On 9/16/26 4:32 PM, Eric Farman wrote:
> The various indicators pointers allow them to be overwritten,
> but leak any existing structs that might be there. The adapter
> indicators path checks that it isn't converting from regular
> to thin interrupts, but a check in the reverse direction isn't
> performed.
guest-triggered memory leak = fixes/stable?
I think
7bca3892cb ("s390x/virtio-ccw: reference-counted indicators")
when we started doing dynamic allocation
Reviewed-by: Matthew Rosato <[email protected]>
>
> Rather than unwinding the existing allocations to allow additional
> assignments, just reject these duplicates.
>
> Signed-off-by: Eric Farman <[email protected]>
> ---
> hw/s390x/virtio-ccw.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
> index eb6378ea4c..d700db405b 100644
> --- a/hw/s390x/virtio-ccw.c
> +++ b/hw/s390x/virtio-ccw.c
> @@ -565,6 +565,11 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw)
> ret = -EINVAL;
> break;
> }
> + if (dev->indicators) {
> + /* Do not set without un-setting first */
> + ret = -ENOSYS;
> + break;
> + }
> if (sch->thinint_active) {
> /* Trigger a command reject. */
> ret = -ENOSYS;
> @@ -599,6 +604,11 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw)
> ret = -EINVAL;
> break;
> }
> + if (dev->indicators2) {
> + /* Do not set without un-setting first */
> + ret = -ENOSYS;
> + break;
> + }
> if (!ccw.cda) {
> ret = -EFAULT;
> } else {
> @@ -657,7 +667,7 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw)
> }
> if (!ccw.cda) {
> ret = -EFAULT;
> - } else if (dev->indicators && !sch->thinint_active) {
> + } else if (dev->indicators || dev->summary_indicator) {
> /* Trigger a command reject. */
> ret = -ENOSYS;
> } else {
