virtio-vsock did not have namespace support (the device was always accessible to any global namespace). Make the virtio-vsock device assignable to a namespace and initialize it to init_net. Because virtio-vsock and init_net are both hardcoded to global mode, nothing changes until the assign command is issued. An assign can land while virtio_transport_rx_work() is draining a batch, so the assigned namespace is re-read per packet rather than once per batch. Matching the rest of the batch against the namespace the device has left would reset connections that belong to the new one. When a device is assigned to a namespace, every already established vsock socket that is no longer able to reach the device is forcibly closed. For that reason, adding new sockets to the connected table must be performed atomically with regards to namespace assignment. This ensures that when the socket is added to the connected table that it actually passes the new reachability conditions set by ns assignment. If it wins the race to the table and does NOT pass the reachability tests, then it will be reset. This is the purpose of the new helper 'vsock_maybe_set_connected()'. Signed-off-by: Bobby Eshleman --- Changes in v3: - Re-read the assigned netns per packet in virtio_transport_rx_work() rather than once per batch, so a mid-batch assign cannot reset the new namespace's connections (Sashiko) - Drop the NULL netns reset in virtio_transport_rx_work(), the assigned netns is now pinned - Drop the .reset op and the virtio_transport_reset{,_no_sock}() exports, the sweep no longer sends a RST (Sashiko) Changes in v2: - Export virtio_transport_reset(), wire it to the new .reset op (Stefano) - netns_assign_allow is now a bool (Stefano) - Pass NULL, not &init_net, in virtio_transport_rx_work(), and comment why (Stefano) - Drop the if (net) guard around put_net() (Stefano) - Drop the comments at the vsock_maybe_set_connected() call sites, the commit msg seems sufficient --- net/vmw_vsock/virtio_transport.c | 23 ++++++++++++++++++----- net/vmw_vsock/virtio_transport_common.c | 18 +++++++++++++----- 2 files changed, 31 insertions(+), 10 deletions(-) diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c index eced6929405d..4123924536dd 100644 --- a/net/vmw_vsock/virtio_transport.c +++ b/net/vmw_vsock/virtio_transport.c @@ -542,7 +542,7 @@ static bool virtio_transport_msgzerocopy_allow(void) bool virtio_transport_stream_allow(struct vsock_sock *vsk, u32 cid, u32 port) { - return vsock_net_mode_global(vsk); + return vsock_g2h_net_reachable(sock_net(sk_vsock(vsk))); } static bool virtio_transport_seqpacket_allow(struct vsock_sock *vsk, @@ -587,6 +587,7 @@ static struct virtio_transport virtio_transport = { .seqpacket_has_data = virtio_transport_seqpacket_has_data, .msgzerocopy_allow = virtio_transport_msgzerocopy_allow, + .netns_assign_allow = true, .notify_poll_in = virtio_transport_notify_poll_in, .notify_poll_out = virtio_transport_notify_poll_out, @@ -616,7 +617,7 @@ virtio_transport_seqpacket_allow(struct vsock_sock *vsk, u32 remote_cid) struct virtio_vsock *vsock; bool seqpacket_allow; - if (!vsock_net_mode_global(vsk)) + if (!vsock_g2h_net_reachable(sock_net(sk_vsock(vsk)))) return false; seqpacket_allow = false; @@ -633,7 +634,12 @@ static void virtio_transport_rx_work(struct work_struct *work) { struct virtio_vsock *vsock = container_of(work, struct virtio_vsock, rx_work); + struct virtio_transport *t = &virtio_transport; + netns_tracker ns_tracker; struct virtqueue *vq; + struct net *net; + + net = vsock_g2h_net_get(&ns_tracker); mutex_lock(&vsock->rx_lock); @@ -682,10 +688,15 @@ static void virtio_transport_rx_work(struct work_struct *work) virtio_transport_deliver_tap_pkt(skb); - /* Force virtio-transport into global mode since it - * does not yet support local-mode namespacing. + /* Only grab a reference if the net changes underneath + * us. */ - virtio_transport_recv_pkt(&virtio_transport, skb, NULL); + if (unlikely(!vsock_g2h_net_eq(net))) { + put_net_track(net, &ns_tracker); + net = vsock_g2h_net_get(&ns_tracker); + } + + virtio_transport_recv_pkt(t, skb, net); } } while (!virtqueue_enable_cb(vq)); @@ -694,6 +705,8 @@ static void virtio_transport_rx_work(struct work_struct *work) virtio_vsock_rx_fill(vsock); out_nofill: mutex_unlock(&vsock->rx_lock); + + put_net_track(net, &ns_tracker); } static int virtio_vsock_vqs_init(struct virtio_vsock *vsock) diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index f225f53ed4ba..0234379c14a1 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -1478,9 +1478,13 @@ virtio_transport_recv_connecting(struct sock *sk, switch (le16_to_cpu(hdr->op)) { case VIRTIO_VSOCK_OP_RESPONSE: - sk->sk_state = TCP_ESTABLISHED; + if (!vsock_maybe_set_connected(vsk)) { + skerr = ECONNRESET; + err = -ENETUNREACH; + goto destroy; + } + sk->sk_socket->state = SS_CONNECTED; - vsock_insert_connected(vsk); sk->sk_state_change(sk); break; case VIRTIO_VSOCK_OP_INVALID: @@ -1736,8 +1740,6 @@ virtio_transport_recv_listen(struct sock *sk, struct sk_buff *skb, lock_sock_nested(child, SINGLE_DEPTH_NESTING); - child->sk_state = TCP_ESTABLISHED; - vchild = vsock_sk(child); vsock_addr_init(&vchild->local_addr, le64_to_cpu(hdr->dst_cid), le32_to_cpu(hdr->dst_port)); @@ -1758,7 +1760,13 @@ virtio_transport_recv_listen(struct sock *sk, struct sk_buff *skb, if (virtio_transport_space_update(child, skb)) child->sk_write_space(child); - vsock_insert_connected(vchild); + if (!vsock_maybe_set_connected(vchild)) { + release_sock(child); + virtio_transport_reset_no_sock(t, skb, sock_net(sk)); + sock_put(child); + return -ENETUNREACH; + } + vsock_enqueue_accept(sk, child); virtio_transport_send_response(vchild, skb); -- 2.53.0-Meta