From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 079B6403E82; Mon, 3 Aug 2026 12:40:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760853; cv=none; b=ErgwjPOr/AhC8cVNuzOpDW6fNdKjATrtobQnnrnHJYp0OK6p6IElo118sPTxIaXbuFHlS4lmHYQZm3g30Dv2jaCvy00t2mTLM9/LPYOCd5ylxTPY0JtJLjri+bDnlKOXXbZd0GQTpvJNpUsmO1oJRIKrx7M/hHZ8LWv23Hu2ukU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760853; c=relaxed/simple; bh=uk+7Bf8nelYwZKq8so9KDG+OngL8L2JQuT7xKObhh3I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TTrNE/nqOBkV60d+slauCTTtFH645KfnWBYzp6NyC/zaxwOGRTg2/sHAw0UBkIQaQbVB83DKpm3sRPr/FsNb3C3vqCrQM/+9BOBLUiMky11KVIst9noFSpqP5IH0NVBcyro0xAw33akJOGRmqkjleh6f2ft2Io0sCMSuqiODrLo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=gc/5CMyp; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="gc/5CMyp" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CHm9M1943475; Mon, 3 Aug 2026 12:40:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=BpRZhORLGYKP9Crm2 pKE9MHN8ysGCZMeb2Spf1oTGU8=; b=gc/5CMypmsGqn4lz/dfePQkp4CTEyqtbs uWm1MNaeoiGhq2zspUojAph7d50r7LGl872vi5xQE+mTcPdhB6L8mbu6I1cgaX9J YNFZymdVntZSWINN06Y7kPkudrGSZI8DLAxDvoi4S8+zpWBJW5iQJpbCMMPcSfc6 odj2xd8Et3FRyOR/bGYrclIkYwOODI4Ffbtq8CzXgLfSokzcBRfk8+73kJtQ5Fox Q9IcDtpUqPkIoHF+BpEDz8HfQ4Pczv3XDtXa/rP0DhfGFIV/BDn8JueZmaRvdX0W w4qEnLBckpI47oi6OfiNVhiJ/3+hlrP4Un25d7s93bP+MBEJgIRNw== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs77g0k6h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:48 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CQKsm009779; Mon, 3 Aug 2026 12:40:48 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsvmh59sk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:48 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673Ceg8M52625850 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:42 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0F8492004B; Mon, 3 Aug 2026 12:40:42 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4FD7620040; Mon, 3 Aug 2026 12:40:41 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:41 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 01/13] KVM: s390: Fix unlikely NULL gmap dereference Date: Mon, 3 Aug 2026 14:40:28 +0200 Message-ID: <20260803124040.126471-2-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfXyh7tdLNftXyN XTJ6FGD1cWQhtX7sPCYnXRab/r5u5m3iClBRIpS5TAPqhc/YQb7lPF4Sc/a+dnI6tzFpbVhszJq 2THKqVePMe3EL/aWa6St015u+Ve6Al4MeqWEu/U7bemCGl8ztZmw7vsozIZqrPJLGG/VUqlql73 jKGQoLCKCnT5SidtMa9gySiZHGepkozw7xqtnjz0N4/psNHa24WwBy3ZGEk6OLIJk+pJOnCwxPR zJx97Zlz22hl9JZB8tVvAkwpftHEfky2ulE9z817VxcNG3m10r5nz2R2VC3QhTQXW1OmfE67FZO ks7vLQFHZd0aLa6qQdKJeTu7TiE63oHPHSLfcPfsSupK42pQaA3Pgl2bjKwycm2Slkd8V3UJeJP +E0Nuc6Yek37GR/dN7vgYfT9k9tJL2G1ltUvR8MdPFz914nmtPPHqzvXg6WVdkd4zKEUQJKin4R yuOoH9OOVCGzzvPvmog== X-Authority-Analysis: v=2.4 cv=WIFPmHsR c=1 sm=1 tr=0 ts=6a708c50 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=-aBWQn_vEbd_VLME6SsA:9 X-Proofpoint-GUID: MgGi7bqxck2eQVVu2SibGd-p8HljkYPG X-Proofpoint-ORIG-GUID: MgGi7bqxck2eQVVu2SibGd-p8HljkYPG X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX8INfFEQJZTb9 Si4gn0vSMHHZJZofo+TkIWDG0r46L6G98W0HsoykwnniWa6wIUa4BasiPdPTf4lBFcS7DdmTG8i IwzK0dYdY+mhEZiygh/7XdSBZGRlZUM= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 lowpriorityscore=0 priorityscore=1501 phishscore=0 malwarescore=0 suspectscore=0 clxscore=1015 impostorscore=0 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" When creating a new vCPU, kvm_vm_ioctl_create_vcpu() will call kvm_arch_vcpu_postcreate() after the file descriptor for the new vCPU has been created. The new file descriptor has not been returned yet, but a malicious userspace program could try to guess it. If a malicious userspace program manages to start the newly created vCPU before kvm_arch_vcpu_postcreate() is called, __vcpu_run() will try to dereference vcpu->arch.gmap and trigger a NULL pointer dereference. Fix this by adding a new field to struct kvm_vcpu_arch to keep track of the initialization status of the vCPU. Refuse to run a vCPU that is not fully initialized. Fixes: dafd032a15f8 ("KVM: s390: move vcpu specific initalization to a late= r point") Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank Reviewed-by: Christian Borntraeger --- arch/s390/include/asm/kvm_host.h | 1 + arch/s390/kvm/kvm-s390.c | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_h= ost.h index eaa34c5bd3c1..edf75b6ad20c 100644 --- a/arch/s390/include/asm/kvm_host.h +++ b/arch/s390/include/asm/kvm_host.h @@ -440,6 +440,7 @@ struct kvm_vcpu_arch { bool skey_enabled; /* Indicator if the access registers have been loaded from guest */ bool acrs_loaded; + bool initialized; struct kvm_s390_pv_vcpu pv; union diag318_info diag318_info; struct kvm_s390_mmu_cache *mc; diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 150b5dd2170e..f86b4b0b356f 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3613,6 +3613,9 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu) if (test_kvm_facility(vcpu->kvm, 74) || vcpu->kvm->arch.user_instr0 || vcpu->kvm->arch.user_operexec) vcpu->arch.sie_block->ictl |=3D ICTL_OPEREXC; + + /* Pairs with smp_load_acquire() in kvm_arch_vcpu_ioctl_run() and kvm_arc= h_vcpu_ioctl() */ + smp_store_release(&vcpu->arch.initialized, true); } =20 static bool kvm_has_pckmo_subfunc(struct kvm *kvm, unsigned long nr) @@ -5039,6 +5042,10 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) kvm_run->kvm_dirty_regs & ~KVM_SYNC_S390_VALID_FIELDS) return -EINVAL; =20 + /* Pairs with smp_store_release() in kvm_arch_vcpu_postcreate() */ + if (!smp_load_acquire(&vcpu->arch.initialized)) + return -EINVAL; + vcpu_load(vcpu); =20 if (guestdbg_exit_pending(vcpu)) { @@ -5523,6 +5530,10 @@ long kvm_arch_vcpu_ioctl(struct file *filp, long r; u16 rc, rrc; =20 + /* Pairs with smp_store_release() in kvm_arch_vcpu_postcreate() */ + if (!smp_load_acquire(&vcpu->arch.initialized)) + return -EINVAL; + vcpu_load(vcpu); =20 switch (ioctl) { --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F2D2E407CF1; Mon, 3 Aug 2026 12:40:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760854; cv=none; b=jq4ESCkCZEUV2qoietjmKA0Ye79PT5yceqFDy0FXhoFCjF3dktcZKjOm8NQoHBVAJmFIqb/OmkC7B6IZet+nsfHSKIWMcvTqmRCnR0Pq1fsH5nD/pNOG6ar0oj8k4nvMEdD0tHXShvFCI+RS7Sm1emQPIuEcS6742RT7Yy5G+m0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760854; c=relaxed/simple; bh=rGUq/bbmBOybJjU+Ue7l7Uyfv2XCqwBWhe6A32dvtIo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Xu5WfcMsyoLZ99Q30P3EkFLoDHJPNI88e5ov8OxsKCoQE2GFK3xvZsu+3LnaI3CYFjbEs1PsfFjkBNlHePJHNlFknaCAzozOXtYBh1K5+Tlswk1bhqhgo0xSaCqJ4wvpXviglzRz5je/uKq5I7Ug6owonpwPRTcpWe11oPRXcyk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=shlY6Uaz; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="shlY6Uaz" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CHk8C1943450; Mon, 3 Aug 2026 12:40:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=a8o63o8zb7q/KcknA rEgZd6tgJdqLJy5aq5FS+Lux1A=; b=shlY6UaznbS+k4Q3/Tg0b58P0Q+WMApeu asgSf7Ch3jGKXvoM0b1L0d0/B+k004NzTeDM7/IleM3fA88vm6YmD51W+f0LeYnx x36AsVx/1eTCgGMPFB14XmT1aVQJ6UaS/CIWIkLbcPpHLVO6DbwZqnia7t6eS+nt Qa4RI+XmSuzK7sTtzZ8ou+Pwshmyq07frsU6Sfpwns2JGfcBJm01484qE0uLl7kt bg3tk+FFuLG2+Pa0WVs139fp7K5eLxQ0rpJ55MuXVuS7xtFzkvS1/AC7ZeYDW7se wLFJFPy2LjEYD/4slmrfHBvY82vkPUKd4oByDaXDf1e4Hr1tIr2ig== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs77g0k6n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:49 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CQMl8027377; Mon, 3 Aug 2026 12:40:48 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsv4jwbsc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:48 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673CegxW52625856 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:42 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8198220043; Mon, 3 Aug 2026 12:40:42 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 20D9D2004D; Mon, 3 Aug 2026 12:40:42 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:42 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 02/13] KVM: s390: Do not free SCA if it was not allocated Date: Mon, 3 Aug 2026 14:40:29 +0200 Message-ID: <20260803124040.126471-3-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX5lcv7gnQyOlw M+kYFomKKDgus4L3ZwkwcJiIcyemKl1JDerojUhGYuH07axB1kXohRAH4yyftXCWXIKdGnTQPrE JfeRNXlI46sUYK9G0FEln0LKa4GkZTn/vSsbA+e8rHdJsdMX94BX2xCbsw8xFZuBFERmgdOyc1q APO6FpP4oTR2c/VLOP7/20bmYVMkifd/mHDBRqy4BjrVPu2D4q1uZ3447G2kzWrKGTczB7cF0dq rENViTiDySb46GPirhSe9xyeq1e83y0SS9fWwAuUtYU8UYRe0+agCioVADuPMiErv5sRh7oOZTD jROEXBJwTvHEbe8oRvK7BprpyzD1quf0uHqLd8fd5Vbg7JJfCGb1RzIQQLYbRK05jMd2SvABgm0 Athic54t6UIccc4X8aiKi7a0dlsOgYxI5lg+Cy4vLqolGApsHGEI1+97RUeznFXfor7QJbELJJL ua9BXQSzIrtZwIOqGvA== X-Authority-Analysis: v=2.4 cv=WIFPmHsR c=1 sm=1 tr=0 ts=6a708c51 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=M5uM2SGDJJfKum1V:21 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=3jiQNkuJ7WxZ42At8I0A:9 X-Proofpoint-GUID: _HaArXb3H2aZ5TxBOTQ4TjxMHq3FSvoF X-Proofpoint-ORIG-GUID: _HaArXb3H2aZ5TxBOTQ4TjxMHq3FSvoF X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX9Z65QaW+Rgse VxSMGb6yXWMk11ocIf8VuQFUEjQfBYhebZZlfahuTWzAawsQQjfjjAqFfNMVD4DySrPRNWuq+Qm 9VoYx7iB6/OwWX5kAC+W6j2qLUB8tCI= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 lowpriorityscore=0 priorityscore=1501 phishscore=0 malwarescore=0 suspectscore=0 clxscore=1015 impostorscore=0 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" If VM creation fails early in kvm_arch_init_vm(), the cleanup code tries to free up the SCA, even though the address is 0. Due to using free_pages_exact(), only the first page is skipped, accidentally freeing pages 1, 2, and 3. Fix by checking whether the pointer is NULL before attempting to free the SCA in sca_dispose(). Fixes: e72753ed1267 ("KVM: s390: Use ESCA instead of BSCA at VM init") Signed-off-by: Claudio Imbrenda Reviewed-by: Christian Borntraeger Reviewed-by: Janosch Frank --- arch/s390/kvm/kvm-s390.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index f86b4b0b356f..1b3290a5ad1a 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3247,7 +3247,8 @@ static void kvm_s390_crypto_init(struct kvm *kvm) =20 static void sca_dispose(struct kvm *kvm) { - free_pages_exact(kvm->arch.sca, sizeof(*kvm->arch.sca)); + if (kvm->arch.sca) + free_pages_exact(kvm->arch.sca, sizeof(*kvm->arch.sca)); kvm->arch.sca =3D NULL; } =20 --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07A8C4052A7; Mon, 3 Aug 2026 12:40:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760853; cv=none; b=ah5VIxXmcsBl3RdlWGCUiAKykweDO3TXyVis94xe5yGvhiDWEcRSOr4eWjJhxzgqHHwb0RgpAtKI0eSBNGdLGiorHlQ105XiH6891VfdD3dQlWI9mGqE8C+iORalKLMMhV7q3Wf+5bjujpxbcPgcwFATuTAp+qfgQjKMZs/V6I4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760853; c=relaxed/simple; bh=PFR1XFwLxC/X4367EBT5xBpNjMhUspJXsUabptoEkM8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S7m+iBVPPXconslkBRTUA9NFO5lT71doD7/trIRxmIuJiK5wCi8nuF4ppRQTRYsCb+QvRLcf0+Kw7Ls/Mvh/qpr2uaN8flvd+86kXCKcXEwZVnGiCl3n8PGyeIeFoNn7yP6Nz78KIvRwHGowe2k0Ch1/bwTRtj6Fj47j5SOkZBo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=MLpefCFc; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="MLpefCFc" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CIAN81938639; Mon, 3 Aug 2026 12:40:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=n9+ojDvm4NA40kUmQ i2tKXfo/PA1HooW9l+BffZSvho=; b=MLpefCFcSkbvfkd0jeKgQljtaeX6daZbG KGvdvXI9jkDQISNdje2m3HZEi0O7biB/cvM3M9qie6oIWpM2K10zcrY6lg72vFJ4 vk96YwuqKiQxro9JsxQxbeALsYEzTA4iz25EWmSogl39sNWTLXJn5SA+CAxixUHv 3an76o21Ap4VWdnQgEggQ9AETwwl3MIa+Nx5UpjNOC8JUpZhpfeHFGOWiG1p79YE 64CjIyUIJk+LvB3GteSSsEKoLUJf2lAoP65WEIC+yIhEnhAV2BkWV+0wf37bD4dN iXzI9yqDcRMRfa2ZHHbXtFhFdwGSklDFx3Q2kXstqVH4Jp6xx+ATQ== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs67hgqcv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:49 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CBcuR016815; Mon, 3 Aug 2026 12:40:48 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsugvwe5k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:48 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673CegXm52625858 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:42 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CD37820043; Mon, 3 Aug 2026 12:40:42 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8968F20040; Mon, 3 Aug 2026 12:40:42 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:42 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 03/13] KVM: s390: Fix kvm_s390_vcpu_unsetup_cmma() Date: Mon, 3 Aug 2026 14:40:30 +0200 Message-ID: <20260803124040.126471-4-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX1JwEQwnhusj0 rYQUvR+GjKuH3f2GPeBfILQ9U1MjjoG6W0rMc9V348nfn1hqu4ICO/UeZljI/Polps2plLjon6B hxJClmBbPm9oz5NIlmo8Bd2QuZPkp58= X-Authority-Analysis: v=2.4 cv=I7VVgtgg c=1 sm=1 tr=0 ts=6a708c51 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=UbkePC3kHMpujdsGQX8A:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX/V1b4PMwDkXM e8ajnbFIwAecKOgZUnwA3nOeT/iI0TXrzk9ojsYhB/wU/qgs6jbLpEG1J27rQLtPVLgqla4CzpJ /1kvPGZgBlOlyDUT3oN5QKGvhAr9irlm+treDVL8v0MSS52JEvCTyJ3x41HI6XKwRSv+GqOqQY3 fhKoJX5QdFyDvQILFCI5QnOJpa1bSr/OVHUk6aq95ppF81RBLfQaXGhP6oHFNk9xKF0K/Z5Pohz OSXlcsYjCFSGZo3qslirkKRnnFxM7Mjx5UiIpqlwPOxwRRMOIe6/sK5k20q9wUgnS7QLyCQiZnq a0GTDB79SqgCp5SvxxwaCvRnP9u76yI5Wt6q+qWWhONEqtMB8ALGffvnCLkjiRZVzw0tuPzJzdm xMjm98AV9NtE1yUWdK+VuxrZUhF9bxVgWTnidm/MwOWXEAcVc7F8kqq7Vocp81r1TKob68mvXIt 3PiqTY9l2lN8mep2SZw== X-Proofpoint-ORIG-GUID: I6y2qYh8k2PlMIGl0-hXqpd8hIOC82Y_ X-Proofpoint-GUID: I6y2qYh8k2PlMIGl0-hXqpd8hIOC82Y_ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 impostorscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 malwarescore=0 adultscore=0 lowpriorityscore=0 phishscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" In some cases kvm_s390_vcpu_unsetup_cmma() can be called with a 0 cbrlo; in such cases, if running with V !=3D R, free_page() will attempt to free physical page 0. Fix by freeing cbrlo only if it's non-zero. Fixes: b31605c12f4e ("KVM: s390: make cmma usage conditionally") Fixes: 29b40f105ec8 ("KVM: s390: protvirt: Add initial vm and cpu lifecycle= handling") Signed-off-by: Claudio Imbrenda --- arch/s390/kvm/kvm-s390.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 1b3290a5ad1a..9be27db0a21e 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3678,7 +3678,8 @@ static void kvm_s390_vcpu_crypto_setup(struct kvm_vcp= u *vcpu) =20 void kvm_s390_vcpu_unsetup_cmma(struct kvm_vcpu *vcpu) { - free_page((unsigned long)phys_to_virt(vcpu->arch.sie_block->cbrlo)); + if (vcpu->arch.sie_block->cbrlo) + free_page((unsigned long)phys_to_virt(vcpu->arch.sie_block->cbrlo)); vcpu->arch.sie_block->cbrlo =3D 0; } =20 --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85EEB40681A; Mon, 3 Aug 2026 12:40:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760854; cv=none; b=ecMBvKcBr0FMVL/QIeauz53606tSkggt5X45IMbwReUHxvg9UplVOABDR3qMroNME74rKJtCxgdUf14AzgRqWW1V7vHtF1z4aSTfcUAETFcqNQU/mGinlt4uxAMlQiEJeJT7cpTA2TCayqLDMi1WldwKgv8/G0e17WQuge+Ggd0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760854; c=relaxed/simple; bh=mOUF/FNmKIk6xX+iKDVdfp/CuFGAPdAfGGNl/wapg7U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cHjCC23oWhMEGVTTyRNIHy93Z3eljCqtq5b+24dnvPSlap82oa7El5iHU+eZ2jy9SvfUTJXdUB1PlIAoWrIf7ViJO+BI1Orx1MDii4m91pY0+JYmQXqRZIR7m7cP27KwlPzcTvhShzno0iFFHOShXzrsI11j/M/2eze4lmSJt74= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Jo1REzeu; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Jo1REzeu" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CI1V82018764; Mon, 3 Aug 2026 12:40:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=PxrXMPXbxz0kJ+bcb c10OSG0wGcTfT747aR8n3xRorE=; b=Jo1REzeuj7UmgOkFcWalNNt6dbR9vUWNN 1KNAqyLrVO7Hh0YJNas7O6HEjCEVp9Upazx28uGjffy5oYUDtG2zu9s/pQp+0TDL +ipo8H4Y9KcArdJn9Y8lCIwXEeY+w51XrfPC35zeDE+fTRwNN4p15x9TFQ3kiHLB fPAE57yaei/gw2a9tqfVGNOttmZHvfqybXnpcOaYRWjywLAUCsWjEhEWFi09mIdK lCxEmvwHZOC6w09le+nIYsKjFwMxQMc41Y5WHYKHSUH1x7CpSDYhYTEDeZncYnSt e6IXkEh2W7XJ2gJkCVU6Enq0fw2H8prcmR/lrEAQslgxunwUlmomg== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs8h4rr5a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:50 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CQG0T009744; Mon, 3 Aug 2026 12:40:49 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsvmh59ss-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:49 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673CehTa32702968 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:43 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 20A9520040; Mon, 3 Aug 2026 12:40:43 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D8F642004B; Mon, 3 Aug 2026 12:40:42 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:42 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 04/13] KVM: s390: Fix overclearing ESCA in case of error Date: Mon, 3 Aug 2026 14:40:31 +0200 Message-ID: <20260803124040.126471-5-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX/5D64QuIkWdO dk3CvvQzeFf/oBWaMDgTEq3F/C9wm2aoJc8LWnYZafWblQSgU/FtnVaQTPJzE+9iGj9jKCRlR4F //jEAYrzKBLfqGZq886ZWv5X60R2x+E= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX3o72Hm2xx1lk UOWXYpvNEsB0SRO801Z1DssODIBqsRD7yh5N0CicOdYa8hAr+goArpqmiFCeTV06A1PrCt64J6X igtMlAhPJFXBSeyzcQWpKhCRBFAxVhltSHMEeaTrY2GOEW61gatMAl7w0cqyk2oLPgwIBSBLH/O k+avu0liO14B/MXQGHiiJ5qv/KODxVx7AT89Xv12/OXpdBz+vDsYWIAmwAcOBaimuF5MtXf0reK gInuwyKDsagfSQCVXDXhPz2GPzFDOu35VM6+KAcOsPs/yq10XbWvLf96/aLCLQ5gwZbYcZv4ZQp R/f3Cz6yG4umpUyWRwEx5WBzC4Klq2KawaAK1bVh+96KouJJMv/N1Hdub99iJW6S5C8c3i5ppHt avh6aH4kcfvGO+AoYHx0H0d3xTNe9SCZ/FiwEDRRQvGeCgtgdTXH14ulaNJUnysjLq3wMIbPnBx mLTLhSETH6RlYBsRUTQ== X-Authority-Analysis: v=2.4 cv=SI1ykuvH c=1 sm=1 tr=0 ts=6a708c52 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=D5IZcPaqysaIEbzteRoA:9 X-Proofpoint-ORIG-GUID: diYJ4f2pusnU6GJRo69XVMXIdTjC02VK X-Proofpoint-GUID: diYJ4f2pusnU6GJRo69XVMXIdTjC02VK X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 suspectscore=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 lowpriorityscore=0 adultscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" If an attempt is made to create a vCPU with an already existing ID, the duplicated vCPU will be destroyed. When destroying a vCPU, its ESCA entry will be cleared. In the above scenario, the spurious duplicate vCPU is destroyed, but the ESCA entry corresponding to the original vCPU is cleared. Fix by skipping clearing the ESCA entry if the vCPU creation was not successful, i.e. if the vcpu->arch.initialized is still zero. Signed-off-by: Claudio Imbrenda Reviewed-by: Janosch Frank --- arch/s390/kvm/interrupt.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c index 9e3e6b0d72ad..2acdff130fa6 100644 --- a/arch/s390/kvm/interrupt.c +++ b/arch/s390/kvm/interrupt.c @@ -86,7 +86,7 @@ static void sca_clear_ext_call(struct kvm_vcpu *vcpu) struct esca_block *sca =3D vcpu->kvm->arch.sca; union esca_sigp_ctrl *sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; =20 - if (!kvm_s390_use_sca_entries()) + if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized) return; kvm_s390_clear_cpuflags(vcpu, CPUSTAT_ECALL_PEND); =20 diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 9be27db0a21e..5b2727d7dfd1 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3462,7 +3462,7 @@ static void sca_del_vcpu(struct kvm_vcpu *vcpu) { struct esca_block *sca =3D vcpu->kvm->arch.sca; =20 - if (!kvm_s390_use_sca_entries()) + if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized) return; =20 clear_bit_inv(vcpu->vcpu_id, (unsigned long *)sca->mcn); --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1C8F1407CF6; Mon, 3 Aug 2026 12:40:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760855; cv=none; b=koTKKkSIyvyHzJ9kDRoWWa3BJGzbMC14/ne8r64zGoqNVlDfsetQLWH5PPQx11FN+rEiKRS0nLhsZF0AcPNvdrhgHbZFPaCHwUpi0h1TL97gI6TUbt6Cjmo4BLhKcu65z/rIdaGqKz7hG4pnFLOxJ6jZfpYafWk6NWBbiVk4KN0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760855; c=relaxed/simple; bh=PWQEXfjf2M8Pe8mPgTxXDz3JhyP+iGsS452FFoGtb24=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cQoFKbh6y2SKovZQL0yqjA7ROGK6CgODOFDjNr1aZl+BK5gZZHl2ImK5B0lb0HU/CuP00WdqgOmeXDMI+jxuCXWNrsk1n3faKJyY+wkkkasi5S1d1PPd9SeIb8UJqh5DbggDJ3CeCTENrDM/RVQv3nGQFMTeKIUrfY+IWi7ugwY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=B9BAt4If; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="B9BAt4If" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CI31h1938467; Mon, 3 Aug 2026 12:40:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=0DtyPJY1DgYM/AyYN MX7APaTCdtFubPxSlrx2X+rcvI=; b=B9BAt4IfbGteBJtjB57XG4w/dwm0vy38h g3iHjSYXg6OwUYLmrgAzPHuPgJyQAQl30IcVtXBBAQ4Zy3UYhO2J1vDFBwLQSzTZ JBDIieJf4rbw2W9FPEMPDNMyGVCShnMLJz8S3gNhCEZTMOU+2fzTGt5YB+7VA75c 503Zxc4R4RPlsBGvGFCnUJgUDL0HVF31Wg6n5sFLhlOD2FtQwxZN3ZZFU4UNVyPP uAHCT0naggJ3MvyN2cXWbNEmP0pvTmgu5kyVVlStuckGVxP0YdAtyZlKOUVvi71m lHjEzlrBcayVTJx9WbCmptBp6IcfBSldB3eX8wzPRM2+6achf2UaQ== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs67hgqcw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:50 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CQFb0025921; Mon, 3 Aug 2026 12:40:49 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fswtyd3hy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:49 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673CehQ232702970 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:43 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 98B8220040; Mon, 3 Aug 2026 12:40:43 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2A71320043; Mon, 3 Aug 2026 12:40:43 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:43 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 05/13] KVM: s390: ucontrol: Fix sca_clear_ext_call() Date: Mon, 3 Aug 2026 14:40:32 +0200 Message-ID: <20260803124040.126471-6-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX0zg/Dzn+EKFA KEaHJovAedrscr75rW+hBvFaQA9qtsByOoEfy/18O5HxvT2QgTHWQC9km2coJa+3kfLqhIuwq2u X5IpsisjA5+0s7e+lpppQCBGivG4h6Y= X-Authority-Analysis: v=2.4 cv=I7VVgtgg c=1 sm=1 tr=0 ts=6a708c52 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=YAUebeNNc2VAqFE0BCsA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX7/wunoxHfF5C B4B4X+iq3/xAikHjBfM1HnElqv3omaNqMRaH3LZMd8laYKuhnqcXxyIcyvr8akOd+6of4aaAMyB 3PsC6MaOY9wsZ+9DA/t8yM+SZ497mwJzQdjGLxhniDs70omPCINx3Gj5wVVV/GSqgUnqtF2UJZd tSYqpaY4fa3xpofuJi1n0vfeeLhbA8RwkHZRc6DNbV94YjWEqxSi5d5dHWK8fFIJXYSTlNjLgwt vmn5V34iN9ectD6s9eL/tTkdWiFfuyWnF7CqU3lK27T9C4pwGjQJkraYgvwDWjY3KcviK7AyV35 qfqSh49mVUDtUm5SmaKDjp4RatNF1y/qnpx8TqensbsJaoGagrRNvZ+Wgmz3LWwrQyVOnResP/C aUjBDSFRza6NF0AsCeDhp6jDaLf42yAryvSrBr2pjWkXYR1S4K+++BfN2/5ZRagM61zf1cvt9cu wEhbc5sptv4ras7Ldww== X-Proofpoint-ORIG-GUID: h_L4ozKgWh5axP96127R4EwNLwGSOIxc X-Proofpoint-GUID: h_L4ozKgWh5axP96127R4EwNLwGSOIxc X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 impostorscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 malwarescore=0 adultscore=0 lowpriorityscore=0 phishscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" When cleaning up a UCONTROL VM, sca_clear_ext_call() will touch memory outside of the allocated ESCA block, and UCONTROL VMs don't even use ESCA. Fix by not touching ESCA for UCONTROL VMs, and fence the KVM_S390_INTERRUPT ioctl altogether. Add extra checks in sca_ext_call_pending() and sca_inject_ext_call() to make sure UCONTROL VMs won't touch ESCA. Fencing does not cause regressions with userspace, since UCONTROL VMs never used KVM_S390_INTERRUPT ioctls. Signed-off-by: Claudio Imbrenda Fixes: 7d43bafcff17 ("KVM: s390: Make provisions for ESCA utilization") --- arch/s390/kvm/interrupt.c | 19 ++++++++++++++----- arch/s390/kvm/kvm-s390.c | 5 +++++ 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c index 2acdff130fa6..6b3f97a7513b 100644 --- a/arch/s390/kvm/interrupt.c +++ b/arch/s390/kvm/interrupt.c @@ -45,13 +45,16 @@ static struct kvm_s390_gib *gib; static int sca_ext_call_pending(struct kvm_vcpu *vcpu, int *src_id) { struct esca_block *sca =3D vcpu->kvm->arch.sca; - union esca_sigp_ctrl sigp_ctrl =3D sca->cpu[vcpu->vcpu_id].sigp_ctrl; + union esca_sigp_ctrl sigp_ctrl; =20 if (!kvm_s390_test_cpuflags(vcpu, CPUSTAT_ECALL_PEND)) return 0; + if (kvm_is_ucontrol(vcpu->kvm)) + return 0; =20 BUG_ON(!kvm_s390_use_sca_entries()); =20 + sigp_ctrl =3D sca->cpu[vcpu->vcpu_id].sigp_ctrl; if (src_id) *src_id =3D sigp_ctrl.scn; =20 @@ -60,13 +63,16 @@ static int sca_ext_call_pending(struct kvm_vcpu *vcpu, = int *src_id) =20 static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id) { - struct esca_block *sca =3D vcpu->kvm->arch.sca; - union esca_sigp_ctrl *sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; union esca_sigp_ctrl old_val, new_val =3D {.scn =3D src_id, .c =3D 1}; + struct esca_block *sca =3D vcpu->kvm->arch.sca; + union esca_sigp_ctrl *sigp_ctrl; int expect, rc; =20 BUG_ON(!kvm_s390_use_sca_entries()); + if (kvm_is_ucontrol(vcpu->kvm)) + return -EINVAL; =20 + sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; old_val =3D READ_ONCE(*sigp_ctrl); old_val.c =3D 0; =20 @@ -84,10 +90,13 @@ static int sca_inject_ext_call(struct kvm_vcpu *vcpu, i= nt src_id) static void sca_clear_ext_call(struct kvm_vcpu *vcpu) { struct esca_block *sca =3D vcpu->kvm->arch.sca; - union esca_sigp_ctrl *sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; + union esca_sigp_ctrl *sigp_ctrl; =20 - if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized) + if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized || kvm_is_ucon= trol(vcpu->kvm)) return; + + /* Initialize after the above check, to prevent going out of bounds */ + sigp_ctrl =3D &sca->cpu[vcpu->vcpu_id].sigp_ctrl; kvm_s390_clear_cpuflags(vcpu, CPUSTAT_ECALL_PEND); =20 WRITE_ONCE(sigp_ctrl->value, 0); diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 5b2727d7dfd1..21574f57be72 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -2934,6 +2934,9 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int= ioctl, unsigned long arg) case KVM_S390_INTERRUPT: { struct kvm_s390_interrupt s390int; =20 + r =3D -EINVAL; + if (kvm_is_ucontrol(kvm)) + break; r =3D -EFAULT; if (copy_from_user(&s390int, argp, sizeof(s390int))) break; @@ -5456,6 +5459,8 @@ long kvm_arch_vcpu_unlocked_ioctl(struct file *filp, = unsigned int ioctl, struct kvm_s390_interrupt s390int; struct kvm_s390_irq s390irq =3D {}; =20 + if (kvm_is_ucontrol(vcpu->kvm)) + return -EINVAL; if (copy_from_user(&s390int, argp, sizeof(s390int))) return -EFAULT; if (s390int_to_s390irq(&s390int, &s390irq)) --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30094409273; Mon, 3 Aug 2026 12:40:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760856; cv=none; b=MDveJljNHaEnvjJ0isNvZoU4FCxzQH3q3CncIUZm0zgQN1BwXAJf8F716GLzZ48a6G/tguFCAfL+mRTAN5j3blPPjCu52GlwU67NPhLka0XfGb8JY6Gcih3p94v/V4DRhFbxzQaHX1yXXPOAL/R1LbPouxx4/r27SGsUDr8jmD8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760856; c=relaxed/simple; bh=6BvXJsYg00jRP6uWfhHCWlM8CF6XCRguWqBauy/PYB4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MXIChDEiC+a7prCJ9QYeMDXU8Ux8vJj7hEpltk8xO0yaueBULLU+Q7V3Ow37F11/dPuuDx4CFuTz1MG7fTis4TRuzuOPaQW+yGORlfj3HAH4XjhR7bCSd245qYdIWwv/SiD4X7IHLJfEiKc2kqMlNVV5i39jsfBg11z0iaN7Xyo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=XCeEcFv2; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="XCeEcFv2" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CHmdf2076350; Mon, 3 Aug 2026 12:40:51 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=FffIEzQXrsNsbAmGp RELJwzpowdDByJB9nWkVuIUH5I=; b=XCeEcFv2F9b7E+EcrsL6SE4KLpCUyfm00 PN9OeeFTmkTdL20okQlIHWhjrqkUEqrxGW28aLYdkGRt8bYFxe5JWD1dR9EGN1ae MUZb2/9YFiRVqRDdlrzh4YeGDpQSG3lUa4NSM2WeCHW4nCpyE5fSpCCXbDQEXQE0 /RAF9Jo5by4BccISwevntUj1LITIBopUWbtpYKsxE4CUBnkQO4+EhFeLNELG2SfO XmJxByj7zWKYZTniUVz+2EK+gKSREVD9fMoFRqDh2jYJ42XWYpInh5u2FGkpaL0c +FiCQUS1z7jCEsG+qNFov657XVyx7/+Y7M4eDqxt1aCAz7gN/BLeA== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs8eugda9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:51 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CBchh016819; Mon, 3 Aug 2026 12:40:50 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsugvwe5q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:50 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673Ceich30146966 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:44 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3049920040; Mon, 3 Aug 2026 12:40:44 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AFAED20043; Mon, 3 Aug 2026 12:40:43 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:43 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 06/13] KVM: s390: Fix leaking of PGM_ADDRESSING to userspace Date: Mon, 3 Aug 2026 14:40:33 +0200 Message-ID: <20260803124040.126471-7-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: lrQxx1x4x-U3f5iPFDXWFVmc03BlzvZB X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX6kGDz4+/E9Vb iKDqkWSosFvi0SA2TR6ixMgYTjtuECVBJSl4BMkpSW3cPVlhZr4NToL6v4MpbLxFvmQuaE3LR90 kk8cutl2PuKNv8RDsaTad7kmM61F/VI= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX5H9TajedQyLn QNTruPEjZe14J3m6JSw053kegbSfz/9uDCFf+3mG8irc5Y01LUiLcyeJNBTdZheL3MHDsNEF6lZ u9QamuaO87M69GsKS8MREx18629b2uP5G6EneeYTtaYukUxd+My7pqGU1M6mH4c2oB953OwIQJL +eStJhy3IN/+NOavygfzmM1nHDj25I/4nTs3+jXIoNUCmjwk3i8UnqG99IQV3LjhEGZwVFIhjQg 3P8qxJdiB7CzjDchtES9bk+1vQkIxg7pfwcIPd71U3qP31hR7mXShsXAk1g9NAkD/KJJ6vTqqpO xJ6/pPqLgGEDjM5Or5SGsPlGp+BONNjHhA6YsJKY8vmDIUuKDrIwaBXN1rKf4kMoFspxPtvLK72 B/XrEGDXmWordGVmj95ibl7cLoAHftnWoOajirZiKS1MQDzyXQTunP59c1Ih4xRDTde0EzbDXzc UjtToPz6Vxe46UJZSTQ== X-Proofpoint-GUID: lrQxx1x4x-U3f5iPFDXWFVmc03BlzvZB X-Authority-Analysis: v=2.4 cv=KfzidwYD c=1 sm=1 tr=0 ts=6a708c53 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=GvWetJuFWLgL5UM2GZoA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 bulkscore=0 impostorscore=0 suspectscore=0 malwarescore=0 adultscore=0 clxscore=1015 priorityscore=1501 phishscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" If kvm_s390_set_cmma_bits() is asked to set CMMA values outside of a memslot, PGM_ADDRESSING (5) is returned, instead of a negative error value. Same issue with kvm_s390_{g,s}et_skeys(), kvm_s390_keyop(), and dat_reset_reference_bit(). Fix by returning -EFAULT whenever the return value would be > 0, which is consistent with the behaviour before the gmap rewrite. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda --- arch/s390/kvm/dat.c | 16 ++++++++++------ arch/s390/kvm/dat.h | 2 +- arch/s390/kvm/kvm-s390.c | 16 ++++++++-------- arch/s390/kvm/priv.c | 5 +++-- 4 files changed, 22 insertions(+), 17 deletions(-) diff --git a/arch/s390/kvm/dat.c b/arch/s390/kvm/dat.c index ed4259d17629..171b61959908 100644 --- a/arch/s390/kvm/dat.c +++ b/arch/s390/kvm/dat.c @@ -755,13 +755,15 @@ int dat_cond_set_storage_key(struct kvm_s390_mmu_cach= e *mmc, union asce asce, gf return rc; } =20 -int dat_reset_reference_bit(union asce asce, gfn_t gfn) +int dat_reset_reference_bit(union asce asce, gfn_t gfn, union skey *skey) { union pgste pgste, old; union crste *crstep; union pte *ptep; int rc; =20 + skey->skey =3D 0; + rc =3D dat_entry_walk(NULL, gfn, asce, DAT_WALK_ANY, TABLE_TYPE_PAGE_TABL= E, &crstep, &ptep); if (rc) return rc; @@ -771,21 +773,23 @@ int dat_reset_reference_bit(union asce asce, gfn_t gf= n) =20 if (!crste.h.fc || !crste.s.fc1.pr) return 0; - return page_reset_referenced(large_crste_to_phys(*crstep, gfn)); + skey->skey =3D page_reset_referenced(large_crste_to_phys(*crstep, gfn)) = << 1; + return 0; } old =3D pgste_get_lock(ptep); pgste =3D old; =20 if (!ptep->h.i) { - rc =3D page_reset_referenced(pte_origin(*ptep)); - pgste.hr =3D rc >> 1; + skey->skey =3D page_reset_referenced(pte_origin(*ptep)) << 1; + pgste.hr =3D skey->r; } - rc |=3D (pgste.gr << 1) | pgste.gc; + skey->r |=3D pgste.gr; + skey->c |=3D pgste.gc; pgste.gr =3D 0; =20 dat_update_ptep_sd(old, pgste, ptep); pgste_set_unlock(ptep, pgste); - return rc; + return 0; } =20 static long dat_reset_skeys_pte(union pte *ptep, gfn_t gfn, gfn_t next, st= ruct dat_walk *walk) diff --git a/arch/s390/kvm/dat.h b/arch/s390/kvm/dat.h index fad605305e05..141ee7b9f019 100644 --- a/arch/s390/kvm/dat.h +++ b/arch/s390/kvm/dat.h @@ -537,7 +537,7 @@ int dat_set_storage_key(struct kvm_s390_mmu_cache *mc, = union asce asce, gfn_t gf union skey skey, bool nq); int dat_cond_set_storage_key(struct kvm_s390_mmu_cache *mmc, union asce as= ce, gfn_t gfn, union skey skey, union skey *oldkey, bool nq, bool mr, bool mc); -int dat_reset_reference_bit(union asce asce, gfn_t gfn); +int dat_reset_reference_bit(union asce asce, gfn_t gfn, union skey *skey); long dat_reset_skeys(union asce asce, gfn_t start); =20 unsigned long dat_get_ptval(struct page_table *table, struct ptval_param p= aram); diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 21574f57be72..e162efaa35b8 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -571,7 +571,7 @@ static int kvm_s390_keyop(struct kvm_s390_mmu_cache *mc= , struct kvm *kvm, int op switch (op) { case KVM_S390_KEYOP_SSKE: r =3D dat_cond_set_storage_key(mc, asce, gfn, skey, &skey, 0, 0, 0); - if (r >=3D 0) + if (r =3D=3D 0 || r =3D=3D 1) return skey.skey; break; case KVM_S390_KEYOP_ISKE: @@ -580,14 +580,14 @@ static int kvm_s390_keyop(struct kvm_s390_mmu_cache *= mc, struct kvm *kvm, int op return skey.skey; break; case KVM_S390_KEYOP_RRBE: - r =3D dat_reset_reference_bit(asce, gfn); - if (r > 0) - return r << 1; + r =3D dat_reset_reference_bit(asce, gfn, &skey); + if (!r) + return skey.skey; break; default: return -EINVAL; } - return r; + return r > 0 ? -EFAULT : r; } =20 /* Section: device related */ @@ -2214,7 +2214,7 @@ static int kvm_s390_get_skeys(struct kvm *kvm, struct= kvm_s390_skeys *args) } =20 kvfree(keys); - return r; + return r <=3D 0 ? r : -EFAULT; } =20 static int kvm_s390_set_skeys(struct kvm *kvm, struct kvm_s390_skeys *args) @@ -2276,7 +2276,7 @@ static int kvm_s390_set_skeys(struct kvm *kvm, struct= kvm_s390_skeys *args) kvm_s390_free_mmu_cache(mc); out: kvfree(keys); - return r; + return r <=3D 0 ? r : -EFAULT; } =20 /* @@ -2386,7 +2386,7 @@ static int kvm_s390_set_cmma_bits(struct kvm *kvm, =20 set_bit(GMAP_FLAG_USES_CMM, &kvm->arch.gmap->flags); =20 - return r; + return r <=3D 0 ? r : -EFAULT; } =20 /** diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c index ad0ddc433a73..ea5a99537346 100644 --- a/arch/s390/kvm/priv.c +++ b/arch/s390/kvm/priv.c @@ -289,6 +289,7 @@ static int handle_iske(struct kvm_vcpu *vcpu) static int handle_rrbe(struct kvm_vcpu *vcpu) { unsigned long gaddr; + union skey skey; int reg1, reg2; int rc; =20 @@ -307,12 +308,12 @@ static int handle_rrbe(struct kvm_vcpu *vcpu) gaddr =3D kvm_s390_logical_to_effective(vcpu, gaddr); gaddr =3D kvm_s390_real_to_abs(vcpu, gaddr); scoped_guard(read_lock, &vcpu->kvm->mmu_lock) - rc =3D dat_reset_reference_bit(vcpu->arch.gmap->asce, gpa_to_gfn(gaddr)); + rc =3D dat_reset_reference_bit(vcpu->arch.gmap->asce, gpa_to_gfn(gaddr),= &skey); if (rc > 0) return kvm_s390_inject_program_int(vcpu, rc); if (rc < 0) return rc; - kvm_s390_set_psw_cc(vcpu, rc); + kvm_s390_set_psw_cc(vcpu, (skey.skey >> 1) & 3); return 0; } =20 --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1923740626C; Mon, 3 Aug 2026 12:40:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760856; cv=none; b=oP27NxSMU5/rPeBd2TN8AZ7uqwbRl+qL7wxTfaKm6OsG3DsJg3Y6I7n8Inp2jtLJHE7m16uKfQTyT1UKcOZ7owEmZYRKMMCP25y124Zc6TKR8tq06naMmBsrKPhU+lx7c7V4gM+I9IeHdw4W5ocyG7hlfcwrYe/LDKtvB6nUY3U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760856; c=relaxed/simple; bh=3caGIdp+p3kPdcgMgYkHp0OEp1q1F9YNv8vDbyO0O04=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LqLDjoL+bbfgC5Tj8OKountl/prHkgbnBj9tbZJslc8l9wQGHxZQ84G1Cos2EY3OrBzzisiJhxuoB2u2HfzDTekqWWXRiMtyUE6W3hacYwxaUGCzZx37EXoWk8aUsKPjz0l4f0DI1WpDkIFPnS9Os9YbO/ZqjT0qiMwpwA1vpnQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=IZL4q7gY; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="IZL4q7gY" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CI7wc2000345; Mon, 3 Aug 2026 12:40:52 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=UneEizWds06um/osM D5l8RbzWNvgmHxpG3rtAjIygyM=; b=IZL4q7gYuk8XUCJHp2myoEjFp5UWirq5C XOXcMKN+KapdOlVotazHHKUYTAQQ1/i89p0YMZMZnVY2pHqOca1Qymqbn1y/kAeN JEtdmbZfTc5DqZh+pDjBqt8kVqkHpSJUVezdHAg1d9pcq2p4FDunEObUYZrVfh6Q XRdjziOHjyE1Y8DqUzOq4MXke0g1SRCnxNjJIYVLsdTlI6zIabrLsfsKal5GC/qU UhUjFqa9Bc/kwOnpIvh+ccE3cF5SJ3rHAkthRUgltS4WEOJoU+ZCfbP0hut32zlC S1bL7nxTLdYePzqEEyYs48X++FxxQHFKFbcHbBuw90LV8yWGlYm7w== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs8a3rryn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:52 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CBgxQ016851; Mon, 3 Aug 2026 12:40:51 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsugvwe5r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:50 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673Cei3I30146968 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:44 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A384920040; Mon, 3 Aug 2026 12:40:44 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 40B142004B; Mon, 3 Aug 2026 12:40:44 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:44 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 07/13] KVM: s390: Fix race in __do_essa() Date: Mon, 3 Aug 2026 14:40:34 +0200 Message-ID: <20260803124040.126471-8-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=E6P9Y6dl c=1 sm=1 tr=0 ts=6a708c54 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=VnNF1IyMAAAA:8 a=vVGDtJNaOgRaVfleRDgA:9 X-Proofpoint-ORIG-GUID: hzjx_BLxbmKuSm4XF4htu4VU6bcLDhdE X-Proofpoint-GUID: hzjx_BLxbmKuSm4XF4htu4VU6bcLDhdE X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX/7Hx7Bs7/XZp 5QD47S8J0XRCi9KSCk+EjAYKhdKwSKVbG2sxpU4n97f8L3+R/1eFEe+afmu3V3uATu7Wj+ThqXW +CCeoMzIeOpc2Wu+abjHTZBOJ+Kgh5M= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX5sjBWizi8OrG d0LFRg4YKnGCGF0CrCrkWBZz/j3gGApP2kbDK+8uaMkYdJ++adU05FMRYYjJomcY6eFrtTMgm+g 6bp66X9Af3npoJRMinA26nIbf0vtdQw+Jdn+kCH4y0OMKHIu6FchEYfk+o5KEAoYusOCfDrJgIZ OAw//yOLfqh4gf6elTZgWXWStoag5aSlEY/8/B6ZNeg65OX/at7DjD2Q1p1xZZHyapUklQ4KWON LxgWjKOwK9g6aO3QsCRPSYDX6r3sZHRtxtL/DYIRGtUDqhUMIfAYwvz6IZudvGF6cFKsrAkQKu2 UPO5w2FKCKTv82eihTFzNci5T68JSzvb3g8yE5w9UbW2VHJqtL0EY8wqu+LmUgz9wbLfkwvX5v2 73XphQsnZpsxjGFyQ7prFf+Pizr7ewonCF51VBdT/2JZNY3b1ojhO9ZnYwiqyxFg5Hz8o6ycCDl Eo4mrJCceSTOKavwwGg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 lowpriorityscore=0 priorityscore=1501 suspectscore=0 adultscore=0 spamscore=0 malwarescore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" An unlikely race between __do_essa() and kvm_s390_vm_start_migration(), kvm_s390_vm_stop_migration(), or dat_get_cmma() was possible. Fix by locking kvm->slots_arch_lock. Since this is not a hot path, the overhead of an additional mutex is negligible. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda --- arch/s390/kvm/kvm-s390.c | 20 ++++++++++---------- arch/s390/kvm/priv.c | 5 +++-- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index e162efaa35b8..e5c5e9f61cb2 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -1219,8 +1219,8 @@ static void kvm_s390_sync_request_broadcast(struct kv= m *kvm, int req) =20 /* * Must be called with kvm->srcu held to avoid races on memslots, and with - * kvm->slots_lock to avoid races with ourselves, kvm_s390_vm_stop_migrati= on(), - * and kvm_s390_get_cmma_bits(). + * kvm->slots_arch_lock to avoid races with ourselves, + * kvm_s390_vm_stop_migration(), and kvm_s390_get_cmma_bits(). */ static int kvm_s390_vm_start_migration(struct kvm *kvm) { @@ -1265,7 +1265,7 @@ static int kvm_s390_vm_start_migration(struct kvm *kv= m) } =20 /* - * Must be called with kvm->slots_lock to avoid races with ourselves, + * Must be called with kvm->slots_arch_lock to avoid races with ourselves, * kvm_s390_vm_start_migration() and kvm_s390_get_cmma_bits(). */ static int kvm_s390_vm_stop_migration(struct kvm *kvm) @@ -1300,7 +1300,9 @@ static int kvm_s390_vm_set_migration(struct kvm *kvm, { int res =3D -ENXIO; =20 - mutex_lock(&kvm->slots_lock); + guard(srcu)(&kvm->srcu); + guard(mutex)(&kvm->slots_arch_lock); + switch (attr->attr) { case KVM_S390_VM_MIGRATION_START: res =3D kvm_s390_vm_start_migration(kvm); @@ -1311,7 +1313,6 @@ static int kvm_s390_vm_set_migration(struct kvm *kvm, default: break; } - mutex_unlock(&kvm->slots_lock); =20 return res; } @@ -3001,9 +3002,8 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int= ioctl, unsigned long arg) r =3D -EFAULT; if (copy_from_user(&args, argp, sizeof(args))) break; - mutex_lock(&kvm->slots_lock); - r =3D kvm_s390_get_cmma_bits(kvm, &args); - mutex_unlock(&kvm->slots_lock); + scoped_guard(mutex, &kvm->slots_arch_lock) + r =3D kvm_s390_get_cmma_bits(kvm, &args); if (!r) { r =3D copy_to_user(argp, &args, sizeof(args)); if (r) @@ -3017,9 +3017,9 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int= ioctl, unsigned long arg) r =3D -EFAULT; if (copy_from_user(&args, argp, sizeof(args))) break; - mutex_lock(&kvm->slots_lock); + mutex_lock(&kvm->slots_arch_lock); r =3D kvm_s390_set_cmma_bits(kvm, &args); - mutex_unlock(&kvm->slots_lock); + mutex_unlock(&kvm->slots_arch_lock); break; } case KVM_S390_PV_COMMAND: { diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c index ea5a99537346..b1ba24c346ef 100644 --- a/arch/s390/kvm/priv.c +++ b/arch/s390/kvm/priv.c @@ -1261,8 +1261,9 @@ static int handle_essa(struct kvm_vcpu *vcpu) /* Retry the ESSA instruction */ kvm_s390_retry_instr(vcpu); } else { - scoped_guard(read_lock, &vcpu->kvm->mmu_lock) - i =3D __do_essa(vcpu, orc); + scoped_guard(mutex, &vcpu->kvm->slots_arch_lock) + scoped_guard(read_lock, &vcpu->kvm->mmu_lock) + i =3D __do_essa(vcpu, orc); if (i < 0) return i; /* Account for the possible extra cbrl entry */ --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C1B1840963F; Mon, 3 Aug 2026 12:40:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760856; cv=none; b=uvrpwVFGVeLfARu2ZzVx9tDAp0ZZ6Job1p++YGj/asNBuuh8PHfcyM4PpjWmbVFjDwNvzvCo69gqCLCcHbg3A5BM+q6i2bB/xozFgTmNPkoa0Egn7RiSw9M+OJVuvzUYgZSnCDcMC1aYGzO+/KDVGGsZoRkOFmD3y9GrZ/8pWwg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760856; c=relaxed/simple; bh=tswRcvjV2UsGuXuFcHb6Xe6uRRImcfr585nXnRvh2Zg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WPgwsG4ghRtPw8VLFDh/q9JKm+Ved5krUAPbnlFWjlxyTtSjjH3ppPG74azjPV9jDt2ob3chTr9iMBYuJDwDhFA+I9qT1pEQYKd2Z4MRKuHYynHeL1NgzZRj7H2zfm8399H5cTVJO7mw+lNqxOqmZGyx1Ki6D20P7/o4x583bbo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=XxIwD5fS; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="XxIwD5fS" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CHvNg1937897; Mon, 3 Aug 2026 12:40:52 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=bPRjq6q44qll6i58L O/+Vola2iS5l5Z6UG1bVIPEDAA=; b=XxIwD5fSJE6XXcsYRomAvuN2rkuopwBXY eX9JF1XFptWpv1pCb4kZvmCT0yHzAMlbxWCWbKp3lWzAXLdQpYtJ5KkC9gWOnlF/ 8NbFNIEq1Ij+Uyl8Hcp3mco9UADBQTctOMBYpu26dOh4c7sAa8iMUO8I9CBbGF5n A2pajQfx5s//WCmIB2rSBdSnF1peuY/liALn7iKyqDv6ejVw1+GhhCyl7NWfkqrH cfFr2vfrOoTrVm7W2K0oDQd0cbSDejbFoc4DGG7e6m/mT5X0740gIfGqW+/S8xM3 2hPoEJ9cUtMdBeUyCsokQC1H3cyqWJz3pQLM8Mv2qB4btz1/krNhQ== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs67hgqd3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:52 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CQMl9027377; Mon, 3 Aug 2026 12:40:51 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsv4jwbsg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:51 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673CejbN30015834 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:45 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1A45520040; Mon, 3 Aug 2026 12:40:45 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B26D820043; Mon, 3 Aug 2026 12:40:44 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:44 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 08/13] KVM: s390: cmma: Fix dirty tracking when removing memslot Date: Mon, 3 Aug 2026 14:40:35 +0200 Message-ID: <20260803124040.126471-9-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfXw7nuvcnhzlBT Ru7kvJys6Ppg+3m2tmFwkX0L4bws0cD8qiipPI5RoyYgptvXoyOrnHzio61gh4zOnkXBIr0+AOV VBFKbbzN81GNC8F5ZoUylymtS5mu8bw= X-Authority-Analysis: v=2.4 cv=I7VVgtgg c=1 sm=1 tr=0 ts=6a708c54 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=xy2Bf3EjJieBI87QFfgA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX4yxJWxwX/Fr8 mF3aHlxXEy4M3vaOYhif0jv9gLCMnAZ4e/taRuEYh+DoDbvnzkG6N/YosJjup+w0diSgDOSlQFX W6HsK+CVFwZ8TvPWhNOw284RBiflDLCTJX4Jm0Q/6z3Wz96BlNPKMKNsV89jMG8Xn7uVe+KGlTB HVVMxt8aw5WfhuvovGxplv4WAQ5k7pcnb+2pKqArfNg1BfKFw78Gp2cZBVboxaaeNmuv5J6Wi76 8Z5clP2e4SP/kdtD65chQSCCo7/ud1fvgYJi7AewHDuMKx+Hlv6NJEaaWKmrZfOcA7ao5jQJBhj be7x8K7GTMXcL+lMWF3gZL+ZRMUjC65idyFagEa/nQnQP8fC60avu+2DRTEZA5FjjitzozU4X/m Ix2pMOw4tjvNONRvvZRh7qNP3QGpM41Iu0iaIey8hSYyBcqaxm6wGdfSE3JU9KaIoQdbgvumlFv U99szTeF+PD1NSV9s6A== X-Proofpoint-ORIG-GUID: SF5tn60_wXxhyXOY8usyIfi-1YxNw77t X-Proofpoint-GUID: SF5tn60_wXxhyXOY8usyIfi-1YxNw77t X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 impostorscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 malwarescore=0 adultscore=0 lowpriorityscore=0 phishscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" When a memslot is removed, all ptes that mapped the slot are cleared or even deallocated. If this happens while the system is in migration mode, and if cmma-dirty pages are removed, the cmma-dirty counter will not reflect reality. Fix by appropriately decrementing the cmma-dirty counter when removing a memslot. Opportunistically improve kvm_arch_commit_memory_region() to use __free() for the struct kvm_s390_mmu_cache. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda --- arch/s390/kvm/dat.c | 7 ++++++- arch/s390/kvm/kvm-s390.c | 25 +++++++++++++++++++++++-- 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/arch/s390/kvm/dat.c b/arch/s390/kvm/dat.c index 171b61959908..3f2d6e8902d7 100644 --- a/arch/s390/kvm/dat.c +++ b/arch/s390/kvm/dat.c @@ -850,6 +850,7 @@ static long _dat_slot_pte(union pte *ptep, gfn_t gfn, g= fn_t next, struct dat_wal struct slot_priv *p =3D walk->priv; union crste dummy =3D { .val =3D p->token }; union pte new_pte, pte =3D READ_ONCE(*ptep); + union pgste pgste; =20 new_pte =3D _PTE_TOK(dummy.tok.type, dummy.tok.par); =20 @@ -857,7 +858,11 @@ static long _dat_slot_pte(union pte *ptep, gfn_t gfn, = gfn_t next, struct dat_wal if (pte.val =3D=3D new_pte.val) return 0; =20 - dat_ptep_xchg(ptep, new_pte, gfn, walk->asce, false); + pgste =3D pgste_get_lock(ptep); + pgste =3D __dat_ptep_xchg(ptep, pgste, new_pte, gfn, walk->asce, false); + pgste.cmma_d =3D 0; + pgste_set_unlock(ptep, pgste); + return 0; } =20 diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index e5c5e9f61cb2..ba811f0673d1 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -5812,14 +5812,30 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, return 0; } =20 +static long cmma_d_count_pte(union pte *ptep, gfn_t gfn, gfn_t next, struc= t dat_walk *walk) +{ + union pgste pgste; + + pgste =3D pgste_get_lock(ptep); + if (pgste.cmma_d) { + pgste.cmma_d =3D 0; + atomic64_dec(walk->priv); + } + pgste_set_unlock(ptep, pgste); + return 0; +} + void kvm_arch_commit_memory_region(struct kvm *kvm, struct kvm_memory_slot *old, const struct kvm_memory_slot *new, enum kvm_mr_change change) { - struct kvm_s390_mmu_cache *mc =3D NULL; + const struct dat_walk_ops ops =3D { .pte_entry =3D cmma_d_count_pte, }; + struct kvm_s390_mmu_cache *mc __free(kvm_s390_mmu_cache) =3D NULL; int rc =3D 0; =20 + guard(mutex)(&kvm->slots_arch_lock); + if (change =3D=3D KVM_MR_FLAGS_ONLY) return; =20 @@ -5830,6 +5846,12 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, } =20 scoped_guard(write_lock, &kvm->mmu_lock) { + if (kvm->arch.migration_mode && kvm->arch.use_cmma && old) { + _dat_walk_gfn_range(old->base_gfn, old->base_gfn + old->npages, + kvm->arch.gmap->asce, &ops, DAT_WALK_IGN_HOLES, + &kvm->arch.cmma_dirty_pages); + } + switch (change) { case KVM_MR_DELETE: rc =3D dat_delete_slot(mc, kvm->arch.gmap->asce, old->base_gfn, old->np= ages); @@ -5851,7 +5873,6 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, out: if (rc) pr_warn("failed to commit memory region\n"); - kvm_s390_free_mmu_cache(mc); return; } =20 --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D4A240B0FB; Mon, 3 Aug 2026 12:40:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760857; cv=none; b=V26LoakUcc264T9Vwim+FjyyFvmxVzOC2sp07zgHWT/V7qN2DsgjMPDw/ukUFlN+i7NHF8/VqfFdXXdzYH6N1m6NARGISf9jyPfl+eR2DekSaFi3bpL3518kmUP5qpeVi0DfoTNVvSXfphWj/gVC8qHR5jFX5lK8cT99OyFc4fk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760857; c=relaxed/simple; bh=HOanDrvD+bLZnZeY7pEyreY/JBB5XIzF0GbLYIxmYn0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dO43yyPguBfpV29HTPRN/KYwLPi/dQA54VF8T3o4YbEa7Q5XxASHdMRq+Her8FzdDqETJHwA3J6iBmOwzSsP0VBwHArcoZEBAZ1z4t9a4E9bRGuyI24F5hiPQyRie2P5GxKqpVsg/pOzV7XoL33MssrCN0/fWkmeAqPgusKnWCg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=szJHMVfz; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="szJHMVfz" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CHtv01943569; Mon, 3 Aug 2026 12:40:52 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=rwemp1JR72yGC96fZ c2lb5FsV7ftYuKoDvMVFB/ovOA=; b=szJHMVfz/jkqIjDaBQNKp4FDjwV2G58+1 yTr3bxWgPc5BvkbJcyZbrQju0dOOdQ7GQ49fbVluMM0lzLigl07DKcmnLKRVtycP VUSZ3NdWRc7JI6lynou9zboBr/47LWlSk3zs30g0MTsX0bv4XL7NxXfSSldblxuS xFXV6JMtNGE/+3/8rvr9N3PFxhrIuxp/U/NiM0vKpXXpjmySIQStNfZNT/6qh463 2dSOIITSrONCF+OQNbqnC4P7YK+OEqQiuqdFTkLGIL/nCRQolnUVLUkAOjG251Jw 91l5aZ7DaBILyPmIctjMcQ6Q/jSqZJmRjgL8bBnYkyPetEcvhOEzw== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs77g0k6x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:52 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CQKhd026114; Mon, 3 Aug 2026 12:40:51 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fswtyd3j1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:51 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673Cej9g30015836 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:45 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AC49620040; Mon, 3 Aug 2026 12:40:45 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 28FAC2004B; Mon, 3 Aug 2026 12:40:45 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:45 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 09/13] KVM: s390: ucontrol: Add missing locking around gmap_remove_child() Date: Mon, 3 Aug 2026 14:40:36 +0200 Message-ID: <20260803124040.126471-10-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX6QCwpzF7eeMh 49GUAeGwi/swmxDeo+LHmCgWZT2ZuahCqVA+g9MNdZwNfQRUyqEss78AdaItIbdNAD1cDO9yvnY S8W/9o2TEM720GNYeZyuJIj+hHs+X5f2Qr4Vpp+RKFvxEFlT6ML2px+h8eer1Qrw4Iin2Q1hK0E Y8KxxscW3fHwJhz0TD6pAYhblJmwp1DxMDTcU3eRMXgsUhWANVJpE+8DsX37Hjs+Ly61VLilP+j D4iKkC9V60ZQ17u/oGuyE9SeyFqdIaqVx3svHtFRbbl6anm406dQ9NUFKcF9ITkCJBfENEWUpxC vf+zS/CnMpKlay8lpeWs3OzkNTafLFnyd18CrLPZQl9fEmITVyUK4lYeS2O1xu8JSLIcvwSk7c/ PtcZcexB74r8f2XHEVJ1UXQ10fZ6vxBUvkv5jswt3Z8eCZBe2xNyFCpRe2C2eFSaeu6RgdBE05i m8Yk5ZGIy0KlgRUub4Q== X-Authority-Analysis: v=2.4 cv=WIFPmHsR c=1 sm=1 tr=0 ts=6a708c54 cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=qtdt0r206yBj_IGTItsA:9 X-Proofpoint-GUID: TmcPc_ONycnH_uTvkokGgNmgmsh4hVzH X-Proofpoint-ORIG-GUID: TmcPc_ONycnH_uTvkokGgNmgmsh4hVzH X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfXzQyokIytL4uS hC06j8UfGhEakmSCJ42Bha4ymZZdmMugaS1EFaot1QKEdp3e/hKCh99pnIU/oQuSoA0coNVuBhc 7LW2oybMyAZ5SO2XSbV+qH11xq0ar3E= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 lowpriorityscore=0 priorityscore=1501 phishscore=0 malwarescore=0 suspectscore=0 clxscore=1015 impostorscore=0 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" gmap_remove_child() needs to be called while holding the children_lock of the parent gmap. This was not the case in the error handling path of kvm_arch_vcpu_create() for UCONTROL guests. Fix by adding the missing lock. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda Reviewed-by: Steffen Eiden --- arch/s390/kvm/kvm-s390.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index ba811f0673d1..2741ca323ede 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3875,7 +3875,9 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) =20 out_ucontrol_uninit: if (kvm_is_ucontrol(vcpu->kvm)) { + spin_lock(&vcpu->kvm->arch.gmap->children_lock); gmap_remove_child(vcpu->arch.gmap); + spin_unlock(&vcpu->kvm->arch.gmap->children_lock); vcpu->arch.gmap =3D gmap_put(vcpu->arch.gmap); } out_free_sie_block: --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8360408614; Mon, 3 Aug 2026 12:40:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760857; cv=none; b=RqbOt0FXCzAkEEPQ2js2kuGcddx5NaecE9UYGPHt9ntZ2YXijVxbo2FsgkZBnAtfkq8cI738HjqIYgkLh2sbaB1sDDVFup9ucpSc0+cEOXigISUsuSVc/C22IeyxQOLzNenBZeaCPR0jccgcQYP35iyJb/UpnYiTnZ9BK4ehL4c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760857; c=relaxed/simple; bh=KnM1KVGK0kPBQvu6Ryfhsr51MIdNqKkHhP5SbM2+pPg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GfG1EJkY4MtxbLNhPSc3uWW9a4+nM/37r4bUTH2IHrkQf6WaZoh8T9ZwxcmFh7hOSSAAfIeCr87ipzM0+5NLELwba6Gh0RhfpnHQ27YZdaKYR1b41ySI+hX7JnU++MjBKPyOdI6qvMclCkk3HP1gmtVB5jjIdlJAExiT0wYHzW8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Rhm6slfv; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Rhm6slfv" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CIHmO1939178; Mon, 3 Aug 2026 12:40:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=fxrGJO7BUkEjBuJE6 4dhCca2Om+6ZKwB7ScUtkxDJhU=; b=Rhm6slfvBdQF64yC4wJJgcWVTxCVYH9Ph M2Yefs3tmsuiYNYdjK/ZfZBVSyhuzghKxKoZxEXQ241jR/4wpf+aw+cPaxWZM2Rd Id70Dnzye5X7UqZ0uQsuzWqufAZiFzl2sk8bOQRkGzsBdJOku2raAb3Wn/cl3AHy TZIlHxBfNtfCkq03TWl+DoNNgz0TKOEtaCaQ5X63oqRkcr49g0D43u2XgCu4OGzd axLqvNEG4FqZPyuSD3eCWZPyaCqPNNjks4EpbM+YzHpDxTGRWrphX/ivI3iAE0oY 2PTHiCMpvoFQINoSsopbjMXmpchZjBxX2pXEilbOuzgQ4I04zWbUg== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs67hgqd9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:53 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CQJH7009771; Mon, 3 Aug 2026 12:40:52 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsvmh59t0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:52 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673CeknE31457648 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:46 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3A00320040; Mon, 3 Aug 2026 12:40:46 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BED0E20043; Mon, 3 Aug 2026 12:40:45 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:45 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 10/13] KVM: s390: Free the mmu cache when kvm_arch_vcpu_create() fails Date: Mon, 3 Aug 2026 14:40:37 +0200 Message-ID: <20260803124040.126471-11-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX4WP/AzUiHL9o sKUbQdVRnHgc761fI+LO2iC//aPyeb27QfhvWs/35s1dMBWo5ePqeeHbl1kXEZyLvIo9GG/MI9x mrwJzVwDSKSJGJDPDdypUhfpkJriKA4= X-Authority-Analysis: v=2.4 cv=I7VVgtgg c=1 sm=1 tr=0 ts=6a708c55 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=owYgaZMeOewOGYH0y6gA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX70VrFm+MOlko XYh+f+qlZn5QWGN9ngUNviFWUzvNRFI3cFsu4N9MroGb7+QXYAqZoFMdHWFyWkg6uV/rBA69V5f NLYr/oFmbmcyWvf7YHikJ9T4Z7eukTR4gEnYXAo21TQueub6SySbhsR31n8BRmHvl48mLdx4m7g zNEANDV+n4rf2XlswLMQW1RFkFhsQq61l3AZf7G9ePvNbFIfJxELjr4g86kg+CW/E4Bl1wGGN1W 9m19LezxLwMupS5t1SdNfdB5Lr38ckeeHa2c9eUheTqBMRDhbZj8vmkH1mATzPSgjgsXTCPkPiC AW5DIN5NQfsWYHlZ8x0pA2T81EEfHo8ViVxTPN1GciID+SHd8+mXZkOYyhV2cs9oz71vcNqEkxD /syHarINBR1hixoevXZQkmPMxwo9M1iok6hQxLaLYvWFZIin/clEbLz+RWzyctNH9uAlPpoHPJ1 OsZkl/E6ssf+1R3XSqg== X-Proofpoint-ORIG-GUID: w3K0Ccb5LDz1Nj4dyYkHOk_uqkF2Z5VL X-Proofpoint-GUID: w3K0Ccb5LDz1Nj4dyYkHOk_uqkF2Z5VL X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 impostorscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 malwarescore=0 adultscore=0 lowpriorityscore=0 phishscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" The mmu cache is the first thing that is allocated in kvm_arch_vcpu_create(), but in case of failure it was not freed. Fix by freeing the mmu cache in case of failure. Refactor kvm_arch_vcpu_create() to use scope-based cleanup instead of gotos. Signed-off-by: Claudio Imbrenda Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") --- arch/s390/kvm/kvm-s390.c | 40 ++++++++++++++++++---------------------- 1 file changed, 18 insertions(+), 22 deletions(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 2741ca323ede..9b8a35e7dc82 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3800,21 +3800,21 @@ int kvm_arch_vcpu_precreate(struct kvm *kvm, unsign= ed int id) return 0; } =20 +DEFINE_FREE(sie_page, struct sie_page *, if (_T) free_page((unsigned long)= (_T))) + int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) { - struct sie_page *sie_page; + struct kvm_s390_mmu_cache *mc __free(kvm_s390_mmu_cache) =3D NULL; + struct sie_page *sie_page __free(sie_page) =3D NULL; int rc; =20 BUILD_BUG_ON(sizeof(struct sie_page) !=3D 4096); - vcpu->arch.mc =3D kvm_s390_new_mmu_cache(); - if (!vcpu->arch.mc) + mc =3D kvm_s390_new_mmu_cache(); + if (!mc) return -ENOMEM; sie_page =3D (struct sie_page *) get_zeroed_page(GFP_KERNEL_ACCOUNT); - if (!sie_page) { - kvm_s390_free_mmu_cache(vcpu->arch.mc); - vcpu->arch.mc =3D NULL; + if (!sie_page) return -ENOMEM; - } =20 vcpu->arch.sie_block =3D &sie_page->sie_block; vcpu->arch.sie_block->itdba =3D virt_to_phys(&sie_page->itdb); @@ -3856,10 +3856,9 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) vcpu->run->kvm_valid_regs |=3D KVM_SYNC_FPRS; =20 if (kvm_is_ucontrol(vcpu->kvm)) { - rc =3D -ENOMEM; vcpu->arch.gmap =3D gmap_new_child(vcpu->kvm->arch.gmap, -1UL); if (!vcpu->arch.gmap) - goto out_free_sie_block; + return -ENOMEM; } =20 VM_EVENT(vcpu->kvm, 3, "create cpu %d at 0x%p, sie block at 0x%p", @@ -3867,22 +3866,19 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) trace_kvm_s390_create_vcpu(vcpu->vcpu_id, vcpu, vcpu->arch.sie_block); =20 rc =3D kvm_s390_vcpu_setup(vcpu); - if (rc) - goto out_ucontrol_uninit; + if (rc) { + if (kvm_is_ucontrol(vcpu->kvm)) { + scoped_guard(spinlock, &vcpu->kvm->arch.gmap->children_lock) + gmap_remove_child(vcpu->arch.gmap); + vcpu->arch.gmap =3D gmap_put(vcpu->arch.gmap); + } + return rc; + } =20 + vcpu->arch.mc =3D no_free_ptr(mc); + sie_page =3D NULL; kvm_s390_update_topology_change_report(vcpu->kvm, 1); return 0; - -out_ucontrol_uninit: - if (kvm_is_ucontrol(vcpu->kvm)) { - spin_lock(&vcpu->kvm->arch.gmap->children_lock); - gmap_remove_child(vcpu->arch.gmap); - spin_unlock(&vcpu->kvm->arch.gmap->children_lock); - vcpu->arch.gmap =3D gmap_put(vcpu->arch.gmap); - } -out_free_sie_block: - free_page((unsigned long)(vcpu->arch.sie_block)); - return rc; } =20 int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6BD3F40C5D4; Mon, 3 Aug 2026 12:40:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760858; cv=none; b=aLxDtb6qAUuBySlMAh7rqoWRmUxOdRYuHgUdsl7gAEyo83xh/2fToKIfv5OPH3Alrn6oatQEQn5/sWMChASpNm/ag4SKY+Q8tZoIkght29/sDCItKHYRO5QIhffR8M60Q3kIJ6QetzduKoBp3rdWwKSyFnq3clctZU4Jg7yFPoM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760858; c=relaxed/simple; bh=lrLXFoXGkCQqajiFzpvyyVTqja9Wibw9Q7qbE7OIzeQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JARI9x/L+WUi1m2zaePrJDm6CROJ0BVWRB1er2fqnDCZN3k4l+G6O5jYRtRZ+aZ5mBPcytOVkrpDqnyIfgoWQ21IsDUF7CbogNMtq8cnzlpw881q6ty5bTsR7FAUOhBvrdZNjJi1Cg1EdOyjPbWX3kQyuPbll1XkcHuTjUJXugA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=FBRO3CTp; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="FBRO3CTp" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CHrQM1943500; Mon, 3 Aug 2026 12:40:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=J5ryilsnnfEEjhv+w mZlP5DZ1N22K6iGMAkWi7r5uEo=; b=FBRO3CTpC3L9alivacjczHpWWIiZ4aDsE 7lhyAuSKeuMQe9eWHo9mKxJSXG3KOoth/w85ltBrA4o4ePo24NZXbJRlfaWQF+z0 Awlt7ODTHJ6rtV4KoOmYMBdPVpdN4fRgMkgQRSpX/otVjkDSMO4o89RFtPuezvh5 zkc0Dj3nyj3VSmtRyEwZU9ta3W3fCe4ta/vvzyY/wCEh4Y2khm4UNQjUWkN3WZPV sXaEUG7kxxv5XZY4EZ2BIQtrgO1aemZvFQMXYfQX3xC824YKYc8uvtdoQNEGYpUq /LO4SC/KqW9P4tcmbdield9cZjgbcAMxfaY+JpCUP5lUZLEM8MZQg== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs77g0k71-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:53 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CQHEv027325; Mon, 3 Aug 2026 12:40:52 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fsu4qdgqw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:52 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673Cekmk31457652 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:46 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C912220040; Mon, 3 Aug 2026 12:40:46 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4BF0A20043; Mon, 3 Aug 2026 12:40:46 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:46 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 11/13] KVM: s390: Return -EINTR if a signal is pending while faulting-in Date: Mon, 3 Aug 2026 14:40:38 +0200 Message-ID: <20260803124040.126471-12-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX0fcjnLDbspwQ edKuIQi+/zzPFUrks/VxkUTM0S1p0bk6GxQSzkSO3nl968Zn3KP2rkZU08BMVchfWMd8Xxhb89D PxH1OJ+phwlCzQmYD4GojOeoxfDRZDGut0JIu945Ry83+pHoE1MRUSmy2BvMabnLYpMva1P4yKf BIJYkMzRN09l9NgZNHyrK4uKRTiOHjULJLGxWk+nvmN7OVEdb/YRZgo4ewGLQfHw6HB72Vo8Kn1 FCVJyTRu7BuxbLPoIMmUpsYidh+fZwaUr6YNcn+BH5HN2sEYGN9fyVvKcbUriFiQHQuDZ2lxWG+ EL+I5oa/nF2a8m5E4Zg+199vcP/SMj7D+AYWvjAqNBVA3vDTVcQiHL0fvQR1ve2zxsaG5p2TJs4 iP788ZiXdzhx7qlfjoR3ND5ECf0hlGrZ5QBQqy3VmOyFlMaycSBG65szh7SiVskd+UXaDbF6lQJ K1LF6lUWk7nGmco6MgQ== X-Authority-Analysis: v=2.4 cv=WIFPmHsR c=1 sm=1 tr=0 ts=6a708c55 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VnNF1IyMAAAA:8 a=4yawSYOjwzvXb9KGJXwA:9 X-Proofpoint-GUID: QthsY7RTdJQ33zaa-zrLeFbpH9hI15Ff X-Proofpoint-ORIG-GUID: QthsY7RTdJQ33zaa-zrLeFbpH9hI15Ff X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX+H6bkR0xKM6D 2BhaJD7OoTOc91cpzGgabCYIsXZHzVPgz/6R1wxxdUsn3uPLLZmWFErznulM0ECweeiX9cGdrEF kAEQzTGPuAuwOrqF3D9a0wl27IDjiNU= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 lowpriorityscore=0 priorityscore=1501 phishscore=0 malwarescore=0 suspectscore=0 clxscore=1015 impostorscore=0 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" If a fatal signal is pending while trying to fault-in a page, return -EINTR instead of -EAGAIN. Also fix unpack_one() to handle -EINTR properly. Signed-off-by: Claudio Imbrenda Fixes: e907ae530133 ("KVM: s390: Add helper functions for fault handling") --- arch/s390/kvm/faultin.c | 6 +++--- arch/s390/kvm/pv.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/s390/kvm/faultin.c b/arch/s390/kvm/faultin.c index fee80047bd94..3cc45f7f5b2d 100644 --- a/arch/s390/kvm/faultin.c +++ b/arch/s390/kvm/faultin.c @@ -91,9 +91,9 @@ int kvm_s390_faultin_gfn(struct kvm_vcpu *vcpu, struct kv= m *kvm, struct guest_fa /* Access outside memory, addressing exception. */ if (is_noslot_pfn(f->pfn)) return PGM_ADDRESSING; - /* Signal pending: try again. */ - if (f->pfn =3D=3D KVM_PFN_ERR_SIGPENDING) - return -EAGAIN; + /* Fatal signal pending: bail out. */ + if (is_sigpending_pfn(f->pfn)) + return -EINTR; /* Check if it's read-only memory; don't try to actually handle that cas= e. */ if (f->pfn =3D=3D KVM_PFN_ERR_RO_FAULT) return -EOPNOTSUPP; diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c index 1beacc841ca8..dc204b521052 100644 --- a/arch/s390/kvm/pv.c +++ b/arch/s390/kvm/pv.c @@ -809,7 +809,7 @@ static int unpack_one(struct kvm *kvm, unsigned long ad= dr, u64 tweak, return -EAGAIN; } =20 - if (ret && ret !=3D -EAGAIN) + if (ret && ret !=3D -EAGAIN && ret !=3D -EINTR) KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: failed addr %llx with rc %x rr= c %x", uvcb.gaddr, *rc, *rrc); return ret; --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6FB240DB33; Mon, 3 Aug 2026 12:40:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760859; cv=none; b=E26WIpTX+/is+M8xc2gz0vesBjJcXXz7OYAa5I+FmldFnaxRJur94joCOL7cN1JiVblxMvfBdd5K4etYvuW41ul/D2EXBjulgRu3llD6/Z7Wy8OKttSQ2CgNWtDn7s9KFcfHXTQj3kQh+LwtE64odvs0cIbm+f0Y3nJQQZQvdOY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760859; c=relaxed/simple; bh=SueeGW913y+l6iNRtLVYVpFY6wBTQ6KEeYtAQFCxDSE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=V3t7a4t9Nf0SqbckZ1nd0h6e1u2LosD6nmjrlLCQ8nHbLm4XkZhC1Bo3EvantO9PR0FAvc07AJfk6uQX0B2D33wrZblwvmLrfXEFwmbf5dF977gAcvNSQ4C5A4WepdM9jNHG0iMlZ62Ba6nSGUXkOr2skBOBpZMEopa/3DURBiE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=dYXLa1gv; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="dYXLa1gv" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CIq5h1939728; Mon, 3 Aug 2026 12:40:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=kD16CCXM6IusG0twE 5s++dKeFs80vjBLnsgXBQEbWo8=; b=dYXLa1gvB50ogq/Ry2pGwmxRm7G5d1GAe X14shRmxJX+KYvNADyiFBo9+lQzmRGE0CmgZzU89UEF3Ji04blU+oU30f0ism6pP xOwPQjpeT9uqt2vDt8lJhSiD9zumurxCRaXxXpwcheOJo704LsSmrQc7axgTouxF esSp3vFo5BUEN6PknjwACKRQbAZ4nbmcHjAT9NcgVQOXSfond7c8OVsZzPfcOt7B MmTpuRmMCpffqpIOGFyPGff8YDTCfikkv8Ok8505S15CP3TfSnwImZqzD/AUkjqX 4WznAyZBb+QOoWfUZzk0NUvA0F3hlgeV5q+CJXOZuXglo+psZJqew== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs67hgqdb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:54 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CBcuS016815; Mon, 3 Aug 2026 12:40:53 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsugvwe5v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:53 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673CelXC29229430 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:47 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7AC2520040; Mon, 3 Aug 2026 12:40:47 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D9A422004B; Mon, 3 Aug 2026 12:40:46 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:46 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 12/13] KVM: s390: Fix ordering when adding to SCA Date: Mon, 3 Aug 2026 14:40:39 +0200 Message-ID: <20260803124040.126471-13-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfXxHzVOFYr1kzz Hov6aWiR1YAS0vXp+JXMtVVQU36X1IlYI9vD6XraCim1SLQd/5K+t8xqNn3ANzyI50NSaCumhU8 t9VLF27p1k90jBQiWngQMcAcNZpzWXw= X-Authority-Analysis: v=2.4 cv=I7VVgtgg c=1 sm=1 tr=0 ts=6a708c56 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=DpaZzcUc-R7GdRs0254A:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX2rbK8XZ+AOgs w1hTcNlJAaCWO1vl9fSv2D+kGupHaUZ2xECa4ogbcyswEWcmn9X2+3dDKee76FR64p3qiXlIf0z 9OVE/noc62JPjw9ifPZ+vcP7rBBBjEG7GSV9c5EMxpSeb3YZByJgv5DnUr96jsphkkRFayG6ZxC qy+SdMEA9Gr+8EC/CwOVgy2vnl57CuWvGEsZ1hZ2//ufsUokH7E5MrhuvGvwQk3wBY7UwxrS8w8 CxTr9rervC2/fXsYCmM5GPN3c1Yzk/Boetzrjh5raUsFQ3abPztXRbOOEI/WSdw/7MF+wKnzHVd 3EWiuYUU1bHyW2SrJNgk3YuRBr876TOmlF3chmIlfR7+ZCEx3sluSIqNH+w7jjtNZFywcX2eEBK fNiZxaeEi4Wx7cshP92oS391I7RVQG25bVMhUj3tsrXV1b/I2zW/epWP94EESSJxAY+J9hEZGnM a2ze8yigQ0Y7H1Mr/3A== X-Proofpoint-ORIG-GUID: 7rLfAkHWlYQUo97yIxm2-XveVALHTIsW X-Proofpoint-GUID: 7rLfAkHWlYQUo97yIxm2-XveVALHTIsW X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 impostorscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 malwarescore=0 adultscore=0 lowpriorityscore=0 phishscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" When adding a new vCPU to the SCA area, the validity bit in the MCN was set before the pointer to the state description, potentially allowing for a race. Fix by setting the pointer before setting the bit. Fixes: 14542a0a54c5 ("KVM: S390: Remove sca_lock") Signed-off-by: Claudio Imbrenda Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank --- arch/s390/kvm/kvm-s390.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 9b8a35e7dc82..518a69c55e85 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3485,8 +3485,8 @@ static void sca_add_vcpu(struct kvm_vcpu *vcpu) if (!kvm_s390_use_sca_entries()) return; =20 + WRITE_ONCE(sca->cpu[vcpu->vcpu_id].sda, virt_to_phys(vcpu->arch.sie_block= )); set_bit_inv(vcpu->vcpu_id, (unsigned long *)sca->mcn); - sca->cpu[vcpu->vcpu_id].sda =3D virt_to_phys(vcpu->arch.sie_block); } =20 static int sca_can_add_vcpu(struct kvm *kvm, unsigned int id) --=20 2.55.0 From nobody Fri Oct 2 08:25:33 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 96C0940EBB0; Mon, 3 Aug 2026 12:40:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760859; cv=none; b=pZHq+aq1mOlirj78oIIkiuw9ccS8BFk4A+4130fTOjz2SCEC3piUxLa7k7il0qF5avMrmVjo19A9BKOoKAGGVh1wYGTX0XLFL5CxelJG9eccXA45pv0t+Bq6mVooKr1h2ZDJnvcws1MEzpEcpq9idaTmcZh0bSD9TSr6RN/FS9c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785760859; c=relaxed/simple; bh=yB18Tdk/yJv2D1uTlZXxVFQX7lyhikE6fAymjrfZIUM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qmS9YykK3WssmE1t54W5yx7v2Us+AO3oD3wrcbwK+xa0vSdCmTxdyjvCoYmSQJOOwq2APqriEDokLGcc+7yC0q+V/IkAOzeF8+l/Ct0V/rx3tkahmv0scMryDokkF+xL7ZbgOhtPyLITWJYNsxFvZIVTJ5TyCBiGt0TqOM+L6uY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=RSPE3w9y; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="RSPE3w9y" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673CI1V92018764; Mon, 3 Aug 2026 12:40:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=+ovgPGLArufZdBlLu 6efjoPl7/x/t4jxjAnDkdUcJ+o=; b=RSPE3w9yKUQedYtCfCNQBcBS90/isG89+ Xepr/CWj9KppQ/L+RYLZO4Z82q11XgKOYDghB27yfM93mClg7Sgj9oCYt+3tjSdi +mE8vayc4Skb1S7H5U0OM0iMPTizhucmyecdxU11HQLRjv1YMWalfNKvNyIFJg0N Bv+/Zal1h85Rx1ZoVY8PC97X1tLPpu8Kk9Ar9kHTPWI993eqteRxBxOO2d4Ex20E fugTE191U/E1wyKAZARKiLJDMl2TeICbYA/DJkZLCB2RBCUpyUsP4XO3sDvgWwOs Klcense4jA+jvjjGXGNeT4FO0kLUblCI3wSvhODpJYRy1TK4u+zhg== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fs8h4rr5m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:55 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 673CBjj4016862; Mon, 3 Aug 2026 12:40:54 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fsugvwe5w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 03 Aug 2026 12:40:54 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 673CemCw16384462 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 3 Aug 2026 12:40:48 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 11BA820040; Mon, 3 Aug 2026 12:40:48 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 92B2720043; Mon, 3 Aug 2026 12:40:47 +0000 (GMT) Received: from p-imbrenda.ehn-de.ibm.com (unknown [9.224.75.30]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 3 Aug 2026 12:40:47 +0000 (GMT) From: Claudio Imbrenda To: linux-kernel@vger.kernel.org Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com, david@kernel.org, seiden@linux.ibm.com, nrb@linux.ibm.com, schlameuss@linux.ibm.com, gra@linux.ibm.com Subject: [PATCH v8 13/13] KVM: s390: Fix cleanup in kvm_s390_pv_create_cpu() Date: Mon, 3 Aug 2026 14:40:40 +0200 Message-ID: <20260803124040.126471-14-imbrenda@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260803124040.126471-1-imbrenda@linux.ibm.com> References: <20260803124040.126471-1-imbrenda@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX7PGLItcmwY9K kga/JXq/yFALZ5ZK/IT+dJAiiQBiYTNkQ0jtgeBuRNeb/HjqPqPdcY5/dmk1Ow1cI2dTVid7+GG VDrDT7C+vp60QDM5m37IkO3f4miGQio= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODAzMDExMCBTYWx0ZWRfX7UHLa7M8jJI1 JiUD2aOmTUoh5ErlI7RgjivujjAq0Yv4Y5y+Z3zavDbEjTVMy6N5jpxsNqZ/1v1Fh4gko5gfc5y W+ncxeQ333Yx/dDIMJAh0zeGA5CWKUxODzSxklZs2Ej/IAUjlAo8d2vs6oQYvBq12Bqo0Ro/vXZ TPNGQqMUosAQeL9VwjVMQLPyOuTLRo0lS93F8XVDoo5WLs2e8tKuzjRK4dXkU255wO45pMj4GRN ERTj0FDgaaxR8r12PYZV5D04tJH2OjkxhmhhuDKVcGiTzQ/n7XGap5haCh3v2Vmhy1DT930P0vT VCdbCoj6tGVNXkYulVKPbF/YytumEXNaoxbnPo4hrRKYCsXbY4e8envzegHr6L/mDtZ5DiHQbSN zgAb8UVe7oK5p45o+TMxSyV8JwvXNNfTemSNdItXwW1/WfAzTt/kkSmTnD3i7kmgOz51z0r5Cvc QO1XLWsr8iXNZKTaldQ== X-Authority-Analysis: v=2.4 cv=SI1ykuvH c=1 sm=1 tr=0 ts=6a708c57 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=h-RzbZz0cncsEQf3j_AA:9 X-Proofpoint-ORIG-GUID: hkv4NIendSP6O1WIOTEdEMbQZYc9doUS X-Proofpoint-GUID: hkv4NIendSP6O1WIOTEdEMbQZYc9doUS X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-03_03,2026-07-30_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 suspectscore=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 lowpriorityscore=0 adultscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608030110 Content-Type: text/plain; charset="utf-8" If creating a protected vCPU in kvm_s390_pv_create_cpu() fails, kvm_s390_pv_destroy_cpu() was called, which checks whether the vCPU has a PV handle and exits doing nothing otherwise. At that point, due to not having created the protected vCPU, the PV handle will not be set, and kvm_s390_pv_destroy_cpu() will do nothing, thus leaking the allocated memory. Fix by factoring out the code to free and reset a PV vCPU; call it from kvm_s390_pv_destroy_cpu() and kvm_s390_pv_create_cpu(). Opportunistically fix the return value of kvm_s390_pv_destroy_cpu() in case of errors: return -EIO instead if EIO. Fixes: d4074324b07a ("KVM: s390: pv: avoid double free of sida page") Signed-off-by: Claudio Imbrenda Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank --- arch/s390/kvm/pv.c | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c index dc204b521052..b02e0159d3cd 100644 --- a/arch/s390/kvm/pv.c +++ b/arch/s390/kvm/pv.c @@ -244,6 +244,24 @@ static void kvm_s390_clear_pv_state(struct kvm *kvm) kvm->arch.pv.stor_var =3D NULL; } =20 +static void kvm_s390_pv_dispose_cpu(struct kvm_vcpu *vcpu, bool free_stor_= base) +{ + if (free_stor_base) + free_pages(vcpu->arch.pv.stor_base, get_order(uv_info.guest_cpu_stor_len= )); + free_page((unsigned long)sida_addr(vcpu->arch.sie_block)); + vcpu->arch.sie_block->pv_handle_cpu =3D 0; + vcpu->arch.sie_block->pv_handle_config =3D 0; + memset(&vcpu->arch.pv, 0, sizeof(vcpu->arch.pv)); + vcpu->arch.sie_block->sdf =3D 0; + /* + * The sidad field (for sdf =3D=3D 2) is now the gbea field (for sdf =3D= =3D 0). + * Use the reset value of gbea to avoid leaking the kernel pointer of + * the just freed sida. + */ + vcpu->arch.sie_block->gbea =3D 1; + kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu); +} + int kvm_s390_pv_destroy_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc) { int cc; @@ -258,24 +276,9 @@ int kvm_s390_pv_destroy_cpu(struct kvm_vcpu *vcpu, u16= *rc, u16 *rrc) WARN_ONCE(cc, "protvirt destroy cpu failed rc %x rrc %x", *rc, *rrc); =20 /* Intended memory leak for something that should never happen. */ - if (!cc) - free_pages(vcpu->arch.pv.stor_base, - get_order(uv_info.guest_cpu_stor_len)); - - free_page((unsigned long)sida_addr(vcpu->arch.sie_block)); - vcpu->arch.sie_block->pv_handle_cpu =3D 0; - vcpu->arch.sie_block->pv_handle_config =3D 0; - memset(&vcpu->arch.pv, 0, sizeof(vcpu->arch.pv)); - vcpu->arch.sie_block->sdf =3D 0; - /* - * The sidad field (for sdf =3D=3D 2) is now the gbea field (for sdf =3D= =3D 0). - * Use the reset value of gbea to avoid leaking the kernel pointer of - * the just freed sida. - */ - vcpu->arch.sie_block->gbea =3D 1; - kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu); + kvm_s390_pv_dispose_cpu(vcpu, !cc); =20 - return cc ? EIO : 0; + return cc ? -EIO : 0; } =20 int kvm_s390_pv_create_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc) @@ -319,9 +322,7 @@ int kvm_s390_pv_create_cpu(struct kvm_vcpu *vcpu, u16 *= rc, u16 *rrc) uvcb.header.rrc); =20 if (cc) { - u16 dummy; - - kvm_s390_pv_destroy_cpu(vcpu, &dummy, &dummy); + kvm_s390_pv_dispose_cpu(vcpu, true); return -EIO; } =20 --=20 2.55.0