In the Linux kernel, the following vulnerability has been resolved:

xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32

The sched_clock() can be used very early since commit 857baa87b642
("sched/clock: Enable sched clock early"). In addition, with commit
38669ba205d1 ("x86/xen/time: Output xen sched_clock time from 0"), kdump
kernel in Xen HVM guest may panic at very early stage when accessing
&__this_cpu_read(xen_vcpu)->time as in below:

setup_arch()
 -> init_hypervisor_platform()
     -> x86_init.hyper.init_platform = xen_hvm_guest_init()
         -> xen_hvm_init_time_ops()
             -> xen_clocksource_read()
                 -> src = &__this_cpu_read(xen_vcpu)->time;

This is because Xen HVM supports at most MAX_VIRT_CPUS=32 'vcpu_info'
embedded inside 'shared_info' during early stage until xen_vcpu_setup() is
used to allocate/relocate 'vcpu_info' for boot cpu at arbitrary address.

However, when Xen HVM guest panic on vcpu >= 32, since
xen_vcpu_info_reset(0) would set per_cpu(xen_vcpu, cpu) = NULL when
vcpu >= 32, xen_clocksource_read() on vcpu >= 32 would panic.

This patch calls xen_hvm_init_time_ops() again later in
xen_hvm_smp_prepare_boot_cpu() after the 'vcpu_info' for boot vcpu is
registered when the boot vcpu is >= 32.

This issue can be reproduced on purpose via below command at the guest
side when kdump/kexec is enabled:

"taskset -c 33 echo c > /proc/sysrq-trigger"

The bugfix for PVM is not implemented due to the lack of testing
environment.

[boris: xen_hvm_init_time_ops() returns on errors instead of jumping to end]

https://git.kernel.org/stable/c/0848767dee78c00c5646eef9b3201ee14ce68563

https://git.kernel.org/stable/c/5c0750cad73350e1c504eb91a94093a79f6f6296

https://git.kernel.org/stable/c/8a7462b5211cd5b74b8815034d038e28cbd96d52

https://git.kernel.org/stable/c/a2a0e04f6478e8c1038db64717f3fafd55de1420

https://git.kernel.org/stable/c/b6f6b353d6c765b83c9e5e518a44ca1ae40fe227

https://git.kernel.org/stable/c/be63f365f454e39d09c41bbd21ea72b5244160b5

https://git.kernel.org/stable/c/eed05744322da07dd7e419432dcedf3c2e017179