From nobody Mon Sep 28 08:01:29 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B26CF4334DD; Mon, 24 Aug 2026 13:59:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579949; cv=none; b=Hd0KvSTrI3Y/4yEXJBJ57rcj1TV5LqX4Ln5fB2uuEV3n+wSdzCYUfGg1QGVfmVUCm5a8zljma8YXqtxdqBPqkL8Tg7/IrCn/lRXxd9p2DqwDsbuH+PZVFTGwglCgIZXBU1g3hAwVFc19OlkAelrqdZ/NQwPCveO36ZUz6igvgak= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579949; c=relaxed/simple; bh=GA58i5yZ7Fz6R/VnbhzSvSFWJgxbSv2V4tpNwTktvHQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HOJXI20aMgO+0CUXIoYl6GJA6p2UHVwlKQ3yqQjgbbKdR49wgGzYBveSR92YDkFKHO1hcnWOYRnJhYY+cr3glYL26PXjFMB9SevZbUe0QDtQQJ1+3bFeSQRpF9sr4g2P8N8NwhEd475Gj9N3YZBbkZo8gRVFFV3Dut/2oLnlpwE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=rvqMp8hc; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="rvqMp8hc" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67OD1aZ41935920; Mon, 24 Aug 2026 13:58:57 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=jNVl2s8E0X9TeiljZ VY6AVLigeFaTta/cQHrRX4/+XA=; b=rvqMp8hcr2CHjr+Wd4TBjS9KleffwsGjJ hFyaCRZTtt/5reLAKb6dC4/HMA1lHurQ6Yu4xfYRC8/Sm3ttClJW2G6dAHVAfHHJ DqcU8EIu72Fd1zS4G00O0/2t9Rep0XWLKoLEFXJA/rsYuXIqypI9u3pSXIYs8mSU SjL1PLCTD9OVto43aGK9Z6TofS4WqVu+bCbxc3z9GxzPSvzupG1bJkEHLYV+Nlgj gvAe+yTbACx2nr0wi8xVxYuJSbNHJCbjFiU85Bew14xJeIoU+iHMp3Qhvk1zZlKH nAxDWRsgOgGfekLXIFN1kblYwrHBYKYHshq7kngNjwtgYlErvnR8Q== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g7393srk4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Aug 2026 13:58:57 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67ODuMZr016699; Mon, 24 Aug 2026 13:58:56 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4g7p3pxehb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Aug 2026 13:58:56 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67ODwtsg40435978 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 24 Aug 2026 13:58:55 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2016D58054; Mon, 24 Aug 2026 13:58:55 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 52ADF5803F; Mon, 24 Aug 2026 13:58:53 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.96.163]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 24 Aug 2026 13:58:53 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH 1/4] s390/vfio-ap: Fix leak of pinned NIB and registered NISC in vfio_ap_irq_enable() Date: Mon, 24 Aug 2026 09:58:47 -0400 Message-ID: <20260824135850.503728-2-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260824135850.503728-1-akrowiak@linux.ibm.com> References: <20260824135850.503728-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: TzT7Hpaed7qz90igUyVS798thvl0GHCl X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODI0MDExNCBTYWx0ZWRfX/ElyCbbiHjfh E4tryVrSAjANoJWETnzpPMGHRcpW+ec8RvOMdfZoQYGs8PaHfF4ZRaEkglrPCrxz5N5piJxZS1O zRU7FtJBHQvvQRRwZD+KU7Rc/xT0A6pB9XwRetily3IrwhdksaoFLNcv3++aqyPZ021wRr8Nt1W KFyC8VZRiT97y0ecjtfxecMejTFtp4BNDO9ISkAVLRbNC0ncZccGvEIj4jfC42GkPjxWTNwr5R5 knaBUWjg+67kgIVMAGaM5Al+FiBdWnVnKL4MTEac7cQgR3QxxWqKYh0ku3I50ItR3iLvVrl2lLq dzpoih2J2icMIGoq1S4Y/6vEn0EQURuAxIPDYMk+6CVvkhylI80yRAm6t9j9ldsjqHEuu0LvwyL l0Z6fc/nodyRxWumydljxibDgbGAydKkCswhiH+b+K3VdixhTtg3jrYBO5yvIDabsi9Ps81AyfE 2KvH9hMsg3rb+C9qr8Q== X-Authority-Analysis: v=2.4 cv=Y/nIdBeN c=1 sm=1 tr=0 ts=6a8c4e21 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=hmEx05nRRPonxVd58HoA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwODI0MDExNCBTYWx0ZWRfXy0pBSlw6vO5Z t0ZTmTkQ92+9Tqwtjw/N5is8z5yLjm3AxxTKynMrbh63Hc0Dc1SH0kfKDEcTnZ+cE+HViMb3AMA Om4NOtGa9CfW+Yu1PsxzNs/+mGzqWKs= X-Proofpoint-ORIG-GUID: TzT7Hpaed7qz90igUyVS798thvl0GHCl X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-24_04,2026-08-24_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 impostorscore=0 priorityscore=1501 adultscore=0 bulkscore=0 suspectscore=0 malwarescore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608240114 Content-Type: text/plain; charset="utf-8" The vfio_ap_irq_enable() function executes the PQAP(AQIC) instruction to enable interrupts for an AP queue. A switch statement is used to examine the status response code returned from the instruction to determine whether it succeeded or failed and react accordingly. For the default case, the vfio_ap_irq_disable function is invoked to disable interrupts for the queue and clean up the AQIC resources (i.e., unpin the NIB and unregister the NISC). There are a number of problems with this: 1. Neither the q->saved_iova nor q->saved_isc has been set, so the AQIC resources - assuming those values have been previously set - will be the NIB and NISC resources from a prior call; the NIB and NISC from the current call are therefore leaked. 2. Interrupts may never have been enabled. Sending a disable instruction to a queue that the hardware just told you is in a bad state (CHECKSTOPPED, DECONFIGURED, Q_NOT_AVAIL) is at best wasted work and at worst generates a further WARN_ONCE from inside vfio_ap_irq_disable's own default. 3. The hardware just rejected the new ap_aqic() enable attempt with an unexpected status. Disabling a previously-working IRQ config - assuming that is even possible - as a reaction to a failed enable attempt does not make sense; it is actively destructive, tearing down something that was working for no valid reason. The fix is to unregister the NISC and an unpin the NIB in the default case of the switch statement. Fixes: ec89b55e3bce7 ("s390: ap: implement PAPQ AQIC interception in kernel= ") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 940c0ff668be..a46bf381ab72 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -503,9 +503,14 @@ static struct ap_queue_status vfio_ap_irq_enable(struc= t vfio_ap_queue *q, vfio_unpin_pages(&q->matrix_mdev->vdev, nib, 1); break; default: - pr_warn("%s: apqn %04x: response: %02x\n", __func__, q->apqn, - status.response_code); - vfio_ap_irq_disable(q); + pr_warn("%s: PQAP(AQIC) failed with response code %02x for apqn %04x\n", + __func__, status.response_code, q->apqn); + /* We could not modify IRQ settings: clear new configuration */ + ret =3D kvm_s390_gisc_unregister(kvm, isc); + if (ret) + VFIO_AP_DBF_WARN("%s: kvm_s390_gisc_unregister: rc=3D%d isc=3D%d, apqn= =3D%#04x\n", + __func__, ret, isc, q->apqn); + vfio_unpin_pages(&q->matrix_mdev->vdev, nib, 1); break; } =20 --=20 2.53.0 From nobody Mon Sep 28 08:01:29 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 712E5432E88; Mon, 24 Aug 2026 13:59:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579954; cv=none; b=JVA4s0FmwTkyxFsjUWZLzLzsXEX8l0CKsiAUWSvtKiJGkLUhCb797usJLf2oX27XwA0KcGuOa4bu1GkObOQ7Jlw0XV4qeSJczvdZ657fW8Xti1uVEVgyt+r+P+SvdwMtOTRXenLhx6nfFE5RgwE8gSVCrlvzrFQiAQuEKurLYKQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579954; c=relaxed/simple; bh=XXtmnDfwYTodPcMZKFOIcacIIohd9GCe22AtPfkThQ8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mf/jgHszIILCNxeYWGWcttIQe25MBI6UAyeQD8Jp8d5ak4o/wpKGyRyMNLkSNsE4+oaf69ijQ1ZFXKjxX6r7N9sXrELs6rvqEv/mCwLL3WHFjAZfsNlXMq7eY7KaNu3hSVCc7H/G+0KAwfl8HoQDVFVXpoDzJxrTt3VyhPkxxQg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=TQ/gKgbj; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="TQ/gKgbj" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67OD1VtN1957870; Mon, 24 Aug 2026 13:59:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qZUeMgb1W4+SPBxla h6XajW2IJAVLCcC32aHn5cZhrY=; b=TQ/gKgbjwKOPWK3AzwP0nRcGJOXdE2gRF bsHM/75G58PvlmNtat2K0+yC4K/5kFn8M9VduURiXN7kxcVqIqnCWuQnCftrRdPd IerWXsuek0YbhqWOfnXVngWY5aBh9nY6wtKfvaWaUDl7NxCflw52kWqVVGxKs+rn optdGrLrsCzuTzoTmNUaxuyOM7Sgo68AuNtgj/jWGzdk6IyvvLYHcqHBfeX8+Av4 CpRu7NhowLsSLP8PjfSWBTPAluqXIFgAdJWBBer6O4X0xPiH9qVqqtZwjtAvtwrf mDQS0bAHQK3BQKQtneJPqSBjDLnfWWtIRaVj5bOeQMW3dWSBpJ2lw== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g73g4hq62-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Aug 2026 13:58:59 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67ODuMSP021047; Mon, 24 Aug 2026 13:58:58 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4g7pfvxcg4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Aug 2026 13:58:58 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67ODwv0H61735180 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 24 Aug 2026 13:58:57 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1A1B358060; Mon, 24 Aug 2026 13:58:57 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4EA7D5804E; Mon, 24 Aug 2026 13:58:55 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.96.163]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 24 Aug 2026 13:58:55 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH 2/4] s390/vfio-ap: Fix failure to release IRQ notification eventfd contexts Date: Mon, 24 Aug 2026 09:58:48 -0400 Message-ID: <20260824135850.503728-3-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260824135850.503728-1-akrowiak@linux.ibm.com> References: <20260824135850.503728-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: t4EHuisXsMPHO_LB4vUtA5UHP2mBjE28 X-Proofpoint-Spam-Info: AW1haW4tMjYwODI0MDExNCBTYWx0ZWRfXxcwXronxS+wc pbvWNYfI5MrfwFGEiJXssqzayU/PdUDse2w/12sZXOJcr7i+HukpWdkU0VVsUH3dX+dLX2teg/r reA9ObLOBt2SetpplDx1f0pr+YVcKDc= X-Proofpoint-GUID: t4EHuisXsMPHO_LB4vUtA5UHP2mBjE28 X-Authority-Analysis: v=2.4 cv=JZyMa0KV c=1 sm=1 tr=0 ts=6a8c4e23 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=fxeDLeT5AZ2qCvnLJ4gA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODI0MDExNCBTYWx0ZWRfX+fj7riCi2qda nTWHSyJmnntyhjHbqXKLz/SBmKDPfInIRFBIl32irwBrcmoSEQZT7w58T0TkcK99trjlmBYagoK JZmWLBQOhSBh/Pf7e0lEMzAB24yW0jBzy6fXm3T+thpalNZEy+IeH1VepAm6MFhmOEZXiSaCDI3 t32L1PwWmYBP9pajxsN9u5bgqbcjsPplKThKqt17wJze9yt2EmLEm076x7JWme/AnFbv0wLuCio KZxlV1mJP6Th0QuUjdIdaGltNQK28LcAHjB74FJ5ipMmr8d8jQ1y7bPrJ2YSFYhttrIbQW1sV+V zmmThk5uVV9KqyT0qlcG85iKHMb/M4yj6d/YKSpRZi+kZt8XMPFhIB39M9wRWpvDNMPpUmXjEwu 2mlpZv5qwO005aTucDlNLV69+2dhYFPAdY4zTdhvudbL83aYQW5AGs0pZQk9Ui0CJysoe3Hxxrv TXLhE9p6QZ76iMFsKRg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-24_04,2026-08-24_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 clxscore=1015 adultscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608240114 Content-Type: text/plain; charset="utf-8" When userspace registers IRQ notification eventfds via the VFIO_DEVICE_SET_IRQS ioctl, vfio_ap_set_request_irq() and vfio_ap_set_cfg_change_irq() each call eventfd_ctx_fdget(), which takes a reference on the eventfd_ctx and stores it in matrix_mdev->req_trigger and matrix_mdev->cfg_chg_trigger respectively. These references are dropped only when userspace explicitly replaces or clears them via a subsequent SET_IRQS call. If the device is closed without that explicit teardown - because the guest exits, the VM process crashes, or the device file is simply closed - neither vfio_ap_mdev_close_device() nor the remove path releases these references. The eventfd_ctx backing objects and their associated file references therefore leak for the lifetime of the kernel. Fix this by introducing vfio_ap_mdev_release_eventfds() and calling it from vfio_ap_mdev_close_device() after vfio_ap_mdev_unset_kvm(). The VFIO core guarantees that close_device is called before vfio_unregister_group_dev() returns in the remove path, so fixing close_device is sufficient to cover both teardown paths. Note: ~~~~ The matrix_dev->mdevs lock must be held during the call to vfio_ap_mdev_release_eventfds(). There is a small window between the calls to vfio_ap_mdev_unset_kvm() which gets and releases the update locks and the acquisition of the matrix_dev->mdevs_lock mutex during which it is possible - although highly unlikely during normal operation - whereby a concurrent SET_IRQS call can get in. Taking matrix_dev->mdevs_lock around vfio_ap_mdev_release_eventfds() is sufficient to make this race-free. The SET_IRQS ioctl path writes req_trigger and cfg_chg_trigger only from vfio_ap_mdev_ioctl(), which holds mdevs_lock for its entire duration and always calls eventfd_ctx_put() on the previous value before storing the new one. Any number of concurrent SET_IRQS calls during the window between vfio_ap_mdev_unset_kvm() and the acquisition of mdevs_lock are therefore safe: each ioctl invocation puts the reference it found and installs a new one, leaving exactly one live reference in the field when it releases the lock. When release_eventfds subsequently acquires mdevs_lock it finds that single surviving reference and puts it. Conversely, a SET_IRQS call that loses the race and blocks on mdevs_lock will find the field NULL after release_eventfds finishes, take ownership of the reference it just created, and install it into a field that will never be read again - a transient leak. To close that final case, callers must ensure no new SET_IRQS ioctls can be issued after close_device() is called, which the VFIO core guarantees by releasing the device file before invoking close_device(). Fixes: bf48961f6f48e ("s390/vfio-ap: realize the VFIO_DEVICE_SET_IRQS ioctl= ") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index a46bf381ab72..6e4569d6b975 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2066,12 +2066,28 @@ static int vfio_ap_mdev_open_device(struct vfio_dev= ice *vdev) return vfio_ap_mdev_set_kvm(matrix_mdev, vdev->kvm); } =20 +static void vfio_ap_mdev_release_eventfds(struct ap_matrix_mdev *matrix_md= ev) +{ + if (matrix_mdev->req_trigger) { + eventfd_ctx_put(matrix_mdev->req_trigger); + matrix_mdev->req_trigger =3D NULL; + } + if (matrix_mdev->cfg_chg_trigger) { + eventfd_ctx_put(matrix_mdev->cfg_chg_trigger); + matrix_mdev->cfg_chg_trigger =3D NULL; + } +} + static void vfio_ap_mdev_close_device(struct vfio_device *vdev) { struct ap_matrix_mdev *matrix_mdev =3D container_of(vdev, struct ap_matrix_mdev, vdev); =20 vfio_ap_mdev_unset_kvm(matrix_mdev); + + mutex_lock(&matrix_dev->mdevs_lock); + vfio_ap_mdev_release_eventfds(matrix_mdev); + mutex_unlock(&matrix_dev->mdevs_lock); } =20 static void vfio_ap_mdev_request(struct vfio_device *vdev, unsigned int co= unt) --=20 2.53.0 From nobody Mon Sep 28 08:01:29 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2DB14433059; Mon, 24 Aug 2026 13:59:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579950; cv=none; b=GzTUU7UlVec0rNWf2dElMA0GvHgf0sMkpwsNdHdxsIHyLAzd3P20ibrZq0ZbxEg6zk8bNeNz93oMV//fxHYHzrqL/ia1lAJvlbbjSz1LzOiz7ZeQWdGI6+KXrtB3qyB598NWbIWVkr30SUWya+Nal8yCzbgaU5Ghgu2aFjIDUsk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579950; c=relaxed/simple; bh=z7XaBpLRVHhbKsLRsvraBZQSzuXhG8LXWCQZh0ebOtM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=a7C2Weve7DWgdwxxRQeVA2nmiU3z4bvSdZX3Atr2QqR2LQrLLfW3jDN/PIpfnXPggFmW41eFs3/NMXNAi9VRLcD32uqQffNOS8NK9KBOlQ0frXxyEjSMGPwpuxyHXPq12IAv9/BT5hbfI4qfydgVLpvlGf9qmnaIovC55g0IM5w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=fI+1fUTW; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="fI+1fUTW" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67OD1fCB1958092; Mon, 24 Aug 2026 13:59:01 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=6OkkulEj2lwC+ZmQR X7bPTmTwcxpIn543p9y/SQLe10=; b=fI+1fUTWjrW9wQa0ilRaCkPGHkOKwH5PN 4rMSCHi/WHuQom68TMBtb++vVltUckpyLspdfJ4yNzJ8uPO6Huw+sYt9S8az0rLU SjGLVIWwh5f36WRSEUXd3wfWrKGm0WJrAQfFEuUMie/nQv1VCioOLQLFBX3WUMbD Nstb38Y0hLF9Eg0S6SY3hNobnEscfCuohr0KOD86d5TSvFRB8CKe4HnNj54eUwfZ Fl9qjmdb7wfDYu417+3KhsFiMPDxVxGvojmiArWoC6MKDdpSeeYJ512Xn66C543h YSXofw3PqLl6Zt+W2TSmYsZFfdvW5Bt9CxkTFiTgooLnmLFXa95Aw== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g73g4hq68-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Aug 2026 13:59:01 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67ODuIvX030621; Mon, 24 Aug 2026 13:59:00 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4g7rag636r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Aug 2026 13:59:00 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67ODwxKe3539676 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 24 Aug 2026 13:58:59 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 26B1B58054; Mon, 24 Aug 2026 13:58:59 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 482FB58056; Mon, 24 Aug 2026 13:58:57 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.96.163]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 24 Aug 2026 13:58:57 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH 3/4] s390/vfio-ap: Fix unbounded loop in apq_reset_check() Date: Mon, 24 Aug 2026 09:58:49 -0400 Message-ID: <20260824135850.503728-4-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260824135850.503728-1-akrowiak@linux.ibm.com> References: <20260824135850.503728-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: VU5VNhRIiXafo0sYIdv1UTAFMIRjWb8M X-Proofpoint-Spam-Info: AW1haW4tMjYwODI0MDExNCBTYWx0ZWRfX5hkmW1n+CZtQ IjBtsrYELkfPxsVIujarHC3uFHdSL8pJ90hXJNauxYZexN6FtVlV0kT957/TJB+zez1ywGNbHfJ Ry7Tqn1vFE1deYIEJsUIHfuIS7CuAWg= X-Proofpoint-GUID: VU5VNhRIiXafo0sYIdv1UTAFMIRjWb8M X-Authority-Analysis: v=2.4 cv=JZyMa0KV c=1 sm=1 tr=0 ts=6a8c4e25 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=KD7G0zD2dsexTIroXy8A:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODI0MDExNCBTYWx0ZWRfXxizVBYhFKV9o FwwiYxOfDYvl5IkpVqeRlGP3HkHXXZb/tg+BIHEzDzfXpF3U4zFv3lGxKnh1YZb7ZfvuhXaEBhh 6ovJRD/ODZnSRP+rwDR91l248/Y1ShKZOSwEU+SKWAXF0sMZyeeyp3DHFZUodoUFKS2cg1yWXAi 2p/DuRDeRdYlMz7X76eVoq4BTbTMFNyX90K09+8/sUVKJzWnNdvK/Hxb+aXWJlK0Yi8gqBKm8BC pQ/ruHRUih9aeNogsBaIMMVBLflfvjeXU//4sNxV0Nvkgbo7Isy2dny89Pt3c6RHhKrPSlsFJO9 XrXwkdsRNP/q5TYi97sKUrrBnH/UGIW30YEhaa3uGhbNkim/CnHG1fIfvIPF8k1prmlTZDhwzZk Ip8d6kvrcvDrQIYTP5eeZIi+Wdxs48BQzSvl38agoGeBkz80eEEFs3YmT1ESxXdL8cVUMmd546a /WjZ8JySgcr+zQPndRg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-24_04,2026-08-24_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 clxscore=1015 adultscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608240114 Content-Type: text/plain; charset="utf-8" The apq_reset_check() worker polls ap_tapq() in a while(true) loop waiting for a queue reset to complete. When ap_tapq() returns AP_RESPONSE_BUSY or AP_RESPONSE_RESET_IN_PROGRESS, apq_status_check() returns -EBUSY and the loop continues after sleeping AP_RESET_INTERVAL (20ms). There is no upper bound on how many times the loop iterates, so if the hardware continuously returns a busy response the worker runs indefinitely. This is particularly harmful because several callers of vfio_ap_mdev_reset_queues() and vfio_ap_mdev_reset_qlist() call flush_work() on each queue's reset_work while holding one or more of the global matrix_dev locks (guests_lock, mdevs_lock) or the KVM lock. An indefinitely spinning worker permanently blocks all of those locks, hanging mdev removal, KVM guest teardown, and the VFIO_DEVICE_RESET ioctl path. Fix this by introducing AP_RESET_TIMEOUT (2000ms) and breaking out of the poll loop when elapsed time reaches that threshold. On timeout the final busy status is written back to q->reset_status so that callers inspecting reset_status.response_code after flush_work() see a non-zero value and can return an appropriate error. vfio_ap_free_aqic_resources() is called before returning to release any KVM ISC registration and pinned NIB page, consistent with all other early-exit paths in the function. Fixes: dd174833e44e ("s390/vfio-ap: remove upper limit on wait for queue re= set to complete") Cc: stable@vger.kernel.org Signed-off-by: Anthony Krowiak --- drivers/s390/crypto/vfio_ap_ops.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index 6e4569d6b975..c7eebbd0ed40 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -31,6 +31,7 @@ #define AP_QUEUE_IN_USE "in use" =20 #define AP_RESET_INTERVAL 20 /* Reset sleep interval (20ms) */ +#define AP_RESET_MAX_WAIT 2000 /* Maximum wait for reset (2000ms) */ =20 static int vfio_ap_mdev_reset_queues(struct ap_matrix_mdev *matrix_mdev); static int vfio_ap_mdev_reset_qlist(struct list_head *qlist); @@ -1973,6 +1974,12 @@ static void apq_reset_check(struct work_struct *rese= t_work) status.response_code, status.queue_empty, status.irq_enabled); + if (elapsed >=3D AP_RESET_MAX_WAIT) { + /* Timed out waiting for reset to complete */ + memcpy(&q->reset_status, &status, sizeof(status)); + vfio_ap_free_aqic_resources(q); + return; + } } else { if (q->reset_status.response_code =3D=3D AP_RESPONSE_RESET_IN_PROGRESS = || q->reset_status.response_code =3D=3D AP_RESPONSE_BUSY || --=20 2.53.0 From nobody Mon Sep 28 08:01:29 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 77F8343440B; Mon, 24 Aug 2026 13:59:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579954; cv=none; b=Alfbrbhe+6Iy1LLASF5Yn5FPfrwOIlVUBFUNkjfPI25NcDHI9fdT+kyRAVryZJTK3Ks6+6wDOS2XyMguUnJq2Gx4tUpDxaafZIk0h7N/OWjjpLeAGkIawmu6GYE2+qAobF6mRBSkuQEmcWdhBJnW39/LuiDHJxoi6nZ7HFYh7is= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579954; c=relaxed/simple; bh=u5PcjXXMkyrMbwr9ocAZBcB3+1JFv7Uh1wjohG7yBkE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=owPyz/7CWN0Q5nhHXk/dlAILnyRdSa5BjoyyfvCdxmlLnoW7xnoBxKQVjPO/Tzesa849Fs1OsoHa+0DD3gOtMReA6NtVFYYFHQrxe1nxbcBXCQv7J13zroYi3/q/1IHlD2lTfQS1VzcNmYGMkmF8xvRqFDaVVmspvPTqdtjK0p8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=hm+l6Mpf; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="hm+l6Mpf" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67OD1igo1936424; Mon, 24 Aug 2026 13:59:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=idf93AL5F33fKA9JO S4Nfr/QILfiPdquLMsyaOH1PNA=; b=hm+l6MpfCIEDcFQ3QcLmjqrSk0SKvwKLD r0k6SfLMGJJkfvLiMWGlXThMaDI9gjY0IF7GWCGSY41ZxsQPbpyJ9/UQ2J+Dz7w1 gvPejbjHvBF7kXGLvFU583dWf173N3IPeABthNZg/uXVOjzZXfoGz64nGnQgKNUs 4suzQ81CUHI28+Tz6dkaXRD/Ya63PG47ftxnATXTtdkNZ1250ucVXfAC8VxlxYkp fIMcxcxWsXWOP0KdpmksUeA8pFsf1Z+q/b3bAcOfJzQfT8+YIwQp4baEdiYLGtB6 Ci234YYumJF2SQQv7AstR/YdUODsM6aHs3tB7RO/dW8VGu1dyIrCQ== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g7393srkq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Aug 2026 13:59:03 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67ODuWcY017298; Mon, 24 Aug 2026 13:59:02 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4g7q3jp8yn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Aug 2026 13:59:02 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (smtpav06.wdc07v.mail.ibm.com [10.39.53.233]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67ODx1KS58196356 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 24 Aug 2026 13:59:01 GMT Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 377295804E; Mon, 24 Aug 2026 13:59:01 +0000 (GMT) Received: from smtpav06.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 54DEE58055; Mon, 24 Aug 2026 13:58:59 +0000 (GMT) Received: from li-4c4c4544-004d-4810-8043-b7c04f423534.ibm.com.com (unknown [9.61.96.163]) by smtpav06.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 24 Aug 2026 13:58:59 +0000 (GMT) From: Anthony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: jjherne@linux.ibm.com, borntraeger@de.ibm.com, mjrosato@linux.ibm.com, pasic@linux.ibm.com, alex@shazbot.org, kwankhede@nvidia.com, fiuczy@linux.ibm.com, pbonzini@redhat.com, frankja@linux.ibm.com, imbrenda@linux.ibm.com, agordeev@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com Subject: [PATCH 4/4] s390/vfio-ap: Use AP_DOMAINS for adm_add bitmap size in vfio_ap_mdev_cfg_add() Date: Mon, 24 Aug 2026 09:58:50 -0400 Message-ID: <20260824135850.503728-5-akrowiak@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260824135850.503728-1-akrowiak@linux.ibm.com> References: <20260824135850.503728-1-akrowiak@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: BbsvJdAyeqtrO72r2GHyiwLD9ZlKmjBf X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODI0MDExNCBTYWx0ZWRfX0fQSVntsRA4N 1eisFPA+qWUa84JoNrE6b3oSQpFME6R5LvZnvNGqZ3Qf0JX7PYOTLx6pbKy+JjyfKLr4s+MXFBL TjIvVmomUem7ftZBC2D2klNJoWeBt8SbYLfgXDwKLnfOjwGPqFdixEFUvwYbNjSnO+zaM+lH7aG jMO4wKcs1gdUhIqti0BW5pqc+PR9x5b3DDUE1yph4S2TW34heUPX9phBAkzxPUU2IfLPKXI3RIy GBHm+mJLhQeWyOgqD7/HE+2Nxle3RGcT61jh6nL4UTWMUFeVFOajgMnS7MAbtsCNki0KMxeSXxF ScJgiE4CyxXQJ5n3NiOSTbG53far7223guxbsp7KJd3APWZthW01vqthAbiwBslVHx59R6Iw8iT tV009XyaBOzS5YXxqtJkfES568+UDkGal22i6N7Xx7QLlizdb74mX1RBri5BTcnu9VC95SAvtu7 m5aI3o/6HQOkOuaLHkA== X-Authority-Analysis: v=2.4 cv=Y/nIdBeN c=1 sm=1 tr=0 ts=6a8c4e27 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=Bc7Uef-wSWuaPYxFuNwA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwODI0MDExNCBTYWx0ZWRfX3yiOUvHGsRAO lraBflxWe14RaL5hD6uBBXmrSiNuFHCzsa/GWOfqgS4KcaDko2rXymbNVq95YfmSGYRtkUr1gc6 XdQ5HstB8yl2H8qyh+kXaxCenH5JSZA= X-Proofpoint-ORIG-GUID: BbsvJdAyeqtrO72r2GHyiwLD9ZlKmjBf X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-24_04,2026-08-24_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 impostorscore=0 priorityscore=1501 adultscore=0 bulkscore=0 suspectscore=0 malwarescore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608240114 Content-Type: text/plain; charset="utf-8" In vfio_ap_mdev_cfg_add(), the bitmap_and() call that computes the intersection of newly added control domains with those assigned to each matrix mdev passes AP_DEVICES as the bitmap size instead of AP_DOMAINS: bitmap_and(matrix_mdev->adm_add, matrix_mdev->matrix.adm, adm_add, AP_DEVICES); Control domains are indexed by AP queue index (APQI) and their bitmaps are sized by AP_DOMAINS, not AP_DEVICES. The two constants are both 256 today so there is no functional impact, but the wrong constant is inconsistent with the two bitmap_and() calls immediately above it and with every other operation on adm/aqm bitmaps in the file, all of which correctly use AP_DOMAINS. Use AP_DOMAINS to keep the code consistent and correct in case the two constants ever diverge. Signed-off-by: Anthony Krowiak Reviewed-by: Jason J. Herne Reviewed-by: Matthew Rosato --- drivers/s390/crypto/vfio_ap_ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_a= p_ops.c index c7eebbd0ed40..e62e0dfa7282 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -2840,7 +2840,7 @@ static void vfio_ap_mdev_cfg_add(unsigned long *apm_a= dd, unsigned long *aqm_add, bitmap_and(matrix_mdev->aqm_add, matrix_mdev->matrix.aqm, aqm_add, AP_DOMAINS); bitmap_and(matrix_mdev->adm_add, - matrix_mdev->matrix.adm, adm_add, AP_DEVICES); + matrix_mdev->matrix.adm, adm_add, AP_DOMAINS); =20 mutex_unlock(&matrix_dev->mdevs_lock); } --=20 2.53.0