Explicitly free vmcs01 instead of the currently loaded VMCS when freeing a vCPU, as relying on loaded_vmcs to point at vmcb01 is unnecessarily risky and confusing. E.g. during vCPU creation, the error path relies on setting loaded_vmcs and obfuscates that it should be impossible for vmcb02 to be allocated, let alone active. Similarly, if KVM were buggy and left vmcb02 as the current vCPU when freeing a vCPU, operating on loaded_vmcs would hit a use-after-free *and* leak vmcs01.
Because KVM isn't buggy, no functional change intended. Signed-off-by: Sean Christopherson <[email protected]> --- arch/x86/kvm/vmx/vmx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index d433cd846ac4..2ef1f634e7ec 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -7515,7 +7515,7 @@ void vmx_vcpu_free(struct kvm_vcpu *vcpu) vmx_destroy_pml_buffer(vcpu); free_vpid(vmx->vpid); nested_vmx_free_vcpu(vcpu); - free_loaded_vmcs(vmx->loaded_vmcs); + free_loaded_vmcs(&vmx->vmcs01); free_page((unsigned long)vmx->ve_info); if (vmx_can_use_ipiv(vcpu)) @@ -7614,7 +7614,7 @@ int vmx_vcpu_create(struct kvm_vcpu *vcpu) return 0; free_vmcs: - free_loaded_vmcs(vmx->loaded_vmcs); + free_loaded_vmcs(&vmx->vmcs01); free_pml: vmx_destroy_pml_buffer(vcpu); free_vpid: -- 2.56.0.307.g5fe7bd680c-goog
