On Fri, 21 Aug 2026 20:09:32 +0100,
Karl Mehltretter <[email protected]> wrote:
>
> On Thu, Aug 20, 2026 at 09:58:57AM +0100, Marc Zyngier wrote:
> > The other bit of interest is in __kvm_vgic_vcpu_destroy(), and its
> > conditional removal of the RD iodevs. Can't we just get rid of this
> > whole block altogether now that we have a saner failing path?
>
> I tested removing that block.
> It reintroduces the use-after-free fixed by ae8f8b376102
> (“KVM: arm64: Unregister redistributor for failed vCPU creation”).
At the very least:
vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
should be removed, as it serves no purpose anymore: all vcpus, valid
or not, should now go through vgic_unregister_redist_iodev() which
resets the value. It isn't massively useful on teardown anyway, so you
might as well kill the extra one.
M.
--
Without deviation from the norm, progress is not possible.
