xref: /linux/kernel/bpf/net_namespace.c (revision 9d19ca5d0e8b4a3f4b2eaa14e86a25f1c93ff35b)
1 // SPDX-License-Identifier: GPL-2.0
2 
3 #include <linux/bpf.h>
4 #include <linux/bpf-netns.h>
5 #include <linux/filter.h>
6 #include <net/net_namespace.h>
7 
8 /*
9  * Functions to manage BPF programs attached to netns
10  */
11 
12 struct bpf_netns_link {
13 	struct bpf_link	link;
14 
15 	/* We don't hold a ref to net in order to auto-detach the link
16 	 * when netns is going away. Instead we rely on pernet
17 	 * pre_exit callback to clear this pointer. Must be accessed
18 	 * with netns_bpf_mutex held.
19 	 */
20 	struct net *net;
21 	struct list_head node; /* node in list of links attached to net */
22 	enum netns_bpf_attach_type netns_type;
23 };
24 
25 /* Protects updates to netns_bpf */
26 DEFINE_MUTEX(netns_bpf_mutex);
27 
28 static void netns_bpf_attach_type_unneed(enum netns_bpf_attach_type type)
29 {
30 	switch (type) {
31 #ifdef CONFIG_INET
32 	case NETNS_BPF_SK_LOOKUP:
33 		static_branch_dec(&bpf_sk_lookup_enabled);
34 		break;
35 #endif
36 	default:
37 		break;
38 	}
39 }
40 
41 static void netns_bpf_attach_type_need(enum netns_bpf_attach_type type)
42 {
43 	switch (type) {
44 #ifdef CONFIG_INET
45 	case NETNS_BPF_SK_LOOKUP:
46 		static_branch_inc(&bpf_sk_lookup_enabled);
47 		break;
48 #endif
49 	default:
50 		break;
51 	}
52 }
53 
54 /* Must be called with netns_bpf_mutex held. */
55 static void netns_bpf_run_array_detach(struct net *net,
56 				       enum netns_bpf_attach_type type)
57 {
58 	struct bpf_prog_array *run_array;
59 
60 	run_array = rcu_replace_pointer(net->bpf.run_array[type], NULL,
61 					lockdep_is_held(&netns_bpf_mutex));
62 	bpf_prog_array_free(run_array);
63 }
64 
65 static int link_index(struct net *net, enum netns_bpf_attach_type type,
66 		      struct bpf_netns_link *link)
67 {
68 	struct bpf_netns_link *pos;
69 	int i = 0;
70 
71 	list_for_each_entry(pos, &net->bpf.links[type], node) {
72 		if (pos == link)
73 			return i;
74 		i++;
75 	}
76 	return -ENOENT;
77 }
78 
79 static int link_count(struct net *net, enum netns_bpf_attach_type type)
80 {
81 	struct list_head *pos;
82 	int i = 0;
83 
84 	list_for_each(pos, &net->bpf.links[type])
85 		i++;
86 	return i;
87 }
88 
89 static void fill_prog_array(struct net *net, enum netns_bpf_attach_type type,
90 			    struct bpf_prog_array *prog_array)
91 {
92 	struct bpf_netns_link *pos;
93 	unsigned int i = 0;
94 
95 	list_for_each_entry(pos, &net->bpf.links[type], node) {
96 		prog_array->items[i].prog = pos->link.prog;
97 		i++;
98 	}
99 }
100 
101 static void bpf_netns_link_release(struct bpf_link *link)
102 {
103 	struct bpf_netns_link *net_link =
104 		container_of(link, struct bpf_netns_link, link);
105 	enum netns_bpf_attach_type type = net_link->netns_type;
106 	struct bpf_prog_array *old_array, *new_array;
107 	struct net *net;
108 	int cnt, idx;
109 
110 	mutex_lock(&netns_bpf_mutex);
111 
112 	/* We can race with cleanup_net, but if we see a non-NULL
113 	 * struct net pointer, pre_exit has not run yet and wait for
114 	 * netns_bpf_mutex.
115 	 */
116 	net = net_link->net;
117 	if (!net)
118 		goto out_unlock;
119 
120 	/* Mark attach point as unused */
121 	netns_bpf_attach_type_unneed(type);
122 
123 	/* Remember link position in case of safe delete */
124 	idx = link_index(net, type, net_link);
125 	list_del(&net_link->node);
126 
127 	cnt = link_count(net, type);
128 	if (!cnt) {
129 		netns_bpf_run_array_detach(net, type);
130 		goto out_unlock;
131 	}
132 
133 	old_array = rcu_dereference_protected(net->bpf.run_array[type],
134 					      lockdep_is_held(&netns_bpf_mutex));
135 	new_array = bpf_prog_array_alloc(cnt, GFP_KERNEL);
136 	if (!new_array) {
137 		WARN_ON(bpf_prog_array_delete_safe_at(old_array, idx));
138 		goto out_unlock;
139 	}
140 	fill_prog_array(net, type, new_array);
141 	rcu_assign_pointer(net->bpf.run_array[type], new_array);
142 	bpf_prog_array_free(old_array);
143 
144 out_unlock:
145 	net_link->net = NULL;
146 	mutex_unlock(&netns_bpf_mutex);
147 }
148 
149 static int bpf_netns_link_detach(struct bpf_link *link)
150 {
151 	bpf_netns_link_release(link);
152 	return 0;
153 }
154 
155 static void bpf_netns_link_dealloc(struct bpf_link *link)
156 {
157 	struct bpf_netns_link *net_link =
158 		container_of(link, struct bpf_netns_link, link);
159 
160 	kfree(net_link);
161 }
162 
163 static int bpf_netns_link_update_prog(struct bpf_link *link,
164 				      struct bpf_prog *new_prog,
165 				      struct bpf_prog *old_prog)
166 {
167 	struct bpf_netns_link *net_link =
168 		container_of(link, struct bpf_netns_link, link);
169 	enum netns_bpf_attach_type type = net_link->netns_type;
170 	struct bpf_prog_array *run_array;
171 	struct net *net;
172 	int idx, ret;
173 
174 	guard(mutex)(&netns_bpf_mutex);
175 
176 	if (old_prog && old_prog != link->prog)
177 		return -EPERM;
178 	if (new_prog->type != link->prog->type)
179 		return -EINVAL;
180 
181 	net = net_link->net;
182 	if (!net || !check_net(net))
183 		/* Link auto-detached or netns dying */
184 		return -ENOLINK;
185 
186 	run_array = rcu_dereference_protected(net->bpf.run_array[type],
187 					      lockdep_is_held(&netns_bpf_mutex));
188 	idx = link_index(net, type, net_link);
189 	ret = bpf_prog_array_update_at(run_array, idx, new_prog);
190 	if (ret)
191 		return ret;
192 
193 	old_prog = xchg(&link->prog, new_prog);
194 	bpf_prog_put(old_prog);
195 	return 0;
196 }
197 
198 static int bpf_netns_link_fill_info(const struct bpf_link *link,
199 				    struct bpf_link_info *info)
200 {
201 	const struct bpf_netns_link *net_link =
202 		container_of(link, struct bpf_netns_link, link);
203 	unsigned int inum = 0;
204 	struct net *net;
205 
206 	mutex_lock(&netns_bpf_mutex);
207 	net = net_link->net;
208 	if (net && check_net(net))
209 		inum = net->ns.inum;
210 	mutex_unlock(&netns_bpf_mutex);
211 
212 	info->netns.netns_ino = inum;
213 	info->netns.attach_type = link->attach_type;
214 	return 0;
215 }
216 
217 static void bpf_netns_link_show_fdinfo(const struct bpf_link *link,
218 				       struct seq_file *seq)
219 {
220 	struct bpf_link_info info = {};
221 
222 	bpf_netns_link_fill_info(link, &info);
223 	seq_printf(seq,
224 		   "netns_ino:\t%u\n"
225 		   "attach_type:\t%u\n",
226 		   info.netns.netns_ino,
227 		   link->attach_type);
228 }
229 
230 static const struct bpf_link_ops bpf_netns_link_ops = {
231 	.release = bpf_netns_link_release,
232 	.dealloc = bpf_netns_link_dealloc,
233 	.detach = bpf_netns_link_detach,
234 	.update_prog = bpf_netns_link_update_prog,
235 	.fill_link_info = bpf_netns_link_fill_info,
236 	.show_fdinfo = bpf_netns_link_show_fdinfo,
237 };
238 
239 /* Must be called with netns_bpf_mutex held. */
240 static int __netns_bpf_prog_query(const union bpf_attr *attr,
241 				  union bpf_attr __user *uattr,
242 				  struct net *net,
243 				  enum netns_bpf_attach_type type)
244 {
245 	__u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids);
246 	struct bpf_prog_array *run_array;
247 	u32 prog_cnt = 0, flags = 0;
248 
249 	run_array = rcu_dereference_protected(net->bpf.run_array[type],
250 					      lockdep_is_held(&netns_bpf_mutex));
251 	if (run_array)
252 		prog_cnt = bpf_prog_array_length(run_array);
253 
254 	if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags)))
255 		return -EFAULT;
256 	if (copy_to_user(&uattr->query.prog_cnt, &prog_cnt, sizeof(prog_cnt)))
257 		return -EFAULT;
258 	if (!attr->query.prog_cnt || !prog_ids || !prog_cnt)
259 		return 0;
260 
261 	return bpf_prog_array_copy_to_user(run_array, prog_ids,
262 					   attr->query.prog_cnt);
263 }
264 
265 int netns_bpf_prog_query(const union bpf_attr *attr,
266 			 union bpf_attr __user *uattr)
267 {
268 	enum netns_bpf_attach_type type;
269 	struct net *net;
270 	int ret;
271 
272 	if (attr->query.query_flags)
273 		return -EINVAL;
274 
275 	type = to_netns_bpf_attach_type(attr->query.attach_type);
276 	if (type < 0)
277 		return -EINVAL;
278 
279 	net = get_net_ns_by_fd(attr->query.target_fd);
280 	if (IS_ERR(net))
281 		return PTR_ERR(net);
282 
283 	mutex_lock(&netns_bpf_mutex);
284 	ret = __netns_bpf_prog_query(attr, uattr, net, type);
285 	mutex_unlock(&netns_bpf_mutex);
286 
287 	put_net(net);
288 	return ret;
289 }
290 
291 int netns_bpf_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
292 {
293 	struct bpf_prog_array *run_array;
294 	enum netns_bpf_attach_type type;
295 	struct bpf_prog *attached;
296 	struct net *net;
297 	int ret;
298 
299 	if (attr->target_fd || attr->attach_flags || attr->replace_bpf_fd)
300 		return -EINVAL;
301 
302 	type = to_netns_bpf_attach_type(attr->attach_type);
303 	if (type < 0)
304 		return -EINVAL;
305 
306 	net = current->nsproxy->net_ns;
307 	mutex_lock(&netns_bpf_mutex);
308 
309 	/* Attaching prog directly is not compatible with links */
310 	if (!list_empty(&net->bpf.links[type])) {
311 		ret = -EEXIST;
312 		goto out_unlock;
313 	}
314 
315 	switch (type) {
316 	case NETNS_BPF_FLOW_DISSECTOR:
317 		ret = flow_dissector_bpf_prog_attach_check(net, prog);
318 		break;
319 	default:
320 		ret = -EINVAL;
321 		break;
322 	}
323 	if (ret)
324 		goto out_unlock;
325 
326 	attached = net->bpf.progs[type];
327 	if (attached == prog) {
328 		/* The same program cannot be attached twice */
329 		ret = -EINVAL;
330 		goto out_unlock;
331 	}
332 
333 	run_array = rcu_dereference_protected(net->bpf.run_array[type],
334 					      lockdep_is_held(&netns_bpf_mutex));
335 	if (run_array) {
336 		WRITE_ONCE(run_array->items[0].prog, prog);
337 	} else {
338 		run_array = bpf_prog_array_alloc(1, GFP_KERNEL);
339 		if (!run_array) {
340 			ret = -ENOMEM;
341 			goto out_unlock;
342 		}
343 		run_array->items[0].prog = prog;
344 		rcu_assign_pointer(net->bpf.run_array[type], run_array);
345 	}
346 
347 	net->bpf.progs[type] = prog;
348 	if (attached)
349 		bpf_prog_put(attached);
350 
351 out_unlock:
352 	mutex_unlock(&netns_bpf_mutex);
353 
354 	return ret;
355 }
356 
357 /* Must be called with netns_bpf_mutex held. */
358 static int __netns_bpf_prog_detach(struct net *net,
359 				   enum netns_bpf_attach_type type,
360 				   struct bpf_prog *old)
361 {
362 	struct bpf_prog *attached;
363 
364 	/* Progs attached via links cannot be detached */
365 	if (!list_empty(&net->bpf.links[type]))
366 		return -EINVAL;
367 
368 	attached = net->bpf.progs[type];
369 	if (!attached || attached != old)
370 		return -ENOENT;
371 	netns_bpf_run_array_detach(net, type);
372 	net->bpf.progs[type] = NULL;
373 	bpf_prog_put(attached);
374 	return 0;
375 }
376 
377 int netns_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype)
378 {
379 	enum netns_bpf_attach_type type;
380 	struct bpf_prog *prog;
381 	int ret;
382 
383 	if (attr->target_fd)
384 		return -EINVAL;
385 
386 	type = to_netns_bpf_attach_type(attr->attach_type);
387 	if (type < 0)
388 		return -EINVAL;
389 
390 	prog = bpf_prog_get_type(attr->attach_bpf_fd, ptype);
391 	if (IS_ERR(prog))
392 		return PTR_ERR(prog);
393 
394 	mutex_lock(&netns_bpf_mutex);
395 	ret = __netns_bpf_prog_detach(current->nsproxy->net_ns, type, prog);
396 	mutex_unlock(&netns_bpf_mutex);
397 
398 	bpf_prog_put(prog);
399 
400 	return ret;
401 }
402 
403 static int netns_bpf_max_progs(enum netns_bpf_attach_type type)
404 {
405 	switch (type) {
406 	case NETNS_BPF_FLOW_DISSECTOR:
407 		return 1;
408 	case NETNS_BPF_SK_LOOKUP:
409 		return 64;
410 	default:
411 		return 0;
412 	}
413 }
414 
415 static int netns_bpf_link_attach(struct net *net, struct bpf_link *link,
416 				 enum netns_bpf_attach_type type)
417 {
418 	struct bpf_netns_link *net_link =
419 		container_of(link, struct bpf_netns_link, link);
420 	struct bpf_prog_array *run_array;
421 	int cnt, err;
422 
423 	mutex_lock(&netns_bpf_mutex);
424 
425 	cnt = link_count(net, type);
426 	if (cnt >= netns_bpf_max_progs(type)) {
427 		err = -E2BIG;
428 		goto out_unlock;
429 	}
430 	/* Links are not compatible with attaching prog directly */
431 	if (net->bpf.progs[type]) {
432 		err = -EEXIST;
433 		goto out_unlock;
434 	}
435 
436 	switch (type) {
437 	case NETNS_BPF_FLOW_DISSECTOR:
438 		err = flow_dissector_bpf_prog_attach_check(net, link->prog);
439 		break;
440 	case NETNS_BPF_SK_LOOKUP:
441 		err = 0; /* nothing to check */
442 		break;
443 	default:
444 		err = -EINVAL;
445 		break;
446 	}
447 	if (err)
448 		goto out_unlock;
449 
450 	run_array = bpf_prog_array_alloc(cnt + 1, GFP_KERNEL);
451 	if (!run_array) {
452 		err = -ENOMEM;
453 		goto out_unlock;
454 	}
455 
456 	list_add_tail(&net_link->node, &net->bpf.links[type]);
457 
458 	fill_prog_array(net, type, run_array);
459 	run_array = rcu_replace_pointer(net->bpf.run_array[type], run_array,
460 					lockdep_is_held(&netns_bpf_mutex));
461 	bpf_prog_array_free(run_array);
462 
463 	/* Mark attach point as used */
464 	netns_bpf_attach_type_need(type);
465 
466 out_unlock:
467 	mutex_unlock(&netns_bpf_mutex);
468 	return err;
469 }
470 
471 int netns_bpf_link_create(const union bpf_attr *attr, struct bpf_prog *prog)
472 {
473 	enum netns_bpf_attach_type netns_type;
474 	struct bpf_link_primer link_primer;
475 	struct bpf_netns_link *net_link;
476 	enum bpf_attach_type type;
477 	struct net *net;
478 	int err;
479 
480 	if (attr->link_create.flags)
481 		return -EINVAL;
482 
483 	type = attr->link_create.attach_type;
484 	netns_type = to_netns_bpf_attach_type(type);
485 	if (netns_type < 0)
486 		return -EINVAL;
487 
488 	net = get_net_ns_by_fd(attr->link_create.target_fd);
489 	if (IS_ERR(net))
490 		return PTR_ERR(net);
491 
492 	net_link = kzalloc_obj(*net_link, GFP_USER);
493 	if (!net_link) {
494 		err = -ENOMEM;
495 		goto out_put_net;
496 	}
497 	bpf_link_init(&net_link->link, BPF_LINK_TYPE_NETNS,
498 		      &bpf_netns_link_ops, prog, type);
499 	net_link->net = net;
500 	net_link->netns_type = netns_type;
501 
502 	err = bpf_link_prime(&net_link->link, &link_primer);
503 	if (err) {
504 		kfree(net_link);
505 		goto out_put_net;
506 	}
507 
508 	err = netns_bpf_link_attach(net, &net_link->link, netns_type);
509 	if (err) {
510 		bpf_link_cleanup(&link_primer);
511 		goto out_put_net;
512 	}
513 
514 	put_net(net);
515 	return bpf_link_settle(&link_primer);
516 
517 out_put_net:
518 	put_net(net);
519 	return err;
520 }
521 
522 static int __net_init netns_bpf_pernet_init(struct net *net)
523 {
524 	int type;
525 
526 	for (type = 0; type < MAX_NETNS_BPF_ATTACH_TYPE; type++)
527 		INIT_LIST_HEAD(&net->bpf.links[type]);
528 
529 	return 0;
530 }
531 
532 static void __net_exit netns_bpf_pernet_pre_exit(struct net *net)
533 {
534 	enum netns_bpf_attach_type type;
535 	struct bpf_netns_link *net_link;
536 
537 	mutex_lock(&netns_bpf_mutex);
538 	for (type = 0; type < MAX_NETNS_BPF_ATTACH_TYPE; type++) {
539 		netns_bpf_run_array_detach(net, type);
540 		list_for_each_entry(net_link, &net->bpf.links[type], node) {
541 			net_link->net = NULL; /* auto-detach link */
542 			netns_bpf_attach_type_unneed(type);
543 		}
544 		if (net->bpf.progs[type])
545 			bpf_prog_put(net->bpf.progs[type]);
546 	}
547 	mutex_unlock(&netns_bpf_mutex);
548 }
549 
550 static struct pernet_operations netns_bpf_pernet_ops __net_initdata = {
551 	.init = netns_bpf_pernet_init,
552 	.pre_exit = netns_bpf_pernet_pre_exit,
553 };
554 
555 static int __init netns_bpf_init(void)
556 {
557 	return register_pernet_subsys(&netns_bpf_pernet_ops);
558 }
559 
560 subsys_initcall(netns_bpf_init);
561