Re: [PATCH v6 21/49] KVM: arm64: gic-v5: Initialise per-VM IRS state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Memory leak of the `dist->spis` array across retries of `vgic_init()` on error paths.
--

commit 13674819963e3cb02a4360c21cc165dd2bbdc227
Author: Sascha Bischoff <Sascha.Bischoff@arm.com>

KVM: arm64: gic-v5: Initialise per-VM IRS state

This commit allocates the per-VM emulated IRS state when creating a virtual
GICv5 and initializes it. It establishes the IRS backing required for SPIs
and LPIs during GICv5 initialization.

> diff --git a/arch/arm64/kvm/vgic/vgic-v5.c b/arch/arm64/kvm/vgic/vgic-v5.c
> index 5a058ef8fe701..bdf06dbff4231 100644
> --- a/arch/arm64/kvm/vgic/vgic-v5.c
> +++ b/arch/arm64/kvm/vgic/vgic-v5.c

[ ... ]

> @@ -747,6 +748,11 @@ int vgic_v5_init(struct kvm *kvm)
>  			goto err;
>  	}
>  
> +	/* Init IRS (and alloc SPI IST) */
> +	ret = kvm_vgic_v5_irs_init(kvm, kvm->arch.vgic.nr_spis);

[Severity: Medium]
Does this leak the dist->spis array (up to ~106KB) if userspace retries
initialization?

When kvm_vgic_v5_irs_init() is called here, it unconditionally allocates
dist->spis without checking if it is already allocated:

arch/arm64/kvm/vgic/vgic-irs-v5.c:kvm_vgic_v5_irs_init() {
    ...
    dist->spis = kcalloc(nr_spis, sizeof(struct vgic_irq),
                         GFP_KERNEL_ACCOUNT);
    ...
}

If a downstream step in vgic_init() fails (such as 
kvm_vgic_setup_default_irq_routing() returning an error), the error path
calls vgic_v5_teardown(), which deliberately does not free dist->spis.

If userspace retries the failed KVM_DEV_ARM_VGIC_CTRL_INIT ioctl, we will
hit kvm_vgic_v5_irs_init() again and overwrite the old dist->spis pointer,
leaking the previous allocation.

Should kvm_vgic_v5_irs_init() check if dist->spis is already allocated, or
should vgic_v5_teardown() free it on failure?

> +	if (ret)
> +		goto err;
> +
>  	return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904113404.4051341-1-sascha.bischoff@arm.com?part=21