From: Jan Beulich <jbeulich@suse.com>
Subject: x86/pass-through: disallow pt_irq_create_bind() on dying domains

DMs may invoke XEN_DOMCTL_bind_pt_irq for domains already under
destruction. When XEN_DOMCTL_bind_pt_irq is invoked after
pci_release_devices() (invoked from underneath domain_kill()) had already
completed, it would allocate hvm_domain_irq(d)->dpci anew, without that
ever being freed during subsequent domain cleanup.

Leverage evtchn_destroy()'s kind-of-spin-barrier, allowing to simply check
->is_dying with the domain's event lock held.

This is XSA-509 / CVE-2026-62437.

Fixes: 7a26b541a202 ("vtd: Dynamically allocate IRQ-tracking structures, only for those")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>

--- a/xen/drivers/passthrough/x86/hvm.c
+++ b/xen/drivers/passthrough/x86/hvm.c
@@ -231,6 +231,12 @@ int pt_irq_create_bind(
  restart:
     write_lock(&d->event_lock);
 
+    if ( d->is_dying )
+    {
+        write_unlock(&d->event_lock);
+        return -ESRCH;
+    }
+
     hvm_irq_dpci = domain_get_irq_dpci(d);
     if ( !hvm_irq_dpci && !is_hardware_domain(d) )
     {