Re: [PATCH v5 10/21] KVM: s390: vsie: Refactor kvm_s390_vsie_destroy and extract reusable methods

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly introduced helper `kvm_s390_vsie_destroy_page()` calls `unpin_scb()` with incorrect arguments and types, causing a direct build break and a logical panic.
--

commit 76eef6d237151922051461101295712b30214ae6
Author: Christoph Schlameuss <schlameuss@linux.ibm.com>

KVM: s390: vsie: Refactor kvm_s390_vsie_destroy and extract reusable methods

This commit refactors kvm_s390_vsie_destroy() by extracting the 
gmap shadow release logic into a safe helper and creating 
kvm_s390_vsie_destroy_page() to reduce nesting. These helper 
methods are intended for reuse in upcoming patches.

> diff --git a/arch/s390/kvm/s390/vsie.c b/arch/s390/kvm/s390/vsie.c
> index 75676f493ab24..5e41dd151f8e4 100644
> --- a/arch/s390/kvm/s390/vsie.c
> +++ b/arch/s390/kvm/s390/vsie.c

[ ... ]

> @@ -1658,24 +1665,29 @@ void kvm_s390_vsie_init(struct kvm *kvm)
>  	xa_init_flags(&kvm->arch.vsie.addr_to_page, XA_FLAGS_ACCOUNT);
>  }
>  
> +static void kvm_s390_vsie_destroy_page(struct kvm *kvm, struct vsie_page *vsie_page)
> +{
> +	unpin_scb(kvm, vsie_page);

[Severity: High]
Does this code call unpin_scb() with the correct arguments?

At this point in the series, unpin_scb() is defined as:

static void unpin_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page,
                      gpa_t gpa)

This call passes only 2 arguments instead of 3, and provides a struct kvm *
instead of the expected struct kvm_vcpu *, which breaks the build.

Additionally, could this cause a panic when executing kvm_s390_vsie_destroy()
during VM teardown (a path reachable by untrusted userspace)?

At this stage in the series, vsie_page->scb_o is already unpinned and
set to NULL for cached pages. Calling unpin_scb() here will unconditionally
call virt_to_phys(vsie_page->scb_o), which panics when operating on NULL.

Note that this appears to be a patch splitting error where teardown code
intended for a later patch was introduced too early. The build and logic
errors are resolved later in the series by commit
5c64511a5db61f1b968b748560aa62a1a39b08a9 ('KVM: s390: vsie: Lazily keep
original scb pinned after vsie exit').

> +	release_gmap_shadow_safe(kvm, vsie_page);
> +	free_vsie_page(vsie_page);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826-vsie-sigpi-v5-0-cf471edb46b2@linux.ibm.com?part=10