From: Tao Cui <cui.tao@linux.dev>
To: maobibo@loongson.cn, gaosong@loongson.cn, zhaotianrui@loongson.cn
Cc: loongarch@lists.linux.dev, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, chenhuacai@kernel.org,
kernel@xen0n.name, nagachaithanya9911@gmail.com,
cui.tao@linux.dev, Tao Cui <cuitao@kylinos.cn>
Subject: [PATCH 1/6] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks
Date: Sun, 27 Sep 2026 15:52:35 +0800 [thread overview]
Message-ID: <20260927075240.3007947-2-cui.tao@linux.dev> (raw)
In-Reply-To: <20260927075240.3007947-1-cui.tao@linux.dev>
From: Tao Cui <cuitao@kylinos.cn>
The destroy callbacks of the four irqchip devices free the device
structure without clearing kvm->arch.{ipi,eiointc,pch_pic,dmsintc},
leaving a dangling pointer. ops->destroy() is not only called at VM
teardown but also when KVM_CREATE_DEVICE succeeds and the following
anon_inode_getfd() fails (e.g. under RLIMIT_NOFILE); the VM stays
alive, kvm_arch_irqchip_in_kernel() still reports true, and interrupt
injection dereferences the freed device.
Clear the pointer before freeing.
Fixes: c532de5a67a7 ("LoongArch: KVM: Add IPI device support")
Fixes: 2e8b9df82631 ("LoongArch: KVM: Add EIOINTC device support")
Fixes: e785dfacf7e7 ("LoongArch: KVM: Add PCHPIC device support")
Fixes: 229132c309d6 ("LoongArch: KVM: Add DMSINTC device support")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
arch/loongarch/kvm/intc/dmsintc.c | 5 ++++-
arch/loongarch/kvm/intc/eiointc.c | 1 +
arch/loongarch/kvm/intc/ipi.c | 1 +
arch/loongarch/kvm/intc/pch_pic.c | 1 +
4 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/loongarch/kvm/intc/dmsintc.c b/arch/loongarch/kvm/intc/dmsintc.c
index 89f980d867be..63072595c01b 100644
--- a/arch/loongarch/kvm/intc/dmsintc.c
+++ b/arch/loongarch/kvm/intc/dmsintc.c
@@ -161,11 +161,14 @@ static int kvm_dmsintc_create(struct kvm_device *dev, u32 type)
static void kvm_dmsintc_destroy(struct kvm_device *dev)
{
+ struct loongarch_dmsintc *s;
if (!dev || !dev->kvm || !dev->kvm->arch.dmsintc)
return;
- kfree(dev->kvm->arch.dmsintc);
+ s = dev->kvm->arch.dmsintc;
+ dev->kvm->arch.dmsintc = NULL;
+ kfree(s);
kfree(dev);
}
diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
index 80f78e07c74a..fe0a1918f26f 100644
--- a/arch/loongarch/kvm/intc/eiointc.c
+++ b/arch/loongarch/kvm/intc/eiointc.c
@@ -675,6 +675,7 @@ static void kvm_eiointc_destroy(struct kvm_device *dev)
kvm = dev->kvm;
eiointc = kvm->arch.eiointc;
+ kvm->arch.eiointc = NULL;
mutex_lock(&kvm->slots_lock);
kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device);
kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device_vext);
diff --git a/arch/loongarch/kvm/intc/ipi.c b/arch/loongarch/kvm/intc/ipi.c
index 7b333a4a0430..6ee90c10827a 100644
--- a/arch/loongarch/kvm/intc/ipi.c
+++ b/arch/loongarch/kvm/intc/ipi.c
@@ -444,6 +444,7 @@ static void kvm_ipi_destroy(struct kvm_device *dev)
kvm = dev->kvm;
ipi = kvm->arch.ipi;
+ kvm->arch.ipi = NULL;
mutex_lock(&kvm->slots_lock);
kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &ipi->device);
mutex_unlock(&kvm->slots_lock);
diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index 2b63b0c2c7ce..62c09b5f3937 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -483,6 +483,7 @@ static void kvm_pch_pic_destroy(struct kvm_device *dev)
kvm = dev->kvm;
s = kvm->arch.pch_pic;
+ kvm->arch.pch_pic = NULL;
/* unregister pch pic device and free it's memory */
mutex_lock(&kvm->slots_lock);
kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &s->device);
--
2.43.0
next prev parent reply other threads:[~2026-09-27 7:53 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-27 7:52 [PATCH 0/6] LoongArch: KVM: irqchip and steal time fixes Tao Cui
2026-09-27 7:52 ` Tao Cui [this message]
2026-09-28 4:07 ` [PATCH 1/6] LoongArch: KVM: Clear device pointer in irqchip destroy callbacks Bibo Mao
2026-09-27 7:52 ` [PATCH 2/6] LoongArch: KVM: Guard against NULL irqchip in irq injection Tao Cui
2026-09-28 4:14 ` Bibo Mao
2026-09-28 9:24 ` Tao Cui
2026-09-27 7:52 ` [PATCH 3/6] LoongArch: KVM: Load dmsintc pointer once in pch_msi_set_irq Tao Cui
2026-09-27 8:05 ` sashiko-bot
2026-09-27 7:52 ` [PATCH 4/6] LoongArch: KVM: Rebase steal time counter in vcpu context Tao Cui
2026-09-27 8:11 ` sashiko-bot
2026-09-28 7:23 ` Bibo Mao
2026-09-28 9:28 ` Tao Cui
2026-09-27 7:52 ` [PATCH 5/6] LoongArch: KVM: Propagate real error code in kvm_pch_pic_create Tao Cui
2026-09-28 7:25 ` Bibo Mao
2026-09-27 7:52 ` [PATCH 6/6] LoongArch: KVM: Reject repeated PCH-PIC CTRL_INIT Tao Cui
2026-09-28 8:01 ` Bibo Mao
2026-09-28 9:31 ` Tao Cui
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260927075240.3007947-2-cui.tao@linux.dev \
--to=cui.tao@linux.dev \
--cc=chenhuacai@kernel.org \
--cc=cuitao@kylinos.cn \
--cc=gaosong@loongson.cn \
--cc=kernel@xen0n.name \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=loongarch@lists.linux.dev \
--cc=maobibo@loongson.cn \
--cc=nagachaithanya9911@gmail.com \
--cc=zhaotianrui@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.