From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D85B7442366; Mon, 17 Aug 2026 13:57:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786975065; cv=none; b=k4ASgR18S68iUMaF6phV57/2+GLBph+KXXZkDEP0A+7UwFPKwllP8FdGR5xxT+aVfSf4rkEqY0hw27/sAI2aJSPYmTB6q9P76tJkDSVs/D3qlqwQdK5PUPboBrOb+3rHKB4Ik+4dTfM8TO2+cxZi7jh0hGIZZ3iTv2ggpFlZ+Q8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786975065; c=relaxed/simple; bh=bZWBsx1i+Dc/ZAmsdnH+qkGEA6Z4TG1rcoi7V4zSnVk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ng3oJfy4LdP+T8CbnLoSeERqyMRvEGuZnOZlRlrrRDiZLiZfR4vf/bZ5vB4HRDdC9nVXbeqimoWKBbm/lnL0O4zn5CEVIiuXUGG3rTjVwXfVpo77Pb/hxq2ZH6ODEHy3v7sBGtpd0BRFR/6wYoAlBa8tXzwvqRK0vnmstYtjRQ4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1aE3oOAl; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="1aE3oOAl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 378E91F000E9; Mon, 17 Aug 2026 13:57:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786975064; bh=QdxujJClhkaBH0gkL6Nz4fbQaAzOKsZidjZO9e3Nk6w=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=1aE3oOAlAAdY4LXaHmLMyf1XoHGT43luXuYFjtXXbbqrOXlRgKWS4V9WAXq+kywp7 oTCNLqclvGqDUUTedn1fMd5thdLWXEFv6ySfANmighS79E3bmCtsv5vm5jqQZk2N0b t1H5yF0d0JGACXgNYfmZ+qESgrVL06uNyZI4ot+w= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Matthew Rosato , Niklas Schnelle , Christian Borntraeger , Farhan Ali , Sasha Levin Subject: [PATCH 6.18 149/250] KVM: s390: pci: Fix aisb calculation Date: Mon, 17 Aug 2026 15:31:50 +0200 Message-ID: <20260817132542.637753004@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132536.466235697@linuxfoundation.org> References: <20260817132536.466235697@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matthew Rosato [ Upstream commit 0cfe660559e857d7c00ab86c73e4510ce069086f ] The current implementation of aisb calculation will erroneously index via an unsigned long * as well as multiply by 8B for every 64-bits in the offset; only one or the other is required. This throws off aisb calculations once the number of devices exceeds 64, and can result in out-of-bounds access as well as failure to indicate summary bits associated with those devices in guests. Fix this by converting to a physical address before applying the offset, as is already done in arch/s390/pci/pci_irq.c. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") Signed-off-by: Matthew Rosato Reviewed-by: Niklas Schnelle Signed-off-by: Christian Borntraeger [alifm@linux.ibm.com: Resolved merge conflict] Signed-off-by: Farhan Ali Signed-off-by: Sasha Levin --- arch/s390/kvm/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index b729457d30167..2ac7e13640931 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -167,7 +167,7 @@ static int kvm_zpci_set_airq(struct zpci_dev *zdev) fib.fmt0.noi = airq_iv_end(zdev->aibv); fib.fmt0.aibv = virt_to_phys(zdev->aibv->vector); fib.fmt0.aibvo = 0; - fib.fmt0.aisb = virt_to_phys(aift->sbv->vector + (zdev->aisb / 64) * 8); + fib.fmt0.aisb = virt_to_phys(aift->sbv->vector) + (zdev->aisb / 64) * 8; fib.fmt0.aisbo = zdev->aisb & 63; fib.gd = zdev->gisa; -- 2.53.0