Re: [PATCH] KVM: x86: Cancel IOAPIC EOI work before freeing vCPUs

[Sean Christopherson <seanjc@google.com>]

On Tue, Jul 28, 2026, Myeonghun Pak wrote:
> The IOAPIC delayed EOI injection worker dereferences local APIC pointers
> from the VM's APIC map.  Since commit 17bcd7144263 ("KVM: x86: Free
> vCPUs before freeing VM state"), kvm_arch_destroy_vm() frees vCPUs and
> their local APICs before kvm_ioapic_destroy() synchronously cancels the
> worker.
> 
> Consequently, if the delayed work is pending when VM teardown starts,
> the worker can run after a local APIC has been freed.

...

> Fixes: 17bcd7144263 ("KVM: x86: Free vCPUs before freeing VM state")
> Cc: stable@vger.kernel.org
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
>  arch/x86/kvm/ioapic.c | 12 +++++++++++-
>  arch/x86/kvm/ioapic.h |  1 +
>  arch/x86/kvm/x86.c    |  1 +
>  3 files changed, 13 insertions(+), 1 deletion(-)
> 
> AI disclosure: I used AI assistance during the audit and am treating the
> issue as public as required by Documentation/process/security-bugs.rst.
> The reproducer has not been posted publicly.

Though that doesn't seem to matter much given you're the fourth person/group to
independently report this bug. :-)

A fix is already pending:
https://lore.kernel.org/all/20260727171718.543491-1-seanjc@google.com

Thanks!