net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/slab.h>
  21 #include <linux/types.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/socket.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/proc_fs.h>
  27 #ifdef CONFIG_SYSCTL
  28 #include <linux/sysctl.h>
  29 #endif
  30 #include <linux/times.h>
  31 #include <net/net_namespace.h>
  32 #include <net/neighbour.h>
  33 #include <net/dst.h>
  34 #include <net/sock.h>
  35 #include <net/netevent.h>
  36 #include <net/netlink.h>
  37 #include <linux/rtnetlink.h>
  38 #include <linux/random.h>
  39 #include <linux/string.h>
  40 #include <linux/log2.h>
  41 #include <linux/inetdevice.h>
  42 #include <net/addrconf.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(unsigned long arg);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags,
  56                            u32 pid);
  57 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  58 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  59
  60 #ifdef CONFIG_PROC_FS
  61 static const struct file_operations neigh_stat_seq_fops;
  62 #endif
  63
  64 /*
  65    Neighbour hash table buckets are protected with rwlock tbl->lock.
  66
  67    - All the scans/updates to hash buckets MUST be made under this lock.
  68    - NOTHING clever should be made under this lock: no callbacks
  69      to protocol backends, no attempts to send something to network.
  70      It will result in deadlocks, if backend/driver wants to use neighbour
  71      cache.
  72    - If the entry requires some non-trivial actions, increase
  73      its reference count and release table lock.
  74
  75    Neighbour entries are protected:
  76    - with reference count.
  77    - with rwlock neigh->lock
  78
  79    Reference count prevents destruction.
  80
  81    neigh->lock mainly serializes ll address data and its validity state.
  82    However, the same lock is used to protect another entry fields:
  83     - timer
  84     - resolution queue
  85
  86    Again, nothing clever shall be made under neigh->lock,
  87    the most complicated procedure, which we allow is dev->hard_header.
  88    It is supposed, that dev->hard_header is simplistic and does
  89    not make callbacks to neighbour tables.
  90  */
  91
  92 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  93 {
  94         kfree_skb(skb);
  95         return -ENETDOWN;
  96 }
  97
  98 static void neigh_cleanup_and_release(struct neighbour *neigh)
  99 {
 100         if (neigh->parms->neigh_cleanup)
 101                 neigh->parms->neigh_cleanup(neigh);
 102
 103         __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 104         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 105         neigh_release(neigh);
 106 }
 107
 108 /*
 109  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 110  * It corresponds to default IPv6 settings and is not overridable,
 111  * because it is really reasonable choice.
 112  */
 113
 114 unsigned long neigh_rand_reach_time(unsigned long base)
 115 {
 116         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 117 }
 118 EXPORT_SYMBOL(neigh_rand_reach_time);
 119
 120
 121 static bool neigh_del(struct neighbour *n, __u8 state,
 122                       struct neighbour __rcu **np, struct neigh_table *tbl)
 123 {
 124         bool retval = false;
 125
 126         write_lock(&n->lock);
 127         if (refcount_read(&n->refcnt) == 1 && !(n->nud_state & state)) {
 128                 struct neighbour *neigh;
 129
 130                 neigh = rcu_dereference_protected(n->next,
 131                                                   lockdep_is_held(&tbl->lock));
 132                 rcu_assign_pointer(*np, neigh);
 133                 n->dead = 1;
 134                 retval = true;
 135         }
 136         write_unlock(&n->lock);
 137         if (retval)
 138                 neigh_cleanup_and_release(n);
 139         return retval;
 140 }
 141
 142 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 143 {
 144         struct neigh_hash_table *nht;
 145         void *pkey = ndel->primary_key;
 146         u32 hash_val;
 147         struct neighbour *n;
 148         struct neighbour __rcu **np;
 149
 150         nht = rcu_dereference_protected(tbl->nht,
 151                                         lockdep_is_held(&tbl->lock));
 152         hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
 153         hash_val = hash_val >> (32 - nht->hash_shift);
 154
 155         np = &nht->hash_buckets[hash_val];
 156         while ((n = rcu_dereference_protected(*np,
 157                                               lockdep_is_held(&tbl->lock)))) {
 158                 if (n == ndel)
 159                         return neigh_del(n, 0, np, tbl);
 160                 np = &n->next;
 161         }
 162         return false;
 163 }
 164
 165 static int neigh_forced_gc(struct neigh_table *tbl)
 166 {
 167         int shrunk = 0;
 168         int i;
 169         struct neigh_hash_table *nht;
 170
 171         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 172
 173         write_lock_bh(&tbl->lock);
 174         nht = rcu_dereference_protected(tbl->nht,
 175                                         lockdep_is_held(&tbl->lock));
 176         for (i = 0; i < (1 << nht->hash_shift); i++) {
 177                 struct neighbour *n;
 178                 struct neighbour __rcu **np;
 179
 180                 np = &nht->hash_buckets[i];
 181                 while ((n = rcu_dereference_protected(*np,
 182                                         lockdep_is_held(&tbl->lock))) != NULL) {
 183                         /* Neighbour record may be discarded if:
 184                          * - nobody refers to it.
 185                          * - it is not permanent
 186                          */
 187                         if (neigh_del(n, NUD_PERMANENT, np, tbl)) {
 188                                 shrunk = 1;
 189                                 continue;
 190                         }
 191                         np = &n->next;
 192                 }
 193         }
 194
 195         tbl->last_flush = jiffies;
 196
 197         write_unlock_bh(&tbl->lock);
 198
 199         return shrunk;
 200 }
 201
 202 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 203 {
 204         neigh_hold(n);
 205         if (unlikely(mod_timer(&n->timer, when))) {
 206                 printk("NEIGH: BUG, double timer add, state is %x\n",
 207                        n->nud_state);
 208                 dump_stack();
 209         }
 210 }
 211
 212 static int neigh_del_timer(struct neighbour *n)
 213 {
 214         if ((n->nud_state & NUD_IN_TIMER) &&
 215             del_timer(&n->timer)) {
 216                 neigh_release(n);
 217                 return 1;
 218         }
 219         return 0;
 220 }
 221
 222 static void pneigh_queue_purge(struct sk_buff_head *list)
 223 {
 224         struct sk_buff *skb;
 225
 226         while ((skb = skb_dequeue(list)) != NULL) {
 227                 dev_put(skb->dev);
 228                 kfree_skb(skb);
 229         }
 230 }
 231
 232 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 233 {
 234         int i;
 235         struct neigh_hash_table *nht;
 236
 237         nht = rcu_dereference_protected(tbl->nht,
 238                                         lockdep_is_held(&tbl->lock));
 239
 240         for (i = 0; i < (1 << nht->hash_shift); i++) {
 241                 struct neighbour *n;
 242                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 243
 244                 while ((n = rcu_dereference_protected(*np,
 245                                         lockdep_is_held(&tbl->lock))) != NULL) {
 246                         if (dev && n->dev != dev) {
 247                                 np = &n->next;
 248                                 continue;
 249                         }
 250                         rcu_assign_pointer(*np,
 251                                    rcu_dereference_protected(n->next,
 252                                                 lockdep_is_held(&tbl->lock)));
 253                         write_lock(&n->lock);
 254                         neigh_del_timer(n);
 255                         n->dead = 1;
 256
 257                         if (refcount_read(&n->refcnt) != 1) {
 258                                 /* The most unpleasant situation.
 259                                    We must destroy neighbour entry,
 260                                    but someone still uses it.
 261
 262                                    The destroy will be delayed until
 263                                    the last user releases us, but
 264                                    we must kill timers etc. and move
 265                                    it to safe state.
 266                                  */
 267                                 __skb_queue_purge(&n->arp_queue);
 268                                 n->arp_queue_len_bytes = 0;
 269                                 n->output = neigh_blackhole;
 270                                 if (n->nud_state & NUD_VALID)
 271                                         n->nud_state = NUD_NOARP;
 272                                 else
 273                                         n->nud_state = NUD_NONE;
 274                                 neigh_dbg(2, "neigh %p is stray\n", n);
 275                         }
 276                         write_unlock(&n->lock);
 277                         neigh_cleanup_and_release(n);
 278                 }
 279         }
 280 }
 281
 282 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 283 {
 284         write_lock_bh(&tbl->lock);
 285         neigh_flush_dev(tbl, dev);
 286         write_unlock_bh(&tbl->lock);
 287 }
 288 EXPORT_SYMBOL(neigh_changeaddr);
 289
 290 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 291 {
 292         write_lock_bh(&tbl->lock);
 293         neigh_flush_dev(tbl, dev);
 294         pneigh_ifdown(tbl, dev);
 295         write_unlock_bh(&tbl->lock);
 296
 297         del_timer_sync(&tbl->proxy_timer);
 298         pneigh_queue_purge(&tbl->proxy_queue);
 299         return 0;
 300 }
 301 EXPORT_SYMBOL(neigh_ifdown);
 302
 303 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 304 {
 305         struct neighbour *n = NULL;
 306         unsigned long now = jiffies;
 307         int entries;
 308
 309         entries = atomic_inc_return(&tbl->entries) - 1;
 310         if (entries >= tbl->gc_thresh3 ||
 311             (entries >= tbl->gc_thresh2 &&
 312              time_after(now, tbl->last_flush + 5 * HZ))) {
 313                 if (!neigh_forced_gc(tbl) &&
 314                     entries >= tbl->gc_thresh3) {
 315                         net_info_ratelimited("%s: neighbor table overflow!\n",
 316                                              tbl->id);
 317                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 318                         goto out_entries;
 319                 }
 320         }
 321
 322         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 323         if (!n)
 324                 goto out_entries;
 325
 326         __skb_queue_head_init(&n->arp_queue);
 327         rwlock_init(&n->lock);
 328         seqlock_init(&n->ha_lock);
 329         n->updated        = n->used = now;
 330         n->nud_state      = NUD_NONE;
 331         n->output         = neigh_blackhole;
 332         seqlock_init(&n->hh.hh_lock);
 333         n->parms          = neigh_parms_clone(&tbl->parms);
 334         setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 335
 336         NEIGH_CACHE_STAT_INC(tbl, allocs);
 337         n->tbl            = tbl;
 338         refcount_set(&n->refcnt, 1);
 339         n->dead           = 1;
 340 out:
 341         return n;
 342
 343 out_entries:
 344         atomic_dec(&tbl->entries);
 345         goto out;
 346 }
 347
 348 static void neigh_get_hash_rnd(u32 *x)
 349 {
 350         get_random_bytes(x, sizeof(*x));
 351         *x |= 1;
 352 }
 353
 354 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 355 {
 356         size_t size = (1 << shift) * sizeof(struct neighbour *);
 357         struct neigh_hash_table *ret;
 358         struct neighbour __rcu **buckets;
 359         int i;
 360
 361         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 362         if (!ret)
 363                 return NULL;
 364         if (size <= PAGE_SIZE)
 365                 buckets = kzalloc(size, GFP_ATOMIC);
 366         else
 367                 buckets = (struct neighbour __rcu **)
 368                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 369                                            get_order(size));
 370         if (!buckets) {
 371                 kfree(ret);
 372                 return NULL;
 373         }
 374         ret->hash_buckets = buckets;
 375         ret->hash_shift = shift;
 376         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 377                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 378         return ret;
 379 }
 380
 381 static void neigh_hash_free_rcu(struct rcu_head *head)
 382 {
 383         struct neigh_hash_table *nht = container_of(head,
 384                                                     struct neigh_hash_table,
 385                                                     rcu);
 386         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 387         struct neighbour __rcu **buckets = nht->hash_buckets;
 388
 389         if (size <= PAGE_SIZE)
 390                 kfree(buckets);
 391         else
 392                 free_pages((unsigned long)buckets, get_order(size));
 393         kfree(nht);
 394 }
 395
 396 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 397                                                 unsigned long new_shift)
 398 {
 399         unsigned int i, hash;
 400         struct neigh_hash_table *new_nht, *old_nht;
 401
 402         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 403
 404         old_nht = rcu_dereference_protected(tbl->nht,
 405                                             lockdep_is_held(&tbl->lock));
 406         new_nht = neigh_hash_alloc(new_shift);
 407         if (!new_nht)
 408                 return old_nht;
 409
 410         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 411                 struct neighbour *n, *next;
 412
 413                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 414                                                    lockdep_is_held(&tbl->lock));
 415                      n != NULL;
 416                      n = next) {
 417                         hash = tbl->hash(n->primary_key, n->dev,
 418                                          new_nht->hash_rnd);
 419
 420                         hash >>= (32 - new_nht->hash_shift);
 421                         next = rcu_dereference_protected(n->next,
 422                                                 lockdep_is_held(&tbl->lock));
 423
 424                         rcu_assign_pointer(n->next,
 425                                            rcu_dereference_protected(
 426                                                 new_nht->hash_buckets[hash],
 427                                                 lockdep_is_held(&tbl->lock)));
 428                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 429                 }
 430         }
 431
 432         rcu_assign_pointer(tbl->nht, new_nht);
 433         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 434         return new_nht;
 435 }
 436
 437 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 438                                struct net_device *dev)
 439 {
 440         struct neighbour *n;
 441
 442         NEIGH_CACHE_STAT_INC(tbl, lookups);
 443
 444         rcu_read_lock_bh();
 445         n = __neigh_lookup_noref(tbl, pkey, dev);
 446         if (n) {
 447                 if (!refcount_inc_not_zero(&n->refcnt))
 448                         n = NULL;
 449                 NEIGH_CACHE_STAT_INC(tbl, hits);
 450         }
 451
 452         rcu_read_unlock_bh();
 453         return n;
 454 }
 455 EXPORT_SYMBOL(neigh_lookup);
 456
 457 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 458                                      const void *pkey)
 459 {
 460         struct neighbour *n;
 461         int key_len = tbl->key_len;
 462         u32 hash_val;
 463         struct neigh_hash_table *nht;
 464
 465         NEIGH_CACHE_STAT_INC(tbl, lookups);
 466
 467         rcu_read_lock_bh();
 468         nht = rcu_dereference_bh(tbl->nht);
 469         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 470
 471         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 472              n != NULL;
 473              n = rcu_dereference_bh(n->next)) {
 474                 if (!memcmp(n->primary_key, pkey, key_len) &&
 475                     net_eq(dev_net(n->dev), net)) {
 476                         if (!refcount_inc_not_zero(&n->refcnt))
 477                                 n = NULL;
 478                         NEIGH_CACHE_STAT_INC(tbl, hits);
 479                         break;
 480                 }
 481         }
 482
 483         rcu_read_unlock_bh();
 484         return n;
 485 }
 486 EXPORT_SYMBOL(neigh_lookup_nodev);
 487
 488 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 489                                  struct net_device *dev, bool want_ref)
 490 {
 491         u32 hash_val;
 492         int key_len = tbl->key_len;
 493         int error;
 494         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 495         struct neigh_hash_table *nht;
 496
 497         if (!n) {
 498                 rc = ERR_PTR(-ENOBUFS);
 499                 goto out;
 500         }
 501
 502         memcpy(n->primary_key, pkey, key_len);
 503         n->dev = dev;
 504         dev_hold(dev);
 505
 506         /* Protocol specific setup. */
 507         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 508                 rc = ERR_PTR(error);
 509                 goto out_neigh_release;
 510         }
 511
 512         if (dev->netdev_ops->ndo_neigh_construct) {
 513                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 514                 if (error < 0) {
 515                         rc = ERR_PTR(error);
 516                         goto out_neigh_release;
 517                 }
 518         }
 519
 520         /* Device specific setup. */
 521         if (n->parms->neigh_setup &&
 522             (error = n->parms->neigh_setup(n)) < 0) {
 523                 rc = ERR_PTR(error);
 524                 goto out_neigh_release;
 525         }
 526
 527         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 528
 529         write_lock_bh(&tbl->lock);
 530         nht = rcu_dereference_protected(tbl->nht,
 531                                         lockdep_is_held(&tbl->lock));
 532
 533         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 534                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 535
 536         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 537
 538         if (n->parms->dead) {
 539                 rc = ERR_PTR(-EINVAL);
 540                 goto out_tbl_unlock;
 541         }
 542
 543         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 544                                             lockdep_is_held(&tbl->lock));
 545              n1 != NULL;
 546              n1 = rcu_dereference_protected(n1->next,
 547                         lockdep_is_held(&tbl->lock))) {
 548                 if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 549                         if (want_ref)
 550                                 neigh_hold(n1);
 551                         rc = n1;
 552                         goto out_tbl_unlock;
 553                 }
 554         }
 555
 556         n->dead = 0;
 557         if (want_ref)
 558                 neigh_hold(n);
 559         rcu_assign_pointer(n->next,
 560                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 561                                                      lockdep_is_held(&tbl->lock)));
 562         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 563         write_unlock_bh(&tbl->lock);
 564         neigh_dbg(2, "neigh %p is created\n", n);
 565         rc = n;
 566 out:
 567         return rc;
 568 out_tbl_unlock:
 569         write_unlock_bh(&tbl->lock);
 570 out_neigh_release:
 571         neigh_release(n);
 572         goto out;
 573 }
 574 EXPORT_SYMBOL(__neigh_create);
 575
 576 static u32 pneigh_hash(const void *pkey, int key_len)
 577 {
 578         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 579         hash_val ^= (hash_val >> 16);
 580         hash_val ^= hash_val >> 8;
 581         hash_val ^= hash_val >> 4;
 582         hash_val &= PNEIGH_HASHMASK;
 583         return hash_val;
 584 }
 585
 586 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 587                                               struct net *net,
 588                                               const void *pkey,
 589                                               int key_len,
 590                                               struct net_device *dev)
 591 {
 592         while (n) {
 593                 if (!memcmp(n->key, pkey, key_len) &&
 594                     net_eq(pneigh_net(n), net) &&
 595                     (n->dev == dev || !n->dev))
 596                         return n;
 597                 n = n->next;
 598         }
 599         return NULL;
 600 }
 601
 602 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 603                 struct net *net, const void *pkey, struct net_device *dev)
 604 {
 605         int key_len = tbl->key_len;
 606         u32 hash_val = pneigh_hash(pkey, key_len);
 607
 608         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 609                                  net, pkey, key_len, dev);
 610 }
 611 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 612
 613 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 614                                     struct net *net, const void *pkey,
 615                                     struct net_device *dev, int creat)
 616 {
 617         struct pneigh_entry *n;
 618         int key_len = tbl->key_len;
 619         u32 hash_val = pneigh_hash(pkey, key_len);
 620
 621         read_lock_bh(&tbl->lock);
 622         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 623                               net, pkey, key_len, dev);
 624         read_unlock_bh(&tbl->lock);
 625
 626         if (n || !creat)
 627                 goto out;
 628
 629         ASSERT_RTNL();
 630
 631         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 632         if (!n)
 633                 goto out;
 634
 635         write_pnet(&n->net, net);
 636         memcpy(n->key, pkey, key_len);
 637         n->dev = dev;
 638         if (dev)
 639                 dev_hold(dev);
 640
 641         if (tbl->pconstructor && tbl->pconstructor(n)) {
 642                 if (dev)
 643                         dev_put(dev);
 644                 kfree(n);
 645                 n = NULL;
 646                 goto out;
 647         }
 648
 649         write_lock_bh(&tbl->lock);
 650         n->next = tbl->phash_buckets[hash_val];
 651         tbl->phash_buckets[hash_val] = n;
 652         write_unlock_bh(&tbl->lock);
 653 out:
 654         return n;
 655 }
 656 EXPORT_SYMBOL(pneigh_lookup);
 657
 658
 659 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 660                   struct net_device *dev)
 661 {
 662         struct pneigh_entry *n, **np;
 663         int key_len = tbl->key_len;
 664         u32 hash_val = pneigh_hash(pkey, key_len);
 665
 666         write_lock_bh(&tbl->lock);
 667         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 668              np = &n->next) {
 669                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 670                     net_eq(pneigh_net(n), net)) {
 671                         *np = n->next;
 672                         write_unlock_bh(&tbl->lock);
 673                         if (tbl->pdestructor)
 674                                 tbl->pdestructor(n);
 675                         if (n->dev)
 676                                 dev_put(n->dev);
 677                         kfree(n);
 678                         return 0;
 679                 }
 680         }
 681         write_unlock_bh(&tbl->lock);
 682         return -ENOENT;
 683 }
 684
 685 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 686 {
 687         struct pneigh_entry *n, **np;
 688         u32 h;
 689
 690         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 691                 np = &tbl->phash_buckets[h];
 692                 while ((n = *np) != NULL) {
 693                         if (!dev || n->dev == dev) {
 694                                 *np = n->next;
 695                                 if (tbl->pdestructor)
 696                                         tbl->pdestructor(n);
 697                                 if (n->dev)
 698                                         dev_put(n->dev);
 699                                 kfree(n);
 700                                 continue;
 701                         }
 702                         np = &n->next;
 703                 }
 704         }
 705         return -ENOENT;
 706 }
 707
 708 static void neigh_parms_destroy(struct neigh_parms *parms);
 709
 710 static inline void neigh_parms_put(struct neigh_parms *parms)
 711 {
 712         if (refcount_dec_and_test(&parms->refcnt))
 713                 neigh_parms_destroy(parms);
 714 }
 715
 716 /*
 717  *      neighbour must already be out of the table;
 718  *
 719  */
 720 void neigh_destroy(struct neighbour *neigh)
 721 {
 722         struct net_device *dev = neigh->dev;
 723
 724         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 725
 726         if (!neigh->dead) {
 727                 pr_warn("Destroying alive neighbour %p\n", neigh);
 728                 dump_stack();
 729                 return;
 730         }
 731
 732         if (neigh_del_timer(neigh))
 733                 pr_warn("Impossible event\n");
 734
 735         write_lock_bh(&neigh->lock);
 736         __skb_queue_purge(&neigh->arp_queue);
 737         write_unlock_bh(&neigh->lock);
 738         neigh->arp_queue_len_bytes = 0;
 739
 740         if (dev->netdev_ops->ndo_neigh_destroy)
 741                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 742
 743         dev_put(dev);
 744         neigh_parms_put(neigh->parms);
 745
 746         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 747
 748         atomic_dec(&neigh->tbl->entries);
 749         kfree_rcu(neigh, rcu);
 750 }
 751 EXPORT_SYMBOL(neigh_destroy);
 752
 753 /* Neighbour state is suspicious;
 754    disable fast path.
 755
 756    Called with write_locked neigh.
 757  */
 758 static void neigh_suspect(struct neighbour *neigh)
 759 {
 760         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 761
 762         neigh->output = neigh->ops->output;
 763 }
 764
 765 /* Neighbour state is OK;
 766    enable fast path.
 767
 768    Called with write_locked neigh.
 769  */
 770 static void neigh_connect(struct neighbour *neigh)
 771 {
 772         neigh_dbg(2, "neigh %p is connected\n", neigh);
 773
 774         neigh->output = neigh->ops->connected_output;
 775 }
 776
 777 static void neigh_periodic_work(struct work_struct *work)
 778 {
 779         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 780         struct neighbour *n;
 781         struct neighbour __rcu **np;
 782         unsigned int i;
 783         struct neigh_hash_table *nht;
 784
 785         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 786
 787         write_lock_bh(&tbl->lock);
 788         nht = rcu_dereference_protected(tbl->nht,
 789                                         lockdep_is_held(&tbl->lock));
 790
 791         /*
 792          *      periodically recompute ReachableTime from random function
 793          */
 794
 795         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 796                 struct neigh_parms *p;
 797                 tbl->last_rand = jiffies;
 798                 list_for_each_entry(p, &tbl->parms_list, list)
 799                         p->reachable_time =
 800                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 801         }
 802
 803         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 804                 goto out;
 805
 806         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 807                 np = &nht->hash_buckets[i];
 808
 809                 while ((n = rcu_dereference_protected(*np,
 810                                 lockdep_is_held(&tbl->lock))) != NULL) {
 811                         unsigned int state;
 812
 813                         write_lock(&n->lock);
 814
 815                         state = n->nud_state;
 816                         if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 817                                 write_unlock(&n->lock);
 818                                 goto next_elt;
 819                         }
 820
 821                         if (time_before(n->used, n->confirmed))
 822                                 n->used = n->confirmed;
 823
 824                         if (refcount_read(&n->refcnt) == 1 &&
 825                             (state == NUD_FAILED ||
 826                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 827                                 *np = n->next;
 828                                 n->dead = 1;
 829                                 write_unlock(&n->lock);
 830                                 neigh_cleanup_and_release(n);
 831                                 continue;
 832                         }
 833                         write_unlock(&n->lock);
 834
 835 next_elt:
 836                         np = &n->next;
 837                 }
 838                 /*
 839                  * It's fine to release lock here, even if hash table
 840                  * grows while we are preempted.
 841                  */
 842                 write_unlock_bh(&tbl->lock);
 843                 cond_resched();
 844                 write_lock_bh(&tbl->lock);
 845                 nht = rcu_dereference_protected(tbl->nht,
 846                                                 lockdep_is_held(&tbl->lock));
 847         }
 848 out:
 849         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 850          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 851          * BASE_REACHABLE_TIME.
 852          */
 853         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 854                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 855         write_unlock_bh(&tbl->lock);
 856 }
 857
 858 static __inline__ int neigh_max_probes(struct neighbour *n)
 859 {
 860         struct neigh_parms *p = n->parms;
 861         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 862                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 863                 NEIGH_VAR(p, MCAST_PROBES));
 864 }
 865
 866 static void neigh_invalidate(struct neighbour *neigh)
 867         __releases(neigh->lock)
 868         __acquires(neigh->lock)
 869 {
 870         struct sk_buff *skb;
 871
 872         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 873         neigh_dbg(2, "neigh %p is failed\n", neigh);
 874         neigh->updated = jiffies;
 875
 876         /* It is very thin place. report_unreachable is very complicated
 877            routine. Particularly, it can hit the same neighbour entry!
 878
 879            So that, we try to be accurate and avoid dead loop. --ANK
 880          */
 881         while (neigh->nud_state == NUD_FAILED &&
 882                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 883                 write_unlock(&neigh->lock);
 884                 neigh->ops->error_report(neigh, skb);
 885                 write_lock(&neigh->lock);
 886         }
 887         __skb_queue_purge(&neigh->arp_queue);
 888         neigh->arp_queue_len_bytes = 0;
 889 }
 890
 891 static void neigh_probe(struct neighbour *neigh)
 892         __releases(neigh->lock)
 893 {
 894         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 895         /* keep skb alive even if arp_queue overflows */
 896         if (skb)
 897                 skb = skb_clone(skb, GFP_ATOMIC);
 898         write_unlock(&neigh->lock);
 899         if (neigh->ops->solicit)
 900                 neigh->ops->solicit(neigh, skb);
 901         atomic_inc(&neigh->probes);
 902         kfree_skb(skb);
 903 }
 904
 905 /* Called when a timer expires for a neighbour entry. */
 906
 907 static void neigh_timer_handler(unsigned long arg)
 908 {
 909         unsigned long now, next;
 910         struct neighbour *neigh = (struct neighbour *)arg;
 911         unsigned int state;
 912         int notify = 0;
 913
 914         write_lock(&neigh->lock);
 915
 916         state = neigh->nud_state;
 917         now = jiffies;
 918         next = now + HZ;
 919
 920         if (!(state & NUD_IN_TIMER))
 921                 goto out;
 922
 923         if (state & NUD_REACHABLE) {
 924                 if (time_before_eq(now,
 925                                    neigh->confirmed + neigh->parms->reachable_time)) {
 926                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
 927                         next = neigh->confirmed + neigh->parms->reachable_time;
 928                 } else if (time_before_eq(now,
 929                                           neigh->used +
 930                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 931                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
 932                         neigh->nud_state = NUD_DELAY;
 933                         neigh->updated = jiffies;
 934                         neigh_suspect(neigh);
 935                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 936                 } else {
 937                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 938                         neigh->nud_state = NUD_STALE;
 939                         neigh->updated = jiffies;
 940                         neigh_suspect(neigh);
 941                         notify = 1;
 942                 }
 943         } else if (state & NUD_DELAY) {
 944                 if (time_before_eq(now,
 945                                    neigh->confirmed +
 946                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 947                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 948                         neigh->nud_state = NUD_REACHABLE;
 949                         neigh->updated = jiffies;
 950                         neigh_connect(neigh);
 951                         notify = 1;
 952                         next = neigh->confirmed + neigh->parms->reachable_time;
 953                 } else {
 954                         neigh_dbg(2, "neigh %p is probed\n", neigh);
 955                         neigh->nud_state = NUD_PROBE;
 956                         neigh->updated = jiffies;
 957                         atomic_set(&neigh->probes, 0);
 958                         notify = 1;
 959                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 960                 }
 961         } else {
 962                 /* NUD_PROBE|NUD_INCOMPLETE */
 963                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 964         }
 965
 966         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 967             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 968                 neigh->nud_state = NUD_FAILED;
 969                 notify = 1;
 970                 neigh_invalidate(neigh);
 971                 goto out;
 972         }
 973
 974         if (neigh->nud_state & NUD_IN_TIMER) {
 975                 if (time_before(next, jiffies + HZ/2))
 976                         next = jiffies + HZ/2;
 977                 if (!mod_timer(&neigh->timer, next))
 978                         neigh_hold(neigh);
 979         }
 980         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 981                 neigh_probe(neigh);
 982         } else {
 983 out:
 984                 write_unlock(&neigh->lock);
 985         }
 986
 987         if (notify)
 988                 neigh_update_notify(neigh, 0);
 989
 990         neigh_release(neigh);
 991 }
 992
 993 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 994 {
 995         int rc;
 996         bool immediate_probe = false;
 997
 998         write_lock_bh(&neigh->lock);
 999
1000         rc = 0;
1001         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1002                 goto out_unlock_bh;
1003         if (neigh->dead)
1004                 goto out_dead;
1005
1006         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1007                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1008                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
1009                         unsigned long next, now = jiffies;
1010
1011                         atomic_set(&neigh->probes,
1012                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
1013                         neigh->nud_state     = NUD_INCOMPLETE;
1014                         neigh->updated = now;
1015                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1016                                          HZ/2);
1017                         neigh_add_timer(neigh, next);
1018                         immediate_probe = true;
1019                 } else {
1020                         neigh->nud_state = NUD_FAILED;
1021                         neigh->updated = jiffies;
1022                         write_unlock_bh(&neigh->lock);
1023
1024                         kfree_skb(skb);
1025                         return 1;
1026                 }
1027         } else if (neigh->nud_state & NUD_STALE) {
1028                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1029                 neigh->nud_state = NUD_DELAY;
1030                 neigh->updated = jiffies;
1031                 neigh_add_timer(neigh, jiffies +
1032                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1033         }
1034
1035         if (neigh->nud_state == NUD_INCOMPLETE) {
1036                 if (skb) {
1037                         while (neigh->arp_queue_len_bytes + skb->truesize >
1038                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1039                                 struct sk_buff *buff;
1040
1041                                 buff = __skb_dequeue(&neigh->arp_queue);
1042                                 if (!buff)
1043                                         break;
1044                                 neigh->arp_queue_len_bytes -= buff->truesize;
1045                                 kfree_skb(buff);
1046                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1047                         }
1048                         skb_dst_force(skb);
1049                         __skb_queue_tail(&neigh->arp_queue, skb);
1050                         neigh->arp_queue_len_bytes += skb->truesize;
1051                 }
1052                 rc = 1;
1053         }
1054 out_unlock_bh:
1055         if (immediate_probe)
1056                 neigh_probe(neigh);
1057         else
1058                 write_unlock(&neigh->lock);
1059         local_bh_enable();
1060         return rc;
1061
1062 out_dead:
1063         if (neigh->nud_state & NUD_STALE)
1064                 goto out_unlock_bh;
1065         write_unlock_bh(&neigh->lock);
1066         kfree_skb(skb);
1067         return 1;
1068 }
1069 EXPORT_SYMBOL(__neigh_event_send);
1070
1071 static void neigh_update_hhs(struct neighbour *neigh)
1072 {
1073         struct hh_cache *hh;
1074         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1075                 = NULL;
1076
1077         if (neigh->dev->header_ops)
1078                 update = neigh->dev->header_ops->cache_update;
1079
1080         if (update) {
1081                 hh = &neigh->hh;
1082                 if (hh->hh_len) {
1083                         write_seqlock_bh(&hh->hh_lock);
1084                         update(hh, neigh->dev, neigh->ha);
1085                         write_sequnlock_bh(&hh->hh_lock);
1086                 }
1087         }
1088 }
1089
1090
1091
1092 /* Generic update routine.
1093    -- lladdr is new lladdr or NULL, if it is not supplied.
1094    -- new    is new state.
1095    -- flags
1096         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1097                                 if it is different.
1098         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1099                                 lladdr instead of overriding it
1100                                 if it is different.
1101         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1102
1103         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1104                                 NTF_ROUTER flag.
1105         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1106                                 a router.
1107
1108    Caller MUST hold reference count on the entry.
1109  */
1110
1111 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1112                  u32 flags, u32 nlmsg_pid)
1113 {
1114         u8 old;
1115         int err;
1116         int notify = 0;
1117         struct net_device *dev;
1118         int update_isrouter = 0;
1119
1120         write_lock_bh(&neigh->lock);
1121
1122         dev    = neigh->dev;
1123         old    = neigh->nud_state;
1124         err    = -EPERM;
1125
1126         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1127             (old & (NUD_NOARP | NUD_PERMANENT)))
1128                 goto out;
1129         if (neigh->dead)
1130                 goto out;
1131
1132         if (!(new & NUD_VALID)) {
1133                 neigh_del_timer(neigh);
1134                 if (old & NUD_CONNECTED)
1135                         neigh_suspect(neigh);
1136                 neigh->nud_state = new;
1137                 err = 0;
1138                 notify = old & NUD_VALID;
1139                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1140                     (new & NUD_FAILED)) {
1141                         neigh_invalidate(neigh);
1142                         notify = 1;
1143                 }
1144                 goto out;
1145         }
1146
1147         /* Compare new lladdr with cached one */
1148         if (!dev->addr_len) {
1149                 /* First case: device needs no address. */
1150                 lladdr = neigh->ha;
1151         } else if (lladdr) {
1152                 /* The second case: if something is already cached
1153                    and a new address is proposed:
1154                    - compare new & old
1155                    - if they are different, check override flag
1156                  */
1157                 if ((old & NUD_VALID) &&
1158                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1159                         lladdr = neigh->ha;
1160         } else {
1161                 /* No address is supplied; if we know something,
1162                    use it, otherwise discard the request.
1163                  */
1164                 err = -EINVAL;
1165                 if (!(old & NUD_VALID))
1166                         goto out;
1167                 lladdr = neigh->ha;
1168         }
1169
1170         /* If entry was valid and address is not changed,
1171            do not change entry state, if new one is STALE.
1172          */
1173         err = 0;
1174         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1175         if (old & NUD_VALID) {
1176                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1177                         update_isrouter = 0;
1178                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1179                             (old & NUD_CONNECTED)) {
1180                                 lladdr = neigh->ha;
1181                                 new = NUD_STALE;
1182                         } else
1183                                 goto out;
1184                 } else {
1185                         if (lladdr == neigh->ha && new == NUD_STALE &&
1186                             !(flags & NEIGH_UPDATE_F_ADMIN))
1187                                 new = old;
1188                 }
1189         }
1190
1191         /* Update timestamps only once we know we will make a change to the
1192          * neighbour entry. Otherwise we risk to move the locktime window with
1193          * noop updates and ignore relevant ARP updates.
1194          */
1195         if (new != old || lladdr != neigh->ha) {
1196                 if (new & NUD_CONNECTED)
1197                         neigh->confirmed = jiffies;
1198                 neigh->updated = jiffies;
1199         }
1200
1201         if (new != old) {
1202                 neigh_del_timer(neigh);
1203                 if (new & NUD_PROBE)
1204                         atomic_set(&neigh->probes, 0);
1205                 if (new & NUD_IN_TIMER)
1206                         neigh_add_timer(neigh, (jiffies +
1207                                                 ((new & NUD_REACHABLE) ?
1208                                                  neigh->parms->reachable_time :
1209                                                  0)));
1210                 neigh->nud_state = new;
1211                 notify = 1;
1212         }
1213
1214         if (lladdr != neigh->ha) {
1215                 write_seqlock(&neigh->ha_lock);
1216                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1217                 write_sequnlock(&neigh->ha_lock);
1218                 neigh_update_hhs(neigh);
1219                 if (!(new & NUD_CONNECTED))
1220                         neigh->confirmed = jiffies -
1221                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1222                 notify = 1;
1223         }
1224         if (new == old)
1225                 goto out;
1226         if (new & NUD_CONNECTED)
1227                 neigh_connect(neigh);
1228         else
1229                 neigh_suspect(neigh);
1230         if (!(old & NUD_VALID)) {
1231                 struct sk_buff *skb;
1232
1233                 /* Again: avoid dead loop if something went wrong */
1234
1235                 while (neigh->nud_state & NUD_VALID &&
1236                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1237                         struct dst_entry *dst = skb_dst(skb);
1238                         struct neighbour *n2, *n1 = neigh;
1239                         write_unlock_bh(&neigh->lock);
1240
1241                         rcu_read_lock();
1242
1243                         /* Why not just use 'neigh' as-is?  The problem is that
1244                          * things such as shaper, eql, and sch_teql can end up
1245                          * using alternative, different, neigh objects to output
1246                          * the packet in the output path.  So what we need to do
1247                          * here is re-lookup the top-level neigh in the path so
1248                          * we can reinject the packet there.
1249                          */
1250                         n2 = NULL;
1251                         if (dst) {
1252                                 n2 = dst_neigh_lookup_skb(dst, skb);
1253                                 if (n2)
1254                                         n1 = n2;
1255                         }
1256                         n1->output(n1, skb);
1257                         if (n2)
1258                                 neigh_release(n2);
1259                         rcu_read_unlock();
1260
1261                         write_lock_bh(&neigh->lock);
1262                 }
1263                 __skb_queue_purge(&neigh->arp_queue);
1264                 neigh->arp_queue_len_bytes = 0;
1265         }
1266 out:
1267         if (update_isrouter) {
1268                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1269                         (neigh->flags | NTF_ROUTER) :
1270                         (neigh->flags & ~NTF_ROUTER);
1271         }
1272         write_unlock_bh(&neigh->lock);
1273
1274         if (notify)
1275                 neigh_update_notify(neigh, nlmsg_pid);
1276
1277         return err;
1278 }
1279 EXPORT_SYMBOL(neigh_update);
1280
1281 /* Update the neigh to listen temporarily for probe responses, even if it is
1282  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1283  */
1284 void __neigh_set_probe_once(struct neighbour *neigh)
1285 {
1286         if (neigh->dead)
1287                 return;
1288         neigh->updated = jiffies;
1289         if (!(neigh->nud_state & NUD_FAILED))
1290                 return;
1291         neigh->nud_state = NUD_INCOMPLETE;
1292         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1293         neigh_add_timer(neigh,
1294                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1295 }
1296 EXPORT_SYMBOL(__neigh_set_probe_once);
1297
1298 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1299                                  u8 *lladdr, void *saddr,
1300                                  struct net_device *dev)
1301 {
1302         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1303                                                  lladdr || !dev->addr_len);
1304         if (neigh)
1305                 neigh_update(neigh, lladdr, NUD_STALE,
1306                              NEIGH_UPDATE_F_OVERRIDE, 0);
1307         return neigh;
1308 }
1309 EXPORT_SYMBOL(neigh_event_ns);
1310
1311 /* called with read_lock_bh(&n->lock); */
1312 static void neigh_hh_init(struct neighbour *n)
1313 {
1314         struct net_device *dev = n->dev;
1315         __be16 prot = n->tbl->protocol;
1316         struct hh_cache *hh = &n->hh;
1317
1318         write_lock_bh(&n->lock);
1319
1320         /* Only one thread can come in here and initialize the
1321          * hh_cache entry.
1322          */
1323         if (!hh->hh_len)
1324                 dev->header_ops->cache(n, hh, prot);
1325
1326         write_unlock_bh(&n->lock);
1327 }
1328
1329 /* Slow and careful. */
1330
1331 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1332 {
1333         int rc = 0;
1334
1335         if (!neigh_event_send(neigh, skb)) {
1336                 int err;
1337                 struct net_device *dev = neigh->dev;
1338                 unsigned int seq;
1339
1340                 if (dev->header_ops->cache && !neigh->hh.hh_len)
1341                         neigh_hh_init(neigh);
1342
1343                 do {
1344                         __skb_pull(skb, skb_network_offset(skb));
1345                         seq = read_seqbegin(&neigh->ha_lock);
1346                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1347                                               neigh->ha, NULL, skb->len);
1348                 } while (read_seqretry(&neigh->ha_lock, seq));
1349
1350                 if (err >= 0)
1351                         rc = dev_queue_xmit(skb);
1352                 else
1353                         goto out_kfree_skb;
1354         }
1355 out:
1356         return rc;
1357 out_kfree_skb:
1358         rc = -EINVAL;
1359         kfree_skb(skb);
1360         goto out;
1361 }
1362 EXPORT_SYMBOL(neigh_resolve_output);
1363
1364 /* As fast as possible without hh cache */
1365
1366 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1367 {
1368         struct net_device *dev = neigh->dev;
1369         unsigned int seq;
1370         int err;
1371
1372         do {
1373                 __skb_pull(skb, skb_network_offset(skb));
1374                 seq = read_seqbegin(&neigh->ha_lock);
1375                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1376                                       neigh->ha, NULL, skb->len);
1377         } while (read_seqretry(&neigh->ha_lock, seq));
1378
1379         if (err >= 0)
1380                 err = dev_queue_xmit(skb);
1381         else {
1382                 err = -EINVAL;
1383                 kfree_skb(skb);
1384         }
1385         return err;
1386 }
1387 EXPORT_SYMBOL(neigh_connected_output);
1388
1389 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1390 {
1391         return dev_queue_xmit(skb);
1392 }
1393 EXPORT_SYMBOL(neigh_direct_output);
1394
1395 static void neigh_proxy_process(unsigned long arg)
1396 {
1397         struct neigh_table *tbl = (struct neigh_table *)arg;
1398         long sched_next = 0;
1399         unsigned long now = jiffies;
1400         struct sk_buff *skb, *n;
1401
1402         spin_lock(&tbl->proxy_queue.lock);
1403
1404         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1405                 long tdif = NEIGH_CB(skb)->sched_next - now;
1406
1407                 if (tdif <= 0) {
1408                         struct net_device *dev = skb->dev;
1409
1410                         __skb_unlink(skb, &tbl->proxy_queue);
1411                         if (tbl->proxy_redo && netif_running(dev)) {
1412                                 rcu_read_lock();
1413                                 tbl->proxy_redo(skb);
1414                                 rcu_read_unlock();
1415                         } else {
1416                                 kfree_skb(skb);
1417                         }
1418
1419                         dev_put(dev);
1420                 } else if (!sched_next || tdif < sched_next)
1421                         sched_next = tdif;
1422         }
1423         del_timer(&tbl->proxy_timer);
1424         if (sched_next)
1425                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1426         spin_unlock(&tbl->proxy_queue.lock);
1427 }
1428
1429 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1430                     struct sk_buff *skb)
1431 {
1432         unsigned long now = jiffies;
1433
1434         unsigned long sched_next = now + (prandom_u32() %
1435                                           NEIGH_VAR(p, PROXY_DELAY));
1436
1437         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1438                 kfree_skb(skb);
1439                 return;
1440         }
1441
1442         NEIGH_CB(skb)->sched_next = sched_next;
1443         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1444
1445         spin_lock(&tbl->proxy_queue.lock);
1446         if (del_timer(&tbl->proxy_timer)) {
1447                 if (time_before(tbl->proxy_timer.expires, sched_next))
1448                         sched_next = tbl->proxy_timer.expires;
1449         }
1450         skb_dst_drop(skb);
1451         dev_hold(skb->dev);
1452         __skb_queue_tail(&tbl->proxy_queue, skb);
1453         mod_timer(&tbl->proxy_timer, sched_next);
1454         spin_unlock(&tbl->proxy_queue.lock);
1455 }
1456 EXPORT_SYMBOL(pneigh_enqueue);
1457
1458 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1459                                                       struct net *net, int ifindex)
1460 {
1461         struct neigh_parms *p;
1462
1463         list_for_each_entry(p, &tbl->parms_list, list) {
1464                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1465                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1466                         return p;
1467         }
1468
1469         return NULL;
1470 }
1471
1472 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1473                                       struct neigh_table *tbl)
1474 {
1475         struct neigh_parms *p;
1476         struct net *net = dev_net(dev);
1477         const struct net_device_ops *ops = dev->netdev_ops;
1478
1479         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1480         if (p) {
1481                 p->tbl            = tbl;
1482                 refcount_set(&p->refcnt, 1);
1483                 p->reachable_time =
1484                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1485                 dev_hold(dev);
1486                 p->dev = dev;
1487                 write_pnet(&p->net, net);
1488                 p->sysctl_table = NULL;
1489
1490                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1491                         dev_put(dev);
1492                         kfree(p);
1493                         return NULL;
1494                 }
1495
1496                 write_lock_bh(&tbl->lock);
1497                 list_add(&p->list, &tbl->parms.list);
1498                 write_unlock_bh(&tbl->lock);
1499
1500                 neigh_parms_data_state_cleanall(p);
1501         }
1502         return p;
1503 }
1504 EXPORT_SYMBOL(neigh_parms_alloc);
1505
1506 static void neigh_rcu_free_parms(struct rcu_head *head)
1507 {
1508         struct neigh_parms *parms =
1509                 container_of(head, struct neigh_parms, rcu_head);
1510
1511         neigh_parms_put(parms);
1512 }
1513
1514 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1515 {
1516         if (!parms || parms == &tbl->parms)
1517                 return;
1518         write_lock_bh(&tbl->lock);
1519         list_del(&parms->list);
1520         parms->dead = 1;
1521         write_unlock_bh(&tbl->lock);
1522         if (parms->dev)
1523                 dev_put(parms->dev);
1524         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1525 }
1526 EXPORT_SYMBOL(neigh_parms_release);
1527
1528 static void neigh_parms_destroy(struct neigh_parms *parms)
1529 {
1530         kfree(parms);
1531 }
1532
1533 static struct lock_class_key neigh_table_proxy_queue_class;
1534
1535 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1536
1537 void neigh_table_init(int index, struct neigh_table *tbl)
1538 {
1539         unsigned long now = jiffies;
1540         unsigned long phsize;
1541
1542         INIT_LIST_HEAD(&tbl->parms_list);
1543         list_add(&tbl->parms.list, &tbl->parms_list);
1544         write_pnet(&tbl->parms.net, &init_net);
1545         refcount_set(&tbl->parms.refcnt, 1);
1546         tbl->parms.reachable_time =
1547                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1548
1549         tbl->stats = alloc_percpu(struct neigh_statistics);
1550         if (!tbl->stats)
1551                 panic("cannot create neighbour cache statistics");
1552
1553 #ifdef CONFIG_PROC_FS
1554         if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1555                               &neigh_stat_seq_fops, tbl))
1556                 panic("cannot create neighbour proc dir entry");
1557 #endif
1558
1559         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1560
1561         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1562         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1563
1564         if (!tbl->nht || !tbl->phash_buckets)
1565                 panic("cannot allocate neighbour cache hashes");
1566
1567         if (!tbl->entry_size)
1568                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1569                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1570         else
1571                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1572
1573         rwlock_init(&tbl->lock);
1574         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1575         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1576                         tbl->parms.reachable_time);
1577         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1578         skb_queue_head_init_class(&tbl->proxy_queue,
1579                         &neigh_table_proxy_queue_class);
1580
1581         tbl->last_flush = now;
1582         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1583
1584         neigh_tables[index] = tbl;
1585 }
1586 EXPORT_SYMBOL(neigh_table_init);
1587
1588 int neigh_table_clear(int index, struct neigh_table *tbl)
1589 {
1590         neigh_tables[index] = NULL;
1591         /* It is not clean... Fix it to unload IPv6 module safely */
1592         cancel_delayed_work_sync(&tbl->gc_work);
1593         del_timer_sync(&tbl->proxy_timer);
1594         pneigh_queue_purge(&tbl->proxy_queue);
1595         neigh_ifdown(tbl, NULL);
1596         if (atomic_read(&tbl->entries))
1597                 pr_crit("neighbour leakage\n");
1598
1599         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1600                  neigh_hash_free_rcu);
1601         tbl->nht = NULL;
1602
1603         kfree(tbl->phash_buckets);
1604         tbl->phash_buckets = NULL;
1605
1606         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1607
1608         free_percpu(tbl->stats);
1609         tbl->stats = NULL;
1610
1611         return 0;
1612 }
1613 EXPORT_SYMBOL(neigh_table_clear);
1614
1615 static struct neigh_table *neigh_find_table(int family)
1616 {
1617         struct neigh_table *tbl = NULL;
1618
1619         switch (family) {
1620         case AF_INET:
1621                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1622                 break;
1623         case AF_INET6:
1624                 tbl = neigh_tables[NEIGH_ND_TABLE];
1625                 break;
1626         case AF_DECnet:
1627                 tbl = neigh_tables[NEIGH_DN_TABLE];
1628                 break;
1629         }
1630
1631         return tbl;
1632 }
1633
1634 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1635                         struct netlink_ext_ack *extack)
1636 {
1637         struct net *net = sock_net(skb->sk);
1638         struct ndmsg *ndm;
1639         struct nlattr *dst_attr;
1640         struct neigh_table *tbl;
1641         struct neighbour *neigh;
1642         struct net_device *dev = NULL;
1643         int err = -EINVAL;
1644
1645         ASSERT_RTNL();
1646         if (nlmsg_len(nlh) < sizeof(*ndm))
1647                 goto out;
1648
1649         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1650         if (dst_attr == NULL)
1651                 goto out;
1652
1653         ndm = nlmsg_data(nlh);
1654         if (ndm->ndm_ifindex) {
1655                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1656                 if (dev == NULL) {
1657                         err = -ENODEV;
1658                         goto out;
1659                 }
1660         }
1661
1662         tbl = neigh_find_table(ndm->ndm_family);
1663         if (tbl == NULL)
1664                 return -EAFNOSUPPORT;
1665
1666         if (nla_len(dst_attr) < tbl->key_len)
1667                 goto out;
1668
1669         if (ndm->ndm_flags & NTF_PROXY) {
1670                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1671                 goto out;
1672         }
1673
1674         if (dev == NULL)
1675                 goto out;
1676
1677         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1678         if (neigh == NULL) {
1679                 err = -ENOENT;
1680                 goto out;
1681         }
1682
1683         err = neigh_update(neigh, NULL, NUD_FAILED,
1684                            NEIGH_UPDATE_F_OVERRIDE |
1685                            NEIGH_UPDATE_F_ADMIN,
1686                            NETLINK_CB(skb).portid);
1687         write_lock_bh(&tbl->lock);
1688         neigh_release(neigh);
1689         neigh_remove_one(neigh, tbl);
1690         write_unlock_bh(&tbl->lock);
1691
1692 out:
1693         return err;
1694 }
1695
1696 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1697                      struct netlink_ext_ack *extack)
1698 {
1699         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1700         struct net *net = sock_net(skb->sk);
1701         struct ndmsg *ndm;
1702         struct nlattr *tb[NDA_MAX+1];
1703         struct neigh_table *tbl;
1704         struct net_device *dev = NULL;
1705         struct neighbour *neigh;
1706         void *dst, *lladdr;
1707         int err;
1708
1709         ASSERT_RTNL();
1710         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL, extack);
1711         if (err < 0)
1712                 goto out;
1713
1714         err = -EINVAL;
1715         if (tb[NDA_DST] == NULL)
1716                 goto out;
1717
1718         ndm = nlmsg_data(nlh);
1719         if (ndm->ndm_ifindex) {
1720                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1721                 if (dev == NULL) {
1722                         err = -ENODEV;
1723                         goto out;
1724                 }
1725
1726                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1727                         goto out;
1728         }
1729
1730         tbl = neigh_find_table(ndm->ndm_family);
1731         if (tbl == NULL)
1732                 return -EAFNOSUPPORT;
1733
1734         if (nla_len(tb[NDA_DST]) < tbl->key_len)
1735                 goto out;
1736         dst = nla_data(tb[NDA_DST]);
1737         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1738
1739         if (ndm->ndm_flags & NTF_PROXY) {
1740                 struct pneigh_entry *pn;
1741
1742                 err = -ENOBUFS;
1743                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1744                 if (pn) {
1745                         pn->flags = ndm->ndm_flags;
1746                         err = 0;
1747                 }
1748                 goto out;
1749         }
1750
1751         if (dev == NULL)
1752                 goto out;
1753
1754         neigh = neigh_lookup(tbl, dst, dev);
1755         if (neigh == NULL) {
1756                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1757                         err = -ENOENT;
1758                         goto out;
1759                 }
1760
1761                 neigh = __neigh_lookup_errno(tbl, dst, dev);
1762                 if (IS_ERR(neigh)) {
1763                         err = PTR_ERR(neigh);
1764                         goto out;
1765                 }
1766         } else {
1767                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1768                         err = -EEXIST;
1769                         neigh_release(neigh);
1770                         goto out;
1771                 }
1772
1773                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1774                         flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1775         }
1776
1777         if (ndm->ndm_flags & NTF_USE) {
1778                 neigh_event_send(neigh, NULL);
1779                 err = 0;
1780         } else
1781                 err = neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1782                                    NETLINK_CB(skb).portid);
1783         neigh_release(neigh);
1784
1785 out:
1786         return err;
1787 }
1788
1789 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1790 {
1791         struct nlattr *nest;
1792
1793         nest = nla_nest_start(skb, NDTA_PARMS);
1794         if (nest == NULL)
1795                 return -ENOBUFS;
1796
1797         if ((parms->dev &&
1798              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1799             nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
1800             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1801                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1802             /* approximative value for deprecated QUEUE_LEN (in packets) */
1803             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1804                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1805             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1806             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1807             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1808                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1809             nla_put_u32(skb, NDTPA_MCAST_PROBES,
1810                         NEIGH_VAR(parms, MCAST_PROBES)) ||
1811             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1812                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
1813             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
1814                           NDTPA_PAD) ||
1815             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1816                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
1817             nla_put_msecs(skb, NDTPA_GC_STALETIME,
1818                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
1819             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1820                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
1821             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1822                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
1823             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1824                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
1825             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1826                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
1827             nla_put_msecs(skb, NDTPA_LOCKTIME,
1828                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
1829                 goto nla_put_failure;
1830         return nla_nest_end(skb, nest);
1831
1832 nla_put_failure:
1833         nla_nest_cancel(skb, nest);
1834         return -EMSGSIZE;
1835 }
1836
1837 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1838                               u32 pid, u32 seq, int type, int flags)
1839 {
1840         struct nlmsghdr *nlh;
1841         struct ndtmsg *ndtmsg;
1842
1843         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1844         if (nlh == NULL)
1845                 return -EMSGSIZE;
1846
1847         ndtmsg = nlmsg_data(nlh);
1848
1849         read_lock_bh(&tbl->lock);
1850         ndtmsg->ndtm_family = tbl->family;
1851         ndtmsg->ndtm_pad1   = 0;
1852         ndtmsg->ndtm_pad2   = 0;
1853
1854         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1855             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
1856             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1857             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1858             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1859                 goto nla_put_failure;
1860         {
1861                 unsigned long now = jiffies;
1862                 unsigned int flush_delta = now - tbl->last_flush;
1863                 unsigned int rand_delta = now - tbl->last_rand;
1864                 struct neigh_hash_table *nht;
1865                 struct ndt_config ndc = {
1866                         .ndtc_key_len           = tbl->key_len,
1867                         .ndtc_entry_size        = tbl->entry_size,
1868                         .ndtc_entries           = atomic_read(&tbl->entries),
1869                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1870                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1871                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1872                 };
1873
1874                 rcu_read_lock_bh();
1875                 nht = rcu_dereference_bh(tbl->nht);
1876                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1877                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1878                 rcu_read_unlock_bh();
1879
1880                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1881                         goto nla_put_failure;
1882         }
1883
1884         {
1885                 int cpu;
1886                 struct ndt_stats ndst;
1887
1888                 memset(&ndst, 0, sizeof(ndst));
1889
1890                 for_each_possible_cpu(cpu) {
1891                         struct neigh_statistics *st;
1892
1893                         st = per_cpu_ptr(tbl->stats, cpu);
1894                         ndst.ndts_allocs                += st->allocs;
1895                         ndst.ndts_destroys              += st->destroys;
1896                         ndst.ndts_hash_grows            += st->hash_grows;
1897                         ndst.ndts_res_failed            += st->res_failed;
1898                         ndst.ndts_lookups               += st->lookups;
1899                         ndst.ndts_hits                  += st->hits;
1900                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1901                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1902                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1903                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1904                         ndst.ndts_table_fulls           += st->table_fulls;
1905                 }
1906
1907                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
1908                                   NDTA_PAD))
1909                         goto nla_put_failure;
1910         }
1911
1912         BUG_ON(tbl->parms.dev);
1913         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1914                 goto nla_put_failure;
1915
1916         read_unlock_bh(&tbl->lock);
1917         nlmsg_end(skb, nlh);
1918         return 0;
1919
1920 nla_put_failure:
1921         read_unlock_bh(&tbl->lock);
1922         nlmsg_cancel(skb, nlh);
1923         return -EMSGSIZE;
1924 }
1925
1926 static int neightbl_fill_param_info(struct sk_buff *skb,
1927                                     struct neigh_table *tbl,
1928                                     struct neigh_parms *parms,
1929                                     u32 pid, u32 seq, int type,
1930                                     unsigned int flags)
1931 {
1932         struct ndtmsg *ndtmsg;
1933         struct nlmsghdr *nlh;
1934
1935         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1936         if (nlh == NULL)
1937                 return -EMSGSIZE;
1938
1939         ndtmsg = nlmsg_data(nlh);
1940
1941         read_lock_bh(&tbl->lock);
1942         ndtmsg->ndtm_family = tbl->family;
1943         ndtmsg->ndtm_pad1   = 0;
1944         ndtmsg->ndtm_pad2   = 0;
1945
1946         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1947             neightbl_fill_parms(skb, parms) < 0)
1948                 goto errout;
1949
1950         read_unlock_bh(&tbl->lock);
1951         nlmsg_end(skb, nlh);
1952         return 0;
1953 errout:
1954         read_unlock_bh(&tbl->lock);
1955         nlmsg_cancel(skb, nlh);
1956         return -EMSGSIZE;
1957 }
1958
1959 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1960         [NDTA_NAME]             = { .type = NLA_STRING },
1961         [NDTA_THRESH1]          = { .type = NLA_U32 },
1962         [NDTA_THRESH2]          = { .type = NLA_U32 },
1963         [NDTA_THRESH3]          = { .type = NLA_U32 },
1964         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1965         [NDTA_PARMS]            = { .type = NLA_NESTED },
1966 };
1967
1968 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1969         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1970         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1971         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1972         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1973         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1974         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1975         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
1976         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1977         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1978         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1979         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1980         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1981         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1982         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1983 };
1984
1985 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
1986                         struct netlink_ext_ack *extack)
1987 {
1988         struct net *net = sock_net(skb->sk);
1989         struct neigh_table *tbl;
1990         struct ndtmsg *ndtmsg;
1991         struct nlattr *tb[NDTA_MAX+1];
1992         bool found = false;
1993         int err, tidx;
1994
1995         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1996                           nl_neightbl_policy, extack);
1997         if (err < 0)
1998                 goto errout;
1999
2000         if (tb[NDTA_NAME] == NULL) {
2001                 err = -EINVAL;
2002                 goto errout;
2003         }
2004
2005         ndtmsg = nlmsg_data(nlh);
2006
2007         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2008                 tbl = neigh_tables[tidx];
2009                 if (!tbl)
2010                         continue;
2011                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2012                         continue;
2013                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2014                         found = true;
2015                         break;
2016                 }
2017         }
2018
2019         if (!found)
2020                 return -ENOENT;
2021
2022         /*
2023          * We acquire tbl->lock to be nice to the periodic timers and
2024          * make sure they always see a consistent set of values.
2025          */
2026         write_lock_bh(&tbl->lock);
2027
2028         if (tb[NDTA_PARMS]) {
2029                 struct nlattr *tbp[NDTPA_MAX+1];
2030                 struct neigh_parms *p;
2031                 int i, ifindex = 0;
2032
2033                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
2034                                        nl_ntbl_parm_policy, extack);
2035                 if (err < 0)
2036                         goto errout_tbl_lock;
2037
2038                 if (tbp[NDTPA_IFINDEX])
2039                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2040
2041                 p = lookup_neigh_parms(tbl, net, ifindex);
2042                 if (p == NULL) {
2043                         err = -ENOENT;
2044                         goto errout_tbl_lock;
2045                 }
2046
2047                 for (i = 1; i <= NDTPA_MAX; i++) {
2048                         if (tbp[i] == NULL)
2049                                 continue;
2050
2051                         switch (i) {
2052                         case NDTPA_QUEUE_LEN:
2053                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2054                                               nla_get_u32(tbp[i]) *
2055                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2056                                 break;
2057                         case NDTPA_QUEUE_LENBYTES:
2058                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2059                                               nla_get_u32(tbp[i]));
2060                                 break;
2061                         case NDTPA_PROXY_QLEN:
2062                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2063                                               nla_get_u32(tbp[i]));
2064                                 break;
2065                         case NDTPA_APP_PROBES:
2066                                 NEIGH_VAR_SET(p, APP_PROBES,
2067                                               nla_get_u32(tbp[i]));
2068                                 break;
2069                         case NDTPA_UCAST_PROBES:
2070                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2071                                               nla_get_u32(tbp[i]));
2072                                 break;
2073                         case NDTPA_MCAST_PROBES:
2074                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2075                                               nla_get_u32(tbp[i]));
2076                                 break;
2077                         case NDTPA_MCAST_REPROBES:
2078                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2079                                               nla_get_u32(tbp[i]));
2080                                 break;
2081                         case NDTPA_BASE_REACHABLE_TIME:
2082                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2083                                               nla_get_msecs(tbp[i]));
2084                                 /* update reachable_time as well, otherwise, the change will
2085                                  * only be effective after the next time neigh_periodic_work
2086                                  * decides to recompute it (can be multiple minutes)
2087                                  */
2088                                 p->reachable_time =
2089                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2090                                 break;
2091                         case NDTPA_GC_STALETIME:
2092                                 NEIGH_VAR_SET(p, GC_STALETIME,
2093                                               nla_get_msecs(tbp[i]));
2094                                 break;
2095                         case NDTPA_DELAY_PROBE_TIME:
2096                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2097                                               nla_get_msecs(tbp[i]));
2098                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2099                                 break;
2100                         case NDTPA_RETRANS_TIME:
2101                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2102                                               nla_get_msecs(tbp[i]));
2103                                 break;
2104                         case NDTPA_ANYCAST_DELAY:
2105                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2106                                               nla_get_msecs(tbp[i]));
2107                                 break;
2108                         case NDTPA_PROXY_DELAY:
2109                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2110                                               nla_get_msecs(tbp[i]));
2111                                 break;
2112                         case NDTPA_LOCKTIME:
2113                                 NEIGH_VAR_SET(p, LOCKTIME,
2114                                               nla_get_msecs(tbp[i]));
2115                                 break;
2116                         }
2117                 }
2118         }
2119
2120         err = -ENOENT;
2121         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2122              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2123             !net_eq(net, &init_net))
2124                 goto errout_tbl_lock;
2125
2126         if (tb[NDTA_THRESH1])
2127                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2128
2129         if (tb[NDTA_THRESH2])
2130                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2131
2132         if (tb[NDTA_THRESH3])
2133                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2134
2135         if (tb[NDTA_GC_INTERVAL])
2136                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2137
2138         err = 0;
2139
2140 errout_tbl_lock:
2141         write_unlock_bh(&tbl->lock);
2142 errout:
2143         return err;
2144 }
2145
2146 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2147 {
2148         struct net *net = sock_net(skb->sk);
2149         int family, tidx, nidx = 0;
2150         int tbl_skip = cb->args[0];
2151         int neigh_skip = cb->args[1];
2152         struct neigh_table *tbl;
2153
2154         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2155
2156         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2157                 struct neigh_parms *p;
2158
2159                 tbl = neigh_tables[tidx];
2160                 if (!tbl)
2161                         continue;
2162
2163                 if (tidx < tbl_skip || (family && tbl->family != family))
2164                         continue;
2165
2166                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2167                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2168                                        NLM_F_MULTI) < 0)
2169                         break;
2170
2171                 nidx = 0;
2172                 p = list_next_entry(&tbl->parms, list);
2173                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2174                         if (!net_eq(neigh_parms_net(p), net))
2175                                 continue;
2176
2177                         if (nidx < neigh_skip)
2178                                 goto next;
2179
2180                         if (neightbl_fill_param_info(skb, tbl, p,
2181                                                      NETLINK_CB(cb->skb).portid,
2182                                                      cb->nlh->nlmsg_seq,
2183                                                      RTM_NEWNEIGHTBL,
2184                                                      NLM_F_MULTI) < 0)
2185                                 goto out;
2186                 next:
2187                         nidx++;
2188                 }
2189
2190                 neigh_skip = 0;
2191         }
2192 out:
2193         cb->args[0] = tidx;
2194         cb->args[1] = nidx;
2195
2196         return skb->len;
2197 }
2198
2199 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2200                            u32 pid, u32 seq, int type, unsigned int flags)
2201 {
2202         unsigned long now = jiffies;
2203         struct nda_cacheinfo ci;
2204         struct nlmsghdr *nlh;
2205         struct ndmsg *ndm;
2206
2207         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2208         if (nlh == NULL)
2209                 return -EMSGSIZE;
2210
2211         ndm = nlmsg_data(nlh);
2212         ndm->ndm_family  = neigh->ops->family;
2213         ndm->ndm_pad1    = 0;
2214         ndm->ndm_pad2    = 0;
2215         ndm->ndm_flags   = neigh->flags;
2216         ndm->ndm_type    = neigh->type;
2217         ndm->ndm_ifindex = neigh->dev->ifindex;
2218
2219         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2220                 goto nla_put_failure;
2221
2222         read_lock_bh(&neigh->lock);
2223         ndm->ndm_state   = neigh->nud_state;
2224         if (neigh->nud_state & NUD_VALID) {
2225                 char haddr[MAX_ADDR_LEN];
2226
2227                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2228                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2229                         read_unlock_bh(&neigh->lock);
2230                         goto nla_put_failure;
2231                 }
2232         }
2233
2234         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2235         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2236         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2237         ci.ndm_refcnt    = refcount_read(&neigh->refcnt) - 1;
2238         read_unlock_bh(&neigh->lock);
2239
2240         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2241             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2242                 goto nla_put_failure;
2243
2244         nlmsg_end(skb, nlh);
2245         return 0;
2246
2247 nla_put_failure:
2248         nlmsg_cancel(skb, nlh);
2249         return -EMSGSIZE;
2250 }
2251
2252 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2253                             u32 pid, u32 seq, int type, unsigned int flags,
2254                             struct neigh_table *tbl)
2255 {
2256         struct nlmsghdr *nlh;
2257         struct ndmsg *ndm;
2258
2259         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2260         if (nlh == NULL)
2261                 return -EMSGSIZE;
2262
2263         ndm = nlmsg_data(nlh);
2264         ndm->ndm_family  = tbl->family;
2265         ndm->ndm_pad1    = 0;
2266         ndm->ndm_pad2    = 0;
2267         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2268         ndm->ndm_type    = RTN_UNICAST;
2269         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2270         ndm->ndm_state   = NUD_NONE;
2271
2272         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2273                 goto nla_put_failure;
2274
2275         nlmsg_end(skb, nlh);
2276         return 0;
2277
2278 nla_put_failure:
2279         nlmsg_cancel(skb, nlh);
2280         return -EMSGSIZE;
2281 }
2282
2283 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2284 {
2285         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2286         __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2287 }
2288
2289 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2290 {
2291         struct net_device *master;
2292
2293         if (!master_idx)
2294                 return false;
2295
2296         master = netdev_master_upper_dev_get(dev);
2297         if (!master || master->ifindex != master_idx)
2298                 return true;
2299
2300         return false;
2301 }
2302
2303 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2304 {
2305         if (filter_idx && dev->ifindex != filter_idx)
2306                 return true;
2307
2308         return false;
2309 }
2310
2311 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2312                             struct netlink_callback *cb)
2313 {
2314         struct net *net = sock_net(skb->sk);
2315         const struct nlmsghdr *nlh = cb->nlh;
2316         struct nlattr *tb[NDA_MAX + 1];
2317         struct neighbour *n;
2318         int rc, h, s_h = cb->args[1];
2319         int idx, s_idx = idx = cb->args[2];
2320         struct neigh_hash_table *nht;
2321         int filter_master_idx = 0, filter_idx = 0;
2322         unsigned int flags = NLM_F_MULTI;
2323         int err;
2324
2325         err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL);
2326         if (!err) {
2327                 if (tb[NDA_IFINDEX])
2328                         filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
2329
2330                 if (tb[NDA_MASTER])
2331                         filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
2332
2333                 if (filter_idx || filter_master_idx)
2334                         flags |= NLM_F_DUMP_FILTERED;
2335         }
2336
2337         rcu_read_lock_bh();
2338         nht = rcu_dereference_bh(tbl->nht);
2339
2340         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2341                 if (h > s_h)
2342                         s_idx = 0;
2343                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2344                      n != NULL;
2345                      n = rcu_dereference_bh(n->next)) {
2346                         if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2347                                 goto next;
2348                         if (neigh_ifindex_filtered(n->dev, filter_idx) ||
2349                             neigh_master_filtered(n->dev, filter_master_idx))
2350                                 goto next;
2351                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2352                                             cb->nlh->nlmsg_seq,
2353                                             RTM_NEWNEIGH,
2354                                             flags) < 0) {
2355                                 rc = -1;
2356                                 goto out;
2357                         }
2358 next:
2359                         idx++;
2360                 }
2361         }
2362         rc = skb->len;
2363 out:
2364         rcu_read_unlock_bh();
2365         cb->args[1] = h;
2366         cb->args[2] = idx;
2367         return rc;
2368 }
2369
2370 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2371                              struct netlink_callback *cb)
2372 {
2373         struct pneigh_entry *n;
2374         struct net *net = sock_net(skb->sk);
2375         int rc, h, s_h = cb->args[3];
2376         int idx, s_idx = idx = cb->args[4];
2377
2378         read_lock_bh(&tbl->lock);
2379
2380         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2381                 if (h > s_h)
2382                         s_idx = 0;
2383                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2384                         if (idx < s_idx || pneigh_net(n) != net)
2385                                 goto next;
2386                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2387                                             cb->nlh->nlmsg_seq,
2388                                             RTM_NEWNEIGH,
2389                                             NLM_F_MULTI, tbl) < 0) {
2390                                 read_unlock_bh(&tbl->lock);
2391                                 rc = -1;
2392                                 goto out;
2393                         }
2394                 next:
2395                         idx++;
2396                 }
2397         }
2398
2399         read_unlock_bh(&tbl->lock);
2400         rc = skb->len;
2401 out:
2402         cb->args[3] = h;
2403         cb->args[4] = idx;
2404         return rc;
2405
2406 }
2407
2408 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2409 {
2410         struct neigh_table *tbl;
2411         int t, family, s_t;
2412         int proxy = 0;
2413         int err;
2414
2415         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2416
2417         /* check for full ndmsg structure presence, family member is
2418          * the same for both structures
2419          */
2420         if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2421             ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2422                 proxy = 1;
2423
2424         s_t = cb->args[0];
2425
2426         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2427                 tbl = neigh_tables[t];
2428
2429                 if (!tbl)
2430                         continue;
2431                 if (t < s_t || (family && tbl->family != family))
2432                         continue;
2433                 if (t > s_t)
2434                         memset(&cb->args[1], 0, sizeof(cb->args) -
2435                                                 sizeof(cb->args[0]));
2436                 if (proxy)
2437                         err = pneigh_dump_table(tbl, skb, cb);
2438                 else
2439                         err = neigh_dump_table(tbl, skb, cb);
2440                 if (err < 0)
2441                         break;
2442         }
2443
2444         cb->args[0] = t;
2445         return skb->len;
2446 }
2447
2448 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2449 {
2450         int chain;
2451         struct neigh_hash_table *nht;
2452
2453         rcu_read_lock_bh();
2454         nht = rcu_dereference_bh(tbl->nht);
2455
2456         read_lock(&tbl->lock); /* avoid resizes */
2457         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2458                 struct neighbour *n;
2459
2460                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2461                      n != NULL;
2462                      n = rcu_dereference_bh(n->next))
2463                         cb(n, cookie);
2464         }
2465         read_unlock(&tbl->lock);
2466         rcu_read_unlock_bh();
2467 }
2468 EXPORT_SYMBOL(neigh_for_each);
2469
2470 /* The tbl->lock must be held as a writer and BH disabled. */
2471 void __neigh_for_each_release(struct neigh_table *tbl,
2472                               int (*cb)(struct neighbour *))
2473 {
2474         int chain;
2475         struct neigh_hash_table *nht;
2476
2477         nht = rcu_dereference_protected(tbl->nht,
2478                                         lockdep_is_held(&tbl->lock));
2479         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2480                 struct neighbour *n;
2481                 struct neighbour __rcu **np;
2482
2483                 np = &nht->hash_buckets[chain];
2484                 while ((n = rcu_dereference_protected(*np,
2485                                         lockdep_is_held(&tbl->lock))) != NULL) {
2486                         int release;
2487
2488                         write_lock(&n->lock);
2489                         release = cb(n);
2490                         if (release) {
2491                                 rcu_assign_pointer(*np,
2492                                         rcu_dereference_protected(n->next,
2493                                                 lockdep_is_held(&tbl->lock)));
2494                                 n->dead = 1;
2495                         } else
2496                                 np = &n->next;
2497                         write_unlock(&n->lock);
2498                         if (release)
2499                                 neigh_cleanup_and_release(n);
2500                 }
2501         }
2502 }
2503 EXPORT_SYMBOL(__neigh_for_each_release);
2504
2505 int neigh_xmit(int index, struct net_device *dev,
2506                const void *addr, struct sk_buff *skb)
2507 {
2508         int err = -EAFNOSUPPORT;
2509         if (likely(index < NEIGH_NR_TABLES)) {
2510                 struct neigh_table *tbl;
2511                 struct neighbour *neigh;
2512
2513                 tbl = neigh_tables[index];
2514                 if (!tbl)
2515                         goto out;
2516                 rcu_read_lock_bh();
2517                 neigh = __neigh_lookup_noref(tbl, addr, dev);
2518                 if (!neigh)
2519                         neigh = __neigh_create(tbl, addr, dev, false);
2520                 err = PTR_ERR(neigh);
2521                 if (IS_ERR(neigh)) {
2522                         rcu_read_unlock_bh();
2523                         goto out_kfree_skb;
2524                 }
2525                 err = neigh->output(neigh, skb);
2526                 rcu_read_unlock_bh();
2527         }
2528         else if (index == NEIGH_LINK_TABLE) {
2529                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2530                                       addr, NULL, skb->len);
2531                 if (err < 0)
2532                         goto out_kfree_skb;
2533                 err = dev_queue_xmit(skb);
2534         }
2535 out:
2536         return err;
2537 out_kfree_skb:
2538         kfree_skb(skb);
2539         goto out;
2540 }
2541 EXPORT_SYMBOL(neigh_xmit);
2542
2543 #ifdef CONFIG_PROC_FS
2544
2545 static struct neighbour *neigh_get_first(struct seq_file *seq)
2546 {
2547         struct neigh_seq_state *state = seq->private;
2548         struct net *net = seq_file_net(seq);
2549         struct neigh_hash_table *nht = state->nht;
2550         struct neighbour *n = NULL;
2551         int bucket = state->bucket;
2552
2553         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2554         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2555                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2556
2557                 while (n) {
2558                         if (!net_eq(dev_net(n->dev), net))
2559                                 goto next;
2560                         if (state->neigh_sub_iter) {
2561                                 loff_t fakep = 0;
2562                                 void *v;
2563
2564                                 v = state->neigh_sub_iter(state, n, &fakep);
2565                                 if (!v)
2566                                         goto next;
2567                         }
2568                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2569                                 break;
2570                         if (n->nud_state & ~NUD_NOARP)
2571                                 break;
2572 next:
2573                         n = rcu_dereference_bh(n->next);
2574                 }
2575
2576                 if (n)
2577                         break;
2578         }
2579         state->bucket = bucket;
2580
2581         return n;
2582 }
2583
2584 static struct neighbour *neigh_get_next(struct seq_file *seq,
2585                                         struct neighbour *n,
2586                                         loff_t *pos)
2587 {
2588         struct neigh_seq_state *state = seq->private;
2589         struct net *net = seq_file_net(seq);
2590         struct neigh_hash_table *nht = state->nht;
2591
2592         if (state->neigh_sub_iter) {
2593                 void *v = state->neigh_sub_iter(state, n, pos);
2594                 if (v)
2595                         return n;
2596         }
2597         n = rcu_dereference_bh(n->next);
2598
2599         while (1) {
2600                 while (n) {
2601                         if (!net_eq(dev_net(n->dev), net))
2602                                 goto next;
2603                         if (state->neigh_sub_iter) {
2604                                 void *v = state->neigh_sub_iter(state, n, pos);
2605                                 if (v)
2606                                         return n;
2607                                 goto next;
2608                         }
2609                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2610                                 break;
2611
2612                         if (n->nud_state & ~NUD_NOARP)
2613                                 break;
2614 next:
2615                         n = rcu_dereference_bh(n->next);
2616                 }
2617
2618                 if (n)
2619                         break;
2620
2621                 if (++state->bucket >= (1 << nht->hash_shift))
2622                         break;
2623
2624                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2625         }
2626
2627         if (n && pos)
2628                 --(*pos);
2629         return n;
2630 }
2631
2632 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2633 {
2634         struct neighbour *n = neigh_get_first(seq);
2635
2636         if (n) {
2637                 --(*pos);
2638                 while (*pos) {
2639                         n = neigh_get_next(seq, n, pos);
2640                         if (!n)
2641                                 break;
2642                 }
2643         }
2644         return *pos ? NULL : n;
2645 }
2646
2647 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2648 {
2649         struct neigh_seq_state *state = seq->private;
2650         struct net *net = seq_file_net(seq);
2651         struct neigh_table *tbl = state->tbl;
2652         struct pneigh_entry *pn = NULL;
2653         int bucket = state->bucket;
2654
2655         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2656         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2657                 pn = tbl->phash_buckets[bucket];
2658                 while (pn && !net_eq(pneigh_net(pn), net))
2659                         pn = pn->next;
2660                 if (pn)
2661                         break;
2662         }
2663         state->bucket = bucket;
2664
2665         return pn;
2666 }
2667
2668 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2669                                             struct pneigh_entry *pn,
2670                                             loff_t *pos)
2671 {
2672         struct neigh_seq_state *state = seq->private;
2673         struct net *net = seq_file_net(seq);
2674         struct neigh_table *tbl = state->tbl;
2675
2676         do {
2677                 pn = pn->next;
2678         } while (pn && !net_eq(pneigh_net(pn), net));
2679
2680         while (!pn) {
2681                 if (++state->bucket > PNEIGH_HASHMASK)
2682                         break;
2683                 pn = tbl->phash_buckets[state->bucket];
2684                 while (pn && !net_eq(pneigh_net(pn), net))
2685                         pn = pn->next;
2686                 if (pn)
2687                         break;
2688         }
2689
2690         if (pn && pos)
2691                 --(*pos);
2692
2693         return pn;
2694 }
2695
2696 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2697 {
2698         struct pneigh_entry *pn = pneigh_get_first(seq);
2699
2700         if (pn) {
2701                 --(*pos);
2702                 while (*pos) {
2703                         pn = pneigh_get_next(seq, pn, pos);
2704                         if (!pn)
2705                                 break;
2706                 }
2707         }
2708         return *pos ? NULL : pn;
2709 }
2710
2711 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2712 {
2713         struct neigh_seq_state *state = seq->private;
2714         void *rc;
2715         loff_t idxpos = *pos;
2716
2717         rc = neigh_get_idx(seq, &idxpos);
2718         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2719                 rc = pneigh_get_idx(seq, &idxpos);
2720
2721         return rc;
2722 }
2723
2724 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2725         __acquires(rcu_bh)
2726 {
2727         struct neigh_seq_state *state = seq->private;
2728
2729         state->tbl = tbl;
2730         state->bucket = 0;
2731         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2732
2733         rcu_read_lock_bh();
2734         state->nht = rcu_dereference_bh(tbl->nht);
2735
2736         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2737 }
2738 EXPORT_SYMBOL(neigh_seq_start);
2739
2740 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2741 {
2742         struct neigh_seq_state *state;
2743         void *rc;
2744
2745         if (v == SEQ_START_TOKEN) {
2746                 rc = neigh_get_first(seq);
2747                 goto out;
2748         }
2749
2750         state = seq->private;
2751         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2752                 rc = neigh_get_next(seq, v, NULL);
2753                 if (rc)
2754                         goto out;
2755                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2756                         rc = pneigh_get_first(seq);
2757         } else {
2758                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2759                 rc = pneigh_get_next(seq, v, NULL);
2760         }
2761 out:
2762         ++(*pos);
2763         return rc;
2764 }
2765 EXPORT_SYMBOL(neigh_seq_next);
2766
2767 void neigh_seq_stop(struct seq_file *seq, void *v)
2768         __releases(rcu_bh)
2769 {
2770         rcu_read_unlock_bh();
2771 }
2772 EXPORT_SYMBOL(neigh_seq_stop);
2773
2774 /* statistics via seq_file */
2775
2776 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2777 {
2778         struct neigh_table *tbl = seq->private;
2779         int cpu;
2780
2781         if (*pos == 0)
2782                 return SEQ_START_TOKEN;
2783
2784         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2785                 if (!cpu_possible(cpu))
2786                         continue;
2787                 *pos = cpu+1;
2788                 return per_cpu_ptr(tbl->stats, cpu);
2789         }
2790         return NULL;
2791 }
2792
2793 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2794 {
2795         struct neigh_table *tbl = seq->private;
2796         int cpu;
2797
2798         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2799                 if (!cpu_possible(cpu))
2800                         continue;
2801                 *pos = cpu+1;
2802                 return per_cpu_ptr(tbl->stats, cpu);
2803         }
2804         return NULL;
2805 }
2806
2807 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2808 {
2809
2810 }
2811
2812 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2813 {
2814         struct neigh_table *tbl = seq->private;
2815         struct neigh_statistics *st = v;
2816
2817         if (v == SEQ_START_TOKEN) {
2818                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
2819                 return 0;
2820         }
2821
2822         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2823                         "%08lx %08lx  %08lx %08lx %08lx %08lx\n",
2824                    atomic_read(&tbl->entries),
2825
2826                    st->allocs,
2827                    st->destroys,
2828                    st->hash_grows,
2829
2830                    st->lookups,
2831                    st->hits,
2832
2833                    st->res_failed,
2834
2835                    st->rcv_probes_mcast,
2836                    st->rcv_probes_ucast,
2837
2838                    st->periodic_gc_runs,
2839                    st->forced_gc_runs,
2840                    st->unres_discards,
2841                    st->table_fulls
2842                    );
2843
2844         return 0;
2845 }
2846
2847 static const struct seq_operations neigh_stat_seq_ops = {
2848         .start  = neigh_stat_seq_start,
2849         .next   = neigh_stat_seq_next,
2850         .stop   = neigh_stat_seq_stop,
2851         .show   = neigh_stat_seq_show,
2852 };
2853
2854 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2855 {
2856         int ret = seq_open(file, &neigh_stat_seq_ops);
2857
2858         if (!ret) {
2859                 struct seq_file *sf = file->private_data;
2860                 sf->private = PDE_DATA(inode);
2861         }
2862         return ret;
2863 };
2864
2865 static const struct file_operations neigh_stat_seq_fops = {
2866         .owner   = THIS_MODULE,
2867         .open    = neigh_stat_seq_open,
2868         .read    = seq_read,
2869         .llseek  = seq_lseek,
2870         .release = seq_release,
2871 };
2872
2873 #endif /* CONFIG_PROC_FS */
2874
2875 static inline size_t neigh_nlmsg_size(void)
2876 {
2877         return NLMSG_ALIGN(sizeof(struct ndmsg))
2878                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2879                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2880                + nla_total_size(sizeof(struct nda_cacheinfo))
2881                + nla_total_size(4); /* NDA_PROBES */
2882 }
2883
2884 static void __neigh_notify(struct neighbour *n, int type, int flags,
2885                            u32 pid)
2886 {
2887         struct net *net = dev_net(n->dev);
2888         struct sk_buff *skb;
2889         int err = -ENOBUFS;
2890
2891         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2892         if (skb == NULL)
2893                 goto errout;
2894
2895         err = neigh_fill_info(skb, n, pid, 0, type, flags);
2896         if (err < 0) {
2897                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2898                 WARN_ON(err == -EMSGSIZE);
2899                 kfree_skb(skb);
2900                 goto errout;
2901         }
2902         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2903         return;
2904 errout:
2905         if (err < 0)
2906                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2907 }
2908
2909 void neigh_app_ns(struct neighbour *n)
2910 {
2911         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
2912 }
2913 EXPORT_SYMBOL(neigh_app_ns);
2914
2915 #ifdef CONFIG_SYSCTL
2916 static int zero;
2917 static int int_max = INT_MAX;
2918 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2919
2920 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2921                            void __user *buffer, size_t *lenp, loff_t *ppos)
2922 {
2923         int size, ret;
2924         struct ctl_table tmp = *ctl;
2925
2926         tmp.extra1 = &zero;
2927         tmp.extra2 = &unres_qlen_max;
2928         tmp.data = &size;
2929
2930         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2931         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2932
2933         if (write && !ret)
2934                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2935         return ret;
2936 }
2937
2938 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2939                                                    int family)
2940 {
2941         switch (family) {
2942         case AF_INET:
2943                 return __in_dev_arp_parms_get_rcu(dev);
2944         case AF_INET6:
2945                 return __in6_dev_nd_parms_get_rcu(dev);
2946         }
2947         return NULL;
2948 }
2949
2950 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2951                                   int index)
2952 {
2953         struct net_device *dev;
2954         int family = neigh_parms_family(p);
2955
2956         rcu_read_lock();
2957         for_each_netdev_rcu(net, dev) {
2958                 struct neigh_parms *dst_p =
2959                                 neigh_get_dev_parms_rcu(dev, family);
2960
2961                 if (dst_p && !test_bit(index, dst_p->data_state))
2962                         dst_p->data[index] = p->data[index];
2963         }
2964         rcu_read_unlock();
2965 }
2966
2967 static void neigh_proc_update(struct ctl_table *ctl, int write)
2968 {
2969         struct net_device *dev = ctl->extra1;
2970         struct neigh_parms *p = ctl->extra2;
2971         struct net *net = neigh_parms_net(p);
2972         int index = (int *) ctl->data - p->data;
2973
2974         if (!write)
2975                 return;
2976
2977         set_bit(index, p->data_state);
2978         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
2979                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2980         if (!dev) /* NULL dev means this is default value */
2981                 neigh_copy_dflt_parms(net, p, index);
2982 }
2983
2984 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2985                                            void __user *buffer,
2986                                            size_t *lenp, loff_t *ppos)
2987 {
2988         struct ctl_table tmp = *ctl;
2989         int ret;
2990
2991         tmp.extra1 = &zero;
2992         tmp.extra2 = &int_max;
2993
2994         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2995         neigh_proc_update(ctl, write);
2996         return ret;
2997 }
2998
2999 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
3000                         void __user *buffer, size_t *lenp, loff_t *ppos)
3001 {
3002         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3003
3004         neigh_proc_update(ctl, write);
3005         return ret;
3006 }
3007 EXPORT_SYMBOL(neigh_proc_dointvec);
3008
3009 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
3010                                 void __user *buffer,
3011                                 size_t *lenp, loff_t *ppos)
3012 {
3013         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3014
3015         neigh_proc_update(ctl, write);
3016         return ret;
3017 }
3018 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3019
3020 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3021                                               void __user *buffer,
3022                                               size_t *lenp, loff_t *ppos)
3023 {
3024         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3025
3026         neigh_proc_update(ctl, write);
3027         return ret;
3028 }
3029
3030 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3031                                    void __user *buffer,
3032                                    size_t *lenp, loff_t *ppos)
3033 {
3034         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3035
3036         neigh_proc_update(ctl, write);
3037         return ret;
3038 }
3039 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3040
3041 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3042                                           void __user *buffer,
3043                                           size_t *lenp, loff_t *ppos)
3044 {
3045         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3046
3047         neigh_proc_update(ctl, write);
3048         return ret;
3049 }
3050
3051 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3052                                           void __user *buffer,
3053                                           size_t *lenp, loff_t *ppos)
3054 {
3055         struct neigh_parms *p = ctl->extra2;
3056         int ret;
3057
3058         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3059                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3060         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3061                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3062         else
3063                 ret = -1;
3064
3065         if (write && ret == 0) {
3066                 /* update reachable_time as well, otherwise, the change will
3067                  * only be effective after the next time neigh_periodic_work
3068                  * decides to recompute it
3069                  */
3070                 p->reachable_time =
3071                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3072         }
3073         return ret;
3074 }
3075
3076 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3077         (&((struct neigh_parms *) 0)->data[index])
3078
3079 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3080         [NEIGH_VAR_ ## attr] = { \
3081                 .procname       = name, \
3082                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3083                 .maxlen         = sizeof(int), \
3084                 .mode           = mval, \
3085                 .proc_handler   = proc, \
3086         }
3087
3088 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3089         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3090
3091 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3092         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3093
3094 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3095         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3096
3097 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3098         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3099
3100 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3101         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3102
3103 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3104         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3105
3106 static struct neigh_sysctl_table {
3107         struct ctl_table_header *sysctl_header;
3108         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3109 } neigh_sysctl_template __read_mostly = {
3110         .neigh_vars = {
3111                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3112                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3113                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3114                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3115                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3116                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3117                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3118                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3119                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3120                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3121                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3122                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3123                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3124                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3125                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3126                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3127                 [NEIGH_VAR_GC_INTERVAL] = {
3128                         .procname       = "gc_interval",
3129                         .maxlen         = sizeof(int),
3130                         .mode           = 0644,
3131                         .proc_handler   = proc_dointvec_jiffies,
3132                 },
3133                 [NEIGH_VAR_GC_THRESH1] = {
3134                         .procname       = "gc_thresh1",
3135                         .maxlen         = sizeof(int),
3136                         .mode           = 0644,
3137                         .extra1         = &zero,
3138                         .extra2         = &int_max,
3139                         .proc_handler   = proc_dointvec_minmax,
3140                 },
3141                 [NEIGH_VAR_GC_THRESH2] = {
3142                         .procname       = "gc_thresh2",
3143                         .maxlen         = sizeof(int),
3144                         .mode           = 0644,
3145                         .extra1         = &zero,
3146                         .extra2         = &int_max,
3147                         .proc_handler   = proc_dointvec_minmax,
3148                 },
3149                 [NEIGH_VAR_GC_THRESH3] = {
3150                         .procname       = "gc_thresh3",
3151                         .maxlen         = sizeof(int),
3152                         .mode           = 0644,
3153                         .extra1         = &zero,
3154                         .extra2         = &int_max,
3155                         .proc_handler   = proc_dointvec_minmax,
3156                 },
3157                 {},
3158         },
3159 };
3160
3161 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3162                           proc_handler *handler)
3163 {
3164         int i;
3165         struct neigh_sysctl_table *t;
3166         const char *dev_name_source;
3167         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3168         char *p_name;
3169
3170         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3171         if (!t)
3172                 goto err;
3173
3174         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3175                 t->neigh_vars[i].data += (long) p;
3176                 t->neigh_vars[i].extra1 = dev;
3177                 t->neigh_vars[i].extra2 = p;
3178         }
3179
3180         if (dev) {
3181                 dev_name_source = dev->name;
3182                 /* Terminate the table early */
3183                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3184                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3185         } else {
3186                 struct neigh_table *tbl = p->tbl;
3187                 dev_name_source = "default";
3188                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3189                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3190                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3191                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3192         }
3193
3194         if (handler) {
3195                 /* RetransTime */
3196                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3197                 /* ReachableTime */
3198                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3199                 /* RetransTime (in milliseconds)*/
3200                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3201                 /* ReachableTime (in milliseconds) */
3202                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3203         } else {
3204                 /* Those handlers will update p->reachable_time after
3205                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3206                  * applied after the next neighbour update instead of waiting for
3207                  * neigh_periodic_work to update its value (can be multiple minutes)
3208                  * So any handler that replaces them should do this as well
3209                  */
3210                 /* ReachableTime */
3211                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3212                         neigh_proc_base_reachable_time;
3213                 /* ReachableTime (in milliseconds) */
3214                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3215                         neigh_proc_base_reachable_time;
3216         }
3217
3218         /* Don't export sysctls to unprivileged users */
3219         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3220                 t->neigh_vars[0].procname = NULL;
3221
3222         switch (neigh_parms_family(p)) {
3223         case AF_INET:
3224               p_name = "ipv4";
3225               break;
3226         case AF_INET6:
3227               p_name = "ipv6";
3228               break;
3229         default:
3230               BUG();
3231         }
3232
3233         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3234                 p_name, dev_name_source);
3235         t->sysctl_header =
3236                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3237         if (!t->sysctl_header)
3238                 goto free;
3239
3240         p->sysctl_table = t;
3241         return 0;
3242
3243 free:
3244         kfree(t);
3245 err:
3246         return -ENOBUFS;
3247 }
3248 EXPORT_SYMBOL(neigh_sysctl_register);
3249
3250 void neigh_sysctl_unregister(struct neigh_parms *p)
3251 {
3252         if (p->sysctl_table) {
3253                 struct neigh_sysctl_table *t = p->sysctl_table;
3254                 p->sysctl_table = NULL;
3255                 unregister_net_sysctl_table(t->sysctl_header);
3256                 kfree(t);
3257         }
3258 }
3259 EXPORT_SYMBOL(neigh_sysctl_unregister);
3260
3261 #endif  /* CONFIG_SYSCTL */
3262
3263 static int __init neigh_init(void)
3264 {
3265         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3266         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3267         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3268
3269         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3270                       NULL);
3271         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3272
3273         return 0;
3274 }
3275
3276 subsys_initcall(neigh_init);
3277