Commit 385a5dc9 authored by Joel Granados's avatar Joel Granados Committed by Luis Chamberlain
Browse files

netfilter: Update to register_net_sysctl_sz 



Move from register_net_sysctl to register_net_sysctl_sz for all the
netfilter related files. Do this while making sure to mirror the NULL
assignments with a table_size of zero for the unprivileged users.

We need to move to the new function in preparation for when we change
SIZE_MAX to ARRAY_SIZE() in the register_net_sysctl macro. Failing to do
so would erroneously allow ARRAY_SIZE() to be called on a pointer. We
hold off the SIZE_MAX to ARRAY_SIZE change until we have migrated all
the relevant net sysctl registering functions to register_net_sysctl_sz
in subsequent commits.

Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarJoel Granados <j.granados@samsung.com>
Signed-off-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
parent 7737e46d

net/bridge/br_netfilter_hooks.c

+2 −1
Original line number Diff line number Diff line
@@ -1135,7 +1135,8 @@ static int br_netfilter_sysctl_init_net(struct net *net) 


	br_netfilter_sysctl_default(brnet);



	brnet->ctl_hdr = register_net_sysctl(net, "net/bridge", table);

	brnet->ctl_hdr = register_net_sysctl_sz(net, "net/bridge", table,

						ARRAY_SIZE(brnf_table));

	if (!brnet->ctl_hdr) {

		if (!net_eq(net, &init_net))

			kfree(table);

net/ipv6/netfilter/nf_conntrack_reasm.c

+2 −1
Original line number Diff line number Diff line
@@ -87,7 +87,8 @@ static int nf_ct_frag6_sysctl_register(struct net *net) 
	table[2].data	= &nf_frag->fqdir->high_thresh;

	table[2].extra1	= &nf_frag->fqdir->low_thresh;



	hdr = register_net_sysctl(net, "net/netfilter", table);

	hdr = register_net_sysctl_sz(net, "net/netfilter", table,

				     ARRAY_SIZE(nf_ct_frag6_sysctl_table));

	if (hdr == NULL)

		goto err_reg;

net/netfilter/ipvs/ip_vs_ctl.c

+6 −2
Original line number Diff line number Diff line
@@ -4266,6 +4266,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) 
	struct net *net = ipvs->net;

	struct ctl_table *tbl;

	int idx, ret;

	size_t ctl_table_size = ARRAY_SIZE(vs_vars);



	atomic_set(&ipvs->dropentry, 0);

	spin_lock_init(&ipvs->dropentry_lock);
@@ -4282,8 +4283,10 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) 
			return -ENOMEM;



		/* Don't export sysctls to unprivileged users */

		if (net->user_ns != &init_user_ns)

		if (net->user_ns != &init_user_ns) {

			tbl[0].procname = NULL;

			ctl_table_size = 0;

		}

	} else

		tbl = vs_vars;

	/* Initialize sysctl defaults */
@@ -4353,7 +4356,8 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) 
#endif



	ret = -ENOMEM;

	ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);

	ipvs->sysctl_hdr = register_net_sysctl_sz(net, "net/ipv4/vs", tbl,

						  ctl_table_size);

	if (!ipvs->sysctl_hdr)

		goto err;

	ipvs->sysctl_tbl = tbl;

net/netfilter/ipvs/ip_vs_lblc.c

+7 −3
Original line number Diff line number Diff line
@@ -550,6 +550,7 @@ static struct ip_vs_scheduler ip_vs_lblc_scheduler = { 
static int __net_init __ip_vs_lblc_init(struct net *net)

{

	struct netns_ipvs *ipvs = net_ipvs(net);

	size_t vars_table_size = ARRAY_SIZE(vs_vars_table);



	if (!ipvs)

		return -ENOENT;
@@ -562,16 +563,19 @@ static int __net_init __ip_vs_lblc_init(struct net *net) 
			return -ENOMEM;



		/* Don't export sysctls to unprivileged users */

		if (net->user_ns != &init_user_ns)

		if (net->user_ns != &init_user_ns) {

			ipvs->lblc_ctl_table[0].procname = NULL;

			vars_table_size = 0;

		}



	} else

		ipvs->lblc_ctl_table = vs_vars_table;

	ipvs->sysctl_lblc_expiration = DEFAULT_EXPIRATION;

	ipvs->lblc_ctl_table[0].data = &ipvs->sysctl_lblc_expiration;



	ipvs->lblc_ctl_header =

		register_net_sysctl(net, "net/ipv4/vs", ipvs->lblc_ctl_table);

	ipvs->lblc_ctl_header = register_net_sysctl_sz(net, "net/ipv4/vs",

						       ipvs->lblc_ctl_table,

						       vars_table_size);

	if (!ipvs->lblc_ctl_header) {

		if (!net_eq(net, &init_net))

			kfree(ipvs->lblc_ctl_table);

net/netfilter/ipvs/ip_vs_lblcr.c

+7 −3
Original line number Diff line number Diff line
@@ -736,6 +736,7 @@ static struct ip_vs_scheduler ip_vs_lblcr_scheduler = 
static int __net_init __ip_vs_lblcr_init(struct net *net)

{

	struct netns_ipvs *ipvs = net_ipvs(net);

	size_t vars_table_size = ARRAY_SIZE(vs_vars_table);



	if (!ipvs)

		return -ENOENT;
@@ -748,15 +749,18 @@ static int __net_init __ip_vs_lblcr_init(struct net *net) 
			return -ENOMEM;



		/* Don't export sysctls to unprivileged users */

		if (net->user_ns != &init_user_ns)

		if (net->user_ns != &init_user_ns) {

			ipvs->lblcr_ctl_table[0].procname = NULL;

			vars_table_size = 0;

		}

	} else

		ipvs->lblcr_ctl_table = vs_vars_table;

	ipvs->sysctl_lblcr_expiration = DEFAULT_EXPIRATION;

	ipvs->lblcr_ctl_table[0].data = &ipvs->sysctl_lblcr_expiration;



	ipvs->lblcr_ctl_header =

		register_net_sysctl(net, "net/ipv4/vs", ipvs->lblcr_ctl_table);

	ipvs->lblcr_ctl_header = register_net_sysctl_sz(net, "net/ipv4/vs",

							ipvs->lblcr_ctl_table,

							vars_table_size);

	if (!ipvs->lblcr_ctl_header) {

		if (!net_eq(net, &init_net))

			kfree(ipvs->lblcr_ctl_table);