CVE-2024-26620

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/vfio-ap: always filter entire AP matrix<br /> <br /> The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or<br /> domain is assigned to the mdev. The purpose of the function is to update<br /> the guest&amp;#39;s AP configuration by filtering the matrix of adapters and<br /> domains assigned to the mdev. When an adapter or domain is assigned, only<br /> the APQNs associated with the APID of the new adapter or APQI of the new<br /> domain are inspected. If an APQN does not reference a queue device bound to<br /> the vfio_ap device driver, then it&amp;#39;s APID will be filtered from the mdev&amp;#39;s<br /> matrix when updating the guest&amp;#39;s AP configuration.<br /> <br /> Inspecting only the APID of the new adapter or APQI of the new domain will<br /> result in passing AP queues through to a guest that are not bound to the<br /> vfio_ap device driver under certain circumstances. Consider the following:<br /> <br /> guest&amp;#39;s AP configuration (all also assigned to the mdev&amp;#39;s matrix):<br /> 14.0004<br /> 14.0005<br /> 14.0006<br /> 16.0004<br /> 16.0005<br /> 16.0006<br /> <br /> unassign domain 4<br /> unbind queue 16.0005<br /> assign domain 4<br /> <br /> When domain 4 is re-assigned, since only domain 4 will be inspected, the<br /> APQNs that will be examined will be:<br /> 14.0004<br /> 16.0004<br /> <br /> Since both of those APQNs reference queue devices that are bound to the<br /> vfio_ap device driver, nothing will get filtered from the mdev&amp;#39;s matrix<br /> when updating the guest&amp;#39;s AP configuration. Consequently, queue 16.0005<br /> will get passed through despite not being bound to the driver. This<br /> violates the linux device model requirement that a guest shall only be<br /> given access to devices bound to the device driver facilitating their<br /> pass-through.<br /> <br /> To resolve this problem, every adapter and domain assigned to the mdev will<br /> be inspected when filtering the mdev&amp;#39;s matrix.