kvm_sbi_hsm_vcpu_get_status() returns SBI_ERR_INVALID_PARAM when
the requested hart does not exist. However, the HART_STATUS case
returns from the SBI handler without storing this error in
retdata->err_val.

As a result, a guest querying the status of a non-existent hart
observes SBI_SUCCESS instead of SBI_ERR_INVALID_PARAM.

Use the common SBI error handling path for HART_STATUS after
saving a valid hart state in retdata->out_val. This preserves
the returned error when kvm_sbi_hsm_vcpu_get_status() fails.

Fixes: bae0dfd74e01 ("RISC-V: KVM: Modify SBI extension handler to return SBI error code")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tan Chi <tanchi25@mails.ucas.ac.cn>
---
 arch/riscv/kvm/vcpu_sbi_hsm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/kvm/vcpu_sbi_hsm.c b/arch/riscv/kvm/vcpu_sbi_hsm.c
index f26207f84bab..06a15629c26b 100644
--- a/arch/riscv/kvm/vcpu_sbi_hsm.c
+++ b/arch/riscv/kvm/vcpu_sbi_hsm.c
@@ -95,9 +95,9 @@ static int kvm_sbi_ext_hsm_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
 		ret = kvm_sbi_hsm_vcpu_get_status(vcpu);
 		if (ret >= 0) {
 			retdata->out_val = ret;
-			retdata->err_val = 0;
+			ret = 0;
 		}
-		return 0;
+		break;
 	case SBI_EXT_HSM_HART_SUSPEND:
 		switch (lower_32_bits(cp->a0)) {
 		case SBI_HSM_SUSPEND_RET_DEFAULT:

base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.53.0

On Mon, Sep 14, 2026 at 8:42 AM Tan Chi <tanchi25@mails.ucas.ac.cn> wrote:
>
> kvm_sbi_hsm_vcpu_get_status() returns SBI_ERR_INVALID_PARAM when
> the requested hart does not exist. However, the HART_STATUS case
> returns from the SBI handler without storing this error in
> retdata->err_val.
>
> As a result, a guest querying the status of a non-existent hart
> observes SBI_SUCCESS instead of SBI_ERR_INVALID_PARAM.
>
> Use the common SBI error handling path for HART_STATUS after
> saving a valid hart state in retdata->out_val. This preserves
> the returned error when kvm_sbi_hsm_vcpu_get_status() fails.
>
> Fixes: bae0dfd74e01 ("RISC-V: KVM: Modify SBI extension handler to return SBI error code")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Tan Chi <tanchi25@mails.ucas.ac.cn>

Good catch.

Reviewed-by: Anup Patel <anup@brainfault.org>

Queued this patch as fix for Linux-7.3-rcX

Thanks,
Anup

> ---
>  arch/riscv/kvm/vcpu_sbi_hsm.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/riscv/kvm/vcpu_sbi_hsm.c b/arch/riscv/kvm/vcpu_sbi_hsm.c
> index f26207f84bab..06a15629c26b 100644
> --- a/arch/riscv/kvm/vcpu_sbi_hsm.c
> +++ b/arch/riscv/kvm/vcpu_sbi_hsm.c
> @@ -95,9 +95,9 @@ static int kvm_sbi_ext_hsm_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
>                 ret = kvm_sbi_hsm_vcpu_get_status(vcpu);
>                 if (ret >= 0) {
>                         retdata->out_val = ret;
> -                       retdata->err_val = 0;
> +                       ret = 0;
>                 }
> -               return 0;
> +               break;
>         case SBI_EXT_HSM_HART_SUSPEND:
>                 switch (lower_32_bits(cp->a0)) {
>                 case SBI_HSM_SUSPEND_RET_DEFAULT:
>
> base-commit: df2908090cda368b01ff43709f51890076c56157
> --
> 2.53.0
>