* - mmap_lock protects between a VM faulting a page in and the VMM performing
  *   an mprotect() to add VM_MTE
  */
-static int sanitise_mte_tags(struct kvm *kvm, kvm_pfn_t pfn,
-                            unsigned long size)
+static void sanitise_mte_tags(struct kvm *kvm, kvm_pfn_t pfn,
+                             unsigned long size)
 {
        unsigned long i, nr_pages = size >> PAGE_SHIFT;
-       struct page *page;
+       struct page *page = pfn_to_page(pfn);
 
        if (!kvm_has_mte(kvm))
-               return 0;
-
-       /*
-        * pfn_to_online_page() is used to reject ZONE_DEVICE pages
-        * that may not support tags.
-        */
-       page = pfn_to_online_page(pfn);
-
-       if (!page)
-               return -EFAULT;
+               return;
 
        for (i = 0; i < nr_pages; i++, page++) {
                if (!page_mte_tagged(page)) {
                        set_page_mte_tagged(page);
                }
        }
-
-       return 0;
 }
 
 static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
        bool write_fault, writable, force_pte = false;
        bool exec_fault;
        bool device = false;
-       bool shared;
        unsigned long mmu_seq;
        struct kvm *kvm = vcpu->kvm;
        struct kvm_mmu_memory_cache *memcache = &vcpu->arch.mmu_page_cache;
                vma_shift = get_vma_page_shift(vma, hva);
        }
 
-       shared = (vma->vm_flags & VM_SHARED);
-
        switch (vma_shift) {
 #ifndef __PAGETABLE_PMD_FOLDED
        case PUD_SHIFT:
 
        if (fault_status != FSC_PERM && !device && kvm_has_mte(kvm)) {
                /* Check the VMM hasn't introduced a new VM_SHARED VMA */
-               if (!shared)
-                       ret = sanitise_mte_tags(kvm, pfn, vma_pagesize);
-               else
+               if ((vma->vm_flags & VM_MTE_ALLOWED) &&
+                   !(vma->vm_flags & VM_SHARED)) {
+                       sanitise_mte_tags(kvm, pfn, vma_pagesize);
+               } else {
                        ret = -EFAULT;
-               if (ret)
                        goto out_unlock;
+               }
        }
 
        if (writable)
 bool kvm_set_spte_gfn(struct kvm *kvm, struct kvm_gfn_range *range)
 {
        kvm_pfn_t pfn = pte_pfn(range->pte);
-       int ret;
 
        if (!kvm->arch.mmu.pgt)
                return false;
 
        WARN_ON(range->end - range->start != 1);
 
-       ret = sanitise_mte_tags(kvm, pfn, PAGE_SIZE);
-       if (ret)
+       /*
+        * If the page isn't tagged, defer to user_mem_abort() for sanitising
+        * the MTE tags. The S2 pte should have been unmapped by
+        * mmu_notifier_invalidate_range_end().
+        */
+       if (kvm_has_mte(kvm) && !page_mte_tagged(pfn_to_page(pfn)))
                return false;
 
        /*