Re: [PATCH] KVM: x86/ioapic: Cancel eoi_inject work before destroying vCPUs

["Huang, Kai" <kai.huang@intel.com>]

On Sun, 2026-07-05 at 13:04 +0800, Weiming Shi wrote:
> kvm_ioapic_eoi_inject_work() re-delivers a throttled level-triggered
> interrupt via kvm_irq_delivery_to_apic(), which walks kvm->arch.apic_map
> and dereferences the destination vCPU's APIC.  The work is cancelled only
> in kvm_ioapic_destroy(), which runs after kvm_destroy_vcpus() has freed
> the vCPUs and their APICs.  kvm_free_lapic() does not rebuild apic_map, so
> the map is left with dangling pointers, and a work item that fires during
> that window reads freed memory:
> 
>  BUG: KASAN: slab-use-after-free in __kvm_irq_delivery_to_apic_fast (arch/x86/kvm/lapic.c:1248)
>  Read of size 8 by task kworker/3:1
>  Workqueue: events kvm_ioapic_eoi_inject_work
>   __kvm_irq_delivery_to_apic_fast (arch/x86/kvm/lapic.c:1248)
>   __kvm_irq_delivery_to_apic (arch/x86/kvm/lapic.c:1343)
>   ioapic_service (arch/x86/kvm/ioapic.c:492)
>   kvm_ioapic_eoi_inject_work (arch/x86/kvm/ioapic.c:525)
>   process_one_work
> 
>  Freed by task 153:
>   kvm_arch_vcpu_destroy (arch/x86/kvm/x86.c:12871)
>   kvm_destroy_vcpus (virt/kvm/kvm_main.c:489)
>   kvm_arch_destroy_vm (arch/x86/kvm/x86.c:13402)
>   kvm_destroy_vm (virt/kvm/kvm_main.c:1302)
>   kvm_vm_release (virt/kvm/kvm_main.c:1363)
> 
> A guest arms the work by EOIing a level-triggered pin 10000 times in a
> row, so the window is reachable from guest ring 0 whenever its VM is torn
> down soon after.
> 
> Add kvm_ioapic_pre_destroy() and call it from kvm_arch_pre_destroy_vm(),
> which already stops the PIT and the kvmclock/MMU workers before vCPUs are
> freed for the same reason.

I am wondering whether we can just move kvm_ioapic_destroy() (and
kvm_pic_destroy()) to kvm_arch_pre_destroy_vm().  I guess the concern is we want
to make sure vIOAPIC is destroyed _after_ kvm_free_irq_routing() is done?

Btw, one odd thing I saw is all KVM IO buses are actually destroyed right after
kvm_free_irq_routing(), but yet kvm_ioapic_destroy() tries to unregister it from
the KVM_MMIO_BUS (ditto for kvm_pic_destroy).