[xen stable-4.18] xen/evtchn: fix race between FIFO expand and reset operations

[patchbot@xxxxxxx]

commit a826f56089cee0e1cd2bec23184570a6454a929d
Author:     Roger Pau Monne <roger.pau@xxxxxxxxxx>
AuthorDate: Mon Jul 20 16:44:35 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:10:03 2026 +0100

    xen/evtchn: fix race between FIFO expand and reset operations
    
    evtchn_fifo_expand_array() will check for the domain evtchn_fifo being
    populated without holding the event_lock, which can lead to a race with a
    concurrent evtchn_reset().
    
    Ensure the checking for evtchn_fifo presence is done while holding the
    event_lock.
    
    This is XSA-505 / CVE-2026-62432.
    
    Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec")
    Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878)
---
 xen/common/event_fifo.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c
index 6cebc3868a..ea613cfdca 100644
--- a/xen/common/event_fifo.c
+++ b/xen/common/event_fifo.c
@@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, 
unsigned long gfn)
 int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array)
 {
     struct domain *d = current->domain;
-    int rc;
-
-    if ( !d->evtchn_fifo )
-        return -EOPNOTSUPP;
+    int rc = -EOPNOTSUPP;
 
     write_lock(&d->event_lock);
-    rc = add_page_to_event_array(d, expand_array->array_gfn);
+    if ( d->evtchn_fifo )
+        rc = add_page_to_event_array(d, expand_array->array_gfn);
     write_unlock(&d->event_lock);
 
     return rc;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.18