Re: [PATCH v2 7/7] KVM: s390: Return -EINTR if a signal was pending while faulting-in

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Returning -EINTR from kvm_s390_faultin_gfn bypasses explicit -EAGAIN handling in callers, causing skipped instructions (missed PSW rewinds) and failed PV_UNPACK ioctl retries.
--

--- Patch [7]: [PATCH v2 7/7] KVM: s390: Return -EINTR if a signal was pending while faulting-in ---
commit f252af4580d9ab98014328b1d85bbc46f505b01c
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>

KVM: s390: Return -EINTR if a signal was pending while faulting-in
    
If a signal is pending while trying to fault-in a page, return -EINTR
instead of -EAGAIN.

> diff --git a/arch/s390/kvm/faultin.c b/arch/s390/kvm/faultin.c
> index fee80047bd94f..235b9c66ce542 100644
> --- a/arch/s390/kvm/faultin.c
> +++ b/arch/s390/kvm/faultin.c
> @@ -93,7 +93,7 @@ int kvm_s390_faultin_gfn(struct kvm_vcpu *vcpu, struct kvm *kvm, struct guest_fa
>  			return PGM_ADDRESSING;
>  		/* Signal pending: try again. */
>  		if (f->pfn == KVM_PFN_ERR_SIGPENDING)
> -			return -EAGAIN;
> +			return -EINTR;

[Severity: Critical]
Will returning -EINTR here bypass explicit -EAGAIN handling in callers?

For example, in arch/s390/kvm/intercept.c:handle_mvpg_pei(), there is
the following loop:

	do {
		rc = kvm_s390_faultin_gfn_simple(vcpu, NULL, gpa_to_gfn(dstaddr), true);
	} while (rc == -EAGAIN);
	if (rc)
		return rc;

	kvm_s390_retry_instr(vcpu);

If a non-fatal signal is pending, handle_mvpg_pei() will return -EINTR
and bypass kvm_s390_retry_instr(vcpu). Since the hardware has already
advanced the guest PSW for the intercept, does exiting to userspace without
rewinding the PSW cause the guest to resume at the next instruction,
silently skipping the MVPG instruction?

Similarly, in arch/s390/kvm/vsie.c:vsie_run(), returning -EINTR from
map_prefix() skips the rc == -EAGAIN check:

		rc = map_prefix(vcpu, vsie_page, sg);
...
		if (rc == -EAGAIN)
			rc = 0;

		/* Exit the loop if the guest needs to process the intercept */
		if (rc || scb_s->icptcode)
			break;

This breaks out of vsie_run() and exits to userspace without rewinding the
SIE instruction.

Finally, in arch/s390/kvm/pv.c:kvm_s390_pv_unpack(), the loop handles -EAGAIN
explicitly to absorb non-fatal signals:

	while (offset < size) {
		ret = unpack_one(kvm, addr, tweak, offset, rc, rrc);
		if (ret == -EAGAIN) {
			cond_resched();
			if (fatal_signal_pending(current))
				break;
			continue;
		}
		if (ret)
			break;

Returning -EINTR terminates the unpacking prematurely. When userspace
retries the KVM_PV_UNPACK ioctl, it restarts from offset 0, which could
cause the Ultravisor to reject the attempt to unpack already-secured pages,
permanently failing the VM boot process.

>  		/* Check if it's read-only memory; don't try to actually handle that case. */
>  		if (f->pfn == KVM_PFN_ERR_RO_FAULT)
>  			return -EOPNOTSUPP;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713150857.269954-1-imbrenda@linux.ibm.com?part=7