From nobody Thu Sep 24 20:31:10 2026 Received: from mta1.migadu.com (out-7.mta1.migadu.com [95.215.58.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 950813F5BC5 for ; Mon, 21 Sep 2026 07:30:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.7 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789975817; cv=none; b=DuT8zEIoACTR8Ipl/hruY3U1L1aRnQN1lTeqJxzvGIk8BXfOWvAgYBVq3Py8SW9w7bWoXxFz09WkBwdwhVskVhcRvDkCQH5agiGLVjisCxachGV4EvuQm575c1x36QqkwaQhPESDspCfI8LsDCn6T+aVEwDLVzj8rm3aaPwVrk0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789975817; c=relaxed/simple; bh=nEDmvpsFQHvopfMtsbrOfCA7ee7FniKC/B0/dYc8A2o=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=tA+vpux3dKBJbxJZTpV1KfjjT3QaVoKdqkZcttwyhyEIn9q1TKhhMqzFWsXaFutK3prMCaH/LnqEZRAnPB87Qdz+hWx+8zKvIwMulGnJ5UMQ8Wn7X38/L8JRgBFPdEMCBMF4PTcQIdmU582NCMZM8ip7WYtkbXW8hBzbk1xzfzw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=ubvVi5R+; arc=none smtp.client-ip=95.215.58.7 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="ubvVi5R+" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=nEDmvpsFQHvopfMtsbrOfCA7ee7FniKC/B0/dYc8A2o=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1789975807; v=1; x=1790580607; b=ubvVi5R+NB+iYRZtTal3qSDzr/K3LN+cXUHRIfl/UvOZuixg9ZUBQXwcipNDH+zNDwwuztPh +dxrYvze5acyUbgeTMIY1+M8JF5NOQZt0K5zuZ7rMZrn5884QabwEqpHyV1ko7xujdbPBXgM1f+ Qs2EEHn+mjgmFS9ArsLQBbzE= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id a323088f969dfdb3; Mon, 21 Sep 2026 07:30:04 +0000 X-Mizu-Trace-ID: a323088f969dfdb3 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Thomas Gleixner , Eric Auger , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Yuan Yao , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 1/4] irqchip/gic-v4: Clear the domain and fwnode pointers after freeing them Date: Mon, 21 Sep 2026 08:29:55 +0100 Message-Id: <20260921072958.2918477-2-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260921072958.2918477-1-fuad.tabba@linux.dev> References: <20260921072958.2918477-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The GICv4 allocation and teardown paths free their irq domains and fwnodes but leave the pointers set, and the allocation error paths test those pointers before removing them. struct its_vm and struct its_vpe are embedded in KVM's per-VM and per-vCPU state, so nothing re-zeroes them between two attempts, and an error path taken after an earlier one already freed the domain calls irq_domain_remove() on freed memory. Reaching this takes two allocation failures, one to leave the stale pointer behind and one to send the next attempt down the error path. Fixes: 7de5c0af9c7c ("irqchip/gic-v4: Add per-VM VPE domain creation") Fixes: 6d31b6ff985d ("irqchip/gic-v4.1: Add VSGI allocation/teardown") Reviewed-by: Yuan Yao Signed-off-by: Fuad Tabba --- drivers/irqchip/irq-gic-v4.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v4.c b/drivers/irqchip/irq-gic-v4.c index 8455b4a5fbb0d..754839e409f88 100644 --- a/drivers/irqchip/irq-gic-v4.c +++ b/drivers/irqchip/irq-gic-v4.c @@ -147,10 +147,14 @@ static int its_alloc_vcpu_sgis(struct its_vpe *vpe, i= nt idx) return 0; =20 err: - if (vpe->sgi_domain) + if (vpe->sgi_domain) { irq_domain_remove(vpe->sgi_domain); - if (vpe->fwnode) + vpe->sgi_domain =3D NULL; + } + if (vpe->fwnode) { irq_domain_free_fwnode(vpe->fwnode); + vpe->fwnode =3D NULL; + } kfree(name); return -ENOMEM; } @@ -191,10 +195,14 @@ int its_alloc_vcpu_irqs(struct its_vm *vm) return 0; =20 err: - if (vm->domain) + if (vm->domain) { irq_domain_remove(vm->domain); - if (vm->fwnode) + vm->domain =3D NULL; + } + if (vm->fwnode) { irq_domain_free_fwnode(vm->fwnode); + vm->fwnode =3D NULL; + } =20 return -ENOMEM; } @@ -215,6 +223,8 @@ static void its_free_sgi_irqs(struct its_vm *vm) irq_domain_free_irqs(irq, 16); irq_domain_remove(vm->vpes[i]->sgi_domain); irq_domain_free_fwnode(vm->vpes[i]->fwnode); + vm->vpes[i]->sgi_domain =3D NULL; + vm->vpes[i]->fwnode =3D NULL; } } =20 @@ -224,6 +234,8 @@ void its_free_vcpu_irqs(struct its_vm *vm) irq_domain_free_irqs(vm->vpes[0]->irq, vm->nr_vpes); irq_domain_remove(vm->domain); irq_domain_free_fwnode(vm->fwnode); + vm->domain =3D NULL; + vm->fwnode =3D NULL; } =20 static int its_send_vpe_cmd(struct its_vpe *vpe, struct its_cmd_info *info) --=20 2.39.5 From nobody Thu Sep 24 20:31:10 2026 Received: from mta1.migadu.com (out-20.mta1.migadu.com [95.215.58.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E7A83FD137 for ; Mon, 21 Sep 2026 07:30:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.20 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789975818; cv=none; b=GN2SLWGcLdGsS4BGNkoEK+oca8B/r7QR6p6bOZHO81jWtPtjyNY286GIyJ7+L/3SczFENkVTkzp6Hv6iLGDWiZ4oSEAKS4MYVURFdqlwPRDw7kQnMb0m4QhZIXkn+BTMS3q1D3lAXTZOsYiEM5NSu853TI9OJ5Fj5yn//zpqCSM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789975818; c=relaxed/simple; bh=YRjrdcXSvz0c+tqwc5MA976Iks7cA0z99Etwh6VpwMA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IFXTMRtAnEFcP/Jxb8VAh7TPgZuZC1l+mj52u2bHtNAVWnS1FbBRB3Ia3xRzCDdwvDe+oaQWzcxG4ejx1V15DrfAS/05n/emFZkuNSjWQgwqyRWqKGCnuaXTYxFzK2AhIkLobhdgLWp4vY4y/BK9gfROaT2mJsxiue2WEIL0C+g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=xMAiMtOr; arc=none smtp.client-ip=95.215.58.20 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="xMAiMtOr" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=YRjrdcXSvz0c+tqwc5MA976Iks7cA0z99Etwh6VpwMA=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1789975811; v=1; x=1790580611; b=xMAiMtOrSud9SSi2GLPjPG3elstbMhdL9nCAPFyvdUne9/7gFhCWYgRXeb8vbgtmiQAhG5pk xIvryYs6wYWYkf4FBqxB4Lii4zbvAsJAErqPs8z8jkz4+50GeJfU4RX7o3swktiCWrU6YmxL802 oiR+sPGP50ldSJUZbE+yomzs= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 5b3602680922a617; Mon, 21 Sep 2026 07:30:07 +0000 X-Mizu-Trace-ID: 5b3602680922a617 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Thomas Gleixner , Eric Auger , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Yuan Yao , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 2/4] irqchip/gic-v4: Unwind what its_alloc_vcpu_irqs() allocated on failure Date: Mon, 21 Sep 2026 08:29:56 +0100 Message-Id: <20260921072958.2918477-3-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260921072958.2918477-1-fuad.tabba@linux.dev> References: <20260921072958.2918477-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A failure in the its_alloc_vcpu_sgis() loop leaves behind both the SGI domains created for the vPEs below the failing index and the vPE irqs allocated before the loop, since irq_domain_remove() frees neither. Each leaked vPE takes its ITS state with it, a vpe_id and an LPI pending table. Free both from a second label before the existing unwind. With the freed pointers now cleared, its_free_sgi_irqs() can skip a vPE with no SGI domain and be reused there. The check has to precede the lookup: irq_find_mapping(NULL, 0) falls back to irq_default_domain, and the live irq it returns would then be freed. Fixes: 6d31b6ff985d ("irqchip/gic-v4.1: Add VSGI allocation/teardown") Reviewed-by: Yuan Yao Signed-off-by: Fuad Tabba --- drivers/irqchip/irq-gic-v4.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-gic-v4.c b/drivers/irqchip/irq-gic-v4.c index 754839e409f88..f707a3cb281aa 100644 --- a/drivers/irqchip/irq-gic-v4.c +++ b/drivers/irqchip/irq-gic-v4.c @@ -159,6 +159,8 @@ static int its_alloc_vcpu_sgis(struct its_vpe *vpe, int= idx) return -ENOMEM; } =20 +static void its_free_sgi_irqs(struct its_vm *vm); + int its_alloc_vcpu_irqs(struct its_vm *vm) { int vpe_base_irq, i; @@ -189,11 +191,14 @@ int its_alloc_vcpu_irqs(struct its_vm *vm) vm->vpes[i]->irq =3D vpe_base_irq + i; ret =3D its_alloc_vcpu_sgis(vm->vpes[i], i); if (ret) - goto err; + goto err_free_irqs; } =20 return 0; =20 +err_free_irqs: + its_free_sgi_irqs(vm); + irq_domain_free_irqs(vpe_base_irq, vm->nr_vpes); err: if (vm->domain) { irq_domain_remove(vm->domain); @@ -215,8 +220,13 @@ static void its_free_sgi_irqs(struct its_vm *vm) return; =20 for (i =3D 0; i < vm->nr_vpes; i++) { - unsigned int irq =3D irq_find_mapping(vm->vpes[i]->sgi_domain, 0); + unsigned int irq; =20 + /* irq_find_mapping() falls back to the default domain on NULL. */ + if (!vm->vpes[i]->sgi_domain) + continue; + + irq =3D irq_find_mapping(vm->vpes[i]->sgi_domain, 0); if (WARN_ON(!irq)) continue; =20 --=20 2.39.5 From nobody Thu Sep 24 20:31:10 2026 Received: from mta1.migadu.com (out-34.mta1.migadu.com [95.215.58.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA5EE3F927A for ; Mon, 21 Sep 2026 07:30:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.34 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789975825; cv=none; b=CHCuim2rsv0gkbclsf2xdqoaXkZoidcxAbHpuEcg+/JmFvJLnW7es10WPraJSDcjLtE9V/f+BD20JFVTCH6bYpmPMuLL0lpsghw0F+jDeX3K0+KqvhV2Iuz0mcBR/8pHrnWDUU5MBV9lKsMndF6s2KK8TAhtaaPwUZMvZdhlWjQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789975825; c=relaxed/simple; bh=y65DU0zqn/mUcvtSk0T3Mz/Mz/7Zq8kcpJPr4FrcEdE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PnPQaJJWzd/DjldLt9q8ewfmmCBX3ntsjH4KEpCbPn8y7Y2+7IsBD2VjGOHlMPZ/2DwZrxA1Q33CRmuoVhpBehGWv13lz5zMPrfMUb2qPVaJlksbuBLSUTe9CGPfwfw4gEBWPfC9fJl54nd3qvaTCLoa+9PMLyfqZi3QOXjo6Xc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=bgRIeKeS; arc=none smtp.client-ip=95.215.58.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="bgRIeKeS" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=y65DU0zqn/mUcvtSk0T3Mz/Mz/7Zq8kcpJPr4FrcEdE=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1789975819; v=1; x=1790580619; b=bgRIeKeS4n1ul2c9W0BP3vcQyVxJKHMzCN+OBdnOQI1gmBFQTCueEqh9RNISFP9pFzCnPNeD S3zigjAXYZZrZQdR0Vrohlx/NT1KnndvO7iiN/8KDP/ddLGfivPjtxWLt3bViTJoKEi1mNbXmdi J3PFU6GR6TkiT2hhl/ECJRQQ= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id be837298a217f5ce; Mon, 21 Sep 2026 07:30:11 +0000 X-Mizu-Trace-ID: be837298a217f5ce X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Thomas Gleixner , Eric Auger , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Yuan Yao , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 3/4] KVM: arm64: vgic: Tear down what vgic_init() created when it fails Date: Mon, 21 Sep 2026 08:29:57 +0100 Message-Id: <20260921072958.2918477-4-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260921072958.2918477-1-fuad.tabba@linux.dev> References: <20260921072958.2918477-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Once kvm_vgic_dist_init() has succeeded, every later failure in vgic_init() returns with the SPI array still allocated. A failure after vgic_v4_init() has also succeeded, which means only kvm_vgic_setup_default_irq_routing(), leaves the vPE array behind as well. A failed vgic_init() leaves kvm_arch_vcpu_precreate() admitting new vCPUs, so a retry of KVM_DEV_ARM_VGIC_CTRL_INIT reaches vgic_v4_init()'s early return with an array that no longer covers every vCPU, and vgic_v3_load()'s WARN_ON(vgic_v4_load()) fires on the first one it misses. Release each on the paths that can reach it, so the ioctl is all or nothing and a retry starts from scratch. vgic_v4_init() unwinds its own state on every error return, so its failure leaves only the SPI array to free. dist->nr_spis stays frozen, since the SPI count cannot change once vgic_init() has supplied it. Fixes: 180ae7b11823 ("KVM: arm/arm64: Enable irqchip routing") Fixes: 74fe55dc9ab7 ("KVM: arm/arm64: GICv4: Add init/teardown of the per-V= M vPE irq domain") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260807105558.73D701F000E9@smtp.kernel= .org/ Signed-off-by: Fuad Tabba --- arch/arm64/kvm/vgic/vgic-init.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-ini= t.c index 1537f4d20318e..67d1e8ce2aa2f 100644 --- a/arch/arm64/kvm/vgic/vgic-init.c +++ b/arch/arm64/kvm/vgic/vgic-init.c @@ -513,7 +513,7 @@ int vgic_init(struct kvm *kvm) if (vgic_supports_direct_irqs(kvm)) { ret =3D vgic_v4_init(kvm); if (ret) - return ret; + goto out_free_spis; } } else { if (!dist->nr_spis) @@ -528,17 +528,24 @@ int vgic_init(struct kvm *kvm) kvm_vgic_vcpu_reset(vcpu); =20 ret =3D kvm_vgic_setup_default_irq_routing(kvm); - if (ret) { - if (vgic_is_v5(kvm)) - vgic_v5_teardown(kvm); - - return ret; - } + if (ret) + goto out_teardown; =20 vgic_debug_init(kvm); dist->initialized =3D true; =20 return 0; + +out_teardown: + if (vgic_is_v5(kvm)) + vgic_v5_teardown(kvm); + else + vgic_v4_teardown(kvm); +out_free_spis: + kfree(dist->spis); + dist->spis =3D NULL; + + return ret; } =20 static void kvm_vgic_dist_destroy(struct kvm *kvm) --=20 2.39.5 From nobody Thu Sep 24 20:31:10 2026 Received: from mta0.migadu.com (out-241.mta0.migadu.com [91.218.175.241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D0B43F54D2 for ; Mon, 21 Sep 2026 07:30:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.241 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789975840; cv=none; b=UHnc9mVYvC8PzWOGFLoHXFPjkOLl+C/m1SObqYMQ269zj7or2CFSzJygHxIZIgqv0A71kcZZkNDHsn045T2n3tKA9e3ZC2ol7iD/24eEUZTxqHSUfOq+ZBKLvpABV8NxaX/sMt2FpQLzb2nJqeQCbLsN4DBjKxkf/6SbuXayoGE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789975840; c=relaxed/simple; bh=0njPdbaKLdmcvhV4JMlTlxwDuJcfUS+uR9TLYY7nzIc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Rc9TS3kjNwM6dihoMPWN6YMuOQUO+mNDuv0XC8QhtP1TlTmUZNwDFDKiYwJ22uv8CtPf0o6e7W1elW2h3JrCreEteZpxLmSdjIVxd6Rhtz/udlwO8mu8g0sWOArl96DkcP2Qe4xtSqVmf5VavfxbbERW90UhKtNI4S6ydAt8MFc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=KLE6vh+7; arc=none smtp.client-ip=91.218.175.241 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="KLE6vh+7" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=0njPdbaKLdmcvhV4JMlTlxwDuJcfUS+uR9TLYY7nzIc=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1789975837; v=1; x=1790580637; b=KLE6vh+7evaPaN/5nD+VipZmRTz4ghguw/qtbjv0pSBdE0qBBBrWK7DgWpVHBRXrn6vmarjj JKbqICwSp07PeSUToP5+ZCfKNr7Mt/D1mJEwhr5LZ6hC8XgOSPxtkaF9Mh5IGAdJaKghzKS1AW4 B+COYPKuNtULaK6hN+bhZlgo= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id ad2a4d2e289077aa; Mon, 21 Sep 2026 07:30:23 +0000 X-Mizu-Trace-ID: ad2a4d2e289077aa X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Thomas Gleixner , Eric Auger , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Yuan Yao , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 4/4] KVM: arm64: vgic-v4: Restore nr_vpes before freeing the vPE resources Date: Mon, 21 Sep 2026 08:29:58 +0100 Message-Id: <20260921072958.2918477-5-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260921072958.2918477-1-fuad.tabba@linux.dev> References: <20260921072958.2918477-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vgic_v4_init() truncates its_vm.nr_vpes to the failing index to bound vgic_v4_teardown()'s free_irq() loop, but its_free_vcpu_irqs() reads the same field: the vPE irqs and the v4.1 SGI domains at or above that index are never freed, each one leaking a vpe_id and an LPI pending table. Restore the count from online_vcpus before that call. This depends on the previous patch: a failed vgic_init() keeps admitting vCPUs, so without that patch's teardown the vPE array outlives the failure while online_vcpus grows past the size it was allocated with. Fixes: bdb2d2ccac65 ("KVM: arm/arm64: GICv4: Add doorbell interrupt handlin= g") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260820130616.1A7241F000E9@smtp.kernel= .org/ Suggested-by: Marc Zyngier Signed-off-by: Fuad Tabba --- arch/arm64/kvm/vgic/vgic-v4.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-v4.c b/arch/arm64/kvm/vgic/vgic-v4.c index ed236f083f0d7..30e1de3fc7d9d 100644 --- a/arch/arm64/kvm/vgic/vgic-v4.c +++ b/arch/arm64/kvm/vgic/vgic-v4.c @@ -333,6 +333,9 @@ void vgic_v4_teardown(struct kvm *kvm) free_irq(irq, vcpu); } =20 + /* Make sure we free all VM-wide, per-CPU resources */ + its_vm->nr_vpes =3D atomic_read(&kvm->online_vcpus); + its_free_vcpu_irqs(its_vm); kfree(its_vm->vpes); its_vm->nr_vpes =3D 0; --=20 2.39.5