Kernel KVM virtualization development
 help / color / mirror / Atom feed
From: Christian Borntraeger <borntraeger@linux.ibm.com>
To: KVM <kvm@vger.kernel.org>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>,
	Janosch Frank <frankja@linux.ibm.com>,
	David Hildenbrand <david@kernel.org>,
	linux-s390 <linux-s390@vger.kernel.org>,
	Claudio Imbrenda <imbrenda@linux.ibm.com>,
	Heiko Carstens <hca@linux.ibm.com>,
	Vasily Gorbik <gor@linux.ibm.com>,
	Alexander Gordeev <agordeev@linux.ibm.com>,
	Sven Schnelle <svens@linux.ibm.com>,
	Matthew Rosato <mjrosato@linux.ibm.com>,
	Douglas Freimuth <freimuth@linux.ibm.com>
Subject: [PATCH v3 3/8] KVM: s390: Zero initialize irq in reinject_machine_check
Date: Wed,  5 Aug 2026 13:04:50 +0200	[thread overview]
Message-ID: <20260805110455.7200-4-borntraeger@linux.ibm.com> (raw)
In-Reply-To: <20260805110455.7200-1-borntraeger@linux.ibm.com>

kvm_s390_reinject_machine_check() fills cr14, mcic, ext_damage_code and
failing_storage_address of the on-stack struct kvm_s390_irq, but struct
kvm_s390_mchk_info also has a pad word and a 16 byte fixed_logout array.
struct mcck_volatile_info carries no logout data, so there is nothing to
copy there and both stay whatever was on the stack.

__inject_mchk() then memcpy()s fixed_logout into the vcpu local
interrupt state unconditionally. This will reach the guest during
deliver and userspace during migration.

Reflecting zeroes is the correct behaviour here, as KVM has no logout
data for a reinjected machine check.

This needs a host machine check while the cpu is in SIE so not trivial
to trigger.

Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
---
 arch/s390/kvm/interrupt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 23f0e0821474..009d6a845d59 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -3109,7 +3109,7 @@ void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
 				     struct mcck_volatile_info *mcck_info)
 {
 	struct kvm_s390_interrupt_info inti;
-	struct kvm_s390_irq irq;
+	struct kvm_s390_irq irq = {};
 	struct kvm_s390_mchk_info *mchk;
 	union mci mci;
 	__u64 cr14 = 0;         /* upper bits are not used */
-- 
2.53.0


  parent reply	other threads:[~2026-08-05 11:05 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-05 11:04 [PATCH v3 0/8] KVM: s390: More fixes Christian Borntraeger
2026-08-05 11:04 ` [PATCH v3 1/8] KVM: s390: Remove user triggerable WARN_ON Christian Borntraeger
2026-08-05 11:15   ` sashiko-bot
2026-08-05 11:04 ` [PATCH v3 2/8] KVM: s390: Zero initialize data structures for inject_pfault_token Christian Borntraeger
2026-08-05 11:31   ` sashiko-bot
2026-08-05 11:04 ` Christian Borntraeger [this message]
2026-08-05 11:29   ` [PATCH v3 3/8] KVM: s390: Zero initialize irq in reinject_machine_check sashiko-bot
2026-08-05 11:04 ` [PATCH v3 4/8] KVM: s390: Fix memory leak in guest debug handling Christian Borntraeger
2026-08-05 11:36   ` sashiko-bot
2026-08-05 11:04 ` [PATCH v3 5/8] KVM: s390: Fix old_data leak in guest debug error path Christian Borntraeger
2026-08-05 11:30   ` sashiko-bot
2026-08-05 11:04 ` [PATCH v3 6/8] KVM: s390: Take srcu when importing watchpoint data Christian Borntraeger
2026-08-05 11:31   ` sashiko-bot
2026-08-05 11:04 ` [PATCH v3 7/8] KVM: s390: Free guest debug data on vcpu destroy Christian Borntraeger
2026-08-05 11:26   ` sashiko-bot
2026-08-05 11:04 ` [PATCH v3 8/8] KVM: s390: Fix length check __import_wp_info() Christian Borntraeger
2026-08-05 11:32   ` sashiko-bot
2026-08-05 11:55 ` [PATCH v3 0/8] KVM: s390: More fixes Claudio Imbrenda

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260805110455.7200-4-borntraeger@linux.ibm.com \
    --to=borntraeger@linux.ibm.com \
    --cc=agordeev@linux.ibm.com \
    --cc=david@kernel.org \
    --cc=frankja@linux.ibm.com \
    --cc=freimuth@linux.ibm.com \
    --cc=gor@linux.ibm.com \
    --cc=hca@linux.ibm.com \
    --cc=imbrenda@linux.ibm.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-s390@vger.kernel.org \
    --cc=mjrosato@linux.ibm.com \
    --cc=svens@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox