Ouch. I see now, thanks for explaining.
One way to fix it is to make kvm_mmu_zap_page() only zap the page it is
given, and use sp->role.invalid on its children. But it's better to fix
it now quickly and do the more involved fixes later.
Just change the assignment to a 'goto restart;' please, I don't like
playing with list_for_each internals.
--
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.
--