From: Tao Cui <cui.tao@linux.dev>
To: maobibo@loongson.cn, gaosong@loongson.cn, zhaotianrui@loongson.cn
Cc: loongarch@lists.linux.dev, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, chenhuacai@kernel.org,
kernel@xen0n.name, nagachaithanya9911@gmail.com,
cui.tao@linux.dev, Tao Cui <cuitao@kylinos.cn>
Subject: [PATCH 6/6] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT
Date: Sun, 27 Sep 2026 15:52:40 +0800 [thread overview]
Message-ID: <20260927075240.3007947-7-cui.tao@linux.dev> (raw)
In-Reply-To: <20260927075240.3007947-1-cui.tao@linux.dev>
From: Tao Cui <cuitao@kylinos.cn>
KVM_DEV_LOONGARCH_PCH_PIC_CTRL_INIT has no guard against repeated
invocation: every call overwrites pch_pic_base and registers the same
kvm_io_device on the MMIO bus at the new address, while
kvm_pch_pic_destroy() unregisters only one bus range. After a repeated
init, MMIO to the stale ranges computes its register offset against the
new base and silently reads 0 / drops writes, and the leftover bus
entries persist until the VM is destroyed.
Reject a repeated init with -EBUSY, a null address with -EINVAL, and
only set pch_pic_base after the bus registration succeeds so a failed
init does not leave the device half-initialized. The registration
error is propagated instead of being replaced with -EFAULT.
Fixes: d206d9514873 ("LoongArch: KVM: Add PCHPIC user mode read and write functions")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
arch/loongarch/kvm/intc/pch_pic.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index 136211f154d4..2baf9ecf0c8a 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -285,7 +285,10 @@ static int kvm_pch_pic_init(struct kvm_device *dev, u64 addr)
struct kvm_io_device *device;
struct loongarch_pch_pic *s = dev->kvm->arch.pch_pic;
- s->pch_pic_base = addr;
+ if (!addr)
+ return -EINVAL;
+ if (s->pch_pic_base)
+ return -EBUSY;
device = &s->device;
/* init device by pch pic writing and reading ops */
kvm_iodevice_init(device, &kvm_pch_pic_ops);
@@ -293,8 +296,11 @@ static int kvm_pch_pic_init(struct kvm_device *dev, u64 addr)
/* register pch pic device */
ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, addr, PCH_PIC_SIZE, device);
mutex_unlock(&kvm->slots_lock);
+ if (ret < 0)
+ return ret;
- return (ret < 0) ? -EFAULT : 0;
+ s->pch_pic_base = addr;
+ return 0;
}
/* used by user space to get or set pch pic registers */
--
2.43.0
next prev parent reply other threads:[~2026-09-27 7:53 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-27 7:52 [PATCH 0/6] LoongArch: KVM: irqchip and steal time fixes Tao Cui
2026-09-27 7:52 ` [PATCH 1/6] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks Tao Cui
2026-09-28 4:07 ` Bibo Mao
2026-09-27 7:52 ` [PATCH 2/6] LoongArch: KVM: Guard against NULL irqchip in irq injection Tao Cui
2026-09-28 4:14 ` Bibo Mao
2026-09-28 9:24 ` Tao Cui
2026-09-27 7:52 ` [PATCH 3/6] LoongArch: KVM: Load dmsintc pointer once in pch_msi_set_irq Tao Cui
2026-09-27 7:52 ` [PATCH 4/6] LoongArch: KVM: Rebase steal time counter in vcpu context Tao Cui
2026-09-28 7:23 ` Bibo Mao
2026-09-28 9:28 ` Tao Cui
2026-09-27 7:52 ` [PATCH 5/6] LoongArch: KVM: Propagate real error code in kvm_pch_pic_create Tao Cui
2026-09-28 7:25 ` Bibo Mao
2026-09-27 7:52 ` Tao Cui [this message]
2026-09-28 8:01 ` [PATCH 6/6] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT Bibo Mao
2026-09-28 9:31 ` Tao Cui
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260927075240.3007947-7-cui.tao@linux.dev \
--to=cui.tao@linux.dev \
--cc=chenhuacai@kernel.org \
--cc=cuitao@kylinos.cn \
--cc=gaosong@loongson.cn \
--cc=kernel@xen0n.name \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=loongarch@lists.linux.dev \
--cc=maobibo@loongson.cn \
--cc=nagachaithanya9911@gmail.com \
--cc=zhaotianrui@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®