Re: [PATCH] KVM: PPC: Book3S HV: Set irqfd->producer only on success

[Amit Machhiwal <amachhiw@linux.ibm.com>]

On 2026/07/09 01:57 PM, leixiang wrote:
> Set irqfd->producer only after kvmppc_set_passthru_irq() succeeds to
> avoid leaving a dangling pointer on failure. The bypass manager does
> not register a failed producer, so the pointer is never cleared.
> 
> Fixes: c57875f5f9be ("KVM: PPC: Book3S HV: Enable IRQ bypass")
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: leixiang <leixiang@kylinos.cn>
> ---
>  arch/powerpc/kvm/book3s_hv.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
> index 61dbeea317f3..ff7b25629125 100644
> --- a/arch/powerpc/kvm/book3s_hv.c
> +++ b/arch/powerpc/kvm/book3s_hv.c
> @@ -6111,12 +6111,12 @@ static int kvmppc_irq_bypass_add_producer_hv(struct irq_bypass_consumer *cons,
>  	struct kvm_kernel_irqfd *irqfd =
>  		container_of(cons, struct kvm_kernel_irqfd, consumer);
>  
> -	irqfd->producer = prod;
> -
>  	ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
>  	if (ret)
>  		pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
>  			prod->irq, irqfd->gsi, ret);
> +	else
> +		irqfd->producer = prod;

cons->add_producer is invoked by __connect() in virt/lib/irqbypass.c,
which itself is called from either irq_bypass_register_consumer() or
irq_bypass_register_producer(). __connect() only records the pairing —
setting cons->producer and prod->consumer — if add_producer returns 0.

  static int __connect(struct irq_bypass_producer *prod,
  		     struct irq_bypass_consumer *cons)
  {
  	[...]
  
  	if (!ret) {
  		prod->consumer = cons;
  		cons->producer = prod;
  	}

On failure, no pairing is recorded, so __disconnect() is never called,
and del_producer is never invoked to clear irqfd->producer. The old
unconditional assignment indeed left a dangling pointer on any
kvmppc_set_passthru_irq() failure.

Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>

~Amit

>  
>  	return ret;
>  }
> -- 
> 2.45.0