Re: [PATCH v2 3/5] KVM: arm64: vgic-v3: Unregister redistributors before freeing regions

On Fri, 21 Aug 2026 20:09:32 +0100,
Karl Mehltretter <[email protected]> wrote:
> 
> On Thu, Aug 20, 2026 at 09:58:57AM +0100, Marc Zyngier wrote:
> > The other bit of interest is in __kvm_vgic_vcpu_destroy(), and its
> > conditional removal of the RD iodevs. Can't we just get rid of this
> > whole block altogether now that we have a saner failing path?
> 
> I tested removing that block.
> It reintroduces the use-after-free fixed by ae8f8b376102
> (“KVM: arm64: Unregister redistributor for failed vCPU creation”).

At the very least:

		vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;

should be removed, as it serves no purpose anymore: all vcpus, valid
or not, should now go through vgic_unregister_redist_iodev() which
resets the value. It isn't massively useful on teardown anyway, so you
might as well kill the extra one.

	M.

-- 
Without deviation from the norm, progress is not possible.