Re: [PATCH v1 2/6] s390/vfio_ccw: limit the number of channel program segments

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] A memory leak in the channel program translation error path allows an unprivileged guest to deterministically exhaust host kernel memory.
--

--- Patch [2]: [PATCH v1 2/6] s390/vfio_ccw: limit the number of channel program segments ---
commit 60b67e17bbec7656c3dc68a47e90805965d6fb93
Author: Eric Farman <farman@linux.ibm.com>

s390/vfio_ccw: limit the number of channel program segments

The processing of channel programs, and the CCWs within them, is done
recursively. As such, there is an arbitrary (but not architectural)
limit to the number of CCWs that can exist in a single channel program.

The vfio-ccw logic breaks these channel programs into segments whenever
it encounters a Transfer-In-Channel (TIC) CCW, and the combined number
of segments count towards the global limit. Impose an equivalent limit
to the number of segments until such logic can be made non-recursive.

> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> index 80c3d87f54822..76632b18fc37c 100644
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
> @@ -319,6 +319,9 @@ static struct ccwchain *ccwchain_alloc(struct channel_program *cp, int len)
>  {
>  	struct ccwchain *chain;
>  
> +	if (cp->ccwchain_count >= CCWCHAIN_COUNT_MAX)
> +		return NULL;
> +
>  	chain = kzalloc_obj(*chain);
>  	if (!chain)
>  		return NULL;

[Severity: High]
This is a pre-existing issue, but does this new limit make a memory leak
trivial for an unprivileged guest to trigger?

If a guest constructs a channel program with multiple Transfer-In-Channel
(TIC) CCWs, an early TIC might successfully allocate and link a chain into
cp->ccwchain_list.

If a subsequent TIC in the same loop hits this new CCWCHAIN_COUNT_MAX
limit, ccwchain_alloc() will return NULL, and the error will propagate
back to cp_init():

drivers/s390/cio/vfio_ccw_cp.c:cp_init() {
    ...
    /* Build a ccwchain for the first CCW segment */
    ret = ccwchain_build_ccws(orb->cmd.cpa, cp);

    if (!ret)
        cp->initialized = true;

    return ret;
}

Since cp->initialized remains false on error, when the subsystem later
calls cp_free(), the cleanup is skipped:

drivers/s390/cio/vfio_ccw_cp.c:cp_free() {
    if (!cp->initialized)
        return;
    ...
}

The next I/O request then unconditionally wipes the list, permanently
leaking the orphaned chains:

drivers/s390/cio/vfio_ccw_cp.c:cp_init() {
    ...
    INIT_LIST_HEAD(&cp->ccwchain_list);
    ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714232208.1683788-1-farman@linux.ibm.com?part=2