linux-kernel - Re: [PATCH] s390/vfio-ap: lock mdev object when handling mdev remove request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ff033f2a-b82c-4c7b-a45d-71c674892b2d@linux.ibm.com>
Date: Tue, 11 Mar 2025 06:34:20 -0400
From: Anthony Krowiak <akrowiak@...ux.ibm.com>
To: linux-s390@...r.kernel.org, linux-kernel@...r.kernel.org,
        kvm@...r.kernel.org
Cc: jjherne@...ux.ibm.com, pasic@...ux.ibm.com, hca@...ux.ibm.com,
        gor@...ux.ibm.com, borntraeger@...ux.ibm.com,
        alex.williamson@...hat.com, clg@...hat.com, mjrosato@...ux.ibm.com,
        stable@...r.kernel.org
Subject: Re: [PATCH] s390/vfio-ap: lock mdev object when handling mdev remove
 request

PING!


On 2/21/25 10:32 AM, Anthony Krowiak wrote:
> The vfio_ap_mdev_request function in drivers/s390/crypto/vfio_ap_ops.c
> accesses fields of an ap_matrix_mdev object without ensuring that the
> object is accessed by only one thread at a time. This patch adds the lock
> necessary to secure access to the ap_matrix_mdev object.
>
> Fixes: 2e3d8d71e285 ("s390/vfio-ap: wire in the vfio_device_ops request callback")
> Signed-off-by: Anthony Krowiak <akrowiak@...ux.ibm.com>
> Cc: <stable@...r.kernel.org>
> ---
>   drivers/s390/crypto/vfio_ap_ops.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
> index a52c2690933f..a2784d3357d9 100644
> --- a/drivers/s390/crypto/vfio_ap_ops.c
> +++ b/drivers/s390/crypto/vfio_ap_ops.c
> @@ -2045,6 +2045,7 @@ static void vfio_ap_mdev_request(struct vfio_device *vdev, unsigned int count)
>   	struct ap_matrix_mdev *matrix_mdev;
>   
>   	matrix_mdev = container_of(vdev, struct ap_matrix_mdev, vdev);
> +	mutex_lock(&matrix_dev->mdevs_lock);
>   
>   	if (matrix_mdev->req_trigger) {
>   		if (!(count % 10))
> @@ -2057,6 +2058,8 @@ static void vfio_ap_mdev_request(struct vfio_device *vdev, unsigned int count)
>   		dev_notice(dev,
>   			   "No device request registered, blocked until released by user\n");
>   	}
> +
> +	mutex_unlock(&matrix_dev->mdevs_lock);
>   }
>   
>   static int vfio_ap_mdev_get_device_info(unsigned long arg)