[xen stable-4.18] sysctl/XSM: drop .page_offline() hook

[patchbot@xxxxxxx]

commit c8d10a8e171ed675283246fe39dbb3b7331139e2
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 16:44:12 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:10:03 2026 +0100

    sysctl/XSM: drop .page_offline() hook
    
    Integrate the checking with xsm_sysctl(), now that it has the full op
    struct passed. As a positive side effect, permissions are then checked at
    the same early point with and without Flask.
    
    This is part of CVE-2026-62426 / XSA-499.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-By: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    (cherry picked from commit 299de2aedabe545092b4225c3335701290bd953a)
---
 xen/common/sysctl.c     |  4 ----
 xen/include/xsm/dummy.h |  6 ------
 xen/include/xsm/xsm.h   |  6 ------
 xen/xsm/dummy.c         |  1 -
 xen/xsm/flask/hooks.c   | 38 ++++++++++++++++++--------------------
 5 files changed, 18 insertions(+), 37 deletions(-)

diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c
index 011def5bb2..95c66a70eb 100644
--- a/xen/common/sysctl.c
+++ b/xen/common/sysctl.c
@@ -187,10 +187,6 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) 
u_sysctl)
         if ( op->u.page_offline.end < op->u.page_offline.start )
             break;
 
-        ret = xsm_page_offline(XSM_HOOK, op->u.page_offline.cmd);
-        if ( ret )
-            break;
-
         ptr = status = xmalloc_array(uint32_t,
                                      (op->u.page_offline.end -
                                       op->u.page_offline.start + 1));
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index b96483d0d8..d5cea513c1 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -428,12 +428,6 @@ static XSM_INLINE int cf_check 
xsm_resource_setup_misc(XSM_DEFAULT_VOID)
     return xsm_default_action(action, current->domain, NULL);
 }
 
-static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd)
-{
-    XSM_ASSERT_ACTION(XSM_HOOK);
-    return xsm_default_action(action, current->domain, NULL);
-}
-
 static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID)
 {
     XSM_ASSERT_ACTION(XSM_PRIV);
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index b5d4e9fe43..193f68c88e 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -129,7 +129,6 @@ struct xsm_ops {
     int (*resource_setup_gsi)(int gsi);
     int (*resource_setup_misc)(void);
 
-    int (*page_offline)(uint32_t cmd);
     int (*hypfs_op)(void);
 
     long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op);
@@ -522,11 +521,6 @@ static inline int xsm_resource_setup_misc(xsm_default_t 
def)
     return alternative_call(xsm_ops.resource_setup_misc);
 }
 
-static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd)
-{
-    return alternative_call(xsm_ops.page_offline, cmd);
-}
-
 static inline int xsm_hypfs_op(xsm_default_t def)
 {
     return alternative_call(xsm_ops.hypfs_op);
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index bb38d6023d..6cc38673d7 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -83,7 +83,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops 
= {
     .resource_setup_gsi            = xsm_resource_setup_gsi,
     .resource_setup_misc           = xsm_resource_setup_misc,
 
-    .page_offline                  = xsm_page_offline,
     .hypfs_op                      = xsm_hypfs_op,
     .hvm_param                     = xsm_hvm_param,
     .hvm_param_altp2mhvm           = xsm_hvm_param_altp2mhvm,
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 03d9b8e60f..e3e94274ca 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -58,6 +58,7 @@ static int flask_deassign_dtdevice(struct domain *d, const 
char *dtpath);
 
 static int flask_resource_plug_core(void);
 static int flask_resource_unplug_core(void);
+static int flask_resource_use_core(void);
 
 static uint32_t domain_sid(const struct domain *dom)
 {
@@ -899,10 +900,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl 
*op)
 {
     switch ( op->cmd )
     {
-    /* These have individual XSM hooks */
-    case XEN_SYSCTL_page_offline_op:
-        return 0;
-
     case XEN_SYSCTL_readconsole:
         return domain_has_xen(current->domain,
                               XEN__READCONSOLE |
@@ -933,6 +930,23 @@ static int cf_check flask_sysctl(const struct xen_sysctl 
*op)
     case XEN_SYSCTL_pm_op:
         return domain_has_xen(current->domain, XEN__PM_OP);
 
+    case XEN_SYSCTL_page_offline_op:
+        switch ( op->u.page_offline.cmd )
+        {
+        case sysctl_page_offline:
+            return flask_resource_unplug_core();
+
+        case sysctl_page_online:
+            return flask_resource_plug_core();
+
+        case sysctl_query_page_offline:
+            return flask_resource_use_core();
+
+        default:
+            return avc_unknown_permission("page_offline",
+                                          op->u.page_offline.cmd);
+        }
+
     case XEN_SYSCTL_lockprof_op:
         return domain_has_xen(current->domain, XEN__LOCKPROF);
 
@@ -1324,21 +1338,6 @@ static int cf_check flask_resource_setup_misc(void)
     return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, 
RESOURCE__SETUP, NULL);
 }
 
-static inline int cf_check flask_page_offline(uint32_t cmd)
-{
-    switch ( cmd )
-    {
-    case sysctl_page_offline:
-        return flask_resource_unplug_core();
-    case sysctl_page_online:
-        return flask_resource_plug_core();
-    case sysctl_query_page_offline:
-        return flask_resource_use_core();
-    default:
-        return avc_unknown_permission("page_offline", cmd);
-    }
-}
-
 static inline int cf_check flask_hypfs_op(void)
 {
     return domain_has_xen(current->domain, XEN__HYPFS_OP);
@@ -1978,7 +1977,6 @@ static const struct xsm_ops __initconst_cf_clobber 
flask_ops = {
     .resource_setup_gsi = flask_resource_setup_gsi,
     .resource_setup_misc = flask_resource_setup_misc,
 
-    .page_offline = flask_page_offline,
     .hypfs_op = flask_hypfs_op,
     .hvm_param = flask_hvm_param,
     .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm,
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.18