From: David Woodhouse <dwmw@xxxxxxxxxxxx> commit 79593c086eb95eb2886f36ee6f78a1d6845e1bdf upstream. If the cache's user host virtual address becomes invalid, there is still a path from kvm_gfn_to_pfn_cache_refresh() where __release_gpc() could release the pfn but the gpc->pfn field has not been overwritten with an error value. If this happens, kvm_gfn_to_pfn_cache_unmap will call put_page again on the same page. Cc: stable@xxxxxxxxxxxxxxx Fixes: 982ed0de4753 ("KVM: Reinstate gfn_to_pfn_cache with invalidation support") Signed-off-by: David Woodhouse <dwmw2@xxxxxxxxxxxxx> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- virt/kvm/pfncache.c | 1 + 1 file changed, 1 insertion(+) --- a/virt/kvm/pfncache.c +++ b/virt/kvm/pfncache.c @@ -191,6 +191,7 @@ int kvm_gfn_to_pfn_cache_refresh(struct gpc->uhva = gfn_to_hva_memslot(gpc->memslot, gfn); if (kvm_is_error_hva(gpc->uhva)) { + gpc->pfn = KVM_PFN_ERR_FAULT; ret = -EFAULT; goto out; } Patches currently in stable-queue which might be from dwmw@xxxxxxxxxxxx are queue-5.17/rcu-kill-rnp-ofl_seq-and-use-only-rcu_state.ofl_lock.patch queue-5.17/kvm-avoid-double-put_page-with-gfn-to-pfn-cache.patch