The implementation of the HVM control operation HVMOP_inject_msi, while
checking whether a particular IRQ was already set up in the necessary
way, fails to properly check all respective conditions. In particular
it doesn't check the returned pointer for being non-NULL before de-
referencing it.

Furthermore that same code also handles certain errors by logging
messages, without (under default settings) at least making these
messages subject to rate limiting.

The NULL pointer de-reference would lead to a host crash, and hence a
denial of service would result.

The spamming of the hypervisor log could similarly lead to a denial of
service.

Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue.