Re: [PATCH 1/3] irqchip/gic-v4: Clear the domain and fwnode pointers after freeing them

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but there is a massive leak of IRQ descriptors and domains, leading to a Use-After-Free, caused by KVM truncating `vm->nr_vpes` in `vgic_v4_init()`.
--

--- Patch [1]: [PATCH 1/3] irqchip/gic-v4: Clear the domain and fwnode pointers after freeing them ---
commit c349510ce4924473f4dc4c6ff4ff6a9d4b983dd5
Author: Fuad Tabba <fuad.tabba@linux.dev>

irqchip/gic-v4: Clear the domain and fwnode pointers after freeing them

The GICv4 allocation and teardown paths free their irq domains and
fwnodes but leave the pointers set, and the allocation error paths test
those pointers before removing them. struct its_vm and struct its_vpe
are embedded in KVM's per-VM and per-vCPU state, so nothing re-zeroes
them between two attempts.

> diff --git a/drivers/irqchip/irq-gic-v4.c b/drivers/irqchip/irq-gic-v4.c
> index 8455b4a5fbb0d..754839e409f88 100644
> --- a/drivers/irqchip/irq-gic-v4.c
> +++ b/drivers/irqchip/irq-gic-v4.c
[ ... ]
> @@ -224,6 +234,8 @@ void its_free_vcpu_irqs(struct its_vm *vm)
>  	irq_domain_free_irqs(vm->vpes[0]->irq, vm->nr_vpes);
>  	irq_domain_remove(vm->domain);
>  	irq_domain_free_fwnode(vm->fwnode);
> +	vm->domain = NULL;
> +	vm->fwnode = NULL;
>  }

[Severity: High]
This is a pre-existing issue, but does this function permanently leak IRQs
and SGI domains?

In arch/arm64/kvm/vgic/vgic-v4.c:vgic_v4_init(), KVM intentionally truncates
dist->its_vm.nr_vpes upon failure to allocate VPE IRQs:

    dist->its_vm.nr_vpes = i;

This limits the teardown loop in vgic_v4_teardown(), which later calls
its_free_vcpu_irqs() with the fatally truncated nr_vpes value.

Because its_free_vcpu_irqs() relies on vm->nr_vpes to free the IRQ hierarchy
and SGI domains originally allocated for all VCPUs, the truncation causes a
partial free.

Furthermore, the parent IRQ domain is forcefully removed while still having
active IRQ mappings. Could this lead to a Use-After-Free of the domain memory
when those orphaned IRQ descriptors are accessed (e.g. via /proc/interrupts)?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260820125053.2951078-1-fuad.tabba@linux.dev?part=1