[PATCH v6 0/2] KVM: arm64: vgic: Fix racy LPI release and re-registration handling

Carlos López posted 2 patches 1 week, 3 days ago
arch/arm64/kvm/vgic/vgic-its.c | 25 +++++++++++++++++--------
arch/arm64/kvm/vgic/vgic.c     | 18 ++++++++----------
include/kvm/arm_vgic.h         |  3 ---
3 files changed, 25 insertions(+), 21 deletions(-)
[PATCH v6 0/2] KVM: arm64: vgic: Fix racy LPI release and re-registration handling
Posted by Carlos López 1 week, 3 days ago
Fix a couple of potential issues that could arise from racy LPI release
and re-registration for the same INTID.

The issue fixed in patch 1 can manifest itself through either a
leaked LPI structure, or a prematurely deleted LPI. The issue fixed
in patch 2 could materialize as a spurious -ENOMEM failure when
registering an LPI.

v6:
* Remove pending_release in patch 1, preventing use-after-free and/or
  spurious WARNs.
* Avoid lock inversion via xa_release() (Sashiko).

v5:
* Make sure evicted IRQs on the registration path are pending
  release (Oliver Upton).

v4:
* Add __GFP_ACCOUNT to patch 2 (Sashiko).

v3:
* Use refcount_dec_and_lock_irqsave() instead of unconditionally
  grabbing the xarray lock in patch 1.
* Add patch 2.

v2:
* Address Sashiko's review. Fix the direct release path by decrementing
  the refcount under the xarray spinlock, preventing a UAF that would
  have been introduced in v1.

Carlos López (2):
  KVM: arm64: vgic: Fix race between LPI release and re-registration
  KVM: arm64: vgic: Mitigate potential LPI registration failure

 arch/arm64/kvm/vgic/vgic-its.c | 25 +++++++++++++++++--------
 arch/arm64/kvm/vgic/vgic.c     | 18 ++++++++----------
 include/kvm/arm_vgic.h         |  3 ---
 3 files changed, 25 insertions(+), 21 deletions(-)


base-commit: 1ee27dacbe5dc4def481794d899d67b0d4570094
-- 
2.51.0

Re: [PATCH v6 0/2] KVM: arm64: vgic: Fix racy LPI release and re-registration handling
Posted by Marc Zyngier 2 days ago
On Wed, 15 Jul 2026 12:51:36 +0200, Carlos López wrote:
> Fix a couple of potential issues that could arise from racy LPI release
> and re-registration for the same INTID.
> 
> The issue fixed in patch 1 can manifest itself through either a
> leaked LPI structure, or a prematurely deleted LPI. The issue fixed
> in patch 2 could materialize as a spurious -ENOMEM failure when
> registering an LPI.
> 
> [...]

Applied to fixes, thanks!

[1/2] KVM: arm64: vgic: Fix race between LPI release and re-registration
      commit: cbfe2b24a1ea9de35032dbdd100fdc700f5be92d
[2/2] KVM: arm64: vgic: Mitigate potential LPI registration failure
      commit: 21f12496fdd357ad4e1fcdd07dc80ab7378f7d24

Cheers,

	M.
-- 
Without deviation from the norm, progress is not possible.