From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B81FDC001DF for ; Tue, 1 Aug 2023 06:12:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231378AbjHAGMM (ORCPT ); Tue, 1 Aug 2023 02:12:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33284 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231359AbjHAGML (ORCPT ); Tue, 1 Aug 2023 02:12:11 -0400 Received: from mg.ssi.bg (mg.ssi.bg [193.238.174.37]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B7E61BCF; Mon, 31 Jul 2023 23:12:07 -0700 (PDT) Received: from mg.bb.i.ssi.bg (localhost [127.0.0.1]) by mg.bb.i.ssi.bg (Proxmox) with ESMTP id 053B317D48; Tue, 1 Aug 2023 09:12:06 +0300 (EEST) Received: from ink.ssi.bg (ink.ssi.bg [193.238.174.40]) by mg.bb.i.ssi.bg (Proxmox) with ESMTPS id DF87917D40; Tue, 1 Aug 2023 09:12:05 +0300 (EEST) Received: from ja.ssi.bg (unknown [213.16.62.126]) by ink.ssi.bg (Postfix) with ESMTPSA id D57A13C043A; Tue, 1 Aug 2023 09:11:40 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=ssi.bg; s=ink; t=1690870305; bh=K3ToJDSb0mjMB1NLV0BUwfRmPEJudUn9AtuMI5luR6U=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=g8VQ+wTIFGtpegn5u/tW44R2fuNOJ5mdhEOWERlo2uGAwt4jdYY1YoeeDuqFVo4U0 aNfo6ZYRdJcjGbVx6zImrYA50NgX00UwUU7zEkwQHrQkNmmicTuRpjV7FrGXxh9JhJ dK2ADIy7PUVpdMu+utC6V/dK7/xavRUlvurILIL0= Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by ja.ssi.bg (8.17.1/8.17.1) with ESMTP id 3716BQUG027447; Tue, 1 Aug 2023 09:11:27 +0300 Date: Tue, 1 Aug 2023 09:11:26 +0300 (EEST) From: Julian Anastasov To: Joel Granados cc: mcgrof@kernel.org, Catalin Marinas , Iurii Zaikin , Jozsef Kadlecsik , Sven Schnelle , Marcelo Ricardo Leitner , Steffen Klassert , Kees Cook , "D. Wythe" , mptcp@lists.linux.dev, Jakub Kicinski , Vasily Gorbik , Paolo Abeni , coreteam@netfilter.org, Jan Karcher , Alexander Aring , Will Deacon , Stefan Schmidt , Matthieu Baerts , bridge@lists.linux-foundation.org, linux-arm-kernel@lists.infradead.org, Joerg Reuter , David Ahern , netfilter-devel@vger.kernel.org, Wen Gu , linux-kernel@vger.kernel.org, Santosh Shilimkar , linux-wpan@vger.kernel.org, lvs-devel@vger.kernel.org, Karsten Graul , Miquel Raynal , Herbert Xu , linux-sctp@vger.kernel.org, Tony Lu , Pablo Neira Ayuso , Ralf Baechle , Florian Westphal , willy@infradead.org, Heiko Carstens , "David S. Miller" , linux-rdma@vger.kernel.org, Roopa Prabhu , Alexander Gordeev , Simon Horman , Mat Martineau , josh@joshtriplett.org, Christian Borntraeger , Eric Dumazet , linux-hams@vger.kernel.org, Wenjia Zhang , linux-fsdevel@vger.kernel.org, linux-s390@vger.kernel.org, Xin Long , Nikolay Aleksandrov , netdev@vger.kernel.org, rds-devel@oss.oracle.com, Joel Granados Subject: Re: [PATCH v2 10/14] netfilter: Update to register_net_sysctl_sz In-Reply-To: <20230731071728.3493794-11-j.granados@samsung.com> Message-ID: References: <20230731071728.3493794-1-j.granados@samsung.com> <20230731071728.3493794-11-j.granados@samsung.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Precedence: bulk List-ID: X-Mailing-List: linux-wpan@vger.kernel.org Hello, On Mon, 31 Jul 2023, Joel Granados wrote: > Move from register_net_sysctl to register_net_sysctl_sz for all the > netfilter related files. Do this while making sure to mirror the NULL > assignments with a table_size of zero for the unprivileged users. > > We need to move to the new function in preparation for when we change > SIZE_MAX to ARRAY_SIZE() in the register_net_sysctl macro. Failing to do > so would erroneously allow ARRAY_SIZE() to be called on a pointer. We > hold off the SIZE_MAX to ARRAY_SIZE change until we have migrated all > the relevant net sysctl registering functions to register_net_sysctl_sz > in subsequent commits. > > Signed-off-by: Joel Granados The IPVS part in net/netfilter/ipvs/ looks good to me, thanks! Acked-by: Julian Anastasov > --- > net/bridge/br_netfilter_hooks.c | 3 ++- > net/ipv6/netfilter/nf_conntrack_reasm.c | 3 ++- > net/netfilter/ipvs/ip_vs_ctl.c | 8 ++++++-- > net/netfilter/ipvs/ip_vs_lblc.c | 10 +++++++--- > net/netfilter/ipvs/ip_vs_lblcr.c | 10 +++++++--- > net/netfilter/nf_conntrack_standalone.c | 4 +++- > net/netfilter/nf_log.c | 7 ++++--- > 7 files changed, 31 insertions(+), 14 deletions(-) > ... > --- a/net/netfilter/ipvs/ip_vs_ctl.c > +++ b/net/netfilter/ipvs/ip_vs_ctl.c > @@ -4266,6 +4266,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) > struct net *net = ipvs->net; > struct ctl_table *tbl; > int idx, ret; > + size_t ctl_table_size = ARRAY_SIZE(vs_vars); > > atomic_set(&ipvs->dropentry, 0); > spin_lock_init(&ipvs->dropentry_lock); > @@ -4282,8 +4283,10 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) > return -ENOMEM; > > /* Don't export sysctls to unprivileged users */ > - if (net->user_ns != &init_user_ns) > + if (net->user_ns != &init_user_ns) { > tbl[0].procname = NULL; > + ctl_table_size = 0; > + } > } else > tbl = vs_vars; > /* Initialize sysctl defaults */ > @@ -4353,7 +4356,8 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) > #endif > > ret = -ENOMEM; > - ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl); > + ipvs->sysctl_hdr = register_net_sysctl_sz(net, "net/ipv4/vs", tbl, > + ctl_table_size); > if (!ipvs->sysctl_hdr) > goto err; > ipvs->sysctl_tbl = tbl; > diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c > index 1b87214d385e..cf78ba4ce5ff 100644 > --- a/net/netfilter/ipvs/ip_vs_lblc.c > +++ b/net/netfilter/ipvs/ip_vs_lblc.c > @@ -550,6 +550,7 @@ static struct ip_vs_scheduler ip_vs_lblc_scheduler = { > static int __net_init __ip_vs_lblc_init(struct net *net) > { > struct netns_ipvs *ipvs = net_ipvs(net); > + size_t vars_table_size = ARRAY_SIZE(vs_vars_table); > > if (!ipvs) > return -ENOENT; > @@ -562,16 +563,19 @@ static int __net_init __ip_vs_lblc_init(struct net *net) > return -ENOMEM; > > /* Don't export sysctls to unprivileged users */ > - if (net->user_ns != &init_user_ns) > + if (net->user_ns != &init_user_ns) { > ipvs->lblc_ctl_table[0].procname = NULL; > + vars_table_size = 0; > + } > > } else > ipvs->lblc_ctl_table = vs_vars_table; > ipvs->sysctl_lblc_expiration = DEFAULT_EXPIRATION; > ipvs->lblc_ctl_table[0].data = &ipvs->sysctl_lblc_expiration; > > - ipvs->lblc_ctl_header = > - register_net_sysctl(net, "net/ipv4/vs", ipvs->lblc_ctl_table); > + ipvs->lblc_ctl_header = register_net_sysctl_sz(net, "net/ipv4/vs", > + ipvs->lblc_ctl_table, > + vars_table_size); > if (!ipvs->lblc_ctl_header) { > if (!net_eq(net, &init_net)) > kfree(ipvs->lblc_ctl_table); > diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c > index ad8f5fea6d3a..9eddf118b40e 100644 > --- a/net/netfilter/ipvs/ip_vs_lblcr.c > +++ b/net/netfilter/ipvs/ip_vs_lblcr.c > @@ -736,6 +736,7 @@ static struct ip_vs_scheduler ip_vs_lblcr_scheduler = > static int __net_init __ip_vs_lblcr_init(struct net *net) > { > struct netns_ipvs *ipvs = net_ipvs(net); > + size_t vars_table_size = ARRAY_SIZE(vs_vars_table); > > if (!ipvs) > return -ENOENT; > @@ -748,15 +749,18 @@ static int __net_init __ip_vs_lblcr_init(struct net *net) > return -ENOMEM; > > /* Don't export sysctls to unprivileged users */ > - if (net->user_ns != &init_user_ns) > + if (net->user_ns != &init_user_ns) { > ipvs->lblcr_ctl_table[0].procname = NULL; > + vars_table_size = 0; > + } > } else > ipvs->lblcr_ctl_table = vs_vars_table; > ipvs->sysctl_lblcr_expiration = DEFAULT_EXPIRATION; > ipvs->lblcr_ctl_table[0].data = &ipvs->sysctl_lblcr_expiration; > > - ipvs->lblcr_ctl_header = > - register_net_sysctl(net, "net/ipv4/vs", ipvs->lblcr_ctl_table); > + ipvs->lblcr_ctl_header = register_net_sysctl_sz(net, "net/ipv4/vs", > + ipvs->lblcr_ctl_table, > + vars_table_size); > if (!ipvs->lblcr_ctl_header) { > if (!net_eq(net, &init_net)) > kfree(ipvs->lblcr_ctl_table); Regards -- Julian Anastasov