From nobody Fri Oct 2 12:19:59 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 981612264A9; Fri, 31 Jul 2026 13:01:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502911; cv=none; b=uq0rVAJnXp1j5e54QYJ/tvtIYVPL5LISi3Op5KbT2up6JI2Mxr220gDguRkwCtGYJ8Flsf0eKA0aREXnrIYR+ytOfxdnUrxbtfpxaNjXH8zi7vKBzg+zbv+rhBLegq9UTW8iCuJhCpzwJnqYAzzl7iDrG8S8Y23N49wQO19WlY8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502911; c=relaxed/simple; bh=uk+7Bf8nelYwZKq8so9KDG+OngL8L2JQuT7xKObhh3I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jJXpyu6RibIK6vBywWqO8fPjZIZfjibx5Z2jxeAeQBsE0RqsdvBk9NbuZFadJHDUes05MdaUw3o2/YTE5U5hYWUIrOSrchNX/uNSQW2ZV8h7NKk10S6os5YPMM6/8jKKiAT0RGaq4U7ctdefx6VhW6+06jaS717iZfVU8kDbkFU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=LHDOjXne; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="LHDOjXne" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBlppU4072834; Fri, 31 Jul 2026 13:01:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=BpRZhORLGYKP9Crm2 pKE9MHN8ysGCZMeb2Spf1oTGU8=; b=LHDOjXne/sVFFCq1mZUmkHDH+biTGxo4Y bcTEC4V6p3lfZZ4jOoYnbdlOj4J6rL1w4WOSZgPXVI/B9Hu2b3PJ7nin1VlEkjak 6DXrkiHX1Ms0DYlNWyhS2waMaO2n0xAH3vv8ohO2x+oP9UaT71yCtcvNowlImtV7 2tkNdIjgQ+GvmsA8/6+z66Ky3GLfqdJnaTLfLXxYNvTzLVfqvjp5tR5i6xqHDFMJ sZsUY3WTuReshuHs/PXE6nhgxHvq+a1y+oRBH5gwnqPOgcLNjEqgYvy9W4/CWJtz Gyvdz3chGwOb4ciVWRnreQWhz4HecwBSXNT9MPVdLDMPj5vvH6DHw== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuycw1cx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:47 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCQEap026825; Fri, 31 Jul 2026 13:01:46 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fn9pgqs3s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:46 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1eDb51446108 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:40 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8DEDD20043; Fri, 31 Jul 2026 13:01:40 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C1D242004B; Fri, 31 Jul 2026 13:01:39 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:39 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 01/14] KVM: s390: Fix unlikely NULL gmap dereference Date: Fri, 31 Jul 2026 15:01:25 +0200 Message-ID: <20260731130138.173983-2-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 97t0CvyjBJrGgRX5u7kucguJagRvBpRj X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfXx7CeoqkMC1I0 o+fzdElw7hETbqjEoUiS80RfYysZExd11c+jofdTKzlLa8LsMmy33eLbkAnw7QQTmjV45b3MCpA BiuIbIv5g7G9iDy7huq9fDSDD0NhC+GwoX7qe8actoxOmVaxU4wAAuvdTKBh8ZuMUVRDR2uod7C vM/xA9r9s7dJ8h9NYpSTPPw4t+qox5TzVXJA9ni6rVCsfi07zxzIH7DU+gCafui6Pr25ptTSvrq ydN1QJjUWwavOb0FvKXqUi61uCBB9QzvATBekG4SH5cGWhmpWBILrqKcptuL8e+iAwod/lZXWDZ S1wVGOiPRJV97vBvEwAUoOA6/LDpzeyG5Gu2a2HIDSffmTwvzdELGIZVdieG/MQkfTBgWZ5bHEk 2oUw6EuXvNQVWxtm+aCSeAYLik76C3M5aAj5n4ISY1eAlKQGf9JfZ1p1XTs7PEM48wdhP0J9bCY pvkc/BTiaT9x6VQzj0w== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX34xSA4PndlrP +rkz8A0Q3a1F8VaVwJzF/jLERMklEXK/gjpj3RXSwVVppmhhMbgPao2i2xqEWZXRpedY6Arl6ON mBGfbEG4rdAHj0UJgSvF18SdRr9EX6I= X-Authority-Analysis: v=2.4 cv=AZeB2XXG c=1 sm=1 tr=0 ts=6a6c9cbb cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=-aBWQn_vEbd_VLME6SsA:9 X-Proofpoint-GUID: 97t0CvyjBJrGgRX5u7kucguJagRvBpRj X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 priorityscore=1501 phishscore=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" When creating a new vCPU, kvm_vm_ioctl_create_vcpu() will call kvm_arch_vcpu_postcreate() after the file descriptor for the new vCPU has been created. The new file descriptor has not been returned yet, but a malicious userspace program could try to guess it. If a malicious userspace program manages to start the newly created vCPU before kvm_arch_vcpu_postcreate() is called, __vcpu_run() will try to dereference vcpu->arch.gmap and trigger a NULL pointer dereference. Fix this by adding a new field to struct kvm_vcpu_arch to keep track of the initialization status of the vCPU. Refuse to run a vCPU that is not fully initialized. Fixes: dafd032a15f8 ("KVM: s390: move vcpu specific initalization to a late= r point") Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank Reviewed-by: Christian Borntraeger --- arch/s390/include/asm/kvm_host.h | 1 + arch/s390/kvm/kvm-s390.c | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_h= ost.h index eaa34c5bd3c1..edf75b6ad20c 100644 --- a/arch/s390/include/asm/kvm_host.h +++ b/arch/s390/include/asm/kvm_host.h @@ -440,6 +440,7 @@ struct kvm_vcpu_arch { bool skey_enabled; /* Indicator if the access registers have been loaded from guest */ bool acrs_loaded; + bool initialized; struct kvm_s390_pv_vcpu pv; union diag318_info diag318_info; struct kvm_s390_mmu_cache *mc; diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 150b5dd2170e..f86b4b0b356f 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3613,6 +3613,9 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu) if (test_kvm_facility(vcpu->kvm, 74) || vcpu->kvm->arch.user_instr0 || vcpu->kvm->arch.user_operexec) vcpu->arch.sie_block->ictl |=3D ICTL_OPEREXC; + + /* Pairs with smp_load_acquire() in kvm_arch_vcpu_ioctl_run() and kvm_arc= h_vcpu_ioctl() */ + smp_store_release(&vcpu->arch.initialized, true); } =20 static bool kvm_has_pckmo_subfunc(struct kvm *kvm, unsigned long nr) @@ -5039,6 +5042,10 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) kvm_run->kvm_dirty_regs & ~KVM_SYNC_S390_VALID_FIELDS) return -EINVAL; =20 + /* Pairs with smp_store_release() in kvm_arch_vcpu_postcreate() */ + if (!smp_load_acquire(&vcpu->arch.initialized)) + return -EINVAL; + vcpu_load(vcpu); =20 if (guestdbg_exit_pending(vcpu)) { @@ -5523,6 +5530,10 @@ long kvm_arch_vcpu_ioctl(struct file *filp, long r; u16 rc, rrc; =20 + /* Pairs with smp_store_release() in kvm_arch_vcpu_postcreate() */ + if (!smp_load_acquire(&vcpu->arch.initialized)) + return -EINVAL; + vcpu_load(vcpu); =20 switch (ioctl) { --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3CA321FDE31; Fri, 31 Jul 2026 13:01:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502912; cv=none; b=W/zRpkHM25USHm/inKOhXhu8V80azEHG0z+k8XmEvgi7AmUkDFHcNjNuVllnzLUjnv6FtgrMvVXpoh715ZLKrn+5c+RYR0FloVoauSWPldpLXTpgU//bxpjhbM/rdu6+jAAiT3s3lVPxJHbm/mnSf1HKnvXq76O3zYJWEuWO4DE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502912; c=relaxed/simple; bh=rGUq/bbmBOybJjU+Ue7l7Uyfv2XCqwBWhe6A32dvtIo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=l1u7wDBSaZa7EZrr3goFnbNvTqeOVvCGq7nidgvYZciBVfuy1ZoY4AeQmQUPWA72zIiWsAPve6ZyzR5ek/AUB033rWa4zyvYd14Txacn0I480FjNMBQLhlN4hAF66baZUabnofwmrwn1eUFPebGkW0FstJYrQO4mxhrthvzqJ50= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=R/yt3TIX; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="R/yt3TIX" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBlcvW4072623; Fri, 31 Jul 2026 13:01:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=a8o63o8zb7q/KcknA rEgZd6tgJdqLJy5aq5FS+Lux1A=; b=R/yt3TIXyeVBpFz9d5VJH1FM2YeLsiAKk qt8V1pgf4bM+AKXHaB4Pi6jMuYEXGH1WrmsiN08ehXp7Z4ErTdai/JhmtEM4xlYV XupnnpiXjPCA8ABuf5ctBGmMG/5Tb6xBqczRz0HDzS34PZprsIdVISxy5CVKdTy9 eEBeYOYDevZi/9LjoxRSsRodpMob657l2YgJZ4Gi/X1KzbzUWH79Fs6ixaQz01py nfbxyee0HgEdYhlXKUEC5RLwHsfBVZIe7Rz/uybYvs9dwYcsQQcu/IcCM+aJpuTc ANFHpm9uQ8UD1XW8N+XY9LGhUitzNHpZW3vHrb7ZmDGAUQ8ny2OIQ== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuycw1d4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:48 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuJh3012652; Fri, 31 Jul 2026 13:01:47 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fn8fkfxxr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:47 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1fvw35651888 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:41 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8BDCA20040; Fri, 31 Jul 2026 13:01:41 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A977B2004B; Fri, 31 Jul 2026 13:01:40 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:40 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 02/14] KVM: s390: Do not free SCA if it was not allocated Date: Fri, 31 Jul 2026 15:01:26 +0200 Message-ID: <20260731130138.173983-3-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: TZnnwUKX2DdPEuiK5jN0HBbJByhZBgFQ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX0Yk4B6NiYypI o8hW1kLcceAeqPHVqMCozcMMlQnM1nvOj0XUPzp1j+l9iRlti6PCfjPQgVPYi3I67oCFm+9hb7n IvZmgDpTHESRKU7UtqvULGmVyPPpVrErq/VM/t8m4XV1NDpKtDA6OwZb+rkTvfkSnxfqeKq7BUo ptGFmo01/A9xCvBVeQewJ2krY54hSROKFJNdvQQcFtkN4QfMWfqdxOm7E0SiIUm7LdME36U2HZ3 +/zV5EjpoOMgBXwN+wROxB72UMj+GDg/FZQAzRlWM51M/sb7X1thG1//jCCR9kxqz44Yg5Rsxuq qdbmGFJgh2+/nURP10ZivABtPIqNWjcRUtJOr3zcDV66IitblktHARQmVX6hkfs+yAUwQ3Jood2 2pgMdCC1uBQTOoKsy1ixDqKFNDvH2zHD0FQlUHESf/HMvcZf2qrnuP0y1Iq/OcYrlhuhSTJDj24 iJ6lyeKNjUzbPPvcoHA== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX4avdRwgxBrHY JK6/z32LNVc0sXNVPagpvgIrj/NyloYrMfyvvUpbw4MrRIEcQbdgKS709tlfMbxTV3bFGQjkivA JFphIQoG6ji8K/plc564Dsin5WAo/rI= X-Authority-Analysis: v=2.4 cv=AZeB2XXG c=1 sm=1 tr=0 ts=6a6c9cbd cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=M5uM2SGDJJfKum1V:21 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=3jiQNkuJ7WxZ42At8I0A:9 X-Proofpoint-GUID: TZnnwUKX2DdPEuiK5jN0HBbJByhZBgFQ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 priorityscore=1501 phishscore=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" If VM creation fails early in kvm_arch_init_vm(), the cleanup code tries to free up the SCA, even though the address is 0. Due to using free_pages_exact(), only the first page is skipped, accidentally freeing pages 1, 2, and 3. Fix by checking whether the pointer is NULL before attempting to free the SCA in sca_dispose(). Fixes: e72753ed1267 ("KVM: s390: Use ESCA instead of BSCA at VM init") Signed-off-by: Claudio Imbrenda --- arch/s390/kvm/kvm-s390.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index f86b4b0b356f..1b3290a5ad1a 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3247,7 +3247,8 @@ static void kvm_s390_crypto_init(struct kvm *kvm) =20 static void sca_dispose(struct kvm *kvm) { - free_pages_exact(kvm->arch.sca, sizeof(*kvm->arch.sca)); + if (kvm->arch.sca) + free_pages_exact(kvm->arch.sca, sizeof(*kvm->arch.sca)); kvm->arch.sca =3D NULL; } =20 --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 570EF426405; Fri, 31 Jul 2026 13:01:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502913; cv=none; b=GDxX3K1Vc7kysVrbtoTgjbEo99+Pfe2OqUXidREm9npELp783h2wMYJo+b9qZ8bPiGpJpQ4m2HuFzBY4lXkl26Eg47Z11UIIvokEmee5shwY3BPAn69me1T3Ch3eNUek2rwELxagCcjWo1+TeUiJYquL4sN4GMesv3mPpJGPaUI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502913; c=relaxed/simple; bh=PFR1XFwLxC/X4367EBT5xBpNjMhUspJXsUabptoEkM8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=F+k6NJGD6A7cZgCJ0xcdAX6Apq9xYqqp0+r/bqe0pRQxEfklNxgdpgViHj5ibwdmJTy1Cb4VRRldSPLvuD4JHtoTKwKkzAKhAUyzLhwp2MLU+GvQhuBhhnFkJlr2elKLT57FE9Sg5JvbYssde0JIbpMgK4Jc4dAo2bN4tLyCovs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=XIK4frd9; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="XIK4frd9" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBmQIS1732323; Fri, 31 Jul 2026 13:01:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=n9+ojDvm4NA40kUmQ i2tKXfo/PA1HooW9l+BffZSvho=; b=XIK4frd9oMTk1z3AjY2o7rGthanKTjj2s 6eMQp9Ia+vEsDxX88BtFIECBW97z/u6SHkEljD10RrkMU8PgD3w6EhduDszP9TmB jxsT2fd8zKF73JiK3U1PmdrVnJqSak2Vjq32EJnJ+UhDA35W3zdHBSb/OgWSLTqn /mkE3xnBbm1FP38/R/Nco/1TIptOtVUjER2IbBGQx8LXmn8NDrZbB73rc3ZP8iHs JMLolJu1HN9n4eAOHWw4NAoBlol0nyYcUstrVAvPwBba3i7w2z9NtE+uWIMWVIm/ rJGKRJNNHz50dqFk4HbalMvCYbp6DvrJExdzIsYrs/teHwKlNU39g== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuw7w3fe-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:50 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuP15021771; Fri, 31 Jul 2026 13:01:49 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fn7uwg2uu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:49 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1gao11272566 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:42 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 81AFD20040; Fri, 31 Jul 2026 13:01:42 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AAD0920043; Fri, 31 Jul 2026 13:01:41 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:41 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 03/14] KVM: s390: Fix kvm_s390_vcpu_unsetup_cmma() Date: Fri, 31 Jul 2026 15:01:27 +0200 Message-ID: <20260731130138.173983-4-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 4awQ3g_y2QBUzVlpF5kAH6OFt23IGww7 X-Proofpoint-ORIG-GUID: 4awQ3g_y2QBUzVlpF5kAH6OFt23IGww7 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX96Gq/1E7y+/2 N5tejVXMUD8xJ5N/xh2JBUUcZSAYxyizkxlhCFuzu2UQyBrmRb2ZlvA292n1OasfZtm0NxRc12m soT6fA7YFgjSmpAdZxx1G5WfQYKOawTHVW5YlvkpbXcq6j6hWVwi3K7N79ATsXaSA51i9nsT5Pa D25dDCdWnL5Cwj0NDil4tao292MVK10da8UiWxIgSUH4UboKV6Mt9xo+JIAnWsyaFA4xlp5Wby6 ajqDn3ef6qbhV5biGihc6gjZuUGBV79mBjojXjwG54PKHl4EQwd6kQBQp73Txx192DP7vW3suhx mGMstWLbpz5iPosw9GnnN0WKbvZBv7CbKHS9nMAG1L1na77RDRvsAf56LziwX/0fxqSeOgjhh4t WeZJav/MaOUQ9jed9zibyEFkdmLRuwfpTIaZsolV9dSu75PxVifYwgXG7aHnWYYl7Skc/6nsAyr mLoZV75W5pWaOZNT97A== X-Authority-Analysis: v=2.4 cv=SKFykuvH c=1 sm=1 tr=0 ts=6a6c9cbe cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=UbkePC3kHMpujdsGQX8A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX+KHg7ba1VbBG 0fTuSBy3BW4dD7Q1ZQMrgpCcBs3wjeetQayFvQ0zNiD/hIMh8o++Sve6WD2QpjyKbXUUL/v0aC4 1iBC9ocP+XNYhmvuoEjDI/49B1Il970= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" In some cases kvm_s390_vcpu_unsetup_cmma() can be called with a 0 cbrlo; in such cases, if running with V !=3D R, free_page() will attempt to free physical page 0. Fix by freeing cbrlo only if it's non-zero. Fixes: b31605c12f4e ("KVM: s390: make cmma usage conditionally") Fixes: 29b40f105ec8 ("KVM: s390: protvirt: Add initial vm and cpu lifecycle= handling") Signed-off-by: Claudio Imbrenda --- arch/s390/kvm/kvm-s390.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 1b3290a5ad1a..9be27db0a21e 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3678,7 +3678,8 @@ static void kvm_s390_vcpu_crypto_setup(struct kvm_vcp= u *vcpu) =20 void kvm_s390_vcpu_unsetup_cmma(struct kvm_vcpu *vcpu) { - free_page((unsigned long)phys_to_virt(vcpu->arch.sie_block->cbrlo)); + if (vcpu->arch.sie_block->cbrlo) + free_page((unsigned long)phys_to_virt(vcpu->arch.sie_block->cbrlo)); vcpu->arch.sie_block->cbrlo =3D 0; } =20 --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64D8942642D; Fri, 31 Jul 2026 13:01:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502913; cv=none; b=ssFMuMka7cQTggFE2Z0ekWZ+v0d6o6FfKrbSxBC5d3Mg2nlZq9o+JecQgOIE5v7bvUMK15acRrdOmOOFg+2Vizyb4+4dUz1H6SsJRSFDSYi9c8BMuUhV7H63YIhNBGznYfZPGu+jNySk4BmqjTeq9s2LezQ4fTjnFFSaB/x8hx0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502913; c=relaxed/simple; bh=gjC05m1OzVU6ocGE5L+jHOcr3zUGxe45T29GvIBP5+0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fdjiu4yygYJhmjukFXvxnwZxIgPJDBButuycgFnJAqQbmDI5OKKzSIR8C1qKqZlGj2Wk7m/6pmbK+v5oxB7JicFfd4vfSvZMVi6mfDRS8SDdc1QMnurFxOOmOSEYK9mfLCpInnnzU+eEjEfhsXwrrR9T4VoJcANxJulTQshmvIE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=FItTn5Nh; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="FItTn5Nh" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBli9H4072800; Fri, 31 Jul 2026 13:01:51 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=yWmkzZNBaUHHdbmCX wJZMsl7NEMhcYeY8y5RhUHgjik=; b=FItTn5Nh8SpfkXIHrRKh42gEDtSLMMoLX hTqC1i/EQdhsqjFLmDOKi5igYCrwAw5IwC1u6xvykmYHWW9JDq4dZWP+SIuGOhKI 4OpkFMsF+tGKlRq/6Ai0YxecuzpNM06beGCYzXJ0dDAk+JLpETUO2LvjXUqAaVbL 6037hpztUegpjhzAokX1JaoetA6BqIKK2uKNM1MOpzWB3bU5SPnHRGcHa9cOF+hT cV4WHNoTnURCPIs+y1ekHMvkPZnOwGYMSnqUZXkFRknEQg3dOlArNPRaP4aI4Okz A57+ZWjQO4IHCeXT4Bv6fsVFS+ovp6iywLY6WH1/biw0jkSK9LG8g== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuycw1da-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:50 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCQEM3026831; Fri, 31 Jul 2026 13:01:49 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fn9pgqs44-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:49 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1hDl28967192 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:43 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C077020040; Fri, 31 Jul 2026 13:01:43 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A27A32004B; Fri, 31 Jul 2026 13:01:42 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:42 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 04/14] KVM: s390: Fix overclearing ESCA in case of error Date: Fri, 31 Jul 2026 15:01:28 +0200 Message-ID: <20260731130138.173983-5-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: TNZhiXUOmEMjCNrmjudnwxDmuqfza-Jc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX7Ze4KilxOduC Qipsf70+eFaNkT5uwr0JwKNJQ0lYDM4naD2fpUOoMqXeM1cmDIhy5em6t5nIovEa8oqhMtGRE+x jnngdDAL2u+UyynktUPaT6Bv4cLdcm10xniF9M71nJ70CnMCmJhfeoVEybJy8eBgq8bVooR2XUN HGpiEzY0oWKFmBWLKqVWJ2vAMju48FD1MT7frVoLAvubYlSou1CW1230r30qPmuZDJquGnKbu0h YhFSIadFUQrEe3N/j9HvIQvLBnzEGnoZzm3xrrleXDF/KRqWONy4cuR5x975MijnG/6+X1xtQgR 9xM2j+qiyD/Ay58cSYU4LE61YkK57Bbv6m/9BsjkZ5SOhcPJfGpKJclCNvTICIOesTAnIBFM9mz lUekKf+jhr3RxE0j4aKKiSTveqkR+blOCdZE+kV3kLP48BOj2G/SfscJAjvKFrsCYdQYSaOyFl/ uV4XUzKF/SpWAFqyV4w== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfXxotVi0FxFyCq UPKSm6g8PNDc6RcV4aVDNu2q5QTzNn87Ox6ODMtYcvv758db9WaI+xDGGeOws57vj4vXvNG3FVD k1l84XXf8wtqZOFCLDu7qxPMucmDbN0= X-Authority-Analysis: v=2.4 cv=AZeB2XXG c=1 sm=1 tr=0 ts=6a6c9cbe cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=OniIQR2WiTFW0jQNa14A:9 X-Proofpoint-GUID: TNZhiXUOmEMjCNrmjudnwxDmuqfza-Jc X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 priorityscore=1501 phishscore=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" If an attempt is made to create a vCPU with an already existing ID, the duplicated vCPU will be destroyed. When destroying a vCPU, its ESCA entry will be cleared. In the above scenario, the spurious duplicate vCPU is destroyed, but the ESCA entry corresponding to the original vCPU is cleared. Fix by skipping clearing the ESCA entry if the vCPU creation was not successful, i.e. if the pointer to the ESCA in the state description is not set. Signed-off-by: Claudio Imbrenda Reviewed-by: Janosch Frank --- arch/s390/kvm/interrupt.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c index 9e3e6b0d72ad..2acdff130fa6 100644 --- a/arch/s390/kvm/interrupt.c +++ b/arch/s390/kvm/interrupt.c @@ -86,7 +86,7 @@ static void sca_clear_ext_call(struct kvm_vcpu *vcpu) struct esca_block *sca =3D vcpu->kvm->arch.sca; union esca_sigp_ctrl *sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; =20 - if (!kvm_s390_use_sca_entries()) + if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized) return; kvm_s390_clear_cpuflags(vcpu, CPUSTAT_ECALL_PEND); =20 diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 9be27db0a21e..5b2727d7dfd1 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3462,7 +3462,7 @@ static void sca_del_vcpu(struct kvm_vcpu *vcpu) { struct esca_block *sca =3D vcpu->kvm->arch.sca; =20 - if (!kvm_s390_use_sca_entries()) + if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized) return; =20 clear_bit_inv(vcpu->vcpu_id, (unsigned long *)sca->mcn); --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F04BC42BE86; Fri, 31 Jul 2026 13:01:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502915; cv=none; b=LovLx1AtYOuRM9ffQdwZsTQoeUzLKHIwkZEt9F5E6lBZmdAhri/lIgMgFzqlM4OcURuXk1UInvilrl2p1B7pNLec+JISgYp/yTqK3talwmETXYeQjIFPi3cISLV+Bw1nKgLMdFQ0+Y3CQFm9nmLcKfkCLrXRHzzDEuyhBzLRE58= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502915; c=relaxed/simple; bh=eaeBNZ9YdlmEngpslj6Plaaezy+Oxl1yRHDDNOrYPc0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DoZ24YUy3suLGDUfSoBwY+I4DFtPYtIGzt5odSOEArFvFl0ycUXnkARHWIzExEg11Kb2Cd0VcPRG670pfuarSs0ZGvd5x2htKleZVkdLJSbInrVW8+u3LD3zg/PPsRxa5lHnLfbUX01otQJ2ysd3MzfSEW4PUHfqptzaaGOrK4U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=nH1gPBXo; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="nH1gPBXo" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBlqW71765837; Fri, 31 Jul 2026 13:01:52 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=cYACTU3Ehy66po10q WiN+GQEIAYJ6njLKHh+/AMnRyg=; b=nH1gPBXoIbiWmmKVHN9Lje+6NdIh+AooA rq8AeQmsnkBVN13qd4ndbMrhNeEzAlK5B2tn0xiOk3VzZ2YPVeWdj2njA4ht/5Rk fRXkUQw0s78ak9XUYFt2xnGqU8z5xdgXZ4RG5W7gBPVkuj5F6bhyqpBNpCUVtLIw 72e7ziDEv6WjAK1NMQhAaKWQnAUBKbFx8MuvyUusSNg9lerjp+jwkR3fT0Uf4J/v 0fL+9ykjMb1psXB0s++6e+AVAKRbYcPSzTvpliarcZa+INEGLSMJiyjVrNyAxGFE aCVFZzzHb6w7NRzy8r2R9k0hbInkKoMhD6a0Dxlpxt1Op0oVWbrPA== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmv0y5504-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:51 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCQEci026835; Fri, 31 Jul 2026 13:01:50 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fn9pgqs46-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:50 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1iSA29491694 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:44 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B8E4620040; Fri, 31 Jul 2026 13:01:44 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DE53520043; Fri, 31 Jul 2026 13:01:43 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:43 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 05/14] KVM: s390: ucontrol: Fix sca_clear_ext_call() Date: Fri, 31 Jul 2026 15:01:29 +0200 Message-ID: <20260731130138.173983-6-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: yG814ASr9ahDzcOyYjmQfscmjds_78JU X-Proofpoint-ORIG-GUID: yG814ASr9ahDzcOyYjmQfscmjds_78JU X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX6iXfj6SfzD4v 0pxPPvOPWYEvSJS2HS9dO4bVh4+VWOOvv83xxZCwhbMuo2rkj0pL5KYSz4/PGeTYruY3NBJ1LSQ oefWdFJj7FSB7m/MI/BKu+zEGhSfXl0= X-Authority-Analysis: v=2.4 cv=dYuwG3Xe c=1 sm=1 tr=0 ts=6a6c9cbf cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=EUfh2IAhO5dQcouLE0wA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfXxaHIJd5xKUyU sRoAmD18mnzG26MOJUpRrvJE/Lq96GPDs7euGWbGiEzlfafkOrAd9Ioi8ly7EvapoPbfSYDt628 HIeE+WSFjhcVVCvbwwdMpvS8ejTHbKpgKZB0lDzGJieqomOdW7q7h6FR+eH8W41KgJhw3jI9JcL SdF3Tv0oV9VAgkwHfHccMdLDL1reQNMnfE5T9CTp+hsEQKsn4mQ9M/Wl8svVnbTn0JB9F2VFKN8 opNowXnp8/jiUFcNoNEX737m2GH3xDN1NadkBqSps74IRWcyvFDyCZ/5MHAaHQIAgwkyXpM/Whg jQXxmYafIA4lC2vXs8at2ULHXdWbc3el2N//kxmHbGDiaeIw+6NGJ+9gNk2fBmFBmdyoeQk3kuC F6VRzz3mEPmoawgc1hdVgwXffW0Ts86Sy0Atdbpqyy4gs1dC5tK0eaj017JDUcWXS2YKTZjJM9j 7TfNbFtgJx1RJKsHJnA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 clxscore=1015 phishscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" When cleaning up a UCONTROL VM, sca_clear_ext_call() will touch memory outside of the allocated ESCA block, and UCONTROL VMs don't even use ESCA. Fix by not touching ESCA for UCONTROL VMs, and fence the KVM_S390_INTERRUPT ioctl altogether. Opportunistically add checks in sca_ext_call_pending() and sca_inject_ext_call() to make sure UCONTROL VMs won't call those functions ever. Signed-off-by: Claudio Imbrenda Fixes: 7d43bafcff17 ("KVM: s390: Make provisions for ESCA utilization") --- arch/s390/kvm/interrupt.c | 19 ++++++++++++++----- arch/s390/kvm/kvm-s390.c | 5 +++++ 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c index 2acdff130fa6..9db68e3ac178 100644 --- a/arch/s390/kvm/interrupt.c +++ b/arch/s390/kvm/interrupt.c @@ -45,13 +45,16 @@ static struct kvm_s390_gib *gib; static int sca_ext_call_pending(struct kvm_vcpu *vcpu, int *src_id) { struct esca_block *sca =3D vcpu->kvm->arch.sca; - union esca_sigp_ctrl sigp_ctrl =3D sca->cpu[vcpu->vcpu_id].sigp_ctrl; + union esca_sigp_ctrl sigp_ctrl; =20 if (!kvm_s390_test_cpuflags(vcpu, CPUSTAT_ECALL_PEND)) return 0; + if (kvm_is_ucontrol(vcpu->kvm)) + return 0; =20 BUG_ON(!kvm_s390_use_sca_entries()); =20 + sigp_ctrl =3D sca->cpu[vcpu->vcpu_id].sigp_ctrl; if (src_id) *src_id =3D sigp_ctrl.scn; =20 @@ -60,13 +63,16 @@ static int sca_ext_call_pending(struct kvm_vcpu *vcpu, = int *src_id) =20 static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id) { - struct esca_block *sca =3D vcpu->kvm->arch.sca; - union esca_sigp_ctrl *sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; union esca_sigp_ctrl old_val, new_val =3D {.scn =3D src_id, .c =3D 1}; + struct esca_block *sca =3D vcpu->kvm->arch.sca; + union esca_sigp_ctrl *sigp_ctrl; int expect, rc; =20 BUG_ON(!kvm_s390_use_sca_entries()); + if (KVM_BUG_ON(kvm_is_ucontrol(vcpu->kvm), vcpu->kvm)) + return -EINVAL; =20 + sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; old_val =3D READ_ONCE(*sigp_ctrl); old_val.c =3D 0; =20 @@ -84,10 +90,13 @@ static int sca_inject_ext_call(struct kvm_vcpu *vcpu, i= nt src_id) static void sca_clear_ext_call(struct kvm_vcpu *vcpu) { struct esca_block *sca =3D vcpu->kvm->arch.sca; - union esca_sigp_ctrl *sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; + union esca_sigp_ctrl *sigp_ctrl; =20 - if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized) + if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized || kvm_is_ucon= trol(vcpu->kvm)) return; + + /* Initialize after the above check, to prevent going out of bounds */ + sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; kvm_s390_clear_cpuflags(vcpu, CPUSTAT_ECALL_PEND); =20 WRITE_ONCE(sigp_ctrl->value, 0); diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 5b2727d7dfd1..21574f57be72 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -2934,6 +2934,9 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int= ioctl, unsigned long arg) case KVM_S390_INTERRUPT: { struct kvm_s390_interrupt s390int; =20 + r =3D -EINVAL; + if (kvm_is_ucontrol(kvm)) + break; r =3D -EFAULT; if (copy_from_user(&s390int, argp, sizeof(s390int))) break; @@ -5456,6 +5459,8 @@ long kvm_arch_vcpu_unlocked_ioctl(struct file *filp, = unsigned int ioctl, struct kvm_s390_interrupt s390int; struct kvm_s390_irq s390irq =3D {}; =20 + if (kvm_is_ucontrol(vcpu->kvm)) + return -EINVAL; if (copy_from_user(&s390int, argp, sizeof(s390int))) return -EFAULT; if (s390int_to_s390irq(&s390int, &s390irq)) --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A13E42DA5B; Fri, 31 Jul 2026 13:01:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502917; cv=none; b=INgqLqgx/G9KFnAKk7iswh0ouPd2WJqUOtNnN14wQbp35r+T/uCkKqSgs0JafC5+9iVfkbrthNNWVLIndfQfHWz7K68WJL7+3qxsvCJJMJ638x4HwEojYvLW4AFBp32U8ewgk2yK6O1g6AUqnUz7bwVVRabzmjVHM4WovsIq1ig= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502917; c=relaxed/simple; bh=6BvXJsYg00jRP6uWfhHCWlM8CF6XCRguWqBauy/PYB4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=obaiX6IL/8wL8fcFJ7urxEWc/HJlFpJaPRi8N5ZH8nuKBeChCXIBts6qiPT1c5vmgkcdnTzY/43f0CjnE3cDyenlbCoHObM3HHoZO24DtK36rdD5PLaZZi//hhpw3S7aVS8fbvscbfN1LZvmcHZwkbxWzsi+6oaquUNdcoHXbbY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=bif0epfc; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="bif0epfc" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBmHbp1674791; Fri, 31 Jul 2026 13:01:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=FffIEzQXrsNsbAmGp RELJwzpowdDByJB9nWkVuIUH5I=; b=bif0epfc9gI4Q1Yd4wPq+W+PdZOb/F0mW EH3MNMtoZmBYl5Yp89s/wWuBKe9rMIM1fl43+S4zGO9ECbJm58TqNeajRw6tfgKl 5DZlhwCDL+jxsvT/FYHzC4/hIN8Tn7d8jMxmHUXQXpHoeMFGQuMNqHMvHfzau+Um 7N/ADCkzM0tHi87/x2cEob6qt+0Ri/b56OXrVrbl9zKk6zXMZkKUYLw+HDuQF1WA +EzvoPIg8MLU4FQHev0TV4fwUY39SXcywnyyfylGvuYxtjyaGtc2pzDRAKvLET61 PSGoSCfWirMJ4gCH6DFN6SQgumfwe5kB9AQofuZskixqojdntEsig== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmv0p420h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:52 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuHFf023546; Fri, 31 Jul 2026 13:01:52 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fna5yfp77-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:51 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1jMt43581900 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:45 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B300A20040; Fri, 31 Jul 2026 13:01:45 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DFD4920043; Fri, 31 Jul 2026 13:01:44 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:44 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 06/14] KVM: s390: Fix leaking of PGM_ADDRESSING to userspace Date: Fri, 31 Jul 2026 15:01:30 +0200 Message-ID: <20260731130138.173983-7-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfXw92rNFEVCo1I oLBAJOYNX4QThlTGLux//6yoPsHnNloM3wBKl9/5YInVvRTT9P/wZUJAOugt1ZnJRbUN31Lz2mh 6JYxQrOG/pjXIDUlWSdA/BVGKWBlU8w= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX4FspcwP/7wC3 rCFb0iMD5sc88ESUEZcv+8H5HMhzip7tC+25Ju4Fc2nIzqH9hCkm90h5AIKqeloDnUmyPzwlWQ6 2v2785J3Y5Nzd2mNUODyGyzj+c0WTWj84HNlQBXMHFsCTdlCxKJcf2OAXmEAZnFqoD5hd+FosXs VOG7G6qWTsUFNx/zrRBo9EGvwltkjnUH7p8zoVRgh33cFErvcgvYtByK+YnN50dxg/eJ5epZyyz v1Nnp+UU4d2VaBNeWNnvIkG5ZPJ3ItuLxHZfKa/TC3ky+4oGrbxVPCl3yEKHnOUMzFBSkXWQhq9 crTsudMMsXUBR6npGXt5W63For6ultDi/Zlek72Am+vvSn/ASvHjGNeMvNBG/mrPlZajlRu0g2L AEZtIndrvFeNmzH47cwnEtrs7XIUHz72fnYUTWOVclAwPAv6Sbb4yeyaauhqg6etSzOQNPH1WjX zraQZC4CfQRni2v+1mw== X-Authority-Analysis: v=2.4 cv=b5WCJNGx c=1 sm=1 tr=0 ts=6a6c9cc0 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=GvWetJuFWLgL5UM2GZoA:9 X-Proofpoint-GUID: oECl6dkHjoOLmJHDzojFGSJcdx1lXsg7 X-Proofpoint-ORIG-GUID: oECl6dkHjoOLmJHDzojFGSJcdx1lXsg7 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 adultscore=0 malwarescore=0 impostorscore=0 bulkscore=0 phishscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" If kvm_s390_set_cmma_bits() is asked to set CMMA values outside of a memslot, PGM_ADDRESSING (5) is returned, instead of a negative error value. Same issue with kvm_s390_{g,s}et_skeys(), kvm_s390_keyop(), and dat_reset_reference_bit(). Fix by returning -EFAULT whenever the return value would be > 0, which is consistent with the behaviour before the gmap rewrite. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda --- arch/s390/kvm/dat.c | 16 ++++++++++------ arch/s390/kvm/dat.h | 2 +- arch/s390/kvm/kvm-s390.c | 16 ++++++++-------- arch/s390/kvm/priv.c | 5 +++-- 4 files changed, 22 insertions(+), 17 deletions(-) diff --git a/arch/s390/kvm/dat.c b/arch/s390/kvm/dat.c index ed4259d17629..171b61959908 100644 --- a/arch/s390/kvm/dat.c +++ b/arch/s390/kvm/dat.c @@ -755,13 +755,15 @@ int dat_cond_set_storage_key(struct kvm_s390_mmu_cach= e *mmc, union asce asce, gf return rc; } =20 -int dat_reset_reference_bit(union asce asce, gfn_t gfn) +int dat_reset_reference_bit(union asce asce, gfn_t gfn, union skey *skey) { union pgste pgste, old; union crste *crstep; union pte *ptep; int rc; =20 + skey->skey =3D 0; + rc =3D dat_entry_walk(NULL, gfn, asce, DAT_WALK_ANY, TABLE_TYPE_PAGE_TABL= E, &crstep, &ptep); if (rc) return rc; @@ -771,21 +773,23 @@ int dat_reset_reference_bit(union asce asce, gfn_t gf= n) =20 if (!crste.h.fc || !crste.s.fc1.pr) return 0; - return page_reset_referenced(large_crste_to_phys(*crstep, gfn)); + skey->skey =3D page_reset_referenced(large_crste_to_phys(*crstep, gfn)) = << 1; + return 0; } old =3D pgste_get_lock(ptep); pgste =3D old; =20 if (!ptep->h.i) { - rc =3D page_reset_referenced(pte_origin(*ptep)); - pgste.hr =3D rc >> 1; + skey->skey =3D page_reset_referenced(pte_origin(*ptep)) << 1; + pgste.hr =3D skey->r; } - rc |=3D (pgste.gr << 1) | pgste.gc; + skey->r |=3D pgste.gr; + skey->c |=3D pgste.gc; pgste.gr =3D 0; =20 dat_update_ptep_sd(old, pgste, ptep); pgste_set_unlock(ptep, pgste); - return rc; + return 0; } =20 static long dat_reset_skeys_pte(union pte *ptep, gfn_t gfn, gfn_t next, st= ruct dat_walk *walk) diff --git a/arch/s390/kvm/dat.h b/arch/s390/kvm/dat.h index fad605305e05..141ee7b9f019 100644 --- a/arch/s390/kvm/dat.h +++ b/arch/s390/kvm/dat.h @@ -537,7 +537,7 @@ int dat_set_storage_key(struct kvm_s390_mmu_cache *mc, = union asce asce, gfn_t gf union skey skey, bool nq); int dat_cond_set_storage_key(struct kvm_s390_mmu_cache *mmc, union asce as= ce, gfn_t gfn, union skey skey, union skey *oldkey, bool nq, bool mr, bool mc); -int dat_reset_reference_bit(union asce asce, gfn_t gfn); +int dat_reset_reference_bit(union asce asce, gfn_t gfn, union skey *skey); long dat_reset_skeys(union asce asce, gfn_t start); =20 unsigned long dat_get_ptval(struct page_table *table, struct ptval_param p= aram); diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 21574f57be72..e162efaa35b8 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -571,7 +571,7 @@ static int kvm_s390_keyop(struct kvm_s390_mmu_cache *mc= , struct kvm *kvm, int op switch (op) { case KVM_S390_KEYOP_SSKE: r =3D dat_cond_set_storage_key(mc, asce, gfn, skey, &skey, 0, 0, 0); - if (r >=3D 0) + if (r =3D=3D 0 || r =3D=3D 1) return skey.skey; break; case KVM_S390_KEYOP_ISKE: @@ -580,14 +580,14 @@ static int kvm_s390_keyop(struct kvm_s390_mmu_cache *= mc, struct kvm *kvm, int op return skey.skey; break; case KVM_S390_KEYOP_RRBE: - r =3D dat_reset_reference_bit(asce, gfn); - if (r > 0) - return r << 1; + r =3D dat_reset_reference_bit(asce, gfn, &skey); + if (!r) + return skey.skey; break; default: return -EINVAL; } - return r; + return r > 0 ? -EFAULT : r; } =20 /* Section: device related */ @@ -2214,7 +2214,7 @@ static int kvm_s390_get_skeys(struct kvm *kvm, struct= kvm_s390_skeys *args) } =20 kvfree(keys); - return r; + return r <=3D 0 ? r : -EFAULT; } =20 static int kvm_s390_set_skeys(struct kvm *kvm, struct kvm_s390_skeys *args) @@ -2276,7 +2276,7 @@ static int kvm_s390_set_skeys(struct kvm *kvm, struct= kvm_s390_skeys *args) kvm_s390_free_mmu_cache(mc); out: kvfree(keys); - return r; + return r <=3D 0 ? r : -EFAULT; } =20 /* @@ -2386,7 +2386,7 @@ static int kvm_s390_set_cmma_bits(struct kvm *kvm, =20 set_bit(GMAP_FLAG_USES_CMM, &kvm->arch.gmap->flags); =20 - return r; + return r <=3D 0 ? r : -EFAULT; } =20 /** diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c index ad0ddc433a73..ea5a99537346 100644 --- a/arch/s390/kvm/priv.c +++ b/arch/s390/kvm/priv.c @@ -289,6 +289,7 @@ static int handle_iske(struct kvm_vcpu *vcpu) static int handle_rrbe(struct kvm_vcpu *vcpu) { unsigned long gaddr; + union skey skey; int reg1, reg2; int rc; =20 @@ -307,12 +308,12 @@ static int handle_rrbe(struct kvm_vcpu *vcpu) gaddr =3D kvm_s390_logical_to_effective(vcpu, gaddr); gaddr =3D kvm_s390_real_to_abs(vcpu, gaddr); scoped_guard(read_lock, &vcpu->kvm->mmu_lock) - rc =3D dat_reset_reference_bit(vcpu->arch.gmap->asce, gpa_to_gfn(gaddr)); + rc =3D dat_reset_reference_bit(vcpu->arch.gmap->asce, gpa_to_gfn(gaddr),= &skey); if (rc > 0) return kvm_s390_inject_program_int(vcpu, rc); if (rc < 0) return rc; - kvm_s390_set_psw_cc(vcpu, rc); + kvm_s390_set_psw_cc(vcpu, (skey.skey >> 1) & 3); return 0; } =20 --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EBCE442DA55; Fri, 31 Jul 2026 13:01:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502917; cv=none; b=f0ZB0lMp12Dz4tUYrVvxFmIAOUoNJkSOKUlyawAt53K24YgyOHS6yjPRuHj/vOl2rQ/43Y4+k66YF6WX6v1an0/6IJiv/Z0BGxweyrRwlXJ/bChYf6z2XvFbq1gagk+9ZDk7MfYNK6MK0jHSFGSMZmPXI9WV0405TWyJ8rF6R4U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502917; c=relaxed/simple; bh=3caGIdp+p3kPdcgMgYkHp0OEp1q1F9YNv8vDbyO0O04=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=p/6lkWq6Li2x+hYBUeS/RVXSFXa6fmTykQTLP3ch5hz6q3r9yGHTHtahO4uMNM58zsGdfdXMJ+TLJ+8I7ECc9srU9QdxK4awnrz8qYu/b9qmVMI1wbcY9ysVOp95xLiaiiN9OoMJJDnfa/j9zTHmvPRtUymlLrRFN1uTOm9Pkxk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=rVotCKmM; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="rVotCKmM" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBlqW81765837; Fri, 31 Jul 2026 13:01:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=UneEizWds06um/osM D5l8RbzWNvgmHxpG3rtAjIygyM=; b=rVotCKmM3UypIVrZEIF6pp4cmnL/oVKHi PGLX23DD9vNgjJytsRFMifxi+fR56cXa/wr2bAQfem2K2YMSQ+MvwI9BfYQhKFt0 y+zkE8gQBdyIRSEYM7j9Da7MlWMFf4LtYHmoDI/xqfDqMYR7ImWhBK01NGne3c0D n67U5fdQK6ydeGOUyVsIzmDAdD1eX5WRWz7bjVOnMPjEubSnwfpQUa1uQMDg81PS jTrFxUXa8UAJKQtsneWI/2zKxGEXowpK8NyUUXJ+GSUfEMy2ZX1DODPBN+bFTkvi vMhDFvbA+cWTmOOYLsI2yFUTzBimfp4G16FKy4obdZ2NT2WkwgNUg== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmv0y5509-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:53 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCQIMk026870; Fri, 31 Jul 2026 13:01:52 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fn9pgqs4a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:52 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1knM32571886 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:46 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B72E420040; Fri, 31 Jul 2026 13:01:46 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D09FF20043; Fri, 31 Jul 2026 13:01:45 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:45 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 07/14] KVM: s390: Fix race in __do_essa() Date: Fri, 31 Jul 2026 15:01:31 +0200 Message-ID: <20260731130138.173983-8-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: ycC_rVo4QATofPMrvJQLvLJTTsdS_R79 X-Proofpoint-ORIG-GUID: ycC_rVo4QATofPMrvJQLvLJTTsdS_R79 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX53uG7PlvNnpX gIPgpnh62xS13mWf/axnGxBD8ObcTCoiu0HQ6tipFaYAhQQ3O3xXOb//p3UOL9iOUjJDD7Bb/dY 22qNmTH82KeJN5K1YqrqgAfKIXmeKiA= X-Authority-Analysis: v=2.4 cv=dYuwG3Xe c=1 sm=1 tr=0 ts=6a6c9cc1 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=vVGDtJNaOgRaVfleRDgA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX1q/Od4B3ur17 ZIvJT6Gd/Iyi2BDztOq16Nf3y710TlXLIHWdQpjcM4VwzmBuLtwLIuQBTxNU1AY/Nw3+lai1Ijg bZMnjihpJ+jlKX1c7uvKFnSfQ9zJCyXSL2T7e2d4hvb1BnMnbYbcqBdi+S4J6ugmUQP7WiiGSXg hmAV1jVD4gMAi0Ai7c8DuT9zzOZPEwzpFwg7e6B872CYElFPMw2KymX1bQ1Ngq+Q0+bYdF1qkBt +PP0dzeckIc+1RY4TAICOWJ3cJznyfs5/hlgRf2bFyUsrNwbLU/S273rh9tqibPA8gtsnFPlIUr EloKvebXReO15yr2r/PYhDhF/En0TohOYcw/gSmTiKMRXzyVklZbHOsqB2Ap/VfvaN+kCvAKdGz irTkL4TxQHPktHetD0nBf5iqlhFllIpbsQErg5FTWaEdpNUj0QM5cdVSeN5CzlpCpKzJKqjzbqk D2mFZgtSj+vmAe+0eTw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 clxscore=1015 phishscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" An unlikely race between __do_essa() and kvm_s390_vm_start_migration(), kvm_s390_vm_stop_migration(), or dat_get_cmma() was possible. Fix by locking kvm->slots_arch_lock. Since this is not a hot path, the overhead of an additional mutex is negligible. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda --- arch/s390/kvm/kvm-s390.c | 20 ++++++++++---------- arch/s390/kvm/priv.c | 5 +++-- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index e162efaa35b8..e5c5e9f61cb2 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -1219,8 +1219,8 @@ static void kvm_s390_sync_request_broadcast(struct kv= m *kvm, int req) =20 /* * Must be called with kvm->srcu held to avoid races on memslots, and with - * kvm->slots_lock to avoid races with ourselves, kvm_s390_vm_stop_migrati= on(), - * and kvm_s390_get_cmma_bits(). + * kvm->slots_arch_lock to avoid races with ourselves, + * kvm_s390_vm_stop_migration(), and kvm_s390_get_cmma_bits(). */ static int kvm_s390_vm_start_migration(struct kvm *kvm) { @@ -1265,7 +1265,7 @@ static int kvm_s390_vm_start_migration(struct kvm *kv= m) } =20 /* - * Must be called with kvm->slots_lock to avoid races with ourselves, + * Must be called with kvm->slots_arch_lock to avoid races with ourselves, * kvm_s390_vm_start_migration() and kvm_s390_get_cmma_bits(). */ static int kvm_s390_vm_stop_migration(struct kvm *kvm) @@ -1300,7 +1300,9 @@ static int kvm_s390_vm_set_migration(struct kvm *kvm, { int res =3D -ENXIO; =20 - mutex_lock(&kvm->slots_lock); + guard(srcu)(&kvm->srcu); + guard(mutex)(&kvm->slots_arch_lock); + switch (attr->attr) { case KVM_S390_VM_MIGRATION_START: res =3D kvm_s390_vm_start_migration(kvm); @@ -1311,7 +1313,6 @@ static int kvm_s390_vm_set_migration(struct kvm *kvm, default: break; } - mutex_unlock(&kvm->slots_lock); =20 return res; } @@ -3001,9 +3002,8 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int= ioctl, unsigned long arg) r =3D -EFAULT; if (copy_from_user(&args, argp, sizeof(args))) break; - mutex_lock(&kvm->slots_lock); - r =3D kvm_s390_get_cmma_bits(kvm, &args); - mutex_unlock(&kvm->slots_lock); + scoped_guard(mutex, &kvm->slots_arch_lock) + r =3D kvm_s390_get_cmma_bits(kvm, &args); if (!r) { r =3D copy_to_user(argp, &args, sizeof(args)); if (r) @@ -3017,9 +3017,9 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int= ioctl, unsigned long arg) r =3D -EFAULT; if (copy_from_user(&args, argp, sizeof(args))) break; - mutex_lock(&kvm->slots_lock); + mutex_lock(&kvm->slots_arch_lock); r =3D kvm_s390_set_cmma_bits(kvm, &args); - mutex_unlock(&kvm->slots_lock); + mutex_unlock(&kvm->slots_arch_lock); break; } case KVM_S390_PV_COMMAND: { diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c index ea5a99537346..b1ba24c346ef 100644 --- a/arch/s390/kvm/priv.c +++ b/arch/s390/kvm/priv.c @@ -1261,8 +1261,9 @@ static int handle_essa(struct kvm_vcpu *vcpu) /* Retry the ESSA instruction */ kvm_s390_retry_instr(vcpu); } else { - scoped_guard(read_lock, &vcpu->kvm->mmu_lock) - i =3D __do_essa(vcpu, orc); + scoped_guard(mutex, &vcpu->kvm->slots_arch_lock) + scoped_guard(read_lock, &vcpu->kvm->mmu_lock) + i =3D __do_essa(vcpu, orc); if (i < 0) return i; /* Account for the possible extra cbrl entry */ --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B8EDE42E8D6; Fri, 31 Jul 2026 13:01:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502918; cv=none; b=ujQng9V/7PtP4Hd0XzyHoFT/+kM54uJd8QPeVoNaY8387lvkKZWsc+3Uv0hL2Ck75fOGDIcoWpWaBfmOfHZrHdJQvr93IthLqfinGs9OzJLZaPql0Hjiw0lertPfqzwp/j/YOAyK6r1PwMNy4oWDO4N/19T35ZE3OyHbFIoVcPs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502918; c=relaxed/simple; bh=tswRcvjV2UsGuXuFcHb6Xe6uRRImcfr585nXnRvh2Zg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YVqwdvw68E3i0kZz1p7+TESj78USZbYb5Nu5DgXRaT9CsvMp8AGRCAPZPk0RYrBPfux9YF1hG9uRpbhSyp1ZhLFb0LDPo3UDlTfJggLAB87YZDYGZiwqE6k1wqqnkw2yl/4/m9qA5ZBj6IDjOAw51OLarfnp90EdIlC34P1CPzw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Lp1Y4y1/; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Lp1Y4y1/" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBlcMX1765235; Fri, 31 Jul 2026 13:01:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=bPRjq6q44qll6i58L O/+Vola2iS5l5Z6UG1bVIPEDAA=; b=Lp1Y4y1/jexjh1rSzhIGSA0jTGy8iRiRt PS1CM0QacBTmGMcNYpYImcCOFA6dk/w0/x5muJd2/wHHuJOi2ZRtGEZpeVlXyia3 bHic8vHbhPPmEojpK8i9S/mSkqmta3rzgWHQqgv2Qo1gPxTvPkfoZ13kuLNmzO+F mb3sXtdfKFm7HlK9qQ6ktXKtQn5Cm4VoUNWAC2oCa+t7KBsTusJtWk8f2VYHDj9A 7hlxUwnqTRV15Mwqulj/4cpRZK2Qi1um7s5r3XoPOGgs3RXQjd+kxJkoBGCosxvl OaD2OMB5d10bzSdwekVFE6MQX689fPU+hd1w7WElwA2aZ9fOtMovg== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmv0y550d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:54 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuK9u023567; Fri, 31 Jul 2026 13:01:54 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fna5yfp7e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:53 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1lqq32375062 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:47 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C159720040; Fri, 31 Jul 2026 13:01:47 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D6FBA2004E; Fri, 31 Jul 2026 13:01:46 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:46 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 08/14] KVM: s390: cmma: Fix dirty tracking when removing memslot Date: Fri, 31 Jul 2026 15:01:32 +0200 Message-ID: <20260731130138.173983-9-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: dFU-O313iRgOFdGCDkARGTUTeyN51HLt X-Proofpoint-ORIG-GUID: dFU-O313iRgOFdGCDkARGTUTeyN51HLt X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX970SeFOPVdBa BoIpphmGq2zdu5f9z0YNMn9Xy80JeCzTrtN/Fj7EVQ7X6Cqf15KbQryXoCqNuQvHrcL0chOuxNa C9lZ8kNbw2mUrJrKWOC/V4wJ99K22ZU= X-Authority-Analysis: v=2.4 cv=dYuwG3Xe c=1 sm=1 tr=0 ts=6a6c9cc2 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=xy2Bf3EjJieBI87QFfgA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX8gNRazf2Cqvp xg2NxQzPCZ4cghbDi+iHbDICHodHTLTq35jq6xJyLpVQBk/iTzYv2cD/EiDMmZvA/jss2SGIPwm eKvVIGrctNwLqwUNuB69HfGLM7yz90l3erwq2/Hgqj72jLbdA0zI+5emnyvUt0VV/6c9KPkBb7J e65VP7O/2gHRFKcEns+RtJrlpMs98+sM4UX+x39iDA+EnfzKwJiUksOh/OrH6YPNLMP7Ty0VSqY WoE8Qiy4lgVB7c+is9RyiSZ995tzP0/gHHjJ6zsrq2UsnwaXDoPME8txKcmwY0tOYs1RHieYus/ SO7cttHXPNL8Fa62Y67ZeMJWpQiy2r7WA8Nwd98iu9WQMOIeDVzkYHm941xtARjP4V/Zj8/XceW NruKwqnKLk9JtEq84tj/dbyNzP4XQSDShCZ3SdT31+vcofEX/fMDY4Mcsi2gQhyRbl9LduhVAyb FZlx3rVsIob6LTVk8Tg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 clxscore=1015 phishscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" When a memslot is removed, all ptes that mapped the slot are cleared or even deallocated. If this happens while the system is in migration mode, and if cmma-dirty pages are removed, the cmma-dirty counter will not reflect reality. Fix by appropriately decrementing the cmma-dirty counter when removing a memslot. Opportunistically improve kvm_arch_commit_memory_region() to use __free() for the struct kvm_s390_mmu_cache. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda --- arch/s390/kvm/dat.c | 7 ++++++- arch/s390/kvm/kvm-s390.c | 25 +++++++++++++++++++++++-- 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/arch/s390/kvm/dat.c b/arch/s390/kvm/dat.c index 171b61959908..3f2d6e8902d7 100644 --- a/arch/s390/kvm/dat.c +++ b/arch/s390/kvm/dat.c @@ -850,6 +850,7 @@ static long _dat_slot_pte(union pte *ptep, gfn_t gfn, g= fn_t next, struct dat_wal struct slot_priv *p =3D walk->priv; union crste dummy =3D { .val =3D p->token }; union pte new_pte, pte =3D READ_ONCE(*ptep); + union pgste pgste; =20 new_pte =3D _PTE_TOK(dummy.tok.type, dummy.tok.par); =20 @@ -857,7 +858,11 @@ static long _dat_slot_pte(union pte *ptep, gfn_t gfn, = gfn_t next, struct dat_wal if (pte.val =3D=3D new_pte.val) return 0; =20 - dat_ptep_xchg(ptep, new_pte, gfn, walk->asce, false); + pgste =3D pgste_get_lock(ptep); + pgste =3D __dat_ptep_xchg(ptep, pgste, new_pte, gfn, walk->asce, false); + pgste.cmma_d =3D 0; + pgste_set_unlock(ptep, pgste); + return 0; } =20 diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index e5c5e9f61cb2..ba811f0673d1 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -5812,14 +5812,30 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, return 0; } =20 +static long cmma_d_count_pte(union pte *ptep, gfn_t gfn, gfn_t next, struc= t dat_walk *walk) +{ + union pgste pgste; + + pgste =3D pgste_get_lock(ptep); + if (pgste.cmma_d) { + pgste.cmma_d =3D 0; + atomic64_dec(walk->priv); + } + pgste_set_unlock(ptep, pgste); + return 0; +} + void kvm_arch_commit_memory_region(struct kvm *kvm, struct kvm_memory_slot *old, const struct kvm_memory_slot *new, enum kvm_mr_change change) { - struct kvm_s390_mmu_cache *mc =3D NULL; + const struct dat_walk_ops ops =3D { .pte_entry =3D cmma_d_count_pte, }; + struct kvm_s390_mmu_cache *mc __free(kvm_s390_mmu_cache) =3D NULL; int rc =3D 0; =20 + guard(mutex)(&kvm->slots_arch_lock); + if (change =3D=3D KVM_MR_FLAGS_ONLY) return; =20 @@ -5830,6 +5846,12 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, } =20 scoped_guard(write_lock, &kvm->mmu_lock) { + if (kvm->arch.migration_mode && kvm->arch.use_cmma && old) { + _dat_walk_gfn_range(old->base_gfn, old->base_gfn + old->npages, + kvm->arch.gmap->asce, &ops, DAT_WALK_IGN_HOLES, + &kvm->arch.cmma_dirty_pages); + } + switch (change) { case KVM_MR_DELETE: rc =3D dat_delete_slot(mc, kvm->arch.gmap->asce, old->base_gfn, old->np= ages); @@ -5851,7 +5873,6 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, out: if (rc) pr_warn("failed to commit memory region\n"); - kvm_s390_free_mmu_cache(mc); return; } =20 --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78DE142FCDA; Fri, 31 Jul 2026 13:01:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502919; cv=none; b=T4k75yXmLMpPs0BODQG5d4PGWB5bdvytLgBQE/T+GFq2aYH1yeHxvbmH6x/NQDyrqzPFkChiL3LtuvuXRyBiUilwO5UVsLUIs63Y1u29+nocwslmSlQl/FSDQADePTC9iq+49EMq9LQ8oI8ZOsaKw99Hu7DBWX6ib2YU70uF+bk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502919; c=relaxed/simple; bh=HOanDrvD+bLZnZeY7pEyreY/JBB5XIzF0GbLYIxmYn0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pi4k3A/shevOAV1Y920le4VvrVx2L+njkIS1fPm6M3XfhdQjZ+mvOzGWAwbNF36GIQ/c7v/pBH6XglviLHkjwwj1krmxQsSHPDIRH7LznHup4MX/IhLpVq12bu4oxdW7P3kHtc+6PuNKeiLPzgHgnvoikV0OOHE/940u+iY1Nmg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=HgeVr6FD; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="HgeVr6FD" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBm8ih1791335; Fri, 31 Jul 2026 13:01:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=rwemp1JR72yGC96fZ c2lb5FsV7ftYuKoDvMVFB/ovOA=; b=HgeVr6FDDkghgPYelTmZ57FlHERwiViPn Jb1asdBq181JD6pUSkDtDEPJB5AcTEsoK/M+EKVSA8ZDMauJniEASDm+DJ5sv64E KMgSJI8TMGdyK3l/eoDhzp1A8a7UV1b+BLJcMDo7JtlNEbcrpsAoaOWCiV77Sm3n afWJUxhxASEzke5cyiveOh4NrRu+Z4BADu13Zm/SMgWbN626Pw2LbOqrI+nKNirF OjnrwA8OIct6zCGrKs1tQfAgIzLJjLnzyrZE/s0vNVpSZCLt6kAklaDLVZ3W7HaI WzCw3cwn+Hz1cUajRhlLlEQwIMGeTNhcao2OWYKmdil/UZvvXqNHA== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuwdc2wu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:55 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuHTu021733; Fri, 31 Jul 2026 13:01:55 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fn7uwg2vh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:54 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1mLH35651918 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:48 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B53982004D; Fri, 31 Jul 2026 13:01:48 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DF5CD20043; Fri, 31 Jul 2026 13:01:47 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:47 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 09/14] KVM: s390: ucontrol: Add missing locking around gmap_remove_child() Date: Fri, 31 Jul 2026 15:01:33 +0200 Message-ID: <20260731130138.173983-10-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 89UZAXg0My2e4y2hwZYM7Ct1mkTdP5gt X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX84eeBWxJnw9a xTNkDYoSvhIUEu+kIBXTc2lvZGOKu3CPjf53fRzJfBNg4yCU3GR2RHWtdlwBs0HErK+l7flSVVk Bbvr+5DGATXpifm2bQe5u8R0vXYb2kM= X-Authority-Analysis: v=2.4 cv=E/z9Y6dl c=1 sm=1 tr=0 ts=6a6c9cc3 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=qtdt0r206yBj_IGTItsA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX4RMjfq2FcWc7 mg4P26m/xes9Vxdeqd/MNS8VgRH8QnRDpUk2VykapB/oeQc515VS8ybJM5NCTTCwIA6rzNGbS/7 U0fMIkHlJcKWuigkUc6RaNGqJ/9UzojRYOSa6KuI96L/xi/UEAjx4AvX/U8QiWuD+p+quIBe2iQ YxNO4r/3P08B/jEv3akapeEYVUCZD+55qpCS4FrcnqV+7D9SzGPDaskv9x2Lk6GGdqpnNPFWcdn ctTC4hoi+WKQh57GqeThukbj9yMAcDzQUqAiEeP4cnRI0yylQbqjcusA/0VzF8SqWWCK8SVcfqu lEby3GWAhaP4KZNAaqz3HV2WaE37A+jXDoK8hCjYWd3KgXhrAYKUR2+yb3Cw/tISrYwqfQzNQ9f n8sgBNCLQhNKVo6LFSRj2OdKT0WNhI9K1agP/74B6vz50/Kxn2BgHd5l4X+eXvuE8ZgAMAQCZ97 X46jO+61yR7L2y+bLxA== X-Proofpoint-GUID: 89UZAXg0My2e4y2hwZYM7Ct1mkTdP5gt X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 phishscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 impostorscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" gmap_remove_child() needs to be called while holding the children_lock of the parent gmap. This was not the case in the error handling path of kvm_arch_vcpu_create() for UCONTROL guests. Fix by adding the missing lock. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda Reviewed-by: Steffen Eiden --- arch/s390/kvm/kvm-s390.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index ba811f0673d1..2741ca323ede 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3875,7 +3875,9 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) =20 out_ucontrol_uninit: if (kvm_is_ucontrol(vcpu->kvm)) { + spin_lock(&vcpu->kvm->arch.gmap->children_lock); gmap_remove_child(vcpu->arch.gmap); + spin_unlock(&vcpu->kvm->arch.gmap->children_lock); vcpu->arch.gmap =3D gmap_put(vcpu->arch.gmap); } out_free_sie_block: --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 23400425CC0; Fri, 31 Jul 2026 13:01:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502920; cv=none; b=FxTL5NqP4R7KCmKyFcHbiZvuzmH4bSBob+M566SwvjLFikQ8+erx5gJHWHd+/SBou6HztVF3IUiXJuJQU8xNbdXYI5vticbsq2rFV8pIGJw3wnBqhqblepP+tWm9IxFM5L7zs8+QE9w8Px5Gi0wT7x8mAodBzSa66TpJpqlmM1M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502920; c=relaxed/simple; bh=KnM1KVGK0kPBQvu6Ryfhsr51MIdNqKkHhP5SbM2+pPg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ce8JODr7xGpqYO+lAmJ2lUIK3LVrY9Vp28+KECZwB5NJNv+HIw9zEDS3RbuvFh5w7UPf0TYp3xE3YZ8tSmkBRl1KHzpppL6X+LAVXsgR9df8d0gHovq7tai3CDgoPUy1lkOFwyWHv2229+It5Im7zfRmQhohDaCJm7DMgaSPVeo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=BL2gajVb; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="BL2gajVb" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBlcMZ1765235; Fri, 31 Jul 2026 13:01:57 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=fxrGJO7BUkEjBuJE6 4dhCca2Om+6ZKwB7ScUtkxDJhU=; b=BL2gajVbQxY8tqi+UCezN2N8ykpWekPqX upOiWY5T+CNGKMGphn6tDEbCqt+L+XW5IP1Yf9YLaWxXSc99Hukr+uxazywdr+vw s7e2t7kI+Nz04mIVcTs9v/jWJKRTZU5+6H1vYN5W72oi5RxNXljy34wt/bxTPdml sruns8dOe33abbVaDDl1x+s9UKgKlzCPsz4+wlyzN8ZRhiWFmTIpfqr4lZrvCHRF T6F8FkhVRlzgx7SfWCCEFYEjkzy4ItyV3kWZ7n3fE1FRkKUyHctdX1R4Bl3TTSN8 mu5YvuSsZMHK29vGv63B7f5wGmdmGOzZ6S+VA6MeVGIt1G7pRLyjA== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmv0y550k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:57 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuR0l021781; Fri, 31 Jul 2026 13:01:56 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fn7uwg2vq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:56 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1nbC13697382 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:49 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BA11E2004D; Fri, 31 Jul 2026 13:01:49 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D352620043; Fri, 31 Jul 2026 13:01:48 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:48 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 10/14] KVM: s390: Free the mmu cache when kvm_arch_vcpu_create() fails Date: Fri, 31 Jul 2026 15:01:34 +0200 Message-ID: <20260731130138.173983-11-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 4pZCYbOY8kn0CBlk5pBiTiCZVyEuhC2u X-Proofpoint-ORIG-GUID: 4pZCYbOY8kn0CBlk5pBiTiCZVyEuhC2u X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX+OeDSUnCI/H9 zwLrC26o+3VdebvJSLPu64O8L8dPkw866x6O4Zm9Cs1rVO8UJAx7W2PeqxKA+U4qvAV4MpVxxDz YF0AeLawP64RINMV3/I0tq1H9U2+4Jk= X-Authority-Analysis: v=2.4 cv=dYuwG3Xe c=1 sm=1 tr=0 ts=6a6c9cc5 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=owYgaZMeOewOGYH0y6gA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX2LGrNG6dku14 O/vYNUQrQBPZidBDg/tYCtyLc3s5LYfQ2qf0LYbIBn2DlBO7nMDzcZyql9E3ajtNM/f5sJWDVby U5meL0oJQ7pOZ/5FGsAzIK0zpmaP20T7GEwWyqi4wdM64VNYTyj5zd9tpoh6syQ4oX5myJJpICW voGOfUtWxB1DEOHeIINGayxK5Oc9UyDG3t13D0C8TUPUFcV69pe5mvkFw55814RgkffriHZdoBu GbrtsKUVahmVCotwQo3oBUtKVT8JcS7eS7b1x3vLWQ6WW6vh3cQlk82Zqmt0RexBP0RC1s3nz6a 5DAfN5Yuu+iEkxQcn7FOIFAivcLG/uiPqvWhbW5wk42Q+6OOpFaGJnQ28HJjJSGhbjUPTTbnKaG v4REnid8wiZ3EZG1h/F4zXOpeh8LlC+Jv8TDU1H2w14p3AJqHBy0mwEBNwrcpoDjuB4BruYt5Jx PL9eFRgMVUNVIBHIpog== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 clxscore=1015 phishscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 suspectscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" The mmu cache is the first thing that is allocated in kvm_arch_vcpu_create(), but in case of failure it was not freed. Fix by freeing the mmu cache in case of failure. Refactor kvm_arch_vcpu_create() to use scope-based cleanup instead of gotos. Signed-off-by: Claudio Imbrenda Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") --- arch/s390/kvm/kvm-s390.c | 40 ++++++++++++++++++---------------------- 1 file changed, 18 insertions(+), 22 deletions(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 2741ca323ede..9b8a35e7dc82 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3800,21 +3800,21 @@ int kvm_arch_vcpu_precreate(struct kvm *kvm, unsign= ed int id) return 0; } =20 +DEFINE_FREE(sie_page, struct sie_page *, if (_T) free_page((unsigned long)= (_T))) + int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) { - struct sie_page *sie_page; + struct kvm_s390_mmu_cache *mc __free(kvm_s390_mmu_cache) =3D NULL; + struct sie_page *sie_page __free(sie_page) =3D NULL; int rc; =20 BUILD_BUG_ON(sizeof(struct sie_page) !=3D 4096); - vcpu->arch.mc =3D kvm_s390_new_mmu_cache(); - if (!vcpu->arch.mc) + mc =3D kvm_s390_new_mmu_cache(); + if (!mc) return -ENOMEM; sie_page =3D (struct sie_page *) get_zeroed_page(GFP_KERNEL_ACCOUNT); - if (!sie_page) { - kvm_s390_free_mmu_cache(vcpu->arch.mc); - vcpu->arch.mc =3D NULL; + if (!sie_page) return -ENOMEM; - } =20 vcpu->arch.sie_block =3D &sie_page->sie_block; vcpu->arch.sie_block->itdba =3D virt_to_phys(&sie_page->itdb); @@ -3856,10 +3856,9 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) vcpu->run->kvm_valid_regs |=3D KVM_SYNC_FPRS; =20 if (kvm_is_ucontrol(vcpu->kvm)) { - rc =3D -ENOMEM; vcpu->arch.gmap =3D gmap_new_child(vcpu->kvm->arch.gmap, -1UL); if (!vcpu->arch.gmap) - goto out_free_sie_block; + return -ENOMEM; } =20 VM_EVENT(vcpu->kvm, 3, "create cpu %d at 0x%p, sie block at 0x%p", @@ -3867,22 +3866,19 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) trace_kvm_s390_create_vcpu(vcpu->vcpu_id, vcpu, vcpu->arch.sie_block); =20 rc =3D kvm_s390_vcpu_setup(vcpu); - if (rc) - goto out_ucontrol_uninit; + if (rc) { + if (kvm_is_ucontrol(vcpu->kvm)) { + scoped_guard(spinlock, &vcpu->kvm->arch.gmap->children_lock) + gmap_remove_child(vcpu->arch.gmap); + vcpu->arch.gmap =3D gmap_put(vcpu->arch.gmap); + } + return rc; + } =20 + vcpu->arch.mc =3D no_free_ptr(mc); + sie_page =3D NULL; kvm_s390_update_topology_change_report(vcpu->kvm, 1); return 0; - -out_ucontrol_uninit: - if (kvm_is_ucontrol(vcpu->kvm)) { - spin_lock(&vcpu->kvm->arch.gmap->children_lock); - gmap_remove_child(vcpu->arch.gmap); - spin_unlock(&vcpu->kvm->arch.gmap->children_lock); - vcpu->arch.gmap =3D gmap_put(vcpu->arch.gmap); - } -out_free_sie_block: - free_page((unsigned long)(vcpu->arch.sie_block)); - return rc; } =20 int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9CDB342885E; Fri, 31 Jul 2026 13:02:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502922; cv=none; b=NEGXqNsLxLELbQdj/h1FOu++lty4ezFp5rfuvAbdma5j10lO8hHxVK5Q2K4WYI4x0PVkXOeun2sBDkGL3PmPbWBoQ8Uq7VBqZM2fsomG98m8NOFS85iBPx1Wca5PFh7+824bUcNPNWxW1xXyPTnA3nGU+IXtnLpfKXR2Ck/JCIU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502922; c=relaxed/simple; bh=lrLXFoXGkCQqajiFzpvyyVTqja9Wibw9Q7qbE7OIzeQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AZX/nA5uTcdTi5KkgyWjCPgJx0r2C88E5pLtYWZhk9AQK53zWsOBRJNpuxfsrnvpn5MqUieiMDS7RvGyPau2qNVlyOCE6auJ4K6p51NDbnqpHIZGEkSCxVw1NiyeJns2UEbsOs7lvh9bKeJJf/j+YHeuUEcBwvUpJ/o79YYluEM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Dw2+/Fn5; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Dw2+/Fn5" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBlwux1791087; Fri, 31 Jul 2026 13:01:58 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=J5ryilsnnfEEjhv+w mZlP5DZ1N22K6iGMAkWi7r5uEo=; b=Dw2+/Fn5Awu+CRQZ3YSgczx7y61a90hBL wUAt9roIyOvoJ2Ggu5I43riD0Sg/+GGl7tDFp4P/TAX8pybq7obLdDWVneE8PBW0 onENaYhMIaoLQI+JFPKYRPUPvWs0vz6c0haZrzUcEz7jOVyFQwZac3VQZWLYs8z5 YsdgZ84bUAJ1dBqhNvTRjAqXkKYDgWp/ZvCfCfQaO2MLfBke8ofX1IMUcGj7RZqp mqGolj7H4F9dHk9OUi9dBNsFJ0wzkn+2+jpEK+gRbYEbR+0+xrn1Lejau3u0zLBU ZTT5CONUaZCIQxBPc7SBiwODNhGUT1jI105blVgqM7jKPNluzctGA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuwdc2wy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:57 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuN2k012675; Fri, 31 Jul 2026 13:01:57 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fn8fkfxyj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:57 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1ofQ29688252 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:50 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BE7DC2004E; Fri, 31 Jul 2026 13:01:50 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D9E6620040; Fri, 31 Jul 2026 13:01:49 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:49 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 11/14] KVM: s390: Return -EINTR if a signal is pending while faulting-in Date: Fri, 31 Jul 2026 15:01:35 +0200 Message-ID: <20260731130138.173983-12-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: Wm6OJOhQB3Ql0eCsDxMledhVgvpqi3J3 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX8pxKPRkuragD cmygZq8SkRX6CKUT477UmKyvVV/n+7ArI7+0UrOX+qvUGD1dGD+2sPHd7nqClPm1Z5MNh7o/skQ K4YSY1UUehM4Gn73HpnaR5pbQDBRCHI= X-Authority-Analysis: v=2.4 cv=E/z9Y6dl c=1 sm=1 tr=0 ts=6a6c9cc5 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=4yawSYOjwzvXb9KGJXwA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX2s/Dh+2e9aKH 1GVNkyh+vdRc5MYsVMbj49jGasGGgLqYwzT40dg37CLCAGNE8tc69Y3Sr3zaE0kNk4r+KAqXz5o I6FjqLkB3PDBaJpErbKUivDNl/alE3PQwg+JAVXBdQmwIMxQOEXGsQEFqzJZFaJcZ1eIM/6A0wJ Y7TFnsfOFgAyj9qR2MtP9gbZWGVPNWifOkaqoUsdLkGn2h2c42fE9dv1VWqIttnqFn/eMI5v/UO IRC1s81KAUBr0WKSKm5fi+OF1LBFGy836ROk0Y8IKhgJP85nsS5qghn2hA6WIzOd75QgQ76RB54 MB2h9DvP7w+CSPGQ9KcLJO5ZNLK5w9b2p20aYktgIkribOl7Zri8j6fAllkeyoSwQ7SD1HLbey7 dTzn+kBJqRR0eajGoTfrng+pA0l6gl4SB36h2/vGdaLY4L9nEEWuXPP9Ni9E9woWjxwMDKkaNt0 m9n6I9Mn5ILykqqiUBw== X-Proofpoint-GUID: Wm6OJOhQB3Ql0eCsDxMledhVgvpqi3J3 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 phishscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 impostorscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" If a fatal signal is pending while trying to fault-in a page, return -EINTR instead of -EAGAIN. Also fix unpack_one() to handle -EINTR properly. Signed-off-by: Claudio Imbrenda Fixes: e907ae530133 ("KVM: s390: Add helper functions for fault handling") --- arch/s390/kvm/faultin.c | 6 +++--- arch/s390/kvm/pv.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/s390/kvm/faultin.c b/arch/s390/kvm/faultin.c index fee80047bd94..3cc45f7f5b2d 100644 --- a/arch/s390/kvm/faultin.c +++ b/arch/s390/kvm/faultin.c @@ -91,9 +91,9 @@ int kvm_s390_faultin_gfn(struct kvm_vcpu *vcpu, struct kv= m *kvm, struct guest_fa /* Access outside memory, addressing exception. */ if (is_noslot_pfn(f->pfn)) return PGM_ADDRESSING; - /* Signal pending: try again. */ - if (f->pfn =3D=3D KVM_PFN_ERR_SIGPENDING) - return -EAGAIN; + /* Fatal signal pending: bail out. */ + if (is_sigpending_pfn(f->pfn)) + return -EINTR; /* Check if it's read-only memory; don't try to actually handle that cas= e. */ if (f->pfn =3D=3D KVM_PFN_ERR_RO_FAULT) return -EOPNOTSUPP; diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c index 1beacc841ca8..dc204b521052 100644 --- a/arch/s390/kvm/pv.c +++ b/arch/s390/kvm/pv.c @@ -809,7 +809,7 @@ static int unpack_one(struct kvm *kvm, unsigned long ad= dr, u64 tweak, return -EAGAIN; } =20 - if (ret && ret !=3D -EAGAIN) + if (ret && ret !=3D -EAGAIN && ret !=3D -EINTR) KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: failed addr %llx with rc %x rr= c %x", uvcb.gaddr, *rc, *rrc); return ret; --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D87BE42980C; Fri, 31 Jul 2026 13:02:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502923; cv=none; b=Mv5evNAIpLBcVdWm50gb0DBy6PAYlUeRx+EmpdJFUO3IrB95X1ksjhmTWS2daY2Peg/sASJeREz09pdTqFXyrZKZc+EpixiKKu3ynTg7H+kTcSlcETVLXyhpIgBzTMlzCFqvjVpiHJgBil8F7KuGdgpCSJeD0vR1x7A9fcDC6lE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502923; c=relaxed/simple; bh=SueeGW913y+l6iNRtLVYVpFY6wBTQ6KEeYtAQFCxDSE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cO3jVRzMJjSMFig014SFRzkx616I5WBFHnFBberuD+nShLMYMIalsEWQOgZAWTss7ad+nwsZc4pd/asT2Qei3K6wWIal8cUANXXMfunajz0dTdojwuBuChiGL+U3z7pxshXwpTw5nEORQMOnjC8eDeM6F+hQM47yUB08sIUw9kE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=lJZVTaDk; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="lJZVTaDk" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBmGSw1671896; Fri, 31 Jul 2026 13:01:59 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=kD16CCXM6IusG0twE 5s++dKeFs80vjBLnsgXBQEbWo8=; b=lJZVTaDkuQVj4jkOANv8zc+Fh9MT7SQON sSFCqNfvVV32k1PBNl/BN1SAQX6RvjDi5/rVWRmRuiWd7Sxc3lUzqCtAXKsqRkKo 69lzXmhzlhFPcjP8q2ikXOxveNVXyhc1lP+1+F/jVwhajqQ6xJBmZuMrVrxWW/gh BZfbSlX//+m8LYbThNlSB7E3qjTr4AJTH+bn/2v+KzDVzeCwe+/lwRuU6MJVz/k1 ri4SGUmsAjFqTgbeRfIth9Y7/xrxabedFohBO9aQuiOPXl1WpoyuU7sqW7K9KZl3 i4XQPbyOdPwpHH4y5VKpK4tfRm/btfY7gQvoN+Gc7u3uyD8s8ImAw== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuyjm2rt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:59 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuHpb023551; Fri, 31 Jul 2026 13:01:58 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fna5yfp7v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:58 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1ptx29753660 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:52 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D917820043; Fri, 31 Jul 2026 13:01:51 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DDD6120040; Fri, 31 Jul 2026 13:01:50 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:50 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 12/14] KVM: s390: Fix ordering when adding to SCA Date: Fri, 31 Jul 2026 15:01:36 +0200 Message-ID: <20260731130138.173983-13-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX3CyY+nnpGGNu Yg65Zy5O3buNR0ni2lET5YdheD96XiNk8PgkhMqyOzeCs/ilIPROYX1Uv3HWiefLkTp6Dy69DRR TNT2Zbcc+K1xpgx0VufC0hdhfpusKFI= X-Proofpoint-GUID: Xh89OLpgrZIBOYtzOz5gJ8DkgEibMMox X-Proofpoint-ORIG-GUID: Xh89OLpgrZIBOYtzOz5gJ8DkgEibMMox X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX2xiGA8EyeXz9 L+eixoMWOYbxVzk2F8fEV5TydjtQ/q6GOTyDCik/uhYujjabPuQipB+f0pE5M4kFBkeg9he5Zet rEfMTMFkpUS6Huy1Xw7OIbDY0I4EZu3Ay855yjexuhCQeWLXS+Ww3pikAwadCu3j5tIFZX0Fb1O adv28okDhZewvj+5BWlPB4hNH+uWh8RP34GFgxbQPTU2F3D90qn1GoITBnALMyNEJ+kBeZlpPKZ XWnp5Th9Zvs92jh1YYJoS17LhwgV09AMFPCG6KNcKUr//uGf87dnOvHYKwfJJ6pmRiwle3Zc0Q4 N9I6LPp/ykNiNWZNCaFMP8xwLyILfZhViQxGO5AA33bL8+jPxiqJmhjjl853pe10/bx8ncF75Gf 2qYibDFmoP9r1eI6v4Dm0BnLyr19NoPMJWMOzp1xb2dYuauBegr5X8wfXpU3QnIsj24CzuGuGqn Di736QksryFEh6Z0Adg== X-Authority-Analysis: v=2.4 cv=X5Vi7mTe c=1 sm=1 tr=0 ts=6a6c9cc7 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=DpaZzcUc-R7GdRs0254A:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 phishscore=0 priorityscore=1501 malwarescore=0 spamscore=0 suspectscore=0 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" When adding a new vCPU to the SCA area, the validity bit in the MCN was set before the pointer to the state description, potentially allowing for a race. Fix by setting the pointer before setting the bit. Fixes: 14542a0a54c5 ("KVM: S390: Remove sca_lock") Signed-off-by: Claudio Imbrenda Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank --- arch/s390/kvm/kvm-s390.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 9b8a35e7dc82..518a69c55e85 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3485,8 +3485,8 @@ static void sca_add_vcpu(struct kvm_vcpu *vcpu) if (!kvm_s390_use_sca_entries()) return; =20 + WRITE_ONCE(sca->cpu[vcpu->vcpu_id].sda, virt_to_phys(vcpu->arch.sie_block= )); set_bit_inv(vcpu->vcpu_id, (unsigned long *)sca->mcn); - sca->cpu[vcpu->vcpu_id].sda =3D virt_to_phys(vcpu->arch.sie_block); } =20 static int sca_can_add_vcpu(struct kvm *kvm, unsigned int id) --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1ECDB432E95; Fri, 31 Jul 2026 13:02:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502923; cv=none; b=a/sRmauHzS1xaE8UyAhBpmRq8tlN9QRrvfQVV97t+e6gAxMtg8wkcC2LtRg0HRxj+6VGQRdaARCnS6q26W3u1ALqWR1EZPgfGoKq8qI1I+/nM5cRHFUdmZ43s1EwUPUvUjU0zNt56lMh6KhwsBqoaAzlVgYylFujR5EAWa/uSpk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502923; c=relaxed/simple; bh=yB18Tdk/yJv2D1uTlZXxVFQX7lyhikE6fAymjrfZIUM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KDbub4sF81ih4Q7aazityRV9/RfRin76AqcOx2JTOPpZ67tw4CrfcvVfs1c+b15jbqFx9KljgRJW0aDpLab+Vf6+b6OGvbJxbnklHo0+2p5WE39lqJTqxwd3+n7ATfvl7nfalZpF1OA016Sh2mIQZMWX9P5+sQdiPxTWeGdpTks= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=nHxaRaHa; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="nHxaRaHa" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBlbYj4072617; Fri, 31 Jul 2026 13:02:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=+ovgPGLArufZdBlLu 6efjoPl7/x/t4jxjAnDkdUcJ+o=; b=nHxaRaHarTvuJeyywR8ENnCyDHVTXw1S8 cIONLNTH704DJSrgXh7DIVoDzaVqaUoduA2jO+cusAYgryTM+D4G5FT0gBGA/pZa FHCp2yNvK3W0mZEHLd7sjmi7OhSh443NgDoGVI2ZcnXdVfPZCjLSARIX6YRexwY/ tmm34+uAwvUc2HDDKVocqzYu2QWIjrB6JoyDZ/HddVmV55Iv+dYOW4jfWNker4iE 4JQauaecZTj1zvUgfWLfCh/20D4nc6TyYbm+obuZZNO5Bjs7e6/dmlFqtv5o/jrv MU8ekwCpcVFXM+bklUgILNexXea+G99wc5GVN9PriZA/RkNaKkXTQ== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuycw1e6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:02:00 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuLZf023579; Fri, 31 Jul 2026 13:01:59 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fna5yfp81-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:01:59 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1q6f38732052 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:52 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C940820043; Fri, 31 Jul 2026 13:01:52 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0427D20040; Fri, 31 Jul 2026 13:01:52 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:51 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 13/14] KVM: s390: Fix cleanup in kvm_s390_pv_create_cpu() Date: Fri, 31 Jul 2026 15:01:37 +0200 Message-ID: <20260731130138.173983-14-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 6AQ2ebyc04UobjU9iMdL8JFu27dmzR3l X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX/ZSlMlT3jT8z PZHukKA/0xeLXgyowWmkeEO+hdS5TvdpjYM2Q+fAF9yOcadZzLfi2DIWdXh2IfPrcfEVMIcZ1IG z6Eb8PMTlsngTy8Vcmar8xrQiV+6r1sss+TbI0ox5p1aW9VCVNm3PW+CtLKw0bgC1FLEUrATPLb kdW7voZUOuK1pqUkx/m18+zyfHGxQlJXooVjCDjfGMlqmH8uHn5//2tqyBH5voEfMgCUmXzG9vg jA7qfrLLrQRC9XFJ02oJAyPb2OyYG6WEg2Pn6mNVtDmuDzq22oKP2XBv8anM22etglhNAWF/26B gXBFhdQ6kZPO45KVJHbC5JTBUxdGwnK3kRFeX6cJPX5qPPYZ9RDjQ+tt4yQFB4lBEHDb05on4Md nC8sG+HZM8x5jGuBG0E1MRY0WRXWV+mS37p1BqG3cWR30myklkk3vDlhGk1k4CAvA1sgDs4cbI6 8IUVxsHMYLGTGnVQOBQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX4Q4DqWMIyWvP jgv1o1YGWzD6GIqFH4dSHEwcSq57rIYDa2M/FqNTiO2jGlfY4XSgyw/lFvuyi7zwC4NO9GhtINJ Po9QT+hcxZDuKzGv78j4QumOixM2S70= X-Authority-Analysis: v=2.4 cv=AZeB2XXG c=1 sm=1 tr=0 ts=6a6c9cc8 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=h-RzbZz0cncsEQf3j_AA:9 X-Proofpoint-GUID: 6AQ2ebyc04UobjU9iMdL8JFu27dmzR3l X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 priorityscore=1501 phishscore=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" If creating a protected vCPU in kvm_s390_pv_create_cpu() fails, kvm_s390_pv_destroy_cpu() was called, which checks whether the vCPU has a PV handle and exits doing nothing otherwise. At that point, due to not having created the protected vCPU, the PV handle will not be set, and kvm_s390_pv_destroy_cpu() will do nothing, thus leaking the allocated memory. Fix by factoring out the code to free and reset a PV vCPU; call it from kvm_s390_pv_destroy_cpu() and kvm_s390_pv_create_cpu(). Opportunistically fix the return value of kvm_s390_pv_destroy_cpu() in case of errors: return -EIO instead if EIO. Fixes: d4074324b07a ("KVM: s390: pv: avoid double free of sida page") Signed-off-by: Claudio Imbrenda Reviewed-by: Steffen Eiden --- arch/s390/kvm/pv.c | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c index dc204b521052..b02e0159d3cd 100644 --- a/arch/s390/kvm/pv.c +++ b/arch/s390/kvm/pv.c @@ -244,6 +244,24 @@ static void kvm_s390_clear_pv_state(struct kvm *kvm) kvm->arch.pv.stor_var =3D NULL; } =20 +static void kvm_s390_pv_dispose_cpu(struct kvm_vcpu *vcpu, bool free_stor_= base) +{ + if (free_stor_base) + free_pages(vcpu->arch.pv.stor_base, get_order(uv_info.guest_cpu_stor_len= )); + free_page((unsigned long)sida_addr(vcpu->arch.sie_block)); + vcpu->arch.sie_block->pv_handle_cpu =3D 0; + vcpu->arch.sie_block->pv_handle_config =3D 0; + memset(&vcpu->arch.pv, 0, sizeof(vcpu->arch.pv)); + vcpu->arch.sie_block->sdf =3D 0; + /* + * The sidad field (for sdf =3D=3D 2) is now the gbea field (for sdf =3D= =3D 0). + * Use the reset value of gbea to avoid leaking the kernel pointer of + * the just freed sida. + */ + vcpu->arch.sie_block->gbea =3D 1; + kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu); +} + int kvm_s390_pv_destroy_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc) { int cc; @@ -258,24 +276,9 @@ int kvm_s390_pv_destroy_cpu(struct kvm_vcpu *vcpu, u16= *rc, u16 *rrc) WARN_ONCE(cc, "protvirt destroy cpu failed rc %x rrc %x", *rc, *rrc); =20 /* Intended memory leak for something that should never happen. */ - if (!cc) - free_pages(vcpu->arch.pv.stor_base, - get_order(uv_info.guest_cpu_stor_len)); - - free_page((unsigned long)sida_addr(vcpu->arch.sie_block)); - vcpu->arch.sie_block->pv_handle_cpu =3D 0; - vcpu->arch.sie_block->pv_handle_config =3D 0; - memset(&vcpu->arch.pv, 0, sizeof(vcpu->arch.pv)); - vcpu->arch.sie_block->sdf =3D 0; - /* - * The sidad field (for sdf =3D=3D 2) is now the gbea field (for sdf =3D= =3D 0). - * Use the reset value of gbea to avoid leaking the kernel pointer of - * the just freed sida. - */ - vcpu->arch.sie_block->gbea =3D 1; - kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu); + kvm_s390_pv_dispose_cpu(vcpu, !cc); =20 - return cc ? EIO : 0; + return cc ? -EIO : 0; } =20 int kvm_s390_pv_create_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc) @@ -319,9 +322,7 @@ int kvm_s390_pv_create_cpu(struct kvm_vcpu *vcpu, u16 *= rc, u16 *rrc) uvcb.header.rrc); =20 if (cc) { - u16 dummy; - - kvm_s390_pv_destroy_cpu(vcpu, &dummy, &dummy); + kvm_s390_pv_dispose_cpu(vcpu, true); return -EIO; } =20 --=20 2.55.0 From nobody Fri Oct 2 12:19:59 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2DF7F436367; Fri, 31 Jul 2026 13:02:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502925; cv=none; b=DQ8DOUYKpUvvGAY94WR9vFl1HSG7V5goxlVEng3azRkniGpo2PUK9wQlzBcKFJ+9V3l37X0AeoPHI3ZYvoCMiM0dgovB15C0Qin0HDqQ6qwbEFVHPBLGKQFypYwtMAnyrDTUh5gzqt0vVBqsBAQXXwJvlIEVb51arZRLka/ogK4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785502925; c=relaxed/simple; bh=b/FnuFBeNRL1fg42qbv/eY/bvC3oo74Z1wmOgclH1iw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hcDxls+xdhLcndeVXowlUc0suwOwDfgSA1x5GG4aLybdzM+RTFQGf+Z74xoZSL0/TTP84owpEiHR/7/5RdNr3i1EDss64MpIO4TdR24YiH4tkcgl0ozwBkN/xuqFHAjRtQkQ608DR2mJoAQtuTdgfe2F5jMp3XAIdioOYq58v6M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=EUoXaBzK; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="EUoXaBzK" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66VBlg421672712; Fri, 31 Jul 2026 13:02:01 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=JoqRAFDJVF71pHpNT n63l2JSsVeaBFtqNLLsWQK4oOo=; b=EUoXaBzKBv8jugGIS0YGzjizPjSfrxsko ZzAVyAyB7wifsaLGQfWfCcFddjtzMGSUGflSWI4gWwrBn3WOSzPDdou56jcUx47R gzlc0MB7Y3lZPOoMjbbxYuInbhGR6MXz5hrjG7mnuC2QcclSnrHPQUxe1SRyKEfS KU/dyVcm01CoQqY89nR7i2wfHo5QmCbt28xjbfpkAjtlcaWNSISwdZpKbNxmiY+H oBgtBPqIPi5Zs8nbKPlclFsv62xNH2jZ+rUZM4FwbPtr6FIw54z/ixgxY21UL4ds ioaXo6xs9WEqLbEZaegvWwStx8dG/i5CFICMfN4jrkbmkZd3pYWOg== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmv0p421d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:02:01 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66VCuOlJ021058; Fri, 31 Jul 2026 13:02:00 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fn7fqr3vc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 13:02:00 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66VD1rWi30605648 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 31 Jul 2026 13:01:53 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D04B420043; Fri, 31 Jul 2026 13:01:53 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E9C8320040; Fri, 31 Jul 2026 13:01:52 +0000 (GMT) Received: from p-imbrenda.ibmuc.com (unknown [9.111.4.62]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 31 Jul 2026 13:01:52 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v7 14/14] KVM: s390: Fix kvm_arch_commit_memory_region() when low on memory Date: Fri, 31 Jul 2026 15:01:38 +0200 Message-ID: <20260731130138.173983-15-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260731130138.173983-1-imbrenda@linux.ibm.com> References: <20260731130138.173983-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfX3vHTqdDiCkri ifXg3Dkyr/Y0O7f6G55kOzoeXSBXO2KuJPBewuUrPJLjy5eNCtR57eXWjHvJfixLjQ08rewdu0f 5UGOYYraApYx4BlyDVIRCoHaCXjpE/A= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzMxMDA5NiBTYWx0ZWRfXwmdoRzAl4n+s wESxoNTVS+pqiBgNTIUfmuSLTjoxmZeNylf+Fy+UiwxXh/3tKsYQS82TgU4BWnB5TVLELRKt6ai ZpTze1xFBvdafkdRowVKPoyaEkgWs6WEf1NzE+vk4pG6EInrh7dArGQXDG/x0sbj6orpF/zxnK/ BpJwp+YgGaiebEuF45onLei5khMyHPCquSH5A8wpiAvIXVbtNPOhh3B106WnC5wQ8INsS/Pclb5 HuvStyn6u1AxhFZkalQaoKWI2mPyew12t2yenUBVwKju1mNNTMxwCFPZ2u7d4S46FEVtynT1ytS LIH/pNLctRp2/2kWSlSH2Xdz51JxF06tJX875V0F8bhZxz1OxByF/dCezco8B6V6CNeBsjQXRlG dnadg0mit/GPocduRA+i9vYwJj1vYv37zkSavO1UnNFE4gxL+81CGOLvN10zpmyK6M5myylgGQ4 YIe0l2URxDVnoVolRew== X-Authority-Analysis: v=2.4 cv=b5WCJNGx c=1 sm=1 tr=0 ts=6a6c9cc9 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=UZJgiOjggnZcZ0CJR5AA:9 X-Proofpoint-GUID: lGkeF6Uwoupbth2r2MTLuJL4rZ2ps_Vl X-Proofpoint-ORIG-GUID: lGkeF6Uwoupbth2r2MTLuJL4rZ2ps_Vl X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-31_04,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 adultscore=0 malwarescore=0 impostorscore=0 bulkscore=0 phishscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607310096 Content-Type: text/plain; charset="utf-8" When low on memory, kvm_arch_commit_memory_region() might not perform the required action completely, and instead just print a warning and return. This allows the VM to continue running with an inconsistent state. Fix by refilling the struct kvm_s390_mmu_cache and trying again. A true failure only happens if the refill fails, or if the cache cannot be allocated at all; in such case print a warning and kill the VM. Such a failure cannot currently happen. Signed-off-by: Claudio Imbrenda Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") --- arch/s390/kvm/kvm-s390.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 518a69c55e85..fd8badb0d571 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -5830,7 +5830,7 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, { const struct dat_walk_ops ops =3D { .pte_entry =3D cmma_d_count_pte, }; struct kvm_s390_mmu_cache *mc __free(kvm_s390_mmu_cache) =3D NULL; - int rc =3D 0; + int rc =3D -ENOMEM; =20 guard(mutex)(&kvm->slots_arch_lock); =20 @@ -5838,11 +5838,9 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, return; =20 mc =3D kvm_s390_new_mmu_cache(); - if (!mc) { - rc =3D -ENOMEM; + if (!mc) goto out; - } - +retry: scoped_guard(write_lock, &kvm->mmu_lock) { if (kvm->arch.migration_mode && kvm->arch.use_cmma && old) { _dat_walk_gfn_range(old->base_gfn, old->base_gfn + old->npages, @@ -5865,9 +5863,15 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, case KVM_MR_FLAGS_ONLY: break; default: + rc =3D 0; WARN(1, "Unknown KVM MR CHANGE: %d\n", change); } } + if (rc =3D=3D -ENOMEM) { + rc =3D kvm_s390_mmu_cache_topup(mc); + if (!rc) + goto retry; + } out: if (rc) pr_warn("failed to commit memory region\n"); --=20 2.55.0