Re: [PATCH V2] net: Allow xt_owner in any user namespace

[ebiederm@xmission.com (Eric W. Biederman)]

Florian Westphal <fw@strlen.de> writes:

> Kevin Cernekee <cernekee@chromium.org> wrote:
>> @@ -35,6 +63,7 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
>>  	const struct xt_owner_match_info *info = par->matchinfo;
>>  	const struct file *filp;
>>  	struct sock *sk = skb_to_full_sk(skb);
>> +	const struct net *net;
>>  
>>  	if (sk == NULL || sk->sk_socket == NULL)
>>  		return (info->match ^ info->invert) == 0;
>> @@ -50,9 +79,10 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
>>  		return ((info->match ^ info->invert) &
>>  		       (XT_OWNER_UID | XT_OWNER_GID)) == 0;
>>  
>> +	net = sock_net(skb->sk);
>
> I think you need to use sock_net(sk) as skb_to_full_sk(skb) can return something
> other than skb->sk.

Actually this should be "par->net".  That did not exist a few years ago
when the patch was written but it does now, and that should simplify
things a little bit, and remove any guess work or uncertainty.

Eric