iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bpf: net: Change do_ipv6_setsockopt() to use the sockopt's lock_sock() and capable()

Browse Source 
Similar to the earlier patch that avoids sk_setsockopt() from
taking sk lock and doing capable test when called by bpf.  This patch
changes do_ipv6_setsockopt() to use the sockopt_{lock,release}_sock()
and sockopt_[ns_]capable().

Reviewed-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/r/20220817061744.4176893-1-kafai@fb.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Martin KaFai Lau 2022-08-16 23:17:44 -07:00 committed by Alexei Starovoitov
parent 1df055d3c7
commit 40cd308ea5
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
net/ipv6/ipv6_sockglue.c
View File

@ -327,7 +327,7 @@ static int ipv6_set_opt_hdr(struct sock *sk, int optname, sockptr_t optval,
int err; int err;
/* hop-by-hop / destination options are privileged option */ /* hop-by-hop / destination options are privileged option */
if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW)) if (optname != IPV6_RTHDR && !sockopt_ns_capable(net->user_ns, CAP_NET_RAW))
return -EPERM; return -EPERM;
/* remove any sticky options header with a zero option /* remove any sticky options header with a zero option
@ -417,7 +417,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
if (needs_rtnl) if (needs_rtnl)
rtnl_lock(); rtnl_lock();
lock_sock(sk); sockopt_lock_sock(sk);
switch (optname) { switch (optname) {
@ -634,8 +634,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
break; break;
case IPV6_TRANSPARENT: case IPV6_TRANSPARENT:
if (valbool && !ns_capable(net->user_ns, CAP_NET_RAW) && if (valbool && !sockopt_ns_capable(net->user_ns, CAP_NET_RAW) &&
!ns_capable(net->user_ns, CAP_NET_ADMIN)) { !sockopt_ns_capable(net->user_ns, CAP_NET_ADMIN)) {
retv = -EPERM; retv = -EPERM;
break; break;
} }
@ -946,7 +946,7 @@ done:
case IPV6_IPSEC_POLICY: case IPV6_IPSEC_POLICY:
case IPV6_XFRM_POLICY: case IPV6_XFRM_POLICY:
retv = -EPERM; retv = -EPERM;
if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) if (!sockopt_ns_capable(net->user_ns, CAP_NET_ADMIN))
break; break;
retv = xfrm_user_policy(sk, optname, optval, optlen); retv = xfrm_user_policy(sk, optname, optval, optlen);
break; break;
@ -994,14 +994,14 @@ done:
break; break;
} }
release_sock(sk); sockopt_release_sock(sk);
if (needs_rtnl) if (needs_rtnl)
rtnl_unlock(); rtnl_unlock();
return retv; return retv;
e_inval: e_inval:
release_sock(sk); sockopt_release_sock(sk);
if (needs_rtnl) if (needs_rtnl)
rtnl_unlock(); rtnl_unlock();
return -EINVAL; return -EINVAL;