Re: [PATCH v2 3/8] KVM: s390: Avoid potentially sleeping while atomic when zapping pages

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] ptep_zap_softleaf_entry unconditionally calls swap_put_entries_direct on non-present PTEs, which triggers warnings and fails when processing migration entries.
--

commit 98730d8ed19b62efe3e43850095ef240bb137294
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>

KVM: s390: Avoid potentially sleeping while atomic when zapping pages

This commit factors out try_get_locked_pte(), which performs a spin_trylock()
instead of blocking and avoids allocating missing page tables. This new
function is used to prevent sleeping while atomic when zapping pages.

> diff --git a/arch/s390/mm/gmap_helpers.c b/arch/s390/mm/gmap_helpers.c
> index f8789ffcc05ca..396207163ca6c 100644
> --- a/arch/s390/mm/gmap_helpers.c
> +++ b/arch/s390/mm/gmap_helpers.c
> @@ -34,6 +34,70 @@ static void ptep_zap_softleaf_entry(struct mm_struct *mm, softleaf_t entry)
>  	swap_put_entries_direct(entry, 1);

[Severity: High]
This isn't a bug introduced by this patch, but does ptep_zap_softleaf_entry()
incorrectly pass non-swap softleaf entries to generic swap reclaim code?

The function acts as a dispatch for non-present PTEs, handling both swap and
migration entries, but unconditionally passes the entry to
swap_put_entries_direct().

Migration entries use swap types greater than MAX_SWAPFILES. When
swap_put_entries_direct() passes this to get_swap_device(), it will fail,
printing a 'Bad swap file entry' error to the kernel log and hitting a
WARN_ON_ONCE(!si).

Because this path is reachable by a guest issuing ESSA instructions on memory
regions undergoing host-side migration, could a malicious guest intentionally
trigger this path to spam the host's dmesg logs on every migrated page,
creating a host-side denial of service?

>  }
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260601152951.196859-1-imbrenda@linux.ibm.com?part=3