From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paul Moore <pmoore@redhat.com>
Subject: Re: [RFC PATCH v2 08/18] ipv6: Add ipv6_renew_options_kern() that accepts a kernel mem pointer.
Date: Sun, 07 Feb 2016 14:56:05 -0500
Message-ID: <2213519.F62jx6DkRd@sifl>
References: <1452246774-13241-9-git-send-email-huw@codeweavers.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7Bit
Cc: netdev@vger.kernel.org, linux-security-module@vger.kernel.org,
	selinux@tycho.nsa.gov
To: Huw Davies <huw@codeweavers.com>
Return-path: <linux-security-module-owner@vger.kernel.org>
In-Reply-To: <1452246774-13241-9-git-send-email-huw@codeweavers.com>
Sender: owner-linux-security-module@vger.kernel.org
List-Id: netdev.vger.kernel.org

On Friday, January 08, 2016 09:52:44 AM Huw Davies wrote:
> The functionality is equivalent to ipv6_renew_options() except
> that the newopt pointer is in kernel, not user, memory
> 
> The kernel memory implementation will be used by the CALIPSO network
> labelling engine, which needs to be able to set IPv6 hop-by-hop
> options.
> 
> Signed-off-by: Huw Davies <huw@codeweavers.com>

...

> +/**
> + * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
> + *
> + * @sk: sock from which to allocate memory
> + * @opt: original options
> + * @newtype: option type to replace in @opt
> + * @newopt: new option of type @newtype to replace (kernel-mem)
> + * @newoptlen: length of @newopt
> + *
> + * See ipv6_renew_options().  The difference is that @newopt is
> + * kernel memory, rather than user memory.
> + */
> +struct ipv6_txoptions *
> +ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
> +			int newtype, struct ipv6_opt_hdr *newopt,
> +			int newoptlen)
> +{
> +	struct ipv6_txoptions *ret_val;
> +	const mm_segment_t old_fs = get_fs();
> +
> +	set_fs(KERNEL_DS);
> +	ret_val = ipv6_renew_options(sk, opt, newtype,
> +				     (struct ipv6_opt_hdr __user *)newopt,
> +				     newoptlen);
> +	set_fs(old_fs);
> +	return ret_val;
> +}

I should preface this by saying that I don't have a strong opinion on this 
either way, and given where the code lives it is really up to DaveM, but I 
wonder if it might be better to create ipv6_renew_options_kern() as the common 
helper function that is called by ipv6_renew_options().

-- 
paul moore
security @ redhat