KVM: x86: Assert that non-MSI doesn't have bypass vCPU when deleting producer

When disconnecting a non-MSI irqfd from an IRQ bypass producer, WARN if
the irqfd is configured for IRQ bypass and set its IRTE back to remapped
mode to harden against kernel/KVM bugs (keeping the irqfd in bypass mode
is often fatal to the host).

Deactivating an irqfd (removing it from the list of irqfds), updating
irqfd routes, and the code in question are all mutually exclusive (all
run under irqfds.lock).  If an irqfd is configured for bypass, and the
irqfd is deassigned at the same time IRQ routing is updated (to change the
routing to non-MSI), then either kvm_arch_update_irqfd_routing() should
process the irqfd routing change and put the IRTE into remapped mode
(routing update "wins"), or kvm_arch_irq_bypass_del_producer() should see
the MSI routing info (deactivation "wins").

Link: https://patch.msgid.link/20260113174606.104978-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
index 7cc8950005b6ec15b5cbd2e2bc74776429184aeb..4c7688670c2d8caec1f71ba3b5a4771870fe79b8 100644 (file)
--- a/arch/x86/kvm/irq.c
+++ b/arch/x86/kvm/irq.c
@@ -514,7 +514,8 @@ void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
         */
        spin_lock_irq(&kvm->irqfds.lock);
 
-       if (irqfd->irq_entry.type == KVM_IRQ_ROUTING_MSI) {
+       if (irqfd->irq_entry.type == KVM_IRQ_ROUTING_MSI ||
+           WARN_ON_ONCE(irqfd->irq_bypass_vcpu)) {
                ret = kvm_pi_update_irte(irqfd, NULL);
                if (ret)
                        pr_info("irq bypass consumer (eventfd %p) unregistration fails: %d\n",