From: Jan Beulich <jbeulich@suse.com>
Subject: sysctl/XSM: drop .scheduler_op() hook

Integrate the checking with xsm_sysctl(), now that it has the full op
struct passed. As a positive side effect, permissions are then checked at
the same early point with and without Flask.

This is part of CVE-2026-62426 / XSA-499.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-By: Daniel P. Smith <dpsmith@apertussolutions.com>

--- a/xen/common/sched/core.c
+++ b/xen/common/sched/core.c
@@ -2089,10 +2089,6 @@ long sched_adjust_global(struct xen_sysc
     struct cpupool *pool;
     int rc;
 
-    rc = xsm_sysctl_scheduler_op(XSM_HOOK, op->cmd);
-    if ( rc )
-        return rc;
-
     if ( (op->cmd != XEN_SYSCTL_SCHEDOP_putinfo) &&
          (op->cmd != XEN_SYSCTL_SCHEDOP_getinfo) )
         return -EINVAL;
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -141,12 +141,6 @@ static XSM_INLINE int cf_check xsm_getdo
     return xsm_default_action(action, current->domain, d);
 }
 
-static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd)
-{
-    XSM_ASSERT_ACTION(XSM_HOOK);
-    return xsm_default_action(action, current->domain, NULL);
-}
-
 static XSM_INLINE int cf_check xsm_set_target(
     XSM_DEFAULT_ARG struct domain *d, struct domain *e)
 {
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -57,7 +57,6 @@ struct xsm_ops {
                                 struct xen_domctl_getdomaininfo *info);
     int (*domain_create)(struct domain *d, uint32_t ssidref);
     int (*getdomaininfo)(struct domain *d);
-    int (*sysctl_scheduler_op)(int op);
     int (*set_target)(struct domain *d, struct domain *e);
     int (*domctl)(struct domain *d, struct xen_domctl *op);
     int (*sysctl)(const struct xen_sysctl *op);
@@ -220,11 +219,6 @@ static inline int xsm_getdomaininfo(xsm_
     return alternative_call(xsm_ops.getdomaininfo, d);
 }
 
-static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd)
-{
-    return alternative_call(xsm_ops.sysctl_scheduler_op, cmd);
-}
-
 static inline int xsm_set_target(
     xsm_default_t def, struct domain *d, struct domain *e)
 {
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -18,7 +18,6 @@ static const struct xsm_ops __initconst_
     .security_domaininfo           = xsm_security_domaininfo,
     .domain_create                 = xsm_domain_create,
     .getdomaininfo                 = xsm_getdomaininfo,
-    .sysctl_scheduler_op           = xsm_sysctl_scheduler_op,
     .set_target                    = xsm_set_target,
     .domctl                        = xsm_domctl,
     .sysctl                        = xsm_sysctl,
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -636,7 +636,7 @@ static int flask_domctl_scheduler_op(str
     }
 }
 
-static int cf_check flask_sysctl_scheduler_op(int op)
+static int flask_sysctl_scheduler_op(unsigned int op)
 {
     switch ( op )
     {
@@ -897,7 +897,6 @@ static int cf_check flask_sysctl(const s
     case XEN_SYSCTL_readconsole:
     case XEN_SYSCTL_getdomaininfolist:
     case XEN_SYSCTL_page_offline_op:
-    case XEN_SYSCTL_scheduler_op:
 #ifdef CONFIG_X86
     case XEN_SYSCTL_cpu_hotplug:
 #endif
@@ -933,6 +932,9 @@ static int cf_check flask_sysctl(const s
     case XEN_SYSCTL_cpupool_op:
         return domain_has_xen(current->domain, XEN__CPUPOOL_OP);
 
+    case XEN_SYSCTL_scheduler_op:
+        return flask_sysctl_scheduler_op(op->u.scheduler_op.cmd);
+
     case XEN_SYSCTL_physinfo:
     case XEN_SYSCTL_cputopoinfo:
     case XEN_SYSCTL_numainfo:
@@ -1895,7 +1897,6 @@ static const struct xsm_ops __initconst_
     .security_domaininfo = flask_security_domaininfo,
     .domain_create = flask_domain_create,
     .getdomaininfo = flask_getdomaininfo,
-    .sysctl_scheduler_op = flask_sysctl_scheduler_op,
     .set_target = flask_set_target,
     .domctl = flask_domctl,
     .sysctl = flask_sysctl,