[xen stable-4.17] x86/pass-through: disallow pt_irq_create_bind() on dying domains

[patchbot@xxxxxxx]

commit 439228f517441fe0187a4ff62be7ae766891dc1c
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Aug 26 17:51:04 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed Aug 26 17:51:38 2026 +0100

    x86/pass-through: disallow pt_irq_create_bind() on dying domains
    
    DMs may invoke XEN_DOMCTL_bind_pt_irq for domains already under
    destruction. When XEN_DOMCTL_bind_pt_irq is invoked after
    pci_release_devices() (invoked from underneath domain_kill()) had already
    completed, it would allocate hvm_domain_irq(d)->dpci anew, without that
    ever being freed during subsequent domain cleanup.
    
    Leverage evtchn_destroy()'s kind-of-spin-barrier, allowing to simply check
    ->is_dying with the domain's event lock held.
    
    This is XSA-509 / CVE-2026-62437.
    
    Fixes: 7a26b541a202 ("vtd: Dynamically allocate IRQ-tracking structures, 
only for those")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    (cherry picked from commit 328a1461430f82d5f0318511e71b7143cdbca872)
---
 xen/drivers/passthrough/x86/hvm.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xen/drivers/passthrough/x86/hvm.c 
b/xen/drivers/passthrough/x86/hvm.c
index a16e0e5344..4c8a3f8a39 100644
--- a/xen/drivers/passthrough/x86/hvm.c
+++ b/xen/drivers/passthrough/x86/hvm.c
@@ -231,6 +231,12 @@ int pt_irq_create_bind(
  restart:
     write_lock(&d->event_lock);
 
+    if ( d->is_dying )
+    {
+        write_unlock(&d->event_lock);
+        return -ESRCH;
+    }
+
     hvm_irq_dpci = domain_get_irq_dpci(d);
     if ( !hvm_irq_dpci && !is_hardware_domain(d) )
     {
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.17