From: Fuad Tabba <fuad.tabba@linux.dev>
To: Yuchao Zhang <ndaugoing@gmail.com>
Cc: sashiko-reviews@lists.linux.dev, kvmarm@lists.linux.dev,
Oliver Upton <oupton@kernel.org>, Marc Zyngier <maz@kernel.org>,
Fuad Tabba <tabba@google.com>
Subject: Re: [PATCH v2] KVM: selftests: arm64: Add test for cross-vCPU LPI disable race
Date: Tue, 22 Sep 2026 18:08:34 +0100 [thread overview]
Message-ID: <20260922170834.3228429-1-fuad.tabba@linux.dev> (raw)
In-Reply-To: <20260922105331.40498-1-ndaugoing@gmail.com>
Hi Yuchao,
The test passes on an unpatched 7.3-rc3 for me, so it doesn't reproduce
the bug yet.
On Tue, 22 Sep 2026 11:53:31 +0100, Yuchao Zhang <ndaugoing@gmail.com> wrote:
[...]
> On unpatched kernels, this race can lead to a use-after-free or host
> kernel panic in vgic_fold_lr_state() due to a dangling last_lr_irq
> pointer. With the fix in place (stopping the VM and holding a
> refcount on last_lr_irq), the test runs to completion without errors.
With only LPIs in flight EOIcount stays 0, so the fold breaks out of the
ap_list walk before it dereferences anything past the stale last_lr_irq.
To crash, the target vcpu has to EOI a non-LPI interrupt that's active
outside the LRs, with the remote disable landing while it's still in the
guest.
Cheers,
/fuad
next prev parent reply other threads:[~2026-09-22 17:08 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-18 4:02 [PATCH v2 0/1] KVM: arm64: vgic: fix UAF/crash on remote LPI disable zjamg
2026-09-18 4:02 ` [PATCH v2] KVM: arm64: vgic: Do not remove in-flight LPIs from AP list on disable zjamg
2026-09-18 7:22 ` Fuad Tabba
2026-09-18 11:50 ` Yuchao Zhang
2026-09-18 11:58 ` Fuad Tabba
2026-09-18 19:15 ` Oliver Upton
2026-09-20 23:54 ` Marc Zyngier
2026-09-20 1:49 ` [PATCH v3 0/1] KVM: arm64: vgic: Drop last_lr_irq and serialize overflow EOI replay Yuchao Zhang
2026-09-20 1:49 ` [PATCH v3] " Yuchao Zhang
2026-09-20 23:47 ` [PATCH v3 0/1] " Marc Zyngier
2026-09-22 10:16 ` Yuchao Zhang
2026-09-22 10:16 ` [PATCH] KVM: selftests: arm64: Add test for cross-vCPU LPI disable race Yuchao Zhang
2026-09-22 10:29 ` sashiko-bot
2026-09-22 10:53 ` Yuchao Zhang
2026-09-22 10:53 ` [PATCH v2] " Yuchao Zhang
2026-09-22 11:03 ` sashiko-bot
2026-09-22 11:24 ` Yuchao Zhang
2026-09-22 17:08 ` Fuad Tabba [this message]
2026-09-22 17:05 ` [PATCH v3 0/1] KVM: arm64: vgic: Drop last_lr_irq and serialize overflow EOI replay Fuad Tabba
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260922170834.3228429-1-fuad.tabba@linux.dev \
--to=fuad.tabba@linux.dev \
--cc=kvmarm@lists.linux.dev \
--cc=maz@kernel.org \
--cc=ndaugoing@gmail.com \
--cc=oupton@kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=tabba@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.