[PATCH 1/2] KVM: arm64: vgic-its: Clear an unqueued LPI before dropping its lock

[Fuad Tabba]

DISCARD reads which vCPU's AP list holds the LPI, drops the irq lock to
pause that vCPU, and takes the lock again to clear the pending state.
When no list holds the LPI there's nothing to pause, yet the lock is
still dropped. In between, vgic_queue_irq_unlock() can list the LPI (for
an MSI that had already made it pending, or a GICR_INVLPIR write
enabling it while latched) and its vCPU can load it into a list
register. The guest then takes an LPI it has discarded.

Clear an LPI that no list holds before dropping the lock.

Fixes: e99ff76f4a02b ("KVM: arm64: vgic-its: Remove the pending state of a discarded LPI")
Signed-off-by: Fuad Tabba <fuad.tabba at linux.dev>
---
 arch/arm64/kvm/vgic/vgic-its.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
index 37059d1338406..42dc71495ad98 100644
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -842,22 +842,24 @@ static int vgic_its_cmd_handle_discard(struct kvm *kvm, struct vgic_its *its,
 		 * Only an LPI on a vCPU's AP list can be in its list registers,
 		 * which the exit path folds back, and that exit moves the LPI
 		 * to its target vCPU if the target has changed: pause both.
+		 * Clear an LPI on no AP list before dropping the lock, so that
+		 * nothing can put it in a list register first.
 		 */
 		scoped_guard(raw_spinlock_irqsave, &irq->irq_lock) {
 			vcpu = irq->vcpu;
 			target = irq->target_vcpu;
+			if (!vcpu)
+				irq->pending_latch = false;
 		}
 
 		if (vcpu) {
 			if (target != vcpu)
 				kvm_pause_vcpu(target);
 			kvm_pause_vcpu(vcpu);
-		}
 
-		scoped_guard(raw_spinlock_irqsave, &irq->irq_lock)
-			irq->pending_latch = false;
+			scoped_guard(raw_spinlock_irqsave, &irq->irq_lock)
+				irq->pending_latch = false;
 
-		if (vcpu) {
 			kvm_resume_vcpu(vcpu);
 			if (target != vcpu)
 				kvm_resume_vcpu(target);
-- 
2.47.3