Re: [PATCH v2 3/3] KVM: SVM: Remove VM from the GA Log notifier list before VM destruction

[Naveen N Rao]

On Tue, Jun 30, 2026 at 02:01:56PM -0700, Sean Christopherson wrote:
> When a VM is being destroyed, delete it from the list used to process GA
> Log interrupts before vCPUs are freed, otherwise avic_ga_log_notifier()
> could theoretically hit a use-after-free if a GA Log notification arrives
> for a vCPU after the last reference to the VM has been put.
> 
> Note, in practice, it's likely all but impossible to trigger UAF, as all
> all irqfds and thus all IRTEs are cleaned up by:
> 
>   kvm_irqfd_release()
>   |
>   |-> irqfd_deactivate()
>       |
>       |-> irqfd_shutdown()
>           |
>           |-> irq_bypass_unregister_consumer()
> 
> And kvm_irqfd_release() is guaranteed to run before the last reference to
> the VM is put.  KVM also configures GA Log interrupts only when a vCPU is
> blocking (older versions of KVM configre GA Log interrupts at all times,
> but AVIC is off by default on those kernels).  Hitting UAF would require
> tearing down a VM shortly after a vCPU stopped blocking, and with a very,
> very delayed IRQ from hardware.
> 
> Opportunistically use guard() to avoid a local "flags" variable.
> 
> Fixes: 5881f73757cc ("svm: Introduce AMD IOMMU avic_ga_log_notifier")
> Cc: Naveen N Rao (AMD) <naveen@xxxxxxxxxx>
> Cc: Xiao Wu <xiaowu.417@xxxxxx>
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> ---
>  arch/x86/kvm/svm/avic.c | 19 ++++++++++++-------
>  arch/x86/kvm/svm/svm.c  |  2 ++
>  arch/x86/kvm/svm/svm.h  |  1 +
>  3 files changed, 15 insertions(+), 7 deletions(-)

LGTM.
Reviewed-by: Naveen N Rao (AMD) <naveen@xxxxxxxxxx>


- Naveen