linux-kernel - Re: [PATCH v2 21/33] net: support ns lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250916040214.319783-1-kuniyu@google.com>
Date: Tue, 16 Sep 2025 03:59:34 +0000
From: Kuniyuki Iwashima <kuniyu@...gle.com>
To: brauner@...nel.org
Cc: amir73il@...il.com, axboe@...nel.dk, cgroups@...r.kernel.org, 
	chuck.lever@...cle.com, cyphar@...har.com, daan.j.demeyer@...il.com, 
	edumazet@...gle.com, hannes@...xchg.org, horms@...nel.org, jack@...e.cz, 
	jlayton@...nel.org, josef@...icpanda.com, kuba@...nel.org, 
	linux-block@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org, 
	linux-nfs@...r.kernel.org, me@...dnzj.com, mkoutny@...e.com, 
	mzxreary@...inter.de, netdev@...r.kernel.org, pabeni@...hat.com, 
	tj@...nel.org, viro@...iv.linux.org.uk, zbyszek@...waw.pl, kuniyu@...gle.com
Subject: Re: [PATCH v2 21/33] net: support ns lookup

From: Christian Brauner <brauner@...nel.org>
Date: Fri, 12 Sep 2025 13:52:44 +0200
> Support the generic ns lookup infrastructure to support file handles for
> namespaces.
> 
> The network namespace has a separate list with different lifetime rules
> which we can just leave in tact. We have a similar concept for mount
> namespaces as well where it is on two differenet lists for different
> purposes.
> 
> Signed-off-by: Christian Brauner <brauner@...nel.org>
> ---
>  include/net/net_namespace.h | 1 +
>  net/core/net_namespace.c    | 8 ++++++--
>  2 files changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
> index 025a7574b275..42075748dff1 100644
> --- a/include/net/net_namespace.h
> +++ b/include/net/net_namespace.h
> @@ -11,6 +11,7 @@
>  #include <linux/list.h>
>  #include <linux/sysctl.h>
>  #include <linux/uidgid.h>
> +#include <linux/nstree.h>
>  
>  #include <net/flow.h>
>  #include <net/netns/core.h>
> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
> index 5fb7bd8ac45a..169ec22c4758 100644
> --- a/net/core/net_namespace.c
> +++ b/net/core/net_namespace.c
> @@ -20,6 +20,7 @@
>  #include <linux/sched/task.h>
>  #include <linux/uidgid.h>
>  #include <linux/proc_fs.h>
> +#include <linux/nstree.h>
>  
>  #include <net/aligned_data.h>

nit: This is no longer necessary.


>  #include <net/sock.h>
> @@ -445,7 +446,7 @@ static __net_init int setup_net(struct net *net)
>  	LIST_HEAD(net_exit_list);
>  	int error = 0;
>  
> -	net->net_cookie = atomic64_inc_return(&net_aligned_data.net_cookie);
> +	net->net_cookie = ns_tree_gen_id(&net->ns);
>  
>  	list_for_each_entry(ops, &pernet_list, list) {
>  		error = ops_init(ops, net);
> @@ -455,6 +456,7 @@ static __net_init int setup_net(struct net *net)
>  	down_write(&net_rwsem);
>  	list_add_tail_rcu(&net->list, &net_namespace_list);
>  	up_write(&net_rwsem);
> +	ns_tree_add_raw(net);
>  out:
>  	return error;
>  
> @@ -674,8 +676,10 @@ static void cleanup_net(struct work_struct *work)
>  
>  	/* Don't let anyone else find us. */
>  	down_write(&net_rwsem);
> -	llist_for_each_entry(net, net_kill_list, cleanup_list)
> +	llist_for_each_entry(net, net_kill_list, cleanup_list) {
> +		ns_tree_remove(net);

Looking at refcount_inc_not_zero() in nsfs_fh_to_dentry(),
I think ns_tree_remove() fits better in __put_net() which
is called just after refcount_dec_and_test(&net->ns.count).

cleanup_net() is single threaded work and somtimes takes long with
too many netns and the netns may stay longer unnecessarily until
next cleanup_net().


>  		list_del_rcu(&net->list);
> +	}
>  	/* Cache last net. After we unlock rtnl, no one new net
>  	 * added to net_namespace_list can assign nsid pointer
>  	 * to a net from net_kill_list (see peernet2id_alloc()).
> 
> -- 
> 2.47.3