net/core/neighbour.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Generic address resolution entity
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   8  *
   9  *      Fixes:
  10  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  11  *      Harald Welte            Add neighbour cache statistics like rtstat
  12  */
  13
  14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  15
  16 #include <linux/slab.h>
  17 #include <linux/kmemleak.h>
  18 #include <linux/types.h>
  19 #include <linux/kernel.h>
  20 #include <linux/module.h>
  21 #include <linux/socket.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/proc_fs.h>
  24 #ifdef CONFIG_SYSCTL
  25 #include <linux/sysctl.h>
  26 #endif
  27 #include <linux/times.h>
  28 #include <net/net_namespace.h>
  29 #include <net/neighbour.h>
  30 #include <net/arp.h>
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/netevent.h>
  34 #include <net/netlink.h>
  35 #include <linux/rtnetlink.h>
  36 #include <linux/random.h>
  37 #include <linux/string.h>
  38 #include <linux/log2.h>
  39 #include <linux/inetdevice.h>
  40 #include <net/addrconf.h>
  41
  42 #include <trace/events/neigh.h>
  43
  44 #define NEIGH_DEBUG 1
  45 #define neigh_dbg(level, fmt, ...)              \
  46 do {                                            \
  47         if (level <= NEIGH_DEBUG)               \
  48                 pr_debug(fmt, ##__VA_ARGS__);   \
  49 } while (0)
  50
  51 #define PNEIGH_HASHMASK         0xF
  52
  53 static void neigh_timer_handler(struct timer_list *t);
  54 static void __neigh_notify(struct neighbour *n, int type, int flags,
  55                            u32 pid);
  56 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  57 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
  58                                     struct net_device *dev);
  59
  60 #ifdef CONFIG_PROC_FS
  61 static const struct seq_operations neigh_stat_seq_ops;
  62 #endif
  63
  64 /*
  65    Neighbour hash table buckets are protected with rwlock tbl->lock.
  66
  67    - All the scans/updates to hash buckets MUST be made under this lock.
  68    - NOTHING clever should be made under this lock: no callbacks
  69      to protocol backends, no attempts to send something to network.
  70      It will result in deadlocks, if backend/driver wants to use neighbour
  71      cache.
  72    - If the entry requires some non-trivial actions, increase
  73      its reference count and release table lock.
  74
  75    Neighbour entries are protected:
  76    - with reference count.
  77    - with rwlock neigh->lock
  78
  79    Reference count prevents destruction.
  80
  81    neigh->lock mainly serializes ll address data and its validity state.
  82    However, the same lock is used to protect another entry fields:
  83     - timer
  84     - resolution queue
  85
  86    Again, nothing clever shall be made under neigh->lock,
  87    the most complicated procedure, which we allow is dev->hard_header.
  88    It is supposed, that dev->hard_header is simplistic and does
  89    not make callbacks to neighbour tables.
  90  */
  91
  92 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  93 {
  94         kfree_skb(skb);
  95         return -ENETDOWN;
  96 }
  97
  98 static void neigh_cleanup_and_release(struct neighbour *neigh)
  99 {
 100         trace_neigh_cleanup_and_release(neigh, 0);
 101         __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 102         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 103         neigh_release(neigh);
 104 }
 105
 106 /*
 107  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 108  * It corresponds to default IPv6 settings and is not overridable,
 109  * because it is really reasonable choice.
 110  */
 111
 112 unsigned long neigh_rand_reach_time(unsigned long base)
 113 {
 114         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 115 }
 116 EXPORT_SYMBOL(neigh_rand_reach_time);
 117
 118 static void neigh_mark_dead(struct neighbour *n)
 119 {
 120         n->dead = 1;
 121         if (!list_empty(&n->gc_list)) {
 122                 list_del_init(&n->gc_list);
 123                 atomic_dec(&n->tbl->gc_entries);
 124         }
 125 }
 126
 127 static void neigh_update_gc_list(struct neighbour *n)
 128 {
 129         bool on_gc_list, exempt_from_gc;
 130
 131         write_lock_bh(&n->tbl->lock);
 132         write_lock(&n->lock);
 133
 134         if (n->dead)
 135                 goto out;
 136
 137         /* remove from the gc list if new state is permanent or if neighbor
 138          * is externally learned; otherwise entry should be on the gc list
 139          */
 140         exempt_from_gc = n->nud_state & NUD_PERMANENT ||
 141                          n->flags & NTF_EXT_LEARNED;
 142         on_gc_list = !list_empty(&n->gc_list);
 143
 144         if (exempt_from_gc && on_gc_list) {
 145                 list_del_init(&n->gc_list);
 146                 atomic_dec(&n->tbl->gc_entries);
 147         } else if (!exempt_from_gc && !on_gc_list) {
 148                 /* add entries to the tail; cleaning removes from the front */
 149                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 150                 atomic_inc(&n->tbl->gc_entries);
 151         }
 152
 153 out:
 154         write_unlock(&n->lock);
 155         write_unlock_bh(&n->tbl->lock);
 156 }
 157
 158 static bool neigh_update_ext_learned(struct neighbour *neigh, u32 flags,
 159                                      int *notify)
 160 {
 161         bool rc = false;
 162         u8 ndm_flags;
 163
 164         if (!(flags & NEIGH_UPDATE_F_ADMIN))
 165                 return rc;
 166
 167         ndm_flags = (flags & NEIGH_UPDATE_F_EXT_LEARNED) ? NTF_EXT_LEARNED : 0;
 168         if ((neigh->flags ^ ndm_flags) & NTF_EXT_LEARNED) {
 169                 if (ndm_flags & NTF_EXT_LEARNED)
 170                         neigh->flags |= NTF_EXT_LEARNED;
 171                 else
 172                         neigh->flags &= ~NTF_EXT_LEARNED;
 173                 rc = true;
 174                 *notify = 1;
 175         }
 176
 177         return rc;
 178 }
 179
 180 static bool neigh_del(struct neighbour *n, struct neighbour __rcu **np,
 181                       struct neigh_table *tbl)
 182 {
 183         bool retval = false;
 184
 185         write_lock(&n->lock);
 186         if (refcount_read(&n->refcnt) == 1) {
 187                 struct neighbour *neigh;
 188
 189                 neigh = rcu_dereference_protected(n->next,
 190                                                   lockdep_is_held(&tbl->lock));
 191                 rcu_assign_pointer(*np, neigh);
 192                 neigh_mark_dead(n);
 193                 retval = true;
 194         }
 195         write_unlock(&n->lock);
 196         if (retval)
 197                 neigh_cleanup_and_release(n);
 198         return retval;
 199 }
 200
 201 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 202 {
 203         struct neigh_hash_table *nht;
 204         void *pkey = ndel->primary_key;
 205         u32 hash_val;
 206         struct neighbour *n;
 207         struct neighbour __rcu **np;
 208
 209         nht = rcu_dereference_protected(tbl->nht,
 210                                         lockdep_is_held(&tbl->lock));
 211         hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
 212         hash_val = hash_val >> (32 - nht->hash_shift);
 213
 214         np = &nht->hash_buckets[hash_val];
 215         while ((n = rcu_dereference_protected(*np,
 216                                               lockdep_is_held(&tbl->lock)))) {
 217                 if (n == ndel)
 218                         return neigh_del(n, np, tbl);
 219                 np = &n->next;
 220         }
 221         return false;
 222 }
 223
 224 static int neigh_forced_gc(struct neigh_table *tbl)
 225 {
 226         int max_clean = atomic_read(&tbl->gc_entries) - tbl->gc_thresh2;
 227         unsigned long tref = jiffies - 5 * HZ;
 228         struct neighbour *n, *tmp;
 229         int shrunk = 0;
 230
 231         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 232
 233         write_lock_bh(&tbl->lock);
 234
 235         list_for_each_entry_safe(n, tmp, &tbl->gc_list, gc_list) {
 236                 if (refcount_read(&n->refcnt) == 1) {
 237                         bool remove = false;
 238
 239                         write_lock(&n->lock);
 240                         if ((n->nud_state == NUD_FAILED) ||
 241                             (n->nud_state == NUD_NOARP) ||
 242                             (tbl->is_multicast &&
 243                              tbl->is_multicast(n->primary_key)) ||
 244                             time_after(tref, n->updated))
 245                                 remove = true;
 246                         write_unlock(&n->lock);
 247
 248                         if (remove && neigh_remove_one(n, tbl))
 249                                 shrunk++;
 250                         if (shrunk >= max_clean)
 251                                 break;
 252                 }
 253         }
 254
 255         tbl->last_flush = jiffies;
 256
 257         write_unlock_bh(&tbl->lock);
 258
 259         return shrunk;
 260 }
 261
 262 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 263 {
 264         neigh_hold(n);
 265         if (unlikely(mod_timer(&n->timer, when))) {
 266                 printk("NEIGH: BUG, double timer add, state is %x\n",
 267                        n->nud_state);
 268                 dump_stack();
 269         }
 270 }
 271
 272 static int neigh_del_timer(struct neighbour *n)
 273 {
 274         if ((n->nud_state & NUD_IN_TIMER) &&
 275             del_timer(&n->timer)) {
 276                 neigh_release(n);
 277                 return 1;
 278         }
 279         return 0;
 280 }
 281
 282 static void pneigh_queue_purge(struct sk_buff_head *list)
 283 {
 284         struct sk_buff *skb;
 285
 286         while ((skb = skb_dequeue(list)) != NULL) {
 287                 dev_put(skb->dev);
 288                 kfree_skb(skb);
 289         }
 290 }
 291
 292 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev,
 293                             bool skip_perm)
 294 {
 295         int i;
 296         struct neigh_hash_table *nht;
 297
 298         nht = rcu_dereference_protected(tbl->nht,
 299                                         lockdep_is_held(&tbl->lock));
 300
 301         for (i = 0; i < (1 << nht->hash_shift); i++) {
 302                 struct neighbour *n;
 303                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 304
 305                 while ((n = rcu_dereference_protected(*np,
 306                                         lockdep_is_held(&tbl->lock))) != NULL) {
 307                         if (dev && n->dev != dev) {
 308                                 np = &n->next;
 309                                 continue;
 310                         }
 311                         if (skip_perm && n->nud_state & NUD_PERMANENT) {
 312                                 np = &n->next;
 313                                 continue;
 314                         }
 315                         rcu_assign_pointer(*np,
 316                                    rcu_dereference_protected(n->next,
 317                                                 lockdep_is_held(&tbl->lock)));
 318                         write_lock(&n->lock);
 319                         neigh_del_timer(n);
 320                         neigh_mark_dead(n);
 321                         if (refcount_read(&n->refcnt) != 1) {
 322                                 /* The most unpleasant situation.
 323                                    We must destroy neighbour entry,
 324                                    but someone still uses it.
 325
 326                                    The destroy will be delayed until
 327                                    the last user releases us, but
 328                                    we must kill timers etc. and move
 329                                    it to safe state.
 330                                  */
 331                                 __skb_queue_purge(&n->arp_queue);
 332                                 n->arp_queue_len_bytes = 0;
 333                                 n->output = neigh_blackhole;
 334                                 if (n->nud_state & NUD_VALID)
 335                                         n->nud_state = NUD_NOARP;
 336                                 else
 337                                         n->nud_state = NUD_NONE;
 338                                 neigh_dbg(2, "neigh %p is stray\n", n);
 339                         }
 340                         write_unlock(&n->lock);
 341                         neigh_cleanup_and_release(n);
 342                 }
 343         }
 344 }
 345
 346 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 347 {
 348         write_lock_bh(&tbl->lock);
 349         neigh_flush_dev(tbl, dev, false);
 350         write_unlock_bh(&tbl->lock);
 351 }
 352 EXPORT_SYMBOL(neigh_changeaddr);
 353
 354 static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
 355                           bool skip_perm)
 356 {
 357         write_lock_bh(&tbl->lock);
 358         neigh_flush_dev(tbl, dev, skip_perm);
 359         pneigh_ifdown_and_unlock(tbl, dev);
 360
 361         del_timer_sync(&tbl->proxy_timer);
 362         pneigh_queue_purge(&tbl->proxy_queue);
 363         return 0;
 364 }
 365
 366 int neigh_carrier_down(struct neigh_table *tbl, struct net_device *dev)
 367 {
 368         __neigh_ifdown(tbl, dev, true);
 369         return 0;
 370 }
 371 EXPORT_SYMBOL(neigh_carrier_down);
 372
 373 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 374 {
 375         __neigh_ifdown(tbl, dev, false);
 376         return 0;
 377 }
 378 EXPORT_SYMBOL(neigh_ifdown);
 379
 380 static struct neighbour *neigh_alloc(struct neigh_table *tbl,
 381                                      struct net_device *dev,
 382                                      u8 flags, bool exempt_from_gc)
 383 {
 384         struct neighbour *n = NULL;
 385         unsigned long now = jiffies;
 386         int entries;
 387
 388         if (exempt_from_gc)
 389                 goto do_alloc;
 390
 391         entries = atomic_inc_return(&tbl->gc_entries) - 1;
 392         if (entries >= tbl->gc_thresh3 ||
 393             (entries >= tbl->gc_thresh2 &&
 394              time_after(now, tbl->last_flush + 5 * HZ))) {
 395                 if (!neigh_forced_gc(tbl) &&
 396                     entries >= tbl->gc_thresh3) {
 397                         net_info_ratelimited("%s: neighbor table overflow!\n",
 398                                              tbl->id);
 399                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 400                         goto out_entries;
 401                 }
 402         }
 403
 404 do_alloc:
 405         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 406         if (!n)
 407                 goto out_entries;
 408
 409         __skb_queue_head_init(&n->arp_queue);
 410         rwlock_init(&n->lock);
 411         seqlock_init(&n->ha_lock);
 412         n->updated        = n->used = now;
 413         n->nud_state      = NUD_NONE;
 414         n->output         = neigh_blackhole;
 415         n->flags          = flags;
 416         seqlock_init(&n->hh.hh_lock);
 417         n->parms          = neigh_parms_clone(&tbl->parms);
 418         timer_setup(&n->timer, neigh_timer_handler, 0);
 419
 420         NEIGH_CACHE_STAT_INC(tbl, allocs);
 421         n->tbl            = tbl;
 422         refcount_set(&n->refcnt, 1);
 423         n->dead           = 1;
 424         INIT_LIST_HEAD(&n->gc_list);
 425
 426         atomic_inc(&tbl->entries);
 427 out:
 428         return n;
 429
 430 out_entries:
 431         if (!exempt_from_gc)
 432                 atomic_dec(&tbl->gc_entries);
 433         goto out;
 434 }
 435
 436 static void neigh_get_hash_rnd(u32 *x)
 437 {
 438         *x = get_random_u32() | 1;
 439 }
 440
 441 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 442 {
 443         size_t size = (1 << shift) * sizeof(struct neighbour *);
 444         struct neigh_hash_table *ret;
 445         struct neighbour __rcu **buckets;
 446         int i;
 447
 448         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 449         if (!ret)
 450                 return NULL;
 451         if (size <= PAGE_SIZE) {
 452                 buckets = kzalloc(size, GFP_ATOMIC);
 453         } else {
 454                 buckets = (struct neighbour __rcu **)
 455                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 456                                            get_order(size));
 457                 kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
 458         }
 459         if (!buckets) {
 460                 kfree(ret);
 461                 return NULL;
 462         }
 463         ret->hash_buckets = buckets;
 464         ret->hash_shift = shift;
 465         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 466                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 467         return ret;
 468 }
 469
 470 static void neigh_hash_free_rcu(struct rcu_head *head)
 471 {
 472         struct neigh_hash_table *nht = container_of(head,
 473                                                     struct neigh_hash_table,
 474                                                     rcu);
 475         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 476         struct neighbour __rcu **buckets = nht->hash_buckets;
 477
 478         if (size <= PAGE_SIZE) {
 479                 kfree(buckets);
 480         } else {
 481                 kmemleak_free(buckets);
 482                 free_pages((unsigned long)buckets, get_order(size));
 483         }
 484         kfree(nht);
 485 }
 486
 487 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 488                                                 unsigned long new_shift)
 489 {
 490         unsigned int i, hash;
 491         struct neigh_hash_table *new_nht, *old_nht;
 492
 493         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 494
 495         old_nht = rcu_dereference_protected(tbl->nht,
 496                                             lockdep_is_held(&tbl->lock));
 497         new_nht = neigh_hash_alloc(new_shift);
 498         if (!new_nht)
 499                 return old_nht;
 500
 501         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 502                 struct neighbour *n, *next;
 503
 504                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 505                                                    lockdep_is_held(&tbl->lock));
 506                      n != NULL;
 507                      n = next) {
 508                         hash = tbl->hash(n->primary_key, n->dev,
 509                                          new_nht->hash_rnd);
 510
 511                         hash >>= (32 - new_nht->hash_shift);
 512                         next = rcu_dereference_protected(n->next,
 513                                                 lockdep_is_held(&tbl->lock));
 514
 515                         rcu_assign_pointer(n->next,
 516                                            rcu_dereference_protected(
 517                                                 new_nht->hash_buckets[hash],
 518                                                 lockdep_is_held(&tbl->lock)));
 519                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 520                 }
 521         }
 522
 523         rcu_assign_pointer(tbl->nht, new_nht);
 524         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 525         return new_nht;
 526 }
 527
 528 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 529                                struct net_device *dev)
 530 {
 531         struct neighbour *n;
 532
 533         NEIGH_CACHE_STAT_INC(tbl, lookups);
 534
 535         rcu_read_lock_bh();
 536         n = __neigh_lookup_noref(tbl, pkey, dev);
 537         if (n) {
 538                 if (!refcount_inc_not_zero(&n->refcnt))
 539                         n = NULL;
 540                 NEIGH_CACHE_STAT_INC(tbl, hits);
 541         }
 542
 543         rcu_read_unlock_bh();
 544         return n;
 545 }
 546 EXPORT_SYMBOL(neigh_lookup);
 547
 548 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 549                                      const void *pkey)
 550 {
 551         struct neighbour *n;
 552         unsigned int key_len = tbl->key_len;
 553         u32 hash_val;
 554         struct neigh_hash_table *nht;
 555
 556         NEIGH_CACHE_STAT_INC(tbl, lookups);
 557
 558         rcu_read_lock_bh();
 559         nht = rcu_dereference_bh(tbl->nht);
 560         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 561
 562         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 563              n != NULL;
 564              n = rcu_dereference_bh(n->next)) {
 565                 if (!memcmp(n->primary_key, pkey, key_len) &&
 566                     net_eq(dev_net(n->dev), net)) {
 567                         if (!refcount_inc_not_zero(&n->refcnt))
 568                                 n = NULL;
 569                         NEIGH_CACHE_STAT_INC(tbl, hits);
 570                         break;
 571                 }
 572         }
 573
 574         rcu_read_unlock_bh();
 575         return n;
 576 }
 577 EXPORT_SYMBOL(neigh_lookup_nodev);
 578
 579 static struct neighbour *
 580 ___neigh_create(struct neigh_table *tbl, const void *pkey,
 581                 struct net_device *dev, u8 flags,
 582                 bool exempt_from_gc, bool want_ref)
 583 {
 584         u32 hash_val, key_len = tbl->key_len;
 585         struct neighbour *n1, *rc, *n;
 586         struct neigh_hash_table *nht;
 587         int error;
 588
 589         n = neigh_alloc(tbl, dev, flags, exempt_from_gc);
 590         trace_neigh_create(tbl, dev, pkey, n, exempt_from_gc);
 591         if (!n) {
 592                 rc = ERR_PTR(-ENOBUFS);
 593                 goto out;
 594         }
 595
 596         memcpy(n->primary_key, pkey, key_len);
 597         n->dev = dev;
 598         dev_hold(dev);
 599
 600         /* Protocol specific setup. */
 601         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 602                 rc = ERR_PTR(error);
 603                 goto out_neigh_release;
 604         }
 605
 606         if (dev->netdev_ops->ndo_neigh_construct) {
 607                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 608                 if (error < 0) {
 609                         rc = ERR_PTR(error);
 610                         goto out_neigh_release;
 611                 }
 612         }
 613
 614         /* Device specific setup. */
 615         if (n->parms->neigh_setup &&
 616             (error = n->parms->neigh_setup(n)) < 0) {
 617                 rc = ERR_PTR(error);
 618                 goto out_neigh_release;
 619         }
 620
 621         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 622
 623         write_lock_bh(&tbl->lock);
 624         nht = rcu_dereference_protected(tbl->nht,
 625                                         lockdep_is_held(&tbl->lock));
 626
 627         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 628                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 629
 630         hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 631
 632         if (n->parms->dead) {
 633                 rc = ERR_PTR(-EINVAL);
 634                 goto out_tbl_unlock;
 635         }
 636
 637         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 638                                             lockdep_is_held(&tbl->lock));
 639              n1 != NULL;
 640              n1 = rcu_dereference_protected(n1->next,
 641                         lockdep_is_held(&tbl->lock))) {
 642                 if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) {
 643                         if (want_ref)
 644                                 neigh_hold(n1);
 645                         rc = n1;
 646                         goto out_tbl_unlock;
 647                 }
 648         }
 649
 650         n->dead = 0;
 651         if (!exempt_from_gc)
 652                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 653
 654         if (want_ref)
 655                 neigh_hold(n);
 656         rcu_assign_pointer(n->next,
 657                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 658                                                      lockdep_is_held(&tbl->lock)));
 659         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 660         write_unlock_bh(&tbl->lock);
 661         neigh_dbg(2, "neigh %p is created\n", n);
 662         rc = n;
 663 out:
 664         return rc;
 665 out_tbl_unlock:
 666         write_unlock_bh(&tbl->lock);
 667 out_neigh_release:
 668         if (!exempt_from_gc)
 669                 atomic_dec(&tbl->gc_entries);
 670         neigh_release(n);
 671         goto out;
 672 }
 673
 674 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 675                                  struct net_device *dev, bool want_ref)
 676 {
 677         return ___neigh_create(tbl, pkey, dev, 0, false, want_ref);
 678 }
 679 EXPORT_SYMBOL(__neigh_create);
 680
 681 static u32 pneigh_hash(const void *pkey, unsigned int key_len)
 682 {
 683         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 684         hash_val ^= (hash_val >> 16);
 685         hash_val ^= hash_val >> 8;
 686         hash_val ^= hash_val >> 4;
 687         hash_val &= PNEIGH_HASHMASK;
 688         return hash_val;
 689 }
 690
 691 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 692                                               struct net *net,
 693                                               const void *pkey,
 694                                               unsigned int key_len,
 695                                               struct net_device *dev)
 696 {
 697         while (n) {
 698                 if (!memcmp(n->key, pkey, key_len) &&
 699                     net_eq(pneigh_net(n), net) &&
 700                     (n->dev == dev || !n->dev))
 701                         return n;
 702                 n = n->next;
 703         }
 704         return NULL;
 705 }
 706
 707 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 708                 struct net *net, const void *pkey, struct net_device *dev)
 709 {
 710         unsigned int key_len = tbl->key_len;
 711         u32 hash_val = pneigh_hash(pkey, key_len);
 712
 713         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 714                                  net, pkey, key_len, dev);
 715 }
 716 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 717
 718 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 719                                     struct net *net, const void *pkey,
 720                                     struct net_device *dev, int creat)
 721 {
 722         struct pneigh_entry *n;
 723         unsigned int key_len = tbl->key_len;
 724         u32 hash_val = pneigh_hash(pkey, key_len);
 725
 726         read_lock_bh(&tbl->lock);
 727         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 728                               net, pkey, key_len, dev);
 729         read_unlock_bh(&tbl->lock);
 730
 731         if (n || !creat)
 732                 goto out;
 733
 734         ASSERT_RTNL();
 735
 736         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 737         if (!n)
 738                 goto out;
 739
 740         n->protocol = 0;
 741         write_pnet(&n->net, net);
 742         memcpy(n->key, pkey, key_len);
 743         n->dev = dev;
 744         dev_hold(dev);
 745
 746         if (tbl->pconstructor && tbl->pconstructor(n)) {
 747                 dev_put(dev);
 748                 kfree(n);
 749                 n = NULL;
 750                 goto out;
 751         }
 752
 753         write_lock_bh(&tbl->lock);
 754         n->next = tbl->phash_buckets[hash_val];
 755         tbl->phash_buckets[hash_val] = n;
 756         write_unlock_bh(&tbl->lock);
 757 out:
 758         return n;
 759 }
 760 EXPORT_SYMBOL(pneigh_lookup);
 761
 762
 763 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 764                   struct net_device *dev)
 765 {
 766         struct pneigh_entry *n, **np;
 767         unsigned int key_len = tbl->key_len;
 768         u32 hash_val = pneigh_hash(pkey, key_len);
 769
 770         write_lock_bh(&tbl->lock);
 771         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 772              np = &n->next) {
 773                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 774                     net_eq(pneigh_net(n), net)) {
 775                         *np = n->next;
 776                         write_unlock_bh(&tbl->lock);
 777                         if (tbl->pdestructor)
 778                                 tbl->pdestructor(n);
 779                         dev_put(n->dev);
 780                         kfree(n);
 781                         return 0;
 782                 }
 783         }
 784         write_unlock_bh(&tbl->lock);
 785         return -ENOENT;
 786 }
 787
 788 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
 789                                     struct net_device *dev)
 790 {
 791         struct pneigh_entry *n, **np, *freelist = NULL;
 792         u32 h;
 793
 794         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 795                 np = &tbl->phash_buckets[h];
 796                 while ((n = *np) != NULL) {
 797                         if (!dev || n->dev == dev) {
 798                                 *np = n->next;
 799                                 n->next = freelist;
 800                                 freelist = n;
 801                                 continue;
 802                         }
 803                         np = &n->next;
 804                 }
 805         }
 806         write_unlock_bh(&tbl->lock);
 807         while ((n = freelist)) {
 808                 freelist = n->next;
 809                 n->next = NULL;
 810                 if (tbl->pdestructor)
 811                         tbl->pdestructor(n);
 812                 dev_put(n->dev);
 813                 kfree(n);
 814         }
 815         return -ENOENT;
 816 }
 817
 818 static void neigh_parms_destroy(struct neigh_parms *parms);
 819
 820 static inline void neigh_parms_put(struct neigh_parms *parms)
 821 {
 822         if (refcount_dec_and_test(&parms->refcnt))
 823                 neigh_parms_destroy(parms);
 824 }
 825
 826 /*
 827  *      neighbour must already be out of the table;
 828  *
 829  */
 830 void neigh_destroy(struct neighbour *neigh)
 831 {
 832         struct net_device *dev = neigh->dev;
 833
 834         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 835
 836         if (!neigh->dead) {
 837                 pr_warn("Destroying alive neighbour %p\n", neigh);
 838                 dump_stack();
 839                 return;
 840         }
 841
 842         if (neigh_del_timer(neigh))
 843                 pr_warn("Impossible event\n");
 844
 845         write_lock_bh(&neigh->lock);
 846         __skb_queue_purge(&neigh->arp_queue);
 847         write_unlock_bh(&neigh->lock);
 848         neigh->arp_queue_len_bytes = 0;
 849
 850         if (dev->netdev_ops->ndo_neigh_destroy)
 851                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 852
 853         dev_put(dev);
 854         neigh_parms_put(neigh->parms);
 855
 856         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 857
 858         atomic_dec(&neigh->tbl->entries);
 859         kfree_rcu(neigh, rcu);
 860 }
 861 EXPORT_SYMBOL(neigh_destroy);
 862
 863 /* Neighbour state is suspicious;
 864    disable fast path.
 865
 866    Called with write_locked neigh.
 867  */
 868 static void neigh_suspect(struct neighbour *neigh)
 869 {
 870         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 871
 872         neigh->output = neigh->ops->output;
 873 }
 874
 875 /* Neighbour state is OK;
 876    enable fast path.
 877
 878    Called with write_locked neigh.
 879  */
 880 static void neigh_connect(struct neighbour *neigh)
 881 {
 882         neigh_dbg(2, "neigh %p is connected\n", neigh);
 883
 884         neigh->output = neigh->ops->connected_output;
 885 }
 886
 887 static void neigh_periodic_work(struct work_struct *work)
 888 {
 889         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 890         struct neighbour *n;
 891         struct neighbour __rcu **np;
 892         unsigned int i;
 893         struct neigh_hash_table *nht;
 894
 895         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 896
 897         write_lock_bh(&tbl->lock);
 898         nht = rcu_dereference_protected(tbl->nht,
 899                                         lockdep_is_held(&tbl->lock));
 900
 901         /*
 902          *      periodically recompute ReachableTime from random function
 903          */
 904
 905         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 906                 struct neigh_parms *p;
 907                 tbl->last_rand = jiffies;
 908                 list_for_each_entry(p, &tbl->parms_list, list)
 909                         p->reachable_time =
 910                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 911         }
 912
 913         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 914                 goto out;
 915
 916         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 917                 np = &nht->hash_buckets[i];
 918
 919                 while ((n = rcu_dereference_protected(*np,
 920                                 lockdep_is_held(&tbl->lock))) != NULL) {
 921                         unsigned int state;
 922
 923                         write_lock(&n->lock);
 924
 925                         state = n->nud_state;
 926                         if ((state & (NUD_PERMANENT | NUD_IN_TIMER)) ||
 927                             (n->flags & NTF_EXT_LEARNED)) {
 928                                 write_unlock(&n->lock);
 929                                 goto next_elt;
 930                         }
 931
 932                         if (time_before(n->used, n->confirmed))
 933                                 n->used = n->confirmed;
 934
 935                         if (refcount_read(&n->refcnt) == 1 &&
 936                             (state == NUD_FAILED ||
 937                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 938                                 *np = n->next;
 939                                 neigh_mark_dead(n);
 940                                 write_unlock(&n->lock);
 941                                 neigh_cleanup_and_release(n);
 942                                 continue;
 943                         }
 944                         write_unlock(&n->lock);
 945
 946 next_elt:
 947                         np = &n->next;
 948                 }
 949                 /*
 950                  * It's fine to release lock here, even if hash table
 951                  * grows while we are preempted.
 952                  */
 953                 write_unlock_bh(&tbl->lock);
 954                 cond_resched();
 955                 write_lock_bh(&tbl->lock);
 956                 nht = rcu_dereference_protected(tbl->nht,
 957                                                 lockdep_is_held(&tbl->lock));
 958         }
 959 out:
 960         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 961          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 962          * BASE_REACHABLE_TIME.
 963          */
 964         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 965                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 966         write_unlock_bh(&tbl->lock);
 967 }
 968
 969 static __inline__ int neigh_max_probes(struct neighbour *n)
 970 {
 971         struct neigh_parms *p = n->parms;
 972         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 973                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 974                 NEIGH_VAR(p, MCAST_PROBES));
 975 }
 976
 977 static void neigh_invalidate(struct neighbour *neigh)
 978         __releases(neigh->lock)
 979         __acquires(neigh->lock)
 980 {
 981         struct sk_buff *skb;
 982
 983         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 984         neigh_dbg(2, "neigh %p is failed\n", neigh);
 985         neigh->updated = jiffies;
 986
 987         /* It is very thin place. report_unreachable is very complicated
 988            routine. Particularly, it can hit the same neighbour entry!
 989
 990            So that, we try to be accurate and avoid dead loop. --ANK
 991          */
 992         while (neigh->nud_state == NUD_FAILED &&
 993                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 994                 write_unlock(&neigh->lock);
 995                 neigh->ops->error_report(neigh, skb);
 996                 write_lock(&neigh->lock);
 997         }
 998         __skb_queue_purge(&neigh->arp_queue);
 999         neigh->arp_queue_len_bytes = 0;
1000 }
1001
1002 static void neigh_probe(struct neighbour *neigh)
1003         __releases(neigh->lock)
1004 {
1005         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
1006         /* keep skb alive even if arp_queue overflows */
1007         if (skb)
1008                 skb = skb_clone(skb, GFP_ATOMIC);
1009         write_unlock(&neigh->lock);
1010         if (neigh->ops->solicit)
1011                 neigh->ops->solicit(neigh, skb);
1012         atomic_inc(&neigh->probes);
1013         consume_skb(skb);
1014 }
1015
1016 /* Called when a timer expires for a neighbour entry. */
1017
1018 static void neigh_timer_handler(struct timer_list *t)
1019 {
1020         unsigned long now, next;
1021         struct neighbour *neigh = from_timer(neigh, t, timer);
1022         unsigned int state;
1023         int notify = 0;
1024
1025         write_lock(&neigh->lock);
1026
1027         state = neigh->nud_state;
1028         now = jiffies;
1029         next = now + HZ;
1030
1031         if (!(state & NUD_IN_TIMER))
1032                 goto out;
1033
1034         if (state & NUD_REACHABLE) {
1035                 if (time_before_eq(now,
1036                                    neigh->confirmed + neigh->parms->reachable_time)) {
1037                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
1038                         next = neigh->confirmed + neigh->parms->reachable_time;
1039                 } else if (time_before_eq(now,
1040                                           neigh->used +
1041                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1042                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
1043                         neigh->nud_state = NUD_DELAY;
1044                         neigh->updated = jiffies;
1045                         neigh_suspect(neigh);
1046                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
1047                 } else {
1048                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
1049                         neigh->nud_state = NUD_STALE;
1050                         neigh->updated = jiffies;
1051                         neigh_suspect(neigh);
1052                         notify = 1;
1053                 }
1054         } else if (state & NUD_DELAY) {
1055                 if (time_before_eq(now,
1056                                    neigh->confirmed +
1057                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1058                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
1059                         neigh->nud_state = NUD_REACHABLE;
1060                         neigh->updated = jiffies;
1061                         neigh_connect(neigh);
1062                         notify = 1;
1063                         next = neigh->confirmed + neigh->parms->reachable_time;
1064                 } else {
1065                         neigh_dbg(2, "neigh %p is probed\n", neigh);
1066                         neigh->nud_state = NUD_PROBE;
1067                         neigh->updated = jiffies;
1068                         atomic_set(&neigh->probes, 0);
1069                         notify = 1;
1070                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1071                                          HZ/100);
1072                 }
1073         } else {
1074                 /* NUD_PROBE|NUD_INCOMPLETE */
1075                 next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME), HZ/100);
1076         }
1077
1078         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
1079             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
1080                 neigh->nud_state = NUD_FAILED;
1081                 notify = 1;
1082                 neigh_invalidate(neigh);
1083                 goto out;
1084         }
1085
1086         if (neigh->nud_state & NUD_IN_TIMER) {
1087                 if (time_before(next, jiffies + HZ/100))
1088                         next = jiffies + HZ/100;
1089                 if (!mod_timer(&neigh->timer, next))
1090                         neigh_hold(neigh);
1091         }
1092         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
1093                 neigh_probe(neigh);
1094         } else {
1095 out:
1096                 write_unlock(&neigh->lock);
1097         }
1098
1099         if (notify)
1100                 neigh_update_notify(neigh, 0);
1101
1102         trace_neigh_timer_handler(neigh, 0);
1103
1104         neigh_release(neigh);
1105 }
1106
1107 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
1108 {
1109         int rc;
1110         bool immediate_probe = false;
1111
1112         write_lock_bh(&neigh->lock);
1113
1114         rc = 0;
1115         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1116                 goto out_unlock_bh;
1117         if (neigh->dead)
1118                 goto out_dead;
1119
1120         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1121                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1122                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
1123                         unsigned long next, now = jiffies;
1124
1125                         atomic_set(&neigh->probes,
1126                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
1127                         neigh_del_timer(neigh);
1128                         neigh->nud_state     = NUD_INCOMPLETE;
1129                         neigh->updated = now;
1130                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1131                                          HZ/100);
1132                         neigh_add_timer(neigh, next);
1133                         immediate_probe = true;
1134                 } else {
1135                         neigh->nud_state = NUD_FAILED;
1136                         neigh->updated = jiffies;
1137                         write_unlock_bh(&neigh->lock);
1138
1139                         kfree_skb(skb);
1140                         return 1;
1141                 }
1142         } else if (neigh->nud_state & NUD_STALE) {
1143                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1144                 neigh_del_timer(neigh);
1145                 neigh->nud_state = NUD_DELAY;
1146                 neigh->updated = jiffies;
1147                 neigh_add_timer(neigh, jiffies +
1148                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1149         }
1150
1151         if (neigh->nud_state == NUD_INCOMPLETE) {
1152                 if (skb) {
1153                         while (neigh->arp_queue_len_bytes + skb->truesize >
1154                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1155                                 struct sk_buff *buff;
1156
1157                                 buff = __skb_dequeue(&neigh->arp_queue);
1158                                 if (!buff)
1159                                         break;
1160                                 neigh->arp_queue_len_bytes -= buff->truesize;
1161                                 kfree_skb(buff);
1162                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1163                         }
1164                         skb_dst_force(skb);
1165                         __skb_queue_tail(&neigh->arp_queue, skb);
1166                         neigh->arp_queue_len_bytes += skb->truesize;
1167                 }
1168                 rc = 1;
1169         }
1170 out_unlock_bh:
1171         if (immediate_probe)
1172                 neigh_probe(neigh);
1173         else
1174                 write_unlock(&neigh->lock);
1175         local_bh_enable();
1176         trace_neigh_event_send_done(neigh, rc);
1177         return rc;
1178
1179 out_dead:
1180         if (neigh->nud_state & NUD_STALE)
1181                 goto out_unlock_bh;
1182         write_unlock_bh(&neigh->lock);
1183         kfree_skb(skb);
1184         trace_neigh_event_send_dead(neigh, 1);
1185         return 1;
1186 }
1187 EXPORT_SYMBOL(__neigh_event_send);
1188
1189 static void neigh_update_hhs(struct neighbour *neigh)
1190 {
1191         struct hh_cache *hh;
1192         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1193                 = NULL;
1194
1195         if (neigh->dev->header_ops)
1196                 update = neigh->dev->header_ops->cache_update;
1197
1198         if (update) {
1199                 hh = &neigh->hh;
1200                 if (READ_ONCE(hh->hh_len)) {
1201                         write_seqlock_bh(&hh->hh_lock);
1202                         update(hh, neigh->dev, neigh->ha);
1203                         write_sequnlock_bh(&hh->hh_lock);
1204                 }
1205         }
1206 }
1207
1208
1209
1210 /* Generic update routine.
1211    -- lladdr is new lladdr or NULL, if it is not supplied.
1212    -- new    is new state.
1213    -- flags
1214         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1215                                 if it is different.
1216         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1217                                 lladdr instead of overriding it
1218                                 if it is different.
1219         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1220
1221         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1222                                 NTF_ROUTER flag.
1223         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1224                                 a router.
1225
1226    Caller MUST hold reference count on the entry.
1227  */
1228
1229 static int __neigh_update(struct neighbour *neigh, const u8 *lladdr,
1230                           u8 new, u32 flags, u32 nlmsg_pid,
1231                           struct netlink_ext_ack *extack)
1232 {
1233         bool ext_learn_change = false;
1234         u8 old;
1235         int err;
1236         int notify = 0;
1237         struct net_device *dev;
1238         int update_isrouter = 0;
1239
1240         trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid);
1241
1242         write_lock_bh(&neigh->lock);
1243
1244         dev    = neigh->dev;
1245         old    = neigh->nud_state;
1246         err    = -EPERM;
1247
1248         if (neigh->dead) {
1249                 NL_SET_ERR_MSG(extack, "Neighbor entry is now dead");
1250                 new = old;
1251                 goto out;
1252         }
1253         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1254             (old & (NUD_NOARP | NUD_PERMANENT)))
1255                 goto out;
1256
1257         ext_learn_change = neigh_update_ext_learned(neigh, flags, &notify);
1258
1259         if (!(new & NUD_VALID)) {
1260                 neigh_del_timer(neigh);
1261                 if (old & NUD_CONNECTED)
1262                         neigh_suspect(neigh);
1263                 neigh->nud_state = new;
1264                 err = 0;
1265                 notify = old & NUD_VALID;
1266                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1267                     (new & NUD_FAILED)) {
1268                         neigh_invalidate(neigh);
1269                         notify = 1;
1270                 }
1271                 goto out;
1272         }
1273
1274         /* Compare new lladdr with cached one */
1275         if (!dev->addr_len) {
1276                 /* First case: device needs no address. */
1277                 lladdr = neigh->ha;
1278         } else if (lladdr) {
1279                 /* The second case: if something is already cached
1280                    and a new address is proposed:
1281                    - compare new & old
1282                    - if they are different, check override flag
1283                  */
1284                 if ((old & NUD_VALID) &&
1285                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1286                         lladdr = neigh->ha;
1287         } else {
1288                 /* No address is supplied; if we know something,
1289                    use it, otherwise discard the request.
1290                  */
1291                 err = -EINVAL;
1292                 if (!(old & NUD_VALID)) {
1293                         NL_SET_ERR_MSG(extack, "No link layer address given");
1294                         goto out;
1295                 }
1296                 lladdr = neigh->ha;
1297         }
1298
1299         /* Update confirmed timestamp for neighbour entry after we
1300          * received ARP packet even if it doesn't change IP to MAC binding.
1301          */
1302         if (new & NUD_CONNECTED)
1303                 neigh->confirmed = jiffies;
1304
1305         /* If entry was valid and address is not changed,
1306            do not change entry state, if new one is STALE.
1307          */
1308         err = 0;
1309         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1310         if (old & NUD_VALID) {
1311                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1312                         update_isrouter = 0;
1313                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1314                             (old & NUD_CONNECTED)) {
1315                                 lladdr = neigh->ha;
1316                                 new = NUD_STALE;
1317                         } else
1318                                 goto out;
1319                 } else {
1320                         if (lladdr == neigh->ha && new == NUD_STALE &&
1321                             !(flags & NEIGH_UPDATE_F_ADMIN))
1322                                 new = old;
1323                 }
1324         }
1325
1326         /* Update timestamp only once we know we will make a change to the
1327          * neighbour entry. Otherwise we risk to move the locktime window with
1328          * noop updates and ignore relevant ARP updates.
1329          */
1330         if (new != old || lladdr != neigh->ha)
1331                 neigh->updated = jiffies;
1332
1333         if (new != old) {
1334                 neigh_del_timer(neigh);
1335                 if (new & NUD_PROBE)
1336                         atomic_set(&neigh->probes, 0);
1337                 if (new & NUD_IN_TIMER)
1338                         neigh_add_timer(neigh, (jiffies +
1339                                                 ((new & NUD_REACHABLE) ?
1340                                                  neigh->parms->reachable_time :
1341                                                  0)));
1342                 neigh->nud_state = new;
1343                 notify = 1;
1344         }
1345
1346         if (lladdr != neigh->ha) {
1347                 write_seqlock(&neigh->ha_lock);
1348                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1349                 write_sequnlock(&neigh->ha_lock);
1350                 neigh_update_hhs(neigh);
1351                 if (!(new & NUD_CONNECTED))
1352                         neigh->confirmed = jiffies -
1353                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1354                 notify = 1;
1355         }
1356         if (new == old)
1357                 goto out;
1358         if (new & NUD_CONNECTED)
1359                 neigh_connect(neigh);
1360         else
1361                 neigh_suspect(neigh);
1362         if (!(old & NUD_VALID)) {
1363                 struct sk_buff *skb;
1364
1365                 /* Again: avoid dead loop if something went wrong */
1366
1367                 while (neigh->nud_state & NUD_VALID &&
1368                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1369                         struct dst_entry *dst = skb_dst(skb);
1370                         struct neighbour *n2, *n1 = neigh;
1371                         write_unlock_bh(&neigh->lock);
1372
1373                         rcu_read_lock();
1374
1375                         /* Why not just use 'neigh' as-is?  The problem is that
1376                          * things such as shaper, eql, and sch_teql can end up
1377                          * using alternative, different, neigh objects to output
1378                          * the packet in the output path.  So what we need to do
1379                          * here is re-lookup the top-level neigh in the path so
1380                          * we can reinject the packet there.
1381                          */
1382                         n2 = NULL;
1383                         if (dst && dst->obsolete != DST_OBSOLETE_DEAD) {
1384                                 n2 = dst_neigh_lookup_skb(dst, skb);
1385                                 if (n2)
1386                                         n1 = n2;
1387                         }
1388                         n1->output(n1, skb);
1389                         if (n2)
1390                                 neigh_release(n2);
1391                         rcu_read_unlock();
1392
1393                         write_lock_bh(&neigh->lock);
1394                 }
1395                 __skb_queue_purge(&neigh->arp_queue);
1396                 neigh->arp_queue_len_bytes = 0;
1397         }
1398 out:
1399         if (update_isrouter)
1400                 neigh_update_is_router(neigh, flags, &notify);
1401         write_unlock_bh(&neigh->lock);
1402
1403         if (((new ^ old) & NUD_PERMANENT) || ext_learn_change)
1404                 neigh_update_gc_list(neigh);
1405
1406         if (notify)
1407                 neigh_update_notify(neigh, nlmsg_pid);
1408
1409         trace_neigh_update_done(neigh, err);
1410
1411         return err;
1412 }
1413
1414 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1415                  u32 flags, u32 nlmsg_pid)
1416 {
1417         return __neigh_update(neigh, lladdr, new, flags, nlmsg_pid, NULL);
1418 }
1419 EXPORT_SYMBOL(neigh_update);
1420
1421 /* Update the neigh to listen temporarily for probe responses, even if it is
1422  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1423  */
1424 void __neigh_set_probe_once(struct neighbour *neigh)
1425 {
1426         if (neigh->dead)
1427                 return;
1428         neigh->updated = jiffies;
1429         if (!(neigh->nud_state & NUD_FAILED))
1430                 return;
1431         neigh->nud_state = NUD_INCOMPLETE;
1432         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1433         neigh_add_timer(neigh,
1434                         jiffies + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1435                                       HZ/100));
1436 }
1437 EXPORT_SYMBOL(__neigh_set_probe_once);
1438
1439 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1440                                  u8 *lladdr, void *saddr,
1441                                  struct net_device *dev)
1442 {
1443         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1444                                                  lladdr || !dev->addr_len);
1445         if (neigh)
1446                 neigh_update(neigh, lladdr, NUD_STALE,
1447                              NEIGH_UPDATE_F_OVERRIDE, 0);
1448         return neigh;
1449 }
1450 EXPORT_SYMBOL(neigh_event_ns);
1451
1452 /* called with read_lock_bh(&n->lock); */
1453 static void neigh_hh_init(struct neighbour *n)
1454 {
1455         struct net_device *dev = n->dev;
1456         __be16 prot = n->tbl->protocol;
1457         struct hh_cache *hh = &n->hh;
1458
1459         write_lock_bh(&n->lock);
1460
1461         /* Only one thread can come in here and initialize the
1462          * hh_cache entry.
1463          */
1464         if (!hh->hh_len)
1465                 dev->header_ops->cache(n, hh, prot);
1466
1467         write_unlock_bh(&n->lock);
1468 }
1469
1470 /* Slow and careful. */
1471
1472 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1473 {
1474         int rc = 0;
1475
1476         if (!neigh_event_send(neigh, skb)) {
1477                 int err;
1478                 struct net_device *dev = neigh->dev;
1479                 unsigned int seq;
1480
1481                 if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
1482                         neigh_hh_init(neigh);
1483
1484                 do {
1485                         __skb_pull(skb, skb_network_offset(skb));
1486                         seq = read_seqbegin(&neigh->ha_lock);
1487                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1488                                               neigh->ha, NULL, skb->len);
1489                 } while (read_seqretry(&neigh->ha_lock, seq));
1490
1491                 if (err >= 0)
1492                         rc = dev_queue_xmit(skb);
1493                 else
1494                         goto out_kfree_skb;
1495         }
1496 out:
1497         return rc;
1498 out_kfree_skb:
1499         rc = -EINVAL;
1500         kfree_skb(skb);
1501         goto out;
1502 }
1503 EXPORT_SYMBOL(neigh_resolve_output);
1504
1505 /* As fast as possible without hh cache */
1506
1507 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1508 {
1509         struct net_device *dev = neigh->dev;
1510         unsigned int seq;
1511         int err;
1512
1513         do {
1514                 __skb_pull(skb, skb_network_offset(skb));
1515                 seq = read_seqbegin(&neigh->ha_lock);
1516                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1517                                       neigh->ha, NULL, skb->len);
1518         } while (read_seqretry(&neigh->ha_lock, seq));
1519
1520         if (err >= 0)
1521                 err = dev_queue_xmit(skb);
1522         else {
1523                 err = -EINVAL;
1524                 kfree_skb(skb);
1525         }
1526         return err;
1527 }
1528 EXPORT_SYMBOL(neigh_connected_output);
1529
1530 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1531 {
1532         return dev_queue_xmit(skb);
1533 }
1534 EXPORT_SYMBOL(neigh_direct_output);
1535
1536 static void neigh_proxy_process(struct timer_list *t)
1537 {
1538         struct neigh_table *tbl = from_timer(tbl, t, proxy_timer);
1539         long sched_next = 0;
1540         unsigned long now = jiffies;
1541         struct sk_buff *skb, *n;
1542
1543         spin_lock(&tbl->proxy_queue.lock);
1544
1545         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1546                 long tdif = NEIGH_CB(skb)->sched_next - now;
1547
1548                 if (tdif <= 0) {
1549                         struct net_device *dev = skb->dev;
1550
1551                         __skb_unlink(skb, &tbl->proxy_queue);
1552                         if (tbl->proxy_redo && netif_running(dev)) {
1553                                 rcu_read_lock();
1554                                 tbl->proxy_redo(skb);
1555                                 rcu_read_unlock();
1556                         } else {
1557                                 kfree_skb(skb);
1558                         }
1559
1560                         dev_put(dev);
1561                 } else if (!sched_next || tdif < sched_next)
1562                         sched_next = tdif;
1563         }
1564         del_timer(&tbl->proxy_timer);
1565         if (sched_next)
1566                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1567         spin_unlock(&tbl->proxy_queue.lock);
1568 }
1569
1570 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1571                     struct sk_buff *skb)
1572 {
1573         unsigned long sched_next = jiffies +
1574                         prandom_u32_max(NEIGH_VAR(p, PROXY_DELAY));
1575
1576         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1577                 kfree_skb(skb);
1578                 return;
1579         }
1580
1581         NEIGH_CB(skb)->sched_next = sched_next;
1582         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1583
1584         spin_lock(&tbl->proxy_queue.lock);
1585         if (del_timer(&tbl->proxy_timer)) {
1586                 if (time_before(tbl->proxy_timer.expires, sched_next))
1587                         sched_next = tbl->proxy_timer.expires;
1588         }
1589         skb_dst_drop(skb);
1590         dev_hold(skb->dev);
1591         __skb_queue_tail(&tbl->proxy_queue, skb);
1592         mod_timer(&tbl->proxy_timer, sched_next);
1593         spin_unlock(&tbl->proxy_queue.lock);
1594 }
1595 EXPORT_SYMBOL(pneigh_enqueue);
1596
1597 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1598                                                       struct net *net, int ifindex)
1599 {
1600         struct neigh_parms *p;
1601
1602         list_for_each_entry(p, &tbl->parms_list, list) {
1603                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1604                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1605                         return p;
1606         }
1607
1608         return NULL;
1609 }
1610
1611 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1612                                       struct neigh_table *tbl)
1613 {
1614         struct neigh_parms *p;
1615         struct net *net = dev_net(dev);
1616         const struct net_device_ops *ops = dev->netdev_ops;
1617
1618         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1619         if (p) {
1620                 p->tbl            = tbl;
1621                 refcount_set(&p->refcnt, 1);
1622                 p->reachable_time =
1623                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1624                 dev_hold(dev);
1625                 p->dev = dev;
1626                 write_pnet(&p->net, net);
1627                 p->sysctl_table = NULL;
1628
1629                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1630                         dev_put(dev);
1631                         kfree(p);
1632                         return NULL;
1633                 }
1634
1635                 write_lock_bh(&tbl->lock);
1636                 list_add(&p->list, &tbl->parms.list);
1637                 write_unlock_bh(&tbl->lock);
1638
1639                 neigh_parms_data_state_cleanall(p);
1640         }
1641         return p;
1642 }
1643 EXPORT_SYMBOL(neigh_parms_alloc);
1644
1645 static void neigh_rcu_free_parms(struct rcu_head *head)
1646 {
1647         struct neigh_parms *parms =
1648                 container_of(head, struct neigh_parms, rcu_head);
1649
1650         neigh_parms_put(parms);
1651 }
1652
1653 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1654 {
1655         if (!parms || parms == &tbl->parms)
1656                 return;
1657         write_lock_bh(&tbl->lock);
1658         list_del(&parms->list);
1659         parms->dead = 1;
1660         write_unlock_bh(&tbl->lock);
1661         dev_put(parms->dev);
1662         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1663 }
1664 EXPORT_SYMBOL(neigh_parms_release);
1665
1666 static void neigh_parms_destroy(struct neigh_parms *parms)
1667 {
1668         kfree(parms);
1669 }
1670
1671 static struct lock_class_key neigh_table_proxy_queue_class;
1672
1673 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1674
1675 void neigh_table_init(int index, struct neigh_table *tbl)
1676 {
1677         unsigned long now = jiffies;
1678         unsigned long phsize;
1679
1680         INIT_LIST_HEAD(&tbl->parms_list);
1681         INIT_LIST_HEAD(&tbl->gc_list);
1682         list_add(&tbl->parms.list, &tbl->parms_list);
1683         write_pnet(&tbl->parms.net, &init_net);
1684         refcount_set(&tbl->parms.refcnt, 1);
1685         tbl->parms.reachable_time =
1686                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1687
1688         tbl->stats = alloc_percpu(struct neigh_statistics);
1689         if (!tbl->stats)
1690                 panic("cannot create neighbour cache statistics");
1691
1692 #ifdef CONFIG_PROC_FS
1693         if (!proc_create_seq_data(tbl->id, 0, init_net.proc_net_stat,
1694                               &neigh_stat_seq_ops, tbl))
1695                 panic("cannot create neighbour proc dir entry");
1696 #endif
1697
1698         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1699
1700         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1701         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1702
1703         if (!tbl->nht || !tbl->phash_buckets)
1704                 panic("cannot allocate neighbour cache hashes");
1705
1706         if (!tbl->entry_size)
1707                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1708                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1709         else
1710                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1711
1712         rwlock_init(&tbl->lock);
1713         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1714         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1715                         tbl->parms.reachable_time);
1716         timer_setup(&tbl->proxy_timer, neigh_proxy_process, 0);
1717         skb_queue_head_init_class(&tbl->proxy_queue,
1718                         &neigh_table_proxy_queue_class);
1719
1720         tbl->last_flush = now;
1721         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1722
1723         neigh_tables[index] = tbl;
1724 }
1725 EXPORT_SYMBOL(neigh_table_init);
1726
1727 int neigh_table_clear(int index, struct neigh_table *tbl)
1728 {
1729         neigh_tables[index] = NULL;
1730         /* It is not clean... Fix it to unload IPv6 module safely */
1731         cancel_delayed_work_sync(&tbl->gc_work);
1732         del_timer_sync(&tbl->proxy_timer);
1733         pneigh_queue_purge(&tbl->proxy_queue);
1734         neigh_ifdown(tbl, NULL);
1735         if (atomic_read(&tbl->entries))
1736                 pr_crit("neighbour leakage\n");
1737
1738         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1739                  neigh_hash_free_rcu);
1740         tbl->nht = NULL;
1741
1742         kfree(tbl->phash_buckets);
1743         tbl->phash_buckets = NULL;
1744
1745         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1746
1747         free_percpu(tbl->stats);
1748         tbl->stats = NULL;
1749
1750         return 0;
1751 }
1752 EXPORT_SYMBOL(neigh_table_clear);
1753
1754 static struct neigh_table *neigh_find_table(int family)
1755 {
1756         struct neigh_table *tbl = NULL;
1757
1758         switch (family) {
1759         case AF_INET:
1760                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1761                 break;
1762         case AF_INET6:
1763                 tbl = neigh_tables[NEIGH_ND_TABLE];
1764                 break;
1765         case AF_DECnet:
1766                 tbl = neigh_tables[NEIGH_DN_TABLE];
1767                 break;
1768         }
1769
1770         return tbl;
1771 }
1772
1773 const struct nla_policy nda_policy[NDA_MAX+1] = {
1774         [NDA_UNSPEC]            = { .strict_start_type = NDA_NH_ID },
1775         [NDA_DST]               = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1776         [NDA_LLADDR]            = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1777         [NDA_CACHEINFO]         = { .len = sizeof(struct nda_cacheinfo) },
1778         [NDA_PROBES]            = { .type = NLA_U32 },
1779         [NDA_VLAN]              = { .type = NLA_U16 },
1780         [NDA_PORT]              = { .type = NLA_U16 },
1781         [NDA_VNI]               = { .type = NLA_U32 },
1782         [NDA_IFINDEX]           = { .type = NLA_U32 },
1783         [NDA_MASTER]            = { .type = NLA_U32 },
1784         [NDA_PROTOCOL]          = { .type = NLA_U8 },
1785         [NDA_NH_ID]             = { .type = NLA_U32 },
1786         [NDA_FDB_EXT_ATTRS]     = { .type = NLA_NESTED },
1787 };
1788
1789 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1790                         struct netlink_ext_ack *extack)
1791 {
1792         struct net *net = sock_net(skb->sk);
1793         struct ndmsg *ndm;
1794         struct nlattr *dst_attr;
1795         struct neigh_table *tbl;
1796         struct neighbour *neigh;
1797         struct net_device *dev = NULL;
1798         int err = -EINVAL;
1799
1800         ASSERT_RTNL();
1801         if (nlmsg_len(nlh) < sizeof(*ndm))
1802                 goto out;
1803
1804         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1805         if (!dst_attr) {
1806                 NL_SET_ERR_MSG(extack, "Network address not specified");
1807                 goto out;
1808         }
1809
1810         ndm = nlmsg_data(nlh);
1811         if (ndm->ndm_ifindex) {
1812                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1813                 if (dev == NULL) {
1814                         err = -ENODEV;
1815                         goto out;
1816                 }
1817         }
1818
1819         tbl = neigh_find_table(ndm->ndm_family);
1820         if (tbl == NULL)
1821                 return -EAFNOSUPPORT;
1822
1823         if (nla_len(dst_attr) < (int)tbl->key_len) {
1824                 NL_SET_ERR_MSG(extack, "Invalid network address");
1825                 goto out;
1826         }
1827
1828         if (ndm->ndm_flags & NTF_PROXY) {
1829                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1830                 goto out;
1831         }
1832
1833         if (dev == NULL)
1834                 goto out;
1835
1836         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1837         if (neigh == NULL) {
1838                 err = -ENOENT;
1839                 goto out;
1840         }
1841
1842         err = __neigh_update(neigh, NULL, NUD_FAILED,
1843                              NEIGH_UPDATE_F_OVERRIDE | NEIGH_UPDATE_F_ADMIN,
1844                              NETLINK_CB(skb).portid, extack);
1845         write_lock_bh(&tbl->lock);
1846         neigh_release(neigh);
1847         neigh_remove_one(neigh, tbl);
1848         write_unlock_bh(&tbl->lock);
1849
1850 out:
1851         return err;
1852 }
1853
1854 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1855                      struct netlink_ext_ack *extack)
1856 {
1857         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE |
1858                 NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1859         struct net *net = sock_net(skb->sk);
1860         struct ndmsg *ndm;
1861         struct nlattr *tb[NDA_MAX+1];
1862         struct neigh_table *tbl;
1863         struct net_device *dev = NULL;
1864         struct neighbour *neigh;
1865         void *dst, *lladdr;
1866         u8 protocol = 0;
1867         int err;
1868
1869         ASSERT_RTNL();
1870         err = nlmsg_parse_deprecated(nlh, sizeof(*ndm), tb, NDA_MAX,
1871                                      nda_policy, extack);
1872         if (err < 0)
1873                 goto out;
1874
1875         err = -EINVAL;
1876         if (!tb[NDA_DST]) {
1877                 NL_SET_ERR_MSG(extack, "Network address not specified");
1878                 goto out;
1879         }
1880
1881         ndm = nlmsg_data(nlh);
1882         if (ndm->ndm_ifindex) {
1883                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1884                 if (dev == NULL) {
1885                         err = -ENODEV;
1886                         goto out;
1887                 }
1888
1889                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len) {
1890                         NL_SET_ERR_MSG(extack, "Invalid link address");
1891                         goto out;
1892                 }
1893         }
1894
1895         tbl = neigh_find_table(ndm->ndm_family);
1896         if (tbl == NULL)
1897                 return -EAFNOSUPPORT;
1898
1899         if (nla_len(tb[NDA_DST]) < (int)tbl->key_len) {
1900                 NL_SET_ERR_MSG(extack, "Invalid network address");
1901                 goto out;
1902         }
1903
1904         dst = nla_data(tb[NDA_DST]);
1905         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1906
1907         if (tb[NDA_PROTOCOL])
1908                 protocol = nla_get_u8(tb[NDA_PROTOCOL]);
1909
1910         if (ndm->ndm_flags & NTF_PROXY) {
1911                 struct pneigh_entry *pn;
1912
1913                 err = -ENOBUFS;
1914                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1915                 if (pn) {
1916                         pn->flags = ndm->ndm_flags;
1917                         if (protocol)
1918                                 pn->protocol = protocol;
1919                         err = 0;
1920                 }
1921                 goto out;
1922         }
1923
1924         if (!dev) {
1925                 NL_SET_ERR_MSG(extack, "Device not specified");
1926                 goto out;
1927         }
1928
1929         if (tbl->allow_add && !tbl->allow_add(dev, extack)) {
1930                 err = -EINVAL;
1931                 goto out;
1932         }
1933
1934         neigh = neigh_lookup(tbl, dst, dev);
1935         if (neigh == NULL) {
1936                 bool exempt_from_gc;
1937
1938                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1939                         err = -ENOENT;
1940                         goto out;
1941                 }
1942
1943                 exempt_from_gc = ndm->ndm_state & NUD_PERMANENT ||
1944                                  ndm->ndm_flags & NTF_EXT_LEARNED;
1945                 neigh = ___neigh_create(tbl, dst, dev,
1946                                         ndm->ndm_flags & NTF_EXT_LEARNED,
1947                                         exempt_from_gc, true);
1948                 if (IS_ERR(neigh)) {
1949                         err = PTR_ERR(neigh);
1950                         goto out;
1951                 }
1952         } else {
1953                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1954                         err = -EEXIST;
1955                         neigh_release(neigh);
1956                         goto out;
1957                 }
1958
1959                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1960                         flags &= ~(NEIGH_UPDATE_F_OVERRIDE |
1961                                    NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1962         }
1963
1964         if (protocol)
1965                 neigh->protocol = protocol;
1966
1967         if (ndm->ndm_flags & NTF_EXT_LEARNED)
1968                 flags |= NEIGH_UPDATE_F_EXT_LEARNED;
1969
1970         if (ndm->ndm_flags & NTF_ROUTER)
1971                 flags |= NEIGH_UPDATE_F_ISROUTER;
1972
1973         if (ndm->ndm_flags & NTF_USE) {
1974                 neigh_event_send(neigh, NULL);
1975                 err = 0;
1976         } else
1977                 err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1978                                      NETLINK_CB(skb).portid, extack);
1979
1980         neigh_release(neigh);
1981
1982 out:
1983         return err;
1984 }
1985
1986 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1987 {
1988         struct nlattr *nest;
1989
1990         nest = nla_nest_start_noflag(skb, NDTA_PARMS);
1991         if (nest == NULL)
1992                 return -ENOBUFS;
1993
1994         if ((parms->dev &&
1995              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1996             nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
1997             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1998                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1999             /* approximative value for deprecated QUEUE_LEN (in packets) */
2000             nla_put_u32(skb, NDTPA_QUEUE_LEN,
2001                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
2002             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
2003             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
2004             nla_put_u32(skb, NDTPA_UCAST_PROBES,
2005                         NEIGH_VAR(parms, UCAST_PROBES)) ||
2006             nla_put_u32(skb, NDTPA_MCAST_PROBES,
2007                         NEIGH_VAR(parms, MCAST_PROBES)) ||
2008             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
2009                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
2010             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
2011                           NDTPA_PAD) ||
2012             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
2013                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
2014             nla_put_msecs(skb, NDTPA_GC_STALETIME,
2015                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
2016             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
2017                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
2018             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
2019                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
2020             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
2021                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
2022             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
2023                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
2024             nla_put_msecs(skb, NDTPA_LOCKTIME,
2025                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
2026                 goto nla_put_failure;
2027         return nla_nest_end(skb, nest);
2028
2029 nla_put_failure:
2030         nla_nest_cancel(skb, nest);
2031         return -EMSGSIZE;
2032 }
2033
2034 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
2035                               u32 pid, u32 seq, int type, int flags)
2036 {
2037         struct nlmsghdr *nlh;
2038         struct ndtmsg *ndtmsg;
2039
2040         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2041         if (nlh == NULL)
2042                 return -EMSGSIZE;
2043
2044         ndtmsg = nlmsg_data(nlh);
2045
2046         read_lock_bh(&tbl->lock);
2047         ndtmsg->ndtm_family = tbl->family;
2048         ndtmsg->ndtm_pad1   = 0;
2049         ndtmsg->ndtm_pad2   = 0;
2050
2051         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
2052             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
2053             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
2054             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
2055             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
2056                 goto nla_put_failure;
2057         {
2058                 unsigned long now = jiffies;
2059                 long flush_delta = now - tbl->last_flush;
2060                 long rand_delta = now - tbl->last_rand;
2061                 struct neigh_hash_table *nht;
2062                 struct ndt_config ndc = {
2063                         .ndtc_key_len           = tbl->key_len,
2064                         .ndtc_entry_size        = tbl->entry_size,
2065                         .ndtc_entries           = atomic_read(&tbl->entries),
2066                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
2067                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
2068                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
2069                 };
2070
2071                 rcu_read_lock_bh();
2072                 nht = rcu_dereference_bh(tbl->nht);
2073                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
2074                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
2075                 rcu_read_unlock_bh();
2076
2077                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
2078                         goto nla_put_failure;
2079         }
2080
2081         {
2082                 int cpu;
2083                 struct ndt_stats ndst;
2084
2085                 memset(&ndst, 0, sizeof(ndst));
2086
2087                 for_each_possible_cpu(cpu) {
2088                         struct neigh_statistics *st;
2089
2090                         st = per_cpu_ptr(tbl->stats, cpu);
2091                         ndst.ndts_allocs                += st->allocs;
2092                         ndst.ndts_destroys              += st->destroys;
2093                         ndst.ndts_hash_grows            += st->hash_grows;
2094                         ndst.ndts_res_failed            += st->res_failed;
2095                         ndst.ndts_lookups               += st->lookups;
2096                         ndst.ndts_hits                  += st->hits;
2097                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
2098                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
2099                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
2100                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
2101                         ndst.ndts_table_fulls           += st->table_fulls;
2102                 }
2103
2104                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
2105                                   NDTA_PAD))
2106                         goto nla_put_failure;
2107         }
2108
2109         BUG_ON(tbl->parms.dev);
2110         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
2111                 goto nla_put_failure;
2112
2113         read_unlock_bh(&tbl->lock);
2114         nlmsg_end(skb, nlh);
2115         return 0;
2116
2117 nla_put_failure:
2118         read_unlock_bh(&tbl->lock);
2119         nlmsg_cancel(skb, nlh);
2120         return -EMSGSIZE;
2121 }
2122
2123 static int neightbl_fill_param_info(struct sk_buff *skb,
2124                                     struct neigh_table *tbl,
2125                                     struct neigh_parms *parms,
2126                                     u32 pid, u32 seq, int type,
2127                                     unsigned int flags)
2128 {
2129         struct ndtmsg *ndtmsg;
2130         struct nlmsghdr *nlh;
2131
2132         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2133         if (nlh == NULL)
2134                 return -EMSGSIZE;
2135
2136         ndtmsg = nlmsg_data(nlh);
2137
2138         read_lock_bh(&tbl->lock);
2139         ndtmsg->ndtm_family = tbl->family;
2140         ndtmsg->ndtm_pad1   = 0;
2141         ndtmsg->ndtm_pad2   = 0;
2142
2143         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
2144             neightbl_fill_parms(skb, parms) < 0)
2145                 goto errout;
2146
2147         read_unlock_bh(&tbl->lock);
2148         nlmsg_end(skb, nlh);
2149         return 0;
2150 errout:
2151         read_unlock_bh(&tbl->lock);
2152         nlmsg_cancel(skb, nlh);
2153         return -EMSGSIZE;
2154 }
2155
2156 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
2157         [NDTA_NAME]             = { .type = NLA_STRING },
2158         [NDTA_THRESH1]          = { .type = NLA_U32 },
2159         [NDTA_THRESH2]          = { .type = NLA_U32 },
2160         [NDTA_THRESH3]          = { .type = NLA_U32 },
2161         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
2162         [NDTA_PARMS]            = { .type = NLA_NESTED },
2163 };
2164
2165 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
2166         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
2167         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
2168         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
2169         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
2170         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
2171         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
2172         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
2173         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
2174         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
2175         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
2176         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
2177         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
2178         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
2179         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
2180 };
2181
2182 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
2183                         struct netlink_ext_ack *extack)
2184 {
2185         struct net *net = sock_net(skb->sk);
2186         struct neigh_table *tbl;
2187         struct ndtmsg *ndtmsg;
2188         struct nlattr *tb[NDTA_MAX+1];
2189         bool found = false;
2190         int err, tidx;
2191
2192         err = nlmsg_parse_deprecated(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
2193                                      nl_neightbl_policy, extack);
2194         if (err < 0)
2195                 goto errout;
2196
2197         if (tb[NDTA_NAME] == NULL) {
2198                 err = -EINVAL;
2199                 goto errout;
2200         }
2201
2202         ndtmsg = nlmsg_data(nlh);
2203
2204         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2205                 tbl = neigh_tables[tidx];
2206                 if (!tbl)
2207                         continue;
2208                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2209                         continue;
2210                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2211                         found = true;
2212                         break;
2213                 }
2214         }
2215
2216         if (!found)
2217                 return -ENOENT;
2218
2219         /*
2220          * We acquire tbl->lock to be nice to the periodic timers and
2221          * make sure they always see a consistent set of values.
2222          */
2223         write_lock_bh(&tbl->lock);
2224
2225         if (tb[NDTA_PARMS]) {
2226                 struct nlattr *tbp[NDTPA_MAX+1];
2227                 struct neigh_parms *p;
2228                 int i, ifindex = 0;
2229
2230                 err = nla_parse_nested_deprecated(tbp, NDTPA_MAX,
2231                                                   tb[NDTA_PARMS],
2232                                                   nl_ntbl_parm_policy, extack);
2233                 if (err < 0)
2234                         goto errout_tbl_lock;
2235
2236                 if (tbp[NDTPA_IFINDEX])
2237                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2238
2239                 p = lookup_neigh_parms(tbl, net, ifindex);
2240                 if (p == NULL) {
2241                         err = -ENOENT;
2242                         goto errout_tbl_lock;
2243                 }
2244
2245                 for (i = 1; i <= NDTPA_MAX; i++) {
2246                         if (tbp[i] == NULL)
2247                                 continue;
2248
2249                         switch (i) {
2250                         case NDTPA_QUEUE_LEN:
2251                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2252                                               nla_get_u32(tbp[i]) *
2253                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2254                                 break;
2255                         case NDTPA_QUEUE_LENBYTES:
2256                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2257                                               nla_get_u32(tbp[i]));
2258                                 break;
2259                         case NDTPA_PROXY_QLEN:
2260                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2261                                               nla_get_u32(tbp[i]));
2262                                 break;
2263                         case NDTPA_APP_PROBES:
2264                                 NEIGH_VAR_SET(p, APP_PROBES,
2265                                               nla_get_u32(tbp[i]));
2266                                 break;
2267                         case NDTPA_UCAST_PROBES:
2268                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2269                                               nla_get_u32(tbp[i]));
2270                                 break;
2271                         case NDTPA_MCAST_PROBES:
2272                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2273                                               nla_get_u32(tbp[i]));
2274                                 break;
2275                         case NDTPA_MCAST_REPROBES:
2276                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2277                                               nla_get_u32(tbp[i]));
2278                                 break;
2279                         case NDTPA_BASE_REACHABLE_TIME:
2280                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2281                                               nla_get_msecs(tbp[i]));
2282                                 /* update reachable_time as well, otherwise, the change will
2283                                  * only be effective after the next time neigh_periodic_work
2284                                  * decides to recompute it (can be multiple minutes)
2285                                  */
2286                                 p->reachable_time =
2287                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2288                                 break;
2289                         case NDTPA_GC_STALETIME:
2290                                 NEIGH_VAR_SET(p, GC_STALETIME,
2291                                               nla_get_msecs(tbp[i]));
2292                                 break;
2293                         case NDTPA_DELAY_PROBE_TIME:
2294                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2295                                               nla_get_msecs(tbp[i]));
2296                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2297                                 break;
2298                         case NDTPA_RETRANS_TIME:
2299                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2300                                               nla_get_msecs(tbp[i]));
2301                                 break;
2302                         case NDTPA_ANYCAST_DELAY:
2303                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2304                                               nla_get_msecs(tbp[i]));
2305                                 break;
2306                         case NDTPA_PROXY_DELAY:
2307                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2308                                               nla_get_msecs(tbp[i]));
2309                                 break;
2310                         case NDTPA_LOCKTIME:
2311                                 NEIGH_VAR_SET(p, LOCKTIME,
2312                                               nla_get_msecs(tbp[i]));
2313                                 break;
2314                         }
2315                 }
2316         }
2317
2318         err = -ENOENT;
2319         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2320              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2321             !net_eq(net, &init_net))
2322                 goto errout_tbl_lock;
2323
2324         if (tb[NDTA_THRESH1])
2325                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2326
2327         if (tb[NDTA_THRESH2])
2328                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2329
2330         if (tb[NDTA_THRESH3])
2331                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2332
2333         if (tb[NDTA_GC_INTERVAL])
2334                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2335
2336         err = 0;
2337
2338 errout_tbl_lock:
2339         write_unlock_bh(&tbl->lock);
2340 errout:
2341         return err;
2342 }
2343
2344 static int neightbl_valid_dump_info(const struct nlmsghdr *nlh,
2345                                     struct netlink_ext_ack *extack)
2346 {
2347         struct ndtmsg *ndtm;
2348
2349         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndtm))) {
2350                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor table dump request");
2351                 return -EINVAL;
2352         }
2353
2354         ndtm = nlmsg_data(nlh);
2355         if (ndtm->ndtm_pad1  || ndtm->ndtm_pad2) {
2356                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor table dump request");
2357                 return -EINVAL;
2358         }
2359
2360         if (nlmsg_attrlen(nlh, sizeof(*ndtm))) {
2361                 NL_SET_ERR_MSG(extack, "Invalid data after header in neighbor table dump request");
2362                 return -EINVAL;
2363         }
2364
2365         return 0;
2366 }
2367
2368 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2369 {
2370         const struct nlmsghdr *nlh = cb->nlh;
2371         struct net *net = sock_net(skb->sk);
2372         int family, tidx, nidx = 0;
2373         int tbl_skip = cb->args[0];
2374         int neigh_skip = cb->args[1];
2375         struct neigh_table *tbl;
2376
2377         if (cb->strict_check) {
2378                 int err = neightbl_valid_dump_info(nlh, cb->extack);
2379
2380                 if (err < 0)
2381                         return err;
2382         }
2383
2384         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2385
2386         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2387                 struct neigh_parms *p;
2388
2389                 tbl = neigh_tables[tidx];
2390                 if (!tbl)
2391                         continue;
2392
2393                 if (tidx < tbl_skip || (family && tbl->family != family))
2394                         continue;
2395
2396                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2397                                        nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2398                                        NLM_F_MULTI) < 0)
2399                         break;
2400
2401                 nidx = 0;
2402                 p = list_next_entry(&tbl->parms, list);
2403                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2404                         if (!net_eq(neigh_parms_net(p), net))
2405                                 continue;
2406
2407                         if (nidx < neigh_skip)
2408                                 goto next;
2409
2410                         if (neightbl_fill_param_info(skb, tbl, p,
2411                                                      NETLINK_CB(cb->skb).portid,
2412                                                      nlh->nlmsg_seq,
2413                                                      RTM_NEWNEIGHTBL,
2414                                                      NLM_F_MULTI) < 0)
2415                                 goto out;
2416                 next:
2417                         nidx++;
2418                 }
2419
2420                 neigh_skip = 0;
2421         }
2422 out:
2423         cb->args[0] = tidx;
2424         cb->args[1] = nidx;
2425
2426         return skb->len;
2427 }
2428
2429 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2430                            u32 pid, u32 seq, int type, unsigned int flags)
2431 {
2432         unsigned long now = jiffies;
2433         struct nda_cacheinfo ci;
2434         struct nlmsghdr *nlh;
2435         struct ndmsg *ndm;
2436
2437         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2438         if (nlh == NULL)
2439                 return -EMSGSIZE;
2440
2441         ndm = nlmsg_data(nlh);
2442         ndm->ndm_family  = neigh->ops->family;
2443         ndm->ndm_pad1    = 0;
2444         ndm->ndm_pad2    = 0;
2445         ndm->ndm_flags   = neigh->flags;
2446         ndm->ndm_type    = neigh->type;
2447         ndm->ndm_ifindex = neigh->dev->ifindex;
2448
2449         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2450                 goto nla_put_failure;
2451
2452         read_lock_bh(&neigh->lock);
2453         ndm->ndm_state   = neigh->nud_state;
2454         if (neigh->nud_state & NUD_VALID) {
2455                 char haddr[MAX_ADDR_LEN];
2456
2457                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2458                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2459                         read_unlock_bh(&neigh->lock);
2460                         goto nla_put_failure;
2461                 }
2462         }
2463
2464         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2465         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2466         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2467         ci.ndm_refcnt    = refcount_read(&neigh->refcnt) - 1;
2468         read_unlock_bh(&neigh->lock);
2469
2470         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2471             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2472                 goto nla_put_failure;
2473
2474         if (neigh->protocol && nla_put_u8(skb, NDA_PROTOCOL, neigh->protocol))
2475                 goto nla_put_failure;
2476
2477         nlmsg_end(skb, nlh);
2478         return 0;
2479
2480 nla_put_failure:
2481         nlmsg_cancel(skb, nlh);
2482         return -EMSGSIZE;
2483 }
2484
2485 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2486                             u32 pid, u32 seq, int type, unsigned int flags,
2487                             struct neigh_table *tbl)
2488 {
2489         struct nlmsghdr *nlh;
2490         struct ndmsg *ndm;
2491
2492         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2493         if (nlh == NULL)
2494                 return -EMSGSIZE;
2495
2496         ndm = nlmsg_data(nlh);
2497         ndm->ndm_family  = tbl->family;
2498         ndm->ndm_pad1    = 0;
2499         ndm->ndm_pad2    = 0;
2500         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2501         ndm->ndm_type    = RTN_UNICAST;
2502         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2503         ndm->ndm_state   = NUD_NONE;
2504
2505         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2506                 goto nla_put_failure;
2507
2508         if (pn->protocol && nla_put_u8(skb, NDA_PROTOCOL, pn->protocol))
2509                 goto nla_put_failure;
2510
2511         nlmsg_end(skb, nlh);
2512         return 0;
2513
2514 nla_put_failure:
2515         nlmsg_cancel(skb, nlh);
2516         return -EMSGSIZE;
2517 }
2518
2519 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2520 {
2521         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2522         __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2523 }
2524
2525 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2526 {
2527         struct net_device *master;
2528
2529         if (!master_idx)
2530                 return false;
2531
2532         master = dev ? netdev_master_upper_dev_get(dev) : NULL;
2533
2534         /* 0 is already used to denote NDA_MASTER wasn't passed, therefore need another
2535          * invalid value for ifindex to denote "no master".
2536          */
2537         if (master_idx == -1)
2538                 return !!master;
2539
2540         if (!master || master->ifindex != master_idx)
2541                 return true;
2542
2543         return false;
2544 }
2545
2546 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2547 {
2548         if (filter_idx && (!dev || dev->ifindex != filter_idx))
2549                 return true;
2550
2551         return false;
2552 }
2553
2554 struct neigh_dump_filter {
2555         int master_idx;
2556         int dev_idx;
2557 };
2558
2559 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2560                             struct netlink_callback *cb,
2561                             struct neigh_dump_filter *filter)
2562 {
2563         struct net *net = sock_net(skb->sk);
2564         struct neighbour *n;
2565         int rc, h, s_h = cb->args[1];
2566         int idx, s_idx = idx = cb->args[2];
2567         struct neigh_hash_table *nht;
2568         unsigned int flags = NLM_F_MULTI;
2569
2570         if (filter->dev_idx || filter->master_idx)
2571                 flags |= NLM_F_DUMP_FILTERED;
2572
2573         rcu_read_lock_bh();
2574         nht = rcu_dereference_bh(tbl->nht);
2575
2576         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2577                 if (h > s_h)
2578                         s_idx = 0;
2579                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2580                      n != NULL;
2581                      n = rcu_dereference_bh(n->next)) {
2582                         if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2583                                 goto next;
2584                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2585                             neigh_master_filtered(n->dev, filter->master_idx))
2586                                 goto next;
2587                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2588                                             cb->nlh->nlmsg_seq,
2589                                             RTM_NEWNEIGH,
2590                                             flags) < 0) {
2591                                 rc = -1;
2592                                 goto out;
2593                         }
2594 next:
2595                         idx++;
2596                 }
2597         }
2598         rc = skb->len;
2599 out:
2600         rcu_read_unlock_bh();
2601         cb->args[1] = h;
2602         cb->args[2] = idx;
2603         return rc;
2604 }
2605
2606 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2607                              struct netlink_callback *cb,
2608                              struct neigh_dump_filter *filter)
2609 {
2610         struct pneigh_entry *n;
2611         struct net *net = sock_net(skb->sk);
2612         int rc, h, s_h = cb->args[3];
2613         int idx, s_idx = idx = cb->args[4];
2614         unsigned int flags = NLM_F_MULTI;
2615
2616         if (filter->dev_idx || filter->master_idx)
2617                 flags |= NLM_F_DUMP_FILTERED;
2618
2619         read_lock_bh(&tbl->lock);
2620
2621         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2622                 if (h > s_h)
2623                         s_idx = 0;
2624                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2625                         if (idx < s_idx || pneigh_net(n) != net)
2626                                 goto next;
2627                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2628                             neigh_master_filtered(n->dev, filter->master_idx))
2629                                 goto next;
2630                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2631                                             cb->nlh->nlmsg_seq,
2632                                             RTM_NEWNEIGH, flags, tbl) < 0) {
2633                                 read_unlock_bh(&tbl->lock);
2634                                 rc = -1;
2635                                 goto out;
2636                         }
2637                 next:
2638                         idx++;
2639                 }
2640         }
2641
2642         read_unlock_bh(&tbl->lock);
2643         rc = skb->len;
2644 out:
2645         cb->args[3] = h;
2646         cb->args[4] = idx;
2647         return rc;
2648
2649 }
2650
2651 static int neigh_valid_dump_req(const struct nlmsghdr *nlh,
2652                                 bool strict_check,
2653                                 struct neigh_dump_filter *filter,
2654                                 struct netlink_ext_ack *extack)
2655 {
2656         struct nlattr *tb[NDA_MAX + 1];
2657         int err, i;
2658
2659         if (strict_check) {
2660                 struct ndmsg *ndm;
2661
2662                 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2663                         NL_SET_ERR_MSG(extack, "Invalid header for neighbor dump request");
2664                         return -EINVAL;
2665                 }
2666
2667                 ndm = nlmsg_data(nlh);
2668                 if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_ifindex ||
2669                     ndm->ndm_state || ndm->ndm_type) {
2670                         NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor dump request");
2671                         return -EINVAL;
2672                 }
2673
2674                 if (ndm->ndm_flags & ~NTF_PROXY) {
2675                         NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor dump request");
2676                         return -EINVAL;
2677                 }
2678
2679                 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg),
2680                                                     tb, NDA_MAX, nda_policy,
2681                                                     extack);
2682         } else {
2683                 err = nlmsg_parse_deprecated(nlh, sizeof(struct ndmsg), tb,
2684                                              NDA_MAX, nda_policy, extack);
2685         }
2686         if (err < 0)
2687                 return err;
2688
2689         for (i = 0; i <= NDA_MAX; ++i) {
2690                 if (!tb[i])
2691                         continue;
2692
2693                 /* all new attributes should require strict_check */
2694                 switch (i) {
2695                 case NDA_IFINDEX:
2696                         filter->dev_idx = nla_get_u32(tb[i]);
2697                         break;
2698                 case NDA_MASTER:
2699                         filter->master_idx = nla_get_u32(tb[i]);
2700                         break;
2701                 default:
2702                         if (strict_check) {
2703                                 NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor dump request");
2704                                 return -EINVAL;
2705                         }
2706                 }
2707         }
2708
2709         return 0;
2710 }
2711
2712 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2713 {
2714         const struct nlmsghdr *nlh = cb->nlh;
2715         struct neigh_dump_filter filter = {};
2716         struct neigh_table *tbl;
2717         int t, family, s_t;
2718         int proxy = 0;
2719         int err;
2720
2721         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2722
2723         /* check for full ndmsg structure presence, family member is
2724          * the same for both structures
2725          */
2726         if (nlmsg_len(nlh) >= sizeof(struct ndmsg) &&
2727             ((struct ndmsg *)nlmsg_data(nlh))->ndm_flags == NTF_PROXY)
2728                 proxy = 1;
2729
2730         err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack);
2731         if (err < 0 && cb->strict_check)
2732                 return err;
2733
2734         s_t = cb->args[0];
2735
2736         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2737                 tbl = neigh_tables[t];
2738
2739                 if (!tbl)
2740                         continue;
2741                 if (t < s_t || (family && tbl->family != family))
2742                         continue;
2743                 if (t > s_t)
2744                         memset(&cb->args[1], 0, sizeof(cb->args) -
2745                                                 sizeof(cb->args[0]));
2746                 if (proxy)
2747                         err = pneigh_dump_table(tbl, skb, cb, &filter);
2748                 else
2749                         err = neigh_dump_table(tbl, skb, cb, &filter);
2750                 if (err < 0)
2751                         break;
2752         }
2753
2754         cb->args[0] = t;
2755         return skb->len;
2756 }
2757
2758 static int neigh_valid_get_req(const struct nlmsghdr *nlh,
2759                                struct neigh_table **tbl,
2760                                void **dst, int *dev_idx, u8 *ndm_flags,
2761                                struct netlink_ext_ack *extack)
2762 {
2763         struct nlattr *tb[NDA_MAX + 1];
2764         struct ndmsg *ndm;
2765         int err, i;
2766
2767         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2768                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor get request");
2769                 return -EINVAL;
2770         }
2771
2772         ndm = nlmsg_data(nlh);
2773         if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
2774             ndm->ndm_type) {
2775                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor get request");
2776                 return -EINVAL;
2777         }
2778
2779         if (ndm->ndm_flags & ~NTF_PROXY) {
2780                 NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor get request");
2781                 return -EINVAL;
2782         }
2783
2784         err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg), tb,
2785                                             NDA_MAX, nda_policy, extack);
2786         if (err < 0)
2787                 return err;
2788
2789         *ndm_flags = ndm->ndm_flags;
2790         *dev_idx = ndm->ndm_ifindex;
2791         *tbl = neigh_find_table(ndm->ndm_family);
2792         if (*tbl == NULL) {
2793                 NL_SET_ERR_MSG(extack, "Unsupported family in header for neighbor get request");
2794                 return -EAFNOSUPPORT;
2795         }
2796
2797         for (i = 0; i <= NDA_MAX; ++i) {
2798                 if (!tb[i])
2799                         continue;
2800
2801                 switch (i) {
2802                 case NDA_DST:
2803                         if (nla_len(tb[i]) != (int)(*tbl)->key_len) {
2804                                 NL_SET_ERR_MSG(extack, "Invalid network address in neighbor get request");
2805                                 return -EINVAL;
2806                         }
2807                         *dst = nla_data(tb[i]);
2808                         break;
2809                 default:
2810                         NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor get request");
2811                         return -EINVAL;
2812                 }
2813         }
2814
2815         return 0;
2816 }
2817
2818 static inline size_t neigh_nlmsg_size(void)
2819 {
2820         return NLMSG_ALIGN(sizeof(struct ndmsg))
2821                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2822                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2823                + nla_total_size(sizeof(struct nda_cacheinfo))
2824                + nla_total_size(4)  /* NDA_PROBES */
2825                + nla_total_size(1); /* NDA_PROTOCOL */
2826 }
2827
2828 static int neigh_get_reply(struct net *net, struct neighbour *neigh,
2829                            u32 pid, u32 seq)
2830 {
2831         struct sk_buff *skb;
2832         int err = 0;
2833
2834         skb = nlmsg_new(neigh_nlmsg_size(), GFP_KERNEL);
2835         if (!skb)
2836                 return -ENOBUFS;
2837
2838         err = neigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0);
2839         if (err) {
2840                 kfree_skb(skb);
2841                 goto errout;
2842         }
2843
2844         err = rtnl_unicast(skb, net, pid);
2845 errout:
2846         return err;
2847 }
2848
2849 static inline size_t pneigh_nlmsg_size(void)
2850 {
2851         return NLMSG_ALIGN(sizeof(struct ndmsg))
2852                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2853                + nla_total_size(1); /* NDA_PROTOCOL */
2854 }
2855
2856 static int pneigh_get_reply(struct net *net, struct pneigh_entry *neigh,
2857                             u32 pid, u32 seq, struct neigh_table *tbl)
2858 {
2859         struct sk_buff *skb;
2860         int err = 0;
2861
2862         skb = nlmsg_new(pneigh_nlmsg_size(), GFP_KERNEL);
2863         if (!skb)
2864                 return -ENOBUFS;
2865
2866         err = pneigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0, tbl);
2867         if (err) {
2868                 kfree_skb(skb);
2869                 goto errout;
2870         }
2871
2872         err = rtnl_unicast(skb, net, pid);
2873 errout:
2874         return err;
2875 }
2876
2877 static int neigh_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
2878                      struct netlink_ext_ack *extack)
2879 {
2880         struct net *net = sock_net(in_skb->sk);
2881         struct net_device *dev = NULL;
2882         struct neigh_table *tbl = NULL;
2883         struct neighbour *neigh;
2884         void *dst = NULL;
2885         u8 ndm_flags = 0;
2886         int dev_idx = 0;
2887         int err;
2888
2889         err = neigh_valid_get_req(nlh, &tbl, &dst, &dev_idx, &ndm_flags,
2890                                   extack);
2891         if (err < 0)
2892                 return err;
2893
2894         if (dev_idx) {
2895                 dev = __dev_get_by_index(net, dev_idx);
2896                 if (!dev) {
2897                         NL_SET_ERR_MSG(extack, "Unknown device ifindex");
2898                         return -ENODEV;
2899                 }
2900         }
2901
2902         if (!dst) {
2903                 NL_SET_ERR_MSG(extack, "Network address not specified");
2904                 return -EINVAL;
2905         }
2906
2907         if (ndm_flags & NTF_PROXY) {
2908                 struct pneigh_entry *pn;
2909
2910                 pn = pneigh_lookup(tbl, net, dst, dev, 0);
2911                 if (!pn) {
2912                         NL_SET_ERR_MSG(extack, "Proxy neighbour entry not found");
2913                         return -ENOENT;
2914                 }
2915                 return pneigh_get_reply(net, pn, NETLINK_CB(in_skb).portid,
2916                                         nlh->nlmsg_seq, tbl);
2917         }
2918
2919         if (!dev) {
2920                 NL_SET_ERR_MSG(extack, "No device specified");
2921                 return -EINVAL;
2922         }
2923
2924         neigh = neigh_lookup(tbl, dst, dev);
2925         if (!neigh) {
2926                 NL_SET_ERR_MSG(extack, "Neighbour entry not found");
2927                 return -ENOENT;
2928         }
2929
2930         err = neigh_get_reply(net, neigh, NETLINK_CB(in_skb).portid,
2931                               nlh->nlmsg_seq);
2932
2933         neigh_release(neigh);
2934
2935         return err;
2936 }
2937
2938 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2939 {
2940         int chain;
2941         struct neigh_hash_table *nht;
2942
2943         rcu_read_lock_bh();
2944         nht = rcu_dereference_bh(tbl->nht);
2945
2946         read_lock(&tbl->lock); /* avoid resizes */
2947         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2948                 struct neighbour *n;
2949
2950                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2951                      n != NULL;
2952                      n = rcu_dereference_bh(n->next))
2953                         cb(n, cookie);
2954         }
2955         read_unlock(&tbl->lock);
2956         rcu_read_unlock_bh();
2957 }
2958 EXPORT_SYMBOL(neigh_for_each);
2959
2960 /* The tbl->lock must be held as a writer and BH disabled. */
2961 void __neigh_for_each_release(struct neigh_table *tbl,
2962                               int (*cb)(struct neighbour *))
2963 {
2964         int chain;
2965         struct neigh_hash_table *nht;
2966
2967         nht = rcu_dereference_protected(tbl->nht,
2968                                         lockdep_is_held(&tbl->lock));
2969         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2970                 struct neighbour *n;
2971                 struct neighbour __rcu **np;
2972
2973                 np = &nht->hash_buckets[chain];
2974                 while ((n = rcu_dereference_protected(*np,
2975                                         lockdep_is_held(&tbl->lock))) != NULL) {
2976                         int release;
2977
2978                         write_lock(&n->lock);
2979                         release = cb(n);
2980                         if (release) {
2981                                 rcu_assign_pointer(*np,
2982                                         rcu_dereference_protected(n->next,
2983                                                 lockdep_is_held(&tbl->lock)));
2984                                 neigh_mark_dead(n);
2985                         } else
2986                                 np = &n->next;
2987                         write_unlock(&n->lock);
2988                         if (release)
2989                                 neigh_cleanup_and_release(n);
2990                 }
2991         }
2992 }
2993 EXPORT_SYMBOL(__neigh_for_each_release);
2994
2995 int neigh_xmit(int index, struct net_device *dev,
2996                const void *addr, struct sk_buff *skb)
2997 {
2998         int err = -EAFNOSUPPORT;
2999         if (likely(index < NEIGH_NR_TABLES)) {
3000                 struct neigh_table *tbl;
3001                 struct neighbour *neigh;
3002
3003                 tbl = neigh_tables[index];
3004                 if (!tbl)
3005                         goto out;
3006                 rcu_read_lock_bh();
3007                 if (index == NEIGH_ARP_TABLE) {
3008                         u32 key = *((u32 *)addr);
3009
3010                         neigh = __ipv4_neigh_lookup_noref(dev, key);
3011                 } else {
3012                         neigh = __neigh_lookup_noref(tbl, addr, dev);
3013                 }
3014                 if (!neigh)
3015                         neigh = __neigh_create(tbl, addr, dev, false);
3016                 err = PTR_ERR(neigh);
3017                 if (IS_ERR(neigh)) {
3018                         rcu_read_unlock_bh();
3019                         goto out_kfree_skb;
3020                 }
3021                 err = neigh->output(neigh, skb);
3022                 rcu_read_unlock_bh();
3023         }
3024         else if (index == NEIGH_LINK_TABLE) {
3025                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
3026                                       addr, NULL, skb->len);
3027                 if (err < 0)
3028                         goto out_kfree_skb;
3029                 err = dev_queue_xmit(skb);
3030         }
3031 out:
3032         return err;
3033 out_kfree_skb:
3034         kfree_skb(skb);
3035         goto out;
3036 }
3037 EXPORT_SYMBOL(neigh_xmit);
3038
3039 #ifdef CONFIG_PROC_FS
3040
3041 static struct neighbour *neigh_get_first(struct seq_file *seq)
3042 {
3043         struct neigh_seq_state *state = seq->private;
3044         struct net *net = seq_file_net(seq);
3045         struct neigh_hash_table *nht = state->nht;
3046         struct neighbour *n = NULL;
3047         int bucket;
3048
3049         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
3050         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
3051                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
3052
3053                 while (n) {
3054                         if (!net_eq(dev_net(n->dev), net))
3055                                 goto next;
3056                         if (state->neigh_sub_iter) {
3057                                 loff_t fakep = 0;
3058                                 void *v;
3059
3060                                 v = state->neigh_sub_iter(state, n, &fakep);
3061                                 if (!v)
3062                                         goto next;
3063                         }
3064                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3065                                 break;
3066                         if (n->nud_state & ~NUD_NOARP)
3067                                 break;
3068 next:
3069                         n = rcu_dereference_bh(n->next);
3070                 }
3071
3072                 if (n)
3073                         break;
3074         }
3075         state->bucket = bucket;
3076
3077         return n;
3078 }
3079
3080 static struct neighbour *neigh_get_next(struct seq_file *seq,
3081                                         struct neighbour *n,
3082                                         loff_t *pos)
3083 {
3084         struct neigh_seq_state *state = seq->private;
3085         struct net *net = seq_file_net(seq);
3086         struct neigh_hash_table *nht = state->nht;
3087
3088         if (state->neigh_sub_iter) {
3089                 void *v = state->neigh_sub_iter(state, n, pos);
3090                 if (v)
3091                         return n;
3092         }
3093         n = rcu_dereference_bh(n->next);
3094
3095         while (1) {
3096                 while (n) {
3097                         if (!net_eq(dev_net(n->dev), net))
3098                                 goto next;
3099                         if (state->neigh_sub_iter) {
3100                                 void *v = state->neigh_sub_iter(state, n, pos);
3101                                 if (v)
3102                                         return n;
3103                                 goto next;
3104                         }
3105                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3106                                 break;
3107
3108                         if (n->nud_state & ~NUD_NOARP)
3109                                 break;
3110 next:
3111                         n = rcu_dereference_bh(n->next);
3112                 }
3113
3114                 if (n)
3115                         break;
3116
3117                 if (++state->bucket >= (1 << nht->hash_shift))
3118                         break;
3119
3120                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
3121         }
3122
3123         if (n && pos)
3124                 --(*pos);
3125         return n;
3126 }
3127
3128 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
3129 {
3130         struct neighbour *n = neigh_get_first(seq);
3131
3132         if (n) {
3133                 --(*pos);
3134                 while (*pos) {
3135                         n = neigh_get_next(seq, n, pos);
3136                         if (!n)
3137                                 break;
3138                 }
3139         }
3140         return *pos ? NULL : n;
3141 }
3142
3143 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
3144 {
3145         struct neigh_seq_state *state = seq->private;
3146         struct net *net = seq_file_net(seq);
3147         struct neigh_table *tbl = state->tbl;
3148         struct pneigh_entry *pn = NULL;
3149         int bucket;
3150
3151         state->flags |= NEIGH_SEQ_IS_PNEIGH;
3152         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
3153                 pn = tbl->phash_buckets[bucket];
3154                 while (pn && !net_eq(pneigh_net(pn), net))
3155                         pn = pn->next;
3156                 if (pn)
3157                         break;
3158         }
3159         state->bucket = bucket;
3160
3161         return pn;
3162 }
3163
3164 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
3165                                             struct pneigh_entry *pn,
3166                                             loff_t *pos)
3167 {
3168         struct neigh_seq_state *state = seq->private;
3169         struct net *net = seq_file_net(seq);
3170         struct neigh_table *tbl = state->tbl;
3171
3172         do {
3173                 pn = pn->next;
3174         } while (pn && !net_eq(pneigh_net(pn), net));
3175
3176         while (!pn) {
3177                 if (++state->bucket > PNEIGH_HASHMASK)
3178                         break;
3179                 pn = tbl->phash_buckets[state->bucket];
3180                 while (pn && !net_eq(pneigh_net(pn), net))
3181                         pn = pn->next;
3182                 if (pn)
3183                         break;
3184         }
3185
3186         if (pn && pos)
3187                 --(*pos);
3188
3189         return pn;
3190 }
3191
3192 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
3193 {
3194         struct pneigh_entry *pn = pneigh_get_first(seq);
3195
3196         if (pn) {
3197                 --(*pos);
3198                 while (*pos) {
3199                         pn = pneigh_get_next(seq, pn, pos);
3200                         if (!pn)
3201                                 break;
3202                 }
3203         }
3204         return *pos ? NULL : pn;
3205 }
3206
3207 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
3208 {
3209         struct neigh_seq_state *state = seq->private;
3210         void *rc;
3211         loff_t idxpos = *pos;
3212
3213         rc = neigh_get_idx(seq, &idxpos);
3214         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3215                 rc = pneigh_get_idx(seq, &idxpos);
3216
3217         return rc;
3218 }
3219
3220 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
3221         __acquires(tbl->lock)
3222         __acquires(rcu_bh)
3223 {
3224         struct neigh_seq_state *state = seq->private;
3225
3226         state->tbl = tbl;
3227         state->bucket = 0;
3228         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
3229
3230         rcu_read_lock_bh();
3231         state->nht = rcu_dereference_bh(tbl->nht);
3232         read_lock(&tbl->lock);
3233
3234         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
3235 }
3236 EXPORT_SYMBOL(neigh_seq_start);
3237
3238 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3239 {
3240         struct neigh_seq_state *state;
3241         void *rc;
3242
3243         if (v == SEQ_START_TOKEN) {
3244                 rc = neigh_get_first(seq);
3245                 goto out;
3246         }
3247
3248         state = seq->private;
3249         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
3250                 rc = neigh_get_next(seq, v, NULL);
3251                 if (rc)
3252                         goto out;
3253                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3254                         rc = pneigh_get_first(seq);
3255         } else {
3256                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
3257                 rc = pneigh_get_next(seq, v, NULL);
3258         }
3259 out:
3260         ++(*pos);
3261         return rc;
3262 }
3263 EXPORT_SYMBOL(neigh_seq_next);
3264
3265 void neigh_seq_stop(struct seq_file *seq, void *v)
3266         __releases(tbl->lock)
3267         __releases(rcu_bh)
3268 {
3269         struct neigh_seq_state *state = seq->private;
3270         struct neigh_table *tbl = state->tbl;
3271
3272         read_unlock(&tbl->lock);
3273         rcu_read_unlock_bh();
3274 }
3275 EXPORT_SYMBOL(neigh_seq_stop);
3276
3277 /* statistics via seq_file */
3278
3279 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
3280 {
3281         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3282         int cpu;
3283
3284         if (*pos == 0)
3285                 return SEQ_START_TOKEN;
3286
3287         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
3288                 if (!cpu_possible(cpu))
3289                         continue;
3290                 *pos = cpu+1;
3291                 return per_cpu_ptr(tbl->stats, cpu);
3292         }
3293         return NULL;
3294 }
3295
3296 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3297 {
3298         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3299         int cpu;
3300
3301         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
3302                 if (!cpu_possible(cpu))
3303                         continue;
3304                 *pos = cpu+1;
3305                 return per_cpu_ptr(tbl->stats, cpu);
3306         }
3307         (*pos)++;
3308         return NULL;
3309 }
3310
3311 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
3312 {
3313
3314 }
3315
3316 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
3317 {
3318         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3319         struct neigh_statistics *st = v;
3320
3321         if (v == SEQ_START_TOKEN) {
3322                 seq_puts(seq, "entries  allocs   destroys hash_grows lookups  hits     res_failed rcv_probes_mcast rcv_probes_ucast periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
3323                 return 0;
3324         }
3325
3326         seq_printf(seq, "%08x %08lx %08lx %08lx   %08lx %08lx %08lx   "
3327                         "%08lx         %08lx         %08lx         "
3328                         "%08lx       %08lx            %08lx\n",
3329                    atomic_read(&tbl->entries),
3330
3331                    st->allocs,
3332                    st->destroys,
3333                    st->hash_grows,
3334
3335                    st->lookups,
3336                    st->hits,
3337
3338                    st->res_failed,
3339
3340                    st->rcv_probes_mcast,
3341                    st->rcv_probes_ucast,
3342
3343                    st->periodic_gc_runs,
3344                    st->forced_gc_runs,
3345                    st->unres_discards,
3346                    st->table_fulls
3347                    );
3348
3349         return 0;
3350 }
3351
3352 static const struct seq_operations neigh_stat_seq_ops = {
3353         .start  = neigh_stat_seq_start,
3354         .next   = neigh_stat_seq_next,
3355         .stop   = neigh_stat_seq_stop,
3356         .show   = neigh_stat_seq_show,
3357 };
3358 #endif /* CONFIG_PROC_FS */
3359
3360 static void __neigh_notify(struct neighbour *n, int type, int flags,
3361                            u32 pid)
3362 {
3363         struct net *net = dev_net(n->dev);
3364         struct sk_buff *skb;
3365         int err = -ENOBUFS;
3366
3367         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
3368         if (skb == NULL)
3369                 goto errout;
3370
3371         err = neigh_fill_info(skb, n, pid, 0, type, flags);
3372         if (err < 0) {
3373                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
3374                 WARN_ON(err == -EMSGSIZE);
3375                 kfree_skb(skb);
3376                 goto errout;
3377         }
3378         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
3379         return;
3380 errout:
3381         if (err < 0)
3382                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
3383 }
3384
3385 void neigh_app_ns(struct neighbour *n)
3386 {
3387         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
3388 }
3389 EXPORT_SYMBOL(neigh_app_ns);
3390
3391 #ifdef CONFIG_SYSCTL
3392 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
3393
3394 static int proc_unres_qlen(struct ctl_table *ctl, int write,
3395                            void *buffer, size_t *lenp, loff_t *ppos)
3396 {
3397         int size, ret;
3398         struct ctl_table tmp = *ctl;
3399
3400         tmp.extra1 = SYSCTL_ZERO;
3401         tmp.extra2 = &unres_qlen_max;
3402         tmp.data = &size;
3403
3404         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
3405         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3406
3407         if (write && !ret)
3408                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
3409         return ret;
3410 }
3411
3412 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
3413                                                    int family)
3414 {
3415         switch (family) {
3416         case AF_INET:
3417                 return __in_dev_arp_parms_get_rcu(dev);
3418         case AF_INET6:
3419                 return __in6_dev_nd_parms_get_rcu(dev);
3420         }
3421         return NULL;
3422 }
3423
3424 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
3425                                   int index)
3426 {
3427         struct net_device *dev;
3428         int family = neigh_parms_family(p);
3429
3430         rcu_read_lock();
3431         for_each_netdev_rcu(net, dev) {
3432                 struct neigh_parms *dst_p =
3433                                 neigh_get_dev_parms_rcu(dev, family);
3434
3435                 if (dst_p && !test_bit(index, dst_p->data_state))
3436                         dst_p->data[index] = p->data[index];
3437         }
3438         rcu_read_unlock();
3439 }
3440
3441 static void neigh_proc_update(struct ctl_table *ctl, int write)
3442 {
3443         struct net_device *dev = ctl->extra1;
3444         struct neigh_parms *p = ctl->extra2;
3445         struct net *net = neigh_parms_net(p);
3446         int index = (int *) ctl->data - p->data;
3447
3448         if (!write)
3449                 return;
3450
3451         set_bit(index, p->data_state);
3452         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
3453                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
3454         if (!dev) /* NULL dev means this is default value */
3455                 neigh_copy_dflt_parms(net, p, index);
3456 }
3457
3458 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
3459                                            void *buffer, size_t *lenp,
3460                                            loff_t *ppos)
3461 {
3462         struct ctl_table tmp = *ctl;
3463         int ret;
3464
3465         tmp.extra1 = SYSCTL_ZERO;
3466         tmp.extra2 = SYSCTL_INT_MAX;
3467
3468         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3469         neigh_proc_update(ctl, write);
3470         return ret;
3471 }
3472
3473 int neigh_proc_dointvec(struct ctl_table *ctl, int write, void *buffer,
3474                         size_t *lenp, loff_t *ppos)
3475 {
3476         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3477
3478         neigh_proc_update(ctl, write);
3479         return ret;
3480 }
3481 EXPORT_SYMBOL(neigh_proc_dointvec);
3482
3483 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write, void *buffer,
3484                                 size_t *lenp, loff_t *ppos)
3485 {
3486         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3487
3488         neigh_proc_update(ctl, write);
3489         return ret;
3490 }
3491 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3492
3493 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3494                                               void *buffer, size_t *lenp,
3495                                               loff_t *ppos)
3496 {
3497         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3498
3499         neigh_proc_update(ctl, write);
3500         return ret;
3501 }
3502
3503 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3504                                    void *buffer, size_t *lenp, loff_t *ppos)
3505 {
3506         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3507
3508         neigh_proc_update(ctl, write);
3509         return ret;
3510 }
3511 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3512
3513 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3514                                           void *buffer, size_t *lenp,
3515                                           loff_t *ppos)
3516 {
3517         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3518
3519         neigh_proc_update(ctl, write);
3520         return ret;
3521 }
3522
3523 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3524                                           void *buffer, size_t *lenp,
3525                                           loff_t *ppos)
3526 {
3527         struct neigh_parms *p = ctl->extra2;
3528         int ret;
3529
3530         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3531                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3532         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3533                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3534         else
3535                 ret = -1;
3536
3537         if (write && ret == 0) {
3538                 /* update reachable_time as well, otherwise, the change will
3539                  * only be effective after the next time neigh_periodic_work
3540                  * decides to recompute it
3541                  */
3542                 p->reachable_time =
3543                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3544         }
3545         return ret;
3546 }
3547
3548 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3549         (&((struct neigh_parms *) 0)->data[index])
3550
3551 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3552         [NEIGH_VAR_ ## attr] = { \
3553                 .procname       = name, \
3554                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3555                 .maxlen         = sizeof(int), \
3556                 .mode           = mval, \
3557                 .proc_handler   = proc, \
3558         }
3559
3560 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3561         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3562
3563 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3564         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3565
3566 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3567         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3568
3569 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3570         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3571
3572 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3573         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3574
3575 static struct neigh_sysctl_table {
3576         struct ctl_table_header *sysctl_header;
3577         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3578 } neigh_sysctl_template __read_mostly = {
3579         .neigh_vars = {
3580                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3581                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3582                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3583                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3584                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3585                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3586                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3587                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3588                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3589                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3590                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3591                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3592                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3593                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3594                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3595                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3596                 [NEIGH_VAR_GC_INTERVAL] = {
3597                         .procname       = "gc_interval",
3598                         .maxlen         = sizeof(int),
3599                         .mode           = 0644,
3600                         .proc_handler   = proc_dointvec_jiffies,
3601                 },
3602                 [NEIGH_VAR_GC_THRESH1] = {
3603                         .procname       = "gc_thresh1",
3604                         .maxlen         = sizeof(int),
3605                         .mode           = 0644,
3606                         .extra1         = SYSCTL_ZERO,
3607                         .extra2         = SYSCTL_INT_MAX,
3608                         .proc_handler   = proc_dointvec_minmax,
3609                 },
3610                 [NEIGH_VAR_GC_THRESH2] = {
3611                         .procname       = "gc_thresh2",
3612                         .maxlen         = sizeof(int),
3613                         .mode           = 0644,
3614                         .extra1         = SYSCTL_ZERO,
3615                         .extra2         = SYSCTL_INT_MAX,
3616                         .proc_handler   = proc_dointvec_minmax,
3617                 },
3618                 [NEIGH_VAR_GC_THRESH3] = {
3619                         .procname       = "gc_thresh3",
3620                         .maxlen         = sizeof(int),
3621                         .mode           = 0644,
3622                         .extra1         = SYSCTL_ZERO,
3623                         .extra2         = SYSCTL_INT_MAX,
3624                         .proc_handler   = proc_dointvec_minmax,
3625                 },
3626                 {},
3627         },
3628 };
3629
3630 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3631                           proc_handler *handler)
3632 {
3633         int i;
3634         struct neigh_sysctl_table *t;
3635         const char *dev_name_source;
3636         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3637         char *p_name;
3638
3639         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3640         if (!t)
3641                 goto err;
3642
3643         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3644                 t->neigh_vars[i].data += (long) p;
3645                 t->neigh_vars[i].extra1 = dev;
3646                 t->neigh_vars[i].extra2 = p;
3647         }
3648
3649         if (dev) {
3650                 dev_name_source = dev->name;
3651                 /* Terminate the table early */
3652                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3653                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3654         } else {
3655                 struct neigh_table *tbl = p->tbl;
3656                 dev_name_source = "default";
3657                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3658                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3659                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3660                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3661         }
3662
3663         if (handler) {
3664                 /* RetransTime */
3665                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3666                 /* ReachableTime */
3667                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3668                 /* RetransTime (in milliseconds)*/
3669                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3670                 /* ReachableTime (in milliseconds) */
3671                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3672         } else {
3673                 /* Those handlers will update p->reachable_time after
3674                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3675                  * applied after the next neighbour update instead of waiting for
3676                  * neigh_periodic_work to update its value (can be multiple minutes)
3677                  * So any handler that replaces them should do this as well
3678                  */
3679                 /* ReachableTime */
3680                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3681                         neigh_proc_base_reachable_time;
3682                 /* ReachableTime (in milliseconds) */
3683                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3684                         neigh_proc_base_reachable_time;
3685         }
3686
3687         /* Don't export sysctls to unprivileged users */
3688         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3689                 t->neigh_vars[0].procname = NULL;
3690
3691         switch (neigh_parms_family(p)) {
3692         case AF_INET:
3693               p_name = "ipv4";
3694               break;
3695         case AF_INET6:
3696               p_name = "ipv6";
3697               break;
3698         default:
3699               BUG();
3700         }
3701
3702         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3703                 p_name, dev_name_source);
3704         t->sysctl_header =
3705                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3706         if (!t->sysctl_header)
3707                 goto free;
3708
3709         p->sysctl_table = t;
3710         return 0;
3711
3712 free:
3713         kfree(t);
3714 err:
3715         return -ENOBUFS;
3716 }
3717 EXPORT_SYMBOL(neigh_sysctl_register);
3718
3719 void neigh_sysctl_unregister(struct neigh_parms *p)
3720 {
3721         if (p->sysctl_table) {
3722                 struct neigh_sysctl_table *t = p->sysctl_table;
3723                 p->sysctl_table = NULL;
3724                 unregister_net_sysctl_table(t->sysctl_header);
3725                 kfree(t);
3726         }
3727 }
3728 EXPORT_SYMBOL(neigh_sysctl_unregister);
3729
3730 #endif  /* CONFIG_SYSCTL */
3731
3732 static int __init neigh_init(void)
3733 {
3734         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, 0);
3735         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, 0);
3736         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, neigh_get, neigh_dump_info, 0);
3737
3738         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3739                       0);
3740         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0);
3741
3742         return 0;
3743 }
3744
3745 subsys_initcall(neigh_init);