1// SPDX-License-Identifier: GPL-2.0-only
2#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
3
4#include <linux/workqueue.h>
5#include <linux/rtnetlink.h>
6#include <linux/cache.h>
7#include <linux/slab.h>
8#include <linux/list.h>
9#include <linux/delay.h>
10#include <linux/sched.h>
11#include <linux/idr.h>
12#include <linux/rculist.h>
13#include <linux/nsproxy.h>
14#include <linux/fs.h>
15#include <linux/proc_ns.h>
16#include <linux/file.h>
17#include <linux/export.h>
18#include <linux/user_namespace.h>
19#include <linux/net_namespace.h>
20#include <linux/sched/task.h>
21#include <linux/uidgid.h>
22#include <linux/proc_fs.h>
23#include <linux/nstree.h>
24
25#include <net/aligned_data.h>
26#include <net/sock.h>
27#include <net/netlink.h>
28#include <net/net_namespace.h>
29#include <net/netns/generic.h>
30
31/*
32 * Our network namespace constructor/destructor lists
33 */
34
35static LIST_HEAD(pernet_list);
36static struct list_head *first_device = &pernet_list;
37
38LIST_HEAD(net_namespace_list);
39EXPORT_SYMBOL_GPL(net_namespace_list);
40
41/* Protects net_namespace_list. Nests iside rtnl_lock() */
42DECLARE_RWSEM(net_rwsem);
43EXPORT_SYMBOL_GPL(net_rwsem);
44
45#ifdef CONFIG_KEYS
46static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) };
47#endif
48
49struct net init_net;
50EXPORT_SYMBOL(init_net);
51
52static bool init_net_initialized;
53/*
54 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids,
55 * init_net_initialized and first_device pointer.
56 * This is internal net namespace object. Please, don't use it
57 * outside.
58 */
59DECLARE_RWSEM(pernet_ops_rwsem);
60
61#define MIN_PERNET_OPS_ID \
62 ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *))
63
64#define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */
65
66static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
67
68static struct net_generic *net_alloc_generic(void)
69{
70 unsigned int gen_ptrs = READ_ONCE(max_gen_ptrs);
71 unsigned int generic_size;
72 struct net_generic *ng;
73
74 generic_size = offsetof(struct net_generic, ptr[gen_ptrs]);
75
76 ng = kzalloc(generic_size, GFP_KERNEL);
77 if (ng)
78 ng->s.len = gen_ptrs;
79
80 return ng;
81}
82
83static int net_assign_generic(struct net *net, unsigned int id, void *data)
84{
85 struct net_generic *ng, *old_ng;
86
87 BUG_ON(id < MIN_PERNET_OPS_ID);
88
89 old_ng = rcu_dereference_protected(net->gen,
90 lockdep_is_held(&pernet_ops_rwsem));
91 if (old_ng->s.len > id) {
92 old_ng->ptr[id] = data;
93 return 0;
94 }
95
96 ng = net_alloc_generic();
97 if (!ng)
98 return -ENOMEM;
99
100 /*
101 * Some synchronisation notes:
102 *
103 * The net_generic explores the net->gen array inside rcu
104 * read section. Besides once set the net->gen->ptr[x]
105 * pointer never changes (see rules in netns/generic.h).
106 *
107 * That said, we simply duplicate this array and schedule
108 * the old copy for kfree after a grace period.
109 */
110
111 memcpy(to: &ng->ptr[MIN_PERNET_OPS_ID], from: &old_ng->ptr[MIN_PERNET_OPS_ID],
112 len: (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *));
113 ng->ptr[id] = data;
114
115 rcu_assign_pointer(net->gen, ng);
116 kfree_rcu(old_ng, s.rcu);
117 return 0;
118}
119
120static int ops_init(const struct pernet_operations *ops, struct net *net)
121{
122 struct net_generic *ng;
123 int err = -ENOMEM;
124 void *data = NULL;
125
126 if (ops->id) {
127 data = kzalloc(ops->size, GFP_KERNEL);
128 if (!data)
129 goto out;
130
131 err = net_assign_generic(net, id: *ops->id, data);
132 if (err)
133 goto cleanup;
134 }
135 err = 0;
136 if (ops->init)
137 err = ops->init(net);
138 if (!err)
139 return 0;
140
141 if (ops->id) {
142 ng = rcu_dereference_protected(net->gen,
143 lockdep_is_held(&pernet_ops_rwsem));
144 ng->ptr[*ops->id] = NULL;
145 }
146
147cleanup:
148 kfree(objp: data);
149
150out:
151 return err;
152}
153
154static void ops_pre_exit_list(const struct pernet_operations *ops,
155 struct list_head *net_exit_list)
156{
157 struct net *net;
158
159 if (ops->pre_exit) {
160 list_for_each_entry(net, net_exit_list, exit_list)
161 ops->pre_exit(net);
162 }
163}
164
165static void ops_exit_rtnl_list(const struct list_head *ops_list,
166 const struct pernet_operations *ops,
167 struct list_head *net_exit_list)
168{
169 const struct pernet_operations *saved_ops = ops;
170 LIST_HEAD(dev_kill_list);
171 struct net *net;
172
173 rtnl_lock();
174
175 list_for_each_entry(net, net_exit_list, exit_list) {
176 __rtnl_net_lock(net);
177
178 ops = saved_ops;
179 list_for_each_entry_continue_reverse(ops, ops_list, list) {
180 if (ops->exit_rtnl)
181 ops->exit_rtnl(net, &dev_kill_list);
182 }
183
184 __rtnl_net_unlock(net);
185 }
186
187 unregister_netdevice_many(head: &dev_kill_list);
188
189 rtnl_unlock();
190}
191
192static void ops_exit_list(const struct pernet_operations *ops,
193 struct list_head *net_exit_list)
194{
195 if (ops->exit) {
196 struct net *net;
197
198 list_for_each_entry(net, net_exit_list, exit_list) {
199 ops->exit(net);
200 cond_resched();
201 }
202 }
203
204 if (ops->exit_batch)
205 ops->exit_batch(net_exit_list);
206}
207
208static void ops_free_list(const struct pernet_operations *ops,
209 struct list_head *net_exit_list)
210{
211 struct net *net;
212
213 if (ops->id) {
214 list_for_each_entry(net, net_exit_list, exit_list)
215 kfree(objp: net_generic(net, id: *ops->id));
216 }
217}
218
219static void ops_undo_list(const struct list_head *ops_list,
220 const struct pernet_operations *ops,
221 struct list_head *net_exit_list,
222 bool expedite_rcu)
223{
224 const struct pernet_operations *saved_ops;
225 bool hold_rtnl = false;
226
227 if (!ops)
228 ops = list_entry(ops_list, typeof(*ops), list);
229
230 saved_ops = ops;
231
232 list_for_each_entry_continue_reverse(ops, ops_list, list) {
233 hold_rtnl |= !!ops->exit_rtnl;
234 ops_pre_exit_list(ops, net_exit_list);
235 }
236
237 /* Another CPU might be rcu-iterating the list, wait for it.
238 * This needs to be before calling the exit() notifiers, so the
239 * rcu_barrier() after ops_undo_list() isn't sufficient alone.
240 * Also the pre_exit() and exit() methods need this barrier.
241 */
242 if (expedite_rcu)
243 synchronize_rcu_expedited();
244 else
245 synchronize_rcu();
246
247 if (hold_rtnl)
248 ops_exit_rtnl_list(ops_list, ops: saved_ops, net_exit_list);
249
250 ops = saved_ops;
251 list_for_each_entry_continue_reverse(ops, ops_list, list)
252 ops_exit_list(ops, net_exit_list);
253
254 ops = saved_ops;
255 list_for_each_entry_continue_reverse(ops, ops_list, list)
256 ops_free_list(ops, net_exit_list);
257}
258
259static void ops_undo_single(struct pernet_operations *ops,
260 struct list_head *net_exit_list)
261{
262 LIST_HEAD(ops_list);
263
264 list_add(new: &ops->list, head: &ops_list);
265 ops_undo_list(ops_list: &ops_list, NULL, net_exit_list, expedite_rcu: false);
266 list_del(entry: &ops->list);
267}
268
269/* should be called with nsid_lock held */
270static int alloc_netid(struct net *net, struct net *peer, int reqid)
271{
272 int min = 0, max = 0;
273
274 if (reqid >= 0) {
275 min = reqid;
276 max = reqid + 1;
277 }
278
279 return idr_alloc(&net->netns_ids, ptr: peer, start: min, end: max, GFP_ATOMIC);
280}
281
282/* This function is used by idr_for_each(). If net is equal to peer, the
283 * function returns the id so that idr_for_each() stops. Because we cannot
284 * returns the id 0 (idr_for_each() will not stop), we return the magic value
285 * NET_ID_ZERO (-1) for it.
286 */
287#define NET_ID_ZERO -1
288static int net_eq_idr(int id, void *net, void *peer)
289{
290 if (net_eq(net1: net, net2: peer))
291 return id ? : NET_ID_ZERO;
292 return 0;
293}
294
295/* Must be called from RCU-critical section or with nsid_lock held */
296static int __peernet2id(const struct net *net, struct net *peer)
297{
298 int id = idr_for_each(&net->netns_ids, fn: net_eq_idr, data: peer);
299
300 /* Magic value for id 0. */
301 if (id == NET_ID_ZERO)
302 return 0;
303 if (id > 0)
304 return id;
305
306 return NETNSA_NSID_NOT_ASSIGNED;
307}
308
309static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
310 struct nlmsghdr *nlh, gfp_t gfp);
311/* This function returns the id of a peer netns. If no id is assigned, one will
312 * be allocated and returned.
313 */
314int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
315{
316 int id;
317
318 if (!check_net(net))
319 return NETNSA_NSID_NOT_ASSIGNED;
320
321 spin_lock(lock: &net->nsid_lock);
322 id = __peernet2id(net, peer);
323 if (id >= 0) {
324 spin_unlock(lock: &net->nsid_lock);
325 return id;
326 }
327
328 /* When peer is obtained from RCU lists, we may race with
329 * its cleanup. Check whether it's alive, and this guarantees
330 * we never hash a peer back to net->netns_ids, after it has
331 * just been idr_remove()'d from there in cleanup_net().
332 */
333 if (!maybe_get_net(net: peer)) {
334 spin_unlock(lock: &net->nsid_lock);
335 return NETNSA_NSID_NOT_ASSIGNED;
336 }
337
338 id = alloc_netid(net, peer, reqid: -1);
339 spin_unlock(lock: &net->nsid_lock);
340
341 put_net(net: peer);
342 if (id < 0)
343 return NETNSA_NSID_NOT_ASSIGNED;
344
345 rtnl_net_notifyid(net, RTM_NEWNSID, id, portid: 0, NULL, gfp);
346
347 return id;
348}
349EXPORT_SYMBOL_GPL(peernet2id_alloc);
350
351/* This function returns, if assigned, the id of a peer netns. */
352int peernet2id(const struct net *net, struct net *peer)
353{
354 int id;
355
356 rcu_read_lock();
357 id = __peernet2id(net, peer);
358 rcu_read_unlock();
359
360 return id;
361}
362EXPORT_SYMBOL(peernet2id);
363
364/* This function returns true is the peer netns has an id assigned into the
365 * current netns.
366 */
367bool peernet_has_id(const struct net *net, struct net *peer)
368{
369 return peernet2id(net, peer) >= 0;
370}
371
372struct net *get_net_ns_by_id(const struct net *net, int id)
373{
374 struct net *peer;
375
376 if (id < 0)
377 return NULL;
378
379 rcu_read_lock();
380 peer = idr_find(&net->netns_ids, id);
381 if (peer)
382 peer = maybe_get_net(net: peer);
383 rcu_read_unlock();
384
385 return peer;
386}
387EXPORT_SYMBOL_GPL(get_net_ns_by_id);
388
389static __net_init void preinit_net_sysctl(struct net *net)
390{
391 net->core.sysctl_somaxconn = SOMAXCONN;
392 /* Limits per socket sk_omem_alloc usage.
393 * TCP zerocopy regular usage needs 128 KB.
394 */
395 net->core.sysctl_optmem_max = 128 * 1024;
396 net->core.sysctl_txrehash = SOCK_TXREHASH_ENABLED;
397 net->core.sysctl_tstamp_allow_data = 1;
398}
399
400/* init code that must occur even if setup_net() is not called. */
401static __net_init int preinit_net(struct net *net, struct user_namespace *user_ns)
402{
403 int ret;
404
405 ret = ns_common_init(net);
406 if (ret)
407 return ret;
408
409 refcount_set(r: &net->passive, n: 1);
410 ref_tracker_dir_init(dir: &net->refcnt_tracker, quarantine_count: 128, class: "net_refcnt");
411 ref_tracker_dir_init(dir: &net->notrefcnt_tracker, quarantine_count: 128, class: "net_notrefcnt");
412
413 get_random_bytes(buf: &net->hash_mix, len: sizeof(u32));
414 net->dev_base_seq = 1;
415 net->user_ns = user_ns;
416
417 idr_init(idr: &net->netns_ids);
418 spin_lock_init(&net->nsid_lock);
419 mutex_init(&net->ipv4.ra_mutex);
420
421#ifdef CONFIG_DEBUG_NET_SMALL_RTNL
422 mutex_init(&net->rtnl_mutex);
423 lock_set_cmp_fn(&net->rtnl_mutex, rtnl_net_lock_cmp_fn, NULL);
424#endif
425
426 INIT_LIST_HEAD(list: &net->ptype_all);
427 INIT_LIST_HEAD(list: &net->ptype_specific);
428 preinit_net_sysctl(net);
429 return 0;
430}
431
432/*
433 * setup_net runs the initializers for the network namespace object.
434 */
435static __net_init int setup_net(struct net *net)
436{
437 /* Must be called with pernet_ops_rwsem held */
438 const struct pernet_operations *ops;
439 LIST_HEAD(net_exit_list);
440 int error = 0;
441
442 net->net_cookie = ns_tree_gen_id(ns: &net->ns);
443
444 list_for_each_entry(ops, &pernet_list, list) {
445 error = ops_init(ops, net);
446 if (error < 0)
447 goto out_undo;
448 }
449 down_write(sem: &net_rwsem);
450 list_add_tail_rcu(new: &net->list, head: &net_namespace_list);
451 up_write(sem: &net_rwsem);
452 ns_tree_add_raw(net);
453out:
454 return error;
455
456out_undo:
457 /* Walk through the list backwards calling the exit functions
458 * for the pernet modules whose init functions did not fail.
459 */
460 list_add(new: &net->exit_list, head: &net_exit_list);
461 ops_undo_list(ops_list: &pernet_list, ops, net_exit_list: &net_exit_list, expedite_rcu: false);
462 rcu_barrier();
463 goto out;
464}
465
466#ifdef CONFIG_NET_NS
467static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
468{
469 return inc_ucount(ns, current_euid(), type: UCOUNT_NET_NAMESPACES);
470}
471
472static void dec_net_namespaces(struct ucounts *ucounts)
473{
474 dec_ucount(ucounts, type: UCOUNT_NET_NAMESPACES);
475}
476
477static struct kmem_cache *net_cachep __ro_after_init;
478static struct workqueue_struct *netns_wq;
479
480static struct net *net_alloc(void)
481{
482 struct net *net = NULL;
483 struct net_generic *ng;
484
485 ng = net_alloc_generic();
486 if (!ng)
487 goto out;
488
489 net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
490 if (!net)
491 goto out_free;
492
493#ifdef CONFIG_KEYS
494 net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL);
495 if (!net->key_domain)
496 goto out_free_2;
497 refcount_set(r: &net->key_domain->usage, n: 1);
498#endif
499
500 rcu_assign_pointer(net->gen, ng);
501out:
502 return net;
503
504#ifdef CONFIG_KEYS
505out_free_2:
506 kmem_cache_free(s: net_cachep, objp: net);
507 net = NULL;
508#endif
509out_free:
510 kfree(objp: ng);
511 goto out;
512}
513
514static LLIST_HEAD(defer_free_list);
515
516static void net_complete_free(void)
517{
518 struct llist_node *kill_list;
519 struct net *net, *next;
520
521 /* Get the list of namespaces to free from last round. */
522 kill_list = llist_del_all(head: &defer_free_list);
523
524 llist_for_each_entry_safe(net, next, kill_list, defer_free_list)
525 kmem_cache_free(s: net_cachep, objp: net);
526
527}
528
529void net_passive_dec(struct net *net)
530{
531 if (refcount_dec_and_test(r: &net->passive)) {
532 kfree(rcu_access_pointer(net->gen));
533
534 /* There should not be any trackers left there. */
535 ref_tracker_dir_exit(dir: &net->notrefcnt_tracker);
536
537 /* Wait for an extra rcu_barrier() before final free. */
538 llist_add(new: &net->defer_free_list, head: &defer_free_list);
539 }
540}
541
542void net_drop_ns(void *p)
543{
544 struct net *net = (struct net *)p;
545
546 if (net)
547 net_passive_dec(net);
548}
549
550struct net *copy_net_ns(u64 flags,
551 struct user_namespace *user_ns, struct net *old_net)
552{
553 struct ucounts *ucounts;
554 struct net *net;
555 int rv;
556
557 if (!(flags & CLONE_NEWNET))
558 return get_net(net: old_net);
559
560 ucounts = inc_net_namespaces(ns: user_ns);
561 if (!ucounts)
562 return ERR_PTR(error: -ENOSPC);
563
564 net = net_alloc();
565 if (!net) {
566 rv = -ENOMEM;
567 goto dec_ucounts;
568 }
569
570 rv = preinit_net(net, user_ns);
571 if (rv < 0)
572 goto dec_ucounts;
573 net->ucounts = ucounts;
574 get_user_ns(ns: user_ns);
575
576 rv = down_read_killable(sem: &pernet_ops_rwsem);
577 if (rv < 0)
578 goto put_userns;
579
580 rv = setup_net(net);
581
582 up_read(sem: &pernet_ops_rwsem);
583
584 if (rv < 0) {
585put_userns:
586 ns_common_free(net);
587#ifdef CONFIG_KEYS
588 key_remove_domain(domain_tag: net->key_domain);
589#endif
590 put_user_ns(ns: user_ns);
591 net_passive_dec(net);
592dec_ucounts:
593 dec_net_namespaces(ucounts);
594 return ERR_PTR(error: rv);
595 }
596 return net;
597}
598
599/**
600 * net_ns_get_ownership - get sysfs ownership data for @net
601 * @net: network namespace in question (can be NULL)
602 * @uid: kernel user ID for sysfs objects
603 * @gid: kernel group ID for sysfs objects
604 *
605 * Returns the uid/gid pair of root in the user namespace associated with the
606 * given network namespace.
607 */
608void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid)
609{
610 if (net) {
611 kuid_t ns_root_uid = make_kuid(from: net->user_ns, uid: 0);
612 kgid_t ns_root_gid = make_kgid(from: net->user_ns, gid: 0);
613
614 if (uid_valid(uid: ns_root_uid))
615 *uid = ns_root_uid;
616
617 if (gid_valid(gid: ns_root_gid))
618 *gid = ns_root_gid;
619 } else {
620 *uid = GLOBAL_ROOT_UID;
621 *gid = GLOBAL_ROOT_GID;
622 }
623}
624EXPORT_SYMBOL_GPL(net_ns_get_ownership);
625
626static void unhash_nsid(struct net *net, struct net *last)
627{
628 struct net *tmp;
629 /* This function is only called from cleanup_net() work,
630 * and this work is the only process, that may delete
631 * a net from net_namespace_list. So, when the below
632 * is executing, the list may only grow. Thus, we do not
633 * use for_each_net_rcu() or net_rwsem.
634 */
635 for_each_net(tmp) {
636 int id;
637
638 spin_lock(lock: &tmp->nsid_lock);
639 id = __peernet2id(net: tmp, peer: net);
640 if (id >= 0)
641 idr_remove(&tmp->netns_ids, id);
642 spin_unlock(lock: &tmp->nsid_lock);
643 if (id >= 0)
644 rtnl_net_notifyid(net: tmp, RTM_DELNSID, id, portid: 0, NULL,
645 GFP_KERNEL);
646 if (tmp == last)
647 break;
648 }
649 spin_lock(lock: &net->nsid_lock);
650 idr_destroy(&net->netns_ids);
651 spin_unlock(lock: &net->nsid_lock);
652}
653
654static LLIST_HEAD(cleanup_list);
655
656struct task_struct *cleanup_net_task;
657
658static void cleanup_net(struct work_struct *work)
659{
660 struct llist_node *net_kill_list;
661 struct net *net, *tmp, *last;
662 LIST_HEAD(net_exit_list);
663
664 WRITE_ONCE(cleanup_net_task, current);
665
666 /* Atomically snapshot the list of namespaces to cleanup */
667 net_kill_list = llist_del_all(head: &cleanup_list);
668
669 down_read(sem: &pernet_ops_rwsem);
670
671 /* Don't let anyone else find us. */
672 down_write(sem: &net_rwsem);
673 llist_for_each_entry(net, net_kill_list, cleanup_list) {
674 ns_tree_remove(net);
675 list_del_rcu(entry: &net->list);
676 }
677 /* Cache last net. After we unlock rtnl, no one new net
678 * added to net_namespace_list can assign nsid pointer
679 * to a net from net_kill_list (see peernet2id_alloc()).
680 * So, we skip them in unhash_nsid().
681 *
682 * Note, that unhash_nsid() does not delete nsid links
683 * between net_kill_list's nets, as they've already
684 * deleted from net_namespace_list. But, this would be
685 * useless anyway, as netns_ids are destroyed there.
686 */
687 last = list_last_entry(&net_namespace_list, struct net, list);
688 up_write(sem: &net_rwsem);
689
690 llist_for_each_entry(net, net_kill_list, cleanup_list) {
691 unhash_nsid(net, last);
692 list_add_tail(new: &net->exit_list, head: &net_exit_list);
693 }
694
695 ops_undo_list(ops_list: &pernet_list, NULL, net_exit_list: &net_exit_list, expedite_rcu: true);
696
697 up_read(sem: &pernet_ops_rwsem);
698
699 /* Ensure there are no outstanding rcu callbacks using this
700 * network namespace.
701 */
702 rcu_barrier();
703
704 net_complete_free();
705
706 /* Finally it is safe to free my network namespace structure */
707 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
708 list_del_init(entry: &net->exit_list);
709 ns_common_free(net);
710 dec_net_namespaces(ucounts: net->ucounts);
711#ifdef CONFIG_KEYS
712 key_remove_domain(domain_tag: net->key_domain);
713#endif
714 put_user_ns(ns: net->user_ns);
715 net_passive_dec(net);
716 }
717 WRITE_ONCE(cleanup_net_task, NULL);
718}
719
720/**
721 * net_ns_barrier - wait until concurrent net_cleanup_work is done
722 *
723 * cleanup_net runs from work queue and will first remove namespaces
724 * from the global list, then run net exit functions.
725 *
726 * Call this in module exit path to make sure that all netns
727 * ->exit ops have been invoked before the function is removed.
728 */
729void net_ns_barrier(void)
730{
731 down_write(sem: &pernet_ops_rwsem);
732 up_write(sem: &pernet_ops_rwsem);
733}
734EXPORT_SYMBOL(net_ns_barrier);
735
736static DECLARE_WORK(net_cleanup_work, cleanup_net);
737
738void __put_net(struct net *net)
739{
740 ref_tracker_dir_exit(dir: &net->refcnt_tracker);
741 /* Cleanup the network namespace in process context */
742 if (llist_add(new: &net->cleanup_list, head: &cleanup_list))
743 queue_work(wq: netns_wq, work: &net_cleanup_work);
744}
745EXPORT_SYMBOL_GPL(__put_net);
746
747/**
748 * get_net_ns - increment the refcount of the network namespace
749 * @ns: common namespace (net)
750 *
751 * Returns the net's common namespace or ERR_PTR() if ref is zero.
752 */
753struct ns_common *get_net_ns(struct ns_common *ns)
754{
755 struct net *net;
756
757 net = maybe_get_net(container_of(ns, struct net, ns));
758 if (net)
759 return &net->ns;
760 return ERR_PTR(error: -EINVAL);
761}
762EXPORT_SYMBOL_GPL(get_net_ns);
763
764struct net *get_net_ns_by_fd(int fd)
765{
766 CLASS(fd, f)(fd);
767
768 if (fd_empty(f))
769 return ERR_PTR(error: -EBADF);
770
771 if (proc_ns_file(fd_file(f))) {
772 struct ns_common *ns = get_proc_ns(file_inode(fd_file(f)));
773 if (ns->ops == &netns_operations)
774 return get_net(container_of(ns, struct net, ns));
775 }
776
777 return ERR_PTR(error: -EINVAL);
778}
779EXPORT_SYMBOL_GPL(get_net_ns_by_fd);
780#endif
781
782struct net *get_net_ns_by_pid(pid_t pid)
783{
784 struct task_struct *tsk;
785 struct net *net;
786
787 /* Lookup the network namespace */
788 net = ERR_PTR(error: -ESRCH);
789 rcu_read_lock();
790 tsk = find_task_by_vpid(nr: pid);
791 if (tsk) {
792 struct nsproxy *nsproxy;
793 task_lock(p: tsk);
794 nsproxy = tsk->nsproxy;
795 if (nsproxy)
796 net = get_net(net: nsproxy->net_ns);
797 task_unlock(p: tsk);
798 }
799 rcu_read_unlock();
800 return net;
801}
802EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
803
804#ifdef CONFIG_NET_NS_REFCNT_TRACKER
805static void net_ns_net_debugfs(struct net *net)
806{
807 ref_tracker_dir_symlink(&net->refcnt_tracker, "netns-%llx-%u-refcnt",
808 net->net_cookie, net->ns.inum);
809 ref_tracker_dir_symlink(&net->notrefcnt_tracker, "netns-%llx-%u-notrefcnt",
810 net->net_cookie, net->ns.inum);
811}
812
813static int __init init_net_debugfs(void)
814{
815 ref_tracker_dir_debugfs(&init_net.refcnt_tracker);
816 ref_tracker_dir_debugfs(&init_net.notrefcnt_tracker);
817 net_ns_net_debugfs(&init_net);
818 return 0;
819}
820late_initcall(init_net_debugfs);
821#else
822static void net_ns_net_debugfs(struct net *net)
823{
824}
825#endif
826
827static __net_init int net_ns_net_init(struct net *net)
828{
829 net_ns_net_debugfs(net);
830 return 0;
831}
832
833static struct pernet_operations __net_initdata net_ns_ops = {
834 .init = net_ns_net_init,
835};
836
837static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
838 [NETNSA_NONE] = { .type = NLA_UNSPEC },
839 [NETNSA_NSID] = { .type = NLA_S32 },
840 [NETNSA_PID] = { .type = NLA_U32 },
841 [NETNSA_FD] = { .type = NLA_U32 },
842 [NETNSA_TARGET_NSID] = { .type = NLA_S32 },
843};
844
845static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
846 struct netlink_ext_ack *extack)
847{
848 struct net *net = sock_net(sk: skb->sk);
849 struct nlattr *tb[NETNSA_MAX + 1];
850 struct nlattr *nla;
851 struct net *peer;
852 int nsid, err;
853
854 err = nlmsg_parse_deprecated(nlh, hdrlen: sizeof(struct rtgenmsg), tb,
855 NETNSA_MAX, policy: rtnl_net_policy, extack);
856 if (err < 0)
857 return err;
858 if (!tb[NETNSA_NSID]) {
859 NL_SET_ERR_MSG(extack, "nsid is missing");
860 return -EINVAL;
861 }
862 nsid = nla_get_s32(nla: tb[NETNSA_NSID]);
863
864 if (tb[NETNSA_PID]) {
865 peer = get_net_ns_by_pid(nla_get_u32(nla: tb[NETNSA_PID]));
866 nla = tb[NETNSA_PID];
867 } else if (tb[NETNSA_FD]) {
868 peer = get_net_ns_by_fd(nla_get_u32(nla: tb[NETNSA_FD]));
869 nla = tb[NETNSA_FD];
870 } else {
871 NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
872 return -EINVAL;
873 }
874 if (IS_ERR(ptr: peer)) {
875 NL_SET_BAD_ATTR(extack, nla);
876 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
877 return PTR_ERR(ptr: peer);
878 }
879
880 spin_lock(lock: &net->nsid_lock);
881 if (__peernet2id(net, peer) >= 0) {
882 spin_unlock(lock: &net->nsid_lock);
883 err = -EEXIST;
884 NL_SET_BAD_ATTR(extack, nla);
885 NL_SET_ERR_MSG(extack,
886 "Peer netns already has a nsid assigned");
887 goto out;
888 }
889
890 err = alloc_netid(net, peer, reqid: nsid);
891 spin_unlock(lock: &net->nsid_lock);
892 if (err >= 0) {
893 rtnl_net_notifyid(net, RTM_NEWNSID, id: err, NETLINK_CB(skb).portid,
894 nlh, GFP_KERNEL);
895 err = 0;
896 } else if (err == -ENOSPC && nsid >= 0) {
897 err = -EEXIST;
898 NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]);
899 NL_SET_ERR_MSG(extack, "The specified nsid is already used");
900 }
901out:
902 put_net(net: peer);
903 return err;
904}
905
906static int rtnl_net_get_size(void)
907{
908 return NLMSG_ALIGN(sizeof(struct rtgenmsg))
909 + nla_total_size(payload: sizeof(s32)) /* NETNSA_NSID */
910 + nla_total_size(payload: sizeof(s32)) /* NETNSA_CURRENT_NSID */
911 ;
912}
913
914struct net_fill_args {
915 u32 portid;
916 u32 seq;
917 int flags;
918 int cmd;
919 int nsid;
920 bool add_ref;
921 int ref_nsid;
922};
923
924static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args)
925{
926 struct nlmsghdr *nlh;
927 struct rtgenmsg *rth;
928
929 nlh = nlmsg_put(skb, portid: args->portid, seq: args->seq, type: args->cmd, payload: sizeof(*rth),
930 flags: args->flags);
931 if (!nlh)
932 return -EMSGSIZE;
933
934 rth = nlmsg_data(nlh);
935 rth->rtgen_family = AF_UNSPEC;
936
937 if (nla_put_s32(skb, attrtype: NETNSA_NSID, value: args->nsid))
938 goto nla_put_failure;
939
940 if (args->add_ref &&
941 nla_put_s32(skb, attrtype: NETNSA_CURRENT_NSID, value: args->ref_nsid))
942 goto nla_put_failure;
943
944 nlmsg_end(skb, nlh);
945 return 0;
946
947nla_put_failure:
948 nlmsg_cancel(skb, nlh);
949 return -EMSGSIZE;
950}
951
952static int rtnl_net_valid_getid_req(struct sk_buff *skb,
953 const struct nlmsghdr *nlh,
954 struct nlattr **tb,
955 struct netlink_ext_ack *extack)
956{
957 int i, err;
958
959 if (!netlink_strict_get_check(skb))
960 return nlmsg_parse_deprecated(nlh, hdrlen: sizeof(struct rtgenmsg),
961 tb, NETNSA_MAX, policy: rtnl_net_policy,
962 extack);
963
964 err = nlmsg_parse_deprecated_strict(nlh, hdrlen: sizeof(struct rtgenmsg), tb,
965 NETNSA_MAX, policy: rtnl_net_policy,
966 extack);
967 if (err)
968 return err;
969
970 for (i = 0; i <= NETNSA_MAX; i++) {
971 if (!tb[i])
972 continue;
973
974 switch (i) {
975 case NETNSA_PID:
976 case NETNSA_FD:
977 case NETNSA_NSID:
978 case NETNSA_TARGET_NSID:
979 break;
980 default:
981 NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request");
982 return -EINVAL;
983 }
984 }
985
986 return 0;
987}
988
989static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
990 struct netlink_ext_ack *extack)
991{
992 struct net *net = sock_net(sk: skb->sk);
993 struct nlattr *tb[NETNSA_MAX + 1];
994 struct net_fill_args fillargs = {
995 .portid = NETLINK_CB(skb).portid,
996 .seq = nlh->nlmsg_seq,
997 .cmd = RTM_NEWNSID,
998 };
999 struct net *peer, *target = net;
1000 struct nlattr *nla;
1001 struct sk_buff *msg;
1002 int err;
1003
1004 err = rtnl_net_valid_getid_req(skb, nlh, tb, extack);
1005 if (err < 0)
1006 return err;
1007 if (tb[NETNSA_PID]) {
1008 peer = get_net_ns_by_pid(nla_get_u32(nla: tb[NETNSA_PID]));
1009 nla = tb[NETNSA_PID];
1010 } else if (tb[NETNSA_FD]) {
1011 peer = get_net_ns_by_fd(nla_get_u32(nla: tb[NETNSA_FD]));
1012 nla = tb[NETNSA_FD];
1013 } else if (tb[NETNSA_NSID]) {
1014 peer = get_net_ns_by_id(net, nla_get_s32(nla: tb[NETNSA_NSID]));
1015 if (!peer)
1016 peer = ERR_PTR(error: -ENOENT);
1017 nla = tb[NETNSA_NSID];
1018 } else {
1019 NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
1020 return -EINVAL;
1021 }
1022
1023 if (IS_ERR(ptr: peer)) {
1024 NL_SET_BAD_ATTR(extack, nla);
1025 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
1026 return PTR_ERR(ptr: peer);
1027 }
1028
1029 if (tb[NETNSA_TARGET_NSID]) {
1030 int id = nla_get_s32(nla: tb[NETNSA_TARGET_NSID]);
1031
1032 target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, netnsid: id);
1033 if (IS_ERR(ptr: target)) {
1034 NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]);
1035 NL_SET_ERR_MSG(extack,
1036 "Target netns reference is invalid");
1037 err = PTR_ERR(ptr: target);
1038 goto out;
1039 }
1040 fillargs.add_ref = true;
1041 fillargs.ref_nsid = peernet2id(net, peer);
1042 }
1043
1044 msg = nlmsg_new(payload: rtnl_net_get_size(), GFP_KERNEL);
1045 if (!msg) {
1046 err = -ENOMEM;
1047 goto out;
1048 }
1049
1050 fillargs.nsid = peernet2id(target, peer);
1051 err = rtnl_net_fill(skb: msg, args: &fillargs);
1052 if (err < 0)
1053 goto err_out;
1054
1055 err = rtnl_unicast(skb: msg, net, NETLINK_CB(skb).portid);
1056 goto out;
1057
1058err_out:
1059 nlmsg_free(skb: msg);
1060out:
1061 if (fillargs.add_ref)
1062 put_net(net: target);
1063 put_net(net: peer);
1064 return err;
1065}
1066
1067struct rtnl_net_dump_cb {
1068 struct net *tgt_net;
1069 struct net *ref_net;
1070 struct sk_buff *skb;
1071 struct net_fill_args fillargs;
1072 int idx;
1073 int s_idx;
1074};
1075
1076/* Runs in RCU-critical section. */
1077static int rtnl_net_dumpid_one(int id, void *peer, void *data)
1078{
1079 struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
1080 int ret;
1081
1082 if (net_cb->idx < net_cb->s_idx)
1083 goto cont;
1084
1085 net_cb->fillargs.nsid = id;
1086 if (net_cb->fillargs.add_ref)
1087 net_cb->fillargs.ref_nsid = __peernet2id(net: net_cb->ref_net, peer);
1088 ret = rtnl_net_fill(skb: net_cb->skb, args: &net_cb->fillargs);
1089 if (ret < 0)
1090 return ret;
1091
1092cont:
1093 net_cb->idx++;
1094 return 0;
1095}
1096
1097static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk,
1098 struct rtnl_net_dump_cb *net_cb,
1099 struct netlink_callback *cb)
1100{
1101 struct netlink_ext_ack *extack = cb->extack;
1102 struct nlattr *tb[NETNSA_MAX + 1];
1103 int err, i;
1104
1105 err = nlmsg_parse_deprecated_strict(nlh, hdrlen: sizeof(struct rtgenmsg), tb,
1106 NETNSA_MAX, policy: rtnl_net_policy,
1107 extack);
1108 if (err < 0)
1109 return err;
1110
1111 for (i = 0; i <= NETNSA_MAX; i++) {
1112 if (!tb[i])
1113 continue;
1114
1115 if (i == NETNSA_TARGET_NSID) {
1116 struct net *net;
1117
1118 net = rtnl_get_net_ns_capable(sk, netnsid: nla_get_s32(nla: tb[i]));
1119 if (IS_ERR(ptr: net)) {
1120 NL_SET_BAD_ATTR(extack, tb[i]);
1121 NL_SET_ERR_MSG(extack,
1122 "Invalid target network namespace id");
1123 return PTR_ERR(ptr: net);
1124 }
1125 net_cb->fillargs.add_ref = true;
1126 net_cb->ref_net = net_cb->tgt_net;
1127 net_cb->tgt_net = net;
1128 } else {
1129 NL_SET_BAD_ATTR(extack, tb[i]);
1130 NL_SET_ERR_MSG(extack,
1131 "Unsupported attribute in dump request");
1132 return -EINVAL;
1133 }
1134 }
1135
1136 return 0;
1137}
1138
1139static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
1140{
1141 struct rtnl_net_dump_cb net_cb = {
1142 .tgt_net = sock_net(sk: skb->sk),
1143 .skb = skb,
1144 .fillargs = {
1145 .portid = NETLINK_CB(cb->skb).portid,
1146 .seq = cb->nlh->nlmsg_seq,
1147 .flags = NLM_F_MULTI,
1148 .cmd = RTM_NEWNSID,
1149 },
1150 .idx = 0,
1151 .s_idx = cb->args[0],
1152 };
1153 int err = 0;
1154
1155 if (cb->strict_check) {
1156 err = rtnl_valid_dump_net_req(nlh: cb->nlh, sk: skb->sk, net_cb: &net_cb, cb);
1157 if (err < 0)
1158 goto end;
1159 }
1160
1161 rcu_read_lock();
1162 idr_for_each(&net_cb.tgt_net->netns_ids, fn: rtnl_net_dumpid_one, data: &net_cb);
1163 rcu_read_unlock();
1164
1165 cb->args[0] = net_cb.idx;
1166end:
1167 if (net_cb.fillargs.add_ref)
1168 put_net(net: net_cb.tgt_net);
1169 return err;
1170}
1171
1172static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
1173 struct nlmsghdr *nlh, gfp_t gfp)
1174{
1175 struct net_fill_args fillargs = {
1176 .portid = portid,
1177 .seq = nlh ? nlh->nlmsg_seq : 0,
1178 .cmd = cmd,
1179 .nsid = id,
1180 };
1181 struct sk_buff *msg;
1182 int err = -ENOMEM;
1183
1184 msg = nlmsg_new(payload: rtnl_net_get_size(), flags: gfp);
1185 if (!msg)
1186 goto out;
1187
1188 err = rtnl_net_fill(skb: msg, args: &fillargs);
1189 if (err < 0)
1190 goto err_out;
1191
1192 rtnl_notify(skb: msg, net, pid: portid, RTNLGRP_NSID, nlh, flags: gfp);
1193 return;
1194
1195err_out:
1196 nlmsg_free(skb: msg);
1197out:
1198 rtnl_set_sk_err(net, RTNLGRP_NSID, error: err);
1199}
1200
1201#ifdef CONFIG_NET_NS
1202static void __init netns_ipv4_struct_check(void)
1203{
1204 /* TX readonly hotpath cache lines */
1205 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1206 sysctl_tcp_early_retrans);
1207 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1208 sysctl_tcp_tso_win_divisor);
1209 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1210 sysctl_tcp_tso_rtt_log);
1211 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1212 sysctl_tcp_autocorking);
1213 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1214 sysctl_tcp_min_snd_mss);
1215 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1216 sysctl_tcp_notsent_lowat);
1217 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1218 sysctl_tcp_limit_output_bytes);
1219 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1220 sysctl_tcp_min_rtt_wlen);
1221 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1222 sysctl_tcp_wmem);
1223 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1224 sysctl_ip_fwd_use_pmtu);
1225 CACHELINE_ASSERT_GROUP_SIZE(struct netns_ipv4, netns_ipv4_read_tx, 33);
1226
1227 /* TXRX readonly hotpath cache lines */
1228 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_txrx,
1229 sysctl_tcp_moderate_rcvbuf);
1230 CACHELINE_ASSERT_GROUP_SIZE(struct netns_ipv4, netns_ipv4_read_txrx, 1);
1231
1232 /* RX readonly hotpath cache line */
1233 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1234 sysctl_ip_early_demux);
1235 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1236 sysctl_tcp_early_demux);
1237 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1238 sysctl_tcp_l3mdev_accept);
1239 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1240 sysctl_tcp_reordering);
1241 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1242 sysctl_tcp_rmem);
1243 CACHELINE_ASSERT_GROUP_SIZE(struct netns_ipv4, netns_ipv4_read_rx, 22);
1244}
1245#endif
1246
1247static const struct rtnl_msg_handler net_ns_rtnl_msg_handlers[] __initconst = {
1248 {.msgtype = RTM_NEWNSID, .doit = rtnl_net_newid,
1249 .flags = RTNL_FLAG_DOIT_UNLOCKED},
1250 {.msgtype = RTM_GETNSID, .doit = rtnl_net_getid,
1251 .dumpit = rtnl_net_dumpid,
1252 .flags = RTNL_FLAG_DOIT_UNLOCKED | RTNL_FLAG_DUMP_UNLOCKED},
1253};
1254
1255void __init net_ns_init(void)
1256{
1257 struct net_generic *ng;
1258
1259#ifdef CONFIG_NET_NS
1260 netns_ipv4_struct_check();
1261 net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
1262 SMP_CACHE_BYTES,
1263 SLAB_PANIC|SLAB_ACCOUNT, NULL);
1264
1265 /* Create workqueue for cleanup */
1266 netns_wq = create_singlethread_workqueue("netns");
1267 if (!netns_wq)
1268 panic(fmt: "Could not create netns workq");
1269#endif
1270
1271 ng = net_alloc_generic();
1272 if (!ng)
1273 panic(fmt: "Could not allocate generic netns");
1274
1275 rcu_assign_pointer(init_net.gen, ng);
1276
1277#ifdef CONFIG_KEYS
1278 init_net.key_domain = &init_net_key_domain;
1279#endif
1280 /*
1281 * This currently cannot fail as the initial network namespace
1282 * has a static inode number.
1283 */
1284 if (preinit_net(net: &init_net, user_ns: &init_user_ns))
1285 panic(fmt: "Could not preinitialize the initial network namespace");
1286
1287 down_write(sem: &pernet_ops_rwsem);
1288 if (setup_net(&init_net))
1289 panic(fmt: "Could not setup the initial network namespace");
1290
1291 init_net_initialized = true;
1292 up_write(sem: &pernet_ops_rwsem);
1293
1294 if (register_pernet_subsys(&net_ns_ops))
1295 panic(fmt: "Could not register network namespace subsystems");
1296
1297 rtnl_register_many(net_ns_rtnl_msg_handlers);
1298}
1299
1300#ifdef CONFIG_NET_NS
1301static int __register_pernet_operations(struct list_head *list,
1302 struct pernet_operations *ops)
1303{
1304 LIST_HEAD(net_exit_list);
1305 struct net *net;
1306 int error;
1307
1308 list_add_tail(new: &ops->list, head: list);
1309 if (ops->init || ops->id) {
1310 /* We held write locked pernet_ops_rwsem, and parallel
1311 * setup_net() and cleanup_net() are not possible.
1312 */
1313 for_each_net(net) {
1314 error = ops_init(ops, net);
1315 if (error)
1316 goto out_undo;
1317 list_add_tail(new: &net->exit_list, head: &net_exit_list);
1318 }
1319 }
1320 return 0;
1321
1322out_undo:
1323 /* If I have an error cleanup all namespaces I initialized */
1324 list_del(entry: &ops->list);
1325 ops_undo_single(ops, net_exit_list: &net_exit_list);
1326 return error;
1327}
1328
1329static void __unregister_pernet_operations(struct pernet_operations *ops)
1330{
1331 LIST_HEAD(net_exit_list);
1332 struct net *net;
1333
1334 /* See comment in __register_pernet_operations() */
1335 for_each_net(net)
1336 list_add_tail(new: &net->exit_list, head: &net_exit_list);
1337
1338 list_del(entry: &ops->list);
1339 ops_undo_single(ops, net_exit_list: &net_exit_list);
1340}
1341
1342#else
1343
1344static int __register_pernet_operations(struct list_head *list,
1345 struct pernet_operations *ops)
1346{
1347 if (!init_net_initialized) {
1348 list_add_tail(&ops->list, list);
1349 return 0;
1350 }
1351
1352 return ops_init(ops, &init_net);
1353}
1354
1355static void __unregister_pernet_operations(struct pernet_operations *ops)
1356{
1357 if (!init_net_initialized) {
1358 list_del(&ops->list);
1359 } else {
1360 LIST_HEAD(net_exit_list);
1361
1362 list_add(&init_net.exit_list, &net_exit_list);
1363 ops_undo_single(ops, &net_exit_list);
1364 }
1365}
1366
1367#endif /* CONFIG_NET_NS */
1368
1369static DEFINE_IDA(net_generic_ids);
1370
1371static int register_pernet_operations(struct list_head *list,
1372 struct pernet_operations *ops)
1373{
1374 int error;
1375
1376 if (WARN_ON(!!ops->id ^ !!ops->size))
1377 return -EINVAL;
1378
1379 if (ops->id) {
1380 error = ida_alloc_min(ida: &net_generic_ids, MIN_PERNET_OPS_ID,
1381 GFP_KERNEL);
1382 if (error < 0)
1383 return error;
1384 *ops->id = error;
1385 /* This does not require READ_ONCE as writers already hold
1386 * pernet_ops_rwsem. But WRITE_ONCE is needed to protect
1387 * net_alloc_generic.
1388 */
1389 WRITE_ONCE(max_gen_ptrs, max(max_gen_ptrs, *ops->id + 1));
1390 }
1391 error = __register_pernet_operations(list, ops);
1392 if (error) {
1393 rcu_barrier();
1394 if (ops->id)
1395 ida_free(&net_generic_ids, id: *ops->id);
1396 }
1397
1398 return error;
1399}
1400
1401static void unregister_pernet_operations(struct pernet_operations *ops)
1402{
1403 __unregister_pernet_operations(ops);
1404 rcu_barrier();
1405 if (ops->id)
1406 ida_free(&net_generic_ids, id: *ops->id);
1407}
1408
1409/**
1410 * register_pernet_subsys - register a network namespace subsystem
1411 * @ops: pernet operations structure for the subsystem
1412 *
1413 * Register a subsystem which has init and exit functions
1414 * that are called when network namespaces are created and
1415 * destroyed respectively.
1416 *
1417 * When registered all network namespace init functions are
1418 * called for every existing network namespace. Allowing kernel
1419 * modules to have a race free view of the set of network namespaces.
1420 *
1421 * When a new network namespace is created all of the init
1422 * methods are called in the order in which they were registered.
1423 *
1424 * When a network namespace is destroyed all of the exit methods
1425 * are called in the reverse of the order with which they were
1426 * registered.
1427 */
1428int register_pernet_subsys(struct pernet_operations *ops)
1429{
1430 int error;
1431 down_write(sem: &pernet_ops_rwsem);
1432 error = register_pernet_operations(list: first_device, ops);
1433 up_write(sem: &pernet_ops_rwsem);
1434 return error;
1435}
1436EXPORT_SYMBOL_GPL(register_pernet_subsys);
1437
1438/**
1439 * unregister_pernet_subsys - unregister a network namespace subsystem
1440 * @ops: pernet operations structure to manipulate
1441 *
1442 * Remove the pernet operations structure from the list to be
1443 * used when network namespaces are created or destroyed. In
1444 * addition run the exit method for all existing network
1445 * namespaces.
1446 */
1447void unregister_pernet_subsys(struct pernet_operations *ops)
1448{
1449 down_write(sem: &pernet_ops_rwsem);
1450 unregister_pernet_operations(ops);
1451 up_write(sem: &pernet_ops_rwsem);
1452}
1453EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
1454
1455/**
1456 * register_pernet_device - register a network namespace device
1457 * @ops: pernet operations structure for the subsystem
1458 *
1459 * Register a device which has init and exit functions
1460 * that are called when network namespaces are created and
1461 * destroyed respectively.
1462 *
1463 * When registered all network namespace init functions are
1464 * called for every existing network namespace. Allowing kernel
1465 * modules to have a race free view of the set of network namespaces.
1466 *
1467 * When a new network namespace is created all of the init
1468 * methods are called in the order in which they were registered.
1469 *
1470 * When a network namespace is destroyed all of the exit methods
1471 * are called in the reverse of the order with which they were
1472 * registered.
1473 */
1474int register_pernet_device(struct pernet_operations *ops)
1475{
1476 int error;
1477 down_write(sem: &pernet_ops_rwsem);
1478 error = register_pernet_operations(list: &pernet_list, ops);
1479 if (!error && (first_device == &pernet_list))
1480 first_device = &ops->list;
1481 up_write(sem: &pernet_ops_rwsem);
1482 return error;
1483}
1484EXPORT_SYMBOL_GPL(register_pernet_device);
1485
1486/**
1487 * unregister_pernet_device - unregister a network namespace netdevice
1488 * @ops: pernet operations structure to manipulate
1489 *
1490 * Remove the pernet operations structure from the list to be
1491 * used when network namespaces are created or destroyed. In
1492 * addition run the exit method for all existing network
1493 * namespaces.
1494 */
1495void unregister_pernet_device(struct pernet_operations *ops)
1496{
1497 down_write(sem: &pernet_ops_rwsem);
1498 if (&ops->list == first_device)
1499 first_device = first_device->next;
1500 unregister_pernet_operations(ops);
1501 up_write(sem: &pernet_ops_rwsem);
1502}
1503EXPORT_SYMBOL_GPL(unregister_pernet_device);
1504
1505#ifdef CONFIG_NET_NS
1506static struct ns_common *netns_get(struct task_struct *task)
1507{
1508 struct net *net = NULL;
1509 struct nsproxy *nsproxy;
1510
1511 task_lock(p: task);
1512 nsproxy = task->nsproxy;
1513 if (nsproxy)
1514 net = get_net(net: nsproxy->net_ns);
1515 task_unlock(p: task);
1516
1517 return net ? &net->ns : NULL;
1518}
1519
1520static void netns_put(struct ns_common *ns)
1521{
1522 put_net(net: to_net_ns(ns));
1523}
1524
1525static int netns_install(struct nsset *nsset, struct ns_common *ns)
1526{
1527 struct nsproxy *nsproxy = nsset->nsproxy;
1528 struct net *net = to_net_ns(ns);
1529
1530 if (!ns_capable(ns: net->user_ns, CAP_SYS_ADMIN) ||
1531 !ns_capable(ns: nsset->cred->user_ns, CAP_SYS_ADMIN))
1532 return -EPERM;
1533
1534 put_net(net: nsproxy->net_ns);
1535 nsproxy->net_ns = get_net(net);
1536 return 0;
1537}
1538
1539static struct user_namespace *netns_owner(struct ns_common *ns)
1540{
1541 return to_net_ns(ns)->user_ns;
1542}
1543
1544const struct proc_ns_operations netns_operations = {
1545 .name = "net",
1546 .get = netns_get,
1547 .put = netns_put,
1548 .install = netns_install,
1549 .owner = netns_owner,
1550};
1551#endif
1552