[PATCH 2/3] seccomp: change return type of seccomp_get_filter to int
From: Tycho Andersen
Date: Fri Sep 28 2018 - 11:47:30 EST
As Jann pointed out in another thread, ptrace_requiest() returns an int, so
it makes sense for seccomp_get_filter() to return an int as well. The
return type of seccomp_get_filter() is bounded by the BPF_MAXINSNS check in
seccomp_prepare_filter(), so this conversion is safe.
Signed-off-by: Tycho Andersen <tycho@xxxxxxxx>
Reported-by: Jann Horn <jannh@xxxxxxxxxx>
CC: Kees Cook <keescook@xxxxxxxxxxxx>
CC: Andy Lutomirski <luto@xxxxxxxxxxxxxx>
---
include/linux/seccomp.h | 6 +++---
kernel/seccomp.c | 6 +++---
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index af972549a7b4..8429bdda947a 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h
@@ -94,13 +94,13 @@ static inline void get_seccomp_filter(struct task_struct *tsk)
#endif /* CONFIG_SECCOMP_FILTER */
#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
-extern long seccomp_get_filter(struct task_struct *task,
+extern int seccomp_get_filter(struct task_struct *task,
unsigned long filter_off, void __user *data);
extern int seccomp_get_metadata(struct task_struct *task,
unsigned long filter_off, void __user *data);
#else
-static inline long seccomp_get_filter(struct task_struct *task,
- unsigned long n, void __user *data)
+static inline int seccomp_get_filter(struct task_struct *task,
+ unsigned long n, void __user *data)
{
return -EINVAL;
}
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 9f3721849747..ef80dd19f268 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1030,12 +1030,12 @@ static struct seccomp_filter *get_nth_filter(struct task_struct *task,
return filter;
}
-long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
- void __user *data)
+int seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
+ void __user *data)
{
struct seccomp_filter *filter;
struct sock_fprog_kern *fprog;
- long ret;
+ int ret;
if (!capable(CAP_SYS_ADMIN) ||
current->seccomp.mode != SECCOMP_MODE_DISABLED) {
--
2.17.1