1 // SPDX-License-Identifier: GPL-2.0
2 /* -*- linux-c -*-
3 * sysctl_net_core.c: sysctl interface to net core subsystem.
4 *
5 * Begun April 1, 1996, Mike Shaver.
6 * Added /proc/sys/net/core directory entry (empty =) ). [MS]
7 */
8
9 #include <linux/filter.h>
10 #include <linux/mm.h>
11 #include <linux/sysctl.h>
12 #include <linux/module.h>
13 #include <linux/socket.h>
14 #include <linux/netdevice.h>
15 #include <linux/ratelimit.h>
16 #include <linux/vmalloc.h>
17 #include <linux/init.h>
18 #include <linux/slab.h>
19 #include <linux/sched/isolation.h>
20
21 #include <net/ip.h>
22 #include <net/sock.h>
23 #include <net/net_ratelimit.h>
24 #include <net/busy_poll.h>
25 #include <net/pkt_sched.h>
26 #include <net/hotdata.h>
27 #include <net/proto_memory.h>
28 #include <net/rps.h>
29
30 #include "dev.h"
31
32 static int int_3600 = 3600;
33 static int min_sndbuf = SOCK_MIN_SNDBUF;
34 static int min_rcvbuf = SOCK_MIN_RCVBUF;
35 static int max_skb_frags = MAX_SKB_FRAGS;
36 static int min_mem_pcpu_rsv = SK_MEMORY_PCPU_RESERVE;
37 static int netdev_budget_usecs_min = 2 * USEC_PER_SEC / HZ;
38
39 static int net_msg_warn; /* Unused, but still a sysctl */
40
41 int sysctl_fb_tunnels_only_for_init_net __read_mostly = 0;
42 EXPORT_SYMBOL(sysctl_fb_tunnels_only_for_init_net);
43
44 /* 0 - Keep current behavior:
45 * IPv4: inherit all current settings from init_net
46 * IPv6: reset all settings to default
47 * 1 - Both inherit all current settings from init_net
48 * 2 - Both reset all settings to default
49 * 3 - Both inherit all settings from current netns
50 */
51 int sysctl_devconf_inherit_init_net __read_mostly;
52 EXPORT_SYMBOL(sysctl_devconf_inherit_init_net);
53
54 #if IS_ENABLED(CONFIG_NET_FLOW_LIMIT) || IS_ENABLED(CONFIG_RPS)
dump_cpumask(void * buffer,size_t * lenp,loff_t * ppos,struct cpumask * mask)55 static void dump_cpumask(void *buffer, size_t *lenp, loff_t *ppos,
56 struct cpumask *mask)
57 {
58 char kbuf[128];
59 int len;
60
61 if (*ppos || !*lenp) {
62 *lenp = 0;
63 return;
64 }
65
66 len = min(sizeof(kbuf) - 1, *lenp);
67 len = scnprintf(kbuf, len, "%*pb", cpumask_pr_args(mask));
68 if (!len) {
69 *lenp = 0;
70 return;
71 }
72
73 if (len < *lenp)
74 kbuf[len++] = '\n';
75 memcpy(buffer, kbuf, len);
76 *lenp = len;
77 *ppos += len;
78 }
79 #endif
80
81 #ifdef CONFIG_RPS
82
rps_default_mask_cow_alloc(struct net * net)83 static struct cpumask *rps_default_mask_cow_alloc(struct net *net)
84 {
85 struct cpumask *rps_default_mask;
86
87 if (net->core.rps_default_mask)
88 return net->core.rps_default_mask;
89
90 rps_default_mask = kzalloc(cpumask_size(), GFP_KERNEL);
91 if (!rps_default_mask)
92 return NULL;
93
94 /* pairs with READ_ONCE in rx_queue_default_mask() */
95 WRITE_ONCE(net->core.rps_default_mask, rps_default_mask);
96 return rps_default_mask;
97 }
98
rps_default_mask_sysctl(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)99 static int rps_default_mask_sysctl(const struct ctl_table *table, int write,
100 void *buffer, size_t *lenp, loff_t *ppos)
101 {
102 struct net *net = (struct net *)table->data;
103 int err = 0;
104
105 rtnl_lock();
106 if (write) {
107 struct cpumask *rps_default_mask = rps_default_mask_cow_alloc(net);
108
109 err = -ENOMEM;
110 if (!rps_default_mask)
111 goto done;
112
113 err = cpumask_parse(buffer, rps_default_mask);
114 if (err)
115 goto done;
116
117 err = rps_cpumask_housekeeping(rps_default_mask);
118 if (err)
119 goto done;
120 } else {
121 dump_cpumask(buffer, lenp, ppos,
122 net->core.rps_default_mask ? : cpu_none_mask);
123 }
124
125 done:
126 rtnl_unlock();
127 return err;
128 }
129
rps_sock_flow_sysctl(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)130 static int rps_sock_flow_sysctl(const struct ctl_table *table, int write,
131 void *buffer, size_t *lenp, loff_t *ppos)
132 {
133 unsigned int orig_size, size;
134 int ret, i;
135 struct ctl_table tmp = {
136 .data = &size,
137 .maxlen = sizeof(size),
138 .mode = table->mode
139 };
140 struct rps_sock_flow_table *orig_sock_table, *sock_table;
141 static DEFINE_MUTEX(sock_flow_mutex);
142
143 mutex_lock(&sock_flow_mutex);
144
145 orig_sock_table = rcu_dereference_protected(
146 net_hotdata.rps_sock_flow_table,
147 lockdep_is_held(&sock_flow_mutex));
148 size = orig_size = orig_sock_table ? orig_sock_table->mask + 1 : 0;
149
150 ret = proc_dointvec(&tmp, write, buffer, lenp, ppos);
151
152 if (write) {
153 if (size) {
154 if (size > 1<<29) {
155 /* Enforce limit to prevent overflow */
156 mutex_unlock(&sock_flow_mutex);
157 return -EINVAL;
158 }
159 size = roundup_pow_of_two(size);
160 if (size != orig_size) {
161 sock_table =
162 vmalloc(RPS_SOCK_FLOW_TABLE_SIZE(size));
163 if (!sock_table) {
164 mutex_unlock(&sock_flow_mutex);
165 return -ENOMEM;
166 }
167 net_hotdata.rps_cpu_mask =
168 roundup_pow_of_two(nr_cpu_ids) - 1;
169 sock_table->mask = size - 1;
170 } else
171 sock_table = orig_sock_table;
172
173 for (i = 0; i < size; i++)
174 sock_table->ents[i] = RPS_NO_CPU;
175 } else
176 sock_table = NULL;
177
178 if (sock_table != orig_sock_table) {
179 rcu_assign_pointer(net_hotdata.rps_sock_flow_table,
180 sock_table);
181 if (sock_table) {
182 static_branch_inc(&rps_needed);
183 static_branch_inc(&rfs_needed);
184 }
185 if (orig_sock_table) {
186 static_branch_dec(&rps_needed);
187 static_branch_dec(&rfs_needed);
188 kvfree_rcu_mightsleep(orig_sock_table);
189 }
190 }
191 }
192
193 mutex_unlock(&sock_flow_mutex);
194
195 return ret;
196 }
197 #endif /* CONFIG_RPS */
198
199 #ifdef CONFIG_NET_FLOW_LIMIT
200 static DEFINE_MUTEX(flow_limit_update_mutex);
201
flow_limit_cpu_sysctl(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)202 static int flow_limit_cpu_sysctl(const struct ctl_table *table, int write,
203 void *buffer, size_t *lenp, loff_t *ppos)
204 {
205 struct sd_flow_limit *cur;
206 struct softnet_data *sd;
207 cpumask_var_t mask;
208 int i, len, ret = 0;
209
210 if (!alloc_cpumask_var(&mask, GFP_KERNEL))
211 return -ENOMEM;
212
213 if (write) {
214 ret = cpumask_parse(buffer, mask);
215 if (ret)
216 goto done;
217
218 mutex_lock(&flow_limit_update_mutex);
219 len = sizeof(*cur) + netdev_flow_limit_table_len;
220 for_each_possible_cpu(i) {
221 sd = &per_cpu(softnet_data, i);
222 cur = rcu_dereference_protected(sd->flow_limit,
223 lockdep_is_held(&flow_limit_update_mutex));
224 if (cur && !cpumask_test_cpu(i, mask)) {
225 RCU_INIT_POINTER(sd->flow_limit, NULL);
226 kfree_rcu_mightsleep(cur);
227 } else if (!cur && cpumask_test_cpu(i, mask)) {
228 cur = kzalloc_node(len, GFP_KERNEL,
229 cpu_to_node(i));
230 if (!cur) {
231 /* not unwinding previous changes */
232 ret = -ENOMEM;
233 goto write_unlock;
234 }
235 cur->num_buckets = netdev_flow_limit_table_len;
236 rcu_assign_pointer(sd->flow_limit, cur);
237 }
238 }
239 write_unlock:
240 mutex_unlock(&flow_limit_update_mutex);
241 } else {
242 cpumask_clear(mask);
243 rcu_read_lock();
244 for_each_possible_cpu(i) {
245 sd = &per_cpu(softnet_data, i);
246 if (rcu_dereference(sd->flow_limit))
247 cpumask_set_cpu(i, mask);
248 }
249 rcu_read_unlock();
250
251 dump_cpumask(buffer, lenp, ppos, mask);
252 }
253
254 done:
255 free_cpumask_var(mask);
256 return ret;
257 }
258
flow_limit_table_len_sysctl(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)259 static int flow_limit_table_len_sysctl(const struct ctl_table *table, int write,
260 void *buffer, size_t *lenp, loff_t *ppos)
261 {
262 unsigned int old, *ptr;
263 int ret;
264
265 mutex_lock(&flow_limit_update_mutex);
266
267 ptr = table->data;
268 old = *ptr;
269 ret = proc_dointvec(table, write, buffer, lenp, ppos);
270 if (!ret && write && !is_power_of_2(*ptr)) {
271 *ptr = old;
272 ret = -EINVAL;
273 }
274
275 mutex_unlock(&flow_limit_update_mutex);
276 return ret;
277 }
278 #endif /* CONFIG_NET_FLOW_LIMIT */
279
280 #ifdef CONFIG_NET_SCHED
set_default_qdisc(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)281 static int set_default_qdisc(const struct ctl_table *table, int write,
282 void *buffer, size_t *lenp, loff_t *ppos)
283 {
284 char id[IFNAMSIZ];
285 struct ctl_table tbl = {
286 .data = id,
287 .maxlen = IFNAMSIZ,
288 };
289 int ret;
290
291 qdisc_get_default(id, IFNAMSIZ);
292
293 ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
294 if (write && ret == 0)
295 ret = qdisc_set_default(id);
296 return ret;
297 }
298 #endif
299
proc_do_dev_weight(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)300 static int proc_do_dev_weight(const struct ctl_table *table, int write,
301 void *buffer, size_t *lenp, loff_t *ppos)
302 {
303 static DEFINE_MUTEX(dev_weight_mutex);
304 int ret, weight;
305
306 mutex_lock(&dev_weight_mutex);
307 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
308 if (!ret && write) {
309 weight = READ_ONCE(weight_p);
310 WRITE_ONCE(net_hotdata.dev_rx_weight, weight * dev_weight_rx_bias);
311 WRITE_ONCE(net_hotdata.dev_tx_weight, weight * dev_weight_tx_bias);
312 }
313 mutex_unlock(&dev_weight_mutex);
314
315 return ret;
316 }
317
proc_do_rss_key(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)318 static int proc_do_rss_key(const struct ctl_table *table, int write,
319 void *buffer, size_t *lenp, loff_t *ppos)
320 {
321 struct ctl_table fake_table;
322 char buf[NETDEV_RSS_KEY_LEN * 3];
323
324 snprintf(buf, sizeof(buf), "%*phC", NETDEV_RSS_KEY_LEN, netdev_rss_key);
325 fake_table.data = buf;
326 fake_table.maxlen = sizeof(buf);
327 return proc_dostring(&fake_table, write, buffer, lenp, ppos);
328 }
329
330 #ifdef CONFIG_BPF_JIT
proc_dointvec_minmax_bpf_enable(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)331 static int proc_dointvec_minmax_bpf_enable(const struct ctl_table *table, int write,
332 void *buffer, size_t *lenp,
333 loff_t *ppos)
334 {
335 int ret, jit_enable = *(int *)table->data;
336 int min = *(int *)table->extra1;
337 int max = *(int *)table->extra2;
338 struct ctl_table tmp = *table;
339
340 if (write && !capable(CAP_SYS_ADMIN))
341 return -EPERM;
342
343 tmp.data = &jit_enable;
344 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
345 if (write && !ret) {
346 if (jit_enable < 2 ||
347 (jit_enable == 2 && bpf_dump_raw_ok(current_cred()))) {
348 *(int *)table->data = jit_enable;
349 if (jit_enable == 2)
350 pr_warn("bpf_jit_enable = 2 was set! NEVER use this in production, only for JIT debugging!\n");
351 } else {
352 ret = -EPERM;
353 }
354 }
355
356 if (write && ret && min == max)
357 pr_info_once("CONFIG_BPF_JIT_ALWAYS_ON is enabled, bpf_jit_enable is permanently set to 1.\n");
358
359 return ret;
360 }
361
362 # ifdef CONFIG_HAVE_EBPF_JIT
363 static int
proc_dointvec_minmax_bpf_restricted(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)364 proc_dointvec_minmax_bpf_restricted(const struct ctl_table *table, int write,
365 void *buffer, size_t *lenp, loff_t *ppos)
366 {
367 if (!capable(CAP_SYS_ADMIN))
368 return -EPERM;
369
370 return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
371 }
372 # endif /* CONFIG_HAVE_EBPF_JIT */
373
374 static int
proc_dolongvec_minmax_bpf_restricted(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)375 proc_dolongvec_minmax_bpf_restricted(const struct ctl_table *table, int write,
376 void *buffer, size_t *lenp, loff_t *ppos)
377 {
378 if (!capable(CAP_SYS_ADMIN))
379 return -EPERM;
380
381 return proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
382 }
383 #endif
384
385 static struct ctl_table net_core_table[] = {
386 {
387 .procname = "mem_pcpu_rsv",
388 .data = &net_hotdata.sysctl_mem_pcpu_rsv,
389 .maxlen = sizeof(int),
390 .mode = 0644,
391 .proc_handler = proc_dointvec_minmax,
392 .extra1 = &min_mem_pcpu_rsv,
393 },
394 {
395 .procname = "dev_weight",
396 .data = &weight_p,
397 .maxlen = sizeof(int),
398 .mode = 0644,
399 .proc_handler = proc_do_dev_weight,
400 .extra1 = SYSCTL_ONE,
401 },
402 {
403 .procname = "dev_weight_rx_bias",
404 .data = &dev_weight_rx_bias,
405 .maxlen = sizeof(int),
406 .mode = 0644,
407 .proc_handler = proc_do_dev_weight,
408 .extra1 = SYSCTL_ONE,
409 },
410 {
411 .procname = "dev_weight_tx_bias",
412 .data = &dev_weight_tx_bias,
413 .maxlen = sizeof(int),
414 .mode = 0644,
415 .proc_handler = proc_do_dev_weight,
416 .extra1 = SYSCTL_ONE,
417 },
418 {
419 .procname = "netdev_max_backlog",
420 .data = &net_hotdata.max_backlog,
421 .maxlen = sizeof(int),
422 .mode = 0644,
423 .proc_handler = proc_dointvec
424 },
425 {
426 .procname = "netdev_rss_key",
427 .data = &netdev_rss_key,
428 .maxlen = sizeof(int),
429 .mode = 0444,
430 .proc_handler = proc_do_rss_key,
431 },
432 #ifdef CONFIG_BPF_JIT
433 {
434 .procname = "bpf_jit_enable",
435 .data = &bpf_jit_enable,
436 .maxlen = sizeof(int),
437 .mode = 0644,
438 .proc_handler = proc_dointvec_minmax_bpf_enable,
439 # ifdef CONFIG_BPF_JIT_ALWAYS_ON
440 .extra1 = SYSCTL_ONE,
441 .extra2 = SYSCTL_ONE,
442 # else
443 .extra1 = SYSCTL_ZERO,
444 .extra2 = SYSCTL_TWO,
445 # endif
446 },
447 # ifdef CONFIG_HAVE_EBPF_JIT
448 {
449 .procname = "bpf_jit_harden",
450 .data = &bpf_jit_harden,
451 .maxlen = sizeof(int),
452 .mode = 0600,
453 .proc_handler = proc_dointvec_minmax_bpf_restricted,
454 .extra1 = SYSCTL_ZERO,
455 .extra2 = SYSCTL_TWO,
456 },
457 {
458 .procname = "bpf_jit_kallsyms",
459 .data = &bpf_jit_kallsyms,
460 .maxlen = sizeof(int),
461 .mode = 0600,
462 .proc_handler = proc_dointvec_minmax_bpf_restricted,
463 .extra1 = SYSCTL_ZERO,
464 .extra2 = SYSCTL_ONE,
465 },
466 # endif
467 {
468 .procname = "bpf_jit_limit",
469 .data = &bpf_jit_limit,
470 .maxlen = sizeof(long),
471 .mode = 0600,
472 .proc_handler = proc_dolongvec_minmax_bpf_restricted,
473 .extra1 = SYSCTL_LONG_ONE,
474 .extra2 = &bpf_jit_limit_max,
475 },
476 #endif
477 {
478 .procname = "netdev_tstamp_prequeue",
479 .data = &net_hotdata.tstamp_prequeue,
480 .maxlen = sizeof(int),
481 .mode = 0644,
482 .proc_handler = proc_dointvec
483 },
484 {
485 .procname = "message_cost",
486 .data = &net_ratelimit_state.interval,
487 .maxlen = sizeof(int),
488 .mode = 0644,
489 .proc_handler = proc_dointvec_jiffies,
490 },
491 {
492 .procname = "message_burst",
493 .data = &net_ratelimit_state.burst,
494 .maxlen = sizeof(int),
495 .mode = 0644,
496 .proc_handler = proc_dointvec,
497 },
498 {
499 .procname = "tstamp_allow_data",
500 .data = &sysctl_tstamp_allow_data,
501 .maxlen = sizeof(int),
502 .mode = 0644,
503 .proc_handler = proc_dointvec_minmax,
504 .extra1 = SYSCTL_ZERO,
505 .extra2 = SYSCTL_ONE
506 },
507 #ifdef CONFIG_RPS
508 {
509 .procname = "rps_sock_flow_entries",
510 .maxlen = sizeof(int),
511 .mode = 0644,
512 .proc_handler = rps_sock_flow_sysctl
513 },
514 #endif
515 #ifdef CONFIG_NET_FLOW_LIMIT
516 {
517 .procname = "flow_limit_cpu_bitmap",
518 .mode = 0644,
519 .proc_handler = flow_limit_cpu_sysctl
520 },
521 {
522 .procname = "flow_limit_table_len",
523 .data = &netdev_flow_limit_table_len,
524 .maxlen = sizeof(int),
525 .mode = 0644,
526 .proc_handler = flow_limit_table_len_sysctl
527 },
528 #endif /* CONFIG_NET_FLOW_LIMIT */
529 #ifdef CONFIG_NET_RX_BUSY_POLL
530 {
531 .procname = "busy_poll",
532 .data = &sysctl_net_busy_poll,
533 .maxlen = sizeof(unsigned int),
534 .mode = 0644,
535 .proc_handler = proc_dointvec_minmax,
536 .extra1 = SYSCTL_ZERO,
537 },
538 {
539 .procname = "busy_read",
540 .data = &sysctl_net_busy_read,
541 .maxlen = sizeof(unsigned int),
542 .mode = 0644,
543 .proc_handler = proc_dointvec_minmax,
544 .extra1 = SYSCTL_ZERO,
545 },
546 #endif
547 #ifdef CONFIG_NET_SCHED
548 {
549 .procname = "default_qdisc",
550 .mode = 0644,
551 .maxlen = IFNAMSIZ,
552 .proc_handler = set_default_qdisc
553 },
554 #endif
555 {
556 .procname = "netdev_budget",
557 .data = &net_hotdata.netdev_budget,
558 .maxlen = sizeof(int),
559 .mode = 0644,
560 .proc_handler = proc_dointvec
561 },
562 {
563 .procname = "warnings",
564 .data = &net_msg_warn,
565 .maxlen = sizeof(int),
566 .mode = 0644,
567 .proc_handler = proc_dointvec
568 },
569 {
570 .procname = "max_skb_frags",
571 .data = &net_hotdata.sysctl_max_skb_frags,
572 .maxlen = sizeof(int),
573 .mode = 0644,
574 .proc_handler = proc_dointvec_minmax,
575 .extra1 = SYSCTL_ONE,
576 .extra2 = &max_skb_frags,
577 },
578 {
579 .procname = "netdev_budget_usecs",
580 .data = &net_hotdata.netdev_budget_usecs,
581 .maxlen = sizeof(unsigned int),
582 .mode = 0644,
583 .proc_handler = proc_dointvec_minmax,
584 .extra1 = &netdev_budget_usecs_min,
585 },
586 {
587 .procname = "fb_tunnels_only_for_init_net",
588 .data = &sysctl_fb_tunnels_only_for_init_net,
589 .maxlen = sizeof(int),
590 .mode = 0644,
591 .proc_handler = proc_dointvec_minmax,
592 .extra1 = SYSCTL_ZERO,
593 .extra2 = SYSCTL_TWO,
594 },
595 {
596 .procname = "devconf_inherit_init_net",
597 .data = &sysctl_devconf_inherit_init_net,
598 .maxlen = sizeof(int),
599 .mode = 0644,
600 .proc_handler = proc_dointvec_minmax,
601 .extra1 = SYSCTL_ZERO,
602 .extra2 = SYSCTL_THREE,
603 },
604 {
605 .procname = "high_order_alloc_disable",
606 .data = &net_high_order_alloc_disable_key.key,
607 .maxlen = sizeof(net_high_order_alloc_disable_key),
608 .mode = 0644,
609 .proc_handler = proc_do_static_key,
610 },
611 {
612 .procname = "gro_normal_batch",
613 .data = &net_hotdata.gro_normal_batch,
614 .maxlen = sizeof(unsigned int),
615 .mode = 0644,
616 .proc_handler = proc_dointvec_minmax,
617 .extra1 = SYSCTL_ONE,
618 },
619 {
620 .procname = "netdev_unregister_timeout_secs",
621 .data = &netdev_unregister_timeout_secs,
622 .maxlen = sizeof(unsigned int),
623 .mode = 0644,
624 .proc_handler = proc_dointvec_minmax,
625 .extra1 = SYSCTL_ONE,
626 .extra2 = &int_3600,
627 },
628 {
629 .procname = "skb_defer_max",
630 .data = &net_hotdata.sysctl_skb_defer_max,
631 .maxlen = sizeof(unsigned int),
632 .mode = 0644,
633 .proc_handler = proc_dointvec_minmax,
634 .extra1 = SYSCTL_ZERO,
635 },
636 };
637
638 static struct ctl_table netns_core_table[] = {
639 #if IS_ENABLED(CONFIG_RPS)
640 {
641 .procname = "rps_default_mask",
642 .data = &init_net,
643 .mode = 0644,
644 .proc_handler = rps_default_mask_sysctl
645 },
646 #endif
647 {
648 .procname = "somaxconn",
649 .data = &init_net.core.sysctl_somaxconn,
650 .maxlen = sizeof(int),
651 .mode = 0644,
652 .extra1 = SYSCTL_ZERO,
653 .proc_handler = proc_dointvec_minmax
654 },
655 {
656 .procname = "optmem_max",
657 .data = &init_net.core.sysctl_optmem_max,
658 .maxlen = sizeof(int),
659 .mode = 0644,
660 .extra1 = SYSCTL_ZERO,
661 .proc_handler = proc_dointvec_minmax
662 },
663 {
664 .procname = "txrehash",
665 .data = &init_net.core.sysctl_txrehash,
666 .maxlen = sizeof(u8),
667 .mode = 0644,
668 .extra1 = SYSCTL_ZERO,
669 .extra2 = SYSCTL_ONE,
670 .proc_handler = proc_dou8vec_minmax,
671 },
672 /* sysctl_core_net_init() will set the values after this
673 * to readonly in network namespaces
674 */
675 {
676 .procname = "wmem_max",
677 .data = &sysctl_wmem_max,
678 .maxlen = sizeof(int),
679 .mode = 0644,
680 .proc_handler = proc_dointvec_minmax,
681 .extra1 = &min_sndbuf,
682 },
683 {
684 .procname = "rmem_max",
685 .data = &sysctl_rmem_max,
686 .maxlen = sizeof(int),
687 .mode = 0644,
688 .proc_handler = proc_dointvec_minmax,
689 .extra1 = &min_rcvbuf,
690 },
691 {
692 .procname = "wmem_default",
693 .data = &sysctl_wmem_default,
694 .maxlen = sizeof(int),
695 .mode = 0644,
696 .proc_handler = proc_dointvec_minmax,
697 .extra1 = &min_sndbuf,
698 },
699 {
700 .procname = "rmem_default",
701 .data = &sysctl_rmem_default,
702 .maxlen = sizeof(int),
703 .mode = 0644,
704 .proc_handler = proc_dointvec_minmax,
705 .extra1 = &min_rcvbuf,
706 },
707 };
708
fb_tunnels_only_for_init_net_sysctl_setup(char * str)709 static int __init fb_tunnels_only_for_init_net_sysctl_setup(char *str)
710 {
711 /* fallback tunnels for initns only */
712 if (!strncmp(str, "initns", 6))
713 sysctl_fb_tunnels_only_for_init_net = 1;
714 /* no fallback tunnels anywhere */
715 else if (!strncmp(str, "none", 4))
716 sysctl_fb_tunnels_only_for_init_net = 2;
717
718 return 1;
719 }
720 __setup("fb_tunnels=", fb_tunnels_only_for_init_net_sysctl_setup);
721
sysctl_core_net_init(struct net * net)722 static __net_init int sysctl_core_net_init(struct net *net)
723 {
724 size_t table_size = ARRAY_SIZE(netns_core_table);
725 struct ctl_table *tbl;
726
727 tbl = netns_core_table;
728 if (!net_eq(net, &init_net)) {
729 int i;
730 tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL);
731 if (tbl == NULL)
732 goto err_dup;
733
734 for (i = 0; i < table_size; ++i) {
735 if (tbl[i].data == &sysctl_wmem_max)
736 break;
737
738 tbl[i].data += (char *)net - (char *)&init_net;
739 }
740 for (; i < table_size; ++i)
741 tbl[i].mode &= ~0222;
742 }
743
744 net->core.sysctl_hdr = register_net_sysctl_sz(net, "net/core", tbl, table_size);
745 if (net->core.sysctl_hdr == NULL)
746 goto err_reg;
747
748 return 0;
749
750 err_reg:
751 if (tbl != netns_core_table)
752 kfree(tbl);
753 err_dup:
754 return -ENOMEM;
755 }
756
sysctl_core_net_exit(struct net * net)757 static __net_exit void sysctl_core_net_exit(struct net *net)
758 {
759 const struct ctl_table *tbl;
760
761 tbl = net->core.sysctl_hdr->ctl_table_arg;
762 unregister_net_sysctl_table(net->core.sysctl_hdr);
763 BUG_ON(tbl == netns_core_table);
764 #if IS_ENABLED(CONFIG_RPS)
765 kfree(net->core.rps_default_mask);
766 #endif
767 kfree(tbl);
768 }
769
770 static __net_initdata struct pernet_operations sysctl_core_ops = {
771 .init = sysctl_core_net_init,
772 .exit = sysctl_core_net_exit,
773 };
774
sysctl_core_init(void)775 static __init int sysctl_core_init(void)
776 {
777 register_net_sysctl(&init_net, "net/core", net_core_table);
778 return register_pernet_subsys(&sysctl_core_ops);
779 }
780
781 fs_initcall(sysctl_core_init);
782