[PATCH v6 0/5] s390/vfio-ap: Fix pre-existing bugs in vfio_ap device driver

[Anthony Krowiak <akrowiak@linux.ibm.com>]

The sashiko AI reported several pre-existing bugs in the vfio_ap device
driver code while reviewing unrelated patches. This series fixes four
such bugs.

Patch 1/4: Fix leak of pinned NIB and registered NISC in 
           vfio_ap_irq_enable/disable()
* Added return codes to vfio_ap_wait_for_irqclear()
  ~ Returns 0 for response codes AP_RESPONSE_NORMAL and 
    AP_RESPONSE_RESET_IN_PROGRESS if the irq_enabled bit is set to 0
    confirming the queue is disabled for interrupts.
  ~ Returns -ENODEV for response code Q_NOT_AVAIL, DECONFIGURED and
    CHECKSTOPPED to indicate the queue is not accessible
  ~ Returns -ETIMEDOUT if the number of retries is exceeded.
  
* Changes to vfio_ap_irq_enable():
  ~ Removed call to vfio_ap_wait_for_irqstate() because the responsibility
    to wait belongs with the guest that initiated the AQIC.
  ~ All AQIC response codes other than AP_RESPONSE_NORMAL indicate the AQIC
    enable call was rejected by the hardware; so, the AQIC
    resources passed as parameters to the AQIC will be freed; i.e., the
    page containing the NIB will be unpinned and the GISC unregistered.
    
* Changes to vfio_ap_irq_disable():
  ~ The AP_RESPONSE_NORMAL switch case added check for return code from 
    vfio_ap_wait_for_irqclear() rather than just freeing AQIC resources. 
    They are now freed only if the return code is 0 or -ENODEV.
     

Patch 3/4: Fix unbounded loop in apq_reset_check()
* Added a done: goto label at the end of apq_reset_check() that frees AQIC
  resources and can be used in all places that free them.
* Added the following return codes to apq_status_check():
  ~ Return -ENODEV for response codes AP_RESPONSE_DECONFIGURED and
    AP_RESPONSE_CHECKSTOPPED. It indicates that the queue is not
    operational; however also tells us zeroization can not be confirmed.
  ~ Return -EAGAIN for response code AP_RESPONSE_BUSY because it is
    unrelated to reset processing and indicates the ZAPQ should be
    executed again. 
* Made changes to the AP_RESET_MAX_WAIT block:
  ~ Now goto done if the return code from apq_status_check() is 0
    or -ENODEV which indicates the queue is not operational, so it is safe
    to free AQIC resources
  ~ Calls a new function, report_aqic_resource_leak() that logs an 
    appropriate error message if reset timed out.
  ~ Sets q->reset_status.response_code to indicate the reset could not
    complete in the case where the response code returned from ZAPQ is
    AP_RESPONSE_NORMAL but the status bits confirming the reset completed
    could not be verified.
* In the -EBUSY code block, replaced the freeing of the AQIC resources
  with goto done;
    
  
Added a patch 5, s390/vfio-ap: fix queue state leakage to guest and host.
* Patch 4/5 opens a hole fixing the unbounded loop in apq_reset_check
  created by commit dd174833e44e ("s390/vfio-ap: remove upper limit on wait
  for queue reset to complete"). That commit was created "ensure both the
  security requirements and prevent resource leakage and corruption in the
  hypervisor. This patch limits the side effects of an unbounded loop, yet
  accomplishes the goals of that commit.

Anthony Krowiak (5):
  s390/vfio-ap: Fix leak of pinned NIB and registered GISC in
    vfio_ap_irq_enable/disable()
  s390/vfio-ap: Fix failure to release IRQ notification eventfd contexts
  s390/vfio-ap: Fix unbounded loop in apq_reset_check()
  s390/vfio-ap: Use AP_DOMAINS for adm_add bitmap size in
    vfio_ap_mdev_cfg_add()
  s390/vfio-ap: fix queue state leakage to guest and host

 drivers/s390/crypto/vfio_ap_ops.c     | 373 +++++++++++++++++++++-----
 drivers/s390/crypto/vfio_ap_private.h |   3 +
 2 files changed, 305 insertions(+), 71 deletions(-)

-- 
2.53.0