From nobody Tue Dec 16 07:07:22 2025 Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC0AA34CFD7 for ; Thu, 23 Oct 2025 18:28:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761244101; cv=none; b=CeKq6UgiJ1w72lo/WZ8mqu7dSwWAFYkybaAykfYGPeBadGINJvKcVT57FY+MNx8csi5OWZWXVzae95dpIF9Ny9nxu8HMlmhQrmI9sZhbUIoEoHg2u6h4Iavq57RbQ445L9nrIXy49H6P5bF2rlxcuQqfBBcZlN91KkGEhBa9jXg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761244101; c=relaxed/simple; bh=LTNf3zO088KcCuJY5DwlnqiVNrOCKFiVyhJKNJE5MP4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=T2Yo6YlUC0xv8Xmu+FoWprlCWz2IsYQuUJ7KyDIK4v9AtnW5Yhnl+MCQ50ffZmydF7PyQaxtTFAc2wDCH+X7/yf+MBgcZLXwoA0Xr6eTRYEeIsnEEc5O+h1PmSTFzr+11vo5oM/nH7olr8X85Xa4vrm3Mzgu9mm+dX645vzwiKM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YfjEVeHs; arc=none smtp.client-ip=209.85.210.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YfjEVeHs" Received: by mail-pf1-f180.google.com with SMTP id d2e1a72fcca58-7a27bf4fbcbso803610b3a.1 for ; Thu, 23 Oct 2025 11:28:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1761244091; x=1761848891; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=oi6EltuDjrHL40/sPKeBo5GOQD3+wZV32ZLMdcfyakU=; b=YfjEVeHsuZ65u2Sj5Fvwglv32W6Wkez8ZScPWTnJGHSdW3WjwEFwjcWhj6dyoVOtnm dpajQATX7DRUa1fTp+iMZQ8mqTMcvSgCZDfrFNnmeoxDMNF1B73MOK9bCGtbxLaAnMMp 04kFDK4DiY1/eCdmtA7iuIKp4SaqZXWlLx33MIFZO5Nc/FKIG3DWsbPFsn+b3k82tdLJ YHmXazaQp4/B46x5GHvLr56OQ8PWE9jKYfi8Xp5QCEKcziLvzUyvTIonySFyWqi3kJds MCXN/J5sOU7tOe8dnpo38wKyPhbddk8CbZqnj/veTd1NH5O14HusArY4ovnf9Baw0soX qrqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1761244091; x=1761848891; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=oi6EltuDjrHL40/sPKeBo5GOQD3+wZV32ZLMdcfyakU=; b=Y4EzTiE3j1AoxZNr2H1h6L+/Isy5XYRumxPCcA90UXRaCWUfo2RK5jxNUR3X9lGmN8 1gMUHrt9AZYG44MYjYSOJhSVAVvIfxdr4upbWSqlpnJtsPW4k6l1WnERh2eTQ24XN1V+ 3JFGw+mD8rmHlmnpiaMzJPpINH59DTsBsp7LKMXxV/cvSzdlkFg3u2i7UySyZubfcLX4 xrUddlzcWE2paRT5YQ9IwCegQ2gjmLyspT9N7/qles7pvNA4WQMuIL15mRko2lAZgAL9 k/9Xf1YqDYobxkieqTzj9R/5ElSZwSQloy8I0PPMLLowGzGyTpD6SYhv7WjKRknCTYEY ejfA== X-Forwarded-Encrypted: i=1; AJvYcCXb5n357o6DgR08/IsWR+Z7eg+iBfFRRz5wWa3OTDKYNb86/tbbXejcwuxUIb473ND+NKgaFZ2zBJig0hs=@vger.kernel.org X-Gm-Message-State: AOJu0YwdNzuoSijr06jGX4wvT92XZICcTWR7w1wUqfjYA0Ot028emjob o56f2yPc9ewUXLl75eB3Dwp0Cf7C4DCrPY16EGkwBm3k+wmUYJGEbqmS X-Gm-Gg: ASbGncuYxZ69au2CreAtPfkYoos7jFQZitS63eHj/Scayb4ZNc5HdWZrl3WSVB0oyOp LM9fjgPKyXSqaxdQJ5YNnFsFCHM/lixn7V450VCaQaUQKEYgKuXM5N9R5XaqBo9haMXRa3Gl1Pu aSxMlErP16+aGgZq4xqdtCbjIAz8XuNo3EsNZgTWtJFIycd6kESSFQ4NhCy6J1srrxLpSxn65m6 WUI+ftbfHGKhovGMzGw0ZGi4PABY+wl8tzdMRXTqXpKP1/iVHoL9rBHOAjcdHwmSmNqfZmNeDCx xZv1gFhShonmZhC2CXgyUmunzRDLmpMNt6vO2RTXmOGZokjSrNvsRGPDmRFAA/F3X1tZkwesjDH 2pH1DwvAJ4UNyFJmhZljfVcalM4m4C9g3OXeWpcerc5y34MEkZbnRDzKK03031N9TwYK8F0Xice zoGF1j/QZjxnneq674PA== X-Google-Smtp-Source: AGHT+IEELjFHyyABUDK0LWZlqB6sz5BNRvODMd0egUzV54kNQXVCm7c3MiRl9+V7BDlFPN8LAFPFTg== X-Received: by 2002:a17:902:e88e:b0:25c:76f1:b024 with SMTP id d9443c01a7336-290c9ceeadcmr331021865ad.25.1761244090770; Thu, 23 Oct 2025 11:28:10 -0700 (PDT) Received: from localhost ([2a03:2880:2ff:4::]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-33e223e3154sm6489960a91.9.2025.10.23.11.28.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Oct 2025 11:28:10 -0700 (PDT) From: Bobby Eshleman Date: Thu, 23 Oct 2025 11:27:46 -0700 Subject: [PATCH net-next v8 07/14] vhost/vsock: add netns support Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251023-vsock-vmtest-v8-7-dea984d02bb0@meta.com> References: <20251023-vsock-vmtest-v8-0-dea984d02bb0@meta.com> In-Reply-To: <20251023-vsock-vmtest-v8-0-dea984d02bb0@meta.com> To: Stefano Garzarella , Shuah Khan , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Stefan Hajnoczi , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?utf-8?q?Eugenio_P=C3=A9rez?= , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Bryan Tan , Vishnu Dasa , Broadcom internal kernel review list , Bobby Eshleman Cc: virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, berrange@redhat.com, Bobby Eshleman X-Mailer: b4 0.14.3 From: Bobby Eshleman Add the ability to isolate vhost-vsock flows using namespaces. The VM, via the vhost_vsock struct, inherits its namespace from the process that opens the vhost-vsock device. vhost_vsock lookup functions are modified to take into account the mode (e.g., if CIDs are matching but modes don't align, then return NULL). vhost_vsock now acquires a reference to the namespace. Signed-off-by: Bobby Eshleman --- Changes in v7: - remove the check_global flag of vhost_vsock_get(), that logic was both wrong and not necessary, reuse vsock_net_check_mode() instead - remove 'delete me' comment Changes in v5: - respect pid namespaces when assigning namespace to vhost_vsock --- drivers/vhost/vsock.c | 44 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 34 insertions(+), 10 deletions(-) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 34adf0cf9124..df6136633cd8 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -46,6 +46,11 @@ static DEFINE_READ_MOSTLY_HASHTABLE(vhost_vsock_hash, 8); struct vhost_vsock { struct vhost_dev dev; struct vhost_virtqueue vqs[2]; + struct net *net; + netns_tracker ns_tracker; + + /* The ns mode at the time vhost_vsock was created */ + enum vsock_net_mode net_mode; =20 /* Link to global vhost_vsock_hash, writes use vhost_vsock_mutex */ struct hlist_node hash; @@ -67,7 +72,8 @@ static u32 vhost_transport_get_local_cid(void) /* Callers that dereference the return value must hold vhost_vsock_mutex o= r the * RCU read lock. */ -static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) +static struct vhost_vsock *vhost_vsock_get(u32 guest_cid, struct net *net, + enum vsock_net_mode mode) { struct vhost_vsock *vsock; =20 @@ -78,9 +84,9 @@ static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) if (other_cid =3D=3D 0) continue; =20 - if (other_cid =3D=3D guest_cid) + if (other_cid =3D=3D guest_cid && + vsock_net_check_mode(net, mode, vsock->net, vsock->net_mode)) return vsock; - } =20 return NULL; @@ -271,14 +277,16 @@ static void vhost_transport_send_pkt_work(struct vhos= t_work *work) static int vhost_transport_send_pkt(struct sk_buff *skb) { + enum vsock_net_mode mode =3D virtio_vsock_skb_net_mode(skb); struct virtio_vsock_hdr *hdr =3D virtio_vsock_hdr(skb); + struct net *net =3D virtio_vsock_skb_net(skb); struct vhost_vsock *vsock; int len =3D skb->len; =20 rcu_read_lock(); =20 /* Find the vhost_vsock according to guest context id */ - vsock =3D vhost_vsock_get(le64_to_cpu(hdr->dst_cid)); + vsock =3D vhost_vsock_get(le64_to_cpu(hdr->dst_cid), net, mode); if (!vsock) { rcu_read_unlock(); kfree_skb(skb); @@ -305,7 +313,8 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk) rcu_read_lock(); =20 /* Find the vhost_vsock according to guest context id */ - vsock =3D vhost_vsock_get(vsk->remote_addr.svm_cid); + vsock =3D vhost_vsock_get(vsk->remote_addr.svm_cid, + sock_net(sk_vsock(vsk)), vsk->net_mode); if (!vsock) goto out; =20 @@ -327,7 +336,7 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk) } =20 static struct sk_buff * -vhost_vsock_alloc_skb(struct vhost_virtqueue *vq, +vhost_vsock_alloc_skb(struct vhost_vsock *vsock, struct vhost_virtqueue *v= q, unsigned int out, unsigned int in) { struct virtio_vsock_hdr *hdr; @@ -353,6 +362,9 @@ vhost_vsock_alloc_skb(struct vhost_virtqueue *vq, if (!skb) return NULL; =20 + virtio_vsock_skb_set_net(skb, vsock->net); + virtio_vsock_skb_set_net_mode(skb, vsock->net_mode); + iov_iter_init(&iov_iter, ITER_SOURCE, vq->iov, out, len); =20 hdr =3D virtio_vsock_hdr(skb); @@ -462,11 +474,12 @@ static struct virtio_transport vhost_transport =3D { =20 static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk, u32 re= mote_cid) { + struct net *net =3D sock_net(sk_vsock(vsk)); struct vhost_vsock *vsock; bool seqpacket_allow =3D false; =20 rcu_read_lock(); - vsock =3D vhost_vsock_get(remote_cid); + vsock =3D vhost_vsock_get(remote_cid, net, vsk->net_mode); =20 if (vsock) seqpacket_allow =3D vsock->seqpacket_allow; @@ -520,7 +533,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_wor= k *work) break; } =20 - skb =3D vhost_vsock_alloc_skb(vq, out, in); + skb =3D vhost_vsock_alloc_skb(vsock, vq, out, in); if (!skb) { vq_err(vq, "Faulted on pkt\n"); continue; @@ -652,8 +665,10 @@ static void vhost_vsock_free(struct vhost_vsock *vsock) =20 static int vhost_vsock_dev_open(struct inode *inode, struct file *file) { + struct vhost_virtqueue **vqs; struct vhost_vsock *vsock; + struct net *net; int ret; =20 /* This struct is large and allocation could fail, fall back to vmalloc @@ -669,6 +684,14 @@ static int vhost_vsock_dev_open(struct inode *inode, s= truct file *file) goto out; } =20 + net =3D current->nsproxy->net_ns; + vsock->net =3D get_net_track(net, &vsock->ns_tracker, GFP_KERNEL); + + /* Cache the mode of the namespace so that if that netns mode changes, + * the vhost_vsock will continue to function as expected. + */ + vsock->net_mode =3D vsock_net_mode(net); + vsock->guest_cid =3D 0; /* no CID assigned yet */ vsock->seqpacket_allow =3D false; =20 @@ -708,7 +731,7 @@ static void vhost_vsock_reset_orphans(struct sock *sk) */ =20 /* If the peer is still valid, no need to reset connection */ - if (vhost_vsock_get(vsk->remote_addr.svm_cid)) + if (vhost_vsock_get(vsk->remote_addr.svm_cid, sock_net(sk), vsk->net_mode= )) return; =20 /* If the close timeout is pending, let it expire. This avoids races @@ -753,6 +776,7 @@ static int vhost_vsock_dev_release(struct inode *inode,= struct file *file) virtio_vsock_skb_queue_purge(&vsock->send_pkt_queue); =20 vhost_dev_cleanup(&vsock->dev); + put_net_track(vsock->net, &vsock->ns_tracker); kfree(vsock->dev.vqs); vhost_vsock_free(vsock); return 0; @@ -779,7 +803,7 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsoc= k, u64 guest_cid) =20 /* Refuse if CID is already in use */ mutex_lock(&vhost_vsock_mutex); - other =3D vhost_vsock_get(guest_cid); + other =3D vhost_vsock_get(guest_cid, vsock->net, vsock->net_mode); if (other && other !=3D vsock) { mutex_unlock(&vhost_vsock_mutex); return -EADDRINUSE; --=20 2.47.3