Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

[thirdparty/kernel/linux.git] / net / netfilter / ipvs / ip_vs_ctl.c

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 143a341bbc0a4dbda5d802939fa52f54544096c5..b6d0dcf3a5c3458c0967f97e6ccffeca971aa066 100644 (file)
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -94,6 +94,7 @@ static void update_defense_level(struct netns_ipvs *ipvs)
 {
        struct sysinfo i;
        int availmem;
+       int amemthresh;
        int nomem;
        int to_change = -1;
 
@@ -105,7 +106,8 @@ static void update_defense_level(struct netns_ipvs *ipvs)
        /* si_swapinfo(&i); */
        /* availmem = availmem - (i.totalswap - i.freeswap); */
 
-       nomem = (availmem < ipvs->sysctl_amemthresh);
+       amemthresh = max(READ_ONCE(ipvs->sysctl_amemthresh), 0);
+       nomem = (availmem < amemthresh);
 
        local_bh_disable();
 
@@ -145,9 +147,8 @@ static void update_defense_level(struct netns_ipvs *ipvs)
                break;
        case 1:
                if (nomem) {
-                       ipvs->drop_rate = ipvs->drop_counter
-                               = ipvs->sysctl_amemthresh /
-                               (ipvs->sysctl_amemthresh-availmem);
+                       ipvs->drop_counter = amemthresh / (amemthresh - availmem);
+                       ipvs->drop_rate = ipvs->drop_counter;
                        ipvs->sysctl_drop_packet = 2;
                } else {
                        ipvs->drop_rate = 0;
@@ -155,9 +156,8 @@ static void update_defense_level(struct netns_ipvs *ipvs)
                break;
        case 2:
                if (nomem) {
-                       ipvs->drop_rate = ipvs->drop_counter
-                               = ipvs->sysctl_amemthresh /
-                               (ipvs->sysctl_amemthresh-availmem);
+                       ipvs->drop_counter = amemthresh / (amemthresh - availmem);
+                       ipvs->drop_rate = ipvs->drop_counter;
                } else {
                        ipvs->drop_rate = 0;
                        ipvs->sysctl_drop_packet = 1;
@@ -2263,7 +2263,6 @@ static struct ctl_table vs_vars[] = {
                .proc_handler   = proc_dointvec,
        },
 #endif
-       { }
 };
 
 #endif
@@ -4270,6 +4269,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
        struct ctl_table *tbl;
        int idx, ret;
        size_t ctl_table_size = ARRAY_SIZE(vs_vars);
+       bool unpriv = net->user_ns != &init_user_ns;
 
        atomic_set(&ipvs->dropentry, 0);
        spin_lock_init(&ipvs->dropentry_lock);
@@ -4284,12 +4284,6 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
                tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
                if (tbl == NULL)
                        return -ENOMEM;
-
-               /* Don't export sysctls to unprivileged users */
-               if (net->user_ns != &init_user_ns) {
-                       tbl[0].procname = NULL;
-                       ctl_table_size = 0;
-               }
        } else
                tbl = vs_vars;
        /* Initialize sysctl defaults */
@@ -4315,10 +4309,17 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
        ipvs->sysctl_sync_ports = 1;
        tbl[idx++].data = &ipvs->sysctl_sync_ports;
        tbl[idx++].data = &ipvs->sysctl_sync_persist_mode;
+
        ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
+
        ipvs->sysctl_sync_sock_size = 0;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
+
        tbl[idx++].data = &ipvs->sysctl_cache_bypass;
        tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
        tbl[idx++].data = &ipvs->sysctl_sloppy_tcp;
@@ -4341,15 +4342,22 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
        tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
        tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
        tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
+
        ipvs->sysctl_run_estimation = 1;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx].extra2 = ipvs;
        tbl[idx++].data = &ipvs->sysctl_run_estimation;
 
        ipvs->est_cpulist_valid = 0;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx].extra2 = ipvs;
        tbl[idx++].data = &ipvs->sysctl_est_cpulist;
 
        ipvs->sysctl_est_nice = IPVS_EST_NICE;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx].extra2 = ipvs;
        tbl[idx++].data = &ipvs->sysctl_est_nice;