Re: [PATCH v7 01/10] s390/vfio_ccw: free all memory if cp_init() fails

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Unbounded mutual recursion between `ccwchain_handle_ccw()` and `ccwchain_loop_tic()` allows guest-triggered host kernel stack exhaustion.
--

--- Patch [1]: [PATCH v7 01/10] s390/vfio_ccw: free all memory if cp_init() fails ---
commit 13d15b9ae0c6f03c0097ee35d98be7a7415af06e
Author: Eric Farman <farman@linux.ibm.com>

s390/vfio_ccw: free all memory if cp_init() fails

This commit updates the cleanup logic during channel program initialization
to prevent memory leaks. It extracts the memory freeing into a separate loop
over the allocated segments rather than handling it inside the recursive
ccwchain_handle_ccw() function.

> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
> @@ -455,9 +455,6 @@ static int ccwchain_handle_ccw(dma32_t cda, struct channel_program *cp)
>  	/* Loop for tics on this new chain. */
>  	ret = ccwchain_loop_tic(chain, cp);

[Severity: Critical]
This isn't a bug introduced by this patch, but does this mutual recursion
have a depth limit?

If a guest provides a channel program with a long, nested sequence of
Transfer in Channel (TIC) commands, each pointing to a new CCW chain,
the execution path appears to cycle endlessly between these two functions:

ccwchain_handle_ccw()
  -> ccwchain_loop_tic()
    -> ccwchain_handle_ccw()

Could this unbounded recursion exhaust the host kernel stack?

> -	if (ret)
> -		ccwchain_free(chain);
> -
>  	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727192230.2715207-1-farman@linux.ibm.com?part=1