seccomp: remove the 'sd' argument from __secure_computing()

After the previous changes 'sd' is always NULL.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://lore.kernel.org/r/20250128150313.GA15336@redhat.com
Signed-off-by: Kees Cook <kees@kernel.org>

diff --git a/arch/powerpc/kernel/ptrace/ptrace.c b/arch/powerpc/kernel/ptrace/ptrace.c
index 727ed4a1454513561102c74388c4b38998ea9dc5..c6997df632873d20f76ffad06b279d8964cffa0d 100644 (file)
--- a/arch/powerpc/kernel/ptrace/ptrace.c
+++ b/arch/powerpc/kernel/ptrace/ptrace.c
@@ -215,7 +215,7 @@ static int do_seccomp(struct pt_regs *regs)
         * have already loaded -ENOSYS into r3, or seccomp has put
         * something else in r3 (via SECCOMP_RET_ERRNO/TRACE).
         */
-       if (__secure_computing(NULL))
+       if (__secure_computing())
                return -1;
 
        /*

diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index d55949071c30ec37e085ffa81bd3db3107c6924a..9b959972bf4a2257b0625d108490e14ebf6b52fd 100644 (file)
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h
@@ -22,13 +22,13 @@
 #include <linux/atomic.h>
 #include <asm/seccomp.h>
 
-extern int __secure_computing(const struct seccomp_data *sd);
+extern int __secure_computing(void);
 
 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
 static inline int secure_computing(void)
 {
        if (unlikely(test_syscall_work(SECCOMP)))
-               return  __secure_computing(NULL);
+               return  __secure_computing();
        return 0;
 }
 #else
@@ -54,7 +54,7 @@ static inline int secure_computing(void) { return 0; }
 #else
 static inline void secure_computing_strict(int this_syscall) { return; }
 #endif
-static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
+static inline int __secure_computing(void) { return 0; }
 
 static inline long prctl_get_seccomp(void)
 {

diff --git a/kernel/entry/common.c b/kernel/entry/common.c
index e33691d5adf7aab4af54cf2bf8e5ef5bd6ad1424..20154572ede94fffdecd325ddad379629d0b1ccb 100644 (file)
--- a/kernel/entry/common.c
+++ b/kernel/entry/common.c
@@ -49,7 +49,7 @@ long syscall_trace_enter(struct pt_regs *regs, long syscall,
 
        /* Do seccomp after ptrace, to catch any tracer changes. */
        if (work & SYSCALL_WORK_SECCOMP) {
-               ret = __secure_computing(NULL);
+               ret = __secure_computing();
                if (ret == -1L)
                        return ret;
        }

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 3231f63d93d89e5492a4ddad051f0f7e4d5e9c3c..e90cbdf3516676b6031576727ad3f0a4884528cc 100644 (file)
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1072,10 +1072,9 @@ void secure_computing_strict(int this_syscall)
        else
                BUG();
 }
-int __secure_computing(const struct seccomp_data *sd)
+int __secure_computing(void)
 {
-       int this_syscall = sd ? sd->nr :
-               syscall_get_nr(current, current_pt_regs());
+       int this_syscall = syscall_get_nr(current, current_pt_regs());
 
        secure_computing_strict(this_syscall);
        return 0;
@@ -1365,7 +1364,7 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
 }
 #endif
 
-int __secure_computing(const struct seccomp_data *sd)
+int __secure_computing(void)
 {
        int mode = current->seccomp.mode;
        int this_syscall;
@@ -1374,15 +1373,14 @@ int __secure_computing(const struct seccomp_data *sd)
            unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
                return 0;
 
-       this_syscall = sd ? sd->nr :
-               syscall_get_nr(current, current_pt_regs());
+       this_syscall = syscall_get_nr(current, current_pt_regs());
 
        switch (mode) {
        case SECCOMP_MODE_STRICT:
                __secure_computing_strict(this_syscall);  /* may call do_exit */
                return 0;
        case SECCOMP_MODE_FILTER:
-               return __seccomp_filter(this_syscall, sd, false);
+               return __seccomp_filter(this_syscall, NULL, false);
        /* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
        case SECCOMP_MODE_DEAD:
                WARN_ON_ONCE(1);