From nobody Sat Jul 25 01:52:22 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C657226B2DA; Mon, 20 Jul 2026 20:19:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578780; cv=none; b=F/uocrynpTWGqc5j9KxetGRWgGODReKAVIQmQPveh6wHExHWpXya6mc/FI9X9HAW/b+/Kc3vo4ik7Hvevi0zwiPwfhsUUF4ThTwqRHzTljStZ5luvtAZoSFGyOxTTT1l31u2HdV/kmdaSkDuJEVVJ2K3RLo0ho0mIk1wsc7H5ho= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578780; c=relaxed/simple; bh=Zk2Yn6BTowlC+vcUBVGFBCS0CLRUwNTuozzVXVqsUJU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Z3rhFar40ru8yph+udNtqbWLucYauh2CrxxuZnPmhrDL/uo+eBjM3wYh4I1/aKt24CroWykf74ccU7HAnlvWF1PNDszYrUsBqy33YJf077UuyOBq1P2hmASnfXtbR93EDiuzXo0Q/J7kBxoPQocKQ4Osv20+PxDQV0pP0INaysI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=hzm+NSbD; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="hzm+NSbD" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KJfrMJ3124864; Mon, 20 Jul 2026 20:19:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ewyopON62ciA3L3OE cO2ShzrjKIHIEii141lYvtUvAw=; b=hzm+NSbDdomgPFWfPKfKCe6OMJ9fJY/LW 9Vco6lZEI4RRXaO9UxAd6uF9IIWFB7ZFiK3W3RLsw9uBlDyyiTK14/5KesUG2N/1 lqJ4AA98XpHTxkGRD03AhgJEd5dFv5sjcQK6zQhnsgzVHkUwrZkL0Krd6SJgBvu4 KVjKcaOvzirpQNmMDzGAWSaJlzmAG618u2ukHSiTM2IKrhB7t6XS21uQ+Yc6MrNT 168AIlreJ8UXPgl58ujgUnkVJA4M/0q9xSu9jC4kYGXiQzESKGoOTLXAanrp454E Desd9QQ9GasZBu6R4COgRiZMzw4Xag281wu66u8S1mbFHPtuXs+vw== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7ab9c6h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:37 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66KKJbje015415; Mon, 20 Jul 2026 20:19:37 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1g7174-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:36 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (smtpav05.fra02v.mail.ibm.com [10.20.54.104]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66KKJXBC46727472 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 20 Jul 2026 20:19:33 GMT Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0320120043; Mon, 20 Jul 2026 20:19:33 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D102120040; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav05.fra02v.mail.ibm.com (Postfix) with SMTP; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id B7800162719; Mon, 20 Jul 2026 22:19:32 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Farhan Ali Subject: [PATCH v2 1/7] s390/vfio_ccw: free all memory if cp_init() fails Date: Mon, 20 Jul 2026 22:19:25 +0200 Message-ID: <20260720201931.976660-2-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260720201931.976660-1-farman@linux.ibm.com> References: <20260720201931.976660-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX7OfIni89QOns fWchE2G2MM9Er0K2zy8GwypYvaEYPdk5GRJUkCLUHNbKSv+gHsjbNGkcwsRa6xqb+MYpHHlTNeU ZudRqN9uhvQ/KWl8tTxkP8m65U3zFPTCQ8mGOeBuA3EWJm/0BQnuIGCh4obfgsy99CHmqi889y5 yGeSW0BU4yw1QNR5hYolhvTQ3aFmiy4zg4C0H1urnj0ARwjT0d+OBUSRsUwZzDGWWPjopi098S2 ZqVj9Bh7wpZ+qTse3w+bhF78G3/sWvwwyCF+9E+zZSuR5i36XUua0fDj3EYb8v0RVw7oBhFeLGy u/SRK0q4JRikVOalKr+zamxh4+Dq5Jtzr/EG4xBNsg1tUK7/T/sKOSS5XdOdYkkFGV/1x9urkwO m/+ns9pfE9r2JeQ8J8sUBrELNPXen3Z7EMRvlk9bAZhiQ13vARGRinCi7YnNqrhzM99ps+VTL4i uzEDIROkYWZE8iHJROg== X-Authority-Analysis: v=2.4 cv=F7ZnsKhN c=1 sm=1 tr=0 ts=6a5e82d9 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=WEmllObKAWPfCt-5-jUA:9 X-Proofpoint-ORIG-GUID: uD7PyJc6TKtwA2v9CSD8T4ej1_56JI6D X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX1bswP7q6gQNG oS3QDdfewdrv8fRsswh7Gcp7tNmuJvOEXOJjdFZk9IYx6RyistNExsP+MAxDm1AJOYruwQ9XKA8 m6h1KCl9CtsSSPYS46kUZBz0xgAwhIU= X-Proofpoint-GUID: uD7PyJc6TKtwA2v9CSD8T4ej1_56JI6D X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_05,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200220 Content-Type: text/plain; charset="utf-8" The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic. Fixes: 8b515be512a2 ("vfio-ccw: Fix memory leak and don't call cp_free in c= p_init") Cc: stable@vger.kernel.org Cc: Farhan Ali Signed-off-by: Eric Farman Reviewed-by: Farhan Ali --- drivers/s390/cio/vfio_ccw_cp.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 7561aa7d3e01..086d1b54bdb0 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -455,9 +455,6 @@ static int ccwchain_handle_ccw(dma32_t cda, struct chan= nel_program *cp) /* Loop for tics on this new chain. */ ret =3D ccwchain_loop_tic(chain, cp); =20 - if (ret) - ccwchain_free(chain); - return ret; } =20 @@ -486,6 +483,23 @@ static int ccwchain_loop_tic(struct ccwchain *chain, s= truct channel_program *cp) return 0; } =20 +static int ccwchain_build_ccws(dma32_t cda, struct channel_program *cp) +{ + struct ccwchain *chain, *temp; + int ret; + + ret =3D ccwchain_handle_ccw(cda, cp); + + if (ret) { + /* Cleanup if an error occurred */ + list_for_each_entry_safe(chain, temp, &cp->ccwchain_list, next) { + ccwchain_free(chain); + } + } + + return ret; +} + static int ccwchain_fetch_tic(struct ccw1 *ccw, struct channel_program *cp) { @@ -735,7 +749,7 @@ int cp_init(struct channel_program *cp, union orb *orb) memcpy(&cp->orb, orb, sizeof(*orb)); =20 /* Build a ccwchain for the first CCW segment */ - ret =3D ccwchain_handle_ccw(orb->cmd.cpa, cp); + ret =3D ccwchain_build_ccws(orb->cmd.cpa, cp); =20 if (!ret) cp->initialized =3D true; --=20 2.53.0 From nobody Sat Jul 25 01:52:22 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76B193BED5F; Mon, 20 Jul 2026 20:19:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578781; cv=none; b=OV11hYsg1kt6q/p7dvB7V837ZtV4W/epi0x/eemcBjiiNBy5/vGU+KBXH3I357lv1HE8fozwdsRPISf/u6/8mY9w44tnzXgh2UpYYN3vaEESmYRY/GOhI1duTgMtDiKR7uxWpWAh6FZFi3xaMdZxuRwkf5W9HARQZhoBl44RJwY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578781; c=relaxed/simple; bh=N7evDN3Q7iGhJtEVsHCOuOIwh62OQK5s/FLwcNHpNRQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gMo2h2dSJBrhTDg067u9jCoPW7dsphSZYGkDvJ/Beho/jqSCv2T8pinv7z/+5x0kURtDlaf7SAuM+Hawrga1vrnJB1dqg2T92Ovqz9yZhJ31w9FG2z4yiz0i9JivpPCC7wfK2gbPIaqRY9+9ZQNLmWz3IVyE3RAshRriV/AXbB4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=VL4YYaJ+; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="VL4YYaJ+" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KJgEe13133784; Mon, 20 Jul 2026 20:19:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=8xnrAsqIGJOgRS+ol KL3N8Jcu+SF2CxJ+EnZg9NoK3s=; b=VL4YYaJ+RijHwfoacaHmXWtDIdirC4utz FsZ+ShLFyY3lgpUTAoPtGgaEXctjgjU8MRgk8pEpjr64tml6endW3ImWDyKAcvG/ g1qj63KSL58/fKhVCi0wthxL8Mxow24A8oFK3q9oeIue2t+4XFy8bPWoNL0kO+yC xtmRiH2xP/KXAtBr9X2J5IV83c6zWQQiTtypo9LnUdDnhkekwbHJzEJczd6Vpd+h P4CZpI1rwLfVs6E1E54w60Lga7kUuJLlAaFI+jjlsZuaRSJ4anbyDfykZIhBnqd1 NGlIdz136mXmsplhqxyMILZKESy6DyS8529luCej8kYMQJHHnyXQw== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg790sbk5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:38 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66KKJbeL018698; Mon, 20 Jul 2026 20:19:37 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgm6vyayw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:37 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66KKJXAp51380702 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 20 Jul 2026 20:19:33 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EE5E92004E; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D01D22004B; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav03.fra02v.mail.ibm.com (Postfix) with SMTP; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id B9A04162783; Mon, 20 Jul 2026 22:19:32 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v2 2/7] s390/vfio_ccw: limit the number of channel program segments Date: Mon, 20 Jul 2026 22:19:26 +0200 Message-ID: <20260720201931.976660-3-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260720201931.976660-1-farman@linux.ibm.com> References: <20260720201931.976660-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: QTDNvkh-u0NGqKpaR25-M9jl6wGBc49q X-Authority-Analysis: v=2.4 cv=V6RNF+ni c=1 sm=1 tr=0 ts=6a5e82da cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=sBi1HX8ECoo2m5KYV-oA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfXxwJt/oj+xYad aVIJYvPeEBuqQE+TXNfrZBwQeqld/diN7RnBRcmKAtSsudHwFV5YDSLiquLRJytVe7DyhzG7lWM QN0tyR9Vp/U8XbqiOtD/RzXCJMunwlo= X-Proofpoint-GUID: QTDNvkh-u0NGqKpaR25-M9jl6wGBc49q X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX6qj00W+BADPg bJeNuLqot2U/F2vtDaIauwsNDSTKQymc5QvIlTy5tCykbiZTff66sDht3Mh4tnFIv1OtigzcsN0 gyznTtLdUOcJLQTyu3TZBK9n3WkfMhmmZcTdlk5coGZ1IFfhd6ojC57bN3+fbFcJ/7oLX5TiQZH BNiWGPn6r1gJe7TmqNnYIj7Ecs8wssVS4JLjwba/itbf1i37O1oNbRMY4b2E4k7t87XBKjXIW65 qoaz0nJ6a8nR3AUUywGTY8NOhUFAVcToG7gOjxgF4vZvylvQuImsMwMJW93gNapOLghwIdKK6U7 rLQaGOaMME3pecweZ0AILCxFbHZy22H4fJ1REdaw9miqfkHO5QgpPePdtAr7/43lUUidzXq1HsK sy4RCPX8UNXFIurA91JvsArzKjkmLbfb8mrGirKk59wqjcpsLtlZ8bSyCFfDiQQ2Os7frVfA7xM S+abXx5AIlhyVsmhGsA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_05,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 adultscore=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 spamscore=0 impostorscore=0 phishscore=0 priorityscore=1501 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200220 Content-Type: text/plain; charset="utf-8" The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 6 ++++++ drivers/s390/cio/vfio_ccw_cp.h | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 086d1b54bdb0..7abdebd8f7c3 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -332,6 +332,7 @@ static struct ccwchain *ccwchain_alloc(struct channel_p= rogram *cp, int len) goto out_err; =20 list_add_tail(&chain->next, &cp->ccwchain_list); + cp->ccwchain_count++; =20 return chain; =20 @@ -441,6 +442,10 @@ static int ccwchain_handle_ccw(dma32_t cda, struct cha= nnel_program *cp) if (len < 0) return len; =20 + /* Limit number of chains in a single channel program */ + if (cp->ccwchain_count >=3D CCWCHAIN_COUNT_MAX) + return ERR_PTR(-EINVAL); + /* Need alloc a new chain for this one. */ chain =3D ccwchain_alloc(cp, len); if (!chain) @@ -745,6 +750,7 @@ int cp_init(struct channel_program *cp, union orb *orb) vdev->dev, "Prefetching channel program even though prefetch not specified in ORB"= ); =20 + cp->ccwchain_count =3D 0; INIT_LIST_HEAD(&cp->ccwchain_list); memcpy(&cp->orb, orb, sizeof(*orb)); =20 diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h index fc31eb699807..dc91a317ef19 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -23,6 +23,11 @@ */ #define CCWCHAIN_LEN_MAX 256 =20 +/* + * Maximum number of chains + */ +#define CCWCHAIN_COUNT_MAX 16 + /** * struct channel_program - manage information for channel program * @ccwchain_list: list head of ccwchains @@ -38,6 +43,7 @@ struct channel_program { union orb orb; bool initialized; struct ccw1 *guest_cp; + int ccwchain_count; }; =20 int cp_init(struct channel_program *cp, union orb *orb); --=20 2.53.0 From nobody Sat Jul 25 01:52:22 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E26873BED19; Mon, 20 Jul 2026 20:19:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578780; cv=none; b=Owqz4BtQuZEDr88EA5lg5OwEkpFnWJcZU0nTEXBX5ybzxlgfE9XUgM1WfHrRmA7j5OSBbaDtzXp4aePoANEGvu0dNKGj0aXOzF+tGGOGhQi11O3gVcwuAJHbJ39ok9KlyIbDkqZbO5uDQJvw8prIFQ0f4pzXnz2f8nXU9vqV3ds= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578780; c=relaxed/simple; bh=54sPX2xBLkiGWjK/dh7pFT0TaP0TfN5Jhxfdgwl9H0k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=K+MaEKDIzUd/ZRMxMED9YvTAWPTwmDPK3qAyEU0oiRMfeASKj8blQd/k5LEXP1tG4tv5+trn4W4C/42r0xChhRcjXMhafdqskmsoEkOrrUuWAlkBkZ7axR7yksy5ileuCT/GCLX0eY6W/pRIe5+V4SEnXJn1rsbJlwAVjIobZqM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=pazJPkUA; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="pazJPkUA" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KJgccq3031783; Mon, 20 Jul 2026 20:19:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=pxRQX4yfvDHbmiJ/K BysaQAz7SXKNIqErAOmcW3ynS4=; b=pazJPkUAlz+fpx6ZhukPW6O0gUsdycIxN XE6T8mjtvvqTR2HKSk8K1AWrYl933A1PE7CXZ32qUfTXfU9hjrHDf7tLMKgMEJ0v AHdjeLjTHGDZgmkEyrJnOhYXMyViQldNp5poYlL0Dhucs+HoJds+xfljQ+WcfSDE qoei9u2KFmxwnlttbChsLUPYdE7Z+iv5lG+9XYAfGF136k2auF8TBtylsllFTtCR YO1FOYAs+6XVZVEiURdivOmihcyXvwEmv0z08bCpj7WEpMYGbyYO91vqlFATP/FD VD3rlepAUkjbLXxxTSWuSbgHPVtaL/L9gOOgV7Eu/OYK47LjzgOVw== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg78g117k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:37 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66KKJbam015416; Mon, 20 Jul 2026 20:19:37 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1g7173-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:36 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66KKJXxh40435974 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 20 Jul 2026 20:19:33 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F00E720049; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D1ADE2004D; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav06.fra02v.mail.ibm.com (Postfix) with SMTP; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id BBE77162788; Mon, 20 Jul 2026 22:19:32 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v2 3/7] s390/vfio_ccw: fix out of bounds check on CCW array Date: Mon, 20 Jul 2026 22:19:27 +0200 Message-ID: <20260720201931.976660-4-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260720201931.976660-1-farman@linux.ibm.com> References: <20260720201931.976660-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX9GCO7eItBKjG CUq/LLmxNeUV2/h4Mkf+zZZXmT+NRiLe1mmroL4ZP21LuJhOGqb4Icr5qD3Byt7tavmUBzFQxCr igxt8geA1VdUZUNsnOREOHurkLh9F1laOiheFzTopp2qnDCeqdgCn1+fVwECA/Q8KfJmqbTS2H+ uAHzYFD3XYc+sJQkm4+zo7u5Q2dhoPs6bjUspqUbdNKsHnWVRroypr9Pb2BYEN2aQAA8v5okU8E et8wVjDEwRa7jLbw2SP3hu32QVBj+JxmLP2jHSmOaujL+4lMRq3mFjibNKEQEAsYHoWOHBw9Fgo 1izYihCq6zL8aMRfUDn8/xevNiF02wKmlfIshhhvBXEAXkEeUd2lom9kxj7EnbSTU8i6sFtsEZK iz6B/VOY7dtvBqxr2WTOjNGu524EK4mhsNra4rSr4kKg5RFn8ytvc+DsEHayadi6+vmVwmgyGkZ Cw5NoCy8S+QnLwvH7SQ== X-Proofpoint-GUID: 0cJz5U8iJGrGttvGpbkohrBSySy3BDog X-Authority-Analysis: v=2.4 cv=MelcfZ/f c=1 sm=1 tr=0 ts=6a5e82d9 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=Ztfy0_AA8xUuwmIluScA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX2zlKfnsYuJfr dvI1tZnOh6hpWFMWrdRg8myvjs8Ra3WUpWJAXJP9oKQetWa2+VmI2xyDwsTeaSb80T+lDOU2/et rfOQS6fnSG4+Dpl23Z9T6PtD1qIrhGI= X-Proofpoint-ORIG-GUID: 0cJz5U8iJGrGttvGpbkohrBSySy3BDog X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_05,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 spamscore=0 clxscore=1015 malwarescore=0 phishscore=0 adultscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200220 Content-Type: text/plain; charset="utf-8" The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs. The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error. Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 7abdebd8f7c3..ce61858c82eb 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -393,11 +393,14 @@ static int ccwchain_calc_length(u64 iova, struct chan= nel_program *cp) if (!ccw_is_chain(ccw) && !is_tic_within_range(ccw, iova, cnt)) break; =20 - ccw++; - } while (cnt < CCWCHAIN_LEN_MAX + 1); + /* Exit the loop when we reach the maximum */ + if (cnt >=3D CCWCHAIN_LEN_MAX) { + cnt =3D -EINVAL; + break; + } =20 - if (cnt =3D=3D CCWCHAIN_LEN_MAX + 1) - cnt =3D -EINVAL; + ccw++; + } while (1); =20 return cnt; } --=20 2.53.0 From nobody Sat Jul 25 01:52:22 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B13F3BED5C; Mon, 20 Jul 2026 20:19:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578780; cv=none; b=kBAlMvGXS8B32rQg8fnfXGEL1pLrfSckh0627TLa3opm0MRdueJ3KHTGnvDiqGTjzrfzrhME1EBXkPe9ni4UKgFWuV/CNL45Fl9+WitwCmM8FMC2a+6MuTEfQ4mcH0Z4mCtuw0oJNNqDXG3l0oQ7gaUuBXTNFc7zuDShYc4w0qo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578780; c=relaxed/simple; bh=yT0Z+XA+JTJtINb6hLFlXlrKvWUD0Sk7zioORP7nnIw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hvpnEnlsfK4/t6qkewT1KVfUzRNhllbBVF4GqGC2q5CM2L12ne5NDnn7CLfh98RGHQIjy0M6eWjYjMhCJeGkbUR0bYquxVTluliuXOeXm3lscV15ECyHZkSi6zUpZgAp4N3Ro+v9PerhHQh+tW69x+DKeBCuN/nMgzOFDrOwiA8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Qx6xgIsG; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Qx6xgIsG" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KJgKsO3031173; Mon, 20 Jul 2026 20:19:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=b79jQyc/RPicvzjGO /Z6hEjSuoY94xr7wGZ2DpvKOeA=; b=Qx6xgIsG7L3ZTy0IRcIEUO+o4kjCxKb7w 4GhRScG/aeW7xQbnTpbH2PmTtFRhTUuXx8G5bId6/TXAn3QL9ZW77f887lsYpiVc v4XZtE+jT9bqrrxn9djxgHVfs/2ta/TX73f197rHVn5zXJzQQn5/E59BzgS8grtv ZZWPlkTojaxKVmsDG8wWADdvIMcYBCk8VQkUAGVH8IjHDwB4EwnboVhuwP3clzqH NhijSRyvsz5WTNe5GwcTWFteCYro5qRKMwsoGe8JAdDZmQThZQkcCO9j1dO1uJWb 8LWb++eFuTCaXUgq5QUAVslaczZmK9/AYMRKcRsc8mHNHZwVU22oA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg78g117p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:38 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66KKJblP029511; Mon, 20 Jul 2026 20:19:37 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgmtjq735-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:37 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66KKJX2E46137754 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 20 Jul 2026 20:19:33 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F14CA2004D; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D3D4D20043; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav07.fra02v.mail.ibm.com (Postfix) with SMTP; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id BE18816278A; Mon, 20 Jul 2026 22:19:32 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v2 4/7] s390/vfio_ccw: ensure first IDAW remains constant Date: Mon, 20 Jul 2026 22:19:28 +0200 Message-ID: <20260720201931.976660-5-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260720201931.976660-1-farman@linux.ibm.com> References: <20260720201931.976660-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX3ZT3tB4vWoQb e+w2YQhK/1QVQr94cOSUXfUruSDImXlqWShqZkqC6IZdB7JagPij6yEMAgqaMCRsueOJ/tJtijK 9T/JcF/bEtZV3wY2x8jDsj2FoPMP2aE9vRpl7kV0fSGP1Oh/M/zc9DRAHe4CFFyzUmLhL18NPVy mhAprdi7ZfqOLyD0iW5T4i+9hvBQb5gjowxR/REwU957cUG1Li4wKTm73khY8aJbPLpK9+Bhw0l 9K5svxS1C+SI5lPZUnp3+2kJHycwvNEbmFPubxIiI6MJnf1nmn0JGLprGhn8wILoLPwj3CGUK5y 910kYVd/I8DUJ4Z18haxNx5x04MeiOMnkKS9gfiVmRkqPIjAbfhHOSXBDAeFkzSqsXBaeil/l7E r1nlV/glUuhQJqm/xyuPD8pTtQHLvm8Aqx+1fgurfJnx69NzZfx9b676Ev+kWsLxs8zTN8+i8+3 yVIA1m03/6BR4WkBl9g== X-Proofpoint-GUID: C4p_dwKyr7ekHXZRO59OQKWlZihlTIMD X-Authority-Analysis: v=2.4 cv=MelcfZ/f c=1 sm=1 tr=0 ts=6a5e82da cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=EVDxiZbKT-KwyQ_dKrEA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX11qOu6KLKYpb pFPeZmJsPQ7+bF2PV1PBZa1WW93E0nlRjZXL0laDIDxv7HcD5udfW2bsyvvGe50tQ5QRJb+AOJo H2umTAh7gf/o5nBngIIkWvHYMavmG9Q= X-Proofpoint-ORIG-GUID: C4p_dwKyr7ekHXZRO59OQKWlZihlTIMD X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_05,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 spamscore=0 clxscore=1015 malwarescore=0 phishscore=0 adultscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200220 Content-Type: text/plain; charset="utf-8" The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with. Fixes: 01aa26c672c0 ("s390/cio: Combine direct and indirect CCW paths") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 15 +++++++++++++++ drivers/s390/cio/vfio_ccw_cp.h | 1 + 2 files changed, 16 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index ce61858c82eb..c6f0264fb5d3 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -533,6 +533,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct= channel_program *cp, int &container_of(cp, struct vfio_ccw_private, cp)->vdev; dma64_t *idaws; dma32_t *idaws_f1; + u64 first_idaw; int idal_len =3D idaw_nr * sizeof(*idaws); int idaw_size =3D idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE; int idaw_mask =3D ~(idaw_size - 1); @@ -549,6 +550,17 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struc= t channel_program *cp, int kfree(idaws); return ERR_PTR(ret); } + + if (cp->orb.cmd.c64) + first_idaw =3D dma64_to_u64(idaws[0]); + else + first_idaw =3D dma32_to_u32(idaws[0] >> 32); + + /* Unexpected mismatch from earlier read */ + if (first_idaw !=3D cp->guest_iova) { + kfree(idaws); + return ERR_PTR(-EINVAL); + } } else { /* Fabricate an IDAL based off CCW data address */ if (cp->orb.cmd.c64) { @@ -614,6 +626,9 @@ static int ccw_count_idaws(struct ccw1 *ccw, iova =3D dma32_to_u32(ccw->cda); } =20 + /* Save the read address for later */ + cp->guest_iova =3D iova; + /* Format-1 IDAWs operate on 2K each */ if (!cp->orb.cmd.c64) return idal_2k_nr_words((void *)iova, bytes); diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h index dc91a317ef19..d547dbc969cc 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -43,6 +43,7 @@ struct channel_program { union orb orb; bool initialized; struct ccw1 *guest_cp; + u64 guest_iova; int ccwchain_count; }; =20 --=20 2.53.0 From nobody Sat Jul 25 01:52:22 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 071A53BFAE2; Mon, 20 Jul 2026 20:19:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578786; cv=none; b=BGRRQ1nOWf4Jo9Axweudow+RzbBR3+O8EC7gfVhvdEY10y5qW5psMcdP/R5AyplMdHF9fgPCZtv8swKwCYJ0TjCBGbWAUp6y9KP5uRBLrJ9Fchrnp/LXLWcLRSmTTX9Y61qTZZ5LxvDxjkCEoCDuXZBsB6B/PRf82aKeXBUiOrU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578786; c=relaxed/simple; bh=/OjOHriBZoh8PlwsqFncb1bWp39ntoW2O6+XuqshVrM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r+NwQcIQcOGGOt3gzxvJn2o8vVPe8drrcDtheBThp4K+d6Zfzg02niqaVBTwQF6XmT4fykBoTalJaaAj0/pKqyBeUyE1v2aQVEHdxEDcrdqXBvXlZvGRBgqxaSrw68hHqgYkZM8Sni7cAjWxOQId5nOWCMuA4d8aiCfmcvDTI/c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Wc2bJiJY; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Wc2bJiJY" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KJfms03124639; Mon, 20 Jul 2026 20:19:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=3gm/FgSDCIMIwPYwp FtqeHupXDMucT6EqhSA8P63lIg=; b=Wc2bJiJYfFQE9Gs8zX8zUP1dUrPXGitEG 7hkuaaJFNuX6An49qQUuuMJ/DtZnw8yQbz+s9qUmLXpYZBxGzCglvc+UWtLV3wle ceJCnHgg3NwewXXXaecUmHw5V1Ikyy/35LQqMjZ56awk8+IGrNAuTrblOVd/fvQ2 fTyNfu3Lr9sT+s0HDRlHXgFqZQuUCIUsPgu9f3gyAAUxhkQxJXXyKGpTB8AGQzNI +XqzokANkF0WrN/hmb+u0ZF18KRHA39EFMjQ1yUJQUm8Gsng9/cuFQReEVvngih/ M/kNXASizeYUBIET216F5kkbyAedXTuo6rnFnpFesvR3UDLVbM1TQ== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7ab9c6j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:38 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66KKJawv018694; Mon, 20 Jul 2026 20:19:37 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgm6vyayx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:37 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66KKJXSD51642676 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 20 Jul 2026 20:19:33 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 20C262004B; Mon, 20 Jul 2026 20:19:33 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 009E720043; Mon, 20 Jul 2026 20:19:33 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav03.fra02v.mail.ibm.com (Postfix) with SMTP; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id C050716279F; Mon, 20 Jul 2026 22:19:32 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Cornelia Huck Subject: [PATCH v2 5/7] s390/vfio_ccw: ensure index for read/write regions are within range Date: Mon, 20 Jul 2026 22:19:29 +0200 Message-ID: <20260720201931.976660-6-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260720201931.976660-1-farman@linux.ibm.com> References: <20260720201931.976660-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX5g4IBteLgxUz TGkGbUkvo1ozhYxP7jjfQD0Ry/ftH+x/GAckD7g4z6R2WiS6Z9BxqYLUorVQJVcTn01X+BtW86k t8+2DbFJabFvgLM4mZ0tPhIsmZKJoIJrzgVl7ZrWtTa1up1QtYgfyYuXF92IJEmGt1VWbNMSGfH KNkTGuoeTmEzDBfBlMoK0rdnBSeTgKvIyape0g6wxuxwV7Q20WbzELiC5egrr3KVc8AapRORQpc hqaxQ3FM2niwh/FY/6/4U8qvPKJlPDSE4Mbt8PyctrqvPMHAKl806lnaHfCs/8Ug/pnEB8zSNLl bRpBcV9+7xUIWQRRXdveI7i7dwSNg6CfkRN5F5JYYIh5WsEIlLay0/s2Ce+sYRNAukqpPW9KYZc MmzPl0NiorWZfQBnR6HZwgg4ZL8pXnHV+1DXo729MosxYeMSiZcw6ysAsdNVQ/8hL/WCA0sgorU /jHGyJ8mhYEOza6Cvvg== X-Authority-Analysis: v=2.4 cv=F7ZnsKhN c=1 sm=1 tr=0 ts=6a5e82da cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=2RTzcq77zNFBleCZhqUA:9 X-Proofpoint-ORIG-GUID: jOnvINKfZTzMO-bT9Xg9Yaj_qLPEx-Bw X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX8TcR18OY3fBT Vk7LvE/C3BlO+NRB0UNy6oZLJpVzFh/+vDOglXoj1QDN6H5ZKaSncka6QD4eUPotLbU7xTdJW2R XTAPFz/qsHbsKEcG9Z1i5c6fNMErI4w= X-Proofpoint-GUID: jOnvINKfZTzMO-bT9Xg9Yaj_qLPEx-Bw X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_05,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200220 Content-Type: text/plain; charset="utf-8" The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced. Fixes: db8e5d17ac03 ("vfio-ccw: add capabilities chain") Cc: stable@vger.kernel.org Cc: Cornelia Huck Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_ops.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index 45ec722d25ea..e695cd985369 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -243,6 +243,7 @@ static ssize_t vfio_ccw_mdev_read(struct vfio_device *v= dev, return vfio_ccw_mdev_read_io_region(private, buf, count, ppos); default: index -=3D VFIO_CCW_NUM_REGIONS; + index =3D array_index_nospec(index, private->num_regions); return private->region[index].ops->read(private, buf, count, ppos); } @@ -295,6 +296,7 @@ static ssize_t vfio_ccw_mdev_write(struct vfio_device *= vdev, return vfio_ccw_mdev_write_io_region(private, buf, count, ppos); default: index -=3D VFIO_CCW_NUM_REGIONS; + index =3D array_index_nospec(index, private->num_regions); return private->region[index].ops->write(private, buf, count, ppos); } --=20 2.53.0 From nobody Sat Jul 25 01:52:22 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76BB53BED69; Mon, 20 Jul 2026 20:19:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578781; cv=none; b=SkL6czdpxlvnARa0ptO81yiroghs4N+aMI/cRVoOA9gc26gcGckbjP0F9xhg3fqWd5+tCVivQEkScatoAQzbyt0wxeYS0/ZeU+cj+Vgnl/CGCSa58gQc0B7H/BN15h5/fTSxTJHiCBgwr6gbkk7vC89YW289o8CunHDQ9wDoPHU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578781; c=relaxed/simple; bh=lpJrG6iT9scBVYyD864SCam0wBve1Emeth0KEeF2PiA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SUfQN04qxp+skmlcTPDxMESYdRD04d4lAsnDEAkyGhAIvumnTyLx6SnEl/btn6KJLZLEqEHG6KdVP2y/Fa9jux+Xn+Wj/h5qsCE2hgXxThSojk6YwoUtqZiVaeauyRLmaUNm7dMlaih9umFwmpNteOgWBC0tOSMhgCdFtINIFMw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=MwEJs7GK; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="MwEJs7GK" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KJfsXt1246280; Mon, 20 Jul 2026 20:19:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=WPUskg3wADi66krTy G85jNapQrPVJvQLs8/ASWZo1tI=; b=MwEJs7GK5xU5a1X46wrjm3XpmNL9aP50l HScsSAVatSyGyCnpoh+rzfmWg5AaWDJ9opqPzt71QdJXT4lI7IM/IeEeW9c5lR9M XfOLeZ78cy46stwAvzYG6c5wY6Rc0CbDW5/FcnucivFNS1J4gewOCnOYLJgHud/d aGrxom8n81PsyMdAe/88hc2AOa/OFi0qkbdCwu8UaZVokzlsCfJAiL8uQItiyDxZ swDaiOr9CuCQBPWTLwt1MNSvHYLdn9lfrRoDVyoYKQ6qiGfcoFPmUH9ONQ930T5x NjOrdi8fozlYME/2AJFFMy4ju+Z4bY6VihEOHEjBJjxlqKsbGF7nw== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77a9bth-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:38 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66KKJb9p029514; Mon, 20 Jul 2026 20:19:37 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgmtjq734-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:37 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66KKJX4Z40435976 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 20 Jul 2026 20:19:33 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1F57F2004D; Mon, 20 Jul 2026 20:19:33 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0125D2004B; Mon, 20 Jul 2026 20:19:33 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav06.fra02v.mail.ibm.com (Postfix) with SMTP; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id C25821627A5; Mon, 20 Jul 2026 22:19:32 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman Subject: [PATCH v2 6/7] s390/vfio_ccw: implement a channel program lock Date: Mon, 20 Jul 2026 22:19:30 +0200 Message-ID: <20260720201931.976660-7-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260720201931.976660-1-farman@linux.ibm.com> References: <20260720201931.976660-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: oKQiAWJkwtVUlFu2iQc-eTnxDsTyKDWl X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfXzaT7+s4YclG8 dXz4QwxNZSgvpNqnpV4h2VKPBVO4gP3KzEkqPrq5KQNtb22p1AK8oyqoP1hwswxLPD6KqgsHR9O 7os0M5wGoLwEOEwjJsOGX93PGAdKJdo= X-Proofpoint-GUID: oKQiAWJkwtVUlFu2iQc-eTnxDsTyKDWl X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX+uIRxKZVqbZA L9QKJT6GXck2cVKRccWFUAbQmEZw2QduUpSwEEPneqTq819Gf7RKQoqNOBBxhZI5MLiltdag+hL +ejmTOWUs2G6lkF4i6TWZYNtFcevfJMTUjh46425hdRB6vw0E4Fg7IZi/YnwrSMkJqoRzbvgjfc UIV05K7AJ4a8s+jjj2/5PoJQ7G0eT/Ro2pd1K/qU/l3hL3VRMJAFwKTw5b21+feBafQmT5odrwz VFWstPa6SCweXHckRkJGZ97ZrFaM9bdfZuOlrMW8PMycYPIzwH5l1rBWyssu+6WvG2fYuPCx0yC X2XiIIMgL0Aq9bgFXuNNqsNbA8ATPXv+IAvBFkTQkwRrZw5JIO8FVUhJuoGGDpAiY9hGAuh23RY wraFepmM9DWZTp3jP3Y7CxLpHj7YhFB7cv1DlTTwW8ZdhfhIm4YZvOeZhGnPp9oWM71V4BosFEk S/7POXKnz5r/6afVJYQ== X-Authority-Analysis: v=2.4 cv=K7AS2SWI c=1 sm=1 tr=0 ts=6a5e82da cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=nvEYHYHUJT7TizB4bHYA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_05,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200220 Content-Type: text/plain; charset="utf-8" The channel_program struct is manipulated without a serialization mechanism to ensure consistent behavior. Take a broad stroke of putting the entire structure behind a spin lock, which can be acquired with or without the mutex guarding the I/O regions that feed into the population of the channel program. Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 13 ++++++++++++- drivers/s390/cio/vfio_ccw_cp.h | 1 + drivers/s390/cio/vfio_ccw_drv.c | 6 +++++- drivers/s390/cio/vfio_ccw_ops.c | 8 +++++++- drivers/s390/cio/vfio_ccw_private.h | 2 ++ 5 files changed, 27 insertions(+), 3 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index c6f0264fb5d3..7bfb3a952817 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -790,7 +790,7 @@ int cp_init(struct channel_program *cp, union orb *orb) * @cp, which must have been returned by a previous call to cp_init(). * Otherwise, undefined behavior occurs. */ -void cp_free(struct channel_program *cp) +void cp_free_locked(struct channel_program *cp) { struct vfio_device *vdev =3D &container_of(cp, struct vfio_ccw_private, cp)->vdev; @@ -810,6 +810,17 @@ void cp_free(struct channel_program *cp) } } =20 +void cp_free(struct channel_program *cp) +{ + struct vfio_ccw_private *private =3D + container_of(cp, struct vfio_ccw_private, cp); + unsigned long flags; + + spin_lock_irqsave(&private->cp_lock, flags); + cp_free_locked(cp); + spin_unlock_irqrestore(&private->cp_lock, flags); +} + /** * cp_prefetch() - translate a guest physical address channel program to * a real-device runnable channel program. diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h index d547dbc969cc..edfb47a292ca 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -48,6 +48,7 @@ struct channel_program { }; =20 int cp_init(struct channel_program *cp, union orb *orb); +void cp_free_locked(struct channel_program *cp); void cp_free(struct channel_program *cp); int cp_prefetch(struct channel_program *cp); union orb *cp_get_orb(struct channel_program *cp, struct subchannel *sch); diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_dr= v.c index 1a095085bc72..bfb68de6e52c 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -83,6 +83,7 @@ void vfio_ccw_sch_io_todo(struct work_struct *work) { struct vfio_ccw_private *private; struct irb *irb; + unsigned long flags; bool is_final; bool cp_is_finished =3D false; =20 @@ -91,13 +92,16 @@ void vfio_ccw_sch_io_todo(struct work_struct *work) =20 is_final =3D !(scsw_actl(&irb->scsw) & (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); + spin_lock_irqsave(&private->cp_lock, flags); if (scsw_is_solicited(&irb->scsw)) { cp_update_scsw(&private->cp, &irb->scsw); if (is_final && private->state =3D=3D VFIO_CCW_STATE_CP_PENDING) { - cp_free(&private->cp); + cp_free_locked(&private->cp); cp_is_finished =3D true; } } + spin_unlock_irqrestore(&private->cp_lock, flags); + mutex_lock(&private->io_mutex); memcpy(private->io_region->irb_area, irb, sizeof(*irb)); mutex_unlock(&private->io_mutex); diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index e695cd985369..d2475b3158cf 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -36,10 +36,15 @@ static void vfio_ccw_dma_unmap(struct vfio_device *vdev= , u64 iova, u64 length) { struct vfio_ccw_private *private =3D container_of(vdev, struct vfio_ccw_private, vdev); + unsigned long flags; =20 /* Drivers MUST unpin pages in response to an invalidation. */ - if (!cp_iova_pinned(&private->cp, iova, length)) + spin_lock_irqsave(&private->cp_lock, flags); + if (!cp_iova_pinned(&private->cp, iova, length)) { + spin_unlock_irqrestore(&private->cp_lock, flags); return; + } + spin_unlock_irqrestore(&private->cp_lock, flags); =20 vfio_ccw_mdev_reset(private); } @@ -54,6 +59,7 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) INIT_LIST_HEAD(&private->crw); INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo); INIT_WORK(&private->crw_work, vfio_ccw_crw_todo); + spin_lock_init(&private->cp_lock); =20 private->cp.guest_cp =3D kzalloc_objs(struct ccw1, CCWCHAIN_LEN_MAX); if (!private->cp.guest_cp) diff --git a/drivers/s390/cio/vfio_ccw_private.h b/drivers/s390/cio/vfio_cc= w_private.h index 0501d4bbcdbd..061b594fde36 100644 --- a/drivers/s390/cio/vfio_ccw_private.h +++ b/drivers/s390/cio/vfio_ccw_private.h @@ -115,7 +115,9 @@ struct vfio_ccw_private { struct ccw_crw_region *crw_region; int num_regions; =20 + spinlock_t cp_lock; struct channel_program cp; + struct irb irb; union scsw scsw; struct list_head crw; --=20 2.53.0 From nobody Sat Jul 25 01:52:22 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0DB833BED44; Mon, 20 Jul 2026 20:19:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578780; cv=none; b=VUMhbkrJy8wCA6nhiA85Vmy/mJRTuaWrbZRRuqYAwe6jaK6ptNy79K2P6y4aYMHuOwW8qilnA4BIq9egVxLleZiC0OhnLgPfcTj65d7TyH5uhEOLB32RsJcEtdvWLz6S71xiEHFS1CTA0FRP9UgeG1kM3RQbrazGe4kL36JmcVQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784578780; c=relaxed/simple; bh=8VSyzjuUzleU0iRGjJve6wH14nf3NIylq6KFDRi7Pts=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qsgLYwPGfNNWVcOQh1wpyHvXzjtF1jMk+CjyNP3eAilWX86nI6rz+/NFfrQqfaijT3CKQpfAuyY5bTiccxtXo8+fBfoHULidXkHF9RmTi2iwB5+LntbBvLBeUZVIxdn0m2OXKG6bhvNrx1A2hqbTlDtHUre7TeFP55p2tmwdHKE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=WgXRw2yU; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="WgXRw2yU" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KJfpBS3048287; Mon, 20 Jul 2026 20:19:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=v2JqUU5j29LMneLiB CEz5Bg4k1E+Q/v1XQ6xgPRubTM=; b=WgXRw2yUKH+f++NDvWWjRxnFYrf989QsS Zn5HeHsScfs5wBfK7coAJn2ElJFppH6BrdmyA0JJE6K/vnTOz30UR3ZF5rF/Ugkx YqFE7jzABGSHINjc/xQ1cHiWBT0DUecgVjt8eVl2yWophAETLhdaMnV9lvWb0c8h d2kaQxWPCOwGRlyXJYqJrLcrUNHa8IPeeHEmdqD+sGcRhwAvoYM6IIRoQR63yN57 iTXKURAMOPSjpaHHUkqRkaI2P5whh3jKgrMy1OwYRpOLJRIxlzc87RY0fuYhvGe7 52IJbbxb4md9pQWNWc/0DBnbNUyN1WaBTY8zZPdprvcec88Gicpfw== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77k12b9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:37 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66KKJafR015412; Mon, 20 Jul 2026 20:19:36 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1g7175-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Jul 2026 20:19:36 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66KKJXPL24248604 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 20 Jul 2026 20:19:33 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2DF362004B; Mon, 20 Jul 2026 20:19:33 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 09BCC20040; Mon, 20 Jul 2026 20:19:33 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav04.fra02v.mail.ibm.com (Postfix) with SMTP; Mon, 20 Jul 2026 20:19:32 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id C474B1627A8; Mon, 20 Jul 2026 22:19:32 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman Subject: [PATCH v2 7/7] s390/vfio_ccw: implement a crw lock Date: Mon, 20 Jul 2026 22:19:31 +0200 Message-ID: <20260720201931.976660-8-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260720201931.976660-1-farman@linux.ibm.com> References: <20260720201931.976660-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=HJXz0Itv c=1 sm=1 tr=0 ts=6a5e82d9 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=nxvipetsQlNpnt3QvtcA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfX+bRrksT/Gcla UBqEFuEr/t6W2Y9778rbwLVIUUbEWryxZnzv1XBHaFgihFBLLIknAuv2JkjvhhYdZAopswL99S9 E09toGvc50GFASqXu8LcnYXCau5ZKVmoYHghzmror3241pPExkQw44Kd/8rjZR3IVCEhpVhiVrM Zu5sp0OtYuSGmi9524P8zTraDFI8UCItKCyz8g/uXwWEtTcwnk4ULWjEsWYns7HLtLtVX3xq5cQ ZT9HimG6GBngM7Pq7PU5lGmUAHUX8OZfBLC/cv1/YE7BT6nzhsReE+bs2h7AGCPgAvPgox6KPyB 75Bn13Sg//+g00jZaEQAsqUtx7EjcNP+S+ADSSMctaHwVSyGqaKWWiOQbEOvoxYVeaDlQ8pGotm NRWsjLgdvJR4MNuoNU+OHER6QCb9J8R7W70/r4gvBkaWzjgQUPs3FVPKPDvFiGha5gvknPZuhil mH7WhclihoOyO3oD0Rg== X-Proofpoint-ORIG-GUID: 8yBwNuoYJE_re-G1nK3Pd-cXXWI5w_Xr X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDIyMCBTYWx0ZWRfXxD5UKkBFkWWR MSR4Oiy8h3PVJkKWvvod5E02kLAr7aFBmxBLNywRb/BOOh/tB5pT8cVzil2YBjiB/3zUhWlNV1P r9jzryqccKeYUBeQa0vNJBe1mFWRuHc= X-Proofpoint-GUID: 8yBwNuoYJE_re-G1nK3Pd-cXXWI5w_Xr X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_05,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 impostorscore=0 clxscore=1015 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200220 Content-Type: text/plain; charset="utf-8" Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively. Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_chp.c | 15 ++++++++++----- drivers/s390/cio/vfio_ccw_drv.c | 4 ++++ drivers/s390/cio/vfio_ccw_ops.c | 3 +++ drivers/s390/cio/vfio_ccw_private.h | 2 ++ 4 files changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_chp.c b/drivers/s390/cio/vfio_ccw_ch= p.c index 38c176cf6295..bbc445efd67f 100644 --- a/drivers/s390/cio/vfio_ccw_chp.c +++ b/drivers/s390/cio/vfio_ccw_chp.c @@ -90,14 +90,18 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_ccw= _private *private, if (pos + count > sizeof(*region)) return -EINVAL; =20 + mutex_lock(&private->io_mutex); + region =3D private->region[i].data; + + spin_lock(&private->crw_lock); crw =3D list_first_entry_or_null(&private->crw, struct vfio_ccw_crw, next); =20 if (crw) list_del(&crw->next); =20 - mutex_lock(&private->io_mutex); - region =3D private->region[i].data; + /* Drop CRW lock while copying to userspace */ + spin_unlock(&private->crw_lock); =20 if (crw) memcpy(®ion->crw, &crw->crw, sizeof(region->crw)); @@ -108,14 +112,15 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_c= cw_private *private, ret =3D count; =20 region->crw =3D 0; - - mutex_unlock(&private->io_mutex); - kfree(crw); =20 /* Notify the guest if more CRWs are on our queue */ + spin_lock(&private->crw_lock); if (!list_empty(&private->crw) && private->crw_trigger) eventfd_signal(private->crw_trigger); + spin_unlock(&private->crw_lock); + + mutex_unlock(&private->io_mutex); =20 return ret; } diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_dr= v.c index bfb68de6e52c..12edccb62cbf 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -125,8 +125,10 @@ void vfio_ccw_crw_todo(struct work_struct *work) =20 private =3D container_of(work, struct vfio_ccw_private, crw_work); =20 + spin_lock(&private->crw_lock); if (!list_empty(&private->crw) && private->crw_trigger) eventfd_signal(private->crw_trigger); + spin_unlock(&private->crw_lock); } =20 /* @@ -296,7 +298,9 @@ static void vfio_ccw_queue_crw(struct vfio_ccw_private = *private, crw->crw.erc =3D erc; crw->crw.rsid =3D rsid; =20 + spin_lock(&private->crw_lock); list_add_tail(&crw->next, &private->crw); + spin_unlock(&private->crw_lock); queue_work(vfio_ccw_work_q, &private->crw_work); } =20 diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index d2475b3158cf..b3699ffd2f1d 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -60,6 +60,7 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo); INIT_WORK(&private->crw_work, vfio_ccw_crw_todo); spin_lock_init(&private->cp_lock); + spin_lock_init(&private->crw_lock); =20 private->cp.guest_cp =3D kzalloc_objs(struct ccw1, CCWCHAIN_LEN_MAX); if (!private->cp.guest_cp) @@ -137,10 +138,12 @@ static void vfio_ccw_mdev_release_dev(struct vfio_dev= ice *vdev) container_of(vdev, struct vfio_ccw_private, vdev); struct vfio_ccw_crw *crw, *temp; =20 + spin_lock(&private->crw_lock); list_for_each_entry_safe(crw, temp, &private->crw, next) { list_del(&crw->next); kfree(crw); } + spin_unlock(&private->crw_lock); =20 kmem_cache_free(vfio_ccw_crw_region, private->crw_region); kmem_cache_free(vfio_ccw_schib_region, private->schib_region); diff --git a/drivers/s390/cio/vfio_ccw_private.h b/drivers/s390/cio/vfio_cc= w_private.h index 061b594fde36..4a43609d6422 100644 --- a/drivers/s390/cio/vfio_ccw_private.h +++ b/drivers/s390/cio/vfio_ccw_private.h @@ -120,6 +120,8 @@ struct vfio_ccw_private { =20 struct irb irb; union scsw scsw; + + spinlock_t crw_lock; struct list_head crw; =20 struct eventfd_ctx *io_trigger; --=20 2.53.0