[PATCH v3] KVM: x86/mmu: Fix NX page unaccounting for TDP MMU pages

[PATCH v3] KVM: x86/mmu: Fix NX page unaccounting for TDP MMU pages

[Carlos López]

unaccount_nx_huge_page() unconditionally passes KVM_SHADOW_MMU to
untrack_possible_nx_huge_page(), which is incorrect, particularly on
the path from kvm_recover_nx_huge_pages(), which handles pages from
both MMUs.

Fix this by passing down the MMU type from the callers. Note that
__kvm_mmu_prepare_zap_page() is only used for shadow MMU pages.

Fixes: 6777885605e1 ("KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU")
Signed-off-by: Carlos López <clopez@suse.de>
---
v3:
  * Pass down the MMU type down from callers (Sean).
v2:
  * Use a helper to retrieve the MMU type to avoid referencing KVM_TDP_MMU for
    32 bit builds (Sashiko).
 arch/x86/kvm/mmu/mmu.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 9788ff180374..f811b1ee0b2c 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -864,11 +864,12 @@ void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp,
 	list_del_init(&sp->possible_nx_huge_page_link);
 }
 
-static void unaccount_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp)
+static void unaccount_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp,
+				    enum kvm_mmu_type mmu_type)
 {
 	sp->nx_huge_page_disallowed = false;
 
-	untrack_possible_nx_huge_page(kvm, sp, KVM_SHADOW_MMU);
+	untrack_possible_nx_huge_page(kvm, sp, mmu_type);
 }
 
 static struct kvm_memory_slot *gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu,
@@ -2829,7 +2830,7 @@ static bool __kvm_mmu_prepare_zap_page(struct kvm *kvm,
 	}
 
 	if (sp->nx_huge_page_disallowed)
-		unaccount_nx_huge_page(kvm, sp);
+		unaccount_nx_huge_page(kvm, sp, KVM_SHADOW_MMU);
 
 	sp->role.invalid = 1;
 
@@ -8055,7 +8056,7 @@ static void kvm_recover_nx_huge_pages(struct kvm *kvm,
 		WARN_ON_ONCE(!sp->nx_huge_page_disallowed);
 		WARN_ON_ONCE(!sp->role.direct);
 
-		unaccount_nx_huge_page(kvm, sp);
+		unaccount_nx_huge_page(kvm, sp, mmu_type);
 
 		if (is_tdp_mmu)
 			spin_unlock(tdp_mmu_pages_lock);

base-commit: 70c944caf570fda2d79baa71435589a8db39f048
-- 
2.51.0

Re: [PATCH v3] KVM: x86/mmu: Fix NX page unaccounting for TDP MMU pages

[Sean Christopherson]

On Wed, 16 Sep 2026 16:33:11 +0200, Carlos López wrote:
> unaccount_nx_huge_page() unconditionally passes KVM_SHADOW_MMU to
> untrack_possible_nx_huge_page(), which is incorrect, particularly on
> the path from kvm_recover_nx_huge_pages(), which handles pages from
> both MMUs.
> 
> Fix this by passing down the MMU type from the callers. Note that
> __kvm_mmu_prepare_zap_page() is only used for shadow MMU pages.
> 
> [...]

Applied to kvm-x86 mmu, thanks!

[1/1] KVM: x86/mmu: Fix NX page unaccounting for TDP MMU pages
      https://github.com/kvm-x86/linux/commit/31adfe155db6

--
https://github.com/kvm-x86/linux/tree/next