Re: [PATCH v5 1/5] LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing memory barriers in lockless MSI injection between `vector_map` and `irq_pending` can cause lost interrupts.
--

--- Patch [1]: [PATCH v5 1/5] LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc ---
commit 9139baa9157d8865599df0b5b9ceaace254286a5
Author: Bibo Mao <maobibo@loongson.cn>
LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc

This commit fixes an uninitialized stack variable array in 
dmsintc_inject_irq() by explicitly initializing it to 0 when no 
pending interrupts are found in the vector map.

> diff --git a/arch/loongarch/kvm/intc/dmsintc.c b/arch/loongarch/kvm/intc/dmsintc.c
> index de25735ce0394..0a8492c4394c7 100644
> --- a/arch/loongarch/kvm/intc/dmsintc.c
> +++ b/arch/loongarch/kvm/intc/dmsintc.c
> @@ -21,6 +21,8 @@ void dmsintc_inject_irq(struct kvm_vcpu *vcpu)
>  		old = atomic64_read(&(ds->vector_map[i]));
>  		if (old)
>  			vector[i] = atomic64_xchg(&(ds->vector_map[i]), 0);

[Severity: High]
This is a pre-existing issue, but is there a missing memory barrier in the
lockless MSI injection mechanism that synchronizes vector_map and irq_pending?

On the producer side, dmsintc_deliver_msi_to_vcpu() lacks a memory barrier
(e.g., smp_wmb()) between setting the payload (vector_map) and the
notification flag (irq_pending):

arch/loongarch/kvm/intc/dmsintc.c:dmsintc_deliver_msi_to_vcpu() {
    ...
	set_bit(vector, (unsigned long *)&ds->vector_map);
	kvm_vcpu_ioctl_interrupt(vcpu, &vcpu_irq);
    ...
}

Since set_bit() does not imply a memory barrier, the host CPU could reorder
these stores.

If reordered, the consumer side might observe the irq_pending flag but
read a stale 0 from vector_map, especially since it uses xchg_relaxed():

arch/loongarch/kvm/interrupt.c:kvm_deliver_intr() {
    ...
	mask = READ_ONCE(vcpu->arch.irq_pending);
	if (mask) {
		mask = xchg_relaxed(&vcpu->arch.irq_pending, 0);
		kvm_irq_deliver(vcpu, mask);
	}
    ...
}

Could this lead to the VCPU clearing irq_pending and skipping the injection,
permanently losing the interrupt and causing a guest VM hang?

> +		else
> +			vector[i] = 0;
>  	}
>  
>  	if (vector[0]) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714072520.2745942-1-maobibo@loongson.cn?part=1