Re: [PATCH v6 08/14] KVM: s390: ucontrol: Add missing locking around gmap_remove_child()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The s390 MMU cache (`vcpu->arch.mc`) and its internally topped-up pages are permanently leaked on the error paths of `kvm_arch_vcpu_create()`.
--

--- Patch [8]: [PATCH v6 08/14] KVM: s390: ucontrol: Add missing locking around gmap_remove_child() ---
commit 84329d883b130f6a53d6ec86765dba1245a95998
Author: Claudio Imbrenda <[email protected]>

KVM: s390: ucontrol: Add missing locking around gmap_remove_child()
    
gmap_remove_child() needs to be called while holding the children_lock
of the parent gmap. This was not the case in the error handling path of
kvm_arch_vcpu_create() for UCONTROL guests.

> diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
> index c1984fe2f9a40..a234c2ab5fed5 100644
> --- a/arch/s390/kvm/kvm-s390.c
> +++ b/arch/s390/kvm/kvm-s390.c
> @@ -3874,7 +3874,9 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
>  
>  out_ucontrol_uninit:
>  	if (kvm_is_ucontrol(vcpu->kvm)) {
> +		spin_lock(&vcpu->kvm->arch.gmap->children_lock);
>  		gmap_remove_child(vcpu->arch.gmap);
> +		spin_unlock(&vcpu->kvm->arch.gmap->children_lock);
>  		vcpu->arch.gmap = gmap_put(vcpu->arch.gmap);
>  	}
>  out_free_sie_block:

[Severity: High]
This is a pre-existing issue, but does this error path permanently leak the
s390 MMU cache and its internally topped-up pages?

When an error occurs during kvm_arch_vcpu_create(), such as a failure in
gmap_new_child() or kvm_s390_vcpu_setup(), the error path jumps to
out_free_sie_block.  This frees the sie_page but fails to call
kvm_s390_free_mmu_cache() for vcpu->arch.mc.

Since userspace can repeatedly invoke the KVM_CREATE_VCPU ioctl and force it
to fail (for example, by exhausting cgroup memory limits to trigger an
-ENOMEM), could this result in a permanent kernel memory leak triggerable
from userspace?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=8