From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF28B3C062A for ; Tue, 28 Apr 2026 16:05:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777392309; cv=none; b=mPgAUGP3OMFMzjpSxCEYoSY5dzl1Ct0nTO01vRhmXkx63Rb7fWReeucA4rX8bKx9WUIBTLeKIy6YNN+19bI9oS29kWo/V2madKK1hAMqohk/Qz7Z6m8Xn6toUBBRcXCQaWB40NTP1nNF4/WZgw3wQusP85vx1obnUf1tkjeNCQA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777392309; c=relaxed/simple; bh=SbOs7Pkhgd9egpCE2IWmvGc4Q39vGYUtUeeG+ZiOk3w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gjPUSqvWcn4zbF5V9wwP4F1DjrqZpI0e6JhKdJvOn9c6RITMRHiuT7rREG+Ij4yHyyANqg2uM6s2S1yOqJLIAj4891eqm/4o6n2RM8OhW5CXSI5p1frWV8+NQXdkjLesGJUUmUcdr6QKSZXtvrnmVLJDELPCEmrc+qXG6FmABJM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=I1F3sE0i; arc=none smtp.client-ip=209.85.221.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="I1F3sE0i" Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-43d7badbd7dso5738937f8f.2 for ; Tue, 28 Apr 2026 09:05:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777392306; x=1777997106; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=FKQ7yTZfnfEOa1drBQiiSAEVFXpVlmgYSqIexWhsfkI=; b=I1F3sE0i0OZnYCddC1BbHVwDUnPJ+1BCRdYZA60rK+3eJsC25Z1ss2sXNwO92NAygJ Ycx72M672prrw43+KHXq5NHzEnvrJJU42zRonNHIuKY4M0FJcjgE4dmFJX3rhtmxnEeT BCtL8ri6qX0YBeBBHq9vQk2Kk5gQ2WWk9z1dlVl8tTpYda5RkRCgAF9nzpcz3kaF1S+8 BahqcW0kwZtsncYCufZwelneHwiXvvuU10rrjHo0vCsBDO0oSi+B44UiwzBPTII8zv37 jD2a5c8MHa3PS5jBpGZXEGDtSQeJ+HfhgD0mPV/oAbmbdYS2HgHfgwOEdxb2ZKBAfcIj x03A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777392306; x=1777997106; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=FKQ7yTZfnfEOa1drBQiiSAEVFXpVlmgYSqIexWhsfkI=; b=Lk44cVKm35F6mZqTfmzmgaYdNTaqahPd6yo4lhmNaVJsnJQKPYSkJ6dtrHWz2AooS3 8wtgiBc2KPZeZgwePekINH22cYT6cm+2gsdF8mj+gTPR3zgkkbE/UYqCYUV2rWd3tzid yA1qFrFeaIWtO95Xzq5mxSJKUwBsRspo56KPpr3Seya5NPoNziW4BqLOK6boQg8QQous L8lqF6n6SQCjrhLBGlYDQaTMSYVKA6jdidUv0EE0mYVxmT/xr1SOQl78Yf5digYuJ268 s4nwRomO6Lenk1V8iasG/khs2KFu7JfwDHhYejy0wsObXbJRMlNrWHHNaBrOV41NYVAr Gd8A== X-Forwarded-Encrypted: i=1; AFNElJ/GwwST2EFlhgmKeOTIKKZWh2hNchRpglhKAvVL+zvGjO4UKKLU1jWMTTdnJWwjYUDBeHS1YMbu6k5hhRg=@vger.kernel.org X-Gm-Message-State: AOJu0YwGFlQlQUxBWRmWmruG0EKaia1/0cyVtXdi+cHwmO7U5vtijP3d 1NJrSP+V6KGXMA3f9hX9BU0wDxMkxf3eONUQUywassa3fraRo18px7ES X-Gm-Gg: AeBDiesLKna307fOzQvfHUVXdCYKvxN4DXgsbo2IbkOjb4Asqtpo2aZhKQjh4KA2MJy TtShTBdjjg3AcFeMFmRjCazrWcggcEp8OB5kA0tN3NRz4npkwlq7fksRgDKhEln3NYsamKY7kO4 f2iFam2outlYPoJe/zW/fKZFkY696hzkZG0G+ZYd3uyqljlpePG1WpFOA5SV8xt6zNVLZ9/JruN BunVBIp89bH4+yehryySkWOBLro3rEUDH0p5LOrUbd36DwjyEl4EFKBR9c/fZFunR3Mxt3dG0SQ FWYQPXAYODuLP1d86+Y/hMi+g9+rT6ATPhL14uYzvSrcmRraqlBY17myaMvFOZBMdG5LoJGs+FZ qzoJ7L4ST4ABZR/ZB+uyAqfaD+WwGV+z+UbeI7Jge688D4EUQtgA768m/+QQctrrsVnz+lm9iZ+ nhivUVe9Pf0RCcE/5p1o8a7tJqj8V+PN6jJdVzaU/OxtypxUN9AyHQuKClNpm6YXUzkSoeA/JUy uSqze4+E4ab5durGXi16uXOF9mbmKBUKBcjdWrmZ1C8UJ6rEJlc2bc= X-Received: by 2002:a05:6000:40e0:b0:43f:e42d:b66 with SMTP id ffacd0b85a97d-44648681dd3mr6945562f8f.3.1777392306080; Tue, 28 Apr 2026 09:05:06 -0700 (PDT) Received: from fedora ([46.248.82.114]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4464004edc8sm7532923f8f.37.2026.04.28.09.05.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Apr 2026 09:05:05 -0700 (PDT) From: Uros Bizjak To: x86@kernel.org, linux-kernel@vger.kernel.org Cc: Uros Bizjak , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" Subject: [PATCH RESEND -tip v2 2/7] x86/insn-eval: Fix signedness bug in segment selector handling Date: Tue, 28 Apr 2026 18:03:36 +0200 Message-ID: <20260428160443.3593331-2-ubizjak@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260428160443.3593331-1-ubizjak@gmail.com> References: <20260428160443.3593331-1-ubizjak@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit get_segment_selector() returns a short, while callers use the pattern: short sel = get_segment_selector(...); if (sel < 0) return -ERR; Segment selectors are 16-bit values, but storing them in a signed 16-bit type means values with the MSB set (>= 0x8000) become negative. This causes valid selectors to be misinterpreted as errors by the 'sel < 0' check. Change get_segment_selector() to return int and update all call sites to use 'int sel' to avoid unintended sign extension and keep error handling via negative return values correct. Additionally, remove the explicit & 0xffff masking when reading segment registers. The compiler already zero-extends unsigned 16-bit values when loading them into a wider type, so the masking is redundant. With this change, valid segment selectors are no longer confused with error returns. Signed-off-by: Uros Bizjak Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" --- arch/x86/lib/insn-eval.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c index e03eeec55cfe..b8847ce0b282 100644 --- a/arch/x86/lib/insn-eval.c +++ b/arch/x86/lib/insn-eval.c @@ -340,18 +340,18 @@ static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff) * * -EINVAL on error. */ -static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx) +static int get_segment_selector(struct pt_regs *regs, int seg_reg_idx) { - unsigned short sel; + unsigned int sel; #ifdef CONFIG_X86_64 switch (seg_reg_idx) { case INAT_SEG_REG_IGNORE: return 0; case INAT_SEG_REG_CS: - return (unsigned short)(regs->cs & 0xffff); + return regs->cs; case INAT_SEG_REG_SS: - return (unsigned short)(regs->ss & 0xffff); + return regs->ss; case INAT_SEG_REG_DS: savesegment(ds, sel); return sel; @@ -373,9 +373,9 @@ static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx) if (v8086_mode(regs)) { switch (seg_reg_idx) { case INAT_SEG_REG_CS: - return (unsigned short)(regs->cs & 0xffff); + return regs->cs; case INAT_SEG_REG_SS: - return (unsigned short)(regs->ss & 0xffff); + return regs->ss; case INAT_SEG_REG_DS: return vm86regs->ds; case INAT_SEG_REG_ES: @@ -392,15 +392,15 @@ static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx) switch (seg_reg_idx) { case INAT_SEG_REG_CS: - return (unsigned short)(regs->cs & 0xffff); + return regs->cs; case INAT_SEG_REG_SS: - return (unsigned short)(regs->ss & 0xffff); + return regs->ss; case INAT_SEG_REG_DS: - return (unsigned short)(regs->ds & 0xffff); + return regs->ds; case INAT_SEG_REG_ES: - return (unsigned short)(regs->es & 0xffff); + return regs->es; case INAT_SEG_REG_FS: - return (unsigned short)(regs->fs & 0xffff); + return regs->fs; case INAT_SEG_REG_GS: savesegment(gs, sel); return sel; @@ -688,7 +688,7 @@ static bool get_desc(struct desc_struct *out, unsigned short sel) unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx) { struct desc_struct desc; - short sel; + int sel; sel = get_segment_selector(regs, seg_reg_idx); if (sel < 0) @@ -756,7 +756,7 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx) { struct desc_struct desc; unsigned long limit; - short sel; + int sel; sel = get_segment_selector(regs, seg_reg_idx); if (sel < 0) @@ -803,7 +803,7 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx) int insn_get_code_seg_params(struct pt_regs *regs) { struct desc_struct desc; - short sel; + int sel; if (v8086_mode(regs)) /* Address and operand size are both 16-bit. */ -- 2.53.0