[xen stable-4.21] evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states()

[patchbot@xxxxxxx]

commit d836145598f0ab01e33e7718d6b6ac9a768ab9d4
Author:     Grygorii Strashko <grygorii_strashko@xxxxxxxx>
AuthorDate: Mon Jul 20 16:38:49 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:07:36 2026 +0100

    evtchn: evtchn_bind_virq() error path unconditionally calls 
domain_deinit_states()
    
    There is a corner case in the error path of evtchn_bind_virq() (handling
    EVTCHNOP_bind_virq hypercall) which allows unprivileged domains to
    interfere with privileged ones: If an unprivileged domain allocates all
    available ports to reach "no more ports available" and then issues an
    EVTCHNOP_bind_virq hypercall to bind any allowed VIRQ (e.g. VIRQ_DEBUG),
    domain_deinit_states() will be called despite not having called
    domain_init_states().
    
    To fix the issue move domain_deinit_states(d) under the same condition as
    used for the domain_init_states() call.
    
    This is CVE-2026-42492 / XSA-496.
    
    Fixes: f94360a7fe9b ("xen: add bitmap to indicate per-domain state changes")
    Signed-off-by: Grygorii Strashko <grygorii_strashko@xxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
    (cherry picked from commit 40c59b6c29b1317707a94194f8121c0d7445b89c)
---
 xen/common/event_channel.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
index 67700b050a..4ae7308699 100644
--- a/xen/common/event_channel.c
+++ b/xen/common/event_channel.c
@@ -523,7 +523,8 @@ int evtchn_bind_virq(evtchn_bind_virq_t *bind, 
evtchn_port_t port)
     if ( rc < 0 )
     {
         gdprintk(XENLOG_WARNING, "EVTCHNOP failure: error %d\n", rc);
-        domain_deinit_states(d);
+        if ( virq == VIRQ_DOM_EXC )
+            domain_deinit_states(d);
         goto out;
     }
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.21