From: Hyunwoo Kim <imv4bel@gmail•com>
To: maz@kernel•org, oupton@kernel•org, joey.gouly@arm•com,
seiden@linux•ibm.com, suzuki.poulose@arm•com,
yuzenghui@huawei•com, catalin.marinas@arm•com, will@kernel•org,
Sascha.Bischoff@arm•com, jic23@kernel•org
Cc: linux-arm-kernel@lists•infradead.org, kvmarm@lists•linux.dev,
imv4bel@gmail•com
Subject: [PATCH] KVM: arm64: vgic: Use list_del_rcu() when flushing pending LPIs
Date: Fri, 5 Jun 2026 06:16:08 +0900 [thread overview]
Message-ID: <aiHrGM1f8czcUby4@v4bel> (raw)
vgic_v3_fold_lr_state() walks the ap_list from last_lr_irq without holding
the ap_list_lock, relying on vgic_irq being freed via kfree_rcu() and on
interrupts being disabled. vgic_flush_pending_lpis() removes entries with
list_del(), which clobbers a node's next pointer, so when another vCPU
disables LPIs via GICR_CTLR the walk can follow the clobbered next pointer
from a removed node, or from the node that last_lr_irq points to.
Remove entries with list_del_rcu() so that the next pointer stays valid
until the walk completes.
Fixes: 3cfd59f81e0f ("KVM: arm64: GICv3: Handle LR overflow when EOImode==0")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail•com>
---
arch/arm64/kvm/vgic/vgic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
index 1e9fe8764584d..73efc0f95bfb1 100644
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -204,7 +204,7 @@ void vgic_flush_pending_lpis(struct kvm_vcpu *vcpu)
list_for_each_entry_safe(irq, tmp, &vgic_cpu->ap_list_head, ap_list) {
if (irq_is_lpi(vcpu->kvm, irq->intid)) {
raw_spin_lock(&irq->irq_lock);
- list_del(&irq->ap_list);
+ list_del_rcu(&irq->ap_list);
irq->vcpu = NULL;
raw_spin_unlock(&irq->irq_lock);
deleted |= vgic_put_irq_norelease(vcpu->kvm, irq);
--
2.43.0
reply other threads:[~2026-06-04 21:16 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aiHrGM1f8czcUby4@v4bel \
--to=imv4bel@gmail$(echo .)com \
--cc=Sascha.Bischoff@arm$(echo .)com \
--cc=catalin.marinas@arm$(echo .)com \
--cc=jic23@kernel$(echo .)org \
--cc=joey.gouly@arm$(echo .)com \
--cc=kvmarm@lists$(echo .)linux.dev \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=maz@kernel$(echo .)org \
--cc=oupton@kernel$(echo .)org \
--cc=seiden@linux$(echo .)ibm.com \
--cc=suzuki.poulose@arm$(echo .)com \
--cc=will@kernel$(echo .)org \
--cc=yuzenghui@huawei$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox