Re: [PATCH v3 2/4] KVM: s390: pci: Fix missing error codes and memory unaccounting

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Calling KVM_S390_ZPCIOP_REG_AEN multiple times on the same device causes severe, unbounded resource leaks and state corruption.
--

--- Patch [2]: [PATCH v3 2/4] KVM: s390: pci: Fix missing error codes and memory unaccounting ---
commit bb1306d6a0da97f9d5b884d1e67a7c8d12b6a908
Author: Farhan Ali <alifm@linux.ibm.com>

KVM: s390: pci: Fix missing error codes and memory unaccounting

This commit fixes error paths in kvm_s390_pci_aif_enable() to properly
propagate error codes on failure and rollback memory accounting.

> diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
> index dd17f8a7b4734..9fdb6e383b189 100644
> --- a/arch/s390/kvm/pci.c
> +++ b/arch/s390/kvm/pci.c

[ ... ]

> @@ -293,14 +293,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
>  	}
>  
>  	/* Account for pinned pages, roll back on failure */
> -	if (account_mem(zdev->kzdev, pcount))
> +	rc = account_mem(zdev->kzdev, pcount);

[Severity: High]
This is a pre-existing issue, but can calling the KVM_S390_ZPCIOP_REG_AEN ioctl
multiple times on the same device cause resource leaks?

Looking at kvm_s390_pci_aif_enable(), there doesn't appear to be a check to
verify if Adapter Interruption Forwarding (AIF) is already enabled for the
device. If it is called repeatedly, it seems account_mem() will blindly
overwrite kzdev->user_account and kzdev->mm_account:

arch/s390/kvm/pci.c:account_mem() {
    ...
    kzdev->user_account = user;
    kzdev->mm_account = current->mm;

    return 0;
}

Does this leave the previously allocated airq_iv and sbv bits leaked, along
with the previous user_struct and mmgrab references? It also looks like this
would permanently elevate the locked_vm and pinned_vm counts for those pages,
which could potentially lead to memory exhaustion on the host.

> +	if (rc)
>  		goto unpin2;
>  
>  	/* AISB must be allocated before we can fill in GAITE */
>  	mutex_lock(&aift->aift_lock);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720175819.1723-1-alifm@linux.ibm.com?part=2