net/core/neighbour.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Generic address resolution entity
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   8  *
   9  *      Fixes:
  10  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  11  *      Harald Welte            Add neighbour cache statistics like rtstat
  12  */
  13
  14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  15
  16 #include <linux/slab.h>
  17 #include <linux/kmemleak.h>
  18 #include <linux/types.h>
  19 #include <linux/kernel.h>
  20 #include <linux/module.h>
  21 #include <linux/socket.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/proc_fs.h>
  24 #ifdef CONFIG_SYSCTL
  25 #include <linux/sysctl.h>
  26 #endif
  27 #include <linux/times.h>
  28 #include <net/net_namespace.h>
  29 #include <net/neighbour.h>
  30 #include <net/arp.h>
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/netevent.h>
  34 #include <net/netlink.h>
  35 #include <linux/rtnetlink.h>
  36 #include <linux/random.h>
  37 #include <linux/string.h>
  38 #include <linux/log2.h>
  39 #include <linux/inetdevice.h>
  40 #include <net/addrconf.h>
  41
  42 #include <trace/events/neigh.h>
  43
  44 #define NEIGH_DEBUG 1
  45 #define neigh_dbg(level, fmt, ...)              \
  46 do {                                            \
  47         if (level <= NEIGH_DEBUG)               \
  48                 pr_debug(fmt, ##__VA_ARGS__);   \
  49 } while (0)
  50
  51 #define PNEIGH_HASHMASK         0xF
  52
  53 static void neigh_timer_handler(struct timer_list *t);
  54 static void __neigh_notify(struct neighbour *n, int type, int flags,
  55                            u32 pid);
  56 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  57 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
  58                                     struct net_device *dev);
  59
  60 #ifdef CONFIG_PROC_FS
  61 static const struct seq_operations neigh_stat_seq_ops;
  62 #endif
  63
  64 /*
  65    Neighbour hash table buckets are protected with rwlock tbl->lock.
  66
  67    - All the scans/updates to hash buckets MUST be made under this lock.
  68    - NOTHING clever should be made under this lock: no callbacks
  69      to protocol backends, no attempts to send something to network.
  70      It will result in deadlocks, if backend/driver wants to use neighbour
  71      cache.
  72    - If the entry requires some non-trivial actions, increase
  73      its reference count and release table lock.
  74
  75    Neighbour entries are protected:
  76    - with reference count.
  77    - with rwlock neigh->lock
  78
  79    Reference count prevents destruction.
  80
  81    neigh->lock mainly serializes ll address data and its validity state.
  82    However, the same lock is used to protect another entry fields:
  83     - timer
  84     - resolution queue
  85
  86    Again, nothing clever shall be made under neigh->lock,
  87    the most complicated procedure, which we allow is dev->hard_header.
  88    It is supposed, that dev->hard_header is simplistic and does
  89    not make callbacks to neighbour tables.
  90  */
  91
  92 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  93 {
  94         kfree_skb(skb);
  95         return -ENETDOWN;
  96 }
  97
  98 static void neigh_cleanup_and_release(struct neighbour *neigh)
  99 {
 100         trace_neigh_cleanup_and_release(neigh, 0);
 101         __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 102         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 103         neigh_release(neigh);
 104 }
 105
 106 /*
 107  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 108  * It corresponds to default IPv6 settings and is not overridable,
 109  * because it is really reasonable choice.
 110  */
 111
 112 unsigned long neigh_rand_reach_time(unsigned long base)
 113 {
 114         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 115 }
 116 EXPORT_SYMBOL(neigh_rand_reach_time);
 117
 118 static void neigh_mark_dead(struct neighbour *n)
 119 {
 120         n->dead = 1;
 121         if (!list_empty(&n->gc_list)) {
 122                 list_del_init(&n->gc_list);
 123                 atomic_dec(&n->tbl->gc_entries);
 124         }
 125         if (!list_empty(&n->managed_list))
 126                 list_del_init(&n->managed_list);
 127 }
 128
 129 static void neigh_update_gc_list(struct neighbour *n)
 130 {
 131         bool on_gc_list, exempt_from_gc;
 132
 133         write_lock_bh(&n->tbl->lock);
 134         write_lock(&n->lock);
 135         if (n->dead)
 136                 goto out;
 137
 138         /* remove from the gc list if new state is permanent or if neighbor
 139          * is externally learned; otherwise entry should be on the gc list
 140          */
 141         exempt_from_gc = n->nud_state & NUD_PERMANENT ||
 142                          n->flags & NTF_EXT_LEARNED;
 143         on_gc_list = !list_empty(&n->gc_list);
 144
 145         if (exempt_from_gc && on_gc_list) {
 146                 list_del_init(&n->gc_list);
 147                 atomic_dec(&n->tbl->gc_entries);
 148         } else if (!exempt_from_gc && !on_gc_list) {
 149                 /* add entries to the tail; cleaning removes from the front */
 150                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 151                 atomic_inc(&n->tbl->gc_entries);
 152         }
 153 out:
 154         write_unlock(&n->lock);
 155         write_unlock_bh(&n->tbl->lock);
 156 }
 157
 158 static void neigh_update_managed_list(struct neighbour *n)
 159 {
 160         bool on_managed_list, add_to_managed;
 161
 162         write_lock_bh(&n->tbl->lock);
 163         write_lock(&n->lock);
 164         if (n->dead)
 165                 goto out;
 166
 167         add_to_managed = n->flags & NTF_MANAGED;
 168         on_managed_list = !list_empty(&n->managed_list);
 169
 170         if (!add_to_managed && on_managed_list)
 171                 list_del_init(&n->managed_list);
 172         else if (add_to_managed && !on_managed_list)
 173                 list_add_tail(&n->managed_list, &n->tbl->managed_list);
 174 out:
 175         write_unlock(&n->lock);
 176         write_unlock_bh(&n->tbl->lock);
 177 }
 178
 179 static void neigh_update_flags(struct neighbour *neigh, u32 flags, int *notify,
 180                                bool *gc_update, bool *managed_update)
 181 {
 182         u32 ndm_flags, old_flags = neigh->flags;
 183
 184         if (!(flags & NEIGH_UPDATE_F_ADMIN))
 185                 return;
 186
 187         ndm_flags  = (flags & NEIGH_UPDATE_F_EXT_LEARNED) ? NTF_EXT_LEARNED : 0;
 188         ndm_flags |= (flags & NEIGH_UPDATE_F_MANAGED) ? NTF_MANAGED : 0;
 189
 190         if ((old_flags ^ ndm_flags) & NTF_EXT_LEARNED) {
 191                 if (ndm_flags & NTF_EXT_LEARNED)
 192                         neigh->flags |= NTF_EXT_LEARNED;
 193                 else
 194                         neigh->flags &= ~NTF_EXT_LEARNED;
 195                 *notify = 1;
 196                 *gc_update = true;
 197         }
 198         if ((old_flags ^ ndm_flags) & NTF_MANAGED) {
 199                 if (ndm_flags & NTF_MANAGED)
 200                         neigh->flags |= NTF_MANAGED;
 201                 else
 202                         neigh->flags &= ~NTF_MANAGED;
 203                 *notify = 1;
 204                 *managed_update = true;
 205         }
 206 }
 207
 208 static bool neigh_del(struct neighbour *n, struct neighbour __rcu **np,
 209                       struct neigh_table *tbl)
 210 {
 211         bool retval = false;
 212
 213         write_lock(&n->lock);
 214         if (refcount_read(&n->refcnt) == 1) {
 215                 struct neighbour *neigh;
 216
 217                 neigh = rcu_dereference_protected(n->next,
 218                                                   lockdep_is_held(&tbl->lock));
 219                 rcu_assign_pointer(*np, neigh);
 220                 neigh_mark_dead(n);
 221                 retval = true;
 222         }
 223         write_unlock(&n->lock);
 224         if (retval)
 225                 neigh_cleanup_and_release(n);
 226         return retval;
 227 }
 228
 229 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 230 {
 231         struct neigh_hash_table *nht;
 232         void *pkey = ndel->primary_key;
 233         u32 hash_val;
 234         struct neighbour *n;
 235         struct neighbour __rcu **np;
 236
 237         nht = rcu_dereference_protected(tbl->nht,
 238                                         lockdep_is_held(&tbl->lock));
 239         hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
 240         hash_val = hash_val >> (32 - nht->hash_shift);
 241
 242         np = &nht->hash_buckets[hash_val];
 243         while ((n = rcu_dereference_protected(*np,
 244                                               lockdep_is_held(&tbl->lock)))) {
 245                 if (n == ndel)
 246                         return neigh_del(n, np, tbl);
 247                 np = &n->next;
 248         }
 249         return false;
 250 }
 251
 252 static int neigh_forced_gc(struct neigh_table *tbl)
 253 {
 254         int max_clean = atomic_read(&tbl->gc_entries) - tbl->gc_thresh2;
 255         unsigned long tref = jiffies - 5 * HZ;
 256         struct neighbour *n, *tmp;
 257         int shrunk = 0;
 258
 259         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 260
 261         write_lock_bh(&tbl->lock);
 262
 263         list_for_each_entry_safe(n, tmp, &tbl->gc_list, gc_list) {
 264                 if (refcount_read(&n->refcnt) == 1) {
 265                         bool remove = false;
 266
 267                         write_lock(&n->lock);
 268                         if ((n->nud_state == NUD_FAILED) ||
 269                             (n->nud_state == NUD_NOARP) ||
 270                             (tbl->is_multicast &&
 271                              tbl->is_multicast(n->primary_key)) ||
 272                             time_after(tref, n->updated))
 273                                 remove = true;
 274                         write_unlock(&n->lock);
 275
 276                         if (remove && neigh_remove_one(n, tbl))
 277                                 shrunk++;
 278                         if (shrunk >= max_clean)
 279                                 break;
 280                 }
 281         }
 282
 283         tbl->last_flush = jiffies;
 284
 285         write_unlock_bh(&tbl->lock);
 286
 287         return shrunk;
 288 }
 289
 290 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 291 {
 292         neigh_hold(n);
 293         if (unlikely(mod_timer(&n->timer, when))) {
 294                 printk("NEIGH: BUG, double timer add, state is %x\n",
 295                        n->nud_state);
 296                 dump_stack();
 297         }
 298 }
 299
 300 static int neigh_del_timer(struct neighbour *n)
 301 {
 302         if ((n->nud_state & NUD_IN_TIMER) &&
 303             del_timer(&n->timer)) {
 304                 neigh_release(n);
 305                 return 1;
 306         }
 307         return 0;
 308 }
 309
 310 static void pneigh_queue_purge(struct sk_buff_head *list)
 311 {
 312         struct sk_buff *skb;
 313
 314         while ((skb = skb_dequeue(list)) != NULL) {
 315                 dev_put(skb->dev);
 316                 kfree_skb(skb);
 317         }
 318 }
 319
 320 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev,
 321                             bool skip_perm)
 322 {
 323         int i;
 324         struct neigh_hash_table *nht;
 325
 326         nht = rcu_dereference_protected(tbl->nht,
 327                                         lockdep_is_held(&tbl->lock));
 328
 329         for (i = 0; i < (1 << nht->hash_shift); i++) {
 330                 struct neighbour *n;
 331                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 332
 333                 while ((n = rcu_dereference_protected(*np,
 334                                         lockdep_is_held(&tbl->lock))) != NULL) {
 335                         if (dev && n->dev != dev) {
 336                                 np = &n->next;
 337                                 continue;
 338                         }
 339                         if (skip_perm && n->nud_state & NUD_PERMANENT) {
 340                                 np = &n->next;
 341                                 continue;
 342                         }
 343                         rcu_assign_pointer(*np,
 344                                    rcu_dereference_protected(n->next,
 345                                                 lockdep_is_held(&tbl->lock)));
 346                         write_lock(&n->lock);
 347                         neigh_del_timer(n);
 348                         neigh_mark_dead(n);
 349                         if (refcount_read(&n->refcnt) != 1) {
 350                                 /* The most unpleasant situation.
 351                                    We must destroy neighbour entry,
 352                                    but someone still uses it.
 353
 354                                    The destroy will be delayed until
 355                                    the last user releases us, but
 356                                    we must kill timers etc. and move
 357                                    it to safe state.
 358                                  */
 359                                 __skb_queue_purge(&n->arp_queue);
 360                                 n->arp_queue_len_bytes = 0;
 361                                 n->output = neigh_blackhole;
 362                                 if (n->nud_state & NUD_VALID)
 363                                         n->nud_state = NUD_NOARP;
 364                                 else
 365                                         n->nud_state = NUD_NONE;
 366                                 neigh_dbg(2, "neigh %p is stray\n", n);
 367                         }
 368                         write_unlock(&n->lock);
 369                         neigh_cleanup_and_release(n);
 370                 }
 371         }
 372 }
 373
 374 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 375 {
 376         write_lock_bh(&tbl->lock);
 377         neigh_flush_dev(tbl, dev, false);
 378         write_unlock_bh(&tbl->lock);
 379 }
 380 EXPORT_SYMBOL(neigh_changeaddr);
 381
 382 static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
 383                           bool skip_perm)
 384 {
 385         write_lock_bh(&tbl->lock);
 386         neigh_flush_dev(tbl, dev, skip_perm);
 387         pneigh_ifdown_and_unlock(tbl, dev);
 388
 389         del_timer_sync(&tbl->proxy_timer);
 390         pneigh_queue_purge(&tbl->proxy_queue);
 391         return 0;
 392 }
 393
 394 int neigh_carrier_down(struct neigh_table *tbl, struct net_device *dev)
 395 {
 396         __neigh_ifdown(tbl, dev, true);
 397         return 0;
 398 }
 399 EXPORT_SYMBOL(neigh_carrier_down);
 400
 401 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 402 {
 403         __neigh_ifdown(tbl, dev, false);
 404         return 0;
 405 }
 406 EXPORT_SYMBOL(neigh_ifdown);
 407
 408 static struct neighbour *neigh_alloc(struct neigh_table *tbl,
 409                                      struct net_device *dev,
 410                                      u32 flags, bool exempt_from_gc)
 411 {
 412         struct neighbour *n = NULL;
 413         unsigned long now = jiffies;
 414         int entries;
 415
 416         if (exempt_from_gc)
 417                 goto do_alloc;
 418
 419         entries = atomic_inc_return(&tbl->gc_entries) - 1;
 420         if (entries >= tbl->gc_thresh3 ||
 421             (entries >= tbl->gc_thresh2 &&
 422              time_after(now, tbl->last_flush + 5 * HZ))) {
 423                 if (!neigh_forced_gc(tbl) &&
 424                     entries >= tbl->gc_thresh3) {
 425                         net_info_ratelimited("%s: neighbor table overflow!\n",
 426                                              tbl->id);
 427                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 428                         goto out_entries;
 429                 }
 430         }
 431
 432 do_alloc:
 433         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 434         if (!n)
 435                 goto out_entries;
 436
 437         __skb_queue_head_init(&n->arp_queue);
 438         rwlock_init(&n->lock);
 439         seqlock_init(&n->ha_lock);
 440         n->updated        = n->used = now;
 441         n->nud_state      = NUD_NONE;
 442         n->output         = neigh_blackhole;
 443         n->flags          = flags;
 444         seqlock_init(&n->hh.hh_lock);
 445         n->parms          = neigh_parms_clone(&tbl->parms);
 446         timer_setup(&n->timer, neigh_timer_handler, 0);
 447
 448         NEIGH_CACHE_STAT_INC(tbl, allocs);
 449         n->tbl            = tbl;
 450         refcount_set(&n->refcnt, 1);
 451         n->dead           = 1;
 452         INIT_LIST_HEAD(&n->gc_list);
 453         INIT_LIST_HEAD(&n->managed_list);
 454
 455         atomic_inc(&tbl->entries);
 456 out:
 457         return n;
 458
 459 out_entries:
 460         if (!exempt_from_gc)
 461                 atomic_dec(&tbl->gc_entries);
 462         goto out;
 463 }
 464
 465 static void neigh_get_hash_rnd(u32 *x)
 466 {
 467         *x = get_random_u32() | 1;
 468 }
 469
 470 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 471 {
 472         size_t size = (1 << shift) * sizeof(struct neighbour *);
 473         struct neigh_hash_table *ret;
 474         struct neighbour __rcu **buckets;
 475         int i;
 476
 477         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 478         if (!ret)
 479                 return NULL;
 480         if (size <= PAGE_SIZE) {
 481                 buckets = kzalloc(size, GFP_ATOMIC);
 482         } else {
 483                 buckets = (struct neighbour __rcu **)
 484                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 485                                            get_order(size));
 486                 kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
 487         }
 488         if (!buckets) {
 489                 kfree(ret);
 490                 return NULL;
 491         }
 492         ret->hash_buckets = buckets;
 493         ret->hash_shift = shift;
 494         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 495                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 496         return ret;
 497 }
 498
 499 static void neigh_hash_free_rcu(struct rcu_head *head)
 500 {
 501         struct neigh_hash_table *nht = container_of(head,
 502                                                     struct neigh_hash_table,
 503                                                     rcu);
 504         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 505         struct neighbour __rcu **buckets = nht->hash_buckets;
 506
 507         if (size <= PAGE_SIZE) {
 508                 kfree(buckets);
 509         } else {
 510                 kmemleak_free(buckets);
 511                 free_pages((unsigned long)buckets, get_order(size));
 512         }
 513         kfree(nht);
 514 }
 515
 516 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 517                                                 unsigned long new_shift)
 518 {
 519         unsigned int i, hash;
 520         struct neigh_hash_table *new_nht, *old_nht;
 521
 522         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 523
 524         old_nht = rcu_dereference_protected(tbl->nht,
 525                                             lockdep_is_held(&tbl->lock));
 526         new_nht = neigh_hash_alloc(new_shift);
 527         if (!new_nht)
 528                 return old_nht;
 529
 530         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 531                 struct neighbour *n, *next;
 532
 533                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 534                                                    lockdep_is_held(&tbl->lock));
 535                      n != NULL;
 536                      n = next) {
 537                         hash = tbl->hash(n->primary_key, n->dev,
 538                                          new_nht->hash_rnd);
 539
 540                         hash >>= (32 - new_nht->hash_shift);
 541                         next = rcu_dereference_protected(n->next,
 542                                                 lockdep_is_held(&tbl->lock));
 543
 544                         rcu_assign_pointer(n->next,
 545                                            rcu_dereference_protected(
 546                                                 new_nht->hash_buckets[hash],
 547                                                 lockdep_is_held(&tbl->lock)));
 548                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 549                 }
 550         }
 551
 552         rcu_assign_pointer(tbl->nht, new_nht);
 553         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 554         return new_nht;
 555 }
 556
 557 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 558                                struct net_device *dev)
 559 {
 560         struct neighbour *n;
 561
 562         NEIGH_CACHE_STAT_INC(tbl, lookups);
 563
 564         rcu_read_lock_bh();
 565         n = __neigh_lookup_noref(tbl, pkey, dev);
 566         if (n) {
 567                 if (!refcount_inc_not_zero(&n->refcnt))
 568                         n = NULL;
 569                 NEIGH_CACHE_STAT_INC(tbl, hits);
 570         }
 571
 572         rcu_read_unlock_bh();
 573         return n;
 574 }
 575 EXPORT_SYMBOL(neigh_lookup);
 576
 577 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 578                                      const void *pkey)
 579 {
 580         struct neighbour *n;
 581         unsigned int key_len = tbl->key_len;
 582         u32 hash_val;
 583         struct neigh_hash_table *nht;
 584
 585         NEIGH_CACHE_STAT_INC(tbl, lookups);
 586
 587         rcu_read_lock_bh();
 588         nht = rcu_dereference_bh(tbl->nht);
 589         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 590
 591         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 592              n != NULL;
 593              n = rcu_dereference_bh(n->next)) {
 594                 if (!memcmp(n->primary_key, pkey, key_len) &&
 595                     net_eq(dev_net(n->dev), net)) {
 596                         if (!refcount_inc_not_zero(&n->refcnt))
 597                                 n = NULL;
 598                         NEIGH_CACHE_STAT_INC(tbl, hits);
 599                         break;
 600                 }
 601         }
 602
 603         rcu_read_unlock_bh();
 604         return n;
 605 }
 606 EXPORT_SYMBOL(neigh_lookup_nodev);
 607
 608 static struct neighbour *
 609 ___neigh_create(struct neigh_table *tbl, const void *pkey,
 610                 struct net_device *dev, u32 flags,
 611                 bool exempt_from_gc, bool want_ref)
 612 {
 613         u32 hash_val, key_len = tbl->key_len;
 614         struct neighbour *n1, *rc, *n;
 615         struct neigh_hash_table *nht;
 616         int error;
 617
 618         n = neigh_alloc(tbl, dev, flags, exempt_from_gc);
 619         trace_neigh_create(tbl, dev, pkey, n, exempt_from_gc);
 620         if (!n) {
 621                 rc = ERR_PTR(-ENOBUFS);
 622                 goto out;
 623         }
 624
 625         memcpy(n->primary_key, pkey, key_len);
 626         n->dev = dev;
 627         dev_hold_track(dev, &n->dev_tracker, GFP_ATOMIC);
 628
 629         /* Protocol specific setup. */
 630         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 631                 rc = ERR_PTR(error);
 632                 goto out_neigh_release;
 633         }
 634
 635         if (dev->netdev_ops->ndo_neigh_construct) {
 636                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 637                 if (error < 0) {
 638                         rc = ERR_PTR(error);
 639                         goto out_neigh_release;
 640                 }
 641         }
 642
 643         /* Device specific setup. */
 644         if (n->parms->neigh_setup &&
 645             (error = n->parms->neigh_setup(n)) < 0) {
 646                 rc = ERR_PTR(error);
 647                 goto out_neigh_release;
 648         }
 649
 650         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 651
 652         write_lock_bh(&tbl->lock);
 653         nht = rcu_dereference_protected(tbl->nht,
 654                                         lockdep_is_held(&tbl->lock));
 655
 656         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 657                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 658
 659         hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 660
 661         if (n->parms->dead) {
 662                 rc = ERR_PTR(-EINVAL);
 663                 goto out_tbl_unlock;
 664         }
 665
 666         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 667                                             lockdep_is_held(&tbl->lock));
 668              n1 != NULL;
 669              n1 = rcu_dereference_protected(n1->next,
 670                         lockdep_is_held(&tbl->lock))) {
 671                 if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) {
 672                         if (want_ref)
 673                                 neigh_hold(n1);
 674                         rc = n1;
 675                         goto out_tbl_unlock;
 676                 }
 677         }
 678
 679         n->dead = 0;
 680         if (!exempt_from_gc)
 681                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 682         if (n->flags & NTF_MANAGED)
 683                 list_add_tail(&n->managed_list, &n->tbl->managed_list);
 684         if (want_ref)
 685                 neigh_hold(n);
 686         rcu_assign_pointer(n->next,
 687                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 688                                                      lockdep_is_held(&tbl->lock)));
 689         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 690         write_unlock_bh(&tbl->lock);
 691         neigh_dbg(2, "neigh %p is created\n", n);
 692         rc = n;
 693 out:
 694         return rc;
 695 out_tbl_unlock:
 696         write_unlock_bh(&tbl->lock);
 697 out_neigh_release:
 698         if (!exempt_from_gc)
 699                 atomic_dec(&tbl->gc_entries);
 700         neigh_release(n);
 701         goto out;
 702 }
 703
 704 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 705                                  struct net_device *dev, bool want_ref)
 706 {
 707         return ___neigh_create(tbl, pkey, dev, 0, false, want_ref);
 708 }
 709 EXPORT_SYMBOL(__neigh_create);
 710
 711 static u32 pneigh_hash(const void *pkey, unsigned int key_len)
 712 {
 713         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 714         hash_val ^= (hash_val >> 16);
 715         hash_val ^= hash_val >> 8;
 716         hash_val ^= hash_val >> 4;
 717         hash_val &= PNEIGH_HASHMASK;
 718         return hash_val;
 719 }
 720
 721 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 722                                               struct net *net,
 723                                               const void *pkey,
 724                                               unsigned int key_len,
 725                                               struct net_device *dev)
 726 {
 727         while (n) {
 728                 if (!memcmp(n->key, pkey, key_len) &&
 729                     net_eq(pneigh_net(n), net) &&
 730                     (n->dev == dev || !n->dev))
 731                         return n;
 732                 n = n->next;
 733         }
 734         return NULL;
 735 }
 736
 737 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 738                 struct net *net, const void *pkey, struct net_device *dev)
 739 {
 740         unsigned int key_len = tbl->key_len;
 741         u32 hash_val = pneigh_hash(pkey, key_len);
 742
 743         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 744                                  net, pkey, key_len, dev);
 745 }
 746 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 747
 748 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 749                                     struct net *net, const void *pkey,
 750                                     struct net_device *dev, int creat)
 751 {
 752         struct pneigh_entry *n;
 753         unsigned int key_len = tbl->key_len;
 754         u32 hash_val = pneigh_hash(pkey, key_len);
 755
 756         read_lock_bh(&tbl->lock);
 757         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 758                               net, pkey, key_len, dev);
 759         read_unlock_bh(&tbl->lock);
 760
 761         if (n || !creat)
 762                 goto out;
 763
 764         ASSERT_RTNL();
 765
 766         n = kzalloc(sizeof(*n) + key_len, GFP_KERNEL);
 767         if (!n)
 768                 goto out;
 769
 770         write_pnet(&n->net, net);
 771         memcpy(n->key, pkey, key_len);
 772         n->dev = dev;
 773         dev_hold_track(dev, &n->dev_tracker, GFP_KERNEL);
 774
 775         if (tbl->pconstructor && tbl->pconstructor(n)) {
 776                 dev_put_track(dev, &n->dev_tracker);
 777                 kfree(n);
 778                 n = NULL;
 779                 goto out;
 780         }
 781
 782         write_lock_bh(&tbl->lock);
 783         n->next = tbl->phash_buckets[hash_val];
 784         tbl->phash_buckets[hash_val] = n;
 785         write_unlock_bh(&tbl->lock);
 786 out:
 787         return n;
 788 }
 789 EXPORT_SYMBOL(pneigh_lookup);
 790
 791
 792 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 793                   struct net_device *dev)
 794 {
 795         struct pneigh_entry *n, **np;
 796         unsigned int key_len = tbl->key_len;
 797         u32 hash_val = pneigh_hash(pkey, key_len);
 798
 799         write_lock_bh(&tbl->lock);
 800         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 801              np = &n->next) {
 802                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 803                     net_eq(pneigh_net(n), net)) {
 804                         *np = n->next;
 805                         write_unlock_bh(&tbl->lock);
 806                         if (tbl->pdestructor)
 807                                 tbl->pdestructor(n);
 808                         dev_put_track(n->dev, &n->dev_tracker);
 809                         kfree(n);
 810                         return 0;
 811                 }
 812         }
 813         write_unlock_bh(&tbl->lock);
 814         return -ENOENT;
 815 }
 816
 817 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
 818                                     struct net_device *dev)
 819 {
 820         struct pneigh_entry *n, **np, *freelist = NULL;
 821         u32 h;
 822
 823         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 824                 np = &tbl->phash_buckets[h];
 825                 while ((n = *np) != NULL) {
 826                         if (!dev || n->dev == dev) {
 827                                 *np = n->next;
 828                                 n->next = freelist;
 829                                 freelist = n;
 830                                 continue;
 831                         }
 832                         np = &n->next;
 833                 }
 834         }
 835         write_unlock_bh(&tbl->lock);
 836         while ((n = freelist)) {
 837                 freelist = n->next;
 838                 n->next = NULL;
 839                 if (tbl->pdestructor)
 840                         tbl->pdestructor(n);
 841                 dev_put_track(n->dev, &n->dev_tracker);
 842                 kfree(n);
 843         }
 844         return -ENOENT;
 845 }
 846
 847 static void neigh_parms_destroy(struct neigh_parms *parms);
 848
 849 static inline void neigh_parms_put(struct neigh_parms *parms)
 850 {
 851         if (refcount_dec_and_test(&parms->refcnt))
 852                 neigh_parms_destroy(parms);
 853 }
 854
 855 /*
 856  *      neighbour must already be out of the table;
 857  *
 858  */
 859 void neigh_destroy(struct neighbour *neigh)
 860 {
 861         struct net_device *dev = neigh->dev;
 862
 863         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 864
 865         if (!neigh->dead) {
 866                 pr_warn("Destroying alive neighbour %p\n", neigh);
 867                 dump_stack();
 868                 return;
 869         }
 870
 871         if (neigh_del_timer(neigh))
 872                 pr_warn("Impossible event\n");
 873
 874         write_lock_bh(&neigh->lock);
 875         __skb_queue_purge(&neigh->arp_queue);
 876         write_unlock_bh(&neigh->lock);
 877         neigh->arp_queue_len_bytes = 0;
 878
 879         if (dev->netdev_ops->ndo_neigh_destroy)
 880                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 881
 882         dev_put_track(dev, &neigh->dev_tracker);
 883         neigh_parms_put(neigh->parms);
 884
 885         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 886
 887         atomic_dec(&neigh->tbl->entries);
 888         kfree_rcu(neigh, rcu);
 889 }
 890 EXPORT_SYMBOL(neigh_destroy);
 891
 892 /* Neighbour state is suspicious;
 893    disable fast path.
 894
 895    Called with write_locked neigh.
 896  */
 897 static void neigh_suspect(struct neighbour *neigh)
 898 {
 899         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 900
 901         neigh->output = neigh->ops->output;
 902 }
 903
 904 /* Neighbour state is OK;
 905    enable fast path.
 906
 907    Called with write_locked neigh.
 908  */
 909 static void neigh_connect(struct neighbour *neigh)
 910 {
 911         neigh_dbg(2, "neigh %p is connected\n", neigh);
 912
 913         neigh->output = neigh->ops->connected_output;
 914 }
 915
 916 static void neigh_periodic_work(struct work_struct *work)
 917 {
 918         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 919         struct neighbour *n;
 920         struct neighbour __rcu **np;
 921         unsigned int i;
 922         struct neigh_hash_table *nht;
 923
 924         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 925
 926         write_lock_bh(&tbl->lock);
 927         nht = rcu_dereference_protected(tbl->nht,
 928                                         lockdep_is_held(&tbl->lock));
 929
 930         /*
 931          *      periodically recompute ReachableTime from random function
 932          */
 933
 934         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 935                 struct neigh_parms *p;
 936                 tbl->last_rand = jiffies;
 937                 list_for_each_entry(p, &tbl->parms_list, list)
 938                         p->reachable_time =
 939                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 940         }
 941
 942         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 943                 goto out;
 944
 945         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 946                 np = &nht->hash_buckets[i];
 947
 948                 while ((n = rcu_dereference_protected(*np,
 949                                 lockdep_is_held(&tbl->lock))) != NULL) {
 950                         unsigned int state;
 951
 952                         write_lock(&n->lock);
 953
 954                         state = n->nud_state;
 955                         if ((state & (NUD_PERMANENT | NUD_IN_TIMER)) ||
 956                             (n->flags & NTF_EXT_LEARNED)) {
 957                                 write_unlock(&n->lock);
 958                                 goto next_elt;
 959                         }
 960
 961                         if (time_before(n->used, n->confirmed))
 962                                 n->used = n->confirmed;
 963
 964                         if (refcount_read(&n->refcnt) == 1 &&
 965                             (state == NUD_FAILED ||
 966                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 967                                 *np = n->next;
 968                                 neigh_mark_dead(n);
 969                                 write_unlock(&n->lock);
 970                                 neigh_cleanup_and_release(n);
 971                                 continue;
 972                         }
 973                         write_unlock(&n->lock);
 974
 975 next_elt:
 976                         np = &n->next;
 977                 }
 978                 /*
 979                  * It's fine to release lock here, even if hash table
 980                  * grows while we are preempted.
 981                  */
 982                 write_unlock_bh(&tbl->lock);
 983                 cond_resched();
 984                 write_lock_bh(&tbl->lock);
 985                 nht = rcu_dereference_protected(tbl->nht,
 986                                                 lockdep_is_held(&tbl->lock));
 987         }
 988 out:
 989         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 990          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 991          * BASE_REACHABLE_TIME.
 992          */
 993         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 994                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 995         write_unlock_bh(&tbl->lock);
 996 }
 997
 998 static __inline__ int neigh_max_probes(struct neighbour *n)
 999 {
1000         struct neigh_parms *p = n->parms;
1001         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
1002                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
1003                 NEIGH_VAR(p, MCAST_PROBES));
1004 }
1005
1006 static void neigh_invalidate(struct neighbour *neigh)
1007         __releases(neigh->lock)
1008         __acquires(neigh->lock)
1009 {
1010         struct sk_buff *skb;
1011
1012         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
1013         neigh_dbg(2, "neigh %p is failed\n", neigh);
1014         neigh->updated = jiffies;
1015
1016         /* It is very thin place. report_unreachable is very complicated
1017            routine. Particularly, it can hit the same neighbour entry!
1018
1019            So that, we try to be accurate and avoid dead loop. --ANK
1020          */
1021         while (neigh->nud_state == NUD_FAILED &&
1022                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1023                 write_unlock(&neigh->lock);
1024                 neigh->ops->error_report(neigh, skb);
1025                 write_lock(&neigh->lock);
1026         }
1027         __skb_queue_purge(&neigh->arp_queue);
1028         neigh->arp_queue_len_bytes = 0;
1029 }
1030
1031 static void neigh_probe(struct neighbour *neigh)
1032         __releases(neigh->lock)
1033 {
1034         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
1035         /* keep skb alive even if arp_queue overflows */
1036         if (skb)
1037                 skb = skb_clone(skb, GFP_ATOMIC);
1038         write_unlock(&neigh->lock);
1039         if (neigh->ops->solicit)
1040                 neigh->ops->solicit(neigh, skb);
1041         atomic_inc(&neigh->probes);
1042         consume_skb(skb);
1043 }
1044
1045 /* Called when a timer expires for a neighbour entry. */
1046
1047 static void neigh_timer_handler(struct timer_list *t)
1048 {
1049         unsigned long now, next;
1050         struct neighbour *neigh = from_timer(neigh, t, timer);
1051         unsigned int state;
1052         int notify = 0;
1053
1054         write_lock(&neigh->lock);
1055
1056         state = neigh->nud_state;
1057         now = jiffies;
1058         next = now + HZ;
1059
1060         if (!(state & NUD_IN_TIMER))
1061                 goto out;
1062
1063         if (state & NUD_REACHABLE) {
1064                 if (time_before_eq(now,
1065                                    neigh->confirmed + neigh->parms->reachable_time)) {
1066                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
1067                         next = neigh->confirmed + neigh->parms->reachable_time;
1068                 } else if (time_before_eq(now,
1069                                           neigh->used +
1070                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1071                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
1072                         neigh->nud_state = NUD_DELAY;
1073                         neigh->updated = jiffies;
1074                         neigh_suspect(neigh);
1075                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
1076                 } else {
1077                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
1078                         neigh->nud_state = NUD_STALE;
1079                         neigh->updated = jiffies;
1080                         neigh_suspect(neigh);
1081                         notify = 1;
1082                 }
1083         } else if (state & NUD_DELAY) {
1084                 if (time_before_eq(now,
1085                                    neigh->confirmed +
1086                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1087                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
1088                         neigh->nud_state = NUD_REACHABLE;
1089                         neigh->updated = jiffies;
1090                         neigh_connect(neigh);
1091                         notify = 1;
1092                         next = neigh->confirmed + neigh->parms->reachable_time;
1093                 } else {
1094                         neigh_dbg(2, "neigh %p is probed\n", neigh);
1095                         neigh->nud_state = NUD_PROBE;
1096                         neigh->updated = jiffies;
1097                         atomic_set(&neigh->probes, 0);
1098                         notify = 1;
1099                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1100                                          HZ/100);
1101                 }
1102         } else {
1103                 /* NUD_PROBE|NUD_INCOMPLETE */
1104                 next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME), HZ/100);
1105         }
1106
1107         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
1108             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
1109                 neigh->nud_state = NUD_FAILED;
1110                 notify = 1;
1111                 neigh_invalidate(neigh);
1112                 goto out;
1113         }
1114
1115         if (neigh->nud_state & NUD_IN_TIMER) {
1116                 if (time_before(next, jiffies + HZ/100))
1117                         next = jiffies + HZ/100;
1118                 if (!mod_timer(&neigh->timer, next))
1119                         neigh_hold(neigh);
1120         }
1121         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
1122                 neigh_probe(neigh);
1123         } else {
1124 out:
1125                 write_unlock(&neigh->lock);
1126         }
1127
1128         if (notify)
1129                 neigh_update_notify(neigh, 0);
1130
1131         trace_neigh_timer_handler(neigh, 0);
1132
1133         neigh_release(neigh);
1134 }
1135
1136 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
1137 {
1138         int rc;
1139         bool immediate_probe = false;
1140
1141         write_lock_bh(&neigh->lock);
1142
1143         rc = 0;
1144         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1145                 goto out_unlock_bh;
1146         if (neigh->dead)
1147                 goto out_dead;
1148
1149         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1150                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1151                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
1152                         unsigned long next, now = jiffies;
1153
1154                         atomic_set(&neigh->probes,
1155                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
1156                         neigh_del_timer(neigh);
1157                         neigh->nud_state     = NUD_INCOMPLETE;
1158                         neigh->updated = now;
1159                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1160                                          HZ/100);
1161                         neigh_add_timer(neigh, next);
1162                         immediate_probe = true;
1163                 } else {
1164                         neigh->nud_state = NUD_FAILED;
1165                         neigh->updated = jiffies;
1166                         write_unlock_bh(&neigh->lock);
1167
1168                         kfree_skb(skb);
1169                         return 1;
1170                 }
1171         } else if (neigh->nud_state & NUD_STALE) {
1172                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1173                 neigh_del_timer(neigh);
1174                 neigh->nud_state = NUD_DELAY;
1175                 neigh->updated = jiffies;
1176                 neigh_add_timer(neigh, jiffies +
1177                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1178         }
1179
1180         if (neigh->nud_state == NUD_INCOMPLETE) {
1181                 if (skb) {
1182                         while (neigh->arp_queue_len_bytes + skb->truesize >
1183                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1184                                 struct sk_buff *buff;
1185
1186                                 buff = __skb_dequeue(&neigh->arp_queue);
1187                                 if (!buff)
1188                                         break;
1189                                 neigh->arp_queue_len_bytes -= buff->truesize;
1190                                 kfree_skb(buff);
1191                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1192                         }
1193                         skb_dst_force(skb);
1194                         __skb_queue_tail(&neigh->arp_queue, skb);
1195                         neigh->arp_queue_len_bytes += skb->truesize;
1196                 }
1197                 rc = 1;
1198         }
1199 out_unlock_bh:
1200         if (immediate_probe)
1201                 neigh_probe(neigh);
1202         else
1203                 write_unlock(&neigh->lock);
1204         local_bh_enable();
1205         trace_neigh_event_send_done(neigh, rc);
1206         return rc;
1207
1208 out_dead:
1209         if (neigh->nud_state & NUD_STALE)
1210                 goto out_unlock_bh;
1211         write_unlock_bh(&neigh->lock);
1212         kfree_skb(skb);
1213         trace_neigh_event_send_dead(neigh, 1);
1214         return 1;
1215 }
1216 EXPORT_SYMBOL(__neigh_event_send);
1217
1218 static void neigh_update_hhs(struct neighbour *neigh)
1219 {
1220         struct hh_cache *hh;
1221         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1222                 = NULL;
1223
1224         if (neigh->dev->header_ops)
1225                 update = neigh->dev->header_ops->cache_update;
1226
1227         if (update) {
1228                 hh = &neigh->hh;
1229                 if (READ_ONCE(hh->hh_len)) {
1230                         write_seqlock_bh(&hh->hh_lock);
1231                         update(hh, neigh->dev, neigh->ha);
1232                         write_sequnlock_bh(&hh->hh_lock);
1233                 }
1234         }
1235 }
1236
1237 /* Generic update routine.
1238    -- lladdr is new lladdr or NULL, if it is not supplied.
1239    -- new    is new state.
1240    -- flags
1241         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1242                                 if it is different.
1243         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1244                                 lladdr instead of overriding it
1245                                 if it is different.
1246         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1247         NEIGH_UPDATE_F_USE      means that the entry is user triggered.
1248         NEIGH_UPDATE_F_MANAGED  means that the entry will be auto-refreshed.
1249         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1250                                 NTF_ROUTER flag.
1251         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1252                                 a router.
1253
1254    Caller MUST hold reference count on the entry.
1255  */
1256 static int __neigh_update(struct neighbour *neigh, const u8 *lladdr,
1257                           u8 new, u32 flags, u32 nlmsg_pid,
1258                           struct netlink_ext_ack *extack)
1259 {
1260         bool gc_update = false, managed_update = false;
1261         int update_isrouter = 0;
1262         struct net_device *dev;
1263         int err, notify = 0;
1264         u8 old;
1265
1266         trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid);
1267
1268         write_lock_bh(&neigh->lock);
1269
1270         dev    = neigh->dev;
1271         old    = neigh->nud_state;
1272         err    = -EPERM;
1273
1274         if (neigh->dead) {
1275                 NL_SET_ERR_MSG(extack, "Neighbor entry is now dead");
1276                 new = old;
1277                 goto out;
1278         }
1279         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1280             (old & (NUD_NOARP | NUD_PERMANENT)))
1281                 goto out;
1282
1283         neigh_update_flags(neigh, flags, &notify, &gc_update, &managed_update);
1284         if (flags & (NEIGH_UPDATE_F_USE | NEIGH_UPDATE_F_MANAGED)) {
1285                 new = old & ~NUD_PERMANENT;
1286                 neigh->nud_state = new;
1287                 err = 0;
1288                 goto out;
1289         }
1290
1291         if (!(new & NUD_VALID)) {
1292                 neigh_del_timer(neigh);
1293                 if (old & NUD_CONNECTED)
1294                         neigh_suspect(neigh);
1295                 neigh->nud_state = new;
1296                 err = 0;
1297                 notify = old & NUD_VALID;
1298                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1299                     (new & NUD_FAILED)) {
1300                         neigh_invalidate(neigh);
1301                         notify = 1;
1302                 }
1303                 goto out;
1304         }
1305
1306         /* Compare new lladdr with cached one */
1307         if (!dev->addr_len) {
1308                 /* First case: device needs no address. */
1309                 lladdr = neigh->ha;
1310         } else if (lladdr) {
1311                 /* The second case: if something is already cached
1312                    and a new address is proposed:
1313                    - compare new & old
1314                    - if they are different, check override flag
1315                  */
1316                 if ((old & NUD_VALID) &&
1317                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1318                         lladdr = neigh->ha;
1319         } else {
1320                 /* No address is supplied; if we know something,
1321                    use it, otherwise discard the request.
1322                  */
1323                 err = -EINVAL;
1324                 if (!(old & NUD_VALID)) {
1325                         NL_SET_ERR_MSG(extack, "No link layer address given");
1326                         goto out;
1327                 }
1328                 lladdr = neigh->ha;
1329         }
1330
1331         /* Update confirmed timestamp for neighbour entry after we
1332          * received ARP packet even if it doesn't change IP to MAC binding.
1333          */
1334         if (new & NUD_CONNECTED)
1335                 neigh->confirmed = jiffies;
1336
1337         /* If entry was valid and address is not changed,
1338            do not change entry state, if new one is STALE.
1339          */
1340         err = 0;
1341         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1342         if (old & NUD_VALID) {
1343                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1344                         update_isrouter = 0;
1345                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1346                             (old & NUD_CONNECTED)) {
1347                                 lladdr = neigh->ha;
1348                                 new = NUD_STALE;
1349                         } else
1350                                 goto out;
1351                 } else {
1352                         if (lladdr == neigh->ha && new == NUD_STALE &&
1353                             !(flags & NEIGH_UPDATE_F_ADMIN))
1354                                 new = old;
1355                 }
1356         }
1357
1358         /* Update timestamp only once we know we will make a change to the
1359          * neighbour entry. Otherwise we risk to move the locktime window with
1360          * noop updates and ignore relevant ARP updates.
1361          */
1362         if (new != old || lladdr != neigh->ha)
1363                 neigh->updated = jiffies;
1364
1365         if (new != old) {
1366                 neigh_del_timer(neigh);
1367                 if (new & NUD_PROBE)
1368                         atomic_set(&neigh->probes, 0);
1369                 if (new & NUD_IN_TIMER)
1370                         neigh_add_timer(neigh, (jiffies +
1371                                                 ((new & NUD_REACHABLE) ?
1372                                                  neigh->parms->reachable_time :
1373                                                  0)));
1374                 neigh->nud_state = new;
1375                 notify = 1;
1376         }
1377
1378         if (lladdr != neigh->ha) {
1379                 write_seqlock(&neigh->ha_lock);
1380                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1381                 write_sequnlock(&neigh->ha_lock);
1382                 neigh_update_hhs(neigh);
1383                 if (!(new & NUD_CONNECTED))
1384                         neigh->confirmed = jiffies -
1385                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1386                 notify = 1;
1387         }
1388         if (new == old)
1389                 goto out;
1390         if (new & NUD_CONNECTED)
1391                 neigh_connect(neigh);
1392         else
1393                 neigh_suspect(neigh);
1394         if (!(old & NUD_VALID)) {
1395                 struct sk_buff *skb;
1396
1397                 /* Again: avoid dead loop if something went wrong */
1398
1399                 while (neigh->nud_state & NUD_VALID &&
1400                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1401                         struct dst_entry *dst = skb_dst(skb);
1402                         struct neighbour *n2, *n1 = neigh;
1403                         write_unlock_bh(&neigh->lock);
1404
1405                         rcu_read_lock();
1406
1407                         /* Why not just use 'neigh' as-is?  The problem is that
1408                          * things such as shaper, eql, and sch_teql can end up
1409                          * using alternative, different, neigh objects to output
1410                          * the packet in the output path.  So what we need to do
1411                          * here is re-lookup the top-level neigh in the path so
1412                          * we can reinject the packet there.
1413                          */
1414                         n2 = NULL;
1415                         if (dst && dst->obsolete != DST_OBSOLETE_DEAD) {
1416                                 n2 = dst_neigh_lookup_skb(dst, skb);
1417                                 if (n2)
1418                                         n1 = n2;
1419                         }
1420                         n1->output(n1, skb);
1421                         if (n2)
1422                                 neigh_release(n2);
1423                         rcu_read_unlock();
1424
1425                         write_lock_bh(&neigh->lock);
1426                 }
1427                 __skb_queue_purge(&neigh->arp_queue);
1428                 neigh->arp_queue_len_bytes = 0;
1429         }
1430 out:
1431         if (update_isrouter)
1432                 neigh_update_is_router(neigh, flags, &notify);
1433         write_unlock_bh(&neigh->lock);
1434         if (((new ^ old) & NUD_PERMANENT) || gc_update)
1435                 neigh_update_gc_list(neigh);
1436         if (managed_update)
1437                 neigh_update_managed_list(neigh);
1438         if (notify)
1439                 neigh_update_notify(neigh, nlmsg_pid);
1440         trace_neigh_update_done(neigh, err);
1441         return err;
1442 }
1443
1444 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1445                  u32 flags, u32 nlmsg_pid)
1446 {
1447         return __neigh_update(neigh, lladdr, new, flags, nlmsg_pid, NULL);
1448 }
1449 EXPORT_SYMBOL(neigh_update);
1450
1451 /* Update the neigh to listen temporarily for probe responses, even if it is
1452  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1453  */
1454 void __neigh_set_probe_once(struct neighbour *neigh)
1455 {
1456         if (neigh->dead)
1457                 return;
1458         neigh->updated = jiffies;
1459         if (!(neigh->nud_state & NUD_FAILED))
1460                 return;
1461         neigh->nud_state = NUD_INCOMPLETE;
1462         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1463         neigh_add_timer(neigh,
1464                         jiffies + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1465                                       HZ/100));
1466 }
1467 EXPORT_SYMBOL(__neigh_set_probe_once);
1468
1469 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1470                                  u8 *lladdr, void *saddr,
1471                                  struct net_device *dev)
1472 {
1473         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1474                                                  lladdr || !dev->addr_len);
1475         if (neigh)
1476                 neigh_update(neigh, lladdr, NUD_STALE,
1477                              NEIGH_UPDATE_F_OVERRIDE, 0);
1478         return neigh;
1479 }
1480 EXPORT_SYMBOL(neigh_event_ns);
1481
1482 /* called with read_lock_bh(&n->lock); */
1483 static void neigh_hh_init(struct neighbour *n)
1484 {
1485         struct net_device *dev = n->dev;
1486         __be16 prot = n->tbl->protocol;
1487         struct hh_cache *hh = &n->hh;
1488
1489         write_lock_bh(&n->lock);
1490
1491         /* Only one thread can come in here and initialize the
1492          * hh_cache entry.
1493          */
1494         if (!hh->hh_len)
1495                 dev->header_ops->cache(n, hh, prot);
1496
1497         write_unlock_bh(&n->lock);
1498 }
1499
1500 /* Slow and careful. */
1501
1502 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1503 {
1504         int rc = 0;
1505
1506         if (!neigh_event_send(neigh, skb)) {
1507                 int err;
1508                 struct net_device *dev = neigh->dev;
1509                 unsigned int seq;
1510
1511                 if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
1512                         neigh_hh_init(neigh);
1513
1514                 do {
1515                         __skb_pull(skb, skb_network_offset(skb));
1516                         seq = read_seqbegin(&neigh->ha_lock);
1517                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1518                                               neigh->ha, NULL, skb->len);
1519                 } while (read_seqretry(&neigh->ha_lock, seq));
1520
1521                 if (err >= 0)
1522                         rc = dev_queue_xmit(skb);
1523                 else
1524                         goto out_kfree_skb;
1525         }
1526 out:
1527         return rc;
1528 out_kfree_skb:
1529         rc = -EINVAL;
1530         kfree_skb(skb);
1531         goto out;
1532 }
1533 EXPORT_SYMBOL(neigh_resolve_output);
1534
1535 /* As fast as possible without hh cache */
1536
1537 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1538 {
1539         struct net_device *dev = neigh->dev;
1540         unsigned int seq;
1541         int err;
1542
1543         do {
1544                 __skb_pull(skb, skb_network_offset(skb));
1545                 seq = read_seqbegin(&neigh->ha_lock);
1546                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1547                                       neigh->ha, NULL, skb->len);
1548         } while (read_seqretry(&neigh->ha_lock, seq));
1549
1550         if (err >= 0)
1551                 err = dev_queue_xmit(skb);
1552         else {
1553                 err = -EINVAL;
1554                 kfree_skb(skb);
1555         }
1556         return err;
1557 }
1558 EXPORT_SYMBOL(neigh_connected_output);
1559
1560 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1561 {
1562         return dev_queue_xmit(skb);
1563 }
1564 EXPORT_SYMBOL(neigh_direct_output);
1565
1566 static void neigh_managed_work(struct work_struct *work)
1567 {
1568         struct neigh_table *tbl = container_of(work, struct neigh_table,
1569                                                managed_work.work);
1570         struct neighbour *neigh;
1571
1572         write_lock_bh(&tbl->lock);
1573         list_for_each_entry(neigh, &tbl->managed_list, managed_list)
1574                 neigh_event_send(neigh, NULL);
1575         queue_delayed_work(system_power_efficient_wq, &tbl->managed_work,
1576                            NEIGH_VAR(&tbl->parms, DELAY_PROBE_TIME));
1577         write_unlock_bh(&tbl->lock);
1578 }
1579
1580 static void neigh_proxy_process(struct timer_list *t)
1581 {
1582         struct neigh_table *tbl = from_timer(tbl, t, proxy_timer);
1583         long sched_next = 0;
1584         unsigned long now = jiffies;
1585         struct sk_buff *skb, *n;
1586
1587         spin_lock(&tbl->proxy_queue.lock);
1588
1589         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1590                 long tdif = NEIGH_CB(skb)->sched_next - now;
1591
1592                 if (tdif <= 0) {
1593                         struct net_device *dev = skb->dev;
1594
1595                         __skb_unlink(skb, &tbl->proxy_queue);
1596                         if (tbl->proxy_redo && netif_running(dev)) {
1597                                 rcu_read_lock();
1598                                 tbl->proxy_redo(skb);
1599                                 rcu_read_unlock();
1600                         } else {
1601                                 kfree_skb(skb);
1602                         }
1603
1604                         dev_put(dev);
1605                 } else if (!sched_next || tdif < sched_next)
1606                         sched_next = tdif;
1607         }
1608         del_timer(&tbl->proxy_timer);
1609         if (sched_next)
1610                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1611         spin_unlock(&tbl->proxy_queue.lock);
1612 }
1613
1614 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1615                     struct sk_buff *skb)
1616 {
1617         unsigned long sched_next = jiffies +
1618                         prandom_u32_max(NEIGH_VAR(p, PROXY_DELAY));
1619
1620         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1621                 kfree_skb(skb);
1622                 return;
1623         }
1624
1625         NEIGH_CB(skb)->sched_next = sched_next;
1626         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1627
1628         spin_lock(&tbl->proxy_queue.lock);
1629         if (del_timer(&tbl->proxy_timer)) {
1630                 if (time_before(tbl->proxy_timer.expires, sched_next))
1631                         sched_next = tbl->proxy_timer.expires;
1632         }
1633         skb_dst_drop(skb);
1634         dev_hold(skb->dev);
1635         __skb_queue_tail(&tbl->proxy_queue, skb);
1636         mod_timer(&tbl->proxy_timer, sched_next);
1637         spin_unlock(&tbl->proxy_queue.lock);
1638 }
1639 EXPORT_SYMBOL(pneigh_enqueue);
1640
1641 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1642                                                       struct net *net, int ifindex)
1643 {
1644         struct neigh_parms *p;
1645
1646         list_for_each_entry(p, &tbl->parms_list, list) {
1647                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1648                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1649                         return p;
1650         }
1651
1652         return NULL;
1653 }
1654
1655 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1656                                       struct neigh_table *tbl)
1657 {
1658         struct neigh_parms *p;
1659         struct net *net = dev_net(dev);
1660         const struct net_device_ops *ops = dev->netdev_ops;
1661
1662         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1663         if (p) {
1664                 p->tbl            = tbl;
1665                 refcount_set(&p->refcnt, 1);
1666                 p->reachable_time =
1667                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1668                 dev_hold_track(dev, &p->dev_tracker, GFP_KERNEL);
1669                 p->dev = dev;
1670                 write_pnet(&p->net, net);
1671                 p->sysctl_table = NULL;
1672
1673                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1674                         dev_put_track(dev, &p->dev_tracker);
1675                         kfree(p);
1676                         return NULL;
1677                 }
1678
1679                 write_lock_bh(&tbl->lock);
1680                 list_add(&p->list, &tbl->parms.list);
1681                 write_unlock_bh(&tbl->lock);
1682
1683                 neigh_parms_data_state_cleanall(p);
1684         }
1685         return p;
1686 }
1687 EXPORT_SYMBOL(neigh_parms_alloc);
1688
1689 static void neigh_rcu_free_parms(struct rcu_head *head)
1690 {
1691         struct neigh_parms *parms =
1692                 container_of(head, struct neigh_parms, rcu_head);
1693
1694         neigh_parms_put(parms);
1695 }
1696
1697 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1698 {
1699         if (!parms || parms == &tbl->parms)
1700                 return;
1701         write_lock_bh(&tbl->lock);
1702         list_del(&parms->list);
1703         parms->dead = 1;
1704         write_unlock_bh(&tbl->lock);
1705         dev_put_track(parms->dev, &parms->dev_tracker);
1706         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1707 }
1708 EXPORT_SYMBOL(neigh_parms_release);
1709
1710 static void neigh_parms_destroy(struct neigh_parms *parms)
1711 {
1712         kfree(parms);
1713 }
1714
1715 static struct lock_class_key neigh_table_proxy_queue_class;
1716
1717 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1718
1719 void neigh_table_init(int index, struct neigh_table *tbl)
1720 {
1721         unsigned long now = jiffies;
1722         unsigned long phsize;
1723
1724         INIT_LIST_HEAD(&tbl->parms_list);
1725         INIT_LIST_HEAD(&tbl->gc_list);
1726         INIT_LIST_HEAD(&tbl->managed_list);
1727
1728         list_add(&tbl->parms.list, &tbl->parms_list);
1729         write_pnet(&tbl->parms.net, &init_net);
1730         refcount_set(&tbl->parms.refcnt, 1);
1731         tbl->parms.reachable_time =
1732                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1733
1734         tbl->stats = alloc_percpu(struct neigh_statistics);
1735         if (!tbl->stats)
1736                 panic("cannot create neighbour cache statistics");
1737
1738 #ifdef CONFIG_PROC_FS
1739         if (!proc_create_seq_data(tbl->id, 0, init_net.proc_net_stat,
1740                               &neigh_stat_seq_ops, tbl))
1741                 panic("cannot create neighbour proc dir entry");
1742 #endif
1743
1744         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1745
1746         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1747         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1748
1749         if (!tbl->nht || !tbl->phash_buckets)
1750                 panic("cannot allocate neighbour cache hashes");
1751
1752         if (!tbl->entry_size)
1753                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1754                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1755         else
1756                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1757
1758         rwlock_init(&tbl->lock);
1759
1760         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1761         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1762                         tbl->parms.reachable_time);
1763         INIT_DEFERRABLE_WORK(&tbl->managed_work, neigh_managed_work);
1764         queue_delayed_work(system_power_efficient_wq, &tbl->managed_work, 0);
1765
1766         timer_setup(&tbl->proxy_timer, neigh_proxy_process, 0);
1767         skb_queue_head_init_class(&tbl->proxy_queue,
1768                         &neigh_table_proxy_queue_class);
1769
1770         tbl->last_flush = now;
1771         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1772
1773         neigh_tables[index] = tbl;
1774 }
1775 EXPORT_SYMBOL(neigh_table_init);
1776
1777 int neigh_table_clear(int index, struct neigh_table *tbl)
1778 {
1779         neigh_tables[index] = NULL;
1780         /* It is not clean... Fix it to unload IPv6 module safely */
1781         cancel_delayed_work_sync(&tbl->managed_work);
1782         cancel_delayed_work_sync(&tbl->gc_work);
1783         del_timer_sync(&tbl->proxy_timer);
1784         pneigh_queue_purge(&tbl->proxy_queue);
1785         neigh_ifdown(tbl, NULL);
1786         if (atomic_read(&tbl->entries))
1787                 pr_crit("neighbour leakage\n");
1788
1789         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1790                  neigh_hash_free_rcu);
1791         tbl->nht = NULL;
1792
1793         kfree(tbl->phash_buckets);
1794         tbl->phash_buckets = NULL;
1795
1796         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1797
1798         free_percpu(tbl->stats);
1799         tbl->stats = NULL;
1800
1801         return 0;
1802 }
1803 EXPORT_SYMBOL(neigh_table_clear);
1804
1805 static struct neigh_table *neigh_find_table(int family)
1806 {
1807         struct neigh_table *tbl = NULL;
1808
1809         switch (family) {
1810         case AF_INET:
1811                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1812                 break;
1813         case AF_INET6:
1814                 tbl = neigh_tables[NEIGH_ND_TABLE];
1815                 break;
1816         case AF_DECnet:
1817                 tbl = neigh_tables[NEIGH_DN_TABLE];
1818                 break;
1819         }
1820
1821         return tbl;
1822 }
1823
1824 const struct nla_policy nda_policy[NDA_MAX+1] = {
1825         [NDA_UNSPEC]            = { .strict_start_type = NDA_NH_ID },
1826         [NDA_DST]               = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1827         [NDA_LLADDR]            = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1828         [NDA_CACHEINFO]         = { .len = sizeof(struct nda_cacheinfo) },
1829         [NDA_PROBES]            = { .type = NLA_U32 },
1830         [NDA_VLAN]              = { .type = NLA_U16 },
1831         [NDA_PORT]              = { .type = NLA_U16 },
1832         [NDA_VNI]               = { .type = NLA_U32 },
1833         [NDA_IFINDEX]           = { .type = NLA_U32 },
1834         [NDA_MASTER]            = { .type = NLA_U32 },
1835         [NDA_PROTOCOL]          = { .type = NLA_U8 },
1836         [NDA_NH_ID]             = { .type = NLA_U32 },
1837         [NDA_FLAGS_EXT]         = NLA_POLICY_MASK(NLA_U32, NTF_EXT_MASK),
1838         [NDA_FDB_EXT_ATTRS]     = { .type = NLA_NESTED },
1839 };
1840
1841 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1842                         struct netlink_ext_ack *extack)
1843 {
1844         struct net *net = sock_net(skb->sk);
1845         struct ndmsg *ndm;
1846         struct nlattr *dst_attr;
1847         struct neigh_table *tbl;
1848         struct neighbour *neigh;
1849         struct net_device *dev = NULL;
1850         int err = -EINVAL;
1851
1852         ASSERT_RTNL();
1853         if (nlmsg_len(nlh) < sizeof(*ndm))
1854                 goto out;
1855
1856         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1857         if (!dst_attr) {
1858                 NL_SET_ERR_MSG(extack, "Network address not specified");
1859                 goto out;
1860         }
1861
1862         ndm = nlmsg_data(nlh);
1863         if (ndm->ndm_ifindex) {
1864                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1865                 if (dev == NULL) {
1866                         err = -ENODEV;
1867                         goto out;
1868                 }
1869         }
1870
1871         tbl = neigh_find_table(ndm->ndm_family);
1872         if (tbl == NULL)
1873                 return -EAFNOSUPPORT;
1874
1875         if (nla_len(dst_attr) < (int)tbl->key_len) {
1876                 NL_SET_ERR_MSG(extack, "Invalid network address");
1877                 goto out;
1878         }
1879
1880         if (ndm->ndm_flags & NTF_PROXY) {
1881                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1882                 goto out;
1883         }
1884
1885         if (dev == NULL)
1886                 goto out;
1887
1888         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1889         if (neigh == NULL) {
1890                 err = -ENOENT;
1891                 goto out;
1892         }
1893
1894         err = __neigh_update(neigh, NULL, NUD_FAILED,
1895                              NEIGH_UPDATE_F_OVERRIDE | NEIGH_UPDATE_F_ADMIN,
1896                              NETLINK_CB(skb).portid, extack);
1897         write_lock_bh(&tbl->lock);
1898         neigh_release(neigh);
1899         neigh_remove_one(neigh, tbl);
1900         write_unlock_bh(&tbl->lock);
1901
1902 out:
1903         return err;
1904 }
1905
1906 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1907                      struct netlink_ext_ack *extack)
1908 {
1909         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE |
1910                     NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1911         struct net *net = sock_net(skb->sk);
1912         struct ndmsg *ndm;
1913         struct nlattr *tb[NDA_MAX+1];
1914         struct neigh_table *tbl;
1915         struct net_device *dev = NULL;
1916         struct neighbour *neigh;
1917         void *dst, *lladdr;
1918         u8 protocol = 0;
1919         u32 ndm_flags;
1920         int err;
1921
1922         ASSERT_RTNL();
1923         err = nlmsg_parse_deprecated(nlh, sizeof(*ndm), tb, NDA_MAX,
1924                                      nda_policy, extack);
1925         if (err < 0)
1926                 goto out;
1927
1928         err = -EINVAL;
1929         if (!tb[NDA_DST]) {
1930                 NL_SET_ERR_MSG(extack, "Network address not specified");
1931                 goto out;
1932         }
1933
1934         ndm = nlmsg_data(nlh);
1935         ndm_flags = ndm->ndm_flags;
1936         if (tb[NDA_FLAGS_EXT]) {
1937                 u32 ext = nla_get_u32(tb[NDA_FLAGS_EXT]);
1938
1939                 BUILD_BUG_ON(sizeof(neigh->flags) * BITS_PER_BYTE <
1940                              (sizeof(ndm->ndm_flags) * BITS_PER_BYTE +
1941                               hweight32(NTF_EXT_MASK)));
1942                 ndm_flags |= (ext << NTF_EXT_SHIFT);
1943         }
1944         if (ndm->ndm_ifindex) {
1945                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1946                 if (dev == NULL) {
1947                         err = -ENODEV;
1948                         goto out;
1949                 }
1950
1951                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len) {
1952                         NL_SET_ERR_MSG(extack, "Invalid link address");
1953                         goto out;
1954                 }
1955         }
1956
1957         tbl = neigh_find_table(ndm->ndm_family);
1958         if (tbl == NULL)
1959                 return -EAFNOSUPPORT;
1960
1961         if (nla_len(tb[NDA_DST]) < (int)tbl->key_len) {
1962                 NL_SET_ERR_MSG(extack, "Invalid network address");
1963                 goto out;
1964         }
1965
1966         dst = nla_data(tb[NDA_DST]);
1967         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1968
1969         if (tb[NDA_PROTOCOL])
1970                 protocol = nla_get_u8(tb[NDA_PROTOCOL]);
1971         if (ndm_flags & NTF_PROXY) {
1972                 struct pneigh_entry *pn;
1973
1974                 if (ndm_flags & NTF_MANAGED) {
1975                         NL_SET_ERR_MSG(extack, "Invalid NTF_* flag combination");
1976                         goto out;
1977                 }
1978
1979                 err = -ENOBUFS;
1980                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1981                 if (pn) {
1982                         pn->flags = ndm_flags;
1983                         if (protocol)
1984                                 pn->protocol = protocol;
1985                         err = 0;
1986                 }
1987                 goto out;
1988         }
1989
1990         if (!dev) {
1991                 NL_SET_ERR_MSG(extack, "Device not specified");
1992                 goto out;
1993         }
1994
1995         if (tbl->allow_add && !tbl->allow_add(dev, extack)) {
1996                 err = -EINVAL;
1997                 goto out;
1998         }
1999
2000         neigh = neigh_lookup(tbl, dst, dev);
2001         if (neigh == NULL) {
2002                 bool ndm_permanent  = ndm->ndm_state & NUD_PERMANENT;
2003                 bool exempt_from_gc = ndm_permanent ||
2004                                       ndm_flags & NTF_EXT_LEARNED;
2005
2006                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
2007                         err = -ENOENT;
2008                         goto out;
2009                 }
2010                 if (ndm_permanent && (ndm_flags & NTF_MANAGED)) {
2011                         NL_SET_ERR_MSG(extack, "Invalid NTF_* flag for permanent entry");
2012                         err = -EINVAL;
2013                         goto out;
2014                 }
2015
2016                 neigh = ___neigh_create(tbl, dst, dev,
2017                                         ndm_flags &
2018                                         (NTF_EXT_LEARNED | NTF_MANAGED),
2019                                         exempt_from_gc, true);
2020                 if (IS_ERR(neigh)) {
2021                         err = PTR_ERR(neigh);
2022                         goto out;
2023                 }
2024         } else {
2025                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2026                         err = -EEXIST;
2027                         neigh_release(neigh);
2028                         goto out;
2029                 }
2030
2031                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
2032                         flags &= ~(NEIGH_UPDATE_F_OVERRIDE |
2033                                    NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
2034         }
2035
2036         if (protocol)
2037                 neigh->protocol = protocol;
2038         if (ndm_flags & NTF_EXT_LEARNED)
2039                 flags |= NEIGH_UPDATE_F_EXT_LEARNED;
2040         if (ndm_flags & NTF_ROUTER)
2041                 flags |= NEIGH_UPDATE_F_ISROUTER;
2042         if (ndm_flags & NTF_MANAGED)
2043                 flags |= NEIGH_UPDATE_F_MANAGED;
2044         if (ndm_flags & NTF_USE)
2045                 flags |= NEIGH_UPDATE_F_USE;
2046
2047         err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags,
2048                              NETLINK_CB(skb).portid, extack);
2049         if (!err && ndm_flags & (NTF_USE | NTF_MANAGED)) {
2050                 neigh_event_send(neigh, NULL);
2051                 err = 0;
2052         }
2053         neigh_release(neigh);
2054 out:
2055         return err;
2056 }
2057
2058 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
2059 {
2060         struct nlattr *nest;
2061
2062         nest = nla_nest_start_noflag(skb, NDTA_PARMS);
2063         if (nest == NULL)
2064                 return -ENOBUFS;
2065
2066         if ((parms->dev &&
2067              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
2068             nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
2069             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
2070                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
2071             /* approximative value for deprecated QUEUE_LEN (in packets) */
2072             nla_put_u32(skb, NDTPA_QUEUE_LEN,
2073                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
2074             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
2075             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
2076             nla_put_u32(skb, NDTPA_UCAST_PROBES,
2077                         NEIGH_VAR(parms, UCAST_PROBES)) ||
2078             nla_put_u32(skb, NDTPA_MCAST_PROBES,
2079                         NEIGH_VAR(parms, MCAST_PROBES)) ||
2080             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
2081                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
2082             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
2083                           NDTPA_PAD) ||
2084             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
2085                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
2086             nla_put_msecs(skb, NDTPA_GC_STALETIME,
2087                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
2088             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
2089                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
2090             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
2091                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
2092             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
2093                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
2094             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
2095                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
2096             nla_put_msecs(skb, NDTPA_LOCKTIME,
2097                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
2098                 goto nla_put_failure;
2099         return nla_nest_end(skb, nest);
2100
2101 nla_put_failure:
2102         nla_nest_cancel(skb, nest);
2103         return -EMSGSIZE;
2104 }
2105
2106 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
2107                               u32 pid, u32 seq, int type, int flags)
2108 {
2109         struct nlmsghdr *nlh;
2110         struct ndtmsg *ndtmsg;
2111
2112         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2113         if (nlh == NULL)
2114                 return -EMSGSIZE;
2115
2116         ndtmsg = nlmsg_data(nlh);
2117
2118         read_lock_bh(&tbl->lock);
2119         ndtmsg->ndtm_family = tbl->family;
2120         ndtmsg->ndtm_pad1   = 0;
2121         ndtmsg->ndtm_pad2   = 0;
2122
2123         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
2124             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
2125             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
2126             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
2127             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
2128                 goto nla_put_failure;
2129         {
2130                 unsigned long now = jiffies;
2131                 long flush_delta = now - tbl->last_flush;
2132                 long rand_delta = now - tbl->last_rand;
2133                 struct neigh_hash_table *nht;
2134                 struct ndt_config ndc = {
2135                         .ndtc_key_len           = tbl->key_len,
2136                         .ndtc_entry_size        = tbl->entry_size,
2137                         .ndtc_entries           = atomic_read(&tbl->entries),
2138                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
2139                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
2140                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
2141                 };
2142
2143                 rcu_read_lock_bh();
2144                 nht = rcu_dereference_bh(tbl->nht);
2145                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
2146                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
2147                 rcu_read_unlock_bh();
2148
2149                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
2150                         goto nla_put_failure;
2151         }
2152
2153         {
2154                 int cpu;
2155                 struct ndt_stats ndst;
2156
2157                 memset(&ndst, 0, sizeof(ndst));
2158
2159                 for_each_possible_cpu(cpu) {
2160                         struct neigh_statistics *st;
2161
2162                         st = per_cpu_ptr(tbl->stats, cpu);
2163                         ndst.ndts_allocs                += st->allocs;
2164                         ndst.ndts_destroys              += st->destroys;
2165                         ndst.ndts_hash_grows            += st->hash_grows;
2166                         ndst.ndts_res_failed            += st->res_failed;
2167                         ndst.ndts_lookups               += st->lookups;
2168                         ndst.ndts_hits                  += st->hits;
2169                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
2170                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
2171                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
2172                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
2173                         ndst.ndts_table_fulls           += st->table_fulls;
2174                 }
2175
2176                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
2177                                   NDTA_PAD))
2178                         goto nla_put_failure;
2179         }
2180
2181         BUG_ON(tbl->parms.dev);
2182         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
2183                 goto nla_put_failure;
2184
2185         read_unlock_bh(&tbl->lock);
2186         nlmsg_end(skb, nlh);
2187         return 0;
2188
2189 nla_put_failure:
2190         read_unlock_bh(&tbl->lock);
2191         nlmsg_cancel(skb, nlh);
2192         return -EMSGSIZE;
2193 }
2194
2195 static int neightbl_fill_param_info(struct sk_buff *skb,
2196                                     struct neigh_table *tbl,
2197                                     struct neigh_parms *parms,
2198                                     u32 pid, u32 seq, int type,
2199                                     unsigned int flags)
2200 {
2201         struct ndtmsg *ndtmsg;
2202         struct nlmsghdr *nlh;
2203
2204         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2205         if (nlh == NULL)
2206                 return -EMSGSIZE;
2207
2208         ndtmsg = nlmsg_data(nlh);
2209
2210         read_lock_bh(&tbl->lock);
2211         ndtmsg->ndtm_family = tbl->family;
2212         ndtmsg->ndtm_pad1   = 0;
2213         ndtmsg->ndtm_pad2   = 0;
2214
2215         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
2216             neightbl_fill_parms(skb, parms) < 0)
2217                 goto errout;
2218
2219         read_unlock_bh(&tbl->lock);
2220         nlmsg_end(skb, nlh);
2221         return 0;
2222 errout:
2223         read_unlock_bh(&tbl->lock);
2224         nlmsg_cancel(skb, nlh);
2225         return -EMSGSIZE;
2226 }
2227
2228 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
2229         [NDTA_NAME]             = { .type = NLA_STRING },
2230         [NDTA_THRESH1]          = { .type = NLA_U32 },
2231         [NDTA_THRESH2]          = { .type = NLA_U32 },
2232         [NDTA_THRESH3]          = { .type = NLA_U32 },
2233         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
2234         [NDTA_PARMS]            = { .type = NLA_NESTED },
2235 };
2236
2237 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
2238         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
2239         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
2240         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
2241         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
2242         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
2243         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
2244         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
2245         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
2246         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
2247         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
2248         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
2249         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
2250         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
2251         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
2252 };
2253
2254 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
2255                         struct netlink_ext_ack *extack)
2256 {
2257         struct net *net = sock_net(skb->sk);
2258         struct neigh_table *tbl;
2259         struct ndtmsg *ndtmsg;
2260         struct nlattr *tb[NDTA_MAX+1];
2261         bool found = false;
2262         int err, tidx;
2263
2264         err = nlmsg_parse_deprecated(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
2265                                      nl_neightbl_policy, extack);
2266         if (err < 0)
2267                 goto errout;
2268
2269         if (tb[NDTA_NAME] == NULL) {
2270                 err = -EINVAL;
2271                 goto errout;
2272         }
2273
2274         ndtmsg = nlmsg_data(nlh);
2275
2276         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2277                 tbl = neigh_tables[tidx];
2278                 if (!tbl)
2279                         continue;
2280                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2281                         continue;
2282                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2283                         found = true;
2284                         break;
2285                 }
2286         }
2287
2288         if (!found)
2289                 return -ENOENT;
2290
2291         /*
2292          * We acquire tbl->lock to be nice to the periodic timers and
2293          * make sure they always see a consistent set of values.
2294          */
2295         write_lock_bh(&tbl->lock);
2296
2297         if (tb[NDTA_PARMS]) {
2298                 struct nlattr *tbp[NDTPA_MAX+1];
2299                 struct neigh_parms *p;
2300                 int i, ifindex = 0;
2301
2302                 err = nla_parse_nested_deprecated(tbp, NDTPA_MAX,
2303                                                   tb[NDTA_PARMS],
2304                                                   nl_ntbl_parm_policy, extack);
2305                 if (err < 0)
2306                         goto errout_tbl_lock;
2307
2308                 if (tbp[NDTPA_IFINDEX])
2309                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2310
2311                 p = lookup_neigh_parms(tbl, net, ifindex);
2312                 if (p == NULL) {
2313                         err = -ENOENT;
2314                         goto errout_tbl_lock;
2315                 }
2316
2317                 for (i = 1; i <= NDTPA_MAX; i++) {
2318                         if (tbp[i] == NULL)
2319                                 continue;
2320
2321                         switch (i) {
2322                         case NDTPA_QUEUE_LEN:
2323                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2324                                               nla_get_u32(tbp[i]) *
2325                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2326                                 break;
2327                         case NDTPA_QUEUE_LENBYTES:
2328                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2329                                               nla_get_u32(tbp[i]));
2330                                 break;
2331                         case NDTPA_PROXY_QLEN:
2332                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2333                                               nla_get_u32(tbp[i]));
2334                                 break;
2335                         case NDTPA_APP_PROBES:
2336                                 NEIGH_VAR_SET(p, APP_PROBES,
2337                                               nla_get_u32(tbp[i]));
2338                                 break;
2339                         case NDTPA_UCAST_PROBES:
2340                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2341                                               nla_get_u32(tbp[i]));
2342                                 break;
2343                         case NDTPA_MCAST_PROBES:
2344                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2345                                               nla_get_u32(tbp[i]));
2346                                 break;
2347                         case NDTPA_MCAST_REPROBES:
2348                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2349                                               nla_get_u32(tbp[i]));
2350                                 break;
2351                         case NDTPA_BASE_REACHABLE_TIME:
2352                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2353                                               nla_get_msecs(tbp[i]));
2354                                 /* update reachable_time as well, otherwise, the change will
2355                                  * only be effective after the next time neigh_periodic_work
2356                                  * decides to recompute it (can be multiple minutes)
2357                                  */
2358                                 p->reachable_time =
2359                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2360                                 break;
2361                         case NDTPA_GC_STALETIME:
2362                                 NEIGH_VAR_SET(p, GC_STALETIME,
2363                                               nla_get_msecs(tbp[i]));
2364                                 break;
2365                         case NDTPA_DELAY_PROBE_TIME:
2366                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2367                                               nla_get_msecs(tbp[i]));
2368                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2369                                 break;
2370                         case NDTPA_RETRANS_TIME:
2371                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2372                                               nla_get_msecs(tbp[i]));
2373                                 break;
2374                         case NDTPA_ANYCAST_DELAY:
2375                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2376                                               nla_get_msecs(tbp[i]));
2377                                 break;
2378                         case NDTPA_PROXY_DELAY:
2379                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2380                                               nla_get_msecs(tbp[i]));
2381                                 break;
2382                         case NDTPA_LOCKTIME:
2383                                 NEIGH_VAR_SET(p, LOCKTIME,
2384                                               nla_get_msecs(tbp[i]));
2385                                 break;
2386                         }
2387                 }
2388         }
2389
2390         err = -ENOENT;
2391         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2392              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2393             !net_eq(net, &init_net))
2394                 goto errout_tbl_lock;
2395
2396         if (tb[NDTA_THRESH1])
2397                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2398
2399         if (tb[NDTA_THRESH2])
2400                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2401
2402         if (tb[NDTA_THRESH3])
2403                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2404
2405         if (tb[NDTA_GC_INTERVAL])
2406                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2407
2408         err = 0;
2409
2410 errout_tbl_lock:
2411         write_unlock_bh(&tbl->lock);
2412 errout:
2413         return err;
2414 }
2415
2416 static int neightbl_valid_dump_info(const struct nlmsghdr *nlh,
2417                                     struct netlink_ext_ack *extack)
2418 {
2419         struct ndtmsg *ndtm;
2420
2421         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndtm))) {
2422                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor table dump request");
2423                 return -EINVAL;
2424         }
2425
2426         ndtm = nlmsg_data(nlh);
2427         if (ndtm->ndtm_pad1  || ndtm->ndtm_pad2) {
2428                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor table dump request");
2429                 return -EINVAL;
2430         }
2431
2432         if (nlmsg_attrlen(nlh, sizeof(*ndtm))) {
2433                 NL_SET_ERR_MSG(extack, "Invalid data after header in neighbor table dump request");
2434                 return -EINVAL;
2435         }
2436
2437         return 0;
2438 }
2439
2440 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2441 {
2442         const struct nlmsghdr *nlh = cb->nlh;
2443         struct net *net = sock_net(skb->sk);
2444         int family, tidx, nidx = 0;
2445         int tbl_skip = cb->args[0];
2446         int neigh_skip = cb->args[1];
2447         struct neigh_table *tbl;
2448
2449         if (cb->strict_check) {
2450                 int err = neightbl_valid_dump_info(nlh, cb->extack);
2451
2452                 if (err < 0)
2453                         return err;
2454         }
2455
2456         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2457
2458         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2459                 struct neigh_parms *p;
2460
2461                 tbl = neigh_tables[tidx];
2462                 if (!tbl)
2463                         continue;
2464
2465                 if (tidx < tbl_skip || (family && tbl->family != family))
2466                         continue;
2467
2468                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2469                                        nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2470                                        NLM_F_MULTI) < 0)
2471                         break;
2472
2473                 nidx = 0;
2474                 p = list_next_entry(&tbl->parms, list);
2475                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2476                         if (!net_eq(neigh_parms_net(p), net))
2477                                 continue;
2478
2479                         if (nidx < neigh_skip)
2480                                 goto next;
2481
2482                         if (neightbl_fill_param_info(skb, tbl, p,
2483                                                      NETLINK_CB(cb->skb).portid,
2484                                                      nlh->nlmsg_seq,
2485                                                      RTM_NEWNEIGHTBL,
2486                                                      NLM_F_MULTI) < 0)
2487                                 goto out;
2488                 next:
2489                         nidx++;
2490                 }
2491
2492                 neigh_skip = 0;
2493         }
2494 out:
2495         cb->args[0] = tidx;
2496         cb->args[1] = nidx;
2497
2498         return skb->len;
2499 }
2500
2501 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2502                            u32 pid, u32 seq, int type, unsigned int flags)
2503 {
2504         u32 neigh_flags, neigh_flags_ext;
2505         unsigned long now = jiffies;
2506         struct nda_cacheinfo ci;
2507         struct nlmsghdr *nlh;
2508         struct ndmsg *ndm;
2509
2510         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2511         if (nlh == NULL)
2512                 return -EMSGSIZE;
2513
2514         neigh_flags_ext = neigh->flags >> NTF_EXT_SHIFT;
2515         neigh_flags     = neigh->flags & NTF_OLD_MASK;
2516
2517         ndm = nlmsg_data(nlh);
2518         ndm->ndm_family  = neigh->ops->family;
2519         ndm->ndm_pad1    = 0;
2520         ndm->ndm_pad2    = 0;
2521         ndm->ndm_flags   = neigh_flags;
2522         ndm->ndm_type    = neigh->type;
2523         ndm->ndm_ifindex = neigh->dev->ifindex;
2524
2525         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2526                 goto nla_put_failure;
2527
2528         read_lock_bh(&neigh->lock);
2529         ndm->ndm_state   = neigh->nud_state;
2530         if (neigh->nud_state & NUD_VALID) {
2531                 char haddr[MAX_ADDR_LEN];
2532
2533                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2534                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2535                         read_unlock_bh(&neigh->lock);
2536                         goto nla_put_failure;
2537                 }
2538         }
2539
2540         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2541         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2542         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2543         ci.ndm_refcnt    = refcount_read(&neigh->refcnt) - 1;
2544         read_unlock_bh(&neigh->lock);
2545
2546         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2547             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2548                 goto nla_put_failure;
2549
2550         if (neigh->protocol && nla_put_u8(skb, NDA_PROTOCOL, neigh->protocol))
2551                 goto nla_put_failure;
2552         if (neigh_flags_ext && nla_put_u32(skb, NDA_FLAGS_EXT, neigh_flags_ext))
2553                 goto nla_put_failure;
2554
2555         nlmsg_end(skb, nlh);
2556         return 0;
2557
2558 nla_put_failure:
2559         nlmsg_cancel(skb, nlh);
2560         return -EMSGSIZE;
2561 }
2562
2563 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2564                             u32 pid, u32 seq, int type, unsigned int flags,
2565                             struct neigh_table *tbl)
2566 {
2567         u32 neigh_flags, neigh_flags_ext;
2568         struct nlmsghdr *nlh;
2569         struct ndmsg *ndm;
2570
2571         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2572         if (nlh == NULL)
2573                 return -EMSGSIZE;
2574
2575         neigh_flags_ext = pn->flags >> NTF_EXT_SHIFT;
2576         neigh_flags     = pn->flags & NTF_OLD_MASK;
2577
2578         ndm = nlmsg_data(nlh);
2579         ndm->ndm_family  = tbl->family;
2580         ndm->ndm_pad1    = 0;
2581         ndm->ndm_pad2    = 0;
2582         ndm->ndm_flags   = neigh_flags | NTF_PROXY;
2583         ndm->ndm_type    = RTN_UNICAST;
2584         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2585         ndm->ndm_state   = NUD_NONE;
2586
2587         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2588                 goto nla_put_failure;
2589
2590         if (pn->protocol && nla_put_u8(skb, NDA_PROTOCOL, pn->protocol))
2591                 goto nla_put_failure;
2592         if (neigh_flags_ext && nla_put_u32(skb, NDA_FLAGS_EXT, neigh_flags_ext))
2593                 goto nla_put_failure;
2594
2595         nlmsg_end(skb, nlh);
2596         return 0;
2597
2598 nla_put_failure:
2599         nlmsg_cancel(skb, nlh);
2600         return -EMSGSIZE;
2601 }
2602
2603 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2604 {
2605         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2606         __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2607 }
2608
2609 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2610 {
2611         struct net_device *master;
2612
2613         if (!master_idx)
2614                 return false;
2615
2616         master = dev ? netdev_master_upper_dev_get(dev) : NULL;
2617
2618         /* 0 is already used to denote NDA_MASTER wasn't passed, therefore need another
2619          * invalid value for ifindex to denote "no master".
2620          */
2621         if (master_idx == -1)
2622                 return !!master;
2623
2624         if (!master || master->ifindex != master_idx)
2625                 return true;
2626
2627         return false;
2628 }
2629
2630 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2631 {
2632         if (filter_idx && (!dev || dev->ifindex != filter_idx))
2633                 return true;
2634
2635         return false;
2636 }
2637
2638 struct neigh_dump_filter {
2639         int master_idx;
2640         int dev_idx;
2641 };
2642
2643 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2644                             struct netlink_callback *cb,
2645                             struct neigh_dump_filter *filter)
2646 {
2647         struct net *net = sock_net(skb->sk);
2648         struct neighbour *n;
2649         int rc, h, s_h = cb->args[1];
2650         int idx, s_idx = idx = cb->args[2];
2651         struct neigh_hash_table *nht;
2652         unsigned int flags = NLM_F_MULTI;
2653
2654         if (filter->dev_idx || filter->master_idx)
2655                 flags |= NLM_F_DUMP_FILTERED;
2656
2657         rcu_read_lock_bh();
2658         nht = rcu_dereference_bh(tbl->nht);
2659
2660         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2661                 if (h > s_h)
2662                         s_idx = 0;
2663                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2664                      n != NULL;
2665                      n = rcu_dereference_bh(n->next)) {
2666                         if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2667                                 goto next;
2668                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2669                             neigh_master_filtered(n->dev, filter->master_idx))
2670                                 goto next;
2671                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2672                                             cb->nlh->nlmsg_seq,
2673                                             RTM_NEWNEIGH,
2674                                             flags) < 0) {
2675                                 rc = -1;
2676                                 goto out;
2677                         }
2678 next:
2679                         idx++;
2680                 }
2681         }
2682         rc = skb->len;
2683 out:
2684         rcu_read_unlock_bh();
2685         cb->args[1] = h;
2686         cb->args[2] = idx;
2687         return rc;
2688 }
2689
2690 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2691                              struct netlink_callback *cb,
2692                              struct neigh_dump_filter *filter)
2693 {
2694         struct pneigh_entry *n;
2695         struct net *net = sock_net(skb->sk);
2696         int rc, h, s_h = cb->args[3];
2697         int idx, s_idx = idx = cb->args[4];
2698         unsigned int flags = NLM_F_MULTI;
2699
2700         if (filter->dev_idx || filter->master_idx)
2701                 flags |= NLM_F_DUMP_FILTERED;
2702
2703         read_lock_bh(&tbl->lock);
2704
2705         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2706                 if (h > s_h)
2707                         s_idx = 0;
2708                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2709                         if (idx < s_idx || pneigh_net(n) != net)
2710                                 goto next;
2711                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2712                             neigh_master_filtered(n->dev, filter->master_idx))
2713                                 goto next;
2714                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2715                                             cb->nlh->nlmsg_seq,
2716                                             RTM_NEWNEIGH, flags, tbl) < 0) {
2717                                 read_unlock_bh(&tbl->lock);
2718                                 rc = -1;
2719                                 goto out;
2720                         }
2721                 next:
2722                         idx++;
2723                 }
2724         }
2725
2726         read_unlock_bh(&tbl->lock);
2727         rc = skb->len;
2728 out:
2729         cb->args[3] = h;
2730         cb->args[4] = idx;
2731         return rc;
2732
2733 }
2734
2735 static int neigh_valid_dump_req(const struct nlmsghdr *nlh,
2736                                 bool strict_check,
2737                                 struct neigh_dump_filter *filter,
2738                                 struct netlink_ext_ack *extack)
2739 {
2740         struct nlattr *tb[NDA_MAX + 1];
2741         int err, i;
2742
2743         if (strict_check) {
2744                 struct ndmsg *ndm;
2745
2746                 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2747                         NL_SET_ERR_MSG(extack, "Invalid header for neighbor dump request");
2748                         return -EINVAL;
2749                 }
2750
2751                 ndm = nlmsg_data(nlh);
2752                 if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_ifindex ||
2753                     ndm->ndm_state || ndm->ndm_type) {
2754                         NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor dump request");
2755                         return -EINVAL;
2756                 }
2757
2758                 if (ndm->ndm_flags & ~NTF_PROXY) {
2759                         NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor dump request");
2760                         return -EINVAL;
2761                 }
2762
2763                 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg),
2764                                                     tb, NDA_MAX, nda_policy,
2765                                                     extack);
2766         } else {
2767                 err = nlmsg_parse_deprecated(nlh, sizeof(struct ndmsg), tb,
2768                                              NDA_MAX, nda_policy, extack);
2769         }
2770         if (err < 0)
2771                 return err;
2772
2773         for (i = 0; i <= NDA_MAX; ++i) {
2774                 if (!tb[i])
2775                         continue;
2776
2777                 /* all new attributes should require strict_check */
2778                 switch (i) {
2779                 case NDA_IFINDEX:
2780                         filter->dev_idx = nla_get_u32(tb[i]);
2781                         break;
2782                 case NDA_MASTER:
2783                         filter->master_idx = nla_get_u32(tb[i]);
2784                         break;
2785                 default:
2786                         if (strict_check) {
2787                                 NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor dump request");
2788                                 return -EINVAL;
2789                         }
2790                 }
2791         }
2792
2793         return 0;
2794 }
2795
2796 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2797 {
2798         const struct nlmsghdr *nlh = cb->nlh;
2799         struct neigh_dump_filter filter = {};
2800         struct neigh_table *tbl;
2801         int t, family, s_t;
2802         int proxy = 0;
2803         int err;
2804
2805         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2806
2807         /* check for full ndmsg structure presence, family member is
2808          * the same for both structures
2809          */
2810         if (nlmsg_len(nlh) >= sizeof(struct ndmsg) &&
2811             ((struct ndmsg *)nlmsg_data(nlh))->ndm_flags == NTF_PROXY)
2812                 proxy = 1;
2813
2814         err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack);
2815         if (err < 0 && cb->strict_check)
2816                 return err;
2817
2818         s_t = cb->args[0];
2819
2820         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2821                 tbl = neigh_tables[t];
2822
2823                 if (!tbl)
2824                         continue;
2825                 if (t < s_t || (family && tbl->family != family))
2826                         continue;
2827                 if (t > s_t)
2828                         memset(&cb->args[1], 0, sizeof(cb->args) -
2829                                                 sizeof(cb->args[0]));
2830                 if (proxy)
2831                         err = pneigh_dump_table(tbl, skb, cb, &filter);
2832                 else
2833                         err = neigh_dump_table(tbl, skb, cb, &filter);
2834                 if (err < 0)
2835                         break;
2836         }
2837
2838         cb->args[0] = t;
2839         return skb->len;
2840 }
2841
2842 static int neigh_valid_get_req(const struct nlmsghdr *nlh,
2843                                struct neigh_table **tbl,
2844                                void **dst, int *dev_idx, u8 *ndm_flags,
2845                                struct netlink_ext_ack *extack)
2846 {
2847         struct nlattr *tb[NDA_MAX + 1];
2848         struct ndmsg *ndm;
2849         int err, i;
2850
2851         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2852                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor get request");
2853                 return -EINVAL;
2854         }
2855
2856         ndm = nlmsg_data(nlh);
2857         if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
2858             ndm->ndm_type) {
2859                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor get request");
2860                 return -EINVAL;
2861         }
2862
2863         if (ndm->ndm_flags & ~NTF_PROXY) {
2864                 NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor get request");
2865                 return -EINVAL;
2866         }
2867
2868         err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg), tb,
2869                                             NDA_MAX, nda_policy, extack);
2870         if (err < 0)
2871                 return err;
2872
2873         *ndm_flags = ndm->ndm_flags;
2874         *dev_idx = ndm->ndm_ifindex;
2875         *tbl = neigh_find_table(ndm->ndm_family);
2876         if (*tbl == NULL) {
2877                 NL_SET_ERR_MSG(extack, "Unsupported family in header for neighbor get request");
2878                 return -EAFNOSUPPORT;
2879         }
2880
2881         for (i = 0; i <= NDA_MAX; ++i) {
2882                 if (!tb[i])
2883                         continue;
2884
2885                 switch (i) {
2886                 case NDA_DST:
2887                         if (nla_len(tb[i]) != (int)(*tbl)->key_len) {
2888                                 NL_SET_ERR_MSG(extack, "Invalid network address in neighbor get request");
2889                                 return -EINVAL;
2890                         }
2891                         *dst = nla_data(tb[i]);
2892                         break;
2893                 default:
2894                         NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor get request");
2895                         return -EINVAL;
2896                 }
2897         }
2898
2899         return 0;
2900 }
2901
2902 static inline size_t neigh_nlmsg_size(void)
2903 {
2904         return NLMSG_ALIGN(sizeof(struct ndmsg))
2905                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2906                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2907                + nla_total_size(sizeof(struct nda_cacheinfo))
2908                + nla_total_size(4)  /* NDA_PROBES */
2909                + nla_total_size(4)  /* NDA_FLAGS_EXT */
2910                + nla_total_size(1); /* NDA_PROTOCOL */
2911 }
2912
2913 static int neigh_get_reply(struct net *net, struct neighbour *neigh,
2914                            u32 pid, u32 seq)
2915 {
2916         struct sk_buff *skb;
2917         int err = 0;
2918
2919         skb = nlmsg_new(neigh_nlmsg_size(), GFP_KERNEL);
2920         if (!skb)
2921                 return -ENOBUFS;
2922
2923         err = neigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0);
2924         if (err) {
2925                 kfree_skb(skb);
2926                 goto errout;
2927         }
2928
2929         err = rtnl_unicast(skb, net, pid);
2930 errout:
2931         return err;
2932 }
2933
2934 static inline size_t pneigh_nlmsg_size(void)
2935 {
2936         return NLMSG_ALIGN(sizeof(struct ndmsg))
2937                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2938                + nla_total_size(4)  /* NDA_FLAGS_EXT */
2939                + nla_total_size(1); /* NDA_PROTOCOL */
2940 }
2941
2942 static int pneigh_get_reply(struct net *net, struct pneigh_entry *neigh,
2943                             u32 pid, u32 seq, struct neigh_table *tbl)
2944 {
2945         struct sk_buff *skb;
2946         int err = 0;
2947
2948         skb = nlmsg_new(pneigh_nlmsg_size(), GFP_KERNEL);
2949         if (!skb)
2950                 return -ENOBUFS;
2951
2952         err = pneigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0, tbl);
2953         if (err) {
2954                 kfree_skb(skb);
2955                 goto errout;
2956         }
2957
2958         err = rtnl_unicast(skb, net, pid);
2959 errout:
2960         return err;
2961 }
2962
2963 static int neigh_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
2964                      struct netlink_ext_ack *extack)
2965 {
2966         struct net *net = sock_net(in_skb->sk);
2967         struct net_device *dev = NULL;
2968         struct neigh_table *tbl = NULL;
2969         struct neighbour *neigh;
2970         void *dst = NULL;
2971         u8 ndm_flags = 0;
2972         int dev_idx = 0;
2973         int err;
2974
2975         err = neigh_valid_get_req(nlh, &tbl, &dst, &dev_idx, &ndm_flags,
2976                                   extack);
2977         if (err < 0)
2978                 return err;
2979
2980         if (dev_idx) {
2981                 dev = __dev_get_by_index(net, dev_idx);
2982                 if (!dev) {
2983                         NL_SET_ERR_MSG(extack, "Unknown device ifindex");
2984                         return -ENODEV;
2985                 }
2986         }
2987
2988         if (!dst) {
2989                 NL_SET_ERR_MSG(extack, "Network address not specified");
2990                 return -EINVAL;
2991         }
2992
2993         if (ndm_flags & NTF_PROXY) {
2994                 struct pneigh_entry *pn;
2995
2996                 pn = pneigh_lookup(tbl, net, dst, dev, 0);
2997                 if (!pn) {
2998                         NL_SET_ERR_MSG(extack, "Proxy neighbour entry not found");
2999                         return -ENOENT;
3000                 }
3001                 return pneigh_get_reply(net, pn, NETLINK_CB(in_skb).portid,
3002                                         nlh->nlmsg_seq, tbl);
3003         }
3004
3005         if (!dev) {
3006                 NL_SET_ERR_MSG(extack, "No device specified");
3007                 return -EINVAL;
3008         }
3009
3010         neigh = neigh_lookup(tbl, dst, dev);
3011         if (!neigh) {
3012                 NL_SET_ERR_MSG(extack, "Neighbour entry not found");
3013                 return -ENOENT;
3014         }
3015
3016         err = neigh_get_reply(net, neigh, NETLINK_CB(in_skb).portid,
3017                               nlh->nlmsg_seq);
3018
3019         neigh_release(neigh);
3020
3021         return err;
3022 }
3023
3024 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
3025 {
3026         int chain;
3027         struct neigh_hash_table *nht;
3028
3029         rcu_read_lock_bh();
3030         nht = rcu_dereference_bh(tbl->nht);
3031
3032         read_lock(&tbl->lock); /* avoid resizes */
3033         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
3034                 struct neighbour *n;
3035
3036                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
3037                      n != NULL;
3038                      n = rcu_dereference_bh(n->next))
3039                         cb(n, cookie);
3040         }
3041         read_unlock(&tbl->lock);
3042         rcu_read_unlock_bh();
3043 }
3044 EXPORT_SYMBOL(neigh_for_each);
3045
3046 /* The tbl->lock must be held as a writer and BH disabled. */
3047 void __neigh_for_each_release(struct neigh_table *tbl,
3048                               int (*cb)(struct neighbour *))
3049 {
3050         int chain;
3051         struct neigh_hash_table *nht;
3052
3053         nht = rcu_dereference_protected(tbl->nht,
3054                                         lockdep_is_held(&tbl->lock));
3055         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
3056                 struct neighbour *n;
3057                 struct neighbour __rcu **np;
3058
3059                 np = &nht->hash_buckets[chain];
3060                 while ((n = rcu_dereference_protected(*np,
3061                                         lockdep_is_held(&tbl->lock))) != NULL) {
3062                         int release;
3063
3064                         write_lock(&n->lock);
3065                         release = cb(n);
3066                         if (release) {
3067                                 rcu_assign_pointer(*np,
3068                                         rcu_dereference_protected(n->next,
3069                                                 lockdep_is_held(&tbl->lock)));
3070                                 neigh_mark_dead(n);
3071                         } else
3072                                 np = &n->next;
3073                         write_unlock(&n->lock);
3074                         if (release)
3075                                 neigh_cleanup_and_release(n);
3076                 }
3077         }
3078 }
3079 EXPORT_SYMBOL(__neigh_for_each_release);
3080
3081 int neigh_xmit(int index, struct net_device *dev,
3082                const void *addr, struct sk_buff *skb)
3083 {
3084         int err = -EAFNOSUPPORT;
3085         if (likely(index < NEIGH_NR_TABLES)) {
3086                 struct neigh_table *tbl;
3087                 struct neighbour *neigh;
3088
3089                 tbl = neigh_tables[index];
3090                 if (!tbl)
3091                         goto out;
3092                 rcu_read_lock_bh();
3093                 if (index == NEIGH_ARP_TABLE) {
3094                         u32 key = *((u32 *)addr);
3095
3096                         neigh = __ipv4_neigh_lookup_noref(dev, key);
3097                 } else {
3098                         neigh = __neigh_lookup_noref(tbl, addr, dev);
3099                 }
3100                 if (!neigh)
3101                         neigh = __neigh_create(tbl, addr, dev, false);
3102                 err = PTR_ERR(neigh);
3103                 if (IS_ERR(neigh)) {
3104                         rcu_read_unlock_bh();
3105                         goto out_kfree_skb;
3106                 }
3107                 err = neigh->output(neigh, skb);
3108                 rcu_read_unlock_bh();
3109         }
3110         else if (index == NEIGH_LINK_TABLE) {
3111                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
3112                                       addr, NULL, skb->len);
3113                 if (err < 0)
3114                         goto out_kfree_skb;
3115                 err = dev_queue_xmit(skb);
3116         }
3117 out:
3118         return err;
3119 out_kfree_skb:
3120         kfree_skb(skb);
3121         goto out;
3122 }
3123 EXPORT_SYMBOL(neigh_xmit);
3124
3125 #ifdef CONFIG_PROC_FS
3126
3127 static struct neighbour *neigh_get_first(struct seq_file *seq)
3128 {
3129         struct neigh_seq_state *state = seq->private;
3130         struct net *net = seq_file_net(seq);
3131         struct neigh_hash_table *nht = state->nht;
3132         struct neighbour *n = NULL;
3133         int bucket;
3134
3135         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
3136         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
3137                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
3138
3139                 while (n) {
3140                         if (!net_eq(dev_net(n->dev), net))
3141                                 goto next;
3142                         if (state->neigh_sub_iter) {
3143                                 loff_t fakep = 0;
3144                                 void *v;
3145
3146                                 v = state->neigh_sub_iter(state, n, &fakep);
3147                                 if (!v)
3148                                         goto next;
3149                         }
3150                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3151                                 break;
3152                         if (n->nud_state & ~NUD_NOARP)
3153                                 break;
3154 next:
3155                         n = rcu_dereference_bh(n->next);
3156                 }
3157
3158                 if (n)
3159                         break;
3160         }
3161         state->bucket = bucket;
3162
3163         return n;
3164 }
3165
3166 static struct neighbour *neigh_get_next(struct seq_file *seq,
3167                                         struct neighbour *n,
3168                                         loff_t *pos)
3169 {
3170         struct neigh_seq_state *state = seq->private;
3171         struct net *net = seq_file_net(seq);
3172         struct neigh_hash_table *nht = state->nht;
3173
3174         if (state->neigh_sub_iter) {
3175                 void *v = state->neigh_sub_iter(state, n, pos);
3176                 if (v)
3177                         return n;
3178         }
3179         n = rcu_dereference_bh(n->next);
3180
3181         while (1) {
3182                 while (n) {
3183                         if (!net_eq(dev_net(n->dev), net))
3184                                 goto next;
3185                         if (state->neigh_sub_iter) {
3186                                 void *v = state->neigh_sub_iter(state, n, pos);
3187                                 if (v)
3188                                         return n;
3189                                 goto next;
3190                         }
3191                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3192                                 break;
3193
3194                         if (n->nud_state & ~NUD_NOARP)
3195                                 break;
3196 next:
3197                         n = rcu_dereference_bh(n->next);
3198                 }
3199
3200                 if (n)
3201                         break;
3202
3203                 if (++state->bucket >= (1 << nht->hash_shift))
3204                         break;
3205
3206                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
3207         }
3208
3209         if (n && pos)
3210                 --(*pos);
3211         return n;
3212 }
3213
3214 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
3215 {
3216         struct neighbour *n = neigh_get_first(seq);
3217
3218         if (n) {
3219                 --(*pos);
3220                 while (*pos) {
3221                         n = neigh_get_next(seq, n, pos);
3222                         if (!n)
3223                                 break;
3224                 }
3225         }
3226         return *pos ? NULL : n;
3227 }
3228
3229 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
3230 {
3231         struct neigh_seq_state *state = seq->private;
3232         struct net *net = seq_file_net(seq);
3233         struct neigh_table *tbl = state->tbl;
3234         struct pneigh_entry *pn = NULL;
3235         int bucket;
3236
3237         state->flags |= NEIGH_SEQ_IS_PNEIGH;
3238         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
3239                 pn = tbl->phash_buckets[bucket];
3240                 while (pn && !net_eq(pneigh_net(pn), net))
3241                         pn = pn->next;
3242                 if (pn)
3243                         break;
3244         }
3245         state->bucket = bucket;
3246
3247         return pn;
3248 }
3249
3250 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
3251                                             struct pneigh_entry *pn,
3252                                             loff_t *pos)
3253 {
3254         struct neigh_seq_state *state = seq->private;
3255         struct net *net = seq_file_net(seq);
3256         struct neigh_table *tbl = state->tbl;
3257
3258         do {
3259                 pn = pn->next;
3260         } while (pn && !net_eq(pneigh_net(pn), net));
3261
3262         while (!pn) {
3263                 if (++state->bucket > PNEIGH_HASHMASK)
3264                         break;
3265                 pn = tbl->phash_buckets[state->bucket];
3266                 while (pn && !net_eq(pneigh_net(pn), net))
3267                         pn = pn->next;
3268                 if (pn)
3269                         break;
3270         }
3271
3272         if (pn && pos)
3273                 --(*pos);
3274
3275         return pn;
3276 }
3277
3278 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
3279 {
3280         struct pneigh_entry *pn = pneigh_get_first(seq);
3281
3282         if (pn) {
3283                 --(*pos);
3284                 while (*pos) {
3285                         pn = pneigh_get_next(seq, pn, pos);
3286                         if (!pn)
3287                                 break;
3288                 }
3289         }
3290         return *pos ? NULL : pn;
3291 }
3292
3293 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
3294 {
3295         struct neigh_seq_state *state = seq->private;
3296         void *rc;
3297         loff_t idxpos = *pos;
3298
3299         rc = neigh_get_idx(seq, &idxpos);
3300         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3301                 rc = pneigh_get_idx(seq, &idxpos);
3302
3303         return rc;
3304 }
3305
3306 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
3307         __acquires(tbl->lock)
3308         __acquires(rcu_bh)
3309 {
3310         struct neigh_seq_state *state = seq->private;
3311
3312         state->tbl = tbl;
3313         state->bucket = 0;
3314         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
3315
3316         rcu_read_lock_bh();
3317         state->nht = rcu_dereference_bh(tbl->nht);
3318         read_lock(&tbl->lock);
3319
3320         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
3321 }
3322 EXPORT_SYMBOL(neigh_seq_start);
3323
3324 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3325 {
3326         struct neigh_seq_state *state;
3327         void *rc;
3328
3329         if (v == SEQ_START_TOKEN) {
3330                 rc = neigh_get_first(seq);
3331                 goto out;
3332         }
3333
3334         state = seq->private;
3335         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
3336                 rc = neigh_get_next(seq, v, NULL);
3337                 if (rc)
3338                         goto out;
3339                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3340                         rc = pneigh_get_first(seq);
3341         } else {
3342                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
3343                 rc = pneigh_get_next(seq, v, NULL);
3344         }
3345 out:
3346         ++(*pos);
3347         return rc;
3348 }
3349 EXPORT_SYMBOL(neigh_seq_next);
3350
3351 void neigh_seq_stop(struct seq_file *seq, void *v)
3352         __releases(tbl->lock)
3353         __releases(rcu_bh)
3354 {
3355         struct neigh_seq_state *state = seq->private;
3356         struct neigh_table *tbl = state->tbl;
3357
3358         read_unlock(&tbl->lock);
3359         rcu_read_unlock_bh();
3360 }
3361 EXPORT_SYMBOL(neigh_seq_stop);
3362
3363 /* statistics via seq_file */
3364
3365 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
3366 {
3367         struct neigh_table *tbl = pde_data(file_inode(seq->file));
3368         int cpu;
3369
3370         if (*pos == 0)
3371                 return SEQ_START_TOKEN;
3372
3373         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
3374                 if (!cpu_possible(cpu))
3375                         continue;
3376                 *pos = cpu+1;
3377                 return per_cpu_ptr(tbl->stats, cpu);
3378         }
3379         return NULL;
3380 }
3381
3382 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3383 {
3384         struct neigh_table *tbl = pde_data(file_inode(seq->file));
3385         int cpu;
3386
3387         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
3388                 if (!cpu_possible(cpu))
3389                         continue;
3390                 *pos = cpu+1;
3391                 return per_cpu_ptr(tbl->stats, cpu);
3392         }
3393         (*pos)++;
3394         return NULL;
3395 }
3396
3397 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
3398 {
3399
3400 }
3401
3402 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
3403 {
3404         struct neigh_table *tbl = pde_data(file_inode(seq->file));
3405         struct neigh_statistics *st = v;
3406
3407         if (v == SEQ_START_TOKEN) {
3408                 seq_puts(seq, "entries  allocs   destroys hash_grows lookups  hits     res_failed rcv_probes_mcast rcv_probes_ucast periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
3409                 return 0;
3410         }
3411
3412         seq_printf(seq, "%08x %08lx %08lx %08lx   %08lx %08lx %08lx   "
3413                         "%08lx         %08lx         %08lx         "
3414                         "%08lx       %08lx            %08lx\n",
3415                    atomic_read(&tbl->entries),
3416
3417                    st->allocs,
3418                    st->destroys,
3419                    st->hash_grows,
3420
3421                    st->lookups,
3422                    st->hits,
3423
3424                    st->res_failed,
3425
3426                    st->rcv_probes_mcast,
3427                    st->rcv_probes_ucast,
3428
3429                    st->periodic_gc_runs,
3430                    st->forced_gc_runs,
3431                    st->unres_discards,
3432                    st->table_fulls
3433                    );
3434
3435         return 0;
3436 }
3437
3438 static const struct seq_operations neigh_stat_seq_ops = {
3439         .start  = neigh_stat_seq_start,
3440         .next   = neigh_stat_seq_next,
3441         .stop   = neigh_stat_seq_stop,
3442         .show   = neigh_stat_seq_show,
3443 };
3444 #endif /* CONFIG_PROC_FS */
3445
3446 static void __neigh_notify(struct neighbour *n, int type, int flags,
3447                            u32 pid)
3448 {
3449         struct net *net = dev_net(n->dev);
3450         struct sk_buff *skb;
3451         int err = -ENOBUFS;
3452
3453         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
3454         if (skb == NULL)
3455                 goto errout;
3456
3457         err = neigh_fill_info(skb, n, pid, 0, type, flags);
3458         if (err < 0) {
3459                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
3460                 WARN_ON(err == -EMSGSIZE);
3461                 kfree_skb(skb);
3462                 goto errout;
3463         }
3464         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
3465         return;
3466 errout:
3467         if (err < 0)
3468                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
3469 }
3470
3471 void neigh_app_ns(struct neighbour *n)
3472 {
3473         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
3474 }
3475 EXPORT_SYMBOL(neigh_app_ns);
3476
3477 #ifdef CONFIG_SYSCTL
3478 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
3479
3480 static int proc_unres_qlen(struct ctl_table *ctl, int write,
3481                            void *buffer, size_t *lenp, loff_t *ppos)
3482 {
3483         int size, ret;
3484         struct ctl_table tmp = *ctl;
3485
3486         tmp.extra1 = SYSCTL_ZERO;
3487         tmp.extra2 = &unres_qlen_max;
3488         tmp.data = &size;
3489
3490         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
3491         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3492
3493         if (write && !ret)
3494                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
3495         return ret;
3496 }
3497
3498 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
3499                                                    int family)
3500 {
3501         switch (family) {
3502         case AF_INET:
3503                 return __in_dev_arp_parms_get_rcu(dev);
3504         case AF_INET6:
3505                 return __in6_dev_nd_parms_get_rcu(dev);
3506         }
3507         return NULL;
3508 }
3509
3510 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
3511                                   int index)
3512 {
3513         struct net_device *dev;
3514         int family = neigh_parms_family(p);
3515
3516         rcu_read_lock();
3517         for_each_netdev_rcu(net, dev) {
3518                 struct neigh_parms *dst_p =
3519                                 neigh_get_dev_parms_rcu(dev, family);
3520
3521                 if (dst_p && !test_bit(index, dst_p->data_state))
3522                         dst_p->data[index] = p->data[index];
3523         }
3524         rcu_read_unlock();
3525 }
3526
3527 static void neigh_proc_update(struct ctl_table *ctl, int write)
3528 {
3529         struct net_device *dev = ctl->extra1;
3530         struct neigh_parms *p = ctl->extra2;
3531         struct net *net = neigh_parms_net(p);
3532         int index = (int *) ctl->data - p->data;
3533
3534         if (!write)
3535                 return;
3536
3537         set_bit(index, p->data_state);
3538         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
3539                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
3540         if (!dev) /* NULL dev means this is default value */
3541                 neigh_copy_dflt_parms(net, p, index);
3542 }
3543
3544 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
3545                                            void *buffer, size_t *lenp,
3546                                            loff_t *ppos)
3547 {
3548         struct ctl_table tmp = *ctl;
3549         int ret;
3550
3551         tmp.extra1 = SYSCTL_ZERO;
3552         tmp.extra2 = SYSCTL_INT_MAX;
3553
3554         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3555         neigh_proc_update(ctl, write);
3556         return ret;
3557 }
3558
3559 int neigh_proc_dointvec(struct ctl_table *ctl, int write, void *buffer,
3560                         size_t *lenp, loff_t *ppos)
3561 {
3562         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3563
3564         neigh_proc_update(ctl, write);
3565         return ret;
3566 }
3567 EXPORT_SYMBOL(neigh_proc_dointvec);
3568
3569 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write, void *buffer,
3570                                 size_t *lenp, loff_t *ppos)
3571 {
3572         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3573
3574         neigh_proc_update(ctl, write);
3575         return ret;
3576 }
3577 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3578
3579 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3580                                               void *buffer, size_t *lenp,
3581                                               loff_t *ppos)
3582 {
3583         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3584
3585         neigh_proc_update(ctl, write);
3586         return ret;
3587 }
3588
3589 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3590                                    void *buffer, size_t *lenp, loff_t *ppos)
3591 {
3592         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3593
3594         neigh_proc_update(ctl, write);
3595         return ret;
3596 }
3597 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3598
3599 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3600                                           void *buffer, size_t *lenp,
3601                                           loff_t *ppos)
3602 {
3603         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3604
3605         neigh_proc_update(ctl, write);
3606         return ret;
3607 }
3608
3609 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3610                                           void *buffer, size_t *lenp,
3611                                           loff_t *ppos)
3612 {
3613         struct neigh_parms *p = ctl->extra2;
3614         int ret;
3615
3616         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3617                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3618         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3619                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3620         else
3621                 ret = -1;
3622
3623         if (write && ret == 0) {
3624                 /* update reachable_time as well, otherwise, the change will
3625                  * only be effective after the next time neigh_periodic_work
3626                  * decides to recompute it
3627                  */
3628                 p->reachable_time =
3629                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3630         }
3631         return ret;
3632 }
3633
3634 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3635         (&((struct neigh_parms *) 0)->data[index])
3636
3637 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3638         [NEIGH_VAR_ ## attr] = { \
3639                 .procname       = name, \
3640                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3641                 .maxlen         = sizeof(int), \
3642                 .mode           = mval, \
3643                 .proc_handler   = proc, \
3644         }
3645
3646 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3647         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3648
3649 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3650         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3651
3652 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3653         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3654
3655 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3656         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3657
3658 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3659         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3660
3661 static struct neigh_sysctl_table {
3662         struct ctl_table_header *sysctl_header;
3663         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3664 } neigh_sysctl_template __read_mostly = {
3665         .neigh_vars = {
3666                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3667                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3668                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3669                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3670                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3671                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3672                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3673                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3674                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3675                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3676                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3677                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3678                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3679                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3680                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3681                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3682                 [NEIGH_VAR_GC_INTERVAL] = {
3683                         .procname       = "gc_interval",
3684                         .maxlen         = sizeof(int),
3685                         .mode           = 0644,
3686                         .proc_handler   = proc_dointvec_jiffies,
3687                 },
3688                 [NEIGH_VAR_GC_THRESH1] = {
3689                         .procname       = "gc_thresh1",
3690                         .maxlen         = sizeof(int),
3691                         .mode           = 0644,
3692                         .extra1         = SYSCTL_ZERO,
3693                         .extra2         = SYSCTL_INT_MAX,
3694                         .proc_handler   = proc_dointvec_minmax,
3695                 },
3696                 [NEIGH_VAR_GC_THRESH2] = {
3697                         .procname       = "gc_thresh2",
3698                         .maxlen         = sizeof(int),
3699                         .mode           = 0644,
3700                         .extra1         = SYSCTL_ZERO,
3701                         .extra2         = SYSCTL_INT_MAX,
3702                         .proc_handler   = proc_dointvec_minmax,
3703                 },
3704                 [NEIGH_VAR_GC_THRESH3] = {
3705                         .procname       = "gc_thresh3",
3706                         .maxlen         = sizeof(int),
3707                         .mode           = 0644,
3708                         .extra1         = SYSCTL_ZERO,
3709                         .extra2         = SYSCTL_INT_MAX,
3710                         .proc_handler   = proc_dointvec_minmax,
3711                 },
3712                 {},
3713         },
3714 };
3715
3716 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3717                           proc_handler *handler)
3718 {
3719         int i;
3720         struct neigh_sysctl_table *t;
3721         const char *dev_name_source;
3722         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3723         char *p_name;
3724
3725         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3726         if (!t)
3727                 goto err;
3728
3729         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3730                 t->neigh_vars[i].data += (long) p;
3731                 t->neigh_vars[i].extra1 = dev;
3732                 t->neigh_vars[i].extra2 = p;
3733         }
3734
3735         if (dev) {
3736                 dev_name_source = dev->name;
3737                 /* Terminate the table early */
3738                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3739                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3740         } else {
3741                 struct neigh_table *tbl = p->tbl;
3742                 dev_name_source = "default";
3743                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3744                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3745                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3746                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3747         }
3748
3749         if (handler) {
3750                 /* RetransTime */
3751                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3752                 /* ReachableTime */
3753                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3754                 /* RetransTime (in milliseconds)*/
3755                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3756                 /* ReachableTime (in milliseconds) */
3757                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3758         } else {
3759                 /* Those handlers will update p->reachable_time after
3760                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3761                  * applied after the next neighbour update instead of waiting for
3762                  * neigh_periodic_work to update its value (can be multiple minutes)
3763                  * So any handler that replaces them should do this as well
3764                  */
3765                 /* ReachableTime */
3766                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3767                         neigh_proc_base_reachable_time;
3768                 /* ReachableTime (in milliseconds) */
3769                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3770                         neigh_proc_base_reachable_time;
3771         }
3772
3773         switch (neigh_parms_family(p)) {
3774         case AF_INET:
3775               p_name = "ipv4";
3776               break;
3777         case AF_INET6:
3778               p_name = "ipv6";
3779               break;
3780         default:
3781               BUG();
3782         }
3783
3784         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3785                 p_name, dev_name_source);
3786         t->sysctl_header =
3787                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3788         if (!t->sysctl_header)
3789                 goto free;
3790
3791         p->sysctl_table = t;
3792         return 0;
3793
3794 free:
3795         kfree(t);
3796 err:
3797         return -ENOBUFS;
3798 }
3799 EXPORT_SYMBOL(neigh_sysctl_register);
3800
3801 void neigh_sysctl_unregister(struct neigh_parms *p)
3802 {
3803         if (p->sysctl_table) {
3804                 struct neigh_sysctl_table *t = p->sysctl_table;
3805                 p->sysctl_table = NULL;
3806                 unregister_net_sysctl_table(t->sysctl_header);
3807                 kfree(t);
3808         }
3809 }
3810 EXPORT_SYMBOL(neigh_sysctl_unregister);
3811
3812 #endif  /* CONFIG_SYSCTL */
3813
3814 static int __init neigh_init(void)
3815 {
3816         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, 0);
3817         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, 0);
3818         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, neigh_get, neigh_dump_info, 0);
3819
3820         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3821                       0);
3822         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0);
3823
3824         return 0;
3825 }
3826
3827 subsys_initcall(neigh_init);