From: sashiko-bot@kernel.org
To: "Anthony Krowiak" <akrowiak@linux.ibm.com>
Cc: linux-s390@vger.kernel.org,
"Alexander Gordeev" <agordeev@linux.ibm.com>,
"Christian Borntraeger" <borntraeger@linux.ibm.vom>,
"Vasily Gorbik" <gor@linux.ibm.com>,
kvm@vger.kernel.org, "Heiko Carstens" <hca@linux.ibm.com>
Subject: Re: [PATCH v4 6/9] s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
Date: Wed, 12 Aug 2026 17:17:18 +0000 [thread overview]
Message-ID: <20260812171719.714151F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260812170945.738351-7-akrowiak@linux.ibm.com>
> The DECLARE_BITMAP(apm_filtered, AP_DEVICES) macro allocates the bitmap
> on the stack without zero-initializing it.
>
> In vfio_ap_mdev_hot_plug_cfg(), the vfio_ap_mdev_filter_matrix() function
> is only called to initialize and populate apm_filtered if either
> filter_adapters or filter_domains is true. If the hot plug configuration
> change only adds control domains (meaning filter_cdoms is true, but
> filter_adapters and filter_domains are both false),
> vfio_ap_mdev_filter_matrix() is bypassed.
>
> Consequently, apm_filtered is passed to reset_queues_for_apids() with
> uninitialized stack garbage. This can cause reset_queues_for_apids() to
> interpret arbitrary stack garbage bits as valid APIDs to reset, potentially
> performing unintended guest hardware queue resets.
>
> Fix this by zero-initializing the apm_filtered bitmap at the beginning of
> vfio_ap_mdev_hot_plug_cfg() using bitmap_zero().
>
> Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complete notification")
> Cc: stable@vger.kernel.org
> Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260812170945.738351-1-akrowiak@linux.ibm.com?part=6
next prev parent reply other threads:[~2026-08-12 17:17 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-12 17:09 [PATCH v4 0/9] s390/vfio-ap: Fix bugs in vfio_ap device driver callback functions Anthony Krowiak
2026-08-12 17:09 ` [PATCH v4 1/9] s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Anthony Krowiak
2026-08-12 17:22 ` sashiko-bot
2026-08-12 17:09 ` [PATCH v4 2/9] s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Anthony Krowiak
2026-08-12 17:28 ` sashiko-bot
2026-08-12 17:09 ` [PATCH v4 3/9] s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects Anthony Krowiak
2026-08-12 17:28 ` sashiko-bot
2026-08-12 18:25 ` Anthony Krowiak
2026-08-12 17:09 ` [PATCH v4 4/9] s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Anthony Krowiak
2026-08-12 17:24 ` sashiko-bot
2026-08-12 17:09 ` [PATCH v4 5/9] s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove Anthony Krowiak
2026-08-12 17:19 ` sashiko-bot
2026-08-12 17:09 ` [PATCH v4 6/9] s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Anthony Krowiak
2026-08-12 17:17 ` sashiko-bot [this message]
2026-08-12 17:09 ` [PATCH v4 7/9] s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Anthony Krowiak
2026-08-12 17:24 ` sashiko-bot
2026-08-12 17:09 ` [PATCH v4 8/9] s390/vfio-ap: Fix NULL deref in status_show() during queue probe Anthony Krowiak
2026-08-12 17:27 ` sashiko-bot
2026-08-12 17:58 ` Matthew Rosato
2026-08-12 18:16 ` Anthony Krowiak
2026-08-12 18:56 ` Matthew Rosato
2026-08-12 17:09 ` [PATCH v4 9/9] s390/vfio-ap: Fix memory leak when queue removed from host AP config Anthony Krowiak
2026-08-12 17:38 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260812171719.714151F000E9@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=agordeev@linux.ibm.com \
--cc=akrowiak@linux.ibm.com \
--cc=borntraeger@linux.ibm.vom \
--cc=gor@linux.ibm.com \
--cc=hca@linux.ibm.com \
--cc=kvm@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.