summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Woodhouse <dwmw@amazon.co.uk>2022-03-29 20:11:47 +0300
committerPaolo Bonzini <pbonzini@redhat.com>2022-04-02 12:34:39 +0300
commit79593c086eb95eb2886f36ee6f78a1d6845e1bdf (patch)
treec0784da492f0d1efb29821eca40379199abf2ce7
parentf47e5bbbc92f5d234bbab317523c64a65b6ac4e2 (diff)
downloadlinux-79593c086eb95eb2886f36ee6f78a1d6845e1bdf.tar.xz
KVM: avoid double put_page with gfn-to-pfn cache
If the cache's user host virtual address becomes invalid, there is still a path from kvm_gfn_to_pfn_cache_refresh() where __release_gpc() could release the pfn but the gpc->pfn field has not been overwritten with an error value. If this happens, kvm_gfn_to_pfn_cache_unmap will call put_page again on the same page. Cc: stable@vger.kernel.org Fixes: 982ed0de4753 ("KVM: Reinstate gfn_to_pfn_cache with invalidation support") Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-rw-r--r--virt/kvm/pfncache.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/virt/kvm/pfncache.c b/virt/kvm/pfncache.c
index ce878f4be4da..1621f8efd961 100644
--- a/virt/kvm/pfncache.c
+++ b/virt/kvm/pfncache.c
@@ -191,6 +191,7 @@ int kvm_gfn_to_pfn_cache_refresh(struct kvm *kvm, struct gfn_to_pfn_cache *gpc,
gpc->uhva = gfn_to_hva_memslot(gpc->memslot, gfn);
if (kvm_is_error_hva(gpc->uhva)) {
+ gpc->pfn = KVM_PFN_ERR_FAULT;
ret = -EFAULT;
goto out;
}