Re: [PATCH v2 2/2] KVM: VMX: Fix stale PID-pointer table entry left after vCPU free

[Huang, Kai]

On Wed, 2026-07-29 at 17:06 +0000, Dmytro Maluka wrote:
> vCPU creation in kvm_vm_ioctl_create_vcpu() may fail after
> kvm_arch_vcpu_create() -> vmx_vcpu_create() already succeeded. In such
> case kvm_vm_ioctl_create_vcpu() destroys the newly created vCPU in the
> failure path. However, that leaves a side effect: the IPIv pid_table
> entry remains configured with this vCPU's pi_desc address. As a result,
> when another vCPU sends an IPI to the APIC ID of this failed-to-create
> vCPU, it will cause HW to write to this (freed!) pi_desc memory. [*]
> 
> Fix this by clearing the pid_table entry when destroying the vCPU.
> 
> Note that the same issue exists for SVM AVIC as well [1], to be fixed.
> 
> [*] Although, since this memory is freed into the kvm_vcpu_cache kmem
>     cache which is only used for allocating kvm_vcpus, _maybe_ this
>     memory will only be reused for pi_desc of another vCPU, not for
>     anything else. So _maybe_ this will only result in delivering the
>     IPI to a wrong vCPU (possibly of another VM) in the worst case, not
>     in a random corruption of kernel memory.
> 
> [1] https://lore.kernel.org/kvm/al4rNqpBYy8FGKPw@blrnaveerao1/
> 
> Signed-off-by: Dmytro Maluka <dmaluka@xxxxxxxxxxxx>

Reviewed-by: Kai Huang <kai.huang@xxxxxxxxx>