[xen staging] domctl: handle XEN_DOMCTL_get_domain_state without acquiring domctl lock

[patchbot@xxxxxxx]

commit eedff4bcd3d1314f098c2a151d4bb8a90c0f1820
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Jun 4 20:20:44 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jun 9 12:45:56 2026 +0100

    domctl: handle XEN_DOMCTL_get_domain_state without acquiring domctl lock
    
    get_domain_state() uses its own locking. Thus, with caller side locking
    irrelevant, it can as well be called with the domctl lock not held.
    
    Move the handling not only ahead of acquiring the lock, but also ahead
    of the XSM check, leveraging that the sub-op has its own hook.
    
    This is part of XSA-492.
    
    Fixes: 3ad3df1bd0aa ("xen: add new domctl get_domain_state")
    Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
---
 xen/common/domctl.c     | 16 ++++++++--------
 xen/include/xsm/dummy.h |  3 +--
 xen/xsm/flask/hooks.c   |  2 +-
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index eee30e8534..8745bc3d30 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -339,6 +339,14 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) 
u_domctl)
 
         goto domctl_out_unlock_domonly;
 
+    case XEN_DOMCTL_get_domain_state:
+        ret = xsm_get_domain_state(XSM_XS_PRIV, d);
+        if ( !ret )
+            ret = get_domain_state(&op->u.get_domain_state, d, &op->domain);
+        if ( !ret )
+            copyback = true;
+        goto domctl_out_unlock_domonly;
+
     default:
         /* Everything else handled further down. */
         break;
@@ -873,14 +881,6 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) 
u_domctl)
             ret = -EOPNOTSUPP;
         break;
 
-    case XEN_DOMCTL_get_domain_state:
-        ret = xsm_get_domain_state(XSM_XS_PRIV, d);
-        if ( !ret )
-            ret = get_domain_state(&op->u.get_domain_state, d, &op->domain);
-        if ( !ret )
-            copyback = true;
-        break;
-
     default:
         ret = arch_do_domctl(op, d, u_domctl);
         break;
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 6ca4209108..ffc6bcbde7 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -172,10 +172,9 @@ static XSM_INLINE int cf_check xsm_domctl(
     case XEN_DOMCTL_bind_pt_irq:
     case XEN_DOMCTL_unbind_pt_irq:
         return xsm_default_action(XSM_DM_PRIV, current->domain, d);
-    case XEN_DOMCTL_get_domain_state:
-        return xsm_default_action(XSM_XS_PRIV, current->domain, d);
 
     case XEN_DOMCTL_getdomaininfo:
+    case XEN_DOMCTL_get_domain_state:
         ASSERT_UNREACHABLE();
         return -EILSEQ;
 
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 03413eac51..bdfaa936be 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -651,6 +651,7 @@ static int cf_check flask_domctl(struct domain *d, unsigned 
int cmd,
 
     /* These have individual XSM hooks and don't make it here. */
     case XEN_DOMCTL_getdomaininfo:
+    case XEN_DOMCTL_get_domain_state:
         ASSERT_UNREACHABLE();
         return -EILSEQ;
 
@@ -661,7 +662,6 @@ static int cf_check flask_domctl(struct domain *d, unsigned 
int cmd,
     case XEN_DOMCTL_memory_mapping:
     case XEN_DOMCTL_set_target:
     case XEN_DOMCTL_vm_event_op:
-    case XEN_DOMCTL_get_domain_state:
 
     /* These have individual XSM hooks (arch/../domctl.c) */
     case XEN_DOMCTL_bind_pt_irq:
--
generated by git-patchbot for /home/xen/git/xen.git#staging