From: Avi Kivity If a page is marked as dirty in the guest pte, set_pte_common() can set the writable bit on newly-instantiated shadow pte. This optimization avoids a write fault after the initial read fault. However, if a write fault instantiates the pte, fix_write_pf() incorrectly reports the fault as a guest page fault, and the guest oopses on what appears to be a correctly-mapped page. Fix is to detect the condition and only report a guest page fault on a user access to a kernel page. With the fix, a kvm guest can survive a whole night of running the kernel hacker's screensaver (make -j9 in a loop). Signed-off-by: Avi Kivity Cc: Ingo Molnar Signed-off-by: Andrew Morton --- drivers/kvm/paging_tmpl.h | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-) diff -puN drivers/kvm/paging_tmpl.h~kvm-fix-bogus-pagefault-on-writable-pages drivers/kvm/paging_tmpl.h --- a/drivers/kvm/paging_tmpl.h~kvm-fix-bogus-pagefault-on-writable-pages +++ a/drivers/kvm/paging_tmpl.h @@ -274,7 +274,7 @@ static int FNAME(fix_write_pf)(struct kv struct kvm_mmu_page *page; if (is_writeble_pte(*shadow_ent)) - return 0; + return !user || (*shadow_ent & PT_USER_MASK); writable_shadow = *shadow_ent & PT_SHADOW_WRITABLE_MASK; if (user) { _