[xen stable-4.17] sysctl/XSM: drop .scheduler_op() hook

[patchbot@xxxxxxx]

commit a93453cd07ed555d3159975c3ea506d0ea78014f
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 16:45:24 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:10:38 2026 +0100

    sysctl/XSM: drop .scheduler_op() hook
    
    Integrate the checking with xsm_sysctl(), now that it has the full op
    struct passed. As a positive side effect, permissions are then checked at
    the same early point with and without Flask.
    
    This is part of CVE-2026-62426 / XSA-499.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-By: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    (cherry picked from commit 751e371c913ca87d0a66304dfa6837158835cac5)
---
 xen/common/sched/core.c | 4 ----
 xen/include/xsm/dummy.h | 6 ------
 xen/include/xsm/xsm.h   | 6 ------
 xen/xsm/dummy.c         | 1 -
 xen/xsm/flask/hooks.c   | 7 ++++---
 5 files changed, 4 insertions(+), 20 deletions(-)

diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c
index 87484361e8..cb8e7155b4 100644
--- a/xen/common/sched/core.c
+++ b/xen/common/sched/core.c
@@ -2089,10 +2089,6 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op 
*op)
     struct cpupool *pool;
     int rc;
 
-    rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd);
-    if ( rc )
-        return rc;
-
     if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) &&
          (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) )
         return -EINVAL;
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 485c324837..8d4e94cc8e 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdomaininfo(
     return xsm_default_action(action, current->domain, d);
 }
 
-static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd)
-{
-    XSM_ASSERT_ACTION(XSM_HOOK);
-    return xsm_default_action(action, current->domain, NULL);
-}
-
 static XSM_INLINE int cf_check xsm_set_target(
     XSM_DEFAULT_ARG struct domain *d, struct domain *e)
 {
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index bafe7834a9..b42996f0c0 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -57,7 +57,6 @@ struct xsm_ops {
                                 struct xen_domctl_getdomaininfo *info);
     int (*domain_create)(struct domain *d, uint32_t ssidref);
     int (*getdomaininfo)(struct domain *d);
-    int (*sysctl_scheduler_op)(int op);
     int (*set_target)(struct domain *d, struct domain *e);
     int (*domctl)(struct domain *d, struct xen_domctl *op);
     int (*sysctl)(const struct xen_sysctl *op);
@@ -220,11 +219,6 @@ static inline int xsm_getdomaininfo(xsm_default_t def, 
struct domain *d)
     return alternative_call(xsm_ops.getdomaininfo, d);
 }
 
-static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd)
-{
-    return alternative_call(xsm_ops.sysctl_scheduler_op, cmd);
-}
-
 static inline int xsm_set_target(
     xsm_default_t def, struct domain *d, struct domain *e)
 {
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 49598bf08a..d1caf13303 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops 
= {
     .security_domaininfo           = xsm_security_domaininfo,
     .domain_create                 = xsm_domain_create,
     .getdomaininfo                 = xsm_getdomaininfo,
-    .sysctl_scheduler_op           = xsm_sysctl_scheduler_op,
     .set_target                    = xsm_set_target,
     .domctl                        = xsm_domctl,
     .sysctl                        = xsm_sysctl,
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 4eecd53f39..a3a916999a 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -636,7 +636,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int 
op)
     }
 }
 
-static int cf_check flask_sysctl_scheduler_op(int op)
+static int flask_sysctl_scheduler_op(unsigned int op)
 {
     switch ( op )
     {
@@ -897,7 +897,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl 
*op)
     case XEN_SYSCTL_readconsole:
     case XEN_SYSCTL_getdomaininfolist:
     case XEN_SYSCTL_page_offline_op:
-    case XEN_SYSCTL_scheduler_op:
 #ifdef CONFIG_X86
     case XEN_SYSCTL_cpu_hotplug:
 #endif
@@ -933,6 +932,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl 
*op)
     case XEN_SYSCTL_cpupool_op:
         return domain_has_xen(current->domain, XEN__CPUPOOL_OP);
 
+    case XEN_SYSCTL_scheduler_op:
+        return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd);
+
     case XEN_SYSCTL_physinfo:
     case XEN_SYSCTL_cputopoinfo:
     case XEN_SYSCTL_numainfo:
@@ -1895,7 +1897,6 @@ static const struct xsm_ops __initconst_cf_clobber 
flask_ops = {
     .security_domaininfo = flask_security_domaininfo,
     .domain_create = flask_domain_create,
     .getdomaininfo = flask_getdomaininfo,
-    .sysctl_scheduler_op = flask_sysctl_scheduler_op,
     .set_target = flask_set_target,
     .domctl = flask_domctl,
     .sysctl = flask_sysctl,
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.17