[PATCH v3 1/2] KVM: x86: Fix sign-extension of the INT n vector in the emulator

Kayra Cizmeci <[email protected]> Sun, 2 Aug 2026 16:44:27 +0300
Newsgroups org.kernel.vger.kvm,org.kernel.vger.linux-kernel
Message-ID <[email protected]>
Currently the INT n operand use SrcImmByte which translates vectors
above 127 to negative numbers. And this negative numbers gets to
(vector << 2) and from there vector are handed and without any
warnings.

Use SrcImmUByte so the vector never translates to negative.

Signed-off-by: Kayra Cizmeci <[email protected]>
---
v1: adds IDT limit check to __emulate_int_real(), link:
https://lore.kernel.org/kvm/[email protected]/
v2: fixes the sign-extension of INT n, link:
https://lore.kernel.org/kvm/[email protected]/
v3: rewrote commit messages, split 1 commit into 2 commits and rebased
onto current mainline.

 arch/x86/kvm/emulate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index b566ab5c7515..ec3138801bb7 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4314,7 +4314,7 @@ static const struct opcode opcode_table[256] = {
 	I(Stack, em_leave),
 	I(ImplicitOps | SrcImmU16 | IsBranch | ShadowStack, em_ret_far_imm),
 	I(ImplicitOps | IsBranch | ShadowStack, em_ret_far),
-	D(ImplicitOps | IsBranch), DI(SrcImmByte | IsBranch | ShadowStack, intn),
+	D(ImplicitOps | IsBranch), DI(SrcImmUByte | IsBranch | ShadowStack, intn),
 	D(ImplicitOps | No64 | IsBranch),
 	II(ImplicitOps | IsBranch | ShadowStack, em_iret, iret),
 	/* 0xD0 - 0xD7 */
-- 
2.53.0