From: Alexander Potapenko A warning can be triggered in kvm_check_and_inject_events() when an interrupt disappears between the time it is checked via kvm_cpu_has_injectable_intr() and the time it is fetched via kvm_cpu_get_interrupt(). This occurs because the warning incorrectly assumes that if an interrupt is injectable, fetching it must always return a valid interrupt vector (i.e., not -1). However, this assumption is broken by level-triggered interrupts that are deasserted concurrently by another thread. For example, if a misconfigured PIT or a PCI device asserts and then immediately deasserts a level-triggered interrupt, the VCPU thread might see the pending interrupt during the check but find it gone during the fetch, resulting in kvm_cpu_get_interrupt() returning -1. The warning manifests as follows: ------------[ cut here ]------------ irq == -1 WARNING: arch/x86/kvm/x86.c:10860 at kvm_check_and_inject_events arch/x86/kvm/x86.c:10860 [inline] WARNING: arch/x86/kvm/x86.c:10860 at vcpu_enter_guest arch/x86/kvm/x86.c:11356 [inline] WARNING: arch/x86/kvm/x86.c:10860 at vcpu_run+0x57ec/0x7950 arch/x86/kvm/x86.c:11770 RIP: 0010:kvm_check_and_inject_events arch/x86/kvm/x86.c:10860 [inline] RIP: 0010:vcpu_enter_guest arch/x86/kvm/x86.c:11356 [inline] RIP: 0010:vcpu_run+0x57ec/0x7950 arch/x86/kvm/x86.c:11770 Call Trace: kvm_arch_vcpu_ioctl_run+0x1193/0x2070 arch/x86/kvm/x86.c:12125 kvm_vcpu_ioctl+0xa61/0xfd0 virt/kvm/kvm_main.c:4470 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Since this is a legitimate Time-Of-Check to Time-Of-Use (TOCTOU) race condition that can occur during normal operation, WARN_ON_ONCE() must not be used for conditions that can legitimately happen. The patch removes the WARN_ON_ONCE() in kvm_check_and_inject_events() and replaces it with a pr_err_ratelimited() to log the event instead. Fixes: bf672720e83c ("KVM: x86: check the kvm_cpu_get_interrupt result before using it") Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot Reported-by: syzbot+dd769db18693736eee89@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=dd769db18693736eee89 Link: https://syzkaller.appspot.com/ai_job?id=35cad3cd-95fd-4c0d-8ca8-812f58d56e59 Signed-off-by: Alexander Potapenko --- diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 0550359ed..c5b4cddd9 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -10857,10 +10857,13 @@ static int kvm_check_and_inject_events(struct kvm_vcpu *vcpu, if (r) { int irq = kvm_cpu_get_interrupt(vcpu); - if (!WARN_ON_ONCE(irq == -1)) { + if (irq != -1) { kvm_queue_interrupt(vcpu, irq, false); kvm_x86_call(inject_irq)(vcpu, false); WARN_ON(kvm_x86_call(interrupt_allowed)(vcpu, true) < 0); + } else { + pr_err_ratelimited( + "KVM: interrupt disappeared between checking and fetching\n"); } } if (kvm_cpu_has_injectable_intr(vcpu)) base-commit: 8cd9520d35a6c38db6567e97dd93b1f11f185dc6 -- See https://goo.gle/syzbot-ai-patches for information about AI-generated patches. You can comment on the patch as usual, syzbot will try to address the comments and send a new version of the patch if necessary. syzbot engineers can be reached at syzkaller@googlegroups.com.