Re: [PATCH v2] KVM: x86: Exempt in-kernel PIC from "disappearing" interrupt warning

[Sean Christopherson]

On Fri, Jun 26, 2026, Aleksandr Nogikh wrote:
> On Thu, Jun 25, 2026 at 11:10 PM 'syzbot' via syzkaller-bugs
> > https://lore.kernel.org/all/345e9d6c-d7d9-4bab-adb3-d6a7bd27599f@xxxxxxxxxxxxxxx/T/
> > ---
> > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> > index 0550359ed..f1681aa9f 100644
> > --- a/arch/x86/kvm/x86.c
> > +++ b/arch/x86/kvm/x86.c
> > @@ -10857,7 +10857,9 @@ static int kvm_check_and_inject_events(struct kvm_vcpu *vcpu,
> >                 if (r) {
> >                         int irq = kvm_cpu_get_interrupt(vcpu);
> >
> > -                       if (!WARN_ON_ONCE(irq == -1)) {
> > +                       WARN_ON_ONCE(irq == -1 && !pic_in_kernel(vcpu->kvm));
> > +
> > +                       if (irq != -1) {
> 
> Hmm, no, that looks weird.
> Sorry for the noise, please ignore.

Looks right to me?  FWIW, this is what I had thrown together locally:

---
Author:     Sean Christopherson <seanjc@xxxxxxxxxx>
AuthorDate: Thu Jun 25 08:46:48 2026 -0700
Commit:     Sean Christopherson <seanjc@xxxxxxxxxx>
CommitDate: Thu Jun 25 09:00:49 2026 -0700

    KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC
    
    When getting a to-be-injected IRQ, don't WARN if the IRQ disappeared and
    the VM has an in-kernel PIC, as the ExtINT handling that's routed through
    KVM's virtual PIC is tracked per-VM, not per-vCPU.  If another vCPU grabs
    the IRQ, or deasserts the interrupt (which is level-triggered), then it's
    both expected and "fine" for a
    
    Keep the assert for split IRQCHIP VMs to help detect KVM bugs, as userspace
    is responsible for routing ExtINT to the intended vCPU, i.e. once an ExtINT
    is pending, it can't be cleared without holding the vCPU's mutex, and thus
    false positives are impossible.
    
    Fixes: bf672720e83c ("KVM: x86: check the kvm_cpu_get_interrupt result before using it")
    Debugged-by: Alexander Potapenko <glider@xxxxxxxxxx>
    Reported-by: syzbot+dd769db18693736eee89@xxxxxxxxxxxxxxxxxxxxxxxxx
    Closes: https://syzkaller.appspot.com/bug?extid=dd769db18693736eee89
    Closes: https://lore.kernel.org/all/6a360fdf.871e809a.2d6dda.0000.GAE@xxxxxxxxxx
    Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>

diff --git arch/x86/kvm/x86.c arch/x86/kvm/x86.c
index 0626e835e9eb..7feddeeb819d 100644
--- arch/x86/kvm/x86.c
+++ arch/x86/kvm/x86.c
@@ -7686,10 +7686,12 @@ static int kvm_check_and_inject_events(struct kvm_vcpu *vcpu,
                if (r) {
                        int irq = kvm_cpu_get_interrupt(vcpu);
 
-                       if (!WARN_ON_ONCE(irq == -1)) {
+                       if (likely(irq != -1)) {
                                kvm_queue_interrupt(vcpu, irq, false);
                                kvm_x86_call(inject_irq)(vcpu, false);
                                WARN_ON(kvm_x86_call(interrupt_allowed)(vcpu, true) < 0);
+                       } else {
+                               WARN_ON_ONCE(!pic_in_kernel(vcpu->kvm));
                        }
                }
                if (kvm_cpu_has_injectable_intr(vcpu))