*chain); if (!chain) return NULL; @@ -332,6 +335,7 @@ static struct ccwchain *ccwchain_alloc(struct channel_p= rogram *cp, int len) goto out_err; =20 list_add_tail(&chain->next, &cp->ccwchain_list); + cp->ccwchain_count++; =20 return chain; =20 @@ -731,6 +735,7 @@ int cp_init(struct channel_program *cp, union orb *orb) vdev->dev, "Prefetching channel program even though prefetch not specified in ORB"= ); =20 + cp->ccwchain_count =3D 0; INIT_LIST_HEAD(&cp->ccwchain_list); memcpy(&cp->orb, orb, sizeof(*orb)); =20 diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h index fc31eb699807..dc91a317ef19 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -23,6 +23,11 @@ */ #define CCWCHAIN_LEN_MAX 256 =20 +/* + * Maximum number of chains + */ +#define CCWCHAIN_COUNT_MAX 16 + /** * struct channel_program - manage information for channel program * @ccwchain_list: list head of ccwchains @@ -38,6 +43,7 @@ struct channel_program { union orb orb; bool initialized; struct ccw1 *guest_cp; + int ccwchain_count; }; =20 int cp_init(struct channel_program *cp, union orb *orb); --=20 2.53.0 From nobody Sat Jul 25 18:53:16 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D980429CEF; Tue, 14 Jul 2026 23:22:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071339; cv=none; b=PayPCtwU8xDJomit5Bf4J0uxpFIOtF1ZL0z0JmzC6SUlQzUW0YSSFGMg3hSYL874ZcCyCJkquEE+N1alq+FFb6L1y035i79HG6rl+cEfBMp7Qot0KVHFHBZZr2MrXvpHeWaMBzJ50F6y6e2oRKw+JdEZfDXC2Un4D5IP0JmfKO0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071339; c=relaxed/simple; bh=hfcmFiET0c7i390IMGXjeWY367lf2ahcVbfMkMo5sJs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IZ8kjFdrfAK6L5iFy09jJUlrqrXxehsNqKwtFwPq2k8Voektq/OF0SsX7QgpLzmhhdH7m7JBHEYPUNiGGEMI0KpfpEYVdYMF7MEVQaw+gHh8CVKEwsAcAY36FnzN+TmkET0rbCljXf6oml7Atfr7uRUvnF8INlE/u4ts0EqR3FQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=W8QMqYKu; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="W8QMqYKu" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66EJCber303757; Tue, 14 Jul 2026 23:22:17 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=IuAPCEwGsXTZACmaF feSITIpKFmRoyRnCy9SontkZ9Q=; b=W8QMqYKu7cLWQb19rqmObelCoAK97MUbS sWDVuH35DBv1EvrzPXfTvFpC92SIlFxDKL27wbn9hwQSuw7z44l+6HoCGOVoOxE2 xlk2k1Jo/kqNA9xPfayl6HprVpYZ+HEdzBBSVWTgSFIdOmvqY7GD21cSQH7n3lqF tQ41TsR6BWIiAibTDJbgF3isYCXm/x+ElVidDyrMfsk4ZVF7yEZ/egCQBQi103lT /QhW4m+aHtOs3f1gzb9YUnrLUG1x2uqycxzjoo/7SLGCainWHwmg8Uq5c2gusCXL sf4JFXBpYSJ2+/33gg+KUM4SieryyXR2PhH+Hbl2amczQmD0ms9lA== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fcv339a7j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:17 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66ENJdqd023960; Tue, 14 Jul 2026 23:22:16 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fc2uy4vrd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:16 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66ENMC9r29360628 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Jul 2026 23:22:12 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 694912004D; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 489A920043; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav03.fra02v.mail.ibm.com (Postfix) with SMTP; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 2E092162688; Wed, 15 Jul 2026 01:22:12 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Farhan Ali Subject: [PATCH v1 3/6] s390/vfio_ccw: free all memory if cp_init() fails Date: Wed, 15 Jul 2026 01:22:05 +0200 Message-ID: <20260714232208.1683788-4-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260714232208.1683788-1-farman@linux.ibm.com> References: <20260714232208.1683788-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfXwdv6a80xG4rh xkIxKAQSakSI4LsXm5c3lZhiYNb86xqoILhGtgO/S8awBAtnk9OxEhlFUjTm9fFaZBONMIVwHUm zXNqMXE6QJJPeuT53MTSRfNeXlAcUzs= X-Authority-Analysis: v=2.4 cv=Mp1iLWae c=1 sm=1 tr=0 ts=6a56c4a9 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=WEmllObKAWPfCt-5-jUA:9 X-Proofpoint-GUID: E-WMP9X3K04AAuVWdf3twjAFQlb2L7_g X-Proofpoint-ORIG-GUID: E-WMP9X3K04AAuVWdf3twjAFQlb2L7_g X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfX1s7WT5QCetbk p3mTkRQGLHP+geSGair1n/ni99hHQFqRhfUu3/ly0IscjlFniq+8kvasj4Fxb7aLjRbqpgBlO1K kyv8y0+osHL1cMX2avE+f4xJC3yugXw5qslTVekdXMN+V4+92A7UTwgFxSkGB9rJgFQxAgAE0+V ohhpKrpVsG5mYkyu5g5FNGRH8QlAKnvARVoLx54avfpdC7be7IQlWeJeWsRAKknrA4jXNMD0N/q bOo+6NA6I2FGMBsd4QWRXQW88kVtl9Hl7niRFT3wRC/xPr+z7tzSz4/xNnsCNkX35E2j9hfkmUa kTGvW9qSXP2Zww/++OxTRdsMfJJmScsyJwt2wfPa/DJ5FFSwNNvoMy75dqJPh076y5Mqu1KVahD j5r3t73JMs3QZLqXE/R7uyDJep44r/9YB1xTuwh8cYV9zxM7Vz4vV01MunCC2LeCvtrvXmqP0am n07Yc8NFWESJWSFe+dQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-14_05,2026-07-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 bulkscore=0 spamscore=0 malwarescore=0 lowpriorityscore=0 impostorscore=0 priorityscore=1501 suspectscore=0 clxscore=1011 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607140240 Content-Type: text/plain; charset="utf-8" The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic. Fixes: 8b515be512a2 ("vfio-ccw: Fix memory leak and don't call cp_free in c= p_init") Cc: stable@vger.kernel.org Cc: Farhan Ali Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 76632b18fc37..74b1f25e01e7 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -459,9 +459,6 @@ static int ccwchain_handle_ccw(dma32_t cda, struct chan= nel_program *cp) /* Loop for tics on this new chain. */ ret =3D ccwchain_loop_tic(chain, cp); =20 - if (ret) - ccwchain_free(chain); - return ret; } =20 @@ -490,6 +487,23 @@ static int ccwchain_loop_tic(struct ccwchain *chain, s= truct channel_program *cp) return 0; } =20 +static int ccwchain_build_ccws(dma32_t cda, struct channel_program *cp) +{ + struct ccwchain *chain, *temp; + int ret; + + ret =3D ccwchain_handle_ccw(cda, cp); + + if (ret) { + /* Cleanup if an error occurred */ + list_for_each_entry_safe(chain, temp, &cp->ccwchain_list, next) { + ccwchain_free(chain); + } + } + + return ret; +} + static int ccwchain_fetch_tic(struct ccw1 *ccw, struct channel_program *cp) { @@ -740,7 +754,7 @@ int cp_init(struct channel_program *cp, union orb *orb) memcpy(&cp->orb, orb, sizeof(*orb)); =20 /* Build a ccwchain for the first CCW segment */ - ret =3D ccwchain_handle_ccw(orb->cmd.cpa, cp); + ret =3D ccwchain_build_ccws(orb->cmd.cpa, cp); =20 if (!ret) cp->initialized =3D true; --=20 2.53.0 From nobody Sat Jul 25 18:53:16 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 025CE43C7A9; Tue, 14 Jul 2026 23:22:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071342; cv=none; b=Xt8dJwgJBqlNa/35d5ZnzCsdNdB1MbjbN5nOywIodlqQ4tLoTwch+skrFUQA0x2OBfivRenH57HNDg6VZR3J3QeUP/RuKTbV3Epdpp1a/w93IXSjt8Y+de8NPl6gJ3EVjErhGCXwdTCEr3iJSd1PBlV5Y/SXIuuQyW2zUNEEItY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071342; c=relaxed/simple; bh=Q+hbXoUx0F7pcykeJlh2c0SpyA8vm9Qsm45sZuopJCY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hWPnE3yIxTeIlH7YmHtoXYSQAGucpTiAzTzAPjdeEJpXbI6oHo7XT283p2va15vJxzbElvQngKupvZjTNSS1ocuZUtgM+pPTs+nAPvSFUWqoJ5A0taLgfthNxw7v0O/TOlXLXLa4R9Alrx3NnAaohtxjFCMUzNDutmcvmlYfozA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=ErhGBq7n; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="ErhGBq7n" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66EJBt8u2204369; Tue, 14 Jul 2026 23:22:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ccziabsZM79oRI5AN v0Tq/iZ559LaXNnkrwPlnCtX+E=; b=ErhGBq7n7wl+uAp1k+z0boFAbHH4maAoJ ORDaowDNQX0QkAWIsmDPoZqthYSlVawPs37BYzt6d1pG6dzjj5JsAgsxVwrxzDlO VJK3NVww3ZOYQ/o05s61Dx6vka5FMVFzvP33RNecSirRW3wZiO3kcCnDDZ1/WhZH c99IFzHbUghP3zwFXKXXmCtXTcSZoPojkAD7adeASK8WARcrAKxZWDnbyImPwk0e nje8HGjc7GC5hvi9O2FvEOAovMWWf1U0058FmG9XnnXQRsZjmEHnM6g7egfXUgS0 mYqxs29mXrE0Q4PGhk/Br+2s4K5mi2TdfJkvRysrweO4fuiASKNMA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbegt8tbq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:20 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66ENJlKN011611; Tue, 14 Jul 2026 23:22:19 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fc15jw6ga-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:18 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66ENMCep52691264 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Jul 2026 23:22:12 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7E7042004B; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 552FA20040; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav04.fra02v.mail.ibm.com (Postfix) with SMTP; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 35FD916268A; Wed, 15 Jul 2026 01:22:12 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v1 4/6] s390/vfio_ccw: copy maximum possible IDAL from guest Date: Wed, 15 Jul 2026 01:22:06 +0200 Message-ID: <20260714232208.1683788-5-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260714232208.1683788-1-farman@linux.ibm.com> References: <20260714232208.1683788-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: r1zk0LttwhNH376GZYBhABMaQrcZzBN8 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfX/ENrylagSzO2 JCMYhGhfQTfPt3SAnBIMhxNs7XcTrW89heLo3C3TjiZQ0sueFwFfHaCBMB6Fhancd3Z6lOjhk0m FS7A+5eLYxszWxv8EbDbqoIt6EuIzos= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfX3rGPIXkjD1Vr inIxVU6FCmiSzkJlUGHZcz4bwCwEse2TyG7FExlwzN5chJs3eBAYWDIne9dzybp0foQVjCHNwlt 5JUKd65KcsKYOU2KNBvm/SnmI5kNCCLjn9ufSbyL7NEgqA69rUkNxfejAXBntE/2l2q87NdB7zP erZ5Ue6svQTg0s/SvO0PdAeRlAi+o7pdPFqijEl0PDAm/238gIxV3izpXipIp0mkx5MZaiXmoMI W4pW3TLQxLxvbHUqyY6pGWz79jkxVylkQ6TSulDfR50kliF3tlFO0p9LNrAhBa0IoXW0I0OMgmi vv5d4VFa2HvnbWz6hIPRnU0r3/5wvNWEfsO/6rTwNJYRpKZlVCSLA/kq+ymTju+JszKMtXyobe1 iNK4sRutMZcw/1PkPfvebvVYzQOo2nHlGaLfvyVp1lAdA+QTRnZceyMDgXv6zNRpWn5fWRBY2xr 4Hm6vQTPEJ8LrGyjbkQ== X-Authority-Analysis: v=2.4 cv=IqMutr/g c=1 sm=1 tr=0 ts=6a56c4ac cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=HebK68l7YlEq7TR_RnQA:9 X-Proofpoint-GUID: r1zk0LttwhNH376GZYBhABMaQrcZzBN8 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-14_05,2026-07-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 clxscore=1015 impostorscore=0 malwarescore=0 adultscore=0 phishscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607140240 Content-Type: text/plain; charset="utf-8" An Indirect Data Address word is always 2K/4K aligned (depending on format/type), except for the first word in a list. This unaligned word makes calculating the number of addresses in a list challenging. The current code attempts to be efficient about this by reading the first word before making its calculations, but it introduces inefficiencies trying to do the math on supposedly equal values. Since an IDAL list cannot cross a 2K/4K boundary, copy the maximum possible list in a way similar to guest_cp, and use that as the source for populating the host IDAL. Fixes: 01aa26c672c0 ("s390/cio: Combine direct and indirect CCW paths") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 27 +++++++++++++++++---------- drivers/s390/cio/vfio_ccw_cp.h | 1 + drivers/s390/cio/vfio_ccw_ops.c | 9 ++++++++- 3 files changed, 26 insertions(+), 11 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 74b1f25e01e7..dac53e26509e 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -523,16 +523,24 @@ static int ccwchain_fetch_tic(struct ccw1 *ccw, return -EFAULT; } =20 +static int calc_max_idal_len(struct ccw1 *ccw, struct channel_program *cp) +{ + int idal_size =3D idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE; + int idal_mask =3D ~(idal_size - 1); + int idal_len =3D idal_size - (ccw->cda & ~idal_mask); + + /* This overestimates for Format-1 or 2K-Format-2 IDAWs */ + return idal_len / 8; +} + static dma64_t *get_guest_idal(struct ccw1 *ccw, struct channel_program *c= p, int idaw_nr) { - struct vfio_device *vdev =3D - &container_of(cp, struct vfio_ccw_private, cp)->vdev; dma64_t *idaws; dma32_t *idaws_f1; int idal_len =3D idaw_nr * sizeof(*idaws); int idaw_size =3D idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE; int idaw_mask =3D ~(idaw_size - 1); - int i, ret; + int i; =20 idaws =3D kzalloc_objs(*idaws, idaw_nr, GFP_DMA | GFP_KERNEL); if (!idaws) @@ -540,11 +548,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struc= t channel_program *cp, int =20 if (ccw_is_idal(ccw)) { /* Copy IDAL from guest */ - ret =3D vfio_dma_rw(vdev, dma32_to_u32(ccw->cda), idaws, idal_len, false= ); - if (ret) { - kfree(idaws); - return ERR_PTR(ret); - } + memcpy(idaws, cp->guest_idal, idal_len); } else { /* Fabricate an IDAL based off CCW data address */ if (cp->orb.cmd.c64) { @@ -586,7 +590,7 @@ static int ccw_count_idaws(struct ccw1 *ccw, struct vfio_device *vdev =3D &container_of(cp, struct vfio_ccw_private, cp)->vdev; u64 iova; - int size =3D cp->orb.cmd.c64 ? sizeof(u64) : sizeof(u32); + int size =3D calc_max_idal_len(ccw, cp); int ret; int bytes =3D 1; =20 @@ -596,10 +600,13 @@ static int ccw_count_idaws(struct ccw1 *ccw, if (ccw_is_idal(ccw)) { /* Read first IDAW to check its starting address. */ /* All subsequent IDAWs will be 2K- or 4K-aligned. */ - ret =3D vfio_dma_rw(vdev, dma32_to_u32(ccw->cda), &iova, size, false); + ret =3D vfio_dma_rw(vdev, dma32_to_u32(ccw->cda), + cp->guest_idal, size, false); if (ret) return ret; =20 + iova =3D cp->guest_idal[0]; + /* * Format-1 IDAWs only occupy the first 32 bits, * and bit 0 is always off. diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h index dc91a317ef19..f33fea569b14 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -43,6 +43,7 @@ struct channel_program { union orb orb; bool initialized; struct ccw1 *guest_cp; + dma64_t *guest_idal; int ccwchain_count; }; =20 diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index 45ec722d25ea..afe9448c165e 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -55,9 +55,13 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vd= ev) INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo); INIT_WORK(&private->crw_work, vfio_ccw_crw_todo); =20 + private->cp.guest_idal =3D kzalloc_objs(dma64_t, 512); + if (!private->cp.guest_idal) + goto out_free_private; + private->cp.guest_cp =3D kzalloc_objs(struct ccw1, CCWCHAIN_LEN_MAX); if (!private->cp.guest_cp) - goto out_free_private; + goto out_free_idal; =20 private->io_region =3D kmem_cache_zalloc(vfio_ccw_io_region, GFP_KERNEL | GFP_DMA); @@ -89,6 +93,8 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) kmem_cache_free(vfio_ccw_io_region, private->io_region); out_free_cp: kfree(private->cp.guest_cp); +out_free_idal: + kfree(private->cp.guest_idal); out_free_private: mutex_destroy(&private->io_mutex); return -ENOMEM; @@ -141,6 +147,7 @@ static void vfio_ccw_mdev_release_dev(struct vfio_devic= e *vdev) kmem_cache_free(vfio_ccw_cmd_region, private->cmd_region); kmem_cache_free(vfio_ccw_io_region, private->io_region); kfree(private->cp.guest_cp); + kfree(private->cp.guest_idal); mutex_destroy(&private->io_mutex); } =20 --=20 2.53.0 From nobody Sat Jul 25 18:53:16 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DAF4D432E65; Tue, 14 Jul 2026 23:22:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071341; cv=none; b=CxlZ3uWAjAJRQGenpEsx95B7+uApuAX22dfjrPKyKumQNv7MGPsHbQdEwbk/ORnWSVCgFTw3KwpPP7OpHb2Ui+zHFgh7XSppxbZaJ4YKQrRJf19u0AU0HRSWUvCSwcaMZcuDyqNPte6+CkzvsBSq7NhFCGIJ+O5DBDTR14DEqbM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071341; c=relaxed/simple; bh=+dQJHwcpPhcQ39+zN0yn2WjwZnnTaOfmxyTXqx8SwUA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Om+20CqTPch7h2SPoo00ulBRooeDB7RM275mcNeePXirAxkWFPUK1xMUAuxA6G66KjV8hueamvkkhCt11wWuDWl/pod71qZkwsUNpMVN/+7oic1pJrsy8o+bjF7V9b9EyaSBGNT6VsCR4Ofps+SDZJTvhjTw7h31lOD7jjiHS2w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=KHRqBIpy; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="KHRqBIpy" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66EJCVRq2113614; Tue, 14 Jul 2026 23:22:17 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qSxpN/yHz7NAbOad3 2x3gCAAoTw5b1MeWiMwtVjtpTM=; b=KHRqBIpyUAOIhBiRvSXH2HmjudFhE19FA Fxwjdu3TdJWot9wDUZySyQ3kXJ60e90maAG2NolCRwdx7AyejG0UNvDS9X17nWpQ M+SaLjXxj8ferIIV4MGUOozi4WYtaNha3vsdpeQzNxrHIRrJwBiY4rJ4yJ5GgHz5 Kz0EaOHT6DUe9EkcMq+An/cPcQu4Jq8vd9v7OI1VfDAySJBLeB4kyjYgqUjL/BXG EEfYDvsLlHN5PfuPafum3eQD10zwJ0EgPWWzZQbrDYmg5/jeSOXzjMym9W8FBcNd isR1O+qqaaw6lrELEryR01wkmrpslahLvu2b6ezhVcaD1JBYSVHQw== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbexwr556-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:17 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66ENJevW000363; Tue, 14 Jul 2026 23:22:16 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fc1nhd3nr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:16 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66ENMClE52035952 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Jul 2026 23:22:12 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A293A20040; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7675D20043; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav04.fra02v.mail.ibm.com (Postfix) with SMTP; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 3BDC61626B7; Wed, 15 Jul 2026 01:22:12 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Cornelia Huck Subject: [PATCH v1 5/6] s390/vfio_ccw: ensure index for read/write regions are within range Date: Wed, 15 Jul 2026 01:22:07 +0200 Message-ID: <20260714232208.1683788-6-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260714232208.1683788-1-farman@linux.ibm.com> References: <20260714232208.1683788-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 2KxYvocmsUQiSVpWZibSJYXIgp5dNyOc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfXzwe7zvYYLdgY YXBLd31mK7iJi9VqjwSQtz8BNwZCCRi+A7mSFNr5IDZ+DSS773CRwJo3URyTWgSvB6wGIwTw6fc KWM/63eu9gKhxina63N0rn10Rxw/2FBvkxIzA3dABtIyUQ/iy50VWyG3M0R3mXUk40i4ybGaszv 6odwvVKL4y7+ZlI5tlFeTFMQh2puTkABwJzuUpCuWXEiIJv3oayLNV7yozG3ft/VMut0q6s+IgO Jt9SWn4g5PdOf4ObmVJNmNWchrOuST66toyWvHpXqOy0amjBtBUloQeogQwTGV8AMqKgVuTc/T7 2Kaz/ukjoUamD47TqZhmJbmOkC7s8Nsyk4FZYJUJm5GScLaY/477JIPfE9HC36jVE+4kUx7jm+l PiHxlkrnSx2hbIG0b0LXH43sR+TwwyI6QJIROYyoCkCc/fi+WxsT1Xg5crDwCGfcA6QtNVbdDQw 2qpgy71lHj+++vGRaLw== X-Authority-Analysis: v=2.4 cv=XJoAjwhE c=1 sm=1 tr=0 ts=6a56c4a9 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=0bsjUvYyXMjrvzAobP8A:9 X-Proofpoint-ORIG-GUID: 2KxYvocmsUQiSVpWZibSJYXIgp5dNyOc X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfX4aux7ccCGEFK wMYMNzGcqqX0EKuV0dPd9hurOXRdL78tC93jjIdHksXsVXCM/Liy/TM6bTyi+8faqMFQDz7Ixwr HXBpoE40VeEQqUiJh3Fg5SodwDM84NE= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-14_05,2026-07-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 bulkscore=0 phishscore=0 lowpriorityscore=0 priorityscore=1501 impostorscore=0 clxscore=1011 spamscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607140240 Content-Type: text/plain; charset="utf-8" The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced. Fixes: db8e5d17ac03 ("vfio-ccw: add capabilities chain") Cc: stable@vger.kernel.org Cc: Cornelia Huck Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_ops.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index afe9448c165e..63cf5850bd50 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -245,6 +245,8 @@ static ssize_t vfio_ccw_mdev_read(struct vfio_device *v= dev, if (index >=3D VFIO_CCW_NUM_REGIONS + private->num_regions) return -EINVAL; =20 + index =3D array_index_nospec(index, VFIO_CCW_NUM_REGIONS + private->num_r= egions); + switch (index) { case VFIO_CCW_CONFIG_REGION_INDEX: return vfio_ccw_mdev_read_io_region(private, buf, count, ppos); @@ -297,6 +299,8 @@ static ssize_t vfio_ccw_mdev_write(struct vfio_device *= vdev, if (index >=3D VFIO_CCW_NUM_REGIONS + private->num_regions) return -EINVAL; =20 + index =3D array_index_nospec(index, VFIO_CCW_NUM_REGIONS + private->num_r= egions); + switch (index) { case VFIO_CCW_CONFIG_REGION_INDEX: return vfio_ccw_mdev_write_io_region(private, buf, count, ppos); --=20 2.53.0 From nobody Sat Jul 25 18:53:16 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA54243B6E1; Tue, 14 Jul 2026 23:22:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071342; cv=none; b=oaV15Q5kzD8PPBBvV14lKRMz36eiC21HArr1m9wFwY/+tQloxue12tgC6j2ofRFtDRLbh+dc27LexwcN22bFP7xbHaGXs9UKh3KS8PXrDaOkwXcH9BL98VGUCU0n4K9+YPq8olk4cJQxBMS9HyuTbAYiWZ7QAKO+jEcJ5mlKPcs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784071342; c=relaxed/simple; bh=P3XWV1htfv/+pnaxzwiBMyLNA7sp2LcefcxT5gFJCTY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NqXGivDOtTw0jgPBZDrgR8DTNaLc3+Uc7luogpKkuVn/YGTQvmCz2780yF1cNQrUnRFRAi5cL8HCw7QQOs+29PkCfeTFXFgeXutx88bzjJ5rDAz819gVFWs42sShZc5QKgdoWs7QWtGpLezS21eXZ/x+VYdqvR2FRX/VuINYH1c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=L0h9C13O; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="L0h9C13O" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66EJBmie2116414; Tue, 14 Jul 2026 23:22:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=jdj62yyVkb6OFhQmM MbgfgBqscDlThLxK9g+9kNIuAk=; b=L0h9C13O1f7T2SYHkmbBwujc0Nyzckw1T QOlRIXE04zlEH9LnyErWAPQxyRnzbOySndlwJ/q8RVhhAhpjckGhaftRbewHRaBO iTn25MJAnPcmkDRNEZtfP0gU6uXvPtxaxf4n+BF0hyBhG/JTxhUfXm1CYWfGnYRW zpr0l9lWUM9rexegNJ6rss7Uo64YUYY5KCNtlW33y3MxOdRS/5NRdmU8NAxhb/Vx NN0jETUUlfxrC032d5Gu8NHVBCPpWQdg75lr3GoiS75KNzSZLbJ6n+4vE/ldYW2g dhObNG2ck/kmVhY+QiV0xR2xBf5q6k0hx2+0DEFXef19l7RKzQ6qw== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbf2a86e3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:19 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66ENJf3g011560; Tue, 14 Jul 2026 23:22:18 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fc15jw6g9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 23:22:18 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (smtpav05.fra02v.mail.ibm.com [10.20.54.104]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66ENMC7P48562512 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Jul 2026 23:22:12 GMT Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 98D0620040; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 745DA2004B; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav05.fra02v.mail.ibm.com (Postfix) with SMTP; Tue, 14 Jul 2026 23:22:12 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 437E11626C4; Wed, 15 Jul 2026 01:22:12 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v1 6/6] s390/vfio_ccw: lock I/O resources alongside I/O regions Date: Wed, 15 Jul 2026 01:22:08 +0200 Message-ID: <20260714232208.1683788-7-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260714232208.1683788-1-farman@linux.ibm.com> References: <20260714232208.1683788-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfX3T2hzZ5ZuHRS fa5ul8XyJISItb3qHjmBrVku8xkxX3rJi+131B/udsYUaF7bctX0ISVIf/VP822rEG8mYmoOfR3 WkJV2nNdmAg9/PXlZ+ptB3mCF5L6HoE= X-Proofpoint-GUID: -aIfqjlLJgtxEpBs-PbIy1JAf2pymKLe X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE0MDI0MCBTYWx0ZWRfX60mjDU47PK4V LkiD/F+kGtgOGQV5gzz3h4vmLNx3akyzbw09KYXTv4PdzddEbUa2WA8ztBk4mPv7vtrzQIG0Pkw XLrzVk23N30CXFZ6lWeREBW0twhrce/AQBMh3EllrCIJrYpERfDKAEH6JNvRJkBc7PQhswxR3uj BMeEnjcnrIvDFSg/iO0VIwKIvLVJnGe/9vkeFUmQYQEp54E82oIOmHs6OsZUuDAO5i/3D3ladCL TW1be0qwdiOeHjk1cn5gKcU/1LXClNKk8W6knV/rRQhnzB+RCWuwhaDGJbryi70DgwjU8o0tZDg Z8TFzIgJ5mRypA9Tzs03fFvLGOwGX7YnW88etc9jDLIVSeoi/gOdPy6dkgcxIObezm3pRXY9dL5 XBnH3buWwNrBj7AXitKJpg5TKv/cDobr12w8ShLbB0g+qTrQ0j0/CsTumiNDopzxHORQ+oOacH7 M6m6vW/EUacX9QyP1Lg== X-Proofpoint-ORIG-GUID: -aIfqjlLJgtxEpBs-PbIy1JAf2pymKLe X-Authority-Analysis: v=2.4 cv=PvajqQM3 c=1 sm=1 tr=0 ts=6a56c4ab cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=KyaCFF8TlgOd3ial2BYA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-14_05,2026-07-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 bulkscore=0 impostorscore=0 adultscore=0 clxscore=1015 lowpriorityscore=0 spamscore=0 suspectscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607140240 Content-Type: text/plain; charset="utf-8" The memory regions shared with userspace for vfio-ccw operations are correctly accessed under a lock, but there are a handful of related structures that are associated with the same lifespan of a given SSCH (and thus the written-to memory region). Some of these cases are done asynchronously from the guest (e.g., hot-unplug of a device or channel path event), and so should be protected in some similar way. Since a subchannel can only have one I/O active at a time, redefine the I/O mutex from protecting the region, to all the resources associated with the I/O. Fixes: 4f76617378ee ("vfio-ccw: protect the I/O region") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_chp.c | 2 +- drivers/s390/cio/vfio_ccw_drv.c | 2 ++ drivers/s390/cio/vfio_ccw_fsm.c | 5 +++++ drivers/s390/cio/vfio_ccw_private.h | 2 +- 4 files changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_chp.c b/drivers/s390/cio/vfio_ccw_ch= p.c index 38c176cf6295..872620a9488d 100644 --- a/drivers/s390/cio/vfio_ccw_chp.c +++ b/drivers/s390/cio/vfio_ccw_chp.c @@ -90,13 +90,13 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_ccw= _private *private, if (pos + count > sizeof(*region)) return -EINVAL; =20 + mutex_lock(&private->io_mutex); crw =3D list_first_entry_or_null(&private->crw, struct vfio_ccw_crw, next); =20 if (crw) list_del(&crw->next); =20 - mutex_lock(&private->io_mutex); region =3D private->region[i].data; =20 if (crw) diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_dr= v.c index 1a095085bc72..385af7daca3b 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -292,7 +292,9 @@ static void vfio_ccw_queue_crw(struct vfio_ccw_private = *private, crw->crw.erc =3D erc; crw->crw.rsid =3D rsid; =20 + mutex_lock(&private->io_mutex); list_add_tail(&crw->next, &private->crw); + mutex_unlock(&private->io_mutex); queue_work(vfio_ccw_work_q, &private->crw_work); } =20 diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fs= m.c index 4d7988ea47ef..96f23da88a39 100644 --- a/drivers/s390/cio/vfio_ccw_fsm.c +++ b/drivers/s390/cio/vfio_ccw_fsm.c @@ -171,7 +171,9 @@ static void fsm_notoper(struct vfio_ccw_private *privat= e, private->state =3D VFIO_CCW_STATE_NOT_OPER; =20 /* This is usually handled during CLOSE event */ + mutex_lock(&private->io_mutex); cp_free(&private->cp); + mutex_unlock(&private->io_mutex); } =20 /* @@ -410,7 +412,10 @@ static void fsm_close(struct vfio_ccw_private *private, =20 private->state =3D VFIO_CCW_STATE_STANDBY; spin_unlock_irq(&sch->lock); + + mutex_lock(&private->io_mutex); cp_free(&private->cp); + mutex_unlock(&private->io_mutex); return; =20 err_unlock: diff --git a/drivers/s390/cio/vfio_ccw_private.h b/drivers/s390/cio/vfio_cc= w_private.h index 0501d4bbcdbd..8f3792fdd31b 100644 --- a/drivers/s390/cio/vfio_ccw_private.h +++ b/drivers/s390/cio/vfio_ccw_private.h @@ -88,7 +88,7 @@ struct vfio_ccw_parent { * @state: internal state of the device * @completion: synchronization helper of the I/O completion * @io_region: MMIO region to input/output I/O arguments/results - * @io_mutex: protect against concurrent update of I/O regions + * @io_mutex: protect against concurrent update of I/O resources * @region: additional regions for other subchannel operations * @cmd_region: MMIO region for asynchronous I/O commands other than START * @schib_region: MMIO region for SCHIB information --=20 2.53.0