Re: [PATCH v6 2/2] KVM: arm64: vgic: Mitigate potential LPI registration failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Silent guest failure due to unhandled -ENOMEM from __xa_store() during LPI registration.
--

--- Patch [2]: [PATCH v6 2/2] KVM: arm64: vgic: Mitigate potential LPI registration failure ---
commit 9b522d02e94ea5f2dfcbdf1fe73fdeacbe285ee9
Author: Carlos López <clopez@suse.de>
KVM: arm64: vgic: Mitigate potential LPI registration failure

This commit changes vgic_add_lpi() to pass GFP_NOWAIT | __GFP_ACCOUNT to
__xa_store() when adding a new LPI. This mitigates a race condition where the
xarray entry might have been freed between xa_reserve_irq() and __xa_store().
However, if the GFP_NOWAIT allocation fails, it still returns an error.

> diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
> index 2240bdf20c926..b59e0e0e1e821 100644
> --- a/arch/arm64/kvm/vgic/vgic-its.c
> +++ b/arch/arm64/kvm/vgic/vgic-its.c
> @@ -121,7 +121,8 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,
>  		 * from the deferred release path, pending cleanup by
>  		 * vgic_release_deleted_lpis(). Evict and free it if present.
>  		 */
> -		oldirq = __xa_store(&dist->lpi_xa, intid, irq, 0);
> +		oldirq = __xa_store(&dist->lpi_xa, intid, irq,
> +				    GFP_NOWAIT | __GFP_ACCOUNT);
>  		ret = xa_err(oldirq);
>  		if (ret) {
>  			xa_unlock_irqrestore(&dist->lpi_xa, flags);

[Severity: High]
This is a pre-existing issue, but does this error path lead to a silent
guest failure?

If the GFP_NOWAIT allocation fails due to host memory pressure,
__xa_store() returns -ENOMEM which is propagated back:

vgic_add_lpi() {
        oldirq = __xa_store(..., GFP_NOWAIT | __GFP_ACCOUNT);
        ret = xa_err(oldirq);
        if (ret) {
                xa_unlock_irqrestore(&dist->lpi_xa, flags);
                kfree(irq);
                return ERR_PTR(ret);
        ...
}

Since vgic_its_process_commands() ignores the return value of
vgic_its_handle_command(), the guest's ITS MAPTI command is silently
dropped and the device interrupts are permanently lost.

Could this be handled by dropping the lock, performing a blocking
xa_reserve_irq() with GFP_KERNEL_ACCOUNT, and retrying the insertion
instead of returning the allocation error?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260715105137.3973823-3-clopez@suse.de?part=2