[PATCH 1/2] KVM: nVMX: Don't clobber VM-Entry instruction length when saving soft INTn
From: ma . mandourr
Date: Wed Oct 21 2026 - 00:27:21 EST
From: Mahmoud Abumandour <ma.mandourr@xxxxxxxxx>
When a VM-Exit from L2 occurs while vectoring a software interrupt, write
the instruction length to vmcs12's VM-Exit instruction length field, as is
done for software exceptions, not to the VM-Entry instruction length field,
which belongs to L1.
Found with a differential testing harness for VMX isolation.
Fixes: 5f3d5799974b ("KVM: nVMX: Rework event injection and recovery")
Signed-off-by: Mahmoud Abumandour <ma.mandourr@xxxxxxxxx>
---
arch/x86/kvm/vmx/nested.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 9b0bfa2f854c..302f5b5aa582 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -4016,7 +4016,7 @@ static void vmcs12_save_pending_event(struct kvm_vcpu *vcpu,
if (vcpu->arch.interrupt.soft) {
idt_vectoring |= INTR_TYPE_SOFT_INTR;
- vmcs12->vm_entry_instruction_len =
+ vmcs12->vm_exit_instruction_len =
vcpu->arch.event_exit_inst_len;
} else
idt_vectoring |= INTR_TYPE_EXT_INTR;
--
2.43.0