Re: [PATCH v6 19/21] KVM: s390: vsie: Add VSIE shadow stat counters

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Permanent leak of a vsie_sca slot and pinned guest pages if xa_insert() fails.
--

commit 9c76bda9b524933159b82f0ac0c72c08101c18e1
Author: Christoph Schlameuss <schlameuss@linux.ibm.com>

KVM: s390: vsie: Add VSIE shadow stat counters

This commit adds new stat counters to VSIE shadowing to verify and monitor
functionality. It tracks the number of allocated and reused SIE control
block (SCB) and system control area (SCA) shadows.

> diff --git a/arch/s390/kvm/s390/vsie.c b/arch/s390/kvm/s390/vsie.c
> index 3a839154fdfed..f8dff6846fb3c 100644
> --- a/arch/s390/kvm/s390/vsie.c
> +++ b/arch/s390/kvm/s390/vsie.c
[ ... ]
> @@ -1134,6 +1134,7 @@ static int get_vsie_sca(struct kvm_vcpu *vcpu, struct kvm_s390_sie_block *scb_o,
>  		kvm->arch.vsie.scas[kvm->arch.vsie.sca_count] = vsie_sca;
>  		kvm->arch.vsie.sca_count++;
>  		atomic_set(&vsie_sca->ref_count, 1);
> +		kvm->stat.vsie_shadow_sca++;
>  	} else {
>  		/* reuse previously created vsie_sca allocation for different osca */
>  		vsie_sca = get_vsie_sca_unused(kvm);

[Severity: High]
Does this code leak a vsie_sca slot and its pinned guest pages if
xa_insert() fails?

Looking at get_vsie_sca() later in this function, if xa_insert() fails
(e.g., due to -ENOMEM):

arch/s390/kvm/s390/vsie.c:get_vsie_sca() {
    ...
    rc = xa_insert(&kvm->arch.vsie.osca_to_sca,
                   vsie_sca->sca_gpa >> SCA_ALIGNMENT_SHIFT,
                   vsie_sca, GFP_KERNEL_ACCOUNT);
    if (rc == -EBUSY)
        rc = 1;

out:
    up_write(&kvm->arch.vsie.vsie_sca_lock);
    if (vsie_sca_new)
        free_vsie_sca(kvm, vsie_sca_new);
    if (vsie_sca)
        *vsie_sca_out = vsie_sca;
    return rc;
}

The error path falls through to the out label without calling unpin_sca()
or put_vsie_sca(). The vsie_sca struct is left with a ref_count of 1 but
is not added to the osca_to_sca xarray. Because its reference count is > 0,
get_vsie_sca_unused() will never reuse it.

Since xa_insert() allocates with GFP_KERNEL_ACCOUNT, could an unprivileged
guest hitting memory limits systematically exhaust the capped pool of
vsie_sca structures, permanently breaking nested virtualization for that VM?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260827-vsie-sigpi-v6-0-8020bb53be52@linux.ibm.com?part=19