From nobody Sat Jul 25 18:53:18 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6FFBF26AA91; Sat, 25 Jul 2026 15:27:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993237; cv=none; b=XZ+EpCLaCKJzAwwJCgB4XnBAsq+Ra+B3lxOsJiooMOe6V7p+YjUk9hGhqbLFgjPNmY7JaDaBSNHuPBFtdQ8/R0ouhHy7V1Sv2tIuvspDIXv3JfvLR0oOGlx7Vx57mkMKAZjj1zQ8gOmeqfhmihT6E3eN+PknGfJu6aiFL5f2e80= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993237; c=relaxed/simple; bh=p+PbP0myv75st5mwvzBTsdFK7aSDgUKdeNFvumRPnck=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VNH7FzX3tDA0JcG/qid0QgeX4wwjCgEPkod2vbZiVb8L4qd95I+d1pWL1AHU803eNC3YmIWgzPgPMmLnw4hUE7EveqmCrEz3Ea/vGdQj8//I8BPc1l/2AzHR0pxuSwkWIXkg1fxq6nOCzB/JhiXf9y+TX59AHTFi/L9vcExPB08= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=dM+sUMUC; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="dM+sUMUC" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66PDnC86818552; Sat, 25 Jul 2026 15:27:14 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=WRGNLeV0oXr2M/BZ+ sfXha8JHIJWYlAk6/V1XSPYaiM=; b=dM+sUMUCLBGdS6DA21I4SU1qBx8N/Yix8 6qCQOwwhlMNX8i6EoCTtG8t96No4/dErG6s3C2pBrZIi0DZB2lsqE/0cOEEyPtff aJF8wD90vvxkZlQ9Yfnf5+GRdYUs2MCtx2YythYlp+9fEqIUamGqXou2YGTRVjtc qpUwZ5aTK8/UWpyzw4yV7x0rYUQO2v7/jR8lhaDwnb1vgOu0ZQMxIZhQJHeknLBO VaBxOe7OBRmLwOt0Ap+SSNqbYx5AaY7J3U9pA4exBdrHrv1EPNNS2G2GwOZrPDwJ HdtoKayvj29V6BGcb98NMgx0xBtnDOrzTH7pJLl+HpJDHywChSAdw== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmv0x8jru-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:14 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66PFQM5d014015; Sat, 25 Jul 2026 15:27:13 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fmn5h9n22-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:13 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66PFR92b47382798 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 25 Jul 2026 15:27:09 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 939AF200E2; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7C0A8200E1; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav06.fra02v.mail.ibm.com (Postfix) with SMTP; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 65643162803; Sat, 25 Jul 2026 17:27:09 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Farhan Ali Subject: [PATCH v4 1/9] s390/vfio_ccw: free all memory if cp_init() fails Date: Sat, 25 Jul 2026 17:26:57 +0200 Message-ID: <20260725152705.3958100-2-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260725152705.3958100-1-farman@linux.ibm.com> References: <20260725152705.3958100-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: kfUMBgCPJTeDA7HvlONg_PDdYcgkNmzQ X-Proofpoint-ORIG-GUID: kfUMBgCPJTeDA7HvlONg_PDdYcgkNmzQ X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX25JUif95S4gr gHMWH1GLA0CExX9QrY1F3mcdZKiP5cXK8mnXXBPMHT/WT5breMnM14sPhZHklHtUsHLJOBJboG6 tqUuJuPvcqXN8MadWbzyHGKKFtAjaFk= X-Authority-Analysis: v=2.4 cv=dYuwG3Xe c=1 sm=1 tr=0 ts=6a64d5d2 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=WEmllObKAWPfCt-5-jUA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX+sxZYBt4K9u3 qSitZJQbwGLf4BwkI3q2Zr2LbYSOKHXLdy1fJsvt9v6HdgdcR+BAVVvIydRlEKF2zWnXdahaS0F LzxYXVaDkF5vWD75PqN5kkDk3bkwP+yvaODzIBLNLUJHTKvplQToxF5ElDROvS8+AT/x1GYj7pi PsXBLuoRLmvl348jrNz3kTu9o4lYyP235zrPxGV+NfCDpbuwbSGbVF0/paR3z7TnS3RsX65tuaN Yl948hcpS0wZeMqNz3nkUEqGjCCaQQlMFnULe7Uf2okC7dOBJc4Rq+fZhBYAhKc5wGo7kmbRpku QoA78q8DNApHYi0J4eyEgl+k38TR/yZ5/jwakuk2wAzAAzX352UArvdujmIwNPpC/Yb2GlF8D2z kdLugBreW+QbZbUtNwLExso9Ny3ALrkbjgnJJju3GtGt17MCYol03uK+Ltewc4MMhp5SWsSKz6a nSztDjyMFt8f/XsY5tw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_04,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 clxscore=1015 phishscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250144 Content-Type: text/plain; charset="utf-8" The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic. Fixes: 8b515be512a2 ("vfio-ccw: Fix memory leak and don't call cp_free in c= p_init") Cc: stable@vger.kernel.org Reviewed-by: Farhan Ali Reviewed-by: Matthew Rosato Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 7561aa7d3e01..086d1b54bdb0 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -455,9 +455,6 @@ static int ccwchain_handle_ccw(dma32_t cda, struct chan= nel_program *cp) /* Loop for tics on this new chain. */ ret =3D ccwchain_loop_tic(chain, cp); =20 - if (ret) - ccwchain_free(chain); - return ret; } =20 @@ -486,6 +483,23 @@ static int ccwchain_loop_tic(struct ccwchain *chain, s= truct channel_program *cp) return 0; } =20 +static int ccwchain_build_ccws(dma32_t cda, struct channel_program *cp) +{ + struct ccwchain *chain, *temp; + int ret; + + ret =3D ccwchain_handle_ccw(cda, cp); + + if (ret) { + /* Cleanup if an error occurred */ + list_for_each_entry_safe(chain, temp, &cp->ccwchain_list, next) { + ccwchain_free(chain); + } + } + + return ret; +} + static int ccwchain_fetch_tic(struct ccw1 *ccw, struct channel_program *cp) { @@ -735,7 +749,7 @@ int cp_init(struct channel_program *cp, union orb *orb) memcpy(&cp->orb, orb, sizeof(*orb)); =20 /* Build a ccwchain for the first CCW segment */ - ret =3D ccwchain_handle_ccw(orb->cmd.cpa, cp); + ret =3D ccwchain_build_ccws(orb->cmd.cpa, cp); =20 if (!ret) cp->initialized =3D true; --=20 2.53.0 From nobody Sat Jul 25 18:53:18 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E83E92F7F0E; Sat, 25 Jul 2026 15:27:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993237; cv=none; b=IS+z5KuFP/L//dDtyoWNsqCAkvxyIjBpHD9hihCnBvZGKjEeWbMAA2U50peQRDUZRx6s7bnvGyUE79HauhjjbFoli7jdcS1BU1FdXZib26fImR4X3gAt4S/JVlbyhneC00OPz8BEYnT+QIy/NCkN8EENCe2KHldtrqL+uc/3soI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993237; c=relaxed/simple; bh=3EckSShkvG+H0FPgvbUGk1DwZ4vc5ZFCuqpJ/RHFI4A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=owdXWVgksAuvGBFT/JlV65PlB2vhzO53pfhWZPfXjUEBFUkZhFffbx4a0G494yCSY1aOImLEuY79bf43ZHdW1WN5vFSVHagKghpjq8JQvOIgd0/AlANTkx5EnZx9PylzOAiNW9xmYawBVcuXn4xbkLoDIRrI7ffK2YxKOxdxagQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=VFctUnna; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="VFctUnna" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66PDmJVp828845; Sat, 25 Jul 2026 15:27:14 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=xs+m2F3zNULxZt7Bf rTJdMKPsHk4cB+6uiMDMsph1T0=; b=VFctUnnaczq03xsOuuArQNLGDVQUASii0 UJiWqqpwDvYdn0BAAUxGdlPct4HoZiwxGCaUlOb48RMdwcYiVkOq/qMRvtdGI2f/ ucpZwfNkbcG/ylVZrcfptlGgHie7qus1Go+gaSlmxtDpWjpZTGB2gALxKXUDzKbT /CAFd2B597e6fgdsJw1DAd87LOcGlDhFJFJ1Zii6NGvqeZDziVRvT7VJj8tuN1G/ dA/KEoHG4i8VBgJc4wMEfaAXwFvJRPTBnV9TMif/XzKPAiMzA0koRmMHf0AJUEaq clKTfOFanMyHDL7w/Mvx0tp6OTsi1eqlqzv8w2tLSyWlGr9BZYNkQ== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuwcgj5w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:14 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66PFQHep032002; Sat, 25 Jul 2026 15:27:13 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fmn2c1njf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:13 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66PFR9S047776170 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 25 Jul 2026 15:27:09 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A3C9020103; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8033520101; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav02.fra02v.mail.ibm.com (Postfix) with SMTP; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 6785E16280A; Sat, 25 Jul 2026 17:27:09 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v4 2/9] s390/vfio_ccw: limit the number of channel program segments Date: Sat, 25 Jul 2026 17:26:58 +0200 Message-ID: <20260725152705.3958100-3-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260725152705.3958100-1-farman@linux.ibm.com> References: <20260725152705.3958100-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: OS9JcLQ8aHF3_cZWUU_aVzdmo8DyNh_I X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX24JBCG3J7Bhx 419CG+XMMt6LnFY3Rn4EEp88q8y8Ptfd8hEEFNWMI//h5Nydf/4LJmbzcdkv+CcItbtfPSEkPNp WKutk3P7rnqi2pX/mnlJh+xAEXop4WI= X-Authority-Analysis: v=2.4 cv=E/z9Y6dl c=1 sm=1 tr=0 ts=6a64d5d2 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=sBi1HX8ECoo2m5KYV-oA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfXwPUmtKfcC/pD 7n07CAY66U3OUvcKgSWzrYNtTzGflRSlaiCtS2E1Ac6AcN8aBbMmFgMxgJ8W2REgWLOsiawgvv3 VXIpD+RNKNC6gNUw13WV1b/SNNnp/EoZ2QPOlBmsWRaGp42n76Z2YgJfsUsyNRy48zXCG5ulBYv jPFymxituSuJs3zvP2go6brvZs6apExz72Fdt95n9mVDu8YH9z/uEjTCRZUAfvWPd7xsVmkQNXA klDEvfqAOKLJDYcjhdJomtIMiqtyTd9NzGGD63q7IgB9UiUw1gVrqgvuIQKG2dzFT90HezMIPwy s3XLv3YQGAeIfvveQL3hlk96CU1sY8PcOJBCNjpbDOLANt+Ep7y+wIDMwogG9WqVyWvRBcVae8x YBuKdywJa6Ya7ZxRsVLZhqEZLqI4VTnN7TJcQ4YfUVEc7bpXAgqDZBEM8EuBB7aUdZNylT2ElDD ONKkFwxGy95ClMUkl3A== X-Proofpoint-GUID: OS9JcLQ8aHF3_cZWUU_aVzdmo8DyNh_I X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_04,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 phishscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 impostorscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250144 Content-Type: text/plain; charset="utf-8" The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 6 ++++++ drivers/s390/cio/vfio_ccw_cp.h | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 086d1b54bdb0..1c2890d139c6 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -332,6 +332,7 @@ static struct ccwchain *ccwchain_alloc(struct channel_p= rogram *cp, int len) goto out_err; =20 list_add_tail(&chain->next, &cp->ccwchain_list); + cp->ccwchain_count++; =20 return chain; =20 @@ -441,6 +442,10 @@ static int ccwchain_handle_ccw(dma32_t cda, struct cha= nnel_program *cp) if (len < 0) return len; =20 + /* Limit number of chains in a single channel program */ + if (cp->ccwchain_count >=3D CCWCHAIN_COUNT_MAX) + return -EINVAL; + /* Need alloc a new chain for this one. */ chain =3D ccwchain_alloc(cp, len); if (!chain) @@ -745,6 +750,7 @@ int cp_init(struct channel_program *cp, union orb *orb) vdev->dev, "Prefetching channel program even though prefetch not specified in ORB"= ); =20 + cp->ccwchain_count =3D 0; INIT_LIST_HEAD(&cp->ccwchain_list); memcpy(&cp->orb, orb, sizeof(*orb)); =20 diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h index fc31eb699807..a9b1d8dbc6f6 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -23,11 +23,18 @@ */ #define CCWCHAIN_LEN_MAX 256 =20 +/* + * Maximum number of chains + */ +#define CCWCHAIN_COUNT_MAX 16 + /** * struct channel_program - manage information for channel program * @ccwchain_list: list head of ccwchains * @orb: orb for the currently processed ssch request * @initialized: whether this instance is actually initialized + * @guest_cp: copy of guest channel program + * @ccwchain_count: number of channel program segments (linked by TIC) * * @ccwchain_list is the head of a ccwchain list, that contents the * translated result of the guest channel program that pointed out by @@ -38,6 +45,7 @@ struct channel_program { union orb orb; bool initialized; struct ccw1 *guest_cp; + unsigned int ccwchain_count; }; =20 int cp_init(struct channel_program *cp, union orb *orb); --=20 2.53.0 From nobody Sat Jul 25 18:53:18 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1EE863290C9; Sat, 25 Jul 2026 15:27:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993253; cv=none; b=lBkOzu90zqoJ0ONJiHufPjsU8ZbmUTM/7sD2RxtKqxSFqdLRDYlnyJPCm4QbCIbiZR0SPM6VUaQFTs1L/wmo8rz9rY/AYVLhTtj0TXHttHqQPy0iyAUDL+cNK64JFUbKTlDKx3lPqjxlshhy/wGgyp8hhUHVZg5IClY3p5pqhXs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993253; c=relaxed/simple; bh=MWY+0jwbIadbvBE2zh8KwKV7cb6u/VW77xCaJIKZglw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tIXb1xaGTLOc36iPCPYv3qvlaWRUBWJ3vJtSdsrglQUo7zOsuODWitQlx8rgjVkQaiyg0KYyktlCNiTNtZ8iBhyuecBH7ba9CNbzY8ulfvTTJmgg6sST3HJStAopceZM99FC8OIEGwu6JNhFZYeba3jbgYxhB3LDVooExQbPrU4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=GUL2t6WW; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="GUL2t6WW" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66PDlhsl3116604; Sat, 25 Jul 2026 15:27:24 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=5su0AaUohi1LbDjfP 2X2bZCB1n+7Y8xMGiDzn+rlF7U=; b=GUL2t6WWSsv6IMau50P8qtbg3Kax6qApa +hiCwq/ILh62VJEcAdg9e32I0n4O3rtkSyVhlrEkpDm7Fh+7zNS54KbLZcKNfbmt 6HkpSqDXjI+XzkrlKrZ0C5R3ERfCfpq8fGYK37Rq7+xKtF3i7xv1Ras1jUIbqkQB g8A8FRLWzaNVRhP58G3c58plQnUlza1XDjxGKLi/KNLl3qBXVbmWxEXhyZJYeFuA rcfzVoDcrvmRhcvjbUYvM3Rt1/XdXNB0fQK9nIVNdKUnd4j+VquW+fbJD9YLsCXr LQbuKwzldDfy59YMQBL5aRJ705QQMjvDKN8u1aK3Lt5H1BtbaGveg== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuyc0k05-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:24 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66PFQRQN000348; Sat, 25 Jul 2026 15:27:23 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fmn12hp6e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:23 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (smtpav05.fra02v.mail.ibm.com [10.20.54.104]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66PFRJG851577174 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 25 Jul 2026 15:27:19 GMT Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A8BBB200C5; Sat, 25 Jul 2026 15:27:19 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 84C99200C4; Sat, 25 Jul 2026 15:27:19 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav05.fra02v.mail.ibm.com (Postfix) with SMTP; Sat, 25 Jul 2026 15:27:19 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 69D4216280D; Sat, 25 Jul 2026 17:27:09 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v4 3/9] s390/vfio_ccw: fix out of bounds check on CCW array Date: Sat, 25 Jul 2026 17:26:59 +0200 Message-ID: <20260725152705.3958100-4-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260725152705.3958100-1-farman@linux.ibm.com> References: <20260725152705.3958100-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: mEjJd8AQFgl-DI2TY-FfpR9J2VL2wZp0 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX6swVFCMA6Xz1 ujCjpeiM2Q/lJfCbwPCsZkCQW2xzB2YkZIEEUytVer4EiWNyuTZ1mRsFyCW6O8EX+V2AA1HEujN RGSdFdJ6WdwlKrtSkZQoQpLShf/5JqBB4Rxbv7t8AS+lNCw3yaAKBJVPlHoUwtqXCbpNJ50zyft ny+T+iVMIFs7Cn+n5mnXNXpk3Zw3xi8i+cDRZVD//Dl6tDFiIwX1cbc86CRXBa0ZajVHLwReQxP jrVZG0O2NlQx21ZwHD6VDgm8JNkIR35VeZEpKc1nx35FTYIPpIxWQogE/WtD7IuBf0AAGKA1m/d YmYGxuqurpkuY0kPL6jtc6/6/xh8Rn1Rt/EOMen6/RUivhogYO/gzRWClkKj0gdo6ytR4WwGUng /FhzncD95eMyw8Ja/sdu/QFOntxTBBRQ1z1zCoZddQHoNxrRLm4KFcNPQ5F0HZj7VksUywrFHoR V9OcOiKRLGmbjduLHmA== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX8BYD+CTpE1Ty nIfMBZLNHWxh9PVB9xWqIQUCFOwsqDKDLV7EBktr2KNqMpqUfL5HZxpPp/kDyfid027mxvNEuHo keC68NJv+XL5f/0mP5fov47hZ25F9tY= X-Authority-Analysis: v=2.4 cv=AZeB2XXG c=1 sm=1 tr=0 ts=6a64d5dc cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=A5C3NnK3Tz1osX5E1PIA:9 X-Proofpoint-GUID: mEjJd8AQFgl-DI2TY-FfpR9J2VL2wZp0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_04,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 priorityscore=1501 phishscore=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250144 Content-Type: text/plain; charset="utf-8" The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs. The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error. Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman Reviewed-by: Matthew Rosato --- drivers/s390/cio/vfio_ccw_cp.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 1c2890d139c6..af632f9d5453 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -377,11 +377,9 @@ static void ccwchain_cda_free(struct ccwchain *chain, = int idx) static int ccwchain_calc_length(u64 iova, struct channel_program *cp) { struct ccw1 *ccw =3D cp->guest_cp; - int cnt =3D 0; - - do { - cnt++; + int cnt; =20 + for (cnt =3D 1; cnt <=3D CCWCHAIN_LEN_MAX; cnt++, ccw++) { /* * We want to keep counting if the current CCW has the * command-chaining flag enabled, or if it is a TIC CCW @@ -391,15 +389,10 @@ static int ccwchain_calc_length(u64 iova, struct chan= nel_program *cp) * after the TIC, depending on the results of its operation. */ if (!ccw_is_chain(ccw) && !is_tic_within_range(ccw, iova, cnt)) - break; - - ccw++; - } while (cnt < CCWCHAIN_LEN_MAX + 1); - - if (cnt =3D=3D CCWCHAIN_LEN_MAX + 1) - cnt =3D -EINVAL; + return cnt; + } =20 - return cnt; + return -EINVAL; } =20 static int tic_target_chain_exists(struct ccw1 *tic, struct channel_progra= m *cp) --=20 2.53.0 From nobody Sat Jul 25 18:53:18 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E84A22F8EB5; Sat, 25 Jul 2026 15:27:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993239; cv=none; b=lLAkmBxYryi3f3rhAkWJYNfIrAlYu5odq7cQTD3PqIU0VEAqfcKOd0FSvYJ1NTTKRRoh8DI5MTOL1cgVq0EMv5+BzNpggKPR0Kn5cupa8SWe7aXc/0g23QuwFTRDKzLocLO00XTphyypTsJxKdT6NvRclDhT3ym5u0ziTGNxkN8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993239; c=relaxed/simple; bh=vJs9xc/30hDx9JGZIF0UswmCWppURTGwpARUb6jic0E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=L92ypGFYQ2beDXjyrpXwIUz9MbVcYTp46Bzje+2bXS+FHYVNnXwxbj/ezywJjfgnK41QPqDY9s688gqJkddkwY5bq34rlpThCinQDK1aH1MA1uEHQCKjc4OvqR096Kwt5L4LDnN+h2Kd5fQFaNM1ETLC8XOqK8lnfuiKqNoslaw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=nksq56uI; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="nksq56uI" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66PDnnvw831538; Sat, 25 Jul 2026 15:27:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=pehW+LNYXXMR8byif W1tmfAYrofliG2hjo0xlZC76H0=; b=nksq56uI+68AoWp5EAnBXIJwjoI1NVpOM YoCIOhvS8Z//u33Hvr/6U4Gevu6M7Cvmb7uIc9le7U7XskkqRd5ByVBDM2dH1sWx 1baOB3ihwXLKLXh9afmE94miiZxGWkiG8g56hP2HhH8VYuuYN2L02plnP4gvs9jM DliO8FVI5dk7TX2k+BYb29o2jJKGYQzT2e5d+2hsUdU4sX0KVXE8oMiY0AwdC8YV rIdVmi40r0TuUaHQEmQJxsjSwIDrRS5oeT+77RumBErgXBdlhbL05v3dLuqqvaq2 df8NR08UcCf9TArM8GUcIUwMYK6uxXFlUlL28Pb+QxETeEs3xnu1A== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuwcgj5v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:14 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66PFQJI4016922; Sat, 25 Jul 2026 15:27:13 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fmn331ntt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:13 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66PFR93553477636 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 25 Jul 2026 15:27:09 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A02AA200B6; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 81C19200B3; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav07.fra02v.mail.ibm.com (Postfix) with SMTP; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 6C103162811; Sat, 25 Jul 2026 17:27:09 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v4 4/9] s390/vfio_ccw: ensure first IDAW remains constant Date: Sat, 25 Jul 2026 17:27:00 +0200 Message-ID: <20260725152705.3958100-5-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260725152705.3958100-1-farman@linux.ibm.com> References: <20260725152705.3958100-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: ZOtjVh6DcmRlb23QP2nzOBKJuXj5WORQ X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX8YJQ0do0Z1/h B/qWNY+CenhJMmLQHSm90ykhYGrDmtqhW9GVQmnM5SJCDJ0zchhnDhNJun8k/RpMzgVszf3rDj0 MahTYh+ylMNjxGxa1HjW7+19Jv44oFw= X-Authority-Analysis: v=2.4 cv=E/z9Y6dl c=1 sm=1 tr=0 ts=6a64d5d2 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=TyQ-expsAN5g-WtpmiwA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX0DggT1pt2J6Q tQx+lbMPoZnA+MK395j2zk7YGF0H9aEkfJgEfTllBAktcr1aCRIUGbPmbvKuEQMjUP20yskjFHQ vBJOnH0HojF5u3f1ymaQHhDrx07qY69vcFZqQ6jKtqg+dGkPzdsmaToCp/W0kULtXZZ1ZR4duJt /3kxS1TBWsBShQ7DuBedquWAmiXG6Utks55+FFh/TBjuCC8NtCnCnoMCcEklcmvaA0Ya5sE4dsp vr5ZRcMgQJUnd63Kvj6S7/pXMoa1VhXizdM+jPWSGGRuMz5GcyET73JzeZ3EKpBBfoh3Jo+XPSl cZpnvz/FOETjZrp4NhrqS9lpBPzrYaxGSe2KirmnSmmVqUbFeJ3AMETwrUiY2cAMeB2d464mmfq Htb3ztSagJOAwItN8DYHZMaNIzrldhF1mTB3dKSN9o6BTJzyJIOtbzit7HuUGV2rbzo18ENNi9h SLBu195h64BGvXbB02w== X-Proofpoint-GUID: ZOtjVh6DcmRlb23QP2nzOBKJuXj5WORQ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_04,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 phishscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 impostorscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250144 Content-Type: text/plain; charset="utf-8" The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with. Fixes: 01aa26c672c0 ("s390/cio: Combine direct and indirect CCW paths") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 16 ++++++++++++++++ drivers/s390/cio/vfio_ccw_cp.h | 2 ++ 2 files changed, 18 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index af632f9d5453..6275794751cb 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -523,6 +523,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct= channel_program *cp, int &container_of(cp, struct vfio_ccw_private, cp)->vdev; dma64_t *idaws; dma32_t *idaws_f1; + u64 first_idaw; int idal_len =3D idaw_nr * sizeof(*idaws); int idaw_size =3D idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE; int idaw_mask =3D ~(idaw_size - 1); @@ -539,6 +540,18 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struc= t channel_program *cp, int kfree(idaws); return ERR_PTR(ret); } + + idaws_f1 =3D (dma32_t *)idaws; + if (cp->orb.cmd.c64) + first_idaw =3D dma64_to_u64(idaws[0]); + else + first_idaw =3D dma32_to_u32(idaws_f1[0]); + + /* Unexpected mismatch from earlier read */ + if (first_idaw !=3D cp->guest_iova) { + kfree(idaws); + return ERR_PTR(-EINVAL); + } } else { /* Fabricate an IDAL based off CCW data address */ if (cp->orb.cmd.c64) { @@ -604,6 +617,9 @@ static int ccw_count_idaws(struct ccw1 *ccw, iova =3D dma32_to_u32(ccw->cda); } =20 + /* Save the read address for later */ + cp->guest_iova =3D iova; + /* Format-1 IDAWs operate on 2K each */ if (!cp->orb.cmd.c64) return idal_2k_nr_words((void *)iova, bytes); diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h index a9b1d8dbc6f6..9af98ff12d67 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -35,6 +35,7 @@ * @initialized: whether this instance is actually initialized * @guest_cp: copy of guest channel program * @ccwchain_count: number of channel program segments (linked by TIC) + * @guest_iova: first data address of a guest channel program * * @ccwchain_list is the head of a ccwchain list, that contents the * translated result of the guest channel program that pointed out by @@ -46,6 +47,7 @@ struct channel_program { bool initialized; struct ccw1 *guest_cp; unsigned int ccwchain_count; + u64 guest_iova; }; =20 int cp_init(struct channel_program *cp, union orb *orb); --=20 2.53.0 From nobody Sat Jul 25 18:53:18 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 402582571D7; Sat, 25 Jul 2026 15:27:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993254; cv=none; b=kGahOa8avkwkQpkSZbyRpQ2vo6a/gbkbgL++8ln4tLKjSUQAGlfTxaNonQfZWAG85xDCildmRiHOjOaQeLG1uoZuUVS8LFWQuK2hCTqMY2DVl0A285jOmSjc6mSmqo+QDp0sSl/j2IXxguzwSFzgvjQN4l7uata4SGuRcrW0aqw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993254; c=relaxed/simple; bh=WfP9KjGiUhNC00atHi0kyLYVsoioA+Sf9b2zatRqvMU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Gd0L3sWH6pXgkTERVLFNJ3Jq8nbIiFKluANzIQQIpbgaQOLlysM0HSMlPSnNG+ZzLmPUr1w1X/dp7CKBecgQan5csriqYx/3ZPdkT7vjWo/5l7tVQa11xAOc2dY2Yz/pOLeMc2qzV3Cm0WeHnCXyxJFryIKBCL3YFqbPoCdiEEM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=TRQxdT8f; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="TRQxdT8f" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66PDo9Fr3121190; Sat, 25 Jul 2026 15:27:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=t1PHiV8rkqviZARZ9 5VBMbb5uovzUNwzuKi8hlP295s=; b=TRQxdT8fCA7isPcUEz6Mx3doUafoRYTxX 371z4DkceLgCxsGh3CO5g7X0bmpgw7hzB1B+QT3xcDqVKtHNt2oCdlt+MsQ5TV1m A58hfVWXm3Zm8f7gM0mUY0yzInvnevJ2+1gwF7YGMMcUE4T63mj7DIbv108IdblD mxnA+uAUFbr5KPiry1kPNP/QJT4XzfmcalnbXhdxjCzqZt27FQ7LdEoRFByyb9UV JmFwG66qU8G2iqGdzDU1h3R8Kg+/iUWoRfjE6J3Rs4aXilBL3uxIdhiFHBsqJyx+ HjwWLf1KNhupCxG/uwfuswzHezOSEQ3FrRDFs0oA2t3/lIGbCwXTA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuyc0jyy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:15 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66PFQSlt032073; Sat, 25 Jul 2026 15:27:13 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fmn2c1njg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:13 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66PFR9wd45023508 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 25 Jul 2026 15:27:10 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CA5E9200FA; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A8CA3200AF; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav03.fra02v.mail.ibm.com (Postfix) with SMTP; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 6E30C162813; Sat, 25 Jul 2026 17:27:09 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , sashiko-bot , stable@vger.kernel.org Subject: [PATCH v4 5/9] s390/vfio_ccw: calculate idal length based on idaw type Date: Sat, 25 Jul 2026 17:27:01 +0200 Message-ID: <20260725152705.3958100-6-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260725152705.3958100-1-farman@linux.ibm.com> References: <20260725152705.3958100-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: fZrW4gRtntmKWdGau55pJTOSivrY5rXR X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX3eI+m1vcNdgS LgYpGGtXNT/uC01ELQ6PdLRgCSKFT+ehn2Azg/AZ9f0r6NkpNHQn8m6bxQCmkXWS5GYno4viGud FDTpp/zlYpB1uvkbd6YzcxJtq+GCxs3jIdQYw66xEqD37f4C504d94Leh+nOVtUK4eDVCoDknNb iQBdAQUmkhz+VCM9lBddCIHun6C5ws7uYuXrgPvnaTTXsxv1qhfYKb2dWGu6CRKgDtCHlcUn+P2 BdFF2hHoySLeLGPRLIKjoWALSt5S180K0CGCcUS6HZyTrIBaAD8vPvJ+HAwOVirZDVuKCEcUHcs 0c5xq2tJkTqqylJ/+c0Z32Q15hxgYeij+t39o7HUQDautXTMRVRyQSaW2W6ErA5ZEVTx+nP0T9p MZ6HMd+6L3r8phKj/H8ZiYvguGnvVwBhF5j3DKfCUhMQ0ecMa4WD29Z5EC36gwdI/BI1BzkLzdD VIQdatA2b6CXxFVQ9xQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX8CcSmGcu1iKQ RbWUQYhgas96t0ThmskZRBD3fNvOApesDT9EjcGgyoBbuwc3D3Dc+Fz2hJH335AN6i1D6jandMM /TkE4q1oI4Z3JgQ0r1I7e4wawKrNEeA= X-Authority-Analysis: v=2.4 cv=AZeB2XXG c=1 sm=1 tr=0 ts=6a64d5d3 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=Qev3T-O1x3Ov5i2I8JAA:9 X-Proofpoint-GUID: fZrW4gRtntmKWdGau55pJTOSivrY5rXR X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_04,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 priorityscore=1501 phishscore=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250144 Content-Type: text/plain; charset="utf-8" Sashiko pointed out that get_guest_idal() unconditionally calculates the length of the IDAL presuming everything is a Format-2 IDAW. The output of vfio-ccw is always Format-2, but the input can be either Format-1 (31-bit addresses) or Format-2 (64-bit addresses). As a result, the size of the guest IDAL may be incorrect and should be trimmed down. Reported-by: sashiko-bot Link: https://lore.kernel.org/r/20260720203400.7328E1F000E9@smtp.kernel.org/ Fixes: 1b676fe3d9d3 ("vfio/ccw: handle a guest Format-1 IDAL") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 6275794751cb..5ef082b8289a 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -233,6 +233,7 @@ static void convert_ccw0_to_ccw1(struct ccw1 *source, u= nsigned long len) } =20 #define idal_is_2k(_cp) (!(_cp)->orb.cmd.c64 || (_cp)->orb.cmd.i2k) +#define get_idaw_size(_cp) ((_cp)->orb.cmd.c64 ? sizeof(u64) : sizeof(u32)) =20 /* * Helpers to operate ccwchain. @@ -524,7 +525,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct= channel_program *cp, int dma64_t *idaws; dma32_t *idaws_f1; u64 first_idaw; - int idal_len =3D idaw_nr * sizeof(*idaws); + int idal_len =3D idaw_nr * get_idaw_size(cp); int idaw_size =3D idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE; int idaw_mask =3D ~(idaw_size - 1); int i, ret; @@ -593,7 +594,7 @@ static int ccw_count_idaws(struct ccw1 *ccw, struct vfio_device *vdev =3D &container_of(cp, struct vfio_ccw_private, cp)->vdev; u64 iova; - int size =3D cp->orb.cmd.c64 ? sizeof(u64) : sizeof(u32); + int size =3D get_idaw_size(cp); int ret; int bytes =3D 1; =20 --=20 2.53.0 From nobody Sat Jul 25 18:53:18 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14E1735C6B8; Sat, 25 Jul 2026 15:27:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993241; cv=none; b=BWsQ2NQymcFfYA64cv7IIFB1f+UlRBtILQQuxvB6imzlSQk0qKjmSjCcE6HAJ8dERadxZWXZzcaWiwcYA6R63pMkP/HcFTqoUWjhwZvfc+CcVwGqWoLy6DNX0fPcSCqkHM0ReX+bbzLlYrx99pnYJLq044XEygOKr9/Dy6M4/Ds= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993241; c=relaxed/simple; bh=VJE3ETER3UQdhXEsrcUeepOm+ZXegDKvZFE+vsfZKI4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aqX6iR75DLNjDrpVpaRIl9GOoa8XMw6dKJIxOASpxSpOVuyftb9xUyorIEQcxzPgj8LHirp2/ZIQxhidYNb/Haj9SQqvyI5Ph/BGZzGCaWdlPW+LtKcIqlsvvVU1GahumGPZM4rBgI/FI1cgRDRk4i8QWEn0gOdgSb8PUkG77DU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=VY/yQn2y; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="VY/yQn2y" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66PDlXoH792915; Sat, 25 Jul 2026 15:27:14 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zk/DcfNEEY0QPc9S/ G2Tvb4Y/VzgS4xcIAJSZytUhfE=; b=VY/yQn2yN4PiBwqw9zEYBvJ0LrPaVJaB7 XWAGiH2pJmxmlC0GQkKqeSSUAMeUkjeCBWdYbRwcAYlqtEtO3m9OYAeUUh1ih6VY IKjawQ3VyQNw3G0pfcQlTgNxTQUJw2BJSwZ3N8KnKV9hYKhBVNa/wVPtiQTvlqsZ /3TJR8geXfOpXx1bZsopFCUFINGhfbuSGrkTv5WUlc9qVvgiRCNlpCVbuNoMp5ne 9/RYZs5NoYiIgMMNS1UvyeeDuTj0ODXl/CNjOLBSn+cheM6jz3UTHJE19OS7ig/l 2xvnRE4TowRGyxp/1nbpsa8JPcKDCUcZfJPsVH5d+2vAqr7BWAroQ== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuw70kbb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:14 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66PFQEeq032343; Sat, 25 Jul 2026 15:27:13 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fmn12hp62-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:13 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66PFR91M42860880 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 25 Jul 2026 15:27:10 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D131120101; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AAA3B20104; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav02.fra02v.mail.ibm.com (Postfix) with SMTP; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 70903162816; Sat, 25 Jul 2026 17:27:09 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Cornelia Huck Subject: [PATCH v4 6/9] s390/vfio_ccw: ensure index for read/write regions are within range Date: Sat, 25 Jul 2026 17:27:02 +0200 Message-ID: <20260725152705.3958100-7-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260725152705.3958100-1-farman@linux.ibm.com> References: <20260725152705.3958100-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: ngbrRK6J8S2psMHLYnIAYsrCepLQitpo X-Proofpoint-ORIG-GUID: ngbrRK6J8S2psMHLYnIAYsrCepLQitpo X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX+UP19sdCgj5Y ogYk65BIgTsdRRFK/Vpp424d2hkWEvfljEbDpgI8xVSySRDMdYi3e8cxmxRzUvG0NJ8d+FjeG0f Dnk2nioZJTC5bTqULTiba92FIwBVdrb+hTxrTlECJ4HDrtF/2fn+7cF08RAKbZdRWgvfBeXLBp1 7kQK8sjzbUjtSYXi7vemQNIxIN+vzD7xRUYgaX8p5ApHmSq8Gc9bLS8c5K4udNPyELiO2b3ZTes +eQWW0snmyvrtnHLuol9u21F7821HRkz8rLHP4VYnAdiWBXrA+TSDnLjJKENNV0IZ/iGVmwtP7C pW+vylWIYLqQa6wD81JZENzrvYoJpFGNkMpNW58eqJgxG1MItiztsw/vlGJ7p0L3eLwpupHN3gw q89bXt/mpjjjzdJ51jEkF7MYbopk9bTEsAgGF8X8+L/5WfbDk7Zs7oLQtOnI3uOEvSo1/Awfhf/ 3WGtex1Ivi8cO9CYRQA== X-Authority-Analysis: v=2.4 cv=SKFykuvH c=1 sm=1 tr=0 ts=6a64d5d2 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=jUipGm6kB3s0BbMcHoAA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX+L6ntvYoI0Z8 bxCS7wtDYcq6KHfn0NiLEEpOaOHqV6H+Fl2LD7QFCMfybsk8mm3X1iYMpBWh8cxYt0CAcP+e8xs QZ0NHmxj7EIg9r2GW7v1CEedTBgXbPQ= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_04,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250144 Content-Type: text/plain; charset="utf-8" The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced. Fixes: db8e5d17ac03 ("vfio-ccw: add capabilities chain") Cc: stable@vger.kernel.org Cc: Cornelia Huck Signed-off-by: Eric Farman Reviewed-by: Matthew Rosato --- drivers/s390/cio/vfio_ccw_async.c | 16 ++++++++++++++++ drivers/s390/cio/vfio_ccw_chp.c | 15 +++++++++++++++ drivers/s390/cio/vfio_ccw_ops.c | 7 +++---- 3 files changed, 34 insertions(+), 4 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_async.c b/drivers/s390/cio/vfio_ccw_= async.c index 420d89ba7f83..4aff0b58fa5d 100644 --- a/drivers/s390/cio/vfio_ccw_async.c +++ b/drivers/s390/cio/vfio_ccw_async.c @@ -8,6 +8,7 @@ */ =20 #include +#include =20 #include "vfio_ccw_private.h" =20 @@ -24,11 +25,20 @@ static ssize_t vfio_ccw_async_region_read(struct vfio_c= cw_private *private, return -EINVAL; =20 mutex_lock(&private->io_mutex); + + if (i >=3D private->num_regions) { + ret =3D -EINVAL; + goto out_unlock; + } + + i =3D array_index_nospec(i, private->num_regions); region =3D private->region[i].data; if (copy_to_user(buf, (void *)region + pos, count)) ret =3D -EFAULT; else ret =3D count; + +out_unlock: mutex_unlock(&private->io_mutex); return ret; } @@ -48,6 +58,12 @@ static ssize_t vfio_ccw_async_region_write(struct vfio_c= cw_private *private, if (!mutex_trylock(&private->io_mutex)) return -EAGAIN; =20 + if (i >=3D private->num_regions) { + ret =3D -EINVAL; + goto out_unlock; + } + + i =3D array_index_nospec(i, private->num_regions); region =3D private->region[i].data; if (copy_from_user((void *)region + pos, buf, count)) { ret =3D -EFAULT; diff --git a/drivers/s390/cio/vfio_ccw_chp.c b/drivers/s390/cio/vfio_ccw_ch= p.c index 38c176cf6295..f3015132d4b5 100644 --- a/drivers/s390/cio/vfio_ccw_chp.c +++ b/drivers/s390/cio/vfio_ccw_chp.c @@ -9,6 +9,7 @@ */ =20 #include +#include #include #include "vfio_ccw_private.h" =20 @@ -26,6 +27,13 @@ static ssize_t vfio_ccw_schib_region_read(struct vfio_cc= w_private *private, return -EINVAL; =20 mutex_lock(&private->io_mutex); + + if (i >=3D private->num_regions) { + ret =3D -EINVAL; + goto out; + } + + i =3D array_index_nospec(i, private->num_regions); region =3D private->region[i].data; =20 if (cio_update_schib(sch)) { @@ -97,6 +105,12 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_ccw= _private *private, list_del(&crw->next); =20 mutex_lock(&private->io_mutex); + if (i >=3D private->num_regions) { + ret =3D -EINVAL; + goto out; + } + + i =3D array_index_nospec(i, private->num_regions); region =3D private->region[i].data; =20 if (crw) @@ -109,6 +123,7 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_ccw= _private *private, =20 region->crw =3D 0; =20 +out: mutex_unlock(&private->io_mutex); =20 kfree(crw); diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index 45ec722d25ea..032a1cdf4df7 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -243,6 +243,7 @@ static ssize_t vfio_ccw_mdev_read(struct vfio_device *v= dev, return vfio_ccw_mdev_read_io_region(private, buf, count, ppos); default: index -=3D VFIO_CCW_NUM_REGIONS; + index =3D array_index_nospec(index, private->num_regions); return private->region[index].ops->read(private, buf, count, ppos); } @@ -295,6 +296,7 @@ static ssize_t vfio_ccw_mdev_write(struct vfio_device *= vdev, return vfio_ccw_mdev_write_io_region(private, buf, count, ppos); default: index -=3D VFIO_CCW_NUM_REGIONS; + index =3D array_index_nospec(index, private->num_regions); return private->region[index].ops->write(private, buf, count, ppos); } @@ -338,11 +340,8 @@ static int vfio_ccw_mdev_ioctl_get_region_info(struct = vfio_device *vdev, VFIO_CCW_NUM_REGIONS + private->num_regions) return -EINVAL; =20 - info->index =3D array_index_nospec(info->index, - VFIO_CCW_NUM_REGIONS + - private->num_regions); - i =3D info->index - VFIO_CCW_NUM_REGIONS; + i =3D array_index_nospec(i, private->num_regions); =20 info->offset =3D VFIO_CCW_INDEX_TO_OFFSET(info->index); info->size =3D private->region[i].size; --=20 2.53.0 From nobody Sat Jul 25 18:53:18 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF0B12E11DC; Sat, 25 Jul 2026 15:27:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993237; cv=none; b=HWNYc+qicNWlghm+ksVrxV90sP8MyDMa8iLW/qunEN64337ZTaWKWgUdC2uEAHUVBnHc7iW/NtTZOPWPAUVGBOiPs/LiPSi5IzHCgb0wtKRSg5p7YU3atFJmrRSSwAZ0tcN+/kdQx5Ut+DVm/RyK2UNzrXHP4i1Vi+vUz+YdspE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993237; c=relaxed/simple; bh=7I6b/RDxO2NqBBbJlcnbKdxssU8WzfFgqoWuP7sR+PQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=k2OFLqaui5xY3yJSckxx57vKtdfeoxvjjUQvDxfQbLoGf71kUlCd+RLVAn5wkLDNSeetoiByutOcNVmzcPuTawjwTPG9qxypSRPDsabVi3U/y8xcKHtG8TspfBQmaD/MZhbE4W1sNj8xBR4J4W/U0sU/edanaFO1iNZxoyaIQ9Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=CsYVFLWh; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="CsYVFLWh" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66PDm3TW794477; Sat, 25 Jul 2026 15:27:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=B/w26A7VI3rWY4o4m vQ03O2IJrh1yfCI5EPtlhTON9k=; b=CsYVFLWh10/5pp8Ul1TrAYwDjgy5CAFSH Wgsw4K+Lzk7y8d7HJLEgXpb9xCGHJ5LAfiJVz/Klb3eJO6F3IWK/zSdQ/3NYxyIy lsR1Oczt9gj4t2JCqH/To76FK1ZW5UiZbrJl9Rx2MooSeC/p7jPWiKeMlcKN5ujB eCPQ+qdKUI8DdTJVkyt9UH3u5fkFtPpJNDE8B+z9BltDvI9y1wXAbuxMujLfRpXA cwPi8xS1tH30kAM0T2RMvgWXA7ZYzMJmHTlTvAmrvnhcaOWLGvsBQWicAuQ1RJ/7 MN3ce9eJZhnMpyFYNXPXAp40KQ3UjK2QLLT3ktTSo/F8VlSFlH0aw== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuw70kbd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:15 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66PFQKkP020353; Sat, 25 Jul 2026 15:27:13 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fmn1u1p2p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:13 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66PFR9Cw47776172 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 25 Jul 2026 15:27:09 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CD90620100; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AAF2B20105; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav02.fra02v.mail.ibm.com (Postfix) with SMTP; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 72A6716281A; Sat, 25 Jul 2026 17:27:09 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v4 7/9] s390/vfio_ccw: move cp cleanup out of not operational Date: Sat, 25 Jul 2026 17:27:03 +0200 Message-ID: <20260725152705.3958100-8-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260725152705.3958100-1-farman@linux.ibm.com> References: <20260725152705.3958100-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: sY2THrTiwCFRX4OoSMnspfaO1o5ulKVA X-Proofpoint-ORIG-GUID: sY2THrTiwCFRX4OoSMnspfaO1o5ulKVA X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX69KqDhr7AMCT /FZo9khRv8nAYiL/H+csTJn75b86fgVAyaBjVB/kCG0sWZ/wsZ/l1VSawtajPC6niYVScCugFdk EmdNEWIFZGjafQKGHD43r/0GQ9A8EoRBd0cK3c8307QTdFH2TDUo1f144z2YhU14py1ms8PmmEI PbCXySoqKAMFMCaAX/EYKM4+csSr6msoq8NzffJ6Qet2pd6J2dxO5dpava5XdT1L+tq2OwQmmJr aorCtFPGOovv9ZLEyDZuDncwn+3HEHvJ8guMKZtYS9FP9WjFil6N72yegUEn8t5G5DobBrDLtOU HPOWI6EyIu6Bv1agaEwzA7LaTYr197sY5MOGbL7hBcVxjOw5XquUvTdjtP1w8GpTNxotNdS8Ved o7k+LVzUqwxqGuTLwaV9bEY2voGl2QxxeIePh4n7/e2Am4sXhsOUFbl6oH3lqalvWsu2kmV9XZ1 T0ij69BQ//wV8249dYQ== X-Authority-Analysis: v=2.4 cv=SKFykuvH c=1 sm=1 tr=0 ts=6a64d5d3 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=eUPndkpJGv8SUAYCnnQA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX4/X86GOV2Ki0 ae/w8DcGgWZHWrFq3jpK884ufqw59c000qafx9+vqdeqk5TWvRXzjaNYlUaAsY9jlxwblkaIMdn QY4oyr1eSWxW2NzOS7zowbaRYGKqt5E= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_04,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250144 Content-Type: text/plain; charset="utf-8" The fsm_notoper() routine is called when the device has been lost, and is (by definition) no longer operational. Since this can happen asynchronously from the normal behavior of the driver, the cleanup may happen when holding other locks in the calling sequence (notably, the cio subchannel lock). Push the cleanup of the private->cp resources to a workqueue, where it can be done out from under that lock sequence and (soon) under its own serialization mechanism. Fixes: 204b394a23ad ("vfio/ccw: Move FSM open/close to MDEV open/close") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_drv.c | 9 +++++++++ drivers/s390/cio/vfio_ccw_fsm.c | 3 +-- drivers/s390/cio/vfio_ccw_ops.c | 1 + drivers/s390/cio/vfio_ccw_private.h | 3 +++ 4 files changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_dr= v.c index 1a095085bc72..c197ad5ab580 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -125,6 +125,15 @@ void vfio_ccw_crw_todo(struct work_struct *work) eventfd_signal(private->crw_trigger); } =20 +void vfio_ccw_notoper_todo(struct work_struct *work) +{ + struct vfio_ccw_private *private; + + private =3D container_of(work, struct vfio_ccw_private, notoper_work); + + cp_free(&private->cp); +} + /* * Css driver callbacks */ diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fs= m.c index 4d7988ea47ef..4d47a3c7b9a0 100644 --- a/drivers/s390/cio/vfio_ccw_fsm.c +++ b/drivers/s390/cio/vfio_ccw_fsm.c @@ -170,8 +170,7 @@ static void fsm_notoper(struct vfio_ccw_private *privat= e, css_sched_sch_todo(sch, SCH_TODO_UNREG); private->state =3D VFIO_CCW_STATE_NOT_OPER; =20 - /* This is usually handled during CLOSE event */ - cp_free(&private->cp); + queue_work(vfio_ccw_work_q, &private->notoper_work); } =20 /* diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index 032a1cdf4df7..6c74d596be9d 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -54,6 +54,7 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) INIT_LIST_HEAD(&private->crw); INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo); INIT_WORK(&private->crw_work, vfio_ccw_crw_todo); + INIT_WORK(&private->notoper_work, vfio_ccw_notoper_todo); =20 private->cp.guest_cp =3D kzalloc_objs(struct ccw1, CCWCHAIN_LEN_MAX); if (!private->cp.guest_cp) diff --git a/drivers/s390/cio/vfio_ccw_private.h b/drivers/s390/cio/vfio_cc= w_private.h index 0501d4bbcdbd..e2256402b089 100644 --- a/drivers/s390/cio/vfio_ccw_private.h +++ b/drivers/s390/cio/vfio_ccw_private.h @@ -102,6 +102,7 @@ struct vfio_ccw_parent { * @req_trigger: eventfd ctx for signaling userspace to return device * @io_work: work for deferral process of I/O handling * @crw_work: work for deferral process of CRW handling + * @notoper_work: work for deferred processing in not-operational state */ struct vfio_ccw_private { struct vfio_device vdev; @@ -125,11 +126,13 @@ struct vfio_ccw_private { struct eventfd_ctx *req_trigger; struct work_struct io_work; struct work_struct crw_work; + struct work_struct notoper_work; } __aligned(8); =20 int vfio_ccw_sch_quiesce(struct subchannel *sch); void vfio_ccw_sch_io_todo(struct work_struct *work); void vfio_ccw_crw_todo(struct work_struct *work); +void vfio_ccw_notoper_todo(struct work_struct *work); =20 extern struct mdev_driver vfio_ccw_mdev_driver; =20 --=20 2.53.0 From nobody Sat Jul 25 18:53:18 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6FF2B2571D7; Sat, 25 Jul 2026 15:27:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993238; cv=none; b=oOaaKWLUG6ML+cuoB/gAvZ//HkbO6oH9nEf97TsetvrsJYfgHHgsrBHOu4gH/6nRSDzX3WSx2JZRYXbkaCxg1cjAT/g2P13mmR5ccjqevs4mZE4C/0VromnrEAcBSuawluzwDMsmYwKSnBbU7jYctEpmZvrr+9kDEsCO4EYI5vo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993238; c=relaxed/simple; bh=u2zK9k06k93JGJNTuH+Q/kzwYFhYrf3rw7o9mmFoSpw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ytn9uCqTFhou60zsdZ+6eKSIvIfBcALGVfM2droCOo8hbUrq7RB4FIFxBoCpSLnY5s/Ci67OqXo0nPIs46TTNyLqwp0wVuX+IvcoUf9lhim6nuqKRaP4+S3qMl31OTwZ2yshjUj6L77z6MuT1rrLeeRoVdSgqleNpXIVRAitVnQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=mqWDozXI; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="mqWDozXI" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66PDlhsk3116604; Sat, 25 Jul 2026 15:27:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=txHDBvFl0LIvtwYcB VhwqLsTswKD8vihnAy33QHGsas=; b=mqWDozXIzYp6wjAMCsHucWG0EcT0v1A99 4+gfa+sVJUTRGKfVpot4Uexyh3A3MBWMK5EbRZebTd5QD4GNE0l6HZFygBVEsQFa riXZ+niuSwY/aYVOGw2USI5LaK50MTd9jH/MGf8H8ZzKr74C6t5GHuMbMYMQBQyT Dkr5ZNMsr/Nye/o1vwngg2wYgi2su3Ox8CjCAzFWjkPgsYqx+MOesIi0OMBEKcBa ZqowsUFpgRdLoPMUpXpCiuKZLUKzllcI0fWFagkAEJGcfC0KolClTSZyeqnyVl5k bO1AmaWAj6q/ldArm+T0Vrq84p9vQLfXB3xufQv17PQYAtmQJYOVw== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuyc0jyx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:14 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66PFQIVa013958; Sat, 25 Jul 2026 15:27:13 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fmn5h9n25-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:13 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66PFR9nj51577168 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 25 Jul 2026 15:27:10 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D3D31200FB; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AA873200F9; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav03.fra02v.mail.ibm.com (Postfix) with SMTP; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 74DCE16281B; Sat, 25 Jul 2026 17:27:09 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v4 8/9] s390/vfio_ccw: implement a channel program mutex Date: Sat, 25 Jul 2026 17:27:04 +0200 Message-ID: <20260725152705.3958100-9-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260725152705.3958100-1-farman@linux.ibm.com> References: <20260725152705.3958100-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: T2DI0WI3ZorvZ4GbRKleK21wHTtn6kqZ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX8FvAxongQ+JW t+7yb+amSAMI+MeubhpFyPJaaPQuWTDlpL5vugMHg16NXvk2+gRavF2V/O+7NQyZtoOO/1rfcX9 S0t+lrnasQlmrJxuZ4I8Uh0rs85Koq9256jWs7Bto0/8KcOa7GEOT7fkRK4l/LD2qcHNRyiWBpE I0bJCcOWssPMUhML7cq9E7SZ5wL8SMX9e2PI2NrNQBkUzMIX613I9qehixS2YrXFf4rxP0Ji64u OqjvlcPt+RO2OwZJoXutzrUeGHoqwnXD63VeJmfqxMsT5gunTprr4VVe/qb9tDQ0Le9vBaEC3fX fkWOaMXcU5amT/FNAuABiWJ4JNdp0hHo9iL4hsbiMTD2fRPrRUgphnQLoTAw3r6J78kthDrI2W3 SqLHiGVwXUF8wJVnXFneXA7tS58i6KKEyKH9yLM5FBfxlkTHAsDzm5FvKO9Y1+s6ek8Apa6mFTf 3Ol7f+/1xQLfbESq+nQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfX4c3gIWbDcseu 3z18oo15wla4O82chnkrAqMSxQ/bB7XtLjCXS6U3ZZP8l56isfhWbpfTQRNAmHbUNu74qZYnhHi lma8bNjlSKTbF1kHvxAJAi6ANgfVjAo= X-Authority-Analysis: v=2.4 cv=AZeB2XXG c=1 sm=1 tr=0 ts=6a64d5d2 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=ivfjLWcg7tKDF-lgONIA:9 X-Proofpoint-GUID: T2DI0WI3ZorvZ4GbRKleK21wHTtn6kqZ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_04,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 priorityscore=1501 phishscore=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250144 Content-Type: text/plain; charset="utf-8" The channel_program struct is manipulated without a serialization mechanism to ensure consistent behavior. Take a broad stroke of putting the entire structure behind a mutex, and ensure everything that needs private->cp holds this mutex. There are a couple where the cio layer's subchannel->lock performs this role in this code, which isn't correct (it should only be used when touching the actual subchannel, like cio_enable_subchannel()), so adjust the locations where that spinlock is acquired/released to correctly coexist with this new mutex. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 30 +++++++++++++++++++++++++---- drivers/s390/cio/vfio_ccw_drv.c | 6 ++++++ drivers/s390/cio/vfio_ccw_fsm.c | 20 ++++++++++++------- drivers/s390/cio/vfio_ccw_ops.c | 10 +++++++++- drivers/s390/cio/vfio_ccw_private.h | 3 +++ 5 files changed, 57 insertions(+), 12 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c index 5ef082b8289a..ab66caff9894 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -738,12 +738,15 @@ static int ccwchain_fetch_one(struct ccw1 *ccw, */ int cp_init(struct channel_program *cp, union orb *orb) { - struct vfio_device *vdev =3D - &container_of(cp, struct vfio_ccw_private, cp)->vdev; + struct vfio_ccw_private *private =3D + container_of(cp, struct vfio_ccw_private, cp); + struct vfio_device *vdev =3D &private->vdev; /* custom ratelimit used to avoid flood during guest IPL */ static DEFINE_RATELIMIT_STATE(ratelimit_state, 5 * HZ, 1); int ret; =20 + lockdep_assert_held(&private->cp_mutex); + /* this is an error in the caller */ if (cp->initialized) return -EBUSY; @@ -784,11 +787,14 @@ int cp_init(struct channel_program *cp, union orb *or= b) */ void cp_free(struct channel_program *cp) { - struct vfio_device *vdev =3D - &container_of(cp, struct vfio_ccw_private, cp)->vdev; + struct vfio_ccw_private *private =3D + container_of(cp, struct vfio_ccw_private, cp); + struct vfio_device *vdev =3D &private->vdev; struct ccwchain *chain, *temp; int i; =20 + lockdep_assert_held(&private->cp_mutex); + if (!cp->initialized) return; =20 @@ -841,11 +847,15 @@ void cp_free(struct channel_program *cp) */ int cp_prefetch(struct channel_program *cp) { + struct vfio_ccw_private *private =3D + container_of(cp, struct vfio_ccw_private, cp); struct ccwchain *chain; struct ccw1 *ccw; struct page_array *pa; int len, idx, ret; =20 + lockdep_assert_held(&private->cp_mutex); + /* this is an error in the caller */ if (!cp->initialized) return -EINVAL; @@ -883,10 +893,14 @@ int cp_prefetch(struct channel_program *cp) */ union orb *cp_get_orb(struct channel_program *cp, struct subchannel *sch) { + struct vfio_ccw_private *private =3D + container_of(cp, struct vfio_ccw_private, cp); union orb *orb; struct ccwchain *chain; struct ccw1 *cpa; =20 + lockdep_assert_held(&private->cp_mutex); + /* this is an error in the caller */ if (!cp->initialized) return NULL; @@ -931,10 +945,14 @@ union orb *cp_get_orb(struct channel_program *cp, str= uct subchannel *sch) */ void cp_update_scsw(struct channel_program *cp, union scsw *scsw) { + struct vfio_ccw_private *private =3D + container_of(cp, struct vfio_ccw_private, cp); struct ccwchain *chain; dma32_t cpa =3D scsw->cmd.cpa; u32 ccw_head; =20 + lockdep_assert_held(&private->cp_mutex); + if (!cp->initialized) return; =20 @@ -977,9 +995,13 @@ void cp_update_scsw(struct channel_program *cp, union = scsw *scsw) */ bool cp_iova_pinned(struct channel_program *cp, u64 iova, u64 length) { + struct vfio_ccw_private *private =3D + container_of(cp, struct vfio_ccw_private, cp); struct ccwchain *chain; int i; =20 + lockdep_assert_held(&private->cp_mutex); + if (!cp->initialized) return false; =20 diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_dr= v.c index c197ad5ab580..4830f0dd9c3a 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -91,6 +91,8 @@ void vfio_ccw_sch_io_todo(struct work_struct *work) =20 is_final =3D !(scsw_actl(&irb->scsw) & (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); + + mutex_lock(&private->cp_mutex); if (scsw_is_solicited(&irb->scsw)) { cp_update_scsw(&private->cp, &irb->scsw); if (is_final && private->state =3D=3D VFIO_CCW_STATE_CP_PENDING) { @@ -98,6 +100,8 @@ void vfio_ccw_sch_io_todo(struct work_struct *work) cp_is_finished =3D true; } } + mutex_unlock(&private->cp_mutex); + mutex_lock(&private->io_mutex); memcpy(private->io_region->irb_area, irb, sizeof(*irb)); mutex_unlock(&private->io_mutex); @@ -131,7 +135,9 @@ void vfio_ccw_notoper_todo(struct work_struct *work) =20 private =3D container_of(work, struct vfio_ccw_private, notoper_work); =20 + mutex_lock(&private->cp_mutex); cp_free(&private->cp); + mutex_unlock(&private->cp_mutex); } =20 /* diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fs= m.c index 4d47a3c7b9a0..cefdfcb0cad7 100644 --- a/drivers/s390/cio/vfio_ccw_fsm.c +++ b/drivers/s390/cio/vfio_ccw_fsm.c @@ -25,17 +25,15 @@ static int fsm_io_helper(struct vfio_ccw_private *priva= te) unsigned long flags; int ret; =20 - spin_lock_irqsave(&sch->lock, flags); - orb =3D cp_get_orb(&private->cp, sch); - if (!orb) { - ret =3D -EIO; - goto out; - } + if (!orb) + return -EIO; =20 VFIO_CCW_TRACE_EVENT(5, "stIO"); VFIO_CCW_TRACE_EVENT(5, dev_name(&sch->dev)); =20 + spin_lock_irqsave(&sch->lock, flags); + /* Issue "Start Subchannel" */ ccode =3D ssch(sch->schid, orb); =20 @@ -71,7 +69,6 @@ static int fsm_io_helper(struct vfio_ccw_private *private) default: ret =3D ccode; } -out: spin_unlock_irqrestore(&sch->lock, flags); return ret; } @@ -251,6 +248,8 @@ static void fsm_io_request(struct vfio_ccw_private *pri= vate, private->state =3D VFIO_CCW_STATE_CP_PROCESSING; memcpy(scsw, io_region->scsw_area, sizeof(*scsw)); =20 + mutex_lock(&private->cp_mutex); + if (scsw->cmd.fctl & SCSW_FCTL_START_FUNC) { orb =3D (union orb *)io_region->orb_area; =20 @@ -299,6 +298,8 @@ static void fsm_io_request(struct vfio_ccw_private *pri= vate, cp_free(&private->cp); goto err_out; } + + mutex_unlock(&private->cp_mutex); return; } else if (scsw->cmd.fctl & SCSW_FCTL_HALT_FUNC) { VFIO_CCW_MSG_EVENT(2, @@ -319,6 +320,7 @@ static void fsm_io_request(struct vfio_ccw_private *pri= vate, } =20 err_out: + mutex_unlock(&private->cp_mutex); private->state =3D VFIO_CCW_STATE_IDLE; trace_vfio_ccw_fsm_io_request(scsw->cmd.fctl, schid, io_region->ret_code, errstr); @@ -409,7 +411,11 @@ static void fsm_close(struct vfio_ccw_private *private, =20 private->state =3D VFIO_CCW_STATE_STANDBY; spin_unlock_irq(&sch->lock); + + mutex_lock(&private->cp_mutex); cp_free(&private->cp); + mutex_unlock(&private->cp_mutex); + return; =20 err_unlock: diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index 6c74d596be9d..9242a37677a0 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -38,8 +38,13 @@ static void vfio_ccw_dma_unmap(struct vfio_device *vdev,= u64 iova, u64 length) container_of(vdev, struct vfio_ccw_private, vdev); =20 /* Drivers MUST unpin pages in response to an invalidation. */ - if (!cp_iova_pinned(&private->cp, iova, length)) + mutex_lock(&private->cp_mutex); + if (!cp_iova_pinned(&private->cp, iova, length)) { + mutex_unlock(&private->cp_mutex); return; + } + + mutex_unlock(&private->cp_mutex); =20 vfio_ccw_mdev_reset(private); } @@ -50,6 +55,7 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) container_of(vdev, struct vfio_ccw_private, vdev); =20 mutex_init(&private->io_mutex); + mutex_init(&private->cp_mutex); private->state =3D VFIO_CCW_STATE_STANDBY; INIT_LIST_HEAD(&private->crw); INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo); @@ -91,6 +97,7 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) out_free_cp: kfree(private->cp.guest_cp); out_free_private: + mutex_destroy(&private->cp_mutex); mutex_destroy(&private->io_mutex); return -ENOMEM; } @@ -142,6 +149,7 @@ static void vfio_ccw_mdev_release_dev(struct vfio_devic= e *vdev) kmem_cache_free(vfio_ccw_cmd_region, private->cmd_region); kmem_cache_free(vfio_ccw_io_region, private->io_region); kfree(private->cp.guest_cp); + mutex_destroy(&private->cp_mutex); mutex_destroy(&private->io_mutex); } =20 diff --git a/drivers/s390/cio/vfio_ccw_private.h b/drivers/s390/cio/vfio_cc= w_private.h index e2256402b089..b595fd81f370 100644 --- a/drivers/s390/cio/vfio_ccw_private.h +++ b/drivers/s390/cio/vfio_ccw_private.h @@ -94,6 +94,7 @@ struct vfio_ccw_parent { * @schib_region: MMIO region for SCHIB information * @crw_region: MMIO region for getting channel report words * @num_regions: number of additional regions + * @cp_mutex: protect against concurrent update of CP resources * @cp: channel program for the current I/O operation * @irb: irb info received from interrupt * @scsw: scsw info @@ -116,7 +117,9 @@ struct vfio_ccw_private { struct ccw_crw_region *crw_region; int num_regions; =20 + struct mutex cp_mutex; struct channel_program cp; + struct irb irb; union scsw scsw; struct list_head crw; --=20 2.53.0 From nobody Sat Jul 25 18:53:18 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF12A2EA47C; Sat, 25 Jul 2026 15:27:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993237; cv=none; b=co5mqYvLJbL3OFXrQNOSvEeX8j+ws10x7ZgLK2i5l9u+5iuCeYLpUSH/HaPm6hZyAScR9ZnDIs8xfXxV7uJP7dzNSA1QrBsqMXULz1naOlJPAhJB2xrV33N0NxG8UNBV16P1cIY2MyXI751lZOMxlO2H9D+GQmQFT65vjgC/rkY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993237; c=relaxed/simple; bh=wpi4P8y9K1SLjsP3VAuJ4TUlSO/AB6pEtdSw/WzBHDY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Van50oOrlYFTuWx8aTMzxqGVwgt6OTxOPSDTZLCqW71cFvfcNex6qUYqL2SYh3QyDKuubuV8lN7gk7HN3To5fGgoYRg8XLpHU3nrjYpd2Pi2LIn9P+MbVJnwQNkoLWgsX04DBnwFOS+ucfWg1pXetGpAXR4T3vwNA4C2bUV+sRs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=ONy/kQFL; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="ONy/kQFL" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66PDlrQp793599; Sat, 25 Jul 2026 15:27:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=inIgiBbYnhUHnNmwl Uxkix66hPWZWzn8hk1Xj47z1yw=; b=ONy/kQFLRW1HV9MqQqd6C3NMOow/vnwS9 y1CsyNfF/LwH02S4LsrsCdPzfoRdiUTRMQGv0jviMTyIVNb8GRelwkDQpjXX7c4U l9uH8qEluaoBS2bsgBq43AsOEXS6v0zeiQ+A+rLd7NrEHOMxDjna8ccGlv0QDKXu 84uHuAWOszA+KoYNQ8ujyigldxoqiVs0e8SxrABCCs6xFOv9ZmsdPukfHia55gRH 2mul2WFuLM+MuQfXGfc106OYgbUJDgIy/DidT+wAHOkYvstDGF1ipOXaosvMirIk PAnv19g7uAFBCfC6sluCz7yuhxYYukWMbMb2Xqlj2WJPR1Uq3lygA== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuw70kbc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:14 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66PFQKAu016934; Sat, 25 Jul 2026 15:27:13 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fmn331ntu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 25 Jul 2026 15:27:13 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66PFR9wV53477638 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 25 Jul 2026 15:27:09 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C274F200E1; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AAFB4200E3; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav06.fra02v.mail.ibm.com (Postfix) with SMTP; Sat, 25 Jul 2026 15:27:09 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 7707E162820; Sat, 25 Jul 2026 17:27:09 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org, Farhan Ali Subject: [PATCH v4 9/9] s390/vfio_ccw: implement a crw lock Date: Sat, 25 Jul 2026 17:27:05 +0200 Message-ID: <20260725152705.3958100-10-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260725152705.3958100-1-farman@linux.ibm.com> References: <20260725152705.3958100-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: qBxJgc0yDB9mkazSg4M-51C7bCaushUb X-Proofpoint-ORIG-GUID: qBxJgc0yDB9mkazSg4M-51C7bCaushUb X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfXyxVPmzlmgZM+ b3U4Gp/1TkyE2Kq70L4i9rj0wrTdkC5KvFr6x2y4TIrGwxPL1aR69fJsYtO4DK7ck/K/kMNdT7+ 75gWap1FVZIXb4Y/d//bBn3lE6I7Gwg+cO+8qHHcKvPvHpc1LdwWEdYYd1n2qfT9d/uKfxqPGOt 3gLGJ36223jR4nR4twHC7yQfWYL2CIuBGPqs521YB44wjnvMEzfmJ2i16xsZfRbK0N7oqyAmPmf KZYO6FVPA9U2wQqWyYEGBe2MnCAGsZuaMqfX+1sVs+lKu3uNiKiSv8u1+bh6KTF4nKoO61i5HOh WnbGZezmcFyKYEEY1qWDUhbja5N0xjLkUAsyQWj2XDqTGuvxTkodT5FNTolrIfIXdZcIM5RtdGA TYpuV/4mN+Qg3FrGvOv8ZXa4ncfBG0vfX9G7v2PWrdtXcGtrjkuxDMZty+FrUJ6vJ6uUA6kXX19 RSDaCFA5P7G4ghmRLGg== X-Authority-Analysis: v=2.4 cv=SKFykuvH c=1 sm=1 tr=0 ts=6a64d5d2 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=huIa1HNm52ewcn7HQvQA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDE0NCBTYWx0ZWRfXxYDFKcPEOT8M fLKS28JktrMSuwVrK390OFylKud1NSsYl9PHoJdEOgqZ/jw/dDxMJjc5LBttz/pJ4som5Zj4nh6 P4IOJrHpibNlA+4Vq7xcAjaBZwg6vnI= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_04,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250144 Content-Type: text/plain; charset="utf-8" Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively. Fixes: 3f02cb2fd9d2 ("vfio-ccw: Wire up the CRW irq and CRW region") Cc: stable@vger.kernel.org Cc: Farhan Ali Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_chp.c | 25 +++++++++++++++---------- drivers/s390/cio/vfio_ccw_drv.c | 4 ++++ drivers/s390/cio/vfio_ccw_ops.c | 3 +++ drivers/s390/cio/vfio_ccw_private.h | 4 ++++ 4 files changed, 26 insertions(+), 10 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_chp.c b/drivers/s390/cio/vfio_ccw_ch= p.c index f3015132d4b5..313c541e83eb 100644 --- a/drivers/s390/cio/vfio_ccw_chp.c +++ b/drivers/s390/cio/vfio_ccw_chp.c @@ -98,12 +98,6 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_ccw_= private *private, if (pos + count > sizeof(*region)) return -EINVAL; =20 - crw =3D list_first_entry_or_null(&private->crw, - struct vfio_ccw_crw, next); - - if (crw) - list_del(&crw->next); - mutex_lock(&private->io_mutex); if (i >=3D private->num_regions) { ret =3D -EINVAL; @@ -113,6 +107,16 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_cc= w_private *private, i =3D array_index_nospec(i, private->num_regions); region =3D private->region[i].data; =20 + spin_lock(&private->crw_lock); + crw =3D list_first_entry_or_null(&private->crw, + struct vfio_ccw_crw, next); + + if (crw) + list_del(&crw->next); + + /* Drop CRW lock while copying to userspace */ + spin_unlock(&private->crw_lock); + if (crw) memcpy(®ion->crw, &crw->crw, sizeof(region->crw)); =20 @@ -122,15 +126,16 @@ static ssize_t vfio_ccw_crw_region_read(struct vfio_c= cw_private *private, ret =3D count; =20 region->crw =3D 0; - -out: - mutex_unlock(&private->io_mutex); - kfree(crw); =20 /* Notify the guest if more CRWs are on our queue */ + spin_lock(&private->crw_lock); if (!list_empty(&private->crw) && private->crw_trigger) eventfd_signal(private->crw_trigger); + spin_unlock(&private->crw_lock); + +out: + mutex_unlock(&private->io_mutex); =20 return ret; } diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_dr= v.c index 4830f0dd9c3a..32f631d08620 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -125,8 +125,10 @@ void vfio_ccw_crw_todo(struct work_struct *work) =20 private =3D container_of(work, struct vfio_ccw_private, crw_work); =20 + spin_lock(&private->crw_lock); if (!list_empty(&private->crw) && private->crw_trigger) eventfd_signal(private->crw_trigger); + spin_unlock(&private->crw_lock); } =20 void vfio_ccw_notoper_todo(struct work_struct *work) @@ -307,7 +309,9 @@ static void vfio_ccw_queue_crw(struct vfio_ccw_private = *private, crw->crw.erc =3D erc; crw->crw.rsid =3D rsid; =20 + spin_lock(&private->crw_lock); list_add_tail(&crw->next, &private->crw); + spin_unlock(&private->crw_lock); queue_work(vfio_ccw_work_q, &private->crw_work); } =20 diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_op= s.c index 9242a37677a0..6735b5f4c07a 100644 --- a/drivers/s390/cio/vfio_ccw_ops.c +++ b/drivers/s390/cio/vfio_ccw_ops.c @@ -61,6 +61,7 @@ static int vfio_ccw_mdev_init_dev(struct vfio_device *vde= v) INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo); INIT_WORK(&private->crw_work, vfio_ccw_crw_todo); INIT_WORK(&private->notoper_work, vfio_ccw_notoper_todo); + spin_lock_init(&private->crw_lock); =20 private->cp.guest_cp =3D kzalloc_objs(struct ccw1, CCWCHAIN_LEN_MAX); if (!private->cp.guest_cp) @@ -139,10 +140,12 @@ static void vfio_ccw_mdev_release_dev(struct vfio_dev= ice *vdev) container_of(vdev, struct vfio_ccw_private, vdev); struct vfio_ccw_crw *crw, *temp; =20 + spin_lock(&private->crw_lock); list_for_each_entry_safe(crw, temp, &private->crw, next) { list_del(&crw->next); kfree(crw); } + spin_unlock(&private->crw_lock); =20 kmem_cache_free(vfio_ccw_crw_region, private->crw_region); kmem_cache_free(vfio_ccw_schib_region, private->schib_region); diff --git a/drivers/s390/cio/vfio_ccw_private.h b/drivers/s390/cio/vfio_cc= w_private.h index b595fd81f370..ffa8be7547fe 100644 --- a/drivers/s390/cio/vfio_ccw_private.h +++ b/drivers/s390/cio/vfio_ccw_private.h @@ -98,6 +98,8 @@ struct vfio_ccw_parent { * @cp: channel program for the current I/O operation * @irb: irb info received from interrupt * @scsw: scsw info + * @crw_lock: serialization of CRW information + * @crw: list of Channel Report Word elements * @io_trigger: eventfd ctx for signaling userspace I/O results * @crw_trigger: eventfd ctx for signaling userspace CRW information * @req_trigger: eventfd ctx for signaling userspace to return device @@ -122,6 +124,8 @@ struct vfio_ccw_private { =20 struct irb irb; union scsw scsw; + + spinlock_t crw_lock; struct list_head crw; =20 struct eventfd_ctx *io_trigger; --=20 2.53.0