[xen stable-4.19] x86/io-apic: prevent early exit from i8259 loop detection

[patchbot@xxxxxxx]

commit c41c22bf8e9f7ff6c5d4dbe9fcf19a61643543c9
Author:     Roger Pau Monné <roger.pau@xxxxxxxxxx>
AuthorDate: Tue Dec 17 12:46:29 2024 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Dec 17 12:46:29 2024 +0100

    x86/io-apic: prevent early exit from i8259 loop detection
    
    Avoid exiting early from the loop when a pin that could be connected to the
    i8259 is found, as such early exit would leave the EOI handler translation
    array only partially allocated and/or initialized.
    
    Otherwise on systems with multiple IO-APICs and an unmasked ExtINT pin on
    any IO-APIC that's no the last one the following NULL pointer dereference
    triggers:
    
    (XEN) Enabling APIC mode.  Using 2 I/O APICs
    (XEN) ----[ Xen-4.20-unstable  x86_64  debug=y  Not tainted ]----
    (XEN) CPU:    0
    (XEN) RIP:    e008:[<ffff82d040328046>] __ioapic_write_entry+0x83/0x95
    [...]
    (XEN) Xen call trace:
    (XEN)    [<ffff82d040328046>] R __ioapic_write_entry+0x83/0x95
    (XEN)    [<ffff82d04027464b>] F amd_iommu_ioapic_update_ire+0x1ea/0x273
    (XEN)    [<ffff82d0402755a1>] F iommu_update_ire_from_apic+0xa/0xc
    (XEN)    [<ffff82d040328056>] F __ioapic_write_entry+0x93/0x95
    (XEN)    [<ffff82d0403283c1>] F 
arch/x86/io_apic.c#clear_IO_APIC_pin+0x7c/0x10e
    (XEN)    [<ffff82d040328480>] F arch/x86/io_apic.c#clear_IO_APIC+0x2d/0x61
    (XEN)    [<ffff82d0404448b7>] F enable_IO_APIC+0x2e3/0x34f
    (XEN)    [<ffff82d04044c9b0>] F smp_prepare_cpus+0x254/0x27a
    (XEN)    [<ffff82d04044bec2>] F __start_xen+0x1ce1/0x23ae
    (XEN)    [<ffff82d0402033ae>] F __high_start+0x8e/0x90
    (XEN)
    (XEN) Pagetable walk from 0000000000000000:
    (XEN)  L4[0x000] = 000000007dbfd063 ffffffffffffffff
    (XEN)  L3[0x000] = 000000007dbfa063 ffffffffffffffff
    (XEN)  L2[0x000] = 000000007dbcc063 ffffffffffffffff
    (XEN)  L1[0x000] = 0000000000000000 ffffffffffffffff
    (XEN)
    (XEN) ****************************************
    (XEN) Panic on CPU 0:
    (XEN) FATAL PAGE FAULT
    (XEN) [error_code=0002]
    (XEN) Faulting linear address: 0000000000000000
    (XEN) ****************************************
    (XEN)
    (XEN) Reboot in five seconds...
    
    Reported-by: Sergii Dmytruk <sergii.dmytruk@xxxxxxxxx>
    Fixes: 86001b3970fe ('x86/io-apic: fix directed EOI when using AMD-Vi 
interrupt remapping')
    Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: f38fd27c4ceadf7ec4e82e82d0731b6ea415c51e
    master date: 2024-12-17 11:15:30 +0100
---
 xen/arch/x86/io_apic.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/io_apic.c b/xen/arch/x86/io_apic.c
index 1fd9559a06..65b019db02 100644
--- a/xen/arch/x86/io_apic.c
+++ b/xen/arch/x86/io_apic.c
@@ -1372,14 +1372,14 @@ void __init enable_IO_APIC(void)
             /* If the interrupt line is enabled and in ExtInt mode
              * I have found the pin where the i8259 is connected.
              */
-            if ((entry.mask == 0) && (entry.delivery_mode == dest_ExtINT)) {
+            if ( ioapic_i8259.pin == -1 && entry.mask == 0 &&
+                 entry.delivery_mode == dest_ExtINT )
+            {
                 ioapic_i8259.apic = apic;
                 ioapic_i8259.pin  = pin;
-                goto found_i8259;
             }
         }
     }
- found_i8259:
     /* Look to see what if the MP table has reported the ExtINT */
     /* If we could not find the appropriate pin by looking at the ioapic
      * the i8259 probably is not connected the ioapic but give the
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.19