net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/slab.h>
  21 #include <linux/types.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/socket.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/proc_fs.h>
  27 #ifdef CONFIG_SYSCTL
  28 #include <linux/sysctl.h>
  29 #endif
  30 #include <linux/times.h>
  31 #include <net/net_namespace.h>
  32 #include <net/neighbour.h>
  33 #include <net/dst.h>
  34 #include <net/sock.h>
  35 #include <net/netevent.h>
  36 #include <net/netlink.h>
  37 #include <linux/rtnetlink.h>
  38 #include <linux/random.h>
  39 #include <linux/string.h>
  40 #include <linux/log2.h>
  41 #include <linux/inetdevice.h>
  42 #include <net/addrconf.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(unsigned long arg);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags,
  56                            u32 pid);
  57 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  58 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  59
  60 #ifdef CONFIG_PROC_FS
  61 static const struct file_operations neigh_stat_seq_fops;
  62 #endif
  63
  64 /*
  65    Neighbour hash table buckets are protected with rwlock tbl->lock.
  66
  67    - All the scans/updates to hash buckets MUST be made under this lock.
  68    - NOTHING clever should be made under this lock: no callbacks
  69      to protocol backends, no attempts to send something to network.
  70      It will result in deadlocks, if backend/driver wants to use neighbour
  71      cache.
  72    - If the entry requires some non-trivial actions, increase
  73      its reference count and release table lock.
  74
  75    Neighbour entries are protected:
  76    - with reference count.
  77    - with rwlock neigh->lock
  78
  79    Reference count prevents destruction.
  80
  81    neigh->lock mainly serializes ll address data and its validity state.
  82    However, the same lock is used to protect another entry fields:
  83     - timer
  84     - resolution queue
  85
  86    Again, nothing clever shall be made under neigh->lock,
  87    the most complicated procedure, which we allow is dev->hard_header.
  88    It is supposed, that dev->hard_header is simplistic and does
  89    not make callbacks to neighbour tables.
  90  */
  91
  92 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  93 {
  94         kfree_skb(skb);
  95         return -ENETDOWN;
  96 }
  97
  98 static void neigh_cleanup_and_release(struct neighbour *neigh)
  99 {
 100         if (neigh->parms->neigh_cleanup)
 101                 neigh->parms->neigh_cleanup(neigh);
 102
 103         __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 104         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 105         neigh_release(neigh);
 106 }
 107
 108 /*
 109  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 110  * It corresponds to default IPv6 settings and is not overridable,
 111  * because it is really reasonable choice.
 112  */
 113
 114 unsigned long neigh_rand_reach_time(unsigned long base)
 115 {
 116         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 117 }
 118 EXPORT_SYMBOL(neigh_rand_reach_time);
 119
 120
 121 static bool neigh_del(struct neighbour *n, __u8 state,
 122                       struct neighbour __rcu **np, struct neigh_table *tbl)
 123 {
 124         bool retval = false;
 125
 126         write_lock(&n->lock);
 127         if (refcount_read(&n->refcnt) == 1 && !(n->nud_state & state)) {
 128                 struct neighbour *neigh;
 129
 130                 neigh = rcu_dereference_protected(n->next,
 131                                                   lockdep_is_held(&tbl->lock));
 132                 rcu_assign_pointer(*np, neigh);
 133                 n->dead = 1;
 134                 retval = true;
 135         }
 136         write_unlock(&n->lock);
 137         if (retval)
 138                 neigh_cleanup_and_release(n);
 139         return retval;
 140 }
 141
 142 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 143 {
 144         struct neigh_hash_table *nht;
 145         void *pkey = ndel->primary_key;
 146         u32 hash_val;
 147         struct neighbour *n;
 148         struct neighbour __rcu **np;
 149
 150         nht = rcu_dereference_protected(tbl->nht,
 151                                         lockdep_is_held(&tbl->lock));
 152         hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
 153         hash_val = hash_val >> (32 - nht->hash_shift);
 154
 155         np = &nht->hash_buckets[hash_val];
 156         while ((n = rcu_dereference_protected(*np,
 157                                               lockdep_is_held(&tbl->lock)))) {
 158                 if (n == ndel)
 159                         return neigh_del(n, 0, np, tbl);
 160                 np = &n->next;
 161         }
 162         return false;
 163 }
 164
 165 static int neigh_forced_gc(struct neigh_table *tbl)
 166 {
 167         int shrunk = 0;
 168         int i;
 169         struct neigh_hash_table *nht;
 170
 171         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 172
 173         write_lock_bh(&tbl->lock);
 174         nht = rcu_dereference_protected(tbl->nht,
 175                                         lockdep_is_held(&tbl->lock));
 176         for (i = 0; i < (1 << nht->hash_shift); i++) {
 177                 struct neighbour *n;
 178                 struct neighbour __rcu **np;
 179
 180                 np = &nht->hash_buckets[i];
 181                 while ((n = rcu_dereference_protected(*np,
 182                                         lockdep_is_held(&tbl->lock))) != NULL) {
 183                         /* Neighbour record may be discarded if:
 184                          * - nobody refers to it.
 185                          * - it is not permanent
 186                          */
 187                         if (neigh_del(n, NUD_PERMANENT, np, tbl)) {
 188                                 shrunk = 1;
 189                                 continue;
 190                         }
 191                         np = &n->next;
 192                 }
 193         }
 194
 195         tbl->last_flush = jiffies;
 196
 197         write_unlock_bh(&tbl->lock);
 198
 199         return shrunk;
 200 }
 201
 202 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 203 {
 204         neigh_hold(n);
 205         if (unlikely(mod_timer(&n->timer, when))) {
 206                 printk("NEIGH: BUG, double timer add, state is %x\n",
 207                        n->nud_state);
 208                 dump_stack();
 209         }
 210 }
 211
 212 static int neigh_del_timer(struct neighbour *n)
 213 {
 214         if ((n->nud_state & NUD_IN_TIMER) &&
 215             del_timer(&n->timer)) {
 216                 neigh_release(n);
 217                 return 1;
 218         }
 219         return 0;
 220 }
 221
 222 static void pneigh_queue_purge(struct sk_buff_head *list)
 223 {
 224         struct sk_buff *skb;
 225
 226         while ((skb = skb_dequeue(list)) != NULL) {
 227                 dev_put(skb->dev);
 228                 kfree_skb(skb);
 229         }
 230 }
 231
 232 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 233 {
 234         int i;
 235         struct neigh_hash_table *nht;
 236
 237         nht = rcu_dereference_protected(tbl->nht,
 238                                         lockdep_is_held(&tbl->lock));
 239
 240         for (i = 0; i < (1 << nht->hash_shift); i++) {
 241                 struct neighbour *n;
 242                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 243
 244                 while ((n = rcu_dereference_protected(*np,
 245                                         lockdep_is_held(&tbl->lock))) != NULL) {
 246                         if (dev && n->dev != dev) {
 247                                 np = &n->next;
 248                                 continue;
 249                         }
 250                         rcu_assign_pointer(*np,
 251                                    rcu_dereference_protected(n->next,
 252                                                 lockdep_is_held(&tbl->lock)));
 253                         write_lock(&n->lock);
 254                         neigh_del_timer(n);
 255                         n->dead = 1;
 256
 257                         if (refcount_read(&n->refcnt) != 1) {
 258                                 /* The most unpleasant situation.
 259                                    We must destroy neighbour entry,
 260                                    but someone still uses it.
 261
 262                                    The destroy will be delayed until
 263                                    the last user releases us, but
 264                                    we must kill timers etc. and move
 265                                    it to safe state.
 266                                  */
 267                                 __skb_queue_purge(&n->arp_queue);
 268                                 n->arp_queue_len_bytes = 0;
 269                                 n->output = neigh_blackhole;
 270                                 if (n->nud_state & NUD_VALID)
 271                                         n->nud_state = NUD_NOARP;
 272                                 else
 273                                         n->nud_state = NUD_NONE;
 274                                 neigh_dbg(2, "neigh %p is stray\n", n);
 275                         }
 276                         write_unlock(&n->lock);
 277                         neigh_cleanup_and_release(n);
 278                 }
 279         }
 280 }
 281
 282 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 283 {
 284         write_lock_bh(&tbl->lock);
 285         neigh_flush_dev(tbl, dev);
 286         write_unlock_bh(&tbl->lock);
 287 }
 288 EXPORT_SYMBOL(neigh_changeaddr);
 289
 290 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 291 {
 292         write_lock_bh(&tbl->lock);
 293         neigh_flush_dev(tbl, dev);
 294         pneigh_ifdown(tbl, dev);
 295         write_unlock_bh(&tbl->lock);
 296
 297         del_timer_sync(&tbl->proxy_timer);
 298         pneigh_queue_purge(&tbl->proxy_queue);
 299         return 0;
 300 }
 301 EXPORT_SYMBOL(neigh_ifdown);
 302
 303 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 304 {
 305         struct neighbour *n = NULL;
 306         unsigned long now = jiffies;
 307         int entries;
 308
 309         entries = atomic_inc_return(&tbl->entries) - 1;
 310         if (entries >= tbl->gc_thresh3 ||
 311             (entries >= tbl->gc_thresh2 &&
 312              time_after(now, tbl->last_flush + 5 * HZ))) {
 313                 if (!neigh_forced_gc(tbl) &&
 314                     entries >= tbl->gc_thresh3) {
 315                         net_info_ratelimited("%s: neighbor table overflow!\n",
 316                                              tbl->id);
 317                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 318                         goto out_entries;
 319                 }
 320         }
 321
 322         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 323         if (!n)
 324                 goto out_entries;
 325
 326         __skb_queue_head_init(&n->arp_queue);
 327         rwlock_init(&n->lock);
 328         seqlock_init(&n->ha_lock);
 329         n->updated        = n->used = now;
 330         n->nud_state      = NUD_NONE;
 331         n->output         = neigh_blackhole;
 332         seqlock_init(&n->hh.hh_lock);
 333         n->parms          = neigh_parms_clone(&tbl->parms);
 334         setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 335
 336         NEIGH_CACHE_STAT_INC(tbl, allocs);
 337         n->tbl            = tbl;
 338         refcount_set(&n->refcnt, 1);
 339         n->dead           = 1;
 340 out:
 341         return n;
 342
 343 out_entries:
 344         atomic_dec(&tbl->entries);
 345         goto out;
 346 }
 347
 348 static void neigh_get_hash_rnd(u32 *x)
 349 {
 350         *x = get_random_u32() | 1;
 351 }
 352
 353 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 354 {
 355         size_t size = (1 << shift) * sizeof(struct neighbour *);
 356         struct neigh_hash_table *ret;
 357         struct neighbour __rcu **buckets;
 358         int i;
 359
 360         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 361         if (!ret)
 362                 return NULL;
 363         if (size <= PAGE_SIZE)
 364                 buckets = kzalloc(size, GFP_ATOMIC);
 365         else
 366                 buckets = (struct neighbour __rcu **)
 367                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 368                                            get_order(size));
 369         if (!buckets) {
 370                 kfree(ret);
 371                 return NULL;
 372         }
 373         ret->hash_buckets = buckets;
 374         ret->hash_shift = shift;
 375         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 376                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 377         return ret;
 378 }
 379
 380 static void neigh_hash_free_rcu(struct rcu_head *head)
 381 {
 382         struct neigh_hash_table *nht = container_of(head,
 383                                                     struct neigh_hash_table,
 384                                                     rcu);
 385         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 386         struct neighbour __rcu **buckets = nht->hash_buckets;
 387
 388         if (size <= PAGE_SIZE)
 389                 kfree(buckets);
 390         else
 391                 free_pages((unsigned long)buckets, get_order(size));
 392         kfree(nht);
 393 }
 394
 395 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 396                                                 unsigned long new_shift)
 397 {
 398         unsigned int i, hash;
 399         struct neigh_hash_table *new_nht, *old_nht;
 400
 401         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 402
 403         old_nht = rcu_dereference_protected(tbl->nht,
 404                                             lockdep_is_held(&tbl->lock));
 405         new_nht = neigh_hash_alloc(new_shift);
 406         if (!new_nht)
 407                 return old_nht;
 408
 409         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 410                 struct neighbour *n, *next;
 411
 412                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 413                                                    lockdep_is_held(&tbl->lock));
 414                      n != NULL;
 415                      n = next) {
 416                         hash = tbl->hash(n->primary_key, n->dev,
 417                                          new_nht->hash_rnd);
 418
 419                         hash >>= (32 - new_nht->hash_shift);
 420                         next = rcu_dereference_protected(n->next,
 421                                                 lockdep_is_held(&tbl->lock));
 422
 423                         rcu_assign_pointer(n->next,
 424                                            rcu_dereference_protected(
 425                                                 new_nht->hash_buckets[hash],
 426                                                 lockdep_is_held(&tbl->lock)));
 427                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 428                 }
 429         }
 430
 431         rcu_assign_pointer(tbl->nht, new_nht);
 432         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 433         return new_nht;
 434 }
 435
 436 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 437                                struct net_device *dev)
 438 {
 439         struct neighbour *n;
 440
 441         NEIGH_CACHE_STAT_INC(tbl, lookups);
 442
 443         rcu_read_lock_bh();
 444         n = __neigh_lookup_noref(tbl, pkey, dev);
 445         if (n) {
 446                 if (!refcount_inc_not_zero(&n->refcnt))
 447                         n = NULL;
 448                 NEIGH_CACHE_STAT_INC(tbl, hits);
 449         }
 450
 451         rcu_read_unlock_bh();
 452         return n;
 453 }
 454 EXPORT_SYMBOL(neigh_lookup);
 455
 456 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 457                                      const void *pkey)
 458 {
 459         struct neighbour *n;
 460         int key_len = tbl->key_len;
 461         u32 hash_val;
 462         struct neigh_hash_table *nht;
 463
 464         NEIGH_CACHE_STAT_INC(tbl, lookups);
 465
 466         rcu_read_lock_bh();
 467         nht = rcu_dereference_bh(tbl->nht);
 468         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 469
 470         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 471              n != NULL;
 472              n = rcu_dereference_bh(n->next)) {
 473                 if (!memcmp(n->primary_key, pkey, key_len) &&
 474                     net_eq(dev_net(n->dev), net)) {
 475                         if (!refcount_inc_not_zero(&n->refcnt))
 476                                 n = NULL;
 477                         NEIGH_CACHE_STAT_INC(tbl, hits);
 478                         break;
 479                 }
 480         }
 481
 482         rcu_read_unlock_bh();
 483         return n;
 484 }
 485 EXPORT_SYMBOL(neigh_lookup_nodev);
 486
 487 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 488                                  struct net_device *dev, bool want_ref)
 489 {
 490         u32 hash_val;
 491         int key_len = tbl->key_len;
 492         int error;
 493         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 494         struct neigh_hash_table *nht;
 495
 496         if (!n) {
 497                 rc = ERR_PTR(-ENOBUFS);
 498                 goto out;
 499         }
 500
 501         memcpy(n->primary_key, pkey, key_len);
 502         n->dev = dev;
 503         dev_hold(dev);
 504
 505         /* Protocol specific setup. */
 506         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 507                 rc = ERR_PTR(error);
 508                 goto out_neigh_release;
 509         }
 510
 511         if (dev->netdev_ops->ndo_neigh_construct) {
 512                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 513                 if (error < 0) {
 514                         rc = ERR_PTR(error);
 515                         goto out_neigh_release;
 516                 }
 517         }
 518
 519         /* Device specific setup. */
 520         if (n->parms->neigh_setup &&
 521             (error = n->parms->neigh_setup(n)) < 0) {
 522                 rc = ERR_PTR(error);
 523                 goto out_neigh_release;
 524         }
 525
 526         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 527
 528         write_lock_bh(&tbl->lock);
 529         nht = rcu_dereference_protected(tbl->nht,
 530                                         lockdep_is_held(&tbl->lock));
 531
 532         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 533                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 534
 535         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 536
 537         if (n->parms->dead) {
 538                 rc = ERR_PTR(-EINVAL);
 539                 goto out_tbl_unlock;
 540         }
 541
 542         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 543                                             lockdep_is_held(&tbl->lock));
 544              n1 != NULL;
 545              n1 = rcu_dereference_protected(n1->next,
 546                         lockdep_is_held(&tbl->lock))) {
 547                 if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 548                         if (want_ref)
 549                                 neigh_hold(n1);
 550                         rc = n1;
 551                         goto out_tbl_unlock;
 552                 }
 553         }
 554
 555         n->dead = 0;
 556         if (want_ref)
 557                 neigh_hold(n);
 558         rcu_assign_pointer(n->next,
 559                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 560                                                      lockdep_is_held(&tbl->lock)));
 561         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 562         write_unlock_bh(&tbl->lock);
 563         neigh_dbg(2, "neigh %p is created\n", n);
 564         rc = n;
 565 out:
 566         return rc;
 567 out_tbl_unlock:
 568         write_unlock_bh(&tbl->lock);
 569 out_neigh_release:
 570         neigh_release(n);
 571         goto out;
 572 }
 573 EXPORT_SYMBOL(__neigh_create);
 574
 575 static u32 pneigh_hash(const void *pkey, int key_len)
 576 {
 577         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 578         hash_val ^= (hash_val >> 16);
 579         hash_val ^= hash_val >> 8;
 580         hash_val ^= hash_val >> 4;
 581         hash_val &= PNEIGH_HASHMASK;
 582         return hash_val;
 583 }
 584
 585 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 586                                               struct net *net,
 587                                               const void *pkey,
 588                                               int key_len,
 589                                               struct net_device *dev)
 590 {
 591         while (n) {
 592                 if (!memcmp(n->key, pkey, key_len) &&
 593                     net_eq(pneigh_net(n), net) &&
 594                     (n->dev == dev || !n->dev))
 595                         return n;
 596                 n = n->next;
 597         }
 598         return NULL;
 599 }
 600
 601 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 602                 struct net *net, const void *pkey, struct net_device *dev)
 603 {
 604         int key_len = tbl->key_len;
 605         u32 hash_val = pneigh_hash(pkey, key_len);
 606
 607         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 608                                  net, pkey, key_len, dev);
 609 }
 610 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 611
 612 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 613                                     struct net *net, const void *pkey,
 614                                     struct net_device *dev, int creat)
 615 {
 616         struct pneigh_entry *n;
 617         int key_len = tbl->key_len;
 618         u32 hash_val = pneigh_hash(pkey, key_len);
 619
 620         read_lock_bh(&tbl->lock);
 621         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 622                               net, pkey, key_len, dev);
 623         read_unlock_bh(&tbl->lock);
 624
 625         if (n || !creat)
 626                 goto out;
 627
 628         ASSERT_RTNL();
 629
 630         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 631         if (!n)
 632                 goto out;
 633
 634         write_pnet(&n->net, net);
 635         memcpy(n->key, pkey, key_len);
 636         n->dev = dev;
 637         if (dev)
 638                 dev_hold(dev);
 639
 640         if (tbl->pconstructor && tbl->pconstructor(n)) {
 641                 if (dev)
 642                         dev_put(dev);
 643                 kfree(n);
 644                 n = NULL;
 645                 goto out;
 646         }
 647
 648         write_lock_bh(&tbl->lock);
 649         n->next = tbl->phash_buckets[hash_val];
 650         tbl->phash_buckets[hash_val] = n;
 651         write_unlock_bh(&tbl->lock);
 652 out:
 653         return n;
 654 }
 655 EXPORT_SYMBOL(pneigh_lookup);
 656
 657
 658 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 659                   struct net_device *dev)
 660 {
 661         struct pneigh_entry *n, **np;
 662         int key_len = tbl->key_len;
 663         u32 hash_val = pneigh_hash(pkey, key_len);
 664
 665         write_lock_bh(&tbl->lock);
 666         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 667              np = &n->next) {
 668                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 669                     net_eq(pneigh_net(n), net)) {
 670                         *np = n->next;
 671                         write_unlock_bh(&tbl->lock);
 672                         if (tbl->pdestructor)
 673                                 tbl->pdestructor(n);
 674                         if (n->dev)
 675                                 dev_put(n->dev);
 676                         kfree(n);
 677                         return 0;
 678                 }
 679         }
 680         write_unlock_bh(&tbl->lock);
 681         return -ENOENT;
 682 }
 683
 684 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 685 {
 686         struct pneigh_entry *n, **np;
 687         u32 h;
 688
 689         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 690                 np = &tbl->phash_buckets[h];
 691                 while ((n = *np) != NULL) {
 692                         if (!dev || n->dev == dev) {
 693                                 *np = n->next;
 694                                 if (tbl->pdestructor)
 695                                         tbl->pdestructor(n);
 696                                 if (n->dev)
 697                                         dev_put(n->dev);
 698                                 kfree(n);
 699                                 continue;
 700                         }
 701                         np = &n->next;
 702                 }
 703         }
 704         return -ENOENT;
 705 }
 706
 707 static void neigh_parms_destroy(struct neigh_parms *parms);
 708
 709 static inline void neigh_parms_put(struct neigh_parms *parms)
 710 {
 711         if (refcount_dec_and_test(&parms->refcnt))
 712                 neigh_parms_destroy(parms);
 713 }
 714
 715 /*
 716  *      neighbour must already be out of the table;
 717  *
 718  */
 719 void neigh_destroy(struct neighbour *neigh)
 720 {
 721         struct net_device *dev = neigh->dev;
 722
 723         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 724
 725         if (!neigh->dead) {
 726                 pr_warn("Destroying alive neighbour %p\n", neigh);
 727                 dump_stack();
 728                 return;
 729         }
 730
 731         if (neigh_del_timer(neigh))
 732                 pr_warn("Impossible event\n");
 733
 734         write_lock_bh(&neigh->lock);
 735         __skb_queue_purge(&neigh->arp_queue);
 736         write_unlock_bh(&neigh->lock);
 737         neigh->arp_queue_len_bytes = 0;
 738
 739         if (dev->netdev_ops->ndo_neigh_destroy)
 740                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 741
 742         dev_put(dev);
 743         neigh_parms_put(neigh->parms);
 744
 745         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 746
 747         atomic_dec(&neigh->tbl->entries);
 748         kfree_rcu(neigh, rcu);
 749 }
 750 EXPORT_SYMBOL(neigh_destroy);
 751
 752 /* Neighbour state is suspicious;
 753    disable fast path.
 754
 755    Called with write_locked neigh.
 756  */
 757 static void neigh_suspect(struct neighbour *neigh)
 758 {
 759         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 760
 761         neigh->output = neigh->ops->output;
 762 }
 763
 764 /* Neighbour state is OK;
 765    enable fast path.
 766
 767    Called with write_locked neigh.
 768  */
 769 static void neigh_connect(struct neighbour *neigh)
 770 {
 771         neigh_dbg(2, "neigh %p is connected\n", neigh);
 772
 773         neigh->output = neigh->ops->connected_output;
 774 }
 775
 776 static void neigh_periodic_work(struct work_struct *work)
 777 {
 778         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 779         struct neighbour *n;
 780         struct neighbour __rcu **np;
 781         unsigned int i;
 782         struct neigh_hash_table *nht;
 783
 784         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 785
 786         write_lock_bh(&tbl->lock);
 787         nht = rcu_dereference_protected(tbl->nht,
 788                                         lockdep_is_held(&tbl->lock));
 789
 790         /*
 791          *      periodically recompute ReachableTime from random function
 792          */
 793
 794         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 795                 struct neigh_parms *p;
 796                 tbl->last_rand = jiffies;
 797                 list_for_each_entry(p, &tbl->parms_list, list)
 798                         p->reachable_time =
 799                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 800         }
 801
 802         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 803                 goto out;
 804
 805         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 806                 np = &nht->hash_buckets[i];
 807
 808                 while ((n = rcu_dereference_protected(*np,
 809                                 lockdep_is_held(&tbl->lock))) != NULL) {
 810                         unsigned int state;
 811
 812                         write_lock(&n->lock);
 813
 814                         state = n->nud_state;
 815                         if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 816                                 write_unlock(&n->lock);
 817                                 goto next_elt;
 818                         }
 819
 820                         if (time_before(n->used, n->confirmed))
 821                                 n->used = n->confirmed;
 822
 823                         if (refcount_read(&n->refcnt) == 1 &&
 824                             (state == NUD_FAILED ||
 825                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 826                                 *np = n->next;
 827                                 n->dead = 1;
 828                                 write_unlock(&n->lock);
 829                                 neigh_cleanup_and_release(n);
 830                                 continue;
 831                         }
 832                         write_unlock(&n->lock);
 833
 834 next_elt:
 835                         np = &n->next;
 836                 }
 837                 /*
 838                  * It's fine to release lock here, even if hash table
 839                  * grows while we are preempted.
 840                  */
 841                 write_unlock_bh(&tbl->lock);
 842                 cond_resched();
 843                 write_lock_bh(&tbl->lock);
 844                 nht = rcu_dereference_protected(tbl->nht,
 845                                                 lockdep_is_held(&tbl->lock));
 846         }
 847 out:
 848         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 849          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 850          * BASE_REACHABLE_TIME.
 851          */
 852         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 853                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 854         write_unlock_bh(&tbl->lock);
 855 }
 856
 857 static __inline__ int neigh_max_probes(struct neighbour *n)
 858 {
 859         struct neigh_parms *p = n->parms;
 860         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 861                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 862                 NEIGH_VAR(p, MCAST_PROBES));
 863 }
 864
 865 static void neigh_invalidate(struct neighbour *neigh)
 866         __releases(neigh->lock)
 867         __acquires(neigh->lock)
 868 {
 869         struct sk_buff *skb;
 870
 871         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 872         neigh_dbg(2, "neigh %p is failed\n", neigh);
 873         neigh->updated = jiffies;
 874
 875         /* It is very thin place. report_unreachable is very complicated
 876            routine. Particularly, it can hit the same neighbour entry!
 877
 878            So that, we try to be accurate and avoid dead loop. --ANK
 879          */
 880         while (neigh->nud_state == NUD_FAILED &&
 881                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 882                 write_unlock(&neigh->lock);
 883                 neigh->ops->error_report(neigh, skb);
 884                 write_lock(&neigh->lock);
 885         }
 886         __skb_queue_purge(&neigh->arp_queue);
 887         neigh->arp_queue_len_bytes = 0;
 888 }
 889
 890 static void neigh_probe(struct neighbour *neigh)
 891         __releases(neigh->lock)
 892 {
 893         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 894         /* keep skb alive even if arp_queue overflows */
 895         if (skb)
 896                 skb = skb_clone(skb, GFP_ATOMIC);
 897         write_unlock(&neigh->lock);
 898         if (neigh->ops->solicit)
 899                 neigh->ops->solicit(neigh, skb);
 900         atomic_inc(&neigh->probes);
 901         kfree_skb(skb);
 902 }
 903
 904 /* Called when a timer expires for a neighbour entry. */
 905
 906 static void neigh_timer_handler(unsigned long arg)
 907 {
 908         unsigned long now, next;
 909         struct neighbour *neigh = (struct neighbour *)arg;
 910         unsigned int state;
 911         int notify = 0;
 912
 913         write_lock(&neigh->lock);
 914
 915         state = neigh->nud_state;
 916         now = jiffies;
 917         next = now + HZ;
 918
 919         if (!(state & NUD_IN_TIMER))
 920                 goto out;
 921
 922         if (state & NUD_REACHABLE) {
 923                 if (time_before_eq(now,
 924                                    neigh->confirmed + neigh->parms->reachable_time)) {
 925                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
 926                         next = neigh->confirmed + neigh->parms->reachable_time;
 927                 } else if (time_before_eq(now,
 928                                           neigh->used +
 929                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 930                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
 931                         neigh->nud_state = NUD_DELAY;
 932                         neigh->updated = jiffies;
 933                         neigh_suspect(neigh);
 934                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 935                 } else {
 936                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 937                         neigh->nud_state = NUD_STALE;
 938                         neigh->updated = jiffies;
 939                         neigh_suspect(neigh);
 940                         notify = 1;
 941                 }
 942         } else if (state & NUD_DELAY) {
 943                 if (time_before_eq(now,
 944                                    neigh->confirmed +
 945                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 946                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 947                         neigh->nud_state = NUD_REACHABLE;
 948                         neigh->updated = jiffies;
 949                         neigh_connect(neigh);
 950                         notify = 1;
 951                         next = neigh->confirmed + neigh->parms->reachable_time;
 952                 } else {
 953                         neigh_dbg(2, "neigh %p is probed\n", neigh);
 954                         neigh->nud_state = NUD_PROBE;
 955                         neigh->updated = jiffies;
 956                         atomic_set(&neigh->probes, 0);
 957                         notify = 1;
 958                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 959                 }
 960         } else {
 961                 /* NUD_PROBE|NUD_INCOMPLETE */
 962                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 963         }
 964
 965         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 966             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 967                 neigh->nud_state = NUD_FAILED;
 968                 notify = 1;
 969                 neigh_invalidate(neigh);
 970                 goto out;
 971         }
 972
 973         if (neigh->nud_state & NUD_IN_TIMER) {
 974                 if (time_before(next, jiffies + HZ/2))
 975                         next = jiffies + HZ/2;
 976                 if (!mod_timer(&neigh->timer, next))
 977                         neigh_hold(neigh);
 978         }
 979         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 980                 neigh_probe(neigh);
 981         } else {
 982 out:
 983                 write_unlock(&neigh->lock);
 984         }
 985
 986         if (notify)
 987                 neigh_update_notify(neigh, 0);
 988
 989         neigh_release(neigh);
 990 }
 991
 992 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 993 {
 994         int rc;
 995         bool immediate_probe = false;
 996
 997         write_lock_bh(&neigh->lock);
 998
 999         rc = 0;
1000         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1001                 goto out_unlock_bh;
1002         if (neigh->dead)
1003                 goto out_dead;
1004
1005         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1006                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1007                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
1008                         unsigned long next, now = jiffies;
1009
1010                         atomic_set(&neigh->probes,
1011                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
1012                         neigh->nud_state     = NUD_INCOMPLETE;
1013                         neigh->updated = now;
1014                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1015                                          HZ/2);
1016                         neigh_add_timer(neigh, next);
1017                         immediate_probe = true;
1018                 } else {
1019                         neigh->nud_state = NUD_FAILED;
1020                         neigh->updated = jiffies;
1021                         write_unlock_bh(&neigh->lock);
1022
1023                         kfree_skb(skb);
1024                         return 1;
1025                 }
1026         } else if (neigh->nud_state & NUD_STALE) {
1027                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1028                 neigh->nud_state = NUD_DELAY;
1029                 neigh->updated = jiffies;
1030                 neigh_add_timer(neigh, jiffies +
1031                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1032         }
1033
1034         if (neigh->nud_state == NUD_INCOMPLETE) {
1035                 if (skb) {
1036                         while (neigh->arp_queue_len_bytes + skb->truesize >
1037                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1038                                 struct sk_buff *buff;
1039
1040                                 buff = __skb_dequeue(&neigh->arp_queue);
1041                                 if (!buff)
1042                                         break;
1043                                 neigh->arp_queue_len_bytes -= buff->truesize;
1044                                 kfree_skb(buff);
1045                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1046                         }
1047                         skb_dst_force(skb);
1048                         __skb_queue_tail(&neigh->arp_queue, skb);
1049                         neigh->arp_queue_len_bytes += skb->truesize;
1050                 }
1051                 rc = 1;
1052         }
1053 out_unlock_bh:
1054         if (immediate_probe)
1055                 neigh_probe(neigh);
1056         else
1057                 write_unlock(&neigh->lock);
1058         local_bh_enable();
1059         return rc;
1060
1061 out_dead:
1062         if (neigh->nud_state & NUD_STALE)
1063                 goto out_unlock_bh;
1064         write_unlock_bh(&neigh->lock);
1065         kfree_skb(skb);
1066         return 1;
1067 }
1068 EXPORT_SYMBOL(__neigh_event_send);
1069
1070 static void neigh_update_hhs(struct neighbour *neigh)
1071 {
1072         struct hh_cache *hh;
1073         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1074                 = NULL;
1075
1076         if (neigh->dev->header_ops)
1077                 update = neigh->dev->header_ops->cache_update;
1078
1079         if (update) {
1080                 hh = &neigh->hh;
1081                 if (hh->hh_len) {
1082                         write_seqlock_bh(&hh->hh_lock);
1083                         update(hh, neigh->dev, neigh->ha);
1084                         write_sequnlock_bh(&hh->hh_lock);
1085                 }
1086         }
1087 }
1088
1089
1090
1091 /* Generic update routine.
1092    -- lladdr is new lladdr or NULL, if it is not supplied.
1093    -- new    is new state.
1094    -- flags
1095         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1096                                 if it is different.
1097         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1098                                 lladdr instead of overriding it
1099                                 if it is different.
1100         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1101
1102         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1103                                 NTF_ROUTER flag.
1104         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1105                                 a router.
1106
1107    Caller MUST hold reference count on the entry.
1108  */
1109
1110 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1111                  u32 flags, u32 nlmsg_pid)
1112 {
1113         u8 old;
1114         int err;
1115         int notify = 0;
1116         struct net_device *dev;
1117         int update_isrouter = 0;
1118
1119         write_lock_bh(&neigh->lock);
1120
1121         dev    = neigh->dev;
1122         old    = neigh->nud_state;
1123         err    = -EPERM;
1124
1125         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1126             (old & (NUD_NOARP | NUD_PERMANENT)))
1127                 goto out;
1128         if (neigh->dead)
1129                 goto out;
1130
1131         if (!(new & NUD_VALID)) {
1132                 neigh_del_timer(neigh);
1133                 if (old & NUD_CONNECTED)
1134                         neigh_suspect(neigh);
1135                 neigh->nud_state = new;
1136                 err = 0;
1137                 notify = old & NUD_VALID;
1138                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1139                     (new & NUD_FAILED)) {
1140                         neigh_invalidate(neigh);
1141                         notify = 1;
1142                 }
1143                 goto out;
1144         }
1145
1146         /* Compare new lladdr with cached one */
1147         if (!dev->addr_len) {
1148                 /* First case: device needs no address. */
1149                 lladdr = neigh->ha;
1150         } else if (lladdr) {
1151                 /* The second case: if something is already cached
1152                    and a new address is proposed:
1153                    - compare new & old
1154                    - if they are different, check override flag
1155                  */
1156                 if ((old & NUD_VALID) &&
1157                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1158                         lladdr = neigh->ha;
1159         } else {
1160                 /* No address is supplied; if we know something,
1161                    use it, otherwise discard the request.
1162                  */
1163                 err = -EINVAL;
1164                 if (!(old & NUD_VALID))
1165                         goto out;
1166                 lladdr = neigh->ha;
1167         }
1168
1169         /* If entry was valid and address is not changed,
1170            do not change entry state, if new one is STALE.
1171          */
1172         err = 0;
1173         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1174         if (old & NUD_VALID) {
1175                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1176                         update_isrouter = 0;
1177                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1178                             (old & NUD_CONNECTED)) {
1179                                 lladdr = neigh->ha;
1180                                 new = NUD_STALE;
1181                         } else
1182                                 goto out;
1183                 } else {
1184                         if (lladdr == neigh->ha && new == NUD_STALE &&
1185                             !(flags & NEIGH_UPDATE_F_ADMIN))
1186                                 new = old;
1187                 }
1188         }
1189
1190         /* Update timestamps only once we know we will make a change to the
1191          * neighbour entry. Otherwise we risk to move the locktime window with
1192          * noop updates and ignore relevant ARP updates.
1193          */
1194         if (new != old || lladdr != neigh->ha) {
1195                 if (new & NUD_CONNECTED)
1196                         neigh->confirmed = jiffies;
1197                 neigh->updated = jiffies;
1198         }
1199
1200         if (new != old) {
1201                 neigh_del_timer(neigh);
1202                 if (new & NUD_PROBE)
1203                         atomic_set(&neigh->probes, 0);
1204                 if (new & NUD_IN_TIMER)
1205                         neigh_add_timer(neigh, (jiffies +
1206                                                 ((new & NUD_REACHABLE) ?
1207                                                  neigh->parms->reachable_time :
1208                                                  0)));
1209                 neigh->nud_state = new;
1210                 notify = 1;
1211         }
1212
1213         if (lladdr != neigh->ha) {
1214                 write_seqlock(&neigh->ha_lock);
1215                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1216                 write_sequnlock(&neigh->ha_lock);
1217                 neigh_update_hhs(neigh);
1218                 if (!(new & NUD_CONNECTED))
1219                         neigh->confirmed = jiffies -
1220                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1221                 notify = 1;
1222         }
1223         if (new == old)
1224                 goto out;
1225         if (new & NUD_CONNECTED)
1226                 neigh_connect(neigh);
1227         else
1228                 neigh_suspect(neigh);
1229         if (!(old & NUD_VALID)) {
1230                 struct sk_buff *skb;
1231
1232                 /* Again: avoid dead loop if something went wrong */
1233
1234                 while (neigh->nud_state & NUD_VALID &&
1235                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1236                         struct dst_entry *dst = skb_dst(skb);
1237                         struct neighbour *n2, *n1 = neigh;
1238                         write_unlock_bh(&neigh->lock);
1239
1240                         rcu_read_lock();
1241
1242                         /* Why not just use 'neigh' as-is?  The problem is that
1243                          * things such as shaper, eql, and sch_teql can end up
1244                          * using alternative, different, neigh objects to output
1245                          * the packet in the output path.  So what we need to do
1246                          * here is re-lookup the top-level neigh in the path so
1247                          * we can reinject the packet there.
1248                          */
1249                         n2 = NULL;
1250                         if (dst) {
1251                                 n2 = dst_neigh_lookup_skb(dst, skb);
1252                                 if (n2)
1253                                         n1 = n2;
1254                         }
1255                         n1->output(n1, skb);
1256                         if (n2)
1257                                 neigh_release(n2);
1258                         rcu_read_unlock();
1259
1260                         write_lock_bh(&neigh->lock);
1261                 }
1262                 __skb_queue_purge(&neigh->arp_queue);
1263                 neigh->arp_queue_len_bytes = 0;
1264         }
1265 out:
1266         if (update_isrouter) {
1267                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1268                         (neigh->flags | NTF_ROUTER) :
1269                         (neigh->flags & ~NTF_ROUTER);
1270         }
1271         write_unlock_bh(&neigh->lock);
1272
1273         if (notify)
1274                 neigh_update_notify(neigh, nlmsg_pid);
1275
1276         return err;
1277 }
1278 EXPORT_SYMBOL(neigh_update);
1279
1280 /* Update the neigh to listen temporarily for probe responses, even if it is
1281  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1282  */
1283 void __neigh_set_probe_once(struct neighbour *neigh)
1284 {
1285         if (neigh->dead)
1286                 return;
1287         neigh->updated = jiffies;
1288         if (!(neigh->nud_state & NUD_FAILED))
1289                 return;
1290         neigh->nud_state = NUD_INCOMPLETE;
1291         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1292         neigh_add_timer(neigh,
1293                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1294 }
1295 EXPORT_SYMBOL(__neigh_set_probe_once);
1296
1297 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1298                                  u8 *lladdr, void *saddr,
1299                                  struct net_device *dev)
1300 {
1301         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1302                                                  lladdr || !dev->addr_len);
1303         if (neigh)
1304                 neigh_update(neigh, lladdr, NUD_STALE,
1305                              NEIGH_UPDATE_F_OVERRIDE, 0);
1306         return neigh;
1307 }
1308 EXPORT_SYMBOL(neigh_event_ns);
1309
1310 /* called with read_lock_bh(&n->lock); */
1311 static void neigh_hh_init(struct neighbour *n)
1312 {
1313         struct net_device *dev = n->dev;
1314         __be16 prot = n->tbl->protocol;
1315         struct hh_cache *hh = &n->hh;
1316
1317         write_lock_bh(&n->lock);
1318
1319         /* Only one thread can come in here and initialize the
1320          * hh_cache entry.
1321          */
1322         if (!hh->hh_len)
1323                 dev->header_ops->cache(n, hh, prot);
1324
1325         write_unlock_bh(&n->lock);
1326 }
1327
1328 /* Slow and careful. */
1329
1330 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1331 {
1332         int rc = 0;
1333
1334         if (!neigh_event_send(neigh, skb)) {
1335                 int err;
1336                 struct net_device *dev = neigh->dev;
1337                 unsigned int seq;
1338
1339                 if (dev->header_ops->cache && !neigh->hh.hh_len)
1340                         neigh_hh_init(neigh);
1341
1342                 do {
1343                         __skb_pull(skb, skb_network_offset(skb));
1344                         seq = read_seqbegin(&neigh->ha_lock);
1345                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1346                                               neigh->ha, NULL, skb->len);
1347                 } while (read_seqretry(&neigh->ha_lock, seq));
1348
1349                 if (err >= 0)
1350                         rc = dev_queue_xmit(skb);
1351                 else
1352                         goto out_kfree_skb;
1353         }
1354 out:
1355         return rc;
1356 out_kfree_skb:
1357         rc = -EINVAL;
1358         kfree_skb(skb);
1359         goto out;
1360 }
1361 EXPORT_SYMBOL(neigh_resolve_output);
1362
1363 /* As fast as possible without hh cache */
1364
1365 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1366 {
1367         struct net_device *dev = neigh->dev;
1368         unsigned int seq;
1369         int err;
1370
1371         do {
1372                 __skb_pull(skb, skb_network_offset(skb));
1373                 seq = read_seqbegin(&neigh->ha_lock);
1374                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1375                                       neigh->ha, NULL, skb->len);
1376         } while (read_seqretry(&neigh->ha_lock, seq));
1377
1378         if (err >= 0)
1379                 err = dev_queue_xmit(skb);
1380         else {
1381                 err = -EINVAL;
1382                 kfree_skb(skb);
1383         }
1384         return err;
1385 }
1386 EXPORT_SYMBOL(neigh_connected_output);
1387
1388 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1389 {
1390         return dev_queue_xmit(skb);
1391 }
1392 EXPORT_SYMBOL(neigh_direct_output);
1393
1394 static void neigh_proxy_process(unsigned long arg)
1395 {
1396         struct neigh_table *tbl = (struct neigh_table *)arg;
1397         long sched_next = 0;
1398         unsigned long now = jiffies;
1399         struct sk_buff *skb, *n;
1400
1401         spin_lock(&tbl->proxy_queue.lock);
1402
1403         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1404                 long tdif = NEIGH_CB(skb)->sched_next - now;
1405
1406                 if (tdif <= 0) {
1407                         struct net_device *dev = skb->dev;
1408
1409                         __skb_unlink(skb, &tbl->proxy_queue);
1410                         if (tbl->proxy_redo && netif_running(dev)) {
1411                                 rcu_read_lock();
1412                                 tbl->proxy_redo(skb);
1413                                 rcu_read_unlock();
1414                         } else {
1415                                 kfree_skb(skb);
1416                         }
1417
1418                         dev_put(dev);
1419                 } else if (!sched_next || tdif < sched_next)
1420                         sched_next = tdif;
1421         }
1422         del_timer(&tbl->proxy_timer);
1423         if (sched_next)
1424                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1425         spin_unlock(&tbl->proxy_queue.lock);
1426 }
1427
1428 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1429                     struct sk_buff *skb)
1430 {
1431         unsigned long now = jiffies;
1432
1433         unsigned long sched_next = now + (prandom_u32() %
1434                                           NEIGH_VAR(p, PROXY_DELAY));
1435
1436         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1437                 kfree_skb(skb);
1438                 return;
1439         }
1440
1441         NEIGH_CB(skb)->sched_next = sched_next;
1442         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1443
1444         spin_lock(&tbl->proxy_queue.lock);
1445         if (del_timer(&tbl->proxy_timer)) {
1446                 if (time_before(tbl->proxy_timer.expires, sched_next))
1447                         sched_next = tbl->proxy_timer.expires;
1448         }
1449         skb_dst_drop(skb);
1450         dev_hold(skb->dev);
1451         __skb_queue_tail(&tbl->proxy_queue, skb);
1452         mod_timer(&tbl->proxy_timer, sched_next);
1453         spin_unlock(&tbl->proxy_queue.lock);
1454 }
1455 EXPORT_SYMBOL(pneigh_enqueue);
1456
1457 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1458                                                       struct net *net, int ifindex)
1459 {
1460         struct neigh_parms *p;
1461
1462         list_for_each_entry(p, &tbl->parms_list, list) {
1463                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1464                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1465                         return p;
1466         }
1467
1468         return NULL;
1469 }
1470
1471 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1472                                       struct neigh_table *tbl)
1473 {
1474         struct neigh_parms *p;
1475         struct net *net = dev_net(dev);
1476         const struct net_device_ops *ops = dev->netdev_ops;
1477
1478         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1479         if (p) {
1480                 p->tbl            = tbl;
1481                 refcount_set(&p->refcnt, 1);
1482                 p->reachable_time =
1483                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1484                 dev_hold(dev);
1485                 p->dev = dev;
1486                 write_pnet(&p->net, net);
1487                 p->sysctl_table = NULL;
1488
1489                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1490                         dev_put(dev);
1491                         kfree(p);
1492                         return NULL;
1493                 }
1494
1495                 write_lock_bh(&tbl->lock);
1496                 list_add(&p->list, &tbl->parms.list);
1497                 write_unlock_bh(&tbl->lock);
1498
1499                 neigh_parms_data_state_cleanall(p);
1500         }
1501         return p;
1502 }
1503 EXPORT_SYMBOL(neigh_parms_alloc);
1504
1505 static void neigh_rcu_free_parms(struct rcu_head *head)
1506 {
1507         struct neigh_parms *parms =
1508                 container_of(head, struct neigh_parms, rcu_head);
1509
1510         neigh_parms_put(parms);
1511 }
1512
1513 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1514 {
1515         if (!parms || parms == &tbl->parms)
1516                 return;
1517         write_lock_bh(&tbl->lock);
1518         list_del(&parms->list);
1519         parms->dead = 1;
1520         write_unlock_bh(&tbl->lock);
1521         if (parms->dev)
1522                 dev_put(parms->dev);
1523         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1524 }
1525 EXPORT_SYMBOL(neigh_parms_release);
1526
1527 static void neigh_parms_destroy(struct neigh_parms *parms)
1528 {
1529         kfree(parms);
1530 }
1531
1532 static struct lock_class_key neigh_table_proxy_queue_class;
1533
1534 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1535
1536 void neigh_table_init(int index, struct neigh_table *tbl)
1537 {
1538         unsigned long now = jiffies;
1539         unsigned long phsize;
1540
1541         INIT_LIST_HEAD(&tbl->parms_list);
1542         list_add(&tbl->parms.list, &tbl->parms_list);
1543         write_pnet(&tbl->parms.net, &init_net);
1544         refcount_set(&tbl->parms.refcnt, 1);
1545         tbl->parms.reachable_time =
1546                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1547
1548         tbl->stats = alloc_percpu(struct neigh_statistics);
1549         if (!tbl->stats)
1550                 panic("cannot create neighbour cache statistics");
1551
1552 #ifdef CONFIG_PROC_FS
1553         if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1554                               &neigh_stat_seq_fops, tbl))
1555                 panic("cannot create neighbour proc dir entry");
1556 #endif
1557
1558         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1559
1560         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1561         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1562
1563         if (!tbl->nht || !tbl->phash_buckets)
1564                 panic("cannot allocate neighbour cache hashes");
1565
1566         if (!tbl->entry_size)
1567                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1568                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1569         else
1570                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1571
1572         rwlock_init(&tbl->lock);
1573         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1574         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1575                         tbl->parms.reachable_time);
1576         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1577         skb_queue_head_init_class(&tbl->proxy_queue,
1578                         &neigh_table_proxy_queue_class);
1579
1580         tbl->last_flush = now;
1581         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1582
1583         neigh_tables[index] = tbl;
1584 }
1585 EXPORT_SYMBOL(neigh_table_init);
1586
1587 int neigh_table_clear(int index, struct neigh_table *tbl)
1588 {
1589         neigh_tables[index] = NULL;
1590         /* It is not clean... Fix it to unload IPv6 module safely */
1591         cancel_delayed_work_sync(&tbl->gc_work);
1592         del_timer_sync(&tbl->proxy_timer);
1593         pneigh_queue_purge(&tbl->proxy_queue);
1594         neigh_ifdown(tbl, NULL);
1595         if (atomic_read(&tbl->entries))
1596                 pr_crit("neighbour leakage\n");
1597
1598         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1599                  neigh_hash_free_rcu);
1600         tbl->nht = NULL;
1601
1602         kfree(tbl->phash_buckets);
1603         tbl->phash_buckets = NULL;
1604
1605         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1606
1607         free_percpu(tbl->stats);
1608         tbl->stats = NULL;
1609
1610         return 0;
1611 }
1612 EXPORT_SYMBOL(neigh_table_clear);
1613
1614 static struct neigh_table *neigh_find_table(int family)
1615 {
1616         struct neigh_table *tbl = NULL;
1617
1618         switch (family) {
1619         case AF_INET:
1620                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1621                 break;
1622         case AF_INET6:
1623                 tbl = neigh_tables[NEIGH_ND_TABLE];
1624                 break;
1625         case AF_DECnet:
1626                 tbl = neigh_tables[NEIGH_DN_TABLE];
1627                 break;
1628         }
1629
1630         return tbl;
1631 }
1632
1633 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1634                         struct netlink_ext_ack *extack)
1635 {
1636         struct net *net = sock_net(skb->sk);
1637         struct ndmsg *ndm;
1638         struct nlattr *dst_attr;
1639         struct neigh_table *tbl;
1640         struct neighbour *neigh;
1641         struct net_device *dev = NULL;
1642         int err = -EINVAL;
1643
1644         ASSERT_RTNL();
1645         if (nlmsg_len(nlh) < sizeof(*ndm))
1646                 goto out;
1647
1648         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1649         if (dst_attr == NULL)
1650                 goto out;
1651
1652         ndm = nlmsg_data(nlh);
1653         if (ndm->ndm_ifindex) {
1654                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1655                 if (dev == NULL) {
1656                         err = -ENODEV;
1657                         goto out;
1658                 }
1659         }
1660
1661         tbl = neigh_find_table(ndm->ndm_family);
1662         if (tbl == NULL)
1663                 return -EAFNOSUPPORT;
1664
1665         if (nla_len(dst_attr) < tbl->key_len)
1666                 goto out;
1667
1668         if (ndm->ndm_flags & NTF_PROXY) {
1669                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1670                 goto out;
1671         }
1672
1673         if (dev == NULL)
1674                 goto out;
1675
1676         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1677         if (neigh == NULL) {
1678                 err = -ENOENT;
1679                 goto out;
1680         }
1681
1682         err = neigh_update(neigh, NULL, NUD_FAILED,
1683                            NEIGH_UPDATE_F_OVERRIDE |
1684                            NEIGH_UPDATE_F_ADMIN,
1685                            NETLINK_CB(skb).portid);
1686         write_lock_bh(&tbl->lock);
1687         neigh_release(neigh);
1688         neigh_remove_one(neigh, tbl);
1689         write_unlock_bh(&tbl->lock);
1690
1691 out:
1692         return err;
1693 }
1694
1695 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1696                      struct netlink_ext_ack *extack)
1697 {
1698         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1699         struct net *net = sock_net(skb->sk);
1700         struct ndmsg *ndm;
1701         struct nlattr *tb[NDA_MAX+1];
1702         struct neigh_table *tbl;
1703         struct net_device *dev = NULL;
1704         struct neighbour *neigh;
1705         void *dst, *lladdr;
1706         int err;
1707
1708         ASSERT_RTNL();
1709         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL, extack);
1710         if (err < 0)
1711                 goto out;
1712
1713         err = -EINVAL;
1714         if (tb[NDA_DST] == NULL)
1715                 goto out;
1716
1717         ndm = nlmsg_data(nlh);
1718         if (ndm->ndm_ifindex) {
1719                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1720                 if (dev == NULL) {
1721                         err = -ENODEV;
1722                         goto out;
1723                 }
1724
1725                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1726                         goto out;
1727         }
1728
1729         tbl = neigh_find_table(ndm->ndm_family);
1730         if (tbl == NULL)
1731                 return -EAFNOSUPPORT;
1732
1733         if (nla_len(tb[NDA_DST]) < tbl->key_len)
1734                 goto out;
1735         dst = nla_data(tb[NDA_DST]);
1736         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1737
1738         if (ndm->ndm_flags & NTF_PROXY) {
1739                 struct pneigh_entry *pn;
1740
1741                 err = -ENOBUFS;
1742                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1743                 if (pn) {
1744                         pn->flags = ndm->ndm_flags;
1745                         err = 0;
1746                 }
1747                 goto out;
1748         }
1749
1750         if (dev == NULL)
1751                 goto out;
1752
1753         neigh = neigh_lookup(tbl, dst, dev);
1754         if (neigh == NULL) {
1755                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1756                         err = -ENOENT;
1757                         goto out;
1758                 }
1759
1760                 neigh = __neigh_lookup_errno(tbl, dst, dev);
1761                 if (IS_ERR(neigh)) {
1762                         err = PTR_ERR(neigh);
1763                         goto out;
1764                 }
1765         } else {
1766                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1767                         err = -EEXIST;
1768                         neigh_release(neigh);
1769                         goto out;
1770                 }
1771
1772                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1773                         flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1774         }
1775
1776         if (ndm->ndm_flags & NTF_USE) {
1777                 neigh_event_send(neigh, NULL);
1778                 err = 0;
1779         } else
1780                 err = neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1781                                    NETLINK_CB(skb).portid);
1782         neigh_release(neigh);
1783
1784 out:
1785         return err;
1786 }
1787
1788 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1789 {
1790         struct nlattr *nest;
1791
1792         nest = nla_nest_start(skb, NDTA_PARMS);
1793         if (nest == NULL)
1794                 return -ENOBUFS;
1795
1796         if ((parms->dev &&
1797              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1798             nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
1799             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1800                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1801             /* approximative value for deprecated QUEUE_LEN (in packets) */
1802             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1803                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1804             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1805             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1806             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1807                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1808             nla_put_u32(skb, NDTPA_MCAST_PROBES,
1809                         NEIGH_VAR(parms, MCAST_PROBES)) ||
1810             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1811                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
1812             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
1813                           NDTPA_PAD) ||
1814             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1815                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
1816             nla_put_msecs(skb, NDTPA_GC_STALETIME,
1817                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
1818             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1819                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
1820             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1821                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
1822             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1823                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
1824             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1825                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
1826             nla_put_msecs(skb, NDTPA_LOCKTIME,
1827                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
1828                 goto nla_put_failure;
1829         return nla_nest_end(skb, nest);
1830
1831 nla_put_failure:
1832         nla_nest_cancel(skb, nest);
1833         return -EMSGSIZE;
1834 }
1835
1836 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1837                               u32 pid, u32 seq, int type, int flags)
1838 {
1839         struct nlmsghdr *nlh;
1840         struct ndtmsg *ndtmsg;
1841
1842         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1843         if (nlh == NULL)
1844                 return -EMSGSIZE;
1845
1846         ndtmsg = nlmsg_data(nlh);
1847
1848         read_lock_bh(&tbl->lock);
1849         ndtmsg->ndtm_family = tbl->family;
1850         ndtmsg->ndtm_pad1   = 0;
1851         ndtmsg->ndtm_pad2   = 0;
1852
1853         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1854             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
1855             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1856             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1857             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1858                 goto nla_put_failure;
1859         {
1860                 unsigned long now = jiffies;
1861                 unsigned int flush_delta = now - tbl->last_flush;
1862                 unsigned int rand_delta = now - tbl->last_rand;
1863                 struct neigh_hash_table *nht;
1864                 struct ndt_config ndc = {
1865                         .ndtc_key_len           = tbl->key_len,
1866                         .ndtc_entry_size        = tbl->entry_size,
1867                         .ndtc_entries           = atomic_read(&tbl->entries),
1868                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1869                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1870                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1871                 };
1872
1873                 rcu_read_lock_bh();
1874                 nht = rcu_dereference_bh(tbl->nht);
1875                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1876                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1877                 rcu_read_unlock_bh();
1878
1879                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1880                         goto nla_put_failure;
1881         }
1882
1883         {
1884                 int cpu;
1885                 struct ndt_stats ndst;
1886
1887                 memset(&ndst, 0, sizeof(ndst));
1888
1889                 for_each_possible_cpu(cpu) {
1890                         struct neigh_statistics *st;
1891
1892                         st = per_cpu_ptr(tbl->stats, cpu);
1893                         ndst.ndts_allocs                += st->allocs;
1894                         ndst.ndts_destroys              += st->destroys;
1895                         ndst.ndts_hash_grows            += st->hash_grows;
1896                         ndst.ndts_res_failed            += st->res_failed;
1897                         ndst.ndts_lookups               += st->lookups;
1898                         ndst.ndts_hits                  += st->hits;
1899                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1900                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1901                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1902                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1903                         ndst.ndts_table_fulls           += st->table_fulls;
1904                 }
1905
1906                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
1907                                   NDTA_PAD))
1908                         goto nla_put_failure;
1909         }
1910
1911         BUG_ON(tbl->parms.dev);
1912         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1913                 goto nla_put_failure;
1914
1915         read_unlock_bh(&tbl->lock);
1916         nlmsg_end(skb, nlh);
1917         return 0;
1918
1919 nla_put_failure:
1920         read_unlock_bh(&tbl->lock);
1921         nlmsg_cancel(skb, nlh);
1922         return -EMSGSIZE;
1923 }
1924
1925 static int neightbl_fill_param_info(struct sk_buff *skb,
1926                                     struct neigh_table *tbl,
1927                                     struct neigh_parms *parms,
1928                                     u32 pid, u32 seq, int type,
1929                                     unsigned int flags)
1930 {
1931         struct ndtmsg *ndtmsg;
1932         struct nlmsghdr *nlh;
1933
1934         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1935         if (nlh == NULL)
1936                 return -EMSGSIZE;
1937
1938         ndtmsg = nlmsg_data(nlh);
1939
1940         read_lock_bh(&tbl->lock);
1941         ndtmsg->ndtm_family = tbl->family;
1942         ndtmsg->ndtm_pad1   = 0;
1943         ndtmsg->ndtm_pad2   = 0;
1944
1945         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1946             neightbl_fill_parms(skb, parms) < 0)
1947                 goto errout;
1948
1949         read_unlock_bh(&tbl->lock);
1950         nlmsg_end(skb, nlh);
1951         return 0;
1952 errout:
1953         read_unlock_bh(&tbl->lock);
1954         nlmsg_cancel(skb, nlh);
1955         return -EMSGSIZE;
1956 }
1957
1958 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1959         [NDTA_NAME]             = { .type = NLA_STRING },
1960         [NDTA_THRESH1]          = { .type = NLA_U32 },
1961         [NDTA_THRESH2]          = { .type = NLA_U32 },
1962         [NDTA_THRESH3]          = { .type = NLA_U32 },
1963         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1964         [NDTA_PARMS]            = { .type = NLA_NESTED },
1965 };
1966
1967 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1968         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1969         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1970         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1971         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1972         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1973         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1974         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
1975         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1976         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1977         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1978         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1979         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1980         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1981         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1982 };
1983
1984 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
1985                         struct netlink_ext_ack *extack)
1986 {
1987         struct net *net = sock_net(skb->sk);
1988         struct neigh_table *tbl;
1989         struct ndtmsg *ndtmsg;
1990         struct nlattr *tb[NDTA_MAX+1];
1991         bool found = false;
1992         int err, tidx;
1993
1994         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1995                           nl_neightbl_policy, extack);
1996         if (err < 0)
1997                 goto errout;
1998
1999         if (tb[NDTA_NAME] == NULL) {
2000                 err = -EINVAL;
2001                 goto errout;
2002         }
2003
2004         ndtmsg = nlmsg_data(nlh);
2005
2006         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2007                 tbl = neigh_tables[tidx];
2008                 if (!tbl)
2009                         continue;
2010                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2011                         continue;
2012                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2013                         found = true;
2014                         break;
2015                 }
2016         }
2017
2018         if (!found)
2019                 return -ENOENT;
2020
2021         /*
2022          * We acquire tbl->lock to be nice to the periodic timers and
2023          * make sure they always see a consistent set of values.
2024          */
2025         write_lock_bh(&tbl->lock);
2026
2027         if (tb[NDTA_PARMS]) {
2028                 struct nlattr *tbp[NDTPA_MAX+1];
2029                 struct neigh_parms *p;
2030                 int i, ifindex = 0;
2031
2032                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
2033                                        nl_ntbl_parm_policy, extack);
2034                 if (err < 0)
2035                         goto errout_tbl_lock;
2036
2037                 if (tbp[NDTPA_IFINDEX])
2038                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2039
2040                 p = lookup_neigh_parms(tbl, net, ifindex);
2041                 if (p == NULL) {
2042                         err = -ENOENT;
2043                         goto errout_tbl_lock;
2044                 }
2045
2046                 for (i = 1; i <= NDTPA_MAX; i++) {
2047                         if (tbp[i] == NULL)
2048                                 continue;
2049
2050                         switch (i) {
2051                         case NDTPA_QUEUE_LEN:
2052                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2053                                               nla_get_u32(tbp[i]) *
2054                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2055                                 break;
2056                         case NDTPA_QUEUE_LENBYTES:
2057                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2058                                               nla_get_u32(tbp[i]));
2059                                 break;
2060                         case NDTPA_PROXY_QLEN:
2061                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2062                                               nla_get_u32(tbp[i]));
2063                                 break;
2064                         case NDTPA_APP_PROBES:
2065                                 NEIGH_VAR_SET(p, APP_PROBES,
2066                                               nla_get_u32(tbp[i]));
2067                                 break;
2068                         case NDTPA_UCAST_PROBES:
2069                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2070                                               nla_get_u32(tbp[i]));
2071                                 break;
2072                         case NDTPA_MCAST_PROBES:
2073                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2074                                               nla_get_u32(tbp[i]));
2075                                 break;
2076                         case NDTPA_MCAST_REPROBES:
2077                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2078                                               nla_get_u32(tbp[i]));
2079                                 break;
2080                         case NDTPA_BASE_REACHABLE_TIME:
2081                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2082                                               nla_get_msecs(tbp[i]));
2083                                 /* update reachable_time as well, otherwise, the change will
2084                                  * only be effective after the next time neigh_periodic_work
2085                                  * decides to recompute it (can be multiple minutes)
2086                                  */
2087                                 p->reachable_time =
2088                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2089                                 break;
2090                         case NDTPA_GC_STALETIME:
2091                                 NEIGH_VAR_SET(p, GC_STALETIME,
2092                                               nla_get_msecs(tbp[i]));
2093                                 break;
2094                         case NDTPA_DELAY_PROBE_TIME:
2095                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2096                                               nla_get_msecs(tbp[i]));
2097                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2098                                 break;
2099                         case NDTPA_RETRANS_TIME:
2100                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2101                                               nla_get_msecs(tbp[i]));
2102                                 break;
2103                         case NDTPA_ANYCAST_DELAY:
2104                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2105                                               nla_get_msecs(tbp[i]));
2106                                 break;
2107                         case NDTPA_PROXY_DELAY:
2108                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2109                                               nla_get_msecs(tbp[i]));
2110                                 break;
2111                         case NDTPA_LOCKTIME:
2112                                 NEIGH_VAR_SET(p, LOCKTIME,
2113                                               nla_get_msecs(tbp[i]));
2114                                 break;
2115                         }
2116                 }
2117         }
2118
2119         err = -ENOENT;
2120         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2121              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2122             !net_eq(net, &init_net))
2123                 goto errout_tbl_lock;
2124
2125         if (tb[NDTA_THRESH1])
2126                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2127
2128         if (tb[NDTA_THRESH2])
2129                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2130
2131         if (tb[NDTA_THRESH3])
2132                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2133
2134         if (tb[NDTA_GC_INTERVAL])
2135                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2136
2137         err = 0;
2138
2139 errout_tbl_lock:
2140         write_unlock_bh(&tbl->lock);
2141 errout:
2142         return err;
2143 }
2144
2145 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2146 {
2147         struct net *net = sock_net(skb->sk);
2148         int family, tidx, nidx = 0;
2149         int tbl_skip = cb->args[0];
2150         int neigh_skip = cb->args[1];
2151         struct neigh_table *tbl;
2152
2153         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2154
2155         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2156                 struct neigh_parms *p;
2157
2158                 tbl = neigh_tables[tidx];
2159                 if (!tbl)
2160                         continue;
2161
2162                 if (tidx < tbl_skip || (family && tbl->family != family))
2163                         continue;
2164
2165                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2166                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2167                                        NLM_F_MULTI) < 0)
2168                         break;
2169
2170                 nidx = 0;
2171                 p = list_next_entry(&tbl->parms, list);
2172                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2173                         if (!net_eq(neigh_parms_net(p), net))
2174                                 continue;
2175
2176                         if (nidx < neigh_skip)
2177                                 goto next;
2178
2179                         if (neightbl_fill_param_info(skb, tbl, p,
2180                                                      NETLINK_CB(cb->skb).portid,
2181                                                      cb->nlh->nlmsg_seq,
2182                                                      RTM_NEWNEIGHTBL,
2183                                                      NLM_F_MULTI) < 0)
2184                                 goto out;
2185                 next:
2186                         nidx++;
2187                 }
2188
2189                 neigh_skip = 0;
2190         }
2191 out:
2192         cb->args[0] = tidx;
2193         cb->args[1] = nidx;
2194
2195         return skb->len;
2196 }
2197
2198 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2199                            u32 pid, u32 seq, int type, unsigned int flags)
2200 {
2201         unsigned long now = jiffies;
2202         struct nda_cacheinfo ci;
2203         struct nlmsghdr *nlh;
2204         struct ndmsg *ndm;
2205
2206         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2207         if (nlh == NULL)
2208                 return -EMSGSIZE;
2209
2210         ndm = nlmsg_data(nlh);
2211         ndm->ndm_family  = neigh->ops->family;
2212         ndm->ndm_pad1    = 0;
2213         ndm->ndm_pad2    = 0;
2214         ndm->ndm_flags   = neigh->flags;
2215         ndm->ndm_type    = neigh->type;
2216         ndm->ndm_ifindex = neigh->dev->ifindex;
2217
2218         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2219                 goto nla_put_failure;
2220
2221         read_lock_bh(&neigh->lock);
2222         ndm->ndm_state   = neigh->nud_state;
2223         if (neigh->nud_state & NUD_VALID) {
2224                 char haddr[MAX_ADDR_LEN];
2225
2226                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2227                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2228                         read_unlock_bh(&neigh->lock);
2229                         goto nla_put_failure;
2230                 }
2231         }
2232
2233         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2234         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2235         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2236         ci.ndm_refcnt    = refcount_read(&neigh->refcnt) - 1;
2237         read_unlock_bh(&neigh->lock);
2238
2239         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2240             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2241                 goto nla_put_failure;
2242
2243         nlmsg_end(skb, nlh);
2244         return 0;
2245
2246 nla_put_failure:
2247         nlmsg_cancel(skb, nlh);
2248         return -EMSGSIZE;
2249 }
2250
2251 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2252                             u32 pid, u32 seq, int type, unsigned int flags,
2253                             struct neigh_table *tbl)
2254 {
2255         struct nlmsghdr *nlh;
2256         struct ndmsg *ndm;
2257
2258         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2259         if (nlh == NULL)
2260                 return -EMSGSIZE;
2261
2262         ndm = nlmsg_data(nlh);
2263         ndm->ndm_family  = tbl->family;
2264         ndm->ndm_pad1    = 0;
2265         ndm->ndm_pad2    = 0;
2266         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2267         ndm->ndm_type    = RTN_UNICAST;
2268         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2269         ndm->ndm_state   = NUD_NONE;
2270
2271         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2272                 goto nla_put_failure;
2273
2274         nlmsg_end(skb, nlh);
2275         return 0;
2276
2277 nla_put_failure:
2278         nlmsg_cancel(skb, nlh);
2279         return -EMSGSIZE;
2280 }
2281
2282 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2283 {
2284         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2285         __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2286 }
2287
2288 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2289 {
2290         struct net_device *master;
2291
2292         if (!master_idx)
2293                 return false;
2294
2295         master = netdev_master_upper_dev_get(dev);
2296         if (!master || master->ifindex != master_idx)
2297                 return true;
2298
2299         return false;
2300 }
2301
2302 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2303 {
2304         if (filter_idx && dev->ifindex != filter_idx)
2305                 return true;
2306
2307         return false;
2308 }
2309
2310 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2311                             struct netlink_callback *cb)
2312 {
2313         struct net *net = sock_net(skb->sk);
2314         const struct nlmsghdr *nlh = cb->nlh;
2315         struct nlattr *tb[NDA_MAX + 1];
2316         struct neighbour *n;
2317         int rc, h, s_h = cb->args[1];
2318         int idx, s_idx = idx = cb->args[2];
2319         struct neigh_hash_table *nht;
2320         int filter_master_idx = 0, filter_idx = 0;
2321         unsigned int flags = NLM_F_MULTI;
2322         int err;
2323
2324         err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL);
2325         if (!err) {
2326                 if (tb[NDA_IFINDEX])
2327                         filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
2328
2329                 if (tb[NDA_MASTER])
2330                         filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
2331
2332                 if (filter_idx || filter_master_idx)
2333                         flags |= NLM_F_DUMP_FILTERED;
2334         }
2335
2336         rcu_read_lock_bh();
2337         nht = rcu_dereference_bh(tbl->nht);
2338
2339         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2340                 if (h > s_h)
2341                         s_idx = 0;
2342                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2343                      n != NULL;
2344                      n = rcu_dereference_bh(n->next)) {
2345                         if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2346                                 goto next;
2347                         if (neigh_ifindex_filtered(n->dev, filter_idx) ||
2348                             neigh_master_filtered(n->dev, filter_master_idx))
2349                                 goto next;
2350                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2351                                             cb->nlh->nlmsg_seq,
2352                                             RTM_NEWNEIGH,
2353                                             flags) < 0) {
2354                                 rc = -1;
2355                                 goto out;
2356                         }
2357 next:
2358                         idx++;
2359                 }
2360         }
2361         rc = skb->len;
2362 out:
2363         rcu_read_unlock_bh();
2364         cb->args[1] = h;
2365         cb->args[2] = idx;
2366         return rc;
2367 }
2368
2369 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2370                              struct netlink_callback *cb)
2371 {
2372         struct pneigh_entry *n;
2373         struct net *net = sock_net(skb->sk);
2374         int rc, h, s_h = cb->args[3];
2375         int idx, s_idx = idx = cb->args[4];
2376
2377         read_lock_bh(&tbl->lock);
2378
2379         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2380                 if (h > s_h)
2381                         s_idx = 0;
2382                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2383                         if (idx < s_idx || pneigh_net(n) != net)
2384                                 goto next;
2385                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2386                                             cb->nlh->nlmsg_seq,
2387                                             RTM_NEWNEIGH,
2388                                             NLM_F_MULTI, tbl) < 0) {
2389                                 read_unlock_bh(&tbl->lock);
2390                                 rc = -1;
2391                                 goto out;
2392                         }
2393                 next:
2394                         idx++;
2395                 }
2396         }
2397
2398         read_unlock_bh(&tbl->lock);
2399         rc = skb->len;
2400 out:
2401         cb->args[3] = h;
2402         cb->args[4] = idx;
2403         return rc;
2404
2405 }
2406
2407 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2408 {
2409         struct neigh_table *tbl;
2410         int t, family, s_t;
2411         int proxy = 0;
2412         int err;
2413
2414         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2415
2416         /* check for full ndmsg structure presence, family member is
2417          * the same for both structures
2418          */
2419         if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2420             ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2421                 proxy = 1;
2422
2423         s_t = cb->args[0];
2424
2425         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2426                 tbl = neigh_tables[t];
2427
2428                 if (!tbl)
2429                         continue;
2430                 if (t < s_t || (family && tbl->family != family))
2431                         continue;
2432                 if (t > s_t)
2433                         memset(&cb->args[1], 0, sizeof(cb->args) -
2434                                                 sizeof(cb->args[0]));
2435                 if (proxy)
2436                         err = pneigh_dump_table(tbl, skb, cb);
2437                 else
2438                         err = neigh_dump_table(tbl, skb, cb);
2439                 if (err < 0)
2440                         break;
2441         }
2442
2443         cb->args[0] = t;
2444         return skb->len;
2445 }
2446
2447 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2448 {
2449         int chain;
2450         struct neigh_hash_table *nht;
2451
2452         rcu_read_lock_bh();
2453         nht = rcu_dereference_bh(tbl->nht);
2454
2455         read_lock(&tbl->lock); /* avoid resizes */
2456         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2457                 struct neighbour *n;
2458
2459                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2460                      n != NULL;
2461                      n = rcu_dereference_bh(n->next))
2462                         cb(n, cookie);
2463         }
2464         read_unlock(&tbl->lock);
2465         rcu_read_unlock_bh();
2466 }
2467 EXPORT_SYMBOL(neigh_for_each);
2468
2469 /* The tbl->lock must be held as a writer and BH disabled. */
2470 void __neigh_for_each_release(struct neigh_table *tbl,
2471                               int (*cb)(struct neighbour *))
2472 {
2473         int chain;
2474         struct neigh_hash_table *nht;
2475
2476         nht = rcu_dereference_protected(tbl->nht,
2477                                         lockdep_is_held(&tbl->lock));
2478         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2479                 struct neighbour *n;
2480                 struct neighbour __rcu **np;
2481
2482                 np = &nht->hash_buckets[chain];
2483                 while ((n = rcu_dereference_protected(*np,
2484                                         lockdep_is_held(&tbl->lock))) != NULL) {
2485                         int release;
2486
2487                         write_lock(&n->lock);
2488                         release = cb(n);
2489                         if (release) {
2490                                 rcu_assign_pointer(*np,
2491                                         rcu_dereference_protected(n->next,
2492                                                 lockdep_is_held(&tbl->lock)));
2493                                 n->dead = 1;
2494                         } else
2495                                 np = &n->next;
2496                         write_unlock(&n->lock);
2497                         if (release)
2498                                 neigh_cleanup_and_release(n);
2499                 }
2500         }
2501 }
2502 EXPORT_SYMBOL(__neigh_for_each_release);
2503
2504 int neigh_xmit(int index, struct net_device *dev,
2505                const void *addr, struct sk_buff *skb)
2506 {
2507         int err = -EAFNOSUPPORT;
2508         if (likely(index < NEIGH_NR_TABLES)) {
2509                 struct neigh_table *tbl;
2510                 struct neighbour *neigh;
2511
2512                 tbl = neigh_tables[index];
2513                 if (!tbl)
2514                         goto out;
2515                 rcu_read_lock_bh();
2516                 neigh = __neigh_lookup_noref(tbl, addr, dev);
2517                 if (!neigh)
2518                         neigh = __neigh_create(tbl, addr, dev, false);
2519                 err = PTR_ERR(neigh);
2520                 if (IS_ERR(neigh)) {
2521                         rcu_read_unlock_bh();
2522                         goto out_kfree_skb;
2523                 }
2524                 err = neigh->output(neigh, skb);
2525                 rcu_read_unlock_bh();
2526         }
2527         else if (index == NEIGH_LINK_TABLE) {
2528                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2529                                       addr, NULL, skb->len);
2530                 if (err < 0)
2531                         goto out_kfree_skb;
2532                 err = dev_queue_xmit(skb);
2533         }
2534 out:
2535         return err;
2536 out_kfree_skb:
2537         kfree_skb(skb);
2538         goto out;
2539 }
2540 EXPORT_SYMBOL(neigh_xmit);
2541
2542 #ifdef CONFIG_PROC_FS
2543
2544 static struct neighbour *neigh_get_first(struct seq_file *seq)
2545 {
2546         struct neigh_seq_state *state = seq->private;
2547         struct net *net = seq_file_net(seq);
2548         struct neigh_hash_table *nht = state->nht;
2549         struct neighbour *n = NULL;
2550         int bucket = state->bucket;
2551
2552         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2553         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2554                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2555
2556                 while (n) {
2557                         if (!net_eq(dev_net(n->dev), net))
2558                                 goto next;
2559                         if (state->neigh_sub_iter) {
2560                                 loff_t fakep = 0;
2561                                 void *v;
2562
2563                                 v = state->neigh_sub_iter(state, n, &fakep);
2564                                 if (!v)
2565                                         goto next;
2566                         }
2567                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2568                                 break;
2569                         if (n->nud_state & ~NUD_NOARP)
2570                                 break;
2571 next:
2572                         n = rcu_dereference_bh(n->next);
2573                 }
2574
2575                 if (n)
2576                         break;
2577         }
2578         state->bucket = bucket;
2579
2580         return n;
2581 }
2582
2583 static struct neighbour *neigh_get_next(struct seq_file *seq,
2584                                         struct neighbour *n,
2585                                         loff_t *pos)
2586 {
2587         struct neigh_seq_state *state = seq->private;
2588         struct net *net = seq_file_net(seq);
2589         struct neigh_hash_table *nht = state->nht;
2590
2591         if (state->neigh_sub_iter) {
2592                 void *v = state->neigh_sub_iter(state, n, pos);
2593                 if (v)
2594                         return n;
2595         }
2596         n = rcu_dereference_bh(n->next);
2597
2598         while (1) {
2599                 while (n) {
2600                         if (!net_eq(dev_net(n->dev), net))
2601                                 goto next;
2602                         if (state->neigh_sub_iter) {
2603                                 void *v = state->neigh_sub_iter(state, n, pos);
2604                                 if (v)
2605                                         return n;
2606                                 goto next;
2607                         }
2608                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2609                                 break;
2610
2611                         if (n->nud_state & ~NUD_NOARP)
2612                                 break;
2613 next:
2614                         n = rcu_dereference_bh(n->next);
2615                 }
2616
2617                 if (n)
2618                         break;
2619
2620                 if (++state->bucket >= (1 << nht->hash_shift))
2621                         break;
2622
2623                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2624         }
2625
2626         if (n && pos)
2627                 --(*pos);
2628         return n;
2629 }
2630
2631 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2632 {
2633         struct neighbour *n = neigh_get_first(seq);
2634
2635         if (n) {
2636                 --(*pos);
2637                 while (*pos) {
2638                         n = neigh_get_next(seq, n, pos);
2639                         if (!n)
2640                                 break;
2641                 }
2642         }
2643         return *pos ? NULL : n;
2644 }
2645
2646 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2647 {
2648         struct neigh_seq_state *state = seq->private;
2649         struct net *net = seq_file_net(seq);
2650         struct neigh_table *tbl = state->tbl;
2651         struct pneigh_entry *pn = NULL;
2652         int bucket = state->bucket;
2653
2654         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2655         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2656                 pn = tbl->phash_buckets[bucket];
2657                 while (pn && !net_eq(pneigh_net(pn), net))
2658                         pn = pn->next;
2659                 if (pn)
2660                         break;
2661         }
2662         state->bucket = bucket;
2663
2664         return pn;
2665 }
2666
2667 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2668                                             struct pneigh_entry *pn,
2669                                             loff_t *pos)
2670 {
2671         struct neigh_seq_state *state = seq->private;
2672         struct net *net = seq_file_net(seq);
2673         struct neigh_table *tbl = state->tbl;
2674
2675         do {
2676                 pn = pn->next;
2677         } while (pn && !net_eq(pneigh_net(pn), net));
2678
2679         while (!pn) {
2680                 if (++state->bucket > PNEIGH_HASHMASK)
2681                         break;
2682                 pn = tbl->phash_buckets[state->bucket];
2683                 while (pn && !net_eq(pneigh_net(pn), net))
2684                         pn = pn->next;
2685                 if (pn)
2686                         break;
2687         }
2688
2689         if (pn && pos)
2690                 --(*pos);
2691
2692         return pn;
2693 }
2694
2695 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2696 {
2697         struct pneigh_entry *pn = pneigh_get_first(seq);
2698
2699         if (pn) {
2700                 --(*pos);
2701                 while (*pos) {
2702                         pn = pneigh_get_next(seq, pn, pos);
2703                         if (!pn)
2704                                 break;
2705                 }
2706         }
2707         return *pos ? NULL : pn;
2708 }
2709
2710 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2711 {
2712         struct neigh_seq_state *state = seq->private;
2713         void *rc;
2714         loff_t idxpos = *pos;
2715
2716         rc = neigh_get_idx(seq, &idxpos);
2717         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2718                 rc = pneigh_get_idx(seq, &idxpos);
2719
2720         return rc;
2721 }
2722
2723 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2724         __acquires(rcu_bh)
2725 {
2726         struct neigh_seq_state *state = seq->private;
2727
2728         state->tbl = tbl;
2729         state->bucket = 0;
2730         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2731
2732         rcu_read_lock_bh();
2733         state->nht = rcu_dereference_bh(tbl->nht);
2734
2735         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2736 }
2737 EXPORT_SYMBOL(neigh_seq_start);
2738
2739 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2740 {
2741         struct neigh_seq_state *state;
2742         void *rc;
2743
2744         if (v == SEQ_START_TOKEN) {
2745                 rc = neigh_get_first(seq);
2746                 goto out;
2747         }
2748
2749         state = seq->private;
2750         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2751                 rc = neigh_get_next(seq, v, NULL);
2752                 if (rc)
2753                         goto out;
2754                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2755                         rc = pneigh_get_first(seq);
2756         } else {
2757                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2758                 rc = pneigh_get_next(seq, v, NULL);
2759         }
2760 out:
2761         ++(*pos);
2762         return rc;
2763 }
2764 EXPORT_SYMBOL(neigh_seq_next);
2765
2766 void neigh_seq_stop(struct seq_file *seq, void *v)
2767         __releases(rcu_bh)
2768 {
2769         rcu_read_unlock_bh();
2770 }
2771 EXPORT_SYMBOL(neigh_seq_stop);
2772
2773 /* statistics via seq_file */
2774
2775 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2776 {
2777         struct neigh_table *tbl = seq->private;
2778         int cpu;
2779
2780         if (*pos == 0)
2781                 return SEQ_START_TOKEN;
2782
2783         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2784                 if (!cpu_possible(cpu))
2785                         continue;
2786                 *pos = cpu+1;
2787                 return per_cpu_ptr(tbl->stats, cpu);
2788         }
2789         return NULL;
2790 }
2791
2792 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2793 {
2794         struct neigh_table *tbl = seq->private;
2795         int cpu;
2796
2797         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2798                 if (!cpu_possible(cpu))
2799                         continue;
2800                 *pos = cpu+1;
2801                 return per_cpu_ptr(tbl->stats, cpu);
2802         }
2803         return NULL;
2804 }
2805
2806 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2807 {
2808
2809 }
2810
2811 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2812 {
2813         struct neigh_table *tbl = seq->private;
2814         struct neigh_statistics *st = v;
2815
2816         if (v == SEQ_START_TOKEN) {
2817                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
2818                 return 0;
2819         }
2820
2821         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2822                         "%08lx %08lx  %08lx %08lx %08lx %08lx\n",
2823                    atomic_read(&tbl->entries),
2824
2825                    st->allocs,
2826                    st->destroys,
2827                    st->hash_grows,
2828
2829                    st->lookups,
2830                    st->hits,
2831
2832                    st->res_failed,
2833
2834                    st->rcv_probes_mcast,
2835                    st->rcv_probes_ucast,
2836
2837                    st->periodic_gc_runs,
2838                    st->forced_gc_runs,
2839                    st->unres_discards,
2840                    st->table_fulls
2841                    );
2842
2843         return 0;
2844 }
2845
2846 static const struct seq_operations neigh_stat_seq_ops = {
2847         .start  = neigh_stat_seq_start,
2848         .next   = neigh_stat_seq_next,
2849         .stop   = neigh_stat_seq_stop,
2850         .show   = neigh_stat_seq_show,
2851 };
2852
2853 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2854 {
2855         int ret = seq_open(file, &neigh_stat_seq_ops);
2856
2857         if (!ret) {
2858                 struct seq_file *sf = file->private_data;
2859                 sf->private = PDE_DATA(inode);
2860         }
2861         return ret;
2862 };
2863
2864 static const struct file_operations neigh_stat_seq_fops = {
2865         .owner   = THIS_MODULE,
2866         .open    = neigh_stat_seq_open,
2867         .read    = seq_read,
2868         .llseek  = seq_lseek,
2869         .release = seq_release,
2870 };
2871
2872 #endif /* CONFIG_PROC_FS */
2873
2874 static inline size_t neigh_nlmsg_size(void)
2875 {
2876         return NLMSG_ALIGN(sizeof(struct ndmsg))
2877                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2878                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2879                + nla_total_size(sizeof(struct nda_cacheinfo))
2880                + nla_total_size(4); /* NDA_PROBES */
2881 }
2882
2883 static void __neigh_notify(struct neighbour *n, int type, int flags,
2884                            u32 pid)
2885 {
2886         struct net *net = dev_net(n->dev);
2887         struct sk_buff *skb;
2888         int err = -ENOBUFS;
2889
2890         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2891         if (skb == NULL)
2892                 goto errout;
2893
2894         err = neigh_fill_info(skb, n, pid, 0, type, flags);
2895         if (err < 0) {
2896                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2897                 WARN_ON(err == -EMSGSIZE);
2898                 kfree_skb(skb);
2899                 goto errout;
2900         }
2901         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2902         return;
2903 errout:
2904         if (err < 0)
2905                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2906 }
2907
2908 void neigh_app_ns(struct neighbour *n)
2909 {
2910         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
2911 }
2912 EXPORT_SYMBOL(neigh_app_ns);
2913
2914 #ifdef CONFIG_SYSCTL
2915 static int zero;
2916 static int int_max = INT_MAX;
2917 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2918
2919 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2920                            void __user *buffer, size_t *lenp, loff_t *ppos)
2921 {
2922         int size, ret;
2923         struct ctl_table tmp = *ctl;
2924
2925         tmp.extra1 = &zero;
2926         tmp.extra2 = &unres_qlen_max;
2927         tmp.data = &size;
2928
2929         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2930         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2931
2932         if (write && !ret)
2933                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2934         return ret;
2935 }
2936
2937 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2938                                                    int family)
2939 {
2940         switch (family) {
2941         case AF_INET:
2942                 return __in_dev_arp_parms_get_rcu(dev);
2943         case AF_INET6:
2944                 return __in6_dev_nd_parms_get_rcu(dev);
2945         }
2946         return NULL;
2947 }
2948
2949 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2950                                   int index)
2951 {
2952         struct net_device *dev;
2953         int family = neigh_parms_family(p);
2954
2955         rcu_read_lock();
2956         for_each_netdev_rcu(net, dev) {
2957                 struct neigh_parms *dst_p =
2958                                 neigh_get_dev_parms_rcu(dev, family);
2959
2960                 if (dst_p && !test_bit(index, dst_p->data_state))
2961                         dst_p->data[index] = p->data[index];
2962         }
2963         rcu_read_unlock();
2964 }
2965
2966 static void neigh_proc_update(struct ctl_table *ctl, int write)
2967 {
2968         struct net_device *dev = ctl->extra1;
2969         struct neigh_parms *p = ctl->extra2;
2970         struct net *net = neigh_parms_net(p);
2971         int index = (int *) ctl->data - p->data;
2972
2973         if (!write)
2974                 return;
2975
2976         set_bit(index, p->data_state);
2977         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
2978                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2979         if (!dev) /* NULL dev means this is default value */
2980                 neigh_copy_dflt_parms(net, p, index);
2981 }
2982
2983 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2984                                            void __user *buffer,
2985                                            size_t *lenp, loff_t *ppos)
2986 {
2987         struct ctl_table tmp = *ctl;
2988         int ret;
2989
2990         tmp.extra1 = &zero;
2991         tmp.extra2 = &int_max;
2992
2993         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2994         neigh_proc_update(ctl, write);
2995         return ret;
2996 }
2997
2998 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2999                         void __user *buffer, size_t *lenp, loff_t *ppos)
3000 {
3001         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3002
3003         neigh_proc_update(ctl, write);
3004         return ret;
3005 }
3006 EXPORT_SYMBOL(neigh_proc_dointvec);
3007
3008 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
3009                                 void __user *buffer,
3010                                 size_t *lenp, loff_t *ppos)
3011 {
3012         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3013
3014         neigh_proc_update(ctl, write);
3015         return ret;
3016 }
3017 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3018
3019 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3020                                               void __user *buffer,
3021                                               size_t *lenp, loff_t *ppos)
3022 {
3023         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3024
3025         neigh_proc_update(ctl, write);
3026         return ret;
3027 }
3028
3029 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3030                                    void __user *buffer,
3031                                    size_t *lenp, loff_t *ppos)
3032 {
3033         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3034
3035         neigh_proc_update(ctl, write);
3036         return ret;
3037 }
3038 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3039
3040 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3041                                           void __user *buffer,
3042                                           size_t *lenp, loff_t *ppos)
3043 {
3044         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3045
3046         neigh_proc_update(ctl, write);
3047         return ret;
3048 }
3049
3050 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3051                                           void __user *buffer,
3052                                           size_t *lenp, loff_t *ppos)
3053 {
3054         struct neigh_parms *p = ctl->extra2;
3055         int ret;
3056
3057         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3058                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3059         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3060                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3061         else
3062                 ret = -1;
3063
3064         if (write && ret == 0) {
3065                 /* update reachable_time as well, otherwise, the change will
3066                  * only be effective after the next time neigh_periodic_work
3067                  * decides to recompute it
3068                  */
3069                 p->reachable_time =
3070                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3071         }
3072         return ret;
3073 }
3074
3075 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3076         (&((struct neigh_parms *) 0)->data[index])
3077
3078 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3079         [NEIGH_VAR_ ## attr] = { \
3080                 .procname       = name, \
3081                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3082                 .maxlen         = sizeof(int), \
3083                 .mode           = mval, \
3084                 .proc_handler   = proc, \
3085         }
3086
3087 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3088         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3089
3090 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3091         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3092
3093 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3094         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3095
3096 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3097         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3098
3099 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3100         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3101
3102 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3103         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3104
3105 static struct neigh_sysctl_table {
3106         struct ctl_table_header *sysctl_header;
3107         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3108 } neigh_sysctl_template __read_mostly = {
3109         .neigh_vars = {
3110                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3111                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3112                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3113                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3114                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3115                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3116                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3117                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3118                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3119                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3120                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3121                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3122                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3123                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3124                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3125                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3126                 [NEIGH_VAR_GC_INTERVAL] = {
3127                         .procname       = "gc_interval",
3128                         .maxlen         = sizeof(int),
3129                         .mode           = 0644,
3130                         .proc_handler   = proc_dointvec_jiffies,
3131                 },
3132                 [NEIGH_VAR_GC_THRESH1] = {
3133                         .procname       = "gc_thresh1",
3134                         .maxlen         = sizeof(int),
3135                         .mode           = 0644,
3136                         .extra1         = &zero,
3137                         .extra2         = &int_max,
3138                         .proc_handler   = proc_dointvec_minmax,
3139                 },
3140                 [NEIGH_VAR_GC_THRESH2] = {
3141                         .procname       = "gc_thresh2",
3142                         .maxlen         = sizeof(int),
3143                         .mode           = 0644,
3144                         .extra1         = &zero,
3145                         .extra2         = &int_max,
3146                         .proc_handler   = proc_dointvec_minmax,
3147                 },
3148                 [NEIGH_VAR_GC_THRESH3] = {
3149                         .procname       = "gc_thresh3",
3150                         .maxlen         = sizeof(int),
3151                         .mode           = 0644,
3152                         .extra1         = &zero,
3153                         .extra2         = &int_max,
3154                         .proc_handler   = proc_dointvec_minmax,
3155                 },
3156                 {},
3157         },
3158 };
3159
3160 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3161                           proc_handler *handler)
3162 {
3163         int i;
3164         struct neigh_sysctl_table *t;
3165         const char *dev_name_source;
3166         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3167         char *p_name;
3168
3169         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3170         if (!t)
3171                 goto err;
3172
3173         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3174                 t->neigh_vars[i].data += (long) p;
3175                 t->neigh_vars[i].extra1 = dev;
3176                 t->neigh_vars[i].extra2 = p;
3177         }
3178
3179         if (dev) {
3180                 dev_name_source = dev->name;
3181                 /* Terminate the table early */
3182                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3183                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3184         } else {
3185                 struct neigh_table *tbl = p->tbl;
3186                 dev_name_source = "default";
3187                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3188                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3189                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3190                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3191         }
3192
3193         if (handler) {
3194                 /* RetransTime */
3195                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3196                 /* ReachableTime */
3197                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3198                 /* RetransTime (in milliseconds)*/
3199                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3200                 /* ReachableTime (in milliseconds) */
3201                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3202         } else {
3203                 /* Those handlers will update p->reachable_time after
3204                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3205                  * applied after the next neighbour update instead of waiting for
3206                  * neigh_periodic_work to update its value (can be multiple minutes)
3207                  * So any handler that replaces them should do this as well
3208                  */
3209                 /* ReachableTime */
3210                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3211                         neigh_proc_base_reachable_time;
3212                 /* ReachableTime (in milliseconds) */
3213                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3214                         neigh_proc_base_reachable_time;
3215         }
3216
3217         /* Don't export sysctls to unprivileged users */
3218         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3219                 t->neigh_vars[0].procname = NULL;
3220
3221         switch (neigh_parms_family(p)) {
3222         case AF_INET:
3223               p_name = "ipv4";
3224               break;
3225         case AF_INET6:
3226               p_name = "ipv6";
3227               break;
3228         default:
3229               BUG();
3230         }
3231
3232         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3233                 p_name, dev_name_source);
3234         t->sysctl_header =
3235                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3236         if (!t->sysctl_header)
3237                 goto free;
3238
3239         p->sysctl_table = t;
3240         return 0;
3241
3242 free:
3243         kfree(t);
3244 err:
3245         return -ENOBUFS;
3246 }
3247 EXPORT_SYMBOL(neigh_sysctl_register);
3248
3249 void neigh_sysctl_unregister(struct neigh_parms *p)
3250 {
3251         if (p->sysctl_table) {
3252                 struct neigh_sysctl_table *t = p->sysctl_table;
3253                 p->sysctl_table = NULL;
3254                 unregister_net_sysctl_table(t->sysctl_header);
3255                 kfree(t);
3256         }
3257 }
3258 EXPORT_SYMBOL(neigh_sysctl_unregister);
3259
3260 #endif  /* CONFIG_SYSCTL */
3261
3262 static int __init neigh_init(void)
3263 {
3264         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3265         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3266         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3267
3268         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3269                       NULL);
3270         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3271
3272         return 0;
3273 }
3274
3275 subsys_initcall(neigh_init);
3276