[PATCH RFC] KVM: x86: Drop WARN_ON_ONCE() for concurrently disappearing interrupts

[syzbot]

A warning can be triggered in kvm_check_and_inject_events() when an
interrupt disappears between the time it is checked via
kvm_cpu_has_injectable_intr() and the time it is fetched via
kvm_cpu_get_interrupt(). This occurs because the warning incorrectly
assumes that if an interrupt is injectable, fetching it must always return
a valid interrupt vector (i.e., not -1).

However, this assumption is broken by level-triggered interrupts that are
deasserted concurrently by another thread. For example, if a misconfigured
PIT or a PCI device asserts and then immediately deasserts a
level-triggered interrupt, the VCPU thread might see the pending interrupt
during the check but find it gone during the fetch, resulting in
kvm_cpu_get_interrupt() returning -1.

The warning manifests as follows:

------------[ cut here ]------------
irq == -1
WARNING: arch/x86/kvm/x86.c:10860 at kvm_check_and_inject_events
arch/x86/kvm/x86.c:10860 [inline]
WARNING: arch/x86/kvm/x86.c:10860 at vcpu_enter_guest
arch/x86/kvm/x86.c:11356 [inline]
WARNING: arch/x86/kvm/x86.c:10860 at vcpu_run+0x57ec/0x7950
arch/x86/kvm/x86.c:11770
RIP: 0010:kvm_check_and_inject_events arch/x86/kvm/x86.c:10860 [inline]
RIP: 0010:vcpu_enter_guest arch/x86/kvm/x86.c:11356 [inline]
RIP: 0010:vcpu_run+0x57ec/0x7950 arch/x86/kvm/x86.c:11770
Call Trace:
<TASK>
kvm_arch_vcpu_ioctl_run+0x1193/0x2070 arch/x86/kvm/x86.c:12125
kvm_vcpu_ioctl+0xa61/0xfd0 virt/kvm/kvm_main.c:4470
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>

Since this is a legitimate Time-Of-Check to Time-Of-Use (TOCTOU) race
condition that can occur during normal operation, WARN_ON_ONCE() must not
be used for conditions that can legitimately happen. The patch removes the
WARN_ON_ONCE() in kvm_check_and_inject_events() and replaces it with a
pr_err_ratelimited() to log the event instead. The same flawed assumption
exists in vmx_check_nested_events(), where kvm_apic_has_interrupt() can
return -1 after kvm_cpu_has_interrupt() returns true. The patch applies the
same fix there by removing the WARN_ON_ONCE() and gracefully handling the
missing interrupt with a rate-limited error message.

Fixes: bf672720e83c ("KVM: x86: check the kvm_cpu_get_interrupt result before using it")
Assisted-by: Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+dd769d...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dd769db18693736eee89
Link: https://syzkaller.appspot.com/ai_job?id=b37654f7-62ad-4e4a-a244-0949c0ca4246
To: "Borislav Petkov" <b...@alien8.de>
To: "Dave Hansen" <dave....@linux.intel.com>
To: <k...@vger.kernel.org>
To: "Ingo Molnar" <mi...@redhat.com>
To: "Paolo Bonzini" <pbon...@redhat.com>
To: "Sean Christopherson" <sea...@google.com>
To: "Thomas Gleixner" <tg...@kernel.org>
To: <x...@kernel.org>
Cc: "H. Peter Anvin" <h...@zytor.com>
Cc: <linux-...@vger.kernel.org>

---
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 3fe88f29b..c3e9c9d9b 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -4446,8 +4446,11 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
}

irq = kvm_apic_has_interrupt(vcpu);
- if (WARN_ON_ONCE(irq < 0))
+ if (irq < 0) {
+ pr_err_ratelimited(
+ "KVM: APIC interrupt disappeared between checking and fetching\n");
goto no_vmexit;
+ }

/*
* If the IRQ is L2's PI notification vector, process posted
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 0550359ed..c5b4cddd9 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10857,10 +10857,13 @@ static int kvm_check_and_inject_events(struct kvm_vcpu *vcpu,
if (r) {
int irq = kvm_cpu_get_interrupt(vcpu);

- if (!WARN_ON_ONCE(irq == -1)) {
+ if (irq != -1) {
kvm_queue_interrupt(vcpu, irq, false);
kvm_x86_call(inject_irq)(vcpu, false);
WARN_ON(kvm_x86_call(interrupt_allowed)(vcpu, true) < 0);
+ } else {
+ pr_err_ratelimited(
+ "KVM: interrupt disappeared between checking and fetching\n");
}
}
if (kvm_cpu_has_injectable_intr(vcpu))


base-commit: 8cd9520d35a6c38db6567e97dd93b1f11f185dc6
--
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzk...@googlegroups.com.

[Alexander Potapenko]

On Tue, Jun 23, 2026 at 1:47 PM 'syzbot' via
syzkaller-upstream-moderation

Let's not touch nested.c for now. Respin with just the arch/x86/kvm/x86.c part.

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/e61a6de2-8e9d-4768-b555-27f8954e48ec%40mail.kernel.org.



--
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Paul Manicle, Liana Sebastian
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg

[syzbot]

Fixes: bf672720e83c ("KVM: x86: check the kvm_cpu_get_interrupt result before using it")

Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot

Reported-by: syzbot+dd769d...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dd769db18693736eee89

Link: https://syzkaller.appspot.com/ai_job?id=35cad3cd-95fd-4c0d-8ca8-812f58d56e59

To: "Borislav Petkov" <b...@alien8.de>
To: "Dave Hansen" <dave....@linux.intel.com>
To: <k...@vger.kernel.org>
To: "Ingo Molnar" <mi...@redhat.com>
To: "Paolo Bonzini" <pbon...@redhat.com>
To: "Sean Christopherson" <sea...@google.com>
To: "Thomas Gleixner" <tg...@kernel.org>
To: <x...@kernel.org>
Cc: "H. Peter Anvin" <h...@zytor.com>
Cc: <linux-...@vger.kernel.org>

---

v2:
- Removed changes to arch/x86/kvm/vmx/nested.c.

v1:
https://lore.kernel.org/all/e61a6de2-8e9d-4768...@mail.kernel.org/T/
---

[Alexander Potapenko]

#syz upstream

On Wed, Jun 24, 2026 at 3:02 PM 'syzbot' via
syzkaller-upstream-moderation

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.

> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/28ac723d-47df-426b-939e-752b6df7f1a8%40mail.kernel.org.