In svm_set_nested_state(), the value of RIP from vmcb02 is passed into
nested_vmcb02_prepare_control(). However, even if RIP is restored with
KVM_SET_REGS prior to KVM_SET_NESTED_STATE, its value is not reflected
into the VMCB until the vCPU is run.

Use the value from KVM's cache instead, which is what KVM_SET_REGS
updates. Not that the passed RIP is still incorrect if KVM_SET_REGS is
not called prior to KVM_SET_NESTED_STATE, this will be fixed separately.

Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE")
CC: stable@vger.kernel.org
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
---
 arch/x86/kvm/svm/nested.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index eebbe00714e3..aec17c80ed73 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1911,7 +1911,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
 	nested_copy_vmcb_control_to_cache(svm, ctl);
 
 	svm_switch_vmcb(svm, &svm->nested.vmcb02);
-	nested_vmcb02_prepare_control(svm, svm->vmcb->save.rip, svm->vmcb->save.cs.base);
+	nested_vmcb02_prepare_control(svm, kvm_rip_read(vcpu), svm->vmcb->save.cs.base);
 
 	/*
 	 * While the nested guest CR3 is already checked and set by
-- 
2.53.0.273.g2a3d683680-goog