net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/slab.h>
  21 #include <linux/types.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/socket.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/proc_fs.h>
  27 #ifdef CONFIG_SYSCTL
  28 #include <linux/sysctl.h>
  29 #endif
  30 #include <linux/times.h>
  31 #include <net/net_namespace.h>
  32 #include <net/neighbour.h>
  33 #include <net/dst.h>
  34 #include <net/sock.h>
  35 #include <net/netevent.h>
  36 #include <net/netlink.h>
  37 #include <linux/rtnetlink.h>
  38 #include <linux/random.h>
  39 #include <linux/string.h>
  40 #include <linux/log2.h>
  41 #include <linux/inetdevice.h>
  42 #include <net/addrconf.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(struct timer_list *t);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags,
  56                            u32 pid);
  57 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  58 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
  59                                     struct net_device *dev);
  60
  61 #ifdef CONFIG_PROC_FS
  62 static const struct seq_operations neigh_stat_seq_ops;
  63 #endif
  64
  65 /*
  66    Neighbour hash table buckets are protected with rwlock tbl->lock.
  67
  68    - All the scans/updates to hash buckets MUST be made under this lock.
  69    - NOTHING clever should be made under this lock: no callbacks
  70      to protocol backends, no attempts to send something to network.
  71      It will result in deadlocks, if backend/driver wants to use neighbour
  72      cache.
  73    - If the entry requires some non-trivial actions, increase
  74      its reference count and release table lock.
  75
  76    Neighbour entries are protected:
  77    - with reference count.
  78    - with rwlock neigh->lock
  79
  80    Reference count prevents destruction.
  81
  82    neigh->lock mainly serializes ll address data and its validity state.
  83    However, the same lock is used to protect another entry fields:
  84     - timer
  85     - resolution queue
  86
  87    Again, nothing clever shall be made under neigh->lock,
  88    the most complicated procedure, which we allow is dev->hard_header.
  89    It is supposed, that dev->hard_header is simplistic and does
  90    not make callbacks to neighbour tables.
  91  */
  92
  93 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  94 {
  95         kfree_skb(skb);
  96         return -ENETDOWN;
  97 }
  98
  99 static void neigh_cleanup_and_release(struct neighbour *neigh)
 100 {
 101         if (neigh->parms->neigh_cleanup)
 102                 neigh->parms->neigh_cleanup(neigh);
 103
 104         __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 105         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 106         neigh_release(neigh);
 107 }
 108
 109 /*
 110  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 111  * It corresponds to default IPv6 settings and is not overridable,
 112  * because it is really reasonable choice.
 113  */
 114
 115 unsigned long neigh_rand_reach_time(unsigned long base)
 116 {
 117         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 118 }
 119 EXPORT_SYMBOL(neigh_rand_reach_time);
 120
 121
 122 static bool neigh_del(struct neighbour *n, __u8 state, __u8 flags,
 123                       struct neighbour __rcu **np, struct neigh_table *tbl)
 124 {
 125         bool retval = false;
 126
 127         write_lock(&n->lock);
 128         if (refcount_read(&n->refcnt) == 1 && !(n->nud_state & state) &&
 129             !(n->flags & flags)) {
 130                 struct neighbour *neigh;
 131
 132                 neigh = rcu_dereference_protected(n->next,
 133                                                   lockdep_is_held(&tbl->lock));
 134                 rcu_assign_pointer(*np, neigh);
 135                 n->dead = 1;
 136                 retval = true;
 137         }
 138         write_unlock(&n->lock);
 139         if (retval)
 140                 neigh_cleanup_and_release(n);
 141         return retval;
 142 }
 143
 144 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 145 {
 146         struct neigh_hash_table *nht;
 147         void *pkey = ndel->primary_key;
 148         u32 hash_val;
 149         struct neighbour *n;
 150         struct neighbour __rcu **np;
 151
 152         nht = rcu_dereference_protected(tbl->nht,
 153                                         lockdep_is_held(&tbl->lock));
 154         hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
 155         hash_val = hash_val >> (32 - nht->hash_shift);
 156
 157         np = &nht->hash_buckets[hash_val];
 158         while ((n = rcu_dereference_protected(*np,
 159                                               lockdep_is_held(&tbl->lock)))) {
 160                 if (n == ndel)
 161                         return neigh_del(n, 0, 0, np, tbl);
 162                 np = &n->next;
 163         }
 164         return false;
 165 }
 166
 167 static int neigh_forced_gc(struct neigh_table *tbl)
 168 {
 169         int shrunk = 0;
 170         int i;
 171         struct neigh_hash_table *nht;
 172
 173         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 174
 175         write_lock_bh(&tbl->lock);
 176         nht = rcu_dereference_protected(tbl->nht,
 177                                         lockdep_is_held(&tbl->lock));
 178         for (i = 0; i < (1 << nht->hash_shift); i++) {
 179                 struct neighbour *n;
 180                 struct neighbour __rcu **np;
 181
 182                 np = &nht->hash_buckets[i];
 183                 while ((n = rcu_dereference_protected(*np,
 184                                         lockdep_is_held(&tbl->lock))) != NULL) {
 185                         /* Neighbour record may be discarded if:
 186                          * - nobody refers to it.
 187                          * - it is not permanent
 188                          */
 189                         if (neigh_del(n, NUD_PERMANENT, NTF_EXT_LEARNED, np,
 190                                       tbl)) {
 191                                 shrunk = 1;
 192                                 continue;
 193                         }
 194                         np = &n->next;
 195                 }
 196         }
 197
 198         tbl->last_flush = jiffies;
 199
 200         write_unlock_bh(&tbl->lock);
 201
 202         return shrunk;
 203 }
 204
 205 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 206 {
 207         neigh_hold(n);
 208         if (unlikely(mod_timer(&n->timer, when))) {
 209                 printk("NEIGH: BUG, double timer add, state is %x\n",
 210                        n->nud_state);
 211                 dump_stack();
 212         }
 213 }
 214
 215 static int neigh_del_timer(struct neighbour *n)
 216 {
 217         if ((n->nud_state & NUD_IN_TIMER) &&
 218             del_timer(&n->timer)) {
 219                 neigh_release(n);
 220                 return 1;
 221         }
 222         return 0;
 223 }
 224
 225 static void pneigh_queue_purge(struct sk_buff_head *list)
 226 {
 227         struct sk_buff *skb;
 228
 229         while ((skb = skb_dequeue(list)) != NULL) {
 230                 dev_put(skb->dev);
 231                 kfree_skb(skb);
 232         }
 233 }
 234
 235 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 236 {
 237         int i;
 238         struct neigh_hash_table *nht;
 239
 240         nht = rcu_dereference_protected(tbl->nht,
 241                                         lockdep_is_held(&tbl->lock));
 242
 243         for (i = 0; i < (1 << nht->hash_shift); i++) {
 244                 struct neighbour *n;
 245                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 246
 247                 while ((n = rcu_dereference_protected(*np,
 248                                         lockdep_is_held(&tbl->lock))) != NULL) {
 249                         if (dev && n->dev != dev) {
 250                                 np = &n->next;
 251                                 continue;
 252                         }
 253                         rcu_assign_pointer(*np,
 254                                    rcu_dereference_protected(n->next,
 255                                                 lockdep_is_held(&tbl->lock)));
 256                         write_lock(&n->lock);
 257                         neigh_del_timer(n);
 258                         n->dead = 1;
 259
 260                         if (refcount_read(&n->refcnt) != 1) {
 261                                 /* The most unpleasant situation.
 262                                    We must destroy neighbour entry,
 263                                    but someone still uses it.
 264
 265                                    The destroy will be delayed until
 266                                    the last user releases us, but
 267                                    we must kill timers etc. and move
 268                                    it to safe state.
 269                                  */
 270                                 __skb_queue_purge(&n->arp_queue);
 271                                 n->arp_queue_len_bytes = 0;
 272                                 n->output = neigh_blackhole;
 273                                 if (n->nud_state & NUD_VALID)
 274                                         n->nud_state = NUD_NOARP;
 275                                 else
 276                                         n->nud_state = NUD_NONE;
 277                                 neigh_dbg(2, "neigh %p is stray\n", n);
 278                         }
 279                         write_unlock(&n->lock);
 280                         neigh_cleanup_and_release(n);
 281                 }
 282         }
 283 }
 284
 285 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 286 {
 287         write_lock_bh(&tbl->lock);
 288         neigh_flush_dev(tbl, dev);
 289         write_unlock_bh(&tbl->lock);
 290 }
 291 EXPORT_SYMBOL(neigh_changeaddr);
 292
 293 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 294 {
 295         write_lock_bh(&tbl->lock);
 296         neigh_flush_dev(tbl, dev);
 297         pneigh_ifdown_and_unlock(tbl, dev);
 298
 299         del_timer_sync(&tbl->proxy_timer);
 300         pneigh_queue_purge(&tbl->proxy_queue);
 301         return 0;
 302 }
 303 EXPORT_SYMBOL(neigh_ifdown);
 304
 305 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 306 {
 307         struct neighbour *n = NULL;
 308         unsigned long now = jiffies;
 309         int entries;
 310
 311         entries = atomic_inc_return(&tbl->entries) - 1;
 312         if (entries >= tbl->gc_thresh3 ||
 313             (entries >= tbl->gc_thresh2 &&
 314              time_after(now, tbl->last_flush + 5 * HZ))) {
 315                 if (!neigh_forced_gc(tbl) &&
 316                     entries >= tbl->gc_thresh3) {
 317                         net_info_ratelimited("%s: neighbor table overflow!\n",
 318                                              tbl->id);
 319                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 320                         goto out_entries;
 321                 }
 322         }
 323
 324         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 325         if (!n)
 326                 goto out_entries;
 327
 328         __skb_queue_head_init(&n->arp_queue);
 329         rwlock_init(&n->lock);
 330         seqlock_init(&n->ha_lock);
 331         n->updated        = n->used = now;
 332         n->nud_state      = NUD_NONE;
 333         n->output         = neigh_blackhole;
 334         seqlock_init(&n->hh.hh_lock);
 335         n->parms          = neigh_parms_clone(&tbl->parms);
 336         timer_setup(&n->timer, neigh_timer_handler, 0);
 337
 338         NEIGH_CACHE_STAT_INC(tbl, allocs);
 339         n->tbl            = tbl;
 340         refcount_set(&n->refcnt, 1);
 341         n->dead           = 1;
 342 out:
 343         return n;
 344
 345 out_entries:
 346         atomic_dec(&tbl->entries);
 347         goto out;
 348 }
 349
 350 static void neigh_get_hash_rnd(u32 *x)
 351 {
 352         *x = get_random_u32() | 1;
 353 }
 354
 355 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 356 {
 357         size_t size = (1 << shift) * sizeof(struct neighbour *);
 358         struct neigh_hash_table *ret;
 359         struct neighbour __rcu **buckets;
 360         int i;
 361
 362         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 363         if (!ret)
 364                 return NULL;
 365         if (size <= PAGE_SIZE)
 366                 buckets = kzalloc(size, GFP_ATOMIC);
 367         else
 368                 buckets = (struct neighbour __rcu **)
 369                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 370                                            get_order(size));
 371         if (!buckets) {
 372                 kfree(ret);
 373                 return NULL;
 374         }
 375         ret->hash_buckets = buckets;
 376         ret->hash_shift = shift;
 377         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 378                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 379         return ret;
 380 }
 381
 382 static void neigh_hash_free_rcu(struct rcu_head *head)
 383 {
 384         struct neigh_hash_table *nht = container_of(head,
 385                                                     struct neigh_hash_table,
 386                                                     rcu);
 387         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 388         struct neighbour __rcu **buckets = nht->hash_buckets;
 389
 390         if (size <= PAGE_SIZE)
 391                 kfree(buckets);
 392         else
 393                 free_pages((unsigned long)buckets, get_order(size));
 394         kfree(nht);
 395 }
 396
 397 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 398                                                 unsigned long new_shift)
 399 {
 400         unsigned int i, hash;
 401         struct neigh_hash_table *new_nht, *old_nht;
 402
 403         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 404
 405         old_nht = rcu_dereference_protected(tbl->nht,
 406                                             lockdep_is_held(&tbl->lock));
 407         new_nht = neigh_hash_alloc(new_shift);
 408         if (!new_nht)
 409                 return old_nht;
 410
 411         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 412                 struct neighbour *n, *next;
 413
 414                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 415                                                    lockdep_is_held(&tbl->lock));
 416                      n != NULL;
 417                      n = next) {
 418                         hash = tbl->hash(n->primary_key, n->dev,
 419                                          new_nht->hash_rnd);
 420
 421                         hash >>= (32 - new_nht->hash_shift);
 422                         next = rcu_dereference_protected(n->next,
 423                                                 lockdep_is_held(&tbl->lock));
 424
 425                         rcu_assign_pointer(n->next,
 426                                            rcu_dereference_protected(
 427                                                 new_nht->hash_buckets[hash],
 428                                                 lockdep_is_held(&tbl->lock)));
 429                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 430                 }
 431         }
 432
 433         rcu_assign_pointer(tbl->nht, new_nht);
 434         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 435         return new_nht;
 436 }
 437
 438 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 439                                struct net_device *dev)
 440 {
 441         struct neighbour *n;
 442
 443         NEIGH_CACHE_STAT_INC(tbl, lookups);
 444
 445         rcu_read_lock_bh();
 446         n = __neigh_lookup_noref(tbl, pkey, dev);
 447         if (n) {
 448                 if (!refcount_inc_not_zero(&n->refcnt))
 449                         n = NULL;
 450                 NEIGH_CACHE_STAT_INC(tbl, hits);
 451         }
 452
 453         rcu_read_unlock_bh();
 454         return n;
 455 }
 456 EXPORT_SYMBOL(neigh_lookup);
 457
 458 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 459                                      const void *pkey)
 460 {
 461         struct neighbour *n;
 462         unsigned int key_len = tbl->key_len;
 463         u32 hash_val;
 464         struct neigh_hash_table *nht;
 465
 466         NEIGH_CACHE_STAT_INC(tbl, lookups);
 467
 468         rcu_read_lock_bh();
 469         nht = rcu_dereference_bh(tbl->nht);
 470         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 471
 472         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 473              n != NULL;
 474              n = rcu_dereference_bh(n->next)) {
 475                 if (!memcmp(n->primary_key, pkey, key_len) &&
 476                     net_eq(dev_net(n->dev), net)) {
 477                         if (!refcount_inc_not_zero(&n->refcnt))
 478                                 n = NULL;
 479                         NEIGH_CACHE_STAT_INC(tbl, hits);
 480                         break;
 481                 }
 482         }
 483
 484         rcu_read_unlock_bh();
 485         return n;
 486 }
 487 EXPORT_SYMBOL(neigh_lookup_nodev);
 488
 489 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 490                                  struct net_device *dev, bool want_ref)
 491 {
 492         u32 hash_val;
 493         unsigned int key_len = tbl->key_len;
 494         int error;
 495         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 496         struct neigh_hash_table *nht;
 497
 498         if (!n) {
 499                 rc = ERR_PTR(-ENOBUFS);
 500                 goto out;
 501         }
 502
 503         memcpy(n->primary_key, pkey, key_len);
 504         n->dev = dev;
 505         dev_hold(dev);
 506
 507         /* Protocol specific setup. */
 508         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 509                 rc = ERR_PTR(error);
 510                 goto out_neigh_release;
 511         }
 512
 513         if (dev->netdev_ops->ndo_neigh_construct) {
 514                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 515                 if (error < 0) {
 516                         rc = ERR_PTR(error);
 517                         goto out_neigh_release;
 518                 }
 519         }
 520
 521         /* Device specific setup. */
 522         if (n->parms->neigh_setup &&
 523             (error = n->parms->neigh_setup(n)) < 0) {
 524                 rc = ERR_PTR(error);
 525                 goto out_neigh_release;
 526         }
 527
 528         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 529
 530         write_lock_bh(&tbl->lock);
 531         nht = rcu_dereference_protected(tbl->nht,
 532                                         lockdep_is_held(&tbl->lock));
 533
 534         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 535                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 536
 537         hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 538
 539         if (n->parms->dead) {
 540                 rc = ERR_PTR(-EINVAL);
 541                 goto out_tbl_unlock;
 542         }
 543
 544         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 545                                             lockdep_is_held(&tbl->lock));
 546              n1 != NULL;
 547              n1 = rcu_dereference_protected(n1->next,
 548                         lockdep_is_held(&tbl->lock))) {
 549                 if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) {
 550                         if (want_ref)
 551                                 neigh_hold(n1);
 552                         rc = n1;
 553                         goto out_tbl_unlock;
 554                 }
 555         }
 556
 557         n->dead = 0;
 558         if (want_ref)
 559                 neigh_hold(n);
 560         rcu_assign_pointer(n->next,
 561                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 562                                                      lockdep_is_held(&tbl->lock)));
 563         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 564         write_unlock_bh(&tbl->lock);
 565         neigh_dbg(2, "neigh %p is created\n", n);
 566         rc = n;
 567 out:
 568         return rc;
 569 out_tbl_unlock:
 570         write_unlock_bh(&tbl->lock);
 571 out_neigh_release:
 572         neigh_release(n);
 573         goto out;
 574 }
 575 EXPORT_SYMBOL(__neigh_create);
 576
 577 static u32 pneigh_hash(const void *pkey, unsigned int key_len)
 578 {
 579         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 580         hash_val ^= (hash_val >> 16);
 581         hash_val ^= hash_val >> 8;
 582         hash_val ^= hash_val >> 4;
 583         hash_val &= PNEIGH_HASHMASK;
 584         return hash_val;
 585 }
 586
 587 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 588                                               struct net *net,
 589                                               const void *pkey,
 590                                               unsigned int key_len,
 591                                               struct net_device *dev)
 592 {
 593         while (n) {
 594                 if (!memcmp(n->key, pkey, key_len) &&
 595                     net_eq(pneigh_net(n), net) &&
 596                     (n->dev == dev || !n->dev))
 597                         return n;
 598                 n = n->next;
 599         }
 600         return NULL;
 601 }
 602
 603 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 604                 struct net *net, const void *pkey, struct net_device *dev)
 605 {
 606         unsigned int key_len = tbl->key_len;
 607         u32 hash_val = pneigh_hash(pkey, key_len);
 608
 609         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 610                                  net, pkey, key_len, dev);
 611 }
 612 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 613
 614 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 615                                     struct net *net, const void *pkey,
 616                                     struct net_device *dev, int creat)
 617 {
 618         struct pneigh_entry *n;
 619         unsigned int key_len = tbl->key_len;
 620         u32 hash_val = pneigh_hash(pkey, key_len);
 621
 622         read_lock_bh(&tbl->lock);
 623         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 624                               net, pkey, key_len, dev);
 625         read_unlock_bh(&tbl->lock);
 626
 627         if (n || !creat)
 628                 goto out;
 629
 630         ASSERT_RTNL();
 631
 632         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 633         if (!n)
 634                 goto out;
 635
 636         write_pnet(&n->net, net);
 637         memcpy(n->key, pkey, key_len);
 638         n->dev = dev;
 639         if (dev)
 640                 dev_hold(dev);
 641
 642         if (tbl->pconstructor && tbl->pconstructor(n)) {
 643                 if (dev)
 644                         dev_put(dev);
 645                 kfree(n);
 646                 n = NULL;
 647                 goto out;
 648         }
 649
 650         write_lock_bh(&tbl->lock);
 651         n->next = tbl->phash_buckets[hash_val];
 652         tbl->phash_buckets[hash_val] = n;
 653         write_unlock_bh(&tbl->lock);
 654 out:
 655         return n;
 656 }
 657 EXPORT_SYMBOL(pneigh_lookup);
 658
 659
 660 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 661                   struct net_device *dev)
 662 {
 663         struct pneigh_entry *n, **np;
 664         unsigned int key_len = tbl->key_len;
 665         u32 hash_val = pneigh_hash(pkey, key_len);
 666
 667         write_lock_bh(&tbl->lock);
 668         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 669              np = &n->next) {
 670                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 671                     net_eq(pneigh_net(n), net)) {
 672                         *np = n->next;
 673                         write_unlock_bh(&tbl->lock);
 674                         if (tbl->pdestructor)
 675                                 tbl->pdestructor(n);
 676                         if (n->dev)
 677                                 dev_put(n->dev);
 678                         kfree(n);
 679                         return 0;
 680                 }
 681         }
 682         write_unlock_bh(&tbl->lock);
 683         return -ENOENT;
 684 }
 685
 686 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
 687                                     struct net_device *dev)
 688 {
 689         struct pneigh_entry *n, **np, *freelist = NULL;
 690         u32 h;
 691
 692         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 693                 np = &tbl->phash_buckets[h];
 694                 while ((n = *np) != NULL) {
 695                         if (!dev || n->dev == dev) {
 696                                 *np = n->next;
 697                                 n->next = freelist;
 698                                 freelist = n;
 699                                 continue;
 700                         }
 701                         np = &n->next;
 702                 }
 703         }
 704         write_unlock_bh(&tbl->lock);
 705         while ((n = freelist)) {
 706                 freelist = n->next;
 707                 n->next = NULL;
 708                 if (tbl->pdestructor)
 709                         tbl->pdestructor(n);
 710                 if (n->dev)
 711                         dev_put(n->dev);
 712                 kfree(n);
 713         }
 714         return -ENOENT;
 715 }
 716
 717 static void neigh_parms_destroy(struct neigh_parms *parms);
 718
 719 static inline void neigh_parms_put(struct neigh_parms *parms)
 720 {
 721         if (refcount_dec_and_test(&parms->refcnt))
 722                 neigh_parms_destroy(parms);
 723 }
 724
 725 /*
 726  *      neighbour must already be out of the table;
 727  *
 728  */
 729 void neigh_destroy(struct neighbour *neigh)
 730 {
 731         struct net_device *dev = neigh->dev;
 732
 733         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 734
 735         if (!neigh->dead) {
 736                 pr_warn("Destroying alive neighbour %p\n", neigh);
 737                 dump_stack();
 738                 return;
 739         }
 740
 741         if (neigh_del_timer(neigh))
 742                 pr_warn("Impossible event\n");
 743
 744         write_lock_bh(&neigh->lock);
 745         __skb_queue_purge(&neigh->arp_queue);
 746         write_unlock_bh(&neigh->lock);
 747         neigh->arp_queue_len_bytes = 0;
 748
 749         if (dev->netdev_ops->ndo_neigh_destroy)
 750                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 751
 752         dev_put(dev);
 753         neigh_parms_put(neigh->parms);
 754
 755         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 756
 757         atomic_dec(&neigh->tbl->entries);
 758         kfree_rcu(neigh, rcu);
 759 }
 760 EXPORT_SYMBOL(neigh_destroy);
 761
 762 /* Neighbour state is suspicious;
 763    disable fast path.
 764
 765    Called with write_locked neigh.
 766  */
 767 static void neigh_suspect(struct neighbour *neigh)
 768 {
 769         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 770
 771         neigh->output = neigh->ops->output;
 772 }
 773
 774 /* Neighbour state is OK;
 775    enable fast path.
 776
 777    Called with write_locked neigh.
 778  */
 779 static void neigh_connect(struct neighbour *neigh)
 780 {
 781         neigh_dbg(2, "neigh %p is connected\n", neigh);
 782
 783         neigh->output = neigh->ops->connected_output;
 784 }
 785
 786 static void neigh_periodic_work(struct work_struct *work)
 787 {
 788         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 789         struct neighbour *n;
 790         struct neighbour __rcu **np;
 791         unsigned int i;
 792         struct neigh_hash_table *nht;
 793
 794         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 795
 796         write_lock_bh(&tbl->lock);
 797         nht = rcu_dereference_protected(tbl->nht,
 798                                         lockdep_is_held(&tbl->lock));
 799
 800         /*
 801          *      periodically recompute ReachableTime from random function
 802          */
 803
 804         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 805                 struct neigh_parms *p;
 806                 tbl->last_rand = jiffies;
 807                 list_for_each_entry(p, &tbl->parms_list, list)
 808                         p->reachable_time =
 809                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 810         }
 811
 812         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 813                 goto out;
 814
 815         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 816                 np = &nht->hash_buckets[i];
 817
 818                 while ((n = rcu_dereference_protected(*np,
 819                                 lockdep_is_held(&tbl->lock))) != NULL) {
 820                         unsigned int state;
 821
 822                         write_lock(&n->lock);
 823
 824                         state = n->nud_state;
 825                         if ((state & (NUD_PERMANENT | NUD_IN_TIMER)) ||
 826                             (n->flags & NTF_EXT_LEARNED)) {
 827                                 write_unlock(&n->lock);
 828                                 goto next_elt;
 829                         }
 830
 831                         if (time_before(n->used, n->confirmed))
 832                                 n->used = n->confirmed;
 833
 834                         if (refcount_read(&n->refcnt) == 1 &&
 835                             (state == NUD_FAILED ||
 836                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 837                                 *np = n->next;
 838                                 n->dead = 1;
 839                                 write_unlock(&n->lock);
 840                                 neigh_cleanup_and_release(n);
 841                                 continue;
 842                         }
 843                         write_unlock(&n->lock);
 844
 845 next_elt:
 846                         np = &n->next;
 847                 }
 848                 /*
 849                  * It's fine to release lock here, even if hash table
 850                  * grows while we are preempted.
 851                  */
 852                 write_unlock_bh(&tbl->lock);
 853                 cond_resched();
 854                 write_lock_bh(&tbl->lock);
 855                 nht = rcu_dereference_protected(tbl->nht,
 856                                                 lockdep_is_held(&tbl->lock));
 857         }
 858 out:
 859         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 860          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 861          * BASE_REACHABLE_TIME.
 862          */
 863         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 864                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 865         write_unlock_bh(&tbl->lock);
 866 }
 867
 868 static __inline__ int neigh_max_probes(struct neighbour *n)
 869 {
 870         struct neigh_parms *p = n->parms;
 871         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 872                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 873                 NEIGH_VAR(p, MCAST_PROBES));
 874 }
 875
 876 static void neigh_invalidate(struct neighbour *neigh)
 877         __releases(neigh->lock)
 878         __acquires(neigh->lock)
 879 {
 880         struct sk_buff *skb;
 881
 882         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 883         neigh_dbg(2, "neigh %p is failed\n", neigh);
 884         neigh->updated = jiffies;
 885
 886         /* It is very thin place. report_unreachable is very complicated
 887            routine. Particularly, it can hit the same neighbour entry!
 888
 889            So that, we try to be accurate and avoid dead loop. --ANK
 890          */
 891         while (neigh->nud_state == NUD_FAILED &&
 892                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 893                 write_unlock(&neigh->lock);
 894                 neigh->ops->error_report(neigh, skb);
 895                 write_lock(&neigh->lock);
 896         }
 897         __skb_queue_purge(&neigh->arp_queue);
 898         neigh->arp_queue_len_bytes = 0;
 899 }
 900
 901 static void neigh_probe(struct neighbour *neigh)
 902         __releases(neigh->lock)
 903 {
 904         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 905         /* keep skb alive even if arp_queue overflows */
 906         if (skb)
 907                 skb = skb_clone(skb, GFP_ATOMIC);
 908         write_unlock(&neigh->lock);
 909         if (neigh->ops->solicit)
 910                 neigh->ops->solicit(neigh, skb);
 911         atomic_inc(&neigh->probes);
 912         kfree_skb(skb);
 913 }
 914
 915 /* Called when a timer expires for a neighbour entry. */
 916
 917 static void neigh_timer_handler(struct timer_list *t)
 918 {
 919         unsigned long now, next;
 920         struct neighbour *neigh = from_timer(neigh, t, timer);
 921         unsigned int state;
 922         int notify = 0;
 923
 924         write_lock(&neigh->lock);
 925
 926         state = neigh->nud_state;
 927         now = jiffies;
 928         next = now + HZ;
 929
 930         if (!(state & NUD_IN_TIMER))
 931                 goto out;
 932
 933         if (state & NUD_REACHABLE) {
 934                 if (time_before_eq(now,
 935                                    neigh->confirmed + neigh->parms->reachable_time)) {
 936                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
 937                         next = neigh->confirmed + neigh->parms->reachable_time;
 938                 } else if (time_before_eq(now,
 939                                           neigh->used +
 940                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 941                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
 942                         neigh->nud_state = NUD_DELAY;
 943                         neigh->updated = jiffies;
 944                         neigh_suspect(neigh);
 945                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 946                 } else {
 947                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 948                         neigh->nud_state = NUD_STALE;
 949                         neigh->updated = jiffies;
 950                         neigh_suspect(neigh);
 951                         notify = 1;
 952                 }
 953         } else if (state & NUD_DELAY) {
 954                 if (time_before_eq(now,
 955                                    neigh->confirmed +
 956                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 957                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 958                         neigh->nud_state = NUD_REACHABLE;
 959                         neigh->updated = jiffies;
 960                         neigh_connect(neigh);
 961                         notify = 1;
 962                         next = neigh->confirmed + neigh->parms->reachable_time;
 963                 } else {
 964                         neigh_dbg(2, "neigh %p is probed\n", neigh);
 965                         neigh->nud_state = NUD_PROBE;
 966                         neigh->updated = jiffies;
 967                         atomic_set(&neigh->probes, 0);
 968                         notify = 1;
 969                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 970                 }
 971         } else {
 972                 /* NUD_PROBE|NUD_INCOMPLETE */
 973                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 974         }
 975
 976         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 977             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 978                 neigh->nud_state = NUD_FAILED;
 979                 notify = 1;
 980                 neigh_invalidate(neigh);
 981                 goto out;
 982         }
 983
 984         if (neigh->nud_state & NUD_IN_TIMER) {
 985                 if (time_before(next, jiffies + HZ/2))
 986                         next = jiffies + HZ/2;
 987                 if (!mod_timer(&neigh->timer, next))
 988                         neigh_hold(neigh);
 989         }
 990         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 991                 neigh_probe(neigh);
 992         } else {
 993 out:
 994                 write_unlock(&neigh->lock);
 995         }
 996
 997         if (notify)
 998                 neigh_update_notify(neigh, 0);
 999
1000         neigh_release(neigh);
1001 }
1002
1003 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
1004 {
1005         int rc;
1006         bool immediate_probe = false;
1007
1008         write_lock_bh(&neigh->lock);
1009
1010         rc = 0;
1011         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1012                 goto out_unlock_bh;
1013         if (neigh->dead)
1014                 goto out_dead;
1015
1016         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1017                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1018                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
1019                         unsigned long next, now = jiffies;
1020
1021                         atomic_set(&neigh->probes,
1022                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
1023                         neigh->nud_state     = NUD_INCOMPLETE;
1024                         neigh->updated = now;
1025                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1026                                          HZ/2);
1027                         neigh_add_timer(neigh, next);
1028                         immediate_probe = true;
1029                 } else {
1030                         neigh->nud_state = NUD_FAILED;
1031                         neigh->updated = jiffies;
1032                         write_unlock_bh(&neigh->lock);
1033
1034                         kfree_skb(skb);
1035                         return 1;
1036                 }
1037         } else if (neigh->nud_state & NUD_STALE) {
1038                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1039                 neigh->nud_state = NUD_DELAY;
1040                 neigh->updated = jiffies;
1041                 neigh_add_timer(neigh, jiffies +
1042                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1043         }
1044
1045         if (neigh->nud_state == NUD_INCOMPLETE) {
1046                 if (skb) {
1047                         while (neigh->arp_queue_len_bytes + skb->truesize >
1048                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1049                                 struct sk_buff *buff;
1050
1051                                 buff = __skb_dequeue(&neigh->arp_queue);
1052                                 if (!buff)
1053                                         break;
1054                                 neigh->arp_queue_len_bytes -= buff->truesize;
1055                                 kfree_skb(buff);
1056                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1057                         }
1058                         skb_dst_force(skb);
1059                         __skb_queue_tail(&neigh->arp_queue, skb);
1060                         neigh->arp_queue_len_bytes += skb->truesize;
1061                 }
1062                 rc = 1;
1063         }
1064 out_unlock_bh:
1065         if (immediate_probe)
1066                 neigh_probe(neigh);
1067         else
1068                 write_unlock(&neigh->lock);
1069         local_bh_enable();
1070         return rc;
1071
1072 out_dead:
1073         if (neigh->nud_state & NUD_STALE)
1074                 goto out_unlock_bh;
1075         write_unlock_bh(&neigh->lock);
1076         kfree_skb(skb);
1077         return 1;
1078 }
1079 EXPORT_SYMBOL(__neigh_event_send);
1080
1081 static void neigh_update_hhs(struct neighbour *neigh)
1082 {
1083         struct hh_cache *hh;
1084         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1085                 = NULL;
1086
1087         if (neigh->dev->header_ops)
1088                 update = neigh->dev->header_ops->cache_update;
1089
1090         if (update) {
1091                 hh = &neigh->hh;
1092                 if (hh->hh_len) {
1093                         write_seqlock_bh(&hh->hh_lock);
1094                         update(hh, neigh->dev, neigh->ha);
1095                         write_sequnlock_bh(&hh->hh_lock);
1096                 }
1097         }
1098 }
1099
1100
1101
1102 /* Generic update routine.
1103    -- lladdr is new lladdr or NULL, if it is not supplied.
1104    -- new    is new state.
1105    -- flags
1106         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1107                                 if it is different.
1108         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1109                                 lladdr instead of overriding it
1110                                 if it is different.
1111         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1112
1113         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1114                                 NTF_ROUTER flag.
1115         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1116                                 a router.
1117
1118    Caller MUST hold reference count on the entry.
1119  */
1120
1121 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1122                  u32 flags, u32 nlmsg_pid)
1123 {
1124         u8 old;
1125         int err;
1126         int notify = 0;
1127         struct net_device *dev;
1128         int update_isrouter = 0;
1129
1130         write_lock_bh(&neigh->lock);
1131
1132         dev    = neigh->dev;
1133         old    = neigh->nud_state;
1134         err    = -EPERM;
1135
1136         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1137             (old & (NUD_NOARP | NUD_PERMANENT)))
1138                 goto out;
1139         if (neigh->dead)
1140                 goto out;
1141
1142         neigh_update_ext_learned(neigh, flags, &notify);
1143
1144         if (!(new & NUD_VALID)) {
1145                 neigh_del_timer(neigh);
1146                 if (old & NUD_CONNECTED)
1147                         neigh_suspect(neigh);
1148                 neigh->nud_state = new;
1149                 err = 0;
1150                 notify = old & NUD_VALID;
1151                 if (((old & (NUD_INCOMPLETE | NUD_PROBE)) ||
1152                      (flags & NEIGH_UPDATE_F_ADMIN)) &&
1153                     (new & NUD_FAILED)) {
1154                         neigh_invalidate(neigh);
1155                         notify = 1;
1156                 }
1157                 goto out;
1158         }
1159
1160         /* Compare new lladdr with cached one */
1161         if (!dev->addr_len) {
1162                 /* First case: device needs no address. */
1163                 lladdr = neigh->ha;
1164         } else if (lladdr) {
1165                 /* The second case: if something is already cached
1166                    and a new address is proposed:
1167                    - compare new & old
1168                    - if they are different, check override flag
1169                  */
1170                 if ((old & NUD_VALID) &&
1171                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1172                         lladdr = neigh->ha;
1173         } else {
1174                 /* No address is supplied; if we know something,
1175                    use it, otherwise discard the request.
1176                  */
1177                 err = -EINVAL;
1178                 if (!(old & NUD_VALID))
1179                         goto out;
1180                 lladdr = neigh->ha;
1181         }
1182
1183         /* Update confirmed timestamp for neighbour entry after we
1184          * received ARP packet even if it doesn't change IP to MAC binding.
1185          */
1186         if (new & NUD_CONNECTED)
1187                 neigh->confirmed = jiffies;
1188
1189         /* If entry was valid and address is not changed,
1190            do not change entry state, if new one is STALE.
1191          */
1192         err = 0;
1193         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1194         if (old & NUD_VALID) {
1195                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1196                         update_isrouter = 0;
1197                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1198                             (old & NUD_CONNECTED)) {
1199                                 lladdr = neigh->ha;
1200                                 new = NUD_STALE;
1201                         } else
1202                                 goto out;
1203                 } else {
1204                         if (lladdr == neigh->ha && new == NUD_STALE &&
1205                             !(flags & NEIGH_UPDATE_F_ADMIN))
1206                                 new = old;
1207                 }
1208         }
1209
1210         /* Update timestamp only once we know we will make a change to the
1211          * neighbour entry. Otherwise we risk to move the locktime window with
1212          * noop updates and ignore relevant ARP updates.
1213          */
1214         if (new != old || lladdr != neigh->ha)
1215                 neigh->updated = jiffies;
1216
1217         if (new != old) {
1218                 neigh_del_timer(neigh);
1219                 if (new & NUD_PROBE)
1220                         atomic_set(&neigh->probes, 0);
1221                 if (new & NUD_IN_TIMER)
1222                         neigh_add_timer(neigh, (jiffies +
1223                                                 ((new & NUD_REACHABLE) ?
1224                                                  neigh->parms->reachable_time :
1225                                                  0)));
1226                 neigh->nud_state = new;
1227                 notify = 1;
1228         }
1229
1230         if (lladdr != neigh->ha) {
1231                 write_seqlock(&neigh->ha_lock);
1232                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1233                 write_sequnlock(&neigh->ha_lock);
1234                 neigh_update_hhs(neigh);
1235                 if (!(new & NUD_CONNECTED))
1236                         neigh->confirmed = jiffies -
1237                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1238                 notify = 1;
1239         }
1240         if (new == old)
1241                 goto out;
1242         if (new & NUD_CONNECTED)
1243                 neigh_connect(neigh);
1244         else
1245                 neigh_suspect(neigh);
1246         if (!(old & NUD_VALID)) {
1247                 struct sk_buff *skb;
1248
1249                 /* Again: avoid dead loop if something went wrong */
1250
1251                 while (neigh->nud_state & NUD_VALID &&
1252                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1253                         struct dst_entry *dst = skb_dst(skb);
1254                         struct neighbour *n2, *n1 = neigh;
1255                         write_unlock_bh(&neigh->lock);
1256
1257                         rcu_read_lock();
1258
1259                         /* Why not just use 'neigh' as-is?  The problem is that
1260                          * things such as shaper, eql, and sch_teql can end up
1261                          * using alternative, different, neigh objects to output
1262                          * the packet in the output path.  So what we need to do
1263                          * here is re-lookup the top-level neigh in the path so
1264                          * we can reinject the packet there.
1265                          */
1266                         n2 = NULL;
1267                         if (dst) {
1268                                 n2 = dst_neigh_lookup_skb(dst, skb);
1269                                 if (n2)
1270                                         n1 = n2;
1271                         }
1272                         n1->output(n1, skb);
1273                         if (n2)
1274                                 neigh_release(n2);
1275                         rcu_read_unlock();
1276
1277                         write_lock_bh(&neigh->lock);
1278                 }
1279                 __skb_queue_purge(&neigh->arp_queue);
1280                 neigh->arp_queue_len_bytes = 0;
1281         }
1282 out:
1283         if (update_isrouter) {
1284                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1285                         (neigh->flags | NTF_ROUTER) :
1286                         (neigh->flags & ~NTF_ROUTER);
1287         }
1288         write_unlock_bh(&neigh->lock);
1289
1290         if (notify)
1291                 neigh_update_notify(neigh, nlmsg_pid);
1292
1293         return err;
1294 }
1295 EXPORT_SYMBOL(neigh_update);
1296
1297 /* Update the neigh to listen temporarily for probe responses, even if it is
1298  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1299  */
1300 void __neigh_set_probe_once(struct neighbour *neigh)
1301 {
1302         if (neigh->dead)
1303                 return;
1304         neigh->updated = jiffies;
1305         if (!(neigh->nud_state & NUD_FAILED))
1306                 return;
1307         neigh->nud_state = NUD_INCOMPLETE;
1308         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1309         neigh_add_timer(neigh,
1310                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1311 }
1312 EXPORT_SYMBOL(__neigh_set_probe_once);
1313
1314 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1315                                  u8 *lladdr, void *saddr,
1316                                  struct net_device *dev)
1317 {
1318         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1319                                                  lladdr || !dev->addr_len);
1320         if (neigh)
1321                 neigh_update(neigh, lladdr, NUD_STALE,
1322                              NEIGH_UPDATE_F_OVERRIDE, 0);
1323         return neigh;
1324 }
1325 EXPORT_SYMBOL(neigh_event_ns);
1326
1327 /* called with read_lock_bh(&n->lock); */
1328 static void neigh_hh_init(struct neighbour *n)
1329 {
1330         struct net_device *dev = n->dev;
1331         __be16 prot = n->tbl->protocol;
1332         struct hh_cache *hh = &n->hh;
1333
1334         write_lock_bh(&n->lock);
1335
1336         /* Only one thread can come in here and initialize the
1337          * hh_cache entry.
1338          */
1339         if (!hh->hh_len)
1340                 dev->header_ops->cache(n, hh, prot);
1341
1342         write_unlock_bh(&n->lock);
1343 }
1344
1345 /* Slow and careful. */
1346
1347 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1348 {
1349         int rc = 0;
1350
1351         if (!neigh_event_send(neigh, skb)) {
1352                 int err;
1353                 struct net_device *dev = neigh->dev;
1354                 unsigned int seq;
1355
1356                 if (dev->header_ops->cache && !neigh->hh.hh_len)
1357                         neigh_hh_init(neigh);
1358
1359                 do {
1360                         __skb_pull(skb, skb_network_offset(skb));
1361                         seq = read_seqbegin(&neigh->ha_lock);
1362                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1363                                               neigh->ha, NULL, skb->len);
1364                 } while (read_seqretry(&neigh->ha_lock, seq));
1365
1366                 if (err >= 0)
1367                         rc = dev_queue_xmit(skb);
1368                 else
1369                         goto out_kfree_skb;
1370         }
1371 out:
1372         return rc;
1373 out_kfree_skb:
1374         rc = -EINVAL;
1375         kfree_skb(skb);
1376         goto out;
1377 }
1378 EXPORT_SYMBOL(neigh_resolve_output);
1379
1380 /* As fast as possible without hh cache */
1381
1382 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1383 {
1384         struct net_device *dev = neigh->dev;
1385         unsigned int seq;
1386         int err;
1387
1388         do {
1389                 __skb_pull(skb, skb_network_offset(skb));
1390                 seq = read_seqbegin(&neigh->ha_lock);
1391                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1392                                       neigh->ha, NULL, skb->len);
1393         } while (read_seqretry(&neigh->ha_lock, seq));
1394
1395         if (err >= 0)
1396                 err = dev_queue_xmit(skb);
1397         else {
1398                 err = -EINVAL;
1399                 kfree_skb(skb);
1400         }
1401         return err;
1402 }
1403 EXPORT_SYMBOL(neigh_connected_output);
1404
1405 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1406 {
1407         return dev_queue_xmit(skb);
1408 }
1409 EXPORT_SYMBOL(neigh_direct_output);
1410
1411 static void neigh_proxy_process(struct timer_list *t)
1412 {
1413         struct neigh_table *tbl = from_timer(tbl, t, proxy_timer);
1414         long sched_next = 0;
1415         unsigned long now = jiffies;
1416         struct sk_buff *skb, *n;
1417
1418         spin_lock(&tbl->proxy_queue.lock);
1419
1420         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1421                 long tdif = NEIGH_CB(skb)->sched_next - now;
1422
1423                 if (tdif <= 0) {
1424                         struct net_device *dev = skb->dev;
1425
1426                         __skb_unlink(skb, &tbl->proxy_queue);
1427                         if (tbl->proxy_redo && netif_running(dev)) {
1428                                 rcu_read_lock();
1429                                 tbl->proxy_redo(skb);
1430                                 rcu_read_unlock();
1431                         } else {
1432                                 kfree_skb(skb);
1433                         }
1434
1435                         dev_put(dev);
1436                 } else if (!sched_next || tdif < sched_next)
1437                         sched_next = tdif;
1438         }
1439         del_timer(&tbl->proxy_timer);
1440         if (sched_next)
1441                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1442         spin_unlock(&tbl->proxy_queue.lock);
1443 }
1444
1445 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1446                     struct sk_buff *skb)
1447 {
1448         unsigned long now = jiffies;
1449
1450         unsigned long sched_next = now + (prandom_u32() %
1451                                           NEIGH_VAR(p, PROXY_DELAY));
1452
1453         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1454                 kfree_skb(skb);
1455                 return;
1456         }
1457
1458         NEIGH_CB(skb)->sched_next = sched_next;
1459         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1460
1461         spin_lock(&tbl->proxy_queue.lock);
1462         if (del_timer(&tbl->proxy_timer)) {
1463                 if (time_before(tbl->proxy_timer.expires, sched_next))
1464                         sched_next = tbl->proxy_timer.expires;
1465         }
1466         skb_dst_drop(skb);
1467         dev_hold(skb->dev);
1468         __skb_queue_tail(&tbl->proxy_queue, skb);
1469         mod_timer(&tbl->proxy_timer, sched_next);
1470         spin_unlock(&tbl->proxy_queue.lock);
1471 }
1472 EXPORT_SYMBOL(pneigh_enqueue);
1473
1474 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1475                                                       struct net *net, int ifindex)
1476 {
1477         struct neigh_parms *p;
1478
1479         list_for_each_entry(p, &tbl->parms_list, list) {
1480                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1481                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1482                         return p;
1483         }
1484
1485         return NULL;
1486 }
1487
1488 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1489                                       struct neigh_table *tbl)
1490 {
1491         struct neigh_parms *p;
1492         struct net *net = dev_net(dev);
1493         const struct net_device_ops *ops = dev->netdev_ops;
1494
1495         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1496         if (p) {
1497                 p->tbl            = tbl;
1498                 refcount_set(&p->refcnt, 1);
1499                 p->reachable_time =
1500                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1501                 dev_hold(dev);
1502                 p->dev = dev;
1503                 write_pnet(&p->net, net);
1504                 p->sysctl_table = NULL;
1505
1506                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1507                         dev_put(dev);
1508                         kfree(p);
1509                         return NULL;
1510                 }
1511
1512                 write_lock_bh(&tbl->lock);
1513                 list_add(&p->list, &tbl->parms.list);
1514                 write_unlock_bh(&tbl->lock);
1515
1516                 neigh_parms_data_state_cleanall(p);
1517         }
1518         return p;
1519 }
1520 EXPORT_SYMBOL(neigh_parms_alloc);
1521
1522 static void neigh_rcu_free_parms(struct rcu_head *head)
1523 {
1524         struct neigh_parms *parms =
1525                 container_of(head, struct neigh_parms, rcu_head);
1526
1527         neigh_parms_put(parms);
1528 }
1529
1530 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1531 {
1532         if (!parms || parms == &tbl->parms)
1533                 return;
1534         write_lock_bh(&tbl->lock);
1535         list_del(&parms->list);
1536         parms->dead = 1;
1537         write_unlock_bh(&tbl->lock);
1538         if (parms->dev)
1539                 dev_put(parms->dev);
1540         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1541 }
1542 EXPORT_SYMBOL(neigh_parms_release);
1543
1544 static void neigh_parms_destroy(struct neigh_parms *parms)
1545 {
1546         kfree(parms);
1547 }
1548
1549 static struct lock_class_key neigh_table_proxy_queue_class;
1550
1551 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1552
1553 void neigh_table_init(int index, struct neigh_table *tbl)
1554 {
1555         unsigned long now = jiffies;
1556         unsigned long phsize;
1557
1558         INIT_LIST_HEAD(&tbl->parms_list);
1559         list_add(&tbl->parms.list, &tbl->parms_list);
1560         write_pnet(&tbl->parms.net, &init_net);
1561         refcount_set(&tbl->parms.refcnt, 1);
1562         tbl->parms.reachable_time =
1563                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1564
1565         tbl->stats = alloc_percpu(struct neigh_statistics);
1566         if (!tbl->stats)
1567                 panic("cannot create neighbour cache statistics");
1568
1569 #ifdef CONFIG_PROC_FS
1570         if (!proc_create_seq_data(tbl->id, 0, init_net.proc_net_stat,
1571                               &neigh_stat_seq_ops, tbl))
1572                 panic("cannot create neighbour proc dir entry");
1573 #endif
1574
1575         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1576
1577         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1578         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1579
1580         if (!tbl->nht || !tbl->phash_buckets)
1581                 panic("cannot allocate neighbour cache hashes");
1582
1583         if (!tbl->entry_size)
1584                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1585                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1586         else
1587                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1588
1589         rwlock_init(&tbl->lock);
1590         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1591         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1592                         tbl->parms.reachable_time);
1593         timer_setup(&tbl->proxy_timer, neigh_proxy_process, 0);
1594         skb_queue_head_init_class(&tbl->proxy_queue,
1595                         &neigh_table_proxy_queue_class);
1596
1597         tbl->last_flush = now;
1598         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1599
1600         neigh_tables[index] = tbl;
1601 }
1602 EXPORT_SYMBOL(neigh_table_init);
1603
1604 int neigh_table_clear(int index, struct neigh_table *tbl)
1605 {
1606         neigh_tables[index] = NULL;
1607         /* It is not clean... Fix it to unload IPv6 module safely */
1608         cancel_delayed_work_sync(&tbl->gc_work);
1609         del_timer_sync(&tbl->proxy_timer);
1610         pneigh_queue_purge(&tbl->proxy_queue);
1611         neigh_ifdown(tbl, NULL);
1612         if (atomic_read(&tbl->entries))
1613                 pr_crit("neighbour leakage\n");
1614
1615         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1616                  neigh_hash_free_rcu);
1617         tbl->nht = NULL;
1618
1619         kfree(tbl->phash_buckets);
1620         tbl->phash_buckets = NULL;
1621
1622         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1623
1624         free_percpu(tbl->stats);
1625         tbl->stats = NULL;
1626
1627         return 0;
1628 }
1629 EXPORT_SYMBOL(neigh_table_clear);
1630
1631 static struct neigh_table *neigh_find_table(int family)
1632 {
1633         struct neigh_table *tbl = NULL;
1634
1635         switch (family) {
1636         case AF_INET:
1637                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1638                 break;
1639         case AF_INET6:
1640                 tbl = neigh_tables[NEIGH_ND_TABLE];
1641                 break;
1642         case AF_DECnet:
1643                 tbl = neigh_tables[NEIGH_DN_TABLE];
1644                 break;
1645         }
1646
1647         return tbl;
1648 }
1649
1650 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1651                         struct netlink_ext_ack *extack)
1652 {
1653         struct net *net = sock_net(skb->sk);
1654         struct ndmsg *ndm;
1655         struct nlattr *dst_attr;
1656         struct neigh_table *tbl;
1657         struct neighbour *neigh;
1658         struct net_device *dev = NULL;
1659         int err = -EINVAL;
1660
1661         ASSERT_RTNL();
1662         if (nlmsg_len(nlh) < sizeof(*ndm))
1663                 goto out;
1664
1665         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1666         if (dst_attr == NULL)
1667                 goto out;
1668
1669         ndm = nlmsg_data(nlh);
1670         if (ndm->ndm_ifindex) {
1671                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1672                 if (dev == NULL) {
1673                         err = -ENODEV;
1674                         goto out;
1675                 }
1676         }
1677
1678         tbl = neigh_find_table(ndm->ndm_family);
1679         if (tbl == NULL)
1680                 return -EAFNOSUPPORT;
1681
1682         if (nla_len(dst_attr) < (int)tbl->key_len)
1683                 goto out;
1684
1685         if (ndm->ndm_flags & NTF_PROXY) {
1686                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1687                 goto out;
1688         }
1689
1690         if (dev == NULL)
1691                 goto out;
1692
1693         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1694         if (neigh == NULL) {
1695                 err = -ENOENT;
1696                 goto out;
1697         }
1698
1699         err = neigh_update(neigh, NULL, NUD_FAILED,
1700                            NEIGH_UPDATE_F_OVERRIDE |
1701                            NEIGH_UPDATE_F_ADMIN,
1702                            NETLINK_CB(skb).portid);
1703         write_lock_bh(&tbl->lock);
1704         neigh_release(neigh);
1705         neigh_remove_one(neigh, tbl);
1706         write_unlock_bh(&tbl->lock);
1707
1708 out:
1709         return err;
1710 }
1711
1712 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1713                      struct netlink_ext_ack *extack)
1714 {
1715         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1716         struct net *net = sock_net(skb->sk);
1717         struct ndmsg *ndm;
1718         struct nlattr *tb[NDA_MAX+1];
1719         struct neigh_table *tbl;
1720         struct net_device *dev = NULL;
1721         struct neighbour *neigh;
1722         void *dst, *lladdr;
1723         int err;
1724
1725         ASSERT_RTNL();
1726         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL, extack);
1727         if (err < 0)
1728                 goto out;
1729
1730         err = -EINVAL;
1731         if (tb[NDA_DST] == NULL)
1732                 goto out;
1733
1734         ndm = nlmsg_data(nlh);
1735         if (ndm->ndm_ifindex) {
1736                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1737                 if (dev == NULL) {
1738                         err = -ENODEV;
1739                         goto out;
1740                 }
1741
1742                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1743                         goto out;
1744         }
1745
1746         tbl = neigh_find_table(ndm->ndm_family);
1747         if (tbl == NULL)
1748                 return -EAFNOSUPPORT;
1749
1750         if (nla_len(tb[NDA_DST]) < (int)tbl->key_len)
1751                 goto out;
1752         dst = nla_data(tb[NDA_DST]);
1753         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1754
1755         if (ndm->ndm_flags & NTF_PROXY) {
1756                 struct pneigh_entry *pn;
1757
1758                 err = -ENOBUFS;
1759                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1760                 if (pn) {
1761                         pn->flags = ndm->ndm_flags;
1762                         err = 0;
1763                 }
1764                 goto out;
1765         }
1766
1767         if (dev == NULL)
1768                 goto out;
1769
1770         neigh = neigh_lookup(tbl, dst, dev);
1771         if (neigh == NULL) {
1772                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1773                         err = -ENOENT;
1774                         goto out;
1775                 }
1776
1777                 neigh = __neigh_lookup_errno(tbl, dst, dev);
1778                 if (IS_ERR(neigh)) {
1779                         err = PTR_ERR(neigh);
1780                         goto out;
1781                 }
1782         } else {
1783                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1784                         err = -EEXIST;
1785                         neigh_release(neigh);
1786                         goto out;
1787                 }
1788
1789                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1790                         flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1791         }
1792
1793         if (ndm->ndm_flags & NTF_EXT_LEARNED)
1794                 flags |= NEIGH_UPDATE_F_EXT_LEARNED;
1795
1796         if (ndm->ndm_flags & NTF_USE) {
1797                 neigh_event_send(neigh, NULL);
1798                 err = 0;
1799         } else
1800                 err = neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1801                                    NETLINK_CB(skb).portid);
1802         neigh_release(neigh);
1803
1804 out:
1805         return err;
1806 }
1807
1808 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1809 {
1810         struct nlattr *nest;
1811
1812         nest = nla_nest_start(skb, NDTA_PARMS);
1813         if (nest == NULL)
1814                 return -ENOBUFS;
1815
1816         if ((parms->dev &&
1817              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1818             nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
1819             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1820                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1821             /* approximative value for deprecated QUEUE_LEN (in packets) */
1822             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1823                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1824             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1825             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1826             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1827                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1828             nla_put_u32(skb, NDTPA_MCAST_PROBES,
1829                         NEIGH_VAR(parms, MCAST_PROBES)) ||
1830             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1831                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
1832             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
1833                           NDTPA_PAD) ||
1834             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1835                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
1836             nla_put_msecs(skb, NDTPA_GC_STALETIME,
1837                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
1838             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1839                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
1840             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1841                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
1842             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1843                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
1844             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1845                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
1846             nla_put_msecs(skb, NDTPA_LOCKTIME,
1847                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
1848                 goto nla_put_failure;
1849         return nla_nest_end(skb, nest);
1850
1851 nla_put_failure:
1852         nla_nest_cancel(skb, nest);
1853         return -EMSGSIZE;
1854 }
1855
1856 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1857                               u32 pid, u32 seq, int type, int flags)
1858 {
1859         struct nlmsghdr *nlh;
1860         struct ndtmsg *ndtmsg;
1861
1862         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1863         if (nlh == NULL)
1864                 return -EMSGSIZE;
1865
1866         ndtmsg = nlmsg_data(nlh);
1867
1868         read_lock_bh(&tbl->lock);
1869         ndtmsg->ndtm_family = tbl->family;
1870         ndtmsg->ndtm_pad1   = 0;
1871         ndtmsg->ndtm_pad2   = 0;
1872
1873         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1874             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
1875             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1876             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1877             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1878                 goto nla_put_failure;
1879         {
1880                 unsigned long now = jiffies;
1881                 unsigned int flush_delta = now - tbl->last_flush;
1882                 unsigned int rand_delta = now - tbl->last_rand;
1883                 struct neigh_hash_table *nht;
1884                 struct ndt_config ndc = {
1885                         .ndtc_key_len           = tbl->key_len,
1886                         .ndtc_entry_size        = tbl->entry_size,
1887                         .ndtc_entries           = atomic_read(&tbl->entries),
1888                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1889                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1890                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1891                 };
1892
1893                 rcu_read_lock_bh();
1894                 nht = rcu_dereference_bh(tbl->nht);
1895                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1896                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1897                 rcu_read_unlock_bh();
1898
1899                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1900                         goto nla_put_failure;
1901         }
1902
1903         {
1904                 int cpu;
1905                 struct ndt_stats ndst;
1906
1907                 memset(&ndst, 0, sizeof(ndst));
1908
1909                 for_each_possible_cpu(cpu) {
1910                         struct neigh_statistics *st;
1911
1912                         st = per_cpu_ptr(tbl->stats, cpu);
1913                         ndst.ndts_allocs                += st->allocs;
1914                         ndst.ndts_destroys              += st->destroys;
1915                         ndst.ndts_hash_grows            += st->hash_grows;
1916                         ndst.ndts_res_failed            += st->res_failed;
1917                         ndst.ndts_lookups               += st->lookups;
1918                         ndst.ndts_hits                  += st->hits;
1919                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1920                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1921                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1922                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1923                         ndst.ndts_table_fulls           += st->table_fulls;
1924                 }
1925
1926                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
1927                                   NDTA_PAD))
1928                         goto nla_put_failure;
1929         }
1930
1931         BUG_ON(tbl->parms.dev);
1932         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1933                 goto nla_put_failure;
1934
1935         read_unlock_bh(&tbl->lock);
1936         nlmsg_end(skb, nlh);
1937         return 0;
1938
1939 nla_put_failure:
1940         read_unlock_bh(&tbl->lock);
1941         nlmsg_cancel(skb, nlh);
1942         return -EMSGSIZE;
1943 }
1944
1945 static int neightbl_fill_param_info(struct sk_buff *skb,
1946                                     struct neigh_table *tbl,
1947                                     struct neigh_parms *parms,
1948                                     u32 pid, u32 seq, int type,
1949                                     unsigned int flags)
1950 {
1951         struct ndtmsg *ndtmsg;
1952         struct nlmsghdr *nlh;
1953
1954         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1955         if (nlh == NULL)
1956                 return -EMSGSIZE;
1957
1958         ndtmsg = nlmsg_data(nlh);
1959
1960         read_lock_bh(&tbl->lock);
1961         ndtmsg->ndtm_family = tbl->family;
1962         ndtmsg->ndtm_pad1   = 0;
1963         ndtmsg->ndtm_pad2   = 0;
1964
1965         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1966             neightbl_fill_parms(skb, parms) < 0)
1967                 goto errout;
1968
1969         read_unlock_bh(&tbl->lock);
1970         nlmsg_end(skb, nlh);
1971         return 0;
1972 errout:
1973         read_unlock_bh(&tbl->lock);
1974         nlmsg_cancel(skb, nlh);
1975         return -EMSGSIZE;
1976 }
1977
1978 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1979         [NDTA_NAME]             = { .type = NLA_STRING },
1980         [NDTA_THRESH1]          = { .type = NLA_U32 },
1981         [NDTA_THRESH2]          = { .type = NLA_U32 },
1982         [NDTA_THRESH3]          = { .type = NLA_U32 },
1983         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1984         [NDTA_PARMS]            = { .type = NLA_NESTED },
1985 };
1986
1987 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1988         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1989         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1990         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1991         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1992         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1993         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1994         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
1995         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1996         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1997         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1998         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1999         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
2000         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
2001         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
2002 };
2003
2004 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
2005                         struct netlink_ext_ack *extack)
2006 {
2007         struct net *net = sock_net(skb->sk);
2008         struct neigh_table *tbl;
2009         struct ndtmsg *ndtmsg;
2010         struct nlattr *tb[NDTA_MAX+1];
2011         bool found = false;
2012         int err, tidx;
2013
2014         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
2015                           nl_neightbl_policy, extack);
2016         if (err < 0)
2017                 goto errout;
2018
2019         if (tb[NDTA_NAME] == NULL) {
2020                 err = -EINVAL;
2021                 goto errout;
2022         }
2023
2024         ndtmsg = nlmsg_data(nlh);
2025
2026         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2027                 tbl = neigh_tables[tidx];
2028                 if (!tbl)
2029                         continue;
2030                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2031                         continue;
2032                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2033                         found = true;
2034                         break;
2035                 }
2036         }
2037
2038         if (!found)
2039                 return -ENOENT;
2040
2041         /*
2042          * We acquire tbl->lock to be nice to the periodic timers and
2043          * make sure they always see a consistent set of values.
2044          */
2045         write_lock_bh(&tbl->lock);
2046
2047         if (tb[NDTA_PARMS]) {
2048                 struct nlattr *tbp[NDTPA_MAX+1];
2049                 struct neigh_parms *p;
2050                 int i, ifindex = 0;
2051
2052                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
2053                                        nl_ntbl_parm_policy, extack);
2054                 if (err < 0)
2055                         goto errout_tbl_lock;
2056
2057                 if (tbp[NDTPA_IFINDEX])
2058                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2059
2060                 p = lookup_neigh_parms(tbl, net, ifindex);
2061                 if (p == NULL) {
2062                         err = -ENOENT;
2063                         goto errout_tbl_lock;
2064                 }
2065
2066                 for (i = 1; i <= NDTPA_MAX; i++) {
2067                         if (tbp[i] == NULL)
2068                                 continue;
2069
2070                         switch (i) {
2071                         case NDTPA_QUEUE_LEN:
2072                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2073                                               nla_get_u32(tbp[i]) *
2074                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2075                                 break;
2076                         case NDTPA_QUEUE_LENBYTES:
2077                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2078                                               nla_get_u32(tbp[i]));
2079                                 break;
2080                         case NDTPA_PROXY_QLEN:
2081                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2082                                               nla_get_u32(tbp[i]));
2083                                 break;
2084                         case NDTPA_APP_PROBES:
2085                                 NEIGH_VAR_SET(p, APP_PROBES,
2086                                               nla_get_u32(tbp[i]));
2087                                 break;
2088                         case NDTPA_UCAST_PROBES:
2089                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2090                                               nla_get_u32(tbp[i]));
2091                                 break;
2092                         case NDTPA_MCAST_PROBES:
2093                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2094                                               nla_get_u32(tbp[i]));
2095                                 break;
2096                         case NDTPA_MCAST_REPROBES:
2097                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2098                                               nla_get_u32(tbp[i]));
2099                                 break;
2100                         case NDTPA_BASE_REACHABLE_TIME:
2101                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2102                                               nla_get_msecs(tbp[i]));
2103                                 /* update reachable_time as well, otherwise, the change will
2104                                  * only be effective after the next time neigh_periodic_work
2105                                  * decides to recompute it (can be multiple minutes)
2106                                  */
2107                                 p->reachable_time =
2108                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2109                                 break;
2110                         case NDTPA_GC_STALETIME:
2111                                 NEIGH_VAR_SET(p, GC_STALETIME,
2112                                               nla_get_msecs(tbp[i]));
2113                                 break;
2114                         case NDTPA_DELAY_PROBE_TIME:
2115                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2116                                               nla_get_msecs(tbp[i]));
2117                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2118                                 break;
2119                         case NDTPA_RETRANS_TIME:
2120                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2121                                               nla_get_msecs(tbp[i]));
2122                                 break;
2123                         case NDTPA_ANYCAST_DELAY:
2124                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2125                                               nla_get_msecs(tbp[i]));
2126                                 break;
2127                         case NDTPA_PROXY_DELAY:
2128                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2129                                               nla_get_msecs(tbp[i]));
2130                                 break;
2131                         case NDTPA_LOCKTIME:
2132                                 NEIGH_VAR_SET(p, LOCKTIME,
2133                                               nla_get_msecs(tbp[i]));
2134                                 break;
2135                         }
2136                 }
2137         }
2138
2139         err = -ENOENT;
2140         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2141              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2142             !net_eq(net, &init_net))
2143                 goto errout_tbl_lock;
2144
2145         if (tb[NDTA_THRESH1])
2146                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2147
2148         if (tb[NDTA_THRESH2])
2149                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2150
2151         if (tb[NDTA_THRESH3])
2152                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2153
2154         if (tb[NDTA_GC_INTERVAL])
2155                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2156
2157         err = 0;
2158
2159 errout_tbl_lock:
2160         write_unlock_bh(&tbl->lock);
2161 errout:
2162         return err;
2163 }
2164
2165 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2166 {
2167         struct net *net = sock_net(skb->sk);
2168         int family, tidx, nidx = 0;
2169         int tbl_skip = cb->args[0];
2170         int neigh_skip = cb->args[1];
2171         struct neigh_table *tbl;
2172
2173         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2174
2175         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2176                 struct neigh_parms *p;
2177
2178                 tbl = neigh_tables[tidx];
2179                 if (!tbl)
2180                         continue;
2181
2182                 if (tidx < tbl_skip || (family && tbl->family != family))
2183                         continue;
2184
2185                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2186                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2187                                        NLM_F_MULTI) < 0)
2188                         break;
2189
2190                 nidx = 0;
2191                 p = list_next_entry(&tbl->parms, list);
2192                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2193                         if (!net_eq(neigh_parms_net(p), net))
2194                                 continue;
2195
2196                         if (nidx < neigh_skip)
2197                                 goto next;
2198
2199                         if (neightbl_fill_param_info(skb, tbl, p,
2200                                                      NETLINK_CB(cb->skb).portid,
2201                                                      cb->nlh->nlmsg_seq,
2202                                                      RTM_NEWNEIGHTBL,
2203                                                      NLM_F_MULTI) < 0)
2204                                 goto out;
2205                 next:
2206                         nidx++;
2207                 }
2208
2209                 neigh_skip = 0;
2210         }
2211 out:
2212         cb->args[0] = tidx;
2213         cb->args[1] = nidx;
2214
2215         return skb->len;
2216 }
2217
2218 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2219                            u32 pid, u32 seq, int type, unsigned int flags)
2220 {
2221         unsigned long now = jiffies;
2222         struct nda_cacheinfo ci;
2223         struct nlmsghdr *nlh;
2224         struct ndmsg *ndm;
2225
2226         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2227         if (nlh == NULL)
2228                 return -EMSGSIZE;
2229
2230         ndm = nlmsg_data(nlh);
2231         ndm->ndm_family  = neigh->ops->family;
2232         ndm->ndm_pad1    = 0;
2233         ndm->ndm_pad2    = 0;
2234         ndm->ndm_flags   = neigh->flags;
2235         ndm->ndm_type    = neigh->type;
2236         ndm->ndm_ifindex = neigh->dev->ifindex;
2237
2238         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2239                 goto nla_put_failure;
2240
2241         read_lock_bh(&neigh->lock);
2242         ndm->ndm_state   = neigh->nud_state;
2243         if (neigh->nud_state & NUD_VALID) {
2244                 char haddr[MAX_ADDR_LEN];
2245
2246                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2247                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2248                         read_unlock_bh(&neigh->lock);
2249                         goto nla_put_failure;
2250                 }
2251         }
2252
2253         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2254         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2255         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2256         ci.ndm_refcnt    = refcount_read(&neigh->refcnt) - 1;
2257         read_unlock_bh(&neigh->lock);
2258
2259         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2260             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2261                 goto nla_put_failure;
2262
2263         nlmsg_end(skb, nlh);
2264         return 0;
2265
2266 nla_put_failure:
2267         nlmsg_cancel(skb, nlh);
2268         return -EMSGSIZE;
2269 }
2270
2271 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2272                             u32 pid, u32 seq, int type, unsigned int flags,
2273                             struct neigh_table *tbl)
2274 {
2275         struct nlmsghdr *nlh;
2276         struct ndmsg *ndm;
2277
2278         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2279         if (nlh == NULL)
2280                 return -EMSGSIZE;
2281
2282         ndm = nlmsg_data(nlh);
2283         ndm->ndm_family  = tbl->family;
2284         ndm->ndm_pad1    = 0;
2285         ndm->ndm_pad2    = 0;
2286         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2287         ndm->ndm_type    = RTN_UNICAST;
2288         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2289         ndm->ndm_state   = NUD_NONE;
2290
2291         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2292                 goto nla_put_failure;
2293
2294         nlmsg_end(skb, nlh);
2295         return 0;
2296
2297 nla_put_failure:
2298         nlmsg_cancel(skb, nlh);
2299         return -EMSGSIZE;
2300 }
2301
2302 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2303 {
2304         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2305         __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2306 }
2307
2308 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2309 {
2310         struct net_device *master;
2311
2312         if (!master_idx)
2313                 return false;
2314
2315         master = netdev_master_upper_dev_get(dev);
2316         if (!master || master->ifindex != master_idx)
2317                 return true;
2318
2319         return false;
2320 }
2321
2322 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2323 {
2324         if (filter_idx && dev->ifindex != filter_idx)
2325                 return true;
2326
2327         return false;
2328 }
2329
2330 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2331                             struct netlink_callback *cb)
2332 {
2333         struct net *net = sock_net(skb->sk);
2334         const struct nlmsghdr *nlh = cb->nlh;
2335         struct nlattr *tb[NDA_MAX + 1];
2336         struct neighbour *n;
2337         int rc, h, s_h = cb->args[1];
2338         int idx, s_idx = idx = cb->args[2];
2339         struct neigh_hash_table *nht;
2340         int filter_master_idx = 0, filter_idx = 0;
2341         unsigned int flags = NLM_F_MULTI;
2342         int err;
2343
2344         err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL);
2345         if (!err) {
2346                 if (tb[NDA_IFINDEX]) {
2347                         if (nla_len(tb[NDA_IFINDEX]) != sizeof(u32))
2348                                 return -EINVAL;
2349                         filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
2350                 }
2351                 if (tb[NDA_MASTER]) {
2352                         if (nla_len(tb[NDA_MASTER]) != sizeof(u32))
2353                                 return -EINVAL;
2354                         filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
2355                 }
2356                 if (filter_idx || filter_master_idx)
2357                         flags |= NLM_F_DUMP_FILTERED;
2358         }
2359
2360         rcu_read_lock_bh();
2361         nht = rcu_dereference_bh(tbl->nht);
2362
2363         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2364                 if (h > s_h)
2365                         s_idx = 0;
2366                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2367                      n != NULL;
2368                      n = rcu_dereference_bh(n->next)) {
2369                         if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2370                                 goto next;
2371                         if (neigh_ifindex_filtered(n->dev, filter_idx) ||
2372                             neigh_master_filtered(n->dev, filter_master_idx))
2373                                 goto next;
2374                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2375                                             cb->nlh->nlmsg_seq,
2376                                             RTM_NEWNEIGH,
2377                                             flags) < 0) {
2378                                 rc = -1;
2379                                 goto out;
2380                         }
2381 next:
2382                         idx++;
2383                 }
2384         }
2385         rc = skb->len;
2386 out:
2387         rcu_read_unlock_bh();
2388         cb->args[1] = h;
2389         cb->args[2] = idx;
2390         return rc;
2391 }
2392
2393 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2394                              struct netlink_callback *cb)
2395 {
2396         struct pneigh_entry *n;
2397         struct net *net = sock_net(skb->sk);
2398         int rc, h, s_h = cb->args[3];
2399         int idx, s_idx = idx = cb->args[4];
2400
2401         read_lock_bh(&tbl->lock);
2402
2403         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2404                 if (h > s_h)
2405                         s_idx = 0;
2406                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2407                         if (idx < s_idx || pneigh_net(n) != net)
2408                                 goto next;
2409                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2410                                             cb->nlh->nlmsg_seq,
2411                                             RTM_NEWNEIGH,
2412                                             NLM_F_MULTI, tbl) < 0) {
2413                                 read_unlock_bh(&tbl->lock);
2414                                 rc = -1;
2415                                 goto out;
2416                         }
2417                 next:
2418                         idx++;
2419                 }
2420         }
2421
2422         read_unlock_bh(&tbl->lock);
2423         rc = skb->len;
2424 out:
2425         cb->args[3] = h;
2426         cb->args[4] = idx;
2427         return rc;
2428
2429 }
2430
2431 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2432 {
2433         struct neigh_table *tbl;
2434         int t, family, s_t;
2435         int proxy = 0;
2436         int err;
2437
2438         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2439
2440         /* check for full ndmsg structure presence, family member is
2441          * the same for both structures
2442          */
2443         if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2444             ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2445                 proxy = 1;
2446
2447         s_t = cb->args[0];
2448
2449         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2450                 tbl = neigh_tables[t];
2451
2452                 if (!tbl)
2453                         continue;
2454                 if (t < s_t || (family && tbl->family != family))
2455                         continue;
2456                 if (t > s_t)
2457                         memset(&cb->args[1], 0, sizeof(cb->args) -
2458                                                 sizeof(cb->args[0]));
2459                 if (proxy)
2460                         err = pneigh_dump_table(tbl, skb, cb);
2461                 else
2462                         err = neigh_dump_table(tbl, skb, cb);
2463                 if (err < 0)
2464                         break;
2465         }
2466
2467         cb->args[0] = t;
2468         return skb->len;
2469 }
2470
2471 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2472 {
2473         int chain;
2474         struct neigh_hash_table *nht;
2475
2476         rcu_read_lock_bh();
2477         nht = rcu_dereference_bh(tbl->nht);
2478
2479         read_lock(&tbl->lock); /* avoid resizes */
2480         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2481                 struct neighbour *n;
2482
2483                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2484                      n != NULL;
2485                      n = rcu_dereference_bh(n->next))
2486                         cb(n, cookie);
2487         }
2488         read_unlock(&tbl->lock);
2489         rcu_read_unlock_bh();
2490 }
2491 EXPORT_SYMBOL(neigh_for_each);
2492
2493 /* The tbl->lock must be held as a writer and BH disabled. */
2494 void __neigh_for_each_release(struct neigh_table *tbl,
2495                               int (*cb)(struct neighbour *))
2496 {
2497         int chain;
2498         struct neigh_hash_table *nht;
2499
2500         nht = rcu_dereference_protected(tbl->nht,
2501                                         lockdep_is_held(&tbl->lock));
2502         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2503                 struct neighbour *n;
2504                 struct neighbour __rcu **np;
2505
2506                 np = &nht->hash_buckets[chain];
2507                 while ((n = rcu_dereference_protected(*np,
2508                                         lockdep_is_held(&tbl->lock))) != NULL) {
2509                         int release;
2510
2511                         write_lock(&n->lock);
2512                         release = cb(n);
2513                         if (release) {
2514                                 rcu_assign_pointer(*np,
2515                                         rcu_dereference_protected(n->next,
2516                                                 lockdep_is_held(&tbl->lock)));
2517                                 n->dead = 1;
2518                         } else
2519                                 np = &n->next;
2520                         write_unlock(&n->lock);
2521                         if (release)
2522                                 neigh_cleanup_and_release(n);
2523                 }
2524         }
2525 }
2526 EXPORT_SYMBOL(__neigh_for_each_release);
2527
2528 int neigh_xmit(int index, struct net_device *dev,
2529                const void *addr, struct sk_buff *skb)
2530 {
2531         int err = -EAFNOSUPPORT;
2532         if (likely(index < NEIGH_NR_TABLES)) {
2533                 struct neigh_table *tbl;
2534                 struct neighbour *neigh;
2535
2536                 tbl = neigh_tables[index];
2537                 if (!tbl)
2538                         goto out;
2539                 rcu_read_lock_bh();
2540                 neigh = __neigh_lookup_noref(tbl, addr, dev);
2541                 if (!neigh)
2542                         neigh = __neigh_create(tbl, addr, dev, false);
2543                 err = PTR_ERR(neigh);
2544                 if (IS_ERR(neigh)) {
2545                         rcu_read_unlock_bh();
2546                         goto out_kfree_skb;
2547                 }
2548                 err = neigh->output(neigh, skb);
2549                 rcu_read_unlock_bh();
2550         }
2551         else if (index == NEIGH_LINK_TABLE) {
2552                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2553                                       addr, NULL, skb->len);
2554                 if (err < 0)
2555                         goto out_kfree_skb;
2556                 err = dev_queue_xmit(skb);
2557         }
2558 out:
2559         return err;
2560 out_kfree_skb:
2561         kfree_skb(skb);
2562         goto out;
2563 }
2564 EXPORT_SYMBOL(neigh_xmit);
2565
2566 #ifdef CONFIG_PROC_FS
2567
2568 static struct neighbour *neigh_get_first(struct seq_file *seq)
2569 {
2570         struct neigh_seq_state *state = seq->private;
2571         struct net *net = seq_file_net(seq);
2572         struct neigh_hash_table *nht = state->nht;
2573         struct neighbour *n = NULL;
2574         int bucket = state->bucket;
2575
2576         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2577         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2578                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2579
2580                 while (n) {
2581                         if (!net_eq(dev_net(n->dev), net))
2582                                 goto next;
2583                         if (state->neigh_sub_iter) {
2584                                 loff_t fakep = 0;
2585                                 void *v;
2586
2587                                 v = state->neigh_sub_iter(state, n, &fakep);
2588                                 if (!v)
2589                                         goto next;
2590                         }
2591                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2592                                 break;
2593                         if (n->nud_state & ~NUD_NOARP)
2594                                 break;
2595 next:
2596                         n = rcu_dereference_bh(n->next);
2597                 }
2598
2599                 if (n)
2600                         break;
2601         }
2602         state->bucket = bucket;
2603
2604         return n;
2605 }
2606
2607 static struct neighbour *neigh_get_next(struct seq_file *seq,
2608                                         struct neighbour *n,
2609                                         loff_t *pos)
2610 {
2611         struct neigh_seq_state *state = seq->private;
2612         struct net *net = seq_file_net(seq);
2613         struct neigh_hash_table *nht = state->nht;
2614
2615         if (state->neigh_sub_iter) {
2616                 void *v = state->neigh_sub_iter(state, n, pos);
2617                 if (v)
2618                         return n;
2619         }
2620         n = rcu_dereference_bh(n->next);
2621
2622         while (1) {
2623                 while (n) {
2624                         if (!net_eq(dev_net(n->dev), net))
2625                                 goto next;
2626                         if (state->neigh_sub_iter) {
2627                                 void *v = state->neigh_sub_iter(state, n, pos);
2628                                 if (v)
2629                                         return n;
2630                                 goto next;
2631                         }
2632                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2633                                 break;
2634
2635                         if (n->nud_state & ~NUD_NOARP)
2636                                 break;
2637 next:
2638                         n = rcu_dereference_bh(n->next);
2639                 }
2640
2641                 if (n)
2642                         break;
2643
2644                 if (++state->bucket >= (1 << nht->hash_shift))
2645                         break;
2646
2647                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2648         }
2649
2650         if (n && pos)
2651                 --(*pos);
2652         return n;
2653 }
2654
2655 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2656 {
2657         struct neighbour *n = neigh_get_first(seq);
2658
2659         if (n) {
2660                 --(*pos);
2661                 while (*pos) {
2662                         n = neigh_get_next(seq, n, pos);
2663                         if (!n)
2664                                 break;
2665                 }
2666         }
2667         return *pos ? NULL : n;
2668 }
2669
2670 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2671 {
2672         struct neigh_seq_state *state = seq->private;
2673         struct net *net = seq_file_net(seq);
2674         struct neigh_table *tbl = state->tbl;
2675         struct pneigh_entry *pn = NULL;
2676         int bucket = state->bucket;
2677
2678         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2679         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2680                 pn = tbl->phash_buckets[bucket];
2681                 while (pn && !net_eq(pneigh_net(pn), net))
2682                         pn = pn->next;
2683                 if (pn)
2684                         break;
2685         }
2686         state->bucket = bucket;
2687
2688         return pn;
2689 }
2690
2691 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2692                                             struct pneigh_entry *pn,
2693                                             loff_t *pos)
2694 {
2695         struct neigh_seq_state *state = seq->private;
2696         struct net *net = seq_file_net(seq);
2697         struct neigh_table *tbl = state->tbl;
2698
2699         do {
2700                 pn = pn->next;
2701         } while (pn && !net_eq(pneigh_net(pn), net));
2702
2703         while (!pn) {
2704                 if (++state->bucket > PNEIGH_HASHMASK)
2705                         break;
2706                 pn = tbl->phash_buckets[state->bucket];
2707                 while (pn && !net_eq(pneigh_net(pn), net))
2708                         pn = pn->next;
2709                 if (pn)
2710                         break;
2711         }
2712
2713         if (pn && pos)
2714                 --(*pos);
2715
2716         return pn;
2717 }
2718
2719 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2720 {
2721         struct pneigh_entry *pn = pneigh_get_first(seq);
2722
2723         if (pn) {
2724                 --(*pos);
2725                 while (*pos) {
2726                         pn = pneigh_get_next(seq, pn, pos);
2727                         if (!pn)
2728                                 break;
2729                 }
2730         }
2731         return *pos ? NULL : pn;
2732 }
2733
2734 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2735 {
2736         struct neigh_seq_state *state = seq->private;
2737         void *rc;
2738         loff_t idxpos = *pos;
2739
2740         rc = neigh_get_idx(seq, &idxpos);
2741         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2742                 rc = pneigh_get_idx(seq, &idxpos);
2743
2744         return rc;
2745 }
2746
2747 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2748         __acquires(rcu_bh)
2749 {
2750         struct neigh_seq_state *state = seq->private;
2751
2752         state->tbl = tbl;
2753         state->bucket = 0;
2754         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2755
2756         rcu_read_lock_bh();
2757         state->nht = rcu_dereference_bh(tbl->nht);
2758
2759         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2760 }
2761 EXPORT_SYMBOL(neigh_seq_start);
2762
2763 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2764 {
2765         struct neigh_seq_state *state;
2766         void *rc;
2767
2768         if (v == SEQ_START_TOKEN) {
2769                 rc = neigh_get_first(seq);
2770                 goto out;
2771         }
2772
2773         state = seq->private;
2774         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2775                 rc = neigh_get_next(seq, v, NULL);
2776                 if (rc)
2777                         goto out;
2778                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2779                         rc = pneigh_get_first(seq);
2780         } else {
2781                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2782                 rc = pneigh_get_next(seq, v, NULL);
2783         }
2784 out:
2785         ++(*pos);
2786         return rc;
2787 }
2788 EXPORT_SYMBOL(neigh_seq_next);
2789
2790 void neigh_seq_stop(struct seq_file *seq, void *v)
2791         __releases(rcu_bh)
2792 {
2793         rcu_read_unlock_bh();
2794 }
2795 EXPORT_SYMBOL(neigh_seq_stop);
2796
2797 /* statistics via seq_file */
2798
2799 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2800 {
2801         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
2802         int cpu;
2803
2804         if (*pos == 0)
2805                 return SEQ_START_TOKEN;
2806
2807         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2808                 if (!cpu_possible(cpu))
2809                         continue;
2810                 *pos = cpu+1;
2811                 return per_cpu_ptr(tbl->stats, cpu);
2812         }
2813         return NULL;
2814 }
2815
2816 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2817 {
2818         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
2819         int cpu;
2820
2821         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2822                 if (!cpu_possible(cpu))
2823                         continue;
2824                 *pos = cpu+1;
2825                 return per_cpu_ptr(tbl->stats, cpu);
2826         }
2827         return NULL;
2828 }
2829
2830 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2831 {
2832
2833 }
2834
2835 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2836 {
2837         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
2838         struct neigh_statistics *st = v;
2839
2840         if (v == SEQ_START_TOKEN) {
2841                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
2842                 return 0;
2843         }
2844
2845         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2846                         "%08lx %08lx  %08lx %08lx %08lx %08lx\n",
2847                    atomic_read(&tbl->entries),
2848
2849                    st->allocs,
2850                    st->destroys,
2851                    st->hash_grows,
2852
2853                    st->lookups,
2854                    st->hits,
2855
2856                    st->res_failed,
2857
2858                    st->rcv_probes_mcast,
2859                    st->rcv_probes_ucast,
2860
2861                    st->periodic_gc_runs,
2862                    st->forced_gc_runs,
2863                    st->unres_discards,
2864                    st->table_fulls
2865                    );
2866
2867         return 0;
2868 }
2869
2870 static const struct seq_operations neigh_stat_seq_ops = {
2871         .start  = neigh_stat_seq_start,
2872         .next   = neigh_stat_seq_next,
2873         .stop   = neigh_stat_seq_stop,
2874         .show   = neigh_stat_seq_show,
2875 };
2876 #endif /* CONFIG_PROC_FS */
2877
2878 static inline size_t neigh_nlmsg_size(void)
2879 {
2880         return NLMSG_ALIGN(sizeof(struct ndmsg))
2881                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2882                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2883                + nla_total_size(sizeof(struct nda_cacheinfo))
2884                + nla_total_size(4); /* NDA_PROBES */
2885 }
2886
2887 static void __neigh_notify(struct neighbour *n, int type, int flags,
2888                            u32 pid)
2889 {
2890         struct net *net = dev_net(n->dev);
2891         struct sk_buff *skb;
2892         int err = -ENOBUFS;
2893
2894         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2895         if (skb == NULL)
2896                 goto errout;
2897
2898         err = neigh_fill_info(skb, n, pid, 0, type, flags);
2899         if (err < 0) {
2900                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2901                 WARN_ON(err == -EMSGSIZE);
2902                 kfree_skb(skb);
2903                 goto errout;
2904         }
2905         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2906         return;
2907 errout:
2908         if (err < 0)
2909                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2910 }
2911
2912 void neigh_app_ns(struct neighbour *n)
2913 {
2914         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
2915 }
2916 EXPORT_SYMBOL(neigh_app_ns);
2917
2918 #ifdef CONFIG_SYSCTL
2919 static int zero;
2920 static int int_max = INT_MAX;
2921 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2922
2923 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2924                            void __user *buffer, size_t *lenp, loff_t *ppos)
2925 {
2926         int size, ret;
2927         struct ctl_table tmp = *ctl;
2928
2929         tmp.extra1 = &zero;
2930         tmp.extra2 = &unres_qlen_max;
2931         tmp.data = &size;
2932
2933         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2934         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2935
2936         if (write && !ret)
2937                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2938         return ret;
2939 }
2940
2941 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2942                                                    int family)
2943 {
2944         switch (family) {
2945         case AF_INET:
2946                 return __in_dev_arp_parms_get_rcu(dev);
2947         case AF_INET6:
2948                 return __in6_dev_nd_parms_get_rcu(dev);
2949         }
2950         return NULL;
2951 }
2952
2953 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2954                                   int index)
2955 {
2956         struct net_device *dev;
2957         int family = neigh_parms_family(p);
2958
2959         rcu_read_lock();
2960         for_each_netdev_rcu(net, dev) {
2961                 struct neigh_parms *dst_p =
2962                                 neigh_get_dev_parms_rcu(dev, family);
2963
2964                 if (dst_p && !test_bit(index, dst_p->data_state))
2965                         dst_p->data[index] = p->data[index];
2966         }
2967         rcu_read_unlock();
2968 }
2969
2970 static void neigh_proc_update(struct ctl_table *ctl, int write)
2971 {
2972         struct net_device *dev = ctl->extra1;
2973         struct neigh_parms *p = ctl->extra2;
2974         struct net *net = neigh_parms_net(p);
2975         int index = (int *) ctl->data - p->data;
2976
2977         if (!write)
2978                 return;
2979
2980         set_bit(index, p->data_state);
2981         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
2982                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2983         if (!dev) /* NULL dev means this is default value */
2984                 neigh_copy_dflt_parms(net, p, index);
2985 }
2986
2987 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2988                                            void __user *buffer,
2989                                            size_t *lenp, loff_t *ppos)
2990 {
2991         struct ctl_table tmp = *ctl;
2992         int ret;
2993
2994         tmp.extra1 = &zero;
2995         tmp.extra2 = &int_max;
2996
2997         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2998         neigh_proc_update(ctl, write);
2999         return ret;
3000 }
3001
3002 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
3003                         void __user *buffer, size_t *lenp, loff_t *ppos)
3004 {
3005         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3006
3007         neigh_proc_update(ctl, write);
3008         return ret;
3009 }
3010 EXPORT_SYMBOL(neigh_proc_dointvec);
3011
3012 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
3013                                 void __user *buffer,
3014                                 size_t *lenp, loff_t *ppos)
3015 {
3016         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3017
3018         neigh_proc_update(ctl, write);
3019         return ret;
3020 }
3021 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3022
3023 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3024                                               void __user *buffer,
3025                                               size_t *lenp, loff_t *ppos)
3026 {
3027         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3028
3029         neigh_proc_update(ctl, write);
3030         return ret;
3031 }
3032
3033 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3034                                    void __user *buffer,
3035                                    size_t *lenp, loff_t *ppos)
3036 {
3037         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3038
3039         neigh_proc_update(ctl, write);
3040         return ret;
3041 }
3042 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3043
3044 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3045                                           void __user *buffer,
3046                                           size_t *lenp, loff_t *ppos)
3047 {
3048         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3049
3050         neigh_proc_update(ctl, write);
3051         return ret;
3052 }
3053
3054 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3055                                           void __user *buffer,
3056                                           size_t *lenp, loff_t *ppos)
3057 {
3058         struct neigh_parms *p = ctl->extra2;
3059         int ret;
3060
3061         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3062                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3063         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3064                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3065         else
3066                 ret = -1;
3067
3068         if (write && ret == 0) {
3069                 /* update reachable_time as well, otherwise, the change will
3070                  * only be effective after the next time neigh_periodic_work
3071                  * decides to recompute it
3072                  */
3073                 p->reachable_time =
3074                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3075         }
3076         return ret;
3077 }
3078
3079 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3080         (&((struct neigh_parms *) 0)->data[index])
3081
3082 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3083         [NEIGH_VAR_ ## attr] = { \
3084                 .procname       = name, \
3085                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3086                 .maxlen         = sizeof(int), \
3087                 .mode           = mval, \
3088                 .proc_handler   = proc, \
3089         }
3090
3091 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3092         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3093
3094 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3095         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3096
3097 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3098         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3099
3100 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3101         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3102
3103 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3104         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3105
3106 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3107         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3108
3109 static struct neigh_sysctl_table {
3110         struct ctl_table_header *sysctl_header;
3111         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3112 } neigh_sysctl_template __read_mostly = {
3113         .neigh_vars = {
3114                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3115                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3116                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3117                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3118                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3119                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3120                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3121                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3122                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3123                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3124                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3125                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3126                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3127                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3128                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3129                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3130                 [NEIGH_VAR_GC_INTERVAL] = {
3131                         .procname       = "gc_interval",
3132                         .maxlen         = sizeof(int),
3133                         .mode           = 0644,
3134                         .proc_handler   = proc_dointvec_jiffies,
3135                 },
3136                 [NEIGH_VAR_GC_THRESH1] = {
3137                         .procname       = "gc_thresh1",
3138                         .maxlen         = sizeof(int),
3139                         .mode           = 0644,
3140                         .extra1         = &zero,
3141                         .extra2         = &int_max,
3142                         .proc_handler   = proc_dointvec_minmax,
3143                 },
3144                 [NEIGH_VAR_GC_THRESH2] = {
3145                         .procname       = "gc_thresh2",
3146                         .maxlen         = sizeof(int),
3147                         .mode           = 0644,
3148                         .extra1         = &zero,
3149                         .extra2         = &int_max,
3150                         .proc_handler   = proc_dointvec_minmax,
3151                 },
3152                 [NEIGH_VAR_GC_THRESH3] = {
3153                         .procname       = "gc_thresh3",
3154                         .maxlen         = sizeof(int),
3155                         .mode           = 0644,
3156                         .extra1         = &zero,
3157                         .extra2         = &int_max,
3158                         .proc_handler   = proc_dointvec_minmax,
3159                 },
3160                 {},
3161         },
3162 };
3163
3164 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3165                           proc_handler *handler)
3166 {
3167         int i;
3168         struct neigh_sysctl_table *t;
3169         const char *dev_name_source;
3170         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3171         char *p_name;
3172
3173         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3174         if (!t)
3175                 goto err;
3176
3177         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3178                 t->neigh_vars[i].data += (long) p;
3179                 t->neigh_vars[i].extra1 = dev;
3180                 t->neigh_vars[i].extra2 = p;
3181         }
3182
3183         if (dev) {
3184                 dev_name_source = dev->name;
3185                 /* Terminate the table early */
3186                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3187                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3188         } else {
3189                 struct neigh_table *tbl = p->tbl;
3190                 dev_name_source = "default";
3191                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3192                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3193                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3194                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3195         }
3196
3197         if (handler) {
3198                 /* RetransTime */
3199                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3200                 /* ReachableTime */
3201                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3202                 /* RetransTime (in milliseconds)*/
3203                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3204                 /* ReachableTime (in milliseconds) */
3205                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3206         } else {
3207                 /* Those handlers will update p->reachable_time after
3208                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3209                  * applied after the next neighbour update instead of waiting for
3210                  * neigh_periodic_work to update its value (can be multiple minutes)
3211                  * So any handler that replaces them should do this as well
3212                  */
3213                 /* ReachableTime */
3214                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3215                         neigh_proc_base_reachable_time;
3216                 /* ReachableTime (in milliseconds) */
3217                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3218                         neigh_proc_base_reachable_time;
3219         }
3220
3221         /* Don't export sysctls to unprivileged users */
3222         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3223                 t->neigh_vars[0].procname = NULL;
3224
3225         switch (neigh_parms_family(p)) {
3226         case AF_INET:
3227               p_name = "ipv4";
3228               break;
3229         case AF_INET6:
3230               p_name = "ipv6";
3231               break;
3232         default:
3233               BUG();
3234         }
3235
3236         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3237                 p_name, dev_name_source);
3238         t->sysctl_header =
3239                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3240         if (!t->sysctl_header)
3241                 goto free;
3242
3243         p->sysctl_table = t;
3244         return 0;
3245
3246 free:
3247         kfree(t);
3248 err:
3249         return -ENOBUFS;
3250 }
3251 EXPORT_SYMBOL(neigh_sysctl_register);
3252
3253 void neigh_sysctl_unregister(struct neigh_parms *p)
3254 {
3255         if (p->sysctl_table) {
3256                 struct neigh_sysctl_table *t = p->sysctl_table;
3257                 p->sysctl_table = NULL;
3258                 unregister_net_sysctl_table(t->sysctl_header);
3259                 kfree(t);
3260         }
3261 }
3262 EXPORT_SYMBOL(neigh_sysctl_unregister);
3263
3264 #endif  /* CONFIG_SYSCTL */
3265
3266 static int __init neigh_init(void)
3267 {
3268         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, 0);
3269         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, 0);
3270         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, 0);
3271
3272         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3273                       0);
3274         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0);
3275
3276         return 0;
3277 }
3278
3279 subsys_initcall(neigh_init);