From nobody Fri Jul 24 22:52:04 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 06B6E416871; Wed, 22 Jul 2026 17:06:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739989; cv=none; b=Ujc3TSsWP+XTgOnXxiE6COVr//4uVosyh0JXdAeOQWPhxTLzeBt6pToQblgwNrkCNNEuGwjMxznSYxLGhc5S/T3RFdNU0Ikq037n0K2GOYU5fhf206n72JNkUozikd4AWj5smavjpbU9Yt6rKE6p4jzrzQTHdU+ju1K3IgqNQkk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739989; c=relaxed/simple; bh=6lEdi6ee562bX2a98JJnWtIj6Ba/lGKcogLJMl94lyo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JEyKU6WB3R/cRtUQFpdFn1t5H0gN62WtcCZdx3qfsKWZIDHjcUkS2IOZhAP4kCdBWyHPs0qiPr61CDW/UX2sx3e+vEBKzSY026o2vuNikzsw49UfEdOA4DUap2HDH3eBDMFPw9WaoWkEE1EsEyW2Mxikl5Pig5uUHf/rpzV2IC4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=GBngBB11; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="GBngBB11" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66MFfrPU303462; Wed, 22 Jul 2026 17:06:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=xRHlaDrJccecYNTrY KvinLH4od394PkGb/NgKoPEI1s=; b=GBngBB11TagXqT806tnTQ1+xYSnbGE4b0 ju+duagZxq/3WshTPhhgKU1Hd6cr6ySautqK5CHduZuQnHKYXmZhPQBYW20EScRS TiSCl/qsny7kKeKEKA7RQjxrLhk2dF1AkAF+4NzsoxG6+8/eHgtxtZWbsc7VPg5n v06tw3hmHprQKttXnAzFN8UCnUWrmfVyG6RPHxfXYHcBtduockT0fBMvfojQXDun zShhbHVoTnc/cL8Nn5EnnvKhNdBmOvZ3McGq/naAYA4NJ8EgeVrIVaJEzFPwlH47 83P+3HTuZWcHPPACaS95L6O7s65QA3H88rMt5PkZjMnNwo4Rzq7ug== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77kax5u-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:26 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66MH4c7k025835; Wed, 22 Jul 2026 17:06:26 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgmtk0aj1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:26 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (smtpav05.wdc07v.mail.ibm.com [10.39.53.232]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66MH6OlL20120272 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 22 Jul 2026 17:06:25 GMT Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A720D58053; Wed, 22 Jul 2026 17:06:24 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BFDDF58043; Wed, 22 Jul 2026 17:06:23 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.253.249]) by smtpav05.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 22 Jul 2026 17:06:23 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com Subject: [PATCH v4 1/6] KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Date: Wed, 22 Jul 2026 10:06:16 -0700 Message-ID: <20260722170621.1686-2-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722170621.1686-1-alifm@linux.ibm.com> References: <20260722170621.1686-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=HJXz0Itv c=1 sm=1 tr=0 ts=6a60f892 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=G-uFRffD-WzugI8hyjEA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX2zE9CWrQ6hUF qXuwxwvSEB097t7xproeMSCRRNGF6TFnNP7+VhLYSPS5aEnzEPxQvXwxtx9QU7T8K5g8QR5Px2b 5UCyHExOkDJaJRfzvI7NyM1JzXD+JctOb9Q6Gw3eQFKqBdavt2CY3UPBo5vvuiD+fzP631hPRdD 23ownmIq99DEAN6r8Uv6xjPqVGnBNHbH5pNgy2YrjdiSaQGr9Zyu0tZMuUpDxnYN/qRy3XP8FM1 Z9yjcfYVgt232D+KSFhJU4kvx/4KpjaQDs0mJUvWyZiyxqx1spIqMZ6Bz36Xr7F2wqrKTZlQA0k v3utnAIELQqbE8EPmurPzypjqLW1dHkPmtgZKk/DgDgt6T2m5I7TB8dQrOZx2D/JMtLIFExC91K kL8aqizpbaRgblKt8hVzoOhDF7dQ0dqbi0QbNEQZhUpR+DIAhzPlLVo7mTpooE7gUPJY8nqlKZV 6d1Lno4cg2oyMNZlwbw== X-Proofpoint-ORIG-GUID: XzAYuZqNXAizA4YQ13kxWkjK9UMX0uzx X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfXxWsRc+mxLSq+ k7PXgXufDEmAyFkJQZgxf1pd1kk4UETs2+ZauSnAQfwMzLiiNnzm7/p2XxWbD95wpXJxHLbzFDd A3iIVgV5XomtwMnLwFpHYQhtfOaxXZU= X-Proofpoint-GUID: XzAYuZqNXAizA4YQ13kxWkjK9UMX0uzx X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-22_04,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 impostorscore=0 clxscore=1015 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607220164 Content-Type: text/plain; charset="utf-8" The MPCIFC instruction doesn't allow registering adapter interrupts without first unregistering. So reject any request to enable interrupt forwarding if its already enabled for the zPCI device. This also fixes overwriting and thus leaking resources when the ioctl is called multiple times for the same device. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Tested-by to the series. But would be good to do this on a v5. --- arch/s390/kvm/pci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 720bb58cabe2..d2a11cdf6941 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -237,6 +237,10 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, if (zdev->gisa =3D=3D 0) return -EINVAL; =20 + /* AIF already enabled for the device */ + if (zdev->kzdev->fib.fmt0.aibv !=3D 0) + return -EINVAL; + kvm =3D zdev->kzdev->kvm; msi_vecs =3D min_t(unsigned int, fib->fmt0.noi, zdev->max_msi); =20 --=20 2.43.0 From nobody Fri Jul 24 22:52:04 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A4C33515DF; Wed, 22 Jul 2026 17:06:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739990; cv=none; b=ssQr+h/YjJ1t6WOlFE1v3AORnhUm/MsTq+KfhsBdLNl6yFsUYJrfBRzRleHiuB2VmD6jBh0xVPEeMNcGcGmxM5zPs2oF2usGN+SEEqTvsCgwDSUXmMdGgJ+dwsmiYKMBQzkk2Q7RF02dAgl71SJ/OosArE3AVBj9KmvoP6FUxeU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739990; c=relaxed/simple; bh=7+1FYKJHGcD/MypKEHc5lg9sR+DKko4ykPkUeC4Ahnw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=c6Cyx5WQWrtQMEQDePeLOyXOFmOkhZAqu70591v2bqJi/BhrQ/SDh7bOW0ZGzBPvSPSsVEnWxfBDGwNcjTmwrzCcqOZKfHmdAWJM3mBSUxEk3qDsWnmJzYBrNmb7z27mN1e2h8Y2tt/Zeyv1vUyc7BAt1nASSNM/AMA/F7QhoqQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Fy1PdtaF; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Fy1PdtaF" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66MFfexQ275840; Wed, 22 Jul 2026 17:06:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=SmrxrqArObQSWOOsc /rFYmYq6uAVUy6w97H5mDDXGNk=; b=Fy1PdtaF4jY+3OF/MwqrwaIEWDAOA6KMx MDcRjvK7+lEbZOjp2lMZ4Eulstfgv4OuxfrMb6LmFb2FM7h2SHycicDjVI9pJzXA eUysA+tF1IP2n/S6sG0cDRbZvN8I1+N3YAJhU+WkA0CzqQ/G+Px7Fz3uYTpSDiDR fmnUGuIidL9Zf1M9lxghYQtb3V3SuW84B2oPoaPQIvKq1nL8tZeSgl25vQtLVAJi KO/9wAeYLNS118pvWXuQs4STY0lT9oTSxxE2Zjuby1ovIv4qW+9DZI2GSpMOqdqR qmh27s/M+CUAW892+gcNjuPHu2fHkuaZwos8OWry6rCRyMVpf2cmw== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg78gav2n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:27 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66MGndJG012118; Wed, 22 Jul 2026 17:06:27 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgktq8g4g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:27 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (smtpav05.wdc07v.mail.ibm.com [10.39.53.232]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66MH6PMX8979198 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 22 Jul 2026 17:06:26 GMT Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B3EDE58059; Wed, 22 Jul 2026 17:06:25 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D419358043; Wed, 22 Jul 2026 17:06:24 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.253.249]) by smtpav05.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 22 Jul 2026 17:06:24 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com Subject: [PATCH v4 2/6] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Date: Wed, 22 Jul 2026 10:06:17 -0700 Message-ID: <20260722170621.1686-3-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722170621.1686-1-alifm@linux.ibm.com> References: <20260722170621.1686-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX0IqjqaNOqwCR l909dxNIsyefqCqrg/2+AQybJBoF5y4mT487v82ZdkD4rUfBb/EctMc5BAfRTW2peUgCFXcXlmt y7yKQ8BcudjjaWb0IP7+krKUSc9AaTRJR/ozOeK3hjvcuHeicT/SpHvTo8uLg/hO672j73JEAYy ipwvZ/p7z7YLAseRblnme2aUesDkgridK9v5Jhip00soRXEFCQ9UKATVqMZrs39BAh7YX/ocViM miYJB9qWgsvhaFcIUAua5BHPQomsPjrzKeWgcNuLAmjC9grJiF9fUEBYJjaOUng0ByvK0Zo9xzh Q8AgBHWTl1BVLAXq8SQumj1i6lzF5u4fVik1zoC3vSE8GubeObCwbmuZDuAga/A8rn0/MahRMDC 22JA9TXozUXkwzNS/dLgx89uwO84L+Y2eNSaGIXDDRDacw9707yA1+pPzUMCFaRu3D1nL4qH4Ni nUSULgPpYvUEEwmdgFA== X-Proofpoint-GUID: aVjV73MfRRw9BttxKkDzx7CfcvS3lxqB X-Authority-Analysis: v=2.4 cv=MelcfZ/f c=1 sm=1 tr=0 ts=6a60f893 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=EQJuD_CdQHuXhf-s-5YA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX7sZQd7STQOy9 kPg+8RQdSqpWGEtiTxd14Wluns6LNIq7rfQHxKYBCGrVv79gxD+Yu3Zdi1tkB09M8aZAgQt111m KwJQ9sVltfsfNsMTQYb+kZ+oRTLF7vg= X-Proofpoint-ORIG-GUID: aVjV73MfRRw9BttxKkDzx7CfcvS3lxqB X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-22_04,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 spamscore=0 clxscore=1015 malwarescore=0 phishscore=0 adultscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607220164 Content-Type: text/plain; charset="utf-8" The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages. Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali Reviewed-by: Christian Borntraeger Tested-by to the series. But would be good to do this on a v5. --- arch/s390/kvm/pci.c | 38 ++++++++++++++++++++++++++++---------- arch/s390/kvm/pci.h | 2 ++ 2 files changed, 30 insertions(+), 10 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index d2a11cdf6941..1b3114c7cfbb 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -190,33 +190,51 @@ static int kvm_zpci_clear_airq(struct zpci_dev *zdev) return cc ? -EIO : 0; } =20 -static inline void unaccount_mem(unsigned long nr_pages) +static inline void unaccount_mem(struct kvm_zdev *kzdev, unsigned long nr_= pages) { - struct user_struct *user =3D get_uid(current_user()); + struct user_struct *user =3D kzdev->user_account; + struct mm_struct *mm_account =3D kzdev->mm_account; =20 - if (user) + if (user) { atomic_long_sub(nr_pages, &user->locked_vm); - if (current->mm) - atomic64_sub(nr_pages, ¤t->mm->pinned_vm); + free_uid(user); + kzdev->user_account =3D NULL; + } + + if (mm_account) { + atomic64_sub(nr_pages, &mm_account->pinned_vm); + mmdrop(mm_account); + kzdev->mm_account =3D NULL; + } } =20 -static inline int account_mem(unsigned long nr_pages) +static inline int account_mem(struct kvm_zdev *kzdev, unsigned long nr_pag= es) { struct user_struct *user =3D get_uid(current_user()); unsigned long page_limit, cur_pages, new_pages; + int rc =3D 0; =20 page_limit =3D rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; =20 cur_pages =3D atomic_long_read(&user->locked_vm); do { new_pages =3D cur_pages + nr_pages; - if (new_pages > page_limit) - return -ENOMEM; + if (new_pages > page_limit) { + rc =3D -ENOMEM; + goto out; + } } while (!atomic_long_try_cmpxchg(&user->locked_vm, &cur_pages, new_pages= )); =20 + mmgrab(current->mm); atomic64_add(nr_pages, ¤t->mm->pinned_vm); + kzdev->user_account =3D user; + kzdev->mm_account =3D current->mm; =20 return 0; + +out: + free_uid(user); + return rc; } =20 static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib = *fib, @@ -279,7 +297,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, } =20 /* Account for pinned pages, roll back on failure */ - if (account_mem(pcount)) + if (account_mem(zdev->kzdev, pcount)) goto unpin2; =20 /* AISB must be allocated before we can fill in GAITE */ @@ -400,7 +418,7 @@ static int kvm_s390_pci_aif_disable(struct zpci_dev *zd= ev, bool force) pcount++; } if (pcount > 0) - unaccount_mem(pcount); + unaccount_mem(kzdev, pcount); out: mutex_unlock(&aift->aift_lock); =20 diff --git a/arch/s390/kvm/pci.h b/arch/s390/kvm/pci.h index ff0972dd5e71..544e6aa75e38 100644 --- a/arch/s390/kvm/pci.h +++ b/arch/s390/kvm/pci.h @@ -21,6 +21,8 @@ struct kvm_zdev { struct zpci_dev *zdev; struct kvm *kvm; struct zpci_fib fib; + struct user_struct *user_account; + struct mm_struct *mm_account; struct list_head entry; }; =20 --=20 2.43.0 From nobody Fri Jul 24 22:52:04 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C88F9401A25; Wed, 22 Jul 2026 17:06:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739991; cv=none; b=Jnr4xjyJsAX63zjbJnwa8vzGYCZpI+Yl+oYswWfBDf+hDaB1Fdxeb9W4iqZcIR8hRvk+bh2/vZIzZk5gGNOOhahZuqb4g0SLxQW9uyJmobtJSB7dQ8x5cJLhICfn6DFudXkS2B3TY6A7yRGq3aDvtakHQBwoOs+Uu8zlfCanGdw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739991; c=relaxed/simple; bh=/ACkjr1TvXEP84dGVA4YeXKP8Wo555KsO/P7YhohpFk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rEyBnVgrxaNyCtgnAXNno/W5P4WO8wV9Gw0qaSWw1ouG+De2FypxsA6s+5OJLo0NB9hcXhizsviT0u++4Y3S+tETyztrTgau63m21+KBNtjIl00EMhvOCot26Nmp6VnP7CNPLuB+xo4Sk/JDQxfa4T41QFTxPd8Ptfx0yLDxsBE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=ive2TK+l; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="ive2TK+l" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66MFgFvS2692215; Wed, 22 Jul 2026 17:06:29 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=oNm5d3PId3WDFe1sN hEu2rh0fC2v7sHGl4qNpwMZirk=; b=ive2TK+lRsWIbc20eP2mjzqDq+UW4y6T1 jRr+GUM7eBY9PRcLt6rPVQhbV1Dd/AmLyIwXYgbVjxdQdaEK3FplzicHYoL/K84n xlyQrl4ap2ggnXGiggmXTn2dk7dJU7+TdmMRIrms8x5D6Z4INUPjA+E2UfpO/tzD fnvTA/pr4n7IcewQ/azcX5Q7dhe9cSU0OGbsfAaPiUlbXzFz8NXOvsLB+3Vp1jem HWZAswvULJ88RMNhTeGb9dwShVGK7vdiLbsKNZnAIjEs0yIfoH1ukDE1OKyaXjl+ 7/3WjM8OKA2cYpvTI9dsrtFxRLWkHGQSZ9P/rHissbMHY7bAondLg== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77akcd9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:28 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66MH4dqj012758; Wed, 22 Jul 2026 17:06:28 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1gg3yb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:28 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (smtpav05.wdc07v.mail.ibm.com [10.39.53.232]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66MH6QFI6488672 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 22 Jul 2026 17:06:27 GMT Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C23F95805D; Wed, 22 Jul 2026 17:06:26 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DE57458043; Wed, 22 Jul 2026 17:06:25 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.253.249]) by smtpav05.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 22 Jul 2026 17:06:25 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com Subject: [PATCH v4 3/6] KVM: s390: pci: Fix missing error codes and memory unaccounting Date: Wed, 22 Jul 2026 10:06:18 -0700 Message-ID: <20260722170621.1686-4-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722170621.1686-1-alifm@linux.ibm.com> References: <20260722170621.1686-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: SqwDvS5CwKMSrxhFaU539YlGGGJOlyMH X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX9mF738Etj1wT WxXOAazy4bQ4JGHFNYRx7L70QZKq/5uSu/7JIpANn15n3wzYG+3QY9ZUKhcrLAhtduj0kHm3hvm BiBwIgMIQ9MXi3uynhi0nDfCixgqVQw= X-Proofpoint-GUID: SqwDvS5CwKMSrxhFaU539YlGGGJOlyMH X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX7DxK2bhAHYQG ahSDOl2Z/4a8zJZ6Y54VfGZ1STXu+QKja1wZfbUbiw5kkFfJjmoVhe3k/Oplp2RgaQnyYqQu8Yw V84yDSca/iiyX61hLkFY8EOgclWGaO/Uw33bEwx1jWbiQgd115yj6wpP9jTFtxstzdl0Sf0a5c5 4B9L8aKZBa2+w5b2VDh8RBpKhkgARN/3Oowu5cSHcaDF1RwZ7QvnMMw3bahWQWSztPT7SZMRule S/ZOczH079nfBtB5/a3IwstqtuZyCgmBVrXmVLeU3QCM1DQRSKBTICxCY2iQ56pGh/tkqCI9Chn 0lan8LlqaDkyTcQ+/H7AtczH+94j/+BkJhb4IKJVwzdCdPqwh2ZvNb/60XCPOzpkfbuf/qkY59e lm9PTzs1PFT0x/pP04tn5C88BLjEOzTyoyDs3g6ag0XtdDmTIp/FtUjO01kRhgI4q3CMzYsCV28 8VOvHyZVB6Ic/FGZ2Vw== X-Authority-Analysis: v=2.4 cv=K7AS2SWI c=1 sm=1 tr=0 ts=6a60f894 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=g4erIPh_aaDScpLpsJUA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-22_04,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607220164 Content-Type: text/plain; charset="utf-8" In kvm_s390_pci_aif_enable() two error paths failed to set error code, causing the function to return 0 on failure. It also failed to rollback memory accounting on failure. Fix both by propagating error code on failure and calling unaccount_mem() in the cleanup path. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Tested-by to the series. But would be good to do this on a v5. --- arch/s390/kvm/pci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 1b3114c7cfbb..33abc15aa685 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -297,14 +297,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, } =20 /* Account for pinned pages, roll back on failure */ - if (account_mem(zdev->kzdev, pcount)) + rc =3D account_mem(zdev->kzdev, pcount); + if (rc) goto unpin2; =20 /* AISB must be allocated before we can fill in GAITE */ mutex_lock(&aift->aift_lock); bit =3D airq_iv_alloc_bit(aift->sbv); - if (bit =3D=3D -1UL) + if (bit =3D=3D -1UL) { + rc =3D -ENOMEM; goto unlock; + } zdev->aisb =3D bit; /* store the summary bit number */ zdev->aibv =3D airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK | @@ -348,6 +351,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, return rc; =20 unlock: + if (pcount > 0) + unaccount_mem(zdev->kzdev, pcount); mutex_unlock(&aift->aift_lock); unpin2: if (fib->fmt0.sum =3D=3D 1) --=20 2.43.0 From nobody Fri Jul 24 22:52:04 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0931C4F7978; Wed, 22 Jul 2026 17:06:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739992; cv=none; b=CbcO0NiDvnv1+EQhd0EkOWE9MKSsx3ShnXet6c4tc48jI7PqgMVi4UvB9qXvOhxwIAxzqOLtdVVlvKje1lrD1phqYdIT4Oq13COb1kklSOlg6leoc24xsb3MFIwdPoiYMY9Eus8D15q5jqmOYX+PXcR9JG1AWgvPBSbCN13c69A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739992; c=relaxed/simple; bh=qkCafmPF2uJNXiBck6SyJPJZ6afWQe6vFPIfcRPlels=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nHf64w8zGx6GXsL0nxEiHjX06swos+xDv5UsSZyizEMP2SJZTrYxvtsxcRZs+DZKGWMl3lxS1tjsmw5xIPeYUn1Bb1jk+UjPjEkIzUe5ZPaC9wT9wlmKT3yl9+XkRXhQGB6hkWYrc1JxagiQfyhM8ELr40XENPnWfDNkIOdjAVM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=cnAILQHu; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="cnAILQHu" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66MFflPA382884; Wed, 22 Jul 2026 17:06:30 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=1TkNdN61S103MDsHz XNwgWKbs37UhH4GKScY6/TtHK0=; b=cnAILQHupwbYxgBXpomEEXKuhHOo75zyX 493XHsQfBlKig/nCY5FGULNYdns9wkV4D4+Kx79/35/wfIQn2MwWlS6qXDcnTHIL mcEN6aNe9n+jjEsbk9hkFwhy/TDy7bLsjQEaZGo3hU0unXPUOroAaxPPiNVbADXC 4Vk26Jw1MSbeNi6Mb94aWTes2YrQf5aePNgyLHk2RDIoABpJcb9rMFfSTueiiNh7 /DHkvaF8jsS/fuxzHdpoY8Ml3oKeJunvD9RR/nU3Mhro8QK2rfJ+tsZSHataTDNS Zi5shZDGjqQwec7drUNTiXNuRgoqVG3MVFamb84iYCH8V3kyvYvIg== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7913cwa-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:30 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66MH4dGt031833; Wed, 22 Jul 2026 17:06:29 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgpgyg1c9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:29 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (smtpav05.wdc07v.mail.ibm.com [10.39.53.232]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66MH6RBw50266588 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 22 Jul 2026 17:06:28 GMT Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D06AD58059; Wed, 22 Jul 2026 17:06:27 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id ED3CF58043; Wed, 22 Jul 2026 17:06:26 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.253.249]) by smtpav05.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 22 Jul 2026 17:06:26 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com Subject: [PATCH v4 4/6] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Date: Wed, 22 Jul 2026 10:06:19 -0700 Message-ID: <20260722170621.1686-5-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722170621.1686-1-alifm@linux.ibm.com> References: <20260722170621.1686-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: BOz2NSB0H0b24eko_FgPh8n5d4-jpBpu X-Authority-Analysis: v=2.4 cv=V6RNF+ni c=1 sm=1 tr=0 ts=6a60f896 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=VpFnpj6RERqEfYQjrFkA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfXxjS6yyTIo3ho NsvOFLI8S37G75kLT0m04rY96szQ/lBBfKShgzU2aY9vEiGCulhfewoJTDMrvSKJ+TceQ8jFuiX I+GG/V7B3SE7LEEkldh8ep4KkVyWJ2Q= X-Proofpoint-GUID: BOz2NSB0H0b24eko_FgPh8n5d4-jpBpu X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX/6duXNlcrC/J rGFL0LA1CyUZx8bdrNiTi+2DIV9TReAnK567hLey4BKqgSV3vm3+Nfg4Z8PJFEOpmYxu3sjDX4E Ch4fTKwmPiu27WwEah2TNhNrAu4enHfwh9uU0C5jXGUyUX49mF6fIlaWtoRNithgzmMMSkeKpxX NOYyPBeFSBb6ZqM0MM/aoOPN0DxQL/7HVhJ0KgKuYbNhrY3Pz6UEDENon2TCGx8KfeTXnEoW6/0 nvKH9h+HYd2itp8aFBdnK4VsrkkJRb+RLuGCa3Slz98MMc63Vx1+E9Exu1wsxC/Brj+ZRHmIyqM aWjYVzD1aHZm8FYFG4W6ELo6cW5uCGNVgo41haaitzXxoKovqMqZMHnMwyn+6n8YFuwf+HlXudH 99AFUBlE6bCdxYVbrB2gsncw/qrcmZjQys8ggFFqY8ThNgJ3l4r3YQj6LTzpXeOvVBe5UTsL2GB iy4uM5HxAY7QxwFkXgA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-22_04,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 adultscore=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 spamscore=0 impostorscore=0 phishscore=0 priorityscore=1501 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607220164 Content-Type: text/plain; charset="utf-8" The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when derefenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Tested-by to the series. But would be good to do this on a v5. --- arch/s390/kvm/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 33abc15aa685..231a4236fc3c 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -314,6 +314,11 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, AIRQ_IV_GUESTVEC, phys_to_virt(fib->fmt0.aibv)); =20 + if (!zdev->aibv) { + rc =3D -ENOMEM; + goto free_aisb; + } + spin_lock_irq(&aift->gait_lock); gaite =3D aift->gait + zdev->aisb; =20 @@ -350,6 +355,9 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, rc =3D kvm_zpci_set_airq(zdev); return rc; =20 +free_aisb: + airq_iv_free_bit(aift->sbv, zdev->aisb); + zdev->aisb =3D 0; unlock: if (pcount > 0) unaccount_mem(zdev->kzdev, pcount); --=20 2.43.0 From nobody Fri Jul 24 22:52:04 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 11C29421234; Wed, 22 Jul 2026 17:06:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739993; cv=none; b=LsLjLIvraA4P/CIQxTqLOuzS/k+PAFbEWOp/92MDwQE1qvKEHP+tU34bb91rSGYt6hSHIOSqAUS3QXlLywk1xNgRTFUPR/BoPfq0fRA1WMQ26TaLeuYqcOyoqGnNTrnCAwX/JOCPX3MyQJ+yXxVk1yeQM+0cPYRADXt7KMOd20c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739993; c=relaxed/simple; bh=O3gQjb7+aEWm9H6Gzv6JD3X68t4Fnyo4j50qgDY1SiQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Cw13OwAk5PoqnLIcSCbnqFfNsgGOAiLJ1SntuB3Ef80cGclKGjv8JZBE0F0GbBPSxXE4Jf9QV34zAOYxZjJDcmjRGDCwVonvJp6nt6OPoxzPvVWeny1gJRvYd7uJFfOAb3WVAuR1k2k/pn5lazO164JDYrmrUFDJFkzZHbodLJk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=C4NQWbS4; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="C4NQWbS4" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66MFfeBk374375; Wed, 22 Jul 2026 17:06:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=XhTcKlgNG+PrRulNA PvlZ2Z8GBD/jvEgSiTuKa+fD9Q=; b=C4NQWbS4Vrks6PETJMpH9Kvstj7UklRh/ zzEtkVsOEqMjhE/Akp3088r3tw8kbjvRJH0eN6i61iC185lBmTC0zwlZPg1RWby2 clL4/zmMwPj+0KXxgsFFkFBeom7LX4UN6XdEBvZfleaG1l6lZXhYC016ki/OiRfc G7C2/sYKWMiwMP3Pvq+clQfCQMFWk0aS1A6idr/IogRrRvZ1jWv5n98XLhWPgRap qjWNYq9Btlv3vNd/ZG5exMRr2TjFe/yf6LlVfXe5aAwUUd8Xl8pKvv3R+HK9gib1 RUPRua8cE05Xh9ZmPNFJEv6RGnRBS3Iaur5/9Z7otVLuLKCW6uYig== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7abkdwf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:31 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66MH4cSg031818; Wed, 22 Jul 2026 17:06:30 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgpgyg1cg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:30 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (smtpav05.wdc07v.mail.ibm.com [10.39.53.232]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66MH6SU327001518 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 22 Jul 2026 17:06:29 GMT Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D662158053; Wed, 22 Jul 2026 17:06:28 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0723E58043; Wed, 22 Jul 2026 17:06:28 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.253.249]) by smtpav05.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 22 Jul 2026 17:06:27 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com Subject: [PATCH v4 5/6] KVM: s390: pci: Fix resource leak on IRQ registration failure Date: Wed, 22 Jul 2026 10:06:20 -0700 Message-ID: <20260722170621.1686-6-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722170621.1686-1-alifm@linux.ibm.com> References: <20260722170621.1686-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX8cCgU90rMBml rPCcTIp845csAyP+PZ4HGiepsW0YDB1npoTlcaUeFtA+9T8YhDVGSjTaeYQt23Oh37BNU7vt3dR LUrY9yA/lgKq4Jxc0pa0pGnbT3lCmRI43l6JOOmHUJVlw9FmBa9sd5eTC3UPPz04qYPngWH0ov8 B0EXkuHXHGeR5JhUXHSZwtQemG8f6t5RS6VbENtY3zgP++saZkr+xENK3mJrn9i1zn/TIPId57y OYKwVMDp3JqAP6qEqs+R9JyQOiZPTLDTrWfZDRQdYGLKBWNwcq6V2ano2Zx/UimhtBM8k8ZSN3U ch9qA5LYFE+TYsxr/Kv4Ix0OFgB4oQkmaFHxC5UnBhOepirLihqHgtJ+zbqWZI0yIxkKT9DL25e gOVVWS1tV3fab8cjvJn2U193qzaaBFnNSCTJ1GZA7loOADOl1i0uUc9itT0Hol5BjQ8yFhSlNtk x8JBzUImQNiEO+NQN6w== X-Authority-Analysis: v=2.4 cv=F7ZnsKhN c=1 sm=1 tr=0 ts=6a60f897 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=jfJf0X725jgLZ45auVgA:9 X-Proofpoint-ORIG-GUID: sLkqwrvI71FE0nxdettbEkYL8JEpXcIB X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX8CCcfiKFH6lk +lKhZUo1hFhcX0vs2g9oJCyr1b3tJ3WOCaIHcl/uvHKg70k2mYc8z7bVULJwwrN0vV4N8PJywr4 dZtDcCjdWvYDGzugafl6lC/Yr+WIuNU= X-Proofpoint-GUID: sLkqwrvI71FE0nxdettbEkYL8JEpXcIB X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-22_04,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607220164 Content-Type: text/plain; charset="utf-8" Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns the error code but doesn't do any resource cleanup thus leaking resources. Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and unpinning any pinned pages. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Tested-by to the series. But would be good to do this on a v5. --- arch/s390/kvm/pci.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 231a4236fc3c..d76b2c5484ac 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -341,19 +341,32 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, aift->kzdev[zdev->aisb] =3D zdev->kzdev; spin_unlock_irq(&aift->gait_lock); =20 - /* Update guest FIB for re-issue */ - fib->fmt0.aisbo =3D zdev->aisb & 63; - fib->fmt0.aisb =3D virt_to_phys(aift->sbv->vector) + (zdev->aisb / 64) * = 8; - fib->fmt0.isc =3D gisc; - /* Save some guest fib values in the host for later use */ - zdev->kzdev->fib.fmt0.isc =3D fib->fmt0.isc; + zdev->kzdev->fib.fmt0.isc =3D gisc; zdev->kzdev->fib.fmt0.aibv =3D fib->fmt0.aibv; - mutex_unlock(&aift->aift_lock); =20 /* Issue the clp to setup the irq now */ rc =3D kvm_zpci_set_airq(zdev); - return rc; + if (!rc) { + mutex_unlock(&aift->aift_lock); + return rc; + } + + /* Start cleanup */ + zdev->kzdev->fib.fmt0.isc =3D 0; + zdev->kzdev->fib.fmt0.aibv =3D 0; + + spin_lock_irq(&aift->gait_lock); + gaite->count--; + gaite->aisb =3D 0; + gaite->gisc =3D 0; + gaite->aisbo =3D 0; + gaite->gisa =3D 0; + aift->kzdev[zdev->aisb] =3D NULL; + spin_unlock_irq(&aift->gait_lock); + + airq_iv_release(zdev->aibv); + zdev->aibv =3D NULL; =20 free_aisb: airq_iv_free_bit(aift->sbv, zdev->aisb); --=20 2.43.0 From nobody Fri Jul 24 22:52:04 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34C54421258; Wed, 22 Jul 2026 17:06:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739994; cv=none; b=VrOl+OX7/CJTXxq8JgtVKies1mMtxmMddTXPRdplN6E4/JxHz8t79eQ+tqrswXDoZ1Cnzvt6e/itDnw7EHNfTEp+GkStlA5pgsIjodAxyJmV9KQMbxMdEs506eU0Npa1pr9Hh6nMZBO5k4AuFHnlYLHok8HGxEnW3XBfIWqoVfc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784739994; c=relaxed/simple; bh=RwzXk/loI857roFrBPTgONzObOwrW7DdnNgQkrxFiCw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DZNBa3AURMuTxKFfCc0zfNdrWse9fFoPY9R4+8RvsTIjcIbI9oW6Tr0AwILx3uyDPhlOX2K+B5rWGQVGFEOjccbAodtWivZAxL8nlnIK2GQWoYLTl+kBpN8kuhK53BwvjXmEJYtLcknOXrjby496FCR9Usw581y9bpcj1DxF47U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=i9G9chGX; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="i9G9chGX" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66MFfmNF382893; Wed, 22 Jul 2026 17:06:32 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=W5iy9Ye8g++11Uesd JYnqIsQr+kMkLzAlBRRbH8zpHI=; b=i9G9chGX65ixtCHIsYvDsj3x2Yhzb2bfK JnLh7elrsl1YjlGPekeMgQEpGHuqWfhnJFE9AqtqF8eQOYtfuTLRq8fBpv6FmEbn lYvScQreoieB3jfZG0NEgwG2VIlLd6KGOtZGWrTfAo0uULrnVLd2FAaSkS6x7QVr j3ph2Lo4n2wj8be+sprf4r2ZobxY01f42rMvzhS2hMfLYfnhr04WMHLKC7KO9VHl kXqBiZdBaoeIFAKGQ2u7Tzbp16+vTiyvsNwFTJjIBbCz/Pa3n5mis6IOfLuodJKO d/Kf3+xmOvHsFX+RBgMCUq1u7It5Yr9NdPmTG7+cn/UXoadItnsAw== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7913cwn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:32 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66MH4gro025503; Wed, 22 Jul 2026 17:06:31 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgnah88wf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2026 17:06:31 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (smtpav05.wdc07v.mail.ibm.com [10.39.53.232]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66MH5slG9765626 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 22 Jul 2026 17:05:54 GMT Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D5A4D58053; Wed, 22 Jul 2026 17:06:29 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0E9EC58043; Wed, 22 Jul 2026 17:06:29 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.253.249]) by smtpav05.wdc07v.mail.ibm.com (Postfix) with ESMTP; Wed, 22 Jul 2026 17:06:28 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, farman@linux.ibm.com Subject: [PATCH v4 6/6] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Date: Wed, 22 Jul 2026 10:06:21 -0700 Message-ID: <20260722170621.1686-7-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722170621.1686-1-alifm@linux.ibm.com> References: <20260722170621.1686-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: CS8sPQxa_q40Y9uBSKPdq0V4ihrGbMpo X-Authority-Analysis: v=2.4 cv=V6RNF+ni c=1 sm=1 tr=0 ts=6a60f898 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=i8wI3NWYBEf5A6oN4S0A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX8KAp2HFyCaVe CGLCZeTo5mx6tFwcH7CBfPJ2Hp6AfNjG4M6ZuQV9iv3Il2vQIS0+HBG+IC/7xEBdLS+8FY47DxF yIS0KjxqDH2n5+ynIcLj3Heja5DGZPg= X-Proofpoint-GUID: CS8sPQxa_q40Y9uBSKPdq0V4ihrGbMpo X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIyMDE2NCBTYWx0ZWRfX6CjyNEflAyvx gcyevkOFvzWmphadC4x7SQc5Wjsb6cI2wGV+kbdBlnNoGG9M7FNq8aRyliegwqUWjrIpZRqv90u AJppQSjmi9D3vz6NWA4TTQ0FG5pzSrJhF37xfQewPc1DrlcI8n7VvFn9nOXg4/ZOIemDkr/eggA xJVr8j74Ut3IiZtuhsNCYqtTjUjM0SkRcWg1nDsfcJTRsXfqBarzNXTpOjbOT6EN0bZRsU2l1e/ KFLkV5EyQdrKmjgFojZV5ISQg/6hRtGom8SZTxSlDJJint5+Z/Rv7S1iRhbA0+xNJes//saP9kG 2Ttad9HYPDV7JqifxyjqUL/Iee9+fk86QMJVwL801058OtFkHsSYxyNMlqR29qbpv1u7AvUKvD/ SnAox/ZPyDY2hARKUcALthJLXjzW/PzmXtT5aApM8Mf2gexXoPYKTldE9cQoouxrJ1YKJk8AohK Zban/ZcxxzsGe3/L3IQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-22_04,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 adultscore=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 spamscore=0 impostorscore=0 phishscore=0 priorityscore=1501 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607220164 Content-Type: text/plain; charset="utf-8" The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a single page boundary, then reject the request as we cannot safely pin the guest AIBV. Similarly reject the request if the AISB address is not 8-byte aligned as the architecture requires doubleword alignment for the summary bit address. Since the AISBO can address up to 64 bits, the size of the AISB can only be 8 bytes for the function. This also ensures the AISB doesn't exceed a single page boundary. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Signed-off-by: Farhan Ali Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Tested-by to the series. But would be good to do this on a v5. --- arch/s390/kvm/pci.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index d76b2c5484ac..e55e75b81b51 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -241,7 +241,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, bool assist) { struct page *pages[1], *aibv_page, *aisb_page =3D NULL; - unsigned int msi_vecs, idx; + unsigned int msi_vecs, idx, size; struct zpci_gaite *gaite; unsigned long hva, bit; struct kvm *kvm; @@ -268,6 +268,14 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, return gisc; =20 /* Replace AIBV address */ + size =3D BITS_TO_LONGS(msi_vecs) * sizeof(unsigned long); + size +=3D (fib->fmt0.aibvo / 8) + 1; + npages =3D DIV_ROUND_UP((fib->fmt0.aibv & ~PAGE_MASK) + size, PAGE_SIZE); + if (npages > 1) { + rc =3D -EINVAL; + goto out; + } + idx =3D srcu_read_lock(&kvm->srcu); hva =3D gfn_to_hva(kvm, gpa_to_gfn((gpa_t)fib->fmt0.aibv)); npages =3D pin_user_pages_fast(hva, 1, FOLL_WRITE | FOLL_LONGTERM, pages); @@ -283,6 +291,12 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, =20 /* Pin the guest AISB if one was specified */ if (fib->fmt0.sum =3D=3D 1) { + + if (fib->fmt0.aisb & 0x7) { + rc =3D -EINVAL; + goto unpin1; + } + idx =3D srcu_read_lock(&kvm->srcu); hva =3D gfn_to_hva(kvm, gpa_to_gfn((gpa_t)fib->fmt0.aisb)); npages =3D pin_user_pages_fast(hva, 1, FOLL_WRITE | FOLL_LONGTERM, --=20 2.43.0