1 Subject: [PATCH] kvm: fix page struct leak in handle_vmon
2 From: Paolo Bonzini <pbonzini () redhat ! com>
3 Date: 2017-01-24 10:56:21
5 handle_vmon gets a reference on VMXON region page,
6 but does not release it. Release the reference.
8 Found by syzkaller; based on a patch by Dmitry.
10 Reported-by: Dmitry Vyukov <dvyukov@google.com>
11 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
12 Reviewed-by: David Hildenbrand <david@redhat.com>
14 arch/x86/kvm/vmx.c | 9 +++++++--
15 1 file changed, 7 insertions(+), 2 deletions(-)
17 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
18 index 42cc3d6f4d20..0f7345035210 100644
19 --- a/arch/x86/kvm/vmx.c
20 +++ b/arch/x86/kvm/vmx.c
21 @@ -7085,13 +7085,18 @@ static int nested_vmx_check_vmptr(struct kvm_vcpu *vcpu, int exit_reason,
24 page = nested_get_page(vcpu, vmptr);
26 - *(u32 *)kmap(page) != VMCS12_REVISION) {
28 nested_vmx_failInvalid(vcpu);
29 + return kvm_skip_emulated_instruction(vcpu);
31 + if (*(u32 *)kmap(page) != VMCS12_REVISION) {
33 + nested_release_page_clean(page);
34 + nested_vmx_failInvalid(vcpu);
35 return kvm_skip_emulated_instruction(vcpu);
38 + nested_release_page_clean(page);
39 vmx->nested.vmxon_ptr = vmptr;
41 case EXIT_REASON_VMCLEAR: