1 // SPDX-License-Identifier: GPL-2.0 2 /* -*- linux-c -*- 3 * sysctl_net_core.c: sysctl interface to net core subsystem. 4 * 5 * Begun April 1, 1996, Mike Shaver. 6 * Added /proc/sys/net/core directory entry (empty =) ). [MS] 7 */ 8 9 #include <linux/mm.h> 10 #include <linux/sysctl.h> 11 #include <linux/module.h> 12 #include <linux/socket.h> 13 #include <linux/netdevice.h> 14 #include <linux/ratelimit.h> 15 #include <linux/vmalloc.h> 16 #include <linux/init.h> 17 #include <linux/slab.h> 18 19 #include <net/ip.h> 20 #include <net/sock.h> 21 #include <net/net_ratelimit.h> 22 #include <net/busy_poll.h> 23 #include <net/pkt_sched.h> 24 25 static int two = 2; 26 static int three = 3; 27 static int min_sndbuf = SOCK_MIN_SNDBUF; 28 static int min_rcvbuf = SOCK_MIN_RCVBUF; 29 static int max_skb_frags = MAX_SKB_FRAGS; 30 static long long_one __maybe_unused = 1; 31 static long long_max __maybe_unused = LONG_MAX; 32 33 static int net_msg_warn; /* Unused, but still a sysctl */ 34 35 int sysctl_fb_tunnels_only_for_init_net __read_mostly = 0; 36 EXPORT_SYMBOL(sysctl_fb_tunnels_only_for_init_net); 37 38 /* 0 - Keep current behavior: 39 * IPv4: inherit all current settings from init_net 40 * IPv6: reset all settings to default 41 * 1 - Both inherit all current settings from init_net 42 * 2 - Both reset all settings to default 43 * 3 - Both inherit all settings from current netns 44 */ 45 int sysctl_devconf_inherit_init_net __read_mostly; 46 EXPORT_SYMBOL(sysctl_devconf_inherit_init_net); 47 48 #ifdef CONFIG_RPS 49 static int rps_sock_flow_sysctl(struct ctl_table *table, int write, 50 void *buffer, size_t *lenp, loff_t *ppos) 51 { 52 unsigned int orig_size, size; 53 int ret, i; 54 struct ctl_table tmp = { 55 .data = &size, 56 .maxlen = sizeof(size), 57 .mode = table->mode 58 }; 59 struct rps_sock_flow_table *orig_sock_table, *sock_table; 60 static DEFINE_MUTEX(sock_flow_mutex); 61 62 mutex_lock(&sock_flow_mutex); 63 64 orig_sock_table = rcu_dereference_protected(rps_sock_flow_table, 65 lockdep_is_held(&sock_flow_mutex)); 66 size = orig_size = orig_sock_table ? orig_sock_table->mask + 1 : 0; 67 68 ret = proc_dointvec(&tmp, write, buffer, lenp, ppos); 69 70 if (write) { 71 if (size) { 72 if (size > 1<<29) { 73 /* Enforce limit to prevent overflow */ 74 mutex_unlock(&sock_flow_mutex); 75 return -EINVAL; 76 } 77 size = roundup_pow_of_two(size); 78 if (size != orig_size) { 79 sock_table = 80 vmalloc(RPS_SOCK_FLOW_TABLE_SIZE(size)); 81 if (!sock_table) { 82 mutex_unlock(&sock_flow_mutex); 83 return -ENOMEM; 84 } 85 rps_cpu_mask = roundup_pow_of_two(nr_cpu_ids) - 1; 86 sock_table->mask = size - 1; 87 } else 88 sock_table = orig_sock_table; 89 90 for (i = 0; i < size; i++) 91 sock_table->ents[i] = RPS_NO_CPU; 92 } else 93 sock_table = NULL; 94 95 if (sock_table != orig_sock_table) { 96 rcu_assign_pointer(rps_sock_flow_table, sock_table); 97 if (sock_table) { 98 static_branch_inc(&rps_needed); 99 static_branch_inc(&rfs_needed); 100 } 101 if (orig_sock_table) { 102 static_branch_dec(&rps_needed); 103 static_branch_dec(&rfs_needed); 104 synchronize_rcu(); 105 vfree(orig_sock_table); 106 } 107 } 108 } 109 110 mutex_unlock(&sock_flow_mutex); 111 112 return ret; 113 } 114 #endif /* CONFIG_RPS */ 115 116 #ifdef CONFIG_NET_FLOW_LIMIT 117 static DEFINE_MUTEX(flow_limit_update_mutex); 118 119 static int flow_limit_cpu_sysctl(struct ctl_table *table, int write, 120 void *buffer, size_t *lenp, loff_t *ppos) 121 { 122 struct sd_flow_limit *cur; 123 struct softnet_data *sd; 124 cpumask_var_t mask; 125 int i, len, ret = 0; 126 127 if (!alloc_cpumask_var(&mask, GFP_KERNEL)) 128 return -ENOMEM; 129 130 if (write) { 131 ret = cpumask_parse(buffer, mask); 132 if (ret) 133 goto done; 134 135 mutex_lock(&flow_limit_update_mutex); 136 len = sizeof(*cur) + netdev_flow_limit_table_len; 137 for_each_possible_cpu(i) { 138 sd = &per_cpu(softnet_data, i); 139 cur = rcu_dereference_protected(sd->flow_limit, 140 lockdep_is_held(&flow_limit_update_mutex)); 141 if (cur && !cpumask_test_cpu(i, mask)) { 142 RCU_INIT_POINTER(sd->flow_limit, NULL); 143 synchronize_rcu(); 144 kfree(cur); 145 } else if (!cur && cpumask_test_cpu(i, mask)) { 146 cur = kzalloc_node(len, GFP_KERNEL, 147 cpu_to_node(i)); 148 if (!cur) { 149 /* not unwinding previous changes */ 150 ret = -ENOMEM; 151 goto write_unlock; 152 } 153 cur->num_buckets = netdev_flow_limit_table_len; 154 rcu_assign_pointer(sd->flow_limit, cur); 155 } 156 } 157 write_unlock: 158 mutex_unlock(&flow_limit_update_mutex); 159 } else { 160 char kbuf[128]; 161 162 if (*ppos || !*lenp) { 163 *lenp = 0; 164 goto done; 165 } 166 167 cpumask_clear(mask); 168 rcu_read_lock(); 169 for_each_possible_cpu(i) { 170 sd = &per_cpu(softnet_data, i); 171 if (rcu_dereference(sd->flow_limit)) 172 cpumask_set_cpu(i, mask); 173 } 174 rcu_read_unlock(); 175 176 len = min(sizeof(kbuf) - 1, *lenp); 177 len = scnprintf(kbuf, len, "%*pb", cpumask_pr_args(mask)); 178 if (!len) { 179 *lenp = 0; 180 goto done; 181 } 182 if (len < *lenp) 183 kbuf[len++] = '\n'; 184 memcpy(buffer, kbuf, len); 185 *lenp = len; 186 *ppos += len; 187 } 188 189 done: 190 free_cpumask_var(mask); 191 return ret; 192 } 193 194 static int flow_limit_table_len_sysctl(struct ctl_table *table, int write, 195 void *buffer, size_t *lenp, loff_t *ppos) 196 { 197 unsigned int old, *ptr; 198 int ret; 199 200 mutex_lock(&flow_limit_update_mutex); 201 202 ptr = table->data; 203 old = *ptr; 204 ret = proc_dointvec(table, write, buffer, lenp, ppos); 205 if (!ret && write && !is_power_of_2(*ptr)) { 206 *ptr = old; 207 ret = -EINVAL; 208 } 209 210 mutex_unlock(&flow_limit_update_mutex); 211 return ret; 212 } 213 #endif /* CONFIG_NET_FLOW_LIMIT */ 214 215 #ifdef CONFIG_NET_SCHED 216 static int set_default_qdisc(struct ctl_table *table, int write, 217 void *buffer, size_t *lenp, loff_t *ppos) 218 { 219 char id[IFNAMSIZ]; 220 struct ctl_table tbl = { 221 .data = id, 222 .maxlen = IFNAMSIZ, 223 }; 224 int ret; 225 226 qdisc_get_default(id, IFNAMSIZ); 227 228 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 229 if (write && ret == 0) 230 ret = qdisc_set_default(id); 231 return ret; 232 } 233 #endif 234 235 static int proc_do_dev_weight(struct ctl_table *table, int write, 236 void *buffer, size_t *lenp, loff_t *ppos) 237 { 238 int ret; 239 240 ret = proc_dointvec(table, write, buffer, lenp, ppos); 241 if (ret != 0) 242 return ret; 243 244 dev_rx_weight = weight_p * dev_weight_rx_bias; 245 dev_tx_weight = weight_p * dev_weight_tx_bias; 246 247 return ret; 248 } 249 250 static int proc_do_rss_key(struct ctl_table *table, int write, 251 void *buffer, size_t *lenp, loff_t *ppos) 252 { 253 struct ctl_table fake_table; 254 char buf[NETDEV_RSS_KEY_LEN * 3]; 255 256 snprintf(buf, sizeof(buf), "%*phC", NETDEV_RSS_KEY_LEN, netdev_rss_key); 257 fake_table.data = buf; 258 fake_table.maxlen = sizeof(buf); 259 return proc_dostring(&fake_table, write, buffer, lenp, ppos); 260 } 261 262 #ifdef CONFIG_BPF_JIT 263 static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write, 264 void *buffer, size_t *lenp, 265 loff_t *ppos) 266 { 267 int ret, jit_enable = *(int *)table->data; 268 struct ctl_table tmp = *table; 269 270 if (write && !capable(CAP_SYS_ADMIN)) 271 return -EPERM; 272 273 tmp.data = &jit_enable; 274 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 275 if (write && !ret) { 276 if (jit_enable < 2 || 277 (jit_enable == 2 && bpf_dump_raw_ok(current_cred()))) { 278 *(int *)table->data = jit_enable; 279 if (jit_enable == 2) 280 pr_warn("bpf_jit_enable = 2 was set! NEVER use this in production, only for JIT debugging!\n"); 281 } else { 282 ret = -EPERM; 283 } 284 } 285 return ret; 286 } 287 288 # ifdef CONFIG_HAVE_EBPF_JIT 289 static int 290 proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write, 291 void *buffer, size_t *lenp, loff_t *ppos) 292 { 293 if (!capable(CAP_SYS_ADMIN)) 294 return -EPERM; 295 296 return proc_dointvec_minmax(table, write, buffer, lenp, ppos); 297 } 298 # endif /* CONFIG_HAVE_EBPF_JIT */ 299 300 static int 301 proc_dolongvec_minmax_bpf_restricted(struct ctl_table *table, int write, 302 void *buffer, size_t *lenp, loff_t *ppos) 303 { 304 if (!capable(CAP_SYS_ADMIN)) 305 return -EPERM; 306 307 return proc_doulongvec_minmax(table, write, buffer, lenp, ppos); 308 } 309 #endif 310 311 static struct ctl_table net_core_table[] = { 312 { 313 .procname = "wmem_max", 314 .data = &sysctl_wmem_max, 315 .maxlen = sizeof(int), 316 .mode = 0644, 317 .proc_handler = proc_dointvec_minmax, 318 .extra1 = &min_sndbuf, 319 }, 320 { 321 .procname = "rmem_max", 322 .data = &sysctl_rmem_max, 323 .maxlen = sizeof(int), 324 .mode = 0644, 325 .proc_handler = proc_dointvec_minmax, 326 .extra1 = &min_rcvbuf, 327 }, 328 { 329 .procname = "wmem_default", 330 .data = &sysctl_wmem_default, 331 .maxlen = sizeof(int), 332 .mode = 0644, 333 .proc_handler = proc_dointvec_minmax, 334 .extra1 = &min_sndbuf, 335 }, 336 { 337 .procname = "rmem_default", 338 .data = &sysctl_rmem_default, 339 .maxlen = sizeof(int), 340 .mode = 0644, 341 .proc_handler = proc_dointvec_minmax, 342 .extra1 = &min_rcvbuf, 343 }, 344 { 345 .procname = "dev_weight", 346 .data = &weight_p, 347 .maxlen = sizeof(int), 348 .mode = 0644, 349 .proc_handler = proc_do_dev_weight, 350 }, 351 { 352 .procname = "dev_weight_rx_bias", 353 .data = &dev_weight_rx_bias, 354 .maxlen = sizeof(int), 355 .mode = 0644, 356 .proc_handler = proc_do_dev_weight, 357 }, 358 { 359 .procname = "dev_weight_tx_bias", 360 .data = &dev_weight_tx_bias, 361 .maxlen = sizeof(int), 362 .mode = 0644, 363 .proc_handler = proc_do_dev_weight, 364 }, 365 { 366 .procname = "netdev_max_backlog", 367 .data = &netdev_max_backlog, 368 .maxlen = sizeof(int), 369 .mode = 0644, 370 .proc_handler = proc_dointvec 371 }, 372 { 373 .procname = "netdev_rss_key", 374 .data = &netdev_rss_key, 375 .maxlen = sizeof(int), 376 .mode = 0444, 377 .proc_handler = proc_do_rss_key, 378 }, 379 #ifdef CONFIG_BPF_JIT 380 { 381 .procname = "bpf_jit_enable", 382 .data = &bpf_jit_enable, 383 .maxlen = sizeof(int), 384 .mode = 0644, 385 .proc_handler = proc_dointvec_minmax_bpf_enable, 386 # ifdef CONFIG_BPF_JIT_ALWAYS_ON 387 .extra1 = SYSCTL_ONE, 388 .extra2 = SYSCTL_ONE, 389 # else 390 .extra1 = SYSCTL_ZERO, 391 .extra2 = &two, 392 # endif 393 }, 394 # ifdef CONFIG_HAVE_EBPF_JIT 395 { 396 .procname = "bpf_jit_harden", 397 .data = &bpf_jit_harden, 398 .maxlen = sizeof(int), 399 .mode = 0600, 400 .proc_handler = proc_dointvec_minmax_bpf_restricted, 401 .extra1 = SYSCTL_ZERO, 402 .extra2 = &two, 403 }, 404 { 405 .procname = "bpf_jit_kallsyms", 406 .data = &bpf_jit_kallsyms, 407 .maxlen = sizeof(int), 408 .mode = 0600, 409 .proc_handler = proc_dointvec_minmax_bpf_restricted, 410 .extra1 = SYSCTL_ZERO, 411 .extra2 = SYSCTL_ONE, 412 }, 413 # endif 414 { 415 .procname = "bpf_jit_limit", 416 .data = &bpf_jit_limit, 417 .maxlen = sizeof(long), 418 .mode = 0600, 419 .proc_handler = proc_dolongvec_minmax_bpf_restricted, 420 .extra1 = &long_one, 421 .extra2 = &long_max, 422 }, 423 #endif 424 { 425 .procname = "netdev_tstamp_prequeue", 426 .data = &netdev_tstamp_prequeue, 427 .maxlen = sizeof(int), 428 .mode = 0644, 429 .proc_handler = proc_dointvec 430 }, 431 { 432 .procname = "message_cost", 433 .data = &net_ratelimit_state.interval, 434 .maxlen = sizeof(int), 435 .mode = 0644, 436 .proc_handler = proc_dointvec_jiffies, 437 }, 438 { 439 .procname = "message_burst", 440 .data = &net_ratelimit_state.burst, 441 .maxlen = sizeof(int), 442 .mode = 0644, 443 .proc_handler = proc_dointvec, 444 }, 445 { 446 .procname = "optmem_max", 447 .data = &sysctl_optmem_max, 448 .maxlen = sizeof(int), 449 .mode = 0644, 450 .proc_handler = proc_dointvec 451 }, 452 { 453 .procname = "tstamp_allow_data", 454 .data = &sysctl_tstamp_allow_data, 455 .maxlen = sizeof(int), 456 .mode = 0644, 457 .proc_handler = proc_dointvec_minmax, 458 .extra1 = SYSCTL_ZERO, 459 .extra2 = SYSCTL_ONE 460 }, 461 #ifdef CONFIG_RPS 462 { 463 .procname = "rps_sock_flow_entries", 464 .maxlen = sizeof(int), 465 .mode = 0644, 466 .proc_handler = rps_sock_flow_sysctl 467 }, 468 #endif 469 #ifdef CONFIG_NET_FLOW_LIMIT 470 { 471 .procname = "flow_limit_cpu_bitmap", 472 .mode = 0644, 473 .proc_handler = flow_limit_cpu_sysctl 474 }, 475 { 476 .procname = "flow_limit_table_len", 477 .data = &netdev_flow_limit_table_len, 478 .maxlen = sizeof(int), 479 .mode = 0644, 480 .proc_handler = flow_limit_table_len_sysctl 481 }, 482 #endif /* CONFIG_NET_FLOW_LIMIT */ 483 #ifdef CONFIG_NET_RX_BUSY_POLL 484 { 485 .procname = "busy_poll", 486 .data = &sysctl_net_busy_poll, 487 .maxlen = sizeof(unsigned int), 488 .mode = 0644, 489 .proc_handler = proc_dointvec_minmax, 490 .extra1 = SYSCTL_ZERO, 491 }, 492 { 493 .procname = "busy_read", 494 .data = &sysctl_net_busy_read, 495 .maxlen = sizeof(unsigned int), 496 .mode = 0644, 497 .proc_handler = proc_dointvec_minmax, 498 .extra1 = SYSCTL_ZERO, 499 }, 500 #endif 501 #ifdef CONFIG_NET_SCHED 502 { 503 .procname = "default_qdisc", 504 .mode = 0644, 505 .maxlen = IFNAMSIZ, 506 .proc_handler = set_default_qdisc 507 }, 508 #endif 509 { 510 .procname = "netdev_budget", 511 .data = &netdev_budget, 512 .maxlen = sizeof(int), 513 .mode = 0644, 514 .proc_handler = proc_dointvec 515 }, 516 { 517 .procname = "warnings", 518 .data = &net_msg_warn, 519 .maxlen = sizeof(int), 520 .mode = 0644, 521 .proc_handler = proc_dointvec 522 }, 523 { 524 .procname = "max_skb_frags", 525 .data = &sysctl_max_skb_frags, 526 .maxlen = sizeof(int), 527 .mode = 0644, 528 .proc_handler = proc_dointvec_minmax, 529 .extra1 = SYSCTL_ONE, 530 .extra2 = &max_skb_frags, 531 }, 532 { 533 .procname = "netdev_budget_usecs", 534 .data = &netdev_budget_usecs, 535 .maxlen = sizeof(unsigned int), 536 .mode = 0644, 537 .proc_handler = proc_dointvec_minmax, 538 .extra1 = SYSCTL_ZERO, 539 }, 540 { 541 .procname = "fb_tunnels_only_for_init_net", 542 .data = &sysctl_fb_tunnels_only_for_init_net, 543 .maxlen = sizeof(int), 544 .mode = 0644, 545 .proc_handler = proc_dointvec_minmax, 546 .extra1 = SYSCTL_ZERO, 547 .extra2 = &two, 548 }, 549 { 550 .procname = "devconf_inherit_init_net", 551 .data = &sysctl_devconf_inherit_init_net, 552 .maxlen = sizeof(int), 553 .mode = 0644, 554 .proc_handler = proc_dointvec_minmax, 555 .extra1 = SYSCTL_ZERO, 556 .extra2 = &three, 557 }, 558 { 559 .procname = "high_order_alloc_disable", 560 .data = &net_high_order_alloc_disable_key.key, 561 .maxlen = sizeof(net_high_order_alloc_disable_key), 562 .mode = 0644, 563 .proc_handler = proc_do_static_key, 564 }, 565 { 566 .procname = "gro_normal_batch", 567 .data = &gro_normal_batch, 568 .maxlen = sizeof(unsigned int), 569 .mode = 0644, 570 .proc_handler = proc_dointvec_minmax, 571 .extra1 = SYSCTL_ONE, 572 }, 573 { } 574 }; 575 576 static struct ctl_table netns_core_table[] = { 577 { 578 .procname = "somaxconn", 579 .data = &init_net.core.sysctl_somaxconn, 580 .maxlen = sizeof(int), 581 .mode = 0644, 582 .extra1 = SYSCTL_ZERO, 583 .proc_handler = proc_dointvec_minmax 584 }, 585 { } 586 }; 587 588 static int __init fb_tunnels_only_for_init_net_sysctl_setup(char *str) 589 { 590 /* fallback tunnels for initns only */ 591 if (!strncmp(str, "initns", 6)) 592 sysctl_fb_tunnels_only_for_init_net = 1; 593 /* no fallback tunnels anywhere */ 594 else if (!strncmp(str, "none", 4)) 595 sysctl_fb_tunnels_only_for_init_net = 2; 596 597 return 1; 598 } 599 __setup("fb_tunnels=", fb_tunnels_only_for_init_net_sysctl_setup); 600 601 static __net_init int sysctl_core_net_init(struct net *net) 602 { 603 struct ctl_table *tbl; 604 605 tbl = netns_core_table; 606 if (!net_eq(net, &init_net)) { 607 tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL); 608 if (tbl == NULL) 609 goto err_dup; 610 611 tbl[0].data = &net->core.sysctl_somaxconn; 612 613 /* Don't export any sysctls to unprivileged users */ 614 if (net->user_ns != &init_user_ns) { 615 tbl[0].procname = NULL; 616 } 617 } 618 619 net->core.sysctl_hdr = register_net_sysctl(net, "net/core", tbl); 620 if (net->core.sysctl_hdr == NULL) 621 goto err_reg; 622 623 return 0; 624 625 err_reg: 626 if (tbl != netns_core_table) 627 kfree(tbl); 628 err_dup: 629 return -ENOMEM; 630 } 631 632 static __net_exit void sysctl_core_net_exit(struct net *net) 633 { 634 struct ctl_table *tbl; 635 636 tbl = net->core.sysctl_hdr->ctl_table_arg; 637 unregister_net_sysctl_table(net->core.sysctl_hdr); 638 BUG_ON(tbl == netns_core_table); 639 kfree(tbl); 640 } 641 642 static __net_initdata struct pernet_operations sysctl_core_ops = { 643 .init = sysctl_core_net_init, 644 .exit = sysctl_core_net_exit, 645 }; 646 647 static __init int sysctl_core_init(void) 648 { 649 register_net_sysctl(&init_net, "net/core", net_core_table); 650 return register_pernet_subsys(&sysctl_core_ops); 651 } 652 653 fs_initcall(sysctl_core_init); 654