From: Tao Cui <cui.tao@linux.dev>
To: maobibo@loongson.cn, gaosong@loongson.cn, zhaotianrui@loongson.cn
Cc: loongarch@lists.linux.dev, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, chenhuacai@kernel.org,
kernel@xen0n.name, nagachaithanya9911@gmail.com,
cui.tao@linux.dev, Tao Cui <cuitao@kylinos.cn>
Subject: [PATCH 2/6] LoongArch: KVM: Guard against NULL irqchip in irq injection
Date: Sun, 27 Sep 2026 15:52:36 +0800 [thread overview]
Message-ID: <20260927075240.3007947-3-cui.tao@linux.dev> (raw)
In-Reply-To: <20260927075240.3007947-1-cui.tao@linux.dev>
From: Tao Cui <cuitao@kylinos.cn>
The irqfd injection path dispatches through the irq routing table
without the kvm_arch_irqchip_in_kernel() gate that protects
KVM_IRQ_LINE: kvm_set_pic_irq() and kvm_arch_set_irq_inatomic() call
pch_pic_set_irq(kvm->arch.pch_pic, ...) and pch_msi_set_irq() calls
eiointc_set_irq(kvm->arch.eiointc, ...) directly, so a routing entry
that outlives the corresponding in-kernel irqchip dereferences a NULL
(or, before the previous patch, a freed) device.
Make pch_pic_set_irq(), eiointc_set_irq() and dmsintc_set_irq()
tolerate a NULL device.
Fixes: 1928254c5ccb ("LoongArch: KVM: Add irqfd support")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
arch/loongarch/kvm/intc/dmsintc.c | 3 +++
arch/loongarch/kvm/intc/eiointc.c | 5 ++++-
arch/loongarch/kvm/intc/pch_pic.c | 3 +++
3 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/arch/loongarch/kvm/intc/dmsintc.c b/arch/loongarch/kvm/intc/dmsintc.c
index 63072595c01b..e27f448bb54f 100644
--- a/arch/loongarch/kvm/intc/dmsintc.c
+++ b/arch/loongarch/kvm/intc/dmsintc.c
@@ -70,6 +70,9 @@ int dmsintc_set_irq(struct kvm *kvm, u64 addr, int data, int level)
unsigned int irq, cpu;
struct kvm_vcpu *vcpu;
+ if (!kvm->arch.dmsintc)
+ return -EINVAL;
+
irq = (addr >> AVEC_IRQ_SHIFT) & AVEC_IRQ_MASK;
cpu = (addr >> AVEC_CPU_SHIFT) & kvm->arch.dmsintc->cpu_mask;
if (cpu >= KVM_MAX_VCPUS)
diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
index fe0a1918f26f..c68f9033638a 100644
--- a/arch/loongarch/kvm/intc/eiointc.c
+++ b/arch/loongarch/kvm/intc/eiointc.c
@@ -112,8 +112,11 @@ static inline void eiointc_update_sw_coremap(struct loongarch_eiointc *s,
void eiointc_set_irq(struct loongarch_eiointc *s, int irq, int level)
{
unsigned long flags;
- unsigned long *isr = (unsigned long *)s->isr;
+ unsigned long *isr;
+ if (!s)
+ return;
+ isr = (unsigned long *)s->isr;
spin_lock_irqsave(&s->lock, flags);
level ? __set_bit(irq, isr) : __clear_bit(irq, isr);
eiointc_update_irq(s, irq, level);
diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index 62c09b5f3937..88666425d800 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -48,6 +48,9 @@ void pch_pic_set_irq(struct loongarch_pch_pic *s, int irq, int level)
{
u64 mask = BIT(irq);
+ if (!s)
+ return;
+
spin_lock(&s->lock);
if (level)
s->irr |= mask; /* set irr */
--
2.43.0
next prev parent reply other threads:[~2026-09-27 7:53 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-27 7:52 [PATCH 0/6] LoongArch: KVM: irqchip and steal time fixes Tao Cui
2026-09-27 7:52 ` [PATCH 1/6] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks Tao Cui
2026-09-28 4:07 ` Bibo Mao
2026-09-27 7:52 ` Tao Cui [this message]
2026-09-28 4:14 ` [PATCH 2/6] LoongArch: KVM: Guard against NULL irqchip in irq injection Bibo Mao
2026-09-28 9:24 ` Tao Cui
2026-09-27 7:52 ` [PATCH 3/6] LoongArch: KVM: Load dmsintc pointer once in pch_msi_set_irq Tao Cui
2026-09-27 7:52 ` [PATCH 4/6] LoongArch: KVM: Rebase steal time counter in vcpu context Tao Cui
2026-09-28 7:23 ` Bibo Mao
2026-09-28 9:28 ` Tao Cui
2026-09-27 7:52 ` [PATCH 5/6] LoongArch: KVM: Propagate real error code in kvm_pch_pic_create Tao Cui
2026-09-28 7:25 ` Bibo Mao
2026-09-27 7:52 ` [PATCH 6/6] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT Tao Cui
2026-09-28 8:01 ` Bibo Mao
2026-09-28 9:31 ` Tao Cui
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260927075240.3007947-3-cui.tao@linux.dev \
--to=cui.tao@linux.dev \
--cc=chenhuacai@kernel.org \
--cc=cuitao@kylinos.cn \
--cc=gaosong@loongson.cn \
--cc=kernel@xen0n.name \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=loongarch@lists.linux.dev \
--cc=maobibo@loongson.cn \
--cc=nagachaithanya9911@gmail.com \
--cc=zhaotianrui@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®