On Mon, 22 Jun 2026 15:51:01 +0800, leixiang wrote:
> The x86 and powerpc add_producer() callbacks set irqfd->producer before the
> fallible setup and never clear it on error. The bypass manager doesn't
> register a producer whose add_producer() failed -- producer->eventfd is
> left NULL, so the later unregister early-returns and del_producer() is
> never called -- so nothing ever drops the pointer.
>
> For VFIO PCI the producer is embedded in struct vfio_pci_irq_ctx and freed
> when the vector is disabled, after which a routing update dereferences the
> dangling pointer via kvm_arch_update_irqfd_routing().
>
> [...]
Applied to kvm-x86 fixes, thanks!
[1/1] KVM: Nullify irqfd->producer when add_producer() fails
https://github.com/kvm-x86/linux/commit/ed446e8aa894
--
https://github.com/kvm-x86/linux/tree/next
