net/core/neighbour.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Generic address resolution entity
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   8  *
   9  *      Fixes:
  10  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  11  *      Harald Welte            Add neighbour cache statistics like rtstat
  12  */
  13
  14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  15
  16 #include <linux/slab.h>
  17 #include <linux/kmemleak.h>
  18 #include <linux/types.h>
  19 #include <linux/kernel.h>
  20 #include <linux/module.h>
  21 #include <linux/socket.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/proc_fs.h>
  24 #ifdef CONFIG_SYSCTL
  25 #include <linux/sysctl.h>
  26 #endif
  27 #include <linux/times.h>
  28 #include <net/net_namespace.h>
  29 #include <net/neighbour.h>
  30 #include <net/arp.h>
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/netevent.h>
  34 #include <net/netlink.h>
  35 #include <linux/rtnetlink.h>
  36 #include <linux/random.h>
  37 #include <linux/string.h>
  38 #include <linux/log2.h>
  39 #include <linux/inetdevice.h>
  40 #include <net/addrconf.h>
  41
  42 #include <trace/events/neigh.h>
  43
  44 #define NEIGH_DEBUG 1
  45 #define neigh_dbg(level, fmt, ...)              \
  46 do {                                            \
  47         if (level <= NEIGH_DEBUG)               \
  48                 pr_debug(fmt, ##__VA_ARGS__);   \
  49 } while (0)
  50
  51 #define PNEIGH_HASHMASK         0xF
  52
  53 static void neigh_timer_handler(struct timer_list *t);
  54 static void __neigh_notify(struct neighbour *n, int type, int flags,
  55                            u32 pid);
  56 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  57 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
  58                                     struct net_device *dev);
  59
  60 #ifdef CONFIG_PROC_FS
  61 static const struct seq_operations neigh_stat_seq_ops;
  62 #endif
  63
  64 /*
  65    Neighbour hash table buckets are protected with rwlock tbl->lock.
  66
  67    - All the scans/updates to hash buckets MUST be made under this lock.
  68    - NOTHING clever should be made under this lock: no callbacks
  69      to protocol backends, no attempts to send something to network.
  70      It will result in deadlocks, if backend/driver wants to use neighbour
  71      cache.
  72    - If the entry requires some non-trivial actions, increase
  73      its reference count and release table lock.
  74
  75    Neighbour entries are protected:
  76    - with reference count.
  77    - with rwlock neigh->lock
  78
  79    Reference count prevents destruction.
  80
  81    neigh->lock mainly serializes ll address data and its validity state.
  82    However, the same lock is used to protect another entry fields:
  83     - timer
  84     - resolution queue
  85
  86    Again, nothing clever shall be made under neigh->lock,
  87    the most complicated procedure, which we allow is dev->hard_header.
  88    It is supposed, that dev->hard_header is simplistic and does
  89    not make callbacks to neighbour tables.
  90  */
  91
  92 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  93 {
  94         kfree_skb(skb);
  95         return -ENETDOWN;
  96 }
  97
  98 static void neigh_cleanup_and_release(struct neighbour *neigh)
  99 {
 100         trace_neigh_cleanup_and_release(neigh, 0);
 101         __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 102         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 103         neigh_release(neigh);
 104 }
 105
 106 /*
 107  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 108  * It corresponds to default IPv6 settings and is not overridable,
 109  * because it is really reasonable choice.
 110  */
 111
 112 unsigned long neigh_rand_reach_time(unsigned long base)
 113 {
 114         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 115 }
 116 EXPORT_SYMBOL(neigh_rand_reach_time);
 117
 118 static void neigh_mark_dead(struct neighbour *n)
 119 {
 120         n->dead = 1;
 121         if (!list_empty(&n->gc_list)) {
 122                 list_del_init(&n->gc_list);
 123                 atomic_dec(&n->tbl->gc_entries);
 124         }
 125 }
 126
 127 static void neigh_update_gc_list(struct neighbour *n)
 128 {
 129         bool on_gc_list, exempt_from_gc;
 130
 131         write_lock_bh(&n->tbl->lock);
 132         write_lock(&n->lock);
 133
 134         if (n->dead)
 135                 goto out;
 136
 137         /* remove from the gc list if new state is permanent or if neighbor
 138          * is externally learned; otherwise entry should be on the gc list
 139          */
 140         exempt_from_gc = n->nud_state & NUD_PERMANENT ||
 141                          n->flags & NTF_EXT_LEARNED;
 142         on_gc_list = !list_empty(&n->gc_list);
 143
 144         if (exempt_from_gc && on_gc_list) {
 145                 list_del_init(&n->gc_list);
 146                 atomic_dec(&n->tbl->gc_entries);
 147         } else if (!exempt_from_gc && !on_gc_list) {
 148                 /* add entries to the tail; cleaning removes from the front */
 149                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 150                 atomic_inc(&n->tbl->gc_entries);
 151         }
 152
 153 out:
 154         write_unlock(&n->lock);
 155         write_unlock_bh(&n->tbl->lock);
 156 }
 157
 158 static bool neigh_update_ext_learned(struct neighbour *neigh, u32 flags,
 159                                      int *notify)
 160 {
 161         bool rc = false;
 162         u8 ndm_flags;
 163
 164         if (!(flags & NEIGH_UPDATE_F_ADMIN))
 165                 return rc;
 166
 167         ndm_flags = (flags & NEIGH_UPDATE_F_EXT_LEARNED) ? NTF_EXT_LEARNED : 0;
 168         if ((neigh->flags ^ ndm_flags) & NTF_EXT_LEARNED) {
 169                 if (ndm_flags & NTF_EXT_LEARNED)
 170                         neigh->flags |= NTF_EXT_LEARNED;
 171                 else
 172                         neigh->flags &= ~NTF_EXT_LEARNED;
 173                 rc = true;
 174                 *notify = 1;
 175         }
 176
 177         return rc;
 178 }
 179
 180 static bool neigh_del(struct neighbour *n, struct neighbour __rcu **np,
 181                       struct neigh_table *tbl)
 182 {
 183         bool retval = false;
 184
 185         write_lock(&n->lock);
 186         if (refcount_read(&n->refcnt) == 1) {
 187                 struct neighbour *neigh;
 188
 189                 neigh = rcu_dereference_protected(n->next,
 190                                                   lockdep_is_held(&tbl->lock));
 191                 rcu_assign_pointer(*np, neigh);
 192                 neigh_mark_dead(n);
 193                 retval = true;
 194         }
 195         write_unlock(&n->lock);
 196         if (retval)
 197                 neigh_cleanup_and_release(n);
 198         return retval;
 199 }
 200
 201 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 202 {
 203         struct neigh_hash_table *nht;
 204         void *pkey = ndel->primary_key;
 205         u32 hash_val;
 206         struct neighbour *n;
 207         struct neighbour __rcu **np;
 208
 209         nht = rcu_dereference_protected(tbl->nht,
 210                                         lockdep_is_held(&tbl->lock));
 211         hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
 212         hash_val = hash_val >> (32 - nht->hash_shift);
 213
 214         np = &nht->hash_buckets[hash_val];
 215         while ((n = rcu_dereference_protected(*np,
 216                                               lockdep_is_held(&tbl->lock)))) {
 217                 if (n == ndel)
 218                         return neigh_del(n, np, tbl);
 219                 np = &n->next;
 220         }
 221         return false;
 222 }
 223
 224 static int neigh_forced_gc(struct neigh_table *tbl)
 225 {
 226         int max_clean = atomic_read(&tbl->gc_entries) - tbl->gc_thresh2;
 227         unsigned long tref = jiffies - 5 * HZ;
 228         struct neighbour *n, *tmp;
 229         int shrunk = 0;
 230
 231         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 232
 233         write_lock_bh(&tbl->lock);
 234
 235         list_for_each_entry_safe(n, tmp, &tbl->gc_list, gc_list) {
 236                 if (refcount_read(&n->refcnt) == 1) {
 237                         bool remove = false;
 238
 239                         write_lock(&n->lock);
 240                         if ((n->nud_state == NUD_FAILED) ||
 241                             (n->nud_state == NUD_NOARP) ||
 242                             (tbl->is_multicast &&
 243                              tbl->is_multicast(n->primary_key)) ||
 244                             time_after(tref, n->updated))
 245                                 remove = true;
 246                         write_unlock(&n->lock);
 247
 248                         if (remove && neigh_remove_one(n, tbl))
 249                                 shrunk++;
 250                         if (shrunk >= max_clean)
 251                                 break;
 252                 }
 253         }
 254
 255         tbl->last_flush = jiffies;
 256
 257         write_unlock_bh(&tbl->lock);
 258
 259         return shrunk;
 260 }
 261
 262 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 263 {
 264         neigh_hold(n);
 265         if (unlikely(mod_timer(&n->timer, when))) {
 266                 printk("NEIGH: BUG, double timer add, state is %x\n",
 267                        n->nud_state);
 268                 dump_stack();
 269         }
 270 }
 271
 272 static int neigh_del_timer(struct neighbour *n)
 273 {
 274         if ((n->nud_state & NUD_IN_TIMER) &&
 275             del_timer(&n->timer)) {
 276                 neigh_release(n);
 277                 return 1;
 278         }
 279         return 0;
 280 }
 281
 282 static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net)
 283 {
 284         struct sk_buff_head tmp;
 285         unsigned long flags;
 286         struct sk_buff *skb;
 287
 288         skb_queue_head_init(&tmp);
 289         spin_lock_irqsave(&list->lock, flags);
 290         skb = skb_peek(list);
 291         while (skb != NULL) {
 292                 struct sk_buff *skb_next = skb_peek_next(skb, list);
 293                 if (net == NULL || net_eq(dev_net(skb->dev), net)) {
 294                         __skb_unlink(skb, list);
 295                         __skb_queue_tail(&tmp, skb);
 296                 }
 297                 skb = skb_next;
 298         }
 299         spin_unlock_irqrestore(&list->lock, flags);
 300
 301         while ((skb = __skb_dequeue(&tmp))) {
 302                 dev_put(skb->dev);
 303                 kfree_skb(skb);
 304         }
 305 }
 306
 307 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev,
 308                             bool skip_perm)
 309 {
 310         int i;
 311         struct neigh_hash_table *nht;
 312
 313         nht = rcu_dereference_protected(tbl->nht,
 314                                         lockdep_is_held(&tbl->lock));
 315
 316         for (i = 0; i < (1 << nht->hash_shift); i++) {
 317                 struct neighbour *n;
 318                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 319
 320                 while ((n = rcu_dereference_protected(*np,
 321                                         lockdep_is_held(&tbl->lock))) != NULL) {
 322                         if (dev && n->dev != dev) {
 323                                 np = &n->next;
 324                                 continue;
 325                         }
 326                         if (skip_perm && n->nud_state & NUD_PERMANENT) {
 327                                 np = &n->next;
 328                                 continue;
 329                         }
 330                         rcu_assign_pointer(*np,
 331                                    rcu_dereference_protected(n->next,
 332                                                 lockdep_is_held(&tbl->lock)));
 333                         write_lock(&n->lock);
 334                         neigh_del_timer(n);
 335                         neigh_mark_dead(n);
 336                         if (refcount_read(&n->refcnt) != 1) {
 337                                 /* The most unpleasant situation.
 338                                    We must destroy neighbour entry,
 339                                    but someone still uses it.
 340
 341                                    The destroy will be delayed until
 342                                    the last user releases us, but
 343                                    we must kill timers etc. and move
 344                                    it to safe state.
 345                                  */
 346                                 __skb_queue_purge(&n->arp_queue);
 347                                 n->arp_queue_len_bytes = 0;
 348                                 n->output = neigh_blackhole;
 349                                 if (n->nud_state & NUD_VALID)
 350                                         n->nud_state = NUD_NOARP;
 351                                 else
 352                                         n->nud_state = NUD_NONE;
 353                                 neigh_dbg(2, "neigh %p is stray\n", n);
 354                         }
 355                         write_unlock(&n->lock);
 356                         neigh_cleanup_and_release(n);
 357                 }
 358         }
 359 }
 360
 361 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 362 {
 363         write_lock_bh(&tbl->lock);
 364         neigh_flush_dev(tbl, dev, false);
 365         write_unlock_bh(&tbl->lock);
 366 }
 367 EXPORT_SYMBOL(neigh_changeaddr);
 368
 369 static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
 370                           bool skip_perm)
 371 {
 372         write_lock_bh(&tbl->lock);
 373         neigh_flush_dev(tbl, dev, skip_perm);
 374         pneigh_ifdown_and_unlock(tbl, dev);
 375         pneigh_queue_purge(&tbl->proxy_queue, dev ? dev_net(dev) : NULL);
 376         if (skb_queue_empty_lockless(&tbl->proxy_queue))
 377                 del_timer_sync(&tbl->proxy_timer);
 378         return 0;
 379 }
 380
 381 int neigh_carrier_down(struct neigh_table *tbl, struct net_device *dev)
 382 {
 383         __neigh_ifdown(tbl, dev, true);
 384         return 0;
 385 }
 386 EXPORT_SYMBOL(neigh_carrier_down);
 387
 388 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 389 {
 390         __neigh_ifdown(tbl, dev, false);
 391         return 0;
 392 }
 393 EXPORT_SYMBOL(neigh_ifdown);
 394
 395 static struct neighbour *neigh_alloc(struct neigh_table *tbl,
 396                                      struct net_device *dev,
 397                                      u8 flags, bool exempt_from_gc)
 398 {
 399         struct neighbour *n = NULL;
 400         unsigned long now = jiffies;
 401         int entries;
 402
 403         if (exempt_from_gc)
 404                 goto do_alloc;
 405
 406         entries = atomic_inc_return(&tbl->gc_entries) - 1;
 407         if (entries >= tbl->gc_thresh3 ||
 408             (entries >= tbl->gc_thresh2 &&
 409              time_after(now, tbl->last_flush + 5 * HZ))) {
 410                 if (!neigh_forced_gc(tbl) &&
 411                     entries >= tbl->gc_thresh3) {
 412                         net_info_ratelimited("%s: neighbor table overflow!\n",
 413                                              tbl->id);
 414                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 415                         goto out_entries;
 416                 }
 417         }
 418
 419 do_alloc:
 420         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 421         if (!n)
 422                 goto out_entries;
 423
 424         __skb_queue_head_init(&n->arp_queue);
 425         rwlock_init(&n->lock);
 426         seqlock_init(&n->ha_lock);
 427         n->updated        = n->used = now;
 428         n->nud_state      = NUD_NONE;
 429         n->output         = neigh_blackhole;
 430         n->flags          = flags;
 431         seqlock_init(&n->hh.hh_lock);
 432         n->parms          = neigh_parms_clone(&tbl->parms);
 433         timer_setup(&n->timer, neigh_timer_handler, 0);
 434
 435         NEIGH_CACHE_STAT_INC(tbl, allocs);
 436         n->tbl            = tbl;
 437         refcount_set(&n->refcnt, 1);
 438         n->dead           = 1;
 439         INIT_LIST_HEAD(&n->gc_list);
 440
 441         atomic_inc(&tbl->entries);
 442 out:
 443         return n;
 444
 445 out_entries:
 446         if (!exempt_from_gc)
 447                 atomic_dec(&tbl->gc_entries);
 448         goto out;
 449 }
 450
 451 static void neigh_get_hash_rnd(u32 *x)
 452 {
 453         *x = get_random_u32() | 1;
 454 }
 455
 456 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 457 {
 458         size_t size = (1 << shift) * sizeof(struct neighbour *);
 459         struct neigh_hash_table *ret;
 460         struct neighbour __rcu **buckets;
 461         int i;
 462
 463         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 464         if (!ret)
 465                 return NULL;
 466         if (size <= PAGE_SIZE) {
 467                 buckets = kzalloc(size, GFP_ATOMIC);
 468         } else {
 469                 buckets = (struct neighbour __rcu **)
 470                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 471                                            get_order(size));
 472                 kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
 473         }
 474         if (!buckets) {
 475                 kfree(ret);
 476                 return NULL;
 477         }
 478         ret->hash_buckets = buckets;
 479         ret->hash_shift = shift;
 480         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 481                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 482         return ret;
 483 }
 484
 485 static void neigh_hash_free_rcu(struct rcu_head *head)
 486 {
 487         struct neigh_hash_table *nht = container_of(head,
 488                                                     struct neigh_hash_table,
 489                                                     rcu);
 490         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 491         struct neighbour __rcu **buckets = nht->hash_buckets;
 492
 493         if (size <= PAGE_SIZE) {
 494                 kfree(buckets);
 495         } else {
 496                 kmemleak_free(buckets);
 497                 free_pages((unsigned long)buckets, get_order(size));
 498         }
 499         kfree(nht);
 500 }
 501
 502 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 503                                                 unsigned long new_shift)
 504 {
 505         unsigned int i, hash;
 506         struct neigh_hash_table *new_nht, *old_nht;
 507
 508         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 509
 510         old_nht = rcu_dereference_protected(tbl->nht,
 511                                             lockdep_is_held(&tbl->lock));
 512         new_nht = neigh_hash_alloc(new_shift);
 513         if (!new_nht)
 514                 return old_nht;
 515
 516         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 517                 struct neighbour *n, *next;
 518
 519                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 520                                                    lockdep_is_held(&tbl->lock));
 521                      n != NULL;
 522                      n = next) {
 523                         hash = tbl->hash(n->primary_key, n->dev,
 524                                          new_nht->hash_rnd);
 525
 526                         hash >>= (32 - new_nht->hash_shift);
 527                         next = rcu_dereference_protected(n->next,
 528                                                 lockdep_is_held(&tbl->lock));
 529
 530                         rcu_assign_pointer(n->next,
 531                                            rcu_dereference_protected(
 532                                                 new_nht->hash_buckets[hash],
 533                                                 lockdep_is_held(&tbl->lock)));
 534                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 535                 }
 536         }
 537
 538         rcu_assign_pointer(tbl->nht, new_nht);
 539         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 540         return new_nht;
 541 }
 542
 543 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 544                                struct net_device *dev)
 545 {
 546         struct neighbour *n;
 547
 548         NEIGH_CACHE_STAT_INC(tbl, lookups);
 549
 550         rcu_read_lock_bh();
 551         n = __neigh_lookup_noref(tbl, pkey, dev);
 552         if (n) {
 553                 if (!refcount_inc_not_zero(&n->refcnt))
 554                         n = NULL;
 555                 NEIGH_CACHE_STAT_INC(tbl, hits);
 556         }
 557
 558         rcu_read_unlock_bh();
 559         return n;
 560 }
 561 EXPORT_SYMBOL(neigh_lookup);
 562
 563 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 564                                      const void *pkey)
 565 {
 566         struct neighbour *n;
 567         unsigned int key_len = tbl->key_len;
 568         u32 hash_val;
 569         struct neigh_hash_table *nht;
 570
 571         NEIGH_CACHE_STAT_INC(tbl, lookups);
 572
 573         rcu_read_lock_bh();
 574         nht = rcu_dereference_bh(tbl->nht);
 575         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 576
 577         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 578              n != NULL;
 579              n = rcu_dereference_bh(n->next)) {
 580                 if (!memcmp(n->primary_key, pkey, key_len) &&
 581                     net_eq(dev_net(n->dev), net)) {
 582                         if (!refcount_inc_not_zero(&n->refcnt))
 583                                 n = NULL;
 584                         NEIGH_CACHE_STAT_INC(tbl, hits);
 585                         break;
 586                 }
 587         }
 588
 589         rcu_read_unlock_bh();
 590         return n;
 591 }
 592 EXPORT_SYMBOL(neigh_lookup_nodev);
 593
 594 static struct neighbour *
 595 ___neigh_create(struct neigh_table *tbl, const void *pkey,
 596                 struct net_device *dev, u8 flags,
 597                 bool exempt_from_gc, bool want_ref)
 598 {
 599         u32 hash_val, key_len = tbl->key_len;
 600         struct neighbour *n1, *rc, *n;
 601         struct neigh_hash_table *nht;
 602         int error;
 603
 604         n = neigh_alloc(tbl, dev, flags, exempt_from_gc);
 605         trace_neigh_create(tbl, dev, pkey, n, exempt_from_gc);
 606         if (!n) {
 607                 rc = ERR_PTR(-ENOBUFS);
 608                 goto out;
 609         }
 610
 611         memcpy(n->primary_key, pkey, key_len);
 612         n->dev = dev;
 613         dev_hold(dev);
 614
 615         /* Protocol specific setup. */
 616         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 617                 rc = ERR_PTR(error);
 618                 goto out_neigh_release;
 619         }
 620
 621         if (dev->netdev_ops->ndo_neigh_construct) {
 622                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 623                 if (error < 0) {
 624                         rc = ERR_PTR(error);
 625                         goto out_neigh_release;
 626                 }
 627         }
 628
 629         /* Device specific setup. */
 630         if (n->parms->neigh_setup &&
 631             (error = n->parms->neigh_setup(n)) < 0) {
 632                 rc = ERR_PTR(error);
 633                 goto out_neigh_release;
 634         }
 635
 636         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 637
 638         write_lock_bh(&tbl->lock);
 639         nht = rcu_dereference_protected(tbl->nht,
 640                                         lockdep_is_held(&tbl->lock));
 641
 642         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 643                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 644
 645         hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 646
 647         if (n->parms->dead) {
 648                 rc = ERR_PTR(-EINVAL);
 649                 goto out_tbl_unlock;
 650         }
 651
 652         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 653                                             lockdep_is_held(&tbl->lock));
 654              n1 != NULL;
 655              n1 = rcu_dereference_protected(n1->next,
 656                         lockdep_is_held(&tbl->lock))) {
 657                 if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) {
 658                         if (want_ref)
 659                                 neigh_hold(n1);
 660                         rc = n1;
 661                         goto out_tbl_unlock;
 662                 }
 663         }
 664
 665         n->dead = 0;
 666         if (!exempt_from_gc)
 667                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 668
 669         if (want_ref)
 670                 neigh_hold(n);
 671         rcu_assign_pointer(n->next,
 672                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 673                                                      lockdep_is_held(&tbl->lock)));
 674         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 675         write_unlock_bh(&tbl->lock);
 676         neigh_dbg(2, "neigh %p is created\n", n);
 677         rc = n;
 678 out:
 679         return rc;
 680 out_tbl_unlock:
 681         write_unlock_bh(&tbl->lock);
 682 out_neigh_release:
 683         if (!exempt_from_gc)
 684                 atomic_dec(&tbl->gc_entries);
 685         neigh_release(n);
 686         goto out;
 687 }
 688
 689 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 690                                  struct net_device *dev, bool want_ref)
 691 {
 692         return ___neigh_create(tbl, pkey, dev, 0, false, want_ref);
 693 }
 694 EXPORT_SYMBOL(__neigh_create);
 695
 696 static u32 pneigh_hash(const void *pkey, unsigned int key_len)
 697 {
 698         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 699         hash_val ^= (hash_val >> 16);
 700         hash_val ^= hash_val >> 8;
 701         hash_val ^= hash_val >> 4;
 702         hash_val &= PNEIGH_HASHMASK;
 703         return hash_val;
 704 }
 705
 706 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 707                                               struct net *net,
 708                                               const void *pkey,
 709                                               unsigned int key_len,
 710                                               struct net_device *dev)
 711 {
 712         while (n) {
 713                 if (!memcmp(n->key, pkey, key_len) &&
 714                     net_eq(pneigh_net(n), net) &&
 715                     (n->dev == dev || !n->dev))
 716                         return n;
 717                 n = n->next;
 718         }
 719         return NULL;
 720 }
 721
 722 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 723                 struct net *net, const void *pkey, struct net_device *dev)
 724 {
 725         unsigned int key_len = tbl->key_len;
 726         u32 hash_val = pneigh_hash(pkey, key_len);
 727
 728         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 729                                  net, pkey, key_len, dev);
 730 }
 731 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 732
 733 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 734                                     struct net *net, const void *pkey,
 735                                     struct net_device *dev, int creat)
 736 {
 737         struct pneigh_entry *n;
 738         unsigned int key_len = tbl->key_len;
 739         u32 hash_val = pneigh_hash(pkey, key_len);
 740
 741         read_lock_bh(&tbl->lock);
 742         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 743                               net, pkey, key_len, dev);
 744         read_unlock_bh(&tbl->lock);
 745
 746         if (n || !creat)
 747                 goto out;
 748
 749         ASSERT_RTNL();
 750
 751         n = kzalloc(sizeof(*n) + key_len, GFP_KERNEL);
 752         if (!n)
 753                 goto out;
 754
 755         write_pnet(&n->net, net);
 756         memcpy(n->key, pkey, key_len);
 757         n->dev = dev;
 758         dev_hold(dev);
 759
 760         if (tbl->pconstructor && tbl->pconstructor(n)) {
 761                 dev_put(dev);
 762                 kfree(n);
 763                 n = NULL;
 764                 goto out;
 765         }
 766
 767         write_lock_bh(&tbl->lock);
 768         n->next = tbl->phash_buckets[hash_val];
 769         tbl->phash_buckets[hash_val] = n;
 770         write_unlock_bh(&tbl->lock);
 771 out:
 772         return n;
 773 }
 774 EXPORT_SYMBOL(pneigh_lookup);
 775
 776
 777 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 778                   struct net_device *dev)
 779 {
 780         struct pneigh_entry *n, **np;
 781         unsigned int key_len = tbl->key_len;
 782         u32 hash_val = pneigh_hash(pkey, key_len);
 783
 784         write_lock_bh(&tbl->lock);
 785         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 786              np = &n->next) {
 787                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 788                     net_eq(pneigh_net(n), net)) {
 789                         *np = n->next;
 790                         write_unlock_bh(&tbl->lock);
 791                         if (tbl->pdestructor)
 792                                 tbl->pdestructor(n);
 793                         dev_put(n->dev);
 794                         kfree(n);
 795                         return 0;
 796                 }
 797         }
 798         write_unlock_bh(&tbl->lock);
 799         return -ENOENT;
 800 }
 801
 802 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
 803                                     struct net_device *dev)
 804 {
 805         struct pneigh_entry *n, **np, *freelist = NULL;
 806         u32 h;
 807
 808         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 809                 np = &tbl->phash_buckets[h];
 810                 while ((n = *np) != NULL) {
 811                         if (!dev || n->dev == dev) {
 812                                 *np = n->next;
 813                                 n->next = freelist;
 814                                 freelist = n;
 815                                 continue;
 816                         }
 817                         np = &n->next;
 818                 }
 819         }
 820         write_unlock_bh(&tbl->lock);
 821         while ((n = freelist)) {
 822                 freelist = n->next;
 823                 n->next = NULL;
 824                 if (tbl->pdestructor)
 825                         tbl->pdestructor(n);
 826                 dev_put(n->dev);
 827                 kfree(n);
 828         }
 829         return -ENOENT;
 830 }
 831
 832 static void neigh_parms_destroy(struct neigh_parms *parms);
 833
 834 static inline void neigh_parms_put(struct neigh_parms *parms)
 835 {
 836         if (refcount_dec_and_test(&parms->refcnt))
 837                 neigh_parms_destroy(parms);
 838 }
 839
 840 /*
 841  *      neighbour must already be out of the table;
 842  *
 843  */
 844 void neigh_destroy(struct neighbour *neigh)
 845 {
 846         struct net_device *dev = neigh->dev;
 847
 848         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 849
 850         if (!neigh->dead) {
 851                 pr_warn("Destroying alive neighbour %p\n", neigh);
 852                 dump_stack();
 853                 return;
 854         }
 855
 856         if (neigh_del_timer(neigh))
 857                 pr_warn("Impossible event\n");
 858
 859         write_lock_bh(&neigh->lock);
 860         __skb_queue_purge(&neigh->arp_queue);
 861         write_unlock_bh(&neigh->lock);
 862         neigh->arp_queue_len_bytes = 0;
 863
 864         if (dev->netdev_ops->ndo_neigh_destroy)
 865                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 866
 867         dev_put(dev);
 868         neigh_parms_put(neigh->parms);
 869
 870         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 871
 872         atomic_dec(&neigh->tbl->entries);
 873         kfree_rcu(neigh, rcu);
 874 }
 875 EXPORT_SYMBOL(neigh_destroy);
 876
 877 /* Neighbour state is suspicious;
 878    disable fast path.
 879
 880    Called with write_locked neigh.
 881  */
 882 static void neigh_suspect(struct neighbour *neigh)
 883 {
 884         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 885
 886         neigh->output = neigh->ops->output;
 887 }
 888
 889 /* Neighbour state is OK;
 890    enable fast path.
 891
 892    Called with write_locked neigh.
 893  */
 894 static void neigh_connect(struct neighbour *neigh)
 895 {
 896         neigh_dbg(2, "neigh %p is connected\n", neigh);
 897
 898         neigh->output = neigh->ops->connected_output;
 899 }
 900
 901 static void neigh_periodic_work(struct work_struct *work)
 902 {
 903         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 904         struct neighbour *n;
 905         struct neighbour __rcu **np;
 906         unsigned int i;
 907         struct neigh_hash_table *nht;
 908
 909         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 910
 911         write_lock_bh(&tbl->lock);
 912         nht = rcu_dereference_protected(tbl->nht,
 913                                         lockdep_is_held(&tbl->lock));
 914
 915         /*
 916          *      periodically recompute ReachableTime from random function
 917          */
 918
 919         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 920                 struct neigh_parms *p;
 921                 tbl->last_rand = jiffies;
 922                 list_for_each_entry(p, &tbl->parms_list, list)
 923                         p->reachable_time =
 924                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 925         }
 926
 927         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 928                 goto out;
 929
 930         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 931                 np = &nht->hash_buckets[i];
 932
 933                 while ((n = rcu_dereference_protected(*np,
 934                                 lockdep_is_held(&tbl->lock))) != NULL) {
 935                         unsigned int state;
 936
 937                         write_lock(&n->lock);
 938
 939                         state = n->nud_state;
 940                         if ((state & (NUD_PERMANENT | NUD_IN_TIMER)) ||
 941                             (n->flags & NTF_EXT_LEARNED)) {
 942                                 write_unlock(&n->lock);
 943                                 goto next_elt;
 944                         }
 945
 946                         if (time_before(n->used, n->confirmed))
 947                                 n->used = n->confirmed;
 948
 949                         if (refcount_read(&n->refcnt) == 1 &&
 950                             (state == NUD_FAILED ||
 951                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 952                                 *np = n->next;
 953                                 neigh_mark_dead(n);
 954                                 write_unlock(&n->lock);
 955                                 neigh_cleanup_and_release(n);
 956                                 continue;
 957                         }
 958                         write_unlock(&n->lock);
 959
 960 next_elt:
 961                         np = &n->next;
 962                 }
 963                 /*
 964                  * It's fine to release lock here, even if hash table
 965                  * grows while we are preempted.
 966                  */
 967                 write_unlock_bh(&tbl->lock);
 968                 cond_resched();
 969                 write_lock_bh(&tbl->lock);
 970                 nht = rcu_dereference_protected(tbl->nht,
 971                                                 lockdep_is_held(&tbl->lock));
 972         }
 973 out:
 974         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 975          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 976          * BASE_REACHABLE_TIME.
 977          */
 978         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 979                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 980         write_unlock_bh(&tbl->lock);
 981 }
 982
 983 static __inline__ int neigh_max_probes(struct neighbour *n)
 984 {
 985         struct neigh_parms *p = n->parms;
 986         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 987                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 988                 NEIGH_VAR(p, MCAST_PROBES));
 989 }
 990
 991 static void neigh_invalidate(struct neighbour *neigh)
 992         __releases(neigh->lock)
 993         __acquires(neigh->lock)
 994 {
 995         struct sk_buff *skb;
 996
 997         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 998         neigh_dbg(2, "neigh %p is failed\n", neigh);
 999         neigh->updated = jiffies;
1000
1001         /* It is very thin place. report_unreachable is very complicated
1002            routine. Particularly, it can hit the same neighbour entry!
1003
1004            So that, we try to be accurate and avoid dead loop. --ANK
1005          */
1006         while (neigh->nud_state == NUD_FAILED &&
1007                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1008                 write_unlock(&neigh->lock);
1009                 neigh->ops->error_report(neigh, skb);
1010                 write_lock(&neigh->lock);
1011         }
1012         __skb_queue_purge(&neigh->arp_queue);
1013         neigh->arp_queue_len_bytes = 0;
1014 }
1015
1016 static void neigh_probe(struct neighbour *neigh)
1017         __releases(neigh->lock)
1018 {
1019         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
1020         /* keep skb alive even if arp_queue overflows */
1021         if (skb)
1022                 skb = skb_clone(skb, GFP_ATOMIC);
1023         write_unlock(&neigh->lock);
1024         if (neigh->ops->solicit)
1025                 neigh->ops->solicit(neigh, skb);
1026         atomic_inc(&neigh->probes);
1027         consume_skb(skb);
1028 }
1029
1030 /* Called when a timer expires for a neighbour entry. */
1031
1032 static void neigh_timer_handler(struct timer_list *t)
1033 {
1034         unsigned long now, next;
1035         struct neighbour *neigh = from_timer(neigh, t, timer);
1036         unsigned int state;
1037         int notify = 0;
1038
1039         write_lock(&neigh->lock);
1040
1041         state = neigh->nud_state;
1042         now = jiffies;
1043         next = now + HZ;
1044
1045         if (!(state & NUD_IN_TIMER))
1046                 goto out;
1047
1048         if (state & NUD_REACHABLE) {
1049                 if (time_before_eq(now,
1050                                    neigh->confirmed + neigh->parms->reachable_time)) {
1051                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
1052                         next = neigh->confirmed + neigh->parms->reachable_time;
1053                 } else if (time_before_eq(now,
1054                                           neigh->used +
1055                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1056                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
1057                         neigh->nud_state = NUD_DELAY;
1058                         neigh->updated = jiffies;
1059                         neigh_suspect(neigh);
1060                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
1061                 } else {
1062                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
1063                         neigh->nud_state = NUD_STALE;
1064                         neigh->updated = jiffies;
1065                         neigh_suspect(neigh);
1066                         notify = 1;
1067                 }
1068         } else if (state & NUD_DELAY) {
1069                 if (time_before_eq(now,
1070                                    neigh->confirmed +
1071                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1072                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
1073                         neigh->nud_state = NUD_REACHABLE;
1074                         neigh->updated = jiffies;
1075                         neigh_connect(neigh);
1076                         notify = 1;
1077                         next = neigh->confirmed + neigh->parms->reachable_time;
1078                 } else {
1079                         neigh_dbg(2, "neigh %p is probed\n", neigh);
1080                         neigh->nud_state = NUD_PROBE;
1081                         neigh->updated = jiffies;
1082                         atomic_set(&neigh->probes, 0);
1083                         notify = 1;
1084                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1085                                          HZ/100);
1086                 }
1087         } else {
1088                 /* NUD_PROBE|NUD_INCOMPLETE */
1089                 next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME), HZ/100);
1090         }
1091
1092         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
1093             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
1094                 neigh->nud_state = NUD_FAILED;
1095                 notify = 1;
1096                 neigh_invalidate(neigh);
1097                 goto out;
1098         }
1099
1100         if (neigh->nud_state & NUD_IN_TIMER) {
1101                 if (time_before(next, jiffies + HZ/100))
1102                         next = jiffies + HZ/100;
1103                 if (!mod_timer(&neigh->timer, next))
1104                         neigh_hold(neigh);
1105         }
1106         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
1107                 neigh_probe(neigh);
1108         } else {
1109 out:
1110                 write_unlock(&neigh->lock);
1111         }
1112
1113         if (notify)
1114                 neigh_update_notify(neigh, 0);
1115
1116         trace_neigh_timer_handler(neigh, 0);
1117
1118         neigh_release(neigh);
1119 }
1120
1121 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
1122 {
1123         int rc;
1124         bool immediate_probe = false;
1125
1126         write_lock_bh(&neigh->lock);
1127
1128         rc = 0;
1129         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1130                 goto out_unlock_bh;
1131         if (neigh->dead)
1132                 goto out_dead;
1133
1134         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1135                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1136                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
1137                         unsigned long next, now = jiffies;
1138
1139                         atomic_set(&neigh->probes,
1140                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
1141                         neigh_del_timer(neigh);
1142                         neigh->nud_state     = NUD_INCOMPLETE;
1143                         neigh->updated = now;
1144                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1145                                          HZ/100);
1146                         neigh_add_timer(neigh, next);
1147                         immediate_probe = true;
1148                 } else {
1149                         neigh->nud_state = NUD_FAILED;
1150                         neigh->updated = jiffies;
1151                         write_unlock_bh(&neigh->lock);
1152
1153                         kfree_skb(skb);
1154                         return 1;
1155                 }
1156         } else if (neigh->nud_state & NUD_STALE) {
1157                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1158                 neigh_del_timer(neigh);
1159                 neigh->nud_state = NUD_DELAY;
1160                 neigh->updated = jiffies;
1161                 neigh_add_timer(neigh, jiffies +
1162                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1163         }
1164
1165         if (neigh->nud_state == NUD_INCOMPLETE) {
1166                 if (skb) {
1167                         while (neigh->arp_queue_len_bytes + skb->truesize >
1168                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1169                                 struct sk_buff *buff;
1170
1171                                 buff = __skb_dequeue(&neigh->arp_queue);
1172                                 if (!buff)
1173                                         break;
1174                                 neigh->arp_queue_len_bytes -= buff->truesize;
1175                                 kfree_skb(buff);
1176                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1177                         }
1178                         skb_dst_force(skb);
1179                         __skb_queue_tail(&neigh->arp_queue, skb);
1180                         neigh->arp_queue_len_bytes += skb->truesize;
1181                 }
1182                 rc = 1;
1183         }
1184 out_unlock_bh:
1185         if (immediate_probe)
1186                 neigh_probe(neigh);
1187         else
1188                 write_unlock(&neigh->lock);
1189         local_bh_enable();
1190         trace_neigh_event_send_done(neigh, rc);
1191         return rc;
1192
1193 out_dead:
1194         if (neigh->nud_state & NUD_STALE)
1195                 goto out_unlock_bh;
1196         write_unlock_bh(&neigh->lock);
1197         kfree_skb(skb);
1198         trace_neigh_event_send_dead(neigh, 1);
1199         return 1;
1200 }
1201 EXPORT_SYMBOL(__neigh_event_send);
1202
1203 static void neigh_update_hhs(struct neighbour *neigh)
1204 {
1205         struct hh_cache *hh;
1206         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1207                 = NULL;
1208
1209         if (neigh->dev->header_ops)
1210                 update = neigh->dev->header_ops->cache_update;
1211
1212         if (update) {
1213                 hh = &neigh->hh;
1214                 if (READ_ONCE(hh->hh_len)) {
1215                         write_seqlock_bh(&hh->hh_lock);
1216                         update(hh, neigh->dev, neigh->ha);
1217                         write_sequnlock_bh(&hh->hh_lock);
1218                 }
1219         }
1220 }
1221
1222
1223
1224 /* Generic update routine.
1225    -- lladdr is new lladdr or NULL, if it is not supplied.
1226    -- new    is new state.
1227    -- flags
1228         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1229                                 if it is different.
1230         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1231                                 lladdr instead of overriding it
1232                                 if it is different.
1233         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1234         NEIGH_UPDATE_F_USE      means that the entry is user triggered.
1235         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1236                                 NTF_ROUTER flag.
1237         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1238                                 a router.
1239
1240    Caller MUST hold reference count on the entry.
1241  */
1242
1243 static int __neigh_update(struct neighbour *neigh, const u8 *lladdr,
1244                           u8 new, u32 flags, u32 nlmsg_pid,
1245                           struct netlink_ext_ack *extack)
1246 {
1247         bool ext_learn_change = false;
1248         u8 old;
1249         int err;
1250         int notify = 0;
1251         struct net_device *dev;
1252         int update_isrouter = 0;
1253
1254         trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid);
1255
1256         write_lock_bh(&neigh->lock);
1257
1258         dev    = neigh->dev;
1259         old    = neigh->nud_state;
1260         err    = -EPERM;
1261
1262         if (neigh->dead) {
1263                 NL_SET_ERR_MSG(extack, "Neighbor entry is now dead");
1264                 new = old;
1265                 goto out;
1266         }
1267         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1268             (old & (NUD_NOARP | NUD_PERMANENT)))
1269                 goto out;
1270
1271         ext_learn_change = neigh_update_ext_learned(neigh, flags, &notify);
1272         if (flags & NEIGH_UPDATE_F_USE) {
1273                 new = old & ~NUD_PERMANENT;
1274                 neigh->nud_state = new;
1275                 err = 0;
1276                 goto out;
1277         }
1278
1279         if (!(new & NUD_VALID)) {
1280                 neigh_del_timer(neigh);
1281                 if (old & NUD_CONNECTED)
1282                         neigh_suspect(neigh);
1283                 neigh->nud_state = new;
1284                 err = 0;
1285                 notify = old & NUD_VALID;
1286                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1287                     (new & NUD_FAILED)) {
1288                         neigh_invalidate(neigh);
1289                         notify = 1;
1290                 }
1291                 goto out;
1292         }
1293
1294         /* Compare new lladdr with cached one */
1295         if (!dev->addr_len) {
1296                 /* First case: device needs no address. */
1297                 lladdr = neigh->ha;
1298         } else if (lladdr) {
1299                 /* The second case: if something is already cached
1300                    and a new address is proposed:
1301                    - compare new & old
1302                    - if they are different, check override flag
1303                  */
1304                 if ((old & NUD_VALID) &&
1305                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1306                         lladdr = neigh->ha;
1307         } else {
1308                 /* No address is supplied; if we know something,
1309                    use it, otherwise discard the request.
1310                  */
1311                 err = -EINVAL;
1312                 if (!(old & NUD_VALID)) {
1313                         NL_SET_ERR_MSG(extack, "No link layer address given");
1314                         goto out;
1315                 }
1316                 lladdr = neigh->ha;
1317         }
1318
1319         /* Update confirmed timestamp for neighbour entry after we
1320          * received ARP packet even if it doesn't change IP to MAC binding.
1321          */
1322         if (new & NUD_CONNECTED)
1323                 neigh->confirmed = jiffies;
1324
1325         /* If entry was valid and address is not changed,
1326            do not change entry state, if new one is STALE.
1327          */
1328         err = 0;
1329         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1330         if (old & NUD_VALID) {
1331                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1332                         update_isrouter = 0;
1333                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1334                             (old & NUD_CONNECTED)) {
1335                                 lladdr = neigh->ha;
1336                                 new = NUD_STALE;
1337                         } else
1338                                 goto out;
1339                 } else {
1340                         if (lladdr == neigh->ha && new == NUD_STALE &&
1341                             !(flags & NEIGH_UPDATE_F_ADMIN))
1342                                 new = old;
1343                 }
1344         }
1345
1346         /* Update timestamp only once we know we will make a change to the
1347          * neighbour entry. Otherwise we risk to move the locktime window with
1348          * noop updates and ignore relevant ARP updates.
1349          */
1350         if (new != old || lladdr != neigh->ha)
1351                 neigh->updated = jiffies;
1352
1353         if (new != old) {
1354                 neigh_del_timer(neigh);
1355                 if (new & NUD_PROBE)
1356                         atomic_set(&neigh->probes, 0);
1357                 if (new & NUD_IN_TIMER)
1358                         neigh_add_timer(neigh, (jiffies +
1359                                                 ((new & NUD_REACHABLE) ?
1360                                                  neigh->parms->reachable_time :
1361                                                  0)));
1362                 neigh->nud_state = new;
1363                 notify = 1;
1364         }
1365
1366         if (lladdr != neigh->ha) {
1367                 write_seqlock(&neigh->ha_lock);
1368                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1369                 write_sequnlock(&neigh->ha_lock);
1370                 neigh_update_hhs(neigh);
1371                 if (!(new & NUD_CONNECTED))
1372                         neigh->confirmed = jiffies -
1373                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1374                 notify = 1;
1375         }
1376         if (new == old)
1377                 goto out;
1378         if (new & NUD_CONNECTED)
1379                 neigh_connect(neigh);
1380         else
1381                 neigh_suspect(neigh);
1382         if (!(old & NUD_VALID)) {
1383                 struct sk_buff *skb;
1384
1385                 /* Again: avoid dead loop if something went wrong */
1386
1387                 while (neigh->nud_state & NUD_VALID &&
1388                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1389                         struct dst_entry *dst = skb_dst(skb);
1390                         struct neighbour *n2, *n1 = neigh;
1391                         write_unlock_bh(&neigh->lock);
1392
1393                         rcu_read_lock();
1394
1395                         /* Why not just use 'neigh' as-is?  The problem is that
1396                          * things such as shaper, eql, and sch_teql can end up
1397                          * using alternative, different, neigh objects to output
1398                          * the packet in the output path.  So what we need to do
1399                          * here is re-lookup the top-level neigh in the path so
1400                          * we can reinject the packet there.
1401                          */
1402                         n2 = NULL;
1403                         if (dst && dst->obsolete != DST_OBSOLETE_DEAD) {
1404                                 n2 = dst_neigh_lookup_skb(dst, skb);
1405                                 if (n2)
1406                                         n1 = n2;
1407                         }
1408                         n1->output(n1, skb);
1409                         if (n2)
1410                                 neigh_release(n2);
1411                         rcu_read_unlock();
1412
1413                         write_lock_bh(&neigh->lock);
1414                 }
1415                 __skb_queue_purge(&neigh->arp_queue);
1416                 neigh->arp_queue_len_bytes = 0;
1417         }
1418 out:
1419         if (update_isrouter)
1420                 neigh_update_is_router(neigh, flags, &notify);
1421         write_unlock_bh(&neigh->lock);
1422
1423         if (((new ^ old) & NUD_PERMANENT) || ext_learn_change)
1424                 neigh_update_gc_list(neigh);
1425
1426         if (notify)
1427                 neigh_update_notify(neigh, nlmsg_pid);
1428
1429         trace_neigh_update_done(neigh, err);
1430
1431         return err;
1432 }
1433
1434 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1435                  u32 flags, u32 nlmsg_pid)
1436 {
1437         return __neigh_update(neigh, lladdr, new, flags, nlmsg_pid, NULL);
1438 }
1439 EXPORT_SYMBOL(neigh_update);
1440
1441 /* Update the neigh to listen temporarily for probe responses, even if it is
1442  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1443  */
1444 void __neigh_set_probe_once(struct neighbour *neigh)
1445 {
1446         if (neigh->dead)
1447                 return;
1448         neigh->updated = jiffies;
1449         if (!(neigh->nud_state & NUD_FAILED))
1450                 return;
1451         neigh->nud_state = NUD_INCOMPLETE;
1452         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1453         neigh_add_timer(neigh,
1454                         jiffies + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1455                                       HZ/100));
1456 }
1457 EXPORT_SYMBOL(__neigh_set_probe_once);
1458
1459 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1460                                  u8 *lladdr, void *saddr,
1461                                  struct net_device *dev)
1462 {
1463         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1464                                                  lladdr || !dev->addr_len);
1465         if (neigh)
1466                 neigh_update(neigh, lladdr, NUD_STALE,
1467                              NEIGH_UPDATE_F_OVERRIDE, 0);
1468         return neigh;
1469 }
1470 EXPORT_SYMBOL(neigh_event_ns);
1471
1472 /* called with read_lock_bh(&n->lock); */
1473 static void neigh_hh_init(struct neighbour *n)
1474 {
1475         struct net_device *dev = n->dev;
1476         __be16 prot = n->tbl->protocol;
1477         struct hh_cache *hh = &n->hh;
1478
1479         write_lock_bh(&n->lock);
1480
1481         /* Only one thread can come in here and initialize the
1482          * hh_cache entry.
1483          */
1484         if (!hh->hh_len)
1485                 dev->header_ops->cache(n, hh, prot);
1486
1487         write_unlock_bh(&n->lock);
1488 }
1489
1490 /* Slow and careful. */
1491
1492 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1493 {
1494         int rc = 0;
1495
1496         if (!neigh_event_send(neigh, skb)) {
1497                 int err;
1498                 struct net_device *dev = neigh->dev;
1499                 unsigned int seq;
1500
1501                 if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
1502                         neigh_hh_init(neigh);
1503
1504                 do {
1505                         __skb_pull(skb, skb_network_offset(skb));
1506                         seq = read_seqbegin(&neigh->ha_lock);
1507                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1508                                               neigh->ha, NULL, skb->len);
1509                 } while (read_seqretry(&neigh->ha_lock, seq));
1510
1511                 if (err >= 0)
1512                         rc = dev_queue_xmit(skb);
1513                 else
1514                         goto out_kfree_skb;
1515         }
1516 out:
1517         return rc;
1518 out_kfree_skb:
1519         rc = -EINVAL;
1520         kfree_skb(skb);
1521         goto out;
1522 }
1523 EXPORT_SYMBOL(neigh_resolve_output);
1524
1525 /* As fast as possible without hh cache */
1526
1527 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1528 {
1529         struct net_device *dev = neigh->dev;
1530         unsigned int seq;
1531         int err;
1532
1533         do {
1534                 __skb_pull(skb, skb_network_offset(skb));
1535                 seq = read_seqbegin(&neigh->ha_lock);
1536                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1537                                       neigh->ha, NULL, skb->len);
1538         } while (read_seqretry(&neigh->ha_lock, seq));
1539
1540         if (err >= 0)
1541                 err = dev_queue_xmit(skb);
1542         else {
1543                 err = -EINVAL;
1544                 kfree_skb(skb);
1545         }
1546         return err;
1547 }
1548 EXPORT_SYMBOL(neigh_connected_output);
1549
1550 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1551 {
1552         return dev_queue_xmit(skb);
1553 }
1554 EXPORT_SYMBOL(neigh_direct_output);
1555
1556 static void neigh_proxy_process(struct timer_list *t)
1557 {
1558         struct neigh_table *tbl = from_timer(tbl, t, proxy_timer);
1559         long sched_next = 0;
1560         unsigned long now = jiffies;
1561         struct sk_buff *skb, *n;
1562
1563         spin_lock(&tbl->proxy_queue.lock);
1564
1565         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1566                 long tdif = NEIGH_CB(skb)->sched_next - now;
1567
1568                 if (tdif <= 0) {
1569                         struct net_device *dev = skb->dev;
1570
1571                         __skb_unlink(skb, &tbl->proxy_queue);
1572                         if (tbl->proxy_redo && netif_running(dev)) {
1573                                 rcu_read_lock();
1574                                 tbl->proxy_redo(skb);
1575                                 rcu_read_unlock();
1576                         } else {
1577                                 kfree_skb(skb);
1578                         }
1579
1580                         dev_put(dev);
1581                 } else if (!sched_next || tdif < sched_next)
1582                         sched_next = tdif;
1583         }
1584         del_timer(&tbl->proxy_timer);
1585         if (sched_next)
1586                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1587         spin_unlock(&tbl->proxy_queue.lock);
1588 }
1589
1590 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1591                     struct sk_buff *skb)
1592 {
1593         unsigned long sched_next = jiffies +
1594                         prandom_u32_max(NEIGH_VAR(p, PROXY_DELAY));
1595
1596         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1597                 kfree_skb(skb);
1598                 return;
1599         }
1600
1601         NEIGH_CB(skb)->sched_next = sched_next;
1602         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1603
1604         spin_lock(&tbl->proxy_queue.lock);
1605         if (del_timer(&tbl->proxy_timer)) {
1606                 if (time_before(tbl->proxy_timer.expires, sched_next))
1607                         sched_next = tbl->proxy_timer.expires;
1608         }
1609         skb_dst_drop(skb);
1610         dev_hold(skb->dev);
1611         __skb_queue_tail(&tbl->proxy_queue, skb);
1612         mod_timer(&tbl->proxy_timer, sched_next);
1613         spin_unlock(&tbl->proxy_queue.lock);
1614 }
1615 EXPORT_SYMBOL(pneigh_enqueue);
1616
1617 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1618                                                       struct net *net, int ifindex)
1619 {
1620         struct neigh_parms *p;
1621
1622         list_for_each_entry(p, &tbl->parms_list, list) {
1623                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1624                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1625                         return p;
1626         }
1627
1628         return NULL;
1629 }
1630
1631 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1632                                       struct neigh_table *tbl)
1633 {
1634         struct neigh_parms *p;
1635         struct net *net = dev_net(dev);
1636         const struct net_device_ops *ops = dev->netdev_ops;
1637
1638         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1639         if (p) {
1640                 p->tbl            = tbl;
1641                 refcount_set(&p->refcnt, 1);
1642                 p->reachable_time =
1643                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1644                 dev_hold(dev);
1645                 p->dev = dev;
1646                 write_pnet(&p->net, net);
1647                 p->sysctl_table = NULL;
1648
1649                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1650                         dev_put(dev);
1651                         kfree(p);
1652                         return NULL;
1653                 }
1654
1655                 write_lock_bh(&tbl->lock);
1656                 list_add(&p->list, &tbl->parms.list);
1657                 write_unlock_bh(&tbl->lock);
1658
1659                 neigh_parms_data_state_cleanall(p);
1660         }
1661         return p;
1662 }
1663 EXPORT_SYMBOL(neigh_parms_alloc);
1664
1665 static void neigh_rcu_free_parms(struct rcu_head *head)
1666 {
1667         struct neigh_parms *parms =
1668                 container_of(head, struct neigh_parms, rcu_head);
1669
1670         neigh_parms_put(parms);
1671 }
1672
1673 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1674 {
1675         if (!parms || parms == &tbl->parms)
1676                 return;
1677         write_lock_bh(&tbl->lock);
1678         list_del(&parms->list);
1679         parms->dead = 1;
1680         write_unlock_bh(&tbl->lock);
1681         dev_put(parms->dev);
1682         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1683 }
1684 EXPORT_SYMBOL(neigh_parms_release);
1685
1686 static void neigh_parms_destroy(struct neigh_parms *parms)
1687 {
1688         kfree(parms);
1689 }
1690
1691 static struct lock_class_key neigh_table_proxy_queue_class;
1692
1693 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1694
1695 void neigh_table_init(int index, struct neigh_table *tbl)
1696 {
1697         unsigned long now = jiffies;
1698         unsigned long phsize;
1699
1700         INIT_LIST_HEAD(&tbl->parms_list);
1701         INIT_LIST_HEAD(&tbl->gc_list);
1702         list_add(&tbl->parms.list, &tbl->parms_list);
1703         write_pnet(&tbl->parms.net, &init_net);
1704         refcount_set(&tbl->parms.refcnt, 1);
1705         tbl->parms.reachable_time =
1706                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1707
1708         tbl->stats = alloc_percpu(struct neigh_statistics);
1709         if (!tbl->stats)
1710                 panic("cannot create neighbour cache statistics");
1711
1712 #ifdef CONFIG_PROC_FS
1713         if (!proc_create_seq_data(tbl->id, 0, init_net.proc_net_stat,
1714                               &neigh_stat_seq_ops, tbl))
1715                 panic("cannot create neighbour proc dir entry");
1716 #endif
1717
1718         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1719
1720         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1721         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1722
1723         if (!tbl->nht || !tbl->phash_buckets)
1724                 panic("cannot allocate neighbour cache hashes");
1725
1726         if (!tbl->entry_size)
1727                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1728                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1729         else
1730                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1731
1732         rwlock_init(&tbl->lock);
1733         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1734         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1735                         tbl->parms.reachable_time);
1736         timer_setup(&tbl->proxy_timer, neigh_proxy_process, 0);
1737         skb_queue_head_init_class(&tbl->proxy_queue,
1738                         &neigh_table_proxy_queue_class);
1739
1740         tbl->last_flush = now;
1741         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1742
1743         neigh_tables[index] = tbl;
1744 }
1745 EXPORT_SYMBOL(neigh_table_init);
1746
1747 int neigh_table_clear(int index, struct neigh_table *tbl)
1748 {
1749         neigh_tables[index] = NULL;
1750         /* It is not clean... Fix it to unload IPv6 module safely */
1751         cancel_delayed_work_sync(&tbl->gc_work);
1752         del_timer_sync(&tbl->proxy_timer);
1753         pneigh_queue_purge(&tbl->proxy_queue, NULL);
1754         neigh_ifdown(tbl, NULL);
1755         if (atomic_read(&tbl->entries))
1756                 pr_crit("neighbour leakage\n");
1757
1758         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1759                  neigh_hash_free_rcu);
1760         tbl->nht = NULL;
1761
1762         kfree(tbl->phash_buckets);
1763         tbl->phash_buckets = NULL;
1764
1765         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1766
1767         free_percpu(tbl->stats);
1768         tbl->stats = NULL;
1769
1770         return 0;
1771 }
1772 EXPORT_SYMBOL(neigh_table_clear);
1773
1774 static struct neigh_table *neigh_find_table(int family)
1775 {
1776         struct neigh_table *tbl = NULL;
1777
1778         switch (family) {
1779         case AF_INET:
1780                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1781                 break;
1782         case AF_INET6:
1783                 tbl = neigh_tables[NEIGH_ND_TABLE];
1784                 break;
1785         case AF_DECnet:
1786                 tbl = neigh_tables[NEIGH_DN_TABLE];
1787                 break;
1788         }
1789
1790         return tbl;
1791 }
1792
1793 const struct nla_policy nda_policy[NDA_MAX+1] = {
1794         [NDA_UNSPEC]            = { .strict_start_type = NDA_NH_ID },
1795         [NDA_DST]               = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1796         [NDA_LLADDR]            = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1797         [NDA_CACHEINFO]         = { .len = sizeof(struct nda_cacheinfo) },
1798         [NDA_PROBES]            = { .type = NLA_U32 },
1799         [NDA_VLAN]              = { .type = NLA_U16 },
1800         [NDA_PORT]              = { .type = NLA_U16 },
1801         [NDA_VNI]               = { .type = NLA_U32 },
1802         [NDA_IFINDEX]           = { .type = NLA_U32 },
1803         [NDA_MASTER]            = { .type = NLA_U32 },
1804         [NDA_PROTOCOL]          = { .type = NLA_U8 },
1805         [NDA_NH_ID]             = { .type = NLA_U32 },
1806         [NDA_FDB_EXT_ATTRS]     = { .type = NLA_NESTED },
1807 };
1808
1809 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1810                         struct netlink_ext_ack *extack)
1811 {
1812         struct net *net = sock_net(skb->sk);
1813         struct ndmsg *ndm;
1814         struct nlattr *dst_attr;
1815         struct neigh_table *tbl;
1816         struct neighbour *neigh;
1817         struct net_device *dev = NULL;
1818         int err = -EINVAL;
1819
1820         ASSERT_RTNL();
1821         if (nlmsg_len(nlh) < sizeof(*ndm))
1822                 goto out;
1823
1824         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1825         if (!dst_attr) {
1826                 NL_SET_ERR_MSG(extack, "Network address not specified");
1827                 goto out;
1828         }
1829
1830         ndm = nlmsg_data(nlh);
1831         if (ndm->ndm_ifindex) {
1832                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1833                 if (dev == NULL) {
1834                         err = -ENODEV;
1835                         goto out;
1836                 }
1837         }
1838
1839         tbl = neigh_find_table(ndm->ndm_family);
1840         if (tbl == NULL)
1841                 return -EAFNOSUPPORT;
1842
1843         if (nla_len(dst_attr) < (int)tbl->key_len) {
1844                 NL_SET_ERR_MSG(extack, "Invalid network address");
1845                 goto out;
1846         }
1847
1848         if (ndm->ndm_flags & NTF_PROXY) {
1849                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1850                 goto out;
1851         }
1852
1853         if (dev == NULL)
1854                 goto out;
1855
1856         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1857         if (neigh == NULL) {
1858                 err = -ENOENT;
1859                 goto out;
1860         }
1861
1862         err = __neigh_update(neigh, NULL, NUD_FAILED,
1863                              NEIGH_UPDATE_F_OVERRIDE | NEIGH_UPDATE_F_ADMIN,
1864                              NETLINK_CB(skb).portid, extack);
1865         write_lock_bh(&tbl->lock);
1866         neigh_release(neigh);
1867         neigh_remove_one(neigh, tbl);
1868         write_unlock_bh(&tbl->lock);
1869
1870 out:
1871         return err;
1872 }
1873
1874 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1875                      struct netlink_ext_ack *extack)
1876 {
1877         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE |
1878                 NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1879         struct net *net = sock_net(skb->sk);
1880         struct ndmsg *ndm;
1881         struct nlattr *tb[NDA_MAX+1];
1882         struct neigh_table *tbl;
1883         struct net_device *dev = NULL;
1884         struct neighbour *neigh;
1885         void *dst, *lladdr;
1886         u8 protocol = 0;
1887         int err;
1888
1889         ASSERT_RTNL();
1890         err = nlmsg_parse_deprecated(nlh, sizeof(*ndm), tb, NDA_MAX,
1891                                      nda_policy, extack);
1892         if (err < 0)
1893                 goto out;
1894
1895         err = -EINVAL;
1896         if (!tb[NDA_DST]) {
1897                 NL_SET_ERR_MSG(extack, "Network address not specified");
1898                 goto out;
1899         }
1900
1901         ndm = nlmsg_data(nlh);
1902         if (ndm->ndm_ifindex) {
1903                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1904                 if (dev == NULL) {
1905                         err = -ENODEV;
1906                         goto out;
1907                 }
1908
1909                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len) {
1910                         NL_SET_ERR_MSG(extack, "Invalid link address");
1911                         goto out;
1912                 }
1913         }
1914
1915         tbl = neigh_find_table(ndm->ndm_family);
1916         if (tbl == NULL)
1917                 return -EAFNOSUPPORT;
1918
1919         if (nla_len(tb[NDA_DST]) < (int)tbl->key_len) {
1920                 NL_SET_ERR_MSG(extack, "Invalid network address");
1921                 goto out;
1922         }
1923
1924         dst = nla_data(tb[NDA_DST]);
1925         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1926
1927         if (tb[NDA_PROTOCOL])
1928                 protocol = nla_get_u8(tb[NDA_PROTOCOL]);
1929
1930         if (ndm->ndm_flags & NTF_PROXY) {
1931                 struct pneigh_entry *pn;
1932
1933                 err = -ENOBUFS;
1934                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1935                 if (pn) {
1936                         pn->flags = ndm->ndm_flags;
1937                         if (protocol)
1938                                 pn->protocol = protocol;
1939                         err = 0;
1940                 }
1941                 goto out;
1942         }
1943
1944         if (!dev) {
1945                 NL_SET_ERR_MSG(extack, "Device not specified");
1946                 goto out;
1947         }
1948
1949         if (tbl->allow_add && !tbl->allow_add(dev, extack)) {
1950                 err = -EINVAL;
1951                 goto out;
1952         }
1953
1954         neigh = neigh_lookup(tbl, dst, dev);
1955         if (neigh == NULL) {
1956                 bool exempt_from_gc;
1957
1958                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1959                         err = -ENOENT;
1960                         goto out;
1961                 }
1962
1963                 exempt_from_gc = ndm->ndm_state & NUD_PERMANENT ||
1964                                  ndm->ndm_flags & NTF_EXT_LEARNED;
1965                 neigh = ___neigh_create(tbl, dst, dev,
1966                                         ndm->ndm_flags & NTF_EXT_LEARNED,
1967                                         exempt_from_gc, true);
1968                 if (IS_ERR(neigh)) {
1969                         err = PTR_ERR(neigh);
1970                         goto out;
1971                 }
1972         } else {
1973                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1974                         err = -EEXIST;
1975                         neigh_release(neigh);
1976                         goto out;
1977                 }
1978
1979                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1980                         flags &= ~(NEIGH_UPDATE_F_OVERRIDE |
1981                                    NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1982         }
1983
1984         if (protocol)
1985                 neigh->protocol = protocol;
1986         if (ndm->ndm_flags & NTF_EXT_LEARNED)
1987                 flags |= NEIGH_UPDATE_F_EXT_LEARNED;
1988         if (ndm->ndm_flags & NTF_ROUTER)
1989                 flags |= NEIGH_UPDATE_F_ISROUTER;
1990         if (ndm->ndm_flags & NTF_USE)
1991                 flags |= NEIGH_UPDATE_F_USE;
1992
1993         err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1994                              NETLINK_CB(skb).portid, extack);
1995         if (!err && ndm->ndm_flags & NTF_USE) {
1996                 neigh_event_send(neigh, NULL);
1997                 err = 0;
1998         }
1999         neigh_release(neigh);
2000 out:
2001         return err;
2002 }
2003
2004 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
2005 {
2006         struct nlattr *nest;
2007
2008         nest = nla_nest_start_noflag(skb, NDTA_PARMS);
2009         if (nest == NULL)
2010                 return -ENOBUFS;
2011
2012         if ((parms->dev &&
2013              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
2014             nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
2015             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
2016                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
2017             /* approximative value for deprecated QUEUE_LEN (in packets) */
2018             nla_put_u32(skb, NDTPA_QUEUE_LEN,
2019                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
2020             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
2021             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
2022             nla_put_u32(skb, NDTPA_UCAST_PROBES,
2023                         NEIGH_VAR(parms, UCAST_PROBES)) ||
2024             nla_put_u32(skb, NDTPA_MCAST_PROBES,
2025                         NEIGH_VAR(parms, MCAST_PROBES)) ||
2026             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
2027                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
2028             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
2029                           NDTPA_PAD) ||
2030             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
2031                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
2032             nla_put_msecs(skb, NDTPA_GC_STALETIME,
2033                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
2034             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
2035                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
2036             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
2037                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
2038             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
2039                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
2040             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
2041                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
2042             nla_put_msecs(skb, NDTPA_LOCKTIME,
2043                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
2044                 goto nla_put_failure;
2045         return nla_nest_end(skb, nest);
2046
2047 nla_put_failure:
2048         nla_nest_cancel(skb, nest);
2049         return -EMSGSIZE;
2050 }
2051
2052 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
2053                               u32 pid, u32 seq, int type, int flags)
2054 {
2055         struct nlmsghdr *nlh;
2056         struct ndtmsg *ndtmsg;
2057
2058         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2059         if (nlh == NULL)
2060                 return -EMSGSIZE;
2061
2062         ndtmsg = nlmsg_data(nlh);
2063
2064         read_lock_bh(&tbl->lock);
2065         ndtmsg->ndtm_family = tbl->family;
2066         ndtmsg->ndtm_pad1   = 0;
2067         ndtmsg->ndtm_pad2   = 0;
2068
2069         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
2070             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
2071             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
2072             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
2073             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
2074                 goto nla_put_failure;
2075         {
2076                 unsigned long now = jiffies;
2077                 long flush_delta = now - tbl->last_flush;
2078                 long rand_delta = now - tbl->last_rand;
2079                 struct neigh_hash_table *nht;
2080                 struct ndt_config ndc = {
2081                         .ndtc_key_len           = tbl->key_len,
2082                         .ndtc_entry_size        = tbl->entry_size,
2083                         .ndtc_entries           = atomic_read(&tbl->entries),
2084                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
2085                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
2086                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
2087                 };
2088
2089                 rcu_read_lock_bh();
2090                 nht = rcu_dereference_bh(tbl->nht);
2091                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
2092                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
2093                 rcu_read_unlock_bh();
2094
2095                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
2096                         goto nla_put_failure;
2097         }
2098
2099         {
2100                 int cpu;
2101                 struct ndt_stats ndst;
2102
2103                 memset(&ndst, 0, sizeof(ndst));
2104
2105                 for_each_possible_cpu(cpu) {
2106                         struct neigh_statistics *st;
2107
2108                         st = per_cpu_ptr(tbl->stats, cpu);
2109                         ndst.ndts_allocs                += st->allocs;
2110                         ndst.ndts_destroys              += st->destroys;
2111                         ndst.ndts_hash_grows            += st->hash_grows;
2112                         ndst.ndts_res_failed            += st->res_failed;
2113                         ndst.ndts_lookups               += st->lookups;
2114                         ndst.ndts_hits                  += st->hits;
2115                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
2116                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
2117                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
2118                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
2119                         ndst.ndts_table_fulls           += st->table_fulls;
2120                 }
2121
2122                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
2123                                   NDTA_PAD))
2124                         goto nla_put_failure;
2125         }
2126
2127         BUG_ON(tbl->parms.dev);
2128         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
2129                 goto nla_put_failure;
2130
2131         read_unlock_bh(&tbl->lock);
2132         nlmsg_end(skb, nlh);
2133         return 0;
2134
2135 nla_put_failure:
2136         read_unlock_bh(&tbl->lock);
2137         nlmsg_cancel(skb, nlh);
2138         return -EMSGSIZE;
2139 }
2140
2141 static int neightbl_fill_param_info(struct sk_buff *skb,
2142                                     struct neigh_table *tbl,
2143                                     struct neigh_parms *parms,
2144                                     u32 pid, u32 seq, int type,
2145                                     unsigned int flags)
2146 {
2147         struct ndtmsg *ndtmsg;
2148         struct nlmsghdr *nlh;
2149
2150         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2151         if (nlh == NULL)
2152                 return -EMSGSIZE;
2153
2154         ndtmsg = nlmsg_data(nlh);
2155
2156         read_lock_bh(&tbl->lock);
2157         ndtmsg->ndtm_family = tbl->family;
2158         ndtmsg->ndtm_pad1   = 0;
2159         ndtmsg->ndtm_pad2   = 0;
2160
2161         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
2162             neightbl_fill_parms(skb, parms) < 0)
2163                 goto errout;
2164
2165         read_unlock_bh(&tbl->lock);
2166         nlmsg_end(skb, nlh);
2167         return 0;
2168 errout:
2169         read_unlock_bh(&tbl->lock);
2170         nlmsg_cancel(skb, nlh);
2171         return -EMSGSIZE;
2172 }
2173
2174 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
2175         [NDTA_NAME]             = { .type = NLA_STRING },
2176         [NDTA_THRESH1]          = { .type = NLA_U32 },
2177         [NDTA_THRESH2]          = { .type = NLA_U32 },
2178         [NDTA_THRESH3]          = { .type = NLA_U32 },
2179         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
2180         [NDTA_PARMS]            = { .type = NLA_NESTED },
2181 };
2182
2183 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
2184         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
2185         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
2186         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
2187         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
2188         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
2189         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
2190         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
2191         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
2192         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
2193         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
2194         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
2195         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
2196         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
2197         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
2198 };
2199
2200 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
2201                         struct netlink_ext_ack *extack)
2202 {
2203         struct net *net = sock_net(skb->sk);
2204         struct neigh_table *tbl;
2205         struct ndtmsg *ndtmsg;
2206         struct nlattr *tb[NDTA_MAX+1];
2207         bool found = false;
2208         int err, tidx;
2209
2210         err = nlmsg_parse_deprecated(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
2211                                      nl_neightbl_policy, extack);
2212         if (err < 0)
2213                 goto errout;
2214
2215         if (tb[NDTA_NAME] == NULL) {
2216                 err = -EINVAL;
2217                 goto errout;
2218         }
2219
2220         ndtmsg = nlmsg_data(nlh);
2221
2222         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2223                 tbl = neigh_tables[tidx];
2224                 if (!tbl)
2225                         continue;
2226                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2227                         continue;
2228                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2229                         found = true;
2230                         break;
2231                 }
2232         }
2233
2234         if (!found)
2235                 return -ENOENT;
2236
2237         /*
2238          * We acquire tbl->lock to be nice to the periodic timers and
2239          * make sure they always see a consistent set of values.
2240          */
2241         write_lock_bh(&tbl->lock);
2242
2243         if (tb[NDTA_PARMS]) {
2244                 struct nlattr *tbp[NDTPA_MAX+1];
2245                 struct neigh_parms *p;
2246                 int i, ifindex = 0;
2247
2248                 err = nla_parse_nested_deprecated(tbp, NDTPA_MAX,
2249                                                   tb[NDTA_PARMS],
2250                                                   nl_ntbl_parm_policy, extack);
2251                 if (err < 0)
2252                         goto errout_tbl_lock;
2253
2254                 if (tbp[NDTPA_IFINDEX])
2255                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2256
2257                 p = lookup_neigh_parms(tbl, net, ifindex);
2258                 if (p == NULL) {
2259                         err = -ENOENT;
2260                         goto errout_tbl_lock;
2261                 }
2262
2263                 for (i = 1; i <= NDTPA_MAX; i++) {
2264                         if (tbp[i] == NULL)
2265                                 continue;
2266
2267                         switch (i) {
2268                         case NDTPA_QUEUE_LEN:
2269                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2270                                               nla_get_u32(tbp[i]) *
2271                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2272                                 break;
2273                         case NDTPA_QUEUE_LENBYTES:
2274                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2275                                               nla_get_u32(tbp[i]));
2276                                 break;
2277                         case NDTPA_PROXY_QLEN:
2278                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2279                                               nla_get_u32(tbp[i]));
2280                                 break;
2281                         case NDTPA_APP_PROBES:
2282                                 NEIGH_VAR_SET(p, APP_PROBES,
2283                                               nla_get_u32(tbp[i]));
2284                                 break;
2285                         case NDTPA_UCAST_PROBES:
2286                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2287                                               nla_get_u32(tbp[i]));
2288                                 break;
2289                         case NDTPA_MCAST_PROBES:
2290                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2291                                               nla_get_u32(tbp[i]));
2292                                 break;
2293                         case NDTPA_MCAST_REPROBES:
2294                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2295                                               nla_get_u32(tbp[i]));
2296                                 break;
2297                         case NDTPA_BASE_REACHABLE_TIME:
2298                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2299                                               nla_get_msecs(tbp[i]));
2300                                 /* update reachable_time as well, otherwise, the change will
2301                                  * only be effective after the next time neigh_periodic_work
2302                                  * decides to recompute it (can be multiple minutes)
2303                                  */
2304                                 p->reachable_time =
2305                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2306                                 break;
2307                         case NDTPA_GC_STALETIME:
2308                                 NEIGH_VAR_SET(p, GC_STALETIME,
2309                                               nla_get_msecs(tbp[i]));
2310                                 break;
2311                         case NDTPA_DELAY_PROBE_TIME:
2312                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2313                                               nla_get_msecs(tbp[i]));
2314                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2315                                 break;
2316                         case NDTPA_RETRANS_TIME:
2317                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2318                                               nla_get_msecs(tbp[i]));
2319                                 break;
2320                         case NDTPA_ANYCAST_DELAY:
2321                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2322                                               nla_get_msecs(tbp[i]));
2323                                 break;
2324                         case NDTPA_PROXY_DELAY:
2325                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2326                                               nla_get_msecs(tbp[i]));
2327                                 break;
2328                         case NDTPA_LOCKTIME:
2329                                 NEIGH_VAR_SET(p, LOCKTIME,
2330                                               nla_get_msecs(tbp[i]));
2331                                 break;
2332                         }
2333                 }
2334         }
2335
2336         err = -ENOENT;
2337         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2338              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2339             !net_eq(net, &init_net))
2340                 goto errout_tbl_lock;
2341
2342         if (tb[NDTA_THRESH1])
2343                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2344
2345         if (tb[NDTA_THRESH2])
2346                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2347
2348         if (tb[NDTA_THRESH3])
2349                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2350
2351         if (tb[NDTA_GC_INTERVAL])
2352                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2353
2354         err = 0;
2355
2356 errout_tbl_lock:
2357         write_unlock_bh(&tbl->lock);
2358 errout:
2359         return err;
2360 }
2361
2362 static int neightbl_valid_dump_info(const struct nlmsghdr *nlh,
2363                                     struct netlink_ext_ack *extack)
2364 {
2365         struct ndtmsg *ndtm;
2366
2367         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndtm))) {
2368                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor table dump request");
2369                 return -EINVAL;
2370         }
2371
2372         ndtm = nlmsg_data(nlh);
2373         if (ndtm->ndtm_pad1  || ndtm->ndtm_pad2) {
2374                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor table dump request");
2375                 return -EINVAL;
2376         }
2377
2378         if (nlmsg_attrlen(nlh, sizeof(*ndtm))) {
2379                 NL_SET_ERR_MSG(extack, "Invalid data after header in neighbor table dump request");
2380                 return -EINVAL;
2381         }
2382
2383         return 0;
2384 }
2385
2386 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2387 {
2388         const struct nlmsghdr *nlh = cb->nlh;
2389         struct net *net = sock_net(skb->sk);
2390         int family, tidx, nidx = 0;
2391         int tbl_skip = cb->args[0];
2392         int neigh_skip = cb->args[1];
2393         struct neigh_table *tbl;
2394
2395         if (cb->strict_check) {
2396                 int err = neightbl_valid_dump_info(nlh, cb->extack);
2397
2398                 if (err < 0)
2399                         return err;
2400         }
2401
2402         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2403
2404         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2405                 struct neigh_parms *p;
2406
2407                 tbl = neigh_tables[tidx];
2408                 if (!tbl)
2409                         continue;
2410
2411                 if (tidx < tbl_skip || (family && tbl->family != family))
2412                         continue;
2413
2414                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2415                                        nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2416                                        NLM_F_MULTI) < 0)
2417                         break;
2418
2419                 nidx = 0;
2420                 p = list_next_entry(&tbl->parms, list);
2421                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2422                         if (!net_eq(neigh_parms_net(p), net))
2423                                 continue;
2424
2425                         if (nidx < neigh_skip)
2426                                 goto next;
2427
2428                         if (neightbl_fill_param_info(skb, tbl, p,
2429                                                      NETLINK_CB(cb->skb).portid,
2430                                                      nlh->nlmsg_seq,
2431                                                      RTM_NEWNEIGHTBL,
2432                                                      NLM_F_MULTI) < 0)
2433                                 goto out;
2434                 next:
2435                         nidx++;
2436                 }
2437
2438                 neigh_skip = 0;
2439         }
2440 out:
2441         cb->args[0] = tidx;
2442         cb->args[1] = nidx;
2443
2444         return skb->len;
2445 }
2446
2447 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2448                            u32 pid, u32 seq, int type, unsigned int flags)
2449 {
2450         unsigned long now = jiffies;
2451         struct nda_cacheinfo ci;
2452         struct nlmsghdr *nlh;
2453         struct ndmsg *ndm;
2454
2455         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2456         if (nlh == NULL)
2457                 return -EMSGSIZE;
2458
2459         ndm = nlmsg_data(nlh);
2460         ndm->ndm_family  = neigh->ops->family;
2461         ndm->ndm_pad1    = 0;
2462         ndm->ndm_pad2    = 0;
2463         ndm->ndm_flags   = neigh->flags;
2464         ndm->ndm_type    = neigh->type;
2465         ndm->ndm_ifindex = neigh->dev->ifindex;
2466
2467         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2468                 goto nla_put_failure;
2469
2470         read_lock_bh(&neigh->lock);
2471         ndm->ndm_state   = neigh->nud_state;
2472         if (neigh->nud_state & NUD_VALID) {
2473                 char haddr[MAX_ADDR_LEN];
2474
2475                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2476                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2477                         read_unlock_bh(&neigh->lock);
2478                         goto nla_put_failure;
2479                 }
2480         }
2481
2482         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2483         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2484         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2485         ci.ndm_refcnt    = refcount_read(&neigh->refcnt) - 1;
2486         read_unlock_bh(&neigh->lock);
2487
2488         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2489             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2490                 goto nla_put_failure;
2491
2492         if (neigh->protocol && nla_put_u8(skb, NDA_PROTOCOL, neigh->protocol))
2493                 goto nla_put_failure;
2494
2495         nlmsg_end(skb, nlh);
2496         return 0;
2497
2498 nla_put_failure:
2499         nlmsg_cancel(skb, nlh);
2500         return -EMSGSIZE;
2501 }
2502
2503 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2504                             u32 pid, u32 seq, int type, unsigned int flags,
2505                             struct neigh_table *tbl)
2506 {
2507         struct nlmsghdr *nlh;
2508         struct ndmsg *ndm;
2509
2510         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2511         if (nlh == NULL)
2512                 return -EMSGSIZE;
2513
2514         ndm = nlmsg_data(nlh);
2515         ndm->ndm_family  = tbl->family;
2516         ndm->ndm_pad1    = 0;
2517         ndm->ndm_pad2    = 0;
2518         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2519         ndm->ndm_type    = RTN_UNICAST;
2520         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2521         ndm->ndm_state   = NUD_NONE;
2522
2523         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2524                 goto nla_put_failure;
2525
2526         if (pn->protocol && nla_put_u8(skb, NDA_PROTOCOL, pn->protocol))
2527                 goto nla_put_failure;
2528
2529         nlmsg_end(skb, nlh);
2530         return 0;
2531
2532 nla_put_failure:
2533         nlmsg_cancel(skb, nlh);
2534         return -EMSGSIZE;
2535 }
2536
2537 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2538 {
2539         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2540         __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2541 }
2542
2543 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2544 {
2545         struct net_device *master;
2546
2547         if (!master_idx)
2548                 return false;
2549
2550         master = dev ? netdev_master_upper_dev_get(dev) : NULL;
2551
2552         /* 0 is already used to denote NDA_MASTER wasn't passed, therefore need another
2553          * invalid value for ifindex to denote "no master".
2554          */
2555         if (master_idx == -1)
2556                 return !!master;
2557
2558         if (!master || master->ifindex != master_idx)
2559                 return true;
2560
2561         return false;
2562 }
2563
2564 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2565 {
2566         if (filter_idx && (!dev || dev->ifindex != filter_idx))
2567                 return true;
2568
2569         return false;
2570 }
2571
2572 struct neigh_dump_filter {
2573         int master_idx;
2574         int dev_idx;
2575 };
2576
2577 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2578                             struct netlink_callback *cb,
2579                             struct neigh_dump_filter *filter)
2580 {
2581         struct net *net = sock_net(skb->sk);
2582         struct neighbour *n;
2583         int rc, h, s_h = cb->args[1];
2584         int idx, s_idx = idx = cb->args[2];
2585         struct neigh_hash_table *nht;
2586         unsigned int flags = NLM_F_MULTI;
2587
2588         if (filter->dev_idx || filter->master_idx)
2589                 flags |= NLM_F_DUMP_FILTERED;
2590
2591         rcu_read_lock_bh();
2592         nht = rcu_dereference_bh(tbl->nht);
2593
2594         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2595                 if (h > s_h)
2596                         s_idx = 0;
2597                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2598                      n != NULL;
2599                      n = rcu_dereference_bh(n->next)) {
2600                         if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2601                                 goto next;
2602                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2603                             neigh_master_filtered(n->dev, filter->master_idx))
2604                                 goto next;
2605                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2606                                             cb->nlh->nlmsg_seq,
2607                                             RTM_NEWNEIGH,
2608                                             flags) < 0) {
2609                                 rc = -1;
2610                                 goto out;
2611                         }
2612 next:
2613                         idx++;
2614                 }
2615         }
2616         rc = skb->len;
2617 out:
2618         rcu_read_unlock_bh();
2619         cb->args[1] = h;
2620         cb->args[2] = idx;
2621         return rc;
2622 }
2623
2624 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2625                              struct netlink_callback *cb,
2626                              struct neigh_dump_filter *filter)
2627 {
2628         struct pneigh_entry *n;
2629         struct net *net = sock_net(skb->sk);
2630         int rc, h, s_h = cb->args[3];
2631         int idx, s_idx = idx = cb->args[4];
2632         unsigned int flags = NLM_F_MULTI;
2633
2634         if (filter->dev_idx || filter->master_idx)
2635                 flags |= NLM_F_DUMP_FILTERED;
2636
2637         read_lock_bh(&tbl->lock);
2638
2639         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2640                 if (h > s_h)
2641                         s_idx = 0;
2642                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2643                         if (idx < s_idx || pneigh_net(n) != net)
2644                                 goto next;
2645                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2646                             neigh_master_filtered(n->dev, filter->master_idx))
2647                                 goto next;
2648                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2649                                             cb->nlh->nlmsg_seq,
2650                                             RTM_NEWNEIGH, flags, tbl) < 0) {
2651                                 read_unlock_bh(&tbl->lock);
2652                                 rc = -1;
2653                                 goto out;
2654                         }
2655                 next:
2656                         idx++;
2657                 }
2658         }
2659
2660         read_unlock_bh(&tbl->lock);
2661         rc = skb->len;
2662 out:
2663         cb->args[3] = h;
2664         cb->args[4] = idx;
2665         return rc;
2666
2667 }
2668
2669 static int neigh_valid_dump_req(const struct nlmsghdr *nlh,
2670                                 bool strict_check,
2671                                 struct neigh_dump_filter *filter,
2672                                 struct netlink_ext_ack *extack)
2673 {
2674         struct nlattr *tb[NDA_MAX + 1];
2675         int err, i;
2676
2677         if (strict_check) {
2678                 struct ndmsg *ndm;
2679
2680                 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2681                         NL_SET_ERR_MSG(extack, "Invalid header for neighbor dump request");
2682                         return -EINVAL;
2683                 }
2684
2685                 ndm = nlmsg_data(nlh);
2686                 if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_ifindex ||
2687                     ndm->ndm_state || ndm->ndm_type) {
2688                         NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor dump request");
2689                         return -EINVAL;
2690                 }
2691
2692                 if (ndm->ndm_flags & ~NTF_PROXY) {
2693                         NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor dump request");
2694                         return -EINVAL;
2695                 }
2696
2697                 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg),
2698                                                     tb, NDA_MAX, nda_policy,
2699                                                     extack);
2700         } else {
2701                 err = nlmsg_parse_deprecated(nlh, sizeof(struct ndmsg), tb,
2702                                              NDA_MAX, nda_policy, extack);
2703         }
2704         if (err < 0)
2705                 return err;
2706
2707         for (i = 0; i <= NDA_MAX; ++i) {
2708                 if (!tb[i])
2709                         continue;
2710
2711                 /* all new attributes should require strict_check */
2712                 switch (i) {
2713                 case NDA_IFINDEX:
2714                         filter->dev_idx = nla_get_u32(tb[i]);
2715                         break;
2716                 case NDA_MASTER:
2717                         filter->master_idx = nla_get_u32(tb[i]);
2718                         break;
2719                 default:
2720                         if (strict_check) {
2721                                 NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor dump request");
2722                                 return -EINVAL;
2723                         }
2724                 }
2725         }
2726
2727         return 0;
2728 }
2729
2730 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2731 {
2732         const struct nlmsghdr *nlh = cb->nlh;
2733         struct neigh_dump_filter filter = {};
2734         struct neigh_table *tbl;
2735         int t, family, s_t;
2736         int proxy = 0;
2737         int err;
2738
2739         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2740
2741         /* check for full ndmsg structure presence, family member is
2742          * the same for both structures
2743          */
2744         if (nlmsg_len(nlh) >= sizeof(struct ndmsg) &&
2745             ((struct ndmsg *)nlmsg_data(nlh))->ndm_flags == NTF_PROXY)
2746                 proxy = 1;
2747
2748         err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack);
2749         if (err < 0 && cb->strict_check)
2750                 return err;
2751
2752         s_t = cb->args[0];
2753
2754         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2755                 tbl = neigh_tables[t];
2756
2757                 if (!tbl)
2758                         continue;
2759                 if (t < s_t || (family && tbl->family != family))
2760                         continue;
2761                 if (t > s_t)
2762                         memset(&cb->args[1], 0, sizeof(cb->args) -
2763                                                 sizeof(cb->args[0]));
2764                 if (proxy)
2765                         err = pneigh_dump_table(tbl, skb, cb, &filter);
2766                 else
2767                         err = neigh_dump_table(tbl, skb, cb, &filter);
2768                 if (err < 0)
2769                         break;
2770         }
2771
2772         cb->args[0] = t;
2773         return skb->len;
2774 }
2775
2776 static int neigh_valid_get_req(const struct nlmsghdr *nlh,
2777                                struct neigh_table **tbl,
2778                                void **dst, int *dev_idx, u8 *ndm_flags,
2779                                struct netlink_ext_ack *extack)
2780 {
2781         struct nlattr *tb[NDA_MAX + 1];
2782         struct ndmsg *ndm;
2783         int err, i;
2784
2785         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2786                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor get request");
2787                 return -EINVAL;
2788         }
2789
2790         ndm = nlmsg_data(nlh);
2791         if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
2792             ndm->ndm_type) {
2793                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor get request");
2794                 return -EINVAL;
2795         }
2796
2797         if (ndm->ndm_flags & ~NTF_PROXY) {
2798                 NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor get request");
2799                 return -EINVAL;
2800         }
2801
2802         err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg), tb,
2803                                             NDA_MAX, nda_policy, extack);
2804         if (err < 0)
2805                 return err;
2806
2807         *ndm_flags = ndm->ndm_flags;
2808         *dev_idx = ndm->ndm_ifindex;
2809         *tbl = neigh_find_table(ndm->ndm_family);
2810         if (*tbl == NULL) {
2811                 NL_SET_ERR_MSG(extack, "Unsupported family in header for neighbor get request");
2812                 return -EAFNOSUPPORT;
2813         }
2814
2815         for (i = 0; i <= NDA_MAX; ++i) {
2816                 if (!tb[i])
2817                         continue;
2818
2819                 switch (i) {
2820                 case NDA_DST:
2821                         if (nla_len(tb[i]) != (int)(*tbl)->key_len) {
2822                                 NL_SET_ERR_MSG(extack, "Invalid network address in neighbor get request");
2823                                 return -EINVAL;
2824                         }
2825                         *dst = nla_data(tb[i]);
2826                         break;
2827                 default:
2828                         NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor get request");
2829                         return -EINVAL;
2830                 }
2831         }
2832
2833         return 0;
2834 }
2835
2836 static inline size_t neigh_nlmsg_size(void)
2837 {
2838         return NLMSG_ALIGN(sizeof(struct ndmsg))
2839                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2840                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2841                + nla_total_size(sizeof(struct nda_cacheinfo))
2842                + nla_total_size(4)  /* NDA_PROBES */
2843                + nla_total_size(1); /* NDA_PROTOCOL */
2844 }
2845
2846 static int neigh_get_reply(struct net *net, struct neighbour *neigh,
2847                            u32 pid, u32 seq)
2848 {
2849         struct sk_buff *skb;
2850         int err = 0;
2851
2852         skb = nlmsg_new(neigh_nlmsg_size(), GFP_KERNEL);
2853         if (!skb)
2854                 return -ENOBUFS;
2855
2856         err = neigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0);
2857         if (err) {
2858                 kfree_skb(skb);
2859                 goto errout;
2860         }
2861
2862         err = rtnl_unicast(skb, net, pid);
2863 errout:
2864         return err;
2865 }
2866
2867 static inline size_t pneigh_nlmsg_size(void)
2868 {
2869         return NLMSG_ALIGN(sizeof(struct ndmsg))
2870                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2871                + nla_total_size(1); /* NDA_PROTOCOL */
2872 }
2873
2874 static int pneigh_get_reply(struct net *net, struct pneigh_entry *neigh,
2875                             u32 pid, u32 seq, struct neigh_table *tbl)
2876 {
2877         struct sk_buff *skb;
2878         int err = 0;
2879
2880         skb = nlmsg_new(pneigh_nlmsg_size(), GFP_KERNEL);
2881         if (!skb)
2882                 return -ENOBUFS;
2883
2884         err = pneigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0, tbl);
2885         if (err) {
2886                 kfree_skb(skb);
2887                 goto errout;
2888         }
2889
2890         err = rtnl_unicast(skb, net, pid);
2891 errout:
2892         return err;
2893 }
2894
2895 static int neigh_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
2896                      struct netlink_ext_ack *extack)
2897 {
2898         struct net *net = sock_net(in_skb->sk);
2899         struct net_device *dev = NULL;
2900         struct neigh_table *tbl = NULL;
2901         struct neighbour *neigh;
2902         void *dst = NULL;
2903         u8 ndm_flags = 0;
2904         int dev_idx = 0;
2905         int err;
2906
2907         err = neigh_valid_get_req(nlh, &tbl, &dst, &dev_idx, &ndm_flags,
2908                                   extack);
2909         if (err < 0)
2910                 return err;
2911
2912         if (dev_idx) {
2913                 dev = __dev_get_by_index(net, dev_idx);
2914                 if (!dev) {
2915                         NL_SET_ERR_MSG(extack, "Unknown device ifindex");
2916                         return -ENODEV;
2917                 }
2918         }
2919
2920         if (!dst) {
2921                 NL_SET_ERR_MSG(extack, "Network address not specified");
2922                 return -EINVAL;
2923         }
2924
2925         if (ndm_flags & NTF_PROXY) {
2926                 struct pneigh_entry *pn;
2927
2928                 pn = pneigh_lookup(tbl, net, dst, dev, 0);
2929                 if (!pn) {
2930                         NL_SET_ERR_MSG(extack, "Proxy neighbour entry not found");
2931                         return -ENOENT;
2932                 }
2933                 return pneigh_get_reply(net, pn, NETLINK_CB(in_skb).portid,
2934                                         nlh->nlmsg_seq, tbl);
2935         }
2936
2937         if (!dev) {
2938                 NL_SET_ERR_MSG(extack, "No device specified");
2939                 return -EINVAL;
2940         }
2941
2942         neigh = neigh_lookup(tbl, dst, dev);
2943         if (!neigh) {
2944                 NL_SET_ERR_MSG(extack, "Neighbour entry not found");
2945                 return -ENOENT;
2946         }
2947
2948         err = neigh_get_reply(net, neigh, NETLINK_CB(in_skb).portid,
2949                               nlh->nlmsg_seq);
2950
2951         neigh_release(neigh);
2952
2953         return err;
2954 }
2955
2956 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2957 {
2958         int chain;
2959         struct neigh_hash_table *nht;
2960
2961         rcu_read_lock_bh();
2962         nht = rcu_dereference_bh(tbl->nht);
2963
2964         read_lock(&tbl->lock); /* avoid resizes */
2965         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2966                 struct neighbour *n;
2967
2968                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2969                      n != NULL;
2970                      n = rcu_dereference_bh(n->next))
2971                         cb(n, cookie);
2972         }
2973         read_unlock(&tbl->lock);
2974         rcu_read_unlock_bh();
2975 }
2976 EXPORT_SYMBOL(neigh_for_each);
2977
2978 /* The tbl->lock must be held as a writer and BH disabled. */
2979 void __neigh_for_each_release(struct neigh_table *tbl,
2980                               int (*cb)(struct neighbour *))
2981 {
2982         int chain;
2983         struct neigh_hash_table *nht;
2984
2985         nht = rcu_dereference_protected(tbl->nht,
2986                                         lockdep_is_held(&tbl->lock));
2987         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2988                 struct neighbour *n;
2989                 struct neighbour __rcu **np;
2990
2991                 np = &nht->hash_buckets[chain];
2992                 while ((n = rcu_dereference_protected(*np,
2993                                         lockdep_is_held(&tbl->lock))) != NULL) {
2994                         int release;
2995
2996                         write_lock(&n->lock);
2997                         release = cb(n);
2998                         if (release) {
2999                                 rcu_assign_pointer(*np,
3000                                         rcu_dereference_protected(n->next,
3001                                                 lockdep_is_held(&tbl->lock)));
3002                                 neigh_mark_dead(n);
3003                         } else
3004                                 np = &n->next;
3005                         write_unlock(&n->lock);
3006                         if (release)
3007                                 neigh_cleanup_and_release(n);
3008                 }
3009         }
3010 }
3011 EXPORT_SYMBOL(__neigh_for_each_release);
3012
3013 int neigh_xmit(int index, struct net_device *dev,
3014                const void *addr, struct sk_buff *skb)
3015 {
3016         int err = -EAFNOSUPPORT;
3017         if (likely(index < NEIGH_NR_TABLES)) {
3018                 struct neigh_table *tbl;
3019                 struct neighbour *neigh;
3020
3021                 tbl = neigh_tables[index];
3022                 if (!tbl)
3023                         goto out;
3024                 rcu_read_lock_bh();
3025                 if (index == NEIGH_ARP_TABLE) {
3026                         u32 key = *((u32 *)addr);
3027
3028                         neigh = __ipv4_neigh_lookup_noref(dev, key);
3029                 } else {
3030                         neigh = __neigh_lookup_noref(tbl, addr, dev);
3031                 }
3032                 if (!neigh)
3033                         neigh = __neigh_create(tbl, addr, dev, false);
3034                 err = PTR_ERR(neigh);
3035                 if (IS_ERR(neigh)) {
3036                         rcu_read_unlock_bh();
3037                         goto out_kfree_skb;
3038                 }
3039                 err = neigh->output(neigh, skb);
3040                 rcu_read_unlock_bh();
3041         }
3042         else if (index == NEIGH_LINK_TABLE) {
3043                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
3044                                       addr, NULL, skb->len);
3045                 if (err < 0)
3046                         goto out_kfree_skb;
3047                 err = dev_queue_xmit(skb);
3048         }
3049 out:
3050         return err;
3051 out_kfree_skb:
3052         kfree_skb(skb);
3053         goto out;
3054 }
3055 EXPORT_SYMBOL(neigh_xmit);
3056
3057 #ifdef CONFIG_PROC_FS
3058
3059 static struct neighbour *neigh_get_first(struct seq_file *seq)
3060 {
3061         struct neigh_seq_state *state = seq->private;
3062         struct net *net = seq_file_net(seq);
3063         struct neigh_hash_table *nht = state->nht;
3064         struct neighbour *n = NULL;
3065         int bucket;
3066
3067         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
3068         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
3069                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
3070
3071                 while (n) {
3072                         if (!net_eq(dev_net(n->dev), net))
3073                                 goto next;
3074                         if (state->neigh_sub_iter) {
3075                                 loff_t fakep = 0;
3076                                 void *v;
3077
3078                                 v = state->neigh_sub_iter(state, n, &fakep);
3079                                 if (!v)
3080                                         goto next;
3081                         }
3082                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3083                                 break;
3084                         if (n->nud_state & ~NUD_NOARP)
3085                                 break;
3086 next:
3087                         n = rcu_dereference_bh(n->next);
3088                 }
3089
3090                 if (n)
3091                         break;
3092         }
3093         state->bucket = bucket;
3094
3095         return n;
3096 }
3097
3098 static struct neighbour *neigh_get_next(struct seq_file *seq,
3099                                         struct neighbour *n,
3100                                         loff_t *pos)
3101 {
3102         struct neigh_seq_state *state = seq->private;
3103         struct net *net = seq_file_net(seq);
3104         struct neigh_hash_table *nht = state->nht;
3105
3106         if (state->neigh_sub_iter) {
3107                 void *v = state->neigh_sub_iter(state, n, pos);
3108                 if (v)
3109                         return n;
3110         }
3111         n = rcu_dereference_bh(n->next);
3112
3113         while (1) {
3114                 while (n) {
3115                         if (!net_eq(dev_net(n->dev), net))
3116                                 goto next;
3117                         if (state->neigh_sub_iter) {
3118                                 void *v = state->neigh_sub_iter(state, n, pos);
3119                                 if (v)
3120                                         return n;
3121                                 goto next;
3122                         }
3123                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3124                                 break;
3125
3126                         if (n->nud_state & ~NUD_NOARP)
3127                                 break;
3128 next:
3129                         n = rcu_dereference_bh(n->next);
3130                 }
3131
3132                 if (n)
3133                         break;
3134
3135                 if (++state->bucket >= (1 << nht->hash_shift))
3136                         break;
3137
3138                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
3139         }
3140
3141         if (n && pos)
3142                 --(*pos);
3143         return n;
3144 }
3145
3146 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
3147 {
3148         struct neighbour *n = neigh_get_first(seq);
3149
3150         if (n) {
3151                 --(*pos);
3152                 while (*pos) {
3153                         n = neigh_get_next(seq, n, pos);
3154                         if (!n)
3155                                 break;
3156                 }
3157         }
3158         return *pos ? NULL : n;
3159 }
3160
3161 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
3162 {
3163         struct neigh_seq_state *state = seq->private;
3164         struct net *net = seq_file_net(seq);
3165         struct neigh_table *tbl = state->tbl;
3166         struct pneigh_entry *pn = NULL;
3167         int bucket;
3168
3169         state->flags |= NEIGH_SEQ_IS_PNEIGH;
3170         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
3171                 pn = tbl->phash_buckets[bucket];
3172                 while (pn && !net_eq(pneigh_net(pn), net))
3173                         pn = pn->next;
3174                 if (pn)
3175                         break;
3176         }
3177         state->bucket = bucket;
3178
3179         return pn;
3180 }
3181
3182 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
3183                                             struct pneigh_entry *pn,
3184                                             loff_t *pos)
3185 {
3186         struct neigh_seq_state *state = seq->private;
3187         struct net *net = seq_file_net(seq);
3188         struct neigh_table *tbl = state->tbl;
3189
3190         do {
3191                 pn = pn->next;
3192         } while (pn && !net_eq(pneigh_net(pn), net));
3193
3194         while (!pn) {
3195                 if (++state->bucket > PNEIGH_HASHMASK)
3196                         break;
3197                 pn = tbl->phash_buckets[state->bucket];
3198                 while (pn && !net_eq(pneigh_net(pn), net))
3199                         pn = pn->next;
3200                 if (pn)
3201                         break;
3202         }
3203
3204         if (pn && pos)
3205                 --(*pos);
3206
3207         return pn;
3208 }
3209
3210 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
3211 {
3212         struct pneigh_entry *pn = pneigh_get_first(seq);
3213
3214         if (pn) {
3215                 --(*pos);
3216                 while (*pos) {
3217                         pn = pneigh_get_next(seq, pn, pos);
3218                         if (!pn)
3219                                 break;
3220                 }
3221         }
3222         return *pos ? NULL : pn;
3223 }
3224
3225 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
3226 {
3227         struct neigh_seq_state *state = seq->private;
3228         void *rc;
3229         loff_t idxpos = *pos;
3230
3231         rc = neigh_get_idx(seq, &idxpos);
3232         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3233                 rc = pneigh_get_idx(seq, &idxpos);
3234
3235         return rc;
3236 }
3237
3238 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
3239         __acquires(tbl->lock)
3240         __acquires(rcu_bh)
3241 {
3242         struct neigh_seq_state *state = seq->private;
3243
3244         state->tbl = tbl;
3245         state->bucket = 0;
3246         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
3247
3248         rcu_read_lock_bh();
3249         state->nht = rcu_dereference_bh(tbl->nht);
3250         read_lock(&tbl->lock);
3251
3252         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
3253 }
3254 EXPORT_SYMBOL(neigh_seq_start);
3255
3256 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3257 {
3258         struct neigh_seq_state *state;
3259         void *rc;
3260
3261         if (v == SEQ_START_TOKEN) {
3262                 rc = neigh_get_first(seq);
3263                 goto out;
3264         }
3265
3266         state = seq->private;
3267         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
3268                 rc = neigh_get_next(seq, v, NULL);
3269                 if (rc)
3270                         goto out;
3271                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3272                         rc = pneigh_get_first(seq);
3273         } else {
3274                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
3275                 rc = pneigh_get_next(seq, v, NULL);
3276         }
3277 out:
3278         ++(*pos);
3279         return rc;
3280 }
3281 EXPORT_SYMBOL(neigh_seq_next);
3282
3283 void neigh_seq_stop(struct seq_file *seq, void *v)
3284         __releases(tbl->lock)
3285         __releases(rcu_bh)
3286 {
3287         struct neigh_seq_state *state = seq->private;
3288         struct neigh_table *tbl = state->tbl;
3289
3290         read_unlock(&tbl->lock);
3291         rcu_read_unlock_bh();
3292 }
3293 EXPORT_SYMBOL(neigh_seq_stop);
3294
3295 /* statistics via seq_file */
3296
3297 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
3298 {
3299         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3300         int cpu;
3301
3302         if (*pos == 0)
3303                 return SEQ_START_TOKEN;
3304
3305         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
3306                 if (!cpu_possible(cpu))
3307                         continue;
3308                 *pos = cpu+1;
3309                 return per_cpu_ptr(tbl->stats, cpu);
3310         }
3311         return NULL;
3312 }
3313
3314 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3315 {
3316         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3317         int cpu;
3318
3319         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
3320                 if (!cpu_possible(cpu))
3321                         continue;
3322                 *pos = cpu+1;
3323                 return per_cpu_ptr(tbl->stats, cpu);
3324         }
3325         (*pos)++;
3326         return NULL;
3327 }
3328
3329 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
3330 {
3331
3332 }
3333
3334 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
3335 {
3336         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3337         struct neigh_statistics *st = v;
3338
3339         if (v == SEQ_START_TOKEN) {
3340                 seq_puts(seq, "entries  allocs   destroys hash_grows lookups  hits     res_failed rcv_probes_mcast rcv_probes_ucast periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
3341                 return 0;
3342         }
3343
3344         seq_printf(seq, "%08x %08lx %08lx %08lx   %08lx %08lx %08lx   "
3345                         "%08lx         %08lx         %08lx         "
3346                         "%08lx       %08lx            %08lx\n",
3347                    atomic_read(&tbl->entries),
3348
3349                    st->allocs,
3350                    st->destroys,
3351                    st->hash_grows,
3352
3353                    st->lookups,
3354                    st->hits,
3355
3356                    st->res_failed,
3357
3358                    st->rcv_probes_mcast,
3359                    st->rcv_probes_ucast,
3360
3361                    st->periodic_gc_runs,
3362                    st->forced_gc_runs,
3363                    st->unres_discards,
3364                    st->table_fulls
3365                    );
3366
3367         return 0;
3368 }
3369
3370 static const struct seq_operations neigh_stat_seq_ops = {
3371         .start  = neigh_stat_seq_start,
3372         .next   = neigh_stat_seq_next,
3373         .stop   = neigh_stat_seq_stop,
3374         .show   = neigh_stat_seq_show,
3375 };
3376 #endif /* CONFIG_PROC_FS */
3377
3378 static void __neigh_notify(struct neighbour *n, int type, int flags,
3379                            u32 pid)
3380 {
3381         struct net *net = dev_net(n->dev);
3382         struct sk_buff *skb;
3383         int err = -ENOBUFS;
3384
3385         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
3386         if (skb == NULL)
3387                 goto errout;
3388
3389         err = neigh_fill_info(skb, n, pid, 0, type, flags);
3390         if (err < 0) {
3391                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
3392                 WARN_ON(err == -EMSGSIZE);
3393                 kfree_skb(skb);
3394                 goto errout;
3395         }
3396         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
3397         return;
3398 errout:
3399         if (err < 0)
3400                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
3401 }
3402
3403 void neigh_app_ns(struct neighbour *n)
3404 {
3405         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
3406 }
3407 EXPORT_SYMBOL(neigh_app_ns);
3408
3409 #ifdef CONFIG_SYSCTL
3410 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
3411
3412 static int proc_unres_qlen(struct ctl_table *ctl, int write,
3413                            void *buffer, size_t *lenp, loff_t *ppos)
3414 {
3415         int size, ret;
3416         struct ctl_table tmp = *ctl;
3417
3418         tmp.extra1 = SYSCTL_ZERO;
3419         tmp.extra2 = &unres_qlen_max;
3420         tmp.data = &size;
3421
3422         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
3423         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3424
3425         if (write && !ret)
3426                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
3427         return ret;
3428 }
3429
3430 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
3431                                                    int family)
3432 {
3433         switch (family) {
3434         case AF_INET:
3435                 return __in_dev_arp_parms_get_rcu(dev);
3436         case AF_INET6:
3437                 return __in6_dev_nd_parms_get_rcu(dev);
3438         }
3439         return NULL;
3440 }
3441
3442 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
3443                                   int index)
3444 {
3445         struct net_device *dev;
3446         int family = neigh_parms_family(p);
3447
3448         rcu_read_lock();
3449         for_each_netdev_rcu(net, dev) {
3450                 struct neigh_parms *dst_p =
3451                                 neigh_get_dev_parms_rcu(dev, family);
3452
3453                 if (dst_p && !test_bit(index, dst_p->data_state))
3454                         dst_p->data[index] = p->data[index];
3455         }
3456         rcu_read_unlock();
3457 }
3458
3459 static void neigh_proc_update(struct ctl_table *ctl, int write)
3460 {
3461         struct net_device *dev = ctl->extra1;
3462         struct neigh_parms *p = ctl->extra2;
3463         struct net *net = neigh_parms_net(p);
3464         int index = (int *) ctl->data - p->data;
3465
3466         if (!write)
3467                 return;
3468
3469         set_bit(index, p->data_state);
3470         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
3471                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
3472         if (!dev) /* NULL dev means this is default value */
3473                 neigh_copy_dflt_parms(net, p, index);
3474 }
3475
3476 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
3477                                            void *buffer, size_t *lenp,
3478                                            loff_t *ppos)
3479 {
3480         struct ctl_table tmp = *ctl;
3481         int ret;
3482
3483         tmp.extra1 = SYSCTL_ZERO;
3484         tmp.extra2 = SYSCTL_INT_MAX;
3485
3486         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3487         neigh_proc_update(ctl, write);
3488         return ret;
3489 }
3490
3491 int neigh_proc_dointvec(struct ctl_table *ctl, int write, void *buffer,
3492                         size_t *lenp, loff_t *ppos)
3493 {
3494         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3495
3496         neigh_proc_update(ctl, write);
3497         return ret;
3498 }
3499 EXPORT_SYMBOL(neigh_proc_dointvec);
3500
3501 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write, void *buffer,
3502                                 size_t *lenp, loff_t *ppos)
3503 {
3504         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3505
3506         neigh_proc_update(ctl, write);
3507         return ret;
3508 }
3509 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3510
3511 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3512                                               void *buffer, size_t *lenp,
3513                                               loff_t *ppos)
3514 {
3515         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3516
3517         neigh_proc_update(ctl, write);
3518         return ret;
3519 }
3520
3521 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3522                                    void *buffer, size_t *lenp, loff_t *ppos)
3523 {
3524         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3525
3526         neigh_proc_update(ctl, write);
3527         return ret;
3528 }
3529 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3530
3531 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3532                                           void *buffer, size_t *lenp,
3533                                           loff_t *ppos)
3534 {
3535         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3536
3537         neigh_proc_update(ctl, write);
3538         return ret;
3539 }
3540
3541 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3542                                           void *buffer, size_t *lenp,
3543                                           loff_t *ppos)
3544 {
3545         struct neigh_parms *p = ctl->extra2;
3546         int ret;
3547
3548         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3549                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3550         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3551                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3552         else
3553                 ret = -1;
3554
3555         if (write && ret == 0) {
3556                 /* update reachable_time as well, otherwise, the change will
3557                  * only be effective after the next time neigh_periodic_work
3558                  * decides to recompute it
3559                  */
3560                 p->reachable_time =
3561                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3562         }
3563         return ret;
3564 }
3565
3566 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3567         (&((struct neigh_parms *) 0)->data[index])
3568
3569 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3570         [NEIGH_VAR_ ## attr] = { \
3571                 .procname       = name, \
3572                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3573                 .maxlen         = sizeof(int), \
3574                 .mode           = mval, \
3575                 .proc_handler   = proc, \
3576         }
3577
3578 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3579         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3580
3581 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3582         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3583
3584 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3585         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3586
3587 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3588         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3589
3590 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3591         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3592
3593 static struct neigh_sysctl_table {
3594         struct ctl_table_header *sysctl_header;
3595         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3596 } neigh_sysctl_template __read_mostly = {
3597         .neigh_vars = {
3598                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3599                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3600                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3601                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3602                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3603                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3604                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3605                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3606                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3607                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3608                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3609                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3610                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3611                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3612                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3613                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3614                 [NEIGH_VAR_GC_INTERVAL] = {
3615                         .procname       = "gc_interval",
3616                         .maxlen         = sizeof(int),
3617                         .mode           = 0644,
3618                         .proc_handler   = proc_dointvec_jiffies,
3619                 },
3620                 [NEIGH_VAR_GC_THRESH1] = {
3621                         .procname       = "gc_thresh1",
3622                         .maxlen         = sizeof(int),
3623                         .mode           = 0644,
3624                         .extra1         = SYSCTL_ZERO,
3625                         .extra2         = SYSCTL_INT_MAX,
3626                         .proc_handler   = proc_dointvec_minmax,
3627                 },
3628                 [NEIGH_VAR_GC_THRESH2] = {
3629                         .procname       = "gc_thresh2",
3630                         .maxlen         = sizeof(int),
3631                         .mode           = 0644,
3632                         .extra1         = SYSCTL_ZERO,
3633                         .extra2         = SYSCTL_INT_MAX,
3634                         .proc_handler   = proc_dointvec_minmax,
3635                 },
3636                 [NEIGH_VAR_GC_THRESH3] = {
3637                         .procname       = "gc_thresh3",
3638                         .maxlen         = sizeof(int),
3639                         .mode           = 0644,
3640                         .extra1         = SYSCTL_ZERO,
3641                         .extra2         = SYSCTL_INT_MAX,
3642                         .proc_handler   = proc_dointvec_minmax,
3643                 },
3644                 {},
3645         },
3646 };
3647
3648 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3649                           proc_handler *handler)
3650 {
3651         int i;
3652         struct neigh_sysctl_table *t;
3653         const char *dev_name_source;
3654         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3655         char *p_name;
3656
3657         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3658         if (!t)
3659                 goto err;
3660
3661         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3662                 t->neigh_vars[i].data += (long) p;
3663                 t->neigh_vars[i].extra1 = dev;
3664                 t->neigh_vars[i].extra2 = p;
3665         }
3666
3667         if (dev) {
3668                 dev_name_source = dev->name;
3669                 /* Terminate the table early */
3670                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3671                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3672         } else {
3673                 struct neigh_table *tbl = p->tbl;
3674                 dev_name_source = "default";
3675                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3676                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3677                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3678                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3679         }
3680
3681         if (handler) {
3682                 /* RetransTime */
3683                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3684                 /* ReachableTime */
3685                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3686                 /* RetransTime (in milliseconds)*/
3687                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3688                 /* ReachableTime (in milliseconds) */
3689                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3690         } else {
3691                 /* Those handlers will update p->reachable_time after
3692                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3693                  * applied after the next neighbour update instead of waiting for
3694                  * neigh_periodic_work to update its value (can be multiple minutes)
3695                  * So any handler that replaces them should do this as well
3696                  */
3697                 /* ReachableTime */
3698                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3699                         neigh_proc_base_reachable_time;
3700                 /* ReachableTime (in milliseconds) */
3701                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3702                         neigh_proc_base_reachable_time;
3703         }
3704
3705         /* Don't export sysctls to unprivileged users */
3706         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3707                 t->neigh_vars[0].procname = NULL;
3708
3709         switch (neigh_parms_family(p)) {
3710         case AF_INET:
3711               p_name = "ipv4";
3712               break;
3713         case AF_INET6:
3714               p_name = "ipv6";
3715               break;
3716         default:
3717               BUG();
3718         }
3719
3720         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3721                 p_name, dev_name_source);
3722         t->sysctl_header =
3723                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3724         if (!t->sysctl_header)
3725                 goto free;
3726
3727         p->sysctl_table = t;
3728         return 0;
3729
3730 free:
3731         kfree(t);
3732 err:
3733         return -ENOBUFS;
3734 }
3735 EXPORT_SYMBOL(neigh_sysctl_register);
3736
3737 void neigh_sysctl_unregister(struct neigh_parms *p)
3738 {
3739         if (p->sysctl_table) {
3740                 struct neigh_sysctl_table *t = p->sysctl_table;
3741                 p->sysctl_table = NULL;
3742                 unregister_net_sysctl_table(t->sysctl_header);
3743                 kfree(t);
3744         }
3745 }
3746 EXPORT_SYMBOL(neigh_sysctl_unregister);
3747
3748 #endif  /* CONFIG_SYSCTL */
3749
3750 static int __init neigh_init(void)
3751 {
3752         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, 0);
3753         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, 0);
3754         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, neigh_get, neigh_dump_info, 0);
3755
3756         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3757                       0);
3758         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0);
3759
3760         return 0;
3761 }
3762
3763 subsys_initcall(neigh_init);