From nobody Sat Jul 25 20:48:40 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B27CC346E40; Mon, 13 Jul 2026 17:26:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963567; cv=none; b=HDyzZGb5yuX7EGGrmc5cJaw8KtnOX/eOZkv+bLZheJrOP69Lc/BBkAm0C/ACl1cJFJaiaH0G2WwrIS/+dgfYsJ0gp4aGF4aBhPv99kumSrzGBtsQqYA6QWsH3iZzrPO7ak8VDC5km8IfQSh3IT3G3h04iCJy734ivyKjUu+WMAw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963567; c=relaxed/simple; bh=Exaf+DLstzGfAYuQAFhmIjaX+0FNKdzp14kRsZmoOQc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LQgzCH7QnuvhiBvI5+apbBwSgYwZIgF6QSAno6n+xImQgMusEZBMGFYWRoqJPnkE9UXKRU9O2Gu2pBuYlvwZ6LJ98gMY7FoFMddZ/o2ba0Z3VpugeAiuuK8TLSyfujXNIckShd4psYtoSEyF3IWi5zFnw0agncG/F53u7ML5aDc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=s/Wu0KlD; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="s/Wu0KlD" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66DFEP5q2770694; Mon, 13 Jul 2026 17:26:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=xMT1MgcTxHsL0ar8P ZF+6cC+u8S4ve3Eyg5SGRElG38=; b=s/Wu0KlDGR8HEu+Zlz3xL25uU2bnbWF9J VRdUkXrXkIWMRgEuUtSUJmjr14sqb+Sq6cEe9eFcPyNXviKxfGOub11wFTrNvKvU ukOClt7Tio6mLTaZIqvNBIVT2cWxZysMCHV8Q4LFR9LJeQXm7KhDjTLOqObIdkp5 ZsMYkLAFm3w2K2eljRQNY5VfWdRJro8hEThkzRSZF43OyBwSq3+JPr83pTqWqZg2 NkZy4rdyXfwQqXTT98EWrqNAQQ2civfv3YsqUcF91tIT348g/H4gQH17g5Tg52S5 qIJECDflU6Wq2jShLTmHHnnHE1h7TWSAqvue86EOcD2IKtRrxWi/A== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbexwhjgb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:04 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66DHJcNh016539; Mon, 13 Jul 2026 17:26:03 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fc2uxxhth-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:03 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66DHQ3WF21168648 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Jul 2026 17:26:03 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E60245805E; Mon, 13 Jul 2026 17:26:02 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6D45A5805F; Mon, 13 Jul 2026 17:26:02 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.249.24]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 13 Jul 2026 17:26:02 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com Subject: [PATCH v1 1/5] KVM: s390: pci: Fix refcount leak in memory accounting functions Date: Mon, 13 Jul 2026 10:25:56 -0700 Message-ID: <20260713172600.1284-2-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260713172600.1284-1-alifm@linux.ibm.com> References: <20260713172600.1284-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 0oXW_xZKOV05omybnikgWhZYYzwtgjXX X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfXx/eAsNckJtow oFLzhxZRACNYnnMrCt+XmL0KFjf5MSEd/lfqzJNJB6PsDGpjIakiySJtYyqvT8A/xXDmEBtcbPr /wwMWUDaigqL9ieVyNKqzzloFsBk6A5Ra5p44N5jgb4RhKS8srv5SZFyJRIogrZpvYU++g//2Qs /Bri5GO8xzhn0hqd9oWka3htLD6r/R5bMT9dwHtWdGyZ4Q2Ko/k5ltJr/vKJEHGfOjM6GsJ+0fD kCvwPuMcrlN5hTtpPSzPUUgmYxV+zzXrtd+WHyO8oJsr+C6NYuyD5/1tA9wKnwuPVhQuKcVBNrL QcDMzoBY3HZ3VSFO0t4atODPtpRA+6R7OKyIBrs4w8MJ65vrymwe/KffZNlhWSAjuPQ48oyweEq hXPoJuaNCXx/NZnTvUw9/WuNzEwtU8HsyxdfqPFZJSRaKzBbe6mZTF5cRIqdEG8GdB3y3VbkeIJ bNoR65Yql98/sg6340g== X-Authority-Analysis: v=2.4 cv=XJoAjwhE c=1 sm=1 tr=0 ts=6a551fac cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=D-MSj2RqzxEEtpeRmKsA:9 X-Proofpoint-ORIG-GUID: 0oXW_xZKOV05omybnikgWhZYYzwtgjXX X-Proofpoint-Spam-Info: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfX97JHaF4DJ5A2 UFfRzIFXK4k3/vdFUFBuXPm9nTna6ZOtMSBUE5fLPqC4dhfhauOsnU7rJ7ybQR4OpS1koJhunzT tiaIzJiIm8L/WU2MzgPum0zziseQ2EI= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-13_04,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 bulkscore=0 phishscore=0 lowpriorityscore=0 priorityscore=1501 impostorscore=0 clxscore=1011 spamscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607130178 Content-Type: text/plain; charset="utf-8" The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). Fix this by calling the free_uid() appropriately. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 720bb58cabe2..5bbbb1de4b5a 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -198,25 +198,32 @@ static inline void unaccount_mem(unsigned long nr_pag= es) atomic_long_sub(nr_pages, &user->locked_vm); if (current->mm) atomic64_sub(nr_pages, ¤t->mm->pinned_vm); + + free_uid(user); } =20 static inline int account_mem(unsigned long nr_pages) { struct user_struct *user =3D get_uid(current_user()); unsigned long page_limit, cur_pages, new_pages; + int rc =3D 0; =20 page_limit =3D rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; =20 cur_pages =3D atomic_long_read(&user->locked_vm); do { new_pages =3D cur_pages + nr_pages; - if (new_pages > page_limit) - return -ENOMEM; + if (new_pages > page_limit) { + rc =3D -ENOMEM; + goto out; + } } while (!atomic_long_try_cmpxchg(&user->locked_vm, &cur_pages, new_pages= )); =20 atomic64_add(nr_pages, ¤t->mm->pinned_vm); =20 - return 0; +out: + free_uid(user); + return rc; } =20 static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib = *fib, --=20 2.43.0 From nobody Sat Jul 25 20:48:40 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A2681346E60; Mon, 13 Jul 2026 17:26:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963568; cv=none; b=F/UYrfDedzSNdnBQ+wJs0Pu+XlyRQo8It3PXfYNCxhk9KzeG5dXC9HzeuX/9q4OT4NXEJV/vVr2D73L4ZyRjjxWtKKWqZVO3GBf7lQx0aoZbdmPvBnS95GtLN9fq12BEG6ziKJaWQJe4yKKOrd3hhj9lyrny2GMxzvjKsVIDvuo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963568; c=relaxed/simple; bh=kRib6+pCFP2nyfSJA5RosilzPMFkv6sx+/aIXrBvA7I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aeZ20F3e2SlG0IWKoS0F1qt6CMtRqi8cLmrNdv57qxgdKX32Oo5xb/9zCbXIHIzYd0aKZZKmXFmpGsWc8qXBgTqCr5kIVsgeFwVVAJCNo+dmOiMv/m+aDAgFWabEWFYiodSmv23Vw+dI48xbwJM0l8gab13N3BLufPDrV7iANZY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=lAGoANNK; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="lAGoANNK" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66DFEP5r2770694; Mon, 13 Jul 2026 17:26:05 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=D1hBcD+/Ho6KnPOs5 M5nq6yjhtFvFa0TV0vp/WMqsnw=; b=lAGoANNK5u2nTwGVGxBukAy/f8nGmadPy e/yOGlaEjG+ZczccMLqWZWOMFzL10vK632A1tob3RvhzuuyK9qGm+UuG6KBXqxBS u84usFRJSKICO3BQxXkVzo2MUdE2aR8Bpv7ZJ99tMh73Mr6y0ixFQCsv1D2Q0eh6 FZIB7gP0DYaRZsfiBWynAaXFwZLVPF6NU6EfhYwx8T6b0BsbQoAx3vurf7KGQjt3 hdJ+hNRagOADtuL81m+QqSSiRXn7u4JjRTzveuIeeOUSfqEXuoFI6b1a1A+anz2B 0LLa63Ikg62uW3CfeFKg+utU8VhKMt2JwqyPxQyC86vQx+IrDWOoA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbexwhjge-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:05 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66DHJbFE002526; Mon, 13 Jul 2026 17:26:04 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fc15jpu7n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:04 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66DHQ3Px32965238 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Jul 2026 17:26:03 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 85FB558060; Mon, 13 Jul 2026 17:26:03 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0F6A258051; Mon, 13 Jul 2026 17:26:03 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.249.24]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 13 Jul 2026 17:26:02 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com Subject: [PATCH v1 2/5] KVM: s390: pci: Fix missing error codes and memory unaccounting Date: Mon, 13 Jul 2026 10:25:57 -0700 Message-ID: <20260713172600.1284-3-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260713172600.1284-1-alifm@linux.ibm.com> References: <20260713172600.1284-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: tUeDD-S2RDqJKDzyC7UbJDY6WQwdjNx0 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfX4F7l7OSxllW5 njJ7jYNUMIrdktm07jRcsfkCgawaTaTjhsHd1Ndj06kBlz0G1vfDoLcoFGISvrhGCm+QbZ+wOV+ QLpbogzA66VEcj35NI3oxg13MMfeuR6qgya99ktHO2zz+FIwrB84cH+g/ej66lndB4A/fH+kkWi QWBvhgFRvKxMXefCoRLHTaxEOY0nTf27GaqNt82r4v9bmv37CmVZIkEVHCpf6Cz+yHbRdgMzbxi 1uHHnzCXACto3e1G3O8SGRhKWHuMIkw009axHQ/9LxXDFP7eqWty1arT1XU6RzmcG3akIbsL/um Ge4m6LzYDZPiPahjnAJKnZXgdASgRhlwrqL9Z9WOAOY7x8NLYJuvLYxsUYqkJlGoqlDSHGwR4p6 fSuHXB8RBHo8yO4jYbb2ZSvCqZM1lYOHwaHUzKq09HqB986P+rr4YmNheXF/8ApWF7uNzphG6mP oRG+X2pqS8/OON62rSg== X-Authority-Analysis: v=2.4 cv=XJoAjwhE c=1 sm=1 tr=0 ts=6a551fad cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=g4erIPh_aaDScpLpsJUA:9 X-Proofpoint-ORIG-GUID: tUeDD-S2RDqJKDzyC7UbJDY6WQwdjNx0 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfXxLCj65X3m2uh RFvKYoHNQGZ0rO/UKhSv1Lg3+tgIh8q8cWcga3c5t80lHO36Q2JKj+8HVC+3jLsuc5+vtzkHD+k qvh/m78aUZn2Jn9+Nzzk6XRqHxYDPJQ= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-13_04,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 bulkscore=0 phishscore=0 lowpriorityscore=0 priorityscore=1501 impostorscore=0 clxscore=1011 spamscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607130178 Content-Type: text/plain; charset="utf-8" In kvm_s390_pci_aif_enable() two error paths failed to set error code, causing the function to return 0 on failure. It also failed to rollback memory accounting on failure. Fix both by propagating error code on failure and calling unaccount_mem() in the cleanup path. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 5bbbb1de4b5a..42db20c2afca 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -282,14 +282,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, } =20 /* Account for pinned pages, roll back on failure */ - if (account_mem(pcount)) + rc =3D account_mem(pcount); + if (rc) goto unpin2; =20 /* AISB must be allocated before we can fill in GAITE */ mutex_lock(&aift->aift_lock); bit =3D airq_iv_alloc_bit(aift->sbv); - if (bit =3D=3D -1UL) + if (bit =3D=3D -1UL) { + rc =3D -ENOMEM; goto unlock; + } zdev->aisb =3D bit; /* store the summary bit number */ zdev->aibv =3D airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK | @@ -333,6 +336,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, return rc; =20 unlock: + if (pcount > 0) + unaccount_mem(pcount); mutex_unlock(&aift->aift_lock); unpin2: if (fib->fmt0.sum =3D=3D 1) --=20 2.43.0 From nobody Sat Jul 25 20:48:40 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19C65347535; Mon, 13 Jul 2026 17:26:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963568; cv=none; b=mcGo3Gr3MI7EqHTxppBft9SP+CkmHr7d8yrHPjKVyxYcFP04chYB0rB64vOzSNOw6jmf2I2uwPVPFieg+f7VJSNo7tL++7pCFVijElC694QoSJNs7kClU67H5eLd4ChMoo5Uc8tBsEhnzrtHbhnYQ2eOly5hSaZkkq3TkPtl/LI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963568; c=relaxed/simple; bh=m+pNB44JX5uhwRo/pxQ+khK95yb2+fKh3piZsFwkJlM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ooYX5guBinH+D0HuSx7m8rhoP3TqcqadMyqxebPKir1to1zcDIE1hJhcHc9Wjh7vl72mSrQ6Iq3x79U6YNQ+x5ZxVZjTWcOPdyB8+LluRJ+gOtTiOn/xa745Z+nbZpS3RwPoN9NzPUbk5wijaG9plRUyzYDGcRrxc6F3snAfZIE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=HlXwSzhU; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="HlXwSzhU" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66DFEUkD2833096; Mon, 13 Jul 2026 17:26:06 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=AxSQixaZay1eU1Wkq BYr28d80HyLe420iYBSt75YpF0=; b=HlXwSzhULve9Df8lrwz+M3l4kfFoOj/ZZ e+8MgwXdgHbS7PVSH0khu+SpyGozRXG0HHYjicSDYF0wZxbRxQjGu4c0ZSroPzGw wb+i3sR8xofhsroXenjM0CMG8c8VcrMGbbqq445k0yNdd3kMrQ5JEzyxPZABNXtv MvIfNXxJ4n+tonK/WBXsxGT+6RYiObud8ecGv85gww6okPYnJqadOYbiom72ryfD HqPvP1I8+LqqaLxvVLabi5FmvP559T1stsRDu5QajkIyHO7q9Ff0le+K0g2CjgiE O+FPlDE4tojMr1rTrlnYFT+nF5aUqJL+a9RgF1sYuwdcGNVSx8rAw== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbegbhmjv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:05 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66DHOeFP003385; Mon, 13 Jul 2026 17:26:05 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fc1nh6r8p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:05 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66DHQ45s23593634 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Jul 2026 17:26:04 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3036858051; Mon, 13 Jul 2026 17:26:04 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A28A05805A; Mon, 13 Jul 2026 17:26:03 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.249.24]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 13 Jul 2026 17:26:03 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com Subject: [PATCH v1 3/5] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Date: Mon, 13 Jul 2026 10:25:58 -0700 Message-ID: <20260713172600.1284-4-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260713172600.1284-1-alifm@linux.ibm.com> References: <20260713172600.1284-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=fOcJG5ae c=1 sm=1 tr=0 ts=6a551fae cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=VpFnpj6RERqEfYQjrFkA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfXwROeCSoit9oA 9Riec5TR3LG5s1hlcr9hlsU6ot1A/asanIt6AlO6CU/wQunl3fNVGyDQskYc2yhGyEGB1CUORC0 IGpLxBFsL61nlP0/JMvoWmNBT3AhI/fz+Ts90Nrx7r1Kzq6F0Wi69Ccffo1P/BQzxstNObRHbqF WSZZQIF8B5loUYpOIXKvu1DYUN8tE7BKBX0AeqtbgCn2VVADMip/jMruQWjlr1z6JF3gPJmQoBz PTamZn4iqJxyruuCFkygAEE4GvkHUsF43hi7PjcqThvyD12B/TnZhhb+/lmvV07UY6n5hb1tV8F a8L1avAJtMVgxMji0kasw8V++Au62yAgXnO4C+S+lEXxiSXHd4lh62AfvvYIIVlk9xSZDYrfXhz PR+gx/oyojVaRB/SZnOwFQ6yEGLM881qUa5ANHsmX23ZbiN+BFKKGspLys/j0r5vmbOoRMkKpkC /HArUKjEaGpBadzGEAQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfX/wkvyiIJNpxg ST4GbP3HQEooBYWg3ZdWcGIKBKz7fMSX/Tavf93f11xM08PEsa7SHGXYFiSJwRKmgRSQrKDCb7w 8PwZpdSzdeoaa2N0E06Ic4rvLl3bQdE= X-Proofpoint-GUID: mFGIARYrnFLYu4fMj0LDVAsHPrp_kQHh X-Proofpoint-ORIG-GUID: mFGIARYrnFLYu4fMj0LDVAsHPrp_kQHh X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-13_04,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 impostorscore=0 suspectscore=0 adultscore=0 priorityscore=1501 malwarescore=0 clxscore=1015 phishscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607130178 Content-Type: text/plain; charset="utf-8" The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when derefenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 42db20c2afca..b3ffb8c25510 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -299,6 +299,11 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, AIRQ_IV_GUESTVEC, phys_to_virt(fib->fmt0.aibv)); =20 + if (!zdev->aibv) { + rc =3D -ENOMEM; + goto free_aisb; + } + spin_lock_irq(&aift->gait_lock); gaite =3D aift->gait + zdev->aisb; =20 @@ -335,6 +340,9 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, rc =3D kvm_zpci_set_airq(zdev); return rc; =20 +free_aisb: + airq_iv_free_bit(aift->sbv, zdev->aisb); + zdev->aisb =3D 0; unlock: if (pcount > 0) unaccount_mem(pcount); --=20 2.43.0 From nobody Sat Jul 25 20:48:40 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 84471348C44; Mon, 13 Jul 2026 17:26:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963568; cv=none; b=t91dOpbSfU/V5GaqV8oyRHgBo/umwNKEuLKvwyrLhXZqQ8Hf38EAo4O4C/OdgRgXc+VFWvFMRAanSZpyvNC6Ym/668Ge2wiAiIvB+zxUYe7zqjMtl0iNXilxO+AkYPQQja3b8MOP/EwxdE7zOvbgu5aFtSNYadlLYNjSWcCVKlg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963568; c=relaxed/simple; bh=4EieKZfEDF1R1N5oWYhDubPwLX2+zTAOr7B76VLnq/8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bUAqUlKum8ZT0e9CtYqEyLdy/afO2cava9kHtmeRTnYJogxMxlpz3o7cetwXbN5q+KGkOOUT1a9kH/Xafu1IotX+2ihfrdQg3wrPxxCqwfwhouyDHPoP9/A/sVDh5EJKyhRPsp7UskntK6kVEHX6gA2DjAHu+IWAOoCN0bkF1ds= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Ij66BgD7; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Ij66BgD7" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66DFEKAc2855620; Mon, 13 Jul 2026 17:26:07 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=eTLGx59kqxdpeE2Ak MJ5sLNuv5UWVWNy5zsCrnXSbqA=; b=Ij66BgD7pYjuWu3Wz+HZe4ETdDPpMjUar ON305rrcqiZU6OfVmr2UvwTbRlbh00MHYUe8sWhJghFBMLoIT5ICON2EQhTUm7Fl gylA0jxfq+u8lIw9K0Cgf6P40qCU8FdBLml5shKoe+5sWnSOYwpiyo1TIcLoz8gV 560Z/DOU63zWi+F93KiPDJSOJuWco1ICtWohIi1gQLD1JSIgpg8Z2eW5/yNYDHC+ w8IB+3zVFWBJbB8fikeXjQcClZaB+t8/ePAgkO99CY/BcGUwOIx5qsh7zR3uwD9x cRIVLYcr9BQXEiF7SHplkqARlUD8ELoC+K3Su2TioiIegEOFqVT3w== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbegt20w1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:06 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66DH4YZ2023791; Mon, 13 Jul 2026 17:26:05 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fc2cg6m51-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:05 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66DHQ4Vj33227426 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Jul 2026 17:26:05 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D049F58051; Mon, 13 Jul 2026 17:26:04 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4D83C5805A; Mon, 13 Jul 2026 17:26:04 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.249.24]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 13 Jul 2026 17:26:04 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com Subject: [PATCH v1 4/5] KVM: s390: pci: Fix resource leak on IRQ registration failure Date: Mon, 13 Jul 2026 10:25:59 -0700 Message-ID: <20260713172600.1284-5-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260713172600.1284-1-alifm@linux.ibm.com> References: <20260713172600.1284-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: uoDhW9JGHI5uQuBX4T1lpn_33zrq547n X-Proofpoint-Spam-Info: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfXzfZ2eN4r9zwn TYk5CIvRJIkA6ZVO2svZI+LHfY2iQR4dRQY/52gI/jc6gZP9HZ8uIVCIdcopuyr+dQeo+F+Yquf fJxhMyylDFnbAG3mfpB8wkhoFQSnAF4= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfX/SrRJVialYng 3aq/zKw93BzRUIWCJNlGu0wzoLGwLpDRLaEO1GrL1Jonsu3O/Gokm8XPYtI/Ql4K0Q3JhMTkbmT /3bASTUMmyxqhohxkYc1+0ngXYMIJMBqAu9ZcP9wkn8mgJ9AshktPuq/e4QPkQQhTNICfs5pJu/ WQ1rfiwRX6j6UdC5xmq7twvQZhJDN/A3WEHoDx95HfHyfqcwSbA1gm9PfuqKGKSgyFSUMhHuD7d yN1TP/MqzxFlT3zppq3Q8WyUsz1eZyQHRKeNMCRuZpY852RfK6GvABRKuZcVRrE2cMlp4ALkr5h 8H+1u5MR3T1iqq89aY2dEKshsMLKiWv3rBF9xO0Pmj9YopbcDXsogMxKpwv1bjzFvabDRx/nplV ZTfOCeiwCsb+sxNMzP0SbCtuF1frqeXcNyu9tLWN2llrGUAB08SsNMA+BLIWsx3FunG4wLxBrGW D46Do05mjiYRaMGVMvQ== X-Authority-Analysis: v=2.4 cv=IqMutr/g c=1 sm=1 tr=0 ts=6a551fae cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=S3gQTLpqa8hfpVGigeQA:9 X-Proofpoint-GUID: uoDhW9JGHI5uQuBX4T1lpn_33zrq547n X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-13_04,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 clxscore=1015 impostorscore=0 malwarescore=0 adultscore=0 phishscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607130178 Content-Type: text/plain; charset="utf-8" Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns the error code but doesn't do any resource cleanup thus leaking resources. Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and unpinning any pinned pages. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index b3ffb8c25510..9a16a2eac65b 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -334,11 +334,29 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, /* Save some guest fib values in the host for later use */ zdev->kzdev->fib.fmt0.isc =3D fib->fmt0.isc; zdev->kzdev->fib.fmt0.aibv =3D fib->fmt0.aibv; - mutex_unlock(&aift->aift_lock); =20 /* Issue the clp to setup the irq now */ rc =3D kvm_zpci_set_airq(zdev); - return rc; + if (!rc) { + mutex_unlock(&aift->aift_lock); + return rc; + } + + /* Start cleanup */ + zdev->kzdev->fib.fmt0.isc =3D 0; + zdev->kzdev->fib.fmt0.aibv =3D 0; + + spin_lock_irq(&aift->gait_lock); + gaite->count--; + gaite->aisb =3D 0; + gaite->gisc =3D 0; + gaite->aisbo =3D 0; + gaite->gisa =3D 0; + aift->kzdev[zdev->aisb] =3D NULL; + spin_unlock_irq(&aift->gait_lock); + + airq_iv_release(zdev->aibv); + zdev->aibv =3D NULL; =20 free_aisb: airq_iv_free_bit(aift->sbv, zdev->aisb); --=20 2.43.0 From nobody Sat Jul 25 20:48:40 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68368346FA7; Mon, 13 Jul 2026 17:26:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963580; cv=none; b=h2kG5dxFCI+5BLqeq1TBfoyFZrNRb+Rok8Z/Z9M9EcgfozsrGxOQrpD/CWxvi0BFKBvv/9Eolzi8qhiUlJwa5NslvFxqDkUFfMTl83sshvclCftXVncwL3HV1C0lDS2VbKCQivVPx2TLY5pm/zuD/X/0CmCJJKYacx0jR6BoTec= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783963580; c=relaxed/simple; bh=nVgeEDe627f6cggLKPkI1ALB+FbPLILphH4xvUQKmbg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ViUC6HEHsbtnemZBf3N3P3QOrkTid+vWnOt7DponGRov1yAaK+3EGQ/Rhuwnc+GohuhLDU1sECXpfj3rVAWAEWk+Helwk7GsRbncipaRUolbaWxSdRPGn0VvVZehBQjKaG5Hn7mnVfyjMWAZptygfX5b7Gca/ZYjD1/wU0Myx/A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Ib/sxBdM; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Ib/sxBdM" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66DFEQ022833006; Mon, 13 Jul 2026 17:26:07 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qAcgkNewLpdxXeGjL nt8JjFj97yq/1EZHAmBCwn086k=; b=Ib/sxBdMctu5cTh7qMPQH72y+/mvz803E MHfPR2Qnq2EWycDkYCR8s38C+vf7qIuc4G4Pd3qfyr+ojeAjhXYVyWIpdP/iQspi ++s8/bJKE2VUqkNaZyH50iwH2jVhOeSUHsGGNcesdibJjaQUzojMDIq1q4HCE1Ov fPEeAhZLAheOgKy7ar10cGN52fLypQAFBBfyWoS855OT5RI8v+mmnhqJiS4LuFNa veJ0Km034payWWGeQv2NntDN76YEZN3reYhjwORYXNAANNSmpTG4/N6+Tm3549Vt t8tEx1wwWmsmAGp4u9VM7zoKbDmTyQJvnS4d+dqmqkyJAdr0HdiAA== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fbegbhmk1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:07 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66DHJcNi016539; Mon, 13 Jul 2026 17:26:06 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fc2uxxhtp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2026 17:26:06 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66DHQ5HC11076176 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Jul 2026 17:26:05 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7221C58051; Mon, 13 Jul 2026 17:26:05 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EACF25805A; Mon, 13 Jul 2026 17:26:04 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.249.24]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 13 Jul 2026 17:26:04 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com Subject: [PATCH v1 5/5] KVM: s390: pci: Fix AIBV and AISB spanning multiple pages Date: Mon, 13 Jul 2026 10:26:00 -0700 Message-ID: <20260713172600.1284-6-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260713172600.1284-1-alifm@linux.ibm.com> References: <20260713172600.1284-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=fOcJG5ae c=1 sm=1 tr=0 ts=6a551faf cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=iuJ1MhL1WkBYaHGgpXwA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfX0q6kERTCv5ri pyhWhCRhqYCt1MO0OzvCms0qDN1Ie35WTq0KTeBfyreU4Q4cqL601yUrD9By6R7FgYkyK1xCsjn nVDSZ8TSkP4SDedhrUsgRvTI2wuqrccWsJQp4WzHrLJwAJTIrOeSJF9zb+wD96zexWbl6ID6VgD bACSTpLU8xgz/UstepyJKSAJWxmFXIR0prmW9kPzCKU4W6XK1lV59ptY6AVrCX8HPrQIT1XdACx M2QGTch0fe10TrtrCCQhQN5Z1orbewq3fLoWOd0QdIViTSCxmSAAcyvKh9I8R/wNvAqaLBPKsvS fwJjScNxWVPuxbTPAHruWDgPD0kfCpOUceGFJB+i2nv3KX2t4mH0p1HF4PjR4xgDHCF9zOxmWKG fTa9WZy8R/uMfvfofoDY6brrORuYm7pc2gWsBgaPB2wn5RAklQwU3EEd6IcDKJYtbHrNzyt0Ggj /qcNvFxpUF443dnHI2Q== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzEzMDE3OCBTYWx0ZWRfXwqLjQucuJ9Vz JQz4n/qSNUhvrFKK+zBHEH+kG69j4X5KoVnUd/E1dPzg02lW5EFpA4Hskyi/NxnyPzJ6JN+5Mh0 qtlGG84aDNdTIVQx2I1L7K9sxXgzlKc= X-Proofpoint-GUID: yLD9RvtyBrRsJNFjLQT2wWNljh26CoiS X-Proofpoint-ORIG-GUID: yLD9RvtyBrRsJNFjLQT2wWNljh26CoiS X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-13_04,2026-07-10_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 impostorscore=0 suspectscore=0 adultscore=0 priorityscore=1501 malwarescore=0 clxscore=1015 phishscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607130178 Content-Type: text/plain; charset="utf-8" The AIBV (adapter interrupt bit vector) holds one bit per MSI-X vector for a given function. With a maximum of 2048 MSI-X vectors per function, the AIBV can be up to 256 bytes. Because a guest is free to place the AIBV at any alignment, it may cross a page boundary. Pin all pages covered by the AIBV to handle this correctly. The AISB (adapter interrupt summary bit) holds one bit per zPCI function. Its total size is configuration-dependent and not architecturally bounded, so the AISB offset is used to detect whether it crosses a page boundary and pin accordingly. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 78 ++++++++++++++++++++++++++++++++++----------- arch/s390/kvm/pci.h | 5 +++ 2 files changed, 64 insertions(+), 19 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 9a16a2eac65b..5fe07181f3d6 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -229,13 +229,15 @@ static inline int account_mem(unsigned long nr_pages) static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib = *fib, bool assist) { - struct page *pages[1], *aibv_page, *aisb_page =3D NULL; - unsigned int msi_vecs, idx; + struct page *aibv_page, *aisb_page =3D NULL; + int gisc, npages, npinned, pcount =3D 0; + unsigned int msi_vecs, idx, size; struct zpci_gaite *gaite; unsigned long hva, bit; + struct kvm_zdev *kzdev; struct kvm *kvm; phys_addr_t gaddr; - int rc =3D 0, gisc, npages, pcount =3D 0; + int rc =3D 0; =20 /* * Interrupt forwarding is only applicable if the device is already @@ -244,6 +246,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, if (zdev->gisa =3D=3D 0) return -EINVAL; =20 + kzdev =3D zdev->kzdev; kvm =3D zdev->kzdev->kvm; msi_vecs =3D min_t(unsigned int, fib->fmt0.noi, zdev->max_msi); =20 @@ -253,32 +256,63 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, return gisc; =20 /* Replace AIBV address */ + size =3D BITS_TO_LONGS(msi_vecs) * sizeof(unsigned long); + npages =3D DIV_ROUND_UP((fib->fmt0.aibv & ~PAGE_MASK) + size, PAGE_SIZE); + if (npages > MAX_AIF_PAGES) { + rc =3D -EINVAL; + goto out; + } + idx =3D srcu_read_lock(&kvm->srcu); hva =3D gfn_to_hva(kvm, gpa_to_gfn((gpa_t)fib->fmt0.aibv)); - npages =3D pin_user_pages_fast(hva, 1, FOLL_WRITE | FOLL_LONGTERM, pages); + npinned =3D pin_user_pages_fast(hva, npages, FOLL_WRITE | FOLL_LONGTERM, + kzdev->aibv_pages); srcu_read_unlock(&kvm->srcu, idx); - if (npages < 1) { + if (npinned <=3D 0) { rc =3D -EIO; goto out; } - aibv_page =3D pages[0]; - pcount++; + + kzdev->aibv_npages =3D npinned; + if (npinned < npages) { + rc =3D -EIO; + goto unpin1; + } + + pcount +=3D npinned; + aibv_page =3D kzdev->aibv_pages[0]; gaddr =3D page_to_phys(aibv_page) + (fib->fmt0.aibv & ~PAGE_MASK); fib->fmt0.aibv =3D gaddr; =20 /* Pin the guest AISB if one was specified */ if (fib->fmt0.sum =3D=3D 1) { + size =3D (fib->fmt0.aisbo / 8) + 1; + npages =3D DIV_ROUND_UP((fib->fmt0.aisb & ~PAGE_MASK) + size, + PAGE_SIZE); + + if (npages > MAX_AIF_PAGES) { + rc =3D -EINVAL; + goto unpin1; + } + idx =3D srcu_read_lock(&kvm->srcu); hva =3D gfn_to_hva(kvm, gpa_to_gfn((gpa_t)fib->fmt0.aisb)); - npages =3D pin_user_pages_fast(hva, 1, FOLL_WRITE | FOLL_LONGTERM, - pages); + npinned =3D pin_user_pages_fast(hva, npages, + FOLL_WRITE | FOLL_LONGTERM, + kzdev->aisb_pages); srcu_read_unlock(&kvm->srcu, idx); - if (npages < 1) { + if (npinned <=3D 0) { rc =3D -EIO; goto unpin1; } - aisb_page =3D pages[0]; - pcount++; + + kzdev->aisb_npages =3D npinned; + if (npinned < npages) { + rc =3D -EIO; + goto unpin2; + } + aisb_page =3D kzdev->aisb_pages[0]; + pcount +=3D npinned; } =20 /* Account for pinned pages, roll back on failure */ @@ -366,10 +400,14 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, unaccount_mem(pcount); mutex_unlock(&aift->aift_lock); unpin2: - if (fib->fmt0.sum =3D=3D 1) - unpin_user_page(aisb_page); + if (fib->fmt0.sum =3D=3D 1) { + unpin_user_pages(kzdev->aisb_pages, + kzdev->aisb_npages); + kzdev->aisb_npages =3D 0; + } unpin1: - unpin_user_page(aibv_page); + unpin_user_pages(kzdev->aibv_pages, kzdev->aibv_npages); + kzdev->aibv_npages =3D 0; out: kvm_s390_gisc_unregister(kvm, fib->fmt0.isc); return rc; @@ -426,12 +464,14 @@ static int kvm_s390_pci_aif_disable(struct zpci_dev *= zdev, bool force) kzdev->fib.fmt0.aibv =3D 0; =20 if (vpage) { - unpin_user_page(vpage); - pcount++; + unpin_user_pages(kzdev->aibv_pages, kzdev->aibv_npages); + pcount +=3D kzdev->aibv_npages; + kzdev->aibv_npages =3D 0; } if (spage) { - unpin_user_page(spage); - pcount++; + unpin_user_pages(kzdev->aisb_pages, kzdev->aisb_npages); + pcount +=3D kzdev->aisb_npages; + kzdev->aisb_npages =3D 0; } if (pcount > 0) unaccount_mem(pcount); diff --git a/arch/s390/kvm/pci.h b/arch/s390/kvm/pci.h index ff0972dd5e71..a2d550f06b6c 100644 --- a/arch/s390/kvm/pci.h +++ b/arch/s390/kvm/pci.h @@ -17,10 +17,15 @@ #include #include =20 +#define MAX_AIF_PAGES 2 struct kvm_zdev { struct zpci_dev *zdev; struct kvm *kvm; struct zpci_fib fib; + struct page *aibv_pages[MAX_AIF_PAGES]; + int aibv_npages; + struct page *aisb_pages[MAX_AIF_PAGES]; + int aisb_npages; struct list_head entry; }; =20 --=20 2.43.0