SVM_EVTINJ_VALID is defined as (1 << 31), i.e. as an int with the sign bit set. Whenever it is used in a 64-bit expression the int is sign extended, so bits 63:32 end up set as well. Two 64-bit users are affected. verify_exception_info() uses the macro as a mask against a 64-bit value when it sanity checks hypervisor supplied exception information: u64 info = ghcb->save.sw_exit_info_2; ... if ((info & SVM_EVTINJ_VALID) && The mask is 0xffffffff80000000, so the check also passes when any bit of the error code in 63:32 is set while the valid bit itself is clear. svm_vmgexit_inject_exception() builds the value that KVM hands to an SEV-ES guest in GHCB SW_EXITINFO2: u64 data = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_EXEPT | vector; For vector == X86_TRAP_GP this yields 0xffffffff8000030d instead of 0x000000008000030d. The field uses the EVENTINJ format, which holds the error code in bits 63:32, so KVM asks the guest to inject #GP with an error code of 0xffffffff. Linux guests only consume the error code when SVM_EVTINJ_VALID_ERR is set, which it is not here, so they are not affected in practice, but the value KVM writes is not the one it intends. Use BIT() instead, as is already done for most single bit definitions in this header. Every other user applies the macro to a u32, where the resulting bits are unchanged. Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler") Fixes: c3392d0ab714 ("KVM: SVM: Provide helpers to set the error code") Signed-off-by: Chaithanya Lagisetty --- arch/x86/include/asm/svm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index aa63431ba92c..921e6ecc4835 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -637,7 +637,7 @@ static inline void __unused_size_checks(void) #define SVM_EVTINJ_TYPE_EXEPT (3 << SVM_EVTINJ_TYPE_SHIFT) #define SVM_EVTINJ_TYPE_SOFT (4 << SVM_EVTINJ_TYPE_SHIFT) -#define SVM_EVTINJ_VALID (1 << 31) +#define SVM_EVTINJ_VALID BIT(31) #define SVM_EVTINJ_VALID_ERR (1 << 11) #define SVM_EVTINJ_RESERVED_BITS ~(SVM_EVTINJ_VEC_MASK | SVM_EVTINJ_TYPE_MASK | \ -- 2.43.0