From nobody Sat Jul 25 23:04:06 2026 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D62F6846A for ; Sun, 12 Jul 2026 09:00:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783846854; cv=none; b=MhrSaxq93giNVP0fXvKanWofhCLg6OJvmuls+gOXuf+MKLYD3CBNbCBmygCwrevbYgnXPueuYfnsdIjDMYB19rMvp7E0blDjX2aWzkx5shXh0e9wSlOKElWFvINPX8op6oxAIEHCYyRUHLaRP9bsOnYcZgCnY9rv0fpjn+WAvNs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783846854; c=relaxed/simple; bh=5WdJpF05mXgMFI3REZfS7otqxKxE5jvJ9kZHgW1xNjQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FrsFVOGnZAE/8vQg9IGGEzbq8PFbJ/IfwcuRr1x4074aNng+YN3ek5CoC5ijbmC5Degpqad/raPAzTUHgEmJ6d4psR+BQ4hNaWJYhi+ljbANCmy4acvDi5CSNV29+6Jl5f1cke1H4RHFXnWmrwxDwLafMxAmHTiD45Vd+zasj0k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YaA8wlSS; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YaA8wlSS" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-ca766c1c9ccso1153144a12.0 for ; Sun, 12 Jul 2026 02:00:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783846852; x=1784451652; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=2z0NXTQ4WspU6NiaqWleR3H7oNVIjIlwseGetO8dygU=; b=YaA8wlSSSXJQAvWRaDaavbMAaAZ1Sj10YrpBX9bkgxEc+FCdGKTF//7Ml2ZEQGSyzJ /F9rdo/G2aKQhESM+964Gwq16+HmDt5Ds0v8r30fiIkdIVvmWGSewSkqlIndhkQqIL+h Ot0RTjHXFCopWJGZ+EqL8YgkeBoDaKdwO0QGRB7e8FkFW+gGAbn5KICGV9boUEPISUks 7ZJ6ieKE1oVYYHrNH0s8AtXyWydN3sJU5oXe07+JQs+VeMYnVv64Xnx0yBgBjQpyE/v6 rQFFpfOn0hS4ZKOiZI/iShmFAhIsmiBKjXo2jt3k9xknSyl25dtZgbANVHZ7f/UUsIkg Is4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783846852; x=1784451652; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2z0NXTQ4WspU6NiaqWleR3H7oNVIjIlwseGetO8dygU=; b=oXDY7GMYTFrZa3Eawiivzq6/UTVe/0sfPvoAunY7Xh4e7+otMJJm5/GPM5qA3jkQoX gaXs5/fjaSTCZufe6dlfvMHNGJNbRzP6Q1K27HnxDCX+EY6ytJK6xe1bNfXOAIGOsYQ5 cHHQ+zp+xYZI0xzS8zZ4m8edV21O+BXBF3zxVNtB8Tl37/Q4tLZaubethIpKOpPhTRtD YgFYmssJ+b2oIdqsqeRMyi+PLDNRfCDhIqZgcZepeiT9xWjPAtFlgcf5YeAxFkmNj1XU 86+LX2NClVpCldaIfOcddwM/zQh1RsncDJJXCdXa05gZxmc8SUwqWuQS0MhgaHpJs54h 2saQ== X-Forwarded-Encrypted: i=1; AHgh+RorGRZNO7bh7T+E/F7IpHWPLNvRG01GCt1ltsHnAOm6Rer9H9QbotwEEJDGFclb9vr7RcsIcDsrK+Cq71s=@vger.kernel.org X-Gm-Message-State: AOJu0YwM8mS+kYxpl0RPxbiNhstLAx4Ki8cut2uV7YKGpOqP49kH+Tto oZHTL3kzwBD+HIlvNxjN4LW2JM3WVcaSYvISZ29p9okF3Q0ZbYMbEBZ4uvB/7g== X-Gm-Gg: AfdE7cmfEVkFYp5pm0DjtkZvBcj8k22D5i1GnIGweqUfAHbi8mXE2Yl9XcSXGKsoeZ2 WP7ePp6ZyK0tMR7mdJgr98XZg58peg9VnqZhw9k52lhi6eU7FQIbmR1q8ItVlzHQL1I1EybNTGE kPsz2sp10AANXaaRvY/CIIG3meNTYzFIRom6sLKE3vWDchPzwqAeD2apjre+Vq7gSpafuIxyWf/ bDqVOG9uyDnPcxFo54DIgjCf8anb8hA7PCGtRlzTY1Zv6PzpOFP6DxA6M7gVCEbEnReJ5uaJGVQ Td9CghHlbcOkZWktHePjbVdvprQrUL+8iE6o9nQVE5FpD3KPEV3vBipV3pp7Bi2A5qpxET0BqSW udvBxytJn8yWN0gPGhkjZPG10/8bUFFhz0oejBXTqNlO4iXSHg/RhQvY6/l0M1CTGxKdhiuSWah u2BLB7J6PAMhBPyqbGRW3qtMCgb3VRU4j44YHn+jJLceHc2UB0NY3koBVSeRTKulOO962i0w== X-Received: by 2002:a05:6a21:6e4c:b0:3b7:9c18:c681 with SMTP id adf61e73a8af0-3c11063219cmr5454526637.9.1783846852155; Sun, 12 Jul 2026 02:00:52 -0700 (PDT) Received: from deepanshu-kernel-hacker.. ([2401:4900:a539:da8b:1aa5:412f:1c54:710a]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13b9081d5c3sm11920181c88.9.2026.07.12.02.00.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 02:00:51 -0700 (PDT) From: Deepanshu Kartikey To: seanjc@google.com, pbonzini@redhat.com, tglx@kernel.org, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+9dcd0a11dc9703a49511@syzkaller.appspotmail.com Subject: [PATCH] KVM: x86: Handle -1 return from kvm_cpu_get_interrupt Date: Sun, 12 Jul 2026 14:30:39 +0530 Message-ID: <20260712090039.36038-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" kvm_check_and_inject_events() checks for a pending PIC interrupt using kvm_cpu_has_injectable_intr() and then fetches it using kvm_cpu_get_interrupt(). These two operations are not atomic with respect to vpic->output. Between the check and fetch, another thread running on a different CPU can call kvm_pic_read_irq() which sets output=3D0 before taking pic_lock(), making it immediately visible to all other threads: Thread A: kvm_cpu_has_injectable_intr() reads output=3D1 Thread B: kvm_pic_read_irq() sets output=3D0 before lock Thread A: kvm_cpu_get_interrupt() reads output=3D0 Thread A: returns -1, WARN_ON_ONCE fires The -1 return is a valid result indicating another thread already consumed the interrupt between the check and fetch. Replace WARN_ON_ONCE with a graceful goto out to handle this race condition correctly. Reported-by: syzbot+9dcd0a11dc9703a49511@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=3D9dcd0a11dc9703a49511 Signed-off-by: Deepanshu Kartikey --- arch/x86/kvm/x86.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index afcac1042947..36bf479a1164 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -10797,11 +10797,11 @@ static int kvm_check_and_inject_events(struct kvm= _vcpu *vcpu, if (r) { int irq =3D kvm_cpu_get_interrupt(vcpu); =20 - if (!WARN_ON_ONCE(irq =3D=3D -1)) { - kvm_queue_interrupt(vcpu, irq, false); - kvm_x86_call(inject_irq)(vcpu, false); - WARN_ON(kvm_x86_call(interrupt_allowed)(vcpu, true) < 0); - } + if (irq =3D=3D -1) + goto out; + kvm_queue_interrupt(vcpu, irq, false); + kvm_x86_call(inject_irq)(vcpu, false); + WARN_ON(kvm_x86_call(interrupt_allowed)(vcpu, true) < 0); } if (kvm_cpu_has_injectable_intr(vcpu)) kvm_x86_call(enable_irq_window)(vcpu); --=20 2.43.0