Re: [REGRESSION 7.2, BISECTED] KVM: x86: Starting Windows guest triggers UBSAN: array-index-out-of-bounds

[Sean Christopherson <seanjc@google.com>]

On Wed, Oct 07, 2026, Paolo Bonzini wrote:
> On Tue, Oct 6, 2026 at 7:37 PM SimonP <simonp.git@mailbox.org> wrote:
> > Hello,
> >
> > See subject. Happens in permission_fault() on line:
> >
> >         fault = (mmu->permissions[index] >> pte_access) & 1;
> >
> > Some output from a printk I added, not spammed but keeps happening:
> >
> > kvm: permission_fault(): pfec = 70, index = 35, not_smap = 0
> 
> Can you confirm you are using nested virtualization, and if so what is
> the L1 hypervisor and L2 guest combination? Also what is the processor
> model?
> 
> The issue is weird; it is caused by the SS bit which is apparently set
> in the #NPF exitcode; but it shouldn't be unless bit 4 is set in the
> misc_ctl field, and KVM never sets it. Can you check if the attached
> patch fixes it (modulo the fact that it shouldn't happen in the first
> place)?

...

> > kvm: permission_fault(): pfec = 70, index = 35, not_smap = 0
> > kvm: permission_fault(): pfec = 70, index = 35, not_smap = 0
> > kvm: permission_fault(): pfec = 70, index = 35, not_smap = 0
> > kvm: permission_fault(): pfec = 68, index = 34, not_smap = 0
> > kvm: permission_fault(): pfec = 68, index = 34, not_smap = 0

It's not just SS, it's also PK (which shouldn't happen either) and RSVD, which
*really* shouldn't happen.  In the page fault path, KVM explicitly clears RSVD
from error code that becomes @access and then pfec, so I'm completely baffled.
Nothing in walk_addr_generic() writes to @access, so the only thing I can think
of is that we're clobbering the stack?

	r = FNAME(walk_addr)(&walker, vcpu, fault->addr,
			     fault->error_code & ~PFERR_RSVD_MASK);