netdev - linux-next: manual merge of the security tree with the net-next tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 4 Aug 2014 16:26:33 +1000
From:	Stephen Rothwell <sfr@...b.auug.org.au>
To:	James Morris <jmorris@...ei.org>,
	David Miller <davem@...emloft.net>, <netdev@...r.kernel.org>
Cc:	linux-next@...r.kernel.org, linux-kernel@...r.kernel.org,
	Alexei Starovoitov <ast@...mgrid.com>,
	Kees Cook <keescook@...omium.org>
Subject: linux-next: manual merge of the security tree with the net-next
 tree

Hi James,

Today's linux-next merge of the security tree got a conflict in
kernel/seccomp.c between commit 7ae457c1e5b4 ("net: filter: split
'struct sk_filter' into socket and bpf parts") from the net-next tree
and commits c8bee430dc52 ("seccomp: split filter prep from check and
apply") and 3ba2530cc06e ("seccomp: allow mode setting across threads")
from the security tree.

I fixed it up (I hope - see below) and can carry the fix as necessary
(no action is required).

-- 
Cheers,
Stephen Rothwell                    sfr@...b.auug.org.au

diff --cc kernel/seccomp.c
index 2f3fa2cc2eac,74f460179171..000000000000
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@@ -186,8 -191,8 +191,8 @@@ static u32 seccomp_run_filters(int sysc
  	 * All filters in the list are evaluated and the lowest BPF return
  	 * value always takes priority (ignoring the DATA).
  	 */
- 	for (f = current->seccomp.filter; f; f = f->prev) {
+ 	for (; f; f = f->prev) {
 -		u32 cur_ret = SK_RUN_FILTER(f->prog, (void *)&sd);
 +		u32 cur_ret = BPF_PROG_RUN(f->prog, (void *)&sd);
  
  		if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
  			ret = cur_ret;
@@@ -273,15 -408,9 +408,9 @@@ static struct seccomp_filter *seccomp_p
  	atomic_set(&filter->usage, 1);
  	filter->prog->len = new_len;
  
 -	sk_filter_select_runtime(filter->prog);
 +	bpf_prog_select_runtime(filter->prog);
  
- 	/*
- 	 * If there is an existing filter, make it the prev and don't drop its
- 	 * task reference.
- 	 */
- 	filter->prev = current->seccomp.filter;
- 	current->seccomp.filter = filter;
- 	return 0;
+ 	return filter;
  
  free_filter_prog:
  	kfree(filter->prog);
@@@ -329,6 -506,14 +506,14 @@@ void get_seccomp_filter(struct task_str
  	atomic_inc(&orig->usage);
  }
  
+ static inline void seccomp_filter_free(struct seccomp_filter *filter)
+ {
+ 	if (filter) {
 -		sk_filter_free(filter->prog);
++		bpf_prog_free(filter->prog);
+ 		kfree(filter);
+ 	}
+ }
+ 
  /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
  void put_seccomp_filter(struct task_struct *tsk)
  {

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)