[xen stable-4.17] x86/vLAPIC: prevent undue recursion of vlapic_error()

[patchbot@xxxxxxx]

commit 3ef9196234bd3b0da239db8f10467d9fff257377
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Sep 24 15:07:47 2024 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Sep 24 15:07:47 2024 +0200

    x86/vLAPIC: prevent undue recursion of vlapic_error()
    
    With the error vector set to an illegal value, the function invoking
    vlapic_set_irq() would bring execution back here, with the non-recursive
    lock already held. Avoid the call in this case, merely further updating
    ESR (if necessary).
    
    This is XSA-462 / CVE-2024-45817.
    
    Fixes: 5f32d186a8b1 ("x86/vlapic: don't silently accept bad vectors")
    Reported-by: Federico Serafini <federico.serafini@xxxxxxxxxxx>
    Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: c42d9ec61f6d11e25fa77bd44dd11dad1edda268
    master date: 2024-09-24 14:23:29 +0200
---
 xen/arch/x86/hvm/vlapic.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c
index c10d313215..3c094903a1 100644
--- a/xen/arch/x86/hvm/vlapic.c
+++ b/xen/arch/x86/hvm/vlapic.c
@@ -124,9 +124,24 @@ static void vlapic_error(struct vlapic *vlapic, unsigned 
int errmask)
     if ( (esr & errmask) != errmask )
     {
         uint32_t lvterr = vlapic_get_reg(vlapic, APIC_LVTERR);
+        bool inj = false;
 
-        vlapic_set_reg(vlapic, APIC_ESR, esr | errmask);
         if ( !(lvterr & APIC_LVT_MASKED) )
+        {
+            /*
+             * If LVTERR is unmasked and has an illegal vector, 
vlapic_set_irq()
+             * will end up back here.  Break the cycle by only injecting LVTERR
+             * if it will succeed, and folding in RECVILL otherwise.
+             */
+            if ( (lvterr & APIC_VECTOR_MASK) >= 16 )
+                 inj = true;
+            else
+                 errmask |= APIC_ESR_RECVILL;
+        }
+
+        vlapic_set_reg(vlapic, APIC_ESR, esr | errmask);
+
+        if ( inj )
             vlapic_set_irq(vlapic, lvterr & APIC_VECTOR_MASK, 0);
     }
     spin_unlock_irqrestore(&vlapic->esr_lock, flags);
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.17