github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-01 11:03:43 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfilter: nft_meta: no longer acquire sk_callback_lock in nft_meta_get_eval_skugid()

Browse Source 
After commit 983512f3a8 ("net: Drop the lock in skb_may_tx_timestamp()")
from Sebastian Andrzej Siewior, apply the same logic in
nft_meta_get_eval_skugid() to avoid touching sk->sk_callback_lock.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Eric Dumazet 2026-02-26 08:29:22 +00:00 committed by Florian Westphal
parent cdec942ac2
commit afc2125de7
1 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
net/netfilter/nft_meta.c
View File

@ -131,33 +131,36 @@ nft_meta_get_eval_skugid(enum nft_meta_keys key,
u32 *dest,
const struct nft_pktinfo *pkt)
{
struct sock *sk = skb_to_full_sk(pkt->skb);
struct socket *sock;
const struct sock *sk = skb_to_full_sk(pkt->skb);
const struct socket *sock;
const struct file *file;
if (!sk || !sk_fullsock(sk) || !net_eq(nft_net(pkt), sock_net(sk)))
return false;
read_lock_bh(&sk->sk_callback_lock);
sock = sk->sk_socket;
if (!sock || !sock->file) {
read_unlock_bh(&sk->sk_callback_lock);
/* The sk pointer remains valid as long as the skb is. The sk_socket and
* file pointer may become NULL if the socket is closed. Both structures
* (including file->cred) are RCU freed which means they can be accessed
* within a RCU read section.
*/
sock = READ_ONCE(sk->sk_socket);
file = sock ? READ_ONCE(sock->file) : NULL;
if (!file)
return false;
}
switch (key) {
case NFT_META_SKUID:
*dest = from_kuid_munged(sock_net(sk)->user_ns,
sock->file->f_cred->fsuid);
file->f_cred->fsuid);
break;
case NFT_META_SKGID:
*dest = from_kgid_munged(sock_net(sk)->user_ns,
sock->file->f_cred->fsgid);
file->f_cred->fsgid);
break;
default:
break;
}
read_unlock_bh(&sk->sk_callback_lock);
return true;
}