* [PATCH v2] KVM: s390: Fix memory corruption by not reinjecting CK machine checks
@ 2026-08-06 14:58 Christian Borntraeger
2026-08-06 15:14 ` sashiko-bot
2026-08-06 15:14 ` Claudio Imbrenda
0 siblings, 2 replies; 3+ messages in thread
From: Christian Borntraeger @ 2026-08-06 14:58 UTC (permalink / raw)
To: Janosch Frank, Claudio Imbrenda
Cc: KVM, Christian Borntraeger, David Hildenbrand, linux-s390,
Heiko Carstens, Vasily Gorbik, Alexander Gordeev, Sven Schnelle
Channel-subsystem damage machine checks are for the host channel
subsystem. The guest channel subsystem is emulated in the userspace VMM.
There is no point in forwarding such machine checks into the guest.
This also simplifies the machine check reinjection and avoids kfree of a
stack variable as reported by sashiko. There might be still machine
checks that have the ck bit set with another bit (like instruction
damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
ED bits already are.
Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
---
v1->v2: move MCCK_CODE_NO_GUEST into nmi.h and reuse that
arch/s390/include/asm/nmi.h | 3 +++
arch/s390/kernel/nmi.c | 5 +----
arch/s390/kvm/interrupt.c | 26 +++++++++-----------------
3 files changed, 13 insertions(+), 21 deletions(-)
diff --git a/arch/s390/include/asm/nmi.h b/arch/s390/include/asm/nmi.h
index 6454c1531854..7919b2b9ac9c 100644
--- a/arch/s390/include/asm/nmi.h
+++ b/arch/s390/include/asm/nmi.h
@@ -22,6 +22,7 @@
#define MCCK_CODE_SYSTEM_DAMAGE BIT(63)
#define MCCK_CODE_EXT_DAMAGE BIT(63 - 5)
#define MCCK_CODE_CP BIT(63 - 9)
+#define MCCK_CODE_CK BIT(63 - 11)
#define MCCK_CODE_STG_ERROR BIT(63 - 16)
#define MCCK_CODE_STG_KEY_ERROR BIT(63 - 18)
#define MCCK_CODE_STG_DEGRAD BIT(63 - 19)
@@ -33,6 +34,8 @@
#define MCCK_CODE_FC_VALID BIT(63 - 43)
#define MCCK_CODE_CPU_TIMER_VALID BIT(63 - 46)
+#define MCCK_CODE_NO_GUEST (MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK)
+
#ifndef __ASSEMBLER__
union mci {
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index e17a59d4d5a4..17297a8b63d9 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -344,8 +344,7 @@ static void notrace s390_backup_mcck_info(struct pt_regs *regs)
sie_page = container_of(sie_block, struct sie_page, sie_block);
mcck_backup = &sie_page->mcck_info;
- mcck_backup->mcic = get_lowcore()->mcck_interruption_code &
- ~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE);
+ mcck_backup->mcic = get_lowcore()->mcck_interruption_code & ~MCCK_CODE_NO_GUEST;
mcck_backup->ext_damage_code = get_lowcore()->external_damage_code;
mcck_backup->failing_storage_address = get_lowcore()->failing_storage_address;
}
@@ -357,8 +356,6 @@ NOKPROBE_SYMBOL(s390_backup_mcck_info);
#define ED_STP_ISLAND 6 /* External damage STP island check */
#define ED_STP_SYNC 7 /* External damage STP sync check */
-#define MCCK_CODE_NO_GUEST (MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE)
-
/*
* machine check handler.
*/
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 7514d9e2403c..3375a956637b 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -3099,9 +3099,7 @@ static int set_adapter_int(struct kvm_kernel_irq_routing_entry *e,
void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
struct mcck_volatile_info *mcck_info)
{
- struct kvm_s390_interrupt_info inti;
- struct kvm_s390_irq irq;
- struct kvm_s390_mchk_info *mchk;
+ struct kvm_s390_irq irq = {};
union mci mci;
__u64 cr14 = 0; /* upper bits are not used */
int rc;
@@ -3120,20 +3118,14 @@ void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
if (mci.w)
cr14 |= CR14_WARNING_SUBMASK;
- mchk = mci.ck ? &inti.mchk : &irq.u.mchk;
- mchk->cr14 = cr14;
- mchk->mcic = mcck_info->mcic;
- mchk->ext_damage_code = mcck_info->ext_damage_code;
- mchk->failing_storage_address = mcck_info->failing_storage_address;
- if (mci.ck) {
- /* Inject the floating machine check */
- inti.type = KVM_S390_MCHK;
- rc = __inject_vm(vcpu->kvm, &inti);
- } else {
- /* Inject the machine check to specified vcpu */
- irq.type = KVM_S390_MCHK;
- rc = kvm_s390_inject_vcpu(vcpu, &irq);
- }
+ irq.u.mchk.cr14 = cr14;
+ irq.u.mchk.mcic = mcck_info->mcic;
+ irq.u.mchk.ext_damage_code = mcck_info->ext_damage_code;
+ irq.u.mchk.failing_storage_address = mcck_info->failing_storage_address;
+
+ /* Inject the machine check to specified vcpu */
+ irq.type = KVM_S390_MCHK;
+ rc = kvm_s390_inject_vcpu(vcpu, &irq);
WARN_ON_ONCE(rc);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH v2] KVM: s390: Fix memory corruption by not reinjecting CK machine checks
2026-08-06 14:58 [PATCH v2] KVM: s390: Fix memory corruption by not reinjecting CK machine checks Christian Borntraeger
@ 2026-08-06 15:14 ` sashiko-bot
2026-08-06 15:14 ` Claudio Imbrenda
1 sibling, 0 replies; 3+ messages in thread
From: sashiko-bot @ 2026-08-06 15:14 UTC (permalink / raw)
To: Christian Borntraeger
Cc: Alexander Gordeev, Vasily Gorbik, linux-s390, Heiko Carstens, kvm
> Channel-subsystem damage machine checks are for the host channel
> subsystem. The guest channel subsystem is emulated in the userspace VMM.
> There is no point in forwarding such machine checks into the guest.
>
> This also simplifies the machine check reinjection and avoids kfree of a
> stack variable as reported by sashiko. There might be still machine
> checks that have the ck bit set with another bit (like instruction
> damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
> ED bits already are.
>
> Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260806145835.31818-1-borntraeger@linux.ibm.com?part=1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v2] KVM: s390: Fix memory corruption by not reinjecting CK machine checks
2026-08-06 14:58 [PATCH v2] KVM: s390: Fix memory corruption by not reinjecting CK machine checks Christian Borntraeger
2026-08-06 15:14 ` sashiko-bot
@ 2026-08-06 15:14 ` Claudio Imbrenda
1 sibling, 0 replies; 3+ messages in thread
From: Claudio Imbrenda @ 2026-08-06 15:14 UTC (permalink / raw)
To: Christian Borntraeger
Cc: Janosch Frank, KVM, David Hildenbrand, linux-s390, Heiko Carstens,
Vasily Gorbik, Alexander Gordeev, Sven Schnelle
On Thu, 6 Aug 2026 16:58:35 +0200
Christian Borntraeger <borntraeger@linux.ibm.com> wrote:
> Channel-subsystem damage machine checks are for the host channel
> subsystem. The guest channel subsystem is emulated in the userspace VMM.
> There is no point in forwarding such machine checks into the guest.
>
> This also simplifies the machine check reinjection and avoids kfree of a
> stack variable as reported by sashiko. There might be still machine
> checks that have the ck bit set with another bit (like instruction
> damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
> ED bits already are.
>
> Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Acked-by: Heiko Carstens <hca@linux.ibm.com>
Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
> ---
> v1->v2: move MCCK_CODE_NO_GUEST into nmi.h and reuse that
>
> arch/s390/include/asm/nmi.h | 3 +++
> arch/s390/kernel/nmi.c | 5 +----
> arch/s390/kvm/interrupt.c | 26 +++++++++-----------------
> 3 files changed, 13 insertions(+), 21 deletions(-)
>
> diff --git a/arch/s390/include/asm/nmi.h b/arch/s390/include/asm/nmi.h
> index 6454c1531854..7919b2b9ac9c 100644
> --- a/arch/s390/include/asm/nmi.h
> +++ b/arch/s390/include/asm/nmi.h
> @@ -22,6 +22,7 @@
> #define MCCK_CODE_SYSTEM_DAMAGE BIT(63)
> #define MCCK_CODE_EXT_DAMAGE BIT(63 - 5)
> #define MCCK_CODE_CP BIT(63 - 9)
> +#define MCCK_CODE_CK BIT(63 - 11)
> #define MCCK_CODE_STG_ERROR BIT(63 - 16)
> #define MCCK_CODE_STG_KEY_ERROR BIT(63 - 18)
> #define MCCK_CODE_STG_DEGRAD BIT(63 - 19)
> @@ -33,6 +34,8 @@
> #define MCCK_CODE_FC_VALID BIT(63 - 43)
> #define MCCK_CODE_CPU_TIMER_VALID BIT(63 - 46)
>
> +#define MCCK_CODE_NO_GUEST (MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK)
> +
> #ifndef __ASSEMBLER__
>
> union mci {
> diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
> index e17a59d4d5a4..17297a8b63d9 100644
> --- a/arch/s390/kernel/nmi.c
> +++ b/arch/s390/kernel/nmi.c
> @@ -344,8 +344,7 @@ static void notrace s390_backup_mcck_info(struct pt_regs *regs)
>
> sie_page = container_of(sie_block, struct sie_page, sie_block);
> mcck_backup = &sie_page->mcck_info;
> - mcck_backup->mcic = get_lowcore()->mcck_interruption_code &
> - ~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE);
> + mcck_backup->mcic = get_lowcore()->mcck_interruption_code & ~MCCK_CODE_NO_GUEST;
> mcck_backup->ext_damage_code = get_lowcore()->external_damage_code;
> mcck_backup->failing_storage_address = get_lowcore()->failing_storage_address;
> }
> @@ -357,8 +356,6 @@ NOKPROBE_SYMBOL(s390_backup_mcck_info);
> #define ED_STP_ISLAND 6 /* External damage STP island check */
> #define ED_STP_SYNC 7 /* External damage STP sync check */
>
> -#define MCCK_CODE_NO_GUEST (MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE)
> -
> /*
> * machine check handler.
> */
> diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
> index 7514d9e2403c..3375a956637b 100644
> --- a/arch/s390/kvm/interrupt.c
> +++ b/arch/s390/kvm/interrupt.c
> @@ -3099,9 +3099,7 @@ static int set_adapter_int(struct kvm_kernel_irq_routing_entry *e,
> void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
> struct mcck_volatile_info *mcck_info)
> {
> - struct kvm_s390_interrupt_info inti;
> - struct kvm_s390_irq irq;
> - struct kvm_s390_mchk_info *mchk;
> + struct kvm_s390_irq irq = {};
> union mci mci;
> __u64 cr14 = 0; /* upper bits are not used */
> int rc;
> @@ -3120,20 +3118,14 @@ void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
> if (mci.w)
> cr14 |= CR14_WARNING_SUBMASK;
>
> - mchk = mci.ck ? &inti.mchk : &irq.u.mchk;
> - mchk->cr14 = cr14;
> - mchk->mcic = mcck_info->mcic;
> - mchk->ext_damage_code = mcck_info->ext_damage_code;
> - mchk->failing_storage_address = mcck_info->failing_storage_address;
> - if (mci.ck) {
> - /* Inject the floating machine check */
> - inti.type = KVM_S390_MCHK;
> - rc = __inject_vm(vcpu->kvm, &inti);
> - } else {
> - /* Inject the machine check to specified vcpu */
> - irq.type = KVM_S390_MCHK;
> - rc = kvm_s390_inject_vcpu(vcpu, &irq);
> - }
> + irq.u.mchk.cr14 = cr14;
> + irq.u.mchk.mcic = mcck_info->mcic;
> + irq.u.mchk.ext_damage_code = mcck_info->ext_damage_code;
> + irq.u.mchk.failing_storage_address = mcck_info->failing_storage_address;
> +
> + /* Inject the machine check to specified vcpu */
> + irq.type = KVM_S390_MCHK;
> + rc = kvm_s390_inject_vcpu(vcpu, &irq);
> WARN_ON_ONCE(rc);
> }
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-06 15:15 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-06 14:58 [PATCH v2] KVM: s390: Fix memory corruption by not reinjecting CK machine checks Christian Borntraeger
2026-08-06 15:14 ` sashiko-bot
2026-08-06 15:14 ` Claudio Imbrenda
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox