Commit c60d847b authored by Will Deacon's avatar Will Deacon Committed by Marc Zyngier
Browse files

KVM: arm64: Fix double-free following kvm_pgtable_stage2_free_unlinked() 



kvm_pgtable_stage2_free_unlinked() does the final put_page() on the
root page of the sub-tree before returning, so remove the additional
put_page() invocations in the callers.

Cc: Ricardo Koller <ricarkol@google.com>
Fixes: f6a27d6d ("KVM: arm64: Drop last page ref in kvm_pgtable_stage2_free_removed()")
Signed-off-by: default avatarWill Deacon <will@kernel.org>
Reviewed-by: default avatarOliver Upton <oliver.upton@linux.dev>
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20240212193052.27765-1-will@kernel.org
parent 42dfa94d

arch/arm64/kvm/hyp/pgtable.c

+0 −2
Original line number Diff line number Diff line
@@ -1419,7 +1419,6 @@ kvm_pte_t *kvm_pgtable_stage2_create_unlinked(struct kvm_pgtable *pgt, 
				 level + 1);

	if (ret) {

		kvm_pgtable_stage2_free_unlinked(mm_ops, pgtable, level);

		mm_ops->put_page(pgtable);

		return ERR_PTR(ret);

	}
@@ -1502,7 +1501,6 @@ static int stage2_split_walker(const struct kvm_pgtable_visit_ctx *ctx, 


	if (!stage2_try_break_pte(ctx, mmu)) {

		kvm_pgtable_stage2_free_unlinked(mm_ops, childp, level);

		mm_ops->put_page(childp);

		return -EAGAIN;

	}