[PATCH v3 stable 6.1 0/5] s390 KVM PCI backports for 6.1

[PATCH v3 stable 6.1 0/5] s390 KVM PCI backports for 6.1

[Farhan Ali]

Hi,

This patchset backports the s390 KVM PCI fixes to stable-6.1. The patchset
includes one dependency patch (patch 1) from Jason Gunthorpe, to export
free_uid(). This is needed to resolve a compilation error. I have resolved
all other merge conflicts and tested them on s390.

Thanks
Farhan

Farhan Ali (3):
  KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
  KVM: s390: pci: Fix missing error codes and memory unaccounting
  KVM: s390: pci: Fix resource leak on IRQ registration failure

Jason Gunthorpe (1):
  kernel/user: Allow user_struct::locked_vm to be usable for iommufd

Matthew Rosato (1):
  KVM: s390: pci: Fix aisb calculation

 arch/s390/kvm/pci.c        | 86 +++++++++++++++++++++++++++-----------
 arch/s390/kvm/pci.h        |  2 +
 include/linux/sched/user.h |  2 +-
 kernel/user.c              |  1 +
 4 files changed, 66 insertions(+), 25 deletions(-)

-- 
2.43.0

[PATCH v3 1/5] kernel/user: Allow user_struct::locked_vm to be usable for iommufd

[Farhan Ali]

From: Jason Gunthorpe <jgg@nvidia.com>

Following the pattern of io_uring, perf, skb, and bpf, iommfd will use
user->locked_vm for accounting pinned pages. Ensure the value is included
in the struct and export free_uid() as iommufd is modular.

user->locked_vm is the good accounting to use for ulimit because it is
per-user, and the security sandboxing of locked pages is not supposed to
be per-process. Other places (vfio, vdpa and infiniband) have used
mm->pinned_vm and/or mm->locked_vm for accounting pinned pages, but this
is only per-process and inconsistent with the new FOLL_LONGTERM users in
the kernel.

Concurrent work is underway to try to put this in a cgroup, so everything
can be consistent and the kernel can provide a FOLL_LONGTERM limit that
actually provides security.

Link: https://lore.kernel.org/r/7-v6-a196d26f289e+11787-iommufd_jgg@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Yi Liu <yi.l.liu@intel.com>
Tested-by: Lixiao Yang <lixiao.yang@intel.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
(cherry picked from commit ce5a23c835aa0f0a931b5bcde1e7811f951b0146)
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
---
 include/linux/sched/user.h | 2 +-
 kernel/user.c              | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h
index f054d0360a75..4cc52698e214 100644
--- a/include/linux/sched/user.h
+++ b/include/linux/sched/user.h
@@ -25,7 +25,7 @@ struct user_struct {
 
 #if defined(CONFIG_PERF_EVENTS) || defined(CONFIG_BPF_SYSCALL) || \
 	defined(CONFIG_NET) || defined(CONFIG_IO_URING) || \
-	defined(CONFIG_VFIO_PCI_ZDEV_KVM)
+	defined(CONFIG_VFIO_PCI_ZDEV_KVM) || IS_ENABLED(CONFIG_IOMMUFD)
 	atomic_long_t locked_vm;
 #endif
 #ifdef CONFIG_WATCH_QUEUE
diff --git a/kernel/user.c b/kernel/user.c
index e2cf8c22b539..d667debeafd6 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -185,6 +185,7 @@ void free_uid(struct user_struct *up)
 	if (refcount_dec_and_lock_irqsave(&up->__count, &uidhash_lock, &flags))
 		free_user(up, flags);
 }
+EXPORT_SYMBOL_GPL(free_uid);
 
 struct user_struct *alloc_uid(kuid_t uid)
 {
-- 
2.43.0

Re: [PATCH v3 1/5] kernel/user: Allow user_struct::locked_vm to be usable for iommufd

[Bradley Morgan]

On 17 August 2026 21:16:02 BST, Farhan Ali <alifm@linux.ibm.com> wrote:
>From: Jason Gunthorpe <jgg@nvidia.com>
>
>Following the pattern of io_uring, perf, skb, and bpf, iommfd will use
>user->locked_vm for accounting pinned pages. Ensure the value is included
>in the struct and export free_uid() as iommufd is modular.
>
>user->locked_vm is the good accounting to use for ulimit because it is
>per-user, and the security sandboxing of locked pages is not supposed to
>be per-process. Other places (vfio, vdpa and infiniband) have used
>mm->pinned_vm and/or mm->locked_vm for accounting pinned pages, but this
>is only per-process and inconsistent with the new FOLL_LONGTERM users in
>the kernel.
>
>Concurrent work is underway to try to put this in a cgroup, so everything
>can be consistent and the kernel can provide a FOLL_LONGTERM limit that
>actually provides security.
>
>Link: https://lore.kernel.org/r/7-v6-a196d26f289e+11787-iommufd_jgg@nvidia.com
>Reviewed-by: Kevin Tian <kevin.tian@intel.com>
>Reviewed-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Bradley Morgan <include@grrlz.net> # kernel/

>Tested-by: Nicolin Chen <nicolinc@nvidia.com>
>Tested-by: Yi Liu <yi.l.liu@intel.com>
>Tested-by: Lixiao Yang <lixiao.yang@intel.com>
>Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
>Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
>(cherry picked from commit ce5a23c835aa0f0a931b5bcde1e7811f951b0146)
>Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
>---
> include/linux/sched/user.h | 2 +-
> kernel/user.c              | 1 +
> 2 files changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h
>index f054d0360a75..4cc52698e214 100644
>--- a/include/linux/sched/user.h
>+++ b/include/linux/sched/user.h
>@@ -25,7 +25,7 @@ struct user_struct {
> 
> #if defined(CONFIG_PERF_EVENTS) || defined(CONFIG_BPF_SYSCALL) || \
> 	defined(CONFIG_NET) || defined(CONFIG_IO_URING) || \
>-	defined(CONFIG_VFIO_PCI_ZDEV_KVM)
>+	defined(CONFIG_VFIO_PCI_ZDEV_KVM) || IS_ENABLED(CONFIG_IOMMUFD)
> 	atomic_long_t locked_vm;
> #endif
> #ifdef CONFIG_WATCH_QUEUE
>diff --git a/kernel/user.c b/kernel/user.c
>index e2cf8c22b539..d667debeafd6 100644
>--- a/kernel/user.c
>+++ b/kernel/user.c
>@@ -185,6 +185,7 @@ void free_uid(struct user_struct *up)
> 	if (refcount_dec_and_lock_irqsave(&up->__count, &uidhash_lock, &flags))
> 		free_user(up, flags);
> }
>+EXPORT_SYMBOL_GPL(free_uid);
> 
> struct user_struct *alloc_uid(kuid_t uid)
> {
>


Thanks!

Re: [PATCH v3 1/5] kernel/user: Allow user_struct::locked_vm to be usable for iommufd

[Bradley Morgan]

On 17 August 2026 22:24:00 BST, Bradley Morgan <include@grrlz.net> wrote:
>On 17 August 2026 21:16:02 BST, Farhan Ali <alifm@linux.ibm.com> wrote:
>>From: Jason Gunthorpe <jgg@nvidia.com>
>>
>>Following the pattern of io_uring, perf, skb, and bpf, iommfd will use
>>user->locked_vm for accounting pinned pages. Ensure the value is included
>>in the struct and export free_uid() as iommufd is modular.
>>
>>user->locked_vm is the good accounting to use for ulimit because it is
>>per-user, and the security sandboxing of locked pages is not supposed to
>>be per-process. Other places (vfio, vdpa and infiniband) have used
>>mm->pinned_vm and/or mm->locked_vm for accounting pinned pages, but this
>>is only per-process and inconsistent with the new FOLL_LONGTERM users in
>>the kernel.
>>
>>Concurrent work is underway to try to put this in a cgroup, so everything
>>can be consistent and the kernel can provide a FOLL_LONGTERM limit that
>>actually provides security.
>>
>>Link:
>https://lore.kernel.org/r/7-v6-a196d26f289e+11787-iommufd_jgg@nvidia.com
>>Reviewed-by: Kevin Tian <kevin.tian@intel.com>
>>Reviewed-by: Eric Auger <eric.auger@redhat.com>
>
>Reviewed-by: Bradley Morgan <include@grrlz.net> # kernel/
>

Oopsie! I didn't realise it was a backport commit :(

Could you add [PATCH 6.1.x] or something in the title, so I don't mess up
again

>>Tested-by: Nicolin Chen <nicolinc@nvidia.com>
>>Tested-by: Yi Liu <yi.l.liu@intel.com>
>>Tested-by: Lixiao Yang <lixiao.yang@intel.com>
>>Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
>>Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
>>(cherry picked from commit ce5a23c835aa0f0a931b5bcde1e7811f951b0146)
>>Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
>>---
>> include/linux/sched/user.h | 2 +-
>> kernel/user.c              | 1 +
>> 2 files changed, 2 insertions(+), 1 deletion(-)
>>
>>diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h
>>index f054d0360a75..4cc52698e214 100644
>>--- a/include/linux/sched/user.h
>>+++ b/include/linux/sched/user.h
>>@@ -25,7 +25,7 @@ struct user_struct {
>> 
>> #if defined(CONFIG_PERF_EVENTS) || defined(CONFIG_BPF_SYSCALL) || \
>> 	defined(CONFIG_NET) || defined(CONFIG_IO_URING) || \
>>-	defined(CONFIG_VFIO_PCI_ZDEV_KVM)
>>+	defined(CONFIG_VFIO_PCI_ZDEV_KVM) || IS_ENABLED(CONFIG_IOMMUFD)
>> 	atomic_long_t locked_vm;
>> #endif
>> #ifdef CONFIG_WATCH_QUEUE
>>diff --git a/kernel/user.c b/kernel/user.c
>>index e2cf8c22b539..d667debeafd6 100644
>>--- a/kernel/user.c
>>+++ b/kernel/user.c
>>@@ -185,6 +185,7 @@ void free_uid(struct user_struct *up)
>> 	if (refcount_dec_and_lock_irqsave(&up->__count, &uidhash_lock, &flags))
>> 		free_user(up, flags);
>> }
>>+EXPORT_SYMBOL_GPL(free_uid);
>> 
>> struct user_struct *alloc_uid(kuid_t uid)
>> {
>>
>
>
>Thanks!

Thanks!

[PATCH v3 2/5] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages

[Farhan Ali]

The account_mem() and unaccount_mem() functions call get_uid() which
increments the reference count of struct user_struct on every invocation.
But we don't decrement the count by calling free_uid(). It also
accounted/unaccounted the pages against the current->mm. But its possible
the unaccount_mem() can be called from a different process context than the
one that originally pinned the pages.

Let's fix this by storing the pinning process user_struct and mm_struct
when accounting for pinned pages, and subsequently free these resources
when the pages are unpinned.

Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Cc: stable@vger.kernel.org
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
[borntraeger@linux.ibm.com: Fixed whitespace]
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
(cherry picked from commit 36f6999ecde3976731a8bfc0b8e667da6f593069)
[alifm@linux.ibm.com: Resolved merge conflict]
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
---
 arch/s390/kvm/pci.c | 48 ++++++++++++++++++++++++++++++++-------------
 arch/s390/kvm/pci.h |  2 ++
 2 files changed, 36 insertions(+), 14 deletions(-)

diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
index 45fb77ada977..4b1ed363b1ef 100644
--- a/arch/s390/kvm/pci.c
+++ b/arch/s390/kvm/pci.c
@@ -191,34 +191,54 @@ static int kvm_zpci_clear_airq(struct zpci_dev *zdev)
 	return cc ? -EIO : 0;
 }
 
-static inline void unaccount_mem(unsigned long nr_pages)
+static inline void unaccount_mem(struct kvm_zdev *kzdev, unsigned long nr_pages)
 {
-	struct user_struct *user = get_uid(current_user());
+	struct user_struct *user = kzdev->user_account;
+	struct mm_struct *mm_account = kzdev->mm_account;
 
-	if (user)
+	if (user) {
 		atomic_long_sub(nr_pages, &user->locked_vm);
-	if (current->mm)
-		atomic64_sub(nr_pages, &current->mm->pinned_vm);
+		free_uid(user);
+		kzdev->user_account = NULL;
+	}
+
+	if (mm_account) {
+		atomic64_sub(nr_pages, &mm_account->pinned_vm);
+		mmdrop(mm_account);
+		kzdev->mm_account = NULL;
+	}
 }
 
-static inline int account_mem(unsigned long nr_pages)
+static inline int account_mem(struct kvm_zdev *kzdev, unsigned long nr_pages)
 {
 	struct user_struct *user = get_uid(current_user());
 	unsigned long page_limit, cur_pages, new_pages;
+	int rc = 0;
 
 	page_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
 
+	cur_pages = atomic_long_read(&user->locked_vm);
 	do {
-		cur_pages = atomic_long_read(&user->locked_vm);
 		new_pages = cur_pages + nr_pages;
-		if (new_pages > page_limit)
-			return -ENOMEM;
-	} while (atomic_long_cmpxchg(&user->locked_vm, cur_pages,
-					new_pages) != cur_pages);
+		if (new_pages > page_limit) {
+			rc = -ENOMEM;
+			goto out;
+		}
+	} while (!atomic_long_try_cmpxchg(&user->locked_vm, &cur_pages, new_pages));
+
+	if (current->mm) {
+		mmgrab(current->mm);
+		atomic64_add(nr_pages, &current->mm->pinned_vm);
+	}
 
-	atomic64_add(nr_pages, &current->mm->pinned_vm);
+	kzdev->user_account = user;
+	kzdev->mm_account = current->mm;
 
 	return 0;
+
+out:
+	free_uid(user);
+	return rc;
 }
 
 static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
@@ -295,7 +315,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
 	}
 
 	/* Account for pinned pages, roll back on failure */
-	if (account_mem(pcount))
+	if (account_mem(zdev->kzdev, pcount))
 		goto unpin2;
 
 	/* AISB must be allocated before we can fill in GAITE */
@@ -424,7 +444,7 @@ static int kvm_s390_pci_aif_disable(struct zpci_dev *zdev, bool force)
 		pcount++;
 	}
 	if (pcount > 0)
-		unaccount_mem(pcount);
+		unaccount_mem(kzdev, pcount);
 out:
 	mutex_unlock(&aift->aift_lock);
 
diff --git a/arch/s390/kvm/pci.h b/arch/s390/kvm/pci.h
index 486d06ef563f..6beea19cea45 100644
--- a/arch/s390/kvm/pci.h
+++ b/arch/s390/kvm/pci.h
@@ -22,6 +22,8 @@ struct kvm_zdev {
 	struct kvm *kvm;
 	struct zpci_fib fib;
 	struct list_head entry;
+	struct user_struct *user_account;
+	struct mm_struct *mm_account;
 };
 
 struct zpci_gaite {
-- 
2.43.0

[PATCH v3 3/5] KVM: s390: pci: Fix missing error codes and memory unaccounting

[Farhan Ali]

In kvm_s390_pci_aif_enable() two error paths failed to set an error code,
causing the function to return 0 on failure. It also failed to rollback
memory accounting on failure. Fix both by propagating an error code on
failure and calling unaccount_mem() in the cleanup path.

Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Cc: stable@vger.kernel.org
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
(cherry picked from commit f86842e4d6c482300f4567f492d512c9ccf5bc4f)
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
---
 arch/s390/kvm/pci.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
index 4b1ed363b1ef..a6f6d5ddb0e3 100644
--- a/arch/s390/kvm/pci.c
+++ b/arch/s390/kvm/pci.c
@@ -315,14 +315,17 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
 	}
 
 	/* Account for pinned pages, roll back on failure */
-	if (account_mem(zdev->kzdev, pcount))
+	rc = account_mem(zdev->kzdev, pcount);
+	if (rc)
 		goto unpin2;
 
 	/* AISB must be allocated before we can fill in GAITE */
 	mutex_lock(&aift->aift_lock);
 	bit = airq_iv_alloc_bit(aift->sbv);
-	if (bit == -1UL)
+	if (bit == -1UL) {
+		rc = -ENOMEM;
 		goto unlock;
+	}
 	zdev->aisb = bit; /* store the summary bit number */
 	zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA |
 				    AIRQ_IV_BITLOCK |
@@ -374,6 +377,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
 	airq_iv_free_bit(aift->sbv, zdev->aisb);
 	zdev->aisb = 0;
 unlock:
+	if (pcount > 0)
+		unaccount_mem(zdev->kzdev, pcount);
 	mutex_unlock(&aift->aift_lock);
 unpin2:
 	if (fib->fmt0.sum == 1)
-- 
2.43.0

[PATCH v3 4/5] KVM: s390: pci: Fix resource leak on IRQ registration failure

[Farhan Ali]

Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns
the error code but doesn't do any resource cleanup thus leaking resources.
Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and
unpinning any pinned pages. While at it, remove dead code that stored FIB
values that were never referenced.

As part of the cleanup, we are also holding the aift_lock a bit longer, as
we hold the lock while executing the MPCIFC instruction. Though this is not
strictly necessary, it means we don't have to drop and re-acquire in the
error case.

Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Cc: stable@vger.kernel.org
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
(cherry picked from commit 5580c9858f1e00f60191eb09c3add359836d60b6)
[alifm@linux.ibm.com: Resolved merge conflict]
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
---
 arch/s390/kvm/pci.c | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
index a6f6d5ddb0e3..8b91f289226b 100644
--- a/arch/s390/kvm/pci.c
+++ b/arch/s390/kvm/pci.c
@@ -359,19 +359,32 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
 	aift->kzdev[zdev->aisb] = zdev->kzdev;
 	spin_unlock_irq(&aift->gait_lock);
 
-	/* Update guest FIB for re-issue */
-	fib->fmt0.aisbo = zdev->aisb & 63;
-	fib->fmt0.aisb = virt_to_phys(aift->sbv->vector + (zdev->aisb / 64) * 8);
-	fib->fmt0.isc = gisc;
-
 	/* Save some guest fib values in the host for later use */
-	zdev->kzdev->fib.fmt0.isc = fib->fmt0.isc;
+	zdev->kzdev->fib.fmt0.isc = gisc;
 	zdev->kzdev->fib.fmt0.aibv = fib->fmt0.aibv;
-	mutex_unlock(&aift->aift_lock);
 
 	/* Issue the clp to setup the irq now */
 	rc = kvm_zpci_set_airq(zdev);
-	return rc;
+	if (!rc) {
+		mutex_unlock(&aift->aift_lock);
+		return rc;
+	}
+
+	/* Start cleanup */
+	zdev->kzdev->fib.fmt0.isc = 0;
+	zdev->kzdev->fib.fmt0.aibv = 0;
+
+	spin_lock_irq(&aift->gait_lock);
+	gaite->count--;
+	gaite->aisb = 0;
+	gaite->gisc = 0;
+	gaite->aisbo = 0;
+	gaite->gisa = 0;
+	aift->kzdev[zdev->aisb] = NULL;
+	spin_unlock_irq(&aift->gait_lock);
+
+	airq_iv_release(zdev->aibv);
+	zdev->aibv = NULL;
 
 free_aisb:
 	airq_iv_free_bit(aift->sbv, zdev->aisb);
-- 
2.43.0

[PATCH v3 5/5] KVM: s390: pci: Fix aisb calculation

[Farhan Ali]

From: Matthew Rosato <mjrosato@linux.ibm.com>

The current implementation of aisb calculation will erroneously index
via an unsigned long * as well as multiply by 8B for every 64-bits in
the offset; only one or the other is required.  This throws off aisb
calculations once the number of devices exceeds 64, and can result
in out-of-bounds access as well as failure to indicate summary bits
associated with those devices in guests.

Fix this by converting to a physical address before applying the
offset, as is already done in arch/s390/pci/pci_irq.c.

Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
(cherry picked from commit 0cfe660559e857d7c00ab86c73e4510ce069086f)
[alifm@linux.ibm.com: Resolved merge conflict]
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
---
 arch/s390/kvm/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
index 8b91f289226b..59e824a7eaaf 100644
--- a/arch/s390/kvm/pci.c
+++ b/arch/s390/kvm/pci.c
@@ -167,7 +167,7 @@ static int kvm_zpci_set_airq(struct zpci_dev *zdev)
 	fib.fmt0.noi = airq_iv_end(zdev->aibv);
 	fib.fmt0.aibv = virt_to_phys(zdev->aibv->vector);
 	fib.fmt0.aibvo = 0;
-	fib.fmt0.aisb = virt_to_phys(aift->sbv->vector + (zdev->aisb / 64) * 8);
+	fib.fmt0.aisb = virt_to_phys(aift->sbv->vector) + (zdev->aisb / 64) * 8;
 	fib.fmt0.aisbo = zdev->aisb & 63;
 	fib.gd = zdev->gisa;
 
-- 
2.43.0

Re: [PATCH v3 stable 6.1 0/5] s390 KVM PCI backports for 6.1

[Sasha Levin]

On Mon, Aug 17, 2026 at 01:16:01PM -0700, Farhan Ali wrote:
> This patchset backports the s390 KVM PCI fixes to stable-6.1. The patchset
> includes one dependency patch (patch 1) from Jason Gunthorpe, to export
> free_uid(). This is needed to resolve a compilation error.

Queued the series for 6.1, thanks.

-- 
Thanks,
Sasha