linux-kernel - [PATCH] irqchip/riscv-imsic: Fix irq migration failure issue when cpu hotplug.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20260203080256.9401-2-yingjun.ni@riscv-computing.com>
Date: Tue,  3 Feb 2026 16:02:57 +0800
From: "Yingjun Ni" <yingjun.ni@...cv-computing.com>
To: <anup@...infault.org>, <tglx@...nel.org>, <pjw@...nel.org>, 
	<palmer@...belt.com>, <aou@...s.berkeley.edu>, <alex@...ti.fr>
Cc: <linux-riscv@...ts.infradead.org>, <linux-kernel@...r.kernel.org>, 
	<yingjun.ni@...cv-computing.com>
Subject: [PATCH] irqchip/riscv-imsic: Fix irq migration failure issue when cpu hotplug.

Add a null pointer check for irq_write_msi_msg to fix NULL pointer
dereference issue when migrating irq.

Modify the return value of imsic_irq_set_affinity to let the subdomain
PCI-MSIX migrate the irq to a new cpu when cpu hotplug.

Don't set vec->move_next in imsic_vector_move_update when the cpu is
offline, because it will never be cleared.

crash log:
Unable to handle kernel NULL pointer dereference at virtual address 0
...
Stopper: multi_cpu_stop+0x0/0x24c <- stop_machine_cpuslocked+0x160/0x1b4
epc : 0x0
 ra : imsic_irq_set_affinity+0x174/0x1ac

Reproduce step:
1. start riscv kernel by qemu.

$QEMU -M virt,aia=aplic-imsic,aia-guests=5 -m 512M -smp 4 \
      -kernel $KERNEL -initrd $ROOTFS  -bios $OPENSBI \
      -device e1000e,netdev=net0,mac=52:54:00:12:34:56 \
      -netdev user,id=net0,net=10.0.2.0/24,dhcpstart=10.0.2.11 \
      -nographic

2. set cpu3 offline.

cat /proc/interrupts
    CPU0  CPU1  CPU2 CPU3
23:   0    0     0    66   PCI-MSIX-0000:00:01.0 eth0-rx-0

echo 0 > /sys/bus/cpu/devices/cpu3/online

Signed-off-by: Yingjun Ni <yingjun.ni@...cv-computing.com>
---
 drivers/irqchip/irq-riscv-imsic-platform.c | 8 ++++++--
 drivers/irqchip/irq-riscv-imsic-state.c    | 5 +++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-riscv-imsic-platform.c b/drivers/irqchip/irq-riscv-imsic-platform.c
index 643c8e459611..131e4f2b5431 100644
--- a/drivers/irqchip/irq-riscv-imsic-platform.c
+++ b/drivers/irqchip/irq-riscv-imsic-platform.c
@@ -93,9 +93,13 @@ static void imsic_irq_compose_msg(struct irq_data *d, struct msi_msg *msg)
 static void imsic_msi_update_msg(struct irq_data *d, struct imsic_vector *vec)
 {
 	struct msi_msg msg = { };
+	struct irq_chip *irq_chip = irq_data_get_irq_chip(d);
+
+	if (!irq_chip->irq_write_msi_msg)
+		return;
 
 	imsic_irq_compose_vector_msg(vec, &msg);
-	irq_data_get_irq_chip(d)->irq_write_msi_msg(d, &msg);
+	irq_chip->irq_write_msi_msg(d, &msg);
 }
 
 static int imsic_irq_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
@@ -173,7 +177,7 @@ static int imsic_irq_set_affinity(struct irq_data *d, const struct cpumask *mask
 	/* Move state of the old vector to the new vector */
 	imsic_vector_move(old_vec, new_vec);
 
-	return IRQ_SET_MASK_OK_DONE;
+	return IRQ_SET_MASK_OK;
 }
 
 static void imsic_irq_force_complete_move(struct irq_data *d)
diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
index b6cebfee9461..cd1bf9516878 100644
--- a/drivers/irqchip/irq-riscv-imsic-state.c
+++ b/drivers/irqchip/irq-riscv-imsic-state.c
@@ -362,6 +362,10 @@ static bool imsic_vector_move_update(struct imsic_local_priv *lpriv,
 	/* Update enable and move details */
 	enabled = READ_ONCE(vec->enable);
 	WRITE_ONCE(vec->enable, new_enable);
+
+	if (!cpu_online(vec->cpu) && is_old_vec)
+		goto out;
+
 	if (is_old_vec)
 		WRITE_ONCE(vec->move_next, move_vec);
 	else
@@ -371,6 +375,7 @@ static bool imsic_vector_move_update(struct imsic_local_priv *lpriv,
 	bitmap_set(lpriv->dirty_bitmap, vec->local_id, 1);
 	__imsic_remote_sync(lpriv, vec->cpu);
 
+out:
 	raw_spin_unlock_irqrestore(&lpriv->lock, flags);
 
 	return enabled;
-- 
2.43.0