From nobody Mon Sep 28 16:20:22 2026 Received: from mta0.migadu.com (out-240.mta0.migadu.com [91.218.175.240]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 491EC44212E for ; Thu, 20 Aug 2026 12:51:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.240 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787230264; cv=none; b=cyDQfZHQVMXgcK8jUxKGgRa7gRYn8jGGR84fDF/X3Kuck/QufQT4ZwIpq/naa+aMMjr1t6aWALbPbLnDNrl65q7KBHqK1gGwY+kpdHZMokFnQCO4Io068YNKP1B+g3qylVPoaSmj5kidQn1Dg5nOovprSWaC15MtIf/+3LvxYu0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787230264; c=relaxed/simple; bh=tLmq2HrjLCESAVz5nI7NICH8bUrsH/OHxKa8Tyxl6MQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PloAZqDJ1tl2nUS+RlRGhS3NrIrs8S6/VtA8iPbDq3ct7TEbVIRtBpnARhIyE/7TT+CkO2T5s8jeFCvj35dtTKOVSC13fWTgKCN96OoCBDs4TfKcDg7JwcBF43I9shL4rTI2aEXoIYiEXSRPfBesrkVzGP/N7ooVHHk1byuDJy8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=izz7ATC+; arc=none smtp.client-ip=91.218.175.240 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="izz7ATC+" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=tLmq2HrjLCESAVz5nI7NICH8bUrsH/OHxKa8Tyxl6MQ=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787230258; v=1; x=1787835058; b=izz7ATC+WN/k4xaVA5ScrcFYWmZkeeW6+U8AKugYk1SaPxiq3PKdaRDNr7h+CpkZXGQg4Cpp wYwEr2+p3hd6Z6RhSzjWk1Isc98ke9lqc0t6UARODgvjWU7036ILYOYBx1i86NbJkxLawvrY62w 8QQJ4esOKPRTZQY0c2YGsafk= X-Envelope-To: linux-kernel@vger.kernel.org Received: from claudy.lan (37.156.72.212) by smtp.migadu.com with ESMTPS id a3afca9ef7e413da; Thu, 20 Aug 2026 12:50:58 +0000 X-Mizu-Trace-ID: a3afca9ef7e413da X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Thomas Gleixner , Eric Auger , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/3] irqchip/gic-v4: Clear the domain and fwnode pointers after freeing them Date: Thu, 20 Aug 2026 13:50:51 +0100 Message-Id: <20260820125053.2951078-2-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260820125053.2951078-1-fuad.tabba@linux.dev> References: <20260820125053.2951078-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The GICv4 allocation and teardown paths free their irq domains and fwnodes but leave the pointers set, and the allocation error paths test those pointers before removing them. struct its_vm and struct its_vpe are embedded in KVM's per-VM and per-vCPU state, so nothing re-zeroes them between two attempts, and an error path taken after an earlier one already freed the domain calls irq_domain_remove() on freed memory. Reaching this takes two allocation failures, one to leave the stale pointer behind and one to send the next attempt down the error path. Fixes: 7de5c0af9c7c ("irqchip/gic-v4: Add per-VM VPE domain creation") Fixes: 6d31b6ff985d ("irqchip/gic-v4.1: Add VSGI allocation/teardown") Signed-off-by: Fuad Tabba --- drivers/irqchip/irq-gic-v4.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v4.c b/drivers/irqchip/irq-gic-v4.c index 8455b4a5fbb0d..754839e409f88 100644 --- a/drivers/irqchip/irq-gic-v4.c +++ b/drivers/irqchip/irq-gic-v4.c @@ -147,10 +147,14 @@ static int its_alloc_vcpu_sgis(struct its_vpe *vpe, i= nt idx) return 0; =20 err: - if (vpe->sgi_domain) + if (vpe->sgi_domain) { irq_domain_remove(vpe->sgi_domain); - if (vpe->fwnode) + vpe->sgi_domain =3D NULL; + } + if (vpe->fwnode) { irq_domain_free_fwnode(vpe->fwnode); + vpe->fwnode =3D NULL; + } kfree(name); return -ENOMEM; } @@ -191,10 +195,14 @@ int its_alloc_vcpu_irqs(struct its_vm *vm) return 0; =20 err: - if (vm->domain) + if (vm->domain) { irq_domain_remove(vm->domain); - if (vm->fwnode) + vm->domain =3D NULL; + } + if (vm->fwnode) { irq_domain_free_fwnode(vm->fwnode); + vm->fwnode =3D NULL; + } =20 return -ENOMEM; } @@ -215,6 +223,8 @@ static void its_free_sgi_irqs(struct its_vm *vm) irq_domain_free_irqs(irq, 16); irq_domain_remove(vm->vpes[i]->sgi_domain); irq_domain_free_fwnode(vm->vpes[i]->fwnode); + vm->vpes[i]->sgi_domain =3D NULL; + vm->vpes[i]->fwnode =3D NULL; } } =20 @@ -224,6 +234,8 @@ void its_free_vcpu_irqs(struct its_vm *vm) irq_domain_free_irqs(vm->vpes[0]->irq, vm->nr_vpes); irq_domain_remove(vm->domain); irq_domain_free_fwnode(vm->fwnode); + vm->domain =3D NULL; + vm->fwnode =3D NULL; } =20 static int its_send_vpe_cmd(struct its_vpe *vpe, struct its_cmd_info *info) --=20 2.39.5 From nobody Mon Sep 28 16:20:22 2026 Received: from mta1.migadu.com (out-226.mta1.migadu.com [95.215.58.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDC0644607F for ; Thu, 20 Aug 2026 12:51:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.226 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787230266; cv=none; b=ukCD/+r+HG5H+x8eKzKXfTFhiSW1/EGhQ8+0uszM6Dy0Vw3DqFFm79jGcwR4C5Lx+29JXOM5KihbBEcm3K6NXReecB2RKGJZk0Kgi+QrJCxEWIOBOz+BioUPOCXbtfnjIMc1zxMifS7fFkk9u8nzyn7PgT7HQAfweUq4a2fTU0E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787230266; c=relaxed/simple; bh=hj/KFP2x7lOTPG4tfrkyrmf+B5TmosOwYkVEHrZCpZg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=DBMpMzCfuuv1H4WXThKqiXeILHC6zCfp6bSY2QKnN5BLq++ihb4JAGIoAXWEai1Go3VDe5AlSlAHKMDwyd6r2eN4SeEXgfuBmDU/dcNDHSG66A0WCYavW+s7qAfAGjCIeRlzYRH+KRmo0WOkvjuhLpkLbDusj7BsgQcsDZ6tJrY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=pNAcQ0VP; arc=none smtp.client-ip=95.215.58.226 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="pNAcQ0VP" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=hj/KFP2x7lOTPG4tfrkyrmf+B5TmosOwYkVEHrZCpZg=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787230259; v=1; x=1787835059; b=pNAcQ0VPFmngbQ3ehqBgBng6uv1pR6IviUszEXlxbCTlUkZhQ+xYpr1LXhkSM16fdR33lW7Y qecNgXtKXrvwmA95tdfe2iElCp8PPSpXv9Ufm2rNPHa7wFWaP0aFh+4/D9hiYsZwmTQxM0ks0Sn 4EKfbN2pp4kyQomwtz85FSGI= X-Envelope-To: linux-kernel@vger.kernel.org Received: from claudy.lan (37.156.72.212) by smtp.migadu.com with ESMTPS id e4b8df4d3a991f5a; Thu, 20 Aug 2026 12:50:59 +0000 X-Mizu-Trace-ID: e4b8df4d3a991f5a X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Thomas Gleixner , Eric Auger , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/3] irqchip/gic-v4: Unwind what its_alloc_vcpu_irqs() allocated on failure Date: Thu, 20 Aug 2026 13:50:52 +0100 Message-Id: <20260820125053.2951078-3-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260820125053.2951078-1-fuad.tabba@linux.dev> References: <20260820125053.2951078-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A failure in the its_alloc_vcpu_sgis() loop leaves behind both the SGI domains created for the vPEs below the failing index and the vPE irqs allocated before the loop, since irq_domain_remove() frees neither. Each leaked vPE takes its ITS state with it, a vpe_id and an LPI pending table. Free both from a second label before the existing unwind. With the freed pointers now cleared, its_free_sgi_irqs() can skip a vPE with no SGI domain rather than warn on it, so the error path can reuse it. Fixes: 6d31b6ff985d ("irqchip/gic-v4.1: Add VSGI allocation/teardown") Signed-off-by: Fuad Tabba --- drivers/irqchip/irq-gic-v4.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-gic-v4.c b/drivers/irqchip/irq-gic-v4.c index 754839e409f88..f707a3cb281aa 100644 --- a/drivers/irqchip/irq-gic-v4.c +++ b/drivers/irqchip/irq-gic-v4.c @@ -159,6 +159,8 @@ static int its_alloc_vcpu_sgis(struct its_vpe *vpe, int= idx) return -ENOMEM; } =20 +static void its_free_sgi_irqs(struct its_vm *vm); + int its_alloc_vcpu_irqs(struct its_vm *vm) { int vpe_base_irq, i; @@ -189,11 +191,14 @@ int its_alloc_vcpu_irqs(struct its_vm *vm) vm->vpes[i]->irq =3D vpe_base_irq + i; ret =3D its_alloc_vcpu_sgis(vm->vpes[i], i); if (ret) - goto err; + goto err_free_irqs; } =20 return 0; =20 +err_free_irqs: + its_free_sgi_irqs(vm); + irq_domain_free_irqs(vpe_base_irq, vm->nr_vpes); err: if (vm->domain) { irq_domain_remove(vm->domain); @@ -215,8 +220,13 @@ static void its_free_sgi_irqs(struct its_vm *vm) return; =20 for (i =3D 0; i < vm->nr_vpes; i++) { - unsigned int irq =3D irq_find_mapping(vm->vpes[i]->sgi_domain, 0); + unsigned int irq; =20 + /* irq_find_mapping() falls back to the default domain on NULL. */ + if (!vm->vpes[i]->sgi_domain) + continue; + + irq =3D irq_find_mapping(vm->vpes[i]->sgi_domain, 0); if (WARN_ON(!irq)) continue; =20 --=20 2.39.5 From nobody Mon Sep 28 16:20:22 2026 Received: from mta0.migadu.com (out-251.mta0.migadu.com [91.218.175.251]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F780443AAB for ; Thu, 20 Aug 2026 12:51:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.251 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787230269; cv=none; b=hVNfsRDc96BbdUlwKLN/UIc7r3cEfh1GtVL6y0GkHLPU1dC5Hm9QlrOFpvW4e9MmjnEJJI1CNmDWtSXBD1/1GmP3C8QkVOejnnSxNBDd5T1H/2XhpHT0dLM487Gx+N3ucZQMWF62LeuBnv7wgRe+EApQaurdrFEmR5lYAn/os9s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787230269; c=relaxed/simple; bh=+OVYGds3T77EelMLOPm4dGH+mQ9alxNzuYkC0tWP/eU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=A4ZQJXSEDFqj7RYMzZorGK6ozTHgWn0W//OHyJG8vSvLuMEuHxoJWAm3NmN7BP/hIHLIzaIRbdvTJRKQkEBf3gOnc7r5m4iKYTeYOZOAoD7kNeBYv10ibh5xItfflPDfex0Nu2vKs6mrhp/3x0oynnyyqlZdeIsC5dPq93KXYqA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=PvK+pHJI; arc=none smtp.client-ip=91.218.175.251 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="PvK+pHJI" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=+OVYGds3T77EelMLOPm4dGH+mQ9alxNzuYkC0tWP/eU=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787230264; v=1; x=1787835064; b=PvK+pHJI8clCwWkypiKruyzbDI2xkP/naswqdUzblHXWTHix22MphV6DghqE2UcirHC8023B 2jZG00d/PPKaPxNfRNGXj8jkkeEeYdRJdozQ2WmSOUF/CxWX7Oz1obH4IRw+QldsDkcq/9dp4uZ aSB6SEP+vf2Cn0r6Fuw2hvSs= X-Envelope-To: linux-kernel@vger.kernel.org Received: from claudy.lan (37.156.72.212) by smtp.migadu.com with ESMTPS id f82f72450b457568; Thu, 20 Aug 2026 12:51:04 +0000 X-Mizu-Trace-ID: f82f72450b457568 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Thomas Gleixner , Eric Auger , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/3] KVM: arm64: vgic: Tear down what vgic_init() created when it fails Date: Thu, 20 Aug 2026 13:50:53 +0100 Message-Id: <20260820125053.2951078-4-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260820125053.2951078-1-fuad.tabba@linux.dev> References: <20260820125053.2951078-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Once kvm_vgic_dist_init() has succeeded, every later failure in vgic_init() returns with the SPI array still allocated. A failure after vgic_v4_init() has also succeeded, which today means only kvm_vgic_setup_default_irq_routing(), leaves the vPE array behind as well. A failed vgic_init() leaves kvm_arch_vcpu_precreate() admitting new vCPUs, so a retry of KVM_DEV_ARM_VGIC_CTRL_INIT reaches vgic_v4_init()'s early return with an array that no longer covers every vCPU, and vgic_v3_load()'s WARN_ON(vgic_v4_load()) fires on the first one it misses. Release both on the two paths that can reach them, so the ioctl is all or nothing and a retry starts from scratch. dist->nr_spis stays frozen, since the SPI count cannot change once vgic_init() has supplied it. Fixes: 74fe55dc9ab7 ("KVM: arm/arm64: GICv4: Add init/teardown of the per-V= M vPE irq domain") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260807105558.73D701F000E9@smtp.kernel= .org/ Signed-off-by: Fuad Tabba --- arch/arm64/kvm/vgic/vgic-init.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-ini= t.c index 4012df6002ea6..7493fded53acc 100644 --- a/arch/arm64/kvm/vgic/vgic-init.c +++ b/arch/arm64/kvm/vgic/vgic-init.c @@ -462,7 +462,7 @@ int vgic_init(struct kvm *kvm) if (vgic_supports_direct_irqs(kvm)) { ret =3D vgic_v4_init(kvm); if (ret) - return ret; + goto out_teardown; } } else { ret =3D vgic_v5_init(kvm); @@ -475,12 +475,19 @@ int vgic_init(struct kvm *kvm) =20 ret =3D kvm_vgic_setup_default_irq_routing(kvm); if (ret) - return ret; + goto out_teardown; =20 vgic_debug_init(kvm); dist->initialized =3D true; =20 return 0; + +out_teardown: + vgic_v4_teardown(kvm); + kfree(dist->spis); + dist->spis =3D NULL; + + return ret; } =20 static void kvm_vgic_dist_destroy(struct kvm *kvm) --=20 2.39.5