[PATCH v3 0/5] powerpc/xive: remove __GFP_NOFAIL and fix IPI error handling

[PATCH v3 0/5] powerpc/xive: remove __GFP_NOFAIL and fix IPI error handling

[Gou Hao]

Changes in v3:
- Split into a separate xive-only series; the drm, test_hmm
  and cxgb4 patches are unchanged since v1 and will no longer be updated here.
- Rework the first patch: instead of simply removing the unreachable
  NULL check, remove __GFP_NOFAIL from the IPI allocation and make
  all xive_ipis access paths NULL-safe (suggested by Andrew Morton [1]
  and Cédric Le Goater).
- Add a patch to defer setting cause_ipi until IPI init succeeds,
  so that smp_muxed_ipi_message_pass() does not call into a
  half-initialized IPI path.
- Add a defensive NULL guard for cause_ipi in
  smp_muxed_ipi_message_pass() as a safety net.

[1] https://lore.kernel.org/all/20260725202632.dcb325658896a470df91cf57@linux-foundation.org/

Changes in v2:
- Remove the now-unused out_free_domain error label in the xive
  patch after deleting the unreachable NULL check goto.
- Fix a use-after-free of xive_ipis: when xive_init_ipis() fails,
  the error path frees xive_ipis but xive_smp_probe() ignores the
  error and proceeds to dereference it in xive_setup_cpu_ipi().
  Propagate the error return through xive_smp_probe() and check
  it in both pnv_smp_probe() and pSeries_smp_probe().

This is a code cleanup series that removes unreachable
NULL checks (and associated error handling) that follow allocations
using __GFP_NOFAIL, which guarantees non-NULL return.

v2: https://lore.kernel.org/all/20260724022851.466017-1-gouhao@uniontech.com/
v1: https://lore.kernel.org/all/20260723081813.176792-1-gouhao@uniontech.com/

Gou Hao (5):
  powerpc/xive: make xive IPI allocation NULL-safe
  powerpc/xive: add error return value to xive_smp_probe()
  powerpc/xive: propagate IPI init errors to prevent use-after-free
  powerpc/xive: defer setting cause_ipi until IPI init succeeds
  powerpc/smp: add NULL guard for cause_ipi in
    smp_muxed_ipi_message_pass

 arch/powerpc/include/asm/xive.h      |  4 ++--
 arch/powerpc/kernel/smp.c            |  3 +++
 arch/powerpc/platforms/powernv/smp.c |  8 +++++---
 arch/powerpc/platforms/pseries/smp.c |  8 +++++---
 arch/powerpc/sysdev/xive/common.c    | 28 ++++++++++++++++----------
 5 files changed, 37 insertions(+), 14 deletions(-)

-- 
2.20.1

[PATCH v3 1/5] powerpc/xive: make xive IPI allocation NULL-safe

[Gou Hao]

__GFP_NOFAIL should not be used in new code [1].  xive_init_ipis()
allocates the xive_ipis array with __GFP_NOFAIL, which makes the
subsequent NULL check unreachable dead code.

Remove __GFP_NOFAIL so the allocation can fail, and make all xive_ipis
access paths NULL-safe:

- Return XIVE_BAD_IRQ from xive_ipi_cpu_to_irq() when xive_ipis is NULL.
- Set xive_ipis to NULL after kfree() in the error path to prevent
  use-after-free.
- Guard xive_setup_cpu_ipi() and xive_cleanup_cpu_ipi() against
  xive_ipi_irq == XIVE_BAD_IRQ to avoid dereferencing an uninitialized
  or already-freed xive_ipis array.

No functional change when allocation succeeds.

Link: https://lore.kernel.org/all/20260725202632.dcb325658896a470df91cf57@linux-foundation.org/ [1]
Fixes: 7dcc37b3eff9 ("powerpc/xive: Map one IPI interrupt per node")
Signed-off-by: Gou Hao <gouhao@uniontech.com>
Reviewed-by: Wentao Guan <guanwentao@uniontech.com>
Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com>
Suggested-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Cédric Le Goater <clg@kaod.org>
Suggested-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
---
 arch/powerpc/sysdev/xive/common.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index dadd1f46ec93..86c78af1f68e 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -74,6 +74,8 @@ static struct xive_ipi_desc {
  */
 static unsigned int xive_ipi_cpu_to_irq(unsigned int cpu)
 {
+	if (!xive_ipis)
+		return XIVE_BAD_IRQ;
 	return xive_ipis[early_cpu_to_node(cpu)].irq;
 }
 #endif
@@ -1132,8 +1134,7 @@ static int __init xive_init_ipis(void)
 	if (!ipi_domain)
 		goto out_free_fwnode;
 
-	xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids,
-				 GFP_KERNEL | __GFP_NOFAIL);
+	xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids, GFP_KERNEL);
 	if (!xive_ipis)
 		goto out_free_domain;
 
@@ -1158,6 +1159,7 @@ static int __init xive_init_ipis(void)
 
 out_free_xive_ipis:
 	kfree(xive_ipis);
+	xive_ipis = NULL;
 out_free_domain:
 	irq_domain_remove(ipi_domain);
 out_free_fwnode:
@@ -1190,6 +1192,9 @@ static int xive_setup_cpu_ipi(unsigned int cpu)
 
 	pr_debug("Setting up IPI for CPU %d\n", cpu);
 
+	if (xive_ipi_irq == XIVE_BAD_IRQ)
+		return -EIO;
+
 	xc = per_cpu(xive_cpu, cpu);
 
 	/* Check if we are already setup */
@@ -1234,6 +1239,9 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc)
 
 	/* Disable the IPI and free the IRQ data */
 
+	if (xive_ipi_irq == XIVE_BAD_IRQ)
+		return;
+
 	/* Already cleaned up ? */
 	if (xc->hw_ipi == XIVE_BAD_IRQ)
 		return;
-- 
2.20.1

[PATCH v3 2/5] powerpc/xive: add error return value to xive_smp_probe()

[Gou Hao]

xive_smp_probe() calls xive_init_ipis() which can fail, but its
return value is currently ignored.  Change xive_smp_probe() to
return int so that errors can be propagated to callers.

This is a preparatory patch for the next one.

No functional change yet; the return value is always 0 at this point.

Signed-off-by: Gou Hao <gouhao@uniontech.com>
Reviewed-by: Wentao Guan <guanwentao@uniontech.com>
Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com>
---
 arch/powerpc/include/asm/xive.h   | 4 ++--
 arch/powerpc/sysdev/xive/common.c | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/include/asm/xive.h b/arch/powerpc/include/asm/xive.h
index efb0f5effcc6..4e3e3358993c 100644
--- a/arch/powerpc/include/asm/xive.h
+++ b/arch/powerpc/include/asm/xive.h
@@ -91,7 +91,7 @@ static inline bool xive_enabled(void) { return __xive_enabled; }
 
 bool xive_spapr_init(void);
 bool xive_native_init(void);
-void xive_smp_probe(void);
+int xive_smp_probe(void);
 int  xive_smp_prepare_cpu(unsigned int cpu);
 void xive_smp_setup_cpu(void);
 void xive_smp_disable_cpu(void);
@@ -153,7 +153,7 @@ static inline bool xive_enabled(void) { return false; }
 
 static inline bool xive_spapr_init(void) { return false; }
 static inline bool xive_native_init(void) { return false; }
-static inline void xive_smp_probe(void) { }
+static inline int xive_smp_probe(void) { return -EINVAL; }
 static inline int  xive_smp_prepare_cpu(unsigned int cpu) { return -EINVAL; }
 static inline void xive_smp_setup_cpu(void) { }
 static inline void xive_smp_disable_cpu(void) { }
diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index 86c78af1f68e..9f80c16be23f 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -1265,7 +1265,7 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc)
 	xive_ops->put_ipi(cpu, xc);
 }
 
-void __init xive_smp_probe(void)
+int __init xive_smp_probe(void)
 {
 	smp_ops->cause_ipi = xive_cause_ipi;
 
@@ -1274,6 +1274,8 @@ void __init xive_smp_probe(void)
 
 	/* Allocate and setup IPI for the boot CPU */
 	xive_setup_cpu_ipi(smp_processor_id());
+
+	return 0;
 }
 
 #endif /* CONFIG_SMP */
-- 
2.20.1

[PATCH v3 3/5] powerpc/xive: propagate IPI init errors to prevent use-after-free

[Gou Hao]

When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),
the error path frees the global xive_ipis array.  However,
xive_smp_probe() previously ignored this failure and proceeded to
call xive_setup_cpu_ipi(), which dereferences the already-freed
xive_ipis pointer -- a use-after-free.

Now that xive_smp_probe() returns int (previous patch), propagate
the error from xive_init_ipis() and xive_setup_cpu_ipi() through
xive_smp_probe().  Check the return value in both pnv_smp_probe()
and pSeries_smp_probe() so that IPI setup is aborted cleanly on
failure, avoiding the use-after-free.

Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller")
Fixes: cbc06f051c52 ("powerpc/xive: Do not skip CPU-less nodes when creating the IPIs")
Signed-off-by: Gou Hao <gouhao@uniontech.com>
Reviewed-by: Wentao Guan <guanwentao@uniontech.com>
Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com>
---
 arch/powerpc/platforms/powernv/smp.c |  8 +++++---
 arch/powerpc/platforms/pseries/smp.c |  8 +++++---
 arch/powerpc/sysdev/xive/common.c    | 10 ++++++----
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index 8f41ef364fc6..b1201dbafcaf 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -332,10 +332,12 @@ static void pnv_cause_ipi(int cpu)
 
 static void __init pnv_smp_probe(void)
 {
-	if (xive_enabled())
-		xive_smp_probe();
-	else
+	if (xive_enabled()) {
+		if (xive_smp_probe() < 0)
+			return;
+	} else {
 		xics_smp_probe();
+	}
 
 	if (cpu_has_feature(CPU_FTR_DBELL)) {
 		ic_cause_ipi = smp_ops->cause_ipi;
diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index db99725e752b..14cd0634eeca 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -194,10 +194,12 @@ static int pseries_cause_nmi_ipi(int cpu)
 
 static __init void pSeries_smp_probe(void)
 {
-	if (xive_enabled())
-		xive_smp_probe();
-	else
+	if (xive_enabled()) {
+		if (xive_smp_probe() < 0)
+			return;
+	} else {
 		xics_smp_probe();
+	}
 
 	/* No doorbell facility, must use the interrupt controller for IPIs */
 	if (!cpu_has_feature(CPU_FTR_DBELL))
diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index 9f80c16be23f..bbe7c85274ea 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -1267,15 +1267,17 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc)
 
 int __init xive_smp_probe(void)
 {
+	int ret;
+
 	smp_ops->cause_ipi = xive_cause_ipi;
 
 	/* Register the IPI */
-	xive_init_ipis();
+	ret = xive_init_ipis();
+	if (ret < 0)
+		return ret;
 
 	/* Allocate and setup IPI for the boot CPU */
-	xive_setup_cpu_ipi(smp_processor_id());
-
-	return 0;
+	return xive_setup_cpu_ipi(smp_processor_id());
 }
 
 #endif /* CONFIG_SMP */
-- 
2.20.1

Re: [PATCH v3 3/5] powerpc/xive: propagate IPI init errors to prevent use-after-free

[Srikar Dronamraju]

* Gou Hao <gouhao@uniontech.com> [2026-07-27 18:42:13]:

>  
>  static void __init pnv_smp_probe(void)
>  {
> -	if (xive_enabled())
> -		xive_smp_probe();
> -	else
> +	if (xive_enabled()) {
> +		if (xive_smp_probe() < 0)
> +			return;
> +	} else {

If xive_smp_probe() fails and we return from here, what is the IPI mechanism
that is going to be used?

Before the patch, we were not configured for IPI and we would fail.
Now we have not configured IPI mechanism, so what are the consequences?

Should we try disable xive_enabled() and try xics_smp_probe() instead?

>  		xics_smp_probe();
> +	}
>  
>  	if (cpu_has_feature(CPU_FTR_DBELL)) {
>  		ic_cause_ipi = smp_ops->cause_ipi;
> diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
> index db99725e752b..14cd0634eeca 100644
> --- a/arch/powerpc/platforms/pseries/smp.c
> +++ b/arch/powerpc/platforms/pseries/smp.c
> @@ -194,10 +194,12 @@ static int pseries_cause_nmi_ipi(int cpu)
>  
>  static __init void pSeries_smp_probe(void)
>  {
> -	if (xive_enabled())
> -		xive_smp_probe();
> -	else
> +	if (xive_enabled()) {
> +		if (xive_smp_probe() < 0)
> +			return;
> +	} else {
>  		xics_smp_probe();
> +	}
>  
>  	/* No doorbell facility, must use the interrupt controller for IPIs */
>  	if (!cpu_has_feature(CPU_FTR_DBELL))
> diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
> index 9f80c16be23f..bbe7c85274ea 100644
> --- a/arch/powerpc/sysdev/xive/common.c
> +++ b/arch/powerpc/sysdev/xive/common.c
> @@ -1267,15 +1267,17 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc)
>  
>  int __init xive_smp_probe(void)
>  {
> +	int ret;
> +
>  	smp_ops->cause_ipi = xive_cause_ipi;
>  
>  	/* Register the IPI */
> -	xive_init_ipis();
> +	ret = xive_init_ipis();
> +	if (ret < 0)
> +		return ret;
>  
>  	/* Allocate and setup IPI for the boot CPU */
> -	xive_setup_cpu_ipi(smp_processor_id());
> -
> -	return 0;
> +	return xive_setup_cpu_ipi(smp_processor_id());
>  }
>  
>  #endif /* CONFIG_SMP */
> -- 
> 2.20.1
> 

-- 
Thanks and Regards
Srikar Dronamraju

Re: [PATCH v3 3/5] powerpc/xive: propagate IPI init errors to prevent use-after-free

[Gou Hao]

On 7/28/26 10:47, Srikar Dronamraju wrote:
> * Gou Hao <gouhao@uniontech.com> [2026-07-27 18:42:13]:
> 
>>   
>>   static void __init pnv_smp_probe(void)
>>   {
>> -	if (xive_enabled())
>> -		xive_smp_probe();
>> -	else
>> +	if (xive_enabled()) {
>> +		if (xive_smp_probe() < 0)
>> +			return;
>> +	} else {
> 
> If xive_smp_probe() fails and we return from here, what is the IPI mechanism
> that is going to be used?
> 
> Before the patch, we were not configured for IPI and we would fail.
> Now we have not configured IPI mechanism, so what are the consequences?
> 
Thank you for your review.

current approach: If xive_smp_probe() fails, smp_ops->cause_ipi remains 
NULL (patch 0004 defers the assignment). The IPI path 
(smp_muxed_ipi_message_pass) has a NULL check that silently drops the 
IPI. This means SMP won't function, but that's preferable to the current 
use-after-free crash.

> Should we try disable xive_enabled() and try xics_smp_probe() instead?
> 

When xive_enabled() is true, the entire interrupt subsystem has already 
been committed to XIVE in xive_init_host(). XICS fallback may need more 
than just disabling xive_enabled() and calling xics_smp_probe().

Full XIVE → XICS fallback is theoretically possible — the kexec path 
already demonstrates this (e.g., xive_shutdown() on PowerNV calls 
opal_xive_reset(OPAL_XIVE_MODE_EMU), and pSeries has H_INT_RESET). After 
reverting XIVE, one could call xics_init() + xics_smp_probe() to set up 
XICS completely.

Implementing a safe, complete fallback would require careful sequencing 
and likely an xive_exit() counterpart — this is a significantly larger 
change that is beyond the scope of this series, which focuses on 
removing __GFP_NOFAIL and fixing the use-after-free.

-- 
Thanks,
Gou Hao

[PATCH v3 4/5] powerpc/xive: defer setting cause_ipi until IPI init succeeds

[Gou Hao]

xive_smp_probe() currently assigns smp_ops->cause_ipi = xive_cause_ipi
before calling xive_init_ipis() and xive_setup_cpu_ipi().  If either
call fails, the platform probe handler returns early but cause_ipi
remains pointing to xive_cause_ipi -- which accesses per-cpu IPI data
(xc->ipi_data) that was never properly initialized, leading to
a WARN and a crash.

Move the cause_ipi assignment to after both calls succeed, so that
smp_ops->cause_ipi is only set when the IPI subsystem is fully
initialized.

Signed-off-by: Gou Hao <gouhao@uniontech.com>
Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com>
---
 arch/powerpc/sysdev/xive/common.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index bbe7c85274ea..8ae088632337 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -1269,15 +1269,19 @@ int __init xive_smp_probe(void)
 {
 	int ret;
 
-	smp_ops->cause_ipi = xive_cause_ipi;
-
 	/* Register the IPI */
 	ret = xive_init_ipis();
 	if (ret < 0)
 		return ret;
 
 	/* Allocate and setup IPI for the boot CPU */
-	return xive_setup_cpu_ipi(smp_processor_id());
+	ret = xive_setup_cpu_ipi(smp_processor_id());
+	if (ret < 0)
+		return ret;
+
+	smp_ops->cause_ipi = xive_cause_ipi;
+
+	return 0;
 }
 
 #endif /* CONFIG_SMP */
-- 
2.20.1

[PATCH v3 5/5] powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass

[Gou Hao]

smp_muxed_ipi_message_pass() calls smp_ops->cause_ipi() without
checking whether it has been set.

On platforms using muxed IPI (e.g. powernv/pseries), smp_ops->cause_ipi
is initialized to NULL in the static smp_ops and only assigned during
the platform smp_probe() handler.  If the IPI subsystem fails to
initialize -- for example when xive_init_ipis() fails and
xive_smp_probe() returns an error -- the probe handler returns early
and cause_ipi is never set.  Any subsequent IPI send (e.g.
arch_smp_send_reschedule()) would dereference the NULL pointer.

Add a NULL check to avoid the crash in that situation.

Fixes: 23d72bfd8f9f ("powerpc: Consolidate ipi message mux and demux")
Signed-off-by: Gou Hao <gouhao@uniontech.com>
Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com>
---
 arch/powerpc/kernel/smp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 3467f86fd78f..6a5a5469aaae 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -289,6 +289,9 @@ void smp_muxed_ipi_set_message(int cpu, int msg)
 
 void smp_muxed_ipi_message_pass(int cpu, int msg)
 {
+	if (!smp_ops->cause_ipi)
+		return;
+
 	smp_muxed_ipi_set_message(cpu, msg);
 
 	/*
-- 
2.20.1