From: Sean Christopherson <seanjc@google.com>
To: Deepanshu Kartikey <kartikey406@gmail.com>
Cc: pbonzini@redhat.com, tglx@kernel.org, mingo@redhat.com,
bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org,
hpa@zytor.com, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org,
syzbot+9dcd0a11dc9703a49511@syzkaller.appspotmail.com
Subject: Re: [PATCH] KVM: x86: Handle -1 return from kvm_cpu_get_interrupt
Date: Mon, 13 Jul 2026 06:14:31 -0700 [thread overview]
Message-ID: <alTktxR0hGS2gKS7@google.com> (raw)
In-Reply-To: <20260712090039.36038-1-kartikey406@gmail.com>
On Sun, Jul 12, 2026, Deepanshu Kartikey wrote:
> kvm_check_and_inject_events() checks for a pending PIC
> interrupt using kvm_cpu_has_injectable_intr() and then
> fetches it using kvm_cpu_get_interrupt(). These two
> operations are not atomic with respect to vpic->output.
>
> Between the check and fetch, another thread running on
> a different CPU can call kvm_pic_read_irq() which sets
> output=0 before taking pic_lock(), making it immediately
> visible to all other threads:
>
> Thread A: kvm_cpu_has_injectable_intr() reads output=1
> Thread B: kvm_pic_read_irq() sets output=0 before lock
> Thread A: kvm_cpu_get_interrupt() reads output=0
> Thread A: returns -1, WARN_ON_ONCE fires
>
> The -1 return is a valid result indicating another thread
> already consumed the interrupt between the check and fetch.
> Replace WARN_ON_ONCE with a graceful goto out to handle
> this race condition correctly.
>
> Reported-by: syzbot+9dcd0a11dc9703a49511@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=9dcd0a11dc9703a49511
Already being handled, thanks!
https://lore.kernel.org/all/86078441-92eb-4461-b823-7d3539ac5859@mail.kernel.org
prev parent reply other threads:[~2026-07-13 13:14 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-12 9:00 [PATCH] KVM: x86: Handle -1 return from kvm_cpu_get_interrupt Deepanshu Kartikey
2026-07-12 9:11 ` sashiko-bot
2026-07-13 13:14 ` Sean Christopherson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alTktxR0hGS2gKS7@google.com \
--to=seanjc@google.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=kartikey406@gmail.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=syzbot+9dcd0a11dc9703a49511@syzkaller.appspotmail.com \
--cc=tglx@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox