vmm: Free vCPUs when destroying them.

[jhb]

Summary

Reported by: andrew

[corvink]

sys/amd64/vmm/vmm.c

670

Should we set vm->vcpu[i] to NULL after calling vcpu_cleanup to avoid any use-after-free?

[jhb]

sys/amd64/vmm/vmm.c

670

We are about to free(vm) in the caller after this function returns in the destroy case, so use-after-free isn't really possible I think.

sys/amd64/vmm/vmm.c

 {
         vmmops_vlapic_cleanup(vcpu->vlapic);
         vmmops_vcpu_cleanup(vcpu->cookie);
         vcpu->cookie = NULL;
         if (destroy) {
                 vmm_stat_free(vcpu->stats);  
                 fpu_save_area_free(vcpu->guestfpu);
                 vcpu_lock_destroy(vcpu);
+                free(vcpu, M_VM);
         }
 }
 
 static struct vcpu *
 vcpu_alloc(struct vm *vm, int vcpu_id)
 {
         struct vcpu *vcpu;
 
vm_cleanup(struct vm *vm, bool destroy)
         vpmtmr_cleanup(vm->vpmtmr);
         vatpit_cleanup(vm->vatpit);
         vhpet_cleanup(vm->vhpet);
         vatpic_cleanup(vm->vatpic);
         vioapic_cleanup(vm->vioapic);
 
         for (i = 0; i < vm->maxcpus; i++) {
                 if (vm->vcpu[i] != NULL)
                         vcpu_cleanup(vm->vcpu[i], destroy);
         }
 
         vmmops_cleanup(vm->cookie);
 
         /*
          * System memory is removed from the guest address space only when
          * the VM is destroyed. This is because the mapping remains the same
          * across VM reset.