From nobody Fri Jul 24 04:45:58 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B121B474257; Thu, 23 Jul 2026 18:34:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831689; cv=none; b=awGT3CoiHpXwDRJXFzq9ASWi01NBZ1Ra6kpvn8QbjpX6D5QZRv0sJDR3qN5sW4EzCKxh3tJuHgr9Kzm2GO1Ue6C6zHRT3o7JfiU73FURbVuYK5dFogX5/UL10pp81jU6MpeVe8PSixMve0R0Zbxa2KBmojOZ5m7fpQhVRXNk3Z8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831689; c=relaxed/simple; bh=J4rj2ZN//xVarZrYZCxN43NnJ0NcRj3mrBSYGw7AmqI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Wb2kdG57bjabWDtOQDUyCFHHldFh9acgtNuGXy4wrnIai5LZfZ7HEKziZ9QnrggawZVGXeaqAPmpuWjgJ1ylP9AgHNPf2A+QF3FYS1+DBxSyUBvwkWGXbAPeqRecAEUco33RhTOqgkxja3jWNUQy4DNGswSHVv/LJNXThh2NRvY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=rGLeh095; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="rGLeh095" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHfrAY3682113; Thu, 23 Jul 2026 18:34:45 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=s8kEz6tL+IAX1w09s dKggdxzvbkfbK6pwkFuZZg4FFU=; b=rGLeh095PHCU6S5jIwtO5B5n4wwIJ2le2 3IDZv6ZbGk8yMqMsWB8li1cZVW4dUa1oHwE9ma5fkHBCiObo/+EgdItf2GVwT+0M bu7k08DIAU8oSp3ZBJlbErls/ILfa/S5lPW7WjtIP3+vB2Cjm6kDOOp/UIBY9iYY OylrhVuz6dXzKecYUggD2gqMt3PaqQDahtJPi/xEDm5cBdi84s171lDRLqPoIJLD 5Hw1t6X3aHcNe0KxG5O2VReSlBqo1z4o8V+rklk8EzETdShUhIJlk4cxZUXDAo9I 8XcpuvUOsasKzqLJTCI670A93ovqkpgoEdg9HnhxiXTVstmpwE0mg== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7abs44t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:44 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NIYd1X005327; Thu, 23 Jul 2026 18:34:43 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgm6wdmg3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:43 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NIYgEc30999146 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 18:34:42 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 69E4258054; Thu, 23 Jul 2026 18:34:42 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8512458050; Thu, 23 Jul 2026 18:34:41 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.254.118]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 18:34:41 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v5 1/6] KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Date: Thu, 23 Jul 2026 11:34:35 -0700 Message-ID: <20260723183440.3271-2-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723183440.3271-1-alifm@linux.ibm.com> References: <20260723183440.3271-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfX3fv50InkElkW j47InmsQasLQyftiDKKU3QGkSeaIfnbCQgL7tG9HPcHl9dF4xUj1/+000HxBgFtRQeZxwNKrNVO PoZJK5nvNLAfWuZXlURjJaytDpNAYr5RdXSieCqBou3QN7T9bh2FpwJlLzSJwD5cKz1KKw4r5VG wMQwFlpB3BHTlhNfzkrVHHn99xvefxOEbdS0dc+afRbc/8JsoqZuhHzAGOCf8jEp5zHBerH6pol 6Mdv3pFfxPcHTqh9O9RuacvLWtOUdJsZwKk2vqFbKRWTMFGfmOJNFIVH05wEDRVQLxFc+lseNJ9 svwbrdqt2ahI0GvcqJEry+MNEkRAjKAoK0TX/FcnJnuQjfBRyHEGYuMB36NEztx8qydntwGZJ1Z uaviXxYMFEcO3YBJaMWT9o0OK+VcnYv/duKC9Jat5MDgzliyk3cd8febNdBN72Q5ByMmRzUFKSr gohGaePdXD2pKlBrb+g== X-Authority-Analysis: v=2.4 cv=F7ZnsKhN c=1 sm=1 tr=0 ts=6a625ec5 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=G-uFRffD-WzugI8hyjEA:9 X-Proofpoint-ORIG-GUID: C8GPBtHJm4CWlXqUrRYpmmShWCnLyidt X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfX2gEi7SMwPluw iVE4lLA6ceEqUnG8AtfKBftAmCn/R5z1JvQWe8ty0iCVyj4YeWtYYno8DxIFq/qP4lHQWFlv4bk /EVdHtOUkp4YzybwzIKtr3V1wnGT92U= X-Proofpoint-GUID: C8GPBtHJm4CWlXqUrRYpmmShWCnLyidt X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230178 Content-Type: text/plain; charset="utf-8" The MPCIFC instruction doesn't allow registering adapter interrupts without first unregistering. So reject any request to enable interrupt forwarding if its already enabled for the zPCI device. This also fixes overwriting and thus leaking resources when the ioctl is called multiple times for the same device. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 720bb58cabe2..d2a11cdf6941 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -237,6 +237,10 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, if (zdev->gisa =3D=3D 0) return -EINVAL; =20 + /* AIF already enabled for the device */ + if (zdev->kzdev->fib.fmt0.aibv !=3D 0) + return -EINVAL; + kvm =3D zdev->kzdev->kvm; msi_vecs =3D min_t(unsigned int, fib->fmt0.noi, zdev->max_msi); =20 --=20 2.43.0 From nobody Fri Jul 24 04:45:58 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F98947D453; Thu, 23 Jul 2026 18:34:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831692; cv=none; b=PnYECyJcLifdhLUGzUjFsdfw/TQZCsmnmHnVTBAN81H6B5AL+Nj5uKAJgKTy0NCl4lfFnlaytLXf6jj78I62eTd6ec2ubWF8pytUuDbsaWqP+W8jjQFh0xcjDM8+xaBl3pn1buSQiYbiX1LJat+iRf+7Qo39xqQbP7F95bz6HXE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831692; c=relaxed/simple; bh=IW1Gni5F3Yk9l9FItdTBHr2nR0rQxqwZ6pRdxOuOvVY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SbvY4NnNoMSYIqVY0vjw3WrN/u4X8kW6RSAW7cc4IOulEoT/QQb1GgvAdxGDPT6B4kG2BQKCpB9FtQwereyfhVnU6IlP7yUNRicoCAbnUf1t0ceV4ZqpmQjGB9/CkwdKpD5c54e9AqO+K0HaJe6DQ72pFSKhg6V0MYytLjREIfQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=WqRA12Fp; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="WqRA12Fp" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHftV63578992; Thu, 23 Jul 2026 18:34:45 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=8U9/b0+zKyQCz2Cvj dULciJQjfyr9Xs5XnEx+6RVNvo=; b=WqRA12FptRjp4bXHEmcrIXcf6ESUcOSJI 0csV3NpEhXA3dlP3epZfxVEBff+ZbXlFb1hviIIKAXEQMQa5Fe2ilTYTtpyyJg6+ eNYd2JteCD+UqBme5Xjptu/EiGYx8ZWw4lI9zck+jCZ98uUdGbd3xcBsK7VTGmr3 bclX4XePSzmjYHnuro7myl9+bnxNVB9L+uNbn1CnSzEJZbYfcKy3C7yspdzawgr4 NjRUY7Ha7yfCGbyh2Jj4zK657Ns+ocr31PQPlL7UPobg+DlZUffMoikK9Z+pk3sy dJRlr/unTKzjJE7V44GWi04moFyhz1GeMgAjRbIE6L/hgA7XUPb0w== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg78gge31-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:45 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NIYcSE006663; Thu, 23 Jul 2026 18:34:44 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgpgyn8rf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:44 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NIYhnm28377664 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 18:34:43 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6E4625805F; Thu, 23 Jul 2026 18:34:43 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 944FD58050; Thu, 23 Jul 2026 18:34:42 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.254.118]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 18:34:42 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v5 2/6] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Date: Thu, 23 Jul 2026 11:34:36 -0700 Message-ID: <20260723183440.3271-3-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723183440.3271-1-alifm@linux.ibm.com> References: <20260723183440.3271-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfXzVoicTgLydT1 VNNHGWNk4g0DoPLy3arQK3DWEvSGINHtLNYqXap3q3FSPmrZ5trIASFjUQE18VAbOu1I8wfcJhq v3jqda1IboQz95eoFj8Oxemy2DBIjrgcWoIs752sCGNgQF8CH4wvLHQKlZDSKfajc1n5Hyi8zlT 92AGfA41MS6u7pxEIUyL9R0Zs5cTtZK12xt6LcqW+YDmNTVjGSu/+wp1d0MNFpnED1c/glrAHZq Tww6L/StuW9eUAg5bjzbx/DWZ0Ghhqrj8EDjbGo1SvlDXftYQc4Z9R6UR7F0dOEFENuO9ltxpUF 9vvCaCZnNNekvcxdJwfqPPZSVrW8/XDf6vU2ZlacmXUFpaY4lPaKb2to0YO8QvvqHeAiadvEjGN IdJz/KcBUIzJDafGgW71BP1lJWAXBnlWYdyKERsOyr9NYeBgCsDGhM5hsOq+/kC4Jo83rdM+JG4 SkqUb9NI7iTz8LNHJdQ== X-Proofpoint-GUID: 5cr7kfRm2kNF3R_uv1OnDO59XvEhvl4J X-Authority-Analysis: v=2.4 cv=MelcfZ/f c=1 sm=1 tr=0 ts=6a625ec5 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=JEwYuTun2GxKFk6TasMA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfXxPaPO9s6/loW NpccnKKuYDoHZllnQ8jjxr0nXeN5Cmx7hReH+MqAvD5tECvxQbAVnSDq3uhq2ZgfX+wHyH1KX8f xsiKlO3IcC9Zf1xxUSPnZ3RcLf7E9ss= X-Proofpoint-ORIG-GUID: 5cr7kfRm2kNF3R_uv1OnDO59XvEhvl4J X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 spamscore=0 clxscore=1015 malwarescore=0 phishscore=0 adultscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230178 Content-Type: text/plain; charset="utf-8" The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages. Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Signed-off-by: Farhan Ali Reviewed-by: Matthew Rosato --- arch/s390/kvm/pci.c | 43 ++++++++++++++++++++++++++++++++----------- arch/s390/kvm/pci.h | 2 ++ 2 files changed, 34 insertions(+), 11 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index d2a11cdf6941..44c00e5e32c5 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -190,33 +190,54 @@ static int kvm_zpci_clear_airq(struct zpci_dev *zdev) return cc ? -EIO : 0; } =20 -static inline void unaccount_mem(unsigned long nr_pages) +static inline void unaccount_mem(struct kvm_zdev *kzdev, unsigned long nr_= pages) { - struct user_struct *user =3D get_uid(current_user()); + struct user_struct *user =3D kzdev->user_account; + struct mm_struct *mm_account =3D kzdev->mm_account; =20 - if (user) + if (user) { atomic_long_sub(nr_pages, &user->locked_vm); - if (current->mm) - atomic64_sub(nr_pages, ¤t->mm->pinned_vm); + free_uid(user); + kzdev->user_account =3D NULL; + } + + if (mm_account) { + atomic64_sub(nr_pages, &mm_account->pinned_vm); + mmdrop(mm_account); + kzdev->mm_account =3D NULL; + } } =20 -static inline int account_mem(unsigned long nr_pages) +static inline int account_mem(struct kvm_zdev *kzdev, unsigned long nr_pag= es) { struct user_struct *user =3D get_uid(current_user()); unsigned long page_limit, cur_pages, new_pages; + int rc =3D 0; =20 page_limit =3D rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; =20 cur_pages =3D atomic_long_read(&user->locked_vm); do { new_pages =3D cur_pages + nr_pages; - if (new_pages > page_limit) - return -ENOMEM; + if (new_pages > page_limit) { + rc =3D -ENOMEM; + goto out; + } } while (!atomic_long_try_cmpxchg(&user->locked_vm, &cur_pages, new_pages= )); =20 - atomic64_add(nr_pages, ¤t->mm->pinned_vm); + if (current->mm) { + mmgrab(current->mm); + atomic64_add(nr_pages, ¤t->mm->pinned_vm); + } + + kzdev->user_account =3D user; + kzdev->mm_account =3D current->mm; =20 return 0; + +out: + free_uid(user); + return rc; } =20 static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib = *fib, @@ -279,7 +300,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, } =20 /* Account for pinned pages, roll back on failure */ - if (account_mem(pcount)) + if (account_mem(zdev->kzdev, pcount)) goto unpin2; =20 /* AISB must be allocated before we can fill in GAITE */ @@ -400,7 +421,7 @@ static int kvm_s390_pci_aif_disable(struct zpci_dev *zd= ev, bool force) pcount++; } if (pcount > 0) - unaccount_mem(pcount); + unaccount_mem(kzdev, pcount); out: mutex_unlock(&aift->aift_lock); =20 diff --git a/arch/s390/kvm/pci.h b/arch/s390/kvm/pci.h index ff0972dd5e71..fdf8c7bf4ed0 100644 --- a/arch/s390/kvm/pci.h +++ b/arch/s390/kvm/pci.h @@ -22,6 +22,8 @@ struct kvm_zdev { struct kvm *kvm; struct zpci_fib fib; struct list_head entry; + struct user_struct *user_account; + struct mm_struct *mm_account; }; =20 struct zpci_gaite { --=20 2.43.0 From nobody Fri Jul 24 04:45:58 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 615EC3B71C6; Thu, 23 Jul 2026 18:34:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831695; cv=none; b=CO2JkyJo0OoqYd/o/mfIclsyJY2FRgRxlmlzFpT26ipZbSyigknYlbnVjvb31zIQfKlIdR40VVzgL92wBI5v3X90g2ZmuURe8FBuLwYGWd8zG7lCdpAksIRpqq04bfYYeKabwwrBETh1cF5sPYk0Xphob2klx0cJNkK6BjUeuxY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831695; c=relaxed/simple; bh=cACEiM6Nq+6I4fyIVQbBsqHVLzW5fcBPUsr1jB3xDMM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S0RoLJGUrjSv7cVz5TeJwGG0p+q4UDYORwtkBg6ceYSB6RwDTGhfbPynRLgv5lAmnIvuWJEWo+t11CyU/qZzK9QpamLHA5qmy3j96exjRP5X8qecyYAAsjserwoUE5nBwGV/eh91OBL/uLJdtLEczt/eenmONFAEgrQhLPfjegQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=QP7dXznj; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="QP7dXznj" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHgb331806161; Thu, 23 Jul 2026 18:34:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=UHxpgyzoTI4Km5fw2 6DQzeQjQssmfWgLtDByRdwuZu8=; b=QP7dXznj8AYz5Pejb44RSFSrX9QhHJ0xI aEZBqXhc5jlrZr/epZ7vFvLz664Qv00yJY1Owq+Ng/KIdjVPOU9D2pUYIHw0MT4U 2TGVo0VlDgWPj7lccZvbMDjY/Dvs9yghf7lsw5qG3TJ3BdpeUTuKI2Woz+tTNDM1 o8Mxg16NRmY4OsWlG1iW8n4aGIGgsodna9fgXVjNAHBwnEzFiPg+b/RsLjS0izYi 7KeMFtASHBPFMYwUDnyzAhr41y7rJL1T4hy/2NaqEnYRKt+PrG0RKJNZugaQ4RP4 +DmQMAU6tNK6lmH/slm8M70G7Ld2nsjHWL+BgxNEY0KJNvIF3nqCg== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77as2tt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:47 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NIYdlc005311; Thu, 23 Jul 2026 18:34:46 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgm6wdmg9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:46 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NIYipq29426182 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 18:34:44 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6952758056; Thu, 23 Jul 2026 18:34:44 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 985E158050; Thu, 23 Jul 2026 18:34:43 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.254.118]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 18:34:43 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v5 3/6] KVM: s390: pci: Fix missing error codes and memory unaccounting Date: Thu, 23 Jul 2026 11:34:37 -0700 Message-ID: <20260723183440.3271-4-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723183440.3271-1-alifm@linux.ibm.com> References: <20260723183440.3271-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: UJfjIU_HsYcgzBkwyyip0T1dd9qNtUWn X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfX1+0MWlQHCCdL zVeJEpYU1nfLVVFyC87829PCN+S3QUZH3ZcFkkXygEVH6zSiUZ3KUBPFGzrVyTecZ7GC3KTtQq8 kIJtlZu81opWrjOaYdfxU6DuIISZbFE= X-Proofpoint-GUID: UJfjIU_HsYcgzBkwyyip0T1dd9qNtUWn X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfX03Z2LTkuYjm7 nup1BF+1aeCx6wKB7pac4ZDdvM9Btbhh8sE5sa82IgapjSgjGRyCIf+9UfXoZ7mtCxJSOtxk7Cl TxkRSc11OAmWgg/gov7+HbCaXGp5fnny/+x9w6I4g9s/f2aXvIdoaw2/4t8wzUELo5AuwgF2Jnn KtknCZRqpCLsTeaB+JcI19qHvyNeaoZqB3mUnhEhGsSe3NgRLxFWOoiMSeBkpioheNtwLTdqxs4 sIQZcxRxMiNjjrBpLg8Mmi8T7T3ADvBERNsHr4f4B/sXkoBBCSjDqtbp3/1chgz+xgvtbaL6dvR NQ7g3t0AdBhM8EWBoqahdDoJXwSznO+dcc5hzy8FMPNfqaQ/GL8jol6O4Dqwa5lWYvP5AEVYPzu 930FkpUQRMJltvRWSnck3jGaf44nz6OwBLLzI1y+5JgB2oNfRHjBdGvZPiy+YSC0fFkm25uZqBI Y36NhPBXBJS2USktEJQ== X-Authority-Analysis: v=2.4 cv=K7AS2SWI c=1 sm=1 tr=0 ts=6a625ec7 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=g4erIPh_aaDScpLpsJUA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230178 Content-Type: text/plain; charset="utf-8" In kvm_s390_pci_aif_enable() two error paths failed to set an error code, causing the function to return 0 on failure. It also failed to rollback memory accounting on failure. Fix both by propagating an error code on failure and calling unaccount_mem() in the cleanup path. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 44c00e5e32c5..f58d7ec0bc7e 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -300,14 +300,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, } =20 /* Account for pinned pages, roll back on failure */ - if (account_mem(zdev->kzdev, pcount)) + rc =3D account_mem(zdev->kzdev, pcount); + if (rc) goto unpin2; =20 /* AISB must be allocated before we can fill in GAITE */ mutex_lock(&aift->aift_lock); bit =3D airq_iv_alloc_bit(aift->sbv); - if (bit =3D=3D -1UL) + if (bit =3D=3D -1UL) { + rc =3D -ENOMEM; goto unlock; + } zdev->aisb =3D bit; /* store the summary bit number */ zdev->aibv =3D airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK | @@ -351,6 +354,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, return rc; =20 unlock: + if (pcount > 0) + unaccount_mem(zdev->kzdev, pcount); mutex_unlock(&aift->aift_lock); unpin2: if (fib->fmt0.sum =3D=3D 1) --=20 2.43.0 From nobody Fri Jul 24 04:45:58 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6217D3BD22F; Thu, 23 Jul 2026 18:34:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831693; cv=none; b=nWrW/20RMQMMxr/SvS1TjVepeTWhPEwPTxsEMeuGoVzqvByvPdTJAA5EOHQBhgqXQVzJlBxO/HMAQHTJm7rnHCygAlmC9in2ar0yR7QDwLTLSfC59fHXoIcgrssPncdnAbJm9EW+HtrdHM03kkzg4KdJ6dac1ybg2oLEwy8oPro= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831693; c=relaxed/simple; bh=SbKNcsHNuuvpmBhdUM5aPMA2TeC7kEeDkvO2AnWU1DU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HzIL2dPbU3DkgR+s0VTK1pAGWuYdf9nyBOi3215y0CXLVt00vNjzq9b9qUYWzJ50D+ewmA8TQCfFHucl4qP8OHR1FQOXwwySMdO0HOgS9sj1tdzeKcZ32Bm+LdXIKFalHFmNIjkj4YWRp7mAHozvLy5IMXxSVe9pcBkW44M3f2w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=iToDj3vq; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="iToDj3vq" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHff1i3699134; Thu, 23 Jul 2026 18:34:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=9BSAswjPgsFB3mwS+ 9M8RqhlvouBeOd1JU81W/D8CTc=; b=iToDj3vqcxnqSXrSUnYlqGttG/0T+enUr 3T4WKfteZNjL/vyqc/5VDDLdHXSN0hFLQfGsgTHh1HtXez30m0gDp6D7nR9fjeV8 MDb9c5suHQQdoq9d4rbaSV0YuB5v9Gvn7SAodggMuNFNwBhHvo09kXfxZM8PXWWR jV7Us+umV7dWMJTNkxS0rsqY187tN5ChZRP3C1RFQRas4KSPy1W8hGrhurXRYLmR cxgwY1xYkTBGwkx2nRGKvBLod1J0ffRZchbjWPTdacHeYl8Lob2twt3ZeM2RZw38 2XmlrjvOqjQqx7MGldslFfsina4Wl+QhFdG4VbKysoDnxMsqEsZMw== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7919363-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:47 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NIYdBS019032; Thu, 23 Jul 2026 18:34:46 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1gnb4b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:46 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NIYj3w26018504 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 18:34:45 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6B6E658054; Thu, 23 Jul 2026 18:34:45 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 94ACE58050; Thu, 23 Jul 2026 18:34:44 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.254.118]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 18:34:44 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v5 4/6] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Date: Thu, 23 Jul 2026 11:34:38 -0700 Message-ID: <20260723183440.3271-5-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723183440.3271-1-alifm@linux.ibm.com> References: <20260723183440.3271-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: -1cZzAMJ8ixisMy2Y7ilB0APxuyYWrNP X-Authority-Analysis: v=2.4 cv=V6RNF+ni c=1 sm=1 tr=0 ts=6a625ec7 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=VpFnpj6RERqEfYQjrFkA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfXzmEmo/Ruz7xw IwLFeJaPTnVnNQcbBAUcaDT5JbWHFbWhWiq1dV/6/A9DKyxqJm3yH+h7lv1yY57Iuj+Bah3MJ3o efjQEzc36VKGeA5aRxAmc2xZdsMWAGw= X-Proofpoint-GUID: -1cZzAMJ8ixisMy2Y7ilB0APxuyYWrNP X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfXyIkHyfiFDh5t 13Ru8FM+gHu6idFgXPL0NUU6fR7Nd53DXq40pVB6btzOpEEPu+NHiJygh6Adbtv15E8386nqE7N KpyEvdwYdmLiOzpk/zKkNMT2YIFkN031K9xsCWQz1c7IolOXFFh5Dn0N2+4F03kJEzuRhcjIL2y SgYTcaVTVPV7kVDJyC7rXrG9zFtcrLU8Uz4v0crUOHcgIXwp9keL59pmgrGm7a/kgMJCM8MlHxb /YjrrBCnOLvzFGb1FZclNDgPBhReILWr/9Tixf4y1h/kjNdBSNqyjPIVB1vylifSJdfJDlrSMMB Umfxg+4DrwcBk3nWYa9bX9+WXM4xfkV+p8iy8lYh+9NgUDcALI5//LEv+aDoGt5zVOkv2MYY/hj 6A8kGtu43g1aiBuflQJmZohtCXesHZMycDpRWuBE1I6L4g5JiQBLvaFs60BTa3J1JsmDVF64NAi f7hHJ11C58pzowUnxRg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 adultscore=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 spamscore=0 impostorscore=0 phishscore=0 priorityscore=1501 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230178 Content-Type: text/plain; charset="utf-8" The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index f58d7ec0bc7e..602534e3cc10 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -317,6 +317,11 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, AIRQ_IV_GUESTVEC, phys_to_virt(fib->fmt0.aibv)); =20 + if (!zdev->aibv) { + rc =3D -ENOMEM; + goto free_aisb; + } + spin_lock_irq(&aift->gait_lock); gaite =3D aift->gait + zdev->aisb; =20 @@ -353,6 +358,9 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, rc =3D kvm_zpci_set_airq(zdev); return rc; =20 +free_aisb: + airq_iv_free_bit(aift->sbv, zdev->aisb); + zdev->aisb =3D 0; unlock: if (pcount > 0) unaccount_mem(zdev->kzdev, pcount); --=20 2.43.0 From nobody Fri Jul 24 04:45:58 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBEA447D451; Thu, 23 Jul 2026 18:34:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831694; cv=none; b=ABb+vZM/I+62FZoScd9m+L1ntl5ThTqE6BcYyHqlHTKi81zKS1sKSvzrDrbUkjTDhhE3QjDTpsRopK0FWTDsD7DsOye593f4SGIFcqhjrjEFKibmmyKf8GPKL5KtEYIjSGiLLbGeJQ+MXE9UhLYW+rVQ3pLPSUcWGtNtzai6a7Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831694; c=relaxed/simple; bh=thA7gX6G54GuWpd3lC/bjXhJ5WYPxJjBSUfbZ+4GtDw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VczXRJPLIUdb+M9mazIh71KtZ6w8HWFZ/YcvHYN4VOALLj007QOK4LWCh6cm3xh8u4rhchbUyXzTiEFtBjqItjRcRs6pTRFV4l5ShOtK6rkBAzZIq2fAiHnl2ZAKvr7ymKYqr2ahJIcitUdvWAC3CDqhZDbJS1jfTLnv9NeV+oc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=A6KGDZrc; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="A6KGDZrc" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHg5AI1805143; Thu, 23 Jul 2026 18:34:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Je/LVVXLIsLg5NQyV sdx9SPo3hpI5m+RasXNPrFWqus=; b=A6KGDZrcDK0gVKcvW7H6aiYAis8mzSdbL FOQ7ORVWbO9OGDnHAF27z8PAbGoEHt8XtLqzKRF6QkNOE9HEfAHsSH6WvXr3vZRj aBrGB1LKfRN59t866SE6Y8XwFXVPTC0OLzuZZBwmCKlL0MydTuNwbVpc/WdQc9QZ E2XNFFPp9aMe8rR6g8o1WI6iRWALfwHt8KSmqbea8gmwXZiV56FjzVN8SDMmqZTw bbwYrtlFns1y+JFCKCimCiXXoTIAkDJb9Vrc6sPGdVrkBUcoGcdDuttALEatexAe 6gyWoI2m1pocmtZduubv4BhhZFqQ+9FBA4uwEMvOh3zX+AOm4nwKA== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77as2tw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:48 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NIYcPL019024; Thu, 23 Jul 2026 18:34:48 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgp1gnb4d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:47 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NIYkZD59834662 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 18:34:46 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6913F58052; Thu, 23 Jul 2026 18:34:46 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 95CAE58050; Thu, 23 Jul 2026 18:34:45 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.254.118]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 18:34:45 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v5 5/6] KVM: s390: pci: Fix resource leak on IRQ registration failure Date: Thu, 23 Jul 2026 11:34:39 -0700 Message-ID: <20260723183440.3271-6-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723183440.3271-1-alifm@linux.ibm.com> References: <20260723183440.3271-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: _orBgy3qahhQAKwrfse-OLlXozT97iSp X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfXz7UmwMStJiYb jDLhHRjC0zPfJFd6hWBJ8tASIyVQGEUG30/fWh/DFQ6F7IKmF8ErCaozswIfuJG3XsepYQj6PBE uxnK5yA1lgkGhh5eV1QhmYnyrGYfBiI= X-Proofpoint-GUID: _orBgy3qahhQAKwrfse-OLlXozT97iSp X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfX8z6nJz6YHAWv 46PQptL6otKlK3o7NGvisJjY4jAdpo3LTL3DbLbtPj6oW0W81OxuoFJuDbn7TOjqNHitkQa3cnV HNFm+heloMAc3PHAYmGJEcz5aNmqIcKydyFu5At5fAIQ5DDI3TC9WLlEQgJ7OjlFT+rLUI0WqZ/ HrADA7csEwUaTX3CInCdn8bySFV+V+5ilGZ0I+GW+d3jyyrNsnZ1zuPUkmWeMVp3N7RFmBU/Zbm n7SNummLeh+Nydn+Js0ZWmIk7jR1vbzLo5qIQFgN/jCTtvDanWuIcALjTMtpc8YLFNnFvYfJVf5 b5oRdkLogVHELasCvIDdFc2jSJkCccxl8RdGAcaVC4cMZWT8jqC1VfaByOH96Eve7fkSB93PcS9 fdnGK97d1CoY/nwup+ZTykOipmfFPXoUnP3JHLFn7UzhueaWzupve9f0wq9tB1jM0R4MK2Wex2h SU1zpya3uGaMyJA6qXA== X-Authority-Analysis: v=2.4 cv=K7AS2SWI c=1 sm=1 tr=0 ts=6a625ec8 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=oLYdd9eN5-LzSxCheKcA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230178 Content-Type: text/plain; charset="utf-8" Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns an error code but doesn't do any resource cleanup, thus leaking resources. Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and unpinning any pinned pages. While at it, remove dead code that stored FIB values that were never referenced. As part of the cleanup, we are also holding the aift_lock while executing=20 the MPCIFC instruction. Though this is not strictly necessary, it means=20 we don't have to drop and re-acquire in the error case. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato Reviewed-by: Christian Borntraeger Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 602534e3cc10..ca8ef76bcf6b 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -344,19 +344,32 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, aift->kzdev[zdev->aisb] =3D zdev->kzdev; spin_unlock_irq(&aift->gait_lock); =20 - /* Update guest FIB for re-issue */ - fib->fmt0.aisbo =3D zdev->aisb & 63; - fib->fmt0.aisb =3D virt_to_phys(aift->sbv->vector) + (zdev->aisb / 64) * = 8; - fib->fmt0.isc =3D gisc; - /* Save some guest fib values in the host for later use */ - zdev->kzdev->fib.fmt0.isc =3D fib->fmt0.isc; + zdev->kzdev->fib.fmt0.isc =3D gisc; zdev->kzdev->fib.fmt0.aibv =3D fib->fmt0.aibv; - mutex_unlock(&aift->aift_lock); =20 /* Issue the clp to setup the irq now */ rc =3D kvm_zpci_set_airq(zdev); - return rc; + if (!rc) { + mutex_unlock(&aift->aift_lock); + return rc; + } + + /* Start cleanup */ + zdev->kzdev->fib.fmt0.isc =3D 0; + zdev->kzdev->fib.fmt0.aibv =3D 0; + + spin_lock_irq(&aift->gait_lock); + gaite->count--; + gaite->aisb =3D 0; + gaite->gisc =3D 0; + gaite->aisbo =3D 0; + gaite->gisa =3D 0; + aift->kzdev[zdev->aisb] =3D NULL; + spin_unlock_irq(&aift->gait_lock); + + airq_iv_release(zdev->aibv); + zdev->aibv =3D NULL; =20 free_aisb: airq_iv_free_bit(aift->sbv, zdev->aisb); --=20 2.43.0 From nobody Fri Jul 24 04:45:58 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BD7A47D47A; Thu, 23 Jul 2026 18:34:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831696; cv=none; b=Cm3fF6Jq/U39bDbiZkRp2w+B4Vz9oHOXTKTI/CVkarE3tXpOSRyYW6aZ7PThKEIMXHLXIM1Qz/Tyq6nCX3GY65edoaFItOee1jkpJGcN8T1pfUyq0m+v0urr3xBwf61hNpOCtqql3xqSN3JKGeDZ0KQFPxvYxilIXA3zbfTF51Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784831696; c=relaxed/simple; bh=54L5Mof65KkksepWM7MEAnPtHmro77V/d/+8oEU5T2A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZoL/hW+my5LEhulTD7f7406l7n5kdDJLAE1v3uFmHIwBLDl01oeaFw8VL7fF8E14ZA0VMhBK9/10W74LdE/MG5c3osLojMiSUGqRRcCDKdOC/rMgX9nKsKC7ZDhuKJtvYD5mmUlhibnx2F7oc+JdWcwJ65dJBlkYLS+a/4Roq6U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=VggVgJyH; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="VggVgJyH" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NHg1dh1805084; Thu, 23 Jul 2026 18:34:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=zbHB3DYzLJg4dV11j yjVCJdhGA4HE7gLLt/5IfMGfVw=; b=VggVgJyH8ioqNmK3VqDqB4dMLJk2ELqSq LG4SzGXQ9ktNaMohlZQqHJxv/QAowCpuFUNUqBeSrJa63AuPZz9Zy871e9TRoH8u d/4cv1RcEhG6AzGg8NOkGKoOVGFtIrqdz5IkyYhjXPjhvLBzDFKiPElbuLfmvWw5 i086kk09e0PyffAlHgH+TSKnSjZjxsB6Y756hydzIMeIQNT0aqCMD2Svg6KAUTFO wRv8hSHP0cFb/7QwSMfT+l3YqRriLD6NKYs5lfLqpVI5E+76SF9aQOLtokE5dWim HZdwsUoaoLisK5qXH1krKlbcxnRfzlu+YCRxUL2k6qhE9ptNjzAPw== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77as2u0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:49 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NIYi7P006987; Thu, 23 Jul 2026 18:34:49 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgpgyn8rs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 18:34:48 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (smtpav04.wdc07v.mail.ibm.com [10.39.53.231]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NIYl1j20972054 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 18:34:47 GMT Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 62C1158052; Thu, 23 Jul 2026 18:34:47 +0000 (GMT) Received: from smtpav04.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 91DF958050; Thu, 23 Jul 2026 18:34:46 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.254.118]) by smtpav04.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 18:34:46 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v5 6/6] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Date: Thu, 23 Jul 2026 11:34:40 -0700 Message-ID: <20260723183440.3271-7-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723183440.3271-1-alifm@linux.ibm.com> References: <20260723183440.3271-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: z5ICz-o9QfjrKqmoHh9AVT_wkjqtNs5C X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfX8RiCRFD5KstZ HEq/VntFqL0Ou5uLD3Qffhl/358N8dCZTSeKr/Y2ZGnQJmlGugLJ6z2GHlBy9OZc4czhfHud225 SDAGHOjG/6r+kQXhBBKxo9Ue9MvvZTo= X-Proofpoint-GUID: z5ICz-o9QfjrKqmoHh9AVT_wkjqtNs5C X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDE3OCBTYWx0ZWRfX5O3XZNNF6Drq B+ZeSV2Q4DXA9nD9cqX1E1dHh45LZQalMlcRyYWXrVyYq/0vjsk6Ei2QAziQl7I2DQ6Fjjs0G3R tQ1khJISzVe5U+xTW3kFJg9IEHR4iz5UUMc/e+1tre7lLmNwv+NSyyAgSjOVt/vl6TJZTuj56TP 7oBXvLRuJO/Mwb5bS7CpaQDpPZdEbDwCZCB+N7LjxwraHeHtJxR3wAsNTaCJkQmrhXTo0mMQYSB JP4F8pRluYjL4xwP6wvMuYO2B0vJYO+SO+XTbr+NhPXg+/QpsHy0TbfY+v3SMATMVkQmU0uvBsR QMEuejjAe6fXgboHnJtJRGX4tA3FgC8pqjkeDkohvMCIx3YMMNbrvKLAWW8YFOjpaizSPu1E8Rf Zwffa0SxaG5ASmwt6TQOFwkH5gRsRBtM2YGRE+OBN2IpoO1sgS+Wglwi8/mZFCOO5SmTEfI3sx/ tzGj+VUTA0Gdv/bhWbQ== X-Authority-Analysis: v=2.4 cv=K7AS2SWI c=1 sm=1 tr=0 ts=6a625ec9 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=i8wI3NWYBEf5A6oN4S0A:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_05,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 suspectscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230178 Content-Type: text/plain; charset="utf-8" The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a single page boundary, then reject the request as we cannot safely pin the guest AIBV. Similarly reject the request if the AISB address is not 8-byte aligned as the architecture requires doubleword alignment for the summary bit address. Since the AISBO can address up to 64 bits, the size of the AISB can only be 8 bytes for the function. This also ensures the AISB doesn't exceed a single page boundary. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali --- arch/s390/kvm/pci.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index ca8ef76bcf6b..25185d04ca28 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -244,7 +244,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, bool assist) { struct page *pages[1], *aibv_page, *aisb_page =3D NULL; - unsigned int msi_vecs, idx; + unsigned int msi_vecs, idx, size; struct zpci_gaite *gaite; unsigned long hva, bit; struct kvm *kvm; @@ -271,6 +271,15 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, return gisc; =20 /* Replace AIBV address */ + size =3D BITS_TO_LONGS(msi_vecs) * sizeof(unsigned long); + size +=3D (fib->fmt0.aibvo / 8); + npages =3D DIV_ROUND_UP((fib->fmt0.aibv & ~PAGE_MASK) + size, PAGE_SIZE); + /* AIBV cannot span more than 1 page */ + if (npages > 1) { + rc =3D -EINVAL; + goto out; + } + idx =3D srcu_read_lock(&kvm->srcu); hva =3D gfn_to_hva(kvm, gpa_to_gfn((gpa_t)fib->fmt0.aibv)); npages =3D pin_user_pages_fast(hva, 1, FOLL_WRITE | FOLL_LONGTERM, pages); @@ -286,6 +295,12 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, =20 /* Pin the guest AISB if one was specified */ if (fib->fmt0.sum =3D=3D 1) { + /* AISB must be dword aligned */ + if (fib->fmt0.aisb & 0x7) { + rc =3D -EINVAL; + goto unpin1; + } + idx =3D srcu_read_lock(&kvm->srcu); hva =3D gfn_to_hva(kvm, gpa_to_gfn((gpa_t)fib->fmt0.aisb)); npages =3D pin_user_pages_fast(hva, 1, FOLL_WRITE | FOLL_LONGTERM, --=20 2.43.0