Commit b03afaa8 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by David S. Miller
Browse files

bpfilter: switch bpfilter_ip_set_sockopt to sockptr_t 



This is mostly to prepare for cleaning up the callers, as bpfilter by
design can't handle kernel pointers.

Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c2f12630

include/linux/bpfilter.h

+3 −3
Original line number Diff line number Diff line
@@ -4,9 +4,10 @@ 


#include <uapi/linux/bpfilter.h>

#include <linux/usermode_driver.h>

#include <linux/sockptr.h>



struct sock;

int bpfilter_ip_set_sockopt(struct sock *sk, int optname, char __user *optval,

int bpfilter_ip_set_sockopt(struct sock *sk, int optname, sockptr_t optval,

			    unsigned int optlen);

int bpfilter_ip_get_sockopt(struct sock *sk, int optname, char __user *optval,

			    int __user *optlen);
@@ -16,8 +17,7 @@ struct bpfilter_umh_ops { 
	struct umd_info info;

	/* since ip_getsockopt() can run in parallel, serialize access to umh */

	struct mutex lock;

	int (*sockopt)(struct sock *sk, int optname,

		       char __user *optval,

	int (*sockopt)(struct sock *sk, int optname, sockptr_t optval,

		       unsigned int optlen, bool is_set);

	int (*start)(void);

};

net/bpfilter/bpfilter_kern.c

+3 −3
Original line number Diff line number Diff line
@@ -60,17 +60,17 @@ stop: 
}



static int bpfilter_process_sockopt(struct sock *sk, int optname,

				    char __user *optval, unsigned int optlen,

				    sockptr_t optval, unsigned int optlen,

				    bool is_set)

{

	struct mbox_request req = {

		.is_set		= is_set,

		.pid		= current->pid,

		.cmd		= optname,

		.addr		= (uintptr_t)optval,

		.addr		= (uintptr_t)optval.user,

		.len		= optlen,

	};

	if (uaccess_kernel()) {

	if (uaccess_kernel() || sockptr_is_kernel(optval)) {

		pr_err("kernel access not supported\n");

		return -EFAULT;

	}

net/ipv4/bpfilter/sockopt.c

+4 −4
Original line number Diff line number Diff line
@@ -21,8 +21,7 @@ void bpfilter_umh_cleanup(struct umd_info *info) 
}

EXPORT_SYMBOL_GPL(bpfilter_umh_cleanup);



static int bpfilter_mbox_request(struct sock *sk, int optname,

				 char __user *optval,

static int bpfilter_mbox_request(struct sock *sk, int optname, sockptr_t optval,

				 unsigned int optlen, bool is_set)

{

	int err;
@@ -52,7 +51,7 @@ out: 
	return err;

}



int bpfilter_ip_set_sockopt(struct sock *sk, int optname, char __user *optval,

int bpfilter_ip_set_sockopt(struct sock *sk, int optname, sockptr_t optval,

			    unsigned int optlen)

{

	return bpfilter_mbox_request(sk, optname, optval, optlen, true);
@@ -66,7 +65,8 @@ int bpfilter_ip_get_sockopt(struct sock *sk, int optname, char __user *optval, 
	if (get_user(len, optlen))

		return -EFAULT;



	return bpfilter_mbox_request(sk, optname, optval, len, false);

	return bpfilter_mbox_request(sk, optname, USER_SOCKPTR(optval), len,

				     false);

}



static int __init bpfilter_sockopt_init(void)

net/ipv4/ip_sockglue.c

+2 −1
Original line number Diff line number Diff line
@@ -1414,7 +1414,8 @@ int ip_setsockopt(struct sock *sk, int level, 
#if IS_ENABLED(CONFIG_BPFILTER_UMH)

	if (optname >= BPFILTER_IPT_SO_SET_REPLACE &&

	    optname < BPFILTER_IPT_SET_MAX)

		err = bpfilter_ip_set_sockopt(sk, optname, optval, optlen);

		err = bpfilter_ip_set_sockopt(sk, optname, USER_SOCKPTR(optval),

					      optlen);

#endif

#ifdef CONFIG_NETFILTER

	/* we need to exclude all possible ENOPROTOOPTs except default case */

CRA Git | Maintained and supported by SUSTech CRA and CCSE