From: Bobby Eshleman bobbyeshleman@meta.com

Associate reply packets with the sending socket. When vsock must reply with an RST packet and there exists a sending socket (e.g., for loopback), setting the skb owner to the socket correctly handles reference counting between the skb and sk (i.e., the sk stays alive until the skb is freed).

This allows the net namespace to be used for socket lookups for the duration of the reply skb's lifetime, preventing race conditions between the namespace lifecycle and vsock socket search using the namespace pointer.

Reviewed-by: Stefano Garzarella sgarzare@redhat.com Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- Changes in v11: - move before adding to netns support (Stefano)

Changes in v10: - break this out into its own patch for easy revert (Stefano) --- net/vmw_vsock/virtio_transport_common.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index e6391eb7cc1b..de71e2b3f77e 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -1165,6 +1165,12 @@ static int virtio_transport_reset_no_sock(const struct virtio_transport *t, .op = VIRTIO_VSOCK_OP_RST, .type = le16_to_cpu(hdr->type), .reply = true, + + /* Set sk owner to socket we are replying to (may be NULL for + * non-loopback). This keeps a reference to the sock and + * sock_net(sk) until the reply skb is freed. + */ + .vsk = vsock_sk(skb->sk), }; struct sk_buff *reply;

From: Bobby Eshleman bobbyeshleman@meta.com

Add functions for initializing namespaces with the different vsock NS modes. Callers can use add_namespaces() and del_namespaces() to create namespaces global0, global1, local0, and local1.

The init_namespaces() function initializes global0, local0, etc... with their respective vsock NS mode. This function is separate so that tests that depend on this initialization can use it, while other tests that want to test the initialization interface itself can start with a clean slate by omitting this call.

Remove namespaces upon exiting the program in cleanup(). This is unlikely to be needed for a healthy run, but it is useful for tests that are manually killed mid-test. In that case, this patch prevents the subsequent test run from finding stale namespaces with already-write-once-locked vsock ns modes.

This patch is in preparation for later namespace tests.

Reviewed-by: Stefano Garzarella sgarzare@redhat.com Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- tools/testing/selftests/vsock/vmtest.sh | 41 +++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+)

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index c7b270dd77a9..f78cc574c274 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -49,6 +49,7 @@ readonly TEST_DESCS=( )

readonly USE_SHARED_VM=(vm_server_host_client vm_client_host_server vm_loopback) +readonly NS_MODES=("local" "global")

VERBOSE=0

@@ -103,6 +104,45 @@ check_result() { fi }

+add_namespaces() { + # add namespaces local0, local1, global0, and global1 + for mode in "${NS_MODES[@]}"; do + ip netns add "${mode}0" 2>/dev/null + ip netns add "${mode}1" 2>/dev/null + done +} + +init_namespaces() { + for mode in "${NS_MODES[@]}"; do + ns_set_mode "${mode}0" "${mode}" + ns_set_mode "${mode}1" "${mode}" + + log_host "set ns ${mode}0 to mode ${mode}" + log_host "set ns ${mode}1 to mode ${mode}" + + # we need lo for qemu port forwarding + ip netns exec "${mode}0" ip link set dev lo up + ip netns exec "${mode}1" ip link set dev lo up + done +} + +del_namespaces() { + for mode in "${NS_MODES[@]}"; do + ip netns del "${mode}0" &>/dev/null + ip netns del "${mode}1" &>/dev/null + log_host "removed ns ${mode}0" + log_host "removed ns ${mode}1" + done +} + +ns_set_mode() { + local ns=$1 + local mode=$2 + + echo "${mode}" | ip netns exec "${ns}" \ + tee /proc/sys/net/vsock/ns_mode &>/dev/null +} + vm_ssh() { ssh -q -o UserKnownHostsFile=/dev/null -p ${SSH_HOST_PORT} localhost "$@" return $? @@ -110,6 +150,7 @@ vm_ssh() {

cleanup() { terminate_pidfiles "${!PIDFILES[@]}" + del_namespaces }

check_args() {

From: Bobby Eshleman bobbyeshleman@meta.com

Add netns support to loopback and vhost. Keep netns disabled for virtio-vsock, but add necessary changes to comply with common API updates.

This is the patch in the series when vhost-vsock namespaces actually come online. Hence, vhost_transport_supports_local_mode() is switched to return true.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- Changes in v12: - change seqpacket_allow() and stream_allow() to return true for loopback and vhost (Stefano)

Changes in v11: - reorder with the skb ownership patch for loopback (Stefano) - toggle vhost_transport_supports_local_mode() to true

Changes in v10: - Splitting patches complicates the series with meaningless placeholder values that eventually get replaced anyway, so to avoid that this patch combines into one. Links to previous patches here: - Link: https://lore.kernel.org/all/20251111-vsock-vmtest-v9-3-852787a37bed@meta.com... - Link: https://lore.kernel.org/all/20251111-vsock-vmtest-v9-6-852787a37bed@meta.com... - Link: https://lore.kernel.org/all/20251111-vsock-vmtest-v9-7-852787a37bed@meta.com... - remove placeholder values (Stefano) - update comment describe net/net_mode for virtio_transport_reset_no_sock() --- drivers/vhost/vsock.c | 56 +++++++++++++++++++++-------- include/linux/virtio_vsock.h | 8 +++-- net/vmw_vsock/virtio_transport.c | 10 ++++-- net/vmw_vsock/virtio_transport_common.c | 63 ++++++++++++++++++++++++--------- net/vmw_vsock/vsock_loopback.c | 19 +++++++--- 5 files changed, 118 insertions(+), 38 deletions(-)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 83937e1d63fa..82cb9ec09e78 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -46,6 +46,11 @@ static DEFINE_READ_MOSTLY_HASHTABLE(vhost_vsock_hash, 8); struct vhost_vsock { struct vhost_dev dev; struct vhost_virtqueue vqs[2]; + struct net *net; + netns_tracker ns_tracker; + + /* The ns mode at the time vhost_vsock was created */ + enum vsock_net_mode net_mode;

/* Link to global vhost_vsock_hash, writes use vhost_vsock_mutex */ struct hlist_node hash; @@ -67,7 +72,8 @@ static u32 vhost_transport_get_local_cid(void) /* Callers that dereference the return value must hold vhost_vsock_mutex or the * RCU read lock. */ -static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) +static struct vhost_vsock *vhost_vsock_get(u32 guest_cid, struct net *net, + enum vsock_net_mode mode) { struct vhost_vsock *vsock;

@@ -78,9 +84,10 @@ static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) if (other_cid == 0) continue;

- if (other_cid == guest_cid) + if (other_cid == guest_cid && + vsock_net_check_mode(net, mode, vsock->net, + vsock->net_mode)) return vsock; - }

return NULL; @@ -269,7 +276,8 @@ static void vhost_transport_send_pkt_work(struct vhost_work *work) }

static int -vhost_transport_send_pkt(struct sk_buff *skb) +vhost_transport_send_pkt(struct sk_buff *skb, struct net *net, + enum vsock_net_mode net_mode) { struct virtio_vsock_hdr *hdr = virtio_vsock_hdr(skb); struct vhost_vsock *vsock; @@ -278,7 +286,7 @@ vhost_transport_send_pkt(struct sk_buff *skb) rcu_read_lock();

/* Find the vhost_vsock according to guest context id */ - vsock = vhost_vsock_get(le64_to_cpu(hdr->dst_cid)); + vsock = vhost_vsock_get(le64_to_cpu(hdr->dst_cid), net, net_mode); if (!vsock) { rcu_read_unlock(); kfree_skb(skb); @@ -305,7 +313,8 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk) rcu_read_lock();

/* Find the vhost_vsock according to guest context id */ - vsock = vhost_vsock_get(vsk->remote_addr.svm_cid); + vsock = vhost_vsock_get(vsk->remote_addr.svm_cid, + sock_net(sk_vsock(vsk)), vsk->net_mode); if (!vsock) goto out;

@@ -407,6 +416,12 @@ static bool vhost_transport_msgzerocopy_allow(void) static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk, u32 remote_cid);

+static bool +vhost_transport_stream_allow(struct vsock_sock *vsk, u32 cid, u32 port) +{ + return true; +} + static struct virtio_transport vhost_transport = { .transport = { .module = THIS_MODULE, @@ -431,7 +446,7 @@ static struct virtio_transport vhost_transport = { .stream_has_space = virtio_transport_stream_has_space, .stream_rcvhiwat = virtio_transport_stream_rcvhiwat, .stream_is_active = virtio_transport_stream_is_active, - .stream_allow = virtio_transport_stream_allow, + .stream_allow = vhost_transport_stream_allow,

.seqpacket_dequeue = virtio_transport_seqpacket_dequeue, .seqpacket_enqueue = virtio_transport_seqpacket_enqueue, @@ -464,14 +479,12 @@ static struct virtio_transport vhost_transport = { static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk, u32 remote_cid) { + struct net *net = sock_net(sk_vsock(vsk)); struct vhost_vsock *vsock; bool seqpacket_allow = false;

- if (vsk->net_mode != VSOCK_NET_MODE_GLOBAL) - return false; - rcu_read_lock(); - vsock = vhost_vsock_get(remote_cid); + vsock = vhost_vsock_get(remote_cid, net, vsk->net_mode);

if (vsock) seqpacket_allow = vsock->seqpacket_allow; @@ -542,7 +555,8 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) if (le64_to_cpu(hdr->src_cid) == vsock->guest_cid && le64_to_cpu(hdr->dst_cid) == vhost_transport_get_local_cid()) - virtio_transport_recv_pkt(&vhost_transport, skb); + virtio_transport_recv_pkt(&vhost_transport, skb, + vsock->net, vsock->net_mode); else kfree_skb(skb);

@@ -659,6 +673,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file) { struct vhost_virtqueue **vqs; struct vhost_vsock *vsock; + struct net *net; int ret;

/* This struct is large and allocation could fail, fall back to vmalloc @@ -674,6 +689,17 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file) goto out; }

+ net = current->nsproxy->net_ns; + vsock->net = get_net_track(net, &vsock->ns_tracker, GFP_KERNEL); + + /* Store the mode of the namespace at the time of creation. If this + * namespace later changes from "global" to "local", we want this vsock + * to continue operating normally and not suddenly break. For that + * reason, we save the mode here and later use it when performing + * socket lookups with vsock_net_check_mode() (see vhost_vsock_get()). + */ + vsock->net_mode = vsock_net_mode(net); + vsock->guest_cid = 0; /* no CID assigned yet */ vsock->seqpacket_allow = false;

@@ -713,7 +739,8 @@ static void vhost_vsock_reset_orphans(struct sock *sk) */

/* If the peer is still valid, no need to reset connection */ - if (vhost_vsock_get(vsk->remote_addr.svm_cid)) + if (vhost_vsock_get(vsk->remote_addr.svm_cid, sock_net(sk), + vsk->net_mode)) return;

/* If the close timeout is pending, let it expire. This avoids races @@ -758,6 +785,7 @@ static int vhost_vsock_dev_release(struct inode *inode, struct file *file) virtio_vsock_skb_queue_purge(&vsock->send_pkt_queue);

vhost_dev_cleanup(&vsock->dev); + put_net_track(vsock->net, &vsock->ns_tracker); kfree(vsock->dev.vqs); vhost_vsock_free(vsock); return 0; @@ -784,7 +812,7 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid)

/* Refuse if CID is already in use */ mutex_lock(&vhost_vsock_mutex); - other = vhost_vsock_get(guest_cid); + other = vhost_vsock_get(guest_cid, vsock->net, vsock->net_mode); if (other && other != vsock) { mutex_unlock(&vhost_vsock_mutex); return -EADDRINUSE; diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h index 1845e8d4f78d..7ea264dcfff7 100644 --- a/include/linux/virtio_vsock.h +++ b/include/linux/virtio_vsock.h @@ -173,6 +173,8 @@ struct virtio_vsock_pkt_info { u32 remote_cid, remote_port; struct vsock_sock *vsk; struct msghdr *msg; + struct net *net; + enum vsock_net_mode net_mode; u32 pkt_len; u16 type; u16 op; @@ -185,7 +187,8 @@ struct virtio_transport { struct vsock_transport transport;

/* Takes ownership of the packet */ - int (*send_pkt)(struct sk_buff *skb); + int (*send_pkt)(struct sk_buff *skb, struct net *net, + enum vsock_net_mode net_mode);

/* Used in MSG_ZEROCOPY mode. Checks, that provided data * (number of buffers) could be transmitted with zerocopy @@ -280,7 +283,8 @@ virtio_transport_dgram_enqueue(struct vsock_sock *vsk, void virtio_transport_destruct(struct vsock_sock *vsk);

void virtio_transport_recv_pkt(struct virtio_transport *t, - struct sk_buff *skb); + struct sk_buff *skb, struct net *net, + enum vsock_net_mode net_mode); void virtio_transport_inc_tx_pkt(struct virtio_vsock_sock *vvs, struct sk_buff *skb); u32 virtio_transport_get_credit(struct virtio_vsock_sock *vvs, u32 wanted); void virtio_transport_put_credit(struct virtio_vsock_sock *vvs, u32 credit); diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c index f5123810192d..3ff695740108 100644 --- a/net/vmw_vsock/virtio_transport.c +++ b/net/vmw_vsock/virtio_transport.c @@ -231,7 +231,8 @@ static int virtio_transport_send_skb_fast_path(struct virtio_vsock *vsock, struc }

static int -virtio_transport_send_pkt(struct sk_buff *skb) +virtio_transport_send_pkt(struct sk_buff *skb, struct net *net, + enum vsock_net_mode net_mode) { struct virtio_vsock_hdr *hdr; struct virtio_vsock *vsock; @@ -665,7 +666,12 @@ static void virtio_transport_rx_work(struct work_struct *work) virtio_vsock_skb_put(skb, payload_len);

virtio_transport_deliver_tap_pkt(skb); - virtio_transport_recv_pkt(&virtio_transport, skb); + + /* Force virtio-transport into global mode since it + * does not yet support local-mode namespacing. + */ + virtio_transport_recv_pkt(&virtio_transport, skb, + NULL, VSOCK_NET_MODE_GLOBAL); } } while (!virtqueue_enable_cb(vq));

diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index de71e2b3f77e..a818152d8b79 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -413,7 +413,7 @@ static int virtio_transport_send_pkt_info(struct vsock_sock *vsk,

virtio_transport_inc_tx_pkt(vvs, skb);

- ret = t_ops->send_pkt(skb); + ret = t_ops->send_pkt(skb, info->net, info->net_mode); if (ret < 0) break;

@@ -527,6 +527,8 @@ static int virtio_transport_send_credit_update(struct vsock_sock *vsk) struct virtio_vsock_pkt_info info = { .op = VIRTIO_VSOCK_OP_CREDIT_UPDATE, .vsk = vsk, + .net = sock_net(sk_vsock(vsk)), + .net_mode = vsk->net_mode, };

return virtio_transport_send_pkt_info(vsk, &info); @@ -1067,6 +1069,8 @@ int virtio_transport_connect(struct vsock_sock *vsk) struct virtio_vsock_pkt_info info = { .op = VIRTIO_VSOCK_OP_REQUEST, .vsk = vsk, + .net = sock_net(sk_vsock(vsk)), + .net_mode = vsk->net_mode, };

return virtio_transport_send_pkt_info(vsk, &info); @@ -1082,6 +1086,8 @@ int virtio_transport_shutdown(struct vsock_sock *vsk, int mode) (mode & SEND_SHUTDOWN ? VIRTIO_VSOCK_SHUTDOWN_SEND : 0), .vsk = vsk, + .net = sock_net(sk_vsock(vsk)), + .net_mode = vsk->net_mode, };

return virtio_transport_send_pkt_info(vsk, &info); @@ -1108,6 +1114,8 @@ virtio_transport_stream_enqueue(struct vsock_sock *vsk, .msg = msg, .pkt_len = len, .vsk = vsk, + .net = sock_net(sk_vsock(vsk)), + .net_mode = vsk->net_mode, };

return virtio_transport_send_pkt_info(vsk, &info); @@ -1145,6 +1153,8 @@ static int virtio_transport_reset(struct vsock_sock *vsk, .op = VIRTIO_VSOCK_OP_RST, .reply = !!skb, .vsk = vsk, + .net = sock_net(sk_vsock(vsk)), + .net_mode = vsk->net_mode, };

/* Send RST only if the original pkt is not a RST pkt */ @@ -1156,9 +1166,14 @@ static int virtio_transport_reset(struct vsock_sock *vsk,

/* Normally packets are associated with a socket. There may be no socket if an * attempt was made to connect to a socket that does not exist. + * + * net and net_mode refer to the namespace of whoever sent the invalid message. + * For loopback, this is the namespace of the socket. For vhost, this is the + * namespace of the VM (i.e., vhost_vsock). */ static int virtio_transport_reset_no_sock(const struct virtio_transport *t, - struct sk_buff *skb) + struct sk_buff *skb, struct net *net, + enum vsock_net_mode net_mode) { struct virtio_vsock_hdr *hdr = virtio_vsock_hdr(skb); struct virtio_vsock_pkt_info info = { @@ -1171,6 +1186,13 @@ static int virtio_transport_reset_no_sock(const struct virtio_transport *t, * sock_net(sk) until the reply skb is freed. */ .vsk = vsock_sk(skb->sk), + + /* net or net_mode are not defined here because we pass + * net and net_mode directly to t->send_pkt(), instead of + * relying on virtio_transport_send_pkt_info() to pass them to + * t->send_pkt(). They are not needed by + * virtio_transport_alloc_skb(). + */ }; struct sk_buff *reply;

@@ -1189,7 +1211,7 @@ static int virtio_transport_reset_no_sock(const struct virtio_transport *t, if (!reply) return -ENOMEM;

- return t->send_pkt(reply); + return t->send_pkt(reply, net, net_mode); }

/* This function should be called with sk_lock held and SOCK_DONE set */ @@ -1471,6 +1493,8 @@ virtio_transport_send_response(struct vsock_sock *vsk, .remote_port = le32_to_cpu(hdr->src_port), .reply = true, .vsk = vsk, + .net = sock_net(sk_vsock(vsk)), + .net_mode = vsk->net_mode, };

return virtio_transport_send_pkt_info(vsk, &info); @@ -1513,12 +1537,14 @@ virtio_transport_recv_listen(struct sock *sk, struct sk_buff *skb, int ret;

if (le16_to_cpu(hdr->op) != VIRTIO_VSOCK_OP_REQUEST) { - virtio_transport_reset_no_sock(t, skb); + virtio_transport_reset_no_sock(t, skb, sock_net(sk), + vsk->net_mode); return -EINVAL; }

if (sk_acceptq_is_full(sk)) { - virtio_transport_reset_no_sock(t, skb); + virtio_transport_reset_no_sock(t, skb, sock_net(sk), + vsk->net_mode); return -ENOMEM; }

@@ -1526,13 +1552,15 @@ virtio_transport_recv_listen(struct sock *sk, struct sk_buff *skb, * Subsequent enqueues would lead to a memory leak. */ if (sk->sk_shutdown == SHUTDOWN_MASK) { - virtio_transport_reset_no_sock(t, skb); + virtio_transport_reset_no_sock(t, skb, sock_net(sk), + vsk->net_mode); return -ESHUTDOWN; }

child = vsock_create_connected(sk); if (!child) { - virtio_transport_reset_no_sock(t, skb); + virtio_transport_reset_no_sock(t, skb, sock_net(sk), + vsk->net_mode); return -ENOMEM; }

@@ -1554,7 +1582,8 @@ virtio_transport_recv_listen(struct sock *sk, struct sk_buff *skb, */ if (ret || vchild->transport != &t->transport) { release_sock(child); - virtio_transport_reset_no_sock(t, skb); + virtio_transport_reset_no_sock(t, skb, sock_net(sk), + vsk->net_mode); sock_put(child); return ret; } @@ -1582,7 +1611,8 @@ static bool virtio_transport_valid_type(u16 type) * lock. */ void virtio_transport_recv_pkt(struct virtio_transport *t, - struct sk_buff *skb) + struct sk_buff *skb, struct net *net, + enum vsock_net_mode net_mode) { struct virtio_vsock_hdr *hdr = virtio_vsock_hdr(skb); struct sockaddr_vm src, dst; @@ -1605,24 +1635,25 @@ void virtio_transport_recv_pkt(struct virtio_transport *t, le32_to_cpu(hdr->fwd_cnt));

if (!virtio_transport_valid_type(le16_to_cpu(hdr->type))) { - (void)virtio_transport_reset_no_sock(t, skb); + (void)virtio_transport_reset_no_sock(t, skb, net, net_mode); goto free_pkt; }

/* The socket must be in connected or bound table * otherwise send reset back */ - sk = vsock_find_connected_socket(&src, &dst); + sk = vsock_find_connected_socket_net(&src, &dst, net, net_mode); if (!sk) { - sk = vsock_find_bound_socket(&dst); + sk = vsock_find_bound_socket_net(&dst, net, net_mode); if (!sk) { - (void)virtio_transport_reset_no_sock(t, skb); + (void)virtio_transport_reset_no_sock(t, skb, net, + net_mode); goto free_pkt; } }

if (virtio_transport_get_type(sk) != le16_to_cpu(hdr->type)) { - (void)virtio_transport_reset_no_sock(t, skb); + (void)virtio_transport_reset_no_sock(t, skb, net, net_mode); sock_put(sk); goto free_pkt; } @@ -1641,7 +1672,7 @@ void virtio_transport_recv_pkt(struct virtio_transport *t, */ if (sock_flag(sk, SOCK_DONE) || (sk->sk_state != TCP_LISTEN && vsk->transport != &t->transport)) { - (void)virtio_transport_reset_no_sock(t, skb); + (void)virtio_transport_reset_no_sock(t, skb, net, net_mode); release_sock(sk); sock_put(sk); goto free_pkt; @@ -1673,7 +1704,7 @@ void virtio_transport_recv_pkt(struct virtio_transport *t, kfree_skb(skb); break; default: - (void)virtio_transport_reset_no_sock(t, skb); + (void)virtio_transport_reset_no_sock(t, skb, net, net_mode); kfree_skb(skb); break; } diff --git a/net/vmw_vsock/vsock_loopback.c b/net/vmw_vsock/vsock_loopback.c index afad27cf533a..aef44d1631c3 100644 --- a/net/vmw_vsock/vsock_loopback.c +++ b/net/vmw_vsock/vsock_loopback.c @@ -26,7 +26,8 @@ static u32 vsock_loopback_get_local_cid(void) return VMADDR_CID_LOCAL; }

-static int vsock_loopback_send_pkt(struct sk_buff *skb) +static int vsock_loopback_send_pkt(struct sk_buff *skb, struct net *net, + enum vsock_net_mode net_mode) { struct vsock_loopback *vsock = &the_vsock_loopback; int len = skb->len; @@ -48,6 +49,13 @@ static int vsock_loopback_cancel_pkt(struct vsock_sock *vsk)

static bool vsock_loopback_seqpacket_allow(struct vsock_sock *vsk, u32 remote_cid); + +static bool vsock_loopback_stream_allow(struct vsock_sock *vsk, u32 cid, + u32 port) +{ + return true; +} + static bool vsock_loopback_msgzerocopy_allow(void) { return true; @@ -77,7 +85,7 @@ static struct virtio_transport loopback_transport = { .stream_has_space = virtio_transport_stream_has_space, .stream_rcvhiwat = virtio_transport_stream_rcvhiwat, .stream_is_active = virtio_transport_stream_is_active, - .stream_allow = virtio_transport_stream_allow, + .stream_allow = vsock_loopback_stream_allow,

.seqpacket_dequeue = virtio_transport_seqpacket_dequeue, .seqpacket_enqueue = virtio_transport_seqpacket_enqueue, @@ -110,7 +118,7 @@ static struct virtio_transport loopback_transport = { static bool vsock_loopback_seqpacket_allow(struct vsock_sock *vsk, u32 remote_cid) { - return vsk->net_mode == VSOCK_NET_MODE_GLOBAL; + return true; }

static void vsock_loopback_work(struct work_struct *work) @@ -132,7 +140,10 @@ static void vsock_loopback_work(struct work_struct *work) */ virtio_transport_consume_skb_sent(skb, false); virtio_transport_deliver_tap_pkt(skb); - virtio_transport_recv_pkt(&loopback_transport, skb); + + virtio_transport_recv_pkt(&loopback_transport, skb, + sock_net(skb->sk), + vsock_sk(skb->sk)->net_mode); } }

From: Bobby Eshleman bobbyeshleman@meta.com

Replace /proc/net parsing with ss(8) for detecting listening sockets in wait_for_listener() functions and add support for TCP, VSOCK, and Unix socket protocols.

The previous implementation parsed /proc/net/tcp using awk to detect listening sockets, but this approach could not support vsock because vsock does not export socket information to /proc/net/.

Instead, use ss so that we can detect listeners on tcp, vsock, and unix.

The protocol parameter is now required for all wait_for_listener family functions (wait_for_listener, vm_wait_for_listener, host_wait_for_listener) to explicitly specify which socket type to wait for.

ss is added to the dependency check in check_deps().

Reviewed-by: Stefano Garzarella sgarzare@redhat.com Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- tools/testing/selftests/vsock/vmtest.sh | 47 +++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 17 deletions(-)

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index 1623e4da15e2..e32997db322d 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -191,7 +191,7 @@ check_args() { }

check_deps() { - for dep in vng ${QEMU} busybox pkill ssh; do + for dep in vng ${QEMU} busybox pkill ssh ss; do if [[ ! -x $(command -v "${dep}") ]]; then echo -e "skip: dependency ${dep} not found!\n" exit "${KSFT_SKIP}" @@ -346,21 +346,32 @@ wait_for_listener() local port=$1 local interval=$2 local max_intervals=$3 - local protocol=tcp - local pattern + local protocol=$4 local i

- pattern=":$(printf "%04X" "${port}") " - - # for tcp protocol additionally check the socket state - [ "${protocol}" = "tcp" ] && pattern="${pattern}0A" - for i in $(seq "${max_intervals}"); do - if awk -v pattern="${pattern}" \ - 'BEGIN {rc=1} $2" "$4 ~ pattern {rc=0} END {exit rc}' \ - /proc/net/"${protocol}"*; then + case "${protocol}" in + tcp) + if ss --listening --tcp --numeric | grep -q ":${port} "; then + break + fi + ;; + vsock) + if ss --listening --vsock --numeric | grep -q ":${port} "; then + break + fi + ;; + unix) + # For unix sockets, port is actually the socket path + if ss --listening --unix | grep -q "${port}"; then + break + fi + ;; + *) + echo "Unknown protocol: ${protocol}" >&2 break - fi + ;; + esac sleep "${interval}" done } @@ -368,23 +379,25 @@ wait_for_listener() vm_wait_for_listener() { local ns=$1 local port=$2 + local protocol=$3

vm_ssh "${ns}" <<EOF $(declare -f wait_for_listener) -wait_for_listener ${port} ${WAIT_PERIOD} ${WAIT_PERIOD_MAX} +wait_for_listener ${port} ${WAIT_PERIOD} ${WAIT_PERIOD_MAX} ${protocol} EOF }

host_wait_for_listener() { local ns=$1 local port=$2 + local protocol=$3

if [[ "${ns}" == "init_ns" ]]; then - wait_for_listener "${port}" "${WAIT_PERIOD}" "${WAIT_PERIOD_MAX}" + wait_for_listener "${port}" "${WAIT_PERIOD}" "${WAIT_PERIOD_MAX}" "${protocol}" else ip netns exec "${ns}" bash <<-EOF $(declare -f wait_for_listener) - wait_for_listener ${port} ${WAIT_PERIOD} ${WAIT_PERIOD_MAX} + wait_for_listener ${port} ${WAIT_PERIOD} ${WAIT_PERIOD_MAX} ${protocol} EOF fi } @@ -431,7 +444,7 @@ vm_vsock_test() { return $rc fi

- vm_wait_for_listener "${ns}" "${port}" + vm_wait_for_listener "${ns}" "${port}" "tcp" rc=$? fi set +o pipefail @@ -472,7 +485,7 @@ host_vsock_test() { return $rc fi

- host_wait_for_listener "${ns}" "${port}" + host_wait_for_listener "${ns}" "${port}" "tcp" rc=$? fi set +o pipefail

From: Bobby Eshleman bobbyeshleman@meta.com

Add tests to verify CID collision rules across different vsock namespace modes.

1. Two VMs with the same CID cannot start in different global namespaces (ns_global_same_cid_fails) 2. Two VMs with the same CID can start in different local namespaces (ns_local_same_cid_ok) 3. VMs with the same CID can coexist when one is in a global namespace and another is in a local namespace (ns_global_local_same_cid_ok and ns_local_global_same_cid_ok)

The tests ns_global_local_same_cid_ok and ns_local_global_same_cid_ok make sure that ordering does not matter.

The tests use a shared helper function namespaces_can_boot_same_cid() that attempts to start two VMs with identical CIDs in the specified namespaces and verifies whether VM initialization failed or succeeded.

Reviewed-by: Stefano Garzarella sgarzare@redhat.com Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- Changes in v11: - check vm_start() rc in namespaces_can_boot_same_cid() (Stefano) - fix ns_local_same_cid_ok() to use local0 and local1 instead of reusing local0 twice. This check should pass, ensuring local namespaces do not collide (Stefano) --- tools/testing/selftests/vsock/vmtest.sh | 78 +++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+)

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index 28b91b906cdc..ec18eb5b4ccd 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -50,6 +50,10 @@ readonly TEST_NAMES=( vm_loopback ns_host_vsock_ns_mode_ok ns_host_vsock_ns_mode_write_once_ok + ns_global_same_cid_fails + ns_local_same_cid_ok + ns_global_local_same_cid_ok + ns_local_global_same_cid_ok ) readonly TEST_DESCS=( # vm_server_host_client @@ -66,6 +70,18 @@ readonly TEST_DESCS=(

# ns_host_vsock_ns_mode_write_once_ok "Check /proc/sys/net/vsock/ns_mode is write-once on the host." + + # ns_global_same_cid_fails + "Check QEMU fails to start two VMs with same CID in two different global namespaces." + + # ns_local_same_cid_ok + "Check QEMU successfully starts two VMs with same CID in two different local namespaces." + + # ns_global_local_same_cid_ok + "Check QEMU successfully starts one VM in a global ns and then another VM in a local ns with the same CID." + + # ns_local_global_same_cid_ok + "Check QEMU successfully starts one VM in a local ns and then another VM in a global ns with the same CID." )

readonly USE_SHARED_VM=( @@ -576,6 +592,68 @@ test_ns_host_vsock_ns_mode_ok() { return "${KSFT_PASS}" }

+namespaces_can_boot_same_cid() { + local ns0=$1 + local ns1=$2 + local pidfile1 pidfile2 + local rc + + pidfile1="$(create_pidfile)" + + # The first VM should be able to start. If it can't then we have + # problems and need to return non-zero. + if ! vm_start "${pidfile1}" "${ns0}"; then + return 1 + fi + + pidfile2="$(create_pidfile)" + vm_start "${pidfile2}" "${ns1}" + rc=$? + terminate_pidfiles "${pidfile1}" "${pidfile2}" + + return "${rc}" +} + +test_ns_global_same_cid_fails() { + init_namespaces + + if namespaces_can_boot_same_cid "global0" "global1"; then + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" +} + +test_ns_local_global_same_cid_ok() { + init_namespaces + + if namespaces_can_boot_same_cid "local0" "global0"; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +test_ns_global_local_same_cid_ok() { + init_namespaces + + if namespaces_can_boot_same_cid "global0" "local0"; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +test_ns_local_same_cid_ok() { + init_namespaces + + if namespaces_can_boot_same_cid "local0" "local1"; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + test_ns_host_vsock_ns_mode_write_once_ok() { for mode in "${NS_MODES[@]}"; do local ns="${mode}0"

From: Bobby Eshleman bobbyeshleman@meta.com

Add tests that validate vsock sockets are resilient to deleting namespaces or changing namespace modes from global to local. The vsock sockets should still function normally.

The function check_ns_changes_dont_break_connection() is added to re-use the step-by-step logic of 1) setup connections, 2) do something that would maybe break the connections, 3) check that the connections are still ok.

Reviewed-by: Stefano Garzarella sgarzare@redhat.com Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- Changes in v11: - remove pipefile (Stefano)

Changes in v9: - more consistent shell style - clarify -u usage comment for pipefile --- tools/testing/selftests/vsock/vmtest.sh | 119 ++++++++++++++++++++++++++++++++ 1 file changed, 119 insertions(+)

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index da9198dc8ab5..a903a0bf66c4 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -68,6 +68,12 @@ readonly TEST_NAMES=( ns_same_local_loopback_ok ns_same_local_host_connect_to_local_vm_ok ns_same_local_vm_connect_to_local_host_ok + ns_mode_change_connection_continue_vm_ok + ns_mode_change_connection_continue_host_ok + ns_mode_change_connection_continue_both_ok + ns_delete_vm_ok + ns_delete_host_ok + ns_delete_both_ok ) readonly TEST_DESCS=( # vm_server_host_client @@ -135,6 +141,24 @@ readonly TEST_DESCS=(

# ns_same_local_vm_connect_to_local_host_ok "Run vsock_test client in VM in a local ns with server in same ns." + + # ns_mode_change_connection_continue_vm_ok + "Check that changing NS mode of VM namespace from global to local after a connection is established doesn't break the connection" + + # ns_mode_change_connection_continue_host_ok + "Check that changing NS mode of host namespace from global to local after a connection is established doesn't break the connection" + + # ns_mode_change_connection_continue_both_ok + "Check that changing NS mode of host and VM namespaces from global to local after a connection is established doesn't break the connection" + + # ns_delete_vm_ok + "Check that deleting the VM's namespace does not break the socket connection" + + # ns_delete_host_ok + "Check that deleting the host's namespace does not break the socket connection" + + # ns_delete_both_ok + "Check that deleting the VM and host's namespaces does not break the socket connection" )

readonly USE_SHARED_VM=( @@ -1274,6 +1298,101 @@ test_vm_loopback() { return "${KSFT_PASS}" }

+check_ns_changes_dont_break_connection() { + local pipefile pidfile outfile + local ns0="global0" + local ns1="global1" + local port=12345 + local pids=() + local rc=0 + + init_namespaces + + pidfile="$(create_pidfile)" + if ! vm_start "${pidfile}" "${ns0}"; then + return "${KSFT_FAIL}" + fi + vm_wait_for_ssh "${ns0}" + + outfile=$(mktemp) + vm_ssh "${ns0}" -- \ + socat VSOCK-LISTEN:"${port}",fork STDOUT > "${outfile}" 2>/dev/null & + pids+=($!) + vm_wait_for_listener "${ns0}" "${port}" "vsock" + + # We use a pipe here so that we can echo into the pipe instead of using + # socat and a unix socket file. We just need a name for the pipe (not a + # regular file) so use -u. + pipefile=$(mktemp -u /tmp/vmtest_pipe_XXXX) + ip netns exec "${ns1}" \ + socat PIPE:"${pipefile}" VSOCK-CONNECT:"${VSOCK_CID}":"${port}" & + pids+=($!) + + timeout "${WAIT_PERIOD}" \ + bash -c 'while [[ ! -e '"${pipefile}"' ]]; do sleep 1; done; exit 0' + + if [[ $2 == "delete" ]]; then + if [[ "$1" == "vm" ]]; then + ip netns del "${ns0}" + elif [[ "$1" == "host" ]]; then + ip netns del "${ns1}" + elif [[ "$1" == "both" ]]; then + ip netns del "${ns0}" + ip netns del "${ns1}" + fi + elif [[ $2 == "change_mode" ]]; then + if [[ "$1" == "vm" ]]; then + ns_set_mode "${ns0}" "local" + elif [[ "$1" == "host" ]]; then + ns_set_mode "${ns1}" "local" + elif [[ "$1" == "both" ]]; then + ns_set_mode "${ns0}" "local" + ns_set_mode "${ns1}" "local" + fi + fi + + echo "TEST" > "${pipefile}" + + timeout "${WAIT_PERIOD}" \ + bash -c 'while [[ ! -s '"${outfile}"' ]]; do sleep 1; done; exit 0' + + if grep -q "TEST" "${outfile}"; then + rc="${KSFT_PASS}" + else + rc="${KSFT_FAIL}" + fi + + terminate_pidfiles "${pidfile}" + terminate_pids "${pids[@]}" + rm -f "${outfile}" "${pipefile}" + + return "${rc}" +} + +test_ns_mode_change_connection_continue_vm_ok() { + check_ns_changes_dont_break_connection "vm" "change_mode" +} + +test_ns_mode_change_connection_continue_host_ok() { + check_ns_changes_dont_break_connection "host" "change_mode" +} + +test_ns_mode_change_connection_continue_both_ok() { + check_ns_changes_dont_break_connection "both" "change_mode" +} + +test_ns_delete_vm_ok() { + check_ns_changes_dont_break_connection "vm" "delete" +} + +test_ns_delete_host_ok() { + check_ns_changes_dont_break_connection "host" "delete" +} + +test_ns_delete_both_ok() { + check_ns_changes_dont_break_connection "both" "delete" +} + shared_vm_test() { local tname

On Wed, Nov 26, 2025 at 11:47:31PM -0800, Bobby Eshleman wrote:

From: Bobby Eshleman bobbyeshleman@meta.com

Add netns logic to vsock core. Additionally, modify transport hook prototypes to be used by later transport-specific patches (e.g., *_seqpacket_allow()).

Namespaces are supported primarily by changing socket lookup functions (e.g., vsock_find_connected_socket()) to take into account the socket namespace and the namespace mode before considering a candidate socket a "match".

This patch also introduces the sysctl /proc/sys/net/vsock/ns_mode that accepts the "global" or "local" mode strings.

Add netns functionality (initialization, passing to transports, procfs, etc...) to the af_vsock socket layer. Later patches that add netns support to transports depend on this patch.

dgram_allow(), stream_allow(), and seqpacket_allow() callbacks are modified to take a vsk in order to perform logic on namespace modes. In future patches, the net and net_mode will also be used for socket lookups in these functions.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com

Changes in v12:

• return true in dgram_allow(), stream_allow(), and seqpacket_allow()

only if net_mode == VSOCK_NET_MODE_GLOBAL (Stefano)

• document bind(VMADDR_CID_ANY) case in af_vsock.c (Stefano)
• change order of stream_allow() call in vmci so we can pass vsk

to it

Changes in v10:

• add file-level comment about what happens to sockets/devices

when the namespace mode changes (Stefano)

• change the 'if (write)' boolean in vsock_net_mode_string() to

if (!write), this simplifies a later patch which adds "goto" for mutex unlocking on function exit.

Changes in v9:

• remove virtio_vsock_alloc_rx_skb() (Stefano)
• remove vsock_global_dummy_net, not needed as net=NULL +

net_mode=VSOCK_NET_MODE_GLOBAL achieves identical result

Changes in v7:

• hv_sock: fix hyperv build error
• explain why vhost does not use the dummy
• explain usage of __vsock_global_dummy_net
• explain why VSOCK_NET_MODE_STR_MAX is 8 characters
• use switch-case in vsock_net_mode_string()
• avoid changing transports as much as possible
• add vsock_find_{bound,connected}_socket_net()
• rename `vsock_hdr` to `sysctl_hdr`
• add virtio_vsock_alloc_linear_skb() wrapper for setting dummy net and

global mode for virtio-vsock, move skb->cb zero-ing into wrapper

• explain seqpacket_allow() change
• move net setting to __vsock_create() instead of vsock_create() so

that child sockets also have their net assigned upon accept()

Changes in v6:

• unregister sysctl ops in vsock_exit()
• af_vsock: clarify description of CID behavior
• af_vsock: fix buf vs buffer naming, and length checking
• af_vsock: fix length checking w/ correct ctl_table->maxlen

Changes in v5:

• vsock_global_net() -> vsock_global_dummy_net()
• update comments for new uAPI
• use /proc/sys/net/vsock/ns_mode instead of /proc/net/vsock_ns_mode
• add prototype changes so patch remains compilable

---

drivers/vhost/vsock.c | 9 +- include/linux/virtio_vsock.h | 4 +- include/net/af_vsock.h | 13 +- net/vmw_vsock/af_vsock.c | 272 +++++++++++++++++++++++++++++--- net/vmw_vsock/hyperv_transport.c | 7 +- net/vmw_vsock/virtio_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 6 +- net/vmw_vsock/vmci_transport.c | 26 ++- net/vmw_vsock/vsock_loopback.c | 8 +- 9 files changed, 310 insertions(+), 44 deletions(-)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index ae01457ea2cd..83937e1d63fa 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -404,7 +404,8 @@ static bool vhost_transport_msgzerocopy_allow(void) return true; }

-static bool vhost_transport_seqpacket_allow(u32 remote_cid); +static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk,

• 			    u32 remote_cid);
  
  

static struct virtio_transport vhost_transport = { .transport = { @@ -460,11 +461,15 @@ static struct virtio_transport vhost_transport = { .send_pkt = vhost_transport_send_pkt, };

-static bool vhost_transport_seqpacket_allow(u32 remote_cid) +static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk,

• 			    u32 remote_cid)
  

{ struct vhost_vsock *vsock; bool seqpacket_allow = false;

• if (vsk->net_mode != VSOCK_NET_MODE_GLOBAL)

• return false;
  

• rcu_read_lock(); vsock = vhost_vsock_get(remote_cid);

diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h index 0c67543a45c8..1845e8d4f78d 100644 --- a/include/linux/virtio_vsock.h +++ b/include/linux/virtio_vsock.h @@ -256,10 +256,10 @@ void virtio_transport_notify_buffer_size(struct vsock_sock *vsk, u64 *val);

u64 virtio_transport_stream_rcvhiwat(struct vsock_sock *vsk); bool virtio_transport_stream_is_active(struct vsock_sock *vsk); -bool virtio_transport_stream_allow(u32 cid, u32 port); +bool virtio_transport_stream_allow(struct vsock_sock *vsk, u32 cid, u32 port); int virtio_transport_dgram_bind(struct vsock_sock *vsk, struct sockaddr_vm *addr); -bool virtio_transport_dgram_allow(u32 cid, u32 port); +bool virtio_transport_dgram_allow(struct vsock_sock *vsk, u32 cid, u32 port);

int virtio_transport_connect(struct vsock_sock *vsk);

diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index 9b5bdd083b6f..d10e73cd7413 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -126,7 +126,7 @@ struct vsock_transport { size_t len, int flags); int (*dgram_enqueue)(struct vsock_sock *, struct sockaddr_vm *, struct msghdr *, size_t len);

• bool (*dgram_allow)(u32 cid, u32 port);

• bool (*dgram_allow)(struct vsock_sock *vsk, u32 cid, u32 port);

  /* STREAM. */ /* TODO: stream_bind() */

@@ -138,14 +138,14 @@ struct vsock_transport { s64 (*stream_has_space)(struct vsock_sock *); u64 (*stream_rcvhiwat)(struct vsock_sock *); bool (*stream_is_active)(struct vsock_sock *);

• bool (*stream_allow)(u32 cid, u32 port);

• bool (*stream_allow)(struct vsock_sock *vsk, u32 cid, u32 port);

  /* SEQ_PACKET. */ ssize_t (*seqpacket_dequeue)(struct vsock_sock *vsk, struct msghdr *msg, int flags); int (*seqpacket_enqueue)(struct vsock_sock *vsk, struct msghdr *msg, size_t len);

• bool (*seqpacket_allow)(u32 remote_cid);

• bool (*seqpacket_allow)(struct vsock_sock *vsk, u32 remote_cid); u32 (*seqpacket_has_data)(struct vsock_sock *vsk);

  /* Notification. */

@@ -218,6 +218,13 @@ void vsock_remove_connected(struct vsock_sock *vsk); struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr); struct sock *vsock_find_connected_socket(struct sockaddr_vm *src, struct sockaddr_vm *dst); +struct sock *vsock_find_bound_socket_net(struct sockaddr_vm *addr,

• 			 struct net *net,
  

• 			 enum vsock_net_mode net_mode);
  

+struct sock *vsock_find_connected_socket_net(struct sockaddr_vm *src,

• 			     struct sockaddr_vm *dst,
  

• 			     struct net *net,
  

• 			     enum vsock_net_mode net_mode);
  

void vsock_remove_sock(struct vsock_sock *vsk); void vsock_for_each_connected_socket(struct vsock_transport *transport, void (*fn)(struct sock *sk)); diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index adcba1b7bf74..6113c22db8dc 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -83,6 +83,46 @@

• TCP_ESTABLISHED - connected
• TCP_CLOSING - disconnecting
• TCP_LISTEN - listening

• • • Namespaces in vsock support two different modes configured
• • through /proc/sys/net/vsock/ns_mode. The modes are "local" and "global".
• • Each mode defines how the namespace interacts with CIDs.
• • /proc/sys/net/vsock/ns_mode is write-once, so that it may be configured
• • and locked down by a namespace manager. The default is "global". The mode
• • is set per-namespace.
• • The modes affect the allocation and accessibility of CIDs as follows:
• • • global - access and allocation are all system-wide

nit: maybe we should mention that this mode is primarily for backward compatibility, since it's the way how vsock worked before netns support.

(We can fix later eventually with a followup patch)

• •  - all CID allocation from global namespaces draw from the same
    

• •    system-wide pool.
    

• •  - if one global namespace has already allocated some CID, another
    

• •    global namespace will not be able to allocate the same CID.
    

• •  - global mode AF_VSOCK sockets can reach any VM or socket in any global
    

• •    namespace, they are not contained to only their own namespace.
    

• •  - AF_VSOCK sockets in a global mode namespace cannot reach VMs or
    

• •    sockets in any local mode namespace.
    

• • • local - access and allocation are contained within the namespace

• • - CID allocation draws only from a private pool local only to the
    

• •   namespace, and does not affect the CIDs available for allocation in any
    

• •   other namespace (global or local).
    

• • - VMs in a local namespace do not collide with CIDs in any other local
    

• •   namespace or any global namespace. For example, if a VM in a local mode
    

• •   namespace is given CID 10, then CID 10 is still available for
    

• •   allocation in any other namespace, but not in the same namespace.
    

• • - AF_VSOCK sockets in a local mode namespace can connect only to VMs or
    

• •   other sockets within their own namespace.
    

• • - sockets bound to VMADDR_CID_ANY in local namespaces will never resolve
    

• •   to any transport that is not compatible with local mode. There is no
    

• •   error that propagates to the user (as there is for connection attempts)
    

• •   because it is possible for some packet to reach this socket from
    

• •   a different transport that *does* support local mode. For
    

• •   example, virtio-vsock may not support local mode, but the socket
    

• •   may still accept a connection from vhost-vsock which does.
    

• • • when a socket or device is initialized in a namespace with mode

• • global, it will stay in global mode even if the namespace later
    

• • changes to local.
    

*/

#include <linux/compat.h> @@ -100,6 +140,7 @@ #include <linux/module.h> #include <linux/mutex.h> #include <linux/net.h> +#include <linux/proc_fs.h> #include <linux/poll.h> #include <linux/random.h> #include <linux/skbuff.h> @@ -111,9 +152,18 @@ #include <linux/workqueue.h> #include <net/sock.h> #include <net/af_vsock.h> +#include <net/netns/vsock.h> #include <uapi/linux/vm_sockets.h> #include <uapi/asm-generic/ioctls.h>

+#define VSOCK_NET_MODE_STR_GLOBAL "global" +#define VSOCK_NET_MODE_STR_LOCAL "local"

+/* 6 chars for "global", 1 for null-terminator, and 1 more for '\n'.

• • The newline is added by proc_dostring() for read operations.
• */

+#define VSOCK_NET_MODE_STR_MAX 8

static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr); static void vsock_sk_destruct(struct sock *sk); static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); @@ -235,33 +285,47 @@ static void __vsock_remove_connected(struct vsock_sock *vsk) sock_put(&vsk->sk); }

-static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr) +static struct sock *__vsock_find_bound_socket_net(struct sockaddr_vm *addr,

• 				  struct net *net,
  

• 				  enum vsock_net_mode net_mode)
  

{ struct vsock_sock *vsk;

list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table) {

• if (vsock_addr_equals_addr(addr, &vsk->local_addr))
  

• 	return sk_vsock(vsk);
  

• struct sock *sk = sk_vsock(vsk);
  

• if (vsock_addr_equals_addr(addr, &vsk->local_addr) &&
  

•     vsock_net_check_mode(sock_net(sk), vsk->net_mode, net,
  

• 			 net_mode))
  

• 	return sk;
  
  

  if (addr->svm_port == vsk->local_addr.svm_port && (vsk->local_addr.svm_cid == VMADDR_CID_ANY ||

•      addr->svm_cid == VMADDR_CID_ANY))
  

• 	return sk_vsock(vsk);
  

•      addr->svm_cid == VMADDR_CID_ANY) &&
  

•      vsock_net_check_mode(sock_net(sk), vsk->net_mode, net,
  

• 			  net_mode))
  

• 	return sk;
  

  }

  return NULL;

}

-static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src,

• 				  struct sockaddr_vm *dst)
  

+static struct sock * +__vsock_find_connected_socket_net(struct sockaddr_vm *src,

• 		  struct sockaddr_vm *dst, struct net *net,
  

• 		  enum vsock_net_mode net_mode)
  

{ struct vsock_sock *vsk;

list_for_each_entry(vsk, vsock_connected_s)ckets(src, dst), connected_table) {

• struct sock *sk = sk_vsock(vsk);
  

• if (vsock_addr_equals_addr(src, &vsk->remote_addr) &&

•     dst->svm_port == vsk->local_addr.svm_port) {
  

• 	return sk_vsock(vsk);
  

•     dst->svm_port == vsk->local_addr.svm_port &&
  

•     vsock_net_check_mode(sock_net(sk), vsk->net_mode, net,
  

• 			 net_mode)) {
  

• 	return sk;
  

  } }

@@ -304,12 +368,14 @@ void vsock_remove_connected(struct vsock_sock *vsk) } EXPORT_SYMBOL_GPL(vsock_remove_connected);

-struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr) +struct sock *vsock_find_bound_socket_net(struct sockaddr_vm *addr,

• 			 struct net *net,
  

• 			 enum vsock_net_mode net_mode)
  

{ struct sock *sk;

spin_lock_bh(&vsock_table_lock);

• sk = __vsock_find_bound_socket(addr);

• sk = __vsock_find_bound_socket_net(addr, net, net_mode); if (sk) sock_hold(sk);

@@ -317,15 +383,23 @@ struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr)

return sk; } +EXPORT_SYMBOL_GPL(vsock_find_bound_socket_net);

+struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr) +{

• return vsock_find_bound_socket_net(addr, NULL, VSOCK_NET_MODE_GLOBAL);

The patch LGTM, my last doubt now is if here (and in vsock_find_connected_socket() ) we should use `init_net`.

In practice, this is the namespace (NULL) and mode (GLOBAL) used by transports that do not support namespaces.

So here we are making them belong to no namespace, so they can only reach global ones. When any namespace, including `init_net`, switches to local, it can no longer be reached by transports that do not support local namespaces, because in practice we still do not have a way to associate a device (in the case of drivers) with a specific namespace. Right?

If I get it right, it can makes sense, but I'd like an ack from net maintainers to be sure we are doing the right things.

Also I think we should have a comment on top of this function to make it clear that should be used only by transport that doesn't support namespace, and the reason why we used NULL and GLOBAL. Plus a comment on top of this file (near where we described local vs global) to clarify the status of this.

That said, if next week net-next will close, I think we can send a follow-up patch just for those comments, so:

Reviewed-by: Stefano Garzarella sgarzare@redhat.com

+} EXPORT_SYMBOL_GPL(vsock_find_bound_socket);

-struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,

• 			 struct sockaddr_vm *dst)
  

+struct sock *vsock_find_connected_socket_net(struct sockaddr_vm *src,

• 			     struct sockaddr_vm *dst,
  

• 			     struct net *net,
  

• 			     enum vsock_net_mode net_mode)
  

{ struct sock *sk;

spin_lock_bh(&vsock_table_lock);

• sk = __vsock_find_connected_socket(src, dst);

• sk = __vsock_find_connected_socket_net(src, dst, net, net_mode); if (sk) sock_hold(sk);

@@ -333,6 +407,14 @@ struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,

return sk; } +EXPORT_SYMBOL_GPL(vsock_find_connected_socket_net);

+struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,

• 			 struct sockaddr_vm *dst)
  

+{

• return vsock_find_connected_socket_net(src, dst,

• 			       NULL, VSOCK_NET_MODE_GLOBAL);
  

+} EXPORT_SYMBOL_GPL(vsock_find_connected_socket);

On Wed, Nov 26, 2025 at 11:47:40PM -0800, Bobby Eshleman wrote:

From: Bobby Eshleman bobbyeshleman@meta.com

Add tests to validate namespace correctness using vsock_test and socat. The vsock_test tool is used to validate expected success tests, but socat is used for expected failure tests. socat is used to ensure that connections are rejected outright instead of failing due to some other socket behavior (as tested in vsock_test). Additionally, socat is already required for tunneling TCP traffic from vsock_test. Using only one of the vsock_test tests like 'test_stream_client_close_client' would have yielded a similar result, but doing so wouldn't remove the socat dependency.

Additionally, check for the dependency socat. socat needs special handling beyond just checking if it is on the path because it must be compiled with support for both vsock and unix. The function check_socat() checks that this support exists.

Add more padding to test name printf strings because the tests added in this patch would otherwise overflow.

Add vm_dmesg_* helpers to encapsulate checking dmesg for oops and warnings.

Add ability to pass extra args to host-side vsock_test so that tests that cause false positives may be skipped with arg --skip.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com

Changes in v12:

• add test skip (vsock_test test 29) when host_vsock_test() uses client

mode in a local namespace. Test 29 causes a false positive to trigger.

I see, LGTM and thanks for adding a comment with the reason!

Reviewed-by: Stefano Garzarella sgarzare@redhat.com

Changes in v11:

• add 'sleep "${WAIT_PERIOD}"' after any non-TCP socat LISTEN cmd

(Stefano)

• add host_wait_for_listener() after any socat TCP-LISTEN (Stefano)
• reuse vm_dmesg_{oops,warn}_count() inside vm_dmesg_check()
• fix copy-paste in test_ns_same_local_vm_connect_to_local_host_ok()

(Stefano)

Changes in v10:

• add vm_dmesg_start() and vm_dmesg_check()

Changes in v9:

• consistent variable quoting

---

tools/testing/selftests/vsock/vmtest.sh | 572 +++++++++++++++++++++++++++++++- 1 file changed, 568 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index ec18eb5b4ccd..da9198dc8ab5 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -7,6 +7,7 @@ # * virtme-ng # * busybox-static (used by virtme-ng) # * qemu (used by virtme-ng) +# * socat # # shellcheck disable=SC2317,SC2119

@@ -54,6 +55,19 @@ readonly TEST_NAMES=( ns_local_same_cid_ok ns_global_local_same_cid_ok ns_local_global_same_cid_ok

• ns_diff_global_host_connect_to_global_vm_ok
• ns_diff_global_host_connect_to_local_vm_fails
• ns_diff_global_vm_connect_to_global_host_ok
• ns_diff_global_vm_connect_to_local_host_fails
• ns_diff_local_host_connect_to_local_vm_fails
• ns_diff_local_vm_connect_to_local_host_fails
• ns_diff_global_to_local_loopback_local_fails
• ns_diff_local_to_global_loopback_fails
• ns_diff_local_to_local_loopback_fails
• ns_diff_global_to_global_loopback_ok
• ns_same_local_loopback_ok
• ns_same_local_host_connect_to_local_vm_ok
• ns_same_local_vm_connect_to_local_host_ok

) readonly TEST_DESCS=( # vm_server_host_client @@ -82,6 +96,45 @@ readonly TEST_DESCS=(

# ns_local_global_same_cid_ok "Check QEMU successfully starts one VM in a local ns and then another VM in a global ns with the same CID."

• # ns_diff_global_host_connect_to_global_vm_ok
• "Run vsock_test client in global ns with server in VM in another global ns."
• # ns_diff_global_host_connect_to_local_vm_fails
• "Run socat to test a process in a global ns fails to connect to a VM in a local ns."
• # ns_diff_global_vm_connect_to_global_host_ok
• "Run vsock_test client in VM in a global ns with server in another global ns."
• # ns_diff_global_vm_connect_to_local_host_fails
• "Run socat to test a VM in a global ns fails to connect to a host process in a local ns."
• # ns_diff_local_host_connect_to_local_vm_fails
• "Run socat to test a host process in a local ns fails to connect to a VM in another local ns."
• # ns_diff_local_vm_connect_to_local_host_fails
• "Run socat to test a VM in a local ns fails to connect to a host process in another local ns."
• # ns_diff_global_to_local_loopback_local_fails
• "Run socat to test a loopback vsock in a global ns fails to connect to a vsock in a local ns."
• # ns_diff_local_to_global_loopback_fails
• "Run socat to test a loopback vsock in a local ns fails to connect to a vsock in a global ns."
• # ns_diff_local_to_local_loopback_fails
• "Run socat to test a loopback vsock in a local ns fails to connect to a vsock in another local ns."
• # ns_diff_global_to_global_loopback_ok
• "Run socat to test a loopback vsock in a global ns successfully connects to a vsock in another global ns."
• # ns_same_local_loopback_ok
• "Run socat to test a loopback vsock in a local ns successfully connects to a vsock in the same ns."
• # ns_same_local_host_connect_to_local_vm_ok
• "Run vsock_test client in a local ns with server in VM in same ns."
• # ns_same_local_vm_connect_to_local_host_ok
• "Run vsock_test client in VM in a local ns with server in same ns."

)

readonly USE_SHARED_VM=( @@ -112,7 +165,7 @@ usage() { for ((i = 0; i < ${#TEST_NAMES[@]}; i++)); do name=${TEST_NAMES[${i}]} desc=${TEST_DESCS[${i}]}

• printf "\t%-35s%-35s\n" "${name}" "${desc}"
  

• printf "\t%-55s%-35s\n" "${name}" "${desc}"
  

  done echo

@@ -231,7 +284,7 @@ check_args() { }

check_deps() {

• for dep in vng ${QEMU} busybox pkill ssh ss; do

• for dep in vng ${QEMU} busybox pkill ssh ss socat; do if [[ ! -x $(command -v "${dep}") ]]; then echo -e "skip: dependency ${dep} not found!\n" exit "${KSFT_SKIP}"

@@ -282,6 +335,20 @@ check_vng() { fi }

+check_socat() {

• local support_string
• support_string="$(socat -V)"
• if [[ "${support_string}" != *"WITH_VSOCK 1"* ]]; then

• die "err: socat is missing vsock support"
  

• fi
• if [[ "${support_string}" != *"WITH_UNIX 1"* ]]; then

• die "err: socat is missing unix support"
  

• fi

+}

handle_build() { if [[ ! "${BUILD}" -eq 1 ]]; then return @@ -330,6 +397,14 @@ terminate_pidfiles() { done }

+terminate_pids() {

• local pid
• for pid in "$@"; do

• kill -SIGTERM "${pid}" &>/dev/null || :
  

• done

+}

vm_start() { local pidfile=$1 local ns=$2 @@ -468,6 +543,28 @@ vm_dmesg_warn_count() { vm_ssh "${ns}" -- dmesg --level=warn 2>/dev/null | grep -c -i 'vsock' }

+vm_dmesg_check() {

• local pidfile=$1
• local ns=$2
• local oops_before=$3
• local warn_before=$4
• local oops_after warn_after
• oops_after=$(vm_dmesg_oops_count "${ns}")
• if [[ "${oops_after}" -gt "${oops_before}" ]]; then

• echo "FAIL: kernel oops detected on vm in ns ${ns}" | log_host
  

• return 1
  

• fi
• warn_after=$(vm_dmesg_warn_count "${ns}")
• if [[ "${warn_after}" -gt "${warn_before}" ]]; then

• echo "FAIL: kernel warning detected on vm in ns ${ns}" | log_host
  

• return 1
  

• fi
• return 0

+}

vm_vsock_test() { local ns=$1 local host=$2 @@ -511,6 +608,8 @@ host_vsock_test() { local host=$2 local cid=$3 local port=$4

• shift 4

• local extra_args=("$@") local rc

  local cmd="${VSOCK_TEST}"

@@ -525,13 +624,15 @@ host_vsock_test() { --mode=client \ --peer-cid="${cid}" \ --control-host="${host}" \

• 	--control-port="${port}" 2>&1 | log_host
  

• 	--control-port="${port}" \
  

• 	"${extra_args[@]}" 2>&1 | log_host
  

  rc=$? else ${cmd} \ --mode=server \ --peer-cid="${cid}" \

• 	--control-port="${port}" 2>&1 | log_host &
  

• 	--control-port="${port}" \
  

• 	"${extra_args[@]}" 2>&1 | log_host &
  

  rc=$?

  if [[ $rc -ne 0 ]]; then

@@ -592,6 +693,468 @@ test_ns_host_vsock_ns_mode_ok() { return "${KSFT_PASS}" }

+test_ns_diff_global_host_connect_to_global_vm_ok() {

• local oops_before warn_before
• local pids pid pidfile
• local ns0 ns1 port
• declare -a pids
• local unixfile
• ns0="global0"
• ns1="global1"
• port=1234
• local rc
• init_namespaces
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns0}"; then

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns0}"
• oops_before=$(vm_dmesg_oops_count "${ns0}")
• warn_before=$(vm_dmesg_warn_count "${ns0}")
• unixfile=$(mktemp -u /tmp/XXXX.sock)
• ip netns exec "${ns1}" \

• socat TCP-LISTEN:"${TEST_HOST_PORT}",fork \
  

• 	UNIX-CONNECT:"${unixfile}" &
  

• pids+=($!)
• host_wait_for_listener "${ns1}" "${TEST_HOST_PORT}" "tcp"
• ip netns exec "${ns0}" socat UNIX-LISTEN:"${unixfile}",fork \

• TCP-CONNECT:localhost:"${TEST_HOST_PORT}" &
  

• pids+=($!)
• host_wait_for_listener "${ns0}" "${unixfile}" "unix"
• vm_vsock_test "${ns0}" "server" 2 "${TEST_GUEST_PORT}"
• vm_wait_for_listener "${ns0}" "${TEST_GUEST_PORT}" "tcp"
• host_vsock_test "${ns1}" "127.0.0.1" "${VSOCK_CID}" "${TEST_HOST_PORT}"
• rc=$?
• vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pids "${pids[@]}"
• terminate_pidfiles "${pidfile}"
• if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

+test_ns_diff_global_host_connect_to_local_vm_fails() {

• local oops_before warn_before
• local ns0="global0"
• local ns1="local0"
• local port=12345
• local dmesg_rc
• local pidfile
• local result
• local pid
• init_namespaces
• outfile=$(mktemp)
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns1}"; then

• log_host "failed to start vm (cid=${VSOCK_CID}, ns=${ns0})"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns1}"
• oops_before=$(vm_dmesg_oops_count "${ns1}")
• warn_before=$(vm_dmesg_warn_count "${ns1}")
• vm_ssh "${ns1}" -- socat VSOCK-LISTEN:"${port}" STDOUT > "${outfile}" &
• vm_wait_for_listener "${ns1}" "${port}" "vsock"
• echo TEST | ip netns exec "${ns0}" \

• socat STDIN VSOCK-CONNECT:"${VSOCK_CID}":"${port}" 2>/dev/null
  

• vm_dmesg_check "${pidfile}" "${ns1}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" == "TEST" ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

+test_ns_diff_global_vm_connect_to_global_host_ok() {

• local oops_before warn_before
• local ns0="global0"
• local ns1="global1"
• local port=12345
• local unixfile
• local dmesg_rc
• local pidfile
• local pids
• local rc
• init_namespaces
• declare -a pids
• log_host "Setup socat bridge from ns ${ns0} to ns ${ns1} over port ${port}"
• unixfile=$(mktemp -u /tmp/XXXX.sock)
• ip netns exec "${ns0}" \

• socat TCP-LISTEN:"${port}" UNIX-CONNECT:"${unixfile}" &
  

• pids+=($!)
• host_wait_for_listener "${ns0}" "${port}" "tcp"
• ip netns exec "${ns1}" \

• socat UNIX-LISTEN:"${unixfile}" TCP-CONNECT:127.0.0.1:"${port}" &
  

• pids+=($!)
• host_wait_for_listener "${ns1}" "${unixfile}" "unix"
• log_host "Launching ${VSOCK_TEST} in ns ${ns1}"
• host_vsock_test "${ns1}" "server" "${VSOCK_CID}" "${port}"
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns0}"; then

• log_host "failed to start vm (cid=${cid}, ns=${ns0})"
  

• terminate_pids "${pids[@]}"
  

• rm -f "${unixfile}"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns0}"
• oops_before=$(vm_dmesg_oops_count "${ns0}")
• warn_before=$(vm_dmesg_warn_count "${ns0}")
• vm_vsock_test "${ns0}" "10.0.2.2" 2 "${port}"
• rc=$?
• vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• terminate_pids "${pids[@]}"
• rm -f "${unixfile}"
• if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

+test_ns_diff_global_vm_connect_to_local_host_fails() {

• local ns0="global0"
• local ns1="local0"
• local port=12345
• local oops_before warn_before
• local dmesg_rc
• local pidfile
• local result
• local pid
• init_namespaces
• log_host "Launching socat in ns ${ns1}"
• outfile=$(mktemp)
• ip netns exec "${ns1}" socat VSOCK-LISTEN:"${port}" STDOUT &> "${outfile}" &
• pid=$!
• host_wait_for_listener "${ns1}" "${port}" "vsock"
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns0}"; then

• log_host "failed to start vm (cid=${cid}, ns=${ns0})"
  

• terminate_pids "${pid}"
  

• rm -f "${outfile}"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns0}"
• oops_before=$(vm_dmesg_oops_count "${ns0}")
• warn_before=$(vm_dmesg_warn_count "${ns0}")
• vm_ssh "${ns0}" -- \

• bash -c "echo TEST | socat STDIN VSOCK-CONNECT:2:${port}" 2>&1 | log_guest
  

• vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• terminate_pids "${pid}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" != TEST ]] && [[ "${dmesg_rc}" -eq 0 ]]; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_local_host_connect_to_local_vm_fails() {

• local ns0="local0"
• local ns1="local1"
• local port=12345
• local oops_before warn_before
• local dmesg_rc
• local pidfile
• local result
• local pid
• init_namespaces
• outfile=$(mktemp)
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns1}"; then

• log_host "failed to start vm (cid=${cid}, ns=${ns0})"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns1}"
• oops_before=$(vm_dmesg_oops_count "${ns1}")
• warn_before=$(vm_dmesg_warn_count "${ns1}")
• vm_ssh "${ns1}" -- socat VSOCK-LISTEN:"${port}" STDOUT > "${outfile}" &
• vm_wait_for_listener "${ns1}" "${port}" "vsock"
• echo TEST | ip netns exec "${ns0}" \

• socat STDIN VSOCK-CONNECT:"${VSOCK_CID}":"${port}" 2>/dev/null
  

• vm_dmesg_check "${pidfile}" "${ns1}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" != TEST ]] && [[ "${dmesg_rc}" -eq 0 ]]; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_local_vm_connect_to_local_host_fails() {

• local oops_before warn_before
• local ns0="local0"
• local ns1="local1"
• local port=12345
• local dmesg_rc
• local pidfile
• local result
• local pid
• init_namespaces
• log_host "Launching socat in ns ${ns1}"
• outfile=$(mktemp)
• ip netns exec "${ns1}" socat VSOCK-LISTEN:"${port}" STDOUT &> "${outfile}" &
• pid=$!
• host_wait_for_listener "${ns1}" "${port}" "vsock"
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns0}"; then

• log_host "failed to start vm (cid=${cid}, ns=${ns0})"
  

• rm -f "${outfile}"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns0}"
• oops_before=$(vm_dmesg_oops_count "${ns0}")
• warn_before=$(vm_dmesg_warn_count "${ns0}")
• vm_ssh "${ns0}" -- \

• bash -c "echo TEST | socat STDIN VSOCK-CONNECT:2:${port}" 2>&1 | log_guest
  

• vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• terminate_pids "${pid}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" != TEST ]] && [[ "${dmesg_rc}" -eq 0 ]]; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+__test_loopback_two_netns() {

• local ns0=$1
• local ns1=$2
• local port=12345
• local result
• local pid
• modprobe vsock_loopback &> /dev/null || :
• log_host "Launching socat in ns ${ns1}"
• outfile=$(mktemp)
• ip netns exec "${ns1}" socat VSOCK-LISTEN:"${port}" STDOUT > "${outfile}" 2>/dev/null &
• pid=$!
• host_wait_for_listener "${ns1}" "${port}" "vsock"
• log_host "Launching socat in ns ${ns0}"
• echo TEST | ip netns exec "${ns0}" socat STDIN VSOCK-CONNECT:1:"${port}" 2>/dev/null
• terminate_pids "${pid}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" == TEST ]]; then

• return 0
  

• fi
• return 1

+}

+test_ns_diff_global_to_local_loopback_local_fails() {

• init_namespaces
• if ! __test_loopback_two_netns "global0" "local0"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_local_to_global_loopback_fails() {

• init_namespaces
• if ! __test_loopback_two_netns "local0" "global0"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_local_to_local_loopback_fails() {

• init_namespaces
• if ! __test_loopback_two_netns "local0" "local1"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_global_to_global_loopback_ok() {

• init_namespaces
• if __test_loopback_two_netns "global0" "global1"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_same_local_loopback_ok() {

• init_namespaces
• if __test_loopback_two_netns "local0" "local0"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_same_local_host_connect_to_local_vm_ok() {

• local oops_before warn_before
• local ns="local0"
• local port=1234
• local dmesg_rc
• local pidfile
• local rc
• init_namespaces
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns}"; then

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns}"
• oops_before=$(vm_dmesg_oops_count "${ns}")
• warn_before=$(vm_dmesg_warn_count "${ns}")
• vm_vsock_test "${ns}" "server" 2 "${TEST_GUEST_PORT}"
• # Skip test 29 (transport release use-after-free): This test attempts
• # binding both G2H and H2G CIDs. Because virtio-vsock (G2H) doesn't
• # support local namespaces the test will fail when
• # transport_g2h->stream_allow() returns false. This edge case only
• # happens for vsock_test in client mode on the host in a local
• # namespace. This is a false positive.
• host_vsock_test "${ns}" "127.0.0.1" "${VSOCK_CID}" "${TEST_HOST_PORT}" --skip=29
• rc=$?
• vm_dmesg_check "${pidfile}" "${ns}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

+test_ns_same_local_vm_connect_to_local_host_ok() {

• local oops_before warn_before
• local ns="local0"
• local port=1234
• local dmesg_rc
• local pidfile
• local rc
• init_namespaces
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns}"; then

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns}"
• oops_before=$(vm_dmesg_oops_count "${ns}")
• warn_before=$(vm_dmesg_warn_count "${ns}")
• host_vsock_test "${ns}" "server" "${VSOCK_CID}" "${port}"
• vm_vsock_test "${ns}" "10.0.2.2" 2 "${port}"
• rc=$?
• vm_dmesg_check "${pidfile}" "${ns}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

namespaces_can_boot_same_cid() { local ns0=$1 local ns1=$2 @@ -869,6 +1432,7 @@ fi check_args "${ARGS[@]}" check_deps check_vng +check_socat handle_build

echo "1..${#ARGS[@]}"

-- 2.47.3

On Thu, Nov 27, 2025 at 03:25:32PM +0100, Stefano Garzarella wrote:

On Wed, Nov 26, 2025 at 11:47:31PM -0800, Bobby Eshleman wrote:

...

From: Bobby Eshleman bobbyeshleman@meta.com

Add netns logic to vsock core. Additionally, modify transport hook prototypes to be used by later transport-specific patches (e.g., *_seqpacket_allow()).

Namespaces are supported primarily by changing socket lookup functions (e.g., vsock_find_connected_socket()) to take into account the socket namespace and the namespace mode before considering a candidate socket a "match".

This patch also introduces the sysctl /proc/sys/net/vsock/ns_mode that accepts the "global" or "local" mode strings.

Add netns functionality (initialization, passing to transports, procfs, etc...) to the af_vsock socket layer. Later patches that add netns support to transports depend on this patch.

dgram_allow(), stream_allow(), and seqpacket_allow() callbacks are modified to take a vsk in order to perform logic on namespace modes. In future patches, the net and net_mode will also be used for socket lookups in these functions.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com

Changes in v12:

• return true in dgram_allow(), stream_allow(), and seqpacket_allow()

only if net_mode == VSOCK_NET_MODE_GLOBAL (Stefano)

• document bind(VMADDR_CID_ANY) case in af_vsock.c (Stefano)
• change order of stream_allow() call in vmci so we can pass vsk

to it

Changes in v10:

• add file-level comment about what happens to sockets/devices

when the namespace mode changes (Stefano)

• change the 'if (write)' boolean in vsock_net_mode_string() to

if (!write), this simplifies a later patch which adds "goto" for mutex unlocking on function exit.

Changes in v9:

• remove virtio_vsock_alloc_rx_skb() (Stefano)
• remove vsock_global_dummy_net, not needed as net=NULL +

net_mode=VSOCK_NET_MODE_GLOBAL achieves identical result

Changes in v7:

• hv_sock: fix hyperv build error
• explain why vhost does not use the dummy
• explain usage of __vsock_global_dummy_net
• explain why VSOCK_NET_MODE_STR_MAX is 8 characters
• use switch-case in vsock_net_mode_string()
• avoid changing transports as much as possible
• add vsock_find_{bound,connected}_socket_net()
• rename `vsock_hdr` to `sysctl_hdr`
• add virtio_vsock_alloc_linear_skb() wrapper for setting dummy net and

global mode for virtio-vsock, move skb->cb zero-ing into wrapper

• explain seqpacket_allow() change
• move net setting to __vsock_create() instead of vsock_create() so

that child sockets also have their net assigned upon accept()

Changes in v6:

• unregister sysctl ops in vsock_exit()
• af_vsock: clarify description of CID behavior
• af_vsock: fix buf vs buffer naming, and length checking
• af_vsock: fix length checking w/ correct ctl_table->maxlen

Changes in v5:

• vsock_global_net() -> vsock_global_dummy_net()
• update comments for new uAPI
• use /proc/sys/net/vsock/ns_mode instead of /proc/net/vsock_ns_mode
• add prototype changes so patch remains compilable

---

drivers/vhost/vsock.c | 9 +- include/linux/virtio_vsock.h | 4 +- include/net/af_vsock.h | 13 +- net/vmw_vsock/af_vsock.c | 272 +++++++++++++++++++++++++++++--- net/vmw_vsock/hyperv_transport.c | 7 +- net/vmw_vsock/virtio_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 6 +- net/vmw_vsock/vmci_transport.c | 26 ++- net/vmw_vsock/vsock_loopback.c | 8 +- 9 files changed, 310 insertions(+), 44 deletions(-)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index ae01457ea2cd..83937e1d63fa 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -404,7 +404,8 @@ static bool vhost_transport_msgzerocopy_allow(void) return true; }

-static bool vhost_transport_seqpacket_allow(u32 remote_cid); +static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk,

• 			    u32 remote_cid);
  
  

static struct virtio_transport vhost_transport = { .transport = { @@ -460,11 +461,15 @@ static struct virtio_transport vhost_transport = { .send_pkt = vhost_transport_send_pkt, };

-static bool vhost_transport_seqpacket_allow(u32 remote_cid) +static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk,

• 			    u32 remote_cid)
  

{ struct vhost_vsock *vsock; bool seqpacket_allow = false;

• if (vsk->net_mode != VSOCK_NET_MODE_GLOBAL)

• return false;
  

• rcu_read_lock(); vsock = vhost_vsock_get(remote_cid);

diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h index 0c67543a45c8..1845e8d4f78d 100644 --- a/include/linux/virtio_vsock.h +++ b/include/linux/virtio_vsock.h @@ -256,10 +256,10 @@ void virtio_transport_notify_buffer_size(struct vsock_sock *vsk, u64 *val);

u64 virtio_transport_stream_rcvhiwat(struct vsock_sock *vsk); bool virtio_transport_stream_is_active(struct vsock_sock *vsk); -bool virtio_transport_stream_allow(u32 cid, u32 port); +bool virtio_transport_stream_allow(struct vsock_sock *vsk, u32 cid, u32 port); int virtio_transport_dgram_bind(struct vsock_sock *vsk, struct sockaddr_vm *addr); -bool virtio_transport_dgram_allow(u32 cid, u32 port); +bool virtio_transport_dgram_allow(struct vsock_sock *vsk, u32 cid, u32 port);

int virtio_transport_connect(struct vsock_sock *vsk);

diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index 9b5bdd083b6f..d10e73cd7413 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -126,7 +126,7 @@ struct vsock_transport { size_t len, int flags); int (*dgram_enqueue)(struct vsock_sock *, struct sockaddr_vm *, struct msghdr *, size_t len);

• bool (*dgram_allow)(u32 cid, u32 port);

• bool (*dgram_allow)(struct vsock_sock *vsk, u32 cid, u32 port);

  /* STREAM. */ /* TODO: stream_bind() */

@@ -138,14 +138,14 @@ struct vsock_transport { s64 (*stream_has_space)(struct vsock_sock *); u64 (*stream_rcvhiwat)(struct vsock_sock *); bool (*stream_is_active)(struct vsock_sock *);

• bool (*stream_allow)(u32 cid, u32 port);

• bool (*stream_allow)(struct vsock_sock *vsk, u32 cid, u32 port);

  /* SEQ_PACKET. */ ssize_t (*seqpacket_dequeue)(struct vsock_sock *vsk, struct msghdr *msg, int flags); int (*seqpacket_enqueue)(struct vsock_sock *vsk, struct msghdr *msg, size_t len);

• bool (*seqpacket_allow)(u32 remote_cid);

• bool (*seqpacket_allow)(struct vsock_sock *vsk, u32 remote_cid); u32 (*seqpacket_has_data)(struct vsock_sock *vsk);

  /* Notification. */

@@ -218,6 +218,13 @@ void vsock_remove_connected(struct vsock_sock *vsk); struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr); struct sock *vsock_find_connected_socket(struct sockaddr_vm *src, struct sockaddr_vm *dst); +struct sock *vsock_find_bound_socket_net(struct sockaddr_vm *addr,

• 			 struct net *net,
  

• 			 enum vsock_net_mode net_mode);
  

+struct sock *vsock_find_connected_socket_net(struct sockaddr_vm *src,

• 			     struct sockaddr_vm *dst,
  

• 			     struct net *net,
  

• 			     enum vsock_net_mode net_mode);
  

void vsock_remove_sock(struct vsock_sock *vsk); void vsock_for_each_connected_socket(struct vsock_transport *transport, void (*fn)(struct sock *sk)); diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index adcba1b7bf74..6113c22db8dc 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -83,6 +83,46 @@

• TCP_ESTABLISHED - connected
• TCP_CLOSING - disconnecting
• TCP_LISTEN - listening

• • • Namespaces in vsock support two different modes configured
• • through /proc/sys/net/vsock/ns_mode. The modes are "local" and "global".
• • Each mode defines how the namespace interacts with CIDs.
• • /proc/sys/net/vsock/ns_mode is write-once, so that it may be configured
• • and locked down by a namespace manager. The default is "global". The mode
• • is set per-namespace.
• • The modes affect the allocation and accessibility of CIDs as follows:
• • • global - access and allocation are all system-wide

nit: maybe we should mention that this mode is primarily for backward compatibility, since it's the way how vsock worked before netns support.

(We can fix later eventually with a followup patch)

...

• •  - all CID allocation from global namespaces draw from the same
    

• •    system-wide pool.
    

• •  - if one global namespace has already allocated some CID, another
    

• •    global namespace will not be able to allocate the same CID.
    

• •  - global mode AF_VSOCK sockets can reach any VM or socket in any global
    

• •    namespace, they are not contained to only their own namespace.
    

• •  - AF_VSOCK sockets in a global mode namespace cannot reach VMs or
    

• •    sockets in any local mode namespace.
    

• • • local - access and allocation are contained within the namespace

• • - CID allocation draws only from a private pool local only to the
    

• •   namespace, and does not affect the CIDs available for allocation in any
    

• •   other namespace (global or local).
    

• • - VMs in a local namespace do not collide with CIDs in any other local
    

• •   namespace or any global namespace. For example, if a VM in a local mode
    

• •   namespace is given CID 10, then CID 10 is still available for
    

• •   allocation in any other namespace, but not in the same namespace.
    

• • - AF_VSOCK sockets in a local mode namespace can connect only to VMs or
    

• •   other sockets within their own namespace.
    

• • - sockets bound to VMADDR_CID_ANY in local namespaces will never resolve
    

• •   to any transport that is not compatible with local mode. There is no
    

• •   error that propagates to the user (as there is for connection attempts)
    

• •   because it is possible for some packet to reach this socket from
    

• •   a different transport that *does* support local mode. For
    

• •   example, virtio-vsock may not support local mode, but the socket
    

• •   may still accept a connection from vhost-vsock which does.
    

• • • when a socket or device is initialized in a namespace with mode

• • global, it will stay in global mode even if the namespace later
    

• • changes to local.
    

*/

#include <linux/compat.h> @@ -100,6 +140,7 @@ #include <linux/module.h> #include <linux/mutex.h> #include <linux/net.h> +#include <linux/proc_fs.h> #include <linux/poll.h> #include <linux/random.h> #include <linux/skbuff.h> @@ -111,9 +152,18 @@ #include <linux/workqueue.h> #include <net/sock.h> #include <net/af_vsock.h> +#include <net/netns/vsock.h> #include <uapi/linux/vm_sockets.h> #include <uapi/asm-generic/ioctls.h>

+#define VSOCK_NET_MODE_STR_GLOBAL "global" +#define VSOCK_NET_MODE_STR_LOCAL "local"

+/* 6 chars for "global", 1 for null-terminator, and 1 more for '\n'.

• • The newline is added by proc_dostring() for read operations.
• */

+#define VSOCK_NET_MODE_STR_MAX 8

static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr); static void vsock_sk_destruct(struct sock *sk); static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); @@ -235,33 +285,47 @@ static void __vsock_remove_connected(struct vsock_sock *vsk) sock_put(&vsk->sk); }

-static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr) +static struct sock *__vsock_find_bound_socket_net(struct sockaddr_vm *addr,

• 				  struct net *net,
  

• 				  enum vsock_net_mode net_mode)
  

{ struct vsock_sock *vsk;

list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table) {

• if (vsock_addr_equals_addr(addr, &vsk->local_addr))
  

• 	return sk_vsock(vsk);
  

• struct sock *sk = sk_vsock(vsk);
  

• if (vsock_addr_equals_addr(addr, &vsk->local_addr) &&
  

•     vsock_net_check_mode(sock_net(sk), vsk->net_mode, net,
  

• 			 net_mode))
  

• 	return sk;
  
  

  if (addr->svm_port == vsk->local_addr.svm_port && (vsk->local_addr.svm_cid == VMADDR_CID_ANY ||

•      addr->svm_cid == VMADDR_CID_ANY))
  

• 	return sk_vsock(vsk);
  

•      addr->svm_cid == VMADDR_CID_ANY) &&
  

•      vsock_net_check_mode(sock_net(sk), vsk->net_mode, net,
  

• 			  net_mode))
  

• 	return sk;
  

  }

  return NULL;

}

-static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src,

• 				  struct sockaddr_vm *dst)
  

+static struct sock * +__vsock_find_connected_socket_net(struct sockaddr_vm *src,

• 		  struct sockaddr_vm *dst, struct net *net,
  

• 		  enum vsock_net_mode net_mode)
  

{ struct vsock_sock *vsk;

list_for_each_entry(vsk, vsock_connected_s)ckets(src, dst), connected_table) {

• struct sock *sk = sk_vsock(vsk);
  

• if (vsock_addr_equals_addr(src, &vsk->remote_addr) &&

•     dst->svm_port == vsk->local_addr.svm_port) {
  

• 	return sk_vsock(vsk);
  

•     dst->svm_port == vsk->local_addr.svm_port &&
  

•     vsock_net_check_mode(sock_net(sk), vsk->net_mode, net,
  

• 			 net_mode)) {
  

• 	return sk;
  

  } }

@@ -304,12 +368,14 @@ void vsock_remove_connected(struct vsock_sock *vsk) } EXPORT_SYMBOL_GPL(vsock_remove_connected);

-struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr) +struct sock *vsock_find_bound_socket_net(struct sockaddr_vm *addr,

• 			 struct net *net,
  

• 			 enum vsock_net_mode net_mode)
  

{ struct sock *sk;

spin_lock_bh(&vsock_table_lock);

• sk = __vsock_find_bound_socket(addr);

• sk = __vsock_find_bound_socket_net(addr, net, net_mode); if (sk) sock_hold(sk);

@@ -317,15 +383,23 @@ struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr)

return sk; } +EXPORT_SYMBOL_GPL(vsock_find_bound_socket_net);

+struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr) +{

• return vsock_find_bound_socket_net(addr, NULL, VSOCK_NET_MODE_GLOBAL);

The patch LGTM, my last doubt now is if here (and in vsock_find_connected_socket() ) we should use `init_net`.

In practice, this is the namespace (NULL) and mode (GLOBAL) used by transports that do not support namespaces.

So here we are making them belong to no namespace, so they can only reach global ones. When any namespace, including `init_net`, switches to local, it can no longer be reached by transports that do not support local namespaces, because in practice we still do not have a way to associate a device (in the case of drivers) with a specific namespace. Right?

Right.

If I get it right, it can makes sense, but I'd like an ack from net maintainers to be sure we are doing the right things.

Also I think we should have a comment on top of this function to make it clear that should be used only by transport that doesn't support namespace, and the reason why we used NULL and GLOBAL. Plus a comment on top of this file (near where we described local vs global) to clarify the status of this.

That said, if next week net-next will close, I think we can send a follow-up patch just for those comments, so:

Sounds good, I'll wait for further feedback before sending anything!

Reviewed-by: Stefano Garzarella sgarzare@redhat.com

...

+} EXPORT_SYMBOL_GPL(vsock_find_bound_socket);

-struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,

• 			 struct sockaddr_vm *dst)
  

+struct sock *vsock_find_connected_socket_net(struct sockaddr_vm *src,

• 			     struct sockaddr_vm *dst,
  

• 			     struct net *net,
  

• 			     enum vsock_net_mode net_mode)
  

{ struct sock *sk;

spin_lock_bh(&vsock_table_lock);

• sk = __vsock_find_connected_socket(src, dst);

• sk = __vsock_find_connected_socket_net(src, dst, net, net_mode); if (sk) sock_hold(sk);

@@ -333,6 +407,14 @@ struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,

return sk; } +EXPORT_SYMBOL_GPL(vsock_find_connected_socket_net);

+struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,

• 			 struct sockaddr_vm *dst)
  

+{

• return vsock_find_connected_socket_net(src, dst,

• 			       NULL, VSOCK_NET_MODE_GLOBAL);
  

+} EXPORT_SYMBOL_GPL(vsock_find_connected_socket);