Re: [REGRESSION 7.2, BISECTED] KVM: x86: Starting Windows guest triggers UBSAN: array-index-out-of-bounds

[SimonP <simonp.git@mailbox.org>]

On Wed, Oct 07, 2026 at 02:05:15PM +0200, Paolo Bonzini wrote:
> On Wed, Oct 7, 2026 at 1:47 PM SimonP <simonp.git@mailbox.org> wrote:
> >
> > On Wed, Oct 07, 2026 at 01:16:32PM +0200, Paolo Bonzini wrote:
> > > On Tue, Oct 6, 2026 at 7:37 PM SimonP <simonp.git@mailbox.org> wrote:
> > > > Hello,
> > > >
> > > > See subject. Happens in permission_fault() on line:
> > > >
> > > >         fault = (mmu->permissions[index] >> pte_access) & 1;
> > > >
> > > > Some output from a printk I added, not spammed but keeps happening:
> > > >
> > > > kvm: permission_fault(): pfec = 70, index = 35, not_smap = 0
> > >
> > > Can you confirm you are using nested virtualization, and if so what is
> > > the L1 hypervisor and L2 guest combination? Also what is the processor
> > > model?
> > >
> > > The issue is weird; it is caused by the SS bit which is apparently set
> > > in the #NPF exitcode; but it shouldn't be unless bit 4 is set in the
> > > misc_ctl field, and KVM never sets it. Can you check if the attached
> > > patch fixes it (modulo the fact that it shouldn't happen in the first
> > > place)?
> >
> > Will test the patch when I can but for now increment the weird counter
> > because there is no nesting, this is on a bare-metal hypervisor. The
> > guest is Windows 11. $(lscpu) is below.
> 
> No, I mean nesting another hypervisor *inside* KVM; do you have
> Hyper-V enabled in your Windows VM? The stack trace has both
> npf_interception and paging64_page_fault, which doesn't really happen
> without nesting.
> 
> If you are using QEMU, you can use "info stats vcpu guest_mode" from
> the QEMU monitor to tell you more. If you're using libvirt, likewise,
> that would be
> 
>    virsh qemu-monitor-command ID --hmp 'info stats vcpu guest_mode
> 

Sorry, misunderstood. Yes, I use WSL2 in the Windows VM.

$ virsh qemu-monitor-command win11 --hmp 'info stats vcpu guest_mode'
provider: kvm
    guest_mode (instant, boolean): no

Regards,
Simon


> Thanks,
> 
> Paolo
>