github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 21:26:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC

Browse Source 
When getting a to-be-injected IRQ, don't WARN if the IRQ disappeared and
the VM has an in-kernel PIC, as the ExtINT handling that's routed through
KVM's virtual PIC is tracked per-VM, not per-vCPU.  If another vCPU grabs
the IRQ, or deasserts the interrupt (which is level-triggered), then it's
both expected and "fine" for a

Keep the assert for split IRQCHIP VMs to help detect KVM bugs, as userspace
is responsible for routing ExtINT to the intended vCPU, i.e. once an ExtINT
is pending, it can't be cleared without holding the vCPU's mutex, and thus
false positives are impossible.

Fixes: bf672720e8 ("KVM: x86: check the kvm_cpu_get_interrupt result before using it")
Debugged-by: Alexander Potapenko <glider@google.com>
Reported-by: syzbot+dd769db18693736eee89@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dd769db18693736eee89
Closes: https://lore.kernel.org/all/6a360fdf.871e809a.2d6dda.0000.GAE@google.com
Link: https://patch.msgid.link/20260724173425.278753-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
This commit is contained in:
Sean Christopherson 2026-07-24 10:34:24 -07:00
parent 0c5fb7bc61
commit 681fb81a41
3 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
arch/x86/kvm/irq.h
View File

@ -118,6 +118,22 @@ int kvm_cpu_has_extint(struct kvm_vcpu *v);
int kvm_cpu_get_extint(struct kvm_vcpu *v);
int kvm_cpu_get_interrupt(struct kvm_vcpu *v);
static inline void kvm_warn_on_lost_irq(struct kvm_vcpu *vcpu)
{
/*
* WARN if an IRQ was lost between detecting the IRQ and grabbing the
* IRQ for injection, unless it's possible the lost IRQ was due to one
* of the exceptional cases below.
*
* If the VM has an in-kernel PIC, the ExtINT handling that's routed
* through KVM's virtual PIC is tracked per-VM, not per-vCPU. If
* another vCPU grabs the IRQ, or deasserts the interrupt (which is
* level-triggered), then it's both expected and "fine" for an IRQ
* seemingly be "lost" from this vCPU's perspective.
*/
WARN_ON_ONCE(!pic_in_kernel(vcpu->kvm));
}
void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu);
void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu);
void kvm_apic_nmi_wd_deliver(struct kvm_vcpu *vcpu);

4
arch/x86/kvm/vmx/nested.c
View File

@ -4467,8 +4467,10 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
}
irq = kvm_apic_has_interrupt(vcpu);
if (WARN_ON_ONCE(irq < 0))
if (unlikely(irq < 0)) {
kvm_warn_on_lost_irq(vcpu);
goto no_vmexit;
}
/*
* If the IRQ is L2's PI notification vector, process posted

4
arch/x86/kvm/x86.c
View File

@ -7733,10 +7733,12 @@ static int kvm_check_and_inject_events(struct kvm_vcpu *vcpu,
if (r) {
int irq = kvm_cpu_get_interrupt(vcpu);
if (!WARN_ON_ONCE(irq == -1)) {
if (likely(irq != -1)) {
kvm_queue_interrupt(vcpu, irq, false);
kvm_x86_call(inject_irq)(vcpu, false);
WARN_ON(kvm_x86_call(interrupt_allowed)(vcpu, true) < 0);
} else {
kvm_warn_on_lost_irq(vcpu);
}
}
if (kvm_cpu_has_injectable_intr(vcpu))