diff options
| author | Farhan Ali <alifm@linux.ibm.com> | 2026-07-23 15:14:07 -0700 |
|---|---|---|
| committer | Christian Borntraeger <borntraeger@linux.ibm.com> | 2026-07-24 11:26:54 +0200 |
| commit | 8bf09b9b7d3232806df95f409581f8a9fd99a3fa (patch) | |
| tree | 6c06375084cc97c9b2c0ce2cc87b1606b84aaaa4 /arch | |
| parent | f86842e4d6c482300f4567f492d512c9ccf5bc4f (diff) | |
| download | linux-next-8bf09b9b7d3232806df95f409581f8a9fd99a3fa.tar.gz linux-next-8bf09b9b7d3232806df95f409581f8a9fd99a3fa.zip | |
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
The airq_iv_create() can return NULL on failure, but the return value was
never checked. If it fails, zdev->aibv will be NULL and fail when
dereferenced in kvm_zpci_set_airq(). Add a NULL check and free the
previously allocated AISB bit and zdev->aisb on failure.
Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Cc: stable@vger.kernel.org
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/s390/kvm/pci.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c index 36eb30953bb5..1eb127fc9f89 100644 --- a/arch/s390/kvm/pci.c +++ b/arch/s390/kvm/pci.c @@ -317,6 +317,11 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, AIRQ_IV_GUESTVEC, phys_to_virt(fib->fmt0.aibv)); + if (!zdev->aibv) { + rc = -ENOMEM; + goto free_aisb; + } + spin_lock_irq(&aift->gait_lock); gaite = aift->gait + zdev->aisb; @@ -353,6 +358,9 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, rc = kvm_zpci_set_airq(zdev); return rc; +free_aisb: + airq_iv_free_bit(aift->sbv, zdev->aisb); + zdev->aisb = 0; unlock: if (pcount > 0) unaccount_mem(zdev->kzdev, pcount); |