From nobody Fri Jul 24 04:44:47 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C30553A5E97; Thu, 23 Jul 2026 17:48:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828892; cv=none; b=EBnnBtDwl3XC2Kh/2uAnwhR9w6Nc08wX6vWNYVX/7GACbMCcX2Cb05QWf3+tUnKXf5QKsCmLtuJ6NIsFi4sh+r1NXHrjilXP8/po3ADPrF1e2HI0dz2qHICcB9hszh7lwcM4bZTolfaEUeaCQp0OGcGbPrk5k+SwJeqXPWRb1M0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828892; c=relaxed/simple; bh=OA3LCuoCUOfCEOxu+e7P1jsqfbXbs0Xq2LJ98jivtQk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ie+nHXe/A5N05l1aSqQzdNhmDFMg7hfWR/O/mx3jl5g0FIJUvrcYv41miELlRairwd1ejNH0mlq4naCLYKDzDp+otWLB0kAxbo42G7FK2D3uAZ0bWk95Xf73+xjyxBn4MH1tQQzBcrZeUKYL9abnQSIsVUdWjdXUArF6sI/Y18M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=U1Y7tRrZ; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="U1Y7tRrZ" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHg5Pg3688687; Thu, 23 Jul 2026 17:48:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=DSFA86ygYl21dKo+h BzqhpTt1TC6eOhZaQFbxA9b3sc=; b=U1Y7tRrZ0ZooejFFbVYsN48Ja1u5JGupC deZrk055gZrO9LkYEXc07D8UuSst23LLqhxL4AF0VUJJRFYwiJKCNS+QXSg1rCYC op+OjaeNX7TQGEcl/NI0aer1bMWx30ePQHiguZcYCQkysNeLC5w6Hh15tWMu8dfY m81IwZOkhIBn0k+88kKDcqHytTC4lq4ju1Y5kFD4dUSnvZxeTaT1zpHRWl12fUDm vlYnooWfkdzm/+bSCVMEZZe/70YftVGu1UhNzJvUFXY2jUivVtNMYlPWzJlu20zs 2gHMMFs3CY86cSb/5JtzOCCyfFSBaThEreXOwx2yLEidebazOomJw== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7ahg97g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:48:09 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NHZ29t009744; Thu, 23 Jul 2026 17:48:08 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1gn5as-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:48:08 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NHm52P53608794 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 17:48:05 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E658B2009C; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BB30220098; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav04.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 9EEBB1627E3; Thu, 23 Jul 2026 19:47:54 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Farhan Ali Subject: [PATCH v3 1/8] s390/vfio_ccw: free all memory if cp_init() fails Date: Thu, 23 Jul 2026 19:47:44 +0200 Message-ID: <20260723174751.1180334-2-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723174751.1180334-1-farman@linux.ibm.com> References: <20260723174751.1180334-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: YIhDyrSaCjA_wm_jMurZgnUP5rqt0NU2 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX15tHHQhS0k3M Wh7KsUTGR0F8jP1HDI6o/a/Q3pXtIE61+gxkismqcBOJNaS5sziGixQMShGGOd5JykMi3E61Ww8 cCitZU7NO25xJIqTgTeJwJLilMaqo5z9+JDwftCnT1EBXUBQ2LB8xUY+YO9RBnhUMg6jBjmfW4b G4RHzYS6/zKCFOzLpOLhKXYaY3LWPwK9goONFKcn6pkQtC6Raxgn7PysYeATDdtMahUqkc28zIE 70dYKWXj9Esubhh8JwBirQjygHIWXJzpkWNDS6/nFMoJ4AMBHZc96eFji5twTDn8xs+cxwW9Rq1 pPb2WahjhfMt2c1KF6r2nxiQhyLinihtrBShj1ea/+Mq/xKfDq4eRDyLBq4evGs2mrJow60GLf0 Z5Xng0n9Od5Km+reggJLrX30z0rWKErbK1VEuwHc5Ewh+wdBiLPFCYI4RzAWUClVAfR4Cy8N8uR GgrGhKVNC03q9/JiMbg== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX+0bCm5rlsCUF bbw//XDK3xyslz+uU9yHYYVLw8Hze6YrJawRNzHdPoRvct7OEnWBBY7x1K4rs9ImRmRQb6lH/Dd mhUgEOiIHYdJJAIAT1x8hUGXqONSANc= X-Proofpoint-GUID: YIhDyrSaCjA_wm_jMurZgnUP5rqt0NU2 X-Authority-Analysis: v=2.4 cv=SM5ykuvH c=1 sm=1 tr=0 ts=6a6253d9 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=WEmllObKAWPfCt-5-jUA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 spamscore=0 malwarescore=0 priorityscore=1501 phishscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230173 Content-Type: text/plain; charset="utf-8" The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic. Fixes: 8b515be512a2 ("vfio-ccw: Fix memory leak and don't call cp_free in c= p_init") Cc: stable@vger.kernel.org Reviewed-by: Farhan Ali Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 7561aa7d3e01..086d1b54bdb0 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -455,9 +455,6 @@ static int ccwchain_handle_ccw(dma32_t cda, struct chan= nel_program *cp) /* Loop for tics on this new chain. */ ret =3D ccwchain_loop_tic(chain, cp); =20 - if (ret) - ccwchain_free(chain); - return ret; } =20 @@ -486,6 +483,23 @@ static int ccwchain_loop_tic(struct ccwchain *chain, s= truct channel_program *cp) return 0; } =20 +static int ccwchain_build_ccws(dma32_t cda, struct channel_program *cp) +{ + struct ccwchain *chain, *temp; + int ret; + + ret =3D ccwchain_handle_ccw(cda, cp); + + if (ret) { + /* Cleanup if an error occurred */ + list_for_each_entry_safe(chain, temp, &cp->ccwchain_list, next) { + ccwchain_free(chain); + } + } + + return ret; +} + static int ccwchain_fetch_tic(struct ccw1 *ccw, struct channel_program *cp) { @@ -735,7 +749,7 @@ int cp_init(struct channel_program *cp, union orb *orb) memcpy(&cp->orb, orb, sizeof(*orb)); =20 /* Build a ccwchain for the first CCW segment */ - ret =3D ccwchain_handle_ccw(orb->cmd.cpa, cp); + ret =3D ccwchain_build_ccws(orb->cmd.cpa, cp); =20 if (!ret) cp->initialized =3D true; --=20 2.53.0 From nobody Fri Jul 24 04:44:47 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5ED033A71AD; Thu, 23 Jul 2026 17:48:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828893; cv=none; b=jUCpee4DerR4stn0EimvF9SYEyJIjnDOnMpP424y6wTU0QUCGhdKamz4KUPX9mJKDSzOXCwj7lyUBk+747Jtmhupxpi9oeIe6W8YcX65GcXio55c53CIM5eUXNN0fwpboIt3+wdcSgRHMJc9UEbShc9AMUl48fqY09cIYmm7FAM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828893; c=relaxed/simple; bh=ec2oww5BN7ivg/qfTAU1hWALj/cNhDxZsl2WqkIg+Nw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NTjxLI4VaZoNYo4ADuyH1RUqSL8E8oi/RYd55bvxNesiFYNcuhbdehuPXCchNKkh08EBwtx0XN88/ayVUtyXQ9EKdBR1rN7nrKuVx9p9kBYWh3UixuWk/TGMTMW+pqLATjCy1Q2+2CvEXxQdN7yF+Za5KSZDLCem3Mmd79xgW4Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=pOxJ5fCC; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="pOxJ5fCC" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHg4OD1805118; Thu, 23 Jul 2026 17:48:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=lhisNdJOInteX2ba+ csgHxKOXloCxio/f8qCLRUnpa8=; b=pOxJ5fCC+PJKnJ1GokWYEsKsE4Dif5cJV dX869evLvuPGnDrrcnzydG21KkLGis+YEpMuoNpg5Jv/sGK3Shq93sfsS+klt830 4txLAc5dKMOE0pnfEUcukkT+lhuozGyNi+tvJS+DXyQ0UGhjEs6ba4Klq4Tj+/7c nm0VxD0Sq+/3grMAEmOXyOuOkQMTDJUJINPzDK3qpyZXz1vu2gxKduSVzX4aYdj/ XMd3WfEiWf0ZN3mjvJwRXm8EmfviJlOsueodFiFU5Ha6WJ+Yhz3VR78Esp/VG/EK gAqY+4wZ2WudJApJzELICUqkxzU+v+GgDv/Fa0MzBtHMHUoL0z8WA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77arw5n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:48:10 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NHZD5I027793; Thu, 23 Jul 2026 17:48:09 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgmtk5bq8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:48:08 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NHm5qG41484566 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 17:48:05 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E42DD2009B; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BC22A20099; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav04.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id A115F1627F1; Thu, 23 Jul 2026 19:47:54 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v3 2/8] s390/vfio_ccw: limit the number of channel program segments Date: Thu, 23 Jul 2026 19:47:45 +0200 Message-ID: <20260723174751.1180334-3-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723174751.1180334-1-farman@linux.ibm.com> References: <20260723174751.1180334-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 7SYeU6ua9KnjWBWDf7ra16TjX2UnaduK X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX2Od7T0wA61z5 fzDxT0U7oNSNHTnpE8qWlqMYSrk0xhxp0euaD6sSms0EqrNEBNszUcm1qvZog+037PmnimWyB1L jp+J7IbhCWGY2tkSjeOQOUOnyZGjN4E= X-Proofpoint-GUID: 7SYeU6ua9KnjWBWDf7ra16TjX2UnaduK X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX2ufT6oYZcUV3 JIjXkOGHHY1WaJ5WSsOFrzRhiq+W5odOhFYLROZFLkQZTMUEDfQnF0K1e9Rt8FUo6iMB0Lo7N4D kN68hgX810EM1BNfCj2jB1yZWvErQ9E+KK0s+96rDgDr95lQSYvQ6398vrFR+8SoIhxuuGcZi+Q h3yA/DEWJXbSESQ86i5CXwG5k8elQxu78HTy327qQxX3HhJb8OTRebYLNizpMrHsTlT6QVs5Rj3 KGYbKkQNwGyTIV7kEuR/d8OJmXQ77mUeybGsYmcbi8VYCMW9XkY7Wb+2UlnzEM9bSBEnnMhZQrM V4ztyUQYigTBVkPoP5P/Rdox8+nS8fM2eVPUGW0b3i4VlglHXgfo2VoPy7MxLUqBv1zBNVaRgQF Ly52jsu32OfWdmtYNhTLn2m2XF+jrjnk27yDKQ2L6db1VtmNHcpPA6o4KkjHkt0Fw1OS1WlmjLI W343YgRZxPVovJCcFBg== X-Authority-Analysis: v=2.4 cv=K7AS2SWI c=1 sm=1 tr=0 ts=6a6253da cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=sBi1HX8ECoo2m5KYV-oA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230173 Content-Type: text/plain; charset="utf-8" The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 6 ++++++ drivers/s390/cio/vfio_ccw_cp.h | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 086d1b54bdb0..1c2890d139c6 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -332,6 +332,7 @@ static struct ccwchain *ccwchain_alloc(struct channel_p= rogram *cp, int len) goto out_err; =20 list_add_tail(&chain->next, &cp->ccwchain_list); + cp->ccwchain_count++; =20 return chain; =20 @@ -441,6 +442,10 @@ static int ccwchain_handle_ccw(dma32_t cda, struct cha= nnel_program *cp) if (len < 0) return len; =20 + /* Limit number of chains in a single channel program */ + if (cp->ccwchain_count >=3D CCWCHAIN_COUNT_MAX) + return -EINVAL; + /* Need alloc a new chain for this one. */ chain =3D ccwchain_alloc(cp, len); if (!chain) @@ -745,6 +750,7 @@ int cp_init(struct channel_program *cp, union orb *orb) vdev->dev, "Prefetching channel program even though prefetch not specified in ORB"= ); =20 + cp->ccwchain_count =3D 0; INIT_LIST_HEAD(&cp->ccwchain_list); memcpy(&cp->orb, orb, sizeof(*orb)); =20 diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h index fc31eb699807..dc91a317ef19 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -23,6 +23,11 @@ */ #define CCWCHAIN_LEN_MAX 256 =20 +/* + * Maximum number of chains + */ +#define CCWCHAIN_COUNT_MAX 16 + /** * struct channel_program - manage information for channel program * @ccwchain_list: list head of ccwchains @@ -38,6 +43,7 @@ struct channel_program { union orb orb; bool initialized; struct ccw1 *guest_cp; + int ccwchain_count; }; =20 int cp_init(struct channel_program *cp, union orb *orb); --=20 2.53.0 From nobody Fri Jul 24 04:44:47 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C2FAB3A5E7A; Thu, 23 Jul 2026 17:48:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828892; cv=none; b=K4Fuy+VLivogZdskqpKZYw/HvzU5VdRr5hpIvPyRgaA54mcW5+1CiCzW6jiy/Ay8jDRrPJwyW7pteOXx/Vajz+vODoGvL4dbmXLT/TjMlDtm9BlTakeduo3wAldzH52Q7DJ+/DEQl6TFBIRILDp6gAnRfiMCgvMdnrSDA8JU+9Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828892; c=relaxed/simple; bh=vFswtA4p//bmZG11dIiJCPd2J48vRVwprbu6jW5ywp8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Au5at7VHon6ZBvXoBJ9E2cjjq+YDk/iSuXum7PwLMuez/4ND3IuO3eY5aO0E/4hjYDyE0FkQIfiKBWDjJFYVAajXPz49Uhgh8mxlbeFJ8Esbnq0fSuI/7biOqSnWstP9kFs8t2dm6wvhz4PZMKwrS5ePkLeYfbOGC7YhnRgoaQg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=bjuMxpDZ; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="bjuMxpDZ" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHgJ8K3579843; Thu, 23 Jul 2026 17:48:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=2UKf1h3GfCkMAo6UL EFfzvtbJkGh2SjHnacxPqPr60o=; b=bjuMxpDZkQGdrUALB1E6/nk2BBJC2Gsmc 5mHbdp+vJ/M+/wAMRmBeGv++4VMy7WT29osyoEk+zPHEbNcDtNNApmdbdXAkqnN1 +p8bTBmEpb2phbzgQp7UT+nbSVZDTa0CgmKGzmlQqA0QpbQZQXrTbpsZAONxQ2oA Fq/0iV6iPfK78keB2x1XonVihmAaaBF/RGabSKeGFhsPaFyOp8fZRYbxih0IKbbm xMVyP2c0NJ1Q1ykQLIX9XFPJTP9XUrJfO8gyXBobt1wtMxklzYB1CxQJp7nPV2B2 wY3dkojdJkacL/maOzLhLrhL/4DF2QIS7yXP7AEMC6LDuvuhxEwng== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg78gg8ev-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:48:09 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NHZ2vE009753; Thu, 23 Jul 2026 17:48:08 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1gn5at-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:48:08 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NHm5GM53739850 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 17:48:05 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EDA5C2009E; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C118E2009A; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav04.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id A350A1627F5; Thu, 23 Jul 2026 19:47:54 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v3 3/8] s390/vfio_ccw: fix out of bounds check on CCW array Date: Thu, 23 Jul 2026 19:47:46 +0200 Message-ID: <20260723174751.1180334-4-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723174751.1180334-1-farman@linux.ibm.com> References: <20260723174751.1180334-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX03z3GPIDTCdh XYEh4LTNbptStZkGIZsysUaby774XxoKmux4TXkDs+Lw0VSeq53gxrPMqngMQG/5hXiuep6q22b 4GF1KUulKDepq4zD295AgPOibKHLf4/XomeVTWqEnOEUAaWikxkNqxKit4DdPhLlw7nkZVWuvW8 3HAB2ML+o1HPA2QTQnkBlUV80NkIRfCUwK1e3dtVl7P+L4WL784kTrfSzbDtYG7xwcKRSBYcCrX 3GdOLHcf6bpjyNcXBO3GXdQFyOfYmjvDQvzKME80dkYUyifzWs5+bBPbvhWZKH8fc4O4rYWpmtr gEvBvRrJmyUxNNvd5ex86XXaAQ9YHzS3ouZGbUm1BASy2adgR39zGF/Ny8aqlSmSNN/V4akog9x 3k38EtdjYc0zgMzmtpH0t3v0zxLsafXiqE9fMItRD1lLlHx5LR9Qowq2BjVAqfLlfWYU1Qdu7pa MDcCys6nj2s9f1Ctn3Q== X-Proofpoint-GUID: uBGdCKDf5VZj0Vud60J0vMTuQEAHy2GU X-Authority-Analysis: v=2.4 cv=MelcfZ/f c=1 sm=1 tr=0 ts=6a6253d9 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=Ztfy0_AA8xUuwmIluScA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX/Sguq9W5dwni K5fn7MdFyjEX6T6/luEx6Z5AuIQBLBTcObmJkQQGEgLuKKBiZqNEVmCSBMdtTvo4rYTiFmTfCm3 1SJVPz8OO6AuEUGGPYqK/SkgFiD4RTI= X-Proofpoint-ORIG-GUID: uBGdCKDf5VZj0Vud60J0vMTuQEAHy2GU X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 spamscore=0 clxscore=1015 malwarescore=0 phishscore=0 adultscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230173 Content-Type: text/plain; charset="utf-8" The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs. The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error. Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 1c2890d139c6..258a99930c6a 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -393,11 +393,14 @@ static int ccwchain_calc_length(u64 iova, struct chan= nel_program *cp) if (!ccw_is_chain(ccw) && !is_tic_within_range(ccw, iova, cnt)) break; =20 - ccw++; - } while (cnt < CCWCHAIN_LEN_MAX + 1); + /* Exit the loop when we reach the maximum */ + if (cnt >=3D CCWCHAIN_LEN_MAX) { + cnt =3D -EINVAL; + break; + } =20 - if (cnt =3D=3D CCWCHAIN_LEN_MAX + 1) - cnt =3D -EINVAL; + ccw++; + } while (1); =20 return cnt; } --=20 2.53.0 From nobody Fri Jul 24 04:44:47 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50F5D38C2B0; Thu, 23 Jul 2026 17:48:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828885; cv=none; b=ciCWb+iaTekzpFZgFwPr9xgq8/11OX9birKnrL8Wn0Gcq441JlLgG40NSDW8NaYHdEp2uGQvqm6OgbDa9ZkcE6AgiBMm/ADVpL1UOBbo9iDGT+7JaVfu9Dd+GOYyOtIaqB9EVn4YLt9Lx3F/B27Ctq5SxRTZJqnXkHfWzi24WME= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828885; c=relaxed/simple; bh=Qih2tjByuAGzHkjSqVMNBnjKPG1/SjTKiFCxMcP2k+8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U5hlF+G5M2Cmg2BNdO9CzTlHae0lQiCmChL4lr7j1k7xdH6A+Cc4YHR7UiU/SEECYeih1r1SbV02eZOcO2QURxYpTLNG4DRZF9ZCzk4X1ZQcc7m+NnjaEoUN5ijXw4ACuNI0esCO2OiqHr7/yjeyXPsRPMjLtvtJzRJa7ZkUtPI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=n16XulLq; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="n16XulLq" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHfpOk3607112; Thu, 23 Jul 2026 17:47:59 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Sg6EsbFs8cz3KtuXj PEJQlbnrdmyb2/7ZFIH540gxsY=; b=n16XulLqObSIRYtNDi1/ejHmmMXfoxDTU +S/TNIrtDkP6cTE029frq4u3oX8+zTzKMOfDezjgdhXJhGPMJQorSCXWiGFmdo9o j1XignzmYjqlyRK/YTnc8DA6UWPV2e4Rsb0I0vjQbwi8NzHnRSGRg/Loq/PcyhGF 4wdy99vpSya53i5MjI+SDyXrsPGL3yvnc4vtDgKFY/hCDMnr4NzXq2HR5bJTmV4b EUcAkh1c1mhKyW/4qp0dNQKIXwDsC9GArGWW4+t1PW3QLo24xihdSG+KWuP26iCC kl4vg8CAkYIhvuuFCisBL/H5QO9uxys8N7cvNizNZm2d0BknGJ+ng== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77kgasp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:47:59 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NHZFWB027893; Thu, 23 Jul 2026 17:47:58 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgktqdgx3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:47:58 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NHltMO30867790 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 17:47:55 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E16C5200B5; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BE0CA200B4; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav02.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id A57A31627F8; Thu, 23 Jul 2026 19:47:54 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v3 4/8] s390/vfio_ccw: ensure first IDAW remains constant Date: Thu, 23 Jul 2026 19:47:47 +0200 Message-ID: <20260723174751.1180334-5-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723174751.1180334-1-farman@linux.ibm.com> References: <20260723174751.1180334-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=HJXz0Itv c=1 sm=1 tr=0 ts=6a6253cf cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=EVDxiZbKT-KwyQ_dKrEA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX49gv+PMK6hVu xF7Hpf1G/RCisyH4O9yTfncSAC78ianupRRJFte9ucJX0Nfi7q5gB3zTd9p6aY7PQ16IJZMnGGI 5x6ougJ7WWp+pqa5g3jp0bIjLZx+np1/G0/DJU/Ubb4zPNYBOCMd7190polWKqRMsgxkTXwzcAW jB6qSrwIGCcnjsiYWf6X064fBlKMAo1gblmMYThAf7brolarpdztb6WB9J/YHTJoLxtb/Gyepto OtQ32MRaXMBRy/+Sb9nEabujf6ShV6a3a87QYnUIXLpZWr1f9VsEwtQYe7LnEoNon1nbJS42/Zd D57RYLZwiEfrj4hpLuOdECldpukbeBmdoS9Aamjw+qecnJmOQMA8zwECyzP7aXVWPckQKtMcuhY j2VdkV5tonFKcHbk5ijlSdIw1t1pXZyqY52DILPE9oUiWu0J2PN/UX4VaWAvP8+BFBGEyZ9WpC+ oWiGBqO8yQbkW7y8KtA== X-Proofpoint-ORIG-GUID: AA16bkr20n2wJQLwCyfT4DzXxOAX4A5N X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfXzLnR2jmuVQeT bZi+Te1UOKNL2JDaxUGVwhEItbH8tncvjB8G2fxa2vE81maUr8V/APKRvYQr3pU4bNKQ14zVfGs boDcS2WXx51eZI4NhT1bqlayfayMP6w= X-Proofpoint-GUID: AA16bkr20n2wJQLwCyfT4DzXxOAX4A5N X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 impostorscore=0 clxscore=1015 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230173 Content-Type: text/plain; charset="utf-8" The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with. Fixes: 01aa26c672c0 ("s390/cio: Combine direct and indirect CCW paths") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 15 +++++++++++++++ drivers/s390/cio/vfio_ccw_cp.h | 1 + 2 files changed, 16 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 258a99930c6a..06b6bc6142a0 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -533,6 +533,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct= channel_program *cp, int &container_of(cp, struct vfio_ccw_private, cp)->vdev; dma64_t *idaws; dma32_t *idaws_f1; + u64 first_idaw; int idal_len =3D idaw_nr * sizeof(*idaws); int idaw_size =3D idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE; int idaw_mask =3D ~(idaw_size - 1); @@ -549,6 +550,17 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struc= t channel_program *cp, int kfree(idaws); return ERR_PTR(ret); } + + if (cp->orb.cmd.c64) + first_idaw =3D dma64_to_u64(idaws[0]); + else + first_idaw =3D dma32_to_u32(idaws[0] >> 32); + + /* Unexpected mismatch from earlier read */ + if (first_idaw !=3D cp->guest_iova) { + kfree(idaws); + return ERR_PTR(-EINVAL); + } } else { /* Fabricate an IDAL based off CCW data address */ if (cp->orb.cmd.c64) { @@ -614,6 +626,9 @@ static int ccw_count_idaws(struct ccw1 *ccw, iova =3D dma32_to_u32(ccw->cda); } =20 + /* Save the read address for later */ + cp->guest_iova =3D iova; + /* Format-1 IDAWs operate on 2K each */ if (!cp->orb.cmd.c64) return idal_2k_nr_words((void *)iova, bytes); diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h index dc91a317ef19..d547dbc969cc 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -43,6 +43,7 @@ struct channel_program { union orb orb; bool initialized; struct ccw1 *guest_cp; + u64 guest_iova; int ccwchain_count; }; =20 --=20 2.53.0 From nobody Fri Jul 24 04:44:47 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38851369219; Thu, 23 Jul 2026 18:14:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784830452; cv=none; b=YbgLC3JZWWAzpuJYNvtH6lnKhb1fERRmJN0MNgjkqzjpzd4azwPiSuBuciT/K51x3mdvltlPDH+PprsfhUCB7QAQo1PlvD6pCUavV8MZtZpKjOmK1LhSpqRmjqWEdtpzrQrfWWSgMWO9EVKiird2ky3R71HJwvGJ4Avxgz5yvkw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784830452; c=relaxed/simple; bh=6/JMiugfV4sScU55OBvsvxuy80I6llEI6X5XFacqoc8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aroMWNKwFaYtR02vzjsZsY8IziYopBITrLdUUv7VuXsZBNObtpOQ84WmUNA4uVzMd1sy7U0cwj/AwKeI7EkzzCVNB3CW5ggGl2gMzFKyZfP429MvF78OmuLX1MWb2W5BEweZ6Y0sf6DV9hpRF3QIkumrF3aSV0AN9D1VcLuzJWM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=g+h9F6Id; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="g+h9F6Id" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHfjCQ3606697; Thu, 23 Jul 2026 18:14:05 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=yXRPadUaCSXOsF4LQ AqW3fNWZ5XVvc2gI0Yb7jyrxiM=; b=g+h9F6Id1JksZO7DH0lkHcrLVVOr2PWIp 8/+0BHHWr54vrWbEcyltyKA27obRW9P5fh59CBBwNuncFfnksXIt8oAeZq3u4FW9 WoKhDeciV73HRwiukPl8+dAXP1m00cRr7rT/CawVIotRO8cV+hYCyK+CumpUfNX+ 41Bl5W41d2v34xiCraPDQwSFVem193YvZm6Kp9NZHu5VoY+5zC3Yv8LfyO4Xx4MC 7vEbE8FkSdEYH2M1TXRQSX9UUWyJ4uZq6ntGLJk9c67oxRcyB+SKMLdIRZTNWn/K cgMJRKBNXnwNhlSKFPHtbxbmHH++EldOgSTvrGufE74fcSiSRu9ag== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77kge2c-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:14:05 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NI4aiY002235; Thu, 23 Jul 2026 18:14:04 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgpgyn67u-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:14:04 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NIE0MX38011368 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 18:14:00 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1202B200DA; Thu, 23 Jul 2026 17:47:55 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E50F8200D9; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav07.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id A7E941627FA; Thu, 23 Jul 2026 19:47:54 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , sashiko-bot , stable@vger.kernel.org Subject: [PATCH v3 5/8] s390/vfio_ccw: calculate idal length based on idaw type Date: Thu, 23 Jul 2026 19:47:48 +0200 Message-ID: <20260723174751.1180334-6-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723174751.1180334-1-farman@linux.ibm.com> References: <20260723174751.1180334-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=HJXz0Itv c=1 sm=1 tr=0 ts=6a6259ed cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=Qev3T-O1x3Ov5i2I8JAA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfX7mFC631alW/N rkwZ+Xs0kiC4nTx3Q8mxJ6iRbS7UEarz+4x4s8RRNH4glsn6Su3uKKdb1lCdbPcf458AWZPrfp4 xfZB5pCngCXHBxhOUtOXOmivDO3IpyYX+23SXPsBPv7cg3ltKxY+gPEbQU4jYzfpowehZXAYncx A7PwF39ygNeWF3055uoo0Oddn9qsmlQKU+n97amYe5pLK4Z1WjBIPdwPrdQv2GbPekhgrN320Qm JNXHwky0H333zwqnt6D4Mrrdg5chdohSo/Mc1kOxFzSVOvVtM/+RG8nNnP43Oedn45Zp/eTFtxZ Eacc8c6n9rWq8zjvb/DIRHnjZf1N10IXpE6Xj2066DcFTLM6tL/+LT5q0+te88hS4lNocxg1F8+ AoQx0LWF/bgIb+XScpFS/bPxnJ1wYkEFsYW+3oJoGLwxx+8pVCr4dfT+d38qTwjOHocOnNLKoBh u3QR95sw5VTXOLVX/WA== X-Proofpoint-ORIG-GUID: ufGEs_rcLHRfZPwj5PB2XaTrLjChfJ-j X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfX9dC+GTztzm/E YejAHjYpADW1RfhhPnfQKx09R0GaLmQSgjLv3/Qm9QLeNMDfT5dkDFv3M3PBvSkYK3pTEXw2qCD 2WtIRpjbHkWMzHYsIDVZGyAQA+pM0dA= X-Proofpoint-GUID: ufGEs_rcLHRfZPwj5PB2XaTrLjChfJ-j X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 impostorscore=0 clxscore=1011 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230178 Content-Type: text/plain; charset="utf-8" Sashiko pointed out that get_guest_idal() unconditionally calculates the length of the IDAL presuming everything is a Format-2 IDAW. The output of vfio-ccw is always Format-2, but the input can be either Format-1 (31-bit addresses) or Format-2 (64-bit addresses). As a result, the size of the guest IDAL may be incorrect and should be trimmed down. Reported-by: sashiko-bot Link: https://lore.kernel.org/r/20260720203400.7328E1F000E9@smtp.kernel.org/ Fixes: 1b676fe3d9d3 ("vfio/ccw: handle a guest Format-1 IDAL") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 06b6bc6142a0..b4a041d35bba 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -233,6 +233,7 @@ static void convert_ccw0_to_ccw1(struct ccw1 *source, u= nsigned long len) } =20 #define idal_is_2k(_cp) (!(_cp)->orb.cmd.c64 || (_cp)->orb.cmd.i2k) +#define get_idaw_size(_cp) ((_cp)->orb.cmd.c64 ? sizeof(u64) : sizeof(u32)) =20 /* * Helpers to operate ccwchain. @@ -534,7 +535,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct= channel_program *cp, int dma64_t *idaws; dma32_t *idaws_f1; u64 first_idaw; - int idal_len =3D idaw_nr * sizeof(*idaws); + int idal_len =3D idaw_nr * get_idaw_size(cp); int idaw_size =3D idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE; int idaw_mask =3D ~(idaw_size - 1); int i, ret; @@ -602,7 +603,7 @@ static int ccw_count_idaws(struct ccw1 *ccw, struct vfio_device *vdev =3D &container_of(cp, struct vfio_ccw_private, cp)->vdev; u64 iova; - int size =3D cp->orb.cmd.c64 ? sizeof(u64) : sizeof(u32); + int size =3D get_idaw_size(cp); int ret; int bytes =3D 1; =20 --=20 2.53.0 From nobody Fri Jul 24 04:44:47 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4EFA33F5B3; Thu, 23 Jul 2026 17:48:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828887; cv=none; b=dbFUoDVc2MC7wHdpvnzJfiVpsdZ3pDTYP9tYbb+RpghgQ7KgTdVXNHLz3izrUlx8WXPGOeUzrxqoJBApsAvTL/0lWq564B/s1lzBgp11G+F/3FaKrbYhyehol0Bp0AAHk9fRbceMkBObvZIvWPdVgRwWn7Tdqn8KhEZeo8ql6DE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828887; c=relaxed/simple; bh=H8YIdGBw5uFaeE3x06j545JlwLifLUC/A60Bef2Q6kU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZIyC+xScFeQcbv9VUEuVguBURv88wzxaqpqDTJGGhSYK8VFA0fRb6cQ1qXiYiwmqPbP9CV5T9ek+gkGKkN6Cmtrbg03GM+LXSHTX/EvWOsnLsSk+g/aMExWaA3duE64BIM8MOBTdhm5Stry+YlP/wnjXPoHMKfDyaSQaAtOAxFg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Br913p6w; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Br913p6w" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHgFWf3579741; Thu, 23 Jul 2026 17:48:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=fCdCgUJj2u35Em7G5 34+P/9lVy3TN3dd6FQ6FUa2caM=; b=Br913p6wwnhQmB9YWugxyjV7uAe0WqIHw 7NSPycBcltq6iD/hDZ989W5b9EOkvbzHABlmUSKzbWpRCxlDGPtqfHoVgRnSlL31 MihapCyToTMW/7ztEcFU8/cnnaI0T56A85uetAOZ8gQDPwu+m3ioAdth4qreb+6d 30mrjMOGDN8E9gM+R/0YV7oIFBMw4rOTVhBvthiKcAIGNDv5hRTkTlYfLnXZWLwZ RzabkyNk0CUWpS5Qbi0mPkCyheTMqjxS14eLNaC58td/AkhniAiUWoGnJTQRP35A B9roDI6Kd/BiUgDECXtVB2If5Pr5uYiWy0gVb0LZkpiGBRUjizxpQ== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg78gg8e5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:47:59 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NHZ29n009744; Thu, 23 Jul 2026 17:47:58 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1gn59r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:47:58 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (smtpav01.fra02v.mail.ibm.com [10.20.54.100]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NHltUl59965704 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 17:47:55 GMT Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1C76B2004E; Thu, 23 Jul 2026 17:47:55 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E8D832004B; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav01.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id AA1491627FE; Thu, 23 Jul 2026 19:47:54 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Cornelia Huck Subject: [PATCH v3 6/8] s390/vfio_ccw: ensure index for read/write regions are within range Date: Thu, 23 Jul 2026 19:47:49 +0200 Message-ID: <20260723174751.1180334-7-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723174751.1180334-1-farman@linux.ibm.com> References: <20260723174751.1180334-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfXwEVc5VTGemmZ oxoAx1po24JwDslz04QZ1X2nrOdNrW0t3B8/o/FUadJDxwH9m/SJzFlJzfZDkc3QO3ekRXirRZ0 Gi63uMASZMqjN1HXlJnqb8OYWJO02AapIsWgNEZJ81unbOmDq20fA6l7my5OLpGVd2p+4Q2e/7y pBuXCBw4QYri7bGJn4DEgsIx1I8luhvVOo8R8NMHNSKv8WoXxR5AIv3jtM6FgHRh+UiBmwdeIxT XO4olnueknJ/lxujO+KpbmI8bbcDZBcMsOKHuJdmEocywzmx++HiARStIGYic6ASzkKULdH4X2z xVtjOO9NgqMOuJ5+/Ny3+2V79o9XJ/dQmda8ZwJH3+Okzg/LZHTyuetCmCOh8DWifA+wYQv60Re SX8tJ5HKKX9Swq6LTmFfDp7WXDDqdX0CdXs6z5cAJfzRhA2LkJyynWMUSTeSe5whomdHl6uMojV EDMVYZlEGhreLd2wHIQ== X-Proofpoint-GUID: KvS7wbp4r8kIJV8UczqpWNmUCVWF3Efy X-Authority-Analysis: v=2.4 cv=MelcfZ/f c=1 sm=1 tr=0 ts=6a6253cf cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=bDB7FJViJsEbW-YDbMsA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfXyO2sDG5IcCNM 0AHNfU0Z5I8Gs/wuN1BO+sjaEL0TLFHZpvXI0TqExynr07fEruaf7YL8gdwHvzQC7MgK4vUmn+4 ibonDrUamnz8V0aUyAVkVOgQl4HU5+A= X-Proofpoint-ORIG-GUID: KvS7wbp4r8kIJV8UczqpWNmUCVWF3Efy X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 spamscore=0 clxscore=1015 malwarescore=0 phishscore=0 adultscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230173 Content-Type: text/plain; charset="utf-8" The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced. Fixes: db8e5d17ac03 ("vfio-ccw: add capabilities chain") Cc: stable@vger.kernel.org Cc: Cornelia Huck Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_async.c | 4 ++++ drivers/s390/cio/vfio_ccw_chp.c | 4 ++++ drivers/s390/cio/vfio_ccw_ops.c | 7 +++---- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_async.c b/drivers/s390/cio/vfio_ccw_= async.c index 420d89ba7f83..f213f62f6641 100644 --- a/drivers/s390/cio/vfio_ccw_async.c +++ b/drivers/s390/cio/vfio_ccw_async.c @@ -8,6 +8,7 @@ */ =20 #include +#include =20 #include "vfio_ccw_private.h" =20 @@ -24,6 +25,8 @@ static ssize_t vfio_ccw_async_region_read(struct vfio_ccw= _private *private, return -EINVAL; =20 mutex_lock(&private->io_mutex); + + i =3D array_index_nospec(i, private->num_regions); region =3D private->region[i].data; if (copy_to_user(buf, (void *)region + pos, count)) ret =3D -EFAULT; @@ -48,6 +51,7 @@ static ssize_t vfio_ccw_async_region_write(struct vfio_cc= w_private *private, if (!mutex_trylock(&private->io_mutex)) return -EAGAIN; =20 + i =3D array_index_nospec(i, private->num_regions); region =3D private->region[i].data; if (copy_from_user((void *)region + pos, buf, count)) { ret =3D -EFAULT; diff --git a/drivers/s390/cio/vfio_ccw_chp.c b/drivers/s390/cio/vfio_ccw_ch= p.c index 38c176cf6295..bf678270c457 100644 --- a/drivers/s390/cio/vfio_ccw_chp.c +++ b/drivers/s390/cio/vfio_ccw_chp.c @@ -9,6 +9,7 @@ */ =20 #include +#include #include #include "vfio_ccw_private.h" =20 @@ -26,6 +27,8 @@ static ssize_t vfio_ccw_schib_region_read(struct vfio_ccw= _private *private, return -EINVAL; =20 mutex_lock(&private->io_mutex); + + i =3D array_index_nospec(i, private->num_regions); region =3D private->region[i].data; =20 if (cio_update_schib(sch)) { @@ -97,6 +100,7 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_ccw_= private *private, list_del(&crw->next); =20 mutex_lock(&private->io_mutex); + i =3D array_index_nospec(i, private->num_regions); region =3D private->region[i].data; =20 if (crw) diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index 45ec722d25ea..032a1cdf4df7 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -243,6 +243,7 @@ static ssize_t vfio_ccw_mdev_read(struct vfio_device *v= dev, return vfio_ccw_mdev_read_io_region(private, buf, count, ppos); default: index -=3D VFIO_CCW_NUM_REGIONS; + index =3D array_index_nospec(index, private->num_regions); return private->region[index].ops->read(private, buf, count, ppos); } @@ -295,6 +296,7 @@ static ssize_t vfio_ccw_mdev_write(struct vfio_device *= vdev, return vfio_ccw_mdev_write_io_region(private, buf, count, ppos); default: index -=3D VFIO_CCW_NUM_REGIONS; + index =3D array_index_nospec(index, private->num_regions); return private->region[index].ops->write(private, buf, count, ppos); } @@ -338,11 +340,8 @@ static int vfio_ccw_mdev_ioctl_get_region_info(struct = vfio_device *vdev, VFIO_CCW_NUM_REGIONS + private->num_regions) return -EINVAL; =20 - info->index =3D array_index_nospec(info->index, - VFIO_CCW_NUM_REGIONS + - private->num_regions); - i =3D info->index - VFIO_CCW_NUM_REGIONS; + i =3D array_index_nospec(i, private->num_regions); =20 info->offset =3D VFIO_CCW_INDEX_TO_OFFSET(info->index); info->size =3D private->region[i].size; --=20 2.53.0 From nobody Fri Jul 24 04:44:47 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AD35A38E8D8; Thu, 23 Jul 2026 17:48:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828884; cv=none; b=b0KWRYF4lBDubhkHx952YWfvYdrqdHyjtBCwKp0IcpRmjeWqebpRNlmT+l5Tq3k9L4qcoEsYooRR+QklzZLThvfqbX9SgE8eJQeiMVycNAF42yHycCugyeTEjVsPtagUmWwmQNsqJSEi+wHzeeN30iRnERBI1qFbGuwWDiaDJvE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828884; c=relaxed/simple; bh=CGHOSA4YvKqaToYBuBTQmTKjYIPCjI8nZiGJ0sYR1UU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rSR6KADdvNF+Nx6cpx0oHyK1+wVnPfubgYMkiWM5tDBmM4jE9iUBSe+tW3CATtIE749CvpsqpKjfNcCKTnLNxoc2hJyITGjGeTFjIys6hw8mXmlMBsf1xixdOOQvwm77F5C+rv6jTk2RqDIgzzEV82Ynx3viheqRR0zxhDoflHU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=GbBpq2J3; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="GbBpq2J3" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHg44r3688684; Thu, 23 Jul 2026 17:48:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=dIjI9qQbTOc0RPofm UxkbZs77CEJzKdRYNgemPgjOAs=; b=GbBpq2J33kJ2br+OEttD8ZgQX+Y++6oKu fyaTgp3KcIjX2eLGn6jzcDskgmmq3EWDEBEL0fDYz3Y462NRh7z4N3Z7kDWuJ4+n cd5PuFc93QJ8SFy2k1jgCxnecs4idG2Z0jC2eL8/pjOwNfaW4PAk7BmgVTNRZo7z d2bmfS2AOFMMZkZxs0feSKqhBnF4si/Iq9YZM5UlADz0XKoBSGGfUFShaAcrHU09 EUKa2wg/hKC5DScdnqbhCK2L8g4ING9/dKYTGdzfXVQw5UgoLcG25uA5D+SLypMQ Nbaa1SHSBq18ibylxOmc02Z/5ZMxho8+lzPxFmqLhTLIuZpWwEivA== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7ahg96t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:47:59 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NHZ22k009756; Thu, 23 Jul 2026 17:47:58 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1gn59s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:47:58 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (smtpav01.fra02v.mail.ibm.com [10.20.54.100]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NHltoD54657476 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 17:47:55 GMT Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1F1192004F; Thu, 23 Jul 2026 17:47:55 +0000 (GMT) Received: from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EE6872004D; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav01.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id AC26C162801; Thu, 23 Jul 2026 19:47:54 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v3 7/8] s390/vfio_ccw: implement a channel program mutex Date: Thu, 23 Jul 2026 19:47:50 +0200 Message-ID: <20260723174751.1180334-8-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723174751.1180334-1-farman@linux.ibm.com> References: <20260723174751.1180334-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: ofEI0HrvVNBBT2juYtml7t_DL8n6143N X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX4UTYf8C+g5Rw zvkwcJMTDOzIZOAIUgS1z2cRdC5KKjFGnDt+7UM2U23671cEmnMPPWGWKhG7ZqEY7x2n9vnY1XD ZdF/1rGa+Ktm54V6R3g09C9iaiWsvlLW7zTDl7G2rK2ZgW6uRYF7OnDNyXeQEjtZrehP1PbRvzZ +0gNN6SnpVS9w+VakCa0FPGKnLyNCfAWjMffiX4mx64isEfoi8zwMChvnLvlZV8E4sCTnROsKzD pQgWRBiD4AxkGYCeL2C4oCGgoqMP7on/QIkRL+1Md82hrywG1aA60lxESan17lKaa5WTgZtNb/b o0Thgg4heKwY9ZfCeDOr5HBpFaK6TJP6Er3H80kX89a+iOr0Yrr/8GD9RIJg3FRvCItIILE1r7O rEtkHjkzui48Ksqh5mY6etZ/cTe3ZfpGS+cIWwKCiJq/P2MPu5IrMFKu+biQfEcIpZBu67sl141 qYM/WbwJWnwnDTkCf2g== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX//eGdmm8e6IX MlZjXx+jiveLKhl80JNcf6ZygyKBmbw2sX7s8ktdms5QogebNhCYiict/9GqCcW6rCOTI82iD2Q Ca3PaEjjlcJVooMNovcrdE7yRkThY1E= X-Proofpoint-GUID: ofEI0HrvVNBBT2juYtml7t_DL8n6143N X-Authority-Analysis: v=2.4 cv=SM5ykuvH c=1 sm=1 tr=0 ts=6a6253cf cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=DdavvDh8zCgnNAJguYcA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 spamscore=0 malwarescore=0 priorityscore=1501 phishscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230173 Content-Type: text/plain; charset="utf-8" The channel_program struct is manipulated without a serialization mechanism to ensure consistent behavior. Take a broad stroke of putting the entire structure behind a mutex, and ensure everything that needs private->cp holds this mutex. There are a couple where the cio layer's subchannel->lock performs this role in this code, which isn't correct (it should only be used when touching the actual subchannel, like cio_enable_subchannel()), so adjust the locations where that spinlock is acquired/released to correctly coexist with this new mutex. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_drv.c | 10 +++++++++- drivers/s390/cio/vfio_ccw_fsm.c | 22 +++++++++++++++------- drivers/s390/cio/vfio_ccw_ops.c | 10 +++++++++- drivers/s390/cio/vfio_ccw_private.h | 3 +++ 4 files changed, 36 insertions(+), 9 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_dr= v.c index 1a095085bc72..1d8c2ed9da50 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -91,6 +91,8 @@ void vfio_ccw_sch_io_todo(struct work_struct *work) =20 is_final =3D !(scsw_actl(&irb->scsw) & (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); + + mutex_lock(&private->cp_mutex); if (scsw_is_solicited(&irb->scsw)) { cp_update_scsw(&private->cp, &irb->scsw); if (is_final && private->state =3D=3D VFIO_CCW_STATE_CP_PENDING) { @@ -98,6 +100,8 @@ void vfio_ccw_sch_io_todo(struct work_struct *work) cp_is_finished =3D true; } } + mutex_unlock(&private->cp_mutex); + mutex_lock(&private->io_mutex); memcpy(private->io_region->irb_area, irb, sizeof(*irb)); mutex_unlock(&private->io_mutex); @@ -259,12 +263,16 @@ static int vfio_ccw_sch_event(struct subchannel *sch,= int process) rc =3D 0; =20 if (cio_update_schib(sch)) { - if (private) + if (private) { + spin_unlock_irqrestore(&sch->lock, flags); vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); + goto out; + } } =20 out_unlock: spin_unlock_irqrestore(&sch->lock, flags); +out: =20 return rc; } diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fs= m.c index 4d7988ea47ef..9fbe97bd23f9 100644 --- a/drivers/s390/cio/vfio_ccw_fsm.c +++ b/drivers/s390/cio/vfio_ccw_fsm.c @@ -25,17 +25,15 @@ static int fsm_io_helper(struct vfio_ccw_private *priva= te) unsigned long flags; int ret; =20 - spin_lock_irqsave(&sch->lock, flags); - orb =3D cp_get_orb(&private->cp, sch); - if (!orb) { - ret =3D -EIO; - goto out; - } + if (!orb) + return -EIO; =20 VFIO_CCW_TRACE_EVENT(5, "stIO"); VFIO_CCW_TRACE_EVENT(5, dev_name(&sch->dev)); =20 + spin_lock_irqsave(&sch->lock, flags); + /* Issue "Start Subchannel" */ ccode =3D ssch(sch->schid, orb); =20 @@ -71,7 +69,6 @@ static int fsm_io_helper(struct vfio_ccw_private *private) default: ret =3D ccode; } -out: spin_unlock_irqrestore(&sch->lock, flags); return ret; } @@ -171,7 +168,9 @@ static void fsm_notoper(struct vfio_ccw_private *privat= e, private->state =3D VFIO_CCW_STATE_NOT_OPER; =20 /* This is usually handled during CLOSE event */ + mutex_lock(&private->cp_mutex); cp_free(&private->cp); + mutex_unlock(&private->cp_mutex); } =20 /* @@ -252,6 +251,8 @@ static void fsm_io_request(struct vfio_ccw_private *pri= vate, private->state =3D VFIO_CCW_STATE_CP_PROCESSING; memcpy(scsw, io_region->scsw_area, sizeof(*scsw)); =20 + mutex_lock(&private->cp_mutex); + if (scsw->cmd.fctl & SCSW_FCTL_START_FUNC) { orb =3D (union orb *)io_region->orb_area; =20 @@ -300,6 +301,8 @@ static void fsm_io_request(struct vfio_ccw_private *pri= vate, cp_free(&private->cp); goto err_out; } + + mutex_unlock(&private->cp_mutex); return; } else if (scsw->cmd.fctl & SCSW_FCTL_HALT_FUNC) { VFIO_CCW_MSG_EVENT(2, @@ -320,6 +323,7 @@ static void fsm_io_request(struct vfio_ccw_private *pri= vate, } =20 err_out: + mutex_unlock(&private->cp_mutex); private->state =3D VFIO_CCW_STATE_IDLE; trace_vfio_ccw_fsm_io_request(scsw->cmd.fctl, schid, io_region->ret_code, errstr); @@ -410,7 +414,11 @@ static void fsm_close(struct vfio_ccw_private *private, =20 private->state =3D VFIO_CCW_STATE_STANDBY; spin_unlock_irq(&sch->lock); + + mutex_lock(&private->cp_mutex); cp_free(&private->cp); + mutex_unlock(&private->cp_mutex); + return; =20 err_unlock: diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index 032a1cdf4df7..04800cfa779b 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -38,8 +38,13 @@ static void vfio_ccw_dma_unmap(struct vfio_device *vdev,= u64 iova, u64 length) container_of(vdev, struct vfio_ccw_private, vdev); =20 /* Drivers MUST unpin pages in response to an invalidation. */ - if (!cp_iova_pinned(&private->cp, iova, length)) + mutex_lock(&private->cp_mutex); + if (!cp_iova_pinned(&private->cp, iova, length)) { + mutex_unlock(&private->cp_mutex); return; + } + + mutex_unlock(&private->cp_mutex); =20 vfio_ccw_mdev_reset(private); } @@ -50,6 +55,7 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) container_of(vdev, struct vfio_ccw_private, vdev); =20 mutex_init(&private->io_mutex); + mutex_init(&private->cp_mutex); private->state =3D VFIO_CCW_STATE_STANDBY; INIT_LIST_HEAD(&private->crw); INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo); @@ -90,6 +96,7 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) out_free_cp: kfree(private->cp.guest_cp); out_free_private: + mutex_destroy(&private->cp_mutex); mutex_destroy(&private->io_mutex); return -ENOMEM; } @@ -141,6 +148,7 @@ static void vfio_ccw_mdev_release_dev(struct vfio_devic= e *vdev) kmem_cache_free(vfio_ccw_cmd_region, private->cmd_region); kmem_cache_free(vfio_ccw_io_region, private->io_region); kfree(private->cp.guest_cp); + mutex_destroy(&private->cp_mutex); mutex_destroy(&private->io_mutex); } =20 diff --git a/drivers/s390/cio/vfio_ccw_private.h b/drivers/s390/cio/vfio_cc= w_private.h index 0501d4bbcdbd..ac5aaa78a74b 100644 --- a/drivers/s390/cio/vfio_ccw_private.h +++ b/drivers/s390/cio/vfio_ccw_private.h @@ -94,6 +94,7 @@ struct vfio_ccw_parent { * @schib_region: MMIO region for SCHIB information * @crw_region: MMIO region for getting channel report words * @num_regions: number of additional regions + * @cp_mutex: protect against concurrent update of CP resources * @cp: channel program for the current I/O operation * @irb: irb info received from interrupt * @scsw: scsw info @@ -115,7 +116,9 @@ struct vfio_ccw_private { struct ccw_crw_region *crw_region; int num_regions; =20 + struct mutex cp_mutex; struct channel_program cp; + struct irb irb; union scsw scsw; struct list_head crw; --=20 2.53.0 From nobody Fri Jul 24 04:44:47 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 69BC13909AB; Thu, 23 Jul 2026 17:48:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828884; cv=none; b=TEPnoy3OdUw+C0fSr8oadiTRZZwxo76d/v1KGdpVytQZ5v2L5b32DtrrzmNfDkpoEM8Q+qz4u9/hGbfs0sSfs13D/pv79ug4kW1LGInCMFwqKmnX/uWczHuVHtDAUkgNqUPdHfA1EHVbZa3BTRdkcIRdRqczBeZ1ekcgI3SmlB0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828884; c=relaxed/simple; bh=g+KDBnTPFlTv2aIMsJAmJAaZVOfMwE8EFTe20OL6DM8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AKv+zgvBFYgunVjZ+0bZA/PWRxDh6xClmqfeTZOF8gmX0odLcZABUKIPw3chaaHcpKOdmk/4RzidtTgIFlPsi4Q4GTe3sQjUlJG1D2GtJkPi35TmapIXOtUvdRd1ILNSy7iHxb7B39A3+kPM6vlak0yf/INLKyCPWEhRUZYB318= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=q9b6bFmV; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="q9b6bFmV" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHgKuY1805437; Thu, 23 Jul 2026 17:48:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=jmi2Xqml8iJ+sFhyD wakqzIGwE442sctsbJrKFG1D0M=; b=q9b6bFmVU0QeXaYBN583H8OtIGqIfFyXI lyXa37A+7/LEM0cC96hVoLhfqNnVngjzfUo8rJGKuY6Na8SRvPWXoqin91sZcLdF Sk0tb57JYL0NcoQY8qNJ+qjLby8AcPAcl5UeKnEzVpnlwszXu4Xl9vLObYVmdltS DrCcc97luKqW0avO5OUQ4Zgv54AeYpyIWfU5ZwGjiCNwL0rzbqNnWlQ50CPya1Nx QAFfQJLoVN3x+nW7tF/dk24vqLeMb/b2usqvD90PjTMgNiXbGlF3r65q4RzeGwlA 5pXAMR6I90xcmEI3nuqF82ggkS0KHRPQ6MSeqxcyhBZlqqzYE5QmA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77arw4y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:48:00 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NHZD5A027793; Thu, 23 Jul 2026 17:47:59 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgmtk5bpc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 17:47:59 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NHltqY60359034 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 17:47:55 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1BCFA20043; Thu, 23 Jul 2026 17:47:55 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EDEBD20040; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav03.fra02v.mail.ibm.com (Postfix) with SMTP; Thu, 23 Jul 2026 17:47:54 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id AE4F7162803; Thu, 23 Jul 2026 19:47:54 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Farhan Ali Subject: [PATCH v3 8/8] s390/vfio_ccw: implement a crw lock Date: Thu, 23 Jul 2026 19:47:51 +0200 Message-ID: <20260723174751.1180334-9-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723174751.1180334-1-farman@linux.ibm.com> References: <20260723174751.1180334-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: bgtAFuClzCIx4xB1kz-Rtd-FR0vDqFZD X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX1jYqx8JkMBk2 mnUYKqO0HRDT+e1h+vGX+aKzTY3Oke3Rhv/pSeUdCyVKVBXdl2bcrSKLNuhMFAiFoTMsxC+E6Sl l7Zi4y/AZYglMFHdjPRM5kMgjlN8fUk= X-Proofpoint-GUID: bgtAFuClzCIx4xB1kz-Rtd-FR0vDqFZD X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3MyBTYWx0ZWRfX2QGs2z+kanpQ nku7+8W0kgkwzBSXOehsAnNsQDvfvb1+LzFt/0a0iogap2y4hqmrllO3jY8AVOSh1sbia2Cd+XO uzH1ti2JsnXDfZP6fyz4e5TzqoqFTZM1eLeX/Ns8XPxJWFh8Bvu9PeILH3awOZAEwGzqG/Ee4oT YEkDTOGyxS3G0xchZBmscd8AfDKeBsaHDMGlyPGjb/5OSlB7Z31Bjqf216YKskt0PhmLFV1NZdS 6n8ihQ80yBuOEwzEy3Fz2WZ29sq7NrocB6/iNgjsejKxd0Cx/PpoRRfxX8wPel4AixV2agNeHe1 d6E6x+h1l6WAVVuhCUOkt046Ox5G9Bw/MQitBsiXiQaXbCUGjIdxuTmiyC/gU8KDsilXXQlBSLy N81WeB/A6mUoAv6vOO2qoewI+kBf8hIyBnOp3mrKi8IchJk3NlD3aiTHZ9zQX7ZeYSZI3tub2jO qw290ZkvcJOpMuMjGqw== X-Authority-Analysis: v=2.4 cv=K7AS2SWI c=1 sm=1 tr=0 ts=6a6253d0 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=0_ASXfQLkdswD2wDWUsA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230173 Content-Type: text/plain; charset="utf-8" Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively. Fixes: 3f02cb2fd9d2 ("vfio-ccw: Wire up the CRW irq and CRW region") Cc: stable@vger.kernel.org Cc: Farhan Ali Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_chp.c | 17 +++++++++++------ drivers/s390/cio/vfio_ccw_drv.c | 4 ++++ drivers/s390/cio/vfio_ccw_ops.c | 3 +++ drivers/s390/cio/vfio_ccw_private.h | 2 ++ 4 files changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_chp.c b/drivers/s390/cio/vfio_ccw_ch= p.c index bf678270c457..3d05aaf790fa 100644 --- a/drivers/s390/cio/vfio_ccw_chp.c +++ b/drivers/s390/cio/vfio_ccw_chp.c @@ -93,15 +93,19 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_ccw= _private *private, if (pos + count > sizeof(*region)) return -EINVAL; =20 + mutex_lock(&private->io_mutex); + i =3D array_index_nospec(i, private->num_regions); + region =3D private->region[i].data; + + spin_lock(&private->crw_lock); crw =3D list_first_entry_or_null(&private->crw, struct vfio_ccw_crw, next); =20 if (crw) list_del(&crw->next); =20 - mutex_lock(&private->io_mutex); - i =3D array_index_nospec(i, private->num_regions); - region =3D private->region[i].data; + /* Drop CRW lock while copying to userspace */ + spin_unlock(&private->crw_lock); =20 if (crw) memcpy(®ion->crw, &crw->crw, sizeof(region->crw)); @@ -112,14 +116,15 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_c= cw_private *private, ret =3D count; =20 region->crw =3D 0; - - mutex_unlock(&private->io_mutex); - kfree(crw); =20 /* Notify the guest if more CRWs are on our queue */ + spin_lock(&private->crw_lock); if (!list_empty(&private->crw) && private->crw_trigger) eventfd_signal(private->crw_trigger); + spin_unlock(&private->crw_lock); + + mutex_unlock(&private->io_mutex); =20 return ret; } diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_dr= v.c index 1d8c2ed9da50..2c0a27851342 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -125,8 +125,10 @@ void vfio_ccw_crw_todo(struct work_struct *work) =20 private =3D container_of(work, struct vfio_ccw_private, crw_work); =20 + spin_lock(&private->crw_lock); if (!list_empty(&private->crw) && private->crw_trigger) eventfd_signal(private->crw_trigger); + spin_unlock(&private->crw_lock); } =20 /* @@ -300,7 +302,9 @@ static void vfio_ccw_queue_crw(struct vfio_ccw_private = *private, crw->crw.erc =3D erc; crw->crw.rsid =3D rsid; =20 + spin_lock(&private->crw_lock); list_add_tail(&crw->next, &private->crw); + spin_unlock(&private->crw_lock); queue_work(vfio_ccw_work_q, &private->crw_work); } =20 diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index 04800cfa779b..277138f14b25 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -60,6 +60,7 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) INIT_LIST_HEAD(&private->crw); INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo); INIT_WORK(&private->crw_work, vfio_ccw_crw_todo); + spin_lock_init(&private->crw_lock); =20 private->cp.guest_cp =3D kzalloc_objs(struct ccw1, CCWCHAIN_LEN_MAX); if (!private->cp.guest_cp) @@ -138,10 +139,12 @@ static void vfio_ccw_mdev_release_dev(struct vfio_dev= ice *vdev) container_of(vdev, struct vfio_ccw_private, vdev); struct vfio_ccw_crw *crw, *temp; =20 + spin_lock(&private->crw_lock); list_for_each_entry_safe(crw, temp, &private->crw, next) { list_del(&crw->next); kfree(crw); } + spin_unlock(&private->crw_lock); =20 kmem_cache_free(vfio_ccw_crw_region, private->crw_region); kmem_cache_free(vfio_ccw_schib_region, private->schib_region); diff --git a/drivers/s390/cio/vfio_ccw_private.h b/drivers/s390/cio/vfio_cc= w_private.h index ac5aaa78a74b..2562679b5ef5 100644 --- a/drivers/s390/cio/vfio_ccw_private.h +++ b/drivers/s390/cio/vfio_ccw_private.h @@ -121,6 +121,8 @@ struct vfio_ccw_private { =20 struct irb irb; union scsw scsw; + + spinlock_t crw_lock; struct list_head crw; =20 struct eventfd_ctx *io_trigger; --=20 2.53.0