]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
KVM: selftests: Fix sign extension bug in get_desc64_base()
authorMJ Pooladkhay <mj@pooladkhay.com>
Mon, 22 Dec 2025 17:42:07 +0000 (17:42 +0000)
committerSean Christopherson <seanjc@google.com>
Thu, 8 Jan 2026 20:00:56 +0000 (12:00 -0800)
commit7fe9f5366bd5d7ee3cfd9f66868a4410d6e4792d
treef89bde66a18d6e0e5f59e69b2ca54592a35f87f9
parent0b28194c4c8e3a6c2552bfa6451f71b1879dd61f
KVM: selftests: Fix sign extension bug in get_desc64_base()

The function get_desc64_base() performs a series of bitwise left shifts on
fields of various sizes. More specifically, when performing '<< 24' on
'desc->base2' (which is a u8), 'base2' is promoted to a signed integer
before shifting.

In a scenario where base2 >= 0x80, the shift places a 1 into bit 31,
causing the 32-bit intermediate value to become negative. When this
result is cast to uint64_t or ORed into the return value, sign extension
occurs, corrupting the upper 32 bits of the address (base3).

Example:
Given:
  base0 = 0x5000
  base1 = 0xd6
  base2 = 0xf8
  base3 = 0xfffffe7c

Expected return: 0xfffffe7cf8d65000
Actual return:   0xfffffffff8d65000

Fix this by explicitly casting the fields to 'uint64_t' before shifting
to prevent sign extension.

Signed-off-by: MJ Pooladkhay <mj@pooladkhay.com>
Link: https://patch.msgid.link/20251222174207.107331-1-mj@pooladkhay.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
tools/testing/selftests/kvm/include/x86/processor.h