[xen stable-4.18] hypercall_xlat_continuation: Replace BUG_ON with domain_crash

[patchbot@xxxxxxx]

commit 1166467ed300d605529aaf7a7d26c8c92defe36a
Author:     Bjoern Doebel <doebel@xxxxxxxxx>
AuthorDate: Wed Mar 27 17:31:38 2024 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Fri Apr 5 15:44:49 2024 +0100

    hypercall_xlat_continuation: Replace BUG_ON with domain_crash
    
    Instead of crashing the host in case of unexpected hypercall parameters,
    resort to only crashing the calling domain.
    
    This is part of XSA-454 / CVE-2023-46842.
    
    Fixes: b8a7efe8528a ("Enable compatibility mode operation for 
HYPERVISOR_memory_op")
    Reported-by: Manuel Andreas <manuel.andreas@xxxxxx>
    Signed-off-by: Bjoern Doebel <doebel@xxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    (cherry picked from commit 9926e692c4afc40bcd66f8416ff6a1e93ce402f6)
---
 xen/arch/x86/hypercall.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/xen/arch/x86/hypercall.c b/xen/arch/x86/hypercall.c
index 01cd73040d..04b5e9874c 100644
--- a/xen/arch/x86/hypercall.c
+++ b/xen/arch/x86/hypercall.c
@@ -140,8 +140,10 @@ int hypercall_xlat_continuation(unsigned int *id, unsigned 
int nr,
                 cval = va_arg(args, unsigned int);
                 if ( cval == nval )
                     mask &= ~1U;
-                else
-                    BUG_ON(nval == (unsigned int)nval);
+                else if ( nval == (unsigned int)nval )
+                    domain_crash(current->domain,
+                                 "multicall (op %lu) bogus continuation arg%u 
(%#lx)\n",
+                                 mcs->call.op, i, nval);
             }
             else if ( id && *id == i )
             {
@@ -153,8 +155,10 @@ int hypercall_xlat_continuation(unsigned int *id, unsigned 
int nr,
                 mcs->call.args[i] = cval;
                 ++rc;
             }
-            else
-                BUG_ON(mcs->call.args[i] != (unsigned int)mcs->call.args[i]);
+            else if ( mcs->call.args[i] != (unsigned int)mcs->call.args[i] )
+                domain_crash(current->domain,
+                             "multicall (op %lu) bad continuation arg%u 
(%#lx)\n",
+                             mcs->call.op, i, mcs->call.args[i]);
         }
     }
     else
@@ -180,8 +184,10 @@ int hypercall_xlat_continuation(unsigned int *id, unsigned 
int nr,
                 cval = va_arg(args, unsigned int);
                 if ( cval == nval )
                     mask &= ~1U;
-                else
-                    BUG_ON(nval == (unsigned int)nval);
+                else if ( nval == (unsigned int)nval )
+                    domain_crash(current->domain,
+                                 "hypercall (op %u) bogus continuation arg%u 
(%#lx)\n",
+                                 regs->eax, i, nval);
             }
             else if ( id && *id == i )
             {
@@ -193,8 +199,10 @@ int hypercall_xlat_continuation(unsigned int *id, unsigned 
int nr,
                 *reg = cval;
                 ++rc;
             }
-            else
-                BUG_ON(*reg != (unsigned int)*reg);
+            else if ( *reg != (unsigned int)*reg )
+                domain_crash(current->domain,
+                             "hypercall (op %u) bad continuation arg%u 
(%#lx)\n",
+                             regs->eax, i, *reg);
         }
     }
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.18