netdev - Re: [PATCH v3 2/2] net: sysctl: introduce sysctl SYSCTL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 19 Apr 2022 11:05:39 +0200
From:   Simon Horman <horms@...ge.net.au>
To:     xiangxia.m.yue@...il.com
Cc:     netdev@...r.kernel.org, Luis Chamberlain <mcgrof@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        Iurii Zaikin <yzaikin@...gle.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        David Ahern <dsahern@...nel.org>, Julian Anastasov <ja@....bg>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Jozsef Kadlecsik <kadlec@...filter.org>,
        Florian Westphal <fw@...len.de>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        Marc Kleine-Budde <mkl@...gutronix.de>,
        Lorenz Bauer <lmb@...udflare.com>,
        Akhmat Karakotov <hmukos@...dex-team.ru>
Subject: Re: [PATCH v3 2/2] net: sysctl: introduce sysctl SYSCTL_THREE

On Sat, Apr 16, 2022 at 12:39:12AM +0800, xiangxia.m.yue@...il.com wrote:
> From: Tonghao Zhang <xiangxia.m.yue@...il.com>
> 
> This patch introdues the SYSCTL_THREE.

...

> diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
> index 7d9cfc730bd4..5851c2a92c0d 100644
> --- a/fs/proc/proc_sysctl.c
> +++ b/fs/proc/proc_sysctl.c
> @@ -26,7 +26,7 @@ static const struct file_operations proc_sys_dir_file_operations;
>  static const struct inode_operations proc_sys_dir_operations;
>  
>  /* shared constants to be used in various sysctls */
> -const int sysctl_vals[] = { -1, 0, 1, 2, 4, 100, 200, 1000, 3000, INT_MAX, 65535 };
> +const int sysctl_vals[] = { 0, 1, 2, 3, 4, 100, 200, 1000, 3000, INT_MAX, 65535, -1 };
>  EXPORT_SYMBOL(sysctl_vals);
>  
>  const unsigned long sysctl_long_vals[] = { 0, 1, LONG_MAX };
> diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
> index 6353d6db69b2..80263f7cdb77 100644
> --- a/include/linux/sysctl.h
> +++ b/include/linux/sysctl.h
> @@ -38,10 +38,10 @@ struct ctl_table_header;
>  struct ctl_dir;
>  
>  /* Keep the same order as in fs/proc/proc_sysctl.c */
> -#define SYSCTL_NEG_ONE			((void *)&sysctl_vals[0])
> -#define SYSCTL_ZERO			((void *)&sysctl_vals[1])
> -#define SYSCTL_ONE			((void *)&sysctl_vals[2])
> -#define SYSCTL_TWO			((void *)&sysctl_vals[3])
> +#define SYSCTL_ZERO			((void *)&sysctl_vals[0])
> +#define SYSCTL_ONE			((void *)&sysctl_vals[1])
> +#define SYSCTL_TWO			((void *)&sysctl_vals[2])
> +#define SYSCTL_THREE			((void *)&sysctl_vals[3])
>  #define SYSCTL_FOUR			((void *)&sysctl_vals[4])
>  #define SYSCTL_ONE_HUNDRED		((void *)&sysctl_vals[5])
>  #define SYSCTL_TWO_HUNDRED		((void *)&sysctl_vals[6])
> @@ -51,6 +51,7 @@ struct ctl_dir;
>  
>  /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
>  #define SYSCTL_MAXOLDUID		((void *)&sysctl_vals[10])
> +#define SYSCTL_NEG_ONE			((void *)&sysctl_vals[11])
>  
>  extern const int sysctl_vals[];

...

> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index 7f645328b47f..efab2b06d373 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -1767,8 +1767,6 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs)
>  
>  #ifdef CONFIG_SYSCTL
>  
> -static int three = 3;
> -
>  static int
>  proc_do_defense_mode(struct ctl_table *table, int write,
>  		     void *buffer, size_t *lenp, loff_t *ppos)
> @@ -1977,7 +1975,7 @@ static struct ctl_table vs_vars[] = {
>  		.mode		= 0644,
>  		.proc_handler	= proc_dointvec_minmax,
>  		.extra1		= SYSCTL_ZERO,
> -		.extra2		= &three,
> +		.extra2		= SYSCTL_THREE,
>  	},
>  	{
>  		.procname	= "nat_icmp_send",

Subjectively, I'm ambivalent towards the merit of this patchset,
perhaps there is some justification for it that I missed.

Objectively, I don't see anything here that would break IPVS.

IPVS portion:

Reviewed-by: Simon Horman <horms@...ge.net.au>