Commit 79593c08 authored by David Woodhouse's avatar David Woodhouse Committed by Paolo Bonzini
Browse files

KVM: avoid double put_page with gfn-to-pfn cache 



If the cache's user host virtual address becomes invalid, there
is still a path from kvm_gfn_to_pfn_cache_refresh() where __release_gpc()
could release the pfn but the gpc->pfn field has not been overwritten
with an error value.  If this happens, kvm_gfn_to_pfn_cache_unmap will
call put_page again on the same page.

Cc: stable@vger.kernel.org
Fixes: 982ed0de ("KVM: Reinstate gfn_to_pfn_cache with invalidation support")
Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent f47e5bbb

virt/kvm/pfncache.c

+1 −0
Original line number Diff line number Diff line
@@ -191,6 +191,7 @@ int kvm_gfn_to_pfn_cache_refresh(struct kvm *kvm, struct gfn_to_pfn_cache *gpc, 
		gpc->uhva = gfn_to_hva_memslot(gpc->memslot, gfn);



		if (kvm_is_error_hva(gpc->uhva)) {

			gpc->pfn = KVM_PFN_ERR_FAULT;

			ret = -EFAULT;

			goto out;

		}