x86/pci: Perform XSM checks on the correct device in pci_conf_write_intercept()

The requested PCI segment needs including in the call to
xsm_pci_config_permission().  Otherwise in a multi-segment system we can check
the perimssions on one device but operate on a different one.

This is only not a vulnerability because pci_conf_write_intercept() is only
reachable by the hardware domain.

Fixes: 300bb048ca ("x86/PCI: make all config space writes subject to XSM checking")
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
master commit: b4a671acf1
master date: 2026-09-03 09:45:16 +0100

xen/arch/x86/pci.c

@@ -76,8 +76,9 @@ int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
                              unsigned int reg, unsigned int size,
                              uint32_t *data)
 {
+    pci_sbdf_t sbdf = PCI_SBDF(seg, bdf);
     struct pci_dev *pdev;
-    int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, bdf,
+    int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, sbdf.sbdf,
                                        reg, reg + size - 1, 1);
 
     if ( rc < 0 )
@@ -93,7 +94,7 @@ int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
 
     pcidevs_lock();
 
-    pdev = pci_get_pdev(NULL, PCI_SBDF(seg, bdf));
+    pdev = pci_get_pdev(NULL, sbdf);
     if ( pdev )
         rc = pci_msi_conf_write_intercept(pdev, reg, size, data);