Stop using the userspace address to mark the guest page dirty.
mark_page_dirty() expects a guest frame number, but was being passed a
host virtual frame number. When slot == NULL, mark_page_dirty_in_slot()
does nothing and does not complain.
This means that in some circumstances the dirtiness of the guest page
might have been lost.
Fix by adding two fields in struct kvm_s390_adapter_int to keep the
guest addressses, and use those for mark_page_dirty().
Fixes: f65470661f36 ("KVM: s390/interrupt: do not pin adapter interrupt pages")
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
---
arch/s390/kvm/interrupt.c | 6 ++++--
include/linux/kvm_host.h | 2 ++
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index f55eca9aa638..1c2bb5cd7e12 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -2768,13 +2768,13 @@ static int adapter_indicators_set(struct kvm *kvm,
bit = get_ind_bit(adapter_int->ind_addr,
adapter_int->ind_offset, adapter->swap);
set_bit(bit, map);
- mark_page_dirty(kvm, adapter_int->ind_addr >> PAGE_SHIFT);
+ mark_page_dirty(kvm, adapter_int->ind_gaddr >> PAGE_SHIFT);
set_page_dirty_lock(ind_page);
map = page_address(summary_page);
bit = get_ind_bit(adapter_int->summary_addr,
adapter_int->summary_offset, adapter->swap);
summary_set = test_and_set_bit(bit, map);
- mark_page_dirty(kvm, adapter_int->summary_addr >> PAGE_SHIFT);
+ mark_page_dirty(kvm, adapter_int->summary_gaddr >> PAGE_SHIFT);
set_page_dirty_lock(summary_page);
srcu_read_unlock(&kvm->srcu, idx);
@@ -2870,7 +2870,9 @@ int kvm_set_routing_entry(struct kvm *kvm,
if (kvm_is_error_hva(uaddr_s) || kvm_is_error_hva(uaddr_i))
return -EFAULT;
e->adapter.summary_addr = uaddr_s;
+ e->adapter.summary_gaddr = ue->u.adapter.summary_addr;
e->adapter.ind_addr = uaddr_i;
+ e->adapter.ind_gaddr = ue->u.adapter.ind_addr;
e->adapter.summary_offset = ue->u.adapter.summary_offset;
e->adapter.ind_offset = ue->u.adapter.ind_offset;
e->adapter.adapter_id = ue->u.adapter.adapter_id;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index d93f75b05ae2..deb36007480d 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -645,7 +645,9 @@ static inline unsigned long *kvm_second_dirty_bitmap(struct kvm_memory_slot *mem
struct kvm_s390_adapter_int {
u64 ind_addr;
+ u64 ind_gaddr;
u64 summary_addr;
+ u64 summary_gaddr;
u64 ind_offset;
u32 summary_offset;
u32 adapter_id;
--
2.52.0On Fri, Feb 06, 2026 at 03:35:51PM +0100, Claudio Imbrenda wrote:
> Stop using the userspace address to mark the guest page dirty.
> mark_page_dirty() expects a guest frame number, but was being passed a
> host virtual frame number. When slot == NULL, mark_page_dirty_in_slot()
> does nothing and does not complain.
>
> This means that in some circumstances the dirtiness of the guest page
> might have been lost.
>
> Fix by adding two fields in struct kvm_s390_adapter_int to keep the
> guest addressses, and use those for mark_page_dirty().
>
> Fixes: f65470661f36 ("KVM: s390/interrupt: do not pin adapter interrupt pages")
> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Great catch!
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
...
On 2/6/26 15:35, Claudio Imbrenda wrote:
> Stop using the userspace address to mark the guest page dirty.
> mark_page_dirty() expects a guest frame number, but was being passed a
> host virtual frame number. When slot == NULL, mark_page_dirty_in_slot()
> does nothing and does not complain.
>
> This means that in some circumstances the dirtiness of the guest page
> might have been lost.
>
> Fix by adding two fields in struct kvm_s390_adapter_int to keep the
> guest addressses, and use those for mark_page_dirty().
>
> Fixes: f65470661f36 ("KVM: s390/interrupt: do not pin adapter interrupt pages")
> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Ouff
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
We had so many of these issues and I wonder if we should move away from
making everything u64 and enforce type checks in some form.
> ---
> arch/s390/kvm/interrupt.c | 6 ++++--
> include/linux/kvm_host.h | 2 ++
> 2 files changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
> index f55eca9aa638..1c2bb5cd7e12 100644
> --- a/arch/s390/kvm/interrupt.c
> +++ b/arch/s390/kvm/interrupt.c
> @@ -2768,13 +2768,13 @@ static int adapter_indicators_set(struct kvm *kvm,
> bit = get_ind_bit(adapter_int->ind_addr,
> adapter_int->ind_offset, adapter->swap);
> set_bit(bit, map);
> - mark_page_dirty(kvm, adapter_int->ind_addr >> PAGE_SHIFT);
> + mark_page_dirty(kvm, adapter_int->ind_gaddr >> PAGE_SHIFT);
> set_page_dirty_lock(ind_page);
> map = page_address(summary_page);
> bit = get_ind_bit(adapter_int->summary_addr,
> adapter_int->summary_offset, adapter->swap);
> summary_set = test_and_set_bit(bit, map);
> - mark_page_dirty(kvm, adapter_int->summary_addr >> PAGE_SHIFT);
> + mark_page_dirty(kvm, adapter_int->summary_gaddr >> PAGE_SHIFT);
> set_page_dirty_lock(summary_page);
> srcu_read_unlock(&kvm->srcu, idx);
>
> @@ -2870,7 +2870,9 @@ int kvm_set_routing_entry(struct kvm *kvm,
> if (kvm_is_error_hva(uaddr_s) || kvm_is_error_hva(uaddr_i))
> return -EFAULT;
> e->adapter.summary_addr = uaddr_s;
> + e->adapter.summary_gaddr = ue->u.adapter.summary_addr;
> e->adapter.ind_addr = uaddr_i;
> + e->adapter.ind_gaddr = ue->u.adapter.ind_addr;
> e->adapter.summary_offset = ue->u.adapter.summary_offset;
> e->adapter.ind_offset = ue->u.adapter.ind_offset;
> e->adapter.adapter_id = ue->u.adapter.adapter_id;
> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index d93f75b05ae2..deb36007480d 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h
> @@ -645,7 +645,9 @@ static inline unsigned long *kvm_second_dirty_bitmap(struct kvm_memory_slot *mem
>
> struct kvm_s390_adapter_int {
> u64 ind_addr;
> + u64 ind_gaddr;
> u64 summary_addr;
> + u64 summary_gaddr;
> u64 ind_offset;
> u32 summary_offset;
> u32 adapter_id;
© 2016 - 2026 Red Hat, Inc.