Re: [PATCH v2 4/8] KVM: s390: Fix guest / virtual address confusion in _essa_clear_cbrl()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] ptep_zap_softleaf_entry unconditionally calls swap_put_entries_direct for all non-present PTEs, including migration and device private entries, leading to WARN_ON_ONCE and potential reference leaks.
--

commit 9ec1cdb739d15e125c9d1bb7c4db08fb59c07068
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>

KVM: s390: Fix guest / virtual address confusion in _essa_clear_cbrl()

This patch fixes a bug where gmap_helper_zap_one_page was being called with a
guest absolute address instead of the expected host virtual address. It
resolves the issue by converting the address to a host virtual address before
performing the zap.

> diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
> index cc0553da14cbb..447ec7ed423dc 100644
> --- a/arch/s390/kvm/priv.c
> +++ b/arch/s390/kvm/priv.c
[ ... ]
> @@ -1199,8 +1200,11 @@ static void _essa_clear_cbrl(struct kvm_vcpu *vcpu, unsigned long *cbrl, int len
>  		if (!ptep || ptep->s.pr)
>  			continue;
>  		pgste = pgste_get_lock(ptep);
> -		if (pgste.usage == PGSTE_GPS_USAGE_UNUSED || pgste.zero)
> -			gmap_helper_zap_one_page(vcpu->kvm->mm, cbrl[i]);
> +		if (pgste.usage == PGSTE_GPS_USAGE_UNUSED || pgste.zero) {
> +			hva = gpa_to_hva(vcpu->kvm, cbrl[i]);
> +			if (!kvm_is_error_hva(hva))
> +				gmap_helper_zap_one_page(vcpu->kvm->mm, hva);
                                ^^^^^^^^^^^^^^^^^^^^^^^^
[Severity: High]
This is a pre-existing issue, but does fixing the address passed to
gmap_helper_zap_one_page expose a bug when encountering non-present PTEs?

Looking at gmap_helper_zap_one_page in arch/s390/mm/gmap_helpers.c, it
dispatches all pte_swap entries to ptep_zap_softleaf_entry:

    if (pte_swap(*ptep)) {
        ptep_zap_softleaf_entry(mm, softleaf_from_pte(*ptep));
        pte_clear(mm, vmaddr, ptep);
    }

In ptep_zap_softleaf_entry, swap_put_entries_direct is called
unconditionally. For non-genuine swap entries like migration or device
private entries, get_swap_device returns NULL, which causes
swap_put_entries_direct to hit a WARN_ON_ONCE and return early.

Furthermore, for device private entries, the required folio teardown sequence
(normally performed by zap_nonpresent_ptes) is completely skipped. Since
pte_clear is then called, could this lead to a permanent folio reference leak
in addition to triggering a kernel warning?

> +		}
>  		pgste_set_unlock(ptep, pgste);
>  	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260601152951.196859-1-imbrenda@linux.ibm.com?part=4