From: Wen Yang <wen.yang@linux.dev>

nf_log keeps the netns in extra2 and encodes the protocol family into
extra1 as an integer cast to a pointer. Both share the fields that hold
numeric bounds elsewhere, and the family encoding is a type error
waiting to happen.

Carry {net, family} in priv, leave data NULL, and keep maxlen as the
proc_dostring() name length. The family becomes a real field.

Signed-off-by: Wen Yang <wen.yang@linux.dev>
---
 net/netfilter/nf_log.c | 67 ++++++++++++++++++++++++------------------
 1 file changed, 38 insertions(+), 29 deletions(-)

diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index f1d3649e3fc6..8163774ad4d4 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -420,8 +420,18 @@ static const struct seq_operations nflog_seq_ops = {
 #endif /* PROC_FS */
 
 #ifdef CONFIG_SYSCTL
+struct nf_log_sysctl_context {
+	struct net *net;
+	unsigned int family;
+};
+
+struct nf_log_sysctl_table {
+	struct ctl_table vars[NFPROTO_NUMPROTO];
+	struct nf_log_sysctl_context context[NFPROTO_NUMPROTO];
+};
+
 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
-static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO];
+static struct nf_log_sysctl_table nf_log_sysctl_table;
 static struct ctl_table_header *nf_log_sysctl_fhdr;
 
 static struct ctl_table nf_log_sysctl_ftable[] = {
@@ -440,8 +450,9 @@ static int nf_log_proc_dostring(const struct ctl_table *table, int write,
 	const struct nf_logger *logger;
 	char buf[NFLOGGER_NAME_LEN];
 	int r = 0;
-	int tindex = (unsigned long)table->extra1;
-	struct net *net = table->extra2;
+	const struct nf_log_sysctl_context *ctx = table->priv;
+	unsigned int tindex = ctx->family;
+	struct net *net = ctx->net;
 
 	if (write) {
 		struct ctl_table tmp = *table;
@@ -451,6 +462,7 @@ static int nf_log_proc_dostring(const struct ctl_table *table, int write,
 		 */
 		buf[0] = '\0';
 		tmp.data = buf;
+		tmp.maxlen = sizeof(buf);
 		r = proc_dostring(&tmp, write, buffer, lenp, ppos);
 		if (r)
 			return r;
@@ -471,6 +483,7 @@ static int nf_log_proc_dostring(const struct ctl_table *table, int write,
 		struct ctl_table tmp = *table;
 
 		tmp.data = buf;
+		tmp.maxlen = sizeof(buf);
 		mutex_lock(&nf_log_mutex);
 		logger = nft_log_dereference(net->nf.nf_loggers[tindex]);
 		if (!logger)
@@ -486,42 +499,38 @@ static int nf_log_proc_dostring(const struct ctl_table *table, int write,
 
 static int netfilter_log_sysctl_init(struct net *net)
 {
+	struct nf_log_sysctl_table *t = &nf_log_sysctl_table;
 	int i;
-	struct ctl_table *table;
 
-	table = nf_log_sysctl_table;
 	if (!net_eq(net, &init_net)) {
-		table = kmemdup(nf_log_sysctl_table,
-				 sizeof(nf_log_sysctl_table),
-				 GFP_KERNEL_ACCOUNT);
-		if (!table)
-			goto err_alloc;
+		t = kmemdup(t, sizeof(*t), GFP_KERNEL_ACCOUNT);
+		if (!t)
+			return -ENOMEM;
 	} else {
 		for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) {
-			snprintf(nf_log_sysctl_fnames[i],
-				 3, "%d", i);
-			nf_log_sysctl_table[i].procname	=
-				nf_log_sysctl_fnames[i];
-			nf_log_sysctl_table[i].maxlen = NFLOGGER_NAME_LEN;
-			nf_log_sysctl_table[i].mode = 0644;
-			nf_log_sysctl_table[i].proc_handler =
-				nf_log_proc_dostring;
-			nf_log_sysctl_table[i].extra1 =
-				(void *)(unsigned long) i;
+			snprintf(nf_log_sysctl_fnames[i], 3, "%d", i);
+			t->vars[i].procname = nf_log_sysctl_fnames[i];
+			t->vars[i].maxlen = NFLOGGER_NAME_LEN;
+			t->vars[i].mode = 0644;
+			t->vars[i].proc_handler = nf_log_proc_dostring;
 		}
 		nf_log_sysctl_fhdr = register_net_sysctl(net, "net/netfilter",
 							 nf_log_sysctl_ftable);
 		if (!nf_log_sysctl_fhdr)
-			goto err_freg;
+			return -ENOMEM;
 	}
 
-	for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
-		table[i].extra2 = net;
+	for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) {
+		t->context[i].net = net;
+		t->context[i].family = i;
+		t->vars[i].data = NULL;
+		t->vars[i].priv = &t->context[i];
+	}
 
 	net->nf.nf_log_dir_header = register_net_sysctl_sz(net,
 							   "net/netfilter/nf_log",
-							   table,
-							   ARRAY_SIZE(nf_log_sysctl_table));
+							   t->vars,
+							   ARRAY_SIZE(t->vars));
 	if (!net->nf.nf_log_dir_header)
 		goto err_reg;
 
@@ -529,22 +538,22 @@ static int netfilter_log_sysctl_init(struct net *net)
 
 err_reg:
 	if (!net_eq(net, &init_net))
-		kfree(table);
+		kfree(t);
 	else
 		unregister_net_sysctl_table(nf_log_sysctl_fhdr);
-err_freg:
-err_alloc:
 	return -ENOMEM;
 }
 
 static void netfilter_log_sysctl_exit(struct net *net)
 {
 	const struct ctl_table *table;
+	const struct nf_log_sysctl_table *t;
 
 	table = net->nf.nf_log_dir_header->ctl_table_arg;
+	t = container_of(table, struct nf_log_sysctl_table, vars[0]);
 	unregister_net_sysctl_table(net->nf.nf_log_dir_header);
 	if (!net_eq(net, &init_net))
-		kfree(table);
+		kfree(t);
 	else
 		unregister_net_sysctl_table(nf_log_sysctl_fhdr);
 }
-- 
2.25.1