Re: [PATCH v4 05/13] KVM: s390: ucontrol: Add missing locking around gmap_remove_child()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The struct kvm_s390_mmu_cache (vcpu->arch.mc) is permanently leaked in the error cleanup paths of kvm_arch_vcpu_create().
--

--- Patch [5]: [PATCH v4 05/13] KVM: s390: ucontrol: Add missing locking around gmap_remove_child() ---
commit 8377be474458b5d68906db9024e50f7b0c2263fe
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>

KVM: s390: ucontrol: Add missing locking around gmap_remove_child()

gmap_remove_child() needs to be called while holding the children_lock
of the parent gmap. This was not the case in the error handling path of
kvm_arch_vcpu_create() for UCONTROL guests.

> diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
> index 5046de39d739e..fa6a0bacd9675 100644
> --- a/arch/s390/kvm/kvm-s390.c
> +++ b/arch/s390/kvm/kvm-s390.c
> @@ -3868,7 +3868,9 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
>  
>  out_ucontrol_uninit:
>  	if (kvm_is_ucontrol(vcpu->kvm)) {
> +		spin_lock(&vcpu->kvm->arch.gmap->children_lock);
>  		gmap_remove_child(vcpu->arch.gmap);
> +		spin_unlock(&vcpu->kvm->arch.gmap->children_lock);
>  		vcpu->arch.gmap = gmap_put(vcpu->arch.gmap);
>  	}
>  out_free_sie_block:
>  	free_page((unsigned long)(vcpu->arch.sie_block));
>  	return rc;

[Severity: High]
This is a pre-existing issue, but does this error path leak vcpu->arch.mc?

In kvm_arch_vcpu_create(), vcpu->arch.mc is dynamically allocated via
kvm_s390_new_mmu_cache(). If a subsequent step like gmap_new_child() or
kvm_s390_vcpu_setup() fails, the code jumps here to out_ucontrol_uninit
or out_free_sie_block.

Since these paths return an error without calling
kvm_s390_free_mmu_cache(vcpu->arch.mc), and the core KVM code in
kvm_vm_ioctl_create_vcpu() does not invoke kvm_arch_vcpu_destroy() when
creation fails, it appears this memory could be permanently leaked.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260728170708.294400-1-imbrenda@linux.ibm.com?part=5