The requested PCI segment needs including in the call to
xsm_pci_config_permission().  Otherwise in a multi-segment system we can check
the perimssions on one device but operate on a different one.

This is only not a vulnerability because pci_conf_write_intercept() is only
reachable by the hardware domain.

Fixes: 300bb048ca31 ("x86/PCI: make all config space writes subject to XSM checking")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
---
CC: Jan Beulich <jbeulich@suse.com>
CC: Roger Pau Monné <roger@xenproject.org>
CC: Teddy Astie <teddy.astie@vates.tech>
CC: Daniel P. Smith <dpsmith@apertussolutions.com>

This was going to be an XSA before realising that the scope was limited to the
hardware domain.
---
 xen/arch/x86/pci.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/pci.c b/xen/arch/x86/pci.c
index 1aefeab66301..4c279875517b 100644
--- a/xen/arch/x86/pci.c
+++ b/xen/arch/x86/pci.c
@@ -76,8 +76,9 @@ int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
                              unsigned int reg, unsigned int size,
                              uint32_t *data)
 {
+    pci_sbdf_t sbdf = PCI_SBDF(seg, bdf);
     struct pci_dev *pdev;
-    int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, bdf,
+    int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, sbdf.sbdf,
                                        reg, reg + size - 1, true);
 
     if ( rc < 0 )
@@ -93,7 +94,7 @@ int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
 
     pcidevs_lock();
 
-    pdev = pci_get_pdev(NULL, PCI_SBDF(seg, bdf));
+    pdev = pci_get_pdev(NULL, sbdf);
     if ( pdev )
         rc = pci_msi_conf_write_intercept(pdev, reg, size, data);
 

base-commit: d5d126a225e78071fbb5db126744bc2a36d511df
-- 
2.39.5