1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/bpf.h> 4 #include <linux/bpf-netns.h> 5 #include <linux/filter.h> 6 #include <net/net_namespace.h> 7 8 /* 9 * Functions to manage BPF programs attached to netns 10 */ 11 12 struct bpf_netns_link { 13 struct bpf_link link; 14 15 /* We don't hold a ref to net in order to auto-detach the link 16 * when netns is going away. Instead we rely on pernet 17 * pre_exit callback to clear this pointer. Must be accessed 18 * with netns_bpf_mutex held. 19 */ 20 struct net *net; 21 struct list_head node; /* node in list of links attached to net */ 22 enum netns_bpf_attach_type netns_type; 23 }; 24 25 /* Protects updates to netns_bpf */ 26 DEFINE_MUTEX(netns_bpf_mutex); 27 28 static void netns_bpf_attach_type_unneed(enum netns_bpf_attach_type type) 29 { 30 switch (type) { 31 #ifdef CONFIG_INET 32 case NETNS_BPF_SK_LOOKUP: 33 static_branch_dec(&bpf_sk_lookup_enabled); 34 break; 35 #endif 36 default: 37 break; 38 } 39 } 40 41 static void netns_bpf_attach_type_need(enum netns_bpf_attach_type type) 42 { 43 switch (type) { 44 #ifdef CONFIG_INET 45 case NETNS_BPF_SK_LOOKUP: 46 static_branch_inc(&bpf_sk_lookup_enabled); 47 break; 48 #endif 49 default: 50 break; 51 } 52 } 53 54 /* Must be called with netns_bpf_mutex held. */ 55 static void netns_bpf_run_array_detach(struct net *net, 56 enum netns_bpf_attach_type type) 57 { 58 struct bpf_prog_array *run_array; 59 60 run_array = rcu_replace_pointer(net->bpf.run_array[type], NULL, 61 lockdep_is_held(&netns_bpf_mutex)); 62 bpf_prog_array_free(run_array); 63 } 64 65 static int link_index(struct net *net, enum netns_bpf_attach_type type, 66 struct bpf_netns_link *link) 67 { 68 struct bpf_netns_link *pos; 69 int i = 0; 70 71 list_for_each_entry(pos, &net->bpf.links[type], node) { 72 if (pos == link) 73 return i; 74 i++; 75 } 76 return -ENOENT; 77 } 78 79 static int link_count(struct net *net, enum netns_bpf_attach_type type) 80 { 81 struct list_head *pos; 82 int i = 0; 83 84 list_for_each(pos, &net->bpf.links[type]) 85 i++; 86 return i; 87 } 88 89 static void fill_prog_array(struct net *net, enum netns_bpf_attach_type type, 90 struct bpf_prog_array *prog_array) 91 { 92 struct bpf_netns_link *pos; 93 unsigned int i = 0; 94 95 list_for_each_entry(pos, &net->bpf.links[type], node) { 96 prog_array->items[i].prog = pos->link.prog; 97 i++; 98 } 99 } 100 101 static void bpf_netns_link_release(struct bpf_link *link) 102 { 103 struct bpf_netns_link *net_link = 104 container_of(link, struct bpf_netns_link, link); 105 enum netns_bpf_attach_type type = net_link->netns_type; 106 struct bpf_prog_array *old_array, *new_array; 107 struct net *net; 108 int cnt, idx; 109 110 mutex_lock(&netns_bpf_mutex); 111 112 /* We can race with cleanup_net, but if we see a non-NULL 113 * struct net pointer, pre_exit has not run yet and wait for 114 * netns_bpf_mutex. 115 */ 116 net = net_link->net; 117 if (!net) 118 goto out_unlock; 119 120 /* Mark attach point as unused */ 121 netns_bpf_attach_type_unneed(type); 122 123 /* Remember link position in case of safe delete */ 124 idx = link_index(net, type, net_link); 125 list_del(&net_link->node); 126 127 cnt = link_count(net, type); 128 if (!cnt) { 129 netns_bpf_run_array_detach(net, type); 130 goto out_unlock; 131 } 132 133 old_array = rcu_dereference_protected(net->bpf.run_array[type], 134 lockdep_is_held(&netns_bpf_mutex)); 135 new_array = bpf_prog_array_alloc(cnt, GFP_KERNEL); 136 if (!new_array) { 137 WARN_ON(bpf_prog_array_delete_safe_at(old_array, idx)); 138 goto out_unlock; 139 } 140 fill_prog_array(net, type, new_array); 141 rcu_assign_pointer(net->bpf.run_array[type], new_array); 142 bpf_prog_array_free(old_array); 143 144 out_unlock: 145 net_link->net = NULL; 146 mutex_unlock(&netns_bpf_mutex); 147 } 148 149 static int bpf_netns_link_detach(struct bpf_link *link) 150 { 151 bpf_netns_link_release(link); 152 return 0; 153 } 154 155 static void bpf_netns_link_dealloc(struct bpf_link *link) 156 { 157 struct bpf_netns_link *net_link = 158 container_of(link, struct bpf_netns_link, link); 159 160 kfree(net_link); 161 } 162 163 static int bpf_netns_link_update_prog(struct bpf_link *link, 164 struct bpf_prog *new_prog, 165 struct bpf_prog *old_prog) 166 { 167 struct bpf_netns_link *net_link = 168 container_of(link, struct bpf_netns_link, link); 169 enum netns_bpf_attach_type type = net_link->netns_type; 170 struct bpf_prog_array *run_array; 171 struct net *net; 172 int idx, ret; 173 174 guard(mutex)(&netns_bpf_mutex); 175 176 if (old_prog && old_prog != link->prog) 177 return -EPERM; 178 if (new_prog->type != link->prog->type) 179 return -EINVAL; 180 181 net = net_link->net; 182 if (!net || !check_net(net)) 183 /* Link auto-detached or netns dying */ 184 return -ENOLINK; 185 186 run_array = rcu_dereference_protected(net->bpf.run_array[type], 187 lockdep_is_held(&netns_bpf_mutex)); 188 idx = link_index(net, type, net_link); 189 ret = bpf_prog_array_update_at(run_array, idx, new_prog); 190 if (ret) 191 return ret; 192 193 old_prog = xchg(&link->prog, new_prog); 194 bpf_prog_put(old_prog); 195 return 0; 196 } 197 198 static int bpf_netns_link_fill_info(const struct bpf_link *link, 199 struct bpf_link_info *info) 200 { 201 const struct bpf_netns_link *net_link = 202 container_of(link, struct bpf_netns_link, link); 203 unsigned int inum = 0; 204 struct net *net; 205 206 mutex_lock(&netns_bpf_mutex); 207 net = net_link->net; 208 if (net && check_net(net)) 209 inum = net->ns.inum; 210 mutex_unlock(&netns_bpf_mutex); 211 212 info->netns.netns_ino = inum; 213 info->netns.attach_type = link->attach_type; 214 return 0; 215 } 216 217 static void bpf_netns_link_show_fdinfo(const struct bpf_link *link, 218 struct seq_file *seq) 219 { 220 struct bpf_link_info info = {}; 221 222 bpf_netns_link_fill_info(link, &info); 223 seq_printf(seq, 224 "netns_ino:\t%u\n" 225 "attach_type:\t%u\n", 226 info.netns.netns_ino, 227 link->attach_type); 228 } 229 230 static const struct bpf_link_ops bpf_netns_link_ops = { 231 .release = bpf_netns_link_release, 232 .dealloc = bpf_netns_link_dealloc, 233 .detach = bpf_netns_link_detach, 234 .update_prog = bpf_netns_link_update_prog, 235 .fill_link_info = bpf_netns_link_fill_info, 236 .show_fdinfo = bpf_netns_link_show_fdinfo, 237 }; 238 239 /* Must be called with netns_bpf_mutex held. */ 240 static int __netns_bpf_prog_query(const union bpf_attr *attr, 241 union bpf_attr __user *uattr, 242 struct net *net, 243 enum netns_bpf_attach_type type) 244 { 245 __u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids); 246 struct bpf_prog_array *run_array; 247 u32 prog_cnt = 0, flags = 0; 248 249 run_array = rcu_dereference_protected(net->bpf.run_array[type], 250 lockdep_is_held(&netns_bpf_mutex)); 251 if (run_array) 252 prog_cnt = bpf_prog_array_length(run_array); 253 254 if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags))) 255 return -EFAULT; 256 if (copy_to_user(&uattr->query.prog_cnt, &prog_cnt, sizeof(prog_cnt))) 257 return -EFAULT; 258 if (!attr->query.prog_cnt || !prog_ids || !prog_cnt) 259 return 0; 260 261 return bpf_prog_array_copy_to_user(run_array, prog_ids, 262 attr->query.prog_cnt); 263 } 264 265 int netns_bpf_prog_query(const union bpf_attr *attr, 266 union bpf_attr __user *uattr) 267 { 268 enum netns_bpf_attach_type type; 269 struct net *net; 270 int ret; 271 272 if (attr->query.query_flags) 273 return -EINVAL; 274 275 type = to_netns_bpf_attach_type(attr->query.attach_type); 276 if (type < 0) 277 return -EINVAL; 278 279 net = get_net_ns_by_fd(attr->query.target_fd); 280 if (IS_ERR(net)) 281 return PTR_ERR(net); 282 283 mutex_lock(&netns_bpf_mutex); 284 ret = __netns_bpf_prog_query(attr, uattr, net, type); 285 mutex_unlock(&netns_bpf_mutex); 286 287 put_net(net); 288 return ret; 289 } 290 291 int netns_bpf_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog) 292 { 293 struct bpf_prog_array *run_array; 294 enum netns_bpf_attach_type type; 295 struct bpf_prog *attached; 296 struct net *net; 297 int ret; 298 299 if (attr->target_fd || attr->attach_flags || attr->replace_bpf_fd) 300 return -EINVAL; 301 302 type = to_netns_bpf_attach_type(attr->attach_type); 303 if (type < 0) 304 return -EINVAL; 305 306 net = current->nsproxy->net_ns; 307 mutex_lock(&netns_bpf_mutex); 308 309 /* Attaching prog directly is not compatible with links */ 310 if (!list_empty(&net->bpf.links[type])) { 311 ret = -EEXIST; 312 goto out_unlock; 313 } 314 315 switch (type) { 316 case NETNS_BPF_FLOW_DISSECTOR: 317 ret = flow_dissector_bpf_prog_attach_check(net, prog); 318 break; 319 default: 320 ret = -EINVAL; 321 break; 322 } 323 if (ret) 324 goto out_unlock; 325 326 attached = net->bpf.progs[type]; 327 if (attached == prog) { 328 /* The same program cannot be attached twice */ 329 ret = -EINVAL; 330 goto out_unlock; 331 } 332 333 run_array = rcu_dereference_protected(net->bpf.run_array[type], 334 lockdep_is_held(&netns_bpf_mutex)); 335 if (run_array) { 336 WRITE_ONCE(run_array->items[0].prog, prog); 337 } else { 338 run_array = bpf_prog_array_alloc(1, GFP_KERNEL); 339 if (!run_array) { 340 ret = -ENOMEM; 341 goto out_unlock; 342 } 343 run_array->items[0].prog = prog; 344 rcu_assign_pointer(net->bpf.run_array[type], run_array); 345 } 346 347 net->bpf.progs[type] = prog; 348 if (attached) 349 bpf_prog_put(attached); 350 351 out_unlock: 352 mutex_unlock(&netns_bpf_mutex); 353 354 return ret; 355 } 356 357 /* Must be called with netns_bpf_mutex held. */ 358 static int __netns_bpf_prog_detach(struct net *net, 359 enum netns_bpf_attach_type type, 360 struct bpf_prog *old) 361 { 362 struct bpf_prog *attached; 363 364 /* Progs attached via links cannot be detached */ 365 if (!list_empty(&net->bpf.links[type])) 366 return -EINVAL; 367 368 attached = net->bpf.progs[type]; 369 if (!attached || attached != old) 370 return -ENOENT; 371 netns_bpf_run_array_detach(net, type); 372 net->bpf.progs[type] = NULL; 373 bpf_prog_put(attached); 374 return 0; 375 } 376 377 int netns_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype) 378 { 379 enum netns_bpf_attach_type type; 380 struct bpf_prog *prog; 381 int ret; 382 383 if (attr->target_fd) 384 return -EINVAL; 385 386 type = to_netns_bpf_attach_type(attr->attach_type); 387 if (type < 0) 388 return -EINVAL; 389 390 prog = bpf_prog_get_type(attr->attach_bpf_fd, ptype); 391 if (IS_ERR(prog)) 392 return PTR_ERR(prog); 393 394 mutex_lock(&netns_bpf_mutex); 395 ret = __netns_bpf_prog_detach(current->nsproxy->net_ns, type, prog); 396 mutex_unlock(&netns_bpf_mutex); 397 398 bpf_prog_put(prog); 399 400 return ret; 401 } 402 403 static int netns_bpf_max_progs(enum netns_bpf_attach_type type) 404 { 405 switch (type) { 406 case NETNS_BPF_FLOW_DISSECTOR: 407 return 1; 408 case NETNS_BPF_SK_LOOKUP: 409 return 64; 410 default: 411 return 0; 412 } 413 } 414 415 static int netns_bpf_link_attach(struct net *net, struct bpf_link *link, 416 enum netns_bpf_attach_type type) 417 { 418 struct bpf_netns_link *net_link = 419 container_of(link, struct bpf_netns_link, link); 420 struct bpf_prog_array *run_array; 421 int cnt, err; 422 423 mutex_lock(&netns_bpf_mutex); 424 425 cnt = link_count(net, type); 426 if (cnt >= netns_bpf_max_progs(type)) { 427 err = -E2BIG; 428 goto out_unlock; 429 } 430 /* Links are not compatible with attaching prog directly */ 431 if (net->bpf.progs[type]) { 432 err = -EEXIST; 433 goto out_unlock; 434 } 435 436 switch (type) { 437 case NETNS_BPF_FLOW_DISSECTOR: 438 err = flow_dissector_bpf_prog_attach_check(net, link->prog); 439 break; 440 case NETNS_BPF_SK_LOOKUP: 441 err = 0; /* nothing to check */ 442 break; 443 default: 444 err = -EINVAL; 445 break; 446 } 447 if (err) 448 goto out_unlock; 449 450 run_array = bpf_prog_array_alloc(cnt + 1, GFP_KERNEL); 451 if (!run_array) { 452 err = -ENOMEM; 453 goto out_unlock; 454 } 455 456 list_add_tail(&net_link->node, &net->bpf.links[type]); 457 458 fill_prog_array(net, type, run_array); 459 run_array = rcu_replace_pointer(net->bpf.run_array[type], run_array, 460 lockdep_is_held(&netns_bpf_mutex)); 461 bpf_prog_array_free(run_array); 462 463 /* Mark attach point as used */ 464 netns_bpf_attach_type_need(type); 465 466 out_unlock: 467 mutex_unlock(&netns_bpf_mutex); 468 return err; 469 } 470 471 int netns_bpf_link_create(const union bpf_attr *attr, struct bpf_prog *prog) 472 { 473 enum netns_bpf_attach_type netns_type; 474 struct bpf_link_primer link_primer; 475 struct bpf_netns_link *net_link; 476 enum bpf_attach_type type; 477 struct net *net; 478 int err; 479 480 if (attr->link_create.flags) 481 return -EINVAL; 482 483 type = attr->link_create.attach_type; 484 netns_type = to_netns_bpf_attach_type(type); 485 if (netns_type < 0) 486 return -EINVAL; 487 488 net = get_net_ns_by_fd(attr->link_create.target_fd); 489 if (IS_ERR(net)) 490 return PTR_ERR(net); 491 492 net_link = kzalloc_obj(*net_link, GFP_USER); 493 if (!net_link) { 494 err = -ENOMEM; 495 goto out_put_net; 496 } 497 bpf_link_init(&net_link->link, BPF_LINK_TYPE_NETNS, 498 &bpf_netns_link_ops, prog, type); 499 net_link->net = net; 500 net_link->netns_type = netns_type; 501 502 err = bpf_link_prime(&net_link->link, &link_primer); 503 if (err) { 504 kfree(net_link); 505 goto out_put_net; 506 } 507 508 err = netns_bpf_link_attach(net, &net_link->link, netns_type); 509 if (err) { 510 bpf_link_cleanup(&link_primer); 511 goto out_put_net; 512 } 513 514 put_net(net); 515 return bpf_link_settle(&link_primer); 516 517 out_put_net: 518 put_net(net); 519 return err; 520 } 521 522 static int __net_init netns_bpf_pernet_init(struct net *net) 523 { 524 int type; 525 526 for (type = 0; type < MAX_NETNS_BPF_ATTACH_TYPE; type++) 527 INIT_LIST_HEAD(&net->bpf.links[type]); 528 529 return 0; 530 } 531 532 static void __net_exit netns_bpf_pernet_pre_exit(struct net *net) 533 { 534 enum netns_bpf_attach_type type; 535 struct bpf_netns_link *net_link; 536 537 mutex_lock(&netns_bpf_mutex); 538 for (type = 0; type < MAX_NETNS_BPF_ATTACH_TYPE; type++) { 539 netns_bpf_run_array_detach(net, type); 540 list_for_each_entry(net_link, &net->bpf.links[type], node) { 541 net_link->net = NULL; /* auto-detach link */ 542 netns_bpf_attach_type_unneed(type); 543 } 544 if (net->bpf.progs[type]) 545 bpf_prog_put(net->bpf.progs[type]); 546 } 547 mutex_unlock(&netns_bpf_mutex); 548 } 549 550 static struct pernet_operations netns_bpf_pernet_ops __net_initdata = { 551 .init = netns_bpf_pernet_init, 552 .pre_exit = netns_bpf_pernet_pre_exit, 553 }; 554 555 static int __init netns_bpf_init(void) 556 { 557 return register_pernet_subsys(&netns_bpf_pernet_ops); 558 } 559 560 subsys_initcall(netns_bpf_init); 561