Re: [PATCH] KVM: Nullify irqfd->producer when add_producer() fails

On Mon, 22 Jun 2026 15:51:01 +0800, leixiang wrote:

The x86 and powerpc add_producer() callbacks set irqfd->producer before the
fallible setup and never clear it on error.  The bypass manager doesn't
register a producer whose add_producer() failed -- producer->eventfd is
left NULL, so the later unregister early-returns and del_producer() is
never called -- so nothing ever drops the pointer.

For VFIO PCI the producer is embedded in struct vfio_pci_irq_ctx and freed
when the vector is disabled, after which a routing update dereferences the
dangling pointer via kvm_arch_update_irqfd_routing().

[...]

Applied to kvm-x86 fixes, thanks!

[1/1] KVM: Nullify irqfd->producer when add_producer() fails
      https://github.com/kvm-x86/linux/commit/ed446e8aa894

--
https://github.com/kvm-x86/linux/tree/next