On a machine without PCI memory-I/O (MIO) support or when running with
pci=nomio the s390 specific PCI MMIO write syscall checks if the MMIO
cookie is above ZPCI_IOMAP_ADDR_BASE as a sanity check before even
trying to perform the MMIO. If this check fails the return value was
left unchanged and thus 0 from prior operations falsely indicating
success. This could potentially confuse user-space into falsely
believing the MMIO, on a mapping not valid for MMIO was successful.

Fix this by setting the return value to -EFAULT prior to the check
following the same pattern as elsewhere in the same function.

Cc: stable@vger.kernel.org
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Fixes: a67a88b0b8de ("s390/pci: remove races against pte updates")
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
---
 arch/s390/pci/pci_mmio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c
index 51e7a28af899..f3f79ba78410 100644
--- a/arch/s390/pci/pci_mmio.c
+++ b/arch/s390/pci/pci_mmio.c
@@ -188,6 +188,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr,
 			goto out_unlock_mmap;
 	}
 
+	ret = -EFAULT;
 	io_addr = (void __iomem *)((args.pfn << PAGE_SHIFT) |
 			(mmio_addr & ~PAGE_MASK));
 

---
base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
change-id: 20260721-b4-syscall_mmio_ret_fix_upstream-ec4d2d08a6c6

Best regards,
-- 
Niklas Schnelle

On Wed, Jul 22, 2026 at 03:08:34PM +0200, Niklas Schnelle wrote:
> On a machine without PCI memory-I/O (MIO) support or when running with
> pci=nomio the s390 specific PCI MMIO write syscall checks if the MMIO
> cookie is above ZPCI_IOMAP_ADDR_BASE as a sanity check before even
> trying to perform the MMIO. If this check fails the return value was
> left unchanged and thus 0 from prior operations falsely indicating
> success. This could potentially confuse user-space into falsely
> believing the MMIO, on a mapping not valid for MMIO was successful.
> 
> Fix this by setting the return value to -EFAULT prior to the check
> following the same pattern as elsewhere in the same function.
> 
> Cc: stable@vger.kernel.org
> Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
> Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
> Fixes: a67a88b0b8de ("s390/pci: remove races against pte updates")
> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
> ---
>  arch/s390/pci/pci_mmio.c | 1 +
>  1 file changed, 1 insertion(+)

Applied, thank you!