1 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 2 3 #include <linux/workqueue.h> 4 #include <linux/rtnetlink.h> 5 #include <linux/cache.h> 6 #include <linux/slab.h> 7 #include <linux/list.h> 8 #include <linux/delay.h> 9 #include <linux/sched.h> 10 #include <linux/idr.h> 11 #include <linux/rculist.h> 12 #include <linux/nsproxy.h> 13 #include <linux/fs.h> 14 #include <linux/proc_ns.h> 15 #include <linux/file.h> 16 #include <linux/export.h> 17 #include <linux/user_namespace.h> 18 #include <net/net_namespace.h> 19 #include <net/netns/generic.h> 20 21 /* 22 * Our network namespace constructor/destructor lists 23 */ 24 25 static LIST_HEAD(pernet_list); 26 static struct list_head *first_device = &pernet_list; 27 DEFINE_MUTEX(net_mutex); 28 29 LIST_HEAD(net_namespace_list); 30 EXPORT_SYMBOL_GPL(net_namespace_list); 31 32 struct net init_net = { 33 .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head), 34 }; 35 EXPORT_SYMBOL(init_net); 36 37 #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */ 38 39 static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS; 40 41 static struct net_generic *net_alloc_generic(void) 42 { 43 struct net_generic *ng; 44 size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]); 45 46 ng = kzalloc(generic_size, GFP_KERNEL); 47 if (ng) 48 ng->len = max_gen_ptrs; 49 50 return ng; 51 } 52 53 static int net_assign_generic(struct net *net, int id, void *data) 54 { 55 struct net_generic *ng, *old_ng; 56 57 BUG_ON(!mutex_is_locked(&net_mutex)); 58 BUG_ON(id == 0); 59 60 old_ng = rcu_dereference_protected(net->gen, 61 lockdep_is_held(&net_mutex)); 62 ng = old_ng; 63 if (old_ng->len >= id) 64 goto assign; 65 66 ng = net_alloc_generic(); 67 if (ng == NULL) 68 return -ENOMEM; 69 70 /* 71 * Some synchronisation notes: 72 * 73 * The net_generic explores the net->gen array inside rcu 74 * read section. Besides once set the net->gen->ptr[x] 75 * pointer never changes (see rules in netns/generic.h). 76 * 77 * That said, we simply duplicate this array and schedule 78 * the old copy for kfree after a grace period. 79 */ 80 81 memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*)); 82 83 rcu_assign_pointer(net->gen, ng); 84 kfree_rcu(old_ng, rcu); 85 assign: 86 ng->ptr[id - 1] = data; 87 return 0; 88 } 89 90 static int ops_init(const struct pernet_operations *ops, struct net *net) 91 { 92 int err = -ENOMEM; 93 void *data = NULL; 94 95 if (ops->id && ops->size) { 96 data = kzalloc(ops->size, GFP_KERNEL); 97 if (!data) 98 goto out; 99 100 err = net_assign_generic(net, *ops->id, data); 101 if (err) 102 goto cleanup; 103 } 104 err = 0; 105 if (ops->init) 106 err = ops->init(net); 107 if (!err) 108 return 0; 109 110 cleanup: 111 kfree(data); 112 113 out: 114 return err; 115 } 116 117 static void ops_free(const struct pernet_operations *ops, struct net *net) 118 { 119 if (ops->id && ops->size) { 120 int id = *ops->id; 121 kfree(net_generic(net, id)); 122 } 123 } 124 125 static void ops_exit_list(const struct pernet_operations *ops, 126 struct list_head *net_exit_list) 127 { 128 struct net *net; 129 if (ops->exit) { 130 list_for_each_entry(net, net_exit_list, exit_list) 131 ops->exit(net); 132 } 133 if (ops->exit_batch) 134 ops->exit_batch(net_exit_list); 135 } 136 137 static void ops_free_list(const struct pernet_operations *ops, 138 struct list_head *net_exit_list) 139 { 140 struct net *net; 141 if (ops->size && ops->id) { 142 list_for_each_entry(net, net_exit_list, exit_list) 143 ops_free(ops, net); 144 } 145 } 146 147 /* 148 * setup_net runs the initializers for the network namespace object. 149 */ 150 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) 151 { 152 /* Must be called with net_mutex held */ 153 const struct pernet_operations *ops, *saved_ops; 154 int error = 0; 155 LIST_HEAD(net_exit_list); 156 157 atomic_set(&net->count, 1); 158 atomic_set(&net->passive, 1); 159 net->dev_base_seq = 1; 160 net->user_ns = user_ns; 161 162 #ifdef NETNS_REFCNT_DEBUG 163 atomic_set(&net->use_count, 0); 164 #endif 165 166 list_for_each_entry(ops, &pernet_list, list) { 167 error = ops_init(ops, net); 168 if (error < 0) 169 goto out_undo; 170 } 171 out: 172 return error; 173 174 out_undo: 175 /* Walk through the list backwards calling the exit functions 176 * for the pernet modules whose init functions did not fail. 177 */ 178 list_add(&net->exit_list, &net_exit_list); 179 saved_ops = ops; 180 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 181 ops_exit_list(ops, &net_exit_list); 182 183 ops = saved_ops; 184 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 185 ops_free_list(ops, &net_exit_list); 186 187 rcu_barrier(); 188 goto out; 189 } 190 191 192 #ifdef CONFIG_NET_NS 193 static struct kmem_cache *net_cachep; 194 static struct workqueue_struct *netns_wq; 195 196 static struct net *net_alloc(void) 197 { 198 struct net *net = NULL; 199 struct net_generic *ng; 200 201 ng = net_alloc_generic(); 202 if (!ng) 203 goto out; 204 205 net = kmem_cache_zalloc(net_cachep, GFP_KERNEL); 206 if (!net) 207 goto out_free; 208 209 rcu_assign_pointer(net->gen, ng); 210 out: 211 return net; 212 213 out_free: 214 kfree(ng); 215 goto out; 216 } 217 218 static void net_free(struct net *net) 219 { 220 #ifdef NETNS_REFCNT_DEBUG 221 if (unlikely(atomic_read(&net->use_count) != 0)) { 222 pr_emerg("network namespace not free! Usage: %d\n", 223 atomic_read(&net->use_count)); 224 return; 225 } 226 #endif 227 kfree(rcu_access_pointer(net->gen)); 228 kmem_cache_free(net_cachep, net); 229 } 230 231 void net_drop_ns(void *p) 232 { 233 struct net *ns = p; 234 if (ns && atomic_dec_and_test(&ns->passive)) 235 net_free(ns); 236 } 237 238 struct net *copy_net_ns(unsigned long flags, 239 struct user_namespace *user_ns, struct net *old_net) 240 { 241 struct net *net; 242 int rv; 243 244 if (!(flags & CLONE_NEWNET)) 245 return get_net(old_net); 246 247 net = net_alloc(); 248 if (!net) 249 return ERR_PTR(-ENOMEM); 250 251 get_user_ns(user_ns); 252 253 mutex_lock(&net_mutex); 254 rv = setup_net(net, user_ns); 255 if (rv == 0) { 256 rtnl_lock(); 257 list_add_tail_rcu(&net->list, &net_namespace_list); 258 rtnl_unlock(); 259 } 260 mutex_unlock(&net_mutex); 261 if (rv < 0) { 262 put_user_ns(user_ns); 263 net_drop_ns(net); 264 return ERR_PTR(rv); 265 } 266 return net; 267 } 268 269 static DEFINE_SPINLOCK(cleanup_list_lock); 270 static LIST_HEAD(cleanup_list); /* Must hold cleanup_list_lock to touch */ 271 272 static void cleanup_net(struct work_struct *work) 273 { 274 const struct pernet_operations *ops; 275 struct net *net, *tmp; 276 struct list_head net_kill_list; 277 LIST_HEAD(net_exit_list); 278 279 /* Atomically snapshot the list of namespaces to cleanup */ 280 spin_lock_irq(&cleanup_list_lock); 281 list_replace_init(&cleanup_list, &net_kill_list); 282 spin_unlock_irq(&cleanup_list_lock); 283 284 mutex_lock(&net_mutex); 285 286 /* Don't let anyone else find us. */ 287 rtnl_lock(); 288 list_for_each_entry(net, &net_kill_list, cleanup_list) { 289 list_del_rcu(&net->list); 290 list_add_tail(&net->exit_list, &net_exit_list); 291 } 292 rtnl_unlock(); 293 294 /* 295 * Another CPU might be rcu-iterating the list, wait for it. 296 * This needs to be before calling the exit() notifiers, so 297 * the rcu_barrier() below isn't sufficient alone. 298 */ 299 synchronize_rcu(); 300 301 /* Run all of the network namespace exit methods */ 302 list_for_each_entry_reverse(ops, &pernet_list, list) 303 ops_exit_list(ops, &net_exit_list); 304 305 /* Free the net generic variables */ 306 list_for_each_entry_reverse(ops, &pernet_list, list) 307 ops_free_list(ops, &net_exit_list); 308 309 mutex_unlock(&net_mutex); 310 311 /* Ensure there are no outstanding rcu callbacks using this 312 * network namespace. 313 */ 314 rcu_barrier(); 315 316 /* Finally it is safe to free my network namespace structure */ 317 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) { 318 list_del_init(&net->exit_list); 319 put_user_ns(net->user_ns); 320 net_drop_ns(net); 321 } 322 } 323 static DECLARE_WORK(net_cleanup_work, cleanup_net); 324 325 void __put_net(struct net *net) 326 { 327 /* Cleanup the network namespace in process context */ 328 unsigned long flags; 329 330 spin_lock_irqsave(&cleanup_list_lock, flags); 331 list_add(&net->cleanup_list, &cleanup_list); 332 spin_unlock_irqrestore(&cleanup_list_lock, flags); 333 334 queue_work(netns_wq, &net_cleanup_work); 335 } 336 EXPORT_SYMBOL_GPL(__put_net); 337 338 struct net *get_net_ns_by_fd(int fd) 339 { 340 struct file *file; 341 struct ns_common *ns; 342 struct net *net; 343 344 file = proc_ns_fget(fd); 345 if (IS_ERR(file)) 346 return ERR_CAST(file); 347 348 ns = get_proc_ns(file_inode(file)); 349 if (ns->ops == &netns_operations) 350 net = get_net(container_of(ns, struct net, ns)); 351 else 352 net = ERR_PTR(-EINVAL); 353 354 fput(file); 355 return net; 356 } 357 358 #else 359 struct net *get_net_ns_by_fd(int fd) 360 { 361 return ERR_PTR(-EINVAL); 362 } 363 #endif 364 365 struct net *get_net_ns_by_pid(pid_t pid) 366 { 367 struct task_struct *tsk; 368 struct net *net; 369 370 /* Lookup the network namespace */ 371 net = ERR_PTR(-ESRCH); 372 rcu_read_lock(); 373 tsk = find_task_by_vpid(pid); 374 if (tsk) { 375 struct nsproxy *nsproxy; 376 task_lock(tsk); 377 nsproxy = tsk->nsproxy; 378 if (nsproxy) 379 net = get_net(nsproxy->net_ns); 380 task_unlock(tsk); 381 } 382 rcu_read_unlock(); 383 return net; 384 } 385 EXPORT_SYMBOL_GPL(get_net_ns_by_pid); 386 387 static __net_init int net_ns_net_init(struct net *net) 388 { 389 #ifdef CONFIG_NET_NS 390 net->ns.ops = &netns_operations; 391 #endif 392 return ns_alloc_inum(&net->ns); 393 } 394 395 static __net_exit void net_ns_net_exit(struct net *net) 396 { 397 ns_free_inum(&net->ns); 398 } 399 400 static struct pernet_operations __net_initdata net_ns_ops = { 401 .init = net_ns_net_init, 402 .exit = net_ns_net_exit, 403 }; 404 405 static int __init net_ns_init(void) 406 { 407 struct net_generic *ng; 408 409 #ifdef CONFIG_NET_NS 410 net_cachep = kmem_cache_create("net_namespace", sizeof(struct net), 411 SMP_CACHE_BYTES, 412 SLAB_PANIC, NULL); 413 414 /* Create workqueue for cleanup */ 415 netns_wq = create_singlethread_workqueue("netns"); 416 if (!netns_wq) 417 panic("Could not create netns workq"); 418 #endif 419 420 ng = net_alloc_generic(); 421 if (!ng) 422 panic("Could not allocate generic netns"); 423 424 rcu_assign_pointer(init_net.gen, ng); 425 426 mutex_lock(&net_mutex); 427 if (setup_net(&init_net, &init_user_ns)) 428 panic("Could not setup the initial network namespace"); 429 430 rtnl_lock(); 431 list_add_tail_rcu(&init_net.list, &net_namespace_list); 432 rtnl_unlock(); 433 434 mutex_unlock(&net_mutex); 435 436 register_pernet_subsys(&net_ns_ops); 437 438 return 0; 439 } 440 441 pure_initcall(net_ns_init); 442 443 #ifdef CONFIG_NET_NS 444 static int __register_pernet_operations(struct list_head *list, 445 struct pernet_operations *ops) 446 { 447 struct net *net; 448 int error; 449 LIST_HEAD(net_exit_list); 450 451 list_add_tail(&ops->list, list); 452 if (ops->init || (ops->id && ops->size)) { 453 for_each_net(net) { 454 error = ops_init(ops, net); 455 if (error) 456 goto out_undo; 457 list_add_tail(&net->exit_list, &net_exit_list); 458 } 459 } 460 return 0; 461 462 out_undo: 463 /* If I have an error cleanup all namespaces I initialized */ 464 list_del(&ops->list); 465 ops_exit_list(ops, &net_exit_list); 466 ops_free_list(ops, &net_exit_list); 467 return error; 468 } 469 470 static void __unregister_pernet_operations(struct pernet_operations *ops) 471 { 472 struct net *net; 473 LIST_HEAD(net_exit_list); 474 475 list_del(&ops->list); 476 for_each_net(net) 477 list_add_tail(&net->exit_list, &net_exit_list); 478 ops_exit_list(ops, &net_exit_list); 479 ops_free_list(ops, &net_exit_list); 480 } 481 482 #else 483 484 static int __register_pernet_operations(struct list_head *list, 485 struct pernet_operations *ops) 486 { 487 return ops_init(ops, &init_net); 488 } 489 490 static void __unregister_pernet_operations(struct pernet_operations *ops) 491 { 492 LIST_HEAD(net_exit_list); 493 list_add(&init_net.exit_list, &net_exit_list); 494 ops_exit_list(ops, &net_exit_list); 495 ops_free_list(ops, &net_exit_list); 496 } 497 498 #endif /* CONFIG_NET_NS */ 499 500 static DEFINE_IDA(net_generic_ids); 501 502 static int register_pernet_operations(struct list_head *list, 503 struct pernet_operations *ops) 504 { 505 int error; 506 507 if (ops->id) { 508 again: 509 error = ida_get_new_above(&net_generic_ids, 1, ops->id); 510 if (error < 0) { 511 if (error == -EAGAIN) { 512 ida_pre_get(&net_generic_ids, GFP_KERNEL); 513 goto again; 514 } 515 return error; 516 } 517 max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id); 518 } 519 error = __register_pernet_operations(list, ops); 520 if (error) { 521 rcu_barrier(); 522 if (ops->id) 523 ida_remove(&net_generic_ids, *ops->id); 524 } 525 526 return error; 527 } 528 529 static void unregister_pernet_operations(struct pernet_operations *ops) 530 { 531 532 __unregister_pernet_operations(ops); 533 rcu_barrier(); 534 if (ops->id) 535 ida_remove(&net_generic_ids, *ops->id); 536 } 537 538 /** 539 * register_pernet_subsys - register a network namespace subsystem 540 * @ops: pernet operations structure for the subsystem 541 * 542 * Register a subsystem which has init and exit functions 543 * that are called when network namespaces are created and 544 * destroyed respectively. 545 * 546 * When registered all network namespace init functions are 547 * called for every existing network namespace. Allowing kernel 548 * modules to have a race free view of the set of network namespaces. 549 * 550 * When a new network namespace is created all of the init 551 * methods are called in the order in which they were registered. 552 * 553 * When a network namespace is destroyed all of the exit methods 554 * are called in the reverse of the order with which they were 555 * registered. 556 */ 557 int register_pernet_subsys(struct pernet_operations *ops) 558 { 559 int error; 560 mutex_lock(&net_mutex); 561 error = register_pernet_operations(first_device, ops); 562 mutex_unlock(&net_mutex); 563 return error; 564 } 565 EXPORT_SYMBOL_GPL(register_pernet_subsys); 566 567 /** 568 * unregister_pernet_subsys - unregister a network namespace subsystem 569 * @ops: pernet operations structure to manipulate 570 * 571 * Remove the pernet operations structure from the list to be 572 * used when network namespaces are created or destroyed. In 573 * addition run the exit method for all existing network 574 * namespaces. 575 */ 576 void unregister_pernet_subsys(struct pernet_operations *ops) 577 { 578 mutex_lock(&net_mutex); 579 unregister_pernet_operations(ops); 580 mutex_unlock(&net_mutex); 581 } 582 EXPORT_SYMBOL_GPL(unregister_pernet_subsys); 583 584 /** 585 * register_pernet_device - register a network namespace device 586 * @ops: pernet operations structure for the subsystem 587 * 588 * Register a device which has init and exit functions 589 * that are called when network namespaces are created and 590 * destroyed respectively. 591 * 592 * When registered all network namespace init functions are 593 * called for every existing network namespace. Allowing kernel 594 * modules to have a race free view of the set of network namespaces. 595 * 596 * When a new network namespace is created all of the init 597 * methods are called in the order in which they were registered. 598 * 599 * When a network namespace is destroyed all of the exit methods 600 * are called in the reverse of the order with which they were 601 * registered. 602 */ 603 int register_pernet_device(struct pernet_operations *ops) 604 { 605 int error; 606 mutex_lock(&net_mutex); 607 error = register_pernet_operations(&pernet_list, ops); 608 if (!error && (first_device == &pernet_list)) 609 first_device = &ops->list; 610 mutex_unlock(&net_mutex); 611 return error; 612 } 613 EXPORT_SYMBOL_GPL(register_pernet_device); 614 615 /** 616 * unregister_pernet_device - unregister a network namespace netdevice 617 * @ops: pernet operations structure to manipulate 618 * 619 * Remove the pernet operations structure from the list to be 620 * used when network namespaces are created or destroyed. In 621 * addition run the exit method for all existing network 622 * namespaces. 623 */ 624 void unregister_pernet_device(struct pernet_operations *ops) 625 { 626 mutex_lock(&net_mutex); 627 if (&ops->list == first_device) 628 first_device = first_device->next; 629 unregister_pernet_operations(ops); 630 mutex_unlock(&net_mutex); 631 } 632 EXPORT_SYMBOL_GPL(unregister_pernet_device); 633 634 #ifdef CONFIG_NET_NS 635 static struct ns_common *netns_get(struct task_struct *task) 636 { 637 struct net *net = NULL; 638 struct nsproxy *nsproxy; 639 640 task_lock(task); 641 nsproxy = task->nsproxy; 642 if (nsproxy) 643 net = get_net(nsproxy->net_ns); 644 task_unlock(task); 645 646 return net ? &net->ns : NULL; 647 } 648 649 static inline struct net *to_net_ns(struct ns_common *ns) 650 { 651 return container_of(ns, struct net, ns); 652 } 653 654 static void netns_put(struct ns_common *ns) 655 { 656 put_net(to_net_ns(ns)); 657 } 658 659 static int netns_install(struct nsproxy *nsproxy, struct ns_common *ns) 660 { 661 struct net *net = to_net_ns(ns); 662 663 if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) || 664 !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) 665 return -EPERM; 666 667 put_net(nsproxy->net_ns); 668 nsproxy->net_ns = get_net(net); 669 return 0; 670 } 671 672 const struct proc_ns_operations netns_operations = { 673 .name = "net", 674 .type = CLONE_NEWNET, 675 .get = netns_get, 676 .put = netns_put, 677 .install = netns_install, 678 }; 679 #endif 680