Re: [PATCH v3 3/4] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unbounded resource and memory leak on duplicate AEN registrations due to missing state check.
--

--- Patch [3]: [PATCH v3 3/4] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure ---
commit 9b0515651fd32d61d1da226af14173f1630435f4
Author: Farhan Ali <alifm@linux.ibm.com>

KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

The airq_iv_create() can return NULL on failure, but the return value was
never checked. If it fails, zdev->aibv will be NULL and fail when
derefenced in kvm_zpci_set_airq(). Add a NULL check and free the previously
allocated AISB bit and zdev->aisb on failure.

> diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
> index 9fdb6e383b189..85f4fb5d36b38 100644
> --- a/arch/s390/kvm/pci.c
> +++ b/arch/s390/kvm/pci.c
> @@ -310,6 +310,11 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
>  				    AIRQ_IV_GUESTVEC,
>  				    phys_to_virt(fib->fmt0.aibv));
>  
> +	if (!zdev->aibv) {
> +		rc = -ENOMEM;
> +		goto free_aisb;
> +	}
> +

[Severity: High]
This isn't a bug introduced by this patch, but does kvm_s390_pci_aif_enable()
lack a state check to prevent duplicate registrations?

If a guest VM or userspace process issues the KVM_S390_ZPCIOP_REG_AEN ioctl
multiple times for the same device, it appears we proceed through the
function and allocate new resources without freeing previous ones.

Could this result in overwriting pointers like zdev->aibv and zdev->aisb,
along with overwriting account info in account_mem():

arch/s390/kvm/pci.c:account_mem() {
        ...
        kzdev->user_account = user;
        kzdev->mm_account = current->mm;
        ...
}

If the pointers are overwritten on a duplicate call, does this permanently
leak the host resources, including previously pinned pages,
mm_struct/user_struct reference counts, and airq_iv structures?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720175819.1723-1-alifm@linux.ibm.com?part=3