From 011509a0c20809a3f1eb645a5109172bc847e8b6 Mon Sep 17 00:00:00 2001 From: Roger Pau Monne Date: Mon, 20 Jul 2026 16:42:53 +0100 Subject: [PATCH] xen/evtchn: fix race between FIFO expand and reset operations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit evtchn_fifo_expand_array() will check for the domain evtchn_fifo being populated without holding the event_lock, which can lead to a race with a concurrent evtchn_reset(). Ensure the checking for evtchn_fifo presence is done while holding the event_lock. This is XSA-505 / CVE-2026-62432. Fixes: 400b3bd6426f ("evtchn: make EVTCHNOP_reset suitable for kexec") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Andrew Cooper (cherry picked from commit 0e9d647aca8a535f7c02dfb62c38b4d320cc7878) --- xen/common/event_fifo.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 37cba9bc45..cae08a594e 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -692,13 +692,11 @@ static int add_page_to_event_array(struct domain *d, unsigned long gfn) int evtchn_fifo_expand_array(const struct evtchn_expand_array *expand_array) { struct domain *d = current->domain; - int rc; - - if ( !d->evtchn_fifo ) - return -EOPNOTSUPP; + int rc = -EOPNOTSUPP; write_lock(&d->event_lock); - rc = add_page_to_event_array(d, expand_array->array_gfn); + if ( d->evtchn_fifo ) + rc = add_page_to_event_array(d, expand_array->array_gfn); write_unlock(&d->event_lock); return rc;