[xen stable-4.18] x86/pass-through: disallow pt_irq_create_bind() on dying domains

[patchbot@xxxxxxx]

commit a5817d143d4c452a420f6691fe167ef2deae98c8
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Aug 26 17:50:35 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed Aug 26 17:50:46 2026 +0100

    x86/pass-through: disallow pt_irq_create_bind() on dying domains
    
    DMs may invoke XEN_DOMCTL_bind_pt_irq for domains already under
    destruction. When XEN_DOMCTL_bind_pt_irq is invoked after
    pci_release_devices() (invoked from underneath domain_kill()) had already
    completed, it would allocate hvm_domain_irq(d)->dpci anew, without that
    ever being freed during subsequent domain cleanup.
    
    Leverage evtchn_destroy()'s kind-of-spin-barrier, allowing to simply check
    ->is_dying with the domain's event lock held.
    
    This is XSA-509 / CVE-2026-62437.
    
    Fixes: 7a26b541a202 ("vtd: Dynamically allocate IRQ-tracking structures, 
only for those")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    (cherry picked from commit 328a1461430f82d5f0318511e71b7143cdbca872)
---
 xen/drivers/passthrough/x86/hvm.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xen/drivers/passthrough/x86/hvm.c 
b/xen/drivers/passthrough/x86/hvm.c
index 6813107648..94e42e1e0f 100644
--- a/xen/drivers/passthrough/x86/hvm.c
+++ b/xen/drivers/passthrough/x86/hvm.c
@@ -231,6 +231,12 @@ int pt_irq_create_bind(
  restart:
     write_lock(&d->event_lock);
 
+    if ( d->is_dying )
+    {
+        write_unlock(&d->event_lock);
+        return -ESRCH;
+    }
+
     hvm_irq_dpci = domain_get_irq_dpci(d);
     if ( !hvm_irq_dpci && !is_hardware_domain(d) )
     {
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.18