As Jann pointed out in another thread, ptrace_requiest() returns an int, so it makes sense for seccomp_get_filter() to return an int as well. The return type of seccomp_get_filter() is bounded by the BPF_MAXINSNS check in seccomp_prepare_filter(), so this conversion is safe.
Signed-off-by: Tycho Andersen <[email protected]> Reported-by: Jann Horn <[email protected]> CC: Kees Cook <[email protected]> CC: Andy Lutomirski <[email protected]> --- include/linux/seccomp.h | 6 +++--- kernel/seccomp.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h index af972549a7b4..8429bdda947a 100644 --- a/include/linux/seccomp.h +++ b/include/linux/seccomp.h @@ -94,13 +94,13 @@ static inline void get_seccomp_filter(struct task_struct *tsk) #endif /* CONFIG_SECCOMP_FILTER */ #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) -extern long seccomp_get_filter(struct task_struct *task, +extern int seccomp_get_filter(struct task_struct *task, unsigned long filter_off, void __user *data); extern int seccomp_get_metadata(struct task_struct *task, unsigned long filter_off, void __user *data); #else -static inline long seccomp_get_filter(struct task_struct *task, - unsigned long n, void __user *data) +static inline int seccomp_get_filter(struct task_struct *task, + unsigned long n, void __user *data) { return -EINVAL; } diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 9f3721849747..ef80dd19f268 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -1030,12 +1030,12 @@ static struct seccomp_filter *get_nth_filter(struct task_struct *task, return filter; } -long seccomp_get_filter(struct task_struct *task, unsigned long filter_off, - void __user *data) +int seccomp_get_filter(struct task_struct *task, unsigned long filter_off, + void __user *data) { struct seccomp_filter *filter; struct sock_fprog_kern *fprog; - long ret; + int ret; if (!capable(CAP_SYS_ADMIN) || current->seccomp.mode != SECCOMP_MODE_DISABLED) { -- 2.17.1
