[PATCH 0/6] LoongArch: KVM: irqchip and steal time fixes

[Tao Cui <cui.tao@linux.dev>]

From: Tao Cui <cuitao@kylinos.cn>

Hi,

Six fixes for the LoongArch KVM irqchip and paravirtual steal time
code:

- Patch 1 fixes a host use-after-free: when KVM_CREATE_DEVICE succeeds
  but the following fd allocation fails (e.g. under RLIMIT_NOFILE),
  ops->destroy() frees the irqchip while kvm->arch.* still points to
  it, so later interrupt injection walks into freed memory.  Verified
  on Loongson-3A6000: with the fd budget exhausted, KVM_IRQ_LINE
  returns success and pch_pic_set_irq() executes on the freed object
  (kprobe); with the fix the same sequence returns -ENXIO.

- Patch 2 makes the irqfd injection entry points tolerate a NULL
  irqchip device: they dispatch through the irq routing table without
  the irqchip_in_kernel() gate that protects KVM_IRQ_LINE, so a
  routing entry that outlives the device dereferences it.

- Patch 3 loads kvm->arch.dmsintc once in the MSI injection path:
  both pch_msi_set_irq() and dmsintc_set_irq() re-read the pointer
  between the non-NULL check and the following dereferences, so a
  concurrent device removal is observed between them.

- Patch 4 fixes steal time accounting: the PVTIME attribute
  initializes its baseline from the control thread's run_delay while
  the accumulation happens in the vcpu thread, so the first delta can
  wrap and the guest reads a steal time near 2^64.  This hits the
  default QEMU topology (control thread sets the attribute, vcpu
  threads run KVM_RUN) once the guest enables steal time.  Verified on
  Loongson-3A6000: a guest steal value of 2^64 - 7.58s before the fix,
  a small value after it.

- Patch 5 aligns kvm_pch_pic_create() with kvm_eiointc_create() by
  propagating the real error code; the kvm_ipi_create() counterpart is
  being fixed separately by "Return the actual error code in
  kvm_ipi_create()" (Chaithanya Lagisetty).

- Patch 6 rejects a repeated PCH-PIC CTRL_INIT: every call registers
  the device on the MMIO bus at the new address while destroy removes
  only one range, so stale ranges silently swallow MMIO accesses
  (measured with kprobes: three accepted inits, one unregister).

All patches carry Fixes tags.

Tao Cui (6):
  LoongArch: KVM: Clear device pointer in irqchip destroy callbacks
  LoongArch: KVM: Guard against NULL irqchip in irq injection
  LoongArch: KVM: Load dmsintc pointer once in pch_msi_set_irq
  LoongArch: KVM: Rebase steal time counter in vcpu context
  LoongArch: KVM: Propagate real error code in kvm_pch_pic_create
  LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT

 arch/loongarch/kvm/intc/dmsintc.c | 12 ++++++++++--
 arch/loongarch/kvm/intc/eiointc.c |  6 +++++-
 arch/loongarch/kvm/intc/ipi.c     |  1 +
 arch/loongarch/kvm/intc/pch_pic.c | 23 +++++++++++++++++------
 arch/loongarch/kvm/vcpu.c         | 25 +++++++++++++++++--------
 5 files changed, 50 insertions(+), 17 deletions(-)

-- 
2.43.0