netfilter: switch nf_setsockopt to sockptr_t

Pass a sockptr_t to prepare for set_fs-less handling of the kernel
pointer from bpf-cgroup.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 711b4d4486f042862dd6730f866fd9076f461a55..0101747de54936b9d1a0ba25e676f74610394856 100644 (file)
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -13,6 +13,7 @@
 #include <linux/static_key.h>
 #include <linux/netfilter_defs.h>
 #include <linux/netdevice.h>
+#include <linux/sockptr.h>
 #include <net/net_namespace.h>
 
 static inline int NF_DROP_GETERR(int verdict)
@@ -163,7 +164,8 @@ struct nf_sockopt_ops {
        /* Non-inclusive ranges: use 0/0/NULL to never get called. */
        int set_optmin;
        int set_optmax;
-       int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
+       int (*set)(struct sock *sk, int optval, sockptr_t arg,
+                  unsigned int len);
        int get_optmin;
        int get_optmax;
        int (*get)(struct sock *sk, int optval, void __user *user, int *len);
@@ -338,7 +340,7 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
 }
 
 /* Call setsockopt() */
-int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
+int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, sockptr_t opt,
                  unsigned int len);
 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
                  int *len);

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 12f8929667bf4345646faa19f9d37de9af3e3685..d35173e803d3fe7136ed1080214d08dcc6da6815 100644 (file)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1063,14 +1063,13 @@ free_counterstmp:
 }
 
 /* replace the table */
-static int do_replace(struct net *net, const void __user *user,
-                     unsigned int len)
+static int do_replace(struct net *net, sockptr_t arg, unsigned int len)
 {
        int ret, countersize;
        struct ebt_table_info *newinfo;
        struct ebt_replace tmp;
 
-       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+       if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
                return -EFAULT;
 
        if (len != sizeof(tmp) + tmp.entries_size)
@@ -1286,12 +1285,11 @@ free_tmp:
        return ret;
 }
 
-static int update_counters(struct net *net, const void __user *user,
-                           unsigned int len)
+static int update_counters(struct net *net, sockptr_t arg, unsigned int len)
 {
        struct ebt_replace hlp;
 
-       if (copy_from_user(&hlp, user, sizeof(hlp)))
+       if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
                return -EFAULT;
 
        if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
@@ -2079,7 +2077,7 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
 
 
 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
-                                           void __user *user, unsigned int len)
+                                            sockptr_t arg, unsigned int len)
 {
        struct compat_ebt_replace tmp;
        int i;
@@ -2087,7 +2085,7 @@ static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
        if (len < sizeof(tmp))
                return -EINVAL;
 
-       if (copy_from_user(&tmp, user, sizeof(tmp)))
+       if (copy_from_sockptr(&tmp, arg, sizeof(tmp)))
                return -EFAULT;
 
        if (len != sizeof(tmp) + tmp.entries_size)
@@ -2114,8 +2112,7 @@ static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
        return 0;
 }
 
-static int compat_do_replace(struct net *net, void __user *user,
-                            unsigned int len)
+static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
 {
        int ret, i, countersize, size64;
        struct ebt_table_info *newinfo;
@@ -2123,10 +2120,10 @@ static int compat_do_replace(struct net *net, void __user *user,
        struct ebt_entries_buf_state state;
        void *entries_tmp;
 
-       ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
+       ret = compat_copy_ebt_replace_from_user(&tmp, arg, len);
        if (ret) {
                /* try real handler in case userland supplied needed padding */
-               if (ret == -EINVAL && do_replace(net, user, len) == 0)
+               if (ret == -EINVAL && do_replace(net, arg, len) == 0)
                        ret = 0;
                return ret;
        }
@@ -2217,17 +2214,17 @@ out_unlock:
        goto free_entries;
 }
 
-static int compat_update_counters(struct net *net, void __user *user,
+static int compat_update_counters(struct net *net, sockptr_t arg,
                                  unsigned int len)
 {
        struct compat_ebt_replace hlp;
 
-       if (copy_from_user(&hlp, user, sizeof(hlp)))
+       if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
                return -EFAULT;
 
        /* try real handler in case userland supplied needed padding */
        if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
-               return update_counters(net, user, len);
+               return update_counters(net, arg, len);
 
        return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
                                  hlp.num_counters, len);
@@ -2368,7 +2365,7 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        return ret;
 }
 
-static int do_ebt_set_ctl(struct sock *sk, int cmd, void __user *user,
+static int do_ebt_set_ctl(struct sock *sk, int cmd, sockptr_t arg,
                unsigned int len)
 {
        struct net *net = sock_net(sk);
@@ -2381,18 +2378,18 @@ static int do_ebt_set_ctl(struct sock *sk, int cmd, void __user *user,
        case EBT_SO_SET_ENTRIES:
 #ifdef CONFIG_COMPAT
                if (in_compat_syscall())
-                       ret = compat_do_replace(net, user, len);
+                       ret = compat_do_replace(net, arg, len);
                else
 #endif
-                       ret = do_replace(net, user, len);
+                       ret = do_replace(net, arg, len);
                break;
        case EBT_SO_SET_COUNTERS:
 #ifdef CONFIG_COMPAT
                if (in_compat_syscall())
-                       ret = compat_update_counters(net, user, len);
+                       ret = compat_update_counters(net, arg, len);
                else
 #endif
-                       ret = update_counters(net, user, len);
+                       ret = update_counters(net, arg, len);
                break;
        default:
                ret = -EINVAL;

diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 7d7ae2dd69b8adfeb5b954f34c85ace146a7d825..7d51ab608fb3f10ba4c6a9176c186e61e664e997 100644 (file)
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1332,7 +1332,8 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use
        /* we need to exclude all possible ENOPROTOOPTs except default case */
        if (err == -ENOPROTOOPT && optname != DSO_LINKINFO &&
            optname != DSO_STREAM && optname != DSO_SEQPACKET)
-               err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
+               err = nf_setsockopt(sk, PF_DECnet, optname,
+                                   USER_SOCKPTR(optval), optlen);
 #endif
 
        return err;

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index da933f99b5d517a5026f835c7b5a4772f77e25f4..42befbf12846c08f3cde6e7a538641385a22e02c 100644 (file)
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1422,7 +1422,8 @@ int ip_setsockopt(struct sock *sk, int level,
                        optname != IP_IPSEC_POLICY &&
                        optname != IP_XFRM_POLICY &&
                        !ip_mroute_opt(optname))
-               err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
+               err = nf_setsockopt(sk, PF_INET, optname, USER_SOCKPTR(optval),
+                                   optlen);
 #endif
        return err;
 }

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 6d24b686c7f00afc6c3a9c412637f6fd2eb71daf..f5b26ef1782001a81d36fd169a2dfd58ad5dcd81 100644 (file)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0-only
+
 /*
  * Packet matching code for ARP packets.
  *
@@ -947,8 +947,7 @@ static int __do_replace(struct net *net, const char *name,
        return ret;
 }
 
-static int do_replace(struct net *net, const void __user *user,
-                     unsigned int len)
+static int do_replace(struct net *net, sockptr_t arg, unsigned int len)
 {
        int ret;
        struct arpt_replace tmp;
@@ -956,7 +955,7 @@ static int do_replace(struct net *net, const void __user *user,
        void *loc_cpu_entry;
        struct arpt_entry *iter;
 
-       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+       if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
                return -EFAULT;
 
        /* overflow check */
@@ -972,8 +971,8 @@ static int do_replace(struct net *net, const void __user *user,
                return -ENOMEM;
 
        loc_cpu_entry = newinfo->entries;
-       if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
-                          tmp.size) != 0) {
+       sockptr_advance(arg, sizeof(tmp));
+       if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
                ret = -EFAULT;
                goto free_newinfo;
        }
@@ -1244,8 +1243,7 @@ out_unlock:
        return ret;
 }
 
-static int compat_do_replace(struct net *net, void __user *user,
-                            unsigned int len)
+static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
 {
        int ret;
        struct compat_arpt_replace tmp;
@@ -1253,7 +1251,7 @@ static int compat_do_replace(struct net *net, void __user *user,
        void *loc_cpu_entry;
        struct arpt_entry *iter;
 
-       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+       if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
                return -EFAULT;
 
        /* overflow check */
@@ -1269,7 +1267,8 @@ static int compat_do_replace(struct net *net, void __user *user,
                return -ENOMEM;
 
        loc_cpu_entry = newinfo->entries;
-       if (copy_from_user(loc_cpu_entry, user + sizeof(tmp), tmp.size) != 0) {
+       sockptr_advance(arg, sizeof(tmp));
+       if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
                ret = -EFAULT;
                goto free_newinfo;
        }
@@ -1401,7 +1400,8 @@ static int compat_get_entries(struct net *net,
 }
 #endif
 
-static int do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+static int do_arpt_set_ctl(struct sock *sk, int cmd, sockptr_t arg,
+               unsigned int len)
 {
        int ret;
 
@@ -1412,14 +1412,14 @@ static int do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned
        case ARPT_SO_SET_REPLACE:
 #ifdef CONFIG_COMPAT
                if (in_compat_syscall())
-                       ret = compat_do_replace(sock_net(sk), user, len);
+                       ret = compat_do_replace(sock_net(sk), arg, len);
                else
 #endif
-                       ret = do_replace(sock_net(sk), user, len);
+                       ret = do_replace(sock_net(sk), arg, len);
                break;
 
        case ARPT_SO_SET_ADD_COUNTERS:
-               ret = do_add_counters(sock_net(sk), USER_SOCKPTR(user), len);
+               ret = do_add_counters(sock_net(sk), arg, len);
                break;
 
        default:

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 4697d09c98dc3ebe9357951bd3edc8a35306c403..f2a9680303d8c0e5e623b2aad1a66671fa28a47e 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1102,7 +1102,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 }
 
 static int
-do_replace(struct net *net, const void __user *user, unsigned int len)
+do_replace(struct net *net, sockptr_t arg, unsigned int len)
 {
        int ret;
        struct ipt_replace tmp;
@@ -1110,7 +1110,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
        void *loc_cpu_entry;
        struct ipt_entry *iter;
 
-       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+       if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
                return -EFAULT;
 
        /* overflow check */
@@ -1126,8 +1126,8 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
                return -ENOMEM;
 
        loc_cpu_entry = newinfo->entries;
-       if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
-                          tmp.size) != 0) {
+       sockptr_advance(arg, sizeof(tmp));
+       if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
                ret = -EFAULT;
                goto free_newinfo;
        }
@@ -1484,7 +1484,7 @@ out_unlock:
 }
 
 static int
-compat_do_replace(struct net *net, void __user *user, unsigned int len)
+compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
 {
        int ret;
        struct compat_ipt_replace tmp;
@@ -1492,7 +1492,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
        void *loc_cpu_entry;
        struct ipt_entry *iter;
 
-       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+       if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
                return -EFAULT;
 
        /* overflow check */
@@ -1508,8 +1508,8 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                return -ENOMEM;
 
        loc_cpu_entry = newinfo->entries;
-       if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
-                          tmp.size) != 0) {
+       sockptr_advance(arg, sizeof(tmp));
+       if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
                ret = -EFAULT;
                goto free_newinfo;
        }
@@ -1610,7 +1610,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
 #endif
 
 static int
-do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+do_ipt_set_ctl(struct sock *sk, int cmd, sockptr_t arg, unsigned int len)
 {
        int ret;
 
@@ -1621,14 +1621,14 @@ do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
        case IPT_SO_SET_REPLACE:
 #ifdef CONFIG_COMPAT
                if (in_compat_syscall())
-                       ret = compat_do_replace(sock_net(sk), user, len);
+                       ret = compat_do_replace(sock_net(sk), arg, len);
                else
 #endif
-                       ret = do_replace(sock_net(sk), user, len);
+                       ret = do_replace(sock_net(sk), arg, len);
                break;
 
        case IPT_SO_SET_ADD_COUNTERS:
-               ret = do_add_counters(sock_net(sk), USER_SOCKPTR(user), len);
+               ret = do_add_counters(sock_net(sk), arg, len);
                break;
 
        default:

diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 56a74707c6174117e0b1a75a3aec40329cfb9679..85892b35cff7b3be36ab1a5a3e56af597706d7d3 100644 (file)
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -996,7 +996,8 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname,
        /* we need to exclude all possible ENOPROTOOPTs except default case */
        if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY &&
                        optname != IPV6_XFRM_POLICY)
-               err = nf_setsockopt(sk, PF_INET6, optname, optval, optlen);
+               err = nf_setsockopt(sk, PF_INET6, optname, USER_SOCKPTR(optval),
+                                   optlen);
 #endif
        return err;
 }

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index a787aba30e2db73323241741cb08516c9448c784..1d52957a413f4ad0b68731f483a49b56e2242a0b 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1119,7 +1119,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 }
 
 static int
-do_replace(struct net *net, const void __user *user, unsigned int len)
+do_replace(struct net *net, sockptr_t arg, unsigned int len)
 {
        int ret;
        struct ip6t_replace tmp;
@@ -1127,7 +1127,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
        void *loc_cpu_entry;
        struct ip6t_entry *iter;
 
-       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+       if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
                return -EFAULT;
 
        /* overflow check */
@@ -1143,8 +1143,8 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
                return -ENOMEM;
 
        loc_cpu_entry = newinfo->entries;
-       if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
-                          tmp.size) != 0) {
+       sockptr_advance(arg, sizeof(tmp));
+       if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
                ret = -EFAULT;
                goto free_newinfo;
        }
@@ -1493,7 +1493,7 @@ out_unlock:
 }
 
 static int
-compat_do_replace(struct net *net, void __user *user, unsigned int len)
+compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
 {
        int ret;
        struct compat_ip6t_replace tmp;
@@ -1501,7 +1501,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
        void *loc_cpu_entry;
        struct ip6t_entry *iter;
 
-       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+       if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
                return -EFAULT;
 
        /* overflow check */
@@ -1517,8 +1517,8 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                return -ENOMEM;
 
        loc_cpu_entry = newinfo->entries;
-       if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
-                          tmp.size) != 0) {
+       sockptr_advance(arg, sizeof(tmp));
+       if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) {
                ret = -EFAULT;
                goto free_newinfo;
        }
@@ -1619,7 +1619,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
 #endif
 
 static int
-do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+do_ip6t_set_ctl(struct sock *sk, int cmd, sockptr_t arg, unsigned int len)
 {
        int ret;
 
@@ -1630,14 +1630,14 @@ do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
        case IP6T_SO_SET_REPLACE:
 #ifdef CONFIG_COMPAT
                if (in_compat_syscall())
-                       ret = compat_do_replace(sock_net(sk), user, len);
+                       ret = compat_do_replace(sock_net(sk), arg, len);
                else
 #endif
-                       ret = do_replace(sock_net(sk), user, len);
+                       ret = do_replace(sock_net(sk), arg, len);
                break;
 
        case IP6T_SO_SET_ADD_COUNTERS:
-               ret = do_add_counters(sock_net(sk), USER_SOCKPTR(user), len);
+               ret = do_add_counters(sock_net(sk), arg, len);
                break;
 
        default:

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 4af83f466dfc2cd0d0720d7b445bff87a2bcda72..bcac316addabe80dc5372bb8c45c1ee792132f63 100644 (file)
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2434,7 +2434,7 @@ static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
 }
 
 static int
-do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+do_ip_vs_set_ctl(struct sock *sk, int cmd, sockptr_t ptr, unsigned int len)
 {
        struct net *net = sock_net(sk);
        int ret;
@@ -2458,7 +2458,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                return -EINVAL;
        }
 
-       if (copy_from_user(arg, user, len) != 0)
+       if (copy_from_sockptr(arg, ptr, len) != 0)
                return -EFAULT;
 
        /* Handle daemons since they have another lock */

diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c
index 90469b1f628a8ee5a07797e8715396db7c7d0183..34afcd03b6f60ef02e3f8d767cedaf298b532add 100644 (file)
--- a/net/netfilter/nf_sockopt.c
+++ b/net/netfilter/nf_sockopt.c
@@ -89,7 +89,7 @@ out:
        return ops;
 }
 
-int nf_setsockopt(struct sock *sk, u_int8_t pf, int val, char __user *opt,
+int nf_setsockopt(struct sock *sk, u_int8_t pf, int val, sockptr_t opt,
                  unsigned int len)
 {
        struct nf_sockopt_ops *ops;