Re: [PATCH v3 07/10] KVM: s390: Return -EINTR if a signal was pending while faulting-in

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `handle_mvpg_pei` function incorrectly leaks positive program exception codes (e.g., PGM_ADDRESSING) to userspace through the KVM_RUN ioctl, instead of injecting them into the guest.
--

--- Patch [7]: [PATCH v3 07/10] KVM: s390: Return -EINTR if a signal was pending while faulting-in ---
commit d199a77e2748da899d6f673aade7f1a0a260ebe8
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>

KVM: s390: Return -EINTR if a signal was pending while faulting-in

If a signal is pending while trying to fault-in a page, return -EINTR
instead of -EAGAIN.

> diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
> index 1980df61ef304..08f2128db1473 100644
> --- a/arch/s390/kvm/intercept.c
> +++ b/arch/s390/kvm/intercept.c
> @@ -369,27 +369,25 @@ static int handle_mvpg_pei(struct kvm_vcpu *vcpu)

[ ... ]

>  	rc = guest_translate_address_with_key(vcpu, vcpu->run->s.regs.gprs[reg1],
>  					      reg1, &dstaddr, GACC_STORE, 0);
>  	if (rc)
>  		return kvm_s390_inject_prog_cond(vcpu, rc);
>  
> +	kvm_s390_retry_instr(vcpu);
> +
>  	do {
> -		rc = kvm_s390_faultin_gfn_simple(vcpu, NULL, gpa_to_gfn(dstaddr), true);
> +		rc = kvm_s390_faultin_gfn_simple(vcpu, NULL, gpa_to_gfn(srcaddr), false);
>  	} while (rc == -EAGAIN);
>  	if (rc)
>  		return rc;

[Severity: High]
This is a pre-existing issue, but does this leak positive program exception
codes to userspace instead of injecting them into the guest?

If a guest executes an MVPG instruction with an unmapped guest address,
kvm_s390_faultin_gfn_simple() can return PGM_ADDRESSING (which is 5).

Because this positive value is returned directly instead of passing it
through kvm_s390_inject_prog_cond(), it appears to propagate all the way up
to the KVM_RUN ioctl return.

Userspace VMMs like QEMU might not update run->exit_reason on a positive
return code, potentially leading to stale exit reasons and state corruption,
and the guest is denied the architectural program exception it is owed.

Should this be wrapped in kvm_s390_inject_prog_cond(vcpu, rc) instead?

> -	kvm_s390_retry_instr(vcpu);
> +	do {
> +		rc = kvm_s390_faultin_gfn_simple(vcpu, NULL, gpa_to_gfn(dstaddr), true);
> +	} while (rc == -EAGAIN);
>  
> -	return 0;
> +	return rc;

[Severity: High]
This is also a pre-existing issue for the same reason. Does the destination
fault-in need the same kvm_s390_inject_prog_cond() wrapper to prevent
positive program exception codes from leaking to userspace?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727150254.236021-1-imbrenda@linux.ibm.com?part=7