autogits/xen
SHA256
2
0
Fork 0
forked from SLFO-pool/xen
Code Pull Requests Activity

Sync from SUSE:SLFO:Main xen revision 54ebbe781035741953178d5d7cea2263

Browse Source
This commit is contained in:
Adrian Schröter 2024-10-01 08:54:04 +02:00
parent 038ca437a0
commit 8b440090d6
3 changed files with 54 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
xen.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Tue Sep 10 09:54:34 MDT 2024 - carnold@suse.com
- bsc#1230366 - VUL-0: CVE-2024-45817: xen: x86: Deadlock in
vlapic_error() (XSA-462)
xsa462.patch
-------------------------------------------------------------------
Wed Aug 14 11:33:39 MDT 2024 - carnold@suse.com

3
xen.spec
View File

@ -119,7 +119,7 @@ BuildRequires: pesign-obs-integration
%endif
Provides: installhint(reboot-needed)
Version: 4.18.3_02
Version: 4.18.3_04
Release: 0
Summary: Xen Virtualization: Hypervisor (aka VMM aka Microkernel)
License: GPL-2.0-only
@ -156,6 +156,7 @@ Source99: baselibs.conf
# Upstream patches
Patch1: 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch
# EMBARGOED security fixes
Patch100: xsa462.patch
# libxc
Patch301: libxc-bitmap-long.patch
Patch302: libxc-sr-xl-migration-debug.patch

45
xsa462.patch Normal file
View File

@ -0,0 +1,45 @@
From: Jan Beulich <jbeulich@suse.com>
Subject: x86/vLAPIC: prevent undue recursion of vlapic_error()
With the error vector set to an illegal value, the function invoking
vlapic_set_irq() would bring execution back here, with the non-recursive
lock already held. Avoid the call in this case, merely further updating
ESR (if necessary).
This is XSA-462.
Fixes: 5f32d186a8b1 ("x86/vlapic: don't silently accept bad vectors")
Reported-by: Federico Serafini <federico.serafini@bugseng.com>
Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
--- a/xen/arch/x86/hvm/vlapic.c
+++ b/xen/arch/x86/hvm/vlapic.c
@@ -113,9 +113,24 @@ static void vlapic_error(struct vlapic *
if ( (esr & errmask) != errmask )
{
uint32_t lvterr = vlapic_get_reg(vlapic, APIC_LVTERR);
+ bool inj = false;
- vlapic_set_reg(vlapic, APIC_ESR, esr | errmask);
if ( !(lvterr & APIC_LVT_MASKED) )
+ {
+ /*
+ * If LVTERR is unmasked and has an illegal vector, vlapic_set_irq()
+ * will end up back here. Break the cycle by only injecting LVTERR
+ * if it will succeed, and folding in RECVILL otherwise.
+ */
+ if ( (lvterr & APIC_VECTOR_MASK) >= 16 )
+ inj = true;
+ else
+ errmask |= APIC_ESR_RECVILL;
+ }
+
+ vlapic_set_reg(vlapic, APIC_ESR, esr | errmask);
+
+ if ( inj )
vlapic_set_irq(vlapic, lvterr & APIC_VECTOR_MASK, 0);
}
spin_unlock_irqrestore(&vlapic->esr_lock, flags);