linux-next: manual merge of the security tree with the net-next tree

Hi James,

Today's linux-next merge of the security tree got a conflict in
kernel/seccomp.c between commit 7ae457c1e5b4 ("net: filter: split
'struct sk_filter' into socket and bpf parts") from the net-next tree
and commits c8bee430dc52 ("seccomp: split filter prep from check and
apply") and 3ba2530cc06e ("seccomp: allow mode setting across threads")
from the security tree.

I fixed it up (I hope - see below) and can carry the fix as necessary
(no action is required).

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au

diff --cc kernel/seccomp.c
index 2f3fa2cc2eac,74f460179171..000000000000

--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c

@@@ -186,8 -191,8 +191,8 @@@ static u32 seccomp_run_filters(int sysc
  	 * All filters in the list are evaluated and the lowest BPF return
  	 * value always takes priority (ignoring the DATA).
  	 */
- 	for (f = current->seccomp.filter; f; f = f->prev) {
+ 	for (; f; f = f->prev) {
 -		u32 cur_ret = SK_RUN_FILTER(f->prog, (void *)&sd);
 +		u32 cur_ret = BPF_PROG_RUN(f->prog, (void *)&sd);
  
  		if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
  			ret = cur_ret;
@@@ -273,15 -408,9 +408,9 @@@ static struct seccomp_filter *seccomp_p
  	atomic_set(&filter->usage, 1);
  	filter->prog->len = new_len;
  
 -	sk_filter_select_runtime(filter->prog);
 +	bpf_prog_select_runtime(filter->prog);
  
- 	/*
- 	 * If there is an existing filter, make it the prev and don't drop its
- 	 * task reference.
- 	 */
- 	filter->prev = current->seccomp.filter;
- 	current->seccomp.filter = filter;
- 	return 0;
+ 	return filter;
  
  free_filter_prog:
  	kfree(filter->prog);
@@@ -329,6 -506,14 +506,14 @@@ void get_seccomp_filter(struct task_str
  	atomic_inc(&orig->usage);
  }
  
+ static inline void seccomp_filter_free(struct seccomp_filter *filter)
+ {
+ 	if (filter) {
 -		sk_filter_free(filter->prog);
++		bpf_prog_free(filter->prog);
+ 		kfree(filter);
+ 	}
+ }
+ 
  /* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
  void put_seccomp_filter(struct task_struct *tsk)
  {

On Sun, Aug 3, 2014 at 11:26 PM, Stephen Rothwell [off-list ref] wrote:

Hi James,

Today's linux-next merge of the security tree got a conflict in
kernel/seccomp.c between commit 7ae457c1e5b4 ("net: filter: split
'struct sk_filter' into socket and bpf parts") from the net-next tree
and commits c8bee430dc52 ("seccomp: split filter prep from check and
apply") and 3ba2530cc06e ("seccomp: allow mode setting across threads")
from the security tree.

I fixed it up (I hope - see below) and can carry the fix as necessary
(no action is required).

Looks correct. Thanks.
Will double check during merge window.