Re: [PATCH v4 6/6] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The AIBV size calculation systematically overestimates the required memory size, leading to false rejection of valid AIBV configurations located near page boundaries.
--

--- Patch [6]: [PATCH v4 6/6] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages ---
commit 4b6ef516a235f953d1559a623689c91ffb836199
Author: Farhan Ali <alifm@linux.ibm.com>

KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

This commit adds validation checks for the guest-provided AIBV and AISB 
addresses before pinning them. It ensures the AIBV does not exceed a single 
page boundary and that the AISB is aligned properly to 8 bytes.

> diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
> index d76b2c5484aca..e55e75b81b516 100644
> --- a/arch/s390/kvm/pci.c
> +++ b/arch/s390/kvm/pci.c

[ ... ]

> @@ -268,6 +268,14 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
>  		return gisc;
>  
>  	/* Replace AIBV address */
> +	size = BITS_TO_LONGS(msi_vecs) * sizeof(unsigned long);
> +	size += (fib->fmt0.aibvo / 8) + 1;
> +	npages = DIV_ROUND_UP((fib->fmt0.aibv & ~PAGE_MASK) + size, PAGE_SIZE);
> +	if (npages > 1) {
> +		rc = -EINVAL;
> +		goto out;
> +	}
> +

[Severity: High]
Does this size calculation artificially inflate the required AIBV memory space 
and falsely reject valid guest configurations?

If a guest places a 1-MSI vector AIBV near the end of a physical page, such 
as at page offset 4088, the size formula calculates at least 9 bytes (8 
bytes from BITS_TO_LONGS(1) plus 1 arbitrary byte). 

This inflated size (4088 + 9 = 4097) crosses the page boundary, causing KVM 
to mistakenly reject a perfectly valid, 8-byte aligned memory placement with 
-EINVAL. Can this formula be adjusted to calculate the exact size required?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722170621.1686-1-alifm@linux.ibm.com?part=6