[PATCH 2/6] LoongArch: KVM: Guard against NULL irqchip in irq injection

[Tao Cui]

From: Tao Cui <cuitao@xxxxxxxxxx>

The irqfd injection path dispatches through the irq routing table
without the kvm_arch_irqchip_in_kernel() gate that protects
KVM_IRQ_LINE: kvm_set_pic_irq() and kvm_arch_set_irq_inatomic() call
pch_pic_set_irq(kvm->arch.pch_pic, ...) and pch_msi_set_irq() calls
eiointc_set_irq(kvm->arch.eiointc, ...) directly, so a routing entry
that outlives the corresponding in-kernel irqchip dereferences a NULL
(or, before the previous patch, a freed) device.

Make pch_pic_set_irq(), eiointc_set_irq() and dmsintc_set_irq()
tolerate a NULL device.

Fixes: 1928254c5ccb ("LoongArch: KVM: Add irqfd support")
Signed-off-by: Tao Cui <cuitao@xxxxxxxxxx>
---
 arch/loongarch/kvm/intc/dmsintc.c | 3 +++
 arch/loongarch/kvm/intc/eiointc.c | 5 ++++-
 arch/loongarch/kvm/intc/pch_pic.c | 3 +++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/arch/loongarch/kvm/intc/dmsintc.c b/arch/loongarch/kvm/intc/dmsintc.c
index 63072595c01b..e27f448bb54f 100644
--- a/arch/loongarch/kvm/intc/dmsintc.c
+++ b/arch/loongarch/kvm/intc/dmsintc.c
@@ -70,6 +70,9 @@ int dmsintc_set_irq(struct kvm *kvm, u64 addr, int data, int level)
 	unsigned int irq, cpu;
 	struct kvm_vcpu *vcpu;
 
+	if (!kvm->arch.dmsintc)
+		return -EINVAL;
+
 	irq = (addr >> AVEC_IRQ_SHIFT) & AVEC_IRQ_MASK;
 	cpu = (addr >> AVEC_CPU_SHIFT) & kvm->arch.dmsintc->cpu_mask;
 	if (cpu >= KVM_MAX_VCPUS)
diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
index fe0a1918f26f..c68f9033638a 100644
--- a/arch/loongarch/kvm/intc/eiointc.c
+++ b/arch/loongarch/kvm/intc/eiointc.c
@@ -112,8 +112,11 @@ static inline void eiointc_update_sw_coremap(struct loongarch_eiointc *s,
 void eiointc_set_irq(struct loongarch_eiointc *s, int irq, int level)
 {
 	unsigned long flags;
-	unsigned long *isr = (unsigned long *)s->isr;
+	unsigned long *isr;
 
+	if (!s)
+		return;
+	isr = (unsigned long *)s->isr;
 	spin_lock_irqsave(&s->lock, flags);
 	level ? __set_bit(irq, isr) : __clear_bit(irq, isr);
 	eiointc_update_irq(s, irq, level);
diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index 62c09b5f3937..88666425d800 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -48,6 +48,9 @@ void pch_pic_set_irq(struct loongarch_pch_pic *s, int irq, int level)
 {
 	u64 mask = BIT(irq);
 
+	if (!s)
+		return;
+
 	spin_lock(&s->lock);
 	if (level)
 		s->irr |= mask; /* set irr */
-- 
2.43.0