Merge branch 'kvm-6.10-fixes' into HEAD

diff --cc arch/x86/kvm/mmu/mmu.c
Simple merge

diff --cc arch/x86/kvm/x86.c
Simple merge

diff --cc virt/kvm/guest_memfd.c
index 3bfe1824ec2d8616eed596c124dd43508a894b7a,747fe251e445bbe30034603632ae501909180a02..9148b9679bb12d648207eb22c3208c83f8e935d7
--- 1/virt/kvm/guest_memfd.c
--- 2/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@@ -542,33 -482,38 +542,34 @@@ void kvm_gmem_unbind(struct kvm_memory_
        fput(file);
  }
  
 -int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot,
 -                   gfn_t gfn, kvm_pfn_t *pfn, int *max_order)
 +static int __kvm_gmem_get_pfn(struct file *file, struct kvm_memory_slot *slot,
 +                     gfn_t gfn, kvm_pfn_t *pfn, int *max_order, bool prepare)
  {
        pgoff_t index = gfn - slot->base_gfn + slot->gmem.pgoff;
 -      struct kvm_gmem *gmem;
 +      struct kvm_gmem *gmem = file->private_data;
        struct folio *folio;
        struct page *page;
 -      struct file *file;
        int r;
  
 -      file = kvm_gmem_get_file(slot);
 -      if (!file)
 +      if (file != slot->gmem.file) {
 +              WARN_ON_ONCE(slot->gmem.file);
                return -EFAULT;
 +      }
  
        gmem = file->private_data;
 -
 -      if (WARN_ON_ONCE(xa_load(&gmem->bindings, index) != slot)) {
 -              r = -EIO;
 -              goto out_fput;
 +      if (xa_load(&gmem->bindings, index) != slot) {
 +              WARN_ON_ONCE(xa_load(&gmem->bindings, index));
 +              return -EIO;
        }
  
 -      folio = kvm_gmem_get_folio(file_inode(file), index);
 -      if (!folio) {
 -              r = -ENOMEM;
 -              goto out_fput;
 -      }
 +      folio = kvm_gmem_get_folio(file_inode(file), index, prepare);
 +      if (IS_ERR(folio))
 +              return PTR_ERR(folio);
  
        if (folio_test_hwpoison(folio)) {
-               r = -EHWPOISON;
-               goto out_unlock;
+               folio_unlock(folio);
+               folio_put(folio);
 -              r = -EHWPOISON;
 -              goto out_fput;
++              return -EHWPOISON;
        }
  
        page = folio_file_page(folio, index);
@@@ -579,8 -524,9 +580,7 @@@
  
        r = 0;
  
- out_unlock:
        folio_unlock(folio);
 -out_fput:
 -      fput(file);
  
        return r;
  }