Re: [PATCH 13/21] KVM: s390: vsie: Add helper to pin multiple guest pages

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Incorrect address calculation for unaligned GPAs in `pin_guest_pages`, leading to data corruption for multi-page contiguous buffers.
--

--- Patch [13]: [PATCH 13/21] KVM: s390: vsie: Add helper to pin multiple guest pages ---
commit b2d504ec12f509941a6b52b4ad1605645f085955
Author: Christoph Schlameuss <schlameuss@linux.ibm.com>

KVM: s390: vsie: Add helper to pin multiple guest pages
    
This commit introduces helpers to pin and unpin multiple consecutive guest
pages in guest-1. It moves the existing pin and unpin methods to avoid
forward declarations and iterates over pages to store guest and host addresses.

> diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
> index 1734215ae73a9..644b37582b5c8 100644
> --- a/arch/s390/kvm/vsie.c
> +++ b/arch/s390/kvm/vsie.c

[ ... ]

> @@ -240,6 +245,40 @@ static void unpin_guest_page(struct kvm *kvm, gpa_t gpa, hpa_t hpa)
>  	mark_page_dirty(kvm, gpa_to_gfn(gpa));
>  }
>  
> +/* unpin multiple guest pages pinned with pin_guest_pages() */
> +static void unpin_guest_pages(struct kvm *kvm, struct kvm_address_pair *addr, unsigned int nr_pages)
> +{
> +	int i;
> +
> +	for (i = 0; i < nr_pages; i++) {
> +		unpin_guest_page(kvm, addr[i].gpa, addr[i].hpa);
> +		addr[i].gpa = 0;
> +		addr[i].hpa = 0;
> +	}
> +}
> +
> +/* pin nr_pages consecutive guest pages */
> +static int pin_guest_pages(struct kvm *kvm, gpa_t gpa, unsigned int nr_pages,
> +			   struct kvm_address_pair *addr)
> +{
> +	hpa_t hpa;
> +	int i, rc;
> +
> +	/* the guest pages may not be mapped continuously, so pin each page */
> +	for (i = 0; i < nr_pages; i++) {
> +		rc = pin_guest_page(kvm, gpa + PAGE_SIZE * i, &hpa);

[Severity: Medium]
Could this address calculation cause issues if the initial gpa is unaligned?

If a caller passes an unaligned gpa to pin_guest_pages() (for example, 0x1010),
adding PAGE_SIZE * i propagates this initial page offset to every subsequent 
page. This would mean the calculation requests 0x2010, 0x3010, and so on,
skipping the guest memory between 0x2000 and 0x200F.

Would it be safer to align the gpa calculation for the subsequent pages to
ensure a truly contiguous buffer is correctly pinned?

> +		if (rc)
> +			goto err;
> +		addr[i].gpa = gpa + PAGE_SIZE * i;
> +		addr[i].hpa = hpa;
> +	}
> +	return i;
> +
> +err:
> +	unpin_guest_pages(kvm, addr, i);
> +	return -EFAULT;
> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-vsie-sigpi-v1-0-ea9f12066408@linux.ibm.com?part=13