From: Tao Cui <cui.tao@linux.dev>
To: maobibo@loongson.cn, gaosong@loongson.cn, zhaotianrui@loongson.cn
Cc: loongarch@lists.linux.dev, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, chenhuacai@kernel.org,
kernel@xen0n.name, nagachaithanya9911@gmail.com,
cui.tao@linux.dev, Tao Cui <cuitao@kylinos.cn>
Subject: [PATCH 3/6] LoongArch: KVM: Load dmsintc pointer once in pch_msi_set_irq
Date: Sun, 27 Sep 2026 15:52:37 +0800 [thread overview]
Message-ID: <20260927075240.3007947-4-cui.tao@linux.dev> (raw)
In-Reply-To: <20260927075240.3007947-1-cui.tao@linux.dev>
From: Tao Cui <cuitao@kylinos.cn>
pch_msi_set_irq() reads kvm->arch.dmsintc several times: the non-NULL
check and the address-window comparison each reload the pointer, so a
concurrent device removal can be observed between them and the
following dereference hits a freed object.
Load the pointer once at the top of pch_msi_set_irq(); also use the
local in dmsintc_set_irq() for its own cpu_mask read.
Fixes: 03de5eecb0f0 ("LoongArch: KVM: Add DMSINTC inject msi to vCPU")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
arch/loongarch/kvm/intc/dmsintc.c | 6 ++++--
arch/loongarch/kvm/intc/pch_pic.c | 7 ++++---
2 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/arch/loongarch/kvm/intc/dmsintc.c b/arch/loongarch/kvm/intc/dmsintc.c
index e27f448bb54f..d42567eba3ed 100644
--- a/arch/loongarch/kvm/intc/dmsintc.c
+++ b/arch/loongarch/kvm/intc/dmsintc.c
@@ -70,11 +70,13 @@ int dmsintc_set_irq(struct kvm *kvm, u64 addr, int data, int level)
unsigned int irq, cpu;
struct kvm_vcpu *vcpu;
- if (!kvm->arch.dmsintc)
+ struct loongarch_dmsintc *s = kvm->arch.dmsintc;
+
+ if (!s)
return -EINVAL;
irq = (addr >> AVEC_IRQ_SHIFT) & AVEC_IRQ_MASK;
- cpu = (addr >> AVEC_CPU_SHIFT) & kvm->arch.dmsintc->cpu_mask;
+ cpu = (addr >> AVEC_CPU_SHIFT) & s->cpu_mask;
if (cpu >= KVM_MAX_VCPUS)
return -EINVAL;
vcpu = kvm_get_vcpu_by_cpuid(kvm, cpu);
diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index 88666425d800..e33d6693c37c 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -74,10 +74,11 @@ void pch_pic_set_irq(struct loongarch_pch_pic *s, int irq, int level)
int pch_msi_set_irq(struct kvm *kvm, struct kvm_kernel_irq_routing_entry *e, int level)
{
u64 msg_addr = (((u64)e->msi.address_hi) << 32) | e->msi.address_lo;
+ struct loongarch_dmsintc *dmsintc = kvm->arch.dmsintc;
- if (cpu_has_msgint && kvm->arch.dmsintc &&
- msg_addr >= kvm->arch.dmsintc->msg_addr_base &&
- msg_addr < (kvm->arch.dmsintc->msg_addr_base + kvm->arch.dmsintc->msg_addr_size)) {
+ if (cpu_has_msgint && dmsintc &&
+ msg_addr >= dmsintc->msg_addr_base &&
+ msg_addr < (dmsintc->msg_addr_base + dmsintc->msg_addr_size)) {
return dmsintc_set_irq(kvm, msg_addr, e->msi.data, level);
}
--
2.43.0
next prev parent reply other threads:[~2026-09-27 7:53 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-27 7:52 [PATCH 0/6] LoongArch: KVM: irqchip and steal time fixes Tao Cui
2026-09-27 7:52 ` [PATCH 1/6] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks Tao Cui
2026-09-28 4:07 ` Bibo Mao
2026-09-27 7:52 ` [PATCH 2/6] LoongArch: KVM: Guard against NULL irqchip in irq injection Tao Cui
2026-09-28 4:14 ` Bibo Mao
2026-09-28 9:24 ` Tao Cui
2026-09-27 7:52 ` Tao Cui [this message]
2026-09-27 7:52 ` [PATCH 4/6] LoongArch: KVM: Rebase steal time counter in vcpu context Tao Cui
2026-09-28 7:23 ` Bibo Mao
2026-09-28 9:28 ` Tao Cui
2026-09-27 7:52 ` [PATCH 5/6] LoongArch: KVM: Propagate real error code in kvm_pch_pic_create Tao Cui
2026-09-28 7:25 ` Bibo Mao
2026-09-27 7:52 ` [PATCH 6/6] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT Tao Cui
2026-09-28 8:01 ` Bibo Mao
2026-09-28 9:31 ` Tao Cui
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260927075240.3007947-4-cui.tao@linux.dev \
--to=cui.tao@linux.dev \
--cc=chenhuacai@kernel.org \
--cc=cuitao@kylinos.cn \
--cc=gaosong@loongson.cn \
--cc=kernel@xen0n.name \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=loongarch@lists.linux.dev \
--cc=maobibo@loongson.cn \
--cc=nagachaithanya9911@gmail.com \
--cc=zhaotianrui@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®