[xen stable-4.21] domctl: handle XEN_DOMCTL_getdomaininfo without acquiring domctl lock

[patchbot@xxxxxxx]

commit 1874bf7927674575d87eb13b5fd3476b02d4238d
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Jun 4 21:37:32 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Thu Jun 4 21:38:04 2026 +0100

    domctl: handle XEN_DOMCTL_getdomaininfo without acquiring domctl lock
    
    getdomaininfo() is not called under consistently the same lock. Thus,
    with caller side locking irrelevant, it can as well be called with the
    domctl lock not held. (Callers not pausing the domain they want to
    retrieve information for already need to be aware that not all of the
    data returned can be relied on as being consistent; most data will also
    be stale by the time the caller gets to look at it.)
    
    Move the handling not only ahead of acquiring the lock, but also ahead
    of the XSM check, leveraging that the sub-op has its own hook.
    
    While moving, convert an assignment to an assertion: The domain in
    question was determined from the field which previously was "updated".
    
    This is part of XSA-492.
    
    Fixes: 5513bd0b4675 ("add xenstore domain flag to hypervisor")
    Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Acked-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    (cherry picked from commit 784bd4dc0bc440b978b80b6945c4bc380b28e32d)
---
 xen/common/domctl.c     | 31 ++++++++++++++++++++-----------
 xen/include/xsm/dummy.h |  6 +++++-
 xen/xsm/flask/hooks.c   |  6 +++++-
 3 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 21bbffdc40..48be3ec58a 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -318,6 +318,26 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) 
u_domctl)
         break;
     }
 
+    /* Handle sub-ops not requiring the domctl lock. */
+    switch ( op->cmd )
+    {
+    case XEN_DOMCTL_getdomaininfo:
+        ret = xsm_getdomaininfo(XSM_XS_PRIV, d);
+        if ( !ret )
+        {
+            getdomaininfo(d, &op->u.getdomaininfo);
+
+            ASSERT(op->domain == op->u.getdomaininfo.domain);
+            copyback = true;
+        }
+
+        goto domctl_out_unlock_domonly;
+
+    default:
+        /* Everything else handled further down. */
+        break;
+    }
+
     ret = xsm_domctl(XSM_OTHER, d, op->cmd,
                      /* SSIDRef only applicable for cmd == createdomain */
                      op->u.createdomain.ssidref);
@@ -516,17 +536,6 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) 
u_domctl)
         copyback = 1;
         break;
 
-    case XEN_DOMCTL_getdomaininfo:
-        ret = xsm_getdomaininfo(XSM_XS_PRIV, d);
-        if ( ret )
-            break;
-
-        getdomaininfo(d, &op->u.getdomaininfo);
-
-        op->domain = op->u.getdomaininfo.domain;
-        copyback = 1;
-        break;
-
     case XEN_DOMCTL_getvcpucontext:
     {
         vcpu_guest_context_u c = { .nat = NULL };
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 12792c3a43..dcdfa79137 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -172,9 +172,13 @@ static XSM_INLINE int cf_check xsm_domctl(
     case XEN_DOMCTL_bind_pt_irq:
     case XEN_DOMCTL_unbind_pt_irq:
         return xsm_default_action(XSM_DM_PRIV, current->domain, d);
-    case XEN_DOMCTL_getdomaininfo:
     case XEN_DOMCTL_get_domain_state:
         return xsm_default_action(XSM_XS_PRIV, current->domain, d);
+
+    case XEN_DOMCTL_getdomaininfo:
+        ASSERT_UNREACHABLE();
+        return -EILSEQ;
+
     default:
         return xsm_default_action(XSM_PRIV, current->domain, d);
     }
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index b0308e1b26..529de9d7f5 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -682,8 +682,12 @@ static int cf_check flask_domctl(struct domain *d, 
unsigned int cmd,
          */
         return avc_current_has_perm(ssidref, SECCLASS_DOMAIN, DOMAIN__CREATE, 
NULL);
 
-    /* These have individual XSM hooks (common/domctl.c) */
+    /* These have individual XSM hooks and don't make it here. */
     case XEN_DOMCTL_getdomaininfo:
+        ASSERT_UNREACHABLE();
+        return -EILSEQ;
+
+    /* These have individual XSM hooks (common/domctl.c) */
     case XEN_DOMCTL_scheduler_op:
     case XEN_DOMCTL_irq_permission:
     case XEN_DOMCTL_iomem_permission:
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.21