1 files changed, 41 insertions, 54 deletions

diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 962e3d543aa..fb9adc5d193 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -17,10 +17,10 @@
 #include <net/sock.h>
 #include <net/fib_rules.h>
 
-static const struct fib_kuid_range fib_kuid_range_unset = {
-	KUIDT_INIT(0),
-	KUIDT_INIT(~0),
-};
+#define uid_valid(uid) ((uid) != -1)
+#define uid_lte(a, b) ((a) <= (b))
+#define uid_eq(a, b) ((a) == (b))
+#define uid_gte(a, b) ((a) >= (b))
 
 int fib_default_rule_add(struct fib_rules_ops *ops,
 			 u32 pref, u32 table, u32 flags)
@@ -36,8 +36,9 @@ int fib_default_rule_add(struct fib_rules_ops *ops,
 	r->pref = pref;
 	r->table = table;
 	r->flags = flags;
+	r->uid_start = INVALID_UID;
+	r->uid_end = INVALID_UID;
 	r->fr_net = hold_net(ops->fro_net);
-	r->uid_range = fib_kuid_range_unset;
 
 	/* The lock is not required here, the list in unreacheable
 	 * at the moment this function is called */
@@ -185,32 +186,21 @@ void fib_rules_unregister(struct fib_rules_ops *ops)
 }
 EXPORT_SYMBOL_GPL(fib_rules_unregister);
 
-static int uid_range_set(struct fib_kuid_range *range)
+static inline uid_t fib_nl_uid(struct nlattr *nla)
 {
-	return uid_valid(range->start) && uid_valid(range->end);
+	return nla_get_u32(nla);
 }
 
-static struct fib_kuid_range nla_get_kuid_range(struct nlattr **tb)
+static int nla_put_uid(struct sk_buff *skb, int idx, uid_t uid)
 {
-	struct fib_rule_uid_range *in;
-	struct fib_kuid_range out;
-
-	in = (struct fib_rule_uid_range *)nla_data(tb[FRA_UID_RANGE]);
-
-	out.start = make_kuid(current_user_ns(), in->start);
-	out.end = make_kuid(current_user_ns(), in->end);
-
-	return out;
+	return nla_put_u32(skb, idx, uid);
 }
 
-static int nla_put_uid_range(struct sk_buff *skb, struct fib_kuid_range *range)
+static int fib_uid_range_match(struct flowi *fl, struct fib_rule *rule)
 {
-	struct fib_rule_uid_range out = {
-		from_kuid_munged(current_user_ns(), range->start),
-		from_kuid_munged(current_user_ns(), range->end)
-	};
-
-	return nla_put(skb, FRA_UID_RANGE, sizeof(out), &out);
+	return (!uid_valid(rule->uid_start) && !uid_valid(rule->uid_end)) ||
+	       (uid_gte(fl->flowi_uid, rule->uid_start) &&
+		uid_lte(fl->flowi_uid, rule->uid_end));
 }
 
 static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
@@ -227,8 +217,7 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
 	if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask)
 		goto out;
 
-	if (uid_lt(fl->flowi_uid, rule->uid_range.start) ||
-	    uid_gt(fl->flowi_uid, rule->uid_range.end))
+	if (!fib_uid_range_match(fl, rule))
 		goto out;
 
 	ret = ops->match(rule, fl, flags);
@@ -401,19 +390,17 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh)
 	} else if (rule->action == FR_ACT_GOTO)
 		goto errout_free;
 
-	if (tb[FRA_UID_RANGE]) {
-		if (current_user_ns() != net->user_ns) {
-			err = -EPERM;
-			goto errout_free;
+	/* UID start and end must either both be valid or both unspecified. */
+	rule->uid_start = rule->uid_end = INVALID_UID;
+	if (tb[FRA_UID_START] || tb[FRA_UID_END]) {
+		if (tb[FRA_UID_START] && tb[FRA_UID_END]) {
+			rule->uid_start = fib_nl_uid(tb[FRA_UID_START]);
+			rule->uid_end = fib_nl_uid(tb[FRA_UID_END]);
 		}
-
-		rule->uid_range = nla_get_kuid_range(tb);
-
-		if (!uid_range_set(&rule->uid_range) ||
-		    !uid_lte(rule->uid_range.start, rule->uid_range.end))
-			goto errout_free;
-	} else {
-		rule->uid_range = fib_kuid_range_unset;
+		if (!uid_valid(rule->uid_start) ||
+		    !uid_valid(rule->uid_end) ||
+		    !uid_lte(rule->uid_start, rule->uid_end))
+		goto errout_free;
 	}
 
 	err = ops->configure(rule, skb, frh, tb);
@@ -475,7 +462,6 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh)
 	struct fib_rules_ops *ops = NULL;
 	struct fib_rule *rule, *tmp;
 	struct nlattr *tb[FRA_MAX+1];
-	struct fib_kuid_range range;
 	int err = -EINVAL;
 
 	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh)))
@@ -495,14 +481,6 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh)
 	if (err < 0)
 		goto errout;
 
-	if (tb[FRA_UID_RANGE]) {
-		range = nla_get_kuid_range(tb);
-		if (!uid_range_set(&range))
-			goto errout;
-	} else {
-		range = fib_kuid_range_unset;
-	}
-
 	list_for_each_entry(rule, &ops->rules_list, list) {
 		if (frh->action && (frh->action != rule->action))
 			continue;
@@ -531,9 +509,12 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh)
 		    (rule->mark_mask != nla_get_u32(tb[FRA_FWMASK])))
 			continue;
 
-		if (uid_range_set(&range) &&
-		    (!uid_eq(rule->uid_range.start, range.start) ||
-		     !uid_eq(rule->uid_range.end, range.end)))
+		if (tb[FRA_UID_START] &&
+		    !uid_eq(rule->uid_start, fib_nl_uid(tb[FRA_UID_START])))
+			continue;
+
+		if (tb[FRA_UID_END] &&
+		    !uid_eq(rule->uid_end, fib_nl_uid(tb[FRA_UID_END])))
 			continue;
 
 		if (!ops->compare(rule, frh, tb))
@@ -593,7 +574,8 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
 			 + nla_total_size(4) /* FRA_TABLE */
 			 + nla_total_size(4) /* FRA_FWMARK */
 			 + nla_total_size(4) /* FRA_FWMASK */
-			 + nla_total_size(sizeof(struct fib_kuid_range));
+			 + nla_total_size(4) /* FRA_UID_START */
+			 + nla_total_size(4); /* FRA_UID_END */
 
 	if (ops->nlmsg_payload)
 		payload += ops->nlmsg_payload(rule);
@@ -647,10 +629,15 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
 	    ((rule->mark_mask || rule->mark) &&
 	     nla_put_u32(skb, FRA_FWMASK, rule->mark_mask)) ||
 	    (rule->target &&
-	     nla_put_u32(skb, FRA_GOTO, rule->target)) ||
-	    (uid_range_set(&rule->uid_range) &&
-	     nla_put_uid_range(skb, &rule->uid_range)))
+	     nla_put_u32(skb, FRA_GOTO, rule->target)))
 		goto nla_put_failure;
+
+	if (uid_valid(rule->uid_start))
+	     nla_put_uid(skb, FRA_UID_START, rule->uid_start);
+
+	if (uid_valid(rule->uid_end))
+	     nla_put_uid(skb, FRA_UID_END, rule->uid_end);
+
 	if (ops->fill(rule, skb, frh) < 0)
 		goto nla_put_failure;