Re: [PATCH] KVM: x86: Handle -1 return from kvm_cpu_get_interrupt

[Sean Christopherson]

On Sun, Jul 12, 2026, Deepanshu Kartikey wrote:
> kvm_check_and_inject_events() checks for a pending PIC
> interrupt using kvm_cpu_has_injectable_intr() and then
> fetches it using kvm_cpu_get_interrupt(). These two
> operations are not atomic with respect to vpic->output.
> 
> Between the check and fetch, another thread running on
> a different CPU can call kvm_pic_read_irq() which sets
> output=0 before taking pic_lock(), making it immediately
> visible to all other threads:
> 
>   Thread A: kvm_cpu_has_injectable_intr() reads output=1
>   Thread B: kvm_pic_read_irq() sets output=0 before lock
>   Thread A: kvm_cpu_get_interrupt() reads output=0
>   Thread A: returns -1, WARN_ON_ONCE fires
> 
> The -1 return is a valid result indicating another thread
> already consumed the interrupt between the check and fetch.
> Replace WARN_ON_ONCE with a graceful goto out to handle
> this race condition correctly.
> 
> Reported-by: syzbot+9dcd0a11dc9703a49511@xxxxxxxxxxxxxxxxxxxxxxxxx
> Link: https://syzkaller.appspot.com/bug?extid=9dcd0a11dc9703a49511

Already being handled, thanks!

https://lore.kernel.org/all/86078441-92eb-4461-b823-7d3539ac5859@xxxxxxxxxxxxxxx