From: Jan Beulich Date: Tue, 24 Sep 2024 13:09:45 +0000 (+0200) Subject: x86/vLAPIC: prevent undue recursion of vlapic_error() X-Git-Tag: RELEASE-4.16.7~17 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=1765a3e0d178e9faf16cb3e19dd39cf22f29eae3;p=xen.git x86/vLAPIC: prevent undue recursion of vlapic_error() With the error vector set to an illegal value, the function invoking vlapic_set_irq() would bring execution back here, with the non-recursive lock already held. Avoid the call in this case, merely further updating ESR (if necessary). This is XSA-462 / CVE-2024-45817. Fixes: 5f32d186a8b1 ("x86/vlapic: don't silently accept bad vectors") Reported-by: Federico Serafini Reported-by: Andrew Cooper Signed-off-by: Jan Beulich Signed-off-by: Andrew Cooper Reviewed-by: Andrew Cooper master commit: c42d9ec61f6d11e25fa77bd44dd11dad1edda268 master date: 2024-09-24 14:23:29 +0200 --- diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c index 3d25aaff55..3e4a2726d4 100644 --- a/xen/arch/x86/hvm/vlapic.c +++ b/xen/arch/x86/hvm/vlapic.c @@ -124,9 +124,24 @@ static void vlapic_error(struct vlapic *vlapic, unsigned int errmask) if ( (esr & errmask) != errmask ) { uint32_t lvterr = vlapic_get_reg(vlapic, APIC_LVTERR); + bool inj = false; - vlapic_set_reg(vlapic, APIC_ESR, esr | errmask); if ( !(lvterr & APIC_LVT_MASKED) ) + { + /* + * If LVTERR is unmasked and has an illegal vector, vlapic_set_irq() + * will end up back here. Break the cycle by only injecting LVTERR + * if it will succeed, and folding in RECVILL otherwise. + */ + if ( (lvterr & APIC_VECTOR_MASK) >= 16 ) + inj = true; + else + errmask |= APIC_ESR_RECVILL; + } + + vlapic_set_reg(vlapic, APIC_ESR, esr | errmask); + + if ( inj ) vlapic_set_irq(vlapic, lvterr & APIC_VECTOR_MASK, 0); } spin_unlock_irqrestore(&vlapic->esr_lock, flags);