Hello,On Mon, 31 Jul 2023, Joel Granados wrote: > Move from register_net_sysctl to register_net_sysctl_sz for all the > netfilter related files. Do this while making sure to mirror the NULL > assignments with a table_size of zero for the unprivileged users. > > We need to move to the new function in preparation for when we change > SIZE_MAX to ARRAY_SIZE() in the register_net_sysctl macro. Failing to do > so would erroneously allow ARRAY_SIZE() to be called on a pointer. We > hold off the SIZE_MAX to ARRAY_SIZE change until we have migrated all > the relevant net sysctl registering functions to register_net_sysctl_sz > in subsequent commits. > > Signed-off-by: Joel Granados <[email protected]> The IPVS part in net/netfilter/ipvs/ looks good to me, thanks! Acked-by: Julian Anastasov <[email protected]> > --- > net/bridge/br_netfilter_hooks.c | 3 ++- > net/ipv6/netfilter/nf_conntrack_reasm.c | 3 ++- > net/netfilter/ipvs/ip_vs_ctl.c | 8 ++++++-- > net/netfilter/ipvs/ip_vs_lblc.c | 10 +++++++--- > net/netfilter/ipvs/ip_vs_lblcr.c | 10 +++++++--- > net/netfilter/nf_conntrack_standalone.c | 4 +++- > net/netfilter/nf_log.c | 7 ++++--- > 7 files changed, 31 insertions(+), 14 deletions(-) > ... > --- a/net/netfilter/ipvs/ip_vs_ctl.c > +++ b/net/netfilter/ipvs/ip_vs_ctl.c > @@ -4266,6 +4266,7 @@ static int __net_init > ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) > struct net *net = ipvs->net; > struct ctl_table *tbl; > int idx, ret; > + size_t ctl_table_size = ARRAY_SIZE(vs_vars); > > atomic_set(&ipvs->dropentry, 0); > spin_lock_init(&ipvs->dropentry_lock); > @@ -4282,8 +4283,10 @@ static int __net_init > ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) > return -ENOMEM; > > /* Don't export sysctls to unprivileged users */ > - if (net->user_ns != &init_user_ns) > + if (net->user_ns != &init_user_ns) { > tbl[0].procname = NULL; > + ctl_table_size = 0; > + } > } else > tbl = vs_vars; > /* Initialize sysctl defaults */ > @@ -4353,7 +4356,8 @@ static int __net_init > ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) > #endif > > ret = -ENOMEM; > - ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl); > + ipvs->sysctl_hdr = register_net_sysctl_sz(net, "net/ipv4/vs", tbl, > + ctl_table_size); > if (!ipvs->sysctl_hdr) > goto err; > ipvs->sysctl_tbl = tbl; > diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c > index 1b87214d385e..cf78ba4ce5ff 100644 > --- a/net/netfilter/ipvs/ip_vs_lblc.c > +++ b/net/netfilter/ipvs/ip_vs_lblc.c > @@ -550,6 +550,7 @@ static struct ip_vs_scheduler ip_vs_lblc_scheduler = { > static int __net_init __ip_vs_lblc_init(struct net *net) > { > struct netns_ipvs *ipvs = net_ipvs(net); > + size_t vars_table_size = ARRAY_SIZE(vs_vars_table); > > if (!ipvs) > return -ENOENT; > @@ -562,16 +563,19 @@ static int __net_init __ip_vs_lblc_init(struct net *net) > return -ENOMEM; > > /* Don't export sysctls to unprivileged users */ > - if (net->user_ns != &init_user_ns) > + if (net->user_ns != &init_user_ns) { > ipvs->lblc_ctl_table[0].procname = NULL; > + vars_table_size = 0; > + } > > } else > ipvs->lblc_ctl_table = vs_vars_table; > ipvs->sysctl_lblc_expiration = DEFAULT_EXPIRATION; > ipvs->lblc_ctl_table[0].data = &ipvs->sysctl_lblc_expiration; > > - ipvs->lblc_ctl_header = > - register_net_sysctl(net, "net/ipv4/vs", ipvs->lblc_ctl_table); > + ipvs->lblc_ctl_header = register_net_sysctl_sz(net, "net/ipv4/vs", > + ipvs->lblc_ctl_table, > + vars_table_size); > if (!ipvs->lblc_ctl_header) { > if (!net_eq(net, &init_net)) > kfree(ipvs->lblc_ctl_table); > diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c > b/net/netfilter/ipvs/ip_vs_lblcr.c > index ad8f5fea6d3a..9eddf118b40e 100644 > --- a/net/netfilter/ipvs/ip_vs_lblcr.c > +++ b/net/netfilter/ipvs/ip_vs_lblcr.c > @@ -736,6 +736,7 @@ static struct ip_vs_scheduler ip_vs_lblcr_scheduler = > static int __net_init __ip_vs_lblcr_init(struct net *net) > { > struct netns_ipvs *ipvs = net_ipvs(net); > + size_t vars_table_size = ARRAY_SIZE(vs_vars_table); > > if (!ipvs) > return -ENOENT; > @@ -748,15 +749,18 @@ static int __net_init __ip_vs_lblcr_init(struct net > *net) > return -ENOMEM; > > /* Don't export sysctls to unprivileged users */ > - if (net->user_ns != &init_user_ns) > + if (net->user_ns != &init_user_ns) { > ipvs->lblcr_ctl_table[0].procname = NULL; > + vars_table_size = 0; > + } > } else > ipvs->lblcr_ctl_table = vs_vars_table; > ipvs->sysctl_lblcr_expiration = DEFAULT_EXPIRATION; > ipvs->lblcr_ctl_table[0].data = &ipvs->sysctl_lblcr_expiration; > > - ipvs->lblcr_ctl_header = > - register_net_sysctl(net, "net/ipv4/vs", ipvs->lblcr_ctl_table); > + ipvs->lblcr_ctl_header = register_net_sysctl_sz(net, "net/ipv4/vs", > + ipvs->lblcr_ctl_table, > + vars_table_size); > if (!ipvs->lblcr_ctl_header) { > if (!net_eq(net, &init_net)) > kfree(ipvs->lblcr_ctl_table); Regards -- Julian Anastasov <[email protected]>
