[PATCH 5.15.y v4 00/11] KVM: fixes for CVE-2026-46113 and related issues

[Kenta Akagi]

This is a backport of the CVE-2026-46113 and CVE-2026-53359 fixes to 5.15.y.

v2: https://lore.kernel.org/all/20260626174620.1819772-1-pbonzini@xxxxxxxxxx/
v3: https://lore.kernel.org/stable/20260913155523.7423-1-k@xxxxxxx/

Changes from v3:
- Added patches 3-6 to backport the change from gpte_is_8_bytes to has_4_byte_gpte.
- Adjusted patches 7-8 (patches 3/7 and 4/7 in v3) accordingly.

A regression has been reported in the backport of commit 0cb2af2ea66a
("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN")
[1], but the corresponding fix has already been merged into 5.15.218 [2].

[1] https://lore.kernel.org/kvm/20260630223723.83727-1-zcgao@xxxxxxxxxx/
[2] https://lore.kernel.org/stable/20260825132543.573783299@xxxxxxxxxxxxxxxxxxx/

David Matlack (2):
  KVM: x86/mmu: Use a bool for direct
  KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root()

Lai Jiangshan (3):
  KVM: X86: Remove useless code to set role.gpte_is_8_bytes when
    role.direct
  KVM: X86: Calculate quadrant when !role.gpte_is_8_bytes
  KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the
    direction

Paolo Bonzini (5):
  KVM: MMU: update comment on the number of page role combinations
  KVM: x86/mmu: Derive shadow MMU page role from parent
  KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes
  KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page()
  KVM: x86: Fix shadow paging use-after-free due to unexpected role

Sean Christopherson (1):
  KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

 Documentation/virt/kvm/mmu.rst  |   8 +-
 arch/x86/include/asm/kvm_host.h |  32 +++---
 arch/x86/kvm/mmu/mmu.c          | 184 ++++++++++++++++++++------------
 arch/x86/kvm/mmu/mmutrace.h     |   2 +-
 arch/x86/kvm/mmu/paging_tmpl.h  |  32 +++---
 arch/x86/kvm/mmu/spte.h         |   5 +
 arch/x86/kvm/mmu/tdp_mmu.c      |   2 +-
 7 files changed, 159 insertions(+), 106 deletions(-)

-- 
2.53.0