On Tue, Oct 27, 2026 at 3:12 PM Sean Christopherson <[email protected]> wrote: > > Explicitly free vmcs01 instead of the currently loaded VMCS when freeing a > vCPU, as relying on loaded_vmcs to point at vmcb01 is unnecessarily risky > and confusing. E.g. during vCPU creation, the error path relies on setting > loaded_vmcs and obfuscates that it should be impossible for vmcb02 to be > allocated, let alone active. Similarly, if KVM were buggy and left vmcb02 > as the current vCPU when freeing a vCPU, operating on loaded_vmcs would hit > a use-after-free *and* leak vmcs01. > > Because KVM isn't buggy, no functional change intended. > > Signed-off-by: Sean Christopherson <[email protected]>
Reviewed-by: James Houghton <[email protected]> > --- > arch/x86/kvm/vmx/vmx.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c > index d433cd846ac4..2ef1f634e7ec 100644 > --- a/arch/x86/kvm/vmx/vmx.c > +++ b/arch/x86/kvm/vmx/vmx.c > @@ -7515,7 +7515,7 @@ void vmx_vcpu_free(struct kvm_vcpu *vcpu) > vmx_destroy_pml_buffer(vcpu); > free_vpid(vmx->vpid); > nested_vmx_free_vcpu(vcpu); > - free_loaded_vmcs(vmx->loaded_vmcs); > + free_loaded_vmcs(&vmx->vmcs01); > free_page((unsigned long)vmx->ve_info); > > if (vmx_can_use_ipiv(vcpu)) > @@ -7614,7 +7614,7 @@ int vmx_vcpu_create(struct kvm_vcpu *vcpu) > return 0; > > free_vmcs: > - free_loaded_vmcs(vmx->loaded_vmcs); > + free_loaded_vmcs(&vmx->vmcs01); > free_pml: > vmx_destroy_pml_buffer(vcpu); > free_vpid: > -- > 2.56.0.307.g5fe7bd680c-goog >
