From: Yosry Ahmed Date: Wed, 27 May 2026 23:46:56 +0000 (+0000) Subject: KVM: nSVM: Bail early out of VMRUN emulation if advancing RIP fails X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=42ff88db18a5a42f619eab1d862e04e6505e8ee6;p=thirdparty%2Flinux.git KVM: nSVM: Bail early out of VMRUN emulation if advancing RIP fails If svm_skip_emulation_instruction() fails, then RIP could not be advanced correctly (e.g. decode failure when NextRIP is not available). KVM will exit to userspace to handle the emulation failure, but only after stuffing the wrong RIP into vmcb01 and entering guest mode. Bail early and exit to userspace before committing any side-effects of emulating the VMRUN (e.g. entering guest mode). Fixes: c8e16b78c614 ("x86: KVM: svm: eliminate hardcoded RIP advancement from vmrun_interception()") Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260527234711.4175166-3-yosry@kernel.org Signed-off-by: Sean Christopherson --- diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index a7ed06d88697..6e26c8e1b771 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1154,9 +1154,10 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) * FIXME: If TF is set on VMRUN should inject a #DB (or handle guest * debugging) right after #VMEXIT, right now it's just ignored. */ - ret = svm_skip_emulated_instruction(vcpu); - if (ret) - kvm_pmu_instruction_retired(vcpu); + if (!svm_skip_emulated_instruction(vcpu)) + return 0; + + kvm_pmu_instruction_retired(vcpu); /* * Since vmcb01 is not in use, we can use it to store some of the L1 @@ -1186,7 +1187,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) nested_svm_vmexit(svm); } - return ret; + return 1; } /* Copy state save area fields which are handled by VMRUN */