Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 06ce521a authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

kvm: fix page struct leak in handle_vmon 



handle_vmon gets a reference on VMXON region page,
but does not release it. Release the reference.

Found by syzkaller; based on a patch by Dmitry.

Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent a26d5534

arch/x86/kvm/vmx.c

+7 −2
Original line number Diff line number Diff line
@@ -6996,13 +6996,18 @@ static int nested_vmx_check_vmptr(struct kvm_vcpu *vcpu, int exit_reason, 
		}



		page = nested_get_page(vcpu, vmptr);

		if (page == NULL ||

		    *(u32 *)kmap(page) != VMCS12_REVISION) {

		if (page == NULL) {

			nested_vmx_failInvalid(vcpu);

			return kvm_skip_emulated_instruction(vcpu);

		}

		if (*(u32 *)kmap(page) != VMCS12_REVISION) {

			kunmap(page);

			nested_release_page_clean(page);

			nested_vmx_failInvalid(vcpu);

			return kvm_skip_emulated_instruction(vcpu);

		}

		kunmap(page);

		nested_release_page_clean(page);

		vmx->nested.vmxon_ptr = vmptr;

		break;

	case EXIT_REASON_VMCLEAR: