Re: [PATCH v2] KVM: s390: Fix memory corruption by not reinjecting CK machine checks

On Thu,  6 Aug 2026 16:58:35 +0200
Christian Borntraeger <[email protected]> wrote:

> Channel-subsystem damage machine checks are for the host channel
> subsystem. The guest channel subsystem is emulated in the userspace VMM.
> There is no point in forwarding such machine checks into the guest.
> 
> This also simplifies the machine check reinjection and avoids kfree of a
> stack variable as reported by sashiko.  There might be still machine
> checks that have the ck bit set with another bit (like instruction
> damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
> ED bits already are.
> 
> Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
> Cc: [email protected]
> Signed-off-by: Christian Borntraeger <[email protected]>
> Acked-by: Heiko Carstens <[email protected]>

Acked-by: Claudio Imbrenda <[email protected]>

> ---
> v1->v2: move MCCK_CODE_NO_GUEST into nmi.h and reuse that
> 
>  arch/s390/include/asm/nmi.h |  3 +++
>  arch/s390/kernel/nmi.c      |  5 +----
>  arch/s390/kvm/interrupt.c   | 26 +++++++++-----------------
>  3 files changed, 13 insertions(+), 21 deletions(-)
> 
> diff --git a/arch/s390/include/asm/nmi.h b/arch/s390/include/asm/nmi.h
> index 6454c1531854..7919b2b9ac9c 100644
> --- a/arch/s390/include/asm/nmi.h
> +++ b/arch/s390/include/asm/nmi.h
> @@ -22,6 +22,7 @@
>  #define MCCK_CODE_SYSTEM_DAMAGE		BIT(63)
>  #define MCCK_CODE_EXT_DAMAGE		BIT(63 - 5)
>  #define MCCK_CODE_CP			BIT(63 - 9)
> +#define MCCK_CODE_CK			BIT(63 - 11)
>  #define MCCK_CODE_STG_ERROR		BIT(63 - 16)
>  #define MCCK_CODE_STG_KEY_ERROR		BIT(63 - 18)
>  #define MCCK_CODE_STG_DEGRAD		BIT(63 - 19)
> @@ -33,6 +34,8 @@
>  #define MCCK_CODE_FC_VALID		BIT(63 - 43)
>  #define MCCK_CODE_CPU_TIMER_VALID	BIT(63 - 46)
>  
> +#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE | MCCK_CODE_CK)
> +
>  #ifndef __ASSEMBLER__
>  
>  union mci {
> diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
> index e17a59d4d5a4..17297a8b63d9 100644
> --- a/arch/s390/kernel/nmi.c
> +++ b/arch/s390/kernel/nmi.c
> @@ -344,8 +344,7 @@ static void notrace s390_backup_mcck_info(struct pt_regs *regs)
>  
>  	sie_page = container_of(sie_block, struct sie_page, sie_block);
>  	mcck_backup = &sie_page->mcck_info;
> -	mcck_backup->mcic = get_lowcore()->mcck_interruption_code &
> -				~(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE);
> +	mcck_backup->mcic = get_lowcore()->mcck_interruption_code & ~MCCK_CODE_NO_GUEST;
>  	mcck_backup->ext_damage_code = get_lowcore()->external_damage_code;
>  	mcck_backup->failing_storage_address = get_lowcore()->failing_storage_address;
>  }
> @@ -357,8 +356,6 @@ NOKPROBE_SYMBOL(s390_backup_mcck_info);
>  #define ED_STP_ISLAND	6	/* External damage STP island check */
>  #define ED_STP_SYNC	7	/* External damage STP sync check */
>  
> -#define MCCK_CODE_NO_GUEST	(MCCK_CODE_CP | MCCK_CODE_EXT_DAMAGE)
> -
>  /*
>   * machine check handler.
>   */
> diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
> index 7514d9e2403c..3375a956637b 100644
> --- a/arch/s390/kvm/interrupt.c
> +++ b/arch/s390/kvm/interrupt.c
> @@ -3099,9 +3099,7 @@ static int set_adapter_int(struct kvm_kernel_irq_routing_entry *e,
>  void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
>  				     struct mcck_volatile_info *mcck_info)
>  {
> -	struct kvm_s390_interrupt_info inti;
> -	struct kvm_s390_irq irq;
> -	struct kvm_s390_mchk_info *mchk;
> +	struct kvm_s390_irq irq = {};
>  	union mci mci;
>  	__u64 cr14 = 0;         /* upper bits are not used */
>  	int rc;
> @@ -3120,20 +3118,14 @@ void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
>  	if (mci.w)
>  		cr14 |= CR14_WARNING_SUBMASK;
>  
> -	mchk = mci.ck ? &inti.mchk : &irq.u.mchk;
> -	mchk->cr14 = cr14;
> -	mchk->mcic = mcck_info->mcic;
> -	mchk->ext_damage_code = mcck_info->ext_damage_code;
> -	mchk->failing_storage_address = mcck_info->failing_storage_address;
> -	if (mci.ck) {
> -		/* Inject the floating machine check */
> -		inti.type = KVM_S390_MCHK;
> -		rc = __inject_vm(vcpu->kvm, &inti);
> -	} else {
> -		/* Inject the machine check to specified vcpu */
> -		irq.type = KVM_S390_MCHK;
> -		rc = kvm_s390_inject_vcpu(vcpu, &irq);
> -	}
> +	irq.u.mchk.cr14 = cr14;
> +	irq.u.mchk.mcic = mcck_info->mcic;
> +	irq.u.mchk.ext_damage_code = mcck_info->ext_damage_code;
> +	irq.u.mchk.failing_storage_address = mcck_info->failing_storage_address;
> +
> +	/* Inject the machine check to specified vcpu */
> +	irq.type = KVM_S390_MCHK;
> +	rc = kvm_s390_inject_vcpu(vcpu, &irq);
>  	WARN_ON_ONCE(rc);
>  }
>