From: Tao Cui <cui.tao@linux.dev>
To: maobibo@loongson.cn, gaosong@loongson.cn, zhaotianrui@loongson.cn
Cc: loongarch@lists.linux.dev, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, chenhuacai@kernel.org,
kernel@xen0n.name, nagachaithanya9911@gmail.com,
cui.tao@linux.dev, Tao Cui <cuitao@kylinos.cn>
Subject: [PATCH 1/6] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks
Date: Sun, 27 Sep 2026 15:52:35 +0800 [thread overview]
Message-ID: <20260927075240.3007947-2-cui.tao@linux.dev> (raw)
In-Reply-To: <20260927075240.3007947-1-cui.tao@linux.dev>
From: Tao Cui <cuitao@kylinos.cn>
The destroy callbacks of the four irqchip devices free the device
structure without clearing kvm->arch.{ipi,eiointc,pch_pic,dmsintc},
leaving a dangling pointer. ops->destroy() is not only called at VM
teardown but also when KVM_CREATE_DEVICE succeeds and the following
anon_inode_getfd() fails (e.g. under RLIMIT_NOFILE); the VM stays
alive, kvm_arch_irqchip_in_kernel() still reports true, and interrupt
injection dereferences the freed device.
Clear the pointer before freeing.
Fixes: c532de5a67a7 ("LoongArch: KVM: Add IPI device support")
Fixes: 2e8b9df82631 ("LoongArch: KVM: Add EIOINTC device support")
Fixes: e785dfacf7e7 ("LoongArch: KVM: Add PCHPIC device support")
Fixes: 229132c309d6 ("LoongArch: KVM: Add DMSINTC device support")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
arch/loongarch/kvm/intc/dmsintc.c | 5 ++++-
arch/loongarch/kvm/intc/eiointc.c | 1 +
arch/loongarch/kvm/intc/ipi.c | 1 +
arch/loongarch/kvm/intc/pch_pic.c | 1 +
4 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/loongarch/kvm/intc/dmsintc.c b/arch/loongarch/kvm/intc/dmsintc.c
index 89f980d867be..63072595c01b 100644
--- a/arch/loongarch/kvm/intc/dmsintc.c
+++ b/arch/loongarch/kvm/intc/dmsintc.c
@@ -161,11 +161,14 @@ static int kvm_dmsintc_create(struct kvm_device *dev, u32 type)
static void kvm_dmsintc_destroy(struct kvm_device *dev)
{
+ struct loongarch_dmsintc *s;
if (!dev || !dev->kvm || !dev->kvm->arch.dmsintc)
return;
- kfree(dev->kvm->arch.dmsintc);
+ s = dev->kvm->arch.dmsintc;
+ dev->kvm->arch.dmsintc = NULL;
+ kfree(s);
kfree(dev);
}
diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
index 80f78e07c74a..fe0a1918f26f 100644
--- a/arch/loongarch/kvm/intc/eiointc.c
+++ b/arch/loongarch/kvm/intc/eiointc.c
@@ -675,6 +675,7 @@ static void kvm_eiointc_destroy(struct kvm_device *dev)
kvm = dev->kvm;
eiointc = kvm->arch.eiointc;
+ kvm->arch.eiointc = NULL;
mutex_lock(&kvm->slots_lock);
kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device);
kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device_vext);
diff --git a/arch/loongarch/kvm/intc/ipi.c b/arch/loongarch/kvm/intc/ipi.c
index 7b333a4a0430..6ee90c10827a 100644
--- a/arch/loongarch/kvm/intc/ipi.c
+++ b/arch/loongarch/kvm/intc/ipi.c
@@ -444,6 +444,7 @@ static void kvm_ipi_destroy(struct kvm_device *dev)
kvm = dev->kvm;
ipi = kvm->arch.ipi;
+ kvm->arch.ipi = NULL;
mutex_lock(&kvm->slots_lock);
kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &ipi->device);
mutex_unlock(&kvm->slots_lock);
diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index 2b63b0c2c7ce..62c09b5f3937 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -483,6 +483,7 @@ static void kvm_pch_pic_destroy(struct kvm_device *dev)
kvm = dev->kvm;
s = kvm->arch.pch_pic;
+ kvm->arch.pch_pic = NULL;
/* unregister pch pic device and free it's memory */
mutex_lock(&kvm->slots_lock);
kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &s->device);
--
2.43.0
next prev parent reply other threads:[~2026-09-27 7:53 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-27 7:52 [PATCH 0/6] LoongArch: KVM: irqchip and steal time fixes Tao Cui
2026-09-27 7:52 ` Tao Cui [this message]
2026-09-28 4:07 ` [PATCH 1/6] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks Bibo Mao
2026-09-27 7:52 ` [PATCH 2/6] LoongArch: KVM: Guard against NULL irqchip in irq injection Tao Cui
2026-09-28 4:14 ` Bibo Mao
2026-09-28 9:24 ` Tao Cui
2026-09-27 7:52 ` [PATCH 3/6] LoongArch: KVM: Load dmsintc pointer once in pch_msi_set_irq Tao Cui
2026-09-27 7:52 ` [PATCH 4/6] LoongArch: KVM: Rebase steal time counter in vcpu context Tao Cui
2026-09-28 7:23 ` Bibo Mao
2026-09-28 9:28 ` Tao Cui
2026-09-27 7:52 ` [PATCH 5/6] LoongArch: KVM: Propagate real error code in kvm_pch_pic_create Tao Cui
2026-09-28 7:25 ` Bibo Mao
2026-09-27 7:52 ` [PATCH 6/6] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT Tao Cui
2026-09-28 8:01 ` Bibo Mao
2026-09-28 9:31 ` Tao Cui
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260927075240.3007947-2-cui.tao@linux.dev \
--to=cui.tao@linux.dev \
--cc=chenhuacai@kernel.org \
--cc=cuitao@kylinos.cn \
--cc=gaosong@loongson.cn \
--cc=kernel@xen0n.name \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=loongarch@lists.linux.dev \
--cc=maobibo@loongson.cn \
--cc=nagachaithanya9911@gmail.com \
--cc=zhaotianrui@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®