FAILED: patch "[PATCH] KVM: Move kvm_io_bus_get_dev() locking responsibilities to" failed to apply to 5.10-stable tree

PATCH New [email protected] 2 participants 2 messages Jul 20 – Jul 21

Subsystems (4)

Stable branch KVM arm64 KVM arm64

lore

Share & tools

lore

[email protected]

author maintainer

2026-07-20 12:21 UTC #0 lore raw

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 3a07249981629ace483ebbef81ef6b34c2d2afec
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026072007-gift-earwig-6100@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 3a07249981629ace483ebbef81ef6b34c2d2afec Mon Sep 17 00:00:00 2001
From: Marc Zyngier <[email protected]>
Date: Sat, 27 Jun 2026 11:51:05 +0100
Subject: [PATCH] KVM: Move kvm_io_bus_get_dev() locking responsibilities to
callers

kvm_io_bus_get_dev() returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, as by the time the caller can introspect the object, it might be gone (the srcu lock having been dropped).

Given that there is only a single user of this helper, the simplest option is to move the locking responsibility to the caller, which can keep the srcu lock held for as long as it wants.

Note that this aligns with other kvm_io_bus*() helpers, which already require the srcu lock to be held by the callers.

Reported-by Will Deacon <[email protected]>

Fixes 8a39d00670f07 ("KVM: kvm_io_bus: Add kvm_io_bus_get_dev() call")

Link https://lore.kernel.org/all/[email protected] open here

Cc [email protected]

Reviewed-by Oliver Upton <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Marc Zyngier <[email protected]>

arch/arm64/kvm/vgic/vgic-its.c +2 -0

index 67d107e9a77d..c90abde39fb8 100644
@@ -508,6 +508,8 @@ static struct vgic_its *__vgic_doorbell_to_its(struct kvm *kvm, gpa_t db)
 	struct kvm_io_device *kvm_io_dev;
 	struct vgic_io_device *iodev;
 
+	guard(srcu)(&kvm->srcu);
+
 	kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, db);
 	if (!kvm_io_dev)
 		return ERR_PTR(-EINVAL);

virt/kvm/kvm_main.c +5 ~~-11~~

index 89489996fbc1..5788eac0ab81 100644
@@ -6068,25 +6068,19 @@ struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
 					 gpa_t addr)
 {
 	struct kvm_io_bus *bus;
-	int dev_idx, srcu_idx;
-	struct kvm_io_device *iodev = NULL;
+	int dev_idx;
 
-	srcu_idx = srcu_read_lock(&kvm->srcu);
+	lockdep_assert_held(&kvm->srcu);
 
 	bus = kvm_get_bus_srcu(kvm, bus_idx);
 	if (!bus)
-		goto out_unlock;
+		return NULL;
 
 	dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
 	if (dev_idx < 0)
-		goto out_unlock;
+		return NULL;
 
-	iodev = bus->range[dev_idx].dev;
-
-out_unlock:
-	srcu_read_unlock(&kvm->srcu, srcu_idx);
-
-	return iodev;
+	return bus->range[dev_idx].dev;
 }
 EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_io_bus_get_dev);

Marc Zyngier

maintainer

2026-07-21 08:52 UTC #1 lore raw

PATCH 1/1 KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

Given that there is only a single user of this helper, the simplest option is to move the locking responsibility to the caller, which can keep the srcu lock held for as long as it wants.

Note that this aligns with other kvm_io_bus*() helpers, which already require the srcu lock to be held by the callers.

Reported-by Will Deacon <[email protected]>

Fixes 8a39d00670f07 ("KVM: kvm_io_bus: Add kvm_io_bus_get_dev() call")

Link https://lore.kernel.org/all/[email protected] open here

Cc [email protected]

Reviewed-by Oliver Upton <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Marc Zyngier <[email protected]>

(cherry picked from commit 3a07249981629ace483ebbef81ef6b34c2d2afec)

[maz: replaced guard() with lock/unlock to avoid C99 warnings]

Signed-off-by Marc Zyngier <[email protected]>

---
 arch/arm64/kvm/vgic/vgic-its.c | 15 +++++++++++----
 virt/kvm/kvm_main.c            | 16 +++++-----------
 2 files changed, 16 insertions(+), 15 deletions(-)

arch/arm64/kvm/vgic/vgic-its.c +11 -4

index 399f70b60dcb3..e6ec0701f5616 100644
@@ -704,6 +704,8 @@ struct vgic_its *vgic_msi_to_its(struct kvm *kvm, struct kvm_msi *msi)
 	u64 address;
 	struct kvm_io_device *kvm_io_dev;
 	struct vgic_io_device *iodev;
+	struct vgic_its *its = NULL;
+	int srcu_idx;
 
 	if (!vgic_has_its(kvm))
 		return ERR_PTR(-ENODEV);

@@ -713,18 +715,23 @@ struct vgic_its *vgic_msi_to_its(struct kvm *kvm, struct kvm_msi *msi)
 
 	address = (u64)msi->address_hi << 32 | msi->address_lo;
 
+	srcu_idx = srcu_read_lock(&kvm->srcu);
+
 	kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, address);
 	if (!kvm_io_dev)
-		return ERR_PTR(-EINVAL);
+		goto out;
 
 	if (kvm_io_dev->ops != &kvm_io_gic_ops)
-		return ERR_PTR(-EINVAL);
+		goto out;
 
 	iodev = container_of(kvm_io_dev, struct vgic_io_device, dev);
 	if (iodev->iodev_type != IODEV_ITS)
-		return ERR_PTR(-EINVAL);
+		goto out;
 
-	return iodev->its;
+	its = iodev->its;
+out:
+	srcu_read_unlock(&kvm->srcu, srcu_idx);
+	return its ?: ERR_PTR(-EINVAL);
 }
 
 /*

virt/kvm/kvm_main.c +5 ~~-11~~

index ef66abe687d78..b340be2d81a3b 100644
@@ -4558,25 +4558,19 @@ struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
 					 gpa_t addr)
 {
 	struct kvm_io_bus *bus;
-	int dev_idx, srcu_idx;
-	struct kvm_io_device *iodev = NULL;
+	int dev_idx;
 
-	srcu_idx = srcu_read_lock(&kvm->srcu);
+	lockdep_assert_held(&kvm->srcu);
 
 	bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
 	if (!bus)
-		goto out_unlock;
+		return NULL;
 
 	dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
 	if (dev_idx < 0)
-		goto out_unlock;
+		return NULL;
 
-	iodev = bus->range[dev_idx].dev;
-
-out_unlock:
-	srcu_read_unlock(&kvm->srcu, srcu_idx);
-
-	return iodev;
+	return bus->range[dev_idx].dev;
 }
 EXPORT_SYMBOL_GPL(kvm_io_bus_get_dev);

Signature · 1 line

2.47.3