From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1D732D060B; Tue, 28 Jul 2026 01:35:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785202518; cv=none; b=thyQ4+YJUAKTEPTGi4OKhzziVOge9UwJBhEOVAAOoGoOv+NWBWv8swGflqdkNjs4ixqEWk78yIAgDJK0TrDeklJ8kTsMDxTHFE1/pHBeugdySLoaaMSuIjoVNy4kCBpRX4DjU9T/LraKVXkGV1OBJR3NUpFArdrr4DOfz1jxjK8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785202518; c=relaxed/simple; bh=3EckSShkvG+H0FPgvbUGk1DwZ4vc5ZFCuqpJ/RHFI4A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hQKa6iW/KSDf7JaC5wfBA4zQccc7YZV/fyCu2Gz3Rr1xa1fzTA6VKPNaQ/Fslsj9Ifz8+LDK5nUOL90f/iL2cGpKqZrtFMSZkCSbYG7VxksDMQs+pvWtR/fmABCiYrvPrKTJFpSUjdMJMs6RG/rQokwt/KUrN1Xz0XSkc1W2fNU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=I5zxiEdt; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="I5zxiEdt" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66S0nCx63678115; Tue, 28 Jul 2026 01:35:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=xs+m2F3zNULxZt7Bf rTJdMKPsHk4cB+6uiMDMsph1T0=; b=I5zxiEdtoJadOqfwFGLNIV1j6hG5Vx7cf dDKkISKbt0HamoEyyLA/463G6HoxGazSo/X40scD88ZH6JO0BTW0gDx3IAAwTLGE VZm/pXeJqIigOW246yzVOzgnudpMBy4WaMbtnKgHaDht3GF8UIVOPSp5fH6ImZEl wLyH1j6aNd+WNSNq/hODx6VeEVFLT0I2ZD4ZngQR2ats5Y/NfmoCq4t8ygZeHWEX f2VJlOI5129D40BTBFAY5rUjzFQDg19am+i0BCg0lKa1Fw94EYg0UJVf7DbaVAAA uoXlPZJ6ttMIHz+TnKCx/ZNyIgvN7MIZTy8j4QtHZur3PaakgU25g== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuyj2ctg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 28 Jul 2026 01:35:15 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66S1QGc4014245; Tue, 28 Jul 2026 01:35:15 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fn8fjys78-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 28 Jul 2026 01:35:14 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (smtpav05.fra02v.mail.ibm.com [10.20.54.104]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66S1ZApF44433914 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 28 Jul 2026 01:35:10 GMT Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B3AF1200C6; Tue, 28 Jul 2026 01:35:10 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8FB10200C5; Tue, 28 Jul 2026 01:35:10 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav05.fra02v.mail.ibm.com (Postfix) with SMTP; Tue, 28 Jul 2026 01:35:10 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 76DD616281B; Tue, 28 Jul 2026 03:35:10 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v8 02/10] s390/vfio_ccw: limit the number of channel program segments Date: Tue, 28 Jul 2026 03:35:01 +0200 Message-ID: <20260728013509.1551753-3-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260728013509.1551753-1-farman@linux.ibm.com> References: <20260728013509.1551753-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-s390@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI4MDAwOSBTYWx0ZWRfX4VZvnZgfQyMZ J0wrwNKLpkNtod17TImG9rpArntqOA2d0eEPSo1YrcIB5aiUrL4PQUWRXVYTybzueg3reQz2/kF Yb/uUiVhxYURNGTNHZbXr8dp/KVRQgY= X-Proofpoint-GUID: J5S8ZTvQpnEZkixA14mNork4zW-EX-d_ X-Proofpoint-ORIG-GUID: J5S8ZTvQpnEZkixA14mNork4zW-EX-d_ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI4MDAwOSBTYWx0ZWRfXzHZWUg78wzWW hSF0cYE1gjHKYOvVUnjex/zILivRtpXXZPfdrzfVwRc1QP2BRPgo1049RcDQeUNaJOroFvMeAKi I//w3WUdxhNAOJa9Bab0y44qmB7PpSjYCy3Qg6+PUuLcwKk+CX8wdyHJI40Y35qXwKfO9ohrPRw 1WJM31P5DBH7RcJ3ek1B2v3hH4M0M+3ccscs6HOvZb/9dCyRofwEhEfl0Xp0zkMj3biPleXkWX7 gZNosZMRntF3tOtwDgr7ZMT0G4d4PlV99KqQ3MhyzXvrkXtTO1CF+f1iLLklXxyXiWl2K8zWqqO tkhDdTGptx5GoY+tHDbfCtJns/zCxAXxO/TEGCt8smvOa/3KTbXtaePeAQzfTSdhJjNB88sPiP4 mgHG7mSjzakIlFgY1XcZv7QUmpbmI+Fw8Zo4naGkGSVuunzHJ3hNkGMp6WVh9LXL6pJpQHHnQ/y HTg/AHXETR+h7jPrcAA== X-Authority-Analysis: v=2.4 cv=X5Vi7mTe c=1 sm=1 tr=0 ts=6a680753 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=sBi1HX8ECoo2m5KYV-oA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-27_07,2026-07-27_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 phishscore=0 priorityscore=1501 malwarescore=0 spamscore=0 suspectscore=0 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607280009 The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 6 ++++++ drivers/s390/cio/vfio_ccw_cp.h | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_c= p.c index 086d1b54bdb0..1c2890d139c6 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -332,6 +332,7 @@ static struct ccwchain *ccwchain_alloc(struct channel= _program *cp, int len) goto out_err; =20 list_add_tail(&chain->next, &cp->ccwchain_list); + cp->ccwchain_count++; =20 return chain; =20 @@ -441,6 +442,10 @@ static int ccwchain_handle_ccw(dma32_t cda, struct c= hannel_program *cp) if (len < 0) return len; =20 + /* Limit number of chains in a single channel program */ + if (cp->ccwchain_count >=3D CCWCHAIN_COUNT_MAX) + return -EINVAL; + /* Need alloc a new chain for this one. */ chain =3D ccwchain_alloc(cp, len); if (!chain) @@ -745,6 +750,7 @@ int cp_init(struct channel_program *cp, union orb *or= b) vdev->dev, "Prefetching channel program even though prefetch not specified in OR= B"); =20 + cp->ccwchain_count =3D 0; INIT_LIST_HEAD(&cp->ccwchain_list); memcpy(&cp->orb, orb, sizeof(*orb)); =20 diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_c= p.h index fc31eb699807..a9b1d8dbc6f6 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -23,11 +23,18 @@ */ #define CCWCHAIN_LEN_MAX 256 =20 +/* + * Maximum number of chains + */ +#define CCWCHAIN_COUNT_MAX 16 + /** * struct channel_program - manage information for channel program * @ccwchain_list: list head of ccwchains * @orb: orb for the currently processed ssch request * @initialized: whether this instance is actually initialized + * @guest_cp: copy of guest channel program + * @ccwchain_count: number of channel program segments (linked by TIC) * * @ccwchain_list is the head of a ccwchain list, that contents the * translated result of the guest channel program that pointed out by @@ -38,6 +45,7 @@ struct channel_program { union orb orb; bool initialized; struct ccw1 *guest_cp; + unsigned int ccwchain_count; }; =20 int cp_init(struct channel_program *cp, union orb *orb); --=20 2.53.0