[PATCH] KVM: Nullify irqfd->producer when add_producer() fails

[PATCH] KVM: Nullify irqfd->producer when add_producer() fails

[leixiang]

The x86 and powerpc add_producer() callbacks set irqfd->producer before the
fallible setup and never clear it on error.  The bypass manager doesn't
register a producer whose add_producer() failed -- producer->eventfd is
left NULL, so the later unregister early-returns and del_producer() is
never called -- so nothing ever drops the pointer.

For VFIO PCI the producer is embedded in struct vfio_pci_irq_ctx and freed
when the vector is disabled, after which a routing update dereferences the
dangling pointer via kvm_arch_update_irqfd_routing().

Nullify irqfd->producer on the error paths.

Fixes: 77e1b8332d1d ("KVM: x86: Decouple device assignment from IRQ bypass")
Fixes: c57875f5f9be ("KVM: PPC: Book3S HV: Enable IRQ bypass")
Cc: stable@vger.kernel.org
Signed-off-by: leixiang <leixiang@kylinos.cn>
---
 arch/powerpc/kvm/book3s_hv.c | 4 +++-
 arch/x86/kvm/irq.c           | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 61dbeea317f3..14919b76fb32 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -6114,9 +6114,11 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
 	irqfd->producer = prod;

 	ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
-	if (ret)
+	if (ret) {
 		pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
 			prod->irq, irqfd->gsi, ret);
+		irqfd->producer = NULL;
+	}

 	return ret;
 }
diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
index 8c62c6d4d5c1..cb8ac4b9b0d7 100644
--- a/arch/x86/kvm/irq.c
+++ b/arch/x86/kvm/irq.c
@@ -488,8 +488,10 @@ int kvm_arch_irq_bypass_add_producer(struct irq_bypass_consumer *cons,

 	if (irqfd->irq_entry.type == KVM_IRQ_ROUTING_MSI) {
 		ret = kvm_pi_update_irte(irqfd, &irqfd->irq_entry);
-		if (ret)
+		if (ret) {
 			kvm->arch.nr_possible_bypass_irqs--;
+			irqfd->producer = NULL;
+		}
 	}
 	spin_unlock_irq(&kvm->irqfds.lock);

--
2.45.0

Re: [PATCH] KVM: Nullify irqfd->producer when add_producer() fails

[Sean Christopherson]

On Mon, Jun 22, 2026, leixiang wrote:
> The x86 and powerpc add_producer() callbacks set irqfd->producer before the
> fallible setup and never clear it on error.  The bypass manager doesn't
> register a producer whose add_producer() failed -- producer->eventfd is
> left NULL, so the later unregister early-returns and del_producer() is
> never called -- so nothing ever drops the pointer.
> 
> For VFIO PCI the producer is embedded in struct vfio_pci_irq_ctx and freed
> when the vector is disabled, after which a routing update dereferences the
> dangling pointer via kvm_arch_update_irqfd_routing().
> 
> Nullify irqfd->producer on the error paths.
> 
> Fixes: 77e1b8332d1d ("KVM: x86: Decouple device assignment from IRQ bypass")
> Fixes: c57875f5f9be ("KVM: PPC: Book3S HV: Enable IRQ bypass")
> Cc: stable@vger.kernel.org
> Signed-off-by: leixiang <leixiang@kylinos.cn>

Please post the PPC patch as a separate patch.  x86 and PPC are separate maintainer
domains and the backports will likely need to go to different LTS kernels.

I'll grab/extract the x86 change from here (and I'll massage the changelog as
appropriate).

> ---
>  arch/powerpc/kvm/book3s_hv.c | 4 +++-
>  arch/x86/kvm/irq.c           | 4 +++-
>  2 files changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
> index 61dbeea317f3..14919b76fb32 100644
> --- a/arch/powerpc/kvm/book3s_hv.c
> +++ b/arch/powerpc/kvm/book3s_hv.c
> @@ -6114,9 +6114,11 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
>  	irqfd->producer = prod;
> 
>  	ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
> -	if (ret)
> +	if (ret) {
>  		pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
>  			prod->irq, irqfd->gsi, ret);
> +		irqfd->producer = NULL;
> +	}

Unlike x86, AFAICT there's no need to set irqfd->producer before configuring
the passthru/bypass stuff.  So I think that fix could be this?

diff --git arch/powerpc/kvm/book3s_hv.c arch/powerpc/kvm/book3s_hv.c
index 61dbeea317f3..ff7b25629125 100644
--- arch/powerpc/kvm/book3s_hv.c
+++ arch/powerpc/kvm/book3s_hv.c
@@ -6111,12 +6111,12 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
        struct kvm_kernel_irqfd *irqfd =
                container_of(cons, struct kvm_kernel_irqfd, consumer);
 
-       irqfd->producer = prod;
-
        ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
        if (ret)
                pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
                        prod->irq, irqfd->gsi, ret);
+       else
+               irqfd->producer = prod;
 
        return ret;
 }

Re: [PATCH] KVM: Nullify irqfd->producer when add_producer() fails

[leixiang]

On 7/9/26 00:40, Sean Christopherson wrote:
> On Mon, Jun 22, 2026, leixiang wrote:
>> The x86 and powerpc add_producer() callbacks set irqfd->producer before the
>> fallible setup and never clear it on error.  The bypass manager doesn't
>> register a producer whose add_producer() failed -- producer->eventfd is
>> left NULL, so the later unregister early-returns and del_producer() is
>> never called -- so nothing ever drops the pointer.
>>
>> For VFIO PCI the producer is embedded in struct vfio_pci_irq_ctx and freed
>> when the vector is disabled, after which a routing update dereferences the
>> dangling pointer via kvm_arch_update_irqfd_routing().
>>
>> Nullify irqfd->producer on the error paths.
>>
>> Fixes: 77e1b8332d1d ("KVM: x86: Decouple device assignment from IRQ bypass")
>> Fixes: c57875f5f9be ("KVM: PPC: Book3S HV: Enable IRQ bypass")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: leixiang <leixiang@kylinos.cn>
> 
> Please post the PPC patch as a separate patch.  x86 and PPC are separate maintainer
> domains and the backports will likely need to go to different LTS kernels.
> 
> I'll grab/extract the x86 change from here (and I'll massage the changelog as
> appropriate).

Thank you for the review and guidance.  I will submit a separate PPC patch.

>> ---
>>  arch/powerpc/kvm/book3s_hv.c | 4 +++-
>>  arch/x86/kvm/irq.c           | 4 +++-
>>  2 files changed, 6 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
>> index 61dbeea317f3..14919b76fb32 100644
>> --- a/arch/powerpc/kvm/book3s_hv.c
>> +++ b/arch/powerpc/kvm/book3s_hv.c
>> @@ -6114,9 +6114,11 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
>>  	irqfd->producer = prod;
>>
>>  	ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
>> -	if (ret)
>> +	if (ret) {
>>  		pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
>>  			prod->irq, irqfd->gsi, ret);
>> +		irqfd->producer = NULL;
>> +	}
> 
> Unlike x86, AFAICT there's no need to set irqfd->producer before configuring
> the passthru/bypass stuff.  So I think that fix could be this?
> 
> diff --git arch/powerpc/kvm/book3s_hv.c arch/powerpc/kvm/book3s_hv.c
> index 61dbeea317f3..ff7b25629125 100644
> --- arch/powerpc/kvm/book3s_hv.c
> +++ arch/powerpc/kvm/book3s_hv.c
> @@ -6111,12 +6111,12 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
>         struct kvm_kernel_irqfd *irqfd =
>                 container_of(cons, struct kvm_kernel_irqfd, consumer);
>  
> -       irqfd->producer = prod;
> -
>         ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
>         if (ret)
>                 pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
>                         prod->irq, irqfd->gsi, ret);
> +       else
> +               irqfd->producer = prod;
>  
>         return ret;
>  }
Agreed. Your approach is cleaner.

[PATCH] KVM: PPC: Book3S HV: Set irqfd->producer only on success

[leixiang]

Set irqfd->producer only after kvmppc_set_passthru_irq() succeeds to
avoid leaving a dangling pointer on failure. The bypass manager does
not register a failed producer, so the pointer is never cleared.

Fixes: c57875f5f9be ("KVM: PPC: Book3S HV: Enable IRQ bypass")
Suggested-by: Sean Christopherson <seanjc@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: leixiang <leixiang@kylinos.cn>
---
 arch/powerpc/kvm/book3s_hv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 61dbeea317f3..ff7b25629125 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -6111,12 +6111,12 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
 	struct kvm_kernel_irqfd *irqfd =
 		container_of(cons, struct kvm_kernel_irqfd, consumer);
 
-	irqfd->producer = prod;
-
 	ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
 	if (ret)
 		pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
 			prod->irq, irqfd->gsi, ret);
+	else
+		irqfd->producer = prod;
 
 	return ret;
 }
-- 
2.45.0

Re: [PATCH] KVM: PPC: Book3S HV: Set irqfd->producer only on success

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [Critical] On x86, `kvm_arch_irq_bypass_add_producer()` leaves a dangling `irqfd->producer` pointer on failure, causing an exploitable Use-After-Free during subsequent IRQ routing updates.
- [High] On ARM64, `irqfd->producer` is never assigned, rendering `kvm_arch_update_irqfd_routing()` dead code and causing stale GICv4 VLPI forwarding state.
--

--- Patch [1]: [PATCH] KVM: PPC: Book3S HV: Set irqfd->producer only on success ---
commit cb5d1de2b1bfd4aded0e24ab02c54c7d0fbd846f
Author: leixiang <leixiang@kylinos.cn>

KVM: PPC: Book3S HV: Set irqfd->producer only on success

This patch updates kvmppc_irq_bypass_add_producer_hv to only set
irqfd->producer when kvmppc_set_passthru_irq succeeds. This prevents
leaving a dangling pointer if the bypass manager fails to register the
producer.

> diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
> index 61dbeea317f3b..ff7b256291250 100644
> --- a/arch/powerpc/kvm/book3s_hv.c
> +++ b/arch/powerpc/kvm/book3s_hv.c
> @@ -6111,12 +6111,12 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
>  	struct kvm_kernel_irqfd *irqfd =
>  		container_of(cons, struct kvm_kernel_irqfd, consumer);
>  
> -	irqfd->producer = prod;
> -
>  	ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
>  	if (ret)
>  		pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
>  			prod->irq, irqfd->gsi, ret);
> +	else
> +		irqfd->producer = prod;

[Severity: Critical]
This is a pre-existing regression and was not introduced by the patch under
review, but does x86 suffer from the exact same logic regression being fixed
here?

Looking at kvm_arch_irq_bypass_add_producer() in arch/x86/kvm/irq.c, it
sets irqfd->producer unconditionally before calling kvm_pi_update_irte():

arch/x86/kvm/irq.c:kvm_arch_irq_bypass_add_producer() {
    ...
    spin_lock_irq(&kvm->irqfds.lock);
    irqfd->producer = prod;
    
    if (!kvm->arch.nr_possible_bypass_irqs++)
        kvm_x86_call(pi_start_bypass)(kvm);
        
    if (irqfd->irq_entry.type == KVM_IRQ_ROUTING_MSI) {
        ret = kvm_pi_update_irte(irqfd, &irqfd->irq_entry);
        if (ret)
            kvm->arch.nr_possible_bypass_irqs--;
    }
    spin_unlock_irq(&kvm->irqfds.lock);
    
    return ret;
}

If kvm_pi_update_irte() fails, it returns an error but leaves
irqfd->producer dangling.

Later, if the guest updates IRQ routing, KVM might invoke
kvm_arch_update_irqfd_routing() which calls kvm_pi_update_irte() again,
which uses the freed pointer:

arch/x86/kvm/irq.c:kvm_pi_update_irte() {
    unsigned int host_irq = irqfd->producer->irq;
    ...
}

Should x86 also clear irqfd->producer on failure?

[Severity: High]
This isn't a regression introduced by this patch, but while reviewing this
change I noticed that ARM64 seems to have the opposite problem.

In arch/arm64/kvm/arm.c, kvm_arch_irq_bypass_add_producer() completely omits
setting irqfd->producer:

arch/arm64/kvm/arm.c:kvm_arch_irq_bypass_add_producer() {
    struct kvm_kernel_irqfd *irqfd =
        container_of(cons, struct kvm_kernel_irqfd, consumer);
    struct kvm_kernel_irq_routing_entry *irq_entry = &irqfd->irq_entry;

    if (irq_entry->type != KVM_IRQ_ROUTING_MSI)
        return 0;

    return kvm_vgic_v4_set_forwarding(irqfd->kvm, prod->irq,
                                      &irqfd->irq_entry);
}

Because irqfd->producer is never assigned, does this render
kvm_arch_update_irqfd_routing() dead code on ARM64?

arch/arm64/kvm/arm.c:kvm_arch_update_irqfd_routing() {
    ...
    return kvm_vgic_v4_unset_forwarding(irqfd->kvm, irqfd->producer->irq);
}

Since the core KVM code in virt/kvm/eventfd.c relies on irqfd->producer being
non-NULL to propagate routing updates, this looks like it could leave
hardware forwarding in a stale state.

Should ARM64 be updated to set irqfd->producer on success?

>  
>  	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709055755.31297-1-leixiang@kylinos.cn?part=1

Re: [PATCH] KVM: PPC: Book3S HV: Set irqfd->producer only on success

[Vaibhav Jain]

Hi leixiang,

Thanks for catching and fixing this for kvm-hv:

leixiang <leixiang@kylinos.cn> writes:

> Set irqfd->producer only after kvmppc_set_passthru_irq() succeeds to
> avoid leaving a dangling pointer on failure. The bypass manager does
> not register a failed producer, so the pointer is never cleared.
>
> Fixes: c57875f5f9be ("KVM: PPC: Book3S HV: Enable IRQ bypass")
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: leixiang <leixiang@kylinos.cn>
> ---
>  arch/powerpc/kvm/book3s_hv.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
> index 61dbeea317f3..ff7b25629125 100644
> --- a/arch/powerpc/kvm/book3s_hv.c
> +++ b/arch/powerpc/kvm/book3s_hv.c
> @@ -6111,12 +6111,12 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
>  	struct kvm_kernel_irqfd *irqfd =
>  		container_of(cons, struct kvm_kernel_irqfd, consumer);
>  
> -	irqfd->producer = prod;
> -
>  	ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
>  	if (ret)
>  		pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
>  			prod->irq, irqfd->gsi, ret);
> +	else
> +		irqfd->producer = prod;
>  
>  	return ret;
>  }
> -- 
> 2.45.0
>

Proposed new error handling path looks better compared to v1 of the
patch. Also agree to the changes made.


Hence,

Reviewed-by: Vaibhav Jain <vaibhav@linux.ibm.com>

-- 
Cheers
~ Vaibhav

Re: [PATCH] KVM: PPC: Book3S HV: Set irqfd->producer only on success

[Amit Machhiwal]

On 2026/07/09 01:57 PM, leixiang wrote:
> Set irqfd->producer only after kvmppc_set_passthru_irq() succeeds to
> avoid leaving a dangling pointer on failure. The bypass manager does
> not register a failed producer, so the pointer is never cleared.
> 
> Fixes: c57875f5f9be ("KVM: PPC: Book3S HV: Enable IRQ bypass")
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: leixiang <leixiang@kylinos.cn>
> ---
>  arch/powerpc/kvm/book3s_hv.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
> index 61dbeea317f3..ff7b25629125 100644
> --- a/arch/powerpc/kvm/book3s_hv.c
> +++ b/arch/powerpc/kvm/book3s_hv.c
> @@ -6111,12 +6111,12 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
>  	struct kvm_kernel_irqfd *irqfd =
>  		container_of(cons, struct kvm_kernel_irqfd, consumer);
>  
> -	irqfd->producer = prod;
> -
>  	ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
>  	if (ret)
>  		pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
>  			prod->irq, irqfd->gsi, ret);
> +	else
> +		irqfd->producer = prod;

cons->add_producer is invoked by __connect() in virt/lib/irqbypass.c,
which itself is called from either irq_bypass_register_consumer() or
irq_bypass_register_producer(). __connect() only records the pairing —
setting cons->producer and prod->consumer — if add_producer returns 0.

  static int __connect(struct irq_bypass_producer *prod,
  		     struct irq_bypass_consumer *cons)
  {
  	[...]
  
  	if (!ret) {
  		prod->consumer = cons;
  		cons->producer = prod;
  	}

On failure, no pairing is recorded, so __disconnect() is never called,
and del_producer is never invoked to clear irqfd->producer. The old
unconditional assignment indeed left a dangling pointer on any
kvmppc_set_passthru_irq() failure.

Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>

~Amit

>  
>  	return ret;
>  }
> -- 
> 2.45.0