1 // SPDX-License-Identifier: GPL-2.0 2 /* -*- linux-c -*- 3 * sysctl_net_core.c: sysctl interface to net core subsystem. 4 * 5 * Begun April 1, 1996, Mike Shaver. 6 * Added /proc/sys/net/core directory entry (empty =) ). [MS] 7 */ 8 9 #include <linux/mm.h> 10 #include <linux/sysctl.h> 11 #include <linux/module.h> 12 #include <linux/socket.h> 13 #include <linux/netdevice.h> 14 #include <linux/ratelimit.h> 15 #include <linux/vmalloc.h> 16 #include <linux/init.h> 17 #include <linux/slab.h> 18 19 #include <net/ip.h> 20 #include <net/sock.h> 21 #include <net/net_ratelimit.h> 22 #include <net/busy_poll.h> 23 #include <net/pkt_sched.h> 24 25 static int two __maybe_unused = 2; 26 static int three = 3; 27 static int min_sndbuf = SOCK_MIN_SNDBUF; 28 static int min_rcvbuf = SOCK_MIN_RCVBUF; 29 static int max_skb_frags = MAX_SKB_FRAGS; 30 static long long_one __maybe_unused = 1; 31 static long long_max __maybe_unused = LONG_MAX; 32 33 static int net_msg_warn; /* Unused, but still a sysctl */ 34 35 int sysctl_fb_tunnels_only_for_init_net __read_mostly = 0; 36 EXPORT_SYMBOL(sysctl_fb_tunnels_only_for_init_net); 37 38 /* 0 - Keep current behavior: 39 * IPv4: inherit all current settings from init_net 40 * IPv6: reset all settings to default 41 * 1 - Both inherit all current settings from init_net 42 * 2 - Both reset all settings to default 43 * 3 - Both inherit all settings from current netns 44 */ 45 int sysctl_devconf_inherit_init_net __read_mostly; 46 EXPORT_SYMBOL(sysctl_devconf_inherit_init_net); 47 48 #ifdef CONFIG_RPS 49 static int rps_sock_flow_sysctl(struct ctl_table *table, int write, 50 void *buffer, size_t *lenp, loff_t *ppos) 51 { 52 unsigned int orig_size, size; 53 int ret, i; 54 struct ctl_table tmp = { 55 .data = &size, 56 .maxlen = sizeof(size), 57 .mode = table->mode 58 }; 59 struct rps_sock_flow_table *orig_sock_table, *sock_table; 60 static DEFINE_MUTEX(sock_flow_mutex); 61 62 mutex_lock(&sock_flow_mutex); 63 64 orig_sock_table = rcu_dereference_protected(rps_sock_flow_table, 65 lockdep_is_held(&sock_flow_mutex)); 66 size = orig_size = orig_sock_table ? orig_sock_table->mask + 1 : 0; 67 68 ret = proc_dointvec(&tmp, write, buffer, lenp, ppos); 69 70 if (write) { 71 if (size) { 72 if (size > 1<<29) { 73 /* Enforce limit to prevent overflow */ 74 mutex_unlock(&sock_flow_mutex); 75 return -EINVAL; 76 } 77 size = roundup_pow_of_two(size); 78 if (size != orig_size) { 79 sock_table = 80 vmalloc(RPS_SOCK_FLOW_TABLE_SIZE(size)); 81 if (!sock_table) { 82 mutex_unlock(&sock_flow_mutex); 83 return -ENOMEM; 84 } 85 rps_cpu_mask = roundup_pow_of_two(nr_cpu_ids) - 1; 86 sock_table->mask = size - 1; 87 } else 88 sock_table = orig_sock_table; 89 90 for (i = 0; i < size; i++) 91 sock_table->ents[i] = RPS_NO_CPU; 92 } else 93 sock_table = NULL; 94 95 if (sock_table != orig_sock_table) { 96 rcu_assign_pointer(rps_sock_flow_table, sock_table); 97 if (sock_table) { 98 static_branch_inc(&rps_needed); 99 static_branch_inc(&rfs_needed); 100 } 101 if (orig_sock_table) { 102 static_branch_dec(&rps_needed); 103 static_branch_dec(&rfs_needed); 104 synchronize_rcu(); 105 vfree(orig_sock_table); 106 } 107 } 108 } 109 110 mutex_unlock(&sock_flow_mutex); 111 112 return ret; 113 } 114 #endif /* CONFIG_RPS */ 115 116 #ifdef CONFIG_NET_FLOW_LIMIT 117 static DEFINE_MUTEX(flow_limit_update_mutex); 118 119 static int flow_limit_cpu_sysctl(struct ctl_table *table, int write, 120 void *buffer, size_t *lenp, loff_t *ppos) 121 { 122 struct sd_flow_limit *cur; 123 struct softnet_data *sd; 124 cpumask_var_t mask; 125 int i, len, ret = 0; 126 127 if (!alloc_cpumask_var(&mask, GFP_KERNEL)) 128 return -ENOMEM; 129 130 if (write) { 131 ret = cpumask_parse(buffer, mask); 132 if (ret) 133 goto done; 134 135 mutex_lock(&flow_limit_update_mutex); 136 len = sizeof(*cur) + netdev_flow_limit_table_len; 137 for_each_possible_cpu(i) { 138 sd = &per_cpu(softnet_data, i); 139 cur = rcu_dereference_protected(sd->flow_limit, 140 lockdep_is_held(&flow_limit_update_mutex)); 141 if (cur && !cpumask_test_cpu(i, mask)) { 142 RCU_INIT_POINTER(sd->flow_limit, NULL); 143 synchronize_rcu(); 144 kfree(cur); 145 } else if (!cur && cpumask_test_cpu(i, mask)) { 146 cur = kzalloc_node(len, GFP_KERNEL, 147 cpu_to_node(i)); 148 if (!cur) { 149 /* not unwinding previous changes */ 150 ret = -ENOMEM; 151 goto write_unlock; 152 } 153 cur->num_buckets = netdev_flow_limit_table_len; 154 rcu_assign_pointer(sd->flow_limit, cur); 155 } 156 } 157 write_unlock: 158 mutex_unlock(&flow_limit_update_mutex); 159 } else { 160 char kbuf[128]; 161 162 if (*ppos || !*lenp) { 163 *lenp = 0; 164 goto done; 165 } 166 167 cpumask_clear(mask); 168 rcu_read_lock(); 169 for_each_possible_cpu(i) { 170 sd = &per_cpu(softnet_data, i); 171 if (rcu_dereference(sd->flow_limit)) 172 cpumask_set_cpu(i, mask); 173 } 174 rcu_read_unlock(); 175 176 len = min(sizeof(kbuf) - 1, *lenp); 177 len = scnprintf(kbuf, len, "%*pb", cpumask_pr_args(mask)); 178 if (!len) { 179 *lenp = 0; 180 goto done; 181 } 182 if (len < *lenp) 183 kbuf[len++] = '\n'; 184 memcpy(buffer, kbuf, len); 185 *lenp = len; 186 *ppos += len; 187 } 188 189 done: 190 free_cpumask_var(mask); 191 return ret; 192 } 193 194 static int flow_limit_table_len_sysctl(struct ctl_table *table, int write, 195 void *buffer, size_t *lenp, loff_t *ppos) 196 { 197 unsigned int old, *ptr; 198 int ret; 199 200 mutex_lock(&flow_limit_update_mutex); 201 202 ptr = table->data; 203 old = *ptr; 204 ret = proc_dointvec(table, write, buffer, lenp, ppos); 205 if (!ret && write && !is_power_of_2(*ptr)) { 206 *ptr = old; 207 ret = -EINVAL; 208 } 209 210 mutex_unlock(&flow_limit_update_mutex); 211 return ret; 212 } 213 #endif /* CONFIG_NET_FLOW_LIMIT */ 214 215 #ifdef CONFIG_NET_SCHED 216 static int set_default_qdisc(struct ctl_table *table, int write, 217 void *buffer, size_t *lenp, loff_t *ppos) 218 { 219 char id[IFNAMSIZ]; 220 struct ctl_table tbl = { 221 .data = id, 222 .maxlen = IFNAMSIZ, 223 }; 224 int ret; 225 226 qdisc_get_default(id, IFNAMSIZ); 227 228 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 229 if (write && ret == 0) 230 ret = qdisc_set_default(id); 231 return ret; 232 } 233 #endif 234 235 static int proc_do_dev_weight(struct ctl_table *table, int write, 236 void *buffer, size_t *lenp, loff_t *ppos) 237 { 238 int ret; 239 240 ret = proc_dointvec(table, write, buffer, lenp, ppos); 241 if (ret != 0) 242 return ret; 243 244 dev_rx_weight = weight_p * dev_weight_rx_bias; 245 dev_tx_weight = weight_p * dev_weight_tx_bias; 246 247 return ret; 248 } 249 250 static int proc_do_rss_key(struct ctl_table *table, int write, 251 void *buffer, size_t *lenp, loff_t *ppos) 252 { 253 struct ctl_table fake_table; 254 char buf[NETDEV_RSS_KEY_LEN * 3]; 255 256 snprintf(buf, sizeof(buf), "%*phC", NETDEV_RSS_KEY_LEN, netdev_rss_key); 257 fake_table.data = buf; 258 fake_table.maxlen = sizeof(buf); 259 return proc_dostring(&fake_table, write, buffer, lenp, ppos); 260 } 261 262 #ifdef CONFIG_BPF_JIT 263 static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write, 264 void *buffer, size_t *lenp, 265 loff_t *ppos) 266 { 267 int ret, jit_enable = *(int *)table->data; 268 struct ctl_table tmp = *table; 269 270 if (write && !capable(CAP_SYS_ADMIN)) 271 return -EPERM; 272 273 tmp.data = &jit_enable; 274 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 275 if (write && !ret) { 276 if (jit_enable < 2 || 277 (jit_enable == 2 && bpf_dump_raw_ok(current_cred()))) { 278 *(int *)table->data = jit_enable; 279 if (jit_enable == 2) 280 pr_warn("bpf_jit_enable = 2 was set! NEVER use this in production, only for JIT debugging!\n"); 281 } else { 282 ret = -EPERM; 283 } 284 } 285 return ret; 286 } 287 288 # ifdef CONFIG_HAVE_EBPF_JIT 289 static int 290 proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write, 291 void *buffer, size_t *lenp, loff_t *ppos) 292 { 293 if (!capable(CAP_SYS_ADMIN)) 294 return -EPERM; 295 296 return proc_dointvec_minmax(table, write, buffer, lenp, ppos); 297 } 298 # endif /* CONFIG_HAVE_EBPF_JIT */ 299 300 static int 301 proc_dolongvec_minmax_bpf_restricted(struct ctl_table *table, int write, 302 void *buffer, size_t *lenp, loff_t *ppos) 303 { 304 if (!capable(CAP_SYS_ADMIN)) 305 return -EPERM; 306 307 return proc_doulongvec_minmax(table, write, buffer, lenp, ppos); 308 } 309 #endif 310 311 static struct ctl_table net_core_table[] = { 312 #ifdef CONFIG_NET 313 { 314 .procname = "wmem_max", 315 .data = &sysctl_wmem_max, 316 .maxlen = sizeof(int), 317 .mode = 0644, 318 .proc_handler = proc_dointvec_minmax, 319 .extra1 = &min_sndbuf, 320 }, 321 { 322 .procname = "rmem_max", 323 .data = &sysctl_rmem_max, 324 .maxlen = sizeof(int), 325 .mode = 0644, 326 .proc_handler = proc_dointvec_minmax, 327 .extra1 = &min_rcvbuf, 328 }, 329 { 330 .procname = "wmem_default", 331 .data = &sysctl_wmem_default, 332 .maxlen = sizeof(int), 333 .mode = 0644, 334 .proc_handler = proc_dointvec_minmax, 335 .extra1 = &min_sndbuf, 336 }, 337 { 338 .procname = "rmem_default", 339 .data = &sysctl_rmem_default, 340 .maxlen = sizeof(int), 341 .mode = 0644, 342 .proc_handler = proc_dointvec_minmax, 343 .extra1 = &min_rcvbuf, 344 }, 345 { 346 .procname = "dev_weight", 347 .data = &weight_p, 348 .maxlen = sizeof(int), 349 .mode = 0644, 350 .proc_handler = proc_do_dev_weight, 351 }, 352 { 353 .procname = "dev_weight_rx_bias", 354 .data = &dev_weight_rx_bias, 355 .maxlen = sizeof(int), 356 .mode = 0644, 357 .proc_handler = proc_do_dev_weight, 358 }, 359 { 360 .procname = "dev_weight_tx_bias", 361 .data = &dev_weight_tx_bias, 362 .maxlen = sizeof(int), 363 .mode = 0644, 364 .proc_handler = proc_do_dev_weight, 365 }, 366 { 367 .procname = "netdev_max_backlog", 368 .data = &netdev_max_backlog, 369 .maxlen = sizeof(int), 370 .mode = 0644, 371 .proc_handler = proc_dointvec 372 }, 373 { 374 .procname = "netdev_rss_key", 375 .data = &netdev_rss_key, 376 .maxlen = sizeof(int), 377 .mode = 0444, 378 .proc_handler = proc_do_rss_key, 379 }, 380 #ifdef CONFIG_BPF_JIT 381 { 382 .procname = "bpf_jit_enable", 383 .data = &bpf_jit_enable, 384 .maxlen = sizeof(int), 385 .mode = 0644, 386 .proc_handler = proc_dointvec_minmax_bpf_enable, 387 # ifdef CONFIG_BPF_JIT_ALWAYS_ON 388 .extra1 = SYSCTL_ONE, 389 .extra2 = SYSCTL_ONE, 390 # else 391 .extra1 = SYSCTL_ZERO, 392 .extra2 = &two, 393 # endif 394 }, 395 # ifdef CONFIG_HAVE_EBPF_JIT 396 { 397 .procname = "bpf_jit_harden", 398 .data = &bpf_jit_harden, 399 .maxlen = sizeof(int), 400 .mode = 0600, 401 .proc_handler = proc_dointvec_minmax_bpf_restricted, 402 .extra1 = SYSCTL_ZERO, 403 .extra2 = &two, 404 }, 405 { 406 .procname = "bpf_jit_kallsyms", 407 .data = &bpf_jit_kallsyms, 408 .maxlen = sizeof(int), 409 .mode = 0600, 410 .proc_handler = proc_dointvec_minmax_bpf_restricted, 411 .extra1 = SYSCTL_ZERO, 412 .extra2 = SYSCTL_ONE, 413 }, 414 # endif 415 { 416 .procname = "bpf_jit_limit", 417 .data = &bpf_jit_limit, 418 .maxlen = sizeof(long), 419 .mode = 0600, 420 .proc_handler = proc_dolongvec_minmax_bpf_restricted, 421 .extra1 = &long_one, 422 .extra2 = &long_max, 423 }, 424 #endif 425 { 426 .procname = "netdev_tstamp_prequeue", 427 .data = &netdev_tstamp_prequeue, 428 .maxlen = sizeof(int), 429 .mode = 0644, 430 .proc_handler = proc_dointvec 431 }, 432 { 433 .procname = "message_cost", 434 .data = &net_ratelimit_state.interval, 435 .maxlen = sizeof(int), 436 .mode = 0644, 437 .proc_handler = proc_dointvec_jiffies, 438 }, 439 { 440 .procname = "message_burst", 441 .data = &net_ratelimit_state.burst, 442 .maxlen = sizeof(int), 443 .mode = 0644, 444 .proc_handler = proc_dointvec, 445 }, 446 { 447 .procname = "optmem_max", 448 .data = &sysctl_optmem_max, 449 .maxlen = sizeof(int), 450 .mode = 0644, 451 .proc_handler = proc_dointvec 452 }, 453 { 454 .procname = "tstamp_allow_data", 455 .data = &sysctl_tstamp_allow_data, 456 .maxlen = sizeof(int), 457 .mode = 0644, 458 .proc_handler = proc_dointvec_minmax, 459 .extra1 = SYSCTL_ZERO, 460 .extra2 = SYSCTL_ONE 461 }, 462 #ifdef CONFIG_RPS 463 { 464 .procname = "rps_sock_flow_entries", 465 .maxlen = sizeof(int), 466 .mode = 0644, 467 .proc_handler = rps_sock_flow_sysctl 468 }, 469 #endif 470 #ifdef CONFIG_NET_FLOW_LIMIT 471 { 472 .procname = "flow_limit_cpu_bitmap", 473 .mode = 0644, 474 .proc_handler = flow_limit_cpu_sysctl 475 }, 476 { 477 .procname = "flow_limit_table_len", 478 .data = &netdev_flow_limit_table_len, 479 .maxlen = sizeof(int), 480 .mode = 0644, 481 .proc_handler = flow_limit_table_len_sysctl 482 }, 483 #endif /* CONFIG_NET_FLOW_LIMIT */ 484 #ifdef CONFIG_NET_RX_BUSY_POLL 485 { 486 .procname = "busy_poll", 487 .data = &sysctl_net_busy_poll, 488 .maxlen = sizeof(unsigned int), 489 .mode = 0644, 490 .proc_handler = proc_dointvec_minmax, 491 .extra1 = SYSCTL_ZERO, 492 }, 493 { 494 .procname = "busy_read", 495 .data = &sysctl_net_busy_read, 496 .maxlen = sizeof(unsigned int), 497 .mode = 0644, 498 .proc_handler = proc_dointvec_minmax, 499 .extra1 = SYSCTL_ZERO, 500 }, 501 #endif 502 #ifdef CONFIG_NET_SCHED 503 { 504 .procname = "default_qdisc", 505 .mode = 0644, 506 .maxlen = IFNAMSIZ, 507 .proc_handler = set_default_qdisc 508 }, 509 #endif 510 #endif /* CONFIG_NET */ 511 { 512 .procname = "netdev_budget", 513 .data = &netdev_budget, 514 .maxlen = sizeof(int), 515 .mode = 0644, 516 .proc_handler = proc_dointvec 517 }, 518 { 519 .procname = "warnings", 520 .data = &net_msg_warn, 521 .maxlen = sizeof(int), 522 .mode = 0644, 523 .proc_handler = proc_dointvec 524 }, 525 { 526 .procname = "max_skb_frags", 527 .data = &sysctl_max_skb_frags, 528 .maxlen = sizeof(int), 529 .mode = 0644, 530 .proc_handler = proc_dointvec_minmax, 531 .extra1 = SYSCTL_ONE, 532 .extra2 = &max_skb_frags, 533 }, 534 { 535 .procname = "netdev_budget_usecs", 536 .data = &netdev_budget_usecs, 537 .maxlen = sizeof(unsigned int), 538 .mode = 0644, 539 .proc_handler = proc_dointvec_minmax, 540 .extra1 = SYSCTL_ZERO, 541 }, 542 { 543 .procname = "fb_tunnels_only_for_init_net", 544 .data = &sysctl_fb_tunnels_only_for_init_net, 545 .maxlen = sizeof(int), 546 .mode = 0644, 547 .proc_handler = proc_dointvec_minmax, 548 .extra1 = SYSCTL_ZERO, 549 .extra2 = SYSCTL_ONE, 550 }, 551 { 552 .procname = "devconf_inherit_init_net", 553 .data = &sysctl_devconf_inherit_init_net, 554 .maxlen = sizeof(int), 555 .mode = 0644, 556 .proc_handler = proc_dointvec_minmax, 557 .extra1 = SYSCTL_ZERO, 558 .extra2 = &three, 559 }, 560 { 561 .procname = "high_order_alloc_disable", 562 .data = &net_high_order_alloc_disable_key.key, 563 .maxlen = sizeof(net_high_order_alloc_disable_key), 564 .mode = 0644, 565 .proc_handler = proc_do_static_key, 566 }, 567 { 568 .procname = "gro_normal_batch", 569 .data = &gro_normal_batch, 570 .maxlen = sizeof(unsigned int), 571 .mode = 0644, 572 .proc_handler = proc_dointvec_minmax, 573 .extra1 = SYSCTL_ONE, 574 }, 575 { } 576 }; 577 578 static struct ctl_table netns_core_table[] = { 579 { 580 .procname = "somaxconn", 581 .data = &init_net.core.sysctl_somaxconn, 582 .maxlen = sizeof(int), 583 .mode = 0644, 584 .extra1 = SYSCTL_ZERO, 585 .proc_handler = proc_dointvec_minmax 586 }, 587 { } 588 }; 589 590 static __net_init int sysctl_core_net_init(struct net *net) 591 { 592 struct ctl_table *tbl; 593 594 tbl = netns_core_table; 595 if (!net_eq(net, &init_net)) { 596 tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL); 597 if (tbl == NULL) 598 goto err_dup; 599 600 tbl[0].data = &net->core.sysctl_somaxconn; 601 602 /* Don't export any sysctls to unprivileged users */ 603 if (net->user_ns != &init_user_ns) { 604 tbl[0].procname = NULL; 605 } 606 } 607 608 net->core.sysctl_hdr = register_net_sysctl(net, "net/core", tbl); 609 if (net->core.sysctl_hdr == NULL) 610 goto err_reg; 611 612 return 0; 613 614 err_reg: 615 if (tbl != netns_core_table) 616 kfree(tbl); 617 err_dup: 618 return -ENOMEM; 619 } 620 621 static __net_exit void sysctl_core_net_exit(struct net *net) 622 { 623 struct ctl_table *tbl; 624 625 tbl = net->core.sysctl_hdr->ctl_table_arg; 626 unregister_net_sysctl_table(net->core.sysctl_hdr); 627 BUG_ON(tbl == netns_core_table); 628 kfree(tbl); 629 } 630 631 static __net_initdata struct pernet_operations sysctl_core_ops = { 632 .init = sysctl_core_net_init, 633 .exit = sysctl_core_net_exit, 634 }; 635 636 static __init int sysctl_core_init(void) 637 { 638 register_net_sysctl(&init_net, "net/core", net_core_table); 639 return register_pernet_subsys(&sysctl_core_ops); 640 } 641 642 fs_initcall(sysctl_core_init); 643