Re: [PATCH v4 6/9] s390/vfio_ccw: ensure index for read/write regions are within range

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing `cancel_work_sync` allows `crw_work` to execute after the device is freed, leading to a Use-After-Free.
--

--- Patch [6]: [PATCH v4 6/9] s390/vfio_ccw: ensure index for read/write regions are within range ---
commit 9f53752835377d5ad4247b37c995e0a1051a888e
Author: Eric Farman <farman@linux.ibm.com>

s390/vfio_ccw: ensure index for read/write regions are within range

This commit adds bounds checking for read/write region indices that were
missed during the capability chain introduction. It also applies
array_index_nospec to prevent speculative execution issues.

> diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
> index 45ec722d25ea6..032a1cdf4df70 100644
> --- a/drivers/s390/cio/vfio_ccw_ops.c
> +++ b/drivers/s390/cio/vfio_ccw_ops.c

[ ... ]

[Severity: Critical]
This is a pre-existing issue, but while reviewing the changes in
vfio_ccw_ops.c, I noticed a potential use-after-free in the device
teardown sequence.

In vfio_ccw_mdev_release_dev(), the private structure is freed, but there
doesn't appear to be a call to cancel_work_sync(&private->crw_work):

drivers/s390/cio/vfio_ccw_ops.c:vfio_ccw_mdev_release_dev() {
	struct vfio_ccw_private *private =
		container_of(vdev, struct vfio_ccw_private, vdev);
	struct vfio_ccw_crw *crw, *temp;

	list_for_each_entry_safe(crw, temp, &private->crw, next) {
...

Concurrently, if a channel path event triggers vfio_ccw_chp_event() just
before the private pointer is cleared, it can queue the work:

drivers/s390/cio/vfio_ccw_drv.c:vfio_ccw_queue_crw() {
    ...
	list_add_tail(&crw->next, &private->crw);
	queue_work(vfio_ccw_work_q, &private->crw_work);
}

Could this race allow the pending crw_work (vfio_ccw_crw_todo) to execute
after the private structure has already been freed, leading to memory
corruption when it accesses private->crw or private->crw_trigger?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725152705.3958100-1-farman@linux.ibm.com?part=6