[xen stable-4.22] x86/pci: Perform XSM checks on the correct device in pci_conf_write_intercept()

[patchbot@xxxxxxx]

commit 2bd89c0ef37be571f1fdd93755ddda9817384d42
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Sep 10 12:32:20 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Sep 10 12:32:20 2026 +0200

    x86/pci: Perform XSM checks on the correct device in 
pci_conf_write_intercept()
    
    The requested PCI segment needs including in the call to
    xsm_pci_config_permission().  Otherwise in a multi-segment system we can 
check
    the perimssions on one device but operate on a different one.
    
    This is only not a vulnerability because pci_conf_write_intercept() is only
    reachable by the hardware domain.
    
    Fixes: 300bb048ca31 ("x86/PCI: make all config space writes subject to XSM 
checking")
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: b4a671acf151dec87bc99bc2547e73149bd3c55e
    master date: 2026-09-03 09:45:16 +0100
---
 xen/arch/x86/pci.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/pci.c b/xen/arch/x86/pci.c
index fd0715fb6a..34dce6d9bb 100644
--- a/xen/arch/x86/pci.c
+++ b/xen/arch/x86/pci.c
@@ -76,8 +76,9 @@ int pci_conf_write_intercept(unsigned int seg, unsigned int 
bdf,
                              unsigned int reg, unsigned int size,
                              uint32_t *data)
 {
+    pci_sbdf_t sbdf = PCI_SBDF(seg, bdf);
     struct pci_dev *pdev;
-    int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, bdf,
+    int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, sbdf.sbdf,
                                        reg, reg + size - 1, 1);
 
     if ( rc < 0 )
@@ -93,7 +94,7 @@ int pci_conf_write_intercept(unsigned int seg, unsigned int 
bdf,
 
     pcidevs_lock();
 
-    pdev = pci_get_pdev(NULL, PCI_SBDF(seg, bdf));
+    pdev = pci_get_pdev(NULL, sbdf);
     if ( pdev )
         rc = pci_msi_conf_write_intercept(pdev, reg, size, data);
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.22