From nobody Thu Oct 1 11:05:39 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5BDC4334A0; Wed, 12 Aug 2026 11:51:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535515; cv=none; b=lUjh8OTIkpdJFKQbVeM+WyRegJW/aQE4A7p1uNgjifz3xy+e2GKnc1OjZOMobHirnSzcjHntkR3CDLZZpFlM2A4H7qkdtyBFL1U+hXKTeI5cj5gwBd1FNyBqtNQkL5XFfJ44iHCFoaljAOdCdwbHvTtssejgj2Dc5n27H8+UC30= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535515; c=relaxed/simple; bh=hAk5VFZTgMbDNPLe+AA+zMf0YOhx4PJoLsGEtIiKUxc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ooSKC0HxchCqwneYVkBVAnXBYYgveAwP1lCmkh/K0nbDZotr/ZPQjHxBoWvmYABFryBo3HlFGtQ6IVd1qqNgGvL2DjiRg5GH5u8dE0v9jT8tUY10n9BNwMYiaJgipIc/uZ0Savt4lII7ltw0IyFW+E4gysCOskxIXdLDQrLgl0I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=l1/wzT8G; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="l1/wzT8G" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CB3aPc3258439; Wed, 12 Aug 2026 11:51:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=+1ReYvhFvHs/C9ZAt kBPmRv/N1oXc4R/xDf8I9N/tjo=; b=l1/wzT8GOCGByZuf/vNmGVqXRBvnRkWpE htm5JeK8mXymvzANy0//y12TYIM1ryax9xUlwU2CLWZAfoaYRYIIlI1Y8YGEGZ9C OPYcOJDHv9xeurlift//fQg1V2kA7fBj9bBT1dF8r1ihn8mq0rKCGtW2weAs7Iv9 MeAhoUg7JYnenHlMWY01pISxgkpvAZ5Q/OBlPAkltrboEyTS7RuuRj6vP4Wnmi2+ BEMuUCVNj3uDrizu/Ss41v7AOglsLrGagYyDSC+6eEU4fDRtrVWeuMp0xlh37A0K vL1k+4H/HYy5GkfrhI1+yIeci65pP6A2NfdZOz9zpSaco3iBrs6eA== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvq9j62y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:47 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CBfOjC029385; Wed, 12 Aug 2026 11:51:46 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fxg9h5re7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:46 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CBpj5w66781660 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 11:51:45 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5DDB358055; Wed, 12 Aug 2026 11:51:45 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 04DAA58059; Wed, 12 Aug 2026 11:51:43 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.9.29]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 12 Aug 2026 11:51:42 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v3 1/9] s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Date: Wed, 12 Aug 2026 07:51:31 -0400 Message-ID: <20260812115139.576303-2-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812115139.576303-1-akrowiak@linux.ibm.com> References: <20260812115139.576303-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: -xIY3Zg_a1OvGDJ7VTgoCjdm7a7jBP81 X-Authority-Analysis: v=2.4 cv=PbDPQChd c=1 sm=1 tr=0 ts=6a7c5e53 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=dlTjfeu_wqJGreSUTgMA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX65qCT7oNqoDL EevI9MrGbt4Df9EzwSc8G3WkAWTWYCt406jeIu/4RDKs/40LMf81Brg5ZLfnGjimEcZgqEtHxfT EQJfZeEw7bnUTns+Y+HAo0QJJXI7bNfaiDnFs+KXN/fnVnB4hW/5NZsL5JXU+ZdGFpdSBoaVqvn RB7l/TNICb/4oX1kJzaBCzPgJiXumOgVqAmGHHnOdYaULfml+hzwFGy5u6G3gh5khKqyS4Adekm oKkZpurdmAYefhxRE5FKy7PN6Khwm0mefprdRtGj/7vBvvSV62259L9BNMK5eWljBrsNcl8xqbl gs/GDRaZCPiP4Y7axt9xliK/M/FhanfxD9el/9SbCjr9IxMrokc2jTOmWIrk75I6ENHNWD9sivX EXCWZCYEegSV2N2s/6F+SF+CbJG4/1HB4IdojMKabCj9z0eOb8kYagElgtFNXp8/QyQCz9mGWMd foY1cX3RlK9+bVnL8Mw== X-Proofpoint-ORIG-GUID: -xIY3Zg_a1OvGDJ7VTgoCjdm7a7jBP81 X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfXyGpc87Pj6dPM Kg11TU2WLa4SC23zW8lc8L6yS4XmHqHvdNmeBnRruY59FJhZC/GWWo/Agio0CJ65Cu7H2F7NClU Oun5O+fT9K5ZfR6fPpkWSMVHwgDUE6E= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_03,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 impostorscore=0 malwarescore=0 adultscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 phishscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120093 Content-Type: text/plain; charset="utf-8" The do_remove flag in vfio_ap_mdev_cfg_remove() is initialised to zero before the loop that iterates over the list of matrix mdevs, but is never reset at the start of each iteration. Since do_remove is OR-accumulated across iterations, a positive result from one mdev carries over to subsequent mdevs. The fix is to set the do_remove flag with the first call to bitmap_and; for example: do_remove =3D bitmap_an rather than do_remove |=3D bitmap_and. Fixes: eeb386aeb5b7 ("s390/vfio-ap: handle config changed and scan complete= notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 44b3a1dcc1b3..845c86ba8bc3 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2603,15 +2603,15 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *= ap_remove, DECLARE_BITMAP(aprem, AP_DEVICES); DECLARE_BITMAP(aqrem, AP_DOMAINS); DECLARE_BITMAP(cdrem, AP_DOMAINS); - int do_remove =3D 0; + int do_remove; =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); =20 - do_remove |=3D bitmap_and(aprem, ap_remove, - matrix_mdev->matrix.apm, - AP_DEVICES); + do_remove =3D bitmap_and(aprem, ap_remove, + matrix_mdev->matrix.apm, + AP_DEVICES); do_remove |=3D bitmap_and(aqrem, aq_remove, matrix_mdev->matrix.aqm, AP_DOMAINS); --=20 2.53.0 From nobody Thu Oct 1 11:05:39 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E80EC43747C; Wed, 12 Aug 2026 11:51:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535518; cv=none; b=KXNTu1j1rhAfZmxLcmxRBl0g3oihn/M2YKxXakBcMmNLoTmDgBogWrBR+pY3JD0gt1WVTflo/4eYAh84eeCSJpDCsV54h8ni3Pw3Kkd0wEiLc321XZrBMlDqyCkno2EmCvG3UvbO8iQHzCxqbDWL9QPSHgKDCp/QB/CbIsQNpmM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535518; c=relaxed/simple; bh=CTJmbt1Hm9qKIkgof5Goy8p/ON4bw5Ig8no4fCdx1Es=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HH4YQc4TLTy7TTTPgrQttHnAYwqgCw2VR9+z2gh7+lCqNZgbWrzGYHS4gC50Z4I+q1Z9DEAGlBUekSAPWBC7W0Cx+/wpx3c+NtWVYxPIgkqsHbe3yQTbJu6bCZD4+REhGKfrAsm6JboDZR1jl+bMyz/b8E/GGR38XFWM8odTDz4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=B0Sq4ojM; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="B0Sq4ojM" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CB3XCj3214191; Wed, 12 Aug 2026 11:51:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qJaVMk+sul4rMvzBc /DXWNfa1ETKQ+5UxcebhCbYaQU=; b=B0Sq4ojMLmLFfvjH5kJ4l3jhyd7ErSy3T rZkC4Zn6Td6P7IIuLiruAwesl/molR4qCIO3Naq/ookGXNhgEcgia3AzbSGDguE4 R12UbE92FLAIe8lCfh0f3/K+NS4Gh2N3Gw8HyDQ8zRHrRK9zIsZWNpxBATld36kG pfS6c8KZC3YKvmp+bpzabTgMHtwW+Vz6HNk3XvHKOnar/oIPwIVwcHLAccvhziOD /opkltqz/rlNzAHXwVMxlzu/8y0IceXQItMralC0IJ/oZfwgVWZ/kx1oqPplGsDM xzhBznu2R6nWtpi0jHj+H3sMdL+HtPqAIcCR5796Y4vmbvD72QemQ== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvp31e80-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:50 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CBfHt5026282; Wed, 12 Aug 2026 11:51:49 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxesq5ytb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:49 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CBpmWB48759286 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 11:51:48 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0B1B75805F; Wed, 12 Aug 2026 11:51:48 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 970D15805E; Wed, 12 Aug 2026 11:51:45 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.9.29]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 12 Aug 2026 11:51:45 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v3 2/9] s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Date: Wed, 12 Aug 2026 07:51:32 -0400 Message-ID: <20260812115139.576303-3-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812115139.576303-1-akrowiak@linux.ibm.com> References: <20260812115139.576303-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=AMtp2X5w c=1 sm=1 tr=0 ts=6a7c5e56 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=7-PX2TBNVYp1iSTFOFgA:9 X-Proofpoint-GUID: 3XZRV6i80eKFc-fKhi-rBlXtuT0sxII6 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX41/l8pTr3fXw 7ft3aPVdFDQRIvU+7V/dySi9nJOkR2it7XEgXWzGZQ4XZM8P1j8uW/ZFyPpCUoQRCUcOTE1rjKJ RU+Mmehg5vxWOBs6DgUxHtPbHtqwluvncEICEvd2oS1+bPS5KcDCrZ/Ts29jPY4+r8ShrsUqjVr np3Zx6o530ekvKCE0BNMRjkpvlkl0NtaLCTxGIjOEu4etPOj7FdysSYU8AxLndjb3g7Q0e2emsd 52xaB5YTxfxK+eZhtuZOydxqNQ+9Os3RMZyOq6g9SkhMXxYUr1zClVtFwY+mW1mgHe8oLtOzSiU uESNVjkilyEhiU0mJ5hu0EN025A5kH4ofO/bunu40UVyHG0B620O7VU0011LqiT9x1jy82E8g0n 8XBMqewoJ1jvIa51zNRnAscF1v6V5rI3G7E0z5mrxoWCw1zXinNlo7k9z4kpH96Tj2QE31+NLAg yR9UaozhwGv5OLNqbeA== X-Proofpoint-ORIG-GUID: 3XZRV6i80eKFc-fKhi-rBlXtuT0sxII6 X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX2c60l+dBY+kX gIU72TtaghJlQ2MI1eu4rIsLNWu6OFSOfs3EvYb+JLUG82PUkqF8Ff+cgwQqPK9DISJJOc3sjY8 A3j9UA/v3bhj6/kPQya/Mj+VbWtNpaI= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_03,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 phishscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120093 Content-Type: text/plain; charset="utf-8" The ap_driver structure has two fields which are function pointers to callbacks: * .on_config_changed: called at the start of the AP bus scan function to notify the device driver that the host AP configuration has changed and the associated AP devices will be added or removed accordingly. This gives the implementor a chance to evaluate the configuration changes and respond to them before the associated devices are added or removed. * .on_scan_complete: Called at the end of the AP bus scan function to notify the device driver that the host AP configuration has changed and the AP devices have been added or removed accordingly. This gives the implementor the opportunity to respond to the changes after the associated devices are added or removed. These two callbacks are implemented in the vfio_ap device driver via the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete functions respectively. Within the call stack of these two callback functions the matrix_mdev->kvm->lock mutex is taken without checking whether matrix_mdev->kvm is NULL or not. If matrix_mdev->kvm has never been set, trying to take the lock will trigger a NULL pointer dereference. This patch adds checks for matrix_mdev->kvm =3D=3D NULL before taking the matrix_mdev->kvm->lock mutex. Note that the matrix_mdev->kvm->lock mutex taken in the vfio_ap_mdev_hot_plug_config function is moved to the calling function along with the matrix_dev->mdevs_lock which is needed there to access the fields of the matrix_mdev. It makes little sense to make the change the check for matrix_mdev->kvm there before taking the kvm->lock mutex only to have to move it out via another patch, so it is done in this patch. It is important to make note of the following: 1. The matrix_dev->guests_lock is acquired at the start of both callback functions. This ensures that matrix_mdev will not be removed via the vfio_ap_mdev_remove function because it too takes matrix_dev_guests_lock before removing the object; so, matrix_mdev will be available for the duration of the callback functions. 2. The matrix_dev->mdevs_lock mutex must be taken in order to access fields within the matrix_mdev structure 3. matrix_mdev->kvm->lock mutex must be taken before the matrix_dev->mdevs_lock to prevent a lockdep splat. 4: The kvm->lock must be held while plugging the guest's AP configuration into its SIE state description via the vfio_ap_mdev_update_guest_apcb function. 5. The vfio_ap_mdev_update_guest_apcb checks matrix_mdev->kvm to verify it is not NULL before doing the hot plug of the guest's AP configuration. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 33 ++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 845c86ba8bc3..e382e5a1cb99 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2606,7 +2606,13 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *a= p_remove, int do_remove; =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { - mutex_lock(&matrix_mdev->kvm->lock); + /* + * The mdevs_lock must be held to access fields within matrix_mdev, + * and kvm->lock must be taken before mdevs_lock to satisfy the lock + * ordering requirement and prevent a lockdep splat. + */ + if (matrix_mdev->kvm) + mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); =20 do_remove =3D bitmap_and(aprem, ap_remove, @@ -2624,7 +2630,8 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *ap= _remove, cdrem); =20 mutex_unlock(&matrix_dev->mdevs_lock); - mutex_unlock(&matrix_mdev->kvm->lock); + if (matrix_mdev->kvm) + mutex_unlock(&matrix_mdev->kvm->lock); } } =20 @@ -2821,9 +2828,6 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matri= x_mdev *matrix_mdev) DECLARE_BITMAP(apm_filtered, AP_DEVICES); bool filter_domains, filter_adapters, filter_cdoms, do_hotplug =3D false; =20 - mutex_lock(&matrix_mdev->kvm->lock); - mutex_lock(&matrix_dev->mdevs_lock); - filter_adapters =3D bitmap_intersects(matrix_mdev->matrix.apm, matrix_mdev->apm_add, AP_DEVICES); filter_domains =3D bitmap_intersects(matrix_mdev->matrix.aqm, @@ -2841,9 +2845,6 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matri= x_mdev *matrix_mdev) vfio_ap_mdev_update_guest_apcb(matrix_mdev); =20 reset_queues_for_apids(matrix_mdev, apm_filtered); - - mutex_unlock(&matrix_dev->mdevs_lock); - mutex_unlock(&matrix_mdev->kvm->lock); } =20 void vfio_ap_on_scan_complete(struct ap_config_info *new_config_info, @@ -2854,15 +2855,29 @@ void vfio_ap_on_scan_complete(struct ap_config_info= *new_config_info, mutex_lock(&matrix_dev->guests_lock); =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { + /* + * The mdevs_lock must be held to access fields within matrix_mdev, + * and kvm->lock must be taken before mdevs_lock to satisfy the lock + * ordering requirement and prevent a lockdep splat. + */ + if (matrix_mdev->kvm) + mutex_lock(&matrix_mdev->kvm->lock); + mutex_lock(&matrix_dev->mdevs_lock); + if (bitmap_empty(matrix_mdev->apm_add, AP_DEVICES) && bitmap_empty(matrix_mdev->aqm_add, AP_DOMAINS) && bitmap_empty(matrix_mdev->adm_add, AP_DOMAINS)) - continue; + goto do_unlock; =20 vfio_ap_mdev_hot_plug_cfg(matrix_mdev); bitmap_clear(matrix_mdev->apm_add, 0, AP_DEVICES); bitmap_clear(matrix_mdev->aqm_add, 0, AP_DOMAINS); bitmap_clear(matrix_mdev->adm_add, 0, AP_DOMAINS); + +do_unlock: + mutex_unlock(&matrix_dev->mdevs_lock); + if (matrix_mdev->kvm) + mutex_unlock(&matrix_mdev->kvm->lock); } =20 mutex_unlock(&matrix_dev->guests_lock); --=20 2.53.0 From nobody Thu Oct 1 11:05:39 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27705439004; Wed, 12 Aug 2026 11:51:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535520; cv=none; b=hx5S9P8QQE6yglA7PJ43nZWSvX+ykQDx8rBMRT35Y0cigXUWP77LY24ZqYVa8UmrjN/Tz+qF8fDdfrvDNbjurivBKjEwi/hrdnMWqsd7hgWU3qVd+3ff+gL3EZBksD8i+kdq+67lvvjjArqdLgWSREd4dSgiR6h8P3iAZRbSNHM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535520; c=relaxed/simple; bh=89X9lBVJkrEtQNYhrB11Xha54OaOwKBksVJ3c7tDCcM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OjoqgT7nIp2sXDXTQFGdrHQ94mbYrMmfvvJYJ2MLmsxnLlw5a5eplOl6QNjfp+qZ6r9YVzD2lhGyWw0kZfyo9DEn4mooRd1mN3A9X0LOQcrcYdCpdUAP7a7KXqyMOkVh1cy5XAi9TQsfbhEcMlhQf8CZ6ITMHJvpZwcVx6jjRdY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=G5QNBmk6; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="G5QNBmk6" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CB41JJ2205708; Wed, 12 Aug 2026 11:51:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=rFapEubsnjwGtU3Ar h0+/W2yhsuB69iyi1GqmPDY61k=; b=G5QNBmk6lm7yC9ymYeitEC6bVHUpxjO/F utd2Qj3GG6GthimcSoybCp5SQXW5bj/Uket8pZaFmyAgGIPKWQbbBsPWVE3aQZnW 4aW/uyYvHL6BEGzncRmO4T+8f9PgmzinOjPBEkI9sF1rRDkO48dSrOs6wr1WyLAl qnoU/wwQfCrDD1KqL6xYsRN5K6aw4H40evTRFmsJXCTt3OV4yITNFE5CGaCuFvCA ZcqEKLfpB5f4Cb5tDw/+5UGNIV6fQdJsH2C+63GDT2vGpBF9Q1kcfdQA/eoKaBe8 4GhckKKPUUSCINXbKJvF1wojAKiA6fPBe5vS8UIhJut6sL0Jt3vWQ== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fyb23tsnt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:53 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CBfIcv006387; Wed, 12 Aug 2026 11:51:52 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxhfy5kxf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:52 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CBpop326215076 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 11:51:51 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B2A9358059; Wed, 12 Aug 2026 11:51:50 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 438C45805D; Wed, 12 Aug 2026 11:51:48 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.9.29]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 12 Aug 2026 11:51:48 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v3 3/9] s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects Date: Wed, 12 Aug 2026 07:51:33 -0400 Message-ID: <20260812115139.576303-4-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812115139.576303-1-akrowiak@linux.ibm.com> References: <20260812115139.576303-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=XqfK/1F9 c=1 sm=1 tr=0 ts=6a7c5e59 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=A59ciYRgiFgMSmRGxjkA:9 a=+jEqtf1s3R9VXZ0wqowq2kgwd+I=:19 a=0bXxn9q0MV6snEgNplNhOjQmxlI=:19 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX7nCs8XA5mT0X 8I6f216k4JfxhMYCzeCkkK2z/FB7kSpa86VuV7rupvQ3emoaZVnXk9qi53KtIrV6TjyyZe1eYVC OQ6bt6Bbn85p8PH294SCzVqhdMamTPOUg19jpve73i2x/cwtVXiuiLE4ni9oV4rIvxYY8kBKzRw +nVOf+YabxTGrYYXu07rQEOqY+jWzsbJIz8Onpcv7czaT5IMLJoQreDyT/G+9w0UJCit5G1l+vX 0itHVZKJMTlCt6ZKZJ79DcGxHC89YlNNCuy9iW5FAWpeRIBAMS9Oo+75fFnyVxtCT0qAdNhtLdd vr2nwMvp/dRIAJ6A+/eEJOJ9q6z1kdnlUvcaqii8uRvTKRmxZUZWqcwiKnS9CAFN+h5KYYbxp1I jerz+lBInCGav1Q36haSucWvwQ0zcNA4WlLFPx54wakSX3dYuZuSSOP1IRSWJu32x8qcU29jHPF ED/kARWN2E1mQ6CbFhg== X-Proofpoint-ORIG-GUID: VMwSnsGx7ST3pqE32Jqw44tMwf4MRacq X-Proofpoint-GUID: VMwSnsGx7ST3pqE32Jqw44tMwf4MRacq X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX98GaJUkij5Hi 0TSHG57+ds2A1mHcySLP6QjF5tVZKgnD6FdWeqO45v60dJxFPFL7CtoQlvdjbOYlm9Nu7jozcPA GkiEeJC+kWR0jPKlBvm/8/ENzsR/OAc= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_03,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 spamscore=0 adultscore=0 malwarescore=0 clxscore=1015 suspectscore=0 priorityscore=1501 impostorscore=0 phishscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120093 Content-Type: text/plain; charset="utf-8" In order to traverse or add/remove ap_matrix_mdev objects in the matrix_dev->mdev_list, the matrix_dev->guests_lock mutex must be held. There are two functions that access the list without holding the mutex: vfio_ap_mdev_probe function ~~~~~~~~~~~~~~~~~~~~~~~~~~~ The vfio_ap_mdev_probe function uses the matrix_dev->mdevs_lock mutex to guard the add of a newly created ap_matrix_mdev object to the matrix_dev->mdev_list. This mutex does not protect list access; its purpose is to guard against concurrent access to fields contained in an ap_matrix_mdev object. This could lead to kernel memory corruption or use-after-free if another mdev is created or removed concurrently. The adding of an ap_matrix_mdev object to matrix_dev->mdev_list is now guarded by the matrix_dev->guests_lock which is the correct way to protect against concurrent mdev_list access. vfio_ap_mdev_for_queue function ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The status_show function that supports display of the status attribute of the devices in /sys/bus/ap/devices calls the vfio_ap_mdev_for_queue function which iterates the matrix_dev->mdev_list to find the object representing the queue device whose status is to be displayed. In order to traverse this list, the matrix_dev->guests_lock mutex must be held. To fix this, the guests_lock mutex is taken prior to taking the matrix_dev->mdevs_lock mutex in the status_show function. It is taken there rather than the vfio_ap_mdev_for_queue function - where it is needed - because it must be taken prior to the mdevs_lock mutex in order to adhere to the proper locking order and prevent a lockdep splat; also because the mdevs_lock is needed there to access fields within the matrix_mdev object in that function. See the vfio-ap-locking.rst in the linux kernel tree. Fixes: 2c1ee8983aa3 ("s390/vfio-ap: prepare for dynamic update of guest's A= PCB on queue probe/remove") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index e382e5a1cb99..5c14ded4fd8e 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -803,9 +803,9 @@ static int vfio_ap_mdev_probe(struct mdev_device *mdev) matrix_mdev->req_trigger =3D NULL; matrix_mdev->cfg_chg_trigger =3D NULL; dev_set_drvdata(&mdev->dev, matrix_mdev); - mutex_lock(&matrix_dev->mdevs_lock); + mutex_lock(&matrix_dev->guests_lock); list_add(&matrix_mdev->node, &matrix_dev->mdev_list); - mutex_unlock(&matrix_dev->mdevs_lock); + mutex_unlock(&matrix_dev->guests_lock); return 0; =20 err_put_vdev: @@ -2297,6 +2297,8 @@ static struct ap_matrix_mdev *vfio_ap_mdev_for_queue(= struct vfio_ap_queue *q) unsigned long apid =3D AP_QID_CARD(q->apqn); unsigned long apqi =3D AP_QID_QUEUE(q->apqn); =20 + lockdep_assert_held(&matrix_dev->guests_lock); + list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { if (test_bit_inv(apid, matrix_mdev->matrix.apm) && test_bit_inv(apqi, matrix_mdev->matrix.aqm)) @@ -2316,6 +2318,7 @@ static ssize_t status_show(struct device *dev, struct ap_matrix_mdev *matrix_mdev; struct ap_device *apdev =3D to_ap_dev(dev); =20 + mutex_lock(&matrix_dev->guests_lock); mutex_lock(&matrix_dev->mdevs_lock); q =3D dev_get_drvdata(&apdev->device); matrix_mdev =3D vfio_ap_mdev_for_queue(q); @@ -2343,6 +2346,7 @@ static ssize_t status_show(struct device *dev, } =20 mutex_unlock(&matrix_dev->mdevs_lock); + mutex_unlock(&matrix_dev->guests_lock); =20 return nchars; } --=20 2.53.0 From nobody Thu Oct 1 11:05:39 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CDE8442123A; Wed, 12 Aug 2026 11:52:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535523; cv=none; b=rR6+wKPibzmlFQC/nwili10w0+rBgo0MEai9SnCkoA2T66MZ9l0XjiZ9AkTVOLNHsprCH1mTxXOihfNRJEkOFZyp6ww6lOk/Nt5mfbBxYsYWO7McD1HSEbFt6Qgndfv04qeJ0VphpTzGJ3hN+2xgR5PQg4hS3nUFxwEqA1WOXJ4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535523; c=relaxed/simple; bh=6pIVYxg/Zi9Biw6oG7xoB05YTxSPhOplE9YZxeLj9dI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DK/h9KhcDmpwe/ew1NZsSwHqeD2qQiBTJyQW+Zk6d7Dw5kOy69VCuJW3WkkIgmY4yipzPZunUcdvfQ2fRP7QbpiqEmIl/zuf9I7q0SzHW+ew6cQxeYxMUoGbxjxtImxG8tgiFD1YfeR57MzDf98s4X6b5ytOaHpwLQxlGCiJODI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=OCeq0HPn; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="OCeq0HPn" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CB3s6j2205543; Wed, 12 Aug 2026 11:51:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=q95Q3msVO00Z9Po4T hOOjQXOf5Koz/qQvAUzQfas7xw=; b=OCeq0HPn1WboCfXkevtWmvEgQhFA4ykM8 loM2WPNTW1s3FunKV65A3ZNkG3ctG75332qesQjxXUcHtw89F6I+9VrbZhDqZIPo o7QSbQ9FJKaYbxNnmIdKD9+G5uyV7QRCbi6sY3XG6SwjhF0GZG6R0f895VP8MLK3 0sr6VJZIxZ3uOrp7/KskOoLgIto89yEvyjiTBNAf8WBDQR2Qe3P//qthNHVLAO52 ce6R3i2Q1yEQi5pGgjGrhSpDcm1sdmCceF7Ftowh71BlAQgB67C9clp4ntTtW+8R d+Ht4mL7OP4qJIiCXVndTdKe3Uv5cbm/3VZYF64fd/5EsGXa3u4Mg== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fyb23tsnv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:55 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CBfO2v029386; Wed, 12 Aug 2026 11:51:54 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fxg9h5req-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:54 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CBprQn7144166 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 11:51:53 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 62BD05805D; Wed, 12 Aug 2026 11:51:53 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EBF775805E; Wed, 12 Aug 2026 11:51:50 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.9.29]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 12 Aug 2026 11:51:50 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v3 4/9] s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Date: Wed, 12 Aug 2026 07:51:34 -0400 Message-ID: <20260812115139.576303-5-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812115139.576303-1-akrowiak@linux.ibm.com> References: <20260812115139.576303-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=XqfK/1F9 c=1 sm=1 tr=0 ts=6a7c5e5b cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=mm-sKQyJWPVlA1vr6AIA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX32+DjrajbGot rMNFWIKobVkseK474eH+i4mJDIEiGw1Q2izCxTWq/3xJwxwY1C3g1rlDmpifnWgXzo17C/LS/P6 F4ndzYG7O2+8ZfqifXjIqpzBqFA0hWdYFCSvYEEzRZMAU540LNCBcmkilsv9gN/JHHpsXxW4sbd maawWx7qupv9iU4MC4BfavOPi4sFLo+2kuhzGZruBGSqeHJBhGR+H63lV2XIaDrB3bYMqHgsajS NVcy3lgcf/CFBpR+98WaNqyEms1xBKPfFMqfYZwqc/QCmZaDwovSnHmogH5jjn0AN3/1Vn06Jia Hj3omLd0J88TZdqGhg2bsLNPSmGJXSNR84EVErIjUz2AyEofJUnXKoEDryUlJV34ohtwI8xvBKb KmzHgDVspeZMSgG6hwCW/yC92hlCtkcbeo+ysmYMwDkanzSsr3+bCYMJHfCemUPzugFw9t0M0g7 m6K9sH4I26/KNkOzE3w== X-Proofpoint-ORIG-GUID: GjKhEaDZuZap3hq4YL36UwTXNWnsfaZv X-Proofpoint-GUID: GjKhEaDZuZap3hq4YL36UwTXNWnsfaZv X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX2qNgNMB9x/LT ioJMHboYdO5oYV2MdWmEzYF/0vVZAikMMYAsZiRKtWfN630LCrVp2SWnAn2ga+pgerLEIuh1G8r ljiBdmQ+8xLj3DRaYU6Omzb61i05G0o= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_03,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 spamscore=0 adultscore=0 malwarescore=0 clxscore=1015 suspectscore=0 priorityscore=1501 impostorscore=0 phishscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120093 Content-Type: text/plain; charset="utf-8" In the vfio_ap_mdev_cfg_add function, the apm_add, aqm_add and adm_add fields of an ap_matrix_mdev object fields are modified while not holding the matrix_dev->mdevs_lock. This lock must be held while making these to guard against a race condition with another caller that may be concurrently modifying these fields or any of the fields in the matrix_mdev->matrix. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 5c14ded4fd8e..8a1ecb891504 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2760,12 +2760,20 @@ static void vfio_ap_mdev_cfg_add(unsigned long *apm= _add, unsigned long *aqm_add, vfio_ap_filter_apid_by_qtype(apm_add, aqm_add); =20 list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) { + /* + * The mdevs_lock must be held in order to access fields + * within matrix_mdev + */ + mutex_lock(&matrix_dev->mdevs_lock); + bitmap_and(matrix_mdev->apm_add, matrix_mdev->matrix.apm, apm_add, AP_DEVICES); bitmap_and(matrix_mdev->aqm_add, matrix_mdev->matrix.aqm, aqm_add, AP_DOMAINS); bitmap_and(matrix_mdev->adm_add, matrix_mdev->matrix.adm, adm_add, AP_DEVICES); + + mutex_unlock(&matrix_dev->mdevs_lock); } } =20 --=20 2.53.0 From nobody Thu Oct 1 11:05:39 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82CD243C05B; Wed, 12 Aug 2026 11:52:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535526; cv=none; b=tNAE1LAVS8R75tHqZIWkeU5hBO/vdAdjCMV0/MeuK44yKTZp/ubw+ppIBuw66TVHfvWd8a/22T+yJgT8MwwlwUJpedjBbZhaj1SEGE+WN6bVLFGpG/mWCaDcxuIJBC8JATJG+BCJ5vhlEi2wQgAoEHC/B20WVHwknCKxu8SKb7M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535526; c=relaxed/simple; bh=H/1I/HKhjJFIWaIoh60ijSmNIf0cmQ6fBj3FC9hxLME=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=M3SmX7FecPbvHJhDnlPLfVDLnRxJHxSR5cutUGz5QyVajTJuHVDS4YYEs1U+C9jRHHgunMS+3HB7B/9y/+bfavvAs+20ZwfR4ddzxdI8UheGQOTdgHZNe9vPHN8SDz97HDficCjffedEA7W6CQPn4aOs4ixmaYhOlXM2YTQ5uYM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=HE8OXiTL; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="HE8OXiTL" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CB3cIh3258446; Wed, 12 Aug 2026 11:51:58 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=GHk+KGcXvDSfwtCVf 3e0pPPjaAAzgDkx/iNdCz//Vdc=; b=HE8OXiTL0vJv/Li9JG1ApPA11fV3eaDy1 Gr2zqgToRGDK6uk3VK/NbiiwnfI5QTNd0YCJ9NdGnrQV4hyLGg2cWm7igKUn+mXP cEg00+jzA0Y67BoF8Lso5yFVWgl7Trc+w7gx4ZcIWj8GNoIP6jT9tbzQL3R4umEs 0qyKfJAFcRpMEU2xso3fwE47eLYrzma6lI88ScOn1dJbJJigh8RijjUOOJfqguxi CJWxkcP6sSkLGmO5GSOuYCNyHopdlpzA0rtDbQM/Yl9ktQqO+NzEltfl2OKUFA2d QmGp5+nqr+E4RsiO9yuNEffLp9hnH3e/p1fWlhpseMMFO1PypAK6g== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvq9j63n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:58 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CBfI4J006382; Wed, 12 Aug 2026 11:51:57 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxhfy5kxn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:51:57 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CBpuOH15532790 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 11:51:56 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 15A0D5805D; Wed, 12 Aug 2026 11:51:56 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AA51158059; Wed, 12 Aug 2026 11:51:53 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.9.29]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 12 Aug 2026 11:51:53 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v3 5/9] s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove Date: Wed, 12 Aug 2026 07:51:35 -0400 Message-ID: <20260812115139.576303-6-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812115139.576303-1-akrowiak@linux.ibm.com> References: <20260812115139.576303-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 51V_c4um9yr2hs-r4wFdpm7PSFA6MCH0 X-Authority-Analysis: v=2.4 cv=PbDPQChd c=1 sm=1 tr=0 ts=6a7c5e5e cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=fkyveIzhjB74ZASU3MYA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX4kbPAU5Uq0E7 D6RmeYsdCBsEhGBkmt+arz9vo0IYIxjHPOH6tr4H/7UbOKRu+FnJQOqZ1JhVlpW7XwhgwRduspp AtzyiX61m376iq+sk6EsDvvNu6YolPuqF1cVWQEUJ+OPDIaMcvqAD1dPeDdM6T3+jFXYB84Wxjh D69XSXbV7Rdi1zDQwNW25R60R+SIQf617R+0mHGEe9H5UgkHPmYIquZkxxLbnD4sBjOHilHKkLh cf0rCSkMAG5MVGRBONVlW3bo2nMZ3hjWNT5ttIKSaikrSeKbjxE3jkFegJQC/nZe8S11iDNyqPF BikvO5Ziy9NP/KzwVKQ8aXzYoxK+VXM7GmraxxV4hu6MLHsQ/R0qplhUf3Jhvik5SjFUFQz95QY yoD9fuHMt/VNmoOGue6VbB/mrhA0aHv437aWGAeofKvqp1b5K1UT69paa/kCDLMHne1BQXzroU2 sxCeRReXF00uzW86fDg== X-Proofpoint-ORIG-GUID: 51V_c4um9yr2hs-r4wFdpm7PSFA6MCH0 X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX4YkPZyGoVn3E Af7ypMK/q0xlUKHvaSJXMb/ERWnWva99qU4rbwt36K+QXJJaU9HriD+wqRLeUplMg4QJBIjGGrm 8uYUN6uyuFXAgTAxvKbygzDMbfcNXfU= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_03,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 impostorscore=0 malwarescore=0 adultscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 phishscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120093 Content-Type: text/plain; charset="utf-8" The vfio_ap_config_remove function uses the bitmap_andnot function to clear bits from the matrix_mdev->matrix.adm bitmap (specifies the control domains assigned to the mdev). This prevents the explicitly unplugged control domains from being removed the KVM guest. The bitmap_and function is used instead. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 8a1ecb891504..b6d0c988cc81 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2625,9 +2625,9 @@ static void vfio_ap_mdev_cfg_remove(unsigned long *ap= _remove, do_remove |=3D bitmap_and(aqrem, aq_remove, matrix_mdev->matrix.aqm, AP_DOMAINS); - do_remove |=3D bitmap_andnot(cdrem, cd_remove, - matrix_mdev->matrix.adm, - AP_DOMAINS); + do_remove |=3D bitmap_and(cdrem, cd_remove, + matrix_mdev->matrix.adm, + AP_DOMAINS); =20 if (do_remove) vfio_ap_mdev_hot_unplug_cfg(matrix_mdev, aprem, aqrem, --=20 2.53.0 From nobody Thu Oct 1 11:05:39 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA7E743CE51; Wed, 12 Aug 2026 11:52:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535528; cv=none; b=lkOiiJo7IwO+Drr6H/YdHUm7wfSvmA+UcAsqu451b+AZS/9RxG9HCiTiZ7Z2Z6VoKjOqe+Z55Qn9uw89xK/7RV9HZsQ8Le0SDjzBzYiUY9QwYZ6vn3RK1bpytSWC/PHESDcdbAHT0lav8LuUrgQveZOdSIrlclqrU/L2GaWYO48= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535528; c=relaxed/simple; bh=2Wf/N3kpJHEuHd+RiacnJK0+ci8T3IWekGQoJJU4yiM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DOvlCAg3T4ITosP63lUtjWGd+zt6Pxo6imFXeO//JMwdf7hc6jBPEdPxbcGVU8PThQcXoBn7EMv4VNDmXPF2KaExSgI06/56yUwF0aUs7Jdn6LIw33Ajy19WKTraoYWF16CaWyUho3TkTrNtUS2PBiFTK2eNMlJkh2D90WfnyQY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=WBDupF6f; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="WBDupF6f" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CB3WIL3304218; Wed, 12 Aug 2026 11:52:01 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=8dYG0nkgaSZFR6vpj HeCMiXGkd9Xt8YhJC2ESgxg6vY=; b=WBDupF6fuhX5jgV1Ffil1J59VTxNeURoM USTG66tXZHUHlSVQisJJWXqH43KKvhC+xQb14xCjc0n50vl+p4a94cdPK6jlK2Au jLHhfRg8+j7kKebqRH6jHTFtAwviSqM+MZpuoDCgz+vON4GHAtmzYi2d0NbRmZ7/ g0f4WLfSFFdAo4kXeyrxzJ0r6U20t2G9xdmuzv0eFmrhIABWwfob6fQQgsyNqvAn mNZ3D4Gcr27CQqy4Q5PWg6h9Z20EjVPXr4QAzLJbtdcOz5b1VfOdo/W73AxyKB3V n5e+Sj5WyevZENofT7CS+Cqj+1whSQpNHjweQDMHX4Q5xaoq8yxag== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvm9t8gg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:52:01 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CBnshm018703; Wed, 12 Aug 2026 11:52:00 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxh0gdp73-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:52:00 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CBpwrM63701474 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 11:51:59 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B06BF58059; Wed, 12 Aug 2026 11:51:58 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4EC295805D; Wed, 12 Aug 2026 11:51:56 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.9.29]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 12 Aug 2026 11:51:56 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v3 6/9] s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Date: Wed, 12 Aug 2026 07:51:36 -0400 Message-ID: <20260812115139.576303-7-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812115139.576303-1-akrowiak@linux.ibm.com> References: <20260812115139.576303-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX1vecvEeq5/1c u5P04XBfEkjKqZmOUyjYF8krWU+c6jYy8BOU08+s8Mox758MBWPeemq+OYMLvLIUg8Bfx+4uKal l4fi8C89hXpyYAM+jLO2uOOUl9kxcmvjN50By7fGw2DrHmca6mO18bN8fiaTwAmn9XTNjN333Nd IR+zDbUaL8qJ07QkKSZV9QC5WfQohd2W94g9BC7hdjF8ydqz3xfuMkU/K2uSD5e2XNCf6/xTTuT 2wVpFWY+7twUv8IzXU579gt+RqnY+MsNCc6ysBvhAZ0cB9EyTC4eQzLvpZhyShObfDFVRjhcnzK ea4qmZhsc08rtom8mOWhGCD4H9PFR+4oeo270HbwIFtFIX6Omp3o8YYwgOqVhhhTA4qisqWrPRy U7L82KCow9bwDJ+94G8xxgDdBHzv+fwl7574GrQL1ReqAArYEiWQN4RX2SeuQUITHbMjDQzBl9I L6e59DkQT5nrXhtbnvA== X-Proofpoint-ORIG-GUID: XLV49F9vP9erkG8foBpX0-4lgouwECxs X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX9x/U1f195wnw M4ipFidgy+LSK3BvegMt/VfVZPlN+DBn2xvFYcOPfKlfDDh11AehXyB6+hbTwS1PW1KROvyAU5Q U7zY/FrSYN2aAwjxS0LRW7XukClwoWc= X-Authority-Analysis: v=2.4 cv=IfK3n2qa c=1 sm=1 tr=0 ts=6a7c5e61 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=_H5xUuJxPEx76qSOziYA:9 X-Proofpoint-GUID: XLV49F9vP9erkG8foBpX0-4lgouwECxs X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_03,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 clxscore=1015 lowpriorityscore=0 adultscore=0 malwarescore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120093 Content-Type: text/plain; charset="utf-8" The DECLARE_BITMAP(apm_filtered, AP_DEVICES) macro allocates the bitmap on the stack without zero-initializing it. In vfio_ap_mdev_hot_plug_cfg(), the vfio_ap_mdev_filter_matrix() function is only called to initialize and populate apm_filtered if either filter_adapters or filter_domains is true. If the hot plug configuration change only adds control domains (meaning filter_cdoms is true, but filter_adapters and filter_domains are both false), vfio_ap_mdev_filter_matrix() is bypassed. Consequently, apm_filtered is passed to reset_queues_for_apids() with uninitialized stack garbage. This can cause reset_queues_for_apids() to interpret arbitrary stack garbage bits as valid APIDs to reset, potentially performing unintended guest hardware queue resets. Fix this by zero-initializing the apm_filtered bitmap at the beginning of vfio_ap_mdev_hot_plug_cfg() using bitmap_zero(). Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index b6d0c988cc81..cdc9bf5c5e53 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2840,6 +2840,8 @@ static void vfio_ap_mdev_hot_plug_cfg(struct ap_matri= x_mdev *matrix_mdev) DECLARE_BITMAP(apm_filtered, AP_DEVICES); bool filter_domains, filter_adapters, filter_cdoms, do_hotplug =3D false; =20 + bitmap_zero(apm_filtered, AP_DEVICES); + filter_adapters =3D bitmap_intersects(matrix_mdev->matrix.apm, matrix_mdev->apm_add, AP_DEVICES); filter_domains =3D bitmap_intersects(matrix_mdev->matrix.aqm, --=20 2.53.0 From nobody Thu Oct 1 11:05:39 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2A23A438000; Wed, 12 Aug 2026 11:52:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535530; cv=none; b=pLl/9XkIQ12qwMSfyX34KFyReRU60dChHEF92p/AJsi7u9Ph1Avy/pt9fY/bsal4hfpoUE9o3PYevxPQwPVw1tisJBwoGBmzapw/CuC4Ppj6mpW6yOi+RFPmaxj3w4p25Kd7r4cHL5PuZoKWjjWsaX3BKQNxtCpnX8q3fVipMN8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535530; c=relaxed/simple; bh=2UPQMWE2CZGpLv4JV48e1VTAVuHL+jSzN8989sqWQLs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ndmM9vxp3x8Jf241JrsBl+KDioxkKieC5W+PZGhyrAVkg4psWhXaE5hfQUp4tYlO7GcV3Ypy3evcriWOjUCFcqbLC3ACpiWI0upTHUmDv/500p5bT+Pv7GpmjvNdVNmKbVLBxCqlhg36Cz4K7eKgg+18WOKvgu0CDhDS1dtQ0oQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=QXJwFYKI; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="QXJwFYKI" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CB3XsE3214182; Wed, 12 Aug 2026 11:52:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=TzSff4Lq7sqJz2rhL aXAj78Z5bkh76RXTn5LiXBPHWY=; b=QXJwFYKIbrRvLdnv4iXg8EImDkfo0iO00 tCW8tW/XmKN+qTTLvBua7lwBwTX2rOgp+t70aMW1z09nBLdADW7d4RYcinsFzO6E YRiJYNNmkXT8M7vwTbmn+wUFNklvpeEVvH5pAnLtc08mNowOG7GLQVHZljiM9bwN tCxoQ2JBrUXIlL4vkb8CtSiMbUPPCO6rzPUH7/cSZp/tLtc1E8E3Dxp6ZT5DWmYz 3Cn/Rr74SVJ2gFMxlxwvacpCfcwk1H+cRvHXnPZNPj0LJ6gO6O7ptq50dG8tKmIz mrqV7MA5EQZzySqt66KTSsdtPF3QaqFU7A26EWSTKiedSSl6ZT5ag== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvp31e8h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:52:03 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CBnvYh018744; Wed, 12 Aug 2026 11:52:03 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxh0gdp76-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:52:03 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CBq17L65601926 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 11:52:01 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 727B458043; Wed, 12 Aug 2026 11:52:01 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EB1CD58055; Wed, 12 Aug 2026 11:51:58 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.9.29]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 12 Aug 2026 11:51:58 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v3 7/9] s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Date: Wed, 12 Aug 2026 07:51:37 -0400 Message-ID: <20260812115139.576303-8-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812115139.576303-1-akrowiak@linux.ibm.com> References: <20260812115139.576303-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=AMtp2X5w c=1 sm=1 tr=0 ts=6a7c5e63 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=l_t73i4lE__BKQLLFKsA:9 X-Proofpoint-GUID: b7gE4aBiIcORUvZDBQpkJUvdaOPopqrL X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX7tRrgv1xgzG8 UzIUzriwJfXsvATE+m0Ge1NjQrlDZdEYXo9RJyZnRAjtTel02PxXjKFJ58kyjZLUddAcRGU5sfx ENRyYknyPEJIifim5tKbG7OunBSzY0OPX5a8EI75F5dlp+V7xa/7f8/b5Tl6bKPxfy2Bq+XVZ9s 6TUvG/aEbJkEQaMPcroGGoOQPZT67TB36gq3VxHga8yiti69YAtf3NGNhziYoLqwW6YOSM/d0mT ci5YA6IpA30HaxCDnOJ6SuHTIM26EwLG+UVcF9IPF/SQOVsdgIUlZLRj5B4B/msNUC5uoIZ+LLC Dropghi2wz1KdsdNVAhT6OGv1NdPq7nV2ElPkMOyH60xrk5i1XfSS2SnAf//eiMWJx60y1V/Wni Y503MMpEq0k9/0XMTro6QroXjUrOmr94WhEahWRQieHlPlaIFZqt3TEQQ9QQBsYKD/HrIhihQUD R6FZ+b4in6rr2VQo5gA== X-Proofpoint-ORIG-GUID: b7gE4aBiIcORUvZDBQpkJUvdaOPopqrL X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX6HWkECjCA0bG OVt1J3mdyymsGXWKgZ5fNlbRF3eYAgjeCc0x7MgtyyxsOnDgOy3TQ3dSPfQJArXYnd67xQ1CFEO 8l5nurRqvBjbS8FBqbCd6HxWnfvB1E8= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_03,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 phishscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120093 Content-Type: text/plain; charset="utf-8" The vfio_ap_mdev_hot_unplug_cfg() function uses the return value of bitmap_andnot() to determine whether the guest APCB needs to be updated. However, bitmap_andnot() returns false when the resulting destination bitmap is empty. This means that if the only adapter, domain or control domain assigned to an mdev is removed from the host's AP configuration, the bit is correctly cleared from the shadow APCB, but bitmap_andnot() returns false because the result is an empty bitmap. Consequently, do_hotplug remains 0 and vfio_ap_mdev_update_guest_apcb() is never called, leaving the KVM guest with stale hardware access to the unplugged AP devices. Fix this by replacing the bitmap_andnot() return value check with bitmap_intersects() to determine whether the shadow APCB actually overlaps with the removal mask. If there is an intersection, call bitmap_andnot() solely for its side effect of clearing the bits, then unconditionally set do_hotplug to trigger the guest APCB update. Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complet= e notification") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index cdc9bf5c5e53..cb1e5db69d8a 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2563,24 +2563,28 @@ static void vfio_ap_mdev_hot_unplug_cfg(struct ap_m= atrix_mdev *matrix_mdev, unsigned long *aqrem, unsigned long *cdrem) { - int do_hotplug =3D 0; + bool do_hotplug =3D false; =20 - if (!bitmap_empty(aprem, AP_DEVICES)) { - do_hotplug |=3D bitmap_andnot(matrix_mdev->shadow_apcb.apm, - matrix_mdev->shadow_apcb.apm, - aprem, AP_DEVICES); + if (bitmap_intersects(matrix_mdev->shadow_apcb.apm, aprem, AP_DEVICES)) { + bitmap_andnot(matrix_mdev->shadow_apcb.apm, + matrix_mdev->shadow_apcb.apm, + aprem, AP_DEVICES); + do_hotplug =3D true; } =20 - if (!bitmap_empty(aqrem, AP_DOMAINS)) { - do_hotplug |=3D bitmap_andnot(matrix_mdev->shadow_apcb.aqm, - matrix_mdev->shadow_apcb.aqm, - aqrem, AP_DEVICES); + if (bitmap_intersects(matrix_mdev->shadow_apcb.aqm, aqrem, AP_DOMAINS)) { + bitmap_andnot(matrix_mdev->shadow_apcb.aqm, + matrix_mdev->shadow_apcb.aqm, + aqrem, AP_DOMAINS); + do_hotplug =3D true; } =20 - if (!bitmap_empty(cdrem, AP_DOMAINS)) - do_hotplug |=3D bitmap_andnot(matrix_mdev->shadow_apcb.adm, - matrix_mdev->shadow_apcb.adm, - cdrem, AP_DOMAINS); + if (bitmap_intersects(matrix_mdev->shadow_apcb.adm, cdrem, AP_DOMAINS)) { + bitmap_andnot(matrix_mdev->shadow_apcb.adm, + matrix_mdev->shadow_apcb.adm, + cdrem, AP_DOMAINS); + do_hotplug =3D true; + } =20 if (do_hotplug) vfio_ap_mdev_update_guest_apcb(matrix_mdev); --=20 2.53.0 From nobody Thu Oct 1 11:05:39 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C28A6438026; Wed, 12 Aug 2026 11:52:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535533; cv=none; b=Y76y7+kH+NvCh2MwI8gcW0VvTTDoR1svwCl4CDrZbQJv7TKwS+vmRNDgtjsOVL2GBcqUERWyr/Z5VgLW9OEfHAovoAYyBO6GSkQczM0SWTx4NXVwXZCdPwMkpCGOGDdPzqAfplfLdQ+GmxHRDiiluD/PfSApArD+PM1ZRd6malU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535533; c=relaxed/simple; bh=WFJgusvDWYxmK/da5mLAFo/CczQmoGdGW2qVzQOoD3Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=AE1v6CYgJLKuS+uqbThC5RsGloLeyxDkmJNTG7TumiWjhRNBjpHHy6BRDapSakQKn/iFhMjw25mE0i5DFmHsUrdzvSC+eV4mkpiYt3L9wgncCsDIBM6qB+eSdMYV1x5FQy8h4Vavmo6W8Cw98N5DEeWshBEmZTigjJqKqEH/Rrk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=beMuQHg0; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="beMuQHg0" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CB3WEn3334211; Wed, 12 Aug 2026 11:52:06 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=2sTRmt C9PsZeYBtsJj6+rGWo4jmhkOccUuBURDFhD6I=; b=beMuQHg0w+Twnzmsm7sORu pHtKqkp+YuebkHPBRf6purjL29V5tSiLE38B/0kgPvhwRBQ0Zf5jq4Nwtvn/3bFm VHd5mXBpQFBKlN5DsVw0YJbArUwmDlD9Efg7lYPl6lUhxA0FgjqD2CYWHRfR8jY+ U8LSyXGjCE1/gLEnbH0Br26tLIpO1fn4X+z+gezwZMOM9QMESXcvV00JbREe0ZbQ gcCCju3BOob3P75i2PCnUafuh2Tp19ao4tkd0FguAVWj/ApweKjJi+p5uAA0TPWd EyTKisZvBJS/oAvg7FjXHu9fPrprdiTdgX0D4QshtClS8Cg0A+Np3ieg9+4DYN3w == Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvnw9dxn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:52:06 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CBns5N018709; Wed, 12 Aug 2026 11:52:05 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxh0gdp79-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:52:05 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CBq4Gi13304380 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 11:52:04 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 508815805D; Wed, 12 Aug 2026 11:52:04 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AC4F158059; Wed, 12 Aug 2026 11:52:01 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.9.29]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 12 Aug 2026 11:52:01 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v3 8/9] s390/vfio-ap: Fix NULL deref in status_show() during queue probe Date: Wed, 12 Aug 2026 07:51:38 -0400 Message-ID: <20260812115139.576303-9-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812115139.576303-1-akrowiak@linux.ibm.com> References: <20260812115139.576303-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=RsP16imK c=1 sm=1 tr=0 ts=6a7c5e66 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=IkcTkHD0fZMA:10 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=6WrCTVO_FsqHOomzZFMA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-GUID: PqUgwOKVG8DvLq-ShdSHh5bt1-vC5vdr X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX4ruds9+vR1Ct 8kcL7N2fuWSVuKZ3utuJjkYiBxJa20HItHCHCN70+DLL+ko+BhjsAeGe8IXe0C+B8qXYKikzDdk xG7RJcULq2y/RAQU9Y1d5q+XZDR7Qau21OOJp6XFNOfpwXiDx0zJWDoyuuyFDYS24ijUMEaC4tC 8MAQVNmS2SnKj4STA74pomNjJLe4X3UkzHbIMDVlVUh9gkflFlE9AEjprdU02Uu7wyABlmOuYWG Bgz5Bj5dZGYb/zhmSTXUQmflCL/g8soJeascA6Vw6buYCB9KCiMVMhBvZ7uWn0QV9ymAWOxS9IE b0wcxJGVPtWiweaYR41ATu1Qb78zwNrbPWAGRgMDL2VYQiO6qrkwrQsUuzcN9GERGhLqFuGSRyS Ddgsonv41rAx8NvcMbBtq30nU/+SCgpqgVjqcG6ejecVqRy6MxyNjeoqmeotuXEpNEbH0gtl7fF h88phAz29Vl20FapJXg== X-Proofpoint-ORIG-GUID: PqUgwOKVG8DvLq-ShdSHh5bt1-vC5vdr X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX4TMGatPsesG5 l1fWo9QSDw1AVrrR8BmAc/VfceW8oMv5MmppGkTi43yksqrz7J4HZiTQx4WVOXGviifFXCSdgMU Zb9O1rf4fld8qNu0Zbj84A+rECI/w/E= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_03,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 impostorscore=0 suspectscore=0 clxscore=1015 malwarescore=0 phishscore=0 adultscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120093 When vfio_ap_mdev_probe_queue() creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore call dev_get_drvdata() and get NULL, which is then passed directly to vfio_ap_mdev_for_queue() where q->apqn is unconditionally dereferenced, causing a NULL pointer dereference. Fix this by acquiring the update locks before calling sysfs_create_group(). The status_show() function acquires guests_lock before reading the driver data, so any concurrent read will block until after dev_set_drvdata() has been called and the update locks are released. As a bonus, the APQN no longer needs to be read from the queue struct after allocation =E2=80=94 it can be read directly from apdev before allocation and stored in a local variable, which is then assigned to q->apqn once the allocation succeeds. Fixes: 260f3ea141382 ("s390/vfio-ap: move probe and remove callbacks to vfi= o_ap_ops.c") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index cb1e5db69d8a..3652ba792be7 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2419,14 +2419,17 @@ void vfio_ap_mdev_unregister(void) =20 int vfio_ap_mdev_probe_queue(struct ap_device *apdev) { - int ret; + int ret, apqn; struct vfio_ap_queue *q; DECLARE_BITMAP(apm_filtered, AP_DEVICES); struct ap_matrix_mdev *matrix_mdev; =20 + apqn =3D to_ap_queue(&apdev->device)->qid; + matrix_mdev =3D get_update_locks_by_apqn(apqn); + ret =3D sysfs_create_group(&apdev->device.kobj, &vfio_queue_attr_group); if (ret) - return ret; + goto err_release_locks; =20 q =3D kzalloc_obj(*q); if (!q) { @@ -2434,11 +2437,10 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apde= v) goto err_remove_group; } =20 - q->apqn =3D to_ap_queue(&apdev->device)->qid; + q->apqn =3D apqn; q->saved_isc =3D VFIO_AP_ISC_INVALID; memset(&q->reset_status, 0, sizeof(q->reset_status)); INIT_WORK(&q->reset_work, apq_reset_check); - matrix_mdev =3D get_update_locks_by_apqn(q->apqn); =20 if (matrix_mdev) { vfio_ap_mdev_link_queue(matrix_mdev, q); @@ -2468,6 +2470,8 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) =20 err_remove_group: sysfs_remove_group(&apdev->device.kobj, &vfio_queue_attr_group); +err_release_locks: + release_update_locks_for_mdev(matrix_mdev); return ret; } =20 --=20 2.53.0 From nobody Thu Oct 1 11:05:39 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 861F3438021; Wed, 12 Aug 2026 11:52:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535536; cv=none; b=TzL36iFfQ/ZTEZp3NQ8Oe4IyPK9YZ0egQd6OYRV8wOrttTagt5ONosrXVQOcp5rf/dEetxZpIrMH6UsthnEDMtcFctzLO76EmcqFmjEUvVSbj4XzudwZ9lOcDj1FPHu5zvRNl/rYYJb2us26omiFI0BXapNTvp6Sww+snWJKJfE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535536; c=relaxed/simple; bh=WnWFlvYXDTgJdc/NeRJsJDveLyX9KEUNzwp2BKHumQg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hDOYrTWrpSr13PzxGIM4r9F/fw+ucIITUGay+vXiBiz3ReVRbVKqIVqVHp+GjZmvtyOKLHWoqCaFYqwFZ6lghlPAZZloHIeO6lNqa8lTa3nZIQ316K5y8sUU1q0jfGx3aiqIcoICb5X+9VOvv11O5krGCSWg9j/0uwB4fYaSzXs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=i/EKeLHV; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="i/EKeLHV" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67CB3XCk3214191; Wed, 12 Aug 2026 11:52:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zV0f4Op2mPPk8zk/d 9NiqgXzV/VwkAcO2oRh8X6NjQw=; b=i/EKeLHVZSHPRDJ3smMSVKdB3dJkUGSKn hDzi3nt28aMGZkM0wS/IjJRpqzmCPw+p2XSAk0UhR7ZK1xcfPINOpjyC4M5t8Kfg TyZ/0mGCRhAzOE0IC8pvELgXyfHkMJVI3DYZL+oooJ9DHz8sb6a0EtbVEYWF4xv2 /2gvR0h4IUqrhZmHJT2hgkYssBD8My7qI+5vJ59J+V1PtfGS2/Nt3xEs8PXHkXBq LDV0T0C6LM88E6JwMrEoJ/+bfIz/qSeBr/pcp1PX0ggm9HPXc1NGdjoXEwVr/xp3 v1fP6Q5MiXGPOI9M6DqGNTGY49vwzX7DxtI8IAQDWKO3XoTKky8og== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fwvp31e8s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:52:09 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67CBns5Q018709; Wed, 12 Aug 2026 11:52:08 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fxh0gdp7h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2026 11:52:08 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67CBq7lX20185810 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 12 Aug 2026 11:52:07 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F19B658043; Wed, 12 Aug 2026 11:52:06 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8BD3558059; Wed, 12 Aug 2026 11:52:04 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.9.29]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 12 Aug 2026 11:52:04 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v3 9/9] s390/vfio-ap: Fix memory leak when queue removed from host AP config Date: Wed, 12 Aug 2026 07:51:39 -0400 Message-ID: <20260812115139.576303-10-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260812115139.576303-1-akrowiak@linux.ibm.com> References: <20260812115139.576303-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=AMtp2X5w c=1 sm=1 tr=0 ts=6a7c5e69 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=VrB3zfVs-A4ss5GmTxoA:9 X-Proofpoint-GUID: Im-rOFBz3vu8Okc81MOT7B_QiF6wFYND X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX9YFRyhMjSRAe czUEz55XQEq4y04QB9TiS98fUSNkkx+JL4fMlWt4y6qleqjn2XWk4Lc1Hd5QWobzqOcnWqnCeeo m6bjAAF099jX2PpCyVaRJdj9UG8L0jqLImY8z6eF/heqbEt99GUjK5rLPBSZfvecntaow6rHiCr MqmWckDhkmixDGiUUA804gjg57PiJCOglrvBlyKxmmrJRG+/cS++G3Rmy6MUrrvK+8fCVpgOcUo 25QC/yUuZu7MZABNw6G0/HHm+VS17aaAn4ZA93FeDqEBXDNVRVx9Iboe3GvH5+mCByDtsJGC0Xy zeuZCkTn0NjqD6HJe6Jiwve89unRNUQoI2fQFaUZ2PCfwO2avaZ28gjGXjNmMJyh5dpy/sIKikg Gp5w88774fZjUrmvYbgh08DvYHomZaGi8JuA8bPjQIvLXcz1LftRqc2G/vsgRB47zt6UzSeOoCf wmcwMt46Kwu7iZQ27zA== X-Proofpoint-ORIG-GUID: Im-rOFBz3vu8Okc81MOT7B_QiF6wFYND X-Proofpoint-Spam-Info: AW1haW4tMjYwODEyMDA5MyBTYWx0ZWRfX86aNJ80iYsHH pVn1vRXzJfSTPfXtR5Yd9yg24XXmnm6nILXAiePf9SakJeNx+grCbS4bfJQDl/dKO203u6IUoP8 lFePjKCL7v7ed5azArQDDwsRv7Ody84= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-12_03,2026-08-12_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 phishscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608120093 Content-Type: text/plain; charset="utf-8" When an adapter or domain is removed from the host's AP configuration, the AP bus invokes vfio_ap_on_cfg_changed() to notify the vfio_ap device driver. For each ap_matrix_mdev object to which the adapter or domain is assigned, vfio_ap_mdev_hot_unplug_cfg() is called and removes the adapter or domain from the matrix_mdev->shadow_apcb (i.e., the guest's AP configuration) and hot unplugs it if a guest is using it. The new host AP configuration (sans adapter or domain) is then stored in matrix_dev->info. When the AP bus subsequently unbinds the physical queue devices associated with the adapter or domain that has been removed, it invokes vfio_ap_mdev_remove_queue() for each queue removed. At this point, the adapter or domain will no longer be assigned to the matrix_mdev->shadow_apcb or the matrix_dev->info object because they would have been removed by vfio_ap_on_cfg_changed(). Consequently, vfio_ap_mdev_reset_queue(q) is bypassed and kfree(q) is called without executing vfio_ap_free_aqic_resources(). This indefinitely pins guest memory (q->saved_iova) and leaks KVM GISC resources (q->saved_isc). Note that resetting the queue would fail with an invalid APQN error due to the fact the queue is not longer in the host's AP configuration; however, it is still necessary to free the AQIC resources. The fix here is to call vfio_ap_free_aqic_resources if the adapter or domain is neither in matrix_mdev->shadow_apcb or matrix_dev->info. Fixes: b9bd10c43456d ("s390/vfio-ap: do not reset queue removed from host c= onfig") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 3652ba792be7..faab5e9179ff 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2507,12 +2507,15 @@ void vfio_ap_mdev_remove_queue(struct ap_device *ap= dev) /* * If the queue is not in the host's AP configuration, then resetting * it will fail with response code 01, (APQN not valid); so, let's make - * sure it is in the host's config. + * sure it is in the host's config. If it is not, then free the KVM GISC + * resources. */ if (test_bit_inv(apid, (unsigned long *)matrix_dev->info.apm) && test_bit_inv(apqi, (unsigned long *)matrix_dev->info.aqm)) { vfio_ap_mdev_reset_queue(q); flush_work(&q->reset_work); + } else { + vfio_ap_free_aqic_resources(q); } =20 done: --=20 2.53.0