[RFC PATCH v1 09/30] sysctl: net: use sysctl_field in xfrm sysctls

[Alexey Gladkov]

The xfrm sysctl table is cloned for each network namespace only to
replace data pointers with per-net storage. The descriptors are
otherwise static, while unprivileged network namespaces still register
an empty table to preserve the existing visibility rule.

Use sysctl_field accessors to derive the per-net storage from the
registration context instead. This keeps the xfrm descriptors const and
removes the per-net ctl_table allocation and free path without changing
which sysctls are exposed.

Signed-off-by: Alexey Gladkov <legion@xxxxxxxxxx>
---
 net/xfrm/xfrm_sysctl.c | 77 ++++++++++++++++--------------------------
 1 file changed, 30 insertions(+), 47 deletions(-)

diff --git a/net/xfrm/xfrm_sysctl.c b/net/xfrm/xfrm_sysctl.c
index ca003e8a0376..1097dd4dc0dc 100644
--- a/net/xfrm/xfrm_sysctl.c
+++ b/net/xfrm/xfrm_sysctl.c
@@ -1,6 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/sysctl.h>
-#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/xfrm.h>
 
@@ -13,71 +12,55 @@ static void __net_init __xfrm_sysctl_init(struct net *net)
 }
 
 #ifdef CONFIG_SYSCTL
-static struct ctl_table xfrm_table[] = {
-	{
-		.procname	= "xfrm_aevent_etime",
-		.maxlen		= sizeof(u32),
-		.mode		= 0644,
-		.proc_handler	= proc_douintvec
-	},
-	{
-		.procname	= "xfrm_aevent_rseqth",
-		.maxlen		= sizeof(u32),
-		.mode		= 0644,
-		.proc_handler	= proc_douintvec
-	},
-	{
-		.procname	= "xfrm_larval_drop",
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec
-	},
-	{
-		.procname	= "xfrm_acq_expires",
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec
-	},
+#define XFRM_UINT_DATA(name)						\
+static unsigned int *xfrm_ ## name ## _data(const struct sysctl_context *ctx) \
+{									\
+	return &ctx->ns.net_ns->xfrm.name;				\
+}
+
+#define XFRM_INT_DATA(name)						\
+static int *xfrm_ ## name ## _data(const struct sysctl_context *ctx)	\
+{									\
+	return &ctx->ns.net_ns->xfrm.name;				\
+}
+
+XFRM_UINT_DATA(sysctl_aevent_etime)
+XFRM_UINT_DATA(sysctl_aevent_rseqth)
+XFRM_INT_DATA(sysctl_larval_drop)
+XFRM_INT_DATA(sysctl_acq_expires)
+
+static const struct sysctl_field xfrm_table[] = {
+	SYSCTL_FIELD_UINT("xfrm_aevent_etime", 0644, xfrm_sysctl_aevent_etime_data),
+	SYSCTL_FIELD_UINT("xfrm_aevent_rseqth", 0644, xfrm_sysctl_aevent_rseqth_data),
+	SYSCTL_FIELD_INT("xfrm_larval_drop", 0644, xfrm_sysctl_larval_drop_data),
+	SYSCTL_FIELD_INT("xfrm_acq_expires", 0644, xfrm_sysctl_acq_expires_data),
 };
 
 int __net_init xfrm_sysctl_init(struct net *net)
 {
-	struct ctl_table *table;
+	struct sysctl_context ctx = {
+		.ns.net_ns = net,
+	};
 	size_t table_size = ARRAY_SIZE(xfrm_table);
 
 	__xfrm_sysctl_init(net);
 
-	table = kmemdup(xfrm_table, sizeof(xfrm_table), GFP_KERNEL);
-	if (!table)
-		goto out_kmemdup;
-	table[0].data = &net->xfrm.sysctl_aevent_etime;
-	table[1].data = &net->xfrm.sysctl_aevent_rseqth;
-	table[2].data = &net->xfrm.sysctl_larval_drop;
-	table[3].data = &net->xfrm.sysctl_acq_expires;
-
 	/* Don't export sysctls to unprivileged users */
 	if (net->user_ns != &init_user_ns)
 		table_size = 0;
 
-	net->xfrm.sysctl_hdr = register_net_sysctl_sz(net, "net/core", table,
-						      table_size);
+	net->xfrm.sysctl_hdr = __register_sysctl_fields(&net->sysctls, "net/core",
+							xfrm_table, table_size,
+							&ctx, sizeof(ctx));
 	if (!net->xfrm.sysctl_hdr)
-		goto out_register;
-	return 0;
+		return -ENOMEM;
 
-out_register:
-	kfree(table);
-out_kmemdup:
-	return -ENOMEM;
+	return 0;
 }
 
 void __net_exit xfrm_sysctl_fini(struct net *net)
 {
-	const struct ctl_table *table;
-
-	table = net->xfrm.sysctl_hdr->ctl_table_arg;
 	unregister_net_sysctl_table(net->xfrm.sysctl_hdr);
-	kfree(table);
 }
 #else
 int __net_init xfrm_sysctl_init(struct net *net)
-- 
2.55.0