1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
From 9358a7fad7f0427e7d1666da0c78cef341ee9072 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Tue, 24 Sep 2024 14:27:03 +0200
Subject: [PATCH 15/35] x86/vLAPIC: prevent undue recursion of vlapic_error()
With the error vector set to an illegal value, the function invoking
vlapic_set_irq() would bring execution back here, with the non-recursive
lock already held. Avoid the call in this case, merely further updating
ESR (if necessary).
This is XSA-462 / CVE-2024-45817.
Fixes: 5f32d186a8b1 ("x86/vlapic: don't silently accept bad vectors")
Reported-by: Federico Serafini <federico.serafini@bugseng.com>
Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
master commit: c42d9ec61f6d11e25fa77bd44dd11dad1edda268
master date: 2024-09-24 14:23:29 +0200
---
xen/arch/x86/hvm/vlapic.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c
index 9cfc82666a..46ff758904 100644
--- a/xen/arch/x86/hvm/vlapic.c
+++ b/xen/arch/x86/hvm/vlapic.c
@@ -112,9 +112,24 @@ static void vlapic_error(struct vlapic *vlapic, unsigned int errmask)
if ( (esr & errmask) != errmask )
{
uint32_t lvterr = vlapic_get_reg(vlapic, APIC_LVTERR);
+ bool inj = false;
- vlapic_set_reg(vlapic, APIC_ESR, esr | errmask);
if ( !(lvterr & APIC_LVT_MASKED) )
+ {
+ /*
+ * If LVTERR is unmasked and has an illegal vector, vlapic_set_irq()
+ * will end up back here. Break the cycle by only injecting LVTERR
+ * if it will succeed, and folding in RECVILL otherwise.
+ */
+ if ( (lvterr & APIC_VECTOR_MASK) >= 16 )
+ inj = true;
+ else
+ errmask |= APIC_ESR_RECVILL;
+ }
+
+ vlapic_set_reg(vlapic, APIC_ESR, esr | errmask);
+
+ if ( inj )
vlapic_set_irq(vlapic, lvterr & APIC_VECTOR_MASK, 0);
}
spin_unlock_irqrestore(&vlapic->esr_lock, flags);
--
2.46.1
|
GitWeb
