Syzbot CI

Subject	KVM: SEV: Fix RMP #PF due to freeing in-use VMSA
Author	seanjc@google.com
Date	2026-07-09 20:49:31 +0000 UTC
Version
Cc	ackerleytng@google.com imv4bel@gmail.com joro@8bytes.org kvm@vger.kernel.org linux-kernel@vger.kernel.org michael.roth@amd.com pbonzini@redhat.com seanjc@google.com tabba@google.com thomas.lendacky@amd.com

Subject

KVM: SEV: Fix RMP #PF due to freeing in-use VMSA

Author

seanjc@google.com

Date

2026-07-09 20:49:31 +0000 UTC

Version

ackerleytng@google.com imv4bel@gmail.com joro@8bytes.org kvm@vger.kernel.org linux-kernel@vger.kernel.org michael.roth@amd.com pbonzini@redhat.com seanjc@google.com tabba@google.com thomas.lendacky@amd.com

Name	Content [All]
[PATCH v4 01/18] KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests	[Body]
[PATCH v4 02/18] KVM: SEV: Extract loading of guest-provided VMSA to a separate helper	[Body]
[PATCH v4 03/18] KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable	[Body]
[PATCH v4 04/18] KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y	[Body]
[PATCH v4 05/18] KVM: x86: Serialize writes to disabled_quirks using kvm->lock	[Body]
[PATCH v4 06/18] KVM: x86: Ensure runtime reads of disabled_quirks are resolved once	[Body]
[PATCH v4 07/18] KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()	[Body]
[PATCH v4 08/18] KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves	[Body]
[PATCH v4 09/18] KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot	[Body]
[PATCH v4 10/18] KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped	[Body]
[PATCH v4 11/18] KVM: SEV: Mark vCPU has having guest-provided VMSA even if its invalid	[Body]
[PATCH v4 12/18] KVM: x86: Guard .gmem_prepare() declarations with HAVE_KVM_GMEM_PREPARE=y	[Body]
[PATCH v4 13/18] KVM: guest_memfd: Pass GPA, not GFN, to prepare() hook	[Body]
[PATCH v4 14/18] KVM: guest_memfd: Drop the redundant printk on arch gmem_prepare() failure	[Body]
[PATCH v4 15/18] KVM: guest_memfd: Fold __kvm_gmem_prepare_folio() into its sole caller	[Body]
[PATCH v4 16/18] KVM: guest_memfd: Explicitly pass number of pages to kvm_arch_gmem_prepare()	[Body]
[PATCH v4 17/18] KVM: guest_memfd: Align the gfn as well as the pfn when "preparing" a folio	[Body]
[PATCH v4 18/18] KVM: guest_memfd: Combine .gmem_prepare()+.gmem_invalidate() into .gmem_convert()	[Body]

Name

Content [All]

[PATCH v4 01/18] KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests

[PATCH v4 02/18] KVM: SEV: Extract loading of guest-provided VMSA to a separate helper

[PATCH v4 03/18] KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable

[PATCH v4 04/18] KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y

[PATCH v4 05/18] KVM: x86: Serialize writes to disabled_quirks using kvm->lock

[PATCH v4 06/18] KVM: x86: Ensure runtime reads of disabled_quirks are resolved once

[PATCH v4 07/18] KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()

[PATCH v4 08/18] KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves

[PATCH v4 09/18] KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot

[PATCH v4 10/18] KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped

[PATCH v4 11/18] KVM: SEV: Mark vCPU has having guest-provided VMSA even if its invalid

[PATCH v4 12/18] KVM: x86: Guard .gmem_prepare() declarations with HAVE_KVM_GMEM_PREPARE=y

[PATCH v4 13/18] KVM: guest_memfd: Pass GPA, not GFN, to prepare() hook

[PATCH v4 14/18] KVM: guest_memfd: Drop the redundant printk on arch gmem_prepare() failure

[PATCH v4 15/18] KVM: guest_memfd: Fold __kvm_gmem_prepare_folio() into its sole caller

[PATCH v4 16/18] KVM: guest_memfd: Explicitly pass number of pages to kvm_arch_gmem_prepare()

[PATCH v4 17/18] KVM: guest_memfd: Align the gfn as well as the pfn when "preparing" a folio

[PATCH v4 18/18] KVM: guest_memfd: Combine .gmem_prepare()+.gmem_invalidate() into .gmem_convert()

Session 2026-07-09

Passed

ID (for dev)	e407ef94-f84b-47ba-a1ca-5f9153f6fef5
Status	finished
Triaged	OK [Log] [Trajectory]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	a204badd8432f93b7e862e7dac6db0fe3d65f370 [Config]		passed [Log]
[KASAN] Boot test: Base	a204badd8432f93b7e862e7dac6db0fe3d65f370 [Config]		passed [Log]
[KASAN] Build Patched		a204badd8432f93b7e862e7dac6db0fe3d65f370 [Config] [patched]	passed [Log]
[KASAN] Boot test: Patched		a204badd8432f93b7e862e7dac6db0fe3d65f370 [Config] [patched]	passed [Log]
[KASAN] Fuzz	a204badd8432f93b7e862e7dac6db0fe3d65f370 [Config]	a204badd8432f93b7e862e7dac6db0fe3d65f370 [Config] [patched]	passed [Log] [Artifacts]

Patches (18)

Series Summary

Sessions

Session 2026-07-09