[xen staging-4.21] domctl: handle XEN_DOMCTL_get_domain_state without acquiring domctl lock

[patchbot@xxxxxxx]

commit 7dff06d83cef9dba3780771eaac720c3c34f1877
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Jun 4 21:37:32 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Thu Jun 4 21:38:04 2026 +0100

    domctl: handle XEN_DOMCTL_get_domain_state without acquiring domctl lock
    
    get_domain_state() uses its own locking. Thus, with caller side locking
    irrelevant, it can as well be called with the domctl lock not held.
    
    Move the handling not only ahead of acquiring the lock, but also ahead
    of the XSM check, leveraging that the sub-op has its own hook.
    
    This is part of XSA-492.
    
    Fixes: 3ad3df1bd0aa ("xen: add new domctl get_domain_state")
    Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    (cherry picked from commit eedff4bcd3d1314f098c2a151d4bb8a90c0f1820)
---
 xen/common/domctl.c     | 16 ++++++++--------
 xen/include/xsm/dummy.h |  3 +--
 xen/xsm/flask/hooks.c   |  2 +-
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 9fe097cc71..509347822c 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -339,6 +339,14 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) 
u_domctl)
 
         goto domctl_out_unlock_domonly;
 
+    case XEN_DOMCTL_get_domain_state:
+        ret = xsm_get_domain_state(XSM_XS_PRIV, d);
+        if ( !ret )
+            ret = get_domain_state(&op->u.get_domain_state, d, &op->domain);
+        if ( !ret )
+            copyback = true;
+        goto domctl_out_unlock_domonly;
+
     default:
         /* Everything else handled further down. */
         break;
@@ -868,14 +876,6 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) 
u_domctl)
             ret = -EOPNOTSUPP;
         break;
 
-    case XEN_DOMCTL_get_domain_state:
-        ret = xsm_get_domain_state(XSM_XS_PRIV, d);
-        if ( !ret )
-            ret = get_domain_state(&op->u.get_domain_state, d, &op->domain);
-        if ( !ret )
-            copyback = true;
-        break;
-
     default:
         ret = arch_do_domctl(op, d, u_domctl);
         break;
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index dcdfa79137..561b078419 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -172,10 +172,9 @@ static XSM_INLINE int cf_check xsm_domctl(
     case XEN_DOMCTL_bind_pt_irq:
     case XEN_DOMCTL_unbind_pt_irq:
         return xsm_default_action(XSM_DM_PRIV, current->domain, d);
-    case XEN_DOMCTL_get_domain_state:
-        return xsm_default_action(XSM_XS_PRIV, current->domain, d);
 
     case XEN_DOMCTL_getdomaininfo:
+    case XEN_DOMCTL_get_domain_state:
         ASSERT_UNREACHABLE();
         return -EILSEQ;
 
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 529de9d7f5..094cb7691f 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -684,6 +684,7 @@ static int cf_check flask_domctl(struct domain *d, unsigned 
int cmd,
 
     /* These have individual XSM hooks and don't make it here. */
     case XEN_DOMCTL_getdomaininfo:
+    case XEN_DOMCTL_get_domain_state:
         ASSERT_UNREACHABLE();
         return -EILSEQ;
 
@@ -694,7 +695,6 @@ static int cf_check flask_domctl(struct domain *d, unsigned 
int cmd,
     case XEN_DOMCTL_memory_mapping:
     case XEN_DOMCTL_set_target:
     case XEN_DOMCTL_vm_event_op:
-    case XEN_DOMCTL_get_domain_state:
 
     /* These have individual XSM hooks (arch/../domctl.c) */
     case XEN_DOMCTL_bind_pt_irq:
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.21