Commit 1df055d3 authored by Martin KaFai Lau's avatar Martin KaFai Lau Committed by Alexei Starovoitov
Browse files

bpf: net: Change do_ip_setsockopt() to use the sockopt's lock_sock() and capable() 



Similar to the earlier patch that avoids sk_setsockopt() from
taking sk lock and doing capable test when called by bpf.  This patch
changes do_ip_setsockopt() to use the sockopt_{lock,release}_sock()
and sockopt_[ns_]capable().

Reviewed-by: default avatarStanislav Fomichev <sdf@google.com>
Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/r/20220817061737.4176402-1-kafai@fb.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent cb388e7e

net/ipv4/ip_sockglue.c

+6 −6
Original line number Diff line number Diff line
@@ -944,7 +944,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, int optname, 
	err = 0;

	if (needs_rtnl)

		rtnl_lock();

	lock_sock(sk);

	sockopt_lock_sock(sk);



	switch (optname) {

	case IP_OPTIONS:
@@ -1333,14 +1333,14 @@ static int do_ip_setsockopt(struct sock *sk, int level, int optname, 
	case IP_IPSEC_POLICY:

	case IP_XFRM_POLICY:

		err = -EPERM;

		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

		if (!sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

			break;

		err = xfrm_user_policy(sk, optname, optval, optlen);

		break;



	case IP_TRANSPARENT:

		if (!!val && !ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&

		    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {

		if (!!val && !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&

		    !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {

			err = -EPERM;

			break;

		}
@@ -1368,13 +1368,13 @@ static int do_ip_setsockopt(struct sock *sk, int level, int optname, 
		err = -ENOPROTOOPT;

		break;

	}

	release_sock(sk);

	sockopt_release_sock(sk);

	if (needs_rtnl)

		rtnl_unlock();

	return err;



e_inval:

	release_sock(sk);

	sockopt_release_sock(sk);

	if (needs_rtnl)

		rtnl_unlock();

	return -EINVAL;