[tip: irq/drivers] irqchip/gic-v3-its: Clear vpt_page after freeing the pending table

[tip-bot2 for Fuad Tabba]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     0d604b1e4617d18dbb5573290ba447d7369251d1
Gitweb:        https://git.kernel.org/tip/0d604b1e4617d18dbb5573290ba447d7369251d1
Author:        Fuad Tabba <fuad.tabba@xxxxxxxxx>
AuthorDate:    Tue, 08 Sep 2026 15:26:32 +01:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Thu, 15 Oct 2026 11:50:47 +02:00

irqchip/gic-v3-its: Clear vpt_page after freeing the pending table

its_vpe_teardown() frees vpt_page without clearing it, so its
vpt_page == NULL guard only holds the first time it runs on a vPE.
struct its_vpe outlives a failed KVM_DEV_ARM_VGIC_CTRL_INIT, so a retry
that fails again frees the pending table and the vPE ID a second time.

Fixes: 325ff3e78c64c ("irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()")
Signed-off-by: Fuad Tabba <fuad.tabba@xxxxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Reviewed-by: Marc Zyngier <maz@xxxxxxxxxx>
Reviewed-by: Zenghui Yu (Huawei) <zenghui.yu@xxxxxxxxx>
Reviewed-by: Radu Rendec <radu@xxxxxxxxxx>
Link: https://patch.msgid.link/20260908142632.2795308-4-fuad.tabba@xxxxxxxxx
---
 drivers/irqchip/irq-gic-v3-its.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 4f6d4aa..872d342 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -4600,6 +4600,7 @@ static void its_vpe_teardown(struct its_vpe *vpe)
 	its_vpe_db_proxy_unmap(vpe);
 	its_vpe_id_free(vpe->vpe_id);
 	its_free_pending_table(vpe->vpt_page);
+	vpe->vpt_page = NULL;
 }
 
 static void its_vpe_irq_domain_free(struct irq_domain *domain,