xen-kernel -- x86 segment base write emulation lacking canonical address checks

The Xen Project reports:

Both writes to the FS and GS register base MSRs as well as the
WRFSBASE and WRGSBASE instructions require their input values to be
canonical, or a #GP fault will be raised. When the use of those
instructions by the hypervisor was enabled, the previous guard
against #GP faults (having recovery code attached) was accidentally
removed.
A malicious guest administrator can crash the host, leading to a
DoS.