--- /dev/null
+From stable-bounces@linux.kernel.org Thu Mar 26 23:05:11 2009
+Date: Thu, 26 Mar 2009 23:05:07 GMT
+Message-Id: <200903262305.n2QN57TC005909@hera.kernel.org>
+From: Joerg Roedel <joerg.roedel@amd.com>
+To: stable@kernel.org
+Subject: KVM: MMU: Fix another largepage memory leak
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+upstream commit: c5bc22424021cabda862727fb3f5098b866f074d
+
+In the paging_fetch function rmap_remove is called after setting a large
+pte to non-present. This causes rmap_remove to not drop the reference to
+the large page. The result is a memory leak of that page.
+
+Cc: stable@kernel.org
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Acked-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+[chrisw: backport to 2.6.29]
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ arch/x86/kvm/paging_tmpl.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -314,9 +314,9 @@ static int FNAME(shadow_walk_entry)(stru
+ return 0;
+
+ if (is_large_pte(*sptep)) {
++ rmap_remove(vcpu->kvm, sptep);
+ set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
+ kvm_flush_remote_tlbs(vcpu->kvm);
+- rmap_remove(vcpu->kvm, sptep);
+ }
+
+ if (level == PT_DIRECTORY_LEVEL && gw->level == PT_DIRECTORY_LEVEL) {