[RFC PATCH 29/39] neighbour: derive sysctl ownership independently of bounds

[wen.yang@linux.dev]

From: Wen Yang <wen.yang@linux.dev>

Derive neighbour parameters from backing storage instead of extra pointers.

Suggested-by: Joel Granados <joel.granados@kernel.org>
Signed-off-by: Wen Yang <wen.yang@linux.dev>
---
 include/net/neighbour.h |   3 ++
 net/core/neighbour.c    | 101 ++++++++++++++++++++++++----------------
 2 files changed, 64 insertions(+), 40 deletions(-)

diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 79a5a548a129..316e34e97fcc 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -420,6 +420,9 @@ void *neigh_seq_start(struct seq_file *, loff_t *, struct neigh_table *,
 void *neigh_seq_next(struct seq_file *, void *, loff_t *);
 void neigh_seq_stop(struct seq_file *, void *);
 
+/* For neighbour parameter entries, whose data points into parms->data. */
+struct neigh_parms *neigh_sysctl_parms(const struct ctl_table *ctl);
+
 int neigh_proc_dointvec(const struct ctl_table *ctl, int write,
 			void *buffer, size_t *lenp, loff_t *ppos);
 int neigh_proc_dointvec_jiffies(const struct ctl_table *ctl, int write,
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index d6e9c7c59a89..ab2559500134 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -3627,16 +3627,14 @@ void neigh_app_ns(struct neighbour *n)
 }
 
 #ifdef CONFIG_SYSCTL
-static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
-
 static int proc_unres_qlen(const struct ctl_table *ctl, int write,
 			   void *buffer, size_t *lenp, loff_t *ppos)
 {
 	int size, ret;
 	struct ctl_table tmp = *ctl;
 
-	tmp.extra1 = SYSCTL_ZERO;
-	tmp.extra2 = &unres_qlen_max;
+	tmp.min = 0;
+	tmp.max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
 	tmp.data = &size;
 
 	size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
@@ -3666,8 +3664,8 @@ static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
 
 static void neigh_proc_update(const struct ctl_table *ctl, int write)
 {
-	struct net_device *dev = ctl->extra1;
-	struct neigh_parms *p = ctl->extra2;
+	struct neigh_parms *p = neigh_sysctl_parms(ctl);
+	struct net_device *dev = p->dev;
 	struct net *net = neigh_parms_net(p);
 	int index = (int *) ctl->data - p->data;
 
@@ -3688,8 +3686,8 @@ static int neigh_proc_dointvec_zero_intmax(const struct ctl_table *ctl, int writ
 	struct ctl_table tmp = *ctl;
 	int ret;
 
-	tmp.extra1 = SYSCTL_ZERO;
-	tmp.extra2 = SYSCTL_INT_MAX;
+	tmp.min = 0;
+	tmp.max = INT_MAX;
 
 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 	neigh_proc_update(ctl, write);
@@ -3700,13 +3698,10 @@ static int neigh_proc_dointvec_ms_jiffies_positive(const struct ctl_table *ctl,
 						   void *buffer, size_t *lenp, loff_t *ppos)
 {
 	struct ctl_table tmp = *ctl;
-	int ret, min, max;
-
-	min = msecs_to_jiffies(NTBL_PARM_MS_MIN);
-	max = msecs_to_jiffies(NTBL_PARM_MS_MAX);
+	int ret;
 
-	tmp.extra1 = &min;
-	tmp.extra2 = &max;
+	tmp.min = msecs_to_jiffies(NTBL_PARM_MS_MIN);
+	tmp.max = msecs_to_jiffies(NTBL_PARM_MS_MAX);
 
 	ret = proc_dointvec_ms_jiffies_minmax(&tmp, write, buffer, lenp, ppos);
 	neigh_proc_update(ctl, write);
@@ -3764,7 +3759,7 @@ static int neigh_proc_base_reachable_time(const struct ctl_table *ctl, int write
 					  void *buffer, size_t *lenp,
 					  loff_t *ppos)
 {
-	struct neigh_parms *p = ctl->extra2;
+	struct neigh_parms *p = neigh_sysctl_parms(ctl);
 	int ret;
 
 	if (strcmp(ctl->procname, "base_reachable_time") == 0)
@@ -3784,35 +3779,31 @@ static int neigh_proc_base_reachable_time(const struct ctl_table *ctl, int write
 	return ret;
 }
 
-#define NEIGH_PARMS_DATA_OFFSET(index)	\
-	(&((struct neigh_parms *) 0)->data[index])
-
-#define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
+#define NEIGH_SYSCTL_ENTRY(attr, name, mval, proc) \
 	[NEIGH_VAR_ ## attr] = { \
 		.procname	= name, \
-		.data		= NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
 		.maxlen		= sizeof(int), \
 		.mode		= mval, \
 		.proc_handler	= proc, \
 	}
 
 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
-	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
+	NEIGH_SYSCTL_ENTRY(attr, name, 0644, neigh_proc_dointvec_zero_intmax)
 
 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
-	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
+	NEIGH_SYSCTL_ENTRY(attr, name, 0644, neigh_proc_dointvec_jiffies)
 
 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
-	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
+	NEIGH_SYSCTL_ENTRY(attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
 
 #define NEIGH_SYSCTL_MS_JIFFIES_POSITIVE_ENTRY(attr, name) \
-	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies_positive)
+	NEIGH_SYSCTL_ENTRY(attr, name, 0644, neigh_proc_dointvec_ms_jiffies_positive)
 
-#define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
-	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
+#define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, name) \
+	NEIGH_SYSCTL_ENTRY(attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
 
-#define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
-	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
+#define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, name) \
+	NEIGH_SYSCTL_ENTRY(attr, name, 0644, neigh_proc_dointvec_unres_qlen)
 
 static struct neigh_sysctl_table {
 	struct ctl_table_header *sysctl_header;
@@ -3834,9 +3825,9 @@ static struct neigh_sysctl_table {
 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
-		NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
-		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
-		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
+		NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, "unres_qlen"),
+		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, "retrans_time_ms"),
+		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, "base_reachable_time_ms"),
 		[NEIGH_VAR_GC_INTERVAL] = {
 			.procname	= "gc_interval",
 			.maxlen		= sizeof(int),
@@ -3847,29 +3838,61 @@ static struct neigh_sysctl_table {
 			.procname	= "gc_thresh1",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.extra1		= SYSCTL_ZERO,
-			.extra2		= SYSCTL_INT_MAX,
+			.min		= 0,
+			.max		= INT_MAX,
 			.proc_handler	= proc_dointvec_minmax,
 		},
 		[NEIGH_VAR_GC_THRESH2] = {
 			.procname	= "gc_thresh2",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.extra1		= SYSCTL_ZERO,
-			.extra2		= SYSCTL_INT_MAX,
+			.min		= 0,
+			.max		= INT_MAX,
 			.proc_handler	= proc_dointvec_minmax,
 		},
 		[NEIGH_VAR_GC_THRESH3] = {
 			.procname	= "gc_thresh3",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.extra1		= SYSCTL_ZERO,
-			.extra2		= SYSCTL_INT_MAX,
+			.min		= 0,
+			.max		= INT_MAX,
 			.proc_handler	= proc_dointvec_minmax,
 		},
 	},
 };
 
+static unsigned int neigh_sysctl_data_index(unsigned int index)
+{
+	switch (index) {
+	case NEIGH_VAR_QUEUE_LEN:
+		return NEIGH_VAR_QUEUE_LEN_BYTES;
+	case NEIGH_VAR_RETRANS_TIME_MS:
+		return NEIGH_VAR_RETRANS_TIME;
+	case NEIGH_VAR_BASE_REACHABLE_TIME_MS:
+		return NEIGH_VAR_BASE_REACHABLE_TIME;
+	default:
+		return index;
+	}
+}
+
+struct neigh_parms *neigh_sysctl_parms(const struct ctl_table *ctl)
+{
+	unsigned int i;
+
+	/* The aliases use the same storage as their non-millisecond entries.
+	 * Keep data pointing at that storage, including for ndisc handlers.
+	 */
+	for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
+		if (!strcmp(ctl->procname,
+			    neigh_sysctl_template.neigh_vars[i].procname))
+			return (struct neigh_parms *)
+				((char *)ctl->data - offsetof(struct neigh_parms, data) -
+				 neigh_sysctl_data_index(i) * sizeof(int));
+	}
+	return NULL;
+}
+EXPORT_SYMBOL(neigh_sysctl_parms);
+
 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
 			  proc_handler *handler)
 {
@@ -3885,9 +3908,7 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
 		goto err;
 
 	for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
-		t->neigh_vars[i].data += (long) p;
-		t->neigh_vars[i].extra1 = dev;
-		t->neigh_vars[i].extra2 = p;
+		t->neigh_vars[i].data = &p->data[neigh_sysctl_data_index(i)];
 	}
 
 	neigh_vars_size = ARRAY_SIZE(t->neigh_vars);
-- 
2.25.1