Re: [PATCH v1] KVM: s390: Fall back to short-term pinning in MAP ioctl

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] UAPI breakage: `kvm_s390_adapter_map` returns success for file-backed memory without recording the mapping, causing `kvm_s390_adapter_unmap` to fail with `-ENOENT`.
--

--- Patch [1]: [PATCH v1] KVM: s390: Fall back to short-term pinning in MAP ioctl ---
commit a05b3db94a2a5dc18d9aa3a80842bcd850efd72d
Author: Jaehoon Kim <jhkim@linux.ibm.com>

KVM: s390: Fall back to short-term pinning in MAP ioctl

This commit adds a fallback to short-term pinning in kvm_s390_adapter_map()
when FOLL_LONGTERM pinning fails, such as for file-backed memory. If the
short-term pin succeeds, it unpins the page and returns success so the
non-atomic irqfd path can handle interrupt injection.

> diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
> index 9e3e6b0d72ad6..4b68e0cb51f6e 100644
> --- a/arch/s390/kvm/interrupt.c
> +++ b/arch/s390/kvm/interrupt.c
> @@ -2520,8 +2520,19 @@ static int kvm_s390_adapter_map(struct kvm *kvm, unsigned int id, __u64 addr)
>  	map->addr = host_addr;
>  	map->page = pin_map_page(kvm, host_addr, FOLL_LONGTERM);
>  	if (!map->page) {
> -		ret = -EINVAL;
> -		goto out;
> +		/*
> +		 * Long-term pinning may fail for memory types such as file-backed
> +		 * memory. Check whether short-term pinning is possible so that the
> +		 * non-atomic irqfd path can handle interrupt injection.
> +		 */
> +		map->page = pin_map_page(kvm, host_addr, 0);
> +		if (!map->page) {
> +			ret = -EINVAL;
> +			goto out;
> +		}
> +		unpin_user_page(map->page);
> +		kfree(map);
> +		return 0;

[Severity: High]
Does returning 0 here break UAPI symmetry?

Since the function returns success without adding the mapping to the
adapter->maps list, a later call to kvm_s390_adapter_unmap() for this
successfully mapped address will fail to find it and return -ENOENT:

arch/s390/kvm/interrupt.c:kvm_s390_adapter_unmap() {
    ...
	spin_lock_irqsave(&adapter->maps_lock, flags);
	list_for_each_entry_safe(map, tmp, &adapter->maps, list) {
		if (map->guest_addr == addr) {
			found = true;
			...
		}
	}
	spin_unlock_irqrestore(&adapter->maps_lock, flags);

	return found ? 0 : -ENOENT;
}

Could this cause userspace hypervisors like QEMU to abort or fail device
cleanup and migration when the unmap ioctl unexpectedly fails?

>  	}
>  	spin_lock_irqsave(&adapter->maps_lock, flags);
>  	if (adapter->nr_maps < MAX_S390_ADAPTER_MAPS) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720222238.1576-1-jhkim@linux.ibm.com?part=1