Revert "ANDROID: Use sk_uid to replace uid get from socket file"

This reverts commit 623f33f213deb39994decbdc7d3b8cea82c4d558.

Bug: 37524657
Change-Id: I214dbf417e720c032d28d62b8a74ece5de9cd919
Signed-off-by: Chenbo Feng <fengc@google.com>

diff --git a/net/netfilter/xt_qtaguid.c b/net/netfilter/xt_qtaguid.c
index fbe4e1e..f95aba4 100644 (file)
--- a/net/netfilter/xt_qtaguid.c
+++ b/net/netfilter/xt_qtaguid.c
@@ -1717,9 +1717,18 @@ static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par)
        }
        MT_DEBUG("qtaguid[%d]: sk=%p got_sock=%d fam=%d proto=%d\n",
                 par->hooknum, sk, got_sock, par->family, ipx_proto(skb, par));
+       if (sk != NULL) {
+               set_sk_callback_lock = true;
+               read_lock_bh(&sk->sk_callback_lock);
+               MT_DEBUG("qtaguid[%d]: sk=%p->sk_socket=%p->file=%p\n",
+                       par->hooknum, sk, sk->sk_socket,
+                       sk->sk_socket ? sk->sk_socket->file : (void *)-1LL);
+               filp = sk->sk_socket ? sk->sk_socket->file : NULL;
+               MT_DEBUG("qtaguid[%d]: filp...uid=%u\n",
+                       par->hooknum, filp ? from_kuid(&init_user_ns, filp->f_cred->fsuid) : -1);
+       }
 
-
-       if (sk == NULL) {
+       if (sk == NULL || sk->sk_socket == NULL) {
                /*
                 * Here, the qtaguid_find_sk() using connection tracking
                 * couldn't find the owner, so for now we just count them
@@ -1732,7 +1741,9 @@ static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par)
                 */
                if (!(info->match & XT_QTAGUID_UID))
                        account_for_uid(skb, sk, 0, par);
-               MT_DEBUG("qtaguid[%d]: leaving (sk=NULL)\n", par->hooknum);
+               MT_DEBUG("qtaguid[%d]: leaving (sk?sk->sk_socket)=%p\n",
+                       par->hooknum,
+                       sk ? sk->sk_socket : NULL);
                res = (info->match ^ info->invert) == 0;
                atomic64_inc(&qtu_events.match_no_sk);
                goto put_sock_ret_res;
@@ -1740,7 +1751,16 @@ static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par)
                res = false;
                goto put_sock_ret_res;
        }
-       sock_uid = sk->sk_uid;
+       filp = sk->sk_socket->file;
+       if (filp == NULL) {
+               MT_DEBUG("qtaguid[%d]: leaving filp=NULL\n", par->hooknum);
+               account_for_uid(skb, sk, 0, par);
+               res = ((info->match ^ info->invert) &
+                       (XT_QTAGUID_UID | XT_QTAGUID_GID)) == 0;
+               atomic64_inc(&qtu_events.match_no_sk_file);
+               goto put_sock_ret_res;
+       }
+       sock_uid = filp->f_cred->fsuid;
        /*
         * TODO: unhack how to force just accounting.
         * For now we only do iface stats when the uid-owner is not requested
@@ -1758,8 +1778,8 @@ static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par)
                kuid_t uid_min = make_kuid(&init_user_ns, info->uid_min);
                kuid_t uid_max = make_kuid(&init_user_ns, info->uid_max);
 
-               if ((uid_gte(sk->sk_uid, uid_min) &&
-                    uid_lte(sk->sk_uid, uid_max)) ^
+               if ((uid_gte(filp->f_cred->fsuid, uid_min) &&
+                    uid_lte(filp->f_cred->fsuid, uid_max)) ^
                    !(info->invert & XT_QTAGUID_UID)) {
                        MT_DEBUG("qtaguid[%d]: leaving uid not matching\n",
                                 par->hooknum);
@@ -1770,19 +1790,7 @@ static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par)
        if (info->match & XT_QTAGUID_GID) {
                kgid_t gid_min = make_kgid(&init_user_ns, info->gid_min);
                kgid_t gid_max = make_kgid(&init_user_ns, info->gid_max);
-               set_sk_callback_lock = true;
-               read_lock_bh(&sk->sk_callback_lock);
-               MT_DEBUG("qtaguid[%d]: sk=%p->sk_socket=%p->file=%p\n",
-                       par->hooknum, sk, sk->sk_socket,
-                       sk->sk_socket ? sk->sk_socket->file : (void *)-1LL);
-               filp = sk->sk_socket ? sk->sk_socket->file : NULL;
-               if (!filp) {
-                       res = ((info->match ^ info->invert) & XT_QTAGUID_GID) == 0;
-                       atomic64_inc(&qtu_events.match_no_sk_gid);
-                       goto put_sock_ret_res;
-               }
-               MT_DEBUG("qtaguid[%d]: filp...uid=%u\n",
-                       par->hooknum, filp ? from_kuid(&init_user_ns, filp->f_cred->fsuid) : -1);
+
                if ((gid_gte(filp->f_cred->fsgid, gid_min) &&
                                gid_lte(filp->f_cred->fsgid, gid_max)) ^
                        !(info->invert & XT_QTAGUID_GID)) {
@@ -1954,7 +1962,7 @@ static int qtaguid_ctrl_proc_show(struct seq_file *m, void *v)
                           "match_found_sk_in_ct=%llu "
                           "match_found_no_sk_in_ct=%llu "
                           "match_no_sk=%llu "
-                          "match_no_sk_gid=%llu\n",
+                          "match_no_sk_file=%llu\n",
                           (u64)atomic64_read(&qtu_events.sockets_tagged),
                           (u64)atomic64_read(&qtu_events.sockets_untagged),
                           (u64)atomic64_read(&qtu_events.counter_set_changes),
@@ -1966,7 +1974,7 @@ static int qtaguid_ctrl_proc_show(struct seq_file *m, void *v)
                           (u64)atomic64_read(&qtu_events.match_found_sk_in_ct),
                           (u64)atomic64_read(&qtu_events.match_found_no_sk_in_ct),
                           (u64)atomic64_read(&qtu_events.match_no_sk),
-                          (u64)atomic64_read(&qtu_events.match_no_sk_gid));
+                          (u64)atomic64_read(&qtu_events.match_no_sk_file));
 
                /* Count the following as part of the last item_index. No need
                 * to lock the sock_tag_list here since it is already locked when

diff --git a/net/netfilter/xt_qtaguid_internal.h b/net/netfilter/xt_qtaguid_internal.h
index c705270..8178fbd 100644 (file)
--- a/net/netfilter/xt_qtaguid_internal.h
+++ b/net/netfilter/xt_qtaguid_internal.h
@@ -289,10 +289,10 @@ struct qtaguid_event_counts {
         */
        atomic64_t match_no_sk;
        /*
-        * The file ptr in the sk_socket wasn't there and we couldn't get GID.
+        * The file ptr in the sk_socket wasn't there.
         * This might happen for traffic while the socket is being closed.
         */
-       atomic64_t match_no_sk_gid;
+       atomic64_t match_no_sk_file;
 };
 
 /* Track the set active_set for the given tag. */