Re: [PATCH v5 2/2] RISC-V: KVM: AIA: Make HGEI number management fully per-CPU

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] This problem wasn't introduced by this patch, but a Use-After-Free vulnerability exists in `kvm_riscv_aia_disable()` during concurrent VM destruction and CPU offline.
--

commit b20fb1dd06460a83c6a2cbe4fe6445306d7467e2
Author: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>

RISC-V: KVM: AIA: Make HGEI number management fully per-CPU

This commit introduces a per-CPU field for the number of Hypervisor Guest
External Interrupt (HGEI) lines, replacing a single global variable. It
updates allocation, freeing, and disabling paths to use the probed
per-CPU values. The global value is retained to represent the minimum
number of HGEI lines across all HARTs.

> diff --git a/arch/riscv/kvm/aia.c b/arch/riscv/kvm/aia.c
> index 5ec503288555d..bafb009c5ce55 100644
> --- a/arch/riscv/kvm/aia.c
> +++ b/arch/riscv/kvm/aia.c
[ ... ]
> @@ -588,7 +617,7 @@ void kvm_riscv_aia_disable(void)
>  
>  	raw_spin_lock_irqsave(&hgctrl->lock, flags);
>  
> -	for (i = 0; i <= kvm_riscv_aia_nr_hgei; i++) {
> +	for (i = 0; i <= hgctrl->nr_hgei; i++) {
>  		vcpu = hgctrl->owners[i];
>  		if (!vcpu)
>  			continue;

[Severity: Critical]
This is a pre-existing issue, but could this lead to a use-after-free
during concurrent VM destruction and CPU offline?

Looking at kvm_riscv_aia_disable(), the code reads the vcpu pointer and
temporarily drops the lock before using it:

    vcpu = hgctrl->owners[i];
    if (!vcpu)
        continue;

    raw_spin_unlock_irqrestore(&hgctrl->lock, flags);
    kvm_riscv_vcpu_aia_imsic_release(vcpu);

If CPU hotplug runs concurrently with VM teardown:

CPU1 (CPU offline)
kvm_riscv_aia_disable()
    vcpu = hgctrl->owners[i];
    raw_spin_unlock_irqrestore(&hgctrl->lock, flags);

CPU2 (VM teardown)
kvm_destroy_vm()
    kvm_vcpu_destroy()
        kvm_riscv_vcpu_aia_deinit()
            imsic_vsfile_cleanup()
                kvm_riscv_aia_free_hgei()
                    // acquires hgctrl->lock, clears the owners slot
        kmem_cache_free(vcpu)

CPU1 (CPU offline resumes)
kvm_riscv_aia_disable()
    kvm_riscv_vcpu_aia_imsic_release(vcpu); // dereferences freed vcpu

Since kvm_vcpu_destroy() does not use RCU for reclamation and no reference
counts are held for the vcpu while the lock is dropped, the memory appears
to be freed immediately.

Is there a mechanism preventing this race?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525094945.3721783-1-anup.patel@oss.qualcomm.com?part=2