From b4a671acf151dec87bc99bc2547e73149bd3c55e Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Wed, 2 Sep 2026 23:28:46 +0100 Subject: [PATCH] x86/pci: Perform XSM checks on the correct device in pci_conf_write_intercept() The requested PCI segment needs including in the call to xsm_pci_config_permission(). Otherwise in a multi-segment system we can check the perimssions on one device but operate on a different one. This is only not a vulnerability because pci_conf_write_intercept() is only reachable by the hardware domain. Fixes: 300bb048ca31 ("x86/PCI: make all config space writes subject to XSM checking") Reviewed-by: Jan Beulich Acked-by: Daniel P. Smith Signed-off-by: Andrew Cooper --- xen/arch/x86/pci.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/pci.c b/xen/arch/x86/pci.c index 1aefeab663..4c27987551 100644 --- a/xen/arch/x86/pci.c +++ b/xen/arch/x86/pci.c @@ -76,8 +76,9 @@ int pci_conf_write_intercept(unsigned int seg, unsigned int bdf, unsigned int reg, unsigned int size, uint32_t *data) { + pci_sbdf_t sbdf = PCI_SBDF(seg, bdf); struct pci_dev *pdev; - int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, bdf, + int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, sbdf.sbdf, reg, reg + size - 1, true); if ( rc < 0 ) @@ -93,7 +94,7 @@ int pci_conf_write_intercept(unsigned int seg, unsigned int bdf, pcidevs_lock(); - pdev = pci_get_pdev(NULL, PCI_SBDF(seg, bdf)); + pdev = pci_get_pdev(NULL, sbdf); if ( pdev ) rc = pci_msi_conf_write_intercept(pdev, reg, size, data);