On 2026/07/09 01:57 PM, leixiang wrote:
> Set irqfd->producer only after kvmppc_set_passthru_irq() succeeds to
> avoid leaving a dangling pointer on failure. The bypass manager does
> not register a failed producer, so the pointer is never cleared.
>
> Fixes: c57875f5f9be ("KVM: PPC: Book3S HV: Enable IRQ bypass")
> Suggested-by: Sean Christopherson <[email protected]>
> Cc: [email protected]
> Signed-off-by: leixiang <[email protected]>
> ---
> arch/powerpc/kvm/book3s_hv.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
> index 61dbeea317f3..ff7b25629125 100644
> --- a/arch/powerpc/kvm/book3s_hv.c
> +++ b/arch/powerpc/kvm/book3s_hv.c
> @@ -6111,12 +6111,12 @@ static int kvmppc_irq_bypass_add_producer_hv(struct
> irq_bypass_consumer *cons,
> struct kvm_kernel_irqfd *irqfd =
> container_of(cons, struct kvm_kernel_irqfd, consumer);
>
> - irqfd->producer = prod;
> -
> ret = kvmppc_set_passthru_irq(irqfd->kvm, prod->irq, irqfd->gsi);
> if (ret)
> pr_info("kvmppc_set_passthru_irq (irq %d, gsi %d) fails: %d\n",
> prod->irq, irqfd->gsi, ret);
> + else
> + irqfd->producer = prod;
cons->add_producer is invoked by __connect() in virt/lib/irqbypass.c,
which itself is called from either irq_bypass_register_consumer() or
irq_bypass_register_producer(). __connect() only records the pairing —
setting cons->producer and prod->consumer — if add_producer returns 0.
static int __connect(struct irq_bypass_producer *prod,
struct irq_bypass_consumer *cons)
{
[...]
if (!ret) {
prod->consumer = cons;
cons->producer = prod;
}
On failure, no pairing is recorded, so __disconnect() is never called,
and del_producer is never invoked to clear irqfd->producer. The old
unconditional assignment indeed left a dangling pointer on any
kvmppc_set_passthru_irq() failure.
Reviewed-by: Amit Machhiwal <[email protected]>
~Amit
>
> return ret;
> }
> --
> 2.45.0
