Re: [PATCH 14/21] KVM: s390: vsie: Add helper to release gmap shadow

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Incorrect replacement of `radix_tree_insert` with `xa_store` inadvertently overwrites active VSIE pages on collision.
--

--- Patch [14]: [PATCH 14/21] KVM: s390: vsie: Add helper to release gmap shadow ---
commit 4c401f4e9eb6b9bc115d89b58dc2831bda3b8f47
Author: Christoph Schlameuss <schlameuss@linux.ibm.com>

KVM: s390: vsie: Add helper to release gmap shadow
    
Create a helper method release_gmap_shadow_safe() to simplify releasing
the gmap shadow of a vsie_page.
Will be called from multiple places in upcoming patches.

> diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
> index 644b37582b5c8..874ed2a553479 100644
> --- a/arch/s390/kvm/vsie.c
> +++ b/arch/s390/kvm/vsie.c
[ ... ]
> @@ -1623,11 +1632,7 @@ static struct vsie_page *get_vsie_page(struct kvm *kvm, unsigned long addr)

[Severity: High]
Does replacing radix_tree_insert() with xa_store() inadvertently overwrite
active VSIE pages on collision?

Looking at get_vsie_page() just above this diff context:

	/* Double use of the same address or allocation failure. */
	if (xa_store(&kvm->arch.vsie.addr_to_page, addr >> 9, vsie_page, GFP_KERNEL)) {
		put_vsie_page(vsie_page);
		mutex_unlock(&kvm->arch.vsie.mutex);
		return NULL;
	}

xa_store() replaces existing entries unconditionally instead of returning
-EEXIST like radix_tree_insert().

When an existing entry is overwritten, it returns the old entry (a truthy
pointer), triggering the error path but leaving the xarray pointing to the
aborted new page.

>  	mutex_unlock(&kvm->arch.vsie.mutex);
>  
>  	memset(&vsie_page->scb_s, 0, sizeof(struct kvm_s390_sie_block));
> -	if (vsie_page->gmap_cache.gmap) {
> -		scoped_guard(spinlock, &kvm->arch.gmap->children_lock)
> -			if (vsie_page->gmap_cache.gmap)
> -				release_gmap_shadow(vsie_page);
> -	}
> +	release_gmap_shadow_safe(kvm, vsie_page);
>  	prefix_unmapped(vsie_page);
>  	vsie_page->fault_addr = 0;
>  	vsie_page->scb_s.ihcpu = 0xffffU;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-vsie-sigpi-v1-0-ea9f12066408@linux.ibm.com?part=14