Hi James,
Today's linux-next merge of the security tree got a conflict in
kernel/seccomp.c between commit 7ae457c1e5b4 ("net: filter: split
'struct sk_filter' into socket and bpf parts") from the net-next tree
and commits c8bee430dc52 ("seccomp: split filter prep from check and
apply") and 3ba2530cc06e ("seccomp: allow mode setting across threads")
from the security tree.
I fixed it up (I hope - see below) and can carry the fix as necessary
(no action is required).
--
Cheers,
Stephen Rothwell sfr@xxxxxxxxxxxxxxxx
diff --cc kernel/seccomp.c
index 2f3fa2cc2eac,74f460179171..000000000000
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@@ -186,8 -191,8 +191,8 @@@ static u32 seccomp_run_filters(int sysc
* All filters in the list are evaluated and the lowest BPF return
* value always takes priority (ignoring the DATA).
*/
- for (f = current->seccomp.filter; f; f = f->prev) {
+ for (; f; f = f->prev) {
- u32 cur_ret = SK_RUN_FILTER(f->prog, (void *)&sd);
+ u32 cur_ret = BPF_PROG_RUN(f->prog, (void *)&sd);
if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
ret = cur_ret;
@@@ -273,15 -408,9 +408,9 @@@ static struct seccomp_filter *seccomp_p
atomic_set(&filter->usage, 1);
filter->prog->len = new_len;
- sk_filter_select_runtime(filter->prog);
+ bpf_prog_select_runtime(filter->prog);
- /*
- * If there is an existing filter, make it the prev and don't drop its
- * task reference.
- */
- filter->prev = current->seccomp.filter;
- current->seccomp.filter = filter;
- return 0;
+ return filter;
free_filter_prog:
kfree(filter->prog);
@@@ -329,6 -506,14 +506,14 @@@ void get_seccomp_filter(struct task_str
atomic_inc(&orig->usage);
}
+ static inline void seccomp_filter_free(struct seccomp_filter *filter)
+ {
+ if (filter) {
- sk_filter_free(filter->prog);
++ bpf_prog_free(filter->prog);
+ kfree(filter);
+ }
+ }
+
/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
void put_seccomp_filter(struct task_struct *tsk)
{
Attachment:
signature.asc
Description: PGP signature
