From: Farhan Ali <alifm@linux.ibm.com>
To: stable@vger.kernel.org, gregkh@linuxfoundation.org, sashal@kernel.org
Cc: alifm@linux.ibm.com,
Christian Borntraeger <borntraeger@linux.ibm.com>,
Matthew Rosato <mjrosato@linux.ibm.com>
Subject: [PATCH v3 3/5] KVM: s390: pci: Fix missing error codes and memory unaccounting
Date: Mon, 17 Aug 2026 13:16:04 -0700 [thread overview]
Message-ID: <20260817201606.3194-4-alifm@linux.ibm.com> (raw)
In-Reply-To: <20260817201606.3194-1-alifm@linux.ibm.com>
In kvm_s390_pci_aif_enable() two error paths failed to set an error code,
causing the function to return 0 on failure. It also failed to rollback
memory accounting on failure. Fix both by propagating an error code on
failure and calling unaccount_mem() in the cleanup path.
Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Cc: stable@vger.kernel.org
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
(cherry picked from commit f86842e4d6c482300f4567f492d512c9ccf5bc4f)
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
---
arch/s390/kvm/pci.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
index 4b1ed363b1ef..a6f6d5ddb0e3 100644
--- a/arch/s390/kvm/pci.c
+++ b/arch/s390/kvm/pci.c
@@ -315,14 +315,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
}
/* Account for pinned pages, roll back on failure */
- if (account_mem(zdev->kzdev, pcount))
+ rc = account_mem(zdev->kzdev, pcount);
+ if (rc)
goto unpin2;
/* AISB must be allocated before we can fill in GAITE */
mutex_lock(&aift->aift_lock);
bit = airq_iv_alloc_bit(aift->sbv);
- if (bit == -1UL)
+ if (bit == -1UL) {
+ rc = -ENOMEM;
goto unlock;
+ }
zdev->aisb = bit; /* store the summary bit number */
zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA |
AIRQ_IV_BITLOCK |
@@ -374,6 +377,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
airq_iv_free_bit(aift->sbv, zdev->aisb);
zdev->aisb = 0;
unlock:
+ if (pcount > 0)
+ unaccount_mem(zdev->kzdev, pcount);
mutex_unlock(&aift->aift_lock);
unpin2:
if (fib->fmt0.sum == 1)
--
2.43.0
next prev parent reply other threads:[~2026-08-17 20:16 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-17 20:16 [PATCH v3 stable 6.1 0/5] s390 KVM PCI backports for 6.1 Farhan Ali
2026-08-17 20:16 ` [PATCH v3 1/5] kernel/user: Allow user_struct::locked_vm to be usable for iommufd Farhan Ali
2026-08-17 21:24 ` Bradley Morgan
2026-08-17 21:33 ` Bradley Morgan
2026-08-17 20:16 ` [PATCH v3 2/5] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Farhan Ali
2026-08-17 20:16 ` Farhan Ali [this message]
2026-08-17 20:16 ` [PATCH v3 4/5] KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali
2026-08-17 20:16 ` [PATCH v3 5/5] KVM: s390: pci: Fix aisb calculation Farhan Ali
2026-08-19 3:32 ` [PATCH v3 stable 6.1 0/5] s390 KVM PCI backports for 6.1 Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260817201606.3194-4-alifm@linux.ibm.com \
--to=alifm@linux.ibm.com \
--cc=borntraeger@linux.ibm.com \
--cc=gregkh@linuxfoundation.org \
--cc=mjrosato@linux.ibm.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox