net/core/neighbour.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Generic address resolution entity
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   8  *
   9  *      Fixes:
  10  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  11  *      Harald Welte            Add neighbour cache statistics like rtstat
  12  */
  13
  14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  15
  16 #include <linux/slab.h>
  17 #include <linux/kmemleak.h>
  18 #include <linux/types.h>
  19 #include <linux/kernel.h>
  20 #include <linux/module.h>
  21 #include <linux/socket.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/proc_fs.h>
  24 #ifdef CONFIG_SYSCTL
  25 #include <linux/sysctl.h>
  26 #endif
  27 #include <linux/times.h>
  28 #include <net/net_namespace.h>
  29 #include <net/neighbour.h>
  30 #include <net/arp.h>
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/netevent.h>
  34 #include <net/netlink.h>
  35 #include <linux/rtnetlink.h>
  36 #include <linux/random.h>
  37 #include <linux/string.h>
  38 #include <linux/log2.h>
  39 #include <linux/inetdevice.h>
  40 #include <net/addrconf.h>
  41
  42 #include <trace/events/neigh.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(struct timer_list *t);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags,
  56                            u32 pid);
  57 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  58 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
  59                                     struct net_device *dev);
  60
  61 #ifdef CONFIG_PROC_FS
  62 static const struct seq_operations neigh_stat_seq_ops;
  63 #endif
  64
  65 /*
  66    Neighbour hash table buckets are protected with rwlock tbl->lock.
  67
  68    - All the scans/updates to hash buckets MUST be made under this lock.
  69    - NOTHING clever should be made under this lock: no callbacks
  70      to protocol backends, no attempts to send something to network.
  71      It will result in deadlocks, if backend/driver wants to use neighbour
  72      cache.
  73    - If the entry requires some non-trivial actions, increase
  74      its reference count and release table lock.
  75
  76    Neighbour entries are protected:
  77    - with reference count.
  78    - with rwlock neigh->lock
  79
  80    Reference count prevents destruction.
  81
  82    neigh->lock mainly serializes ll address data and its validity state.
  83    However, the same lock is used to protect another entry fields:
  84     - timer
  85     - resolution queue
  86
  87    Again, nothing clever shall be made under neigh->lock,
  88    the most complicated procedure, which we allow is dev->hard_header.
  89    It is supposed, that dev->hard_header is simplistic and does
  90    not make callbacks to neighbour tables.
  91  */
  92
  93 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  94 {
  95         kfree_skb(skb);
  96         return -ENETDOWN;
  97 }
  98
  99 static void neigh_cleanup_and_release(struct neighbour *neigh)
 100 {
 101         trace_neigh_cleanup_and_release(neigh, 0);
 102         __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 103         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 104         neigh_release(neigh);
 105 }
 106
 107 /*
 108  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 109  * It corresponds to default IPv6 settings and is not overridable,
 110  * because it is really reasonable choice.
 111  */
 112
 113 unsigned long neigh_rand_reach_time(unsigned long base)
 114 {
 115         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 116 }
 117 EXPORT_SYMBOL(neigh_rand_reach_time);
 118
 119 static void neigh_mark_dead(struct neighbour *n)
 120 {
 121         n->dead = 1;
 122         if (!list_empty(&n->gc_list)) {
 123                 list_del_init(&n->gc_list);
 124                 atomic_dec(&n->tbl->gc_entries);
 125         }
 126 }
 127
 128 static void neigh_update_gc_list(struct neighbour *n)
 129 {
 130         bool on_gc_list, exempt_from_gc;
 131
 132         write_lock_bh(&n->tbl->lock);
 133         write_lock(&n->lock);
 134
 135         /* remove from the gc list if new state is permanent or if neighbor
 136          * is externally learned; otherwise entry should be on the gc list
 137          */
 138         exempt_from_gc = n->nud_state & NUD_PERMANENT ||
 139                          n->flags & NTF_EXT_LEARNED;
 140         on_gc_list = !list_empty(&n->gc_list);
 141
 142         if (exempt_from_gc && on_gc_list) {
 143                 list_del_init(&n->gc_list);
 144                 atomic_dec(&n->tbl->gc_entries);
 145         } else if (!exempt_from_gc && !on_gc_list) {
 146                 /* add entries to the tail; cleaning removes from the front */
 147                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 148                 atomic_inc(&n->tbl->gc_entries);
 149         }
 150
 151         write_unlock(&n->lock);
 152         write_unlock_bh(&n->tbl->lock);
 153 }
 154
 155 static bool neigh_update_ext_learned(struct neighbour *neigh, u32 flags,
 156                                      int *notify)
 157 {
 158         bool rc = false;
 159         u8 ndm_flags;
 160
 161         if (!(flags & NEIGH_UPDATE_F_ADMIN))
 162                 return rc;
 163
 164         ndm_flags = (flags & NEIGH_UPDATE_F_EXT_LEARNED) ? NTF_EXT_LEARNED : 0;
 165         if ((neigh->flags ^ ndm_flags) & NTF_EXT_LEARNED) {
 166                 if (ndm_flags & NTF_EXT_LEARNED)
 167                         neigh->flags |= NTF_EXT_LEARNED;
 168                 else
 169                         neigh->flags &= ~NTF_EXT_LEARNED;
 170                 rc = true;
 171                 *notify = 1;
 172         }
 173
 174         return rc;
 175 }
 176
 177 static bool neigh_del(struct neighbour *n, struct neighbour __rcu **np,
 178                       struct neigh_table *tbl)
 179 {
 180         bool retval = false;
 181
 182         write_lock(&n->lock);
 183         if (refcount_read(&n->refcnt) == 1) {
 184                 struct neighbour *neigh;
 185
 186                 neigh = rcu_dereference_protected(n->next,
 187                                                   lockdep_is_held(&tbl->lock));
 188                 rcu_assign_pointer(*np, neigh);
 189                 neigh_mark_dead(n);
 190                 retval = true;
 191         }
 192         write_unlock(&n->lock);
 193         if (retval)
 194                 neigh_cleanup_and_release(n);
 195         return retval;
 196 }
 197
 198 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 199 {
 200         struct neigh_hash_table *nht;
 201         void *pkey = ndel->primary_key;
 202         u32 hash_val;
 203         struct neighbour *n;
 204         struct neighbour __rcu **np;
 205
 206         nht = rcu_dereference_protected(tbl->nht,
 207                                         lockdep_is_held(&tbl->lock));
 208         hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
 209         hash_val = hash_val >> (32 - nht->hash_shift);
 210
 211         np = &nht->hash_buckets[hash_val];
 212         while ((n = rcu_dereference_protected(*np,
 213                                               lockdep_is_held(&tbl->lock)))) {
 214                 if (n == ndel)
 215                         return neigh_del(n, np, tbl);
 216                 np = &n->next;
 217         }
 218         return false;
 219 }
 220
 221 static int neigh_forced_gc(struct neigh_table *tbl)
 222 {
 223         int max_clean = atomic_read(&tbl->gc_entries) - tbl->gc_thresh2;
 224         unsigned long tref = jiffies - 5 * HZ;
 225         struct neighbour *n, *tmp;
 226         int shrunk = 0;
 227
 228         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 229
 230         write_lock_bh(&tbl->lock);
 231
 232         list_for_each_entry_safe(n, tmp, &tbl->gc_list, gc_list) {
 233                 if (refcount_read(&n->refcnt) == 1) {
 234                         bool remove = false;
 235
 236                         write_lock(&n->lock);
 237                         if ((n->nud_state == NUD_FAILED) ||
 238                             time_after(tref, n->updated))
 239                                 remove = true;
 240                         write_unlock(&n->lock);
 241
 242                         if (remove && neigh_remove_one(n, tbl))
 243                                 shrunk++;
 244                         if (shrunk >= max_clean)
 245                                 break;
 246                 }
 247         }
 248
 249         tbl->last_flush = jiffies;
 250
 251         write_unlock_bh(&tbl->lock);
 252
 253         return shrunk;
 254 }
 255
 256 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 257 {
 258         neigh_hold(n);
 259         if (unlikely(mod_timer(&n->timer, when))) {
 260                 printk("NEIGH: BUG, double timer add, state is %x\n",
 261                        n->nud_state);
 262                 dump_stack();
 263         }
 264 }
 265
 266 static int neigh_del_timer(struct neighbour *n)
 267 {
 268         if ((n->nud_state & NUD_IN_TIMER) &&
 269             del_timer(&n->timer)) {
 270                 neigh_release(n);
 271                 return 1;
 272         }
 273         return 0;
 274 }
 275
 276 static void pneigh_queue_purge(struct sk_buff_head *list)
 277 {
 278         struct sk_buff *skb;
 279
 280         while ((skb = skb_dequeue(list)) != NULL) {
 281                 dev_put(skb->dev);
 282                 kfree_skb(skb);
 283         }
 284 }
 285
 286 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev,
 287                             bool skip_perm)
 288 {
 289         int i;
 290         struct neigh_hash_table *nht;
 291
 292         nht = rcu_dereference_protected(tbl->nht,
 293                                         lockdep_is_held(&tbl->lock));
 294
 295         for (i = 0; i < (1 << nht->hash_shift); i++) {
 296                 struct neighbour *n;
 297                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 298
 299                 while ((n = rcu_dereference_protected(*np,
 300                                         lockdep_is_held(&tbl->lock))) != NULL) {
 301                         if (dev && n->dev != dev) {
 302                                 np = &n->next;
 303                                 continue;
 304                         }
 305                         if (skip_perm && n->nud_state & NUD_PERMANENT) {
 306                                 np = &n->next;
 307                                 continue;
 308                         }
 309                         rcu_assign_pointer(*np,
 310                                    rcu_dereference_protected(n->next,
 311                                                 lockdep_is_held(&tbl->lock)));
 312                         write_lock(&n->lock);
 313                         neigh_del_timer(n);
 314                         neigh_mark_dead(n);
 315                         if (refcount_read(&n->refcnt) != 1) {
 316                                 /* The most unpleasant situation.
 317                                    We must destroy neighbour entry,
 318                                    but someone still uses it.
 319
 320                                    The destroy will be delayed until
 321                                    the last user releases us, but
 322                                    we must kill timers etc. and move
 323                                    it to safe state.
 324                                  */
 325                                 __skb_queue_purge(&n->arp_queue);
 326                                 n->arp_queue_len_bytes = 0;
 327                                 n->output = neigh_blackhole;
 328                                 if (n->nud_state & NUD_VALID)
 329                                         n->nud_state = NUD_NOARP;
 330                                 else
 331                                         n->nud_state = NUD_NONE;
 332                                 neigh_dbg(2, "neigh %p is stray\n", n);
 333                         }
 334                         write_unlock(&n->lock);
 335                         neigh_cleanup_and_release(n);
 336                 }
 337         }
 338 }
 339
 340 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 341 {
 342         write_lock_bh(&tbl->lock);
 343         neigh_flush_dev(tbl, dev, false);
 344         write_unlock_bh(&tbl->lock);
 345 }
 346 EXPORT_SYMBOL(neigh_changeaddr);
 347
 348 static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
 349                           bool skip_perm)
 350 {
 351         write_lock_bh(&tbl->lock);
 352         neigh_flush_dev(tbl, dev, skip_perm);
 353         pneigh_ifdown_and_unlock(tbl, dev);
 354
 355         del_timer_sync(&tbl->proxy_timer);
 356         pneigh_queue_purge(&tbl->proxy_queue);
 357         return 0;
 358 }
 359
 360 int neigh_carrier_down(struct neigh_table *tbl, struct net_device *dev)
 361 {
 362         __neigh_ifdown(tbl, dev, true);
 363         return 0;
 364 }
 365 EXPORT_SYMBOL(neigh_carrier_down);
 366
 367 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 368 {
 369         __neigh_ifdown(tbl, dev, false);
 370         return 0;
 371 }
 372 EXPORT_SYMBOL(neigh_ifdown);
 373
 374 static struct neighbour *neigh_alloc(struct neigh_table *tbl,
 375                                      struct net_device *dev,
 376                                      bool exempt_from_gc)
 377 {
 378         struct neighbour *n = NULL;
 379         unsigned long now = jiffies;
 380         int entries;
 381
 382         if (exempt_from_gc)
 383                 goto do_alloc;
 384
 385         entries = atomic_inc_return(&tbl->gc_entries) - 1;
 386         if (entries >= tbl->gc_thresh3 ||
 387             (entries >= tbl->gc_thresh2 &&
 388              time_after(now, tbl->last_flush + 5 * HZ))) {
 389                 if (!neigh_forced_gc(tbl) &&
 390                     entries >= tbl->gc_thresh3) {
 391                         net_info_ratelimited("%s: neighbor table overflow!\n",
 392                                              tbl->id);
 393                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 394                         goto out_entries;
 395                 }
 396         }
 397
 398 do_alloc:
 399         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 400         if (!n)
 401                 goto out_entries;
 402
 403         __skb_queue_head_init(&n->arp_queue);
 404         rwlock_init(&n->lock);
 405         seqlock_init(&n->ha_lock);
 406         n->updated        = n->used = now;
 407         n->nud_state      = NUD_NONE;
 408         n->output         = neigh_blackhole;
 409         seqlock_init(&n->hh.hh_lock);
 410         n->parms          = neigh_parms_clone(&tbl->parms);
 411         timer_setup(&n->timer, neigh_timer_handler, 0);
 412
 413         NEIGH_CACHE_STAT_INC(tbl, allocs);
 414         n->tbl            = tbl;
 415         refcount_set(&n->refcnt, 1);
 416         n->dead           = 1;
 417         INIT_LIST_HEAD(&n->gc_list);
 418
 419         atomic_inc(&tbl->entries);
 420 out:
 421         return n;
 422
 423 out_entries:
 424         if (!exempt_from_gc)
 425                 atomic_dec(&tbl->gc_entries);
 426         goto out;
 427 }
 428
 429 static void neigh_get_hash_rnd(u32 *x)
 430 {
 431         *x = get_random_u32() | 1;
 432 }
 433
 434 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 435 {
 436         size_t size = (1 << shift) * sizeof(struct neighbour *);
 437         struct neigh_hash_table *ret;
 438         struct neighbour __rcu **buckets;
 439         int i;
 440
 441         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 442         if (!ret)
 443                 return NULL;
 444         if (size <= PAGE_SIZE) {
 445                 buckets = kzalloc(size, GFP_ATOMIC);
 446         } else {
 447                 buckets = (struct neighbour __rcu **)
 448                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 449                                            get_order(size));
 450                 kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
 451         }
 452         if (!buckets) {
 453                 kfree(ret);
 454                 return NULL;
 455         }
 456         ret->hash_buckets = buckets;
 457         ret->hash_shift = shift;
 458         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 459                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 460         return ret;
 461 }
 462
 463 static void neigh_hash_free_rcu(struct rcu_head *head)
 464 {
 465         struct neigh_hash_table *nht = container_of(head,
 466                                                     struct neigh_hash_table,
 467                                                     rcu);
 468         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 469         struct neighbour __rcu **buckets = nht->hash_buckets;
 470
 471         if (size <= PAGE_SIZE) {
 472                 kfree(buckets);
 473         } else {
 474                 kmemleak_free(buckets);
 475                 free_pages((unsigned long)buckets, get_order(size));
 476         }
 477         kfree(nht);
 478 }
 479
 480 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 481                                                 unsigned long new_shift)
 482 {
 483         unsigned int i, hash;
 484         struct neigh_hash_table *new_nht, *old_nht;
 485
 486         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 487
 488         old_nht = rcu_dereference_protected(tbl->nht,
 489                                             lockdep_is_held(&tbl->lock));
 490         new_nht = neigh_hash_alloc(new_shift);
 491         if (!new_nht)
 492                 return old_nht;
 493
 494         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 495                 struct neighbour *n, *next;
 496
 497                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 498                                                    lockdep_is_held(&tbl->lock));
 499                      n != NULL;
 500                      n = next) {
 501                         hash = tbl->hash(n->primary_key, n->dev,
 502                                          new_nht->hash_rnd);
 503
 504                         hash >>= (32 - new_nht->hash_shift);
 505                         next = rcu_dereference_protected(n->next,
 506                                                 lockdep_is_held(&tbl->lock));
 507
 508                         rcu_assign_pointer(n->next,
 509                                            rcu_dereference_protected(
 510                                                 new_nht->hash_buckets[hash],
 511                                                 lockdep_is_held(&tbl->lock)));
 512                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 513                 }
 514         }
 515
 516         rcu_assign_pointer(tbl->nht, new_nht);
 517         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 518         return new_nht;
 519 }
 520
 521 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 522                                struct net_device *dev)
 523 {
 524         struct neighbour *n;
 525
 526         NEIGH_CACHE_STAT_INC(tbl, lookups);
 527
 528         rcu_read_lock_bh();
 529         n = __neigh_lookup_noref(tbl, pkey, dev);
 530         if (n) {
 531                 if (!refcount_inc_not_zero(&n->refcnt))
 532                         n = NULL;
 533                 NEIGH_CACHE_STAT_INC(tbl, hits);
 534         }
 535
 536         rcu_read_unlock_bh();
 537         return n;
 538 }
 539 EXPORT_SYMBOL(neigh_lookup);
 540
 541 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 542                                      const void *pkey)
 543 {
 544         struct neighbour *n;
 545         unsigned int key_len = tbl->key_len;
 546         u32 hash_val;
 547         struct neigh_hash_table *nht;
 548
 549         NEIGH_CACHE_STAT_INC(tbl, lookups);
 550
 551         rcu_read_lock_bh();
 552         nht = rcu_dereference_bh(tbl->nht);
 553         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 554
 555         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 556              n != NULL;
 557              n = rcu_dereference_bh(n->next)) {
 558                 if (!memcmp(n->primary_key, pkey, key_len) &&
 559                     net_eq(dev_net(n->dev), net)) {
 560                         if (!refcount_inc_not_zero(&n->refcnt))
 561                                 n = NULL;
 562                         NEIGH_CACHE_STAT_INC(tbl, hits);
 563                         break;
 564                 }
 565         }
 566
 567         rcu_read_unlock_bh();
 568         return n;
 569 }
 570 EXPORT_SYMBOL(neigh_lookup_nodev);
 571
 572 static struct neighbour *___neigh_create(struct neigh_table *tbl,
 573                                          const void *pkey,
 574                                          struct net_device *dev,
 575                                          bool exempt_from_gc, bool want_ref)
 576 {
 577         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev, exempt_from_gc);
 578         u32 hash_val;
 579         unsigned int key_len = tbl->key_len;
 580         int error;
 581         struct neigh_hash_table *nht;
 582
 583         trace_neigh_create(tbl, dev, pkey, n, exempt_from_gc);
 584
 585         if (!n) {
 586                 rc = ERR_PTR(-ENOBUFS);
 587                 goto out;
 588         }
 589
 590         memcpy(n->primary_key, pkey, key_len);
 591         n->dev = dev;
 592         dev_hold(dev);
 593
 594         /* Protocol specific setup. */
 595         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 596                 rc = ERR_PTR(error);
 597                 goto out_neigh_release;
 598         }
 599
 600         if (dev->netdev_ops->ndo_neigh_construct) {
 601                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 602                 if (error < 0) {
 603                         rc = ERR_PTR(error);
 604                         goto out_neigh_release;
 605                 }
 606         }
 607
 608         /* Device specific setup. */
 609         if (n->parms->neigh_setup &&
 610             (error = n->parms->neigh_setup(n)) < 0) {
 611                 rc = ERR_PTR(error);
 612                 goto out_neigh_release;
 613         }
 614
 615         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 616
 617         write_lock_bh(&tbl->lock);
 618         nht = rcu_dereference_protected(tbl->nht,
 619                                         lockdep_is_held(&tbl->lock));
 620
 621         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 622                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 623
 624         hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 625
 626         if (n->parms->dead) {
 627                 rc = ERR_PTR(-EINVAL);
 628                 goto out_tbl_unlock;
 629         }
 630
 631         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 632                                             lockdep_is_held(&tbl->lock));
 633              n1 != NULL;
 634              n1 = rcu_dereference_protected(n1->next,
 635                         lockdep_is_held(&tbl->lock))) {
 636                 if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) {
 637                         if (want_ref)
 638                                 neigh_hold(n1);
 639                         rc = n1;
 640                         goto out_tbl_unlock;
 641                 }
 642         }
 643
 644         n->dead = 0;
 645         if (!exempt_from_gc)
 646                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 647
 648         if (want_ref)
 649                 neigh_hold(n);
 650         rcu_assign_pointer(n->next,
 651                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 652                                                      lockdep_is_held(&tbl->lock)));
 653         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 654         write_unlock_bh(&tbl->lock);
 655         neigh_dbg(2, "neigh %p is created\n", n);
 656         rc = n;
 657 out:
 658         return rc;
 659 out_tbl_unlock:
 660         write_unlock_bh(&tbl->lock);
 661 out_neigh_release:
 662         if (!exempt_from_gc)
 663                 atomic_dec(&tbl->gc_entries);
 664         neigh_release(n);
 665         goto out;
 666 }
 667
 668 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 669                                  struct net_device *dev, bool want_ref)
 670 {
 671         return ___neigh_create(tbl, pkey, dev, false, want_ref);
 672 }
 673 EXPORT_SYMBOL(__neigh_create);
 674
 675 static u32 pneigh_hash(const void *pkey, unsigned int key_len)
 676 {
 677         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 678         hash_val ^= (hash_val >> 16);
 679         hash_val ^= hash_val >> 8;
 680         hash_val ^= hash_val >> 4;
 681         hash_val &= PNEIGH_HASHMASK;
 682         return hash_val;
 683 }
 684
 685 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 686                                               struct net *net,
 687                                               const void *pkey,
 688                                               unsigned int key_len,
 689                                               struct net_device *dev)
 690 {
 691         while (n) {
 692                 if (!memcmp(n->key, pkey, key_len) &&
 693                     net_eq(pneigh_net(n), net) &&
 694                     (n->dev == dev || !n->dev))
 695                         return n;
 696                 n = n->next;
 697         }
 698         return NULL;
 699 }
 700
 701 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 702                 struct net *net, const void *pkey, struct net_device *dev)
 703 {
 704         unsigned int key_len = tbl->key_len;
 705         u32 hash_val = pneigh_hash(pkey, key_len);
 706
 707         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 708                                  net, pkey, key_len, dev);
 709 }
 710 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 711
 712 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 713                                     struct net *net, const void *pkey,
 714                                     struct net_device *dev, int creat)
 715 {
 716         struct pneigh_entry *n;
 717         unsigned int key_len = tbl->key_len;
 718         u32 hash_val = pneigh_hash(pkey, key_len);
 719
 720         read_lock_bh(&tbl->lock);
 721         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 722                               net, pkey, key_len, dev);
 723         read_unlock_bh(&tbl->lock);
 724
 725         if (n || !creat)
 726                 goto out;
 727
 728         ASSERT_RTNL();
 729
 730         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 731         if (!n)
 732                 goto out;
 733
 734         n->protocol = 0;
 735         write_pnet(&n->net, net);
 736         memcpy(n->key, pkey, key_len);
 737         n->dev = dev;
 738         if (dev)
 739                 dev_hold(dev);
 740
 741         if (tbl->pconstructor && tbl->pconstructor(n)) {
 742                 if (dev)
 743                         dev_put(dev);
 744                 kfree(n);
 745                 n = NULL;
 746                 goto out;
 747         }
 748
 749         write_lock_bh(&tbl->lock);
 750         n->next = tbl->phash_buckets[hash_val];
 751         tbl->phash_buckets[hash_val] = n;
 752         write_unlock_bh(&tbl->lock);
 753 out:
 754         return n;
 755 }
 756 EXPORT_SYMBOL(pneigh_lookup);
 757
 758
 759 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 760                   struct net_device *dev)
 761 {
 762         struct pneigh_entry *n, **np;
 763         unsigned int key_len = tbl->key_len;
 764         u32 hash_val = pneigh_hash(pkey, key_len);
 765
 766         write_lock_bh(&tbl->lock);
 767         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 768              np = &n->next) {
 769                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 770                     net_eq(pneigh_net(n), net)) {
 771                         *np = n->next;
 772                         write_unlock_bh(&tbl->lock);
 773                         if (tbl->pdestructor)
 774                                 tbl->pdestructor(n);
 775                         if (n->dev)
 776                                 dev_put(n->dev);
 777                         kfree(n);
 778                         return 0;
 779                 }
 780         }
 781         write_unlock_bh(&tbl->lock);
 782         return -ENOENT;
 783 }
 784
 785 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
 786                                     struct net_device *dev)
 787 {
 788         struct pneigh_entry *n, **np, *freelist = NULL;
 789         u32 h;
 790
 791         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 792                 np = &tbl->phash_buckets[h];
 793                 while ((n = *np) != NULL) {
 794                         if (!dev || n->dev == dev) {
 795                                 *np = n->next;
 796                                 n->next = freelist;
 797                                 freelist = n;
 798                                 continue;
 799                         }
 800                         np = &n->next;
 801                 }
 802         }
 803         write_unlock_bh(&tbl->lock);
 804         while ((n = freelist)) {
 805                 freelist = n->next;
 806                 n->next = NULL;
 807                 if (tbl->pdestructor)
 808                         tbl->pdestructor(n);
 809                 if (n->dev)
 810                         dev_put(n->dev);
 811                 kfree(n);
 812         }
 813         return -ENOENT;
 814 }
 815
 816 static void neigh_parms_destroy(struct neigh_parms *parms);
 817
 818 static inline void neigh_parms_put(struct neigh_parms *parms)
 819 {
 820         if (refcount_dec_and_test(&parms->refcnt))
 821                 neigh_parms_destroy(parms);
 822 }
 823
 824 /*
 825  *      neighbour must already be out of the table;
 826  *
 827  */
 828 void neigh_destroy(struct neighbour *neigh)
 829 {
 830         struct net_device *dev = neigh->dev;
 831
 832         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 833
 834         if (!neigh->dead) {
 835                 pr_warn("Destroying alive neighbour %p\n", neigh);
 836                 dump_stack();
 837                 return;
 838         }
 839
 840         if (neigh_del_timer(neigh))
 841                 pr_warn("Impossible event\n");
 842
 843         write_lock_bh(&neigh->lock);
 844         __skb_queue_purge(&neigh->arp_queue);
 845         write_unlock_bh(&neigh->lock);
 846         neigh->arp_queue_len_bytes = 0;
 847
 848         if (dev->netdev_ops->ndo_neigh_destroy)
 849                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 850
 851         dev_put(dev);
 852         neigh_parms_put(neigh->parms);
 853
 854         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 855
 856         atomic_dec(&neigh->tbl->entries);
 857         kfree_rcu(neigh, rcu);
 858 }
 859 EXPORT_SYMBOL(neigh_destroy);
 860
 861 /* Neighbour state is suspicious;
 862    disable fast path.
 863
 864    Called with write_locked neigh.
 865  */
 866 static void neigh_suspect(struct neighbour *neigh)
 867 {
 868         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 869
 870         neigh->output = neigh->ops->output;
 871 }
 872
 873 /* Neighbour state is OK;
 874    enable fast path.
 875
 876    Called with write_locked neigh.
 877  */
 878 static void neigh_connect(struct neighbour *neigh)
 879 {
 880         neigh_dbg(2, "neigh %p is connected\n", neigh);
 881
 882         neigh->output = neigh->ops->connected_output;
 883 }
 884
 885 static void neigh_periodic_work(struct work_struct *work)
 886 {
 887         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 888         struct neighbour *n;
 889         struct neighbour __rcu **np;
 890         unsigned int i;
 891         struct neigh_hash_table *nht;
 892
 893         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 894
 895         write_lock_bh(&tbl->lock);
 896         nht = rcu_dereference_protected(tbl->nht,
 897                                         lockdep_is_held(&tbl->lock));
 898
 899         /*
 900          *      periodically recompute ReachableTime from random function
 901          */
 902
 903         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 904                 struct neigh_parms *p;
 905                 tbl->last_rand = jiffies;
 906                 list_for_each_entry(p, &tbl->parms_list, list)
 907                         p->reachable_time =
 908                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 909         }
 910
 911         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 912                 goto out;
 913
 914         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 915                 np = &nht->hash_buckets[i];
 916
 917                 while ((n = rcu_dereference_protected(*np,
 918                                 lockdep_is_held(&tbl->lock))) != NULL) {
 919                         unsigned int state;
 920
 921                         write_lock(&n->lock);
 922
 923                         state = n->nud_state;
 924                         if ((state & (NUD_PERMANENT | NUD_IN_TIMER)) ||
 925                             (n->flags & NTF_EXT_LEARNED)) {
 926                                 write_unlock(&n->lock);
 927                                 goto next_elt;
 928                         }
 929
 930                         if (time_before(n->used, n->confirmed))
 931                                 n->used = n->confirmed;
 932
 933                         if (refcount_read(&n->refcnt) == 1 &&
 934                             (state == NUD_FAILED ||
 935                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 936                                 *np = n->next;
 937                                 neigh_mark_dead(n);
 938                                 write_unlock(&n->lock);
 939                                 neigh_cleanup_and_release(n);
 940                                 continue;
 941                         }
 942                         write_unlock(&n->lock);
 943
 944 next_elt:
 945                         np = &n->next;
 946                 }
 947                 /*
 948                  * It's fine to release lock here, even if hash table
 949                  * grows while we are preempted.
 950                  */
 951                 write_unlock_bh(&tbl->lock);
 952                 cond_resched();
 953                 write_lock_bh(&tbl->lock);
 954                 nht = rcu_dereference_protected(tbl->nht,
 955                                                 lockdep_is_held(&tbl->lock));
 956         }
 957 out:
 958         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 959          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 960          * BASE_REACHABLE_TIME.
 961          */
 962         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 963                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 964         write_unlock_bh(&tbl->lock);
 965 }
 966
 967 static __inline__ int neigh_max_probes(struct neighbour *n)
 968 {
 969         struct neigh_parms *p = n->parms;
 970         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 971                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 972                 NEIGH_VAR(p, MCAST_PROBES));
 973 }
 974
 975 static void neigh_invalidate(struct neighbour *neigh)
 976         __releases(neigh->lock)
 977         __acquires(neigh->lock)
 978 {
 979         struct sk_buff *skb;
 980
 981         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 982         neigh_dbg(2, "neigh %p is failed\n", neigh);
 983         neigh->updated = jiffies;
 984
 985         /* It is very thin place. report_unreachable is very complicated
 986            routine. Particularly, it can hit the same neighbour entry!
 987
 988            So that, we try to be accurate and avoid dead loop. --ANK
 989          */
 990         while (neigh->nud_state == NUD_FAILED &&
 991                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 992                 write_unlock(&neigh->lock);
 993                 neigh->ops->error_report(neigh, skb);
 994                 write_lock(&neigh->lock);
 995         }
 996         __skb_queue_purge(&neigh->arp_queue);
 997         neigh->arp_queue_len_bytes = 0;
 998 }
 999
1000 static void neigh_probe(struct neighbour *neigh)
1001         __releases(neigh->lock)
1002 {
1003         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
1004         /* keep skb alive even if arp_queue overflows */
1005         if (skb)
1006                 skb = skb_clone(skb, GFP_ATOMIC);
1007         write_unlock(&neigh->lock);
1008         if (neigh->ops->solicit)
1009                 neigh->ops->solicit(neigh, skb);
1010         atomic_inc(&neigh->probes);
1011         consume_skb(skb);
1012 }
1013
1014 /* Called when a timer expires for a neighbour entry. */
1015
1016 static void neigh_timer_handler(struct timer_list *t)
1017 {
1018         unsigned long now, next;
1019         struct neighbour *neigh = from_timer(neigh, t, timer);
1020         unsigned int state;
1021         int notify = 0;
1022
1023         write_lock(&neigh->lock);
1024
1025         state = neigh->nud_state;
1026         now = jiffies;
1027         next = now + HZ;
1028
1029         if (!(state & NUD_IN_TIMER))
1030                 goto out;
1031
1032         if (state & NUD_REACHABLE) {
1033                 if (time_before_eq(now,
1034                                    neigh->confirmed + neigh->parms->reachable_time)) {
1035                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
1036                         next = neigh->confirmed + neigh->parms->reachable_time;
1037                 } else if (time_before_eq(now,
1038                                           neigh->used +
1039                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1040                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
1041                         neigh->nud_state = NUD_DELAY;
1042                         neigh->updated = jiffies;
1043                         neigh_suspect(neigh);
1044                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
1045                 } else {
1046                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
1047                         neigh->nud_state = NUD_STALE;
1048                         neigh->updated = jiffies;
1049                         neigh_suspect(neigh);
1050                         notify = 1;
1051                 }
1052         } else if (state & NUD_DELAY) {
1053                 if (time_before_eq(now,
1054                                    neigh->confirmed +
1055                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1056                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
1057                         neigh->nud_state = NUD_REACHABLE;
1058                         neigh->updated = jiffies;
1059                         neigh_connect(neigh);
1060                         notify = 1;
1061                         next = neigh->confirmed + neigh->parms->reachable_time;
1062                 } else {
1063                         neigh_dbg(2, "neigh %p is probed\n", neigh);
1064                         neigh->nud_state = NUD_PROBE;
1065                         neigh->updated = jiffies;
1066                         atomic_set(&neigh->probes, 0);
1067                         notify = 1;
1068                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1069                                          HZ/100);
1070                 }
1071         } else {
1072                 /* NUD_PROBE|NUD_INCOMPLETE */
1073                 next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME), HZ/100);
1074         }
1075
1076         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
1077             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
1078                 neigh->nud_state = NUD_FAILED;
1079                 notify = 1;
1080                 neigh_invalidate(neigh);
1081                 goto out;
1082         }
1083
1084         if (neigh->nud_state & NUD_IN_TIMER) {
1085                 if (time_before(next, jiffies + HZ/2))
1086                         next = jiffies + HZ/2;
1087                 if (!mod_timer(&neigh->timer, next))
1088                         neigh_hold(neigh);
1089         }
1090         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
1091                 neigh_probe(neigh);
1092         } else {
1093 out:
1094                 write_unlock(&neigh->lock);
1095         }
1096
1097         if (notify)
1098                 neigh_update_notify(neigh, 0);
1099
1100         trace_neigh_timer_handler(neigh, 0);
1101
1102         neigh_release(neigh);
1103 }
1104
1105 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
1106 {
1107         int rc;
1108         bool immediate_probe = false;
1109
1110         write_lock_bh(&neigh->lock);
1111
1112         rc = 0;
1113         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1114                 goto out_unlock_bh;
1115         if (neigh->dead)
1116                 goto out_dead;
1117
1118         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1119                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1120                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
1121                         unsigned long next, now = jiffies;
1122
1123                         atomic_set(&neigh->probes,
1124                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
1125                         neigh_del_timer(neigh);
1126                         neigh->nud_state     = NUD_INCOMPLETE;
1127                         neigh->updated = now;
1128                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1129                                          HZ/100);
1130                         neigh_add_timer(neigh, next);
1131                         immediate_probe = true;
1132                 } else {
1133                         neigh->nud_state = NUD_FAILED;
1134                         neigh->updated = jiffies;
1135                         write_unlock_bh(&neigh->lock);
1136
1137                         kfree_skb(skb);
1138                         return 1;
1139                 }
1140         } else if (neigh->nud_state & NUD_STALE) {
1141                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1142                 neigh_del_timer(neigh);
1143                 neigh->nud_state = NUD_DELAY;
1144                 neigh->updated = jiffies;
1145                 neigh_add_timer(neigh, jiffies +
1146                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1147         }
1148
1149         if (neigh->nud_state == NUD_INCOMPLETE) {
1150                 if (skb) {
1151                         while (neigh->arp_queue_len_bytes + skb->truesize >
1152                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1153                                 struct sk_buff *buff;
1154
1155                                 buff = __skb_dequeue(&neigh->arp_queue);
1156                                 if (!buff)
1157                                         break;
1158                                 neigh->arp_queue_len_bytes -= buff->truesize;
1159                                 kfree_skb(buff);
1160                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1161                         }
1162                         skb_dst_force(skb);
1163                         __skb_queue_tail(&neigh->arp_queue, skb);
1164                         neigh->arp_queue_len_bytes += skb->truesize;
1165                 }
1166                 rc = 1;
1167         }
1168 out_unlock_bh:
1169         if (immediate_probe)
1170                 neigh_probe(neigh);
1171         else
1172                 write_unlock(&neigh->lock);
1173         local_bh_enable();
1174         trace_neigh_event_send_done(neigh, rc);
1175         return rc;
1176
1177 out_dead:
1178         if (neigh->nud_state & NUD_STALE)
1179                 goto out_unlock_bh;
1180         write_unlock_bh(&neigh->lock);
1181         kfree_skb(skb);
1182         trace_neigh_event_send_dead(neigh, 1);
1183         return 1;
1184 }
1185 EXPORT_SYMBOL(__neigh_event_send);
1186
1187 static void neigh_update_hhs(struct neighbour *neigh)
1188 {
1189         struct hh_cache *hh;
1190         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1191                 = NULL;
1192
1193         if (neigh->dev->header_ops)
1194                 update = neigh->dev->header_ops->cache_update;
1195
1196         if (update) {
1197                 hh = &neigh->hh;
1198                 if (READ_ONCE(hh->hh_len)) {
1199                         write_seqlock_bh(&hh->hh_lock);
1200                         update(hh, neigh->dev, neigh->ha);
1201                         write_sequnlock_bh(&hh->hh_lock);
1202                 }
1203         }
1204 }
1205
1206
1207
1208 /* Generic update routine.
1209    -- lladdr is new lladdr or NULL, if it is not supplied.
1210    -- new    is new state.
1211    -- flags
1212         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1213                                 if it is different.
1214         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1215                                 lladdr instead of overriding it
1216                                 if it is different.
1217         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1218
1219         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1220                                 NTF_ROUTER flag.
1221         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1222                                 a router.
1223
1224    Caller MUST hold reference count on the entry.
1225  */
1226
1227 static int __neigh_update(struct neighbour *neigh, const u8 *lladdr,
1228                           u8 new, u32 flags, u32 nlmsg_pid,
1229                           struct netlink_ext_ack *extack)
1230 {
1231         bool ext_learn_change = false;
1232         u8 old;
1233         int err;
1234         int notify = 0;
1235         struct net_device *dev;
1236         int update_isrouter = 0;
1237
1238         trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid);
1239
1240         write_lock_bh(&neigh->lock);
1241
1242         dev    = neigh->dev;
1243         old    = neigh->nud_state;
1244         err    = -EPERM;
1245
1246         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1247             (old & (NUD_NOARP | NUD_PERMANENT)))
1248                 goto out;
1249         if (neigh->dead) {
1250                 NL_SET_ERR_MSG(extack, "Neighbor entry is now dead");
1251                 goto out;
1252         }
1253
1254         ext_learn_change = neigh_update_ext_learned(neigh, flags, &notify);
1255
1256         if (!(new & NUD_VALID)) {
1257                 neigh_del_timer(neigh);
1258                 if (old & NUD_CONNECTED)
1259                         neigh_suspect(neigh);
1260                 neigh->nud_state = new;
1261                 err = 0;
1262                 notify = old & NUD_VALID;
1263                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1264                     (new & NUD_FAILED)) {
1265                         neigh_invalidate(neigh);
1266                         notify = 1;
1267                 }
1268                 goto out;
1269         }
1270
1271         /* Compare new lladdr with cached one */
1272         if (!dev->addr_len) {
1273                 /* First case: device needs no address. */
1274                 lladdr = neigh->ha;
1275         } else if (lladdr) {
1276                 /* The second case: if something is already cached
1277                    and a new address is proposed:
1278                    - compare new & old
1279                    - if they are different, check override flag
1280                  */
1281                 if ((old & NUD_VALID) &&
1282                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1283                         lladdr = neigh->ha;
1284         } else {
1285                 /* No address is supplied; if we know something,
1286                    use it, otherwise discard the request.
1287                  */
1288                 err = -EINVAL;
1289                 if (!(old & NUD_VALID)) {
1290                         NL_SET_ERR_MSG(extack, "No link layer address given");
1291                         goto out;
1292                 }
1293                 lladdr = neigh->ha;
1294         }
1295
1296         /* Update confirmed timestamp for neighbour entry after we
1297          * received ARP packet even if it doesn't change IP to MAC binding.
1298          */
1299         if (new & NUD_CONNECTED)
1300                 neigh->confirmed = jiffies;
1301
1302         /* If entry was valid and address is not changed,
1303            do not change entry state, if new one is STALE.
1304          */
1305         err = 0;
1306         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1307         if (old & NUD_VALID) {
1308                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1309                         update_isrouter = 0;
1310                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1311                             (old & NUD_CONNECTED)) {
1312                                 lladdr = neigh->ha;
1313                                 new = NUD_STALE;
1314                         } else
1315                                 goto out;
1316                 } else {
1317                         if (lladdr == neigh->ha && new == NUD_STALE &&
1318                             !(flags & NEIGH_UPDATE_F_ADMIN))
1319                                 new = old;
1320                 }
1321         }
1322
1323         /* Update timestamp only once we know we will make a change to the
1324          * neighbour entry. Otherwise we risk to move the locktime window with
1325          * noop updates and ignore relevant ARP updates.
1326          */
1327         if (new != old || lladdr != neigh->ha)
1328                 neigh->updated = jiffies;
1329
1330         if (new != old) {
1331                 neigh_del_timer(neigh);
1332                 if (new & NUD_PROBE)
1333                         atomic_set(&neigh->probes, 0);
1334                 if (new & NUD_IN_TIMER)
1335                         neigh_add_timer(neigh, (jiffies +
1336                                                 ((new & NUD_REACHABLE) ?
1337                                                  neigh->parms->reachable_time :
1338                                                  0)));
1339                 neigh->nud_state = new;
1340                 notify = 1;
1341         }
1342
1343         if (lladdr != neigh->ha) {
1344                 write_seqlock(&neigh->ha_lock);
1345                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1346                 write_sequnlock(&neigh->ha_lock);
1347                 neigh_update_hhs(neigh);
1348                 if (!(new & NUD_CONNECTED))
1349                         neigh->confirmed = jiffies -
1350                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1351                 notify = 1;
1352         }
1353         if (new == old)
1354                 goto out;
1355         if (new & NUD_CONNECTED)
1356                 neigh_connect(neigh);
1357         else
1358                 neigh_suspect(neigh);
1359         if (!(old & NUD_VALID)) {
1360                 struct sk_buff *skb;
1361
1362                 /* Again: avoid dead loop if something went wrong */
1363
1364                 while (neigh->nud_state & NUD_VALID &&
1365                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1366                         struct dst_entry *dst = skb_dst(skb);
1367                         struct neighbour *n2, *n1 = neigh;
1368                         write_unlock_bh(&neigh->lock);
1369
1370                         rcu_read_lock();
1371
1372                         /* Why not just use 'neigh' as-is?  The problem is that
1373                          * things such as shaper, eql, and sch_teql can end up
1374                          * using alternative, different, neigh objects to output
1375                          * the packet in the output path.  So what we need to do
1376                          * here is re-lookup the top-level neigh in the path so
1377                          * we can reinject the packet there.
1378                          */
1379                         n2 = NULL;
1380                         if (dst) {
1381                                 n2 = dst_neigh_lookup_skb(dst, skb);
1382                                 if (n2)
1383                                         n1 = n2;
1384                         }
1385                         n1->output(n1, skb);
1386                         if (n2)
1387                                 neigh_release(n2);
1388                         rcu_read_unlock();
1389
1390                         write_lock_bh(&neigh->lock);
1391                 }
1392                 __skb_queue_purge(&neigh->arp_queue);
1393                 neigh->arp_queue_len_bytes = 0;
1394         }
1395 out:
1396         if (update_isrouter)
1397                 neigh_update_is_router(neigh, flags, &notify);
1398         write_unlock_bh(&neigh->lock);
1399
1400         if (((new ^ old) & NUD_PERMANENT) || ext_learn_change)
1401                 neigh_update_gc_list(neigh);
1402
1403         if (notify)
1404                 neigh_update_notify(neigh, nlmsg_pid);
1405
1406         trace_neigh_update_done(neigh, err);
1407
1408         return err;
1409 }
1410
1411 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1412                  u32 flags, u32 nlmsg_pid)
1413 {
1414         return __neigh_update(neigh, lladdr, new, flags, nlmsg_pid, NULL);
1415 }
1416 EXPORT_SYMBOL(neigh_update);
1417
1418 /* Update the neigh to listen temporarily for probe responses, even if it is
1419  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1420  */
1421 void __neigh_set_probe_once(struct neighbour *neigh)
1422 {
1423         if (neigh->dead)
1424                 return;
1425         neigh->updated = jiffies;
1426         if (!(neigh->nud_state & NUD_FAILED))
1427                 return;
1428         neigh->nud_state = NUD_INCOMPLETE;
1429         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1430         neigh_add_timer(neigh,
1431                         jiffies + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1432                                       HZ/100));
1433 }
1434 EXPORT_SYMBOL(__neigh_set_probe_once);
1435
1436 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1437                                  u8 *lladdr, void *saddr,
1438                                  struct net_device *dev)
1439 {
1440         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1441                                                  lladdr || !dev->addr_len);
1442         if (neigh)
1443                 neigh_update(neigh, lladdr, NUD_STALE,
1444                              NEIGH_UPDATE_F_OVERRIDE, 0);
1445         return neigh;
1446 }
1447 EXPORT_SYMBOL(neigh_event_ns);
1448
1449 /* called with read_lock_bh(&n->lock); */
1450 static void neigh_hh_init(struct neighbour *n)
1451 {
1452         struct net_device *dev = n->dev;
1453         __be16 prot = n->tbl->protocol;
1454         struct hh_cache *hh = &n->hh;
1455
1456         write_lock_bh(&n->lock);
1457
1458         /* Only one thread can come in here and initialize the
1459          * hh_cache entry.
1460          */
1461         if (!hh->hh_len)
1462                 dev->header_ops->cache(n, hh, prot);
1463
1464         write_unlock_bh(&n->lock);
1465 }
1466
1467 /* Slow and careful. */
1468
1469 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1470 {
1471         int rc = 0;
1472
1473         if (!neigh_event_send(neigh, skb)) {
1474                 int err;
1475                 struct net_device *dev = neigh->dev;
1476                 unsigned int seq;
1477
1478                 if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
1479                         neigh_hh_init(neigh);
1480
1481                 do {
1482                         __skb_pull(skb, skb_network_offset(skb));
1483                         seq = read_seqbegin(&neigh->ha_lock);
1484                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1485                                               neigh->ha, NULL, skb->len);
1486                 } while (read_seqretry(&neigh->ha_lock, seq));
1487
1488                 if (err >= 0)
1489                         rc = dev_queue_xmit(skb);
1490                 else
1491                         goto out_kfree_skb;
1492         }
1493 out:
1494         return rc;
1495 out_kfree_skb:
1496         rc = -EINVAL;
1497         kfree_skb(skb);
1498         goto out;
1499 }
1500 EXPORT_SYMBOL(neigh_resolve_output);
1501
1502 /* As fast as possible without hh cache */
1503
1504 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1505 {
1506         struct net_device *dev = neigh->dev;
1507         unsigned int seq;
1508         int err;
1509
1510         do {
1511                 __skb_pull(skb, skb_network_offset(skb));
1512                 seq = read_seqbegin(&neigh->ha_lock);
1513                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1514                                       neigh->ha, NULL, skb->len);
1515         } while (read_seqretry(&neigh->ha_lock, seq));
1516
1517         if (err >= 0)
1518                 err = dev_queue_xmit(skb);
1519         else {
1520                 err = -EINVAL;
1521                 kfree_skb(skb);
1522         }
1523         return err;
1524 }
1525 EXPORT_SYMBOL(neigh_connected_output);
1526
1527 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1528 {
1529         return dev_queue_xmit(skb);
1530 }
1531 EXPORT_SYMBOL(neigh_direct_output);
1532
1533 static void neigh_proxy_process(struct timer_list *t)
1534 {
1535         struct neigh_table *tbl = from_timer(tbl, t, proxy_timer);
1536         long sched_next = 0;
1537         unsigned long now = jiffies;
1538         struct sk_buff *skb, *n;
1539
1540         spin_lock(&tbl->proxy_queue.lock);
1541
1542         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1543                 long tdif = NEIGH_CB(skb)->sched_next - now;
1544
1545                 if (tdif <= 0) {
1546                         struct net_device *dev = skb->dev;
1547
1548                         __skb_unlink(skb, &tbl->proxy_queue);
1549                         if (tbl->proxy_redo && netif_running(dev)) {
1550                                 rcu_read_lock();
1551                                 tbl->proxy_redo(skb);
1552                                 rcu_read_unlock();
1553                         } else {
1554                                 kfree_skb(skb);
1555                         }
1556
1557                         dev_put(dev);
1558                 } else if (!sched_next || tdif < sched_next)
1559                         sched_next = tdif;
1560         }
1561         del_timer(&tbl->proxy_timer);
1562         if (sched_next)
1563                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1564         spin_unlock(&tbl->proxy_queue.lock);
1565 }
1566
1567 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1568                     struct sk_buff *skb)
1569 {
1570         unsigned long now = jiffies;
1571
1572         unsigned long sched_next = now + (prandom_u32() %
1573                                           NEIGH_VAR(p, PROXY_DELAY));
1574
1575         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1576                 kfree_skb(skb);
1577                 return;
1578         }
1579
1580         NEIGH_CB(skb)->sched_next = sched_next;
1581         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1582
1583         spin_lock(&tbl->proxy_queue.lock);
1584         if (del_timer(&tbl->proxy_timer)) {
1585                 if (time_before(tbl->proxy_timer.expires, sched_next))
1586                         sched_next = tbl->proxy_timer.expires;
1587         }
1588         skb_dst_drop(skb);
1589         dev_hold(skb->dev);
1590         __skb_queue_tail(&tbl->proxy_queue, skb);
1591         mod_timer(&tbl->proxy_timer, sched_next);
1592         spin_unlock(&tbl->proxy_queue.lock);
1593 }
1594 EXPORT_SYMBOL(pneigh_enqueue);
1595
1596 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1597                                                       struct net *net, int ifindex)
1598 {
1599         struct neigh_parms *p;
1600
1601         list_for_each_entry(p, &tbl->parms_list, list) {
1602                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1603                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1604                         return p;
1605         }
1606
1607         return NULL;
1608 }
1609
1610 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1611                                       struct neigh_table *tbl)
1612 {
1613         struct neigh_parms *p;
1614         struct net *net = dev_net(dev);
1615         const struct net_device_ops *ops = dev->netdev_ops;
1616
1617         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1618         if (p) {
1619                 p->tbl            = tbl;
1620                 refcount_set(&p->refcnt, 1);
1621                 p->reachable_time =
1622                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1623                 dev_hold(dev);
1624                 p->dev = dev;
1625                 write_pnet(&p->net, net);
1626                 p->sysctl_table = NULL;
1627
1628                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1629                         dev_put(dev);
1630                         kfree(p);
1631                         return NULL;
1632                 }
1633
1634                 write_lock_bh(&tbl->lock);
1635                 list_add(&p->list, &tbl->parms.list);
1636                 write_unlock_bh(&tbl->lock);
1637
1638                 neigh_parms_data_state_cleanall(p);
1639         }
1640         return p;
1641 }
1642 EXPORT_SYMBOL(neigh_parms_alloc);
1643
1644 static void neigh_rcu_free_parms(struct rcu_head *head)
1645 {
1646         struct neigh_parms *parms =
1647                 container_of(head, struct neigh_parms, rcu_head);
1648
1649         neigh_parms_put(parms);
1650 }
1651
1652 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1653 {
1654         if (!parms || parms == &tbl->parms)
1655                 return;
1656         write_lock_bh(&tbl->lock);
1657         list_del(&parms->list);
1658         parms->dead = 1;
1659         write_unlock_bh(&tbl->lock);
1660         if (parms->dev)
1661                 dev_put(parms->dev);
1662         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1663 }
1664 EXPORT_SYMBOL(neigh_parms_release);
1665
1666 static void neigh_parms_destroy(struct neigh_parms *parms)
1667 {
1668         kfree(parms);
1669 }
1670
1671 static struct lock_class_key neigh_table_proxy_queue_class;
1672
1673 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1674
1675 void neigh_table_init(int index, struct neigh_table *tbl)
1676 {
1677         unsigned long now = jiffies;
1678         unsigned long phsize;
1679
1680         INIT_LIST_HEAD(&tbl->parms_list);
1681         INIT_LIST_HEAD(&tbl->gc_list);
1682         list_add(&tbl->parms.list, &tbl->parms_list);
1683         write_pnet(&tbl->parms.net, &init_net);
1684         refcount_set(&tbl->parms.refcnt, 1);
1685         tbl->parms.reachable_time =
1686                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1687
1688         tbl->stats = alloc_percpu(struct neigh_statistics);
1689         if (!tbl->stats)
1690                 panic("cannot create neighbour cache statistics");
1691
1692 #ifdef CONFIG_PROC_FS
1693         if (!proc_create_seq_data(tbl->id, 0, init_net.proc_net_stat,
1694                               &neigh_stat_seq_ops, tbl))
1695                 panic("cannot create neighbour proc dir entry");
1696 #endif
1697
1698         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1699
1700         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1701         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1702
1703         if (!tbl->nht || !tbl->phash_buckets)
1704                 panic("cannot allocate neighbour cache hashes");
1705
1706         if (!tbl->entry_size)
1707                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1708                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1709         else
1710                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1711
1712         rwlock_init(&tbl->lock);
1713         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1714         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1715                         tbl->parms.reachable_time);
1716         timer_setup(&tbl->proxy_timer, neigh_proxy_process, 0);
1717         skb_queue_head_init_class(&tbl->proxy_queue,
1718                         &neigh_table_proxy_queue_class);
1719
1720         tbl->last_flush = now;
1721         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1722
1723         neigh_tables[index] = tbl;
1724 }
1725 EXPORT_SYMBOL(neigh_table_init);
1726
1727 int neigh_table_clear(int index, struct neigh_table *tbl)
1728 {
1729         neigh_tables[index] = NULL;
1730         /* It is not clean... Fix it to unload IPv6 module safely */
1731         cancel_delayed_work_sync(&tbl->gc_work);
1732         del_timer_sync(&tbl->proxy_timer);
1733         pneigh_queue_purge(&tbl->proxy_queue);
1734         neigh_ifdown(tbl, NULL);
1735         if (atomic_read(&tbl->entries))
1736                 pr_crit("neighbour leakage\n");
1737
1738         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1739                  neigh_hash_free_rcu);
1740         tbl->nht = NULL;
1741
1742         kfree(tbl->phash_buckets);
1743         tbl->phash_buckets = NULL;
1744
1745         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1746
1747         free_percpu(tbl->stats);
1748         tbl->stats = NULL;
1749
1750         return 0;
1751 }
1752 EXPORT_SYMBOL(neigh_table_clear);
1753
1754 static struct neigh_table *neigh_find_table(int family)
1755 {
1756         struct neigh_table *tbl = NULL;
1757
1758         switch (family) {
1759         case AF_INET:
1760                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1761                 break;
1762         case AF_INET6:
1763                 tbl = neigh_tables[NEIGH_ND_TABLE];
1764                 break;
1765         case AF_DECnet:
1766                 tbl = neigh_tables[NEIGH_DN_TABLE];
1767                 break;
1768         }
1769
1770         return tbl;
1771 }
1772
1773 const struct nla_policy nda_policy[NDA_MAX+1] = {
1774         [NDA_DST]               = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1775         [NDA_LLADDR]            = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1776         [NDA_CACHEINFO]         = { .len = sizeof(struct nda_cacheinfo) },
1777         [NDA_PROBES]            = { .type = NLA_U32 },
1778         [NDA_VLAN]              = { .type = NLA_U16 },
1779         [NDA_PORT]              = { .type = NLA_U16 },
1780         [NDA_VNI]               = { .type = NLA_U32 },
1781         [NDA_IFINDEX]           = { .type = NLA_U32 },
1782         [NDA_MASTER]            = { .type = NLA_U32 },
1783         [NDA_PROTOCOL]          = { .type = NLA_U8 },
1784 };
1785
1786 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1787                         struct netlink_ext_ack *extack)
1788 {
1789         struct net *net = sock_net(skb->sk);
1790         struct ndmsg *ndm;
1791         struct nlattr *dst_attr;
1792         struct neigh_table *tbl;
1793         struct neighbour *neigh;
1794         struct net_device *dev = NULL;
1795         int err = -EINVAL;
1796
1797         ASSERT_RTNL();
1798         if (nlmsg_len(nlh) < sizeof(*ndm))
1799                 goto out;
1800
1801         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1802         if (!dst_attr) {
1803                 NL_SET_ERR_MSG(extack, "Network address not specified");
1804                 goto out;
1805         }
1806
1807         ndm = nlmsg_data(nlh);
1808         if (ndm->ndm_ifindex) {
1809                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1810                 if (dev == NULL) {
1811                         err = -ENODEV;
1812                         goto out;
1813                 }
1814         }
1815
1816         tbl = neigh_find_table(ndm->ndm_family);
1817         if (tbl == NULL)
1818                 return -EAFNOSUPPORT;
1819
1820         if (nla_len(dst_attr) < (int)tbl->key_len) {
1821                 NL_SET_ERR_MSG(extack, "Invalid network address");
1822                 goto out;
1823         }
1824
1825         if (ndm->ndm_flags & NTF_PROXY) {
1826                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1827                 goto out;
1828         }
1829
1830         if (dev == NULL)
1831                 goto out;
1832
1833         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1834         if (neigh == NULL) {
1835                 err = -ENOENT;
1836                 goto out;
1837         }
1838
1839         err = __neigh_update(neigh, NULL, NUD_FAILED,
1840                              NEIGH_UPDATE_F_OVERRIDE | NEIGH_UPDATE_F_ADMIN,
1841                              NETLINK_CB(skb).portid, extack);
1842         write_lock_bh(&tbl->lock);
1843         neigh_release(neigh);
1844         neigh_remove_one(neigh, tbl);
1845         write_unlock_bh(&tbl->lock);
1846
1847 out:
1848         return err;
1849 }
1850
1851 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1852                      struct netlink_ext_ack *extack)
1853 {
1854         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE |
1855                 NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1856         struct net *net = sock_net(skb->sk);
1857         struct ndmsg *ndm;
1858         struct nlattr *tb[NDA_MAX+1];
1859         struct neigh_table *tbl;
1860         struct net_device *dev = NULL;
1861         struct neighbour *neigh;
1862         void *dst, *lladdr;
1863         u8 protocol = 0;
1864         int err;
1865
1866         ASSERT_RTNL();
1867         err = nlmsg_parse_deprecated(nlh, sizeof(*ndm), tb, NDA_MAX,
1868                                      nda_policy, extack);
1869         if (err < 0)
1870                 goto out;
1871
1872         err = -EINVAL;
1873         if (!tb[NDA_DST]) {
1874                 NL_SET_ERR_MSG(extack, "Network address not specified");
1875                 goto out;
1876         }
1877
1878         ndm = nlmsg_data(nlh);
1879         if (ndm->ndm_ifindex) {
1880                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1881                 if (dev == NULL) {
1882                         err = -ENODEV;
1883                         goto out;
1884                 }
1885
1886                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len) {
1887                         NL_SET_ERR_MSG(extack, "Invalid link address");
1888                         goto out;
1889                 }
1890         }
1891
1892         tbl = neigh_find_table(ndm->ndm_family);
1893         if (tbl == NULL)
1894                 return -EAFNOSUPPORT;
1895
1896         if (nla_len(tb[NDA_DST]) < (int)tbl->key_len) {
1897                 NL_SET_ERR_MSG(extack, "Invalid network address");
1898                 goto out;
1899         }
1900
1901         dst = nla_data(tb[NDA_DST]);
1902         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1903
1904         if (tb[NDA_PROTOCOL])
1905                 protocol = nla_get_u8(tb[NDA_PROTOCOL]);
1906
1907         if (ndm->ndm_flags & NTF_PROXY) {
1908                 struct pneigh_entry *pn;
1909
1910                 err = -ENOBUFS;
1911                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1912                 if (pn) {
1913                         pn->flags = ndm->ndm_flags;
1914                         if (protocol)
1915                                 pn->protocol = protocol;
1916                         err = 0;
1917                 }
1918                 goto out;
1919         }
1920
1921         if (!dev) {
1922                 NL_SET_ERR_MSG(extack, "Device not specified");
1923                 goto out;
1924         }
1925
1926         if (tbl->allow_add && !tbl->allow_add(dev, extack)) {
1927                 err = -EINVAL;
1928                 goto out;
1929         }
1930
1931         neigh = neigh_lookup(tbl, dst, dev);
1932         if (neigh == NULL) {
1933                 bool exempt_from_gc;
1934
1935                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1936                         err = -ENOENT;
1937                         goto out;
1938                 }
1939
1940                 exempt_from_gc = ndm->ndm_state & NUD_PERMANENT ||
1941                                  ndm->ndm_flags & NTF_EXT_LEARNED;
1942                 neigh = ___neigh_create(tbl, dst, dev, exempt_from_gc, true);
1943                 if (IS_ERR(neigh)) {
1944                         err = PTR_ERR(neigh);
1945                         goto out;
1946                 }
1947         } else {
1948                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1949                         err = -EEXIST;
1950                         neigh_release(neigh);
1951                         goto out;
1952                 }
1953
1954                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1955                         flags &= ~(NEIGH_UPDATE_F_OVERRIDE |
1956                                    NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1957         }
1958
1959         if (ndm->ndm_flags & NTF_EXT_LEARNED)
1960                 flags |= NEIGH_UPDATE_F_EXT_LEARNED;
1961
1962         if (ndm->ndm_flags & NTF_ROUTER)
1963                 flags |= NEIGH_UPDATE_F_ISROUTER;
1964
1965         if (ndm->ndm_flags & NTF_USE) {
1966                 neigh_event_send(neigh, NULL);
1967                 err = 0;
1968         } else
1969                 err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1970                                      NETLINK_CB(skb).portid, extack);
1971
1972         if (protocol)
1973                 neigh->protocol = protocol;
1974
1975         neigh_release(neigh);
1976
1977 out:
1978         return err;
1979 }
1980
1981 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1982 {
1983         struct nlattr *nest;
1984
1985         nest = nla_nest_start_noflag(skb, NDTA_PARMS);
1986         if (nest == NULL)
1987                 return -ENOBUFS;
1988
1989         if ((parms->dev &&
1990              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1991             nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
1992             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1993                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1994             /* approximative value for deprecated QUEUE_LEN (in packets) */
1995             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1996                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1997             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1998             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1999             nla_put_u32(skb, NDTPA_UCAST_PROBES,
2000                         NEIGH_VAR(parms, UCAST_PROBES)) ||
2001             nla_put_u32(skb, NDTPA_MCAST_PROBES,
2002                         NEIGH_VAR(parms, MCAST_PROBES)) ||
2003             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
2004                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
2005             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
2006                           NDTPA_PAD) ||
2007             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
2008                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
2009             nla_put_msecs(skb, NDTPA_GC_STALETIME,
2010                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
2011             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
2012                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
2013             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
2014                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
2015             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
2016                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
2017             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
2018                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
2019             nla_put_msecs(skb, NDTPA_LOCKTIME,
2020                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
2021                 goto nla_put_failure;
2022         return nla_nest_end(skb, nest);
2023
2024 nla_put_failure:
2025         nla_nest_cancel(skb, nest);
2026         return -EMSGSIZE;
2027 }
2028
2029 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
2030                               u32 pid, u32 seq, int type, int flags)
2031 {
2032         struct nlmsghdr *nlh;
2033         struct ndtmsg *ndtmsg;
2034
2035         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2036         if (nlh == NULL)
2037                 return -EMSGSIZE;
2038
2039         ndtmsg = nlmsg_data(nlh);
2040
2041         read_lock_bh(&tbl->lock);
2042         ndtmsg->ndtm_family = tbl->family;
2043         ndtmsg->ndtm_pad1   = 0;
2044         ndtmsg->ndtm_pad2   = 0;
2045
2046         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
2047             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
2048             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
2049             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
2050             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
2051                 goto nla_put_failure;
2052         {
2053                 unsigned long now = jiffies;
2054                 long flush_delta = now - tbl->last_flush;
2055                 long rand_delta = now - tbl->last_rand;
2056                 struct neigh_hash_table *nht;
2057                 struct ndt_config ndc = {
2058                         .ndtc_key_len           = tbl->key_len,
2059                         .ndtc_entry_size        = tbl->entry_size,
2060                         .ndtc_entries           = atomic_read(&tbl->entries),
2061                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
2062                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
2063                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
2064                 };
2065
2066                 rcu_read_lock_bh();
2067                 nht = rcu_dereference_bh(tbl->nht);
2068                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
2069                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
2070                 rcu_read_unlock_bh();
2071
2072                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
2073                         goto nla_put_failure;
2074         }
2075
2076         {
2077                 int cpu;
2078                 struct ndt_stats ndst;
2079
2080                 memset(&ndst, 0, sizeof(ndst));
2081
2082                 for_each_possible_cpu(cpu) {
2083                         struct neigh_statistics *st;
2084
2085                         st = per_cpu_ptr(tbl->stats, cpu);
2086                         ndst.ndts_allocs                += st->allocs;
2087                         ndst.ndts_destroys              += st->destroys;
2088                         ndst.ndts_hash_grows            += st->hash_grows;
2089                         ndst.ndts_res_failed            += st->res_failed;
2090                         ndst.ndts_lookups               += st->lookups;
2091                         ndst.ndts_hits                  += st->hits;
2092                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
2093                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
2094                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
2095                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
2096                         ndst.ndts_table_fulls           += st->table_fulls;
2097                 }
2098
2099                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
2100                                   NDTA_PAD))
2101                         goto nla_put_failure;
2102         }
2103
2104         BUG_ON(tbl->parms.dev);
2105         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
2106                 goto nla_put_failure;
2107
2108         read_unlock_bh(&tbl->lock);
2109         nlmsg_end(skb, nlh);
2110         return 0;
2111
2112 nla_put_failure:
2113         read_unlock_bh(&tbl->lock);
2114         nlmsg_cancel(skb, nlh);
2115         return -EMSGSIZE;
2116 }
2117
2118 static int neightbl_fill_param_info(struct sk_buff *skb,
2119                                     struct neigh_table *tbl,
2120                                     struct neigh_parms *parms,
2121                                     u32 pid, u32 seq, int type,
2122                                     unsigned int flags)
2123 {
2124         struct ndtmsg *ndtmsg;
2125         struct nlmsghdr *nlh;
2126
2127         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2128         if (nlh == NULL)
2129                 return -EMSGSIZE;
2130
2131         ndtmsg = nlmsg_data(nlh);
2132
2133         read_lock_bh(&tbl->lock);
2134         ndtmsg->ndtm_family = tbl->family;
2135         ndtmsg->ndtm_pad1   = 0;
2136         ndtmsg->ndtm_pad2   = 0;
2137
2138         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
2139             neightbl_fill_parms(skb, parms) < 0)
2140                 goto errout;
2141
2142         read_unlock_bh(&tbl->lock);
2143         nlmsg_end(skb, nlh);
2144         return 0;
2145 errout:
2146         read_unlock_bh(&tbl->lock);
2147         nlmsg_cancel(skb, nlh);
2148         return -EMSGSIZE;
2149 }
2150
2151 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
2152         [NDTA_NAME]             = { .type = NLA_STRING },
2153         [NDTA_THRESH1]          = { .type = NLA_U32 },
2154         [NDTA_THRESH2]          = { .type = NLA_U32 },
2155         [NDTA_THRESH3]          = { .type = NLA_U32 },
2156         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
2157         [NDTA_PARMS]            = { .type = NLA_NESTED },
2158 };
2159
2160 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
2161         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
2162         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
2163         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
2164         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
2165         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
2166         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
2167         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
2168         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
2169         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
2170         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
2171         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
2172         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
2173         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
2174         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
2175 };
2176
2177 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
2178                         struct netlink_ext_ack *extack)
2179 {
2180         struct net *net = sock_net(skb->sk);
2181         struct neigh_table *tbl;
2182         struct ndtmsg *ndtmsg;
2183         struct nlattr *tb[NDTA_MAX+1];
2184         bool found = false;
2185         int err, tidx;
2186
2187         err = nlmsg_parse_deprecated(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
2188                                      nl_neightbl_policy, extack);
2189         if (err < 0)
2190                 goto errout;
2191
2192         if (tb[NDTA_NAME] == NULL) {
2193                 err = -EINVAL;
2194                 goto errout;
2195         }
2196
2197         ndtmsg = nlmsg_data(nlh);
2198
2199         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2200                 tbl = neigh_tables[tidx];
2201                 if (!tbl)
2202                         continue;
2203                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2204                         continue;
2205                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2206                         found = true;
2207                         break;
2208                 }
2209         }
2210
2211         if (!found)
2212                 return -ENOENT;
2213
2214         /*
2215          * We acquire tbl->lock to be nice to the periodic timers and
2216          * make sure they always see a consistent set of values.
2217          */
2218         write_lock_bh(&tbl->lock);
2219
2220         if (tb[NDTA_PARMS]) {
2221                 struct nlattr *tbp[NDTPA_MAX+1];
2222                 struct neigh_parms *p;
2223                 int i, ifindex = 0;
2224
2225                 err = nla_parse_nested_deprecated(tbp, NDTPA_MAX,
2226                                                   tb[NDTA_PARMS],
2227                                                   nl_ntbl_parm_policy, extack);
2228                 if (err < 0)
2229                         goto errout_tbl_lock;
2230
2231                 if (tbp[NDTPA_IFINDEX])
2232                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2233
2234                 p = lookup_neigh_parms(tbl, net, ifindex);
2235                 if (p == NULL) {
2236                         err = -ENOENT;
2237                         goto errout_tbl_lock;
2238                 }
2239
2240                 for (i = 1; i <= NDTPA_MAX; i++) {
2241                         if (tbp[i] == NULL)
2242                                 continue;
2243
2244                         switch (i) {
2245                         case NDTPA_QUEUE_LEN:
2246                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2247                                               nla_get_u32(tbp[i]) *
2248                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2249                                 break;
2250                         case NDTPA_QUEUE_LENBYTES:
2251                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2252                                               nla_get_u32(tbp[i]));
2253                                 break;
2254                         case NDTPA_PROXY_QLEN:
2255                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2256                                               nla_get_u32(tbp[i]));
2257                                 break;
2258                         case NDTPA_APP_PROBES:
2259                                 NEIGH_VAR_SET(p, APP_PROBES,
2260                                               nla_get_u32(tbp[i]));
2261                                 break;
2262                         case NDTPA_UCAST_PROBES:
2263                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2264                                               nla_get_u32(tbp[i]));
2265                                 break;
2266                         case NDTPA_MCAST_PROBES:
2267                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2268                                               nla_get_u32(tbp[i]));
2269                                 break;
2270                         case NDTPA_MCAST_REPROBES:
2271                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2272                                               nla_get_u32(tbp[i]));
2273                                 break;
2274                         case NDTPA_BASE_REACHABLE_TIME:
2275                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2276                                               nla_get_msecs(tbp[i]));
2277                                 /* update reachable_time as well, otherwise, the change will
2278                                  * only be effective after the next time neigh_periodic_work
2279                                  * decides to recompute it (can be multiple minutes)
2280                                  */
2281                                 p->reachable_time =
2282                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2283                                 break;
2284                         case NDTPA_GC_STALETIME:
2285                                 NEIGH_VAR_SET(p, GC_STALETIME,
2286                                               nla_get_msecs(tbp[i]));
2287                                 break;
2288                         case NDTPA_DELAY_PROBE_TIME:
2289                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2290                                               nla_get_msecs(tbp[i]));
2291                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2292                                 break;
2293                         case NDTPA_RETRANS_TIME:
2294                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2295                                               nla_get_msecs(tbp[i]));
2296                                 break;
2297                         case NDTPA_ANYCAST_DELAY:
2298                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2299                                               nla_get_msecs(tbp[i]));
2300                                 break;
2301                         case NDTPA_PROXY_DELAY:
2302                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2303                                               nla_get_msecs(tbp[i]));
2304                                 break;
2305                         case NDTPA_LOCKTIME:
2306                                 NEIGH_VAR_SET(p, LOCKTIME,
2307                                               nla_get_msecs(tbp[i]));
2308                                 break;
2309                         }
2310                 }
2311         }
2312
2313         err = -ENOENT;
2314         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2315              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2316             !net_eq(net, &init_net))
2317                 goto errout_tbl_lock;
2318
2319         if (tb[NDTA_THRESH1])
2320                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2321
2322         if (tb[NDTA_THRESH2])
2323                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2324
2325         if (tb[NDTA_THRESH3])
2326                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2327
2328         if (tb[NDTA_GC_INTERVAL])
2329                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2330
2331         err = 0;
2332
2333 errout_tbl_lock:
2334         write_unlock_bh(&tbl->lock);
2335 errout:
2336         return err;
2337 }
2338
2339 static int neightbl_valid_dump_info(const struct nlmsghdr *nlh,
2340                                     struct netlink_ext_ack *extack)
2341 {
2342         struct ndtmsg *ndtm;
2343
2344         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndtm))) {
2345                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor table dump request");
2346                 return -EINVAL;
2347         }
2348
2349         ndtm = nlmsg_data(nlh);
2350         if (ndtm->ndtm_pad1  || ndtm->ndtm_pad2) {
2351                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor table dump request");
2352                 return -EINVAL;
2353         }
2354
2355         if (nlmsg_attrlen(nlh, sizeof(*ndtm))) {
2356                 NL_SET_ERR_MSG(extack, "Invalid data after header in neighbor table dump request");
2357                 return -EINVAL;
2358         }
2359
2360         return 0;
2361 }
2362
2363 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2364 {
2365         const struct nlmsghdr *nlh = cb->nlh;
2366         struct net *net = sock_net(skb->sk);
2367         int family, tidx, nidx = 0;
2368         int tbl_skip = cb->args[0];
2369         int neigh_skip = cb->args[1];
2370         struct neigh_table *tbl;
2371
2372         if (cb->strict_check) {
2373                 int err = neightbl_valid_dump_info(nlh, cb->extack);
2374
2375                 if (err < 0)
2376                         return err;
2377         }
2378
2379         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2380
2381         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2382                 struct neigh_parms *p;
2383
2384                 tbl = neigh_tables[tidx];
2385                 if (!tbl)
2386                         continue;
2387
2388                 if (tidx < tbl_skip || (family && tbl->family != family))
2389                         continue;
2390
2391                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2392                                        nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2393                                        NLM_F_MULTI) < 0)
2394                         break;
2395
2396                 nidx = 0;
2397                 p = list_next_entry(&tbl->parms, list);
2398                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2399                         if (!net_eq(neigh_parms_net(p), net))
2400                                 continue;
2401
2402                         if (nidx < neigh_skip)
2403                                 goto next;
2404
2405                         if (neightbl_fill_param_info(skb, tbl, p,
2406                                                      NETLINK_CB(cb->skb).portid,
2407                                                      nlh->nlmsg_seq,
2408                                                      RTM_NEWNEIGHTBL,
2409                                                      NLM_F_MULTI) < 0)
2410                                 goto out;
2411                 next:
2412                         nidx++;
2413                 }
2414
2415                 neigh_skip = 0;
2416         }
2417 out:
2418         cb->args[0] = tidx;
2419         cb->args[1] = nidx;
2420
2421         return skb->len;
2422 }
2423
2424 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2425                            u32 pid, u32 seq, int type, unsigned int flags)
2426 {
2427         unsigned long now = jiffies;
2428         struct nda_cacheinfo ci;
2429         struct nlmsghdr *nlh;
2430         struct ndmsg *ndm;
2431
2432         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2433         if (nlh == NULL)
2434                 return -EMSGSIZE;
2435
2436         ndm = nlmsg_data(nlh);
2437         ndm->ndm_family  = neigh->ops->family;
2438         ndm->ndm_pad1    = 0;
2439         ndm->ndm_pad2    = 0;
2440         ndm->ndm_flags   = neigh->flags;
2441         ndm->ndm_type    = neigh->type;
2442         ndm->ndm_ifindex = neigh->dev->ifindex;
2443
2444         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2445                 goto nla_put_failure;
2446
2447         read_lock_bh(&neigh->lock);
2448         ndm->ndm_state   = neigh->nud_state;
2449         if (neigh->nud_state & NUD_VALID) {
2450                 char haddr[MAX_ADDR_LEN];
2451
2452                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2453                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2454                         read_unlock_bh(&neigh->lock);
2455                         goto nla_put_failure;
2456                 }
2457         }
2458
2459         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2460         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2461         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2462         ci.ndm_refcnt    = refcount_read(&neigh->refcnt) - 1;
2463         read_unlock_bh(&neigh->lock);
2464
2465         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2466             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2467                 goto nla_put_failure;
2468
2469         if (neigh->protocol && nla_put_u8(skb, NDA_PROTOCOL, neigh->protocol))
2470                 goto nla_put_failure;
2471
2472         nlmsg_end(skb, nlh);
2473         return 0;
2474
2475 nla_put_failure:
2476         nlmsg_cancel(skb, nlh);
2477         return -EMSGSIZE;
2478 }
2479
2480 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2481                             u32 pid, u32 seq, int type, unsigned int flags,
2482                             struct neigh_table *tbl)
2483 {
2484         struct nlmsghdr *nlh;
2485         struct ndmsg *ndm;
2486
2487         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2488         if (nlh == NULL)
2489                 return -EMSGSIZE;
2490
2491         ndm = nlmsg_data(nlh);
2492         ndm->ndm_family  = tbl->family;
2493         ndm->ndm_pad1    = 0;
2494         ndm->ndm_pad2    = 0;
2495         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2496         ndm->ndm_type    = RTN_UNICAST;
2497         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2498         ndm->ndm_state   = NUD_NONE;
2499
2500         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2501                 goto nla_put_failure;
2502
2503         if (pn->protocol && nla_put_u8(skb, NDA_PROTOCOL, pn->protocol))
2504                 goto nla_put_failure;
2505
2506         nlmsg_end(skb, nlh);
2507         return 0;
2508
2509 nla_put_failure:
2510         nlmsg_cancel(skb, nlh);
2511         return -EMSGSIZE;
2512 }
2513
2514 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2515 {
2516         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2517         __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2518 }
2519
2520 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2521 {
2522         struct net_device *master;
2523
2524         if (!master_idx)
2525                 return false;
2526
2527         master = dev ? netdev_master_upper_dev_get(dev) : NULL;
2528         if (!master || master->ifindex != master_idx)
2529                 return true;
2530
2531         return false;
2532 }
2533
2534 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2535 {
2536         if (filter_idx && (!dev || dev->ifindex != filter_idx))
2537                 return true;
2538
2539         return false;
2540 }
2541
2542 struct neigh_dump_filter {
2543         int master_idx;
2544         int dev_idx;
2545 };
2546
2547 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2548                             struct netlink_callback *cb,
2549                             struct neigh_dump_filter *filter)
2550 {
2551         struct net *net = sock_net(skb->sk);
2552         struct neighbour *n;
2553         int rc, h, s_h = cb->args[1];
2554         int idx, s_idx = idx = cb->args[2];
2555         struct neigh_hash_table *nht;
2556         unsigned int flags = NLM_F_MULTI;
2557
2558         if (filter->dev_idx || filter->master_idx)
2559                 flags |= NLM_F_DUMP_FILTERED;
2560
2561         rcu_read_lock_bh();
2562         nht = rcu_dereference_bh(tbl->nht);
2563
2564         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2565                 if (h > s_h)
2566                         s_idx = 0;
2567                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2568                      n != NULL;
2569                      n = rcu_dereference_bh(n->next)) {
2570                         if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2571                                 goto next;
2572                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2573                             neigh_master_filtered(n->dev, filter->master_idx))
2574                                 goto next;
2575                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2576                                             cb->nlh->nlmsg_seq,
2577                                             RTM_NEWNEIGH,
2578                                             flags) < 0) {
2579                                 rc = -1;
2580                                 goto out;
2581                         }
2582 next:
2583                         idx++;
2584                 }
2585         }
2586         rc = skb->len;
2587 out:
2588         rcu_read_unlock_bh();
2589         cb->args[1] = h;
2590         cb->args[2] = idx;
2591         return rc;
2592 }
2593
2594 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2595                              struct netlink_callback *cb,
2596                              struct neigh_dump_filter *filter)
2597 {
2598         struct pneigh_entry *n;
2599         struct net *net = sock_net(skb->sk);
2600         int rc, h, s_h = cb->args[3];
2601         int idx, s_idx = idx = cb->args[4];
2602         unsigned int flags = NLM_F_MULTI;
2603
2604         if (filter->dev_idx || filter->master_idx)
2605                 flags |= NLM_F_DUMP_FILTERED;
2606
2607         read_lock_bh(&tbl->lock);
2608
2609         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2610                 if (h > s_h)
2611                         s_idx = 0;
2612                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2613                         if (idx < s_idx || pneigh_net(n) != net)
2614                                 goto next;
2615                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2616                             neigh_master_filtered(n->dev, filter->master_idx))
2617                                 goto next;
2618                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2619                                             cb->nlh->nlmsg_seq,
2620                                             RTM_NEWNEIGH, flags, tbl) < 0) {
2621                                 read_unlock_bh(&tbl->lock);
2622                                 rc = -1;
2623                                 goto out;
2624                         }
2625                 next:
2626                         idx++;
2627                 }
2628         }
2629
2630         read_unlock_bh(&tbl->lock);
2631         rc = skb->len;
2632 out:
2633         cb->args[3] = h;
2634         cb->args[4] = idx;
2635         return rc;
2636
2637 }
2638
2639 static int neigh_valid_dump_req(const struct nlmsghdr *nlh,
2640                                 bool strict_check,
2641                                 struct neigh_dump_filter *filter,
2642                                 struct netlink_ext_ack *extack)
2643 {
2644         struct nlattr *tb[NDA_MAX + 1];
2645         int err, i;
2646
2647         if (strict_check) {
2648                 struct ndmsg *ndm;
2649
2650                 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2651                         NL_SET_ERR_MSG(extack, "Invalid header for neighbor dump request");
2652                         return -EINVAL;
2653                 }
2654
2655                 ndm = nlmsg_data(nlh);
2656                 if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_ifindex ||
2657                     ndm->ndm_state || ndm->ndm_type) {
2658                         NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor dump request");
2659                         return -EINVAL;
2660                 }
2661
2662                 if (ndm->ndm_flags & ~NTF_PROXY) {
2663                         NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor dump request");
2664                         return -EINVAL;
2665                 }
2666
2667                 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg),
2668                                                     tb, NDA_MAX, nda_policy,
2669                                                     extack);
2670         } else {
2671                 err = nlmsg_parse_deprecated(nlh, sizeof(struct ndmsg), tb,
2672                                              NDA_MAX, nda_policy, extack);
2673         }
2674         if (err < 0)
2675                 return err;
2676
2677         for (i = 0; i <= NDA_MAX; ++i) {
2678                 if (!tb[i])
2679                         continue;
2680
2681                 /* all new attributes should require strict_check */
2682                 switch (i) {
2683                 case NDA_IFINDEX:
2684                         filter->dev_idx = nla_get_u32(tb[i]);
2685                         break;
2686                 case NDA_MASTER:
2687                         filter->master_idx = nla_get_u32(tb[i]);
2688                         break;
2689                 default:
2690                         if (strict_check) {
2691                                 NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor dump request");
2692                                 return -EINVAL;
2693                         }
2694                 }
2695         }
2696
2697         return 0;
2698 }
2699
2700 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2701 {
2702         const struct nlmsghdr *nlh = cb->nlh;
2703         struct neigh_dump_filter filter = {};
2704         struct neigh_table *tbl;
2705         int t, family, s_t;
2706         int proxy = 0;
2707         int err;
2708
2709         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2710
2711         /* check for full ndmsg structure presence, family member is
2712          * the same for both structures
2713          */
2714         if (nlmsg_len(nlh) >= sizeof(struct ndmsg) &&
2715             ((struct ndmsg *)nlmsg_data(nlh))->ndm_flags == NTF_PROXY)
2716                 proxy = 1;
2717
2718         err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack);
2719         if (err < 0 && cb->strict_check)
2720                 return err;
2721
2722         s_t = cb->args[0];
2723
2724         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2725                 tbl = neigh_tables[t];
2726
2727                 if (!tbl)
2728                         continue;
2729                 if (t < s_t || (family && tbl->family != family))
2730                         continue;
2731                 if (t > s_t)
2732                         memset(&cb->args[1], 0, sizeof(cb->args) -
2733                                                 sizeof(cb->args[0]));
2734                 if (proxy)
2735                         err = pneigh_dump_table(tbl, skb, cb, &filter);
2736                 else
2737                         err = neigh_dump_table(tbl, skb, cb, &filter);
2738                 if (err < 0)
2739                         break;
2740         }
2741
2742         cb->args[0] = t;
2743         return skb->len;
2744 }
2745
2746 static int neigh_valid_get_req(const struct nlmsghdr *nlh,
2747                                struct neigh_table **tbl,
2748                                void **dst, int *dev_idx, u8 *ndm_flags,
2749                                struct netlink_ext_ack *extack)
2750 {
2751         struct nlattr *tb[NDA_MAX + 1];
2752         struct ndmsg *ndm;
2753         int err, i;
2754
2755         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2756                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor get request");
2757                 return -EINVAL;
2758         }
2759
2760         ndm = nlmsg_data(nlh);
2761         if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
2762             ndm->ndm_type) {
2763                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor get request");
2764                 return -EINVAL;
2765         }
2766
2767         if (ndm->ndm_flags & ~NTF_PROXY) {
2768                 NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor get request");
2769                 return -EINVAL;
2770         }
2771
2772         err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg), tb,
2773                                             NDA_MAX, nda_policy, extack);
2774         if (err < 0)
2775                 return err;
2776
2777         *ndm_flags = ndm->ndm_flags;
2778         *dev_idx = ndm->ndm_ifindex;
2779         *tbl = neigh_find_table(ndm->ndm_family);
2780         if (*tbl == NULL) {
2781                 NL_SET_ERR_MSG(extack, "Unsupported family in header for neighbor get request");
2782                 return -EAFNOSUPPORT;
2783         }
2784
2785         for (i = 0; i <= NDA_MAX; ++i) {
2786                 if (!tb[i])
2787                         continue;
2788
2789                 switch (i) {
2790                 case NDA_DST:
2791                         if (nla_len(tb[i]) != (int)(*tbl)->key_len) {
2792                                 NL_SET_ERR_MSG(extack, "Invalid network address in neighbor get request");
2793                                 return -EINVAL;
2794                         }
2795                         *dst = nla_data(tb[i]);
2796                         break;
2797                 default:
2798                         NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor get request");
2799                         return -EINVAL;
2800                 }
2801         }
2802
2803         return 0;
2804 }
2805
2806 static inline size_t neigh_nlmsg_size(void)
2807 {
2808         return NLMSG_ALIGN(sizeof(struct ndmsg))
2809                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2810                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2811                + nla_total_size(sizeof(struct nda_cacheinfo))
2812                + nla_total_size(4)  /* NDA_PROBES */
2813                + nla_total_size(1); /* NDA_PROTOCOL */
2814 }
2815
2816 static int neigh_get_reply(struct net *net, struct neighbour *neigh,
2817                            u32 pid, u32 seq)
2818 {
2819         struct sk_buff *skb;
2820         int err = 0;
2821
2822         skb = nlmsg_new(neigh_nlmsg_size(), GFP_KERNEL);
2823         if (!skb)
2824                 return -ENOBUFS;
2825
2826         err = neigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0);
2827         if (err) {
2828                 kfree_skb(skb);
2829                 goto errout;
2830         }
2831
2832         err = rtnl_unicast(skb, net, pid);
2833 errout:
2834         return err;
2835 }
2836
2837 static inline size_t pneigh_nlmsg_size(void)
2838 {
2839         return NLMSG_ALIGN(sizeof(struct ndmsg))
2840                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2841                + nla_total_size(1); /* NDA_PROTOCOL */
2842 }
2843
2844 static int pneigh_get_reply(struct net *net, struct pneigh_entry *neigh,
2845                             u32 pid, u32 seq, struct neigh_table *tbl)
2846 {
2847         struct sk_buff *skb;
2848         int err = 0;
2849
2850         skb = nlmsg_new(pneigh_nlmsg_size(), GFP_KERNEL);
2851         if (!skb)
2852                 return -ENOBUFS;
2853
2854         err = pneigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0, tbl);
2855         if (err) {
2856                 kfree_skb(skb);
2857                 goto errout;
2858         }
2859
2860         err = rtnl_unicast(skb, net, pid);
2861 errout:
2862         return err;
2863 }
2864
2865 static int neigh_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
2866                      struct netlink_ext_ack *extack)
2867 {
2868         struct net *net = sock_net(in_skb->sk);
2869         struct net_device *dev = NULL;
2870         struct neigh_table *tbl = NULL;
2871         struct neighbour *neigh;
2872         void *dst = NULL;
2873         u8 ndm_flags = 0;
2874         int dev_idx = 0;
2875         int err;
2876
2877         err = neigh_valid_get_req(nlh, &tbl, &dst, &dev_idx, &ndm_flags,
2878                                   extack);
2879         if (err < 0)
2880                 return err;
2881
2882         if (dev_idx) {
2883                 dev = __dev_get_by_index(net, dev_idx);
2884                 if (!dev) {
2885                         NL_SET_ERR_MSG(extack, "Unknown device ifindex");
2886                         return -ENODEV;
2887                 }
2888         }
2889
2890         if (!dst) {
2891                 NL_SET_ERR_MSG(extack, "Network address not specified");
2892                 return -EINVAL;
2893         }
2894
2895         if (ndm_flags & NTF_PROXY) {
2896                 struct pneigh_entry *pn;
2897
2898                 pn = pneigh_lookup(tbl, net, dst, dev, 0);
2899                 if (!pn) {
2900                         NL_SET_ERR_MSG(extack, "Proxy neighbour entry not found");
2901                         return -ENOENT;
2902                 }
2903                 return pneigh_get_reply(net, pn, NETLINK_CB(in_skb).portid,
2904                                         nlh->nlmsg_seq, tbl);
2905         }
2906
2907         if (!dev) {
2908                 NL_SET_ERR_MSG(extack, "No device specified");
2909                 return -EINVAL;
2910         }
2911
2912         neigh = neigh_lookup(tbl, dst, dev);
2913         if (!neigh) {
2914                 NL_SET_ERR_MSG(extack, "Neighbour entry not found");
2915                 return -ENOENT;
2916         }
2917
2918         err = neigh_get_reply(net, neigh, NETLINK_CB(in_skb).portid,
2919                               nlh->nlmsg_seq);
2920
2921         neigh_release(neigh);
2922
2923         return err;
2924 }
2925
2926 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2927 {
2928         int chain;
2929         struct neigh_hash_table *nht;
2930
2931         rcu_read_lock_bh();
2932         nht = rcu_dereference_bh(tbl->nht);
2933
2934         read_lock(&tbl->lock); /* avoid resizes */
2935         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2936                 struct neighbour *n;
2937
2938                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2939                      n != NULL;
2940                      n = rcu_dereference_bh(n->next))
2941                         cb(n, cookie);
2942         }
2943         read_unlock(&tbl->lock);
2944         rcu_read_unlock_bh();
2945 }
2946 EXPORT_SYMBOL(neigh_for_each);
2947
2948 /* The tbl->lock must be held as a writer and BH disabled. */
2949 void __neigh_for_each_release(struct neigh_table *tbl,
2950                               int (*cb)(struct neighbour *))
2951 {
2952         int chain;
2953         struct neigh_hash_table *nht;
2954
2955         nht = rcu_dereference_protected(tbl->nht,
2956                                         lockdep_is_held(&tbl->lock));
2957         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2958                 struct neighbour *n;
2959                 struct neighbour __rcu **np;
2960
2961                 np = &nht->hash_buckets[chain];
2962                 while ((n = rcu_dereference_protected(*np,
2963                                         lockdep_is_held(&tbl->lock))) != NULL) {
2964                         int release;
2965
2966                         write_lock(&n->lock);
2967                         release = cb(n);
2968                         if (release) {
2969                                 rcu_assign_pointer(*np,
2970                                         rcu_dereference_protected(n->next,
2971                                                 lockdep_is_held(&tbl->lock)));
2972                                 neigh_mark_dead(n);
2973                         } else
2974                                 np = &n->next;
2975                         write_unlock(&n->lock);
2976                         if (release)
2977                                 neigh_cleanup_and_release(n);
2978                 }
2979         }
2980 }
2981 EXPORT_SYMBOL(__neigh_for_each_release);
2982
2983 int neigh_xmit(int index, struct net_device *dev,
2984                const void *addr, struct sk_buff *skb)
2985 {
2986         int err = -EAFNOSUPPORT;
2987         if (likely(index < NEIGH_NR_TABLES)) {
2988                 struct neigh_table *tbl;
2989                 struct neighbour *neigh;
2990
2991                 tbl = neigh_tables[index];
2992                 if (!tbl)
2993                         goto out;
2994                 rcu_read_lock_bh();
2995                 if (index == NEIGH_ARP_TABLE) {
2996                         u32 key = *((u32 *)addr);
2997
2998                         neigh = __ipv4_neigh_lookup_noref(dev, key);
2999                 } else {
3000                         neigh = __neigh_lookup_noref(tbl, addr, dev);
3001                 }
3002                 if (!neigh)
3003                         neigh = __neigh_create(tbl, addr, dev, false);
3004                 err = PTR_ERR(neigh);
3005                 if (IS_ERR(neigh)) {
3006                         rcu_read_unlock_bh();
3007                         goto out_kfree_skb;
3008                 }
3009                 err = neigh->output(neigh, skb);
3010                 rcu_read_unlock_bh();
3011         }
3012         else if (index == NEIGH_LINK_TABLE) {
3013                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
3014                                       addr, NULL, skb->len);
3015                 if (err < 0)
3016                         goto out_kfree_skb;
3017                 err = dev_queue_xmit(skb);
3018         }
3019 out:
3020         return err;
3021 out_kfree_skb:
3022         kfree_skb(skb);
3023         goto out;
3024 }
3025 EXPORT_SYMBOL(neigh_xmit);
3026
3027 #ifdef CONFIG_PROC_FS
3028
3029 static struct neighbour *neigh_get_first(struct seq_file *seq)
3030 {
3031         struct neigh_seq_state *state = seq->private;
3032         struct net *net = seq_file_net(seq);
3033         struct neigh_hash_table *nht = state->nht;
3034         struct neighbour *n = NULL;
3035         int bucket;
3036
3037         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
3038         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
3039                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
3040
3041                 while (n) {
3042                         if (!net_eq(dev_net(n->dev), net))
3043                                 goto next;
3044                         if (state->neigh_sub_iter) {
3045                                 loff_t fakep = 0;
3046                                 void *v;
3047
3048                                 v = state->neigh_sub_iter(state, n, &fakep);
3049                                 if (!v)
3050                                         goto next;
3051                         }
3052                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3053                                 break;
3054                         if (n->nud_state & ~NUD_NOARP)
3055                                 break;
3056 next:
3057                         n = rcu_dereference_bh(n->next);
3058                 }
3059
3060                 if (n)
3061                         break;
3062         }
3063         state->bucket = bucket;
3064
3065         return n;
3066 }
3067
3068 static struct neighbour *neigh_get_next(struct seq_file *seq,
3069                                         struct neighbour *n,
3070                                         loff_t *pos)
3071 {
3072         struct neigh_seq_state *state = seq->private;
3073         struct net *net = seq_file_net(seq);
3074         struct neigh_hash_table *nht = state->nht;
3075
3076         if (state->neigh_sub_iter) {
3077                 void *v = state->neigh_sub_iter(state, n, pos);
3078                 if (v)
3079                         return n;
3080         }
3081         n = rcu_dereference_bh(n->next);
3082
3083         while (1) {
3084                 while (n) {
3085                         if (!net_eq(dev_net(n->dev), net))
3086                                 goto next;
3087                         if (state->neigh_sub_iter) {
3088                                 void *v = state->neigh_sub_iter(state, n, pos);
3089                                 if (v)
3090                                         return n;
3091                                 goto next;
3092                         }
3093                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3094                                 break;
3095
3096                         if (n->nud_state & ~NUD_NOARP)
3097                                 break;
3098 next:
3099                         n = rcu_dereference_bh(n->next);
3100                 }
3101
3102                 if (n)
3103                         break;
3104
3105                 if (++state->bucket >= (1 << nht->hash_shift))
3106                         break;
3107
3108                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
3109         }
3110
3111         if (n && pos)
3112                 --(*pos);
3113         return n;
3114 }
3115
3116 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
3117 {
3118         struct neighbour *n = neigh_get_first(seq);
3119
3120         if (n) {
3121                 --(*pos);
3122                 while (*pos) {
3123                         n = neigh_get_next(seq, n, pos);
3124                         if (!n)
3125                                 break;
3126                 }
3127         }
3128         return *pos ? NULL : n;
3129 }
3130
3131 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
3132 {
3133         struct neigh_seq_state *state = seq->private;
3134         struct net *net = seq_file_net(seq);
3135         struct neigh_table *tbl = state->tbl;
3136         struct pneigh_entry *pn = NULL;
3137         int bucket = state->bucket;
3138
3139         state->flags |= NEIGH_SEQ_IS_PNEIGH;
3140         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
3141                 pn = tbl->phash_buckets[bucket];
3142                 while (pn && !net_eq(pneigh_net(pn), net))
3143                         pn = pn->next;
3144                 if (pn)
3145                         break;
3146         }
3147         state->bucket = bucket;
3148
3149         return pn;
3150 }
3151
3152 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
3153                                             struct pneigh_entry *pn,
3154                                             loff_t *pos)
3155 {
3156         struct neigh_seq_state *state = seq->private;
3157         struct net *net = seq_file_net(seq);
3158         struct neigh_table *tbl = state->tbl;
3159
3160         do {
3161                 pn = pn->next;
3162         } while (pn && !net_eq(pneigh_net(pn), net));
3163
3164         while (!pn) {
3165                 if (++state->bucket > PNEIGH_HASHMASK)
3166                         break;
3167                 pn = tbl->phash_buckets[state->bucket];
3168                 while (pn && !net_eq(pneigh_net(pn), net))
3169                         pn = pn->next;
3170                 if (pn)
3171                         break;
3172         }
3173
3174         if (pn && pos)
3175                 --(*pos);
3176
3177         return pn;
3178 }
3179
3180 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
3181 {
3182         struct pneigh_entry *pn = pneigh_get_first(seq);
3183
3184         if (pn) {
3185                 --(*pos);
3186                 while (*pos) {
3187                         pn = pneigh_get_next(seq, pn, pos);
3188                         if (!pn)
3189                                 break;
3190                 }
3191         }
3192         return *pos ? NULL : pn;
3193 }
3194
3195 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
3196 {
3197         struct neigh_seq_state *state = seq->private;
3198         void *rc;
3199         loff_t idxpos = *pos;
3200
3201         rc = neigh_get_idx(seq, &idxpos);
3202         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3203                 rc = pneigh_get_idx(seq, &idxpos);
3204
3205         return rc;
3206 }
3207
3208 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
3209         __acquires(tbl->lock)
3210         __acquires(rcu_bh)
3211 {
3212         struct neigh_seq_state *state = seq->private;
3213
3214         state->tbl = tbl;
3215         state->bucket = 0;
3216         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
3217
3218         rcu_read_lock_bh();
3219         state->nht = rcu_dereference_bh(tbl->nht);
3220         read_lock(&tbl->lock);
3221
3222         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
3223 }
3224 EXPORT_SYMBOL(neigh_seq_start);
3225
3226 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3227 {
3228         struct neigh_seq_state *state;
3229         void *rc;
3230
3231         if (v == SEQ_START_TOKEN) {
3232                 rc = neigh_get_first(seq);
3233                 goto out;
3234         }
3235
3236         state = seq->private;
3237         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
3238                 rc = neigh_get_next(seq, v, NULL);
3239                 if (rc)
3240                         goto out;
3241                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3242                         rc = pneigh_get_first(seq);
3243         } else {
3244                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
3245                 rc = pneigh_get_next(seq, v, NULL);
3246         }
3247 out:
3248         ++(*pos);
3249         return rc;
3250 }
3251 EXPORT_SYMBOL(neigh_seq_next);
3252
3253 void neigh_seq_stop(struct seq_file *seq, void *v)
3254         __releases(tbl->lock)
3255         __releases(rcu_bh)
3256 {
3257         struct neigh_seq_state *state = seq->private;
3258         struct neigh_table *tbl = state->tbl;
3259
3260         read_unlock(&tbl->lock);
3261         rcu_read_unlock_bh();
3262 }
3263 EXPORT_SYMBOL(neigh_seq_stop);
3264
3265 /* statistics via seq_file */
3266
3267 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
3268 {
3269         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3270         int cpu;
3271
3272         if (*pos == 0)
3273                 return SEQ_START_TOKEN;
3274
3275         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
3276                 if (!cpu_possible(cpu))
3277                         continue;
3278                 *pos = cpu+1;
3279                 return per_cpu_ptr(tbl->stats, cpu);
3280         }
3281         return NULL;
3282 }
3283
3284 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3285 {
3286         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3287         int cpu;
3288
3289         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
3290                 if (!cpu_possible(cpu))
3291                         continue;
3292                 *pos = cpu+1;
3293                 return per_cpu_ptr(tbl->stats, cpu);
3294         }
3295         (*pos)++;
3296         return NULL;
3297 }
3298
3299 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
3300 {
3301
3302 }
3303
3304 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
3305 {
3306         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3307         struct neigh_statistics *st = v;
3308
3309         if (v == SEQ_START_TOKEN) {
3310                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
3311                 return 0;
3312         }
3313
3314         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
3315                         "%08lx %08lx  %08lx %08lx %08lx %08lx\n",
3316                    atomic_read(&tbl->entries),
3317
3318                    st->allocs,
3319                    st->destroys,
3320                    st->hash_grows,
3321
3322                    st->lookups,
3323                    st->hits,
3324
3325                    st->res_failed,
3326
3327                    st->rcv_probes_mcast,
3328                    st->rcv_probes_ucast,
3329
3330                    st->periodic_gc_runs,
3331                    st->forced_gc_runs,
3332                    st->unres_discards,
3333                    st->table_fulls
3334                    );
3335
3336         return 0;
3337 }
3338
3339 static const struct seq_operations neigh_stat_seq_ops = {
3340         .start  = neigh_stat_seq_start,
3341         .next   = neigh_stat_seq_next,
3342         .stop   = neigh_stat_seq_stop,
3343         .show   = neigh_stat_seq_show,
3344 };
3345 #endif /* CONFIG_PROC_FS */
3346
3347 static void __neigh_notify(struct neighbour *n, int type, int flags,
3348                            u32 pid)
3349 {
3350         struct net *net = dev_net(n->dev);
3351         struct sk_buff *skb;
3352         int err = -ENOBUFS;
3353
3354         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
3355         if (skb == NULL)
3356                 goto errout;
3357
3358         err = neigh_fill_info(skb, n, pid, 0, type, flags);
3359         if (err < 0) {
3360                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
3361                 WARN_ON(err == -EMSGSIZE);
3362                 kfree_skb(skb);
3363                 goto errout;
3364         }
3365         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
3366         return;
3367 errout:
3368         if (err < 0)
3369                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
3370 }
3371
3372 void neigh_app_ns(struct neighbour *n)
3373 {
3374         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
3375 }
3376 EXPORT_SYMBOL(neigh_app_ns);
3377
3378 #ifdef CONFIG_SYSCTL
3379 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
3380
3381 static int proc_unres_qlen(struct ctl_table *ctl, int write,
3382                            void *buffer, size_t *lenp, loff_t *ppos)
3383 {
3384         int size, ret;
3385         struct ctl_table tmp = *ctl;
3386
3387         tmp.extra1 = SYSCTL_ZERO;
3388         tmp.extra2 = &unres_qlen_max;
3389         tmp.data = &size;
3390
3391         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
3392         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3393
3394         if (write && !ret)
3395                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
3396         return ret;
3397 }
3398
3399 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
3400                                                    int family)
3401 {
3402         switch (family) {
3403         case AF_INET:
3404                 return __in_dev_arp_parms_get_rcu(dev);
3405         case AF_INET6:
3406                 return __in6_dev_nd_parms_get_rcu(dev);
3407         }
3408         return NULL;
3409 }
3410
3411 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
3412                                   int index)
3413 {
3414         struct net_device *dev;
3415         int family = neigh_parms_family(p);
3416
3417         rcu_read_lock();
3418         for_each_netdev_rcu(net, dev) {
3419                 struct neigh_parms *dst_p =
3420                                 neigh_get_dev_parms_rcu(dev, family);
3421
3422                 if (dst_p && !test_bit(index, dst_p->data_state))
3423                         dst_p->data[index] = p->data[index];
3424         }
3425         rcu_read_unlock();
3426 }
3427
3428 static void neigh_proc_update(struct ctl_table *ctl, int write)
3429 {
3430         struct net_device *dev = ctl->extra1;
3431         struct neigh_parms *p = ctl->extra2;
3432         struct net *net = neigh_parms_net(p);
3433         int index = (int *) ctl->data - p->data;
3434
3435         if (!write)
3436                 return;
3437
3438         set_bit(index, p->data_state);
3439         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
3440                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
3441         if (!dev) /* NULL dev means this is default value */
3442                 neigh_copy_dflt_parms(net, p, index);
3443 }
3444
3445 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
3446                                            void *buffer, size_t *lenp,
3447                                            loff_t *ppos)
3448 {
3449         struct ctl_table tmp = *ctl;
3450         int ret;
3451
3452         tmp.extra1 = SYSCTL_ZERO;
3453         tmp.extra2 = SYSCTL_INT_MAX;
3454
3455         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3456         neigh_proc_update(ctl, write);
3457         return ret;
3458 }
3459
3460 int neigh_proc_dointvec(struct ctl_table *ctl, int write, void *buffer,
3461                         size_t *lenp, loff_t *ppos)
3462 {
3463         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3464
3465         neigh_proc_update(ctl, write);
3466         return ret;
3467 }
3468 EXPORT_SYMBOL(neigh_proc_dointvec);
3469
3470 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write, void *buffer,
3471                                 size_t *lenp, loff_t *ppos)
3472 {
3473         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3474
3475         neigh_proc_update(ctl, write);
3476         return ret;
3477 }
3478 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3479
3480 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3481                                               void *buffer, size_t *lenp,
3482                                               loff_t *ppos)
3483 {
3484         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3485
3486         neigh_proc_update(ctl, write);
3487         return ret;
3488 }
3489
3490 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3491                                    void *buffer, size_t *lenp, loff_t *ppos)
3492 {
3493         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3494
3495         neigh_proc_update(ctl, write);
3496         return ret;
3497 }
3498 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3499
3500 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3501                                           void *buffer, size_t *lenp,
3502                                           loff_t *ppos)
3503 {
3504         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3505
3506         neigh_proc_update(ctl, write);
3507         return ret;
3508 }
3509
3510 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3511                                           void *buffer, size_t *lenp,
3512                                           loff_t *ppos)
3513 {
3514         struct neigh_parms *p = ctl->extra2;
3515         int ret;
3516
3517         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3518                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3519         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3520                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3521         else
3522                 ret = -1;
3523
3524         if (write && ret == 0) {
3525                 /* update reachable_time as well, otherwise, the change will
3526                  * only be effective after the next time neigh_periodic_work
3527                  * decides to recompute it
3528                  */
3529                 p->reachable_time =
3530                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3531         }
3532         return ret;
3533 }
3534
3535 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3536         (&((struct neigh_parms *) 0)->data[index])
3537
3538 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3539         [NEIGH_VAR_ ## attr] = { \
3540                 .procname       = name, \
3541                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3542                 .maxlen         = sizeof(int), \
3543                 .mode           = mval, \
3544                 .proc_handler   = proc, \
3545         }
3546
3547 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3548         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3549
3550 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3551         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3552
3553 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3554         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3555
3556 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3557         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3558
3559 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3560         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3561
3562 static struct neigh_sysctl_table {
3563         struct ctl_table_header *sysctl_header;
3564         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3565 } neigh_sysctl_template __read_mostly = {
3566         .neigh_vars = {
3567                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3568                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3569                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3570                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3571                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3572                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3573                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3574                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3575                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3576                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3577                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3578                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3579                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3580                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3581                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3582                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3583                 [NEIGH_VAR_GC_INTERVAL] = {
3584                         .procname       = "gc_interval",
3585                         .maxlen         = sizeof(int),
3586                         .mode           = 0644,
3587                         .proc_handler   = proc_dointvec_jiffies,
3588                 },
3589                 [NEIGH_VAR_GC_THRESH1] = {
3590                         .procname       = "gc_thresh1",
3591                         .maxlen         = sizeof(int),
3592                         .mode           = 0644,
3593                         .extra1         = SYSCTL_ZERO,
3594                         .extra2         = SYSCTL_INT_MAX,
3595                         .proc_handler   = proc_dointvec_minmax,
3596                 },
3597                 [NEIGH_VAR_GC_THRESH2] = {
3598                         .procname       = "gc_thresh2",
3599                         .maxlen         = sizeof(int),
3600                         .mode           = 0644,
3601                         .extra1         = SYSCTL_ZERO,
3602                         .extra2         = SYSCTL_INT_MAX,
3603                         .proc_handler   = proc_dointvec_minmax,
3604                 },
3605                 [NEIGH_VAR_GC_THRESH3] = {
3606                         .procname       = "gc_thresh3",
3607                         .maxlen         = sizeof(int),
3608                         .mode           = 0644,
3609                         .extra1         = SYSCTL_ZERO,
3610                         .extra2         = SYSCTL_INT_MAX,
3611                         .proc_handler   = proc_dointvec_minmax,
3612                 },
3613                 {},
3614         },
3615 };
3616
3617 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3618                           proc_handler *handler)
3619 {
3620         int i;
3621         struct neigh_sysctl_table *t;
3622         const char *dev_name_source;
3623         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3624         char *p_name;
3625
3626         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3627         if (!t)
3628                 goto err;
3629
3630         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3631                 t->neigh_vars[i].data += (long) p;
3632                 t->neigh_vars[i].extra1 = dev;
3633                 t->neigh_vars[i].extra2 = p;
3634         }
3635
3636         if (dev) {
3637                 dev_name_source = dev->name;
3638                 /* Terminate the table early */
3639                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3640                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3641         } else {
3642                 struct neigh_table *tbl = p->tbl;
3643                 dev_name_source = "default";
3644                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3645                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3646                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3647                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3648         }
3649
3650         if (handler) {
3651                 /* RetransTime */
3652                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3653                 /* ReachableTime */
3654                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3655                 /* RetransTime (in milliseconds)*/
3656                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3657                 /* ReachableTime (in milliseconds) */
3658                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3659         } else {
3660                 /* Those handlers will update p->reachable_time after
3661                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3662                  * applied after the next neighbour update instead of waiting for
3663                  * neigh_periodic_work to update its value (can be multiple minutes)
3664                  * So any handler that replaces them should do this as well
3665                  */
3666                 /* ReachableTime */
3667                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3668                         neigh_proc_base_reachable_time;
3669                 /* ReachableTime (in milliseconds) */
3670                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3671                         neigh_proc_base_reachable_time;
3672         }
3673
3674         /* Don't export sysctls to unprivileged users */
3675         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3676                 t->neigh_vars[0].procname = NULL;
3677
3678         switch (neigh_parms_family(p)) {
3679         case AF_INET:
3680               p_name = "ipv4";
3681               break;
3682         case AF_INET6:
3683               p_name = "ipv6";
3684               break;
3685         default:
3686               BUG();
3687         }
3688
3689         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3690                 p_name, dev_name_source);
3691         t->sysctl_header =
3692                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3693         if (!t->sysctl_header)
3694                 goto free;
3695
3696         p->sysctl_table = t;
3697         return 0;
3698
3699 free:
3700         kfree(t);
3701 err:
3702         return -ENOBUFS;
3703 }
3704 EXPORT_SYMBOL(neigh_sysctl_register);
3705
3706 void neigh_sysctl_unregister(struct neigh_parms *p)
3707 {
3708         if (p->sysctl_table) {
3709                 struct neigh_sysctl_table *t = p->sysctl_table;
3710                 p->sysctl_table = NULL;
3711                 unregister_net_sysctl_table(t->sysctl_header);
3712                 kfree(t);
3713         }
3714 }
3715 EXPORT_SYMBOL(neigh_sysctl_unregister);
3716
3717 #endif  /* CONFIG_SYSCTL */
3718
3719 static int __init neigh_init(void)
3720 {
3721         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, 0);
3722         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, 0);
3723         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, neigh_get, neigh_dump_info, 0);
3724
3725         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3726                       0);
3727         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0);
3728
3729         return 0;
3730 }
3731
3732 subsys_initcall(neigh_init);