x86/vrtc: fix race in CMOS index checking

Do the checking for a valid CMOS index while holding the spinlock,
otherwise the value could be changed by the guest after having been
checked.

This is XSA-503 / CVE-2026-62430.

Fixes: 34bef0e6d5 ("hvm: Add locking to platform timers.")
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit 52350da926)

xen/arch/x86/hvm/rtc.c

@@ -645,16 +645,24 @@ static int update_in_progress(RTCState *s)
     return 0;
 }
 
-static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr)
+static bool rtc_ioport_read(RTCState *s, uint32_t addr, uint32_t *val)
 {
     int ret;
     struct domain *d = vrtc_domain(s);
 
+    *val = ~0;
+
     if ( (addr & 1) == 0 )
-        return 0xff;
+        return true;
 
     spin_lock(&s->lock);
 
+    if ( s->hw.cmos_index >= RTC_CMOS_SIZE )
+    {
+        spin_unlock(&s->lock);
+        return false;
+    }
+
     switch ( s->hw.cmos_index )
     {
     case RTC_SECONDS:
@@ -694,7 +702,9 @@ static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr)
 
     spin_unlock(&s->lock);
 
-    return ret;
+    *val = ret;
+
+    return true;
 }
 
 static int cf_check handle_rtc_io(
@@ -714,11 +724,8 @@ static int cf_check handle_rtc_io(
         if ( rtc_ioport_write(vrtc, port, (uint8_t)*val) )
             return X86EMUL_OKAY;
     }
-    else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE )
-    {
-        *val = rtc_ioport_read(vrtc, port);
+    else if ( rtc_ioport_read(vrtc, port, val) )
         return X86EMUL_OKAY;
-    }
 
     return X86EMUL_UNHANDLEABLE;
 }