From d1eec3dc18de5fd7140357b74c64be092a4d185a Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 20 Jul 2026 16:37:30 +0100 Subject: [PATCH] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subsequently some sub-ops will want to inspect their sub-sub-ops. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b) --- xen/common/sysctl.c | 2 +- xen/include/xsm/dummy.h | 3 ++- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 6 +++--- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 5207664252..2df2426762 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; - ret = xsm_sysctl(XSM_PRIV, op->cmd); + ret = xsm_sysctl(XSM_PRIV, op); if ( ret ) return ret; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 74b1c0ed39..2d49e99b3c 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -180,7 +180,8 @@ static XSM_INLINE int cf_check xsm_domctl( } } -static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl( + XSM_DEFAULT_ARG const struct xen_sysctl *op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 89823abbf8..48ca5fd3f5 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -62,7 +62,7 @@ struct xsm_ops { int (*set_target)(struct domain *d, struct domain *e); int (*domctl)(struct domain *d, struct xen_domctl *op); #ifdef CONFIG_SYSCTL - int (*sysctl)(int cmd); + int (*sysctl)(const struct xen_sysctl *op); int (*readconsole)(uint32_t clear); #endif @@ -251,9 +251,9 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d, } #ifdef CONFIG_SYSCTL -static inline int xsm_sysctl(xsm_default_t def, int cmd) +static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op) { - return alternative_call(xsm_ops.sysctl, cmd); + return alternative_call(xsm_ops.sysctl, op); } static inline int xsm_readconsole(xsm_default_t def, uint32_t clear) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 5633c02c4b..a8b9cf442f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -872,9 +872,9 @@ static int cf_check flask_domctl(struct domain *d, struct xen_domctl *op) } #ifdef CONFIG_SYSCTL -static int cf_check flask_sysctl(int cmd) +static int cf_check flask_sysctl(const struct xen_sysctl *op) { - switch ( cmd ) + switch ( op->cmd ) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: @@ -942,7 +942,7 @@ static int cf_check flask_sysctl(int cmd) XEN2__COVERAGE_OP, NULL); default: - return avc_unknown_permission("sysctl", cmd); + return avc_unknown_permission("sysctl", op->cmd); } }