diff options
| author | Fuad Tabba <fuad.tabba@linux.dev> | 2026-09-21 08:29:58 +0100 |
|---|---|---|
| committer | Marc Zyngier <maz@kernel.org> | 2026-10-27 14:17:01 +0000 |
| commit | 99ec74a33d52219f57cc61a2bc7bd5114cc997b0 (patch) | |
| tree | 63446cecded847b5ee019739ad222485eab894f7 | |
| parent | 25993ec8c5bb30baa746936d7a76f03c58150927 (diff) | |
| download | linux-next-99ec74a33d52219f57cc61a2bc7bd5114cc997b0.tar.gz linux-next-99ec74a33d52219f57cc61a2bc7bd5114cc997b0.zip | |
KVM: arm64: vgic-v4: Restore nr_vpes before freeing the vPE resources
vgic_v4_init() truncates its_vm.nr_vpes to the failing index to bound
vgic_v4_teardown()'s free_irq() loop, but its_free_vcpu_irqs() reads
the same field: the vPE irqs and the v4.1 SGI domains at or above that
index are never freed, each one leaking a vpe_id and an LPI pending
table.
Restore the count from online_vcpus before that call. This depends on
the previous patch: a failed vgic_init() keeps admitting vCPUs, so
without that patch's teardown the vPE array outlives the failure while
online_vcpus grows past the size it was allocated with.
Fixes: bdb2d2ccac65 ("KVM: arm/arm64: GICv4: Add doorbell interrupt handling")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260820130616.1A7241F000E9@smtp.kernel.org/
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20260921072958.2918477-5-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
| -rw-r--r-- | arch/arm64/kvm/vgic/vgic-v4.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/arm64/kvm/vgic/vgic-v4.c b/arch/arm64/kvm/vgic/vgic-v4.c index ed236f083f0d..30e1de3fc7d9 100644 --- a/arch/arm64/kvm/vgic/vgic-v4.c +++ b/arch/arm64/kvm/vgic/vgic-v4.c @@ -333,6 +333,9 @@ void vgic_v4_teardown(struct kvm *kvm) free_irq(irq, vcpu); } + /* Make sure we free all VM-wide, per-CPU resources */ + its_vm->nr_vpes = atomic_read(&kvm->online_vcpus); + its_free_vcpu_irqs(its_vm); kfree(its_vm->vpes); its_vm->nr_vpes = 0; |