Re: [GIT PULL v1 19/23] KVM: s390: ucontrol: Add missing locking around gmap_remove_child()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing cleanup of `vcpu->arch.mc` on error paths in `kvm_arch_vcpu_create`.
--

--- Patch [19]: [GIT PULL v1 19/23] KVM: s390: ucontrol: Add missing locking around gmap_remove_child() ---
commit 61cd1afcaa7879de84aab0c942311aadeeda9499
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>

KVM: s390: ucontrol: Add missing locking around gmap_remove_child()

This commit adds missing locking around gmap_remove_child() in the error
handling path of kvm_arch_vcpu_create() for UCONTROL guests.

> diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
> index ba811f0673d10..2741ca323edea 100644
> --- a/arch/s390/kvm/kvm-s390.c
> +++ b/arch/s390/kvm/kvm-s390.c
> @@ -3875,7 +3875,9 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
>  
>  out_ucontrol_uninit:
>  	if (kvm_is_ucontrol(vcpu->kvm)) {
> +		spin_lock(&vcpu->kvm->arch.gmap->children_lock);
>  		gmap_remove_child(vcpu->arch.gmap);
> +		spin_unlock(&vcpu->kvm->arch.gmap->children_lock);
>  		vcpu->arch.gmap = gmap_put(vcpu->arch.gmap);
>  	}
>  out_free_sie_block:

[Severity: High]
This isn't a bug introduced by this patch, but does this error path leak
the mmu cache allocated for the vCPU?

In kvm_arch_vcpu_create() within arch/s390/kvm/kvm-s390.c, if an
unprivileged process repeatedly calls KVM_CREATE_VCPU near its memory
cgroup limit, allocations in kvm_s390_vcpu_setup() can fail. This causes
execution to jump to the out_ucontrol_uninit and out_free_sie_block error
paths.

While these error paths free vcpu->arch.sie_block and handle the child
gmap, it appears they miss calling kvm_s390_free_mmu_cache() to free
vcpu->arch.mc.

Could this result in a permanent memory leak of vcpu->arch.mc and its
topped-up pages when vCPU creation fails?

>  	free_page((unsigned long)(vcpu->arch.sie_block));
>  	return rc;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803160924.236807-1-imbrenda@linux.ibm.com?part=19