diff options
| author | David Woodhouse <dwmw@amazon.co.uk> | 2022-03-29 13:11:47 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-04-08 13:58:52 +0200 |
| commit | e815876cedf5bcea03df18600a23133af28ea472 (patch) | |
| tree | c224100ad1a1593221824679fbd4c8f73c628af3 /virt | |
| parent | a6ffdebfb6a9c2ffeed902b544b96fe67498210e (diff) | |
| download | linux-e815876cedf5bcea03df18600a23133af28ea472.tar.gz linux-e815876cedf5bcea03df18600a23133af28ea472.tar.bz2 linux-e815876cedf5bcea03df18600a23133af28ea472.zip | |
KVM: avoid double put_page with gfn-to-pfn cache
commit 79593c086eb95eb2886f36ee6f78a1d6845e1bdf upstream.
If the cache's user host virtual address becomes invalid, there
is still a path from kvm_gfn_to_pfn_cache_refresh() where __release_gpc()
could release the pfn but the gpc->pfn field has not been overwritten
with an error value. If this happens, kvm_gfn_to_pfn_cache_unmap will
call put_page again on the same page.
Cc: stable@vger.kernel.org
Fixes: 982ed0de4753 ("KVM: Reinstate gfn_to_pfn_cache with invalidation support")
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'virt')
| -rw-r--r-- | virt/kvm/pfncache.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/virt/kvm/pfncache.c b/virt/kvm/pfncache.c index ce878f4be4da..1621f8efd961 100644 --- a/virt/kvm/pfncache.c +++ b/virt/kvm/pfncache.c @@ -191,6 +191,7 @@ int kvm_gfn_to_pfn_cache_refresh(struct kvm *kvm, struct gfn_to_pfn_cache *gpc, gpc->uhva = gfn_to_hva_memslot(gpc->memslot, gfn); if (kvm_is_error_hva(gpc->uhva)) { + gpc->pfn = KVM_PFN_ERR_FAULT; ret = -EFAULT; goto out; } |