From nobody Fri Jul 24 04:46:03 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9ADA9339844; Thu, 23 Jul 2026 22:14:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844854; cv=none; b=FyL5XnQv1RuDkGyXNZWQIukysSD9aYGhNDZnAPWaitbqGFVNAuT7+4z3zlzMSg63b2GUx0UKuvE9JgZUKK68zKNB7ecOfIQLIJa/wdRnyzHUE5QoPHuaRZlsQhIxB6QwtLuUOroXoxa/2B+DN0r6xtAGKiD5QTVc/GkOPlXqgZI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844854; c=relaxed/simple; bh=J4rj2ZN//xVarZrYZCxN43NnJ0NcRj3mrBSYGw7AmqI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NU5xX+ez8juJxrcIVae5EzVK/1IC4IIFtJNpQwltUpfUE6O+lV1P91X08mFQoTRz44XjW8blRGR6MJdcymPzFIE3L7nhXyxBkPMo/Bpu5cxtEGD+FaLZXT0aTouNZQAJID0uSA9rDZmwo6uF3w/cr8gpIu/gUyYWCEm+Of+kV84= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=rTSfBIWq; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="rTSfBIWq" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NLgUox4192294; Thu, 23 Jul 2026 22:14:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=s8kEz6tL+IAX1w09s dKggdxzvbkfbK6pwkFuZZg4FFU=; b=rTSfBIWqZUrmRzLpe1TY0KSZ1mt/7Kg8b PxukEyrdTwyl8yOK4ERhl7MKX3lxS62OkQ23uhtTwTycjRFMugOeBUe8+YcB3Bi9 PcbHXjI5XsNA1vaUy9tQZHtnBRYOrthbf9fHxrIwa2Frvdg9SvzprVFihuvWhj3N LixWtgt7P/a9iXPs6JPIaIZny9Mhbwk3DpOxTIzfRSKC+FWV1EXxBY0QZMrMP9L7 gVhiWl3CiOrAnVxvOwEoIZobB+bX908Aa62E4xpYyoC4BohX1fLHJXvru05rrAn5 NJKXzdGUDrHeogOEPMs/u3pQd0oFmBLxhvWD9jRBnJKSDMW/yfeZw== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7ahh8ex-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:12 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NM4cNO031287; Thu, 23 Jul 2026 22:14:11 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgpgyp0ux-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:11 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (smtpav04.dal12v.mail.ibm.com [10.241.53.103]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NMEAK227066988 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 22:14:11 GMT Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DB7885805A; Thu, 23 Jul 2026 22:14:10 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 411D958056; Thu, 23 Jul 2026 22:14:10 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.246.245]) by smtpav04.dal12v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 22:14:10 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v6 1/6] KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Date: Thu, 23 Jul 2026 15:14:04 -0700 Message-ID: <20260723221409.5874-2-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723221409.5874-1-alifm@linux.ibm.com> References: <20260723221409.5874-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: HVYBf80CMZCwmu5DhCzfvwqQP0yyc0FH X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfX+ygpPwVVR4l7 E1euulMoO6LtbnSKvTPUR18TLT2HdV/+sQho2Mv7598pHiv0ccysLlQfuQU/25uPjTfr6L9tFQ4 zb5QAQrrTFo/66l8WjNqY2KlGGixE5U+NsUEItVAYiee2RZ/ono1KYHo5nigS2NfZ/iN/8pfsGM HyEL0nVPVIDtv81/dmpVekbjHS0p3svuxvlzNT22PTASH9hZ6LsGaPwtqo6+m6WIQq2FF0VKZuX vWT6TVO/UJvuAOmC1rAubBYubrHNzEGsIA8NSRfLD/7A5Kr4WSQU5bAZ3W9nXFhfoxQ6JeZq8Ar m9YcJ0XZiaT/BSytx6N9gsN+KeaQeCE35wPKNltsmtE88h5IHt960ZgyFlRfqzID8hqOnTOePE4 LcaFbzrbl6NvDoYzgu6pV4rXC+73BhFsUYNH+K7c1v/gAt6Fg/59md052gX4vK0Hl/KV5bHhQCi 1tQDTPOYjpZM6vMnE2w== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfXxpeBFRWhBgnT i2TRoxZvMOru2MyUQetlVm/MG3/7y90g+y4Z0XjkOKx5dlG4GfSPo6kSURcekKu047/bL/Qii32 2CSlpshYZm+zGZVW96b2DHGGK4e2TrU= X-Proofpoint-GUID: HVYBf80CMZCwmu5DhCzfvwqQP0yyc0FH X-Authority-Analysis: v=2.4 cv=SM5ykuvH c=1 sm=1 tr=0 ts=6a629234 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=G-uFRffD-WzugI8hyjEA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_07,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 spamscore=0 malwarescore=0 priorityscore=1501 phishscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230215 Content-Type: text/plain; charset="utf-8" The MPCIFC instruction doesn't allow registering adapter interrupts without first unregistering. So reject any request to enable interrupt forwarding if its already enabled for the zPCI device. This also fixes overwriting and thus leaking resources when the ioctl is called multiple times for the same device. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali Tested-by: Matthew Rosato --- arch/s390/kvm/pci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 720bb58cabe2..d2a11cdf6941 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -237,6 +237,10 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, if (zdev->gisa =3D=3D 0) return -EINVAL; =20 + /* AIF already enabled for the device */ + if (zdev->kzdev->fib.fmt0.aibv !=3D 0) + return -EINVAL; + kvm =3D zdev->kzdev->kvm; msi_vecs =3D min_t(unsigned int, fib->fmt0.noi, zdev->max_msi); =20 --=20 2.43.0 From nobody Fri Jul 24 04:46:03 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9AF48286409; Thu, 23 Jul 2026 22:14:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844856; cv=none; b=WFyVlnu/BHrFR1zjmgVbDaTLzrd/IZD6n9dP3iRkvP7M6Efwj7yryToSdDYKbGPqRibdo3KZFq10Qa6VaHf/94gnkkv2wLXI6Tbfv8+SjO/GwHDq8onyPrv7hwYESy4M5hXrvmBCBWXwztL5QX4ZYHJRLD1D8MwcloJgyp6Elzg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844856; c=relaxed/simple; bh=fqaThiPNzIVoMXPHGOntizGg/6n2rla544u3IDRVPlE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kXOLvaf88ZLLe8mi7WsLX+oPdvSdjKDpjuLli8avnikyQ0StHxDf+ebKUtu1S5o0FIlUzRJ/TbUooGOpB+CtDE9l0cDZo1uqCDDUrYubVX8oVMvo++0qwKJn/kcCk6zOYGQaDXpe5qgb7fsV1H4B1/ABuua6IIYAIPMq5E78d5g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Gq5elxdE; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Gq5elxdE" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NLgEe74186885; Thu, 23 Jul 2026 22:14:13 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=acBVdoIgc8w1e6aH8 pRq4ijNnTyeMgJjFmYngVNo/eg=; b=Gq5elxdEC+OxDrZLY1/EkeK7dfPiOWr07 odS1tC+1CX0XxnvGxPe5nkOoERgxkvsNrzuods1RPm6/2HNbsaFCZq5UPoDDQpdW 3wIpaSujWT/v0S52ZTfeOADUdFdGYcFPxcsOVCMSnkBP+nlsBPlYB3LvUqMZI7Y/ h07s2WP3rkCRMuCy2rMND+huycy2rSkkFfErXbIfguSr9WIxSO84PhndIiEznHoU KOJuqsIN3siM+ieh2jnjLxELBclbntTZQJecJTXTHa1AqDBINjOkAOlDnCDUFm4Q OkLbLXtqh65Uubv7r8VgNoDlY/1WJnFk5obGxgHVAXYWiyvQZvxOA== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7abswx6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:13 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NM4aQL028626; Thu, 23 Jul 2026 22:14:12 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgktqeexe-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:12 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (smtpav04.dal12v.mail.ibm.com [10.241.53.103]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NMEBZp28443220 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 22:14:11 GMT Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8D1DB5805A; Thu, 23 Jul 2026 22:14:11 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 036E358056; Thu, 23 Jul 2026 22:14:11 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.246.245]) by smtpav04.dal12v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 22:14:10 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v6 2/6] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Date: Thu, 23 Jul 2026 15:14:05 -0700 Message-ID: <20260723221409.5874-3-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723221409.5874-1-alifm@linux.ibm.com> References: <20260723221409.5874-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfX0TJbPCbBWm4J HcFU6BqFXwus5j+GIPRShg7Gwposembo8mpSoUY3ZPyZCCbi773eZiYelUP0xzqW+2ImuRDyUdJ p84PWRx3kVp/t1GeBmR/2q1OWW8YZfVUu0QmTPfpJZM460FAgMRNgeDVBPJCQn3VrnsWrEXKpxv +hVG9BqW06W1ZMD33G7cQjlAfbH+/dG4Of0xp4FvEpyDlmIbSvNDugU8kMuoOqgHl9AmiuJQL82 vJYLjhRuGUj/NR2+acVjn44ItopJ2aFDbdG7OzFv7ioJYimpMwz1CopVk0fCzMUGCAqMU33J0Gp FUiXdKnb508QcTzSM6qW1qoFGvzZzdGOVkXufrUwYtekMqhkb8UXpk0NA0xT2egQa4fab1x7h4m m9oTLR80jVSyCwNgHzTKjSyWix8AJjE0yzNkti5kJLSO6U6riZ1JK7ByakHX0lxn1wKQWTQGW+/ vXJeh078BaZH1+NZM1Q== X-Authority-Analysis: v=2.4 cv=F7ZnsKhN c=1 sm=1 tr=0 ts=6a629235 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=JEwYuTun2GxKFk6TasMA:9 X-Proofpoint-ORIG-GUID: YBLRGD2fneZq8owNc6XFc5p52x0pckn2 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfX/Lfc1bPbZa4+ LiTyMyzpDgMxqx7iU+FdjRO0jWc3PS1wfiQZvDmnIXqJ3piHy+vMEyXiSIdCXaKn45c80uACPMo Nxu9oH9anbtfDN2L0+erX9bszUCwX+U= X-Proofpoint-GUID: YBLRGD2fneZq8owNc6XFc5p52x0pckn2 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_07,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230215 Content-Type: text/plain; charset="utf-8" The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages. Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali Tested-by: Matthew Rosato --- arch/s390/kvm/pci.c | 43 ++++++++++++++++++++++++++++++++----------- arch/s390/kvm/pci.h | 2 ++ 2 files changed, 34 insertions(+), 11 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index d2a11cdf6941..44c00e5e32c5 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -190,33 +190,54 @@ static int kvm_zpci_clear_airq(struct zpci_dev *zdev) return cc ? -EIO : 0; } =20 -static inline void unaccount_mem(unsigned long nr_pages) +static inline void unaccount_mem(struct kvm_zdev *kzdev, unsigned long nr_= pages) { - struct user_struct *user =3D get_uid(current_user()); + struct user_struct *user =3D kzdev->user_account; + struct mm_struct *mm_account =3D kzdev->mm_account; =20 - if (user) + if (user) { atomic_long_sub(nr_pages, &user->locked_vm); - if (current->mm) - atomic64_sub(nr_pages, ¤t->mm->pinned_vm); + free_uid(user); + kzdev->user_account =3D NULL; + } + + if (mm_account) { + atomic64_sub(nr_pages, &mm_account->pinned_vm); + mmdrop(mm_account); + kzdev->mm_account =3D NULL; + } } =20 -static inline int account_mem(unsigned long nr_pages) +static inline int account_mem(struct kvm_zdev *kzdev, unsigned long nr_pag= es) { struct user_struct *user =3D get_uid(current_user()); unsigned long page_limit, cur_pages, new_pages; + int rc =3D 0; =20 page_limit =3D rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; =20 cur_pages =3D atomic_long_read(&user->locked_vm); do { new_pages =3D cur_pages + nr_pages; - if (new_pages > page_limit) - return -ENOMEM; + if (new_pages > page_limit) { + rc =3D -ENOMEM; + goto out; + } } while (!atomic_long_try_cmpxchg(&user->locked_vm, &cur_pages, new_pages= )); =20 - atomic64_add(nr_pages, ¤t->mm->pinned_vm); + if (current->mm) { + mmgrab(current->mm); + atomic64_add(nr_pages, ¤t->mm->pinned_vm); + } + + kzdev->user_account =3D user; + kzdev->mm_account =3D current->mm; =20 return 0; + +out: + free_uid(user); + return rc; } =20 static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib = *fib, @@ -279,7 +300,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, } =20 /* Account for pinned pages, roll back on failure */ - if (account_mem(pcount)) + if (account_mem(zdev->kzdev, pcount)) goto unpin2; =20 /* AISB must be allocated before we can fill in GAITE */ @@ -400,7 +421,7 @@ static int kvm_s390_pci_aif_disable(struct zpci_dev *zd= ev, bool force) pcount++; } if (pcount > 0) - unaccount_mem(pcount); + unaccount_mem(kzdev, pcount); out: mutex_unlock(&aift->aift_lock); =20 diff --git a/arch/s390/kvm/pci.h b/arch/s390/kvm/pci.h index ff0972dd5e71..fdf8c7bf4ed0 100644 --- a/arch/s390/kvm/pci.h +++ b/arch/s390/kvm/pci.h @@ -22,6 +22,8 @@ struct kvm_zdev { struct kvm *kvm; struct zpci_fib fib; struct list_head entry; + struct user_struct *user_account; + struct mm_struct *mm_account; }; =20 struct zpci_gaite { --=20 2.43.0 From nobody Fri Jul 24 04:46:03 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA1E53F5BE3; Thu, 23 Jul 2026 22:14:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844857; cv=none; b=sKtAAMRnoaQqUKU+czUzWElHxU76ZpFt4Jj4V+eJx91yLushG/xbmRoY6tQeiXmTEjlYDziuESqxvlBFObddW0FGeHjHzx70fsxsEDbHWh7pe4L0Jobx7YK+tkv5yIwbbhFkdeNJKPWl36sXwXRKp4BnWJ7jLrxz1pF/mk4Ffhk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844857; c=relaxed/simple; bh=cACEiM6Nq+6I4fyIVQbBsqHVLzW5fcBPUsr1jB3xDMM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XI8qTphARy+OZZTEUBkOpnJzuolikkarK1arZxmPbyGYzSESGGMikaHZZPRsMGt6X5LKeI0MsdpAwDXjxyApnxS65julxeoK7hK6bqmVxbW7Xi4WtWRaxauCRQFjw2ja0nw79hOUuUEkQWKi2Y3pQHzhT4U83Lh9jnI4AsC4Mk0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=ANOTZSuS; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="ANOTZSuS" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NLfkpd4185855; Thu, 23 Jul 2026 22:14:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=UHxpgyzoTI4Km5fw2 6DQzeQjQssmfWgLtDByRdwuZu8=; b=ANOTZSuSg8jWyHVgO1G5hbReY4Uho8BlE 7yJZtvegP1bE1s93mBjvfrvmi70hJL2toNc0poVUZfjrXe/Xx+o7pE2Sm/vlxdus S6mZmpWjY5Ou73zPGNNO3GRdRpK2nnF1EoZZti/YBdvYqUrxlbsaG6JxGewdVgwI jCvsxKe3acuZVHsyjszwBJmwV9wKcwvi+pFQM8uXyC7ppcM4FdNbGc7Tp2dDENdo 1xUFs4DfPYi3qPO6bQyV0DU/O5+iXW2OpYuXoW+zfTAfe3nUtKkgxZN0Zu7ZYqg0 bnS6tnBMs96wqMTyNsOUwENO2M9v1nPhIZCdR3HkVxOwi+ajXt2FA== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7abswx8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:14 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NM4e25028647; Thu, 23 Jul 2026 22:14:14 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgktqeexh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:14 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (smtpav04.dal12v.mail.ibm.com [10.241.53.103]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NMECEw28705418 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 22:14:12 GMT Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4A71658052; Thu, 23 Jul 2026 22:14:12 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id ABFE558056; Thu, 23 Jul 2026 22:14:11 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.246.245]) by smtpav04.dal12v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 22:14:11 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v6 3/6] KVM: s390: pci: Fix missing error codes and memory unaccounting Date: Thu, 23 Jul 2026 15:14:06 -0700 Message-ID: <20260723221409.5874-4-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723221409.5874-1-alifm@linux.ibm.com> References: <20260723221409.5874-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfX7Lrgt7ffezon fE3YYHhaDGrQi2CWlRXB5ONEEFzdlbRGKnmhZYwz1iwRFKO1+48izDYhPYiW/sML/a2dSlX9A0n DoZx1V8lfTGgke5Nlvn3zWz6EmKdoYF4LSZExTf95zt9fyjpSdsThJ+Nfg9g4sTjwG9rSeJo0EF JE4EKJUoGXwrtPl8Pa2W0wRBXDDeg5AmzMvOyHNwQ/PbMGuSP5QqFWRxqJBT4KO6tU02Vtkd/Al 4vMoGY/HXxZOVZRGeZrhVgzovvkYXMDf+UD6H5+kql8CWgziz+sMQhE/zplIi/3cbePOo8AcNF/ 4Wyp5hlMhxGm4yeVaWhyyxNFZXhe9BEr6380+0vx2AiJ0EJWupiEAVWpPWu+LkLCyLzAIn84d2q pJYkdC0XyfPccLfEBTDVf2Xo2nmWXTkfp10G2KNYaSkD3jX9TZXI4W3WNLglEb5G7KO0m9k+gu3 LD2ijQag1Zqm2hsz1yg== X-Authority-Analysis: v=2.4 cv=F7ZnsKhN c=1 sm=1 tr=0 ts=6a629237 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=g4erIPh_aaDScpLpsJUA:9 X-Proofpoint-ORIG-GUID: Aq9t9OFX62_oFt4uez8WgnZULdibkYH5 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfX4nake/5ANs8w 0n+U+Y8p9LAJbpy5nmDmPrn2E8qZu3UaOziJWf0pzzV1UjLGWZ43FOljfoDVJ5oNLC4Gfyc+Q2+ varbZL6mMPi79ewuV+X0O7wLeGCmaAM= X-Proofpoint-GUID: Aq9t9OFX62_oFt4uez8WgnZULdibkYH5 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_07,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230215 Content-Type: text/plain; charset="utf-8" In kvm_s390_pci_aif_enable() two error paths failed to set an error code, causing the function to return 0 on failure. It also failed to rollback memory accounting on failure. Fix both by propagating an error code on failure and calling unaccount_mem() in the cleanup path. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali Tested-by: Matthew Rosato --- arch/s390/kvm/pci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 44c00e5e32c5..f58d7ec0bc7e 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -300,14 +300,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, } =20 /* Account for pinned pages, roll back on failure */ - if (account_mem(zdev->kzdev, pcount)) + rc =3D account_mem(zdev->kzdev, pcount); + if (rc) goto unpin2; =20 /* AISB must be allocated before we can fill in GAITE */ mutex_lock(&aift->aift_lock); bit =3D airq_iv_alloc_bit(aift->sbv); - if (bit =3D=3D -1UL) + if (bit =3D=3D -1UL) { + rc =3D -ENOMEM; goto unlock; + } zdev->aisb =3D bit; /* store the summary bit number */ zdev->aibv =3D airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK | @@ -351,6 +354,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, return rc; =20 unlock: + if (pcount > 0) + unaccount_mem(zdev->kzdev, pcount); mutex_unlock(&aift->aift_lock); unpin2: if (fib->fmt0.sum =3D=3D 1) --=20 2.43.0 From nobody Fri Jul 24 04:46:03 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 74BE3403E97; Thu, 23 Jul 2026 22:14:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844857; cv=none; b=EyQz1JqE1qzCRCS1qxTL+hbRelMEEcVrnce2phBPGal9zdUJfdDjhkMcvkkIDeU9QCLrtguqP4mJBM1ZPaHRsQ2xCtmv/TqXV5Yy7L0BMSARmTEXFinc9/ZnDZaEdogs0/TFyoFHTMlDQqOD+o9/n/H/luQZfo85OGTNyphnAgI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844857; c=relaxed/simple; bh=SbKNcsHNuuvpmBhdUM5aPMA2TeC7kEeDkvO2AnWU1DU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nsN1w/c5DSxNEFuTFXXFifMLWziFL/VNKZU1Ce0Pc/PnmokMwWnLzJ62qeVG/55E1/n7u4srIC/IbGeo6PiPA4rC5bX3Ff+PT881cP6N7MCHOaD8Fxho5PAIRzOKxzOWmpytn9XtlRPmqjH0xY9Y7A8LWUjuPPzDyUF5NjMEjSY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=KujGQoka; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="KujGQoka" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NLfn7F4185875; Thu, 23 Jul 2026 22:14:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=9BSAswjPgsFB3mwS+ 9M8RqhlvouBeOd1JU81W/D8CTc=; b=KujGQoka4k8Lw+gAKyU0QLP9wVmYxT8qG iGkr8ZUFle1oC7v0d3myzSnI4k7z8ufsU5az5dzSLSKZehuX9QWduQTypZx8pshg eMMJCtU/6MrDCvxHzcf/nmrKSZXb7UWxzeuNnUQGjAWIyG4dBXv6LfFj39PNV+/X OZ8TnsWKAqjJjFcjotN7QU1Rasmp6MdREFTkfsHGOKbjU/0lMBm2tqPzlvuStDYJ jMTK+YGB7cy97fDpHyHkYrNkCRIuMMqkQTsAhRmBqbKdVhhy8AeGh8DdPJg2WWOk zNW1Ost0dRCJzZ7AhaDCHnNm1404X1vk7vSekiGtKAdlHrl+I5UYw== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7abswx9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:15 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NM4aIj024339; Thu, 23 Jul 2026 22:14:14 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgnahe89q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:14 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (smtpav04.dal12v.mail.ibm.com [10.241.53.103]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NMEDU130605900 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 22:14:13 GMT Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 10CAE5805A; Thu, 23 Jul 2026 22:14:13 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 712DD58056; Thu, 23 Jul 2026 22:14:12 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.246.245]) by smtpav04.dal12v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 22:14:12 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v6 4/6] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Date: Thu, 23 Jul 2026 15:14:07 -0700 Message-ID: <20260723221409.5874-5-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723221409.5874-1-alifm@linux.ibm.com> References: <20260723221409.5874-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfXwWzHi2a9ZnIC wCjZpvEUquNpcG9gTmzglLbUvpEIjxR//3uvt0gtPTdDFr9A5PEDEXSQgrs4ufok8Mt/q6wQnYY dEsZhxZo7oUTPQ79Yr3U/Wym1TKWCdeJEnm304G22DRCiEr7b1dzH4UCRg8JnmHRnpVBP5iT45c /BMvPpRC/7pnxxr4kAFAqipQR4CCG3gkILUXq4zQYaEZ7bqY7h5ePW1VDceqNTTySAV3NQM9euL bk+VpD7Ck1/FwRVXCZcbI+5MOgIYeW/bqOPD+ywC/94KxuC6FJxUVBITSWpd0+iW99tY+87cHvn ru4xe2t2xkjKwh8jNopXEDd1ma0vozS55O1Z9T+JCtVRsJSI4LFqtcaDmz5qjX4/eyeE207ICPz jVW5nrpr8cl9p8KzEbTDyHN1WZKN2So4il2FJVHLXvcI04BZjyZRoc8YADSSkuq2c7PTyQBzrQZ Sf1XoWK4RAGidNNjpvQ== X-Authority-Analysis: v=2.4 cv=F7ZnsKhN c=1 sm=1 tr=0 ts=6a629237 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=VpFnpj6RERqEfYQjrFkA:9 X-Proofpoint-ORIG-GUID: CCfJCW68kNntKFx7dJgXYuhH50PBBiLC X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfX3CsV3tAiwR3q OZjGfuOzaP9CpIn0I3nO1M3GntVtMburQuhzqnciwKZzgKVOjMqH0m5old19pwD97juHkWZRSPT SO4IRNexHgxyKRAhKpDamI373+9Xk6I= X-Proofpoint-GUID: CCfJCW68kNntKFx7dJgXYuhH50PBBiLC X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_07,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230215 Content-Type: text/plain; charset="utf-8" The airq_iv_create() can return NULL on failure, but the return value was never checked. If it fails, zdev->aibv will be NULL and fail when dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the previously allocated AISB bit and zdev->aisb on failure. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali Tested-by: Matthew Rosato --- arch/s390/kvm/pci.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index f58d7ec0bc7e..602534e3cc10 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -317,6 +317,11 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, AIRQ_IV_GUESTVEC, phys_to_virt(fib->fmt0.aibv)); =20 + if (!zdev->aibv) { + rc =3D -ENOMEM; + goto free_aisb; + } + spin_lock_irq(&aift->gait_lock); gaite =3D aift->gait + zdev->aisb; =20 @@ -353,6 +358,9 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, rc =3D kvm_zpci_set_airq(zdev); return rc; =20 +free_aisb: + airq_iv_free_bit(aift->sbv, zdev->aisb); + zdev->aisb =3D 0; unlock: if (pcount > 0) unaccount_mem(zdev->kzdev, pcount); --=20 2.43.0 From nobody Fri Jul 24 04:46:03 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 700714071D9; Thu, 23 Jul 2026 22:14:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844859; cv=none; b=KVcdOqVHaJItFIica+zEY5RFOfQCYyZHgnlhj2C1ziuBYAuQD7lLDsDJ5He/eztiYt6iRoNpn4eGEXWLW35Ba/pFAptT77hvcZ2SeVY3EHSWav1d8X/sE/nHgv93ijlUUxN60a/dLAdv0UWoDwtB7PWVFstQc9S4dNkisJ7O7CA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844859; c=relaxed/simple; bh=eTUhxLhdcL3m5nLDSBqMtukI3bolpOlUGy7PrCpLP9w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mRj71CNATd+TFzeiuLNVYUNDvoX32//nYEL9jGAYRADFxw05IYTxEIbD/B1NkVMCzc7+TBNre1dt/grmtHNUEi18q3gOukScJ+NDCgED+AC9HCDI7NeW/g+ydeJSIZn4pC6Qmis80BTvhhkBYdK5i5y94qZQAh4aBogNaQKe1rI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=DSK839Gm; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="DSK839Gm" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NLfr3o4190840; Thu, 23 Jul 2026 22:14:16 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=0ditP3I48O0xc3JbV 5y4O1MbTHUZnFmkecjfup2QoGc=; b=DSK839GmKcuXJgoXg3YLuaiCdXrXqsZaM T7zMMY+t7WVEfAWx7gCZSUKK8QBOv1bXhzKqERcOzmmbDiRcaxNKv0mkkjNqQKkb aOTmoM7XgXYMaESvWc1JK0BNGGgMMLrjWgL4NxAzCwLTTJ8tKwrtH/HmoRpNi6Dz 1Eys7t8HSsfEQvNXherSyw+kEXAPwJmOJxQ4xXtxVSPdq1qF9E5JsH0tOBkWfEw5 1LYx7c+XNq8+qElsBj2sKSl7QhVmba5bPCPjrKs3jZhu2/iN5uOQCOtc5AIBYTT0 Eq5OmNitfy3twHZKGAn9KRyb2elAdEBqqdzSW8o24q/H22P81Q+5A== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg7ahh8f6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:15 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NM4dVt027215; Thu, 23 Jul 2026 22:14:15 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgmtk69rg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:15 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (smtpav04.dal12v.mail.ibm.com [10.241.53.103]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NMEDbB28639894 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 22:14:14 GMT Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B86E65805A; Thu, 23 Jul 2026 22:14:13 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2F9EC58056; Thu, 23 Jul 2026 22:14:13 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.246.245]) by smtpav04.dal12v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 22:14:13 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v6 5/6] KVM: s390: pci: Fix resource leak on IRQ registration failure Date: Thu, 23 Jul 2026 15:14:08 -0700 Message-ID: <20260723221409.5874-6-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723221409.5874-1-alifm@linux.ibm.com> References: <20260723221409.5874-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 5ICDvvMv6NZToYVo987AmCR4xxlKUphG X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfX306TGzgr+g3D GDAxD4TR7gtM06JNEiGG/7neFH08LHni68kvC9iEH5zmp7329I3cZ9S/SYKblgNczDGJqfbJCC+ AG88XOB0k2M/Gh3H1gQo0NauTcP2ybgnqGfmi7hIV2j3UxYizZ8W0jWsoBXmXCfNYNnNrX/Ml7j xqZTN3OyRp7tWsjY+gAEMR5Io/bIwLdGahoSBGPxxxw9t0WW+XLmCGT4S5u7KHWlok3BR06GF7V AZ5EDKKGkbQchsFHIiuZ/gtcijHGEcM9jto6SZKNjcpuZudnwocZiY1tvkAaO8qyVUoLLmdFxAN ABEKoKIpKjM4PJ5WdDhTwxWCFSaU8RSUe4mJmTABchFu2BMOsokf1mcS0Ql4cCwHClnptIxZDc5 TwO7/vOrwcuQ79+HIr0EoiKDoreHdysj7kvD3UAnGGo6vWOnG8w9aKOdCQd/K1CSAhj+m3KVlnB uApP8xfMPhygA9FOEPA== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfX/KFIsQ9fEFOe j72cV6SpjK5kPDcDARt7nMXIwoO/vq+8NUYpcatrO38rw0JyLc9g0+SOKlHs6KVzkBUse/Zidw4 RPHv54F93wiUi39X/Xk3ziRI+6IX/to= X-Proofpoint-GUID: 5ICDvvMv6NZToYVo987AmCR4xxlKUphG X-Authority-Analysis: v=2.4 cv=SM5ykuvH c=1 sm=1 tr=0 ts=6a629237 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=oLYdd9eN5-LzSxCheKcA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_07,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 spamscore=0 malwarescore=0 priorityscore=1501 phishscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230215 Content-Type: text/plain; charset="utf-8" Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns the error code but doesn't do any resource cleanup thus leaking resources. Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and unpinning any pinned pages. While at it, remove dead code that stored FIB values that were never referenced. As part of the cleanup, we are also holding the aift_lock a bit longer, as we hold the lock while executing the MPCIFC instruction. Though this is not strictly necessary, it means we don't have to drop and re-acquire in the error case. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato Reviewed-by: Christian Borntraeger Signed-off-by: Farhan Ali Tested-by: Matthew Rosato --- arch/s390/kvm/pci.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 602534e3cc10..ca8ef76bcf6b 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -344,19 +344,32 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *z= dev, struct zpci_fib *fib, aift->kzdev[zdev->aisb] =3D zdev->kzdev; spin_unlock_irq(&aift->gait_lock); =20 - /* Update guest FIB for re-issue */ - fib->fmt0.aisbo =3D zdev->aisb & 63; - fib->fmt0.aisb =3D virt_to_phys(aift->sbv->vector) + (zdev->aisb / 64) * = 8; - fib->fmt0.isc =3D gisc; - /* Save some guest fib values in the host for later use */ - zdev->kzdev->fib.fmt0.isc =3D fib->fmt0.isc; + zdev->kzdev->fib.fmt0.isc =3D gisc; zdev->kzdev->fib.fmt0.aibv =3D fib->fmt0.aibv; - mutex_unlock(&aift->aift_lock); =20 /* Issue the clp to setup the irq now */ rc =3D kvm_zpci_set_airq(zdev); - return rc; + if (!rc) { + mutex_unlock(&aift->aift_lock); + return rc; + } + + /* Start cleanup */ + zdev->kzdev->fib.fmt0.isc =3D 0; + zdev->kzdev->fib.fmt0.aibv =3D 0; + + spin_lock_irq(&aift->gait_lock); + gaite->count--; + gaite->aisb =3D 0; + gaite->gisc =3D 0; + gaite->aisbo =3D 0; + gaite->gisa =3D 0; + aift->kzdev[zdev->aisb] =3D NULL; + spin_unlock_irq(&aift->gait_lock); + + airq_iv_release(zdev->aibv); + zdev->aibv =3D NULL; =20 free_aisb: airq_iv_free_bit(aift->sbv, zdev->aisb); --=20 2.43.0 From nobody Fri Jul 24 04:46:03 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53F4640680F; Thu, 23 Jul 2026 22:14:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844859; cv=none; b=A6Dd+NWZXtRCpM4EFnGeuX9G0ejFGL89QdXd/KAXZeKHaDe4VlLEi/Lh47qtw1KpOCeEoK0p0jBZqLZespVzEGmuQJUTSsrgwUEdp6ujWW8cp3+2U56AaPxCXSxc3T9wp3HfujRfLc+Uax6DObVj9q6P7nOqrcBx17WrrrSqlIw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784844859; c=relaxed/simple; bh=MacpDKDFJI5J2Im3qcTckDBzBDVwUziMXK28jgxdLOc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OVLU6Mrn0y2Ajnh7+CUhSC86EH3I2LJueT/vG/w5lu5Xf1UjYA/NvPGiO0jLkL4JbamQfaDNMDnWw8u0M5YPBZhKsq+4c55f2ZM/ZgD6ZvRlp+GrrbfjFvQpYJYuv9QYrdPH6ndXU3tLb9k7YRf6IO++SkVFCANB1qBCGkaCXtc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=IjJ37WaG; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="IjJ37WaG" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66NLfsSG4107491; Thu, 23 Jul 2026 22:14:16 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=rL1hyFJMkJ8v+rgOi ipi7u8d2nKbJu/alwGibKzNOiI=; b=IjJ37WaGKMATUq994onJWn7GNhQuI0UAO d4BlxdriZktLjf4hbKx7Tp8c6+3b2U1PZwLbQveXH9oFHu+5q/z6V7IbTt044GhD sfransM+e0r9KaE7Ir8MdU06fHAKhsiDTMJ8Wj8heWsWCgQRn7MAXa/pxmAL4f3f JCJFfGpXsaj7T6MyRtttFVat1zRhxpa+pfLBpDy7AaB9npRgnXEhiyd6kaACVT93 yD2duUjsfFKSjK0Md/9Jn1oM9y9Js5Q7PVmQx3RbJl89/6VXHR4mUr266opaJstO Y0mZ+i7M/kJLbiVM3/R+OSNwgAK+3HGduQUrHtq5HCdUlI+/gyMVw== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg77kh9y3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:16 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66NM4aIk024339; Thu, 23 Jul 2026 22:14:15 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fgnahe89u-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2026 22:14:15 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (smtpav04.dal12v.mail.ibm.com [10.241.53.103]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66NMEE0R64684506 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jul 2026 22:14:14 GMT Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6045158052; Thu, 23 Jul 2026 22:14:14 +0000 (GMT) Received: from smtpav04.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D320B5805E; Thu, 23 Jul 2026 22:14:13 +0000 (GMT) Received: from IBM-D32RQW3.ibm.com (unknown [9.61.246.245]) by smtpav04.dal12v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jul 2026 22:14:13 +0000 (GMT) From: Farhan Ali To: linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org Cc: alifm@linux.ibm.com, mjrosato@linux.ibm.com, borntraeger@linux.ibm.com, stable@vger.kernel.org Subject: [PATCH v6 6/6] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Date: Thu, 23 Jul 2026 15:14:09 -0700 Message-ID: <20260723221409.5874-7-alifm@linux.ibm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260723221409.5874-1-alifm@linux.ibm.com> References: <20260723221409.5874-1-alifm@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=HJXz0Itv c=1 sm=1 tr=0 ts=6a629238 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=i8wI3NWYBEf5A6oN4S0A:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfXxAsQrQjmwiCL Iu8DJA3Tt2VGfoeiClFgfCmzZdN6yK0T0A7OgL0/kjJ3Kit9F3UDFz+8pJhnhWLEoca11Gt0nHE 89NBz67g44ko2srTtIBR/ql14xOfyYPfxtPEc3PWVJb2jXU1kkPHDRNDPlh5jeGsTL6Sy5dvp2C TKBT3oWFWNUOyaDrNH/vMBitPJKVcRw0SAoitNIWIaj2JrVqAPa+icN/LDphKx6/s4drhS1AH69 bLOclxIYEixvi/IsGnptFx8unqRE1bwgPYvTpzp2XK29x3udFtDRXIBg3JHoZlpcHSvw5yP49rq Wi0712Ws2x6BjCv+kwst61eSG+9M/ZafPigNmnqPPoKu2/yeMtiS9TT0BnsGSPKYkO76+X9M5Cb hIB5AA/41nVUrDQKxA+zU0DsNiUDPzpGhp8LbKkkw56NHTotUBCaTM+7iuaRxn2zypB1e7p0U6L /Se+nG6D7OHYWrTF/JQ== X-Proofpoint-ORIG-GUID: lM1A98UMDCHSDulx3Ev08KneVs_zjml0 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIzMDIxNSBTYWx0ZWRfX9mnSkeeuc4xT eJNdGKCO4huYJ7rWsIu4TeytnBn6yUYvoJX0Ux1KYRlEECPHLZwtu9XbCHmL48few3Xh3eET2xZ /G4WkgnoG4jQkRtN57x9gTt+gXIkuJc= X-Proofpoint-GUID: lM1A98UMDCHSDulx3Ev08KneVs_zjml0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-23_07,2026-07-22_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 malwarescore=0 impostorscore=0 clxscore=1015 phishscore=0 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607230215 Content-Type: text/plain; charset="utf-8" The AIBV holds one bit per MSI-X vector for a given function. The size of the bit vector is derived from the NOI and the AIBVO. If the size of the AIBV exceeds a single page boundary, then reject the request as we cannot safely pin the guest AIBV. Similarly reject the request if the AISB address is not 8-byte aligned as the architecture requires doubleword alignment for the summary bit address. Since the AISBO can address up to 64 bits, the size of the AISB can only be 8 bytes for the function. This also ensures the AISB doesn't exceed a single page boundary. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabli= ng interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali Tested-by: Matthew Rosato --- arch/s390/kvm/pci.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index ca8ef76bcf6b..4394cefef242 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -244,7 +244,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zde= v, struct zpci_fib *fib, bool assist) { struct page *pages[1], *aibv_page, *aisb_page =3D NULL; - unsigned int msi_vecs, idx; + unsigned int msi_vecs, idx, size; struct zpci_gaite *gaite; unsigned long hva, bit; struct kvm *kvm; @@ -271,6 +271,14 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, return gisc; =20 /* Replace AIBV address */ + size =3D BITS_TO_LONGS(msi_vecs + fib->fmt0.aibvo) * sizeof(unsigned long= ); + npages =3D DIV_ROUND_UP((fib->fmt0.aibv & ~PAGE_MASK) + size, PAGE_SIZE); + /* AIBV cannot span more than 1 page */ + if (npages > 1) { + rc =3D -EINVAL; + goto out; + } + idx =3D srcu_read_lock(&kvm->srcu); hva =3D gfn_to_hva(kvm, gpa_to_gfn((gpa_t)fib->fmt0.aibv)); npages =3D pin_user_pages_fast(hva, 1, FOLL_WRITE | FOLL_LONGTERM, pages); @@ -286,6 +294,12 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zd= ev, struct zpci_fib *fib, =20 /* Pin the guest AISB if one was specified */ if (fib->fmt0.sum =3D=3D 1) { + /* AISB must be dword aligned */ + if (fib->fmt0.aisb & 0x7) { + rc =3D -EINVAL; + goto unpin1; + } + idx =3D srcu_read_lock(&kvm->srcu); hva =3D gfn_to_hva(kvm, gpa_to_gfn((gpa_t)fib->fmt0.aisb)); npages =3D pin_user_pages_fast(hva, 1, FOLL_WRITE | FOLL_LONGTERM, --=20 2.43.0