Even more x86 fixes:

- Avoid a false positive panic in the #PF handler, if the kernel triggers
   a page fault within the asynchronous page fault handler before the flags
   are reset.  This can happen for example because of a perf NMI.
 
 - Always reset a vCPU's MMU pointer back to the root MMU when loading
   nested guest state fails during RSM or KVM_SET_NESTED_STATE.  Otherwise,
   KVM tries to run a non-nested guest with a nested MMU, which can result
   in a NULL pointer dereference attempting to get the nested MMU's pgd
   (EPTP or nested CR3).
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmrQj4kUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroOVGQf/cWZSdm/Ct31wH7UjwZiPkRUNQFMy
 Oy8jrGwXd/h/nfVAgF25wY49gx9JopCPHWJ1EU5NPSkOLTDJ+eMNZUfoCMuhDyYS
 gbMdvAbAEILKlgBAbC1pWr1fg6kMUQTJilp54elEP9XhKCOBG+KxfYu9BEvbonoc
 SvW/lN3RhIfHKLhTaOMwAA55Ta5ypebEUhjzZZXWFduWgOJn2F2L9ur8KlcpGQDq
 fXIeZihH0gmz3n00Q2M+F6BhGnNIxalmjvJ0khHHSUuLBUqKmvAPlzAcHwEbENWT
 gVGzq5Jr8nCVey6iLoUQu2Y1Tms/t+zFyAJXFsDE0TBCswW3XAX7DG8hxg==
 =4PsA
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "Even more x86 fixes:

   - Avoid a false positive panic in the #PF handler, if the kernel
     triggers a page fault within the asynchronous page fault handler
     before the flags are reset.

     This can happen for example because of a perf NMI.

   - Always reset a vCPU's MMU pointer back to the root MMU when loading
     nested guest state fails during RSM or KVM_SET_NESTED_STATE.

     Otherwise KVM tries to run a non-nested guest with a nested MMU,
     which can result in a NULL pointer dereference attempting to get
     the nested MMU's pgd (EPTP or nested CR3)"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
  x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
This commit is contained in:
Linus Torvalds 2026-10-15 08:12:47 -07:00
commit 9aa622dbaa
2 changed files with 32 additions and 4 deletions