KVM: VMX: fix use after free of vmx->loaded_vmcs

[pandora-kernel.git] / arch / x86 / kvm / vmx.c

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 0abf8b7..7661eb1 100644 (file)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -7390,8 +7390,8 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
        struct vcpu_vmx *vmx = to_vmx(vcpu);
 
        free_vpid(vmx);
        struct vcpu_vmx *vmx = to_vmx(vcpu);
 
        free_vpid(vmx);

-       free_nested(vmx);

        free_loaded_vmcs(vmx->loaded_vmcs);
        free_loaded_vmcs(vmx->loaded_vmcs);

+       free_nested(vmx);

        kfree(vmx->guest_msrs);
        kvm_vcpu_uninit(vcpu);
        kmem_cache_free(kvm_vcpu_cache, vmx);
        kfree(vmx->guest_msrs);
        kvm_vcpu_uninit(vcpu);
        kmem_cache_free(kvm_vcpu_cache, vmx);