KVM: s390: Fix incorrect usage of mmu_notifier_register()

JIRA: https://issues.redhat.com/browse/RHEL-113440

commit 185d903
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>
Date:   Mon Aug 25 17:18:30 2025 +0200

    KVM: s390: Fix incorrect usage of mmu_notifier_register()

    If mmu_notifier_register() fails, for example because a signal was
    pending, the mmu_notifier will not be registered. But when the VM gets
    destroyed, it will get unregistered anyway and that will cause one
    extra mmdrop(), which will eventually cause the mm of the process to
    be freed too early, and cause a use-after free.

    This bug happens rarely, and only when secure guests are involved.

    The solution is to check the return value of mmu_notifier_register()
    and return it to the caller (ultimately it will be propagated all the
    way to userspace). In case of -EINTR, userspace will try again.

    Fixes: ca2fd06 ("KVM: s390: pv: add mmu_notifier")
    Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
    Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
    Reviewed-by: David Hildenbrand <david@redhat.com>
    Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
    Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
    Signed-off-by: Janosch Frank <frankja@linux.ibm.com>

Signed-off-by: Thomas Huth <thuth@redhat.com>

Author: huth

arch/s390/kvm/pv.c

@@ -622,6 +622,17 @@ int kvm_s390_pv_init_vm(struct kvm *kvm, u16 *rc, u16 *rrc)
 	int cc, ret;
 	u16 dummy;
 
+	/* Add the notifier only once. No races because we hold kvm->lock */
+	if (kvm->arch.pv.mmu_notifier.ops != &kvm_s390_pv_mmu_notifier_ops) {
+		/* The notifier will be unregistered when the VM is destroyed */
+		kvm->arch.pv.mmu_notifier.ops = &kvm_s390_pv_mmu_notifier_ops;
+		ret = mmu_notifier_register(&kvm->arch.pv.mmu_notifier, kvm->mm);
+		if (ret) {
+			kvm->arch.pv.mmu_notifier.ops = NULL;
+			return ret;
+		}
+	}
+
 	ret = kvm_s390_pv_alloc_vm(kvm);
 	if (ret)
 		return ret;
@@ -657,11 +668,6 @@ int kvm_s390_pv_init_vm(struct kvm *kvm, u16 *rc, u16 *rrc)
 		return -EIO;
 	}
 	kvm->arch.gmap->guest_handle = uvcb.guest_handle;
-	/* Add the notifier only once. No races because we hold kvm->lock */
-	if (kvm->arch.pv.mmu_notifier.ops != &kvm_s390_pv_mmu_notifier_ops) {
-		kvm->arch.pv.mmu_notifier.ops = &kvm_s390_pv_mmu_notifier_ops;
-		mmu_notifier_register(&kvm->arch.pv.mmu_notifier, kvm->mm);
-	}
 	return 0;
 }