kernel/bpf/net_namespace.c

   1 // SPDX-License-Identifier: GPL-2.0
   2
   3 #include <linux/bpf.h>
   4 #include <linux/filter.h>
   5 #include <net/net_namespace.h>
   6
   7 /*
   8  * Functions to manage BPF programs attached to netns
   9  */
  10
  11 struct bpf_netns_link {
  12         struct bpf_link link;
  13         enum bpf_attach_type type;
  14         enum netns_bpf_attach_type netns_type;
  15
  16         /* We don't hold a ref to net in order to auto-detach the link
  17          * when netns is going away. Instead we rely on pernet
  18          * pre_exit callback to clear this pointer. Must be accessed
  19          * with netns_bpf_mutex held.
  20          */
  21         struct net *net;
  22 };
  23
  24 /* Protects updates to netns_bpf */
  25 DEFINE_MUTEX(netns_bpf_mutex);
  26
  27 /* Must be called with netns_bpf_mutex held. */
  28 static void __net_exit bpf_netns_link_auto_detach(struct bpf_link *link)
  29 {
  30         struct bpf_netns_link *net_link =
  31                 container_of(link, struct bpf_netns_link, link);
  32
  33         net_link->net = NULL;
  34 }
  35
  36 static void bpf_netns_link_release(struct bpf_link *link)
  37 {
  38         struct bpf_netns_link *net_link =
  39                 container_of(link, struct bpf_netns_link, link);
  40         enum netns_bpf_attach_type type = net_link->netns_type;
  41         struct net *net;
  42
  43         /* Link auto-detached by dying netns. */
  44         if (!net_link->net)
  45                 return;
  46
  47         mutex_lock(&netns_bpf_mutex);
  48
  49         /* Recheck after potential sleep. We can race with cleanup_net
  50          * here, but if we see a non-NULL struct net pointer pre_exit
  51          * has not happened yet and will block on netns_bpf_mutex.
  52          */
  53         net = net_link->net;
  54         if (!net)
  55                 goto out_unlock;
  56
  57         net->bpf.links[type] = NULL;
  58         RCU_INIT_POINTER(net->bpf.progs[type], NULL);
  59
  60 out_unlock:
  61         mutex_unlock(&netns_bpf_mutex);
  62 }
  63
  64 static void bpf_netns_link_dealloc(struct bpf_link *link)
  65 {
  66         struct bpf_netns_link *net_link =
  67                 container_of(link, struct bpf_netns_link, link);
  68
  69         kfree(net_link);
  70 }
  71
  72 static int bpf_netns_link_update_prog(struct bpf_link *link,
  73                                       struct bpf_prog *new_prog,
  74                                       struct bpf_prog *old_prog)
  75 {
  76         struct bpf_netns_link *net_link =
  77                 container_of(link, struct bpf_netns_link, link);
  78         enum netns_bpf_attach_type type = net_link->netns_type;
  79         struct net *net;
  80         int ret = 0;
  81
  82         if (old_prog && old_prog != link->prog)
  83                 return -EPERM;
  84         if (new_prog->type != link->prog->type)
  85                 return -EINVAL;
  86
  87         mutex_lock(&netns_bpf_mutex);
  88
  89         net = net_link->net;
  90         if (!net || !check_net(net)) {
  91                 /* Link auto-detached or netns dying */
  92                 ret = -ENOLINK;
  93                 goto out_unlock;
  94         }
  95
  96         old_prog = xchg(&link->prog, new_prog);
  97         rcu_assign_pointer(net->bpf.progs[type], new_prog);
  98         bpf_prog_put(old_prog);
  99
 100 out_unlock:
 101         mutex_unlock(&netns_bpf_mutex);
 102         return ret;
 103 }
 104
 105 static int bpf_netns_link_fill_info(const struct bpf_link *link,
 106                                     struct bpf_link_info *info)
 107 {
 108         const struct bpf_netns_link *net_link =
 109                 container_of(link, struct bpf_netns_link, link);
 110         unsigned int inum = 0;
 111         struct net *net;
 112
 113         mutex_lock(&netns_bpf_mutex);
 114         net = net_link->net;
 115         if (net && check_net(net))
 116                 inum = net->ns.inum;
 117         mutex_unlock(&netns_bpf_mutex);
 118
 119         info->netns.netns_ino = inum;
 120         info->netns.attach_type = net_link->type;
 121         return 0;
 122 }
 123
 124 static void bpf_netns_link_show_fdinfo(const struct bpf_link *link,
 125                                        struct seq_file *seq)
 126 {
 127         struct bpf_link_info info = {};
 128
 129         bpf_netns_link_fill_info(link, &info);
 130         seq_printf(seq,
 131                    "netns_ino:\t%u\n"
 132                    "attach_type:\t%u\n",
 133                    info.netns.netns_ino,
 134                    info.netns.attach_type);
 135 }
 136
 137 static const struct bpf_link_ops bpf_netns_link_ops = {
 138         .release = bpf_netns_link_release,
 139         .dealloc = bpf_netns_link_dealloc,
 140         .update_prog = bpf_netns_link_update_prog,
 141         .fill_link_info = bpf_netns_link_fill_info,
 142         .show_fdinfo = bpf_netns_link_show_fdinfo,
 143 };
 144
 145 int netns_bpf_prog_query(const union bpf_attr *attr,
 146                          union bpf_attr __user *uattr)
 147 {
 148         __u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids);
 149         u32 prog_id, prog_cnt = 0, flags = 0;
 150         enum netns_bpf_attach_type type;
 151         struct bpf_prog *attached;
 152         struct net *net;
 153
 154         if (attr->query.query_flags)
 155                 return -EINVAL;
 156
 157         type = to_netns_bpf_attach_type(attr->query.attach_type);
 158         if (type < 0)
 159                 return -EINVAL;
 160
 161         net = get_net_ns_by_fd(attr->query.target_fd);
 162         if (IS_ERR(net))
 163                 return PTR_ERR(net);
 164
 165         rcu_read_lock();
 166         attached = rcu_dereference(net->bpf.progs[type]);
 167         if (attached) {
 168                 prog_cnt = 1;
 169                 prog_id = attached->aux->id;
 170         }
 171         rcu_read_unlock();
 172
 173         put_net(net);
 174
 175         if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags)))
 176                 return -EFAULT;
 177         if (copy_to_user(&uattr->query.prog_cnt, &prog_cnt, sizeof(prog_cnt)))
 178                 return -EFAULT;
 179
 180         if (!attr->query.prog_cnt || !prog_ids || !prog_cnt)
 181                 return 0;
 182
 183         if (copy_to_user(prog_ids, &prog_id, sizeof(u32)))
 184                 return -EFAULT;
 185
 186         return 0;
 187 }
 188
 189 int netns_bpf_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 190 {
 191         enum netns_bpf_attach_type type;
 192         struct net *net;
 193         int ret;
 194
 195         type = to_netns_bpf_attach_type(attr->attach_type);
 196         if (type < 0)
 197                 return -EINVAL;
 198
 199         net = current->nsproxy->net_ns;
 200         mutex_lock(&netns_bpf_mutex);
 201
 202         /* Attaching prog directly is not compatible with links */
 203         if (net->bpf.links[type]) {
 204                 ret = -EEXIST;
 205                 goto out_unlock;
 206         }
 207
 208         switch (type) {
 209         case NETNS_BPF_FLOW_DISSECTOR:
 210                 ret = flow_dissector_bpf_prog_attach(net, prog);
 211                 break;
 212         default:
 213                 ret = -EINVAL;
 214                 break;
 215         }
 216 out_unlock:
 217         mutex_unlock(&netns_bpf_mutex);
 218
 219         return ret;
 220 }
 221
 222 /* Must be called with netns_bpf_mutex held. */
 223 static int __netns_bpf_prog_detach(struct net *net,
 224                                    enum netns_bpf_attach_type type)
 225 {
 226         struct bpf_prog *attached;
 227
 228         /* Progs attached via links cannot be detached */
 229         if (net->bpf.links[type])
 230                 return -EINVAL;
 231
 232         attached = rcu_dereference_protected(net->bpf.progs[type],
 233                                              lockdep_is_held(&netns_bpf_mutex));
 234         if (!attached)
 235                 return -ENOENT;
 236         RCU_INIT_POINTER(net->bpf.progs[type], NULL);
 237         bpf_prog_put(attached);
 238         return 0;
 239 }
 240
 241 int netns_bpf_prog_detach(const union bpf_attr *attr)
 242 {
 243         enum netns_bpf_attach_type type;
 244         int ret;
 245
 246         type = to_netns_bpf_attach_type(attr->attach_type);
 247         if (type < 0)
 248                 return -EINVAL;
 249
 250         mutex_lock(&netns_bpf_mutex);
 251         ret = __netns_bpf_prog_detach(current->nsproxy->net_ns, type);
 252         mutex_unlock(&netns_bpf_mutex);
 253
 254         return ret;
 255 }
 256
 257 static int netns_bpf_link_attach(struct net *net, struct bpf_link *link,
 258                                  enum netns_bpf_attach_type type)
 259 {
 260         struct bpf_prog *prog;
 261         int err;
 262
 263         mutex_lock(&netns_bpf_mutex);
 264
 265         /* Allow attaching only one prog or link for now */
 266         if (net->bpf.links[type]) {
 267                 err = -E2BIG;
 268                 goto out_unlock;
 269         }
 270         /* Links are not compatible with attaching prog directly */
 271         prog = rcu_dereference_protected(net->bpf.progs[type],
 272                                          lockdep_is_held(&netns_bpf_mutex));
 273         if (prog) {
 274                 err = -EEXIST;
 275                 goto out_unlock;
 276         }
 277
 278         switch (type) {
 279         case NETNS_BPF_FLOW_DISSECTOR:
 280                 err = flow_dissector_bpf_prog_attach(net, link->prog);
 281                 break;
 282         default:
 283                 err = -EINVAL;
 284                 break;
 285         }
 286         if (err)
 287                 goto out_unlock;
 288
 289         net->bpf.links[type] = link;
 290
 291 out_unlock:
 292         mutex_unlock(&netns_bpf_mutex);
 293         return err;
 294 }
 295
 296 int netns_bpf_link_create(const union bpf_attr *attr, struct bpf_prog *prog)
 297 {
 298         enum netns_bpf_attach_type netns_type;
 299         struct bpf_link_primer link_primer;
 300         struct bpf_netns_link *net_link;
 301         enum bpf_attach_type type;
 302         struct net *net;
 303         int err;
 304
 305         if (attr->link_create.flags)
 306                 return -EINVAL;
 307
 308         type = attr->link_create.attach_type;
 309         netns_type = to_netns_bpf_attach_type(type);
 310         if (netns_type < 0)
 311                 return -EINVAL;
 312
 313         net = get_net_ns_by_fd(attr->link_create.target_fd);
 314         if (IS_ERR(net))
 315                 return PTR_ERR(net);
 316
 317         net_link = kzalloc(sizeof(*net_link), GFP_USER);
 318         if (!net_link) {
 319                 err = -ENOMEM;
 320                 goto out_put_net;
 321         }
 322         bpf_link_init(&net_link->link, BPF_LINK_TYPE_NETNS,
 323                       &bpf_netns_link_ops, prog);
 324         net_link->net = net;
 325         net_link->type = type;
 326         net_link->netns_type = netns_type;
 327
 328         err = bpf_link_prime(&net_link->link, &link_primer);
 329         if (err) {
 330                 kfree(net_link);
 331                 goto out_put_net;
 332         }
 333
 334         err = netns_bpf_link_attach(net, &net_link->link, netns_type);
 335         if (err) {
 336                 bpf_link_cleanup(&link_primer);
 337                 goto out_put_net;
 338         }
 339
 340         put_net(net);
 341         return bpf_link_settle(&link_primer);
 342
 343 out_put_net:
 344         put_net(net);
 345         return err;
 346 }
 347
 348 static void __net_exit netns_bpf_pernet_pre_exit(struct net *net)
 349 {
 350         enum netns_bpf_attach_type type;
 351         struct bpf_link *link;
 352
 353         mutex_lock(&netns_bpf_mutex);
 354         for (type = 0; type < MAX_NETNS_BPF_ATTACH_TYPE; type++) {
 355                 link = net->bpf.links[type];
 356                 if (link)
 357                         bpf_netns_link_auto_detach(link);
 358                 else
 359                         __netns_bpf_prog_detach(net, type);
 360         }
 361         mutex_unlock(&netns_bpf_mutex);
 362 }
 363
 364 static struct pernet_operations netns_bpf_pernet_ops __net_initdata = {
 365         .pre_exit = netns_bpf_pernet_pre_exit,
 366 };
 367
 368 static int __init netns_bpf_init(void)
 369 {
 370         return register_pernet_subsys(&netns_bpf_pernet_ops);
 371 }
 372
 373 subsys_initcall(netns_bpf_init);