From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A169BC61CE4 for ; Mon, 24 Aug 2026 07:43:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=Zd8vpElBmMOJ6sntGJLRVcXNHFDrKfdh0UTTNmML8Dg=; b=wikmOetwW1OxlJIP7y4mNLIibn jNrcmbLBi1jwRR/x48GCow6ejhnaEESHx0brAfUD8wN7nz+XwGoPQPZAuCev6VV2y7pQyYvKGQX++ KYfQJPgfIwZ0uH04MXj0dzf4uXWdfZ0InZvidU9IqMy2Fy3pfGizJe7TfWTj7vejdh8d3P8HMx1r/ j8+zv9G97QgDCmh66QNWUmfTRAhgtGYZQ4zCNaLrF/qoKQMxznCiyoiFINBGt0dTfbHpL+4eGd8Z3 96RwWhkIlUR530ck1tVBbpqV2cM8I9+JRuAJeOiMFtBl4QLpoPUrT9h0ZJk40EW6JNOCbhKXL2uZA kZuGqKBw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wyPKf-0000000G7GA-3czA; Mon, 24 Aug 2026 07:43:01 +0000 Received: from out-109.mta0.migadu.com ([2001:41d0:1004:224b::6d] helo=mta0.migadu.com) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wyPKa-0000000G78Q-3PNx for linux-arm-kernel@lists.infradead.org; Mon, 24 Aug 2026 07:42:58 +0000 X-Envelope-To: linux-arm-kernel@lists.infradead.org DKIM-Signature: a=rsa-sha256; bh=tLmq2HrjLCESAVz5nI7NICH8bUrsH/OHxKa8Tyxl6MQ=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787557374; v=1; x=1788162174; b=PI0/2queFP1BFyhexZd22gK3sOHqq0VELAuKvXWES71xMDk/34bn2RXN9qzA9hDCBUJdf2aR mWOaGtVAFo6FVKLOwWoY5PVKRYtf3/Jz32ZK4Aiyn4qR0Lu0UvQfVlYS1FQxniiKFOZQWh5rgUa Y3TfBdAP3uBhn/i6DF+E6xT0= X-Envelope-To: linux-arm-kernel@lists.infradead.org Received: from claudy.local (2a01:4b00:ad36:1d00:3a05:25ff:fe33:35a9) by smtp.migadu.com with ESMTPS id 02e1aa68f1a3f532; Mon, 24 Aug 2026 07:42:54 +0000 X-Mizu-Trace-ID: 02e1aa68f1a3f532 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton Cc: Thomas Gleixner , Eric Auger , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Will Deacon , Sascha Bischoff , Sebastian Ene , Fuad Tabba , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/4] irqchip/gic-v4: Clear the domain and fwnode pointers after freeing them Date: Mon, 24 Aug 2026 08:42:42 +0100 Message-Id: <20260824074245.710955-2-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260824074245.710955-1-fuad.tabba@linux.dev> References: <20260824074245.710955-1-fuad.tabba@linux.dev> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260824_004257_039289_E04F1240 X-CRM114-Status: GOOD ( 12.18 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The GICv4 allocation and teardown paths free their irq domains and fwnodes but leave the pointers set, and the allocation error paths test those pointers before removing them. struct its_vm and struct its_vpe are embedded in KVM's per-VM and per-vCPU state, so nothing re-zeroes them between two attempts, and an error path taken after an earlier one already freed the domain calls irq_domain_remove() on freed memory. Reaching this takes two allocation failures, one to leave the stale pointer behind and one to send the next attempt down the error path. Fixes: 7de5c0af9c7c ("irqchip/gic-v4: Add per-VM VPE domain creation") Fixes: 6d31b6ff985d ("irqchip/gic-v4.1: Add VSGI allocation/teardown") Signed-off-by: Fuad Tabba --- drivers/irqchip/irq-gic-v4.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v4.c b/drivers/irqchip/irq-gic-v4.c index 8455b4a5fbb0d..754839e409f88 100644 --- a/drivers/irqchip/irq-gic-v4.c +++ b/drivers/irqchip/irq-gic-v4.c @@ -147,10 +147,14 @@ static int its_alloc_vcpu_sgis(struct its_vpe *vpe, int idx) return 0; err: - if (vpe->sgi_domain) + if (vpe->sgi_domain) { irq_domain_remove(vpe->sgi_domain); - if (vpe->fwnode) + vpe->sgi_domain = NULL; + } + if (vpe->fwnode) { irq_domain_free_fwnode(vpe->fwnode); + vpe->fwnode = NULL; + } kfree(name); return -ENOMEM; } @@ -191,10 +195,14 @@ int its_alloc_vcpu_irqs(struct its_vm *vm) return 0; err: - if (vm->domain) + if (vm->domain) { irq_domain_remove(vm->domain); - if (vm->fwnode) + vm->domain = NULL; + } + if (vm->fwnode) { irq_domain_free_fwnode(vm->fwnode); + vm->fwnode = NULL; + } return -ENOMEM; } @@ -215,6 +223,8 @@ static void its_free_sgi_irqs(struct its_vm *vm) irq_domain_free_irqs(irq, 16); irq_domain_remove(vm->vpes[i]->sgi_domain); irq_domain_free_fwnode(vm->vpes[i]->fwnode); + vm->vpes[i]->sgi_domain = NULL; + vm->vpes[i]->fwnode = NULL; } } @@ -224,6 +234,8 @@ void its_free_vcpu_irqs(struct its_vm *vm) irq_domain_free_irqs(vm->vpes[0]->irq, vm->nr_vpes); irq_domain_remove(vm->domain); irq_domain_free_fwnode(vm->fwnode); + vm->domain = NULL; + vm->fwnode = NULL; } static int its_send_vpe_cmd(struct its_vpe *vpe, struct its_cmd_info *info) -- 2.39.5