From nobody Tue Sep 29 07:39:19 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C017E43FD0B; Mon, 10 Aug 2026 19:23:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389799; cv=none; b=p8llGZUEHGoVn2fPNsfsWcUQKIVGJOgOTIc+w3xj5omgX3rlhNJLX2oz6s9HOpmE9ShT+Wfne4aMxJ4umD2K9+DOvJ9a8w6sFnNtGJaz606zQFcf6VE4PNSDXUrBHL4MnRYdxqViHnc8lg1vkJ2jonVGpiFpvzaTa0pRqlnw4uo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389799; c=relaxed/simple; bh=sp851rKcjACvmA4idI1Vzv+6+lvy2OGsAjfNlN8mTIE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Z2BgySe3/pOFAcSNQolk8Zvi9XZIJ7V0PuOXxLNtbad7k8wk/pj8LKcQwgYEXQVHc5I7FUEYtLzP5cl+0bqTsqhCpxXhJ7h9LxoWwoW2t5u2nwl1CPvpqsyP8uzWMoW5ZcTyiiLe66yqayRq4mEYO1fQ+sY7AOvfSXmk9mg8KEI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=hjEHKu0m; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="hjEHKu0m" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67AJ2COs613750; Mon, 10 Aug 2026 19:23:03 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Cbfw1pahnu31h+7Er d33ZjAfOVNEsK7X1JFcNQj/0L0=; b=hjEHKu0mc0ZLnZkG21F2UfPA9gkSgL3Ey b6Qb/0OPleFVSUXM6s1OuWQ3YEZuUzWvXOEemvm8xkbGuemKtt5WLGm/uyWUIRBM Az8E2N/qz9Gq8SvPFdgeFvUxvE/UTmdw3WFJYHAC9O0Lia8dILNRLMcqKG0/TUSp bekEXuQbcNm4kQ9YxFZ+kGpVunaCMrLAGpx6P3Rf6h/6+t79gEpnU9L+P88BarrZ /fUdjmicDlKvWa0yMBeBA3+DENOFbUx6kN6A58fiAFfOA8f0oL/FAmxGjZIbZtEn y/9pQzZJgfwX81ZK/gysz6cY6JhF/i1rYzP3R7eNciUI7rF5VIf/w== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvjysqts-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:03 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67AJBgpT017950; Mon, 10 Aug 2026 19:23:02 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxh0g602b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:02 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67AJN09l29885076 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 10 Aug 2026 19:23:00 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2A50D58058; Mon, 10 Aug 2026 19:23:00 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 12CF058057; Mon, 10 Aug 2026 19:22:59 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.71.153]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 10 Aug 2026 19:22:58 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v2 1/8] s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Date: Mon, 10 Aug 2026 15:22:50 -0400 Message-ID: <20260810192257.1208410-2-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260810192257.1208410-1-akrowiak@linux.ibm.com> References: <20260810192257.1208410-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX6YE3nBMcE6t0 tI+sTxbHuSCpvGcEsPwI3ZobbKD9N7g3GylBfChvDlhh21fduGg4xs1BO48Y/zyzLwAEQDpggez bonzNBwj+grKGY8sCesUfTTCTYs903h3cWAjGW2OLkFEJKIvrXnx2OlBhJIkM00ZtLDSdR7UaEN BDf6uxHw06k9Lmnj+QOZUJyd7YXssefq/irzZY6jMaxWAML0HzPv6ZIdSKYdHsKGXpyjQLmKVWw mvanb0aZZJlSTWrv8PL2Q+D9vNNoodKZsaB+pF57PmwcUGTf0jhVcbmqCkljcnGP75AiKkhNS+K UpSsnP1lJH7WX6dgGmlBTHW7UwbgyvCIOCDvT1cUy5qy0dWD5DwppwPASGAxm4X0MoIpDfQvrQU zdpObqjqvZToyn+ZdItj8cyOAj1GX4jJEpjoXjT6kfKpskda/CUBifv/qM666vqszOowdZsgov8 5eU6CNzB0rKsThnvFag== X-Proofpoint-Spam-Info: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfXx4nrZkNpnLjl On/jZeJ4MFkq2ARHeIEhtjp7BNG3aZRrocc3ZaL041h1cRIcMxB+mmnULP0vS34iNamsWDIBbjs mDT11bLcOu9LH9yv2jY7eXZIOgI1JQc= X-Authority-Analysis: v=2.4 cv=RqD16imK c=1 sm=1 tr=0 ts=6a7a2517 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=dlTjfeu_wqJGreSUTgMA:9 X-Proofpoint-GUID: 5lEFgIJiweYxg9xY4I7c4oll5hNhtaRo X-Proofpoint-ORIG-GUID: 5lEFgIJiweYxg9xY4I7c4oll5hNhtaRo X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-10_05,2026-08-10_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 priorityscore=1501 suspectscore=0 lowpriorityscore=0 clxscore=1015 adultscore=0 bulkscore=0 malwarescore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608100162 Content-Type: text/plain; charset="utf-8" The do_remove flag in vfio_ap_mdev_cfg_remove() is initialised to zero before the loop that iterates over the list of matrix mdevs, but is never reset at the start of each iteration. Since do_remove is OR-accumulated across iterations, a positive result from one mdev carries over to subsequent mdevs. The fix is to set the do_remove flag with the first call to bitmap_and; for example: do_remove =3D bitmap_an rather than do_remove |=3D bitmap_and. Fixes: eeb386aeb5b7 ("s390/vfio-ap: handle config changed and scan complete= notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 44b3a1dcc1b3..845c86ba8bc3 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2603,15 +2603,15 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *= ap_remove, DECLARE_BITMAP(aprem, AP_DEVICES); DECLARE_BITMAP(aqrem, AP_DOMAINS); DECLARE_BITMAP(cdrem, AP_DOMAINS); - int do_remove =3D 0; + int do_remove; =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); =20 - do_remove |=3D bitmap_and(aprem, ap_remove, - matrix_mdev->matrix.apm, - AP_DEVICES); + do_remove =3D bitmap_and(aprem, ap_remove, + matrix_mdev->matrix.apm, + AP_DEVICES); do_remove |=3D bitmap_and(aqrem, aq_remove, matrix_mdev->matrix.aqm, AP_DOMAINS); --=20 2.53.0 From nobody Tue Sep 29 07:39:19 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B41D44103A; Mon, 10 Aug 2026 19:23:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389809; cv=none; b=TfdEJYP6gWvS7yC8H9zj1A9MCx05PTvHvkmhVWQK0TGLBpcQe+cTeBSf7gR/ybK6rggDXuZEcKc8/k4IFRU7F5ikpKfmQvGuIYL822ahIEfp+Pm7qC8VmqypqgY8ZMuYvzfkMlM33lOJamR+7gnwzn9Nf6+RF2R+uBFpSuOSN+I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389809; c=relaxed/simple; bh=imYGgSUs4id0nDvfXxI/LaxrXyfCCqi5Ste57YvTn6I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aPKKTo4TQh1cq5ciiFkTbeUn8O1i5jsbRujgBW9lD6cE/kNb2ZTqcBCLRf1rsG0N5c/RVzaL6FsYqjYCHxjB+qK8hMg7/SwOaR2jFA+Ndy+Hccb6JXYdZ6OZTVpSmS9qg82shmmdaZ3sbs0osmON5oobJkfubC1VtB0gT9pf9N4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=MwZz4MbA; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="MwZz4MbA" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67AJ2WKH2433130; Mon, 10 Aug 2026 19:23:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=w2YLaPTpS70OxnwPJ /s1uFYb5UUIoitae0C3qdL2X7Q=; b=MwZz4MbANVIU0qtYOcfD1LpYkgJupzYbO MaQ97d8j5lnmWyzJL/QIHkxOQ6umhWeY59lAS1YUy1aWLHImqfpHnDSKjOjFN1EK hBARbHH5rLnP/4kRfL0fxPN59pKgX7e5ZUhX7deBgFgPTyMbkONihIhlmQJmq/59 e2uXsYulmPCP1yNucVhxtOaUeC1ELacO0UhSX3tzhQ+pS16QKT0EKwFTfzWAUzZZ peXQr8R7boFiqrj9fwedjWEoQNdZ/tj99Jz338FR72TwMQ+oAElzJvxoqwf1vP2Y PnrE3kjZ56HEb8udwm5cVeo1CY3+lqU8awUxuFelHX/JLv3KS/8bQ== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvq99q8v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:04 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67AJC1Ej006166; Mon, 10 Aug 2026 19:23:02 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fxf5vx869-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:02 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67AJMNtk24707716 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 10 Aug 2026 19:22:23 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 523A558058; Mon, 10 Aug 2026 19:23:01 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3BED758057; Mon, 10 Aug 2026 19:23:00 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.71.153]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 10 Aug 2026 19:23:00 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v2 2/8] s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Date: Mon, 10 Aug 2026 15:22:51 -0400 Message-ID: <20260810192257.1208410-3-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260810192257.1208410-1-akrowiak@linux.ibm.com> References: <20260810192257.1208410-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: gyo82APbNKJXlxie2q4c_x3BfyfUbhLF X-Authority-Analysis: v=2.4 cv=PbDPQChd c=1 sm=1 tr=0 ts=6a7a2518 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=7-PX2TBNVYp1iSTFOFgA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX+huM75OztS2V VwnFxmt5OqoNLcxHLbsed7D5OwjwfRfzIe6fnO4iYxDTZz9X9kKy6JL5zQxuSL61HMWXq9peGS3 OII09QXHHJkX0/InKMBCl3454IfmyqK8PVjwjyZeq+6Y2GqwKdDSH7wisfbXJ/ox3HKimT2VQuo GWL82Ffx+O5P36+0K7APpG4+DTPAxD5tWNGiJbB5MuygM0VajylbnEoBuI4ZufgxPBu7js9RXkK 76gGpukm2JzpabFZ+5RYtC+U98IG604rfLE8jNZbs/Is8huU6QoEkjzx4NIySQIoaDeaGObjp0B kjTPbSbpWU7ifz9uXdgqNFczd6I2mGdh6fy5h/7BU9JcL2fOyxaDUj1zLrxZfqU+ivQkUXK/QTo rJ752t18n98UVin4mWf19y4mAPFML+ndr8zy78RwI0YsmrKKv/NQxfeVq+P0j6367XIIFRJQF98 2em8+UYP8TZ9tn/j3sQ== X-Proofpoint-ORIG-GUID: gyo82APbNKJXlxie2q4c_x3BfyfUbhLF X-Proofpoint-Spam-Info: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX7aBLhcL8Xu1x LpxrUlkIu1l8zKzK6SCT8fqVF0vQkjcpdpTk+lH77ARv34VPqKX76xmHFM7eeEbFGReyrmo87Rs gtM/xx5/OS/YFUfltFAScdzmaeaHZKU= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-10_05,2026-08-10_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 impostorscore=0 malwarescore=0 adultscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 phishscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608100162 Content-Type: text/plain; charset="utf-8" The ap_driver structure has two fields which are function pointers to callbacks: * .on_config_changed: called at the start of the AP bus scan function to notify the device driver that the host AP configuration has changed and the associated AP devices will be added or removed accordingly. This gives the implementor a chance to evaluate the configuration changes and respond to them before the associated devices are added or removed. * .on_scan_complete: Called at the end of the AP bus scan function to notify the device driver that the host AP configuration has changed and the AP devices have been added or removed accordingly. This gives the implementor the opportunity to respond to the changes after the associated devices are added or removed. These two callbacks are implemented in the vfio_ap device driver via the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete functions respectively. Within the call stack of these two callback functions the matrix_mdev->kvm->lock mutex is taken without checking whether matrix_mdev->kvm is NULL or not. If matrix_mdev->kvm has never been set, trying to take the lock will trigger a NULL pointer dereference. This patch adds checks for matrix_mdev->kvm =3D=3D NULL before taking the matrix_mdev->kvm->lock mutex. Note that the matrix_mdev->kvm->lock mutex taken in the vfio_ap_mdev_hot_plug_config function is moved to the calling function along with the matrix_dev->mdevs_lock which is needed there to access the fields of the matrix_mdev. It makes little sense to make the change the check for matrix_mdev->kvm there before taking the kvm->lock mutex only to have to move it out via another patch, so it is done in this patch. It is important to make note of the following: 1. The matrix_dev->guests_lock is acquired at the start of both callback functions. This ensures that matrix_mdev will not be removed via the vfio_ap_mdev_remove function because it too takes matrix_dev_guests_lock before removing the object; so, matrix_mdev will be available for the duration of the callback functions. 2. The matrix_dev->mdevs_lock mutex must be taken in order to access fields within the matrix_mdev structure 3. matrix_mdev->kvm->lock mutex must be taken before the matrix_dev->mdevs_lock to prevent a lockdep splat. 4: The kvm->lock must be held while plugging the guest's AP configuration into its SIE state description via the vfio_ap_mdev_update_guest_apcb function. 5. The vfio_ap_mdev_update_guest_apcb checks matrix_mdev->kvm to verify it is not NULL before doing the hot plug of the guest's AP configuration. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 33 ++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 845c86ba8bc3..e382e5a1cb99 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2606,7 +2606,13 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *a= p_remove, int do_remove; =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { - mutex_lock(&matrix_mdev->kvm->lock); + /* + * The mdevs_lock must be held to access fields within matrix_mdev, + * and kvm->lock must be taken before mdevs_lock to satisfy the lock + * ordering requirement and prevent a lockdep splat. + */ + if (matrix_mdev->kvm) + mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); =20 do_remove =3D bitmap_and(aprem, ap_remove, @@ -2624,7 +2630,8 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *ap= _remove, cdrem); =20 mutex_unlock(&matrix_dev->mdevs_lock); - mutex_unlock(&matrix_mdev->kvm->lock); + if (matrix_mdev->kvm) + mutex_unlock(&matrix_mdev->kvm->lock); } } =20 @@ -2821,9 +2828,6 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matri= x_mdev *matrix_mdev) DECLARE_BITMAP(apm_filtered, AP_DEVICES); bool filter_domains, filter_adapters, filter_cdoms, do_hotplug =3D false; =20 - mutex_lock(&matrix_mdev->kvm->lock); - mutex_lock(&matrix_dev->mdevs_lock); - filter_adapters =3D bitmap_intersects(matrix_mdev->matrix.apm, matrix_mdev->apm_add, AP_DEVICES); filter_domains =3D bitmap_intersects(matrix_mdev->matrix.aqm, @@ -2841,9 +2845,6 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matri= x_mdev *matrix_mdev) vfio_ap_mdev_update_guest_apcb(matrix_mdev); =20 reset_queues_for_apids(matrix_mdev, apm_filtered); - - mutex_unlock(&matrix_dev->mdevs_lock); - mutex_unlock(&matrix_mdev->kvm->lock); } =20 void vfio_ap_on_scan_complete(struct ap_config_info *new_config_info, @@ -2854,15 +2855,29 @@ void vfio_ap_on_scan_complete(struct ap_config_info= *new_config_info, mutex_lock(&matrix_dev->guests_lock); =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { + /* + * The mdevs_lock must be held to access fields within matrix_mdev, + * and kvm->lock must be taken before mdevs_lock to satisfy the lock + * ordering requirement and prevent a lockdep splat. + */ + if (matrix_mdev->kvm) + mutex_lock(&matrix_mdev->kvm->lock); + mutex_lock(&matrix_dev->mdevs_lock); + if (bitmap_empty(matrix_mdev->apm_add, AP_DEVICES) && bitmap_empty(matrix_mdev->aqm_add, AP_DOMAINS) && bitmap_empty(matrix_mdev->adm_add, AP_DOMAINS)) - continue; + goto do_unlock; =20 vfio_ap_mdev_hot_plug_cfg(matrix_mdev); bitmap_clear(matrix_mdev->apm_add, 0, AP_DEVICES); bitmap_clear(matrix_mdev->aqm_add, 0, AP_DOMAINS); bitmap_clear(matrix_mdev->adm_add, 0, AP_DOMAINS); + +do_unlock: + mutex_unlock(&matrix_dev->mdevs_lock); + if (matrix_mdev->kvm) + mutex_unlock(&matrix_mdev->kvm->lock); } =20 mutex_unlock(&matrix_dev->guests_lock); --=20 2.53.0 From nobody Tue Sep 29 07:39:19 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5AB0342DA5A; Mon, 10 Aug 2026 19:23:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389796; cv=none; b=I2EPyG68js3AeQS/AcpcnxItm+dV/fYbNt49J5jlOtuTNDejB8vd+ueImlh1HiWsNm/ZxgrIrgltTHycciZbZPBCPB3xC3XoDeaZAznktmVFBo78dQguRvO2Mc7NdYAqlaQh9AhuEwGXtv9d9TbQKmVD78yppnHExi0mwG8QLvM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389796; c=relaxed/simple; bh=4tidI23Pm+dYwkNbLIXMMsazONFi/qGjVCp+vtRgBAI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VJtLDPXH0gCEXbadmBrJheGUlrUOsLeEbfY360CDOec8ES6u70Qcn5/vf0gSFvvzeUpxTGbcxsyJFMA29xZFroHunF9FLK+Roao+qL5uGG3PLseHBTi7VTgfD9OrvhWTwmXDemHQKWMpXmc51IVerWgTOjBn8c4ldekc9POPj3Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=E1ARI9DF; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="E1ARI9DF" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67AJ2mFG1382850; Mon, 10 Aug 2026 19:23:05 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qbE/FfN+6bKSEEHXg zeGEhHoSj357bjJBkyHRtmLeYs=; b=E1ARI9DFmobY8Q9u72AZ/ANKl36PmW7Xs 0cb7qBmjC92Rw5TihQRLURv5YNm0oK5UlaEWeRLq8sKrGMdGxI9R8ug9cjrRP/SB E+2NCqPwbiowislUtX5SRxozMfRkJmNAG3tYUA7/De6ZOTZqX5abbriW+o8enVXG PcuzZeDcNRUfKJpmTit5aJHzTjxw4cDoMt4QS1epfrRPIdFAjmIUGm5TuHZBfqLa G7YkC3foiEflvg3ZDtUsJePXz01kUqCbBlnoUe1q7F0T5xxN4ONPDifnndN9ASpV X4W20nEAA8YTlLlM1hUbWQJQ7jkKTIEOr6qxI4sEGXUNmIq32zRIg== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fyb23jm3v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:05 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67AJBci5017862; Mon, 10 Aug 2026 19:23:04 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxh0g602f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:04 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67AJN2xY35979940 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 10 Aug 2026 19:23:02 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 79A2858058; Mon, 10 Aug 2026 19:23:02 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6D22058057; Mon, 10 Aug 2026 19:23:01 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.71.153]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 10 Aug 2026 19:23:01 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v2 3/8] s390/vfio-ap: Fix use of wrong lock in mdev probe function Date: Mon, 10 Aug 2026 15:22:52 -0400 Message-ID: <20260810192257.1208410-4-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260810192257.1208410-1-akrowiak@linux.ibm.com> References: <20260810192257.1208410-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=XqfK/1F9 c=1 sm=1 tr=0 ts=6a7a2519 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=IOhVIQ1U7ISs0PSOFQMA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX89VIYVWL6k9u U4DufLH/EYFhprFk1zg06J1Bc13taCG6RnQOI1hVrRjLssZEtqM3z/hNrgrC4c39TbmbiE1r1k/ Gl9fvTq981jIOW6T/twOEMaN8feDYHERgcdlqA3FcxEQx1DXcUQQvsF0bLwRcsWd7p8Yo0AmhN2 qLzND5TjP0Z4704yugfN2ma+63AgkcTof34QPXYircqLSnmlEJPKgwci86cGYKsff/ICLxzN6UN KcMdCvpTFCUgx5dEBq+5c5bAjJx+aujkKYYszUZSb1aht2u4po5OqNFfbFiq5rk9R+sP1ge3oux 3KgzVb+S5SdeONPydPs8ycU+c16RSjBTgkv162n3sR8eqWQpC8L0TNKqL7Y6FVZEaM+4vNRKxlf AiTLkGONa1tC2GFp/Wlnf4DQMURVSuUgpT0mJj8e5kk/raAgYmsQnQ35BmVP2EeV35u7FqvhzCS LpWn18oHCUbMaxXYClA== X-Proofpoint-ORIG-GUID: 8Cjv-eEuMRiZBTtPUt0UdhH5qf1Q58sW X-Proofpoint-GUID: 8Cjv-eEuMRiZBTtPUt0UdhH5qf1Q58sW X-Proofpoint-Spam-Info: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfXxrjaF6RO2CXX 1nhqE7GENfl7lmqNP08zDJCOas2lLxaMu2BWicH9wQypudW/e3rjr2hoNFH9wOxGnBYsBldFhlY O1ozCmcdpxyCjEpKFJu2U4YLzzmCAU4= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-10_05,2026-08-10_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 spamscore=0 adultscore=0 malwarescore=0 clxscore=1015 suspectscore=0 priorityscore=1501 impostorscore=0 phishscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608100162 Content-Type: text/plain; charset="utf-8" The vfio_ap_mdev_probe function uses the matrix_dev->mdevs_lock mutex to guard the add of a newly created ap_matrix_mdev object to the matrix_dev->mdev_list. This mutex does not protect against traversal of the list; its purpose is to guard against concurrent access to fields contained in an ap_matrix_mdev object. This could lead to kernel memory corruption or use-after-free if another mdev is created concurrently. The adding of an ap_matrix_mdev object to matrix_dev->mdev_list is now guarded by the matrix_dev->guests_lock which is the correct way to protect against concurrent mdev_list access. See the vfio-ap-locking.rst in the linux kernel tree. Fixes: 2c1ee8983aa3 ("s390/vfio-ap: prepare for dynamic update of guest's A= PCB on queue probe/remove") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index e382e5a1cb99..a472de00bc14 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -803,9 +803,9 @@ static int vfio_ap_mdev_probe(struct mdev_device *mdev) matrix_mdev->req_trigger =3D NULL; matrix_mdev->cfg_chg_trigger =3D NULL; dev_set_drvdata(&mdev->dev, matrix_mdev); - mutex_lock(&matrix_dev->mdevs_lock); + mutex_lock(&matrix_dev->guests_lock); list_add(&matrix_mdev->node, &matrix_dev->mdev_list); - mutex_unlock(&matrix_dev->mdevs_lock); + mutex_unlock(&matrix_dev->guests_lock); return 0; =20 err_put_vdev: --=20 2.53.0 From nobody Tue Sep 29 07:39:19 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B85A43F8CB; Mon, 10 Aug 2026 19:23:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389799; cv=none; b=h0DgzgBZCQVeE8xuDEZ3TDkRMJeJpAQILrhwxUbeojjjRY2JYDxbwCR9slbxZjKxlOpmb39+p0CSqJgrFM9ZrH4OoCpNIDkyENsWj1CekHrvCmfjecMsokQlVe3UdB6kdZRnK2+/1sPYoRd7ohKPEDrHhe4xCCP86IbnXnfsUDI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389799; c=relaxed/simple; bh=WotD2MLbxeRHgu/jt/5UwQhdLwGWX0k9HUrbL1gIpxM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fZmJOL2gPO8ehxn9t6Rsz+iI3kZxev9WMh7LFwrSa32PCoie03wAw4MpbdZdZ07+EJkxkjix5NZM9/Fnxj860WGpeHDW7jMEO8JXWJ5JfPn2INM/jQUDiUZJRZ23KYJsTlT67JdL3poWH+bTNz1+ldZWpXGqfSmVfnRROYGDb9s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=QiujdA6Z; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="QiujdA6Z" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67AJ2RfP614215; Mon, 10 Aug 2026 19:23:06 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=wl88axlrYzF3a4bJk reen17QLWcHEjfJd08Y3z49IjY=; b=QiujdA6ZVq9GAn4u0dnYNPtS867yNPnOA SZIqKw/LcYq4jYFruqDEXxLzQTl6ki2lbjxBCHDTKDpnqaBxjIyxpgqf5oCHRaek GwQkBneFgwbqkF9xMkFeHEWbE6AVhmSAMWItubLUHeIbgF/+mtX+hTUY/9x63B8c 1JH21ZOdagtZ5bF6EbbLpxGCG7INnosBOR8yma3BBmKUu0Ths6CwXjSpLVdmQhzo GmReGB+JgbPxeKBjkbKlNFH+kYakbM+ToCiyiu/kMA5Mkg8Npf56GxwRxo7zKheW g3XxpE2336C/bJ/OQQx5A3KC0uvQOy8cwUby60iyZgBbhU6U9ynvA== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvjysqty-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:06 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67AJBci6017862; Mon, 10 Aug 2026 19:23:05 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxh0g602h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:05 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67AJN3HF30278398 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 10 Aug 2026 19:23:04 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B072358059; Mon, 10 Aug 2026 19:23:03 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 93B1858057; Mon, 10 Aug 2026 19:23:02 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.71.153]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 10 Aug 2026 19:23:02 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v2 4/8] s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Date: Mon, 10 Aug 2026 15:22:53 -0400 Message-ID: <20260810192257.1208410-5-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260810192257.1208410-1-akrowiak@linux.ibm.com> References: <20260810192257.1208410-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX5nd6CMjD08fO PWs1/VP8H7hkroHQvWDmATJ2aTtXjTQfKz/EEPbFvBU50kqfb8FcvbAczbP81eXAMax2ZGuzmsQ 2mpxoMzTCVQjkT4Act3vASGnL7B2ucc7ODv+2pqs/avFdHdxj9ueAOLqPBd2nP3tFxBVGJoMWoq Gyy+CsTFLyqvUe33uWG2vA4SBDgP9Skx3nQj87vy/0m9bZoqois92IpaiVW2fuQwCALxlRBmUzH /yeDIHVBNE54CH6PtuWP7lnuPZGMOeyygNTqB0607v2rS0ZqEnAbjOjSA1NKCrSBo/o+DHONbuq PeO5AQzdZutSTVEvm3SR3sVuV14GlT+ZvbHcGTbVv1Asfi0vVO8U7TPKDL5iEZqtzDZsCzEMQPw UHAs0QgA2nMl7z2cGvcAVRjB2YSA5eMOFi50IE9One6PZQtkb3xSWZXM4WNZmvcHpjkhTRUylGd L5lyvFq9Gw8YLERx1mw== X-Proofpoint-Spam-Info: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX7oDt2lNiG0DJ Q6gkY2Y+4WMbMR1SG5ZYAzcAXLvHscb9KyIwaLJXYOMQsNpO5sKZ49xgllVSjVByianio6tNwWJ lTNXulUBML4zgY1r9+M99vn+UviK+Tc= X-Authority-Analysis: v=2.4 cv=RqD16imK c=1 sm=1 tr=0 ts=6a7a251a cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=mm-sKQyJWPVlA1vr6AIA:9 X-Proofpoint-GUID: XH0RNbxn6-ygYZDd5xODbF82D-EbbPrm X-Proofpoint-ORIG-GUID: XH0RNbxn6-ygYZDd5xODbF82D-EbbPrm X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-10_05,2026-08-10_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 priorityscore=1501 suspectscore=0 lowpriorityscore=0 clxscore=1015 adultscore=0 bulkscore=0 malwarescore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608100162 Content-Type: text/plain; charset="utf-8" In the vfio_ap_mdev_cfg_add function, the apm_add, aqm_add and adm_add fields of an ap_matrix_mdev object fields are modified while not holding the matrix_dev->mdevs_lock. This lock must be held while making these to guard against a race condition with another caller that may be concurrently modifying these fields or any of the fields in the matrix_mdev->matrix. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index a472de00bc14..897518b88c28 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2756,12 +2756,20 @@ static void vfio_ap_mdev_cfg_add(unsigned long *apm= _add, unsigned long *aqm_add, vfio_ap_filter_apid_by_qtype(apm_add, aqm_add); =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { + /* + * The mdevs_lock must be held in order to access fields + * within matrix_mdev + */ + mutex_lock(&matrix_dev->mdevs_lock); + bitmap_and(matrix_mdev->apm_add, matrix_mdev->matrix.apm, apm_add, AP_DEVICES); bitmap_and(matrix_mdev->aqm_add, matrix_mdev->matrix.aqm, aqm_add, AP_DOMAINS); bitmap_and(matrix_mdev->adm_add, matrix_mdev->matrix.adm, adm_add, AP_DEVICES); + + mutex_unlock(&matrix_dev->mdevs_lock); } } =20 --=20 2.53.0 From nobody Tue Sep 29 07:39:19 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 634BF282F06; Mon, 10 Aug 2026 19:23:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389800; cv=none; b=fImia3xYwYbSqjpyauYDYQ/BudE4o7Pl3Fi9Gl1kd8D5bN7+uxDjnD3XsC8ZBtbTPI1heKPQklQsdIOBXTQ2MMQ5ykob9yKPIKYVqOzudOZJWdyYjxUHfeD8B4+RoOXVhN3ZfGKgcooC9bXBZqpgMdY+/ztAtzEi1ecJ2ZiQSfY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389800; c=relaxed/simple; bh=S+0Py54QPwwjxmTjKRphpYRFREkV9K/0Uu60dj0hMsc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PzSdfjrVKfA+GqbnXorp//VM/lCW0MIndEzHZWDXvms7KKc0pcpJzvGNQKMpzjsyZ92lCQXFIU8pwSEcSTZi/s5lari4Yx3RFTNJ63Lr7c6n4aPlFHFhtB7+pTVnb1qCXnp6ppuyjNQxW3vqivIVLqEeUs0Aj0y/7kq6lSNiIh4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=hvwsBDqI; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="hvwsBDqI" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67AJ2AR42432696; Mon, 10 Aug 2026 19:23:07 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=orXM1OrBDo65TknnI ovW003eex8NQqhw3By9QYQljIo=; b=hvwsBDqIi/YW/H/Z4koxACBdRQOPHfmEZ ucgZ+3a9F8ADgmigoG4/LmK7wqn7Lq+g1x/9Ruy2+vHPHSqiuE9RIPTz3rN24PhQ 44ZWOghMiVQs2N2ZdFYmNq20S+du619cpCQqvzOZdTwhFsdwup0eDC+EhKx7pyY7 2kJjbKu+svZSXq2msGjUpNsUQ7ln1ah3h+5zCnnb23eb1c8OSMtoILirEK4iE6oj FZmqAH1zC1SglNj3fkr+O8hUc+d+LCzk1Qf447lcngIBJnef8+MezqdUFwwIlicq CXkC/gTwtjajTrdPTvQqpYDkpP9xf9gB4t56aFOrjQjbJA4WpeISg== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvq99q91-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:06 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67AJBdBI002986; Mon, 10 Aug 2026 19:23:05 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxhfxwwp9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:05 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67AJN4Tr25428518 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 10 Aug 2026 19:23:05 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DFD5A58058; Mon, 10 Aug 2026 19:23:04 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CBC6458057; Mon, 10 Aug 2026 19:23:03 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.71.153]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 10 Aug 2026 19:23:03 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v2 5/8] s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove Date: Mon, 10 Aug 2026 15:22:54 -0400 Message-ID: <20260810192257.1208410-6-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260810192257.1208410-1-akrowiak@linux.ibm.com> References: <20260810192257.1208410-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: NHdc7HLIyVUjDW5AjzFQMSoJrngpUGt0 X-Authority-Analysis: v=2.4 cv=PbDPQChd c=1 sm=1 tr=0 ts=6a7a251a cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=fkyveIzhjB74ZASU3MYA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX/RGKmYxdwaHZ 3QiMly0Hcdy8gNqRIxx5nAs+c+7WqkqGYSl5ENyD7NvBpbygaLPyEz2hiO95wZTSpTIgJ5FjRxG +nHHUiJKcUH3Ir9xJuUsqooWR/dJ7aPKLYpCXmNAAj1bcDcsJIUyHpSwUTVXeCEa3s30A2XItPu WoKPFmERKKDGC0Cl7TERM9M7d0m78QYyaztBQNxescHnJovMBHs8YSPYnyuECrOrzCqL7E+kI0m lWrmwk79uAPC0fegYa8/k8ATd6NZn3RzMzIacQFd6MxDo+hsTmVglECH5BrXSih7mzuA0A90I4I eeYtgXs6LTSNgJ2jSvCkSCfnpkEfiCDzQvQV6NKMu/u42iidhWXLH2HcABqsvvrs+v8FjlE2kRr EcxEcdepd9t4o6BYNm+/R3luBzOUDxEG95W1Ew7R+K5YRSKK122x2R8ad7I6W/ghUro/rlPWo4j rAuT4kS3c8z0ANgjMXg== X-Proofpoint-ORIG-GUID: NHdc7HLIyVUjDW5AjzFQMSoJrngpUGt0 X-Proofpoint-Spam-Info: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX/Nicgw37BB4D 4qifrhYXvIk885Ix6IyUmXeHsX6R5Zhj7hReZjvu/tRE0rultwS69IyZDwjifMSPJdvKg6VNiEX wvB8jGaSN2J40DQfzvVPzv8WtUaIPoE= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-10_05,2026-08-10_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 impostorscore=0 malwarescore=0 adultscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 phishscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608100162 Content-Type: text/plain; charset="utf-8" The vfio_ap_config_remove function uses the bitmap_andnot function to clear bits from the matrix_mdev->matrix.adm bitmap (specifies the control domains assigned to the mdev). This prevents the explicitly unplugged control domains from being removed the KVM guest. The bitmap_and function is used instead. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 897518b88c28..9c7257c179a7 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2621,9 +2621,9 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *ap= _remove, do_remove |=3D bitmap_and(aqrem, aq_remove, matrix_mdev->matrix.aqm, AP_DOMAINS); - do_remove |=3D bitmap_andnot(cdrem, cd_remove, - matrix_mdev->matrix.adm, - AP_DOMAINS); + do_remove |=3D bitmap_and(cdrem, cd_remove, + matrix_mdev->matrix.adm, + AP_DOMAINS); =20 if (do_remove) vfio_ap_mdev_hot_unplug_cfg(matrix_mdev, aprem, aqrem, --=20 2.53.0 From nobody Tue Sep 29 07:39:19 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 125EF38A700; Mon, 10 Aug 2026 19:23:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389801; cv=none; b=ZmcqbN/PZ2wDXRZ5h2k+oDHq1ri2inoJ9bkn3Fr+5Q9zpULMvHViMr3kX8piYZ7er+uXbkaZl7ey4PDeFtnBPLhz1gJXS7t8akpqUmvrfDm3Sk3ADgfGTEkQj4kOqJP3rxCgEOxbiWDhGh3tRi9f+6DVtyospV4uVxXzlxP0pU4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389801; c=relaxed/simple; bh=A91BXmgS4+Y6X+9eJyK4oy0VXJCaYGlUROXv1Ek/8RQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Kkh5+HjVxBmz+EGBG72yQWQRVY8MFxr8YvKkLMEQnZO1ufUaqCgjG8k+COxjXytW+BBNoNdYn8G/POjcMx2fIv10Fi2QnUexrmRCesH3eQoyW2oPIxeAvPzIkUyHh2O9+2IubFod1tI6PiCNK1jei73QDV9UauYH6/tG+H7lRd4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=o6YdRx6z; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="o6YdRx6z" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67AJ29hj613725; Mon, 10 Aug 2026 19:23:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=MNuGs9mO+dy7lv21b Tkp4UsvfApLsygFm356gsfXoY8=; b=o6YdRx6zDPKesvLPK79v7gEwIVU5Yluk4 NOiy1feoExRHar350mbVrUoHAiE8uGVXeanI/hSWYji8E76OSOAitYSpFQNShhof +Pqti+goqJUD0RMHo3GMhob9ts+rDcnTeniJLbwnUQefCwQxrre5O8bTzTsYQTmC fmV/eLaJbhPwzeRfnMo1AqC/daxX+VAnsihFG6WaiW4prV5PyDXI4A7D/5PnpY3I RAx2YND5Ams8dLY1lF4szSYdXz6I354hhxgaF+FrUJDlykxeXx+FIK4iJ8665jaX ePnUuXuX4imxNrhAS20Xz02ToxWCCafqUowwwcH4krVpgjsUKtsJA== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvjysqu3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:08 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67AJBd8v014697; Mon, 10 Aug 2026 19:23:07 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxespx9sc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:07 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67AJN6Wd31392286 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 10 Aug 2026 19:23:06 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1357F58061; Mon, 10 Aug 2026 19:23:06 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0656B58059; Mon, 10 Aug 2026 19:23:05 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.71.153]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 10 Aug 2026 19:23:04 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v2 6/8] s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Date: Mon, 10 Aug 2026 15:22:55 -0400 Message-ID: <20260810192257.1208410-7-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260810192257.1208410-1-akrowiak@linux.ibm.com> References: <20260810192257.1208410-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfXyPVYjSLEikmp 4WTCUHqcF1ABO/gcYSwETOFz6kDzOVXjo1GkHAZ+nh7+N4+/YNpuftb3cR+AqdYS1X0XnU2CkHe PoSWX9+NK3Ks7exfFNtN7tzt4q6H91r2FJ4ner1CVIoBKfIiBQ212LR2JmiJJ5fTyjMYbJosT/4 bCXeL40deuW9BUhDT0O5TFSBSZ2VEXHhqSFIEm/VdQz+Dgb3u7W9CYD0XZ/i5s5IFb2YUe1E+LL NcWBAjWWuUx7Uf2qyqFExQXxn3UVtohlEqQRaNLcX9q1YjN6QyFXcLzMLbmE26q60tQCmtz0Tjn ubRRPm+jnR4Uh9AU1LNMaqnAQPhJMEsliQ0Yf98nlgE/nwNvMo0/LCowz6G8Dci91HTtji2tpD8 Ne0FXJWnzUpeJBOyU1j6FSsYVT9NKTn7xwsd4i1Qq/pVyADqp0kHqW8pGBTsE2mcOAwHePy+kdq GMYZvmYblCBf4iW/++g== X-Proofpoint-Spam-Info: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX22fwf6O6bVZ7 EFVYbZRqK1Dj7X0G7csaa8L6gK1xgjV6ilay5NU5xmMGOfofNf5OpZol+26NQYlacrUTZaCMSv0 9ehlY2dYd1hU9PwWc6H/gt9iGoVt9ME= X-Authority-Analysis: v=2.4 cv=RqD16imK c=1 sm=1 tr=0 ts=6a7a251c cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=_H5xUuJxPEx76qSOziYA:9 X-Proofpoint-GUID: UYKu45aP7t89TYs43j3zO8PwaSMVS2H1 X-Proofpoint-ORIG-GUID: UYKu45aP7t89TYs43j3zO8PwaSMVS2H1 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-10_05,2026-08-10_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 priorityscore=1501 suspectscore=0 lowpriorityscore=0 clxscore=1015 adultscore=0 bulkscore=0 malwarescore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608100162 Content-Type: text/plain; charset="utf-8" The DECLARE_BITMAP(apm_filtered, AP_DEVICES) macro allocates the bitmap on the stack without zero-initializing it. In vfio_ap_mdev_hot_plug_cfg(), the vfio_ap_mdev_filter_matrix() function is only called to initialize and populate apm_filtered if either filter_adapters or filter_domains is true. If the hot plug configuration change only adds control domains (meaning filter_cdoms is true, but filter_adapters and filter_domains are both false), vfio_ap_mdev_filter_matrix() is bypassed. Consequently, apm_filtered is passed to reset_queues_for_apids() with uninitialized stack garbage. This can cause reset_queues_for_apids() to interpret arbitrary stack garbage bits as valid APIDs to reset, potentially performing unintended guest hardware queue resets. Fix this by zero-initializing the apm_filtered bitmap at the beginning of vfio_ap_mdev_hot_plug_cfg() using bitmap_zero(). Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 9c7257c179a7..061bbad20291 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2836,6 +2836,8 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matri= x_mdev *matrix_mdev) DECLARE_BITMAP(apm_filtered, AP_DEVICES); bool filter_domains, filter_adapters, filter_cdoms, do_hotplug =3D false; =20 + bitmap_zero(apm_filtered, AP_DEVICES); + filter_adapters =3D bitmap_intersects(matrix_mdev->matrix.apm, matrix_mdev->apm_add, AP_DEVICES); filter_domains =3D bitmap_intersects(matrix_mdev->matrix.aqm, --=20 2.53.0 From nobody Tue Sep 29 07:39:19 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F1DB440A24; Mon, 10 Aug 2026 19:23:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389805; cv=none; b=I+I4ppqB3TiDaDC4baUfy6QJiXDKNDWqSNN/F/HwBKLBx4utNpSza40vzdfMzeExZ4wFmy7T+7y98m8KauuKmyZyu/bZ6XWDumGW8AhAQy5mgrbL60F48HRSH26uj10Bj6fw/8rQR1GbHWmX3Rny9L/YXb59VCVznFeVQpL+xuw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389805; c=relaxed/simple; bh=7k9J58J30oGbjxwn+0QCzB9GbRM6ICEQKMyXpOr1Ql8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=a1LBrQ+/u4TzCiUZVbPAdC+1vTRcfAENDLvwWoLCjeM45Er7hkq9KiI8aw5pMhQGRb8wykDEbTDt2GjA3njT4tmDQCXEtT2anecnx/ryKMgq8Z49iJGDitc6Ycyd6mxMtLSWRwtRAvfwPz+BVdNC3dbZEZ9BG/8ejGKzWMeZXSA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=n2x71LxU; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="n2x71LxU" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67AJ2Nm92392671; Mon, 10 Aug 2026 19:23:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=HHKLH6sSMnLUF6G8a lNNHoa1uZUHV2DMdNYgDeK4E3k=; b=n2x71LxUQEQKNXxEs8JtZlZT4h56vaPrt xXXpSPwDESGOfT7JPcRQNAYG91rXyKBEjkTYosrbtJpmq6ZtI9HCPErLrCbMGjaw Fbx3ue9RT224CgtGyj+Cs5OMtDj8driTrtK8G5kDSHsngJm15grJAMkLcWMSxLo2 b8Opnrxl/F7g549eL6bg0a3Cuoc3Br0BBcaEQRrrFqKeSYlGvPIotqbFPsjlCyhP eIXngFPfQDTsMRfAsejA3hfx3dD8kx/FG34BcPdVlUPFW2fYdRxPIPM47LHD1quz ZifyluNRvUsEuKqjOrVfdUlbahY3aom8sbQlagi8I5jxT3FFR9VFw== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvp2s8vc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:08 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67AJBwHt018137; Mon, 10 Aug 2026 19:23:08 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxh0g602q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:08 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67AJN7JJ21824064 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 10 Aug 2026 19:23:07 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B6C658057; Mon, 10 Aug 2026 19:23:07 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2E1A358059; Mon, 10 Aug 2026 19:23:06 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.71.153]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 10 Aug 2026 19:23:06 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v2 7/8] s390/vfio-ap: Fix required lock not held during display of sysfs status attribute Date: Mon, 10 Aug 2026 15:22:56 -0400 Message-ID: <20260810192257.1208410-8-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260810192257.1208410-1-akrowiak@linux.ibm.com> References: <20260810192257.1208410-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=AMtp2X5w c=1 sm=1 tr=0 ts=6a7a251d cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=6H0jsFd48SEkPfM2B64A:9 a=+jEqtf1s3R9VXZ0wqowq2kgwd+I=:19 a=0bXxn9q0MV6snEgNplNhOjQmxlI=:19 X-Proofpoint-GUID: IMZ-6LHey7m8dSwygWrcJizEmS6Pf2gl X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX96UB1fOsio0P en7IMOUm0MLtuS9sXjdiazB2dpnbpNZpixu9mIg48UVZygQACwGmrpddvoIg2rffMK3jTBUvJbG OIhg2XRGD+OLEMupUhIoD3J+s/NIZcWY87cCD0o/escMDRRb235DJgPueC3RZsZyi9MvLrT61x+ sXEegCiG2lKEaCqNDvHAUsjrhu8vJpl2kB4mD+QA9i7gw4oXgYqGLJoTc0K9DVXQ93pbYeOr8cQ 3apPx3XpIGiG4w5dXekiqZBGnnv8ENxxjZRRa/qZCkZLBp4QTxyHZvH1yIYbqia/3UQmmF3sOp2 n5lkAbe1VgQVPV79AVYh7ore0AUcEXJwg0gxjfAMbotzZIvXKY1BGVEvaVm2dxWBNQIxwS2SBwk zEjZauBDgPOdyfX3MUaJwNUOuN36K8iOtePpfjaPJQWIsNT4Udc1UHxyilZUeME4mApiMlAbKyg 3hyAirGaJ4+yknTFb1Q== X-Proofpoint-ORIG-GUID: IMZ-6LHey7m8dSwygWrcJizEmS6Pf2gl X-Proofpoint-Spam-Info: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfX/72p5bf8vsEN SzKFzJkbpmXG9+mmFI6A/Kq9br8CfivtMyrdUIqPzjAMv9/9CV3NIpG3yovCV2RHlqcnUCWd2nX kT8N1ks+sNsD10D0vBZNTe8eRVv/OXI= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-10_05,2026-08-10_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 phishscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608100162 Content-Type: text/plain; charset="utf-8" The status_show function that supports display of the status attribute of the devices in /sys/bus/ap/devices calls the vfio_ap_mdev_for_queue function which iterates the matrix_dev->mdev_list to find the object representing the queue device whose status is to be displayed. In order to traverse this list, the matrix_dev->guests_lock mutex must be held which is not the case. To fix this, the guests_lock mutex is taken prior to taking the matrix_dev->mdevs_lock mutex in the status_show function. It is taken there rather than the vfio_ap_mdev_for_queue function - where it is needed - because it must be taken prior to the mdevs_lock mutex in order to adhere to the proper locking order and prevent a lockdep splat; also because the mdevs_lock is needed there to access fields within the matrix_mdev object in that function. Fixes: f139862b92cf ("s390/vfio-ap: add status attribute to AP queue device= 's sysfs dir") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 061bbad20291..cdc9bf5c5e53 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2297,6 +2297,8 @@ static struct ap_matrix_mdev *vfio_ap_mdev_for_queue(= struct vfio_ap_queue *q) unsigned long apid =3D AP_QID_CARD(q->apqn); unsigned long apqi =3D AP_QID_QUEUE(q->apqn); =20 + lockdep_assert_held(&matrix_dev->guests_lock); + list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { if (test_bit_inv(apid, matrix_mdev->matrix.apm) && test_bit_inv(apqi, matrix_mdev->matrix.aqm)) @@ -2316,6 +2318,7 @@ static ssize_t status_show(struct device *dev, struct ap_matrix_mdev *matrix_mdev; struct ap_device *apdev =3D to_ap_dev(dev); =20 + mutex_lock(&matrix_dev->guests_lock); mutex_lock(&matrix_dev->mdevs_lock); q =3D dev_get_drvdata(&apdev->device); matrix_mdev =3D vfio_ap_mdev_for_queue(q); @@ -2343,6 +2346,7 @@ static ssize_t status_show(struct device *dev, } =20 mutex_unlock(&matrix_dev->mdevs_lock); + mutex_unlock(&matrix_dev->guests_lock); =20 return nchars; } --=20 2.53.0 From nobody Tue Sep 29 07:39:19 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB27043F4BC; Mon, 10 Aug 2026 19:23:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389806; cv=none; b=jljdNk9/s/3CMkdZv+sUVg1o6t62IpbsLZWENxULmnLOAGMBKHzsFg2/Z685G4dS3jotG32RcyOmpO3djvr61OTtmC9VUryK2kqvw/ApK9ZnKLXA8eLcqKPCOL21TIdWqpfO6pZ2UqkOoCu6fJMJ1wHiae8X+uZBPMm1ncB+ld8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786389806; c=relaxed/simple; bh=E5NA9imRWdVHGoRIX7vM2uwOntFDatYm1bNmnQPoK/w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tglSan8gB/Min44hYPEuW3x4jK5S26i7yHwxuJPPFS3rplkK8QydRIpfNk2zZj793+7QrdI2q56n+Fd6SxdS3mMwG0bdO3zHn4JEtCYl5YzlO/fPSRmmsXH8rsDtXX4NHlWxaybvFWsvd4J7pxc2W6SPraIsPgaatwj7tM9iObI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=YO1r+14g; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="YO1r+14g" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67AJ2Fa22432863; Mon, 10 Aug 2026 19:23:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=vgNXOQXPQ3geHSkNQ E8PLNEfgt2zSlou3yaq1yO9Onc=; b=YO1r+14geTmCUk+X+j1SkpebtFy1h5CXM Tl90H7nTCmuINK4zYh21LJi9U8zb35ZKJ+SFquN0rhPV+QcfI2OVrTALcwH7rfvw ISWR7iwEfldtsTNEMmpNGvKcwfG8Y+Oqp19SDquN4xT6zgaBeaAboFgS0cOjRxou tbbm60ayGEIBIQ3oc+n4CKZNuZQeGTLv6MZxtfspRiqQdnl28j5bRAqcsOOWdyJ8 KprqfJtm0n+7hv6WguUqe3Fje454k9vAQhp50oAC6NDd5W05YmOk2GT/YRLe+dxE AbAu7/dPBAixf8F2s3/xkGQfKF2X2ijOYcGRmPa9ScGcEs+3kutrA== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvq99q98-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:10 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67AJBci9017862; Mon, 10 Aug 2026 19:23:09 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxh0g602s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 10 Aug 2026 19:23:09 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67AJN8Ej15663692 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 10 Aug 2026 19:23:08 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6758B58057; Mon, 10 Aug 2026 19:23:08 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5665558059; Mon, 10 Aug 2026 19:23:07 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.71.153]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 10 Aug 2026 19:23:07 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v2 8/8] s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Date: Mon, 10 Aug 2026 15:22:57 -0400 Message-ID: <20260810192257.1208410-9-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260810192257.1208410-1-akrowiak@linux.ibm.com> References: <20260810192257.1208410-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: eLTl6CUmOKq3Re_flLjOUkcghONE0Mvy X-Authority-Analysis: v=2.4 cv=PbDPQChd c=1 sm=1 tr=0 ts=6a7a251e cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=_WWcq-yiL1ZFSUElpscA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfXxfRZ7c1ZywfZ FgFxqZ24lpFA4edAiwxxANFQar8bslzbV9zT0504kukDINDkIv4SR+T+Dg3wfY8apJCJCvY5Uvx ew+xDVwOoeuyUn+SKlJmztkN342+Bhk0TqHzh4bJ+PiIJIJgWXb1dPqvJeiIr33aLXoXqwfhLl3 3KrlIBmM5azEGHwwozspiBdROzxgMQhpSgT+2BJVFpAwZocmP4nPsGZzKXV5RChNKqu7cJufbhD xUK5yS44R/xXKkZFjq8OYfJVx9RwlDXqt49dwoeg5EvRFFsyvIesv9cViqg0rhKTs9sB2yJyUL3 p9TRwNZ3rvBj71PRB2/SCyMJS9zVvzaKe6nbVI5s3vxEcF4Lql1nfEhS6V7yvMnr7+qQvy1OToq LgqPtu2YfZPhmRdZPTUGfykcvgN9b43r48g9BEjkldeI+jAslTexFBpP6B0qsO5Ks2huR9tKYmC WtZlb+srKivzha3y8qg== X-Proofpoint-ORIG-GUID: eLTl6CUmOKq3Re_flLjOUkcghONE0Mvy X-Proofpoint-Spam-Info: AW1haW4tMjYwODEwMDE2MiBTYWx0ZWRfXw9yj/oovgzM/ hxkH1V+qhErQMaH+MGZOc0vj/288JVNp9GPO7sTT6wRF2Hg4NYj5swB9v+ecLs7hKQcXlbYB11k 0+4Go7ye1sjjI5kB6z4jq9CKQvUd5Xo= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-10_05,2026-08-10_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 impostorscore=0 malwarescore=0 adultscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 phishscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608100162 Content-Type: text/plain; charset="utf-8" The vfio_ap_mdev_hot_unplug_cfg() function uses the return value of bitmap_andnot() to determine whether the guest APCB needs to be updated. However, bitmap_andnot() returns false when the resulting destination bitmap is empty. This means that if the only adapter, domain or control domain assigned to an mdev is removed from the host's AP confikguration, the bit is correctly cleared from the shadow APCB, but bitmap_andnot() returns false because the result is an empty bitmap. Consequently, do_hotplug remains 0 and vfio_ap_mdev_update_guest_apcb() is never called, leaving the KVM guest with stale hardware access to the unplugged AP devices. Fix this by replacing the bitmap_andnot() return value check with bitmap_intersects() to determine whether the shadow APCB actually overlaps with the removal mask. If there is an intersection, call bitmap_andnot() solely for its side effect of clearing the bits, then unconditionally set do_hotplug to trigger the guest APCB update. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index cdc9bf5c5e53..cb1e5db69d8a 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2563,24 +2563,28 @@ static void vfio_ap_mdev_hot_unplug_cfg(struct ap_m= atrix_mdev *matrix_mdev, unsigned long *aqrem, unsigned long *cdrem) { - int do_hotplug =3D 0; + bool do_hotplug =3D false; =20 - if (!bitmap_empty(aprem, AP_DEVICES)) { - do_hotplug |=3D bitmap_andnot(matrix_mdev->shadow_apcb.apm, - matrix_mdev->shadow_apcb.apm, - aprem, AP_DEVICES); + if (bitmap_intersects(matrix_mdev->shadow_apcb.apm, aprem, AP_DEVICES)) { + bitmap_andnot(matrix_mdev->shadow_apcb.apm, + matrix_mdev->shadow_apcb.apm, + aprem, AP_DEVICES); + do_hotplug =3D true; } =20 - if (!bitmap_empty(aqrem, AP_DOMAINS)) { - do_hotplug |=3D bitmap_andnot(matrix_mdev->shadow_apcb.aqm, - matrix_mdev->shadow_apcb.aqm, - aqrem, AP_DEVICES); + if (bitmap_intersects(matrix_mdev->shadow_apcb.aqm, aqrem, AP_DOMAINS)) { + bitmap_andnot(matrix_mdev->shadow_apcb.aqm, + matrix_mdev->shadow_apcb.aqm, + aqrem, AP_DOMAINS); + do_hotplug =3D true; } =20 - if (!bitmap_empty(cdrem, AP_DOMAINS)) - do_hotplug |=3D bitmap_andnot(matrix_mdev->shadow_apcb.adm, - matrix_mdev->shadow_apcb.adm, - cdrem, AP_DOMAINS); + if (bitmap_intersects(matrix_mdev->shadow_apcb.adm, cdrem, AP_DOMAINS)) { + bitmap_andnot(matrix_mdev->shadow_apcb.adm, + matrix_mdev->shadow_apcb.adm, + cdrem, AP_DOMAINS); + do_hotplug =3D true; + } =20 if (do_hotplug) vfio_ap_mdev_update_guest_apcb(matrix_mdev); --=20 2.53.0