Re: [PATCH v3 02/40] irqchip/gic-v5: Provide OF IRS config frame attrs to KVM

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Failing to initialize an IRS leaves dangling pointers in the `per_cpu_irs_data` array, causing a Use-After-Free on subsequent accesses.
--

commit 2e4c81aa47ab5216dcd3371d3e6ff357cb0a76e6
Author: Sascha Bischoff <Sascha.Bischoff@arm.com>

irqchip/gic-v5: Provide OF IRS config frame attrs to KVM

This commit passes a pointer to an IRS config frame to KVM so it can interact
with the host IRS directly. It adds a new function to retrieve the chip data
and populates the gic_v5_kvm_info structure with the IRS base address and
coherency flag.

> diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
> index f3fce0b1e25d9..607e066821b52 100644
> --- a/drivers/irqchip/irq-gic-v5-irs.c
> +++ b/drivers/irqchip/irq-gic-v5-irs.c
[ ... ]
> @@ -50,6 +48,11 @@ static void irs_writeq_relaxed(struct gicv5_irs_chip_data *irs_data,
>  	writeq_relaxed(val, irs_data->irs_base + reg_offset);
>  }
>  
> +struct gicv5_irs_chip_data *gicv5_irs_get_chip_data(void)
> +{
> +	return per_cpu(per_cpu_irs_data, 0);

[Severity: High]
This isn't a bug introduced by this patch, but can accessing per_cpu_irs_data
here result in a use-after-free?

If an IRS fails initialization (for example, due to missing LPI support
checked in gicv5_irs_init()), the driver frees irs_data on the error path
in gicv5_irs_of_init():

    kfree(irs_data);

However, gicv5_irs_of_init_affinity() has already populated per_cpu_irs_data
for the associated CPUs prior to the failure:

    per_cpu(per_cpu_irs_data, cpu) = irs_data;

If another IRS on the system initializes successfully, gicv5_irs_of_probe()
succeeds. When the CPUs associated with the failed IRS start up,
gicv5_starting_cpu() invokes gicv5_irs_register_cpu(), which unconditionally
dereferences the dangling pointer from per_cpu_irs_data:

    irs_writel_relaxed(irs_data, selr, GICV5_IRS_PE_SELR);

Since this patch exposes per_cpu_irs_data to KVM, KVM could also receive and
dereference this dangling pointer. Does the error path need to clear the
per-CPU pointers before freeing irs_data?

> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703154811.3355680-1-sascha.bischoff@arm.com?part=2