xen/evtchn: fix race between FIFO expand and reset operations

evtchn_fifo_expand_array() will check for the domain evtchn_fifo being
populated without holding the event_lock, which can lead to a race with a
concurrent evtchn_reset().

Ensure the checking for evtchn_fifo presence is done while holding the
event_lock.

This is XSA-505 / CVE-2026-62432.

Fixes: 400b3bd642 ("evtchn: make EVTCHNOP_reset suitable for kexec")
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
(cherry picked from commit 0e9d647aca)

xen/common/event_fifo.c

@@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn)
 int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array)
 {
     struct domain *d = current->domain;
-    int rc;
-
-    if ( !d->evtchn_fifo )
-        return -EOPNOTSUPP;
+    int rc = -EOPNOTSUPP;
 
     write_lock(&d->event_lock);
-    rc = add_page_to_event_array(d, expand_array->array_gfn);
+    if ( d->evtchn_fifo )
+        rc = add_page_to_event_array(d, expand_array->array_gfn);
     write_unlock(&d->event_lock);
 
     return rc;