[PATCH 0/1] address one of sashiko pre-existing issues

[PATCH 0/1] address one of sashiko pre-existing issues

[Christian Borntraeger]

Heiko, Vasily, Alexander,

this touches s390 nmi code. Please review the change.
Shall we move  MCCK_CODE_NO_GUEST into nmi.h and use
that for masking in s390_backup_mcck_info as well? 


If you are ok with this, 
shall we take this via the kvm tree?



Christian Borntraeger (1):
  KVM: s390: Fix memory corruption by not reinjecting CK machine checks

 arch/s390/include/asm/nmi.h |  1 +
 arch/s390/kernel/nmi.c      |  4 ++--
 arch/s390/kvm/interrupt.c   | 24 ++++++++----------------
 3 files changed, 11 insertions(+), 18 deletions(-)

-- 
2.53.0

[PATCH 1/1] KVM: s390: Fix memory corruption by not reinjecting CK machine checks

[Christian Borntraeger]

Channel-subsystem damage machine checks are for the host channel
subsystem. The guest channel subsystem is emulated in the userspace VMM.
There is no point in forwarding such machine checks into the guest.

This also simplifies the machine check reinjection and avoids kfree of a
stack variable as reported by sashiko.  There might be still machine
checks that have the ck bit set with another bit (like instruction
damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
ED bits already are.

Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
---
 arch/s390/include/asm/nmi.h |  1 +
 arch/s390/kernel/nmi.c      |  4 ++--
 arch/s390/kvm/interrupt.c   | 24 ++++++++----------------
 3 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/arch/s390/include/asm/nmi.h b/arch/s390/include/asm/nmi.h
index 6454c1531854..dd26c20bd231 100644
--- a/arch/s390/include/asm/nmi.h
+++ b/arch/s390/include/asm/nmi.h
@@ -22,6 +22,7 @@
 #define MCCK_CODE_SYSTEM_DAMAGE		BIT(63)
 #define MCCK_CODE_EXT_DAMAGE		BIT(63 - 5)
 #define MCCK_CODE_CP			BIT(63 - 9)
+#define MCCK_CODE_CK			BIT(63 - 11)
 #define MCCK_CODE_STG_ERROR		BIT(63 - 16)
 #define MCCK_CODE_STG_KEY_ERROR		BIT(63 - 18)
 #define MCCK_CODE_STG_DEGRAD		BIT(63 - 19)
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index e17a59d4d5a4..652b98795243 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -345,7 +345,7 @@ static void notrace s390_backup_mcck_info(struct pt_regs *regs)
 	sie_page = container_of(sie_block, struct sie_page, sie_block);
 	mcck_backup = &sie_page->mcck_info;
 	mcck_backup->mcic = get_lowcore()->mcck_interruption_code &
-				~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE);
+			~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK);
 	mcck_backup->ext_damage_code = get_lowcore()->external_damage_code;
 	mcck_backup->failing_storage_address = get_lowcore()->failing_storage_address;
 }
@@ -357,7 +357,7 @@ NOKPROBE_SYMBOL(s390_backup_mcck_info);
 #define ED_STP_ISLAND	6	/* External damage STP island check */
 #define ED_STP_SYNC	7	/* External damage STP sync check */
 
-#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE)
+#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK)
 
 /*
  * machine check handler.
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 009d6a845d59..0d9fbe75dc66 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -3108,9 +3108,7 @@ static int set_adapter_int(struct kvm_kernel_irq_routing_entry *e,
 void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
 				     struct mcck_volatile_info *mcck_info)
 {
-	struct kvm_s390_interrupt_info inti;
 	struct kvm_s390_irq irq = {};
-	struct kvm_s390_mchk_info *mchk;
 	union mci mci;
 	__u64 cr14 = 0;         /* upper bits are not used */
 	int rc;
@@ -3129,20 +3127,14 @@ void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
 	if (mci.w)
 		cr14 |= CR14_WARNING_SUBMASK;
 
-	mchk = mci.ck ? &inti.mchk : &irq.u.mchk;
-	mchk->cr14 = cr14;
-	mchk->mcic = mcck_info->mcic;
-	mchk->ext_damage_code = mcck_info->ext_damage_code;
-	mchk->failing_storage_address = mcck_info->failing_storage_address;
-	if (mci.ck) {
-		/* Inject the floating machine check */
-		inti.type = KVM_S390_MCHK;
-		rc = __inject_vm(vcpu->kvm, &inti);
-	} else {
-		/* Inject the machine check to specified vcpu */
-		irq.type = KVM_S390_MCHK;
-		rc = kvm_s390_inject_vcpu(vcpu, &irq);
-	}
+	irq.u.mchk.cr14 = cr14;
+	irq.u.mchk.mcic = mcck_info->mcic;
+	irq.u.mchk.ext_damage_code = mcck_info->ext_damage_code;
+	irq.u.mchk.failing_storage_address = mcck_info->failing_storage_address;
+
+	/* Inject the machine check to specified vcpu */
+	irq.type = KVM_S390_MCHK;
+	rc = kvm_s390_inject_vcpu(vcpu, &irq);
 	WARN_ON_ONCE(rc);
 }
 
-- 
2.53.0

[PATCH on master] KVM: s390: Fix memory corruption by not reinjecting CK machine checks

[Christian Borntraeger]

Channel-subsystem damage machine checks are for the host channel
subsystem. The guest channel subsystem is emulated in the userspace VMM.
There is no point in forwarding such machine checks into the guest.

This also simplifies the machine check reinjection and avoids kfree of a
stack variable as reported by sashiko.  There might be still machine
checks that have the ck bit set with another bit (like instruction
damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
ED bits already are.

Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
---
 arch/s390/include/asm/nmi.h |  1 +
 arch/s390/kernel/nmi.c      |  4 ++--
 arch/s390/kvm/interrupt.c   | 26 +++++++++-----------------
 3 files changed, 12 insertions(+), 19 deletions(-)

diff --git a/arch/s390/include/asm/nmi.h b/arch/s390/include/asm/nmi.h
index 6454c1531854..dd26c20bd231 100644
--- a/arch/s390/include/asm/nmi.h
+++ b/arch/s390/include/asm/nmi.h
@@ -22,6 +22,7 @@
 #define MCCK_CODE_SYSTEM_DAMAGE		BIT(63)
 #define MCCK_CODE_EXT_DAMAGE		BIT(63 - 5)
 #define MCCK_CODE_CP			BIT(63 - 9)
+#define MCCK_CODE_CK			BIT(63 - 11)
 #define MCCK_CODE_STG_ERROR		BIT(63 - 16)
 #define MCCK_CODE_STG_KEY_ERROR		BIT(63 - 18)
 #define MCCK_CODE_STG_DEGRAD		BIT(63 - 19)
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index e17a59d4d5a4..652b98795243 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -345,7 +345,7 @@ static void notrace s390_backup_mcck_info(struct pt_regs *regs)
 	sie_page = container_of(sie_block, struct sie_page, sie_block);
 	mcck_backup = &sie_page->mcck_info;
 	mcck_backup->mcic = get_lowcore()->mcck_interruption_code &
-				~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE);
+			~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK);
 	mcck_backup->ext_damage_code = get_lowcore()->external_damage_code;
 	mcck_backup->failing_storage_address = get_lowcore()->failing_storage_address;
 }
@@ -357,7 +357,7 @@ NOKPROBE_SYMBOL(s390_backup_mcck_info);
 #define ED_STP_ISLAND	6	/* External damage STP island check */
 #define ED_STP_SYNC	7	/* External damage STP sync check */
 
-#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE)
+#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK)
 
 /*
  * machine check handler.
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 7514d9e2403c..3375a956637b 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -3099,9 +3099,7 @@ static int set_adapter_int(struct kvm_kernel_irq_routing_entry *e,
 void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
 				     struct mcck_volatile_info *mcck_info)
 {
-	struct kvm_s390_interrupt_info inti;
-	struct kvm_s390_irq irq;
-	struct kvm_s390_mchk_info *mchk;
+	struct kvm_s390_irq irq = {};
 	union mci mci;
 	__u64 cr14 = 0;         /* upper bits are not used */
 	int rc;
@@ -3120,20 +3118,14 @@ void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
 	if (mci.w)
 		cr14 |= CR14_WARNING_SUBMASK;
 
-	mchk = mci.ck ? &inti.mchk : &irq.u.mchk;
-	mchk->cr14 = cr14;
-	mchk->mcic = mcck_info->mcic;
-	mchk->ext_damage_code = mcck_info->ext_damage_code;
-	mchk->failing_storage_address = mcck_info->failing_storage_address;
-	if (mci.ck) {
-		/* Inject the floating machine check */
-		inti.type = KVM_S390_MCHK;
-		rc = __inject_vm(vcpu->kvm, &inti);
-	} else {
-		/* Inject the machine check to specified vcpu */
-		irq.type = KVM_S390_MCHK;
-		rc = kvm_s390_inject_vcpu(vcpu, &irq);
-	}
+	irq.u.mchk.cr14 = cr14;
+	irq.u.mchk.mcic = mcck_info->mcic;
+	irq.u.mchk.ext_damage_code = mcck_info->ext_damage_code;
+	irq.u.mchk.failing_storage_address = mcck_info->failing_storage_address;
+
+	/* Inject the machine check to specified vcpu */
+	irq.type = KVM_S390_MCHK;
+	rc = kvm_s390_inject_vcpu(vcpu, &irq);
 	WARN_ON_ONCE(rc);
 }
 
-- 
2.53.0

Re: [PATCH on master] KVM: s390: Fix memory corruption by not reinjecting CK machine checks

[sashiko-bot]

> Channel-subsystem damage machine checks are for the host channel
> subsystem. The guest channel subsystem is emulated in the userspace VMM.
> There is no point in forwarding such machine checks into the guest.
> 
> This also simplifies the machine check reinjection and avoids kfree of a
> stack variable as reported by sashiko.  There might be still machine
> checks that have the ck bit set with another bit (like instruction
> damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
> ED bits already are.
> 
> Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806130410.14254-1-borntraeger@linux.ibm.com?part=1

Re: [PATCH 1/1] KVM: s390: Fix memory corruption by not reinjecting CK machine checks

[Heiko Carstens]

On Thu, Aug 06, 2026 at 02:52:41PM +0200, Christian Borntraeger wrote:
> Channel-subsystem damage machine checks are for the host channel
> subsystem. The guest channel subsystem is emulated in the userspace VMM.
> There is no point in forwarding such machine checks into the guest.
> 
> This also simplifies the machine check reinjection and avoids kfree of a
> stack variable as reported by sashiko.  There might be still machine
> checks that have the ck bit set with another bit (like instruction
> damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
> ED bits already are.
> 
> Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
>  arch/s390/include/asm/nmi.h |  1 +
>  arch/s390/kernel/nmi.c      |  4 ++--
>  arch/s390/kvm/interrupt.c   | 24 ++++++++----------------
>  3 files changed, 11 insertions(+), 18 deletions(-)
> 
> diff --git a/arch/s390/include/asm/nmi.h b/arch/s390/include/asm/nmi.h
> index 6454c1531854..dd26c20bd231 100644
> --- a/arch/s390/include/asm/nmi.h
> +++ b/arch/s390/include/asm/nmi.h
> @@ -22,6 +22,7 @@
>  #define MCCK_CODE_SYSTEM_DAMAGE		BIT(63)
>  #define MCCK_CODE_EXT_DAMAGE		BIT(63 - 5)
>  #define MCCK_CODE_CP			BIT(63 - 9)
> +#define MCCK_CODE_CK			BIT(63 - 11)
>  #define MCCK_CODE_STG_ERROR		BIT(63 - 16)
>  #define MCCK_CODE_STG_KEY_ERROR		BIT(63 - 18)
>  #define MCCK_CODE_STG_DEGRAD		BIT(63 - 19)
> diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
> index e17a59d4d5a4..652b98795243 100644
> --- a/arch/s390/kernel/nmi.c
> +++ b/arch/s390/kernel/nmi.c
> @@ -345,7 +345,7 @@ static void notrace s390_backup_mcck_info(struct pt_regs *regs)
>  	sie_page = container_of(sie_block, struct sie_page, sie_block);
>  	mcck_backup = &sie_page->mcck_info;
>  	mcck_backup->mcic = get_lowcore()->mcck_interruption_code &
> -				~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE);
> +			~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK);
>  	mcck_backup->ext_damage_code = get_lowcore()->external_damage_code;
>  	mcck_backup->failing_storage_address = get_lowcore()->failing_storage_address;
>  }
> @@ -357,7 +357,7 @@ NOKPROBE_SYMBOL(s390_backup_mcck_info);
>  #define ED_STP_ISLAND	6	/* External damage STP island check */
>  #define ED_STP_SYNC	7	/* External damage STP sync check */
>  
> -#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE)
> +#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK)

So what you proposed in the cover-letter is to change the above to:

	mcck_backup->mcic = get_lowcore()->mcck_interruption_code & ~MCCK_CODE_NO_GUEST;

Right? Yes, pleae do that! And this can also go via kvm.

Acked-by: Heiko Carstens <hca@linux.ibm.com>

Re: [PATCH 1/1] KVM: s390: Fix memory corruption by not reinjecting CK machine checks

[Claudio Imbrenda]

On Thu,  6 Aug 2026 14:52:41 +0200
Christian Borntraeger <borntraeger@linux.ibm.com> wrote:

> Channel-subsystem damage machine checks are for the host channel
> subsystem. The guest channel subsystem is emulated in the userspace VMM.
> There is no point in forwarding such machine checks into the guest.
> 
> This also simplifies the machine check reinjection and avoids kfree of a
> stack variable as reported by sashiko.  There might be still machine
> checks that have the ck bit set with another bit (like instruction
> damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
> ED bits already are.
> 
> Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
>  arch/s390/include/asm/nmi.h |  1 +
>  arch/s390/kernel/nmi.c      |  4 ++--
>  arch/s390/kvm/interrupt.c   | 24 ++++++++----------------
>  3 files changed, 11 insertions(+), 18 deletions(-)
> 
> diff --git a/arch/s390/include/asm/nmi.h b/arch/s390/include/asm/nmi.h
> index 6454c1531854..dd26c20bd231 100644
> --- a/arch/s390/include/asm/nmi.h
> +++ b/arch/s390/include/asm/nmi.h
> @@ -22,6 +22,7 @@
>  #define MCCK_CODE_SYSTEM_DAMAGE		BIT(63)
>  #define MCCK_CODE_EXT_DAMAGE		BIT(63 - 5)
>  #define MCCK_CODE_CP			BIT(63 - 9)
> +#define MCCK_CODE_CK			BIT(63 - 11)
>  #define MCCK_CODE_STG_ERROR		BIT(63 - 16)
>  #define MCCK_CODE_STG_KEY_ERROR		BIT(63 - 18)
>  #define MCCK_CODE_STG_DEGRAD		BIT(63 - 19)
> diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
> index e17a59d4d5a4..652b98795243 100644
> --- a/arch/s390/kernel/nmi.c
> +++ b/arch/s390/kernel/nmi.c
> @@ -345,7 +345,7 @@ static void notrace s390_backup_mcck_info(struct pt_regs *regs)
>  	sie_page = container_of(sie_block, struct sie_page, sie_block);
>  	mcck_backup = &sie_page->mcck_info;
>  	mcck_backup->mcic = get_lowcore()->mcck_interruption_code &
> -				~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE);
> +			~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK);

... here, instead of duplicating it?

>  	mcck_backup->ext_damage_code = get_lowcore()->external_damage_code;
>  	mcck_backup->failing_storage_address = get_lowcore()->failing_storage_address;
>  }
> @@ -357,7 +357,7 @@ NOKPROBE_SYMBOL(s390_backup_mcck_info);
>  #define ED_STP_ISLAND	6	/* External damage STP island check */
>  #define ED_STP_SYNC	7	/* External damage STP sync check */
>  
> -#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE)
> +#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK)

it looks like this macro here should have been used above... ^

>  
>  /*
>   * machine check handler.

[...]

Re: [PATCH 1/1] KVM: s390: Fix memory corruption by not reinjecting CK machine checks

[Christian Borntraeger]

Am 06.08.26 um 16:37 schrieb Claudio Imbrenda:
> On Thu,  6 Aug 2026 14:52:41 +0200
> Christian Borntraeger <borntraeger@linux.ibm.com> wrote:
> 
>> Channel-subsystem damage machine checks are for the host channel
>> subsystem. The guest channel subsystem is emulated in the userspace VMM.
>> There is no point in forwarding such machine checks into the guest.
>>
>> This also simplifies the machine check reinjection and avoids kfree of a
>> stack variable as reported by sashiko.  There might be still machine
>> checks that have the ck bit set with another bit (like instruction
>> damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
>> ED bits already are.
>>
>> Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
>> ---
>>   arch/s390/include/asm/nmi.h |  1 +
>>   arch/s390/kernel/nmi.c      |  4 ++--
>>   arch/s390/kvm/interrupt.c   | 24 ++++++++----------------
>>   3 files changed, 11 insertions(+), 18 deletions(-)
>>
>> diff --git a/arch/s390/include/asm/nmi.h b/arch/s390/include/asm/nmi.h
>> index 6454c1531854..dd26c20bd231 100644
>> --- a/arch/s390/include/asm/nmi.h
>> +++ b/arch/s390/include/asm/nmi.h
>> @@ -22,6 +22,7 @@
>>   #define MCCK_CODE_SYSTEM_DAMAGE		BIT(63)
>>   #define MCCK_CODE_EXT_DAMAGE		BIT(63 - 5)
>>   #define MCCK_CODE_CP			BIT(63 - 9)
>> +#define MCCK_CODE_CK			BIT(63 - 11)
>>   #define MCCK_CODE_STG_ERROR		BIT(63 - 16)
>>   #define MCCK_CODE_STG_KEY_ERROR		BIT(63 - 18)
>>   #define MCCK_CODE_STG_DEGRAD		BIT(63 - 19)
>> diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
>> index e17a59d4d5a4..652b98795243 100644
>> --- a/arch/s390/kernel/nmi.c
>> +++ b/arch/s390/kernel/nmi.c
>> @@ -345,7 +345,7 @@ static void notrace s390_backup_mcck_info(struct pt_regs *regs)
>>   	sie_page = container_of(sie_block, struct sie_page, sie_block);
>>   	mcck_backup = &sie_page->mcck_info;
>>   	mcck_backup->mcic = get_lowcore()->mcck_interruption_code &
>> -				~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE);
>> +			~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK);
> 
> ... here, instead of duplicating it?
> 
>>   	mcck_backup->ext_damage_code = get_lowcore()->external_damage_code;
>>   	mcck_backup->failing_storage_address = get_lowcore()->failing_storage_address;
>>   }
>> @@ -357,7 +357,7 @@ NOKPROBE_SYMBOL(s390_backup_mcck_info);
>>   #define ED_STP_ISLAND	6	/* External damage STP island check */
>>   #define ED_STP_SYNC	7	/* External damage STP sync check */
>>   
>> -#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE)
>> +#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK)
> 
> it looks like this macro here should have been used above... ^

Yes, see my comment in the cover letter. We would need to move this define.