[PATCH] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure

[PATCH] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure

[Haoxiang Li]

kvm_s390_gisc_register() registers the guest ISC before pinning
the guest interrupt forwarding pages and allocating the AISB bit.
If any of the later setup steps fails, the function unwinds the
pinned pages and other local state, but does not unregister the
GISC reference. Add the missing kvm_s390_gisc_unregister() to the
error unwind path.

Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
 arch/s390/kvm/pci.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
index 5b075c38998e..a9d5996590e7 100644
--- a/arch/s390/kvm/pci.c
+++ b/arch/s390/kvm/pci.c
@@ -252,7 +252,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
 	srcu_read_unlock(&kvm->srcu, idx);
 	if (npages < 1) {
 		rc = -EIO;
-		goto out;
+		goto out_unregister_gisc;
 	}
 	aibv_page = pages[0];
 	pcount++;
@@ -327,6 +327,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
 		unpin_user_page(aisb_page);
 unpin1:
 	unpin_user_page(aibv_page);
+out_unregister_gisc:
+	kvm_s390_gisc_unregister(kvm, fib->fmt0.isc);
 out:
 	return rc;
 }
-- 
2.25.1

Re: [PATCH] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure

[Matthew Rosato]

On 6/23/26 3:52 AM, Haoxiang Li wrote:
> kvm_s390_gisc_register() registers the guest ISC before pinning
> the guest interrupt forwarding pages and allocating the AISB bit.
> If any of the later setup steps fails, the function unwinds the
> pinned pages and other local state, but does not unregister the
> GISC reference. Add the missing kvm_s390_gisc_unregister() to the
> error unwind path.

Hi Haoxiang,

Thanks for the fix!  A comment below..

> 
> Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
> ---
>  arch/s390/kvm/pci.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c
> index 5b075c38998e..a9d5996590e7 100644
> --- a/arch/s390/kvm/pci.c
> +++ b/arch/s390/kvm/pci.c
> @@ -252,7 +252,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
>  	srcu_read_unlock(&kvm->srcu, idx);
>  	if (npages < 1) {
>  		rc = -EIO;
> -		goto out;
> +		goto out_unregister_gisc;
>  	}
>  	aibv_page = pages[0];
>  	pcount++;
> @@ -327,6 +327,8 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib,
>  		unpin_user_page(aisb_page);
>  unpin1:
>  	unpin_user_page(aibv_page);
> +out_unregister_gisc:
> +	kvm_s390_gisc_unregister(kvm, fib->fmt0.isc);
>  out:

Label 'out' is now unused in this function.

I think you could make this a 1-liner fix by keeping the goto unchanged
and instead just placing the unregister call right after out:

Thanks,
Matt 

>  	return rc;
>  }