[xen stable-4.17] sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl()

[patchbot@xxxxxxx]

commit 59eefcbff2c75b5b816829793db9263f81b02016
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 16:45:24 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:10:38 2026 +0100

    sysctl/XSM: pass full struct xen_sysctl to xsm_sysctl()
    
    Subsequently some sub-ops will want to inspect their sub-sub-ops.
    
    This is part of CVE-2026-62426 / XSA-499.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    (cherry picked from commit 9f4aa6d00a61fd5cee74d31e7de1a659bfbeae7b)
---
 xen/common/sysctl.c     | 2 +-
 xen/include/xsm/dummy.h | 3 ++-
 xen/include/xsm/xsm.h   | 6 +++---
 xen/xsm/flask/hooks.c   | 6 +++---
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c
index 4c7551c5d9..88a5b4a974 100644
--- a/xen/common/sysctl.c
+++ b/xen/common/sysctl.c
@@ -42,7 +42,7 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl)
     if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION )
         return -EACCES;
 
-    ret = xsm_sysctl(XSM_PRIV, op->cmd);
+    ret = xsm_sysctl(XSM_PRIV, op);
     if ( ret )
         return ret;
 
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 8ed7c3dacf..485c324837 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -178,7 +178,8 @@ static XSM_INLINE int cf_check xsm_domctl(
     }
 }
 
-static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd)
+static XSM_INLINE int cf_check xsm_sysctl(
+    XSM_DEFAULT_ARG const struct xen_sysctl *op)
 {
     XSM_ASSERT_ACTION(XSM_PRIV);
     return xsm_default_action(action, current->domain, NULL);
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 102880da9e..bafe7834a9 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -60,7 +60,7 @@ struct xsm_ops {
     int (*sysctl_scheduler_op)(int op);
     int (*set_target)(struct domain *d, struct domain *e);
     int (*domctl)(struct domain *d, struct xen_domctl *op);
-    int (*sysctl)(int cmd);
+    int (*sysctl)(const struct xen_sysctl *op);
     int (*readconsole)(uint32_t clear);
 
     int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2);
@@ -237,9 +237,9 @@ static inline int xsm_domctl(xsm_default_t def, struct 
domain *d,
     return alternative_call(xsm_ops.domctl, d, op);
 }
 
-static inline int xsm_sysctl(xsm_default_t def, int cmd)
+static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op)
 {
-    return alternative_call(xsm_ops.sysctl, cmd);
+    return alternative_call(xsm_ops.sysctl, op);
 }
 
 static inline int xsm_readconsole(xsm_default_t def, uint32_t clear)
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index f6957d63e5..4eecd53f39 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -889,9 +889,9 @@ static int cf_check flask_domctl(struct domain *d, struct 
xen_domctl *op)
     }
 }
 
-static int cf_check flask_sysctl(int cmd)
+static int cf_check flask_sysctl(const struct xen_sysctl *op)
 {
-    switch ( cmd )
+    switch ( op->cmd )
     {
     /* These have individual XSM hooks */
     case XEN_SYSCTL_readconsole:
@@ -963,7 +963,7 @@ static int cf_check flask_sysctl(int cmd)
                                     XEN2__COVERAGE_OP, NULL);
 
     default:
-        return avc_unknown_permission("sysctl", cmd);
+        return avc_unknown_permission("sysctl", op->cmd);
     }
 }
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.17