From nobody Tue Sep 29 10:31:56 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9CB18397B02; Sat, 8 Aug 2026 17:07:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208845; cv=none; b=Ik9EsKwDhEXfrAp2tusGoCtwn0iY7v9V+uotZ1ODkb88+DZjGZr155DayBkXORYnr67256qj6iFA/pVBxmy/qJBVvLQWiel3rbXBimESXao0aO9Xtucjd3cHQ6pjT0pF15m96dkXTKVFGV362V+Dbp0AAqUAtTph7Kf5aYmZCZA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208845; c=relaxed/simple; bh=sp851rKcjACvmA4idI1Vzv+6+lvy2OGsAjfNlN8mTIE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tT3PK4rappSBSh98CtQvi3KwhsEmm4Auj2vUs8rmnSHbwm9P1cXDpIIUkQJmMTJhu9bReOo8hJc+7LZfeCuQYbqcqUPTVEv0ft9bP13AQPoAaC6TG6Cyz7eM70xRuak780+bL+WUK+Q5FLqBgyaY7l1tfnie7tqkp41cnEr5Pe8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=RRBIIalF; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="RRBIIalF" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 678H1ebD625481; Sat, 8 Aug 2026 17:07:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Cbfw1pahnu31h+7Er d33ZjAfOVNEsK7X1JFcNQj/0L0=; b=RRBIIalFlNh0+J6W1kYdDCxtkVwDu/g2a 13772441d2fn3//Y0NGrXRpFxsQVgFGtyQKXf9nOOXNNmBw1AB5Jqyt1hFOvMTlZ 443bpItJ+/vNqQ3gcQ5L9PjhkXR3kAoWw/Ci/atRvWyDzn3f398o5udUFrMPnjJV J+9BYTK3BYNqHIGphLR8rOKUkTF2eZTZe6Pg3gMgXY43uHxClt2cgYao4Bb5K8/Y s8VxVecUDncicDJ6eMRd7CuV/L6NiznIVSnYNHqfOJStBeajESxNZwOzB4iqndNt ABQddFvW06aLYlp8eHUfmR3EKFaI4AHrACBI6lENLlqdblERCrwJg== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvp2hn1e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:18 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 678GujXe015862; Sat, 8 Aug 2026 17:07:18 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsv4km4ky-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:18 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 678H7GE858458538 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 8 Aug 2026 17:07:17 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DCCB358052; Sat, 8 Aug 2026 17:07:16 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2721558045; Sat, 8 Aug 2026 17:07:15 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.94.189]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 8 Aug 2026 17:07:15 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH 1/5] s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Date: Sat, 8 Aug 2026 13:07:08 -0400 Message-ID: <20260808170712.839066-2-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260808170712.839066-1-akrowiak@linux.ibm.com> References: <20260808170712.839066-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=AMtp2X5w c=1 sm=1 tr=0 ts=6a776246 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=dlTjfeu_wqJGreSUTgMA:9 X-Proofpoint-GUID: 0fD-k0eye_LITg1rfWrT2DRMOD0pbIFY X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfX7itLkES0f4lW W59SLYtBiMBwyqcoD2vKBgPpbOyopiorkkoIDjrOVguNz6SxZDmkP1mwAt27+D1DHZF0rtEZhm+ LnPd1w4sXj7qVcJ0HGhnZLDcL0/l170FHr0l5Vg36ghOadJd8evJzrs/S1dLF8Sb4rnXauFtXbL iN9+1qzl6G8bsIVOjoyoHWdivDjgaj6NQ5zs71BXX6dgELBHq3g6fV7zs6pyRqi5K91XvoPi6P+ HW9oAFWHcHqufsY/rCmP5wJQ6nwzKbG/lz0MesWItqMdCJkaKjnLUZu3LA+MAS6exKv3pTzh7Ze nU1uJPzvSdXLuyplAMhUY0lvFP+aPF+uGWPgMn4JxoaLyVZQUUbdSi+oGARK95RLlR5HSK4C3iv cwq7lUyPAjW07sExbaxXJQK9BvAmB/rO60y6qrhiKECLQBn9KIKJBaA+8+NMMwd4c/oQjyUYKHX uquc2qCDxZL2T71tnFQ== X-Proofpoint-ORIG-GUID: 0fD-k0eye_LITg1rfWrT2DRMOD0pbIFY X-Proofpoint-Spam-Info: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfX4n/siw4d3aaf AgFCEbamDLnRdS++u1tDbqI8apibgsHEFRTAn/rZw6wTva+OTXPDeMFBIq8sLZFWGCP9if3csx4 ktwawsYsKu974k69WbbzKSNFLt90Jcg= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-08_06,2026-08-07_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 phishscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608080146 Content-Type: text/plain; charset="utf-8" The do_remove flag in vfio_ap_mdev_cfg_remove() is initialised to zero before the loop that iterates over the list of matrix mdevs, but is never reset at the start of each iteration. Since do_remove is OR-accumulated across iterations, a positive result from one mdev carries over to subsequent mdevs. The fix is to set the do_remove flag with the first call to bitmap_and; for example: do_remove =3D bitmap_an rather than do_remove |=3D bitmap_and. Fixes: eeb386aeb5b7 ("s390/vfio-ap: handle config changed and scan complete= notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 44b3a1dcc1b3..845c86ba8bc3 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2603,15 +2603,15 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *= ap_remove, DECLARE_BITMAP(aprem, AP_DEVICES); DECLARE_BITMAP(aqrem, AP_DOMAINS); DECLARE_BITMAP(cdrem, AP_DOMAINS); - int do_remove =3D 0; + int do_remove; =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); =20 - do_remove |=3D bitmap_and(aprem, ap_remove, - matrix_mdev->matrix.apm, - AP_DEVICES); + do_remove =3D bitmap_and(aprem, ap_remove, + matrix_mdev->matrix.apm, + AP_DEVICES); do_remove |=3D bitmap_and(aqrem, aq_remove, matrix_mdev->matrix.aqm, AP_DOMAINS); --=20 2.53.0 From nobody Tue Sep 29 10:31:57 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC25F3939BC; Sat, 8 Aug 2026 17:07:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208852; cv=none; b=WriHoSrT5pQlCkJMXu6fgw1VcNEbYNOcg7IMNzBV6PpwXIHDqjwgQEmxyQo/r7wUx/4FrKdWqaJwXx2ZQFFGScD6iKjSORQGz4vARb44zYuYzwuOeEPGbJJV2WV5TH7o2bm983upl1S7AVa4eZMwa9yGZIxyCRiWyohyoZtTReQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208852; c=relaxed/simple; bh=imYGgSUs4id0nDvfXxI/LaxrXyfCCqi5Ste57YvTn6I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KtjTKhpjiNtSON3mPBGjI4AzRgbtX6GWZGIKner69/9YYiO5iUbTYWdfwM4I7X23UDo56P3wmHTAo5f9wU+gsKjBWPVuVaYg3vNmbQSeTEMwPWnoRTjI08oIql9cjq4qaAIkK4s1jfgzbbqO+TvPYm1qbXWqW9FTchDJPhZ478o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=q9yCMK/X; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="q9yCMK/X" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 678H1fcp722551; Sat, 8 Aug 2026 17:07:21 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=w2YLaPTpS70OxnwPJ /s1uFYb5UUIoitae0C3qdL2X7Q=; b=q9yCMK/Xy3YTd0A/EpwIN/FVweuRvyyHK fLYS7GfVFZ7wnOA/lOWxpN2jikAmwS2KsMH5EYJakAuj6jR6ZV+qaqIs+sGs5Cqh 0AG/nycwD9eBTKfsqxcEJK5lvYKCQCJEw9437pp+oo9JpJ6NbjkIEosVzUF1mtTB 8tEB2sjF4178RQhiw5czvVUrS6tBQdAq3xHBOkvhdC7gIglcqC2L+dXuYQ0rgvaA d48siJQlwahJjlGUndzhFdu45A4WXu2VEaFIuUROL5gfq6vQLPxaWel8FQtDyT8+ qlQ2VZ3Cg/t21HmEosiw5GQ9IFKfkNBV+Y+sFGfmOF8XyuQ37Ey3A== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvm99ryf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:21 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 678Gug10007246; Sat, 8 Aug 2026 17:07:20 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fsu4r47pv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:20 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 678H7IE727066972 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 8 Aug 2026 17:07:18 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C4E0258050; Sat, 8 Aug 2026 17:07:18 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 14DC458045; Sat, 8 Aug 2026 17:07:17 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.94.189]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 8 Aug 2026 17:07:16 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH 2/5] s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Date: Sat, 8 Aug 2026 13:07:09 -0400 Message-ID: <20260808170712.839066-3-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260808170712.839066-1-akrowiak@linux.ibm.com> References: <20260808170712.839066-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfX8WG6QaQBfnDI El2inXbyrI1j/GhuwC75Ig3val/jYYFUP9SDD0m48Y5ZZBBz3BqiHQdwCsHTpLOmEbLBsEbeYaE AMzDSDdE7ASlJEvz3vDTXwkaA0t5I/5XfIFB6qTOs1UBMgvWPvyUZSThno/MT1OYTDaxPcN6x4M EgaR5H0XLt58GBQvzpEaqHBoRvUIHhJ+X+VEyhBJrlNi8TVSEsGkpB/ydd4iSGuaEFrpRgsaPXE qYuEynBASBrkpXb4JU73YB6XDmK59hAjPE7BW6AP5Yt1hJxIzYv+H0ufx82YMzD+CDbxtWFeQQ9 ETeNf1+UD5DYehAHX/pXoPv3bybH48lMAD0PEbjw09a4ahyuIG9vVc10jLmIzk7ieuIwVn6rr0z R+2Cwx+OKiEnFXTX0AbVhfThWEqt50d0cQUuEn4hy/b2ExLG+bKsfL7NAz3qd70jdatb3h0sPum qMjn6qJTaK4m+El9RsQ== X-Proofpoint-ORIG-GUID: KXzkQV8mpmwN7aPOtj-Su8tTuPfxc_62 X-Proofpoint-Spam-Info: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfX0czUsXK9Ei/6 imxkzZlFqxMNSvnMn9Q7zM9HUIBMbvxOY6s7fRsBg6Hc47myTuetjxXNYolnqulllD1S5YTkZC1 Q5j9awQq4Mbsl/Qp09+sSmCpHS8l/Ro= X-Authority-Analysis: v=2.4 cv=IfK3n2qa c=1 sm=1 tr=0 ts=6a776249 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=7-PX2TBNVYp1iSTFOFgA:9 X-Proofpoint-GUID: KXzkQV8mpmwN7aPOtj-Su8tTuPfxc_62 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-08_06,2026-08-07_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 clxscore=1015 lowpriorityscore=0 adultscore=0 malwarescore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608080146 Content-Type: text/plain; charset="utf-8" The ap_driver structure has two fields which are function pointers to callbacks: * .on_config_changed: called at the start of the AP bus scan function to notify the device driver that the host AP configuration has changed and the associated AP devices will be added or removed accordingly. This gives the implementor a chance to evaluate the configuration changes and respond to them before the associated devices are added or removed. * .on_scan_complete: Called at the end of the AP bus scan function to notify the device driver that the host AP configuration has changed and the AP devices have been added or removed accordingly. This gives the implementor the opportunity to respond to the changes after the associated devices are added or removed. These two callbacks are implemented in the vfio_ap device driver via the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete functions respectively. Within the call stack of these two callback functions the matrix_mdev->kvm->lock mutex is taken without checking whether matrix_mdev->kvm is NULL or not. If matrix_mdev->kvm has never been set, trying to take the lock will trigger a NULL pointer dereference. This patch adds checks for matrix_mdev->kvm =3D=3D NULL before taking the matrix_mdev->kvm->lock mutex. Note that the matrix_mdev->kvm->lock mutex taken in the vfio_ap_mdev_hot_plug_config function is moved to the calling function along with the matrix_dev->mdevs_lock which is needed there to access the fields of the matrix_mdev. It makes little sense to make the change the check for matrix_mdev->kvm there before taking the kvm->lock mutex only to have to move it out via another patch, so it is done in this patch. It is important to make note of the following: 1. The matrix_dev->guests_lock is acquired at the start of both callback functions. This ensures that matrix_mdev will not be removed via the vfio_ap_mdev_remove function because it too takes matrix_dev_guests_lock before removing the object; so, matrix_mdev will be available for the duration of the callback functions. 2. The matrix_dev->mdevs_lock mutex must be taken in order to access fields within the matrix_mdev structure 3. matrix_mdev->kvm->lock mutex must be taken before the matrix_dev->mdevs_lock to prevent a lockdep splat. 4: The kvm->lock must be held while plugging the guest's AP configuration into its SIE state description via the vfio_ap_mdev_update_guest_apcb function. 5. The vfio_ap_mdev_update_guest_apcb checks matrix_mdev->kvm to verify it is not NULL before doing the hot plug of the guest's AP configuration. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 33 ++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 845c86ba8bc3..e382e5a1cb99 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2606,7 +2606,13 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *a= p_remove, int do_remove; =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { - mutex_lock(&matrix_mdev->kvm->lock); + /* + * The mdevs_lock must be held to access fields within matrix_mdev, + * and kvm->lock must be taken before mdevs_lock to satisfy the lock + * ordering requirement and prevent a lockdep splat. + */ + if (matrix_mdev->kvm) + mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); =20 do_remove =3D bitmap_and(aprem, ap_remove, @@ -2624,7 +2630,8 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *ap= _remove, cdrem); =20 mutex_unlock(&matrix_dev->mdevs_lock); - mutex_unlock(&matrix_mdev->kvm->lock); + if (matrix_mdev->kvm) + mutex_unlock(&matrix_mdev->kvm->lock); } } =20 @@ -2821,9 +2828,6 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matri= x_mdev *matrix_mdev) DECLARE_BITMAP(apm_filtered, AP_DEVICES); bool filter_domains, filter_adapters, filter_cdoms, do_hotplug =3D false; =20 - mutex_lock(&matrix_mdev->kvm->lock); - mutex_lock(&matrix_dev->mdevs_lock); - filter_adapters =3D bitmap_intersects(matrix_mdev->matrix.apm, matrix_mdev->apm_add, AP_DEVICES); filter_domains =3D bitmap_intersects(matrix_mdev->matrix.aqm, @@ -2841,9 +2845,6 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matri= x_mdev *matrix_mdev) vfio_ap_mdev_update_guest_apcb(matrix_mdev); =20 reset_queues_for_apids(matrix_mdev, apm_filtered); - - mutex_unlock(&matrix_dev->mdevs_lock); - mutex_unlock(&matrix_mdev->kvm->lock); } =20 void vfio_ap_on_scan_complete(struct ap_config_info *new_config_info, @@ -2854,15 +2855,29 @@ void vfio_ap_on_scan_complete(struct ap_config_info= *new_config_info, mutex_lock(&matrix_dev->guests_lock); =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { + /* + * The mdevs_lock must be held to access fields within matrix_mdev, + * and kvm->lock must be taken before mdevs_lock to satisfy the lock + * ordering requirement and prevent a lockdep splat. + */ + if (matrix_mdev->kvm) + mutex_lock(&matrix_mdev->kvm->lock); + mutex_lock(&matrix_dev->mdevs_lock); + if (bitmap_empty(matrix_mdev->apm_add, AP_DEVICES) && bitmap_empty(matrix_mdev->aqm_add, AP_DOMAINS) && bitmap_empty(matrix_mdev->adm_add, AP_DOMAINS)) - continue; + goto do_unlock; =20 vfio_ap_mdev_hot_plug_cfg(matrix_mdev); bitmap_clear(matrix_mdev->apm_add, 0, AP_DEVICES); bitmap_clear(matrix_mdev->aqm_add, 0, AP_DOMAINS); bitmap_clear(matrix_mdev->adm_add, 0, AP_DOMAINS); + +do_unlock: + mutex_unlock(&matrix_dev->mdevs_lock); + if (matrix_mdev->kvm) + mutex_unlock(&matrix_mdev->kvm->lock); } =20 mutex_unlock(&matrix_dev->guests_lock); --=20 2.53.0 From nobody Tue Sep 29 10:31:57 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 652F937A829; Sat, 8 Aug 2026 17:07:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208849; cv=none; b=R5+bj20E302tqvOfoBAQjDRwKW5+qxpgOGedKHZxXC6HERHYBcQuhlks7wKAFUVV4+1OGXiEry7meF/7iqic5yJDCJ2tykRsF338ujKc1Eo2szAQZpjNLDINYoSwvsUMYlD6ybSPJUX467aPOHkdFde/EOGbHjZjzxDrTL46Lv4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208849; c=relaxed/simple; bh=4tidI23Pm+dYwkNbLIXMMsazONFi/qGjVCp+vtRgBAI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RqNeIweLglsSIjPqWcOflun0fZ3gyGyLPgWt3p7LcpBtqSH/4/WBcmoFeZ/cMjGPkXrLv4mHAovXeXgCYFgLSGmjhW1WAqCF+VEdKyRc2Tg4V4eL4D/XQw4EGhnG4+MciCjiBfuCCGSVLyLcuaNtsAcdAMreSP0Up5q2cjvgTyY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=e6W5cLMO; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="e6W5cLMO" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 678H1tqh605924; Sat, 8 Aug 2026 17:07:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qbE/FfN+6bKSEEHXg zeGEhHoSj357bjJBkyHRtmLeYs=; b=e6W5cLMOxSIYV2R8CS00JKhqb4U0YmTSk O9/U66SDr5TaJjwZJdLm9Fhg1ma7U8vMKPlLFoGIsM5XMNqkxVZdEm7J6JPYJHPL ZoLPY34noF85BrzzfH1tFLRIwvxFJrdcPX6uQcg++t80j3binXGghu9I+SNU+9Ac XPFsz+TT6nQP8beDhPsy0jRFgXcRe44z2GrxveE+6MLQ3Lmi+T5meVQfPRaGZJ7h cLqHtZD1EXV9Qkw/isn94Dnp0GOzW5bQ/mf9+vxmctnv02LSd21P1T5gR+8EaWid H5fhgG1AHyQMGPpp/pb/5+IqMLoPSA0giNoNnOQWGK7zFKjNjNrWQ== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvkchn9b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:22 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 678GudD4013079; Sat, 8 Aug 2026 17:07:22 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fswu03vkf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:21 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 678H7KqK27984572 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 8 Aug 2026 17:07:21 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C775558050; Sat, 8 Aug 2026 17:07:20 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 00A8D58045; Sat, 8 Aug 2026 17:07:19 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.94.189]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 8 Aug 2026 17:07:18 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH 3/5] s390/vfio-ap: Fix use of wrong lock in mdev probe function Date: Sat, 8 Aug 2026 13:07:10 -0400 Message-ID: <20260808170712.839066-4-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260808170712.839066-1-akrowiak@linux.ibm.com> References: <20260808170712.839066-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: mizJpq5wg1SRAPkJIGn-j68Ptjvt9EnM X-Authority-Analysis: v=2.4 cv=J86aKgnS c=1 sm=1 tr=0 ts=6a77624a cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=IOhVIQ1U7ISs0PSOFQMA:9 X-Proofpoint-ORIG-GUID: mizJpq5wg1SRAPkJIGn-j68Ptjvt9EnM X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfX6r5CDk+8WwP1 lKxGJO4wCC+cNW1v4UHUUFKQ973J/wUf4MrgMbZAJ4Eh2F2F8IcC3FKvmYnvYzB8pO6qil8zRU6 3NTsrinqOBevI1aUyhUQoba2Us+wISxv7szBhwwyrFu0tuGwoTBEaiLqKz4SQnb6p3cQuhYC1Bo /RJCF243zxFSLoDylz4zhngebfK1HnUcg4o9+iKFhyotdig4kVBSLCvpen8g8ym5fwQussaSbyA VtV5KrVS2uZK34xvGNg+59W04PZ1fZ84RXjp3UgrcJUH4b+xd5vkjVlSHkimO8N9lFjrAGnV/Mp OeWtgAmIcksKSVpJmFb5KMqjpx5yXVrQUPs+8ZWwozJ3uYofi124iNdALoFl0KPfseClSGdxEUN 4lC3nloQygqVn4QaCqdbzsQhmagjccGysWKKrowJ1Oh5Aj34MXMhl3ovjcE0+jPu7UkY1JmgV3x d6hzucMh9eT3S1vaVng== X-Proofpoint-Spam-Info: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfXwAxH70ALHyjA CZd6UTXWJqVv8AJ6+KMi4IvKK7doVbSbb/sdQWuvj4iEx+0rITI3Gsp0b/HwnR172i54a8dM1WK dj2/Cfe8VznXHpzYQTxrQU3ncp8XFX0= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-08_06,2026-08-07_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 priorityscore=1501 suspectscore=0 malwarescore=0 adultscore=0 phishscore=0 impostorscore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608080146 Content-Type: text/plain; charset="utf-8" The vfio_ap_mdev_probe function uses the matrix_dev->mdevs_lock mutex to guard the add of a newly created ap_matrix_mdev object to the matrix_dev->mdev_list. This mutex does not protect against traversal of the list; its purpose is to guard against concurrent access to fields contained in an ap_matrix_mdev object. This could lead to kernel memory corruption or use-after-free if another mdev is created concurrently. The adding of an ap_matrix_mdev object to matrix_dev->mdev_list is now guarded by the matrix_dev->guests_lock which is the correct way to protect against concurrent mdev_list access. See the vfio-ap-locking.rst in the linux kernel tree. Fixes: 2c1ee8983aa3 ("s390/vfio-ap: prepare for dynamic update of guest's A= PCB on queue probe/remove") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index e382e5a1cb99..a472de00bc14 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -803,9 +803,9 @@ static int vfio_ap_mdev_probe(struct mdev_device *mdev) matrix_mdev->req_trigger =3D NULL; matrix_mdev->cfg_chg_trigger =3D NULL; dev_set_drvdata(&mdev->dev, matrix_mdev); - mutex_lock(&matrix_dev->mdevs_lock); + mutex_lock(&matrix_dev->guests_lock); list_add(&matrix_mdev->node, &matrix_dev->mdev_list); - mutex_unlock(&matrix_dev->mdevs_lock); + mutex_unlock(&matrix_dev->guests_lock); return 0; =20 err_put_vdev: --=20 2.53.0 From nobody Tue Sep 29 10:31:57 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 569D61E1A3D; Sat, 8 Aug 2026 17:07:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208852; cv=none; b=DssSQoWHcFRudEXTtlo8BGNu3ChfxcKEhfbRLopu9XeNdMmftvm4umtzVCRCV2y+LBACC3XptPb3+rMiBYkCnhT8bzl/NkPHNPo6u/DKOPpbvtj3y9XG3RM9FS4sNint+Biz/3IqxUKOdCutsxY2ALtR+qM2RBo0eBUD3l06/uk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208852; c=relaxed/simple; bh=WotD2MLbxeRHgu/jt/5UwQhdLwGWX0k9HUrbL1gIpxM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CfJinpa3EAVQNWb0L8czbdHJtAtmSm+mXQMoEA3O+j+TMg8+83stPGSQDAA01nkr2X5xU7Ia42n0cHC4a7p5NDbgkwsSUVgOaydk+1gfwZ0RHVtL3j09zD9O7bQo9cFGrDzklS377f9POtU5ZzwiShhqAYUGZurvVhyYKPE9sbU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=tFWsYOEk; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="tFWsYOEk" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 678H1a4i3041381; Sat, 8 Aug 2026 17:07:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=wl88axlrYzF3a4bJk reen17QLWcHEjfJd08Y3z49IjY=; b=tFWsYOEktIcLIG1UGfnL0hvmb7C9EywPa pWQwnzqe0DDaSR1s8CyrfpcToYb5U2z7JpbKr/HhZ7Ynsjep3VXhuR111BM7QmxT SkEaCDQgjN0Dg7ad51Ut07TmPKCLOJ0oasCfhTxMM5G4OGlz0aVrvuurt/UHKJCw 0cxoKMXAG/lI+i2gAAvurf+87ROXz10i2G4dCQZLLRNcOGLGgouqIu4L91jFJT9c nySvuvDDBjTVBCVAxGrn8DyAahT62zVX30ppq6/NCwa2B3DiQGSafP3SZO8/6uP7 F9C0L5PmcxoNS6i/8X6NZxhc7EMYqxPoebRYtyZLiXiQ46xG2+97g== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvjyhs02-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:24 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 678GuYTs007037; Sat, 8 Aug 2026 17:07:23 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fsu4r47q2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:23 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 678H7MWh35258832 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 8 Aug 2026 17:07:23 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B7CF958050; Sat, 8 Aug 2026 17:07:22 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F1EB558045; Sat, 8 Aug 2026 17:07:20 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.94.189]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 8 Aug 2026 17:07:20 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH 4/5] s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Date: Sat, 8 Aug 2026 13:07:11 -0400 Message-ID: <20260808170712.839066-5-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260808170712.839066-1-akrowiak@linux.ibm.com> References: <20260808170712.839066-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfX/3fG4AZtWYne K+pNgcqTkN0HwZ4+pKH2GwOXjbJNkAu6P77GXM6CtDFrexSCvtGzWOcX72iITaPWRbeZ0Tm5azu k9H+yOPAjpt2yv4/PVOyXUtVxLGF41dbZq/B3BEgX68fqIN6bEK1Hd2dAWGyM34a9PMDANoOPUq CCEW3Pq2gWjAd+tjd3fgnR14vuFBzk+T60sw4NjxBofHsJb1U3Ueie8WUimj6HWP4pdbD/+T8Jk HMaYoNMkP4WZfcbXWHORJSInyCoTffegOqGXXUyBcxoqC9bukv+U0E0jARWCfnWc/lJ+KuAUaQG l5HiaL4JkZhS78yItVPDK4gxxgN1a83H4XjqRNUdK+1Lsvz5xZ1yhsFBome1IvYz6TKQQ0VLIz3 SlP6mWuCR+GRPC7GulLE1/76F4Ryxh5nY3nlnzcL/hS+Q0ctxFPQlYKosWbFaETWqvgfQM9bsfA 2ayw8i0FcUSRe1ynQdA== X-Proofpoint-Spam-Info: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfX3tF1XiaEWaeL 4kAxTIuJLssaDu9va73Qds67G+2onYWWddZpaWA9fsNngEUpoLVbCE8RHFy8XHeHBlicA68PYqs KA/BnhWLt8d7G95qZKEp6/od29k2jmM= X-Authority-Analysis: v=2.4 cv=RqD16imK c=1 sm=1 tr=0 ts=6a77624c cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=mm-sKQyJWPVlA1vr6AIA:9 X-Proofpoint-GUID: AiMZuteYNdAbWYx18w5tB_q6NOh9-Wcs X-Proofpoint-ORIG-GUID: AiMZuteYNdAbWYx18w5tB_q6NOh9-Wcs X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-08_06,2026-08-07_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 priorityscore=1501 suspectscore=0 lowpriorityscore=0 clxscore=1015 adultscore=0 bulkscore=0 malwarescore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608080146 Content-Type: text/plain; charset="utf-8" In the vfio_ap_mdev_cfg_add function, the apm_add, aqm_add and adm_add fields of an ap_matrix_mdev object fields are modified while not holding the matrix_dev->mdevs_lock. This lock must be held while making these to guard against a race condition with another caller that may be concurrently modifying these fields or any of the fields in the matrix_mdev->matrix. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index a472de00bc14..897518b88c28 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2756,12 +2756,20 @@ static void vfio_ap_mdev_cfg_add(unsigned long *apm= _add, unsigned long *aqm_add, vfio_ap_filter_apid_by_qtype(apm_add, aqm_add); =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { + /* + * The mdevs_lock must be held in order to access fields + * within matrix_mdev + */ + mutex_lock(&matrix_dev->mdevs_lock); + bitmap_and(matrix_mdev->apm_add, matrix_mdev->matrix.apm, apm_add, AP_DEVICES); bitmap_and(matrix_mdev->aqm_add, matrix_mdev->matrix.aqm, aqm_add, AP_DOMAINS); bitmap_and(matrix_mdev->adm_add, matrix_mdev->matrix.adm, adm_add, AP_DEVICES); + + mutex_unlock(&matrix_dev->mdevs_lock); } } =20 --=20 2.53.0 From nobody Tue Sep 29 10:31:57 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4701039A4B3; Sat, 8 Aug 2026 17:07:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208859; cv=none; b=jG/tbw8s/L6c901gDGquN3DWn4mrtCOAdaV496/u6SkWCN6ibo8NH81lzxUpoMaZCWbp2Tk2YB4XPbg4isnGN1AyBptS6YX8VPPj0ammVf2ezFqewost/q4hSa4w1yL7dfzItIcUW2CZV/OpCaMrQn9+fjTZNM0OqCCDpU6thLo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786208859; c=relaxed/simple; bh=S+0Py54QPwwjxmTjKRphpYRFREkV9K/0Uu60dj0hMsc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jy42cbqLiSuOgTNWhroGtZCxWoiE0WU0Z5v21Q0QtlA7CEWHXNIAOFKCOuB3ok6cDJLMy7YZAwOz+j3kiwUzofFoqro1skeIjnfJBGBqMBLLXXBjhbh0RXRcg7W+sWfJ0CNBh/Z4EOy+p3mTpTmNyYK8hP3fo1OhXZ1koux8E8k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=KHUimw45; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="KHUimw45" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 678H1n0O625794; Sat, 8 Aug 2026 17:07:27 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=orXM1OrBDo65TknnI ovW003eex8NQqhw3By9QYQljIo=; b=KHUimw45EJtoFWOOjNmO3ld7qwypBESwp KniZAsA0S5GO5zO8nMp77s73bbKGM+W99SiyVMWqlJZOmbG4Lu9Q3HQ9nRKBfq3D veWGwvL5g9rxLPzG/m2ARB25FjD9Y8CFbhUcYNCO0wJWlH67JOZnTvsFOzSU0Qf1 xWTholAYKsUijMeTqyC3RA7XvwdbA4tbA9y0ACa74r4BZLs62aZGsDJyUycbJBVy ALCmd5ye/r2/GEUvKmkzNl8tE76+NyNZEtcIXZd7vlHF3VBSKTxrfRxBcWKWJUDr vd43MaprjJO/HkCJvnY8THXP5uwKGKSLpUOX1CNuWgFkRL/dcIBEA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvp2hn1q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:26 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 678GudO6015818; Sat, 8 Aug 2026 17:07:26 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsv4km4m5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 08 Aug 2026 17:07:26 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 678H7O0g12714652 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 8 Aug 2026 17:07:25 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A478C58050; Sat, 8 Aug 2026 17:07:24 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E39E458045; Sat, 8 Aug 2026 17:07:22 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.94.189]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Sat, 8 Aug 2026 17:07:22 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH 5/5] s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove Date: Sat, 8 Aug 2026 13:07:12 -0400 Message-ID: <20260808170712.839066-6-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260808170712.839066-1-akrowiak@linux.ibm.com> References: <20260808170712.839066-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=AMtp2X5w c=1 sm=1 tr=0 ts=6a77624e cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=fkyveIzhjB74ZASU3MYA:9 X-Proofpoint-GUID: EGHw3iLd-9i4O3AWSkvnyK1oUH5IsNMU X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfX+KPEJNcR7436 kbgBwAcZuprtLrlqZ7emCG0T99G32XQ2Su6D7m4sm1+Jn2nT3CrQLCaX3ne4KYMypKR/Ue2EyFb N+4Lt7y8zDWrkCIYSl3SV60y1ruH42BNX1GT+faEqpzpzIimnJijuBK1mf1w5z1EHyueUvq0w5c VpBbRMnXXvkQ/zP0ZqH56NliHUkId7e0NeSuaQ3XGEkxs4jSzyeKurLjeoVyY+V8V7zmUTMdLbH pbeFxlG3wsE81KVaMNN4bl8zqHKMqyrJPnhq/k2Ss6oyVX/xa1yurSeJ58Rmyte+mbwnQs9enpF pz6+GyMsotCoRAe52b+et2zf2pmVo8x/tKIn++Zifv1p31q219WeyButV9YA2Wzhpc3JvL2IKEL 5VU+eOL4lNpGb0fIrs/AaLiCxzU96hDD1SaUNNiEi1oNH1JReM1EJpjPcpwdXTEaBRYDK2aMwAI 8nJa4YixWz0zX3KMujQ== X-Proofpoint-ORIG-GUID: EGHw3iLd-9i4O3AWSkvnyK1oUH5IsNMU X-Proofpoint-Spam-Info: AW1haW4tMjYwODA4MDE0NiBTYWx0ZWRfXweiRPntf9bjR ogJd+tCXn0nU1OpiBeJD+B/1NIHxF45CwgbqR0OQTH0wzgmrrIlJPbtKXA7OIl+gqWSGSnsbBDS 7EnkD7veQc8M1HsD9Jw623Oef2k0tjY= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-08_06,2026-08-07_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 phishscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608080146 Content-Type: text/plain; charset="utf-8" The vfio_ap_config_remove function uses the bitmap_andnot function to clear bits from the matrix_mdev->matrix.adm bitmap (specifies the control domains assigned to the mdev). This prevents the explicitly unplugged control domains from being removed the KVM guest. The bitmap_and function is used instead. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 897518b88c28..9c7257c179a7 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2621,9 +2621,9 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *ap= _remove, do_remove |=3D bitmap_and(aqrem, aq_remove, matrix_mdev->matrix.aqm, AP_DOMAINS); - do_remove |=3D bitmap_andnot(cdrem, cd_remove, - matrix_mdev->matrix.adm, - AP_DOMAINS); + do_remove |=3D bitmap_and(cdrem, cd_remove, + matrix_mdev->matrix.adm, + AP_DOMAINS); =20 if (do_remove) vfio_ap_mdev_hot_unplug_cfg(matrix_mdev, aprem, aqrem, --=20 2.53.0