Re: [PATCH v2 2/4] KVM: s390: pci: Fix missing error codes and memory unaccounting

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Repeated KVM_S390_ZPCIOP_REG_AEN ioctls on the same device leak previously allocated resources and references.
--

--- Patch [2]: [PATCH v2 2/4] KVM: s390: pci: Fix missing error codes and memory unaccounting ---
commit d30a6fbb3e26fd01708c6bf05d003dbb34124513
Author: Farhan Ali <alifm@linux.ibm.com>

KVM: s390: pci: Fix missing error codes and memory unaccounting

In kvm_s390_pci_aif_enable() two error paths failed to set error code,
causing the function to return 0 on failure. It also failed to rollback
memory accounting on failure. Fix both by propagating error code on
failure and calling unaccount_mem() in the cleanup path.

> diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
> index dd17f8a7b4734..9fdb6e383b189 100644
> --- a/arch/s390/kvm/pci.c
> +++ b/arch/s390/kvm/pci.c
> @@ -293,14 +293,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
>  	}
>  
>  	/* Account for pinned pages, roll back on failure */
> -	if (account_mem(zdev->kzdev, pcount))
> +	rc = account_mem(zdev->kzdev, pcount);
> +	if (rc)
>  		goto unpin2;
>  
>  	/* AISB must be allocated before we can fill in GAITE */
>  	mutex_lock(&aift->aift_lock);
>  	bit = airq_iv_alloc_bit(aift->sbv);
> -	if (bit == -1UL)
> +	if (bit == -1UL) {
> +		rc = -ENOMEM;
>  		goto unlock;
> +	}
>  	zdev->aisb = bit; /* store the summary bit number */
>  	zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA |

[Severity: High]
This isn't a bug introduced by this patch, but does calling
KVM_S390_ZPCIOP_REG_AEN multiple times on the same device leak previously
allocated resources?

If a user-space process calls the ioctl multiple times,
kvm_s390_pci_aif_enable() appears to unconditionally allocate and pin new
resources.

Will this overwrite zdev->aisb and zdev->aibv without freeing the
previously allocated airq_iv structures?

Additionally, when this calls account_mem(), does it overwrite
kzdev->user_account and kzdev->mm_account without releasing the previous
references, such as by using free_uid and mmdrop?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716175241.1039-1-alifm@linux.ibm.com?part=2