xref: /openbmc/linux/net/core/net_namespace.c (revision 8684014d)
1 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
2 
3 #include <linux/workqueue.h>
4 #include <linux/rtnetlink.h>
5 #include <linux/cache.h>
6 #include <linux/slab.h>
7 #include <linux/list.h>
8 #include <linux/delay.h>
9 #include <linux/sched.h>
10 #include <linux/idr.h>
11 #include <linux/rculist.h>
12 #include <linux/nsproxy.h>
13 #include <linux/fs.h>
14 #include <linux/proc_ns.h>
15 #include <linux/file.h>
16 #include <linux/export.h>
17 #include <linux/user_namespace.h>
18 #include <net/net_namespace.h>
19 #include <net/netns/generic.h>
20 
21 /*
22  *	Our network namespace constructor/destructor lists
23  */
24 
25 static LIST_HEAD(pernet_list);
26 static struct list_head *first_device = &pernet_list;
27 DEFINE_MUTEX(net_mutex);
28 
29 LIST_HEAD(net_namespace_list);
30 EXPORT_SYMBOL_GPL(net_namespace_list);
31 
32 struct net init_net = {
33 	.dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head),
34 };
35 EXPORT_SYMBOL(init_net);
36 
37 #define INITIAL_NET_GEN_PTRS	13 /* +1 for len +2 for rcu_head */
38 
39 static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
40 
41 static struct net_generic *net_alloc_generic(void)
42 {
43 	struct net_generic *ng;
44 	size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
45 
46 	ng = kzalloc(generic_size, GFP_KERNEL);
47 	if (ng)
48 		ng->len = max_gen_ptrs;
49 
50 	return ng;
51 }
52 
53 static int net_assign_generic(struct net *net, int id, void *data)
54 {
55 	struct net_generic *ng, *old_ng;
56 
57 	BUG_ON(!mutex_is_locked(&net_mutex));
58 	BUG_ON(id == 0);
59 
60 	old_ng = rcu_dereference_protected(net->gen,
61 					   lockdep_is_held(&net_mutex));
62 	ng = old_ng;
63 	if (old_ng->len >= id)
64 		goto assign;
65 
66 	ng = net_alloc_generic();
67 	if (ng == NULL)
68 		return -ENOMEM;
69 
70 	/*
71 	 * Some synchronisation notes:
72 	 *
73 	 * The net_generic explores the net->gen array inside rcu
74 	 * read section. Besides once set the net->gen->ptr[x]
75 	 * pointer never changes (see rules in netns/generic.h).
76 	 *
77 	 * That said, we simply duplicate this array and schedule
78 	 * the old copy for kfree after a grace period.
79 	 */
80 
81 	memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
82 
83 	rcu_assign_pointer(net->gen, ng);
84 	kfree_rcu(old_ng, rcu);
85 assign:
86 	ng->ptr[id - 1] = data;
87 	return 0;
88 }
89 
90 static int ops_init(const struct pernet_operations *ops, struct net *net)
91 {
92 	int err = -ENOMEM;
93 	void *data = NULL;
94 
95 	if (ops->id && ops->size) {
96 		data = kzalloc(ops->size, GFP_KERNEL);
97 		if (!data)
98 			goto out;
99 
100 		err = net_assign_generic(net, *ops->id, data);
101 		if (err)
102 			goto cleanup;
103 	}
104 	err = 0;
105 	if (ops->init)
106 		err = ops->init(net);
107 	if (!err)
108 		return 0;
109 
110 cleanup:
111 	kfree(data);
112 
113 out:
114 	return err;
115 }
116 
117 static void ops_free(const struct pernet_operations *ops, struct net *net)
118 {
119 	if (ops->id && ops->size) {
120 		int id = *ops->id;
121 		kfree(net_generic(net, id));
122 	}
123 }
124 
125 static void ops_exit_list(const struct pernet_operations *ops,
126 			  struct list_head *net_exit_list)
127 {
128 	struct net *net;
129 	if (ops->exit) {
130 		list_for_each_entry(net, net_exit_list, exit_list)
131 			ops->exit(net);
132 	}
133 	if (ops->exit_batch)
134 		ops->exit_batch(net_exit_list);
135 }
136 
137 static void ops_free_list(const struct pernet_operations *ops,
138 			  struct list_head *net_exit_list)
139 {
140 	struct net *net;
141 	if (ops->size && ops->id) {
142 		list_for_each_entry(net, net_exit_list, exit_list)
143 			ops_free(ops, net);
144 	}
145 }
146 
147 /*
148  * setup_net runs the initializers for the network namespace object.
149  */
150 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
151 {
152 	/* Must be called with net_mutex held */
153 	const struct pernet_operations *ops, *saved_ops;
154 	int error = 0;
155 	LIST_HEAD(net_exit_list);
156 
157 	atomic_set(&net->count, 1);
158 	atomic_set(&net->passive, 1);
159 	net->dev_base_seq = 1;
160 	net->user_ns = user_ns;
161 
162 #ifdef NETNS_REFCNT_DEBUG
163 	atomic_set(&net->use_count, 0);
164 #endif
165 
166 	list_for_each_entry(ops, &pernet_list, list) {
167 		error = ops_init(ops, net);
168 		if (error < 0)
169 			goto out_undo;
170 	}
171 out:
172 	return error;
173 
174 out_undo:
175 	/* Walk through the list backwards calling the exit functions
176 	 * for the pernet modules whose init functions did not fail.
177 	 */
178 	list_add(&net->exit_list, &net_exit_list);
179 	saved_ops = ops;
180 	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
181 		ops_exit_list(ops, &net_exit_list);
182 
183 	ops = saved_ops;
184 	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
185 		ops_free_list(ops, &net_exit_list);
186 
187 	rcu_barrier();
188 	goto out;
189 }
190 
191 
192 #ifdef CONFIG_NET_NS
193 static struct kmem_cache *net_cachep;
194 static struct workqueue_struct *netns_wq;
195 
196 static struct net *net_alloc(void)
197 {
198 	struct net *net = NULL;
199 	struct net_generic *ng;
200 
201 	ng = net_alloc_generic();
202 	if (!ng)
203 		goto out;
204 
205 	net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
206 	if (!net)
207 		goto out_free;
208 
209 	rcu_assign_pointer(net->gen, ng);
210 out:
211 	return net;
212 
213 out_free:
214 	kfree(ng);
215 	goto out;
216 }
217 
218 static void net_free(struct net *net)
219 {
220 #ifdef NETNS_REFCNT_DEBUG
221 	if (unlikely(atomic_read(&net->use_count) != 0)) {
222 		pr_emerg("network namespace not free! Usage: %d\n",
223 			 atomic_read(&net->use_count));
224 		return;
225 	}
226 #endif
227 	kfree(rcu_access_pointer(net->gen));
228 	kmem_cache_free(net_cachep, net);
229 }
230 
231 void net_drop_ns(void *p)
232 {
233 	struct net *ns = p;
234 	if (ns && atomic_dec_and_test(&ns->passive))
235 		net_free(ns);
236 }
237 
238 struct net *copy_net_ns(unsigned long flags,
239 			struct user_namespace *user_ns, struct net *old_net)
240 {
241 	struct net *net;
242 	int rv;
243 
244 	if (!(flags & CLONE_NEWNET))
245 		return get_net(old_net);
246 
247 	net = net_alloc();
248 	if (!net)
249 		return ERR_PTR(-ENOMEM);
250 
251 	get_user_ns(user_ns);
252 
253 	mutex_lock(&net_mutex);
254 	rv = setup_net(net, user_ns);
255 	if (rv == 0) {
256 		rtnl_lock();
257 		list_add_tail_rcu(&net->list, &net_namespace_list);
258 		rtnl_unlock();
259 	}
260 	mutex_unlock(&net_mutex);
261 	if (rv < 0) {
262 		put_user_ns(user_ns);
263 		net_drop_ns(net);
264 		return ERR_PTR(rv);
265 	}
266 	return net;
267 }
268 
269 static DEFINE_SPINLOCK(cleanup_list_lock);
270 static LIST_HEAD(cleanup_list);  /* Must hold cleanup_list_lock to touch */
271 
272 static void cleanup_net(struct work_struct *work)
273 {
274 	const struct pernet_operations *ops;
275 	struct net *net, *tmp;
276 	struct list_head net_kill_list;
277 	LIST_HEAD(net_exit_list);
278 
279 	/* Atomically snapshot the list of namespaces to cleanup */
280 	spin_lock_irq(&cleanup_list_lock);
281 	list_replace_init(&cleanup_list, &net_kill_list);
282 	spin_unlock_irq(&cleanup_list_lock);
283 
284 	mutex_lock(&net_mutex);
285 
286 	/* Don't let anyone else find us. */
287 	rtnl_lock();
288 	list_for_each_entry(net, &net_kill_list, cleanup_list) {
289 		list_del_rcu(&net->list);
290 		list_add_tail(&net->exit_list, &net_exit_list);
291 	}
292 	rtnl_unlock();
293 
294 	/*
295 	 * Another CPU might be rcu-iterating the list, wait for it.
296 	 * This needs to be before calling the exit() notifiers, so
297 	 * the rcu_barrier() below isn't sufficient alone.
298 	 */
299 	synchronize_rcu();
300 
301 	/* Run all of the network namespace exit methods */
302 	list_for_each_entry_reverse(ops, &pernet_list, list)
303 		ops_exit_list(ops, &net_exit_list);
304 
305 	/* Free the net generic variables */
306 	list_for_each_entry_reverse(ops, &pernet_list, list)
307 		ops_free_list(ops, &net_exit_list);
308 
309 	mutex_unlock(&net_mutex);
310 
311 	/* Ensure there are no outstanding rcu callbacks using this
312 	 * network namespace.
313 	 */
314 	rcu_barrier();
315 
316 	/* Finally it is safe to free my network namespace structure */
317 	list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
318 		list_del_init(&net->exit_list);
319 		put_user_ns(net->user_ns);
320 		net_drop_ns(net);
321 	}
322 }
323 static DECLARE_WORK(net_cleanup_work, cleanup_net);
324 
325 void __put_net(struct net *net)
326 {
327 	/* Cleanup the network namespace in process context */
328 	unsigned long flags;
329 
330 	spin_lock_irqsave(&cleanup_list_lock, flags);
331 	list_add(&net->cleanup_list, &cleanup_list);
332 	spin_unlock_irqrestore(&cleanup_list_lock, flags);
333 
334 	queue_work(netns_wq, &net_cleanup_work);
335 }
336 EXPORT_SYMBOL_GPL(__put_net);
337 
338 struct net *get_net_ns_by_fd(int fd)
339 {
340 	struct file *file;
341 	struct ns_common *ns;
342 	struct net *net;
343 
344 	file = proc_ns_fget(fd);
345 	if (IS_ERR(file))
346 		return ERR_CAST(file);
347 
348 	ns = get_proc_ns(file_inode(file));
349 	if (ns->ops == &netns_operations)
350 		net = get_net(container_of(ns, struct net, ns));
351 	else
352 		net = ERR_PTR(-EINVAL);
353 
354 	fput(file);
355 	return net;
356 }
357 
358 #else
359 struct net *get_net_ns_by_fd(int fd)
360 {
361 	return ERR_PTR(-EINVAL);
362 }
363 #endif
364 
365 struct net *get_net_ns_by_pid(pid_t pid)
366 {
367 	struct task_struct *tsk;
368 	struct net *net;
369 
370 	/* Lookup the network namespace */
371 	net = ERR_PTR(-ESRCH);
372 	rcu_read_lock();
373 	tsk = find_task_by_vpid(pid);
374 	if (tsk) {
375 		struct nsproxy *nsproxy;
376 		task_lock(tsk);
377 		nsproxy = tsk->nsproxy;
378 		if (nsproxy)
379 			net = get_net(nsproxy->net_ns);
380 		task_unlock(tsk);
381 	}
382 	rcu_read_unlock();
383 	return net;
384 }
385 EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
386 
387 static __net_init int net_ns_net_init(struct net *net)
388 {
389 #ifdef CONFIG_NET_NS
390 	net->ns.ops = &netns_operations;
391 #endif
392 	return ns_alloc_inum(&net->ns);
393 }
394 
395 static __net_exit void net_ns_net_exit(struct net *net)
396 {
397 	ns_free_inum(&net->ns);
398 }
399 
400 static struct pernet_operations __net_initdata net_ns_ops = {
401 	.init = net_ns_net_init,
402 	.exit = net_ns_net_exit,
403 };
404 
405 static int __init net_ns_init(void)
406 {
407 	struct net_generic *ng;
408 
409 #ifdef CONFIG_NET_NS
410 	net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
411 					SMP_CACHE_BYTES,
412 					SLAB_PANIC, NULL);
413 
414 	/* Create workqueue for cleanup */
415 	netns_wq = create_singlethread_workqueue("netns");
416 	if (!netns_wq)
417 		panic("Could not create netns workq");
418 #endif
419 
420 	ng = net_alloc_generic();
421 	if (!ng)
422 		panic("Could not allocate generic netns");
423 
424 	rcu_assign_pointer(init_net.gen, ng);
425 
426 	mutex_lock(&net_mutex);
427 	if (setup_net(&init_net, &init_user_ns))
428 		panic("Could not setup the initial network namespace");
429 
430 	rtnl_lock();
431 	list_add_tail_rcu(&init_net.list, &net_namespace_list);
432 	rtnl_unlock();
433 
434 	mutex_unlock(&net_mutex);
435 
436 	register_pernet_subsys(&net_ns_ops);
437 
438 	return 0;
439 }
440 
441 pure_initcall(net_ns_init);
442 
443 #ifdef CONFIG_NET_NS
444 static int __register_pernet_operations(struct list_head *list,
445 					struct pernet_operations *ops)
446 {
447 	struct net *net;
448 	int error;
449 	LIST_HEAD(net_exit_list);
450 
451 	list_add_tail(&ops->list, list);
452 	if (ops->init || (ops->id && ops->size)) {
453 		for_each_net(net) {
454 			error = ops_init(ops, net);
455 			if (error)
456 				goto out_undo;
457 			list_add_tail(&net->exit_list, &net_exit_list);
458 		}
459 	}
460 	return 0;
461 
462 out_undo:
463 	/* If I have an error cleanup all namespaces I initialized */
464 	list_del(&ops->list);
465 	ops_exit_list(ops, &net_exit_list);
466 	ops_free_list(ops, &net_exit_list);
467 	return error;
468 }
469 
470 static void __unregister_pernet_operations(struct pernet_operations *ops)
471 {
472 	struct net *net;
473 	LIST_HEAD(net_exit_list);
474 
475 	list_del(&ops->list);
476 	for_each_net(net)
477 		list_add_tail(&net->exit_list, &net_exit_list);
478 	ops_exit_list(ops, &net_exit_list);
479 	ops_free_list(ops, &net_exit_list);
480 }
481 
482 #else
483 
484 static int __register_pernet_operations(struct list_head *list,
485 					struct pernet_operations *ops)
486 {
487 	return ops_init(ops, &init_net);
488 }
489 
490 static void __unregister_pernet_operations(struct pernet_operations *ops)
491 {
492 	LIST_HEAD(net_exit_list);
493 	list_add(&init_net.exit_list, &net_exit_list);
494 	ops_exit_list(ops, &net_exit_list);
495 	ops_free_list(ops, &net_exit_list);
496 }
497 
498 #endif /* CONFIG_NET_NS */
499 
500 static DEFINE_IDA(net_generic_ids);
501 
502 static int register_pernet_operations(struct list_head *list,
503 				      struct pernet_operations *ops)
504 {
505 	int error;
506 
507 	if (ops->id) {
508 again:
509 		error = ida_get_new_above(&net_generic_ids, 1, ops->id);
510 		if (error < 0) {
511 			if (error == -EAGAIN) {
512 				ida_pre_get(&net_generic_ids, GFP_KERNEL);
513 				goto again;
514 			}
515 			return error;
516 		}
517 		max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
518 	}
519 	error = __register_pernet_operations(list, ops);
520 	if (error) {
521 		rcu_barrier();
522 		if (ops->id)
523 			ida_remove(&net_generic_ids, *ops->id);
524 	}
525 
526 	return error;
527 }
528 
529 static void unregister_pernet_operations(struct pernet_operations *ops)
530 {
531 
532 	__unregister_pernet_operations(ops);
533 	rcu_barrier();
534 	if (ops->id)
535 		ida_remove(&net_generic_ids, *ops->id);
536 }
537 
538 /**
539  *      register_pernet_subsys - register a network namespace subsystem
540  *	@ops:  pernet operations structure for the subsystem
541  *
542  *	Register a subsystem which has init and exit functions
543  *	that are called when network namespaces are created and
544  *	destroyed respectively.
545  *
546  *	When registered all network namespace init functions are
547  *	called for every existing network namespace.  Allowing kernel
548  *	modules to have a race free view of the set of network namespaces.
549  *
550  *	When a new network namespace is created all of the init
551  *	methods are called in the order in which they were registered.
552  *
553  *	When a network namespace is destroyed all of the exit methods
554  *	are called in the reverse of the order with which they were
555  *	registered.
556  */
557 int register_pernet_subsys(struct pernet_operations *ops)
558 {
559 	int error;
560 	mutex_lock(&net_mutex);
561 	error =  register_pernet_operations(first_device, ops);
562 	mutex_unlock(&net_mutex);
563 	return error;
564 }
565 EXPORT_SYMBOL_GPL(register_pernet_subsys);
566 
567 /**
568  *      unregister_pernet_subsys - unregister a network namespace subsystem
569  *	@ops: pernet operations structure to manipulate
570  *
571  *	Remove the pernet operations structure from the list to be
572  *	used when network namespaces are created or destroyed.  In
573  *	addition run the exit method for all existing network
574  *	namespaces.
575  */
576 void unregister_pernet_subsys(struct pernet_operations *ops)
577 {
578 	mutex_lock(&net_mutex);
579 	unregister_pernet_operations(ops);
580 	mutex_unlock(&net_mutex);
581 }
582 EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
583 
584 /**
585  *      register_pernet_device - register a network namespace device
586  *	@ops:  pernet operations structure for the subsystem
587  *
588  *	Register a device which has init and exit functions
589  *	that are called when network namespaces are created and
590  *	destroyed respectively.
591  *
592  *	When registered all network namespace init functions are
593  *	called for every existing network namespace.  Allowing kernel
594  *	modules to have a race free view of the set of network namespaces.
595  *
596  *	When a new network namespace is created all of the init
597  *	methods are called in the order in which they were registered.
598  *
599  *	When a network namespace is destroyed all of the exit methods
600  *	are called in the reverse of the order with which they were
601  *	registered.
602  */
603 int register_pernet_device(struct pernet_operations *ops)
604 {
605 	int error;
606 	mutex_lock(&net_mutex);
607 	error = register_pernet_operations(&pernet_list, ops);
608 	if (!error && (first_device == &pernet_list))
609 		first_device = &ops->list;
610 	mutex_unlock(&net_mutex);
611 	return error;
612 }
613 EXPORT_SYMBOL_GPL(register_pernet_device);
614 
615 /**
616  *      unregister_pernet_device - unregister a network namespace netdevice
617  *	@ops: pernet operations structure to manipulate
618  *
619  *	Remove the pernet operations structure from the list to be
620  *	used when network namespaces are created or destroyed.  In
621  *	addition run the exit method for all existing network
622  *	namespaces.
623  */
624 void unregister_pernet_device(struct pernet_operations *ops)
625 {
626 	mutex_lock(&net_mutex);
627 	if (&ops->list == first_device)
628 		first_device = first_device->next;
629 	unregister_pernet_operations(ops);
630 	mutex_unlock(&net_mutex);
631 }
632 EXPORT_SYMBOL_GPL(unregister_pernet_device);
633 
634 #ifdef CONFIG_NET_NS
635 static struct ns_common *netns_get(struct task_struct *task)
636 {
637 	struct net *net = NULL;
638 	struct nsproxy *nsproxy;
639 
640 	task_lock(task);
641 	nsproxy = task->nsproxy;
642 	if (nsproxy)
643 		net = get_net(nsproxy->net_ns);
644 	task_unlock(task);
645 
646 	return net ? &net->ns : NULL;
647 }
648 
649 static inline struct net *to_net_ns(struct ns_common *ns)
650 {
651 	return container_of(ns, struct net, ns);
652 }
653 
654 static void netns_put(struct ns_common *ns)
655 {
656 	put_net(to_net_ns(ns));
657 }
658 
659 static int netns_install(struct nsproxy *nsproxy, struct ns_common *ns)
660 {
661 	struct net *net = to_net_ns(ns);
662 
663 	if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
664 	    !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
665 		return -EPERM;
666 
667 	put_net(nsproxy->net_ns);
668 	nsproxy->net_ns = get_net(net);
669 	return 0;
670 }
671 
672 const struct proc_ns_operations netns_operations = {
673 	.name		= "net",
674 	.type		= CLONE_NEWNET,
675 	.get		= netns_get,
676 	.put		= netns_put,
677 	.install	= netns_install,
678 };
679 #endif
680