Re: [PATCH v2 1/7] s390/vfio_ccw: free all memory if cp_init() fails

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] An untrusted guest can cause kernel stack exhaustion or memory exhaustion (OOM) by providing a channel program with a deeply nested, linear chain of Transfer in Channel (TIC) CCWs.
- [High] An off-by-one loop condition in `ccwchain_calc_length()` causes an out-of-bounds heap read.
--

--- Patch [1]: [PATCH v2 1/7] s390/vfio_ccw: free all memory if cp_init() fails ---
commit 6db32c0a42b6a98e43b665d960a38dfaf7572bca
Author: Eric Farman <farman@linux.ibm.com>

s390/vfio_ccw: free all memory if cp_init() fails

This commit updates cp_init() to address a memory leak when initialization
fails. It performs the cleanup outside of the recursive handling logic to
avoid leaking segments created by Transfer in Channel (TIC) commands.

> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> index 7561aa7d3e017..086d1b54bdb05 100644
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
> @@ -455,9 +455,6 @@ static int ccwchain_handle_ccw(dma32_t cda, struct channel_program *cp)
>  	/* Loop for tics on this new chain. */
>  	ret = ccwchain_loop_tic(chain, cp);
>  
> -	if (ret)
> -		ccwchain_free(chain);
> -

[Severity: High]
This is a pre-existing issue, but can this recursive call to
ccwchain_handle_ccw() cause kernel stack exhaustion?

Looking at ccwchain_loop_tic() in drivers/s390/cio/vfio_ccw_cp.c, it
recursively calls ccwchain_handle_ccw() for each forward-jumping TIC:

drivers/s390/cio/vfio_ccw_cp.c:ccwchain_loop_tic() {
        ...
        /* Build a ccwchain for the next segment */
        ret = ccwchain_handle_ccw(tic->cda, cp);
        ...
}

Since this happens without any depth tracking or overall chain count limits,
could an untrusted guest cause a panic or OOM by providing a channel program
with a deeply nested, linear chain of Transfer in Channel (TIC) CCWs?

[Severity: High]
This is a pre-existing issue, but does this off-by-one loop condition
in ccwchain_calc_length() cause an out-of-bounds heap read?

drivers/s390/cio/vfio_ccw_cp.c:ccwchain_calc_length() {
        ...
        } while (cnt < CCWCHAIN_LEN_MAX + 1);
        ...
}

If a guest VM supplies exactly 256 CCWs that all have the command-chaining
flag enabled, will the loop evaluate !ccw_is_chain(ccw) on the 257th
iteration?

This appears to dereference ccw one element past the allocated array on
cp->guest_cp, which could trigger memory debug splats or crashes.

>  	return ret;
>  }

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720201931.976660-1-farman@linux.ibm.com?part=1