[xen staging-4.19] x86/vrtc: fix race in CMOS index checking

[patchbot@xxxxxxx]

commit ffe6e364c79e36615bc891acc1940057efff386b
Author:     Roger Pau Monne <roger.pau@xxxxxxxxxx>
AuthorDate: Fri Jul 10 15:05:50 2026 +0200
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:08:52 2026 +0100

    x86/vrtc: fix race in CMOS index checking
    
    Do the checking for a valid CMOS index while holding the spinlock,
    otherwise the value could be changed by the guest after having been
    checked.
    
    This is XSA-503 / CVE-2026-62430.
    
    Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.")
    Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    (cherry picked from commit 52350da92619a77472ebb87f20f6a1fea49eebfd)
---
 xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c
index e33a8ec108..79ca3281e0 100644
--- a/xen/arch/x86/hvm/rtc.c
+++ b/xen/arch/x86/hvm/rtc.c
@@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s)
     return 0;
 }
 
-static uint32_t rtc_ioport_read(RTCState *s)
+static bool rtc_ioport_read(RTCState *s, uint32_t *val)
 {
     int ret;
     struct domain *d = vrtc_domain(s);
 
+    *val = ~0;
+
     spin_lock(&s->lock);
 
+    if ( s->hw.cmos_index >= RTC_CMOS_SIZE )
+    {
+        spin_unlock(&s->lock);
+        return false;
+    }
+
     switch ( s->hw.cmos_index )
     {
     case RTC_SECONDS:
@@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s)
 
     spin_unlock(&s->lock);
 
-    return ret;
+    *val = ret;
+
+    return true;
 }
 
 static int cf_check handle_rtc_io(
@@ -718,11 +728,8 @@ static int cf_check handle_rtc_io(
         *val = 0xff;
         return X86EMUL_OKAY;
     }
-    else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE )
-    {
-        *val = rtc_ioport_read(vrtc);
+    else if ( rtc_ioport_read(vrtc, val) )
         return X86EMUL_OKAY;
-    }
 
     return X86EMUL_UNHANDLEABLE;
 }
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.19