Linux Audio

Check our new training course

Embedded Linux training

Mar 10-20, 2025, special US time zones
Register
Loading...
v6.8
   1// SPDX-License-Identifier: GPL-2.0-only
   2#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   3
   4#include <linux/workqueue.h>
   5#include <linux/rtnetlink.h>
   6#include <linux/cache.h>
   7#include <linux/slab.h>
   8#include <linux/list.h>
   9#include <linux/delay.h>
  10#include <linux/sched.h>
  11#include <linux/idr.h>
  12#include <linux/rculist.h>
  13#include <linux/nsproxy.h>
  14#include <linux/fs.h>
  15#include <linux/proc_ns.h>
  16#include <linux/file.h>
  17#include <linux/export.h>
  18#include <linux/user_namespace.h>
  19#include <linux/net_namespace.h>
  20#include <linux/sched/task.h>
  21#include <linux/uidgid.h>
  22#include <linux/cookie.h>
  23#include <linux/proc_fs.h>
  24
  25#include <net/sock.h>
  26#include <net/netlink.h>
  27#include <net/net_namespace.h>
  28#include <net/netns/generic.h>
  29
  30/*
  31 *	Our network namespace constructor/destructor lists
  32 */
  33
  34static LIST_HEAD(pernet_list);
  35static struct list_head *first_device = &pernet_list;
  36
  37LIST_HEAD(net_namespace_list);
  38EXPORT_SYMBOL_GPL(net_namespace_list);
  39
  40/* Protects net_namespace_list. Nests iside rtnl_lock() */
  41DECLARE_RWSEM(net_rwsem);
  42EXPORT_SYMBOL_GPL(net_rwsem);
  43
  44#ifdef CONFIG_KEYS
  45static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) };
  46#endif
  47
  48struct net init_net;
 
 
 
 
 
 
  49EXPORT_SYMBOL(init_net);
  50
  51static bool init_net_initialized;
  52/*
  53 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids,
  54 * init_net_initialized and first_device pointer.
  55 * This is internal net namespace object. Please, don't use it
  56 * outside.
  57 */
  58DECLARE_RWSEM(pernet_ops_rwsem);
  59EXPORT_SYMBOL_GPL(pernet_ops_rwsem);
  60
  61#define MIN_PERNET_OPS_ID	\
  62	((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *))
  63
  64#define INITIAL_NET_GEN_PTRS	13 /* +1 for len +2 for rcu_head */
  65
  66static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
  67
  68DEFINE_COOKIE(net_cookie);
  69
  70static struct net_generic *net_alloc_generic(void)
  71{
  72	struct net_generic *ng;
  73	unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
  74
  75	ng = kzalloc(generic_size, GFP_KERNEL);
  76	if (ng)
  77		ng->s.len = max_gen_ptrs;
  78
  79	return ng;
  80}
  81
  82static int net_assign_generic(struct net *net, unsigned int id, void *data)
  83{
  84	struct net_generic *ng, *old_ng;
  85
  86	BUG_ON(id < MIN_PERNET_OPS_ID);
  87
  88	old_ng = rcu_dereference_protected(net->gen,
  89					   lockdep_is_held(&pernet_ops_rwsem));
  90	if (old_ng->s.len > id) {
  91		old_ng->ptr[id] = data;
  92		return 0;
  93	}
  94
  95	ng = net_alloc_generic();
  96	if (!ng)
  97		return -ENOMEM;
  98
  99	/*
 100	 * Some synchronisation notes:
 101	 *
 102	 * The net_generic explores the net->gen array inside rcu
 103	 * read section. Besides once set the net->gen->ptr[x]
 104	 * pointer never changes (see rules in netns/generic.h).
 105	 *
 106	 * That said, we simply duplicate this array and schedule
 107	 * the old copy for kfree after a grace period.
 108	 */
 109
 110	memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID],
 111	       (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *));
 112	ng->ptr[id] = data;
 113
 114	rcu_assign_pointer(net->gen, ng);
 115	kfree_rcu(old_ng, s.rcu);
 116	return 0;
 117}
 118
 119static int ops_init(const struct pernet_operations *ops, struct net *net)
 120{
 121	struct net_generic *ng;
 122	int err = -ENOMEM;
 123	void *data = NULL;
 124
 125	if (ops->id && ops->size) {
 126		data = kzalloc(ops->size, GFP_KERNEL);
 127		if (!data)
 128			goto out;
 129
 130		err = net_assign_generic(net, *ops->id, data);
 131		if (err)
 132			goto cleanup;
 133	}
 134	err = 0;
 135	if (ops->init)
 136		err = ops->init(net);
 137	if (!err)
 138		return 0;
 139
 140	if (ops->id && ops->size) {
 141		ng = rcu_dereference_protected(net->gen,
 142					       lockdep_is_held(&pernet_ops_rwsem));
 143		ng->ptr[*ops->id] = NULL;
 144	}
 145
 146cleanup:
 147	kfree(data);
 148
 149out:
 150	return err;
 151}
 152
 
 
 
 
 
 
 
 153static void ops_pre_exit_list(const struct pernet_operations *ops,
 154			      struct list_head *net_exit_list)
 155{
 156	struct net *net;
 157
 158	if (ops->pre_exit) {
 159		list_for_each_entry(net, net_exit_list, exit_list)
 160			ops->pre_exit(net);
 161	}
 162}
 163
 164static void ops_exit_list(const struct pernet_operations *ops,
 165			  struct list_head *net_exit_list)
 166{
 167	struct net *net;
 168	if (ops->exit) {
 169		list_for_each_entry(net, net_exit_list, exit_list) {
 170			ops->exit(net);
 171			cond_resched();
 172		}
 173	}
 174	if (ops->exit_batch)
 175		ops->exit_batch(net_exit_list);
 176}
 177
 178static void ops_free_list(const struct pernet_operations *ops,
 179			  struct list_head *net_exit_list)
 180{
 181	struct net *net;
 182	if (ops->size && ops->id) {
 183		list_for_each_entry(net, net_exit_list, exit_list)
 184			kfree(net_generic(net, *ops->id));
 185	}
 186}
 187
 188/* should be called with nsid_lock held */
 189static int alloc_netid(struct net *net, struct net *peer, int reqid)
 190{
 191	int min = 0, max = 0;
 192
 193	if (reqid >= 0) {
 194		min = reqid;
 195		max = reqid + 1;
 196	}
 197
 198	return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC);
 199}
 200
 201/* This function is used by idr_for_each(). If net is equal to peer, the
 202 * function returns the id so that idr_for_each() stops. Because we cannot
 203 * returns the id 0 (idr_for_each() will not stop), we return the magic value
 204 * NET_ID_ZERO (-1) for it.
 205 */
 206#define NET_ID_ZERO -1
 207static int net_eq_idr(int id, void *net, void *peer)
 208{
 209	if (net_eq(net, peer))
 210		return id ? : NET_ID_ZERO;
 211	return 0;
 212}
 213
 214/* Must be called from RCU-critical section or with nsid_lock held */
 215static int __peernet2id(const struct net *net, struct net *peer)
 216{
 217	int id = idr_for_each(&net->netns_ids, net_eq_idr, peer);
 218
 219	/* Magic value for id 0. */
 220	if (id == NET_ID_ZERO)
 221		return 0;
 222	if (id > 0)
 223		return id;
 224
 225	return NETNSA_NSID_NOT_ASSIGNED;
 226}
 227
 228static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
 229			      struct nlmsghdr *nlh, gfp_t gfp);
 230/* This function returns the id of a peer netns. If no id is assigned, one will
 231 * be allocated and returned.
 232 */
 233int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
 234{
 235	int id;
 236
 237	if (refcount_read(&net->ns.count) == 0)
 238		return NETNSA_NSID_NOT_ASSIGNED;
 239
 240	spin_lock_bh(&net->nsid_lock);
 241	id = __peernet2id(net, peer);
 242	if (id >= 0) {
 243		spin_unlock_bh(&net->nsid_lock);
 244		return id;
 245	}
 246
 247	/* When peer is obtained from RCU lists, we may race with
 248	 * its cleanup. Check whether it's alive, and this guarantees
 249	 * we never hash a peer back to net->netns_ids, after it has
 250	 * just been idr_remove()'d from there in cleanup_net().
 251	 */
 252	if (!maybe_get_net(peer)) {
 253		spin_unlock_bh(&net->nsid_lock);
 254		return NETNSA_NSID_NOT_ASSIGNED;
 255	}
 256
 257	id = alloc_netid(net, peer, -1);
 258	spin_unlock_bh(&net->nsid_lock);
 259
 260	put_net(peer);
 261	if (id < 0)
 262		return NETNSA_NSID_NOT_ASSIGNED;
 263
 264	rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp);
 265
 266	return id;
 267}
 268EXPORT_SYMBOL_GPL(peernet2id_alloc);
 269
 270/* This function returns, if assigned, the id of a peer netns. */
 271int peernet2id(const struct net *net, struct net *peer)
 272{
 273	int id;
 274
 275	rcu_read_lock();
 276	id = __peernet2id(net, peer);
 277	rcu_read_unlock();
 278
 279	return id;
 280}
 281EXPORT_SYMBOL(peernet2id);
 282
 283/* This function returns true is the peer netns has an id assigned into the
 284 * current netns.
 285 */
 286bool peernet_has_id(const struct net *net, struct net *peer)
 287{
 288	return peernet2id(net, peer) >= 0;
 289}
 290
 291struct net *get_net_ns_by_id(const struct net *net, int id)
 292{
 293	struct net *peer;
 294
 295	if (id < 0)
 296		return NULL;
 297
 298	rcu_read_lock();
 299	peer = idr_find(&net->netns_ids, id);
 300	if (peer)
 301		peer = maybe_get_net(peer);
 302	rcu_read_unlock();
 303
 304	return peer;
 305}
 306EXPORT_SYMBOL_GPL(get_net_ns_by_id);
 307
 308/* init code that must occur even if setup_net() is not called. */
 309static __net_init void preinit_net(struct net *net)
 310{
 311	ref_tracker_dir_init(&net->notrefcnt_tracker, 128, "net notrefcnt");
 312}
 313
 314/*
 315 * setup_net runs the initializers for the network namespace object.
 316 */
 317static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
 318{
 319	/* Must be called with pernet_ops_rwsem held */
 320	const struct pernet_operations *ops, *saved_ops;
 321	int error = 0;
 322	LIST_HEAD(net_exit_list);
 323
 324	refcount_set(&net->ns.count, 1);
 325	ref_tracker_dir_init(&net->refcnt_tracker, 128, "net refcnt");
 326
 327	refcount_set(&net->passive, 1);
 328	get_random_bytes(&net->hash_mix, sizeof(u32));
 329	preempt_disable();
 330	net->net_cookie = gen_cookie_next(&net_cookie);
 331	preempt_enable();
 332	net->dev_base_seq = 1;
 333	net->user_ns = user_ns;
 334	idr_init(&net->netns_ids);
 335	spin_lock_init(&net->nsid_lock);
 336	mutex_init(&net->ipv4.ra_mutex);
 337
 338	list_for_each_entry(ops, &pernet_list, list) {
 339		error = ops_init(ops, net);
 340		if (error < 0)
 341			goto out_undo;
 342	}
 343	down_write(&net_rwsem);
 344	list_add_tail_rcu(&net->list, &net_namespace_list);
 345	up_write(&net_rwsem);
 346out:
 347	return error;
 348
 349out_undo:
 350	/* Walk through the list backwards calling the exit functions
 351	 * for the pernet modules whose init functions did not fail.
 352	 */
 353	list_add(&net->exit_list, &net_exit_list);
 354	saved_ops = ops;
 355	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 356		ops_pre_exit_list(ops, &net_exit_list);
 357
 358	synchronize_rcu();
 359
 360	ops = saved_ops;
 361	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 362		ops_exit_list(ops, &net_exit_list);
 363
 364	ops = saved_ops;
 365	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 366		ops_free_list(ops, &net_exit_list);
 367
 368	rcu_barrier();
 369	goto out;
 370}
 371
 372static int __net_init net_defaults_init_net(struct net *net)
 373{
 374	net->core.sysctl_somaxconn = SOMAXCONN;
 375	/* Limits per socket sk_omem_alloc usage.
 376	 * TCP zerocopy regular usage needs 128 KB.
 377	 */
 378	net->core.sysctl_optmem_max = 128 * 1024;
 379	net->core.sysctl_txrehash = SOCK_TXREHASH_ENABLED;
 380
 381	return 0;
 382}
 383
 384static struct pernet_operations net_defaults_ops = {
 385	.init = net_defaults_init_net,
 386};
 387
 388static __init int net_defaults_init(void)
 389{
 390	if (register_pernet_subsys(&net_defaults_ops))
 391		panic("Cannot initialize net default settings");
 392
 393	return 0;
 394}
 395
 396core_initcall(net_defaults_init);
 397
 398#ifdef CONFIG_NET_NS
 399static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
 400{
 401	return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES);
 402}
 403
 404static void dec_net_namespaces(struct ucounts *ucounts)
 405{
 406	dec_ucount(ucounts, UCOUNT_NET_NAMESPACES);
 407}
 408
 409static struct kmem_cache *net_cachep __ro_after_init;
 410static struct workqueue_struct *netns_wq;
 411
 412static struct net *net_alloc(void)
 413{
 414	struct net *net = NULL;
 415	struct net_generic *ng;
 416
 417	ng = net_alloc_generic();
 418	if (!ng)
 419		goto out;
 420
 421	net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
 422	if (!net)
 423		goto out_free;
 424
 425#ifdef CONFIG_KEYS
 426	net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL);
 427	if (!net->key_domain)
 428		goto out_free_2;
 429	refcount_set(&net->key_domain->usage, 1);
 430#endif
 431
 432	rcu_assign_pointer(net->gen, ng);
 433out:
 434	return net;
 435
 436#ifdef CONFIG_KEYS
 437out_free_2:
 438	kmem_cache_free(net_cachep, net);
 439	net = NULL;
 440#endif
 441out_free:
 442	kfree(ng);
 443	goto out;
 444}
 445
 446static void net_free(struct net *net)
 447{
 448	if (refcount_dec_and_test(&net->passive)) {
 449		kfree(rcu_access_pointer(net->gen));
 450
 451		/* There should not be any trackers left there. */
 452		ref_tracker_dir_exit(&net->notrefcnt_tracker);
 453
 454		kmem_cache_free(net_cachep, net);
 455	}
 456}
 457
 458void net_drop_ns(void *p)
 459{
 460	struct net *net = (struct net *)p;
 461
 462	if (net)
 463		net_free(net);
 464}
 465
 466struct net *copy_net_ns(unsigned long flags,
 467			struct user_namespace *user_ns, struct net *old_net)
 468{
 469	struct ucounts *ucounts;
 470	struct net *net;
 471	int rv;
 472
 473	if (!(flags & CLONE_NEWNET))
 474		return get_net(old_net);
 475
 476	ucounts = inc_net_namespaces(user_ns);
 477	if (!ucounts)
 478		return ERR_PTR(-ENOSPC);
 479
 480	net = net_alloc();
 481	if (!net) {
 482		rv = -ENOMEM;
 483		goto dec_ucounts;
 484	}
 485
 486	preinit_net(net);
 487	refcount_set(&net->passive, 1);
 488	net->ucounts = ucounts;
 489	get_user_ns(user_ns);
 490
 491	rv = down_read_killable(&pernet_ops_rwsem);
 492	if (rv < 0)
 493		goto put_userns;
 494
 495	rv = setup_net(net, user_ns);
 496
 497	up_read(&pernet_ops_rwsem);
 498
 499	if (rv < 0) {
 500put_userns:
 501#ifdef CONFIG_KEYS
 502		key_remove_domain(net->key_domain);
 503#endif
 504		put_user_ns(user_ns);
 505		net_free(net);
 506dec_ucounts:
 507		dec_net_namespaces(ucounts);
 508		return ERR_PTR(rv);
 509	}
 510	return net;
 511}
 512
 513/**
 514 * net_ns_get_ownership - get sysfs ownership data for @net
 515 * @net: network namespace in question (can be NULL)
 516 * @uid: kernel user ID for sysfs objects
 517 * @gid: kernel group ID for sysfs objects
 518 *
 519 * Returns the uid/gid pair of root in the user namespace associated with the
 520 * given network namespace.
 521 */
 522void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid)
 523{
 524	if (net) {
 525		kuid_t ns_root_uid = make_kuid(net->user_ns, 0);
 526		kgid_t ns_root_gid = make_kgid(net->user_ns, 0);
 527
 528		if (uid_valid(ns_root_uid))
 529			*uid = ns_root_uid;
 530
 531		if (gid_valid(ns_root_gid))
 532			*gid = ns_root_gid;
 533	} else {
 534		*uid = GLOBAL_ROOT_UID;
 535		*gid = GLOBAL_ROOT_GID;
 536	}
 537}
 538EXPORT_SYMBOL_GPL(net_ns_get_ownership);
 539
 540static void unhash_nsid(struct net *net, struct net *last)
 541{
 542	struct net *tmp;
 543	/* This function is only called from cleanup_net() work,
 544	 * and this work is the only process, that may delete
 545	 * a net from net_namespace_list. So, when the below
 546	 * is executing, the list may only grow. Thus, we do not
 547	 * use for_each_net_rcu() or net_rwsem.
 548	 */
 549	for_each_net(tmp) {
 550		int id;
 551
 552		spin_lock_bh(&tmp->nsid_lock);
 553		id = __peernet2id(tmp, net);
 554		if (id >= 0)
 555			idr_remove(&tmp->netns_ids, id);
 556		spin_unlock_bh(&tmp->nsid_lock);
 557		if (id >= 0)
 558			rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL,
 559					  GFP_KERNEL);
 560		if (tmp == last)
 561			break;
 562	}
 563	spin_lock_bh(&net->nsid_lock);
 564	idr_destroy(&net->netns_ids);
 565	spin_unlock_bh(&net->nsid_lock);
 566}
 567
 568static LLIST_HEAD(cleanup_list);
 569
 570static void cleanup_net(struct work_struct *work)
 571{
 572	const struct pernet_operations *ops;
 573	struct net *net, *tmp, *last;
 574	struct llist_node *net_kill_list;
 575	LIST_HEAD(net_exit_list);
 576
 577	/* Atomically snapshot the list of namespaces to cleanup */
 578	net_kill_list = llist_del_all(&cleanup_list);
 579
 580	down_read(&pernet_ops_rwsem);
 581
 582	/* Don't let anyone else find us. */
 583	down_write(&net_rwsem);
 584	llist_for_each_entry(net, net_kill_list, cleanup_list)
 585		list_del_rcu(&net->list);
 586	/* Cache last net. After we unlock rtnl, no one new net
 587	 * added to net_namespace_list can assign nsid pointer
 588	 * to a net from net_kill_list (see peernet2id_alloc()).
 589	 * So, we skip them in unhash_nsid().
 590	 *
 591	 * Note, that unhash_nsid() does not delete nsid links
 592	 * between net_kill_list's nets, as they've already
 593	 * deleted from net_namespace_list. But, this would be
 594	 * useless anyway, as netns_ids are destroyed there.
 595	 */
 596	last = list_last_entry(&net_namespace_list, struct net, list);
 597	up_write(&net_rwsem);
 598
 599	llist_for_each_entry(net, net_kill_list, cleanup_list) {
 600		unhash_nsid(net, last);
 601		list_add_tail(&net->exit_list, &net_exit_list);
 602	}
 603
 604	/* Run all of the network namespace pre_exit methods */
 605	list_for_each_entry_reverse(ops, &pernet_list, list)
 606		ops_pre_exit_list(ops, &net_exit_list);
 607
 608	/*
 609	 * Another CPU might be rcu-iterating the list, wait for it.
 610	 * This needs to be before calling the exit() notifiers, so
 611	 * the rcu_barrier() below isn't sufficient alone.
 612	 * Also the pre_exit() and exit() methods need this barrier.
 613	 */
 614	synchronize_rcu();
 615
 616	/* Run all of the network namespace exit methods */
 617	list_for_each_entry_reverse(ops, &pernet_list, list)
 618		ops_exit_list(ops, &net_exit_list);
 619
 620	/* Free the net generic variables */
 621	list_for_each_entry_reverse(ops, &pernet_list, list)
 622		ops_free_list(ops, &net_exit_list);
 623
 624	up_read(&pernet_ops_rwsem);
 625
 626	/* Ensure there are no outstanding rcu callbacks using this
 627	 * network namespace.
 628	 */
 629	rcu_barrier();
 630
 631	/* Finally it is safe to free my network namespace structure */
 632	list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
 633		list_del_init(&net->exit_list);
 634		dec_net_namespaces(net->ucounts);
 635#ifdef CONFIG_KEYS
 636		key_remove_domain(net->key_domain);
 637#endif
 638		put_user_ns(net->user_ns);
 639		net_free(net);
 640	}
 641}
 642
 643/**
 644 * net_ns_barrier - wait until concurrent net_cleanup_work is done
 645 *
 646 * cleanup_net runs from work queue and will first remove namespaces
 647 * from the global list, then run net exit functions.
 648 *
 649 * Call this in module exit path to make sure that all netns
 650 * ->exit ops have been invoked before the function is removed.
 651 */
 652void net_ns_barrier(void)
 653{
 654	down_write(&pernet_ops_rwsem);
 655	up_write(&pernet_ops_rwsem);
 656}
 657EXPORT_SYMBOL(net_ns_barrier);
 658
 659static DECLARE_WORK(net_cleanup_work, cleanup_net);
 660
 661void __put_net(struct net *net)
 662{
 663	ref_tracker_dir_exit(&net->refcnt_tracker);
 664	/* Cleanup the network namespace in process context */
 665	if (llist_add(&net->cleanup_list, &cleanup_list))
 666		queue_work(netns_wq, &net_cleanup_work);
 667}
 668EXPORT_SYMBOL_GPL(__put_net);
 669
 670/**
 671 * get_net_ns - increment the refcount of the network namespace
 672 * @ns: common namespace (net)
 673 *
 674 * Returns the net's common namespace.
 675 */
 676struct ns_common *get_net_ns(struct ns_common *ns)
 677{
 678	return &get_net(container_of(ns, struct net, ns))->ns;
 679}
 680EXPORT_SYMBOL_GPL(get_net_ns);
 681
 682struct net *get_net_ns_by_fd(int fd)
 683{
 684	struct fd f = fdget(fd);
 685	struct net *net = ERR_PTR(-EINVAL);
 
 686
 687	if (!f.file)
 688		return ERR_PTR(-EBADF);
 689
 690	if (proc_ns_file(f.file)) {
 691		struct ns_common *ns = get_proc_ns(file_inode(f.file));
 692		if (ns->ops == &netns_operations)
 693			net = get_net(container_of(ns, struct net, ns));
 694	}
 695	fdput(f);
 696
 
 697	return net;
 698}
 699EXPORT_SYMBOL_GPL(get_net_ns_by_fd);
 700#endif
 701
 702struct net *get_net_ns_by_pid(pid_t pid)
 703{
 704	struct task_struct *tsk;
 705	struct net *net;
 706
 707	/* Lookup the network namespace */
 708	net = ERR_PTR(-ESRCH);
 709	rcu_read_lock();
 710	tsk = find_task_by_vpid(pid);
 711	if (tsk) {
 712		struct nsproxy *nsproxy;
 713		task_lock(tsk);
 714		nsproxy = tsk->nsproxy;
 715		if (nsproxy)
 716			net = get_net(nsproxy->net_ns);
 717		task_unlock(tsk);
 718	}
 719	rcu_read_unlock();
 720	return net;
 721}
 722EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
 723
 724static __net_init int net_ns_net_init(struct net *net)
 725{
 726#ifdef CONFIG_NET_NS
 727	net->ns.ops = &netns_operations;
 728#endif
 729	return ns_alloc_inum(&net->ns);
 730}
 731
 732static __net_exit void net_ns_net_exit(struct net *net)
 733{
 734	ns_free_inum(&net->ns);
 735}
 736
 737static struct pernet_operations __net_initdata net_ns_ops = {
 738	.init = net_ns_net_init,
 739	.exit = net_ns_net_exit,
 740};
 741
 742static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
 743	[NETNSA_NONE]		= { .type = NLA_UNSPEC },
 744	[NETNSA_NSID]		= { .type = NLA_S32 },
 745	[NETNSA_PID]		= { .type = NLA_U32 },
 746	[NETNSA_FD]		= { .type = NLA_U32 },
 747	[NETNSA_TARGET_NSID]	= { .type = NLA_S32 },
 748};
 749
 750static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
 751			  struct netlink_ext_ack *extack)
 752{
 753	struct net *net = sock_net(skb->sk);
 754	struct nlattr *tb[NETNSA_MAX + 1];
 755	struct nlattr *nla;
 756	struct net *peer;
 757	int nsid, err;
 758
 759	err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb,
 760				     NETNSA_MAX, rtnl_net_policy, extack);
 761	if (err < 0)
 762		return err;
 763	if (!tb[NETNSA_NSID]) {
 764		NL_SET_ERR_MSG(extack, "nsid is missing");
 765		return -EINVAL;
 766	}
 767	nsid = nla_get_s32(tb[NETNSA_NSID]);
 768
 769	if (tb[NETNSA_PID]) {
 770		peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
 771		nla = tb[NETNSA_PID];
 772	} else if (tb[NETNSA_FD]) {
 773		peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
 774		nla = tb[NETNSA_FD];
 775	} else {
 776		NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
 777		return -EINVAL;
 778	}
 779	if (IS_ERR(peer)) {
 780		NL_SET_BAD_ATTR(extack, nla);
 781		NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
 782		return PTR_ERR(peer);
 783	}
 784
 785	spin_lock_bh(&net->nsid_lock);
 786	if (__peernet2id(net, peer) >= 0) {
 787		spin_unlock_bh(&net->nsid_lock);
 788		err = -EEXIST;
 789		NL_SET_BAD_ATTR(extack, nla);
 790		NL_SET_ERR_MSG(extack,
 791			       "Peer netns already has a nsid assigned");
 792		goto out;
 793	}
 794
 795	err = alloc_netid(net, peer, nsid);
 796	spin_unlock_bh(&net->nsid_lock);
 797	if (err >= 0) {
 798		rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid,
 799				  nlh, GFP_KERNEL);
 800		err = 0;
 801	} else if (err == -ENOSPC && nsid >= 0) {
 802		err = -EEXIST;
 803		NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]);
 804		NL_SET_ERR_MSG(extack, "The specified nsid is already used");
 805	}
 806out:
 807	put_net(peer);
 808	return err;
 809}
 810
 811static int rtnl_net_get_size(void)
 812{
 813	return NLMSG_ALIGN(sizeof(struct rtgenmsg))
 814	       + nla_total_size(sizeof(s32)) /* NETNSA_NSID */
 815	       + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */
 816	       ;
 817}
 818
 819struct net_fill_args {
 820	u32 portid;
 821	u32 seq;
 822	int flags;
 823	int cmd;
 824	int nsid;
 825	bool add_ref;
 826	int ref_nsid;
 827};
 828
 829static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args)
 830{
 831	struct nlmsghdr *nlh;
 832	struct rtgenmsg *rth;
 833
 834	nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth),
 835			args->flags);
 836	if (!nlh)
 837		return -EMSGSIZE;
 838
 839	rth = nlmsg_data(nlh);
 840	rth->rtgen_family = AF_UNSPEC;
 841
 842	if (nla_put_s32(skb, NETNSA_NSID, args->nsid))
 843		goto nla_put_failure;
 844
 845	if (args->add_ref &&
 846	    nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid))
 847		goto nla_put_failure;
 848
 849	nlmsg_end(skb, nlh);
 850	return 0;
 851
 852nla_put_failure:
 853	nlmsg_cancel(skb, nlh);
 854	return -EMSGSIZE;
 855}
 856
 857static int rtnl_net_valid_getid_req(struct sk_buff *skb,
 858				    const struct nlmsghdr *nlh,
 859				    struct nlattr **tb,
 860				    struct netlink_ext_ack *extack)
 861{
 862	int i, err;
 863
 864	if (!netlink_strict_get_check(skb))
 865		return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg),
 866					      tb, NETNSA_MAX, rtnl_net_policy,
 867					      extack);
 868
 869	err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
 870					    NETNSA_MAX, rtnl_net_policy,
 871					    extack);
 872	if (err)
 873		return err;
 874
 875	for (i = 0; i <= NETNSA_MAX; i++) {
 876		if (!tb[i])
 877			continue;
 878
 879		switch (i) {
 880		case NETNSA_PID:
 881		case NETNSA_FD:
 882		case NETNSA_NSID:
 883		case NETNSA_TARGET_NSID:
 884			break;
 885		default:
 886			NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request");
 887			return -EINVAL;
 888		}
 889	}
 890
 891	return 0;
 892}
 893
 894static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
 895			  struct netlink_ext_ack *extack)
 896{
 897	struct net *net = sock_net(skb->sk);
 898	struct nlattr *tb[NETNSA_MAX + 1];
 899	struct net_fill_args fillargs = {
 900		.portid = NETLINK_CB(skb).portid,
 901		.seq = nlh->nlmsg_seq,
 902		.cmd = RTM_NEWNSID,
 903	};
 904	struct net *peer, *target = net;
 905	struct nlattr *nla;
 906	struct sk_buff *msg;
 907	int err;
 908
 909	err = rtnl_net_valid_getid_req(skb, nlh, tb, extack);
 910	if (err < 0)
 911		return err;
 912	if (tb[NETNSA_PID]) {
 913		peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
 914		nla = tb[NETNSA_PID];
 915	} else if (tb[NETNSA_FD]) {
 916		peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
 917		nla = tb[NETNSA_FD];
 918	} else if (tb[NETNSA_NSID]) {
 919		peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID]));
 920		if (!peer)
 921			peer = ERR_PTR(-ENOENT);
 922		nla = tb[NETNSA_NSID];
 923	} else {
 924		NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
 925		return -EINVAL;
 926	}
 927
 928	if (IS_ERR(peer)) {
 929		NL_SET_BAD_ATTR(extack, nla);
 930		NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
 931		return PTR_ERR(peer);
 932	}
 933
 934	if (tb[NETNSA_TARGET_NSID]) {
 935		int id = nla_get_s32(tb[NETNSA_TARGET_NSID]);
 936
 937		target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id);
 938		if (IS_ERR(target)) {
 939			NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]);
 940			NL_SET_ERR_MSG(extack,
 941				       "Target netns reference is invalid");
 942			err = PTR_ERR(target);
 943			goto out;
 944		}
 945		fillargs.add_ref = true;
 946		fillargs.ref_nsid = peernet2id(net, peer);
 947	}
 948
 949	msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
 950	if (!msg) {
 951		err = -ENOMEM;
 952		goto out;
 953	}
 954
 955	fillargs.nsid = peernet2id(target, peer);
 956	err = rtnl_net_fill(msg, &fillargs);
 957	if (err < 0)
 958		goto err_out;
 959
 960	err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid);
 961	goto out;
 962
 963err_out:
 964	nlmsg_free(msg);
 965out:
 966	if (fillargs.add_ref)
 967		put_net(target);
 968	put_net(peer);
 969	return err;
 970}
 971
 972struct rtnl_net_dump_cb {
 973	struct net *tgt_net;
 974	struct net *ref_net;
 975	struct sk_buff *skb;
 976	struct net_fill_args fillargs;
 977	int idx;
 978	int s_idx;
 979};
 980
 981/* Runs in RCU-critical section. */
 982static int rtnl_net_dumpid_one(int id, void *peer, void *data)
 983{
 984	struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
 985	int ret;
 986
 987	if (net_cb->idx < net_cb->s_idx)
 988		goto cont;
 989
 990	net_cb->fillargs.nsid = id;
 991	if (net_cb->fillargs.add_ref)
 992		net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer);
 993	ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs);
 994	if (ret < 0)
 995		return ret;
 996
 997cont:
 998	net_cb->idx++;
 999	return 0;
1000}
1001
1002static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk,
1003				   struct rtnl_net_dump_cb *net_cb,
1004				   struct netlink_callback *cb)
1005{
1006	struct netlink_ext_ack *extack = cb->extack;
1007	struct nlattr *tb[NETNSA_MAX + 1];
1008	int err, i;
1009
1010	err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
1011					    NETNSA_MAX, rtnl_net_policy,
1012					    extack);
1013	if (err < 0)
1014		return err;
1015
1016	for (i = 0; i <= NETNSA_MAX; i++) {
1017		if (!tb[i])
1018			continue;
1019
1020		if (i == NETNSA_TARGET_NSID) {
1021			struct net *net;
1022
1023			net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i]));
1024			if (IS_ERR(net)) {
1025				NL_SET_BAD_ATTR(extack, tb[i]);
1026				NL_SET_ERR_MSG(extack,
1027					       "Invalid target network namespace id");
1028				return PTR_ERR(net);
1029			}
1030			net_cb->fillargs.add_ref = true;
1031			net_cb->ref_net = net_cb->tgt_net;
1032			net_cb->tgt_net = net;
1033		} else {
1034			NL_SET_BAD_ATTR(extack, tb[i]);
1035			NL_SET_ERR_MSG(extack,
1036				       "Unsupported attribute in dump request");
1037			return -EINVAL;
1038		}
1039	}
1040
1041	return 0;
1042}
1043
1044static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
1045{
1046	struct rtnl_net_dump_cb net_cb = {
1047		.tgt_net = sock_net(skb->sk),
1048		.skb = skb,
1049		.fillargs = {
1050			.portid = NETLINK_CB(cb->skb).portid,
1051			.seq = cb->nlh->nlmsg_seq,
1052			.flags = NLM_F_MULTI,
1053			.cmd = RTM_NEWNSID,
1054		},
1055		.idx = 0,
1056		.s_idx = cb->args[0],
1057	};
1058	int err = 0;
1059
1060	if (cb->strict_check) {
1061		err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb);
1062		if (err < 0)
1063			goto end;
1064	}
1065
1066	rcu_read_lock();
1067	idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb);
1068	rcu_read_unlock();
1069
1070	cb->args[0] = net_cb.idx;
1071end:
1072	if (net_cb.fillargs.add_ref)
1073		put_net(net_cb.tgt_net);
1074	return err < 0 ? err : skb->len;
1075}
1076
1077static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
1078			      struct nlmsghdr *nlh, gfp_t gfp)
1079{
1080	struct net_fill_args fillargs = {
1081		.portid = portid,
1082		.seq = nlh ? nlh->nlmsg_seq : 0,
1083		.cmd = cmd,
1084		.nsid = id,
1085	};
1086	struct sk_buff *msg;
1087	int err = -ENOMEM;
1088
1089	msg = nlmsg_new(rtnl_net_get_size(), gfp);
1090	if (!msg)
1091		goto out;
1092
1093	err = rtnl_net_fill(msg, &fillargs);
1094	if (err < 0)
1095		goto err_out;
1096
1097	rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp);
1098	return;
1099
1100err_out:
1101	nlmsg_free(msg);
1102out:
1103	rtnl_set_sk_err(net, RTNLGRP_NSID, err);
1104}
1105
1106#ifdef CONFIG_NET_NS
1107static void __init netns_ipv4_struct_check(void)
1108{
1109	/* TX readonly hotpath cache lines */
1110	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1111				      sysctl_tcp_early_retrans);
1112	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1113				      sysctl_tcp_tso_win_divisor);
1114	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1115				      sysctl_tcp_tso_rtt_log);
1116	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1117				      sysctl_tcp_autocorking);
1118	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1119				      sysctl_tcp_min_snd_mss);
1120	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1121				      sysctl_tcp_notsent_lowat);
1122	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1123				      sysctl_tcp_limit_output_bytes);
1124	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1125				      sysctl_tcp_min_rtt_wlen);
1126	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1127				      sysctl_tcp_wmem);
1128	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1129				      sysctl_ip_fwd_use_pmtu);
1130	CACHELINE_ASSERT_GROUP_SIZE(struct netns_ipv4, netns_ipv4_read_tx, 33);
1131
1132	/* TXRX readonly hotpath cache lines */
1133	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_txrx,
1134				      sysctl_tcp_moderate_rcvbuf);
1135	CACHELINE_ASSERT_GROUP_SIZE(struct netns_ipv4, netns_ipv4_read_txrx, 1);
1136
1137	/* RX readonly hotpath cache line */
1138	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1139				      sysctl_ip_early_demux);
1140	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1141				      sysctl_tcp_early_demux);
1142	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1143				      sysctl_tcp_reordering);
1144	CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1145				      sysctl_tcp_rmem);
1146	CACHELINE_ASSERT_GROUP_SIZE(struct netns_ipv4, netns_ipv4_read_rx, 18);
1147}
1148#endif
1149
1150void __init net_ns_init(void)
1151{
1152	struct net_generic *ng;
1153
1154#ifdef CONFIG_NET_NS
1155	netns_ipv4_struct_check();
1156	net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
1157					SMP_CACHE_BYTES,
1158					SLAB_PANIC|SLAB_ACCOUNT, NULL);
1159
1160	/* Create workqueue for cleanup */
1161	netns_wq = create_singlethread_workqueue("netns");
1162	if (!netns_wq)
1163		panic("Could not create netns workq");
1164#endif
1165
1166	ng = net_alloc_generic();
1167	if (!ng)
1168		panic("Could not allocate generic netns");
1169
1170	rcu_assign_pointer(init_net.gen, ng);
1171
1172#ifdef CONFIG_KEYS
1173	init_net.key_domain = &init_net_key_domain;
1174#endif
1175	down_write(&pernet_ops_rwsem);
1176	preinit_net(&init_net);
1177	if (setup_net(&init_net, &init_user_ns))
1178		panic("Could not setup the initial network namespace");
1179
1180	init_net_initialized = true;
1181	up_write(&pernet_ops_rwsem);
1182
1183	if (register_pernet_subsys(&net_ns_ops))
1184		panic("Could not register network namespace subsystems");
1185
1186	rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
1187		      RTNL_FLAG_DOIT_UNLOCKED);
1188	rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid,
1189		      RTNL_FLAG_DOIT_UNLOCKED);
1190}
1191
1192static void free_exit_list(struct pernet_operations *ops, struct list_head *net_exit_list)
1193{
1194	ops_pre_exit_list(ops, net_exit_list);
1195	synchronize_rcu();
1196	ops_exit_list(ops, net_exit_list);
1197	ops_free_list(ops, net_exit_list);
1198}
1199
 
 
1200#ifdef CONFIG_NET_NS
1201static int __register_pernet_operations(struct list_head *list,
1202					struct pernet_operations *ops)
1203{
1204	struct net *net;
1205	int error;
1206	LIST_HEAD(net_exit_list);
1207
1208	list_add_tail(&ops->list, list);
1209	if (ops->init || (ops->id && ops->size)) {
1210		/* We held write locked pernet_ops_rwsem, and parallel
1211		 * setup_net() and cleanup_net() are not possible.
1212		 */
1213		for_each_net(net) {
1214			error = ops_init(ops, net);
1215			if (error)
1216				goto out_undo;
1217			list_add_tail(&net->exit_list, &net_exit_list);
1218		}
1219	}
1220	return 0;
1221
1222out_undo:
1223	/* If I have an error cleanup all namespaces I initialized */
1224	list_del(&ops->list);
1225	free_exit_list(ops, &net_exit_list);
 
 
 
1226	return error;
1227}
1228
1229static void __unregister_pernet_operations(struct pernet_operations *ops)
1230{
1231	struct net *net;
1232	LIST_HEAD(net_exit_list);
1233
1234	list_del(&ops->list);
1235	/* See comment in __register_pernet_operations() */
1236	for_each_net(net)
1237		list_add_tail(&net->exit_list, &net_exit_list);
1238
1239	free_exit_list(ops, &net_exit_list);
 
 
1240}
1241
1242#else
1243
1244static int __register_pernet_operations(struct list_head *list,
1245					struct pernet_operations *ops)
1246{
1247	if (!init_net_initialized) {
1248		list_add_tail(&ops->list, list);
1249		return 0;
1250	}
1251
1252	return ops_init(ops, &init_net);
1253}
1254
1255static void __unregister_pernet_operations(struct pernet_operations *ops)
1256{
1257	if (!init_net_initialized) {
1258		list_del(&ops->list);
1259	} else {
1260		LIST_HEAD(net_exit_list);
1261		list_add(&init_net.exit_list, &net_exit_list);
1262		free_exit_list(ops, &net_exit_list);
 
 
 
1263	}
1264}
1265
1266#endif /* CONFIG_NET_NS */
1267
1268static DEFINE_IDA(net_generic_ids);
1269
1270static int register_pernet_operations(struct list_head *list,
1271				      struct pernet_operations *ops)
1272{
1273	int error;
1274
1275	if (ops->id) {
1276		error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID,
1277				GFP_KERNEL);
1278		if (error < 0)
1279			return error;
1280		*ops->id = error;
1281		max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1);
1282	}
1283	error = __register_pernet_operations(list, ops);
1284	if (error) {
1285		rcu_barrier();
1286		if (ops->id)
1287			ida_free(&net_generic_ids, *ops->id);
1288	}
1289
1290	return error;
1291}
1292
1293static void unregister_pernet_operations(struct pernet_operations *ops)
1294{
1295	__unregister_pernet_operations(ops);
1296	rcu_barrier();
1297	if (ops->id)
1298		ida_free(&net_generic_ids, *ops->id);
1299}
1300
1301/**
1302 *      register_pernet_subsys - register a network namespace subsystem
1303 *	@ops:  pernet operations structure for the subsystem
1304 *
1305 *	Register a subsystem which has init and exit functions
1306 *	that are called when network namespaces are created and
1307 *	destroyed respectively.
1308 *
1309 *	When registered all network namespace init functions are
1310 *	called for every existing network namespace.  Allowing kernel
1311 *	modules to have a race free view of the set of network namespaces.
1312 *
1313 *	When a new network namespace is created all of the init
1314 *	methods are called in the order in which they were registered.
1315 *
1316 *	When a network namespace is destroyed all of the exit methods
1317 *	are called in the reverse of the order with which they were
1318 *	registered.
1319 */
1320int register_pernet_subsys(struct pernet_operations *ops)
1321{
1322	int error;
1323	down_write(&pernet_ops_rwsem);
1324	error =  register_pernet_operations(first_device, ops);
1325	up_write(&pernet_ops_rwsem);
1326	return error;
1327}
1328EXPORT_SYMBOL_GPL(register_pernet_subsys);
1329
1330/**
1331 *      unregister_pernet_subsys - unregister a network namespace subsystem
1332 *	@ops: pernet operations structure to manipulate
1333 *
1334 *	Remove the pernet operations structure from the list to be
1335 *	used when network namespaces are created or destroyed.  In
1336 *	addition run the exit method for all existing network
1337 *	namespaces.
1338 */
1339void unregister_pernet_subsys(struct pernet_operations *ops)
1340{
1341	down_write(&pernet_ops_rwsem);
1342	unregister_pernet_operations(ops);
1343	up_write(&pernet_ops_rwsem);
1344}
1345EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
1346
1347/**
1348 *      register_pernet_device - register a network namespace device
1349 *	@ops:  pernet operations structure for the subsystem
1350 *
1351 *	Register a device which has init and exit functions
1352 *	that are called when network namespaces are created and
1353 *	destroyed respectively.
1354 *
1355 *	When registered all network namespace init functions are
1356 *	called for every existing network namespace.  Allowing kernel
1357 *	modules to have a race free view of the set of network namespaces.
1358 *
1359 *	When a new network namespace is created all of the init
1360 *	methods are called in the order in which they were registered.
1361 *
1362 *	When a network namespace is destroyed all of the exit methods
1363 *	are called in the reverse of the order with which they were
1364 *	registered.
1365 */
1366int register_pernet_device(struct pernet_operations *ops)
1367{
1368	int error;
1369	down_write(&pernet_ops_rwsem);
1370	error = register_pernet_operations(&pernet_list, ops);
1371	if (!error && (first_device == &pernet_list))
1372		first_device = &ops->list;
1373	up_write(&pernet_ops_rwsem);
1374	return error;
1375}
1376EXPORT_SYMBOL_GPL(register_pernet_device);
1377
1378/**
1379 *      unregister_pernet_device - unregister a network namespace netdevice
1380 *	@ops: pernet operations structure to manipulate
1381 *
1382 *	Remove the pernet operations structure from the list to be
1383 *	used when network namespaces are created or destroyed.  In
1384 *	addition run the exit method for all existing network
1385 *	namespaces.
1386 */
1387void unregister_pernet_device(struct pernet_operations *ops)
1388{
1389	down_write(&pernet_ops_rwsem);
1390	if (&ops->list == first_device)
1391		first_device = first_device->next;
1392	unregister_pernet_operations(ops);
1393	up_write(&pernet_ops_rwsem);
1394}
1395EXPORT_SYMBOL_GPL(unregister_pernet_device);
1396
1397#ifdef CONFIG_NET_NS
1398static struct ns_common *netns_get(struct task_struct *task)
1399{
1400	struct net *net = NULL;
1401	struct nsproxy *nsproxy;
1402
1403	task_lock(task);
1404	nsproxy = task->nsproxy;
1405	if (nsproxy)
1406		net = get_net(nsproxy->net_ns);
1407	task_unlock(task);
1408
1409	return net ? &net->ns : NULL;
1410}
1411
1412static inline struct net *to_net_ns(struct ns_common *ns)
1413{
1414	return container_of(ns, struct net, ns);
1415}
1416
1417static void netns_put(struct ns_common *ns)
1418{
1419	put_net(to_net_ns(ns));
1420}
1421
1422static int netns_install(struct nsset *nsset, struct ns_common *ns)
1423{
1424	struct nsproxy *nsproxy = nsset->nsproxy;
1425	struct net *net = to_net_ns(ns);
1426
1427	if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
1428	    !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
1429		return -EPERM;
1430
1431	put_net(nsproxy->net_ns);
1432	nsproxy->net_ns = get_net(net);
1433	return 0;
1434}
1435
1436static struct user_namespace *netns_owner(struct ns_common *ns)
1437{
1438	return to_net_ns(ns)->user_ns;
1439}
1440
1441const struct proc_ns_operations netns_operations = {
1442	.name		= "net",
1443	.type		= CLONE_NEWNET,
1444	.get		= netns_get,
1445	.put		= netns_put,
1446	.install	= netns_install,
1447	.owner		= netns_owner,
1448};
1449#endif
v5.14.15
   1// SPDX-License-Identifier: GPL-2.0-only
   2#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   3
   4#include <linux/workqueue.h>
   5#include <linux/rtnetlink.h>
   6#include <linux/cache.h>
   7#include <linux/slab.h>
   8#include <linux/list.h>
   9#include <linux/delay.h>
  10#include <linux/sched.h>
  11#include <linux/idr.h>
  12#include <linux/rculist.h>
  13#include <linux/nsproxy.h>
  14#include <linux/fs.h>
  15#include <linux/proc_ns.h>
  16#include <linux/file.h>
  17#include <linux/export.h>
  18#include <linux/user_namespace.h>
  19#include <linux/net_namespace.h>
  20#include <linux/sched/task.h>
  21#include <linux/uidgid.h>
  22#include <linux/cookie.h>
 
  23
  24#include <net/sock.h>
  25#include <net/netlink.h>
  26#include <net/net_namespace.h>
  27#include <net/netns/generic.h>
  28
  29/*
  30 *	Our network namespace constructor/destructor lists
  31 */
  32
  33static LIST_HEAD(pernet_list);
  34static struct list_head *first_device = &pernet_list;
  35
  36LIST_HEAD(net_namespace_list);
  37EXPORT_SYMBOL_GPL(net_namespace_list);
  38
  39/* Protects net_namespace_list. Nests iside rtnl_lock() */
  40DECLARE_RWSEM(net_rwsem);
  41EXPORT_SYMBOL_GPL(net_rwsem);
  42
  43#ifdef CONFIG_KEYS
  44static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) };
  45#endif
  46
  47struct net init_net = {
  48	.ns.count	= REFCOUNT_INIT(1),
  49	.dev_base_head	= LIST_HEAD_INIT(init_net.dev_base_head),
  50#ifdef CONFIG_KEYS
  51	.key_domain	= &init_net_key_domain,
  52#endif
  53};
  54EXPORT_SYMBOL(init_net);
  55
  56static bool init_net_initialized;
  57/*
  58 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids,
  59 * init_net_initialized and first_device pointer.
  60 * This is internal net namespace object. Please, don't use it
  61 * outside.
  62 */
  63DECLARE_RWSEM(pernet_ops_rwsem);
  64EXPORT_SYMBOL_GPL(pernet_ops_rwsem);
  65
  66#define MIN_PERNET_OPS_ID	\
  67	((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *))
  68
  69#define INITIAL_NET_GEN_PTRS	13 /* +1 for len +2 for rcu_head */
  70
  71static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
  72
  73DEFINE_COOKIE(net_cookie);
  74
  75static struct net_generic *net_alloc_generic(void)
  76{
  77	struct net_generic *ng;
  78	unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
  79
  80	ng = kzalloc(generic_size, GFP_KERNEL);
  81	if (ng)
  82		ng->s.len = max_gen_ptrs;
  83
  84	return ng;
  85}
  86
  87static int net_assign_generic(struct net *net, unsigned int id, void *data)
  88{
  89	struct net_generic *ng, *old_ng;
  90
  91	BUG_ON(id < MIN_PERNET_OPS_ID);
  92
  93	old_ng = rcu_dereference_protected(net->gen,
  94					   lockdep_is_held(&pernet_ops_rwsem));
  95	if (old_ng->s.len > id) {
  96		old_ng->ptr[id] = data;
  97		return 0;
  98	}
  99
 100	ng = net_alloc_generic();
 101	if (ng == NULL)
 102		return -ENOMEM;
 103
 104	/*
 105	 * Some synchronisation notes:
 106	 *
 107	 * The net_generic explores the net->gen array inside rcu
 108	 * read section. Besides once set the net->gen->ptr[x]
 109	 * pointer never changes (see rules in netns/generic.h).
 110	 *
 111	 * That said, we simply duplicate this array and schedule
 112	 * the old copy for kfree after a grace period.
 113	 */
 114
 115	memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID],
 116	       (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *));
 117	ng->ptr[id] = data;
 118
 119	rcu_assign_pointer(net->gen, ng);
 120	kfree_rcu(old_ng, s.rcu);
 121	return 0;
 122}
 123
 124static int ops_init(const struct pernet_operations *ops, struct net *net)
 125{
 
 126	int err = -ENOMEM;
 127	void *data = NULL;
 128
 129	if (ops->id && ops->size) {
 130		data = kzalloc(ops->size, GFP_KERNEL);
 131		if (!data)
 132			goto out;
 133
 134		err = net_assign_generic(net, *ops->id, data);
 135		if (err)
 136			goto cleanup;
 137	}
 138	err = 0;
 139	if (ops->init)
 140		err = ops->init(net);
 141	if (!err)
 142		return 0;
 143
 
 
 
 
 
 
 144cleanup:
 145	kfree(data);
 146
 147out:
 148	return err;
 149}
 150
 151static void ops_free(const struct pernet_operations *ops, struct net *net)
 152{
 153	if (ops->id && ops->size) {
 154		kfree(net_generic(net, *ops->id));
 155	}
 156}
 157
 158static void ops_pre_exit_list(const struct pernet_operations *ops,
 159			      struct list_head *net_exit_list)
 160{
 161	struct net *net;
 162
 163	if (ops->pre_exit) {
 164		list_for_each_entry(net, net_exit_list, exit_list)
 165			ops->pre_exit(net);
 166	}
 167}
 168
 169static void ops_exit_list(const struct pernet_operations *ops,
 170			  struct list_head *net_exit_list)
 171{
 172	struct net *net;
 173	if (ops->exit) {
 174		list_for_each_entry(net, net_exit_list, exit_list)
 175			ops->exit(net);
 
 
 176	}
 177	if (ops->exit_batch)
 178		ops->exit_batch(net_exit_list);
 179}
 180
 181static void ops_free_list(const struct pernet_operations *ops,
 182			  struct list_head *net_exit_list)
 183{
 184	struct net *net;
 185	if (ops->size && ops->id) {
 186		list_for_each_entry(net, net_exit_list, exit_list)
 187			ops_free(ops, net);
 188	}
 189}
 190
 191/* should be called with nsid_lock held */
 192static int alloc_netid(struct net *net, struct net *peer, int reqid)
 193{
 194	int min = 0, max = 0;
 195
 196	if (reqid >= 0) {
 197		min = reqid;
 198		max = reqid + 1;
 199	}
 200
 201	return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC);
 202}
 203
 204/* This function is used by idr_for_each(). If net is equal to peer, the
 205 * function returns the id so that idr_for_each() stops. Because we cannot
 206 * returns the id 0 (idr_for_each() will not stop), we return the magic value
 207 * NET_ID_ZERO (-1) for it.
 208 */
 209#define NET_ID_ZERO -1
 210static int net_eq_idr(int id, void *net, void *peer)
 211{
 212	if (net_eq(net, peer))
 213		return id ? : NET_ID_ZERO;
 214	return 0;
 215}
 216
 217/* Must be called from RCU-critical section or with nsid_lock held */
 218static int __peernet2id(const struct net *net, struct net *peer)
 219{
 220	int id = idr_for_each(&net->netns_ids, net_eq_idr, peer);
 221
 222	/* Magic value for id 0. */
 223	if (id == NET_ID_ZERO)
 224		return 0;
 225	if (id > 0)
 226		return id;
 227
 228	return NETNSA_NSID_NOT_ASSIGNED;
 229}
 230
 231static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
 232			      struct nlmsghdr *nlh, gfp_t gfp);
 233/* This function returns the id of a peer netns. If no id is assigned, one will
 234 * be allocated and returned.
 235 */
 236int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
 237{
 238	int id;
 239
 240	if (refcount_read(&net->ns.count) == 0)
 241		return NETNSA_NSID_NOT_ASSIGNED;
 242
 243	spin_lock_bh(&net->nsid_lock);
 244	id = __peernet2id(net, peer);
 245	if (id >= 0) {
 246		spin_unlock_bh(&net->nsid_lock);
 247		return id;
 248	}
 249
 250	/* When peer is obtained from RCU lists, we may race with
 251	 * its cleanup. Check whether it's alive, and this guarantees
 252	 * we never hash a peer back to net->netns_ids, after it has
 253	 * just been idr_remove()'d from there in cleanup_net().
 254	 */
 255	if (!maybe_get_net(peer)) {
 256		spin_unlock_bh(&net->nsid_lock);
 257		return NETNSA_NSID_NOT_ASSIGNED;
 258	}
 259
 260	id = alloc_netid(net, peer, -1);
 261	spin_unlock_bh(&net->nsid_lock);
 262
 263	put_net(peer);
 264	if (id < 0)
 265		return NETNSA_NSID_NOT_ASSIGNED;
 266
 267	rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp);
 268
 269	return id;
 270}
 271EXPORT_SYMBOL_GPL(peernet2id_alloc);
 272
 273/* This function returns, if assigned, the id of a peer netns. */
 274int peernet2id(const struct net *net, struct net *peer)
 275{
 276	int id;
 277
 278	rcu_read_lock();
 279	id = __peernet2id(net, peer);
 280	rcu_read_unlock();
 281
 282	return id;
 283}
 284EXPORT_SYMBOL(peernet2id);
 285
 286/* This function returns true is the peer netns has an id assigned into the
 287 * current netns.
 288 */
 289bool peernet_has_id(const struct net *net, struct net *peer)
 290{
 291	return peernet2id(net, peer) >= 0;
 292}
 293
 294struct net *get_net_ns_by_id(const struct net *net, int id)
 295{
 296	struct net *peer;
 297
 298	if (id < 0)
 299		return NULL;
 300
 301	rcu_read_lock();
 302	peer = idr_find(&net->netns_ids, id);
 303	if (peer)
 304		peer = maybe_get_net(peer);
 305	rcu_read_unlock();
 306
 307	return peer;
 308}
 
 
 
 
 
 
 
 309
 310/*
 311 * setup_net runs the initializers for the network namespace object.
 312 */
 313static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
 314{
 315	/* Must be called with pernet_ops_rwsem held */
 316	const struct pernet_operations *ops, *saved_ops;
 317	int error = 0;
 318	LIST_HEAD(net_exit_list);
 319
 320	refcount_set(&net->ns.count, 1);
 
 
 321	refcount_set(&net->passive, 1);
 322	get_random_bytes(&net->hash_mix, sizeof(u32));
 323	preempt_disable();
 324	net->net_cookie = gen_cookie_next(&net_cookie);
 325	preempt_enable();
 326	net->dev_base_seq = 1;
 327	net->user_ns = user_ns;
 328	idr_init(&net->netns_ids);
 329	spin_lock_init(&net->nsid_lock);
 330	mutex_init(&net->ipv4.ra_mutex);
 331
 332	list_for_each_entry(ops, &pernet_list, list) {
 333		error = ops_init(ops, net);
 334		if (error < 0)
 335			goto out_undo;
 336	}
 337	down_write(&net_rwsem);
 338	list_add_tail_rcu(&net->list, &net_namespace_list);
 339	up_write(&net_rwsem);
 340out:
 341	return error;
 342
 343out_undo:
 344	/* Walk through the list backwards calling the exit functions
 345	 * for the pernet modules whose init functions did not fail.
 346	 */
 347	list_add(&net->exit_list, &net_exit_list);
 348	saved_ops = ops;
 349	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 350		ops_pre_exit_list(ops, &net_exit_list);
 351
 352	synchronize_rcu();
 353
 354	ops = saved_ops;
 355	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 356		ops_exit_list(ops, &net_exit_list);
 357
 358	ops = saved_ops;
 359	list_for_each_entry_continue_reverse(ops, &pernet_list, list)
 360		ops_free_list(ops, &net_exit_list);
 361
 362	rcu_barrier();
 363	goto out;
 364}
 365
 366static int __net_init net_defaults_init_net(struct net *net)
 367{
 368	net->core.sysctl_somaxconn = SOMAXCONN;
 
 
 
 
 
 
 369	return 0;
 370}
 371
 372static struct pernet_operations net_defaults_ops = {
 373	.init = net_defaults_init_net,
 374};
 375
 376static __init int net_defaults_init(void)
 377{
 378	if (register_pernet_subsys(&net_defaults_ops))
 379		panic("Cannot initialize net default settings");
 380
 381	return 0;
 382}
 383
 384core_initcall(net_defaults_init);
 385
 386#ifdef CONFIG_NET_NS
 387static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
 388{
 389	return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES);
 390}
 391
 392static void dec_net_namespaces(struct ucounts *ucounts)
 393{
 394	dec_ucount(ucounts, UCOUNT_NET_NAMESPACES);
 395}
 396
 397static struct kmem_cache *net_cachep __ro_after_init;
 398static struct workqueue_struct *netns_wq;
 399
 400static struct net *net_alloc(void)
 401{
 402	struct net *net = NULL;
 403	struct net_generic *ng;
 404
 405	ng = net_alloc_generic();
 406	if (!ng)
 407		goto out;
 408
 409	net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
 410	if (!net)
 411		goto out_free;
 412
 413#ifdef CONFIG_KEYS
 414	net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL);
 415	if (!net->key_domain)
 416		goto out_free_2;
 417	refcount_set(&net->key_domain->usage, 1);
 418#endif
 419
 420	rcu_assign_pointer(net->gen, ng);
 421out:
 422	return net;
 423
 424#ifdef CONFIG_KEYS
 425out_free_2:
 426	kmem_cache_free(net_cachep, net);
 427	net = NULL;
 428#endif
 429out_free:
 430	kfree(ng);
 431	goto out;
 432}
 433
 434static void net_free(struct net *net)
 435{
 436	kfree(rcu_access_pointer(net->gen));
 437	kmem_cache_free(net_cachep, net);
 
 
 
 
 
 
 438}
 439
 440void net_drop_ns(void *p)
 441{
 442	struct net *ns = p;
 443	if (ns && refcount_dec_and_test(&ns->passive))
 444		net_free(ns);
 
 445}
 446
 447struct net *copy_net_ns(unsigned long flags,
 448			struct user_namespace *user_ns, struct net *old_net)
 449{
 450	struct ucounts *ucounts;
 451	struct net *net;
 452	int rv;
 453
 454	if (!(flags & CLONE_NEWNET))
 455		return get_net(old_net);
 456
 457	ucounts = inc_net_namespaces(user_ns);
 458	if (!ucounts)
 459		return ERR_PTR(-ENOSPC);
 460
 461	net = net_alloc();
 462	if (!net) {
 463		rv = -ENOMEM;
 464		goto dec_ucounts;
 465	}
 
 
 466	refcount_set(&net->passive, 1);
 467	net->ucounts = ucounts;
 468	get_user_ns(user_ns);
 469
 470	rv = down_read_killable(&pernet_ops_rwsem);
 471	if (rv < 0)
 472		goto put_userns;
 473
 474	rv = setup_net(net, user_ns);
 475
 476	up_read(&pernet_ops_rwsem);
 477
 478	if (rv < 0) {
 479put_userns:
 
 480		key_remove_domain(net->key_domain);
 
 481		put_user_ns(user_ns);
 482		net_drop_ns(net);
 483dec_ucounts:
 484		dec_net_namespaces(ucounts);
 485		return ERR_PTR(rv);
 486	}
 487	return net;
 488}
 489
 490/**
 491 * net_ns_get_ownership - get sysfs ownership data for @net
 492 * @net: network namespace in question (can be NULL)
 493 * @uid: kernel user ID for sysfs objects
 494 * @gid: kernel group ID for sysfs objects
 495 *
 496 * Returns the uid/gid pair of root in the user namespace associated with the
 497 * given network namespace.
 498 */
 499void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid)
 500{
 501	if (net) {
 502		kuid_t ns_root_uid = make_kuid(net->user_ns, 0);
 503		kgid_t ns_root_gid = make_kgid(net->user_ns, 0);
 504
 505		if (uid_valid(ns_root_uid))
 506			*uid = ns_root_uid;
 507
 508		if (gid_valid(ns_root_gid))
 509			*gid = ns_root_gid;
 510	} else {
 511		*uid = GLOBAL_ROOT_UID;
 512		*gid = GLOBAL_ROOT_GID;
 513	}
 514}
 515EXPORT_SYMBOL_GPL(net_ns_get_ownership);
 516
 517static void unhash_nsid(struct net *net, struct net *last)
 518{
 519	struct net *tmp;
 520	/* This function is only called from cleanup_net() work,
 521	 * and this work is the only process, that may delete
 522	 * a net from net_namespace_list. So, when the below
 523	 * is executing, the list may only grow. Thus, we do not
 524	 * use for_each_net_rcu() or net_rwsem.
 525	 */
 526	for_each_net(tmp) {
 527		int id;
 528
 529		spin_lock_bh(&tmp->nsid_lock);
 530		id = __peernet2id(tmp, net);
 531		if (id >= 0)
 532			idr_remove(&tmp->netns_ids, id);
 533		spin_unlock_bh(&tmp->nsid_lock);
 534		if (id >= 0)
 535			rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL,
 536					  GFP_KERNEL);
 537		if (tmp == last)
 538			break;
 539	}
 540	spin_lock_bh(&net->nsid_lock);
 541	idr_destroy(&net->netns_ids);
 542	spin_unlock_bh(&net->nsid_lock);
 543}
 544
 545static LLIST_HEAD(cleanup_list);
 546
 547static void cleanup_net(struct work_struct *work)
 548{
 549	const struct pernet_operations *ops;
 550	struct net *net, *tmp, *last;
 551	struct llist_node *net_kill_list;
 552	LIST_HEAD(net_exit_list);
 553
 554	/* Atomically snapshot the list of namespaces to cleanup */
 555	net_kill_list = llist_del_all(&cleanup_list);
 556
 557	down_read(&pernet_ops_rwsem);
 558
 559	/* Don't let anyone else find us. */
 560	down_write(&net_rwsem);
 561	llist_for_each_entry(net, net_kill_list, cleanup_list)
 562		list_del_rcu(&net->list);
 563	/* Cache last net. After we unlock rtnl, no one new net
 564	 * added to net_namespace_list can assign nsid pointer
 565	 * to a net from net_kill_list (see peernet2id_alloc()).
 566	 * So, we skip them in unhash_nsid().
 567	 *
 568	 * Note, that unhash_nsid() does not delete nsid links
 569	 * between net_kill_list's nets, as they've already
 570	 * deleted from net_namespace_list. But, this would be
 571	 * useless anyway, as netns_ids are destroyed there.
 572	 */
 573	last = list_last_entry(&net_namespace_list, struct net, list);
 574	up_write(&net_rwsem);
 575
 576	llist_for_each_entry(net, net_kill_list, cleanup_list) {
 577		unhash_nsid(net, last);
 578		list_add_tail(&net->exit_list, &net_exit_list);
 579	}
 580
 581	/* Run all of the network namespace pre_exit methods */
 582	list_for_each_entry_reverse(ops, &pernet_list, list)
 583		ops_pre_exit_list(ops, &net_exit_list);
 584
 585	/*
 586	 * Another CPU might be rcu-iterating the list, wait for it.
 587	 * This needs to be before calling the exit() notifiers, so
 588	 * the rcu_barrier() below isn't sufficient alone.
 589	 * Also the pre_exit() and exit() methods need this barrier.
 590	 */
 591	synchronize_rcu();
 592
 593	/* Run all of the network namespace exit methods */
 594	list_for_each_entry_reverse(ops, &pernet_list, list)
 595		ops_exit_list(ops, &net_exit_list);
 596
 597	/* Free the net generic variables */
 598	list_for_each_entry_reverse(ops, &pernet_list, list)
 599		ops_free_list(ops, &net_exit_list);
 600
 601	up_read(&pernet_ops_rwsem);
 602
 603	/* Ensure there are no outstanding rcu callbacks using this
 604	 * network namespace.
 605	 */
 606	rcu_barrier();
 607
 608	/* Finally it is safe to free my network namespace structure */
 609	list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
 610		list_del_init(&net->exit_list);
 611		dec_net_namespaces(net->ucounts);
 
 612		key_remove_domain(net->key_domain);
 
 613		put_user_ns(net->user_ns);
 614		net_drop_ns(net);
 615	}
 616}
 617
 618/**
 619 * net_ns_barrier - wait until concurrent net_cleanup_work is done
 620 *
 621 * cleanup_net runs from work queue and will first remove namespaces
 622 * from the global list, then run net exit functions.
 623 *
 624 * Call this in module exit path to make sure that all netns
 625 * ->exit ops have been invoked before the function is removed.
 626 */
 627void net_ns_barrier(void)
 628{
 629	down_write(&pernet_ops_rwsem);
 630	up_write(&pernet_ops_rwsem);
 631}
 632EXPORT_SYMBOL(net_ns_barrier);
 633
 634static DECLARE_WORK(net_cleanup_work, cleanup_net);
 635
 636void __put_net(struct net *net)
 637{
 
 638	/* Cleanup the network namespace in process context */
 639	if (llist_add(&net->cleanup_list, &cleanup_list))
 640		queue_work(netns_wq, &net_cleanup_work);
 641}
 642EXPORT_SYMBOL_GPL(__put_net);
 643
 644/**
 645 * get_net_ns - increment the refcount of the network namespace
 646 * @ns: common namespace (net)
 647 *
 648 * Returns the net's common namespace.
 649 */
 650struct ns_common *get_net_ns(struct ns_common *ns)
 651{
 652	return &get_net(container_of(ns, struct net, ns))->ns;
 653}
 654EXPORT_SYMBOL_GPL(get_net_ns);
 655
 656struct net *get_net_ns_by_fd(int fd)
 657{
 658	struct file *file;
 659	struct ns_common *ns;
 660	struct net *net;
 661
 662	file = proc_ns_fget(fd);
 663	if (IS_ERR(file))
 664		return ERR_CAST(file);
 665
 666	ns = get_proc_ns(file_inode(file));
 667	if (ns->ops == &netns_operations)
 668		net = get_net(container_of(ns, struct net, ns));
 669	else
 670		net = ERR_PTR(-EINVAL);
 671
 672	fput(file);
 673	return net;
 674}
 675EXPORT_SYMBOL_GPL(get_net_ns_by_fd);
 676#endif
 677
 678struct net *get_net_ns_by_pid(pid_t pid)
 679{
 680	struct task_struct *tsk;
 681	struct net *net;
 682
 683	/* Lookup the network namespace */
 684	net = ERR_PTR(-ESRCH);
 685	rcu_read_lock();
 686	tsk = find_task_by_vpid(pid);
 687	if (tsk) {
 688		struct nsproxy *nsproxy;
 689		task_lock(tsk);
 690		nsproxy = tsk->nsproxy;
 691		if (nsproxy)
 692			net = get_net(nsproxy->net_ns);
 693		task_unlock(tsk);
 694	}
 695	rcu_read_unlock();
 696	return net;
 697}
 698EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
 699
 700static __net_init int net_ns_net_init(struct net *net)
 701{
 702#ifdef CONFIG_NET_NS
 703	net->ns.ops = &netns_operations;
 704#endif
 705	return ns_alloc_inum(&net->ns);
 706}
 707
 708static __net_exit void net_ns_net_exit(struct net *net)
 709{
 710	ns_free_inum(&net->ns);
 711}
 712
 713static struct pernet_operations __net_initdata net_ns_ops = {
 714	.init = net_ns_net_init,
 715	.exit = net_ns_net_exit,
 716};
 717
 718static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
 719	[NETNSA_NONE]		= { .type = NLA_UNSPEC },
 720	[NETNSA_NSID]		= { .type = NLA_S32 },
 721	[NETNSA_PID]		= { .type = NLA_U32 },
 722	[NETNSA_FD]		= { .type = NLA_U32 },
 723	[NETNSA_TARGET_NSID]	= { .type = NLA_S32 },
 724};
 725
 726static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
 727			  struct netlink_ext_ack *extack)
 728{
 729	struct net *net = sock_net(skb->sk);
 730	struct nlattr *tb[NETNSA_MAX + 1];
 731	struct nlattr *nla;
 732	struct net *peer;
 733	int nsid, err;
 734
 735	err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb,
 736				     NETNSA_MAX, rtnl_net_policy, extack);
 737	if (err < 0)
 738		return err;
 739	if (!tb[NETNSA_NSID]) {
 740		NL_SET_ERR_MSG(extack, "nsid is missing");
 741		return -EINVAL;
 742	}
 743	nsid = nla_get_s32(tb[NETNSA_NSID]);
 744
 745	if (tb[NETNSA_PID]) {
 746		peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
 747		nla = tb[NETNSA_PID];
 748	} else if (tb[NETNSA_FD]) {
 749		peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
 750		nla = tb[NETNSA_FD];
 751	} else {
 752		NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
 753		return -EINVAL;
 754	}
 755	if (IS_ERR(peer)) {
 756		NL_SET_BAD_ATTR(extack, nla);
 757		NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
 758		return PTR_ERR(peer);
 759	}
 760
 761	spin_lock_bh(&net->nsid_lock);
 762	if (__peernet2id(net, peer) >= 0) {
 763		spin_unlock_bh(&net->nsid_lock);
 764		err = -EEXIST;
 765		NL_SET_BAD_ATTR(extack, nla);
 766		NL_SET_ERR_MSG(extack,
 767			       "Peer netns already has a nsid assigned");
 768		goto out;
 769	}
 770
 771	err = alloc_netid(net, peer, nsid);
 772	spin_unlock_bh(&net->nsid_lock);
 773	if (err >= 0) {
 774		rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid,
 775				  nlh, GFP_KERNEL);
 776		err = 0;
 777	} else if (err == -ENOSPC && nsid >= 0) {
 778		err = -EEXIST;
 779		NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]);
 780		NL_SET_ERR_MSG(extack, "The specified nsid is already used");
 781	}
 782out:
 783	put_net(peer);
 784	return err;
 785}
 786
 787static int rtnl_net_get_size(void)
 788{
 789	return NLMSG_ALIGN(sizeof(struct rtgenmsg))
 790	       + nla_total_size(sizeof(s32)) /* NETNSA_NSID */
 791	       + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */
 792	       ;
 793}
 794
 795struct net_fill_args {
 796	u32 portid;
 797	u32 seq;
 798	int flags;
 799	int cmd;
 800	int nsid;
 801	bool add_ref;
 802	int ref_nsid;
 803};
 804
 805static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args)
 806{
 807	struct nlmsghdr *nlh;
 808	struct rtgenmsg *rth;
 809
 810	nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth),
 811			args->flags);
 812	if (!nlh)
 813		return -EMSGSIZE;
 814
 815	rth = nlmsg_data(nlh);
 816	rth->rtgen_family = AF_UNSPEC;
 817
 818	if (nla_put_s32(skb, NETNSA_NSID, args->nsid))
 819		goto nla_put_failure;
 820
 821	if (args->add_ref &&
 822	    nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid))
 823		goto nla_put_failure;
 824
 825	nlmsg_end(skb, nlh);
 826	return 0;
 827
 828nla_put_failure:
 829	nlmsg_cancel(skb, nlh);
 830	return -EMSGSIZE;
 831}
 832
 833static int rtnl_net_valid_getid_req(struct sk_buff *skb,
 834				    const struct nlmsghdr *nlh,
 835				    struct nlattr **tb,
 836				    struct netlink_ext_ack *extack)
 837{
 838	int i, err;
 839
 840	if (!netlink_strict_get_check(skb))
 841		return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg),
 842					      tb, NETNSA_MAX, rtnl_net_policy,
 843					      extack);
 844
 845	err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
 846					    NETNSA_MAX, rtnl_net_policy,
 847					    extack);
 848	if (err)
 849		return err;
 850
 851	for (i = 0; i <= NETNSA_MAX; i++) {
 852		if (!tb[i])
 853			continue;
 854
 855		switch (i) {
 856		case NETNSA_PID:
 857		case NETNSA_FD:
 858		case NETNSA_NSID:
 859		case NETNSA_TARGET_NSID:
 860			break;
 861		default:
 862			NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request");
 863			return -EINVAL;
 864		}
 865	}
 866
 867	return 0;
 868}
 869
 870static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
 871			  struct netlink_ext_ack *extack)
 872{
 873	struct net *net = sock_net(skb->sk);
 874	struct nlattr *tb[NETNSA_MAX + 1];
 875	struct net_fill_args fillargs = {
 876		.portid = NETLINK_CB(skb).portid,
 877		.seq = nlh->nlmsg_seq,
 878		.cmd = RTM_NEWNSID,
 879	};
 880	struct net *peer, *target = net;
 881	struct nlattr *nla;
 882	struct sk_buff *msg;
 883	int err;
 884
 885	err = rtnl_net_valid_getid_req(skb, nlh, tb, extack);
 886	if (err < 0)
 887		return err;
 888	if (tb[NETNSA_PID]) {
 889		peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
 890		nla = tb[NETNSA_PID];
 891	} else if (tb[NETNSA_FD]) {
 892		peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
 893		nla = tb[NETNSA_FD];
 894	} else if (tb[NETNSA_NSID]) {
 895		peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID]));
 896		if (!peer)
 897			peer = ERR_PTR(-ENOENT);
 898		nla = tb[NETNSA_NSID];
 899	} else {
 900		NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
 901		return -EINVAL;
 902	}
 903
 904	if (IS_ERR(peer)) {
 905		NL_SET_BAD_ATTR(extack, nla);
 906		NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
 907		return PTR_ERR(peer);
 908	}
 909
 910	if (tb[NETNSA_TARGET_NSID]) {
 911		int id = nla_get_s32(tb[NETNSA_TARGET_NSID]);
 912
 913		target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id);
 914		if (IS_ERR(target)) {
 915			NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]);
 916			NL_SET_ERR_MSG(extack,
 917				       "Target netns reference is invalid");
 918			err = PTR_ERR(target);
 919			goto out;
 920		}
 921		fillargs.add_ref = true;
 922		fillargs.ref_nsid = peernet2id(net, peer);
 923	}
 924
 925	msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
 926	if (!msg) {
 927		err = -ENOMEM;
 928		goto out;
 929	}
 930
 931	fillargs.nsid = peernet2id(target, peer);
 932	err = rtnl_net_fill(msg, &fillargs);
 933	if (err < 0)
 934		goto err_out;
 935
 936	err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid);
 937	goto out;
 938
 939err_out:
 940	nlmsg_free(msg);
 941out:
 942	if (fillargs.add_ref)
 943		put_net(target);
 944	put_net(peer);
 945	return err;
 946}
 947
 948struct rtnl_net_dump_cb {
 949	struct net *tgt_net;
 950	struct net *ref_net;
 951	struct sk_buff *skb;
 952	struct net_fill_args fillargs;
 953	int idx;
 954	int s_idx;
 955};
 956
 957/* Runs in RCU-critical section. */
 958static int rtnl_net_dumpid_one(int id, void *peer, void *data)
 959{
 960	struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
 961	int ret;
 962
 963	if (net_cb->idx < net_cb->s_idx)
 964		goto cont;
 965
 966	net_cb->fillargs.nsid = id;
 967	if (net_cb->fillargs.add_ref)
 968		net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer);
 969	ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs);
 970	if (ret < 0)
 971		return ret;
 972
 973cont:
 974	net_cb->idx++;
 975	return 0;
 976}
 977
 978static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk,
 979				   struct rtnl_net_dump_cb *net_cb,
 980				   struct netlink_callback *cb)
 981{
 982	struct netlink_ext_ack *extack = cb->extack;
 983	struct nlattr *tb[NETNSA_MAX + 1];
 984	int err, i;
 985
 986	err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
 987					    NETNSA_MAX, rtnl_net_policy,
 988					    extack);
 989	if (err < 0)
 990		return err;
 991
 992	for (i = 0; i <= NETNSA_MAX; i++) {
 993		if (!tb[i])
 994			continue;
 995
 996		if (i == NETNSA_TARGET_NSID) {
 997			struct net *net;
 998
 999			net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i]));
1000			if (IS_ERR(net)) {
1001				NL_SET_BAD_ATTR(extack, tb[i]);
1002				NL_SET_ERR_MSG(extack,
1003					       "Invalid target network namespace id");
1004				return PTR_ERR(net);
1005			}
1006			net_cb->fillargs.add_ref = true;
1007			net_cb->ref_net = net_cb->tgt_net;
1008			net_cb->tgt_net = net;
1009		} else {
1010			NL_SET_BAD_ATTR(extack, tb[i]);
1011			NL_SET_ERR_MSG(extack,
1012				       "Unsupported attribute in dump request");
1013			return -EINVAL;
1014		}
1015	}
1016
1017	return 0;
1018}
1019
1020static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
1021{
1022	struct rtnl_net_dump_cb net_cb = {
1023		.tgt_net = sock_net(skb->sk),
1024		.skb = skb,
1025		.fillargs = {
1026			.portid = NETLINK_CB(cb->skb).portid,
1027			.seq = cb->nlh->nlmsg_seq,
1028			.flags = NLM_F_MULTI,
1029			.cmd = RTM_NEWNSID,
1030		},
1031		.idx = 0,
1032		.s_idx = cb->args[0],
1033	};
1034	int err = 0;
1035
1036	if (cb->strict_check) {
1037		err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb);
1038		if (err < 0)
1039			goto end;
1040	}
1041
1042	rcu_read_lock();
1043	idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb);
1044	rcu_read_unlock();
1045
1046	cb->args[0] = net_cb.idx;
1047end:
1048	if (net_cb.fillargs.add_ref)
1049		put_net(net_cb.tgt_net);
1050	return err < 0 ? err : skb->len;
1051}
1052
1053static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
1054			      struct nlmsghdr *nlh, gfp_t gfp)
1055{
1056	struct net_fill_args fillargs = {
1057		.portid = portid,
1058		.seq = nlh ? nlh->nlmsg_seq : 0,
1059		.cmd = cmd,
1060		.nsid = id,
1061	};
1062	struct sk_buff *msg;
1063	int err = -ENOMEM;
1064
1065	msg = nlmsg_new(rtnl_net_get_size(), gfp);
1066	if (!msg)
1067		goto out;
1068
1069	err = rtnl_net_fill(msg, &fillargs);
1070	if (err < 0)
1071		goto err_out;
1072
1073	rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp);
1074	return;
1075
1076err_out:
1077	nlmsg_free(msg);
1078out:
1079	rtnl_set_sk_err(net, RTNLGRP_NSID, err);
1080}
1081
1082static int __init net_ns_init(void)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1083{
1084	struct net_generic *ng;
1085
1086#ifdef CONFIG_NET_NS
 
1087	net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
1088					SMP_CACHE_BYTES,
1089					SLAB_PANIC|SLAB_ACCOUNT, NULL);
1090
1091	/* Create workqueue for cleanup */
1092	netns_wq = create_singlethread_workqueue("netns");
1093	if (!netns_wq)
1094		panic("Could not create netns workq");
1095#endif
1096
1097	ng = net_alloc_generic();
1098	if (!ng)
1099		panic("Could not allocate generic netns");
1100
1101	rcu_assign_pointer(init_net.gen, ng);
1102
 
 
 
1103	down_write(&pernet_ops_rwsem);
 
1104	if (setup_net(&init_net, &init_user_ns))
1105		panic("Could not setup the initial network namespace");
1106
1107	init_net_initialized = true;
1108	up_write(&pernet_ops_rwsem);
1109
1110	if (register_pernet_subsys(&net_ns_ops))
1111		panic("Could not register network namespace subsystems");
1112
1113	rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
1114		      RTNL_FLAG_DOIT_UNLOCKED);
1115	rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid,
1116		      RTNL_FLAG_DOIT_UNLOCKED);
 
1117
1118	return 0;
 
 
 
 
 
1119}
1120
1121pure_initcall(net_ns_init);
1122
1123#ifdef CONFIG_NET_NS
1124static int __register_pernet_operations(struct list_head *list,
1125					struct pernet_operations *ops)
1126{
1127	struct net *net;
1128	int error;
1129	LIST_HEAD(net_exit_list);
1130
1131	list_add_tail(&ops->list, list);
1132	if (ops->init || (ops->id && ops->size)) {
1133		/* We held write locked pernet_ops_rwsem, and parallel
1134		 * setup_net() and cleanup_net() are not possible.
1135		 */
1136		for_each_net(net) {
1137			error = ops_init(ops, net);
1138			if (error)
1139				goto out_undo;
1140			list_add_tail(&net->exit_list, &net_exit_list);
1141		}
1142	}
1143	return 0;
1144
1145out_undo:
1146	/* If I have an error cleanup all namespaces I initialized */
1147	list_del(&ops->list);
1148	ops_pre_exit_list(ops, &net_exit_list);
1149	synchronize_rcu();
1150	ops_exit_list(ops, &net_exit_list);
1151	ops_free_list(ops, &net_exit_list);
1152	return error;
1153}
1154
1155static void __unregister_pernet_operations(struct pernet_operations *ops)
1156{
1157	struct net *net;
1158	LIST_HEAD(net_exit_list);
1159
1160	list_del(&ops->list);
1161	/* See comment in __register_pernet_operations() */
1162	for_each_net(net)
1163		list_add_tail(&net->exit_list, &net_exit_list);
1164	ops_pre_exit_list(ops, &net_exit_list);
1165	synchronize_rcu();
1166	ops_exit_list(ops, &net_exit_list);
1167	ops_free_list(ops, &net_exit_list);
1168}
1169
1170#else
1171
1172static int __register_pernet_operations(struct list_head *list,
1173					struct pernet_operations *ops)
1174{
1175	if (!init_net_initialized) {
1176		list_add_tail(&ops->list, list);
1177		return 0;
1178	}
1179
1180	return ops_init(ops, &init_net);
1181}
1182
1183static void __unregister_pernet_operations(struct pernet_operations *ops)
1184{
1185	if (!init_net_initialized) {
1186		list_del(&ops->list);
1187	} else {
1188		LIST_HEAD(net_exit_list);
1189		list_add(&init_net.exit_list, &net_exit_list);
1190		ops_pre_exit_list(ops, &net_exit_list);
1191		synchronize_rcu();
1192		ops_exit_list(ops, &net_exit_list);
1193		ops_free_list(ops, &net_exit_list);
1194	}
1195}
1196
1197#endif /* CONFIG_NET_NS */
1198
1199static DEFINE_IDA(net_generic_ids);
1200
1201static int register_pernet_operations(struct list_head *list,
1202				      struct pernet_operations *ops)
1203{
1204	int error;
1205
1206	if (ops->id) {
1207		error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID,
1208				GFP_KERNEL);
1209		if (error < 0)
1210			return error;
1211		*ops->id = error;
1212		max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1);
1213	}
1214	error = __register_pernet_operations(list, ops);
1215	if (error) {
1216		rcu_barrier();
1217		if (ops->id)
1218			ida_free(&net_generic_ids, *ops->id);
1219	}
1220
1221	return error;
1222}
1223
1224static void unregister_pernet_operations(struct pernet_operations *ops)
1225{
1226	__unregister_pernet_operations(ops);
1227	rcu_barrier();
1228	if (ops->id)
1229		ida_free(&net_generic_ids, *ops->id);
1230}
1231
1232/**
1233 *      register_pernet_subsys - register a network namespace subsystem
1234 *	@ops:  pernet operations structure for the subsystem
1235 *
1236 *	Register a subsystem which has init and exit functions
1237 *	that are called when network namespaces are created and
1238 *	destroyed respectively.
1239 *
1240 *	When registered all network namespace init functions are
1241 *	called for every existing network namespace.  Allowing kernel
1242 *	modules to have a race free view of the set of network namespaces.
1243 *
1244 *	When a new network namespace is created all of the init
1245 *	methods are called in the order in which they were registered.
1246 *
1247 *	When a network namespace is destroyed all of the exit methods
1248 *	are called in the reverse of the order with which they were
1249 *	registered.
1250 */
1251int register_pernet_subsys(struct pernet_operations *ops)
1252{
1253	int error;
1254	down_write(&pernet_ops_rwsem);
1255	error =  register_pernet_operations(first_device, ops);
1256	up_write(&pernet_ops_rwsem);
1257	return error;
1258}
1259EXPORT_SYMBOL_GPL(register_pernet_subsys);
1260
1261/**
1262 *      unregister_pernet_subsys - unregister a network namespace subsystem
1263 *	@ops: pernet operations structure to manipulate
1264 *
1265 *	Remove the pernet operations structure from the list to be
1266 *	used when network namespaces are created or destroyed.  In
1267 *	addition run the exit method for all existing network
1268 *	namespaces.
1269 */
1270void unregister_pernet_subsys(struct pernet_operations *ops)
1271{
1272	down_write(&pernet_ops_rwsem);
1273	unregister_pernet_operations(ops);
1274	up_write(&pernet_ops_rwsem);
1275}
1276EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
1277
1278/**
1279 *      register_pernet_device - register a network namespace device
1280 *	@ops:  pernet operations structure for the subsystem
1281 *
1282 *	Register a device which has init and exit functions
1283 *	that are called when network namespaces are created and
1284 *	destroyed respectively.
1285 *
1286 *	When registered all network namespace init functions are
1287 *	called for every existing network namespace.  Allowing kernel
1288 *	modules to have a race free view of the set of network namespaces.
1289 *
1290 *	When a new network namespace is created all of the init
1291 *	methods are called in the order in which they were registered.
1292 *
1293 *	When a network namespace is destroyed all of the exit methods
1294 *	are called in the reverse of the order with which they were
1295 *	registered.
1296 */
1297int register_pernet_device(struct pernet_operations *ops)
1298{
1299	int error;
1300	down_write(&pernet_ops_rwsem);
1301	error = register_pernet_operations(&pernet_list, ops);
1302	if (!error && (first_device == &pernet_list))
1303		first_device = &ops->list;
1304	up_write(&pernet_ops_rwsem);
1305	return error;
1306}
1307EXPORT_SYMBOL_GPL(register_pernet_device);
1308
1309/**
1310 *      unregister_pernet_device - unregister a network namespace netdevice
1311 *	@ops: pernet operations structure to manipulate
1312 *
1313 *	Remove the pernet operations structure from the list to be
1314 *	used when network namespaces are created or destroyed.  In
1315 *	addition run the exit method for all existing network
1316 *	namespaces.
1317 */
1318void unregister_pernet_device(struct pernet_operations *ops)
1319{
1320	down_write(&pernet_ops_rwsem);
1321	if (&ops->list == first_device)
1322		first_device = first_device->next;
1323	unregister_pernet_operations(ops);
1324	up_write(&pernet_ops_rwsem);
1325}
1326EXPORT_SYMBOL_GPL(unregister_pernet_device);
1327
1328#ifdef CONFIG_NET_NS
1329static struct ns_common *netns_get(struct task_struct *task)
1330{
1331	struct net *net = NULL;
1332	struct nsproxy *nsproxy;
1333
1334	task_lock(task);
1335	nsproxy = task->nsproxy;
1336	if (nsproxy)
1337		net = get_net(nsproxy->net_ns);
1338	task_unlock(task);
1339
1340	return net ? &net->ns : NULL;
1341}
1342
1343static inline struct net *to_net_ns(struct ns_common *ns)
1344{
1345	return container_of(ns, struct net, ns);
1346}
1347
1348static void netns_put(struct ns_common *ns)
1349{
1350	put_net(to_net_ns(ns));
1351}
1352
1353static int netns_install(struct nsset *nsset, struct ns_common *ns)
1354{
1355	struct nsproxy *nsproxy = nsset->nsproxy;
1356	struct net *net = to_net_ns(ns);
1357
1358	if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
1359	    !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
1360		return -EPERM;
1361
1362	put_net(nsproxy->net_ns);
1363	nsproxy->net_ns = get_net(net);
1364	return 0;
1365}
1366
1367static struct user_namespace *netns_owner(struct ns_common *ns)
1368{
1369	return to_net_ns(ns)->user_ns;
1370}
1371
1372const struct proc_ns_operations netns_operations = {
1373	.name		= "net",
1374	.type		= CLONE_NEWNET,
1375	.get		= netns_get,
1376	.put		= netns_put,
1377	.install	= netns_install,
1378	.owner		= netns_owner,
1379};
1380#endif