net: filter: let unattached filters use sock_fprog_kern

The sk_unattached_filter_create() API is used by BPF filters that
are not directly attached or related to sockets, and are used in
team, ptp, xt_bpf, cls_bpf, etc. As such all users do their own
internal managment of obtaining filter blocks and thus already
have them in kernel memory and set up before calling into
sk_unattached_filter_create(). As a result, due to __user annotation
in sock_fprog, sparse triggers false positives (incorrect type in
assignment [different address space]) when filters are set up before
passing them to sk_unattached_filter_create(). Therefore, let
sk_unattached_filter_create() API use sock_fprog_kern to overcome
this issue.

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 2 deletions

diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 16186965af97..13f64df2c710 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -160,7 +160,7 @@ static int cls_bpf_modify_existing(struct net *net, struct tcf_proto *tp,
 {
         struct sock_filter *bpf_ops, *bpf_old;
         struct tcf_exts exts;
-        struct sock_fprog tmp;
+        struct sock_fprog_kern tmp;
         struct sk_filter *fp, *fp_old;
         u16 bpf_size, bpf_len;
         u32 classid;
@@ -191,7 +191,7 @@ static int cls_bpf_modify_existing(struct net *net, struct tcf_proto *tp,
         memcpy(bpf_ops, nla_data(tb[TCA_BPF_OPS]), bpf_size);
 
         tmp.len = bpf_len;
-        tmp.filter = (struct sock_filter __user *) bpf_ops;
+        tmp.filter = bpf_ops;
 
         ret = sk_unattached_filter_create(&fp, &tmp);
         if (ret)