From 59eefcbff2c75b5b816829793db9263f81b02016 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 20 Jul 2026 16:45:24 +0100 Subject: [PATCH] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 4c7551c5d9..88a5b4a974 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 8ed7c3dacf..485c324837 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -178,7 +178,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 102880da9e..bafe7834a9 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -60,7 +60,7 @@ struct xsm_ops { int (*sysctl_scheduler_op)(int op); int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2); @@ -237,9 +237,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, return alternative_call(xsm_ops.domctl, d, op); } -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index f6957d63e5..4eecd53f39 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -889,9 +889,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } } -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -963,7 +963,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } }