1 files changed, 23 insertions, 14 deletions

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 7fa89c39c64f..1b270fd60634 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2797,7 +2797,6 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
         struct kvm_memory_slot *memslot;
         unsigned long n;
         unsigned long is_dirty = 0;
-        unsigned long *dirty_bitmap = NULL;
 
         mutex_lock(&kvm->slots_lock);
 
@@ -2812,27 +2811,30 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
 
         n = kvm_dirty_bitmap_bytes(memslot);
 
-        r = -ENOMEM;
-        dirty_bitmap = vmalloc(n);
-        if (!dirty_bitmap)
-                goto out;
-        memset(dirty_bitmap, 0, n);
-
         for (i = 0; !is_dirty && i < n/sizeof(long); i++)
                 is_dirty = memslot->dirty_bitmap[i];
 
         /* If nothing is dirty, don't bother messing with page tables. */
         if (is_dirty) {
                 struct kvm_memslots *slots, *old_slots;
+                unsigned long *dirty_bitmap;
 
                 spin_lock(&kvm->mmu_lock);
                 kvm_mmu_slot_remove_write_access(kvm, log->slot);
                 spin_unlock(&kvm->mmu_lock);
 
-                slots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
-                if (!slots)
-                        goto out_free;
+                r = -ENOMEM;
+                dirty_bitmap = vmalloc(n);
+                if (!dirty_bitmap)
+                        goto out;
+                memset(dirty_bitmap, 0, n);
 
+                r = -ENOMEM;
+                slots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
+                if (!slots) {
+                        vfree(dirty_bitmap);
+                        goto out;
+                }
                 memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
                 slots->memslots[log->slot].dirty_bitmap = dirty_bitmap;
 
@@ -2841,13 +2843,20 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
                 synchronize_srcu_expedited(&kvm->srcu);
                 dirty_bitmap = old_slots->memslots[log->slot].dirty_bitmap;
                 kfree(old_slots);
+
+                r = -EFAULT;
+                if (copy_to_user(log->dirty_bitmap, dirty_bitmap, n)) {
+                        vfree(dirty_bitmap);
+                        goto out;
+                }
+                vfree(dirty_bitmap);
+        } else {
+                r = -EFAULT;
+                if (clear_user(log->dirty_bitmap, n))
+                        goto out;
         }
 
         r = 0;
-        if (copy_to_user(log->dirty_bitmap, dirty_bitmap, n))
-                r = -EFAULT;
-out_free:
-        vfree(dirty_bitmap);
 out:
         mutex_unlock(&kvm->slots_lock);
         return r;