1 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
3 #include <linux/workqueue.h>
4 #include <linux/rtnetlink.h>
5 #include <linux/cache.h>
6 #include <linux/slab.h>
7 #include <linux/list.h>
8 #include <linux/delay.h>
9 #include <linux/sched.h>
10 #include <linux/idr.h>
11 #include <linux/rculist.h>
12 #include <linux/nsproxy.h>
13 #include <linux/proc_fs.h>
14 #include <linux/file.h>
15 #include <linux/export.h>
16 #include <linux/user_namespace.h>
17 #include <net/net_namespace.h>
18 #include <net/netns/generic.h>
21 * Our network namespace constructor/destructor lists
24 static LIST_HEAD(pernet_list
);
25 static struct list_head
*first_device
= &pernet_list
;
26 static DEFINE_MUTEX(net_mutex
);
28 LIST_HEAD(net_namespace_list
);
29 EXPORT_SYMBOL_GPL(net_namespace_list
);
31 struct net init_net
= {
32 .dev_base_head
= LIST_HEAD_INIT(init_net
.dev_base_head
),
34 EXPORT_SYMBOL(init_net
);
36 #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */
38 static unsigned int max_gen_ptrs
= INITIAL_NET_GEN_PTRS
;
40 static struct net_generic
*net_alloc_generic(void)
42 struct net_generic
*ng
;
43 size_t generic_size
= offsetof(struct net_generic
, ptr
[max_gen_ptrs
]);
45 ng
= kzalloc(generic_size
, GFP_KERNEL
);
47 ng
->len
= max_gen_ptrs
;
52 static int net_assign_generic(struct net
*net
, int id
, void *data
)
54 struct net_generic
*ng
, *old_ng
;
56 BUG_ON(!mutex_is_locked(&net_mutex
));
59 old_ng
= rcu_dereference_protected(net
->gen
,
60 lockdep_is_held(&net_mutex
));
62 if (old_ng
->len
>= id
)
65 ng
= net_alloc_generic();
70 * Some synchronisation notes:
72 * The net_generic explores the net->gen array inside rcu
73 * read section. Besides once set the net->gen->ptr[x]
74 * pointer never changes (see rules in netns/generic.h).
76 * That said, we simply duplicate this array and schedule
77 * the old copy for kfree after a grace period.
80 memcpy(&ng
->ptr
, &old_ng
->ptr
, old_ng
->len
* sizeof(void*));
82 rcu_assign_pointer(net
->gen
, ng
);
83 kfree_rcu(old_ng
, rcu
);
85 ng
->ptr
[id
- 1] = data
;
89 static int ops_init(const struct pernet_operations
*ops
, struct net
*net
)
94 if (ops
->id
&& ops
->size
) {
95 data
= kzalloc(ops
->size
, GFP_KERNEL
);
99 err
= net_assign_generic(net
, *ops
->id
, data
);
105 err
= ops
->init(net
);
116 static void ops_free(const struct pernet_operations
*ops
, struct net
*net
)
118 if (ops
->id
&& ops
->size
) {
120 kfree(net_generic(net
, id
));
124 static void ops_exit_list(const struct pernet_operations
*ops
,
125 struct list_head
*net_exit_list
)
129 list_for_each_entry(net
, net_exit_list
, exit_list
)
133 ops
->exit_batch(net_exit_list
);
136 static void ops_free_list(const struct pernet_operations
*ops
,
137 struct list_head
*net_exit_list
)
140 if (ops
->size
&& ops
->id
) {
141 list_for_each_entry(net
, net_exit_list
, exit_list
)
147 * setup_net runs the initializers for the network namespace object.
149 static __net_init
int setup_net(struct net
*net
, struct user_namespace
*user_ns
)
151 /* Must be called with net_mutex held */
152 const struct pernet_operations
*ops
, *saved_ops
;
154 LIST_HEAD(net_exit_list
);
156 atomic_set(&net
->count
, 1);
157 atomic_set(&net
->passive
, 1);
158 net
->dev_base_seq
= 1;
159 net
->user_ns
= user_ns
;
161 #ifdef NETNS_REFCNT_DEBUG
162 atomic_set(&net
->use_count
, 0);
165 list_for_each_entry(ops
, &pernet_list
, list
) {
166 error
= ops_init(ops
, net
);
174 /* Walk through the list backwards calling the exit functions
175 * for the pernet modules whose init functions did not fail.
177 list_add(&net
->exit_list
, &net_exit_list
);
179 list_for_each_entry_continue_reverse(ops
, &pernet_list
, list
)
180 ops_exit_list(ops
, &net_exit_list
);
183 list_for_each_entry_continue_reverse(ops
, &pernet_list
, list
)
184 ops_free_list(ops
, &net_exit_list
);
192 static struct kmem_cache
*net_cachep
;
193 static struct workqueue_struct
*netns_wq
;
195 static struct net
*net_alloc(void)
197 struct net
*net
= NULL
;
198 struct net_generic
*ng
;
200 ng
= net_alloc_generic();
204 net
= kmem_cache_zalloc(net_cachep
, GFP_KERNEL
);
208 rcu_assign_pointer(net
->gen
, ng
);
217 static void net_free(struct net
*net
)
219 #ifdef NETNS_REFCNT_DEBUG
220 if (unlikely(atomic_read(&net
->use_count
) != 0)) {
221 pr_emerg("network namespace not free! Usage: %d\n",
222 atomic_read(&net
->use_count
));
227 kmem_cache_free(net_cachep
, net
);
230 void net_drop_ns(void *p
)
233 if (ns
&& atomic_dec_and_test(&ns
->passive
))
237 struct net
*copy_net_ns(unsigned long flags
,
238 struct user_namespace
*user_ns
, struct net
*old_net
)
243 if (!(flags
& CLONE_NEWNET
))
244 return get_net(old_net
);
248 return ERR_PTR(-ENOMEM
);
250 get_user_ns(user_ns
);
252 mutex_lock(&net_mutex
);
253 rv
= setup_net(net
, user_ns
);
256 list_add_tail_rcu(&net
->list
, &net_namespace_list
);
259 mutex_unlock(&net_mutex
);
261 put_user_ns(user_ns
);
268 static DEFINE_SPINLOCK(cleanup_list_lock
);
269 static LIST_HEAD(cleanup_list
); /* Must hold cleanup_list_lock to touch */
271 static void cleanup_net(struct work_struct
*work
)
273 const struct pernet_operations
*ops
;
274 struct net
*net
, *tmp
;
275 LIST_HEAD(net_kill_list
);
276 LIST_HEAD(net_exit_list
);
278 /* Atomically snapshot the list of namespaces to cleanup */
279 spin_lock_irq(&cleanup_list_lock
);
280 list_replace_init(&cleanup_list
, &net_kill_list
);
281 spin_unlock_irq(&cleanup_list_lock
);
283 mutex_lock(&net_mutex
);
285 /* Don't let anyone else find us. */
287 list_for_each_entry(net
, &net_kill_list
, cleanup_list
) {
288 list_del_rcu(&net
->list
);
289 list_add_tail(&net
->exit_list
, &net_exit_list
);
294 * Another CPU might be rcu-iterating the list, wait for it.
295 * This needs to be before calling the exit() notifiers, so
296 * the rcu_barrier() below isn't sufficient alone.
300 /* Run all of the network namespace exit methods */
301 list_for_each_entry_reverse(ops
, &pernet_list
, list
)
302 ops_exit_list(ops
, &net_exit_list
);
304 /* Free the net generic variables */
305 list_for_each_entry_reverse(ops
, &pernet_list
, list
)
306 ops_free_list(ops
, &net_exit_list
);
308 mutex_unlock(&net_mutex
);
310 /* Ensure there are no outstanding rcu callbacks using this
315 /* Finally it is safe to free my network namespace structure */
316 list_for_each_entry_safe(net
, tmp
, &net_exit_list
, exit_list
) {
317 list_del_init(&net
->exit_list
);
318 put_user_ns(net
->user_ns
);
322 static DECLARE_WORK(net_cleanup_work
, cleanup_net
);
324 void __put_net(struct net
*net
)
326 /* Cleanup the network namespace in process context */
329 spin_lock_irqsave(&cleanup_list_lock
, flags
);
330 list_add(&net
->cleanup_list
, &cleanup_list
);
331 spin_unlock_irqrestore(&cleanup_list_lock
, flags
);
333 queue_work(netns_wq
, &net_cleanup_work
);
335 EXPORT_SYMBOL_GPL(__put_net
);
337 struct net
*get_net_ns_by_fd(int fd
)
339 struct proc_inode
*ei
;
343 file
= proc_ns_fget(fd
);
345 return ERR_CAST(file
);
347 ei
= PROC_I(file
->f_dentry
->d_inode
);
348 if (ei
->ns_ops
== &netns_operations
)
349 net
= get_net(ei
->ns
);
351 net
= ERR_PTR(-EINVAL
);
358 struct net
*get_net_ns_by_fd(int fd
)
360 return ERR_PTR(-EINVAL
);
364 struct net
*get_net_ns_by_pid(pid_t pid
)
366 struct task_struct
*tsk
;
369 /* Lookup the network namespace */
370 net
= ERR_PTR(-ESRCH
);
372 tsk
= find_task_by_vpid(pid
);
374 struct nsproxy
*nsproxy
;
375 nsproxy
= task_nsproxy(tsk
);
377 net
= get_net(nsproxy
->net_ns
);
382 EXPORT_SYMBOL_GPL(get_net_ns_by_pid
);
384 static __net_init
int net_ns_net_init(struct net
*net
)
386 return proc_alloc_inum(&net
->proc_inum
);
389 static __net_exit
void net_ns_net_exit(struct net
*net
)
391 proc_free_inum(net
->proc_inum
);
394 static struct pernet_operations __net_initdata net_ns_ops
= {
395 .init
= net_ns_net_init
,
396 .exit
= net_ns_net_exit
,
399 static int __init
net_ns_init(void)
401 struct net_generic
*ng
;
404 net_cachep
= kmem_cache_create("net_namespace", sizeof(struct net
),
408 /* Create workqueue for cleanup */
409 netns_wq
= create_singlethread_workqueue("netns");
411 panic("Could not create netns workq");
414 ng
= net_alloc_generic();
416 panic("Could not allocate generic netns");
418 rcu_assign_pointer(init_net
.gen
, ng
);
420 mutex_lock(&net_mutex
);
421 if (setup_net(&init_net
, &init_user_ns
))
422 panic("Could not setup the initial network namespace");
425 list_add_tail_rcu(&init_net
.list
, &net_namespace_list
);
428 mutex_unlock(&net_mutex
);
430 register_pernet_subsys(&net_ns_ops
);
435 pure_initcall(net_ns_init
);
438 static int __register_pernet_operations(struct list_head
*list
,
439 struct pernet_operations
*ops
)
443 LIST_HEAD(net_exit_list
);
445 list_add_tail(&ops
->list
, list
);
446 if (ops
->init
|| (ops
->id
&& ops
->size
)) {
448 error
= ops_init(ops
, net
);
451 list_add_tail(&net
->exit_list
, &net_exit_list
);
457 /* If I have an error cleanup all namespaces I initialized */
458 list_del(&ops
->list
);
459 ops_exit_list(ops
, &net_exit_list
);
460 ops_free_list(ops
, &net_exit_list
);
464 static void __unregister_pernet_operations(struct pernet_operations
*ops
)
467 LIST_HEAD(net_exit_list
);
469 list_del(&ops
->list
);
471 list_add_tail(&net
->exit_list
, &net_exit_list
);
472 ops_exit_list(ops
, &net_exit_list
);
473 ops_free_list(ops
, &net_exit_list
);
478 static int __register_pernet_operations(struct list_head
*list
,
479 struct pernet_operations
*ops
)
481 return ops_init(ops
, &init_net
);
484 static void __unregister_pernet_operations(struct pernet_operations
*ops
)
486 LIST_HEAD(net_exit_list
);
487 list_add(&init_net
.exit_list
, &net_exit_list
);
488 ops_exit_list(ops
, &net_exit_list
);
489 ops_free_list(ops
, &net_exit_list
);
492 #endif /* CONFIG_NET_NS */
494 static DEFINE_IDA(net_generic_ids
);
496 static int register_pernet_operations(struct list_head
*list
,
497 struct pernet_operations
*ops
)
503 error
= ida_get_new_above(&net_generic_ids
, 1, ops
->id
);
505 if (error
== -EAGAIN
) {
506 ida_pre_get(&net_generic_ids
, GFP_KERNEL
);
511 max_gen_ptrs
= max_t(unsigned int, max_gen_ptrs
, *ops
->id
);
513 error
= __register_pernet_operations(list
, ops
);
517 ida_remove(&net_generic_ids
, *ops
->id
);
523 static void unregister_pernet_operations(struct pernet_operations
*ops
)
526 __unregister_pernet_operations(ops
);
529 ida_remove(&net_generic_ids
, *ops
->id
);
533 * register_pernet_subsys - register a network namespace subsystem
534 * @ops: pernet operations structure for the subsystem
536 * Register a subsystem which has init and exit functions
537 * that are called when network namespaces are created and
538 * destroyed respectively.
540 * When registered all network namespace init functions are
541 * called for every existing network namespace. Allowing kernel
542 * modules to have a race free view of the set of network namespaces.
544 * When a new network namespace is created all of the init
545 * methods are called in the order in which they were registered.
547 * When a network namespace is destroyed all of the exit methods
548 * are called in the reverse of the order with which they were
551 int register_pernet_subsys(struct pernet_operations
*ops
)
554 mutex_lock(&net_mutex
);
555 error
= register_pernet_operations(first_device
, ops
);
556 mutex_unlock(&net_mutex
);
559 EXPORT_SYMBOL_GPL(register_pernet_subsys
);
562 * unregister_pernet_subsys - unregister a network namespace subsystem
563 * @ops: pernet operations structure to manipulate
565 * Remove the pernet operations structure from the list to be
566 * used when network namespaces are created or destroyed. In
567 * addition run the exit method for all existing network
570 void unregister_pernet_subsys(struct pernet_operations
*ops
)
572 mutex_lock(&net_mutex
);
573 unregister_pernet_operations(ops
);
574 mutex_unlock(&net_mutex
);
576 EXPORT_SYMBOL_GPL(unregister_pernet_subsys
);
579 * register_pernet_device - register a network namespace device
580 * @ops: pernet operations structure for the subsystem
582 * Register a device which has init and exit functions
583 * that are called when network namespaces are created and
584 * destroyed respectively.
586 * When registered all network namespace init functions are
587 * called for every existing network namespace. Allowing kernel
588 * modules to have a race free view of the set of network namespaces.
590 * When a new network namespace is created all of the init
591 * methods are called in the order in which they were registered.
593 * When a network namespace is destroyed all of the exit methods
594 * are called in the reverse of the order with which they were
597 int register_pernet_device(struct pernet_operations
*ops
)
600 mutex_lock(&net_mutex
);
601 error
= register_pernet_operations(&pernet_list
, ops
);
602 if (!error
&& (first_device
== &pernet_list
))
603 first_device
= &ops
->list
;
604 mutex_unlock(&net_mutex
);
607 EXPORT_SYMBOL_GPL(register_pernet_device
);
610 * unregister_pernet_device - unregister a network namespace netdevice
611 * @ops: pernet operations structure to manipulate
613 * Remove the pernet operations structure from the list to be
614 * used when network namespaces are created or destroyed. In
615 * addition run the exit method for all existing network
618 void unregister_pernet_device(struct pernet_operations
*ops
)
620 mutex_lock(&net_mutex
);
621 if (&ops
->list
== first_device
)
622 first_device
= first_device
->next
;
623 unregister_pernet_operations(ops
);
624 mutex_unlock(&net_mutex
);
626 EXPORT_SYMBOL_GPL(unregister_pernet_device
);
629 static void *netns_get(struct task_struct
*task
)
631 struct net
*net
= NULL
;
632 struct nsproxy
*nsproxy
;
635 nsproxy
= task_nsproxy(task
);
637 net
= get_net(nsproxy
->net_ns
);
643 static void netns_put(void *ns
)
648 static int netns_install(struct nsproxy
*nsproxy
, void *ns
)
650 struct net
*net
= ns
;
652 if (!ns_capable(net
->user_ns
, CAP_SYS_ADMIN
))
655 put_net(nsproxy
->net_ns
);
656 nsproxy
->net_ns
= get_net(net
);
660 static unsigned int netns_inum(void *ns
)
662 struct net
*net
= ns
;
663 return net
->proc_inum
;
666 const struct proc_ns_operations netns_operations
= {
668 .type
= CLONE_NEWNET
,
671 .install
= netns_install
,