xref: /linux/net/core/neighbour.c (revision 9410645520e9b820069761f3450ef6661418e279)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *	Generic address resolution entity
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
8  *
9  *	Fixes:
10  *	Vitaly E. Lavrov	releasing NULL neighbor in neigh_add.
11  *	Harald Welte		Add neighbour cache statistics like rtstat
12  */
13 
14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 
16 #include <linux/slab.h>
17 #include <linux/kmemleak.h>
18 #include <linux/types.h>
19 #include <linux/kernel.h>
20 #include <linux/module.h>
21 #include <linux/socket.h>
22 #include <linux/netdevice.h>
23 #include <linux/proc_fs.h>
24 #ifdef CONFIG_SYSCTL
25 #include <linux/sysctl.h>
26 #endif
27 #include <linux/times.h>
28 #include <net/net_namespace.h>
29 #include <net/neighbour.h>
30 #include <net/arp.h>
31 #include <net/dst.h>
32 #include <net/sock.h>
33 #include <net/netevent.h>
34 #include <net/netlink.h>
35 #include <linux/rtnetlink.h>
36 #include <linux/random.h>
37 #include <linux/string.h>
38 #include <linux/log2.h>
39 #include <linux/inetdevice.h>
40 #include <net/addrconf.h>
41 
42 #include <trace/events/neigh.h>
43 
44 #define NEIGH_DEBUG 1
45 #define neigh_dbg(level, fmt, ...)		\
46 do {						\
47 	if (level <= NEIGH_DEBUG)		\
48 		pr_debug(fmt, ##__VA_ARGS__);	\
49 } while (0)
50 
51 #define PNEIGH_HASHMASK		0xF
52 
53 static void neigh_timer_handler(struct timer_list *t);
54 static void __neigh_notify(struct neighbour *n, int type, int flags,
55 			   u32 pid);
56 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
57 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
58 				    struct net_device *dev);
59 
60 #ifdef CONFIG_PROC_FS
61 static const struct seq_operations neigh_stat_seq_ops;
62 #endif
63 
64 /*
65    Neighbour hash table buckets are protected with rwlock tbl->lock.
66 
67    - All the scans/updates to hash buckets MUST be made under this lock.
68    - NOTHING clever should be made under this lock: no callbacks
69      to protocol backends, no attempts to send something to network.
70      It will result in deadlocks, if backend/driver wants to use neighbour
71      cache.
72    - If the entry requires some non-trivial actions, increase
73      its reference count and release table lock.
74 
75    Neighbour entries are protected:
76    - with reference count.
77    - with rwlock neigh->lock
78 
79    Reference count prevents destruction.
80 
81    neigh->lock mainly serializes ll address data and its validity state.
82    However, the same lock is used to protect another entry fields:
83     - timer
84     - resolution queue
85 
86    Again, nothing clever shall be made under neigh->lock,
87    the most complicated procedure, which we allow is dev->hard_header.
88    It is supposed, that dev->hard_header is simplistic and does
89    not make callbacks to neighbour tables.
90  */
91 
neigh_blackhole(struct neighbour * neigh,struct sk_buff * skb)92 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
93 {
94 	kfree_skb(skb);
95 	return -ENETDOWN;
96 }
97 
neigh_cleanup_and_release(struct neighbour * neigh)98 static void neigh_cleanup_and_release(struct neighbour *neigh)
99 {
100 	trace_neigh_cleanup_and_release(neigh, 0);
101 	__neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
102 	call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
103 	neigh_release(neigh);
104 }
105 
106 /*
107  * It is random distribution in the interval (1/2)*base...(3/2)*base.
108  * It corresponds to default IPv6 settings and is not overridable,
109  * because it is really reasonable choice.
110  */
111 
neigh_rand_reach_time(unsigned long base)112 unsigned long neigh_rand_reach_time(unsigned long base)
113 {
114 	return base ? get_random_u32_below(base) + (base >> 1) : 0;
115 }
116 EXPORT_SYMBOL(neigh_rand_reach_time);
117 
neigh_mark_dead(struct neighbour * n)118 static void neigh_mark_dead(struct neighbour *n)
119 {
120 	n->dead = 1;
121 	if (!list_empty(&n->gc_list)) {
122 		list_del_init(&n->gc_list);
123 		atomic_dec(&n->tbl->gc_entries);
124 	}
125 	if (!list_empty(&n->managed_list))
126 		list_del_init(&n->managed_list);
127 }
128 
neigh_update_gc_list(struct neighbour * n)129 static void neigh_update_gc_list(struct neighbour *n)
130 {
131 	bool on_gc_list, exempt_from_gc;
132 
133 	write_lock_bh(&n->tbl->lock);
134 	write_lock(&n->lock);
135 	if (n->dead)
136 		goto out;
137 
138 	/* remove from the gc list if new state is permanent or if neighbor
139 	 * is externally learned; otherwise entry should be on the gc list
140 	 */
141 	exempt_from_gc = n->nud_state & NUD_PERMANENT ||
142 			 n->flags & NTF_EXT_LEARNED;
143 	on_gc_list = !list_empty(&n->gc_list);
144 
145 	if (exempt_from_gc && on_gc_list) {
146 		list_del_init(&n->gc_list);
147 		atomic_dec(&n->tbl->gc_entries);
148 	} else if (!exempt_from_gc && !on_gc_list) {
149 		/* add entries to the tail; cleaning removes from the front */
150 		list_add_tail(&n->gc_list, &n->tbl->gc_list);
151 		atomic_inc(&n->tbl->gc_entries);
152 	}
153 out:
154 	write_unlock(&n->lock);
155 	write_unlock_bh(&n->tbl->lock);
156 }
157 
neigh_update_managed_list(struct neighbour * n)158 static void neigh_update_managed_list(struct neighbour *n)
159 {
160 	bool on_managed_list, add_to_managed;
161 
162 	write_lock_bh(&n->tbl->lock);
163 	write_lock(&n->lock);
164 	if (n->dead)
165 		goto out;
166 
167 	add_to_managed = n->flags & NTF_MANAGED;
168 	on_managed_list = !list_empty(&n->managed_list);
169 
170 	if (!add_to_managed && on_managed_list)
171 		list_del_init(&n->managed_list);
172 	else if (add_to_managed && !on_managed_list)
173 		list_add_tail(&n->managed_list, &n->tbl->managed_list);
174 out:
175 	write_unlock(&n->lock);
176 	write_unlock_bh(&n->tbl->lock);
177 }
178 
neigh_update_flags(struct neighbour * neigh,u32 flags,int * notify,bool * gc_update,bool * managed_update)179 static void neigh_update_flags(struct neighbour *neigh, u32 flags, int *notify,
180 			       bool *gc_update, bool *managed_update)
181 {
182 	u32 ndm_flags, old_flags = neigh->flags;
183 
184 	if (!(flags & NEIGH_UPDATE_F_ADMIN))
185 		return;
186 
187 	ndm_flags  = (flags & NEIGH_UPDATE_F_EXT_LEARNED) ? NTF_EXT_LEARNED : 0;
188 	ndm_flags |= (flags & NEIGH_UPDATE_F_MANAGED) ? NTF_MANAGED : 0;
189 
190 	if ((old_flags ^ ndm_flags) & NTF_EXT_LEARNED) {
191 		if (ndm_flags & NTF_EXT_LEARNED)
192 			neigh->flags |= NTF_EXT_LEARNED;
193 		else
194 			neigh->flags &= ~NTF_EXT_LEARNED;
195 		*notify = 1;
196 		*gc_update = true;
197 	}
198 	if ((old_flags ^ ndm_flags) & NTF_MANAGED) {
199 		if (ndm_flags & NTF_MANAGED)
200 			neigh->flags |= NTF_MANAGED;
201 		else
202 			neigh->flags &= ~NTF_MANAGED;
203 		*notify = 1;
204 		*managed_update = true;
205 	}
206 }
207 
neigh_del(struct neighbour * n,struct neighbour __rcu ** np,struct neigh_table * tbl)208 static bool neigh_del(struct neighbour *n, struct neighbour __rcu **np,
209 		      struct neigh_table *tbl)
210 {
211 	bool retval = false;
212 
213 	write_lock(&n->lock);
214 	if (refcount_read(&n->refcnt) == 1) {
215 		struct neighbour *neigh;
216 
217 		neigh = rcu_dereference_protected(n->next,
218 						  lockdep_is_held(&tbl->lock));
219 		rcu_assign_pointer(*np, neigh);
220 		neigh_mark_dead(n);
221 		retval = true;
222 	}
223 	write_unlock(&n->lock);
224 	if (retval)
225 		neigh_cleanup_and_release(n);
226 	return retval;
227 }
228 
neigh_remove_one(struct neighbour * ndel,struct neigh_table * tbl)229 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
230 {
231 	struct neigh_hash_table *nht;
232 	void *pkey = ndel->primary_key;
233 	u32 hash_val;
234 	struct neighbour *n;
235 	struct neighbour __rcu **np;
236 
237 	nht = rcu_dereference_protected(tbl->nht,
238 					lockdep_is_held(&tbl->lock));
239 	hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
240 	hash_val = hash_val >> (32 - nht->hash_shift);
241 
242 	np = &nht->hash_buckets[hash_val];
243 	while ((n = rcu_dereference_protected(*np,
244 					      lockdep_is_held(&tbl->lock)))) {
245 		if (n == ndel)
246 			return neigh_del(n, np, tbl);
247 		np = &n->next;
248 	}
249 	return false;
250 }
251 
neigh_forced_gc(struct neigh_table * tbl)252 static int neigh_forced_gc(struct neigh_table *tbl)
253 {
254 	int max_clean = atomic_read(&tbl->gc_entries) -
255 			READ_ONCE(tbl->gc_thresh2);
256 	u64 tmax = ktime_get_ns() + NSEC_PER_MSEC;
257 	unsigned long tref = jiffies - 5 * HZ;
258 	struct neighbour *n, *tmp;
259 	int shrunk = 0;
260 	int loop = 0;
261 
262 	NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
263 
264 	write_lock_bh(&tbl->lock);
265 
266 	list_for_each_entry_safe(n, tmp, &tbl->gc_list, gc_list) {
267 		if (refcount_read(&n->refcnt) == 1) {
268 			bool remove = false;
269 
270 			write_lock(&n->lock);
271 			if ((n->nud_state == NUD_FAILED) ||
272 			    (n->nud_state == NUD_NOARP) ||
273 			    (tbl->is_multicast &&
274 			     tbl->is_multicast(n->primary_key)) ||
275 			    !time_in_range(n->updated, tref, jiffies))
276 				remove = true;
277 			write_unlock(&n->lock);
278 
279 			if (remove && neigh_remove_one(n, tbl))
280 				shrunk++;
281 			if (shrunk >= max_clean)
282 				break;
283 			if (++loop == 16) {
284 				if (ktime_get_ns() > tmax)
285 					goto unlock;
286 				loop = 0;
287 			}
288 		}
289 	}
290 
291 	WRITE_ONCE(tbl->last_flush, jiffies);
292 unlock:
293 	write_unlock_bh(&tbl->lock);
294 
295 	return shrunk;
296 }
297 
neigh_add_timer(struct neighbour * n,unsigned long when)298 static void neigh_add_timer(struct neighbour *n, unsigned long when)
299 {
300 	/* Use safe distance from the jiffies - LONG_MAX point while timer
301 	 * is running in DELAY/PROBE state but still show to user space
302 	 * large times in the past.
303 	 */
304 	unsigned long mint = jiffies - (LONG_MAX - 86400 * HZ);
305 
306 	neigh_hold(n);
307 	if (!time_in_range(n->confirmed, mint, jiffies))
308 		n->confirmed = mint;
309 	if (time_before(n->used, n->confirmed))
310 		n->used = n->confirmed;
311 	if (unlikely(mod_timer(&n->timer, when))) {
312 		printk("NEIGH: BUG, double timer add, state is %x\n",
313 		       n->nud_state);
314 		dump_stack();
315 	}
316 }
317 
neigh_del_timer(struct neighbour * n)318 static int neigh_del_timer(struct neighbour *n)
319 {
320 	if ((n->nud_state & NUD_IN_TIMER) &&
321 	    del_timer(&n->timer)) {
322 		neigh_release(n);
323 		return 1;
324 	}
325 	return 0;
326 }
327 
neigh_get_dev_parms_rcu(struct net_device * dev,int family)328 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
329 						   int family)
330 {
331 	switch (family) {
332 	case AF_INET:
333 		return __in_dev_arp_parms_get_rcu(dev);
334 	case AF_INET6:
335 		return __in6_dev_nd_parms_get_rcu(dev);
336 	}
337 	return NULL;
338 }
339 
neigh_parms_qlen_dec(struct net_device * dev,int family)340 static void neigh_parms_qlen_dec(struct net_device *dev, int family)
341 {
342 	struct neigh_parms *p;
343 
344 	rcu_read_lock();
345 	p = neigh_get_dev_parms_rcu(dev, family);
346 	if (p)
347 		p->qlen--;
348 	rcu_read_unlock();
349 }
350 
pneigh_queue_purge(struct sk_buff_head * list,struct net * net,int family)351 static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net,
352 			       int family)
353 {
354 	struct sk_buff_head tmp;
355 	unsigned long flags;
356 	struct sk_buff *skb;
357 
358 	skb_queue_head_init(&tmp);
359 	spin_lock_irqsave(&list->lock, flags);
360 	skb = skb_peek(list);
361 	while (skb != NULL) {
362 		struct sk_buff *skb_next = skb_peek_next(skb, list);
363 		struct net_device *dev = skb->dev;
364 
365 		if (net == NULL || net_eq(dev_net(dev), net)) {
366 			neigh_parms_qlen_dec(dev, family);
367 			__skb_unlink(skb, list);
368 			__skb_queue_tail(&tmp, skb);
369 		}
370 		skb = skb_next;
371 	}
372 	spin_unlock_irqrestore(&list->lock, flags);
373 
374 	while ((skb = __skb_dequeue(&tmp))) {
375 		dev_put(skb->dev);
376 		kfree_skb(skb);
377 	}
378 }
379 
neigh_flush_dev(struct neigh_table * tbl,struct net_device * dev,bool skip_perm)380 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev,
381 			    bool skip_perm)
382 {
383 	int i;
384 	struct neigh_hash_table *nht;
385 
386 	nht = rcu_dereference_protected(tbl->nht,
387 					lockdep_is_held(&tbl->lock));
388 
389 	for (i = 0; i < (1 << nht->hash_shift); i++) {
390 		struct neighbour *n;
391 		struct neighbour __rcu **np = &nht->hash_buckets[i];
392 
393 		while ((n = rcu_dereference_protected(*np,
394 					lockdep_is_held(&tbl->lock))) != NULL) {
395 			if (dev && n->dev != dev) {
396 				np = &n->next;
397 				continue;
398 			}
399 			if (skip_perm && n->nud_state & NUD_PERMANENT) {
400 				np = &n->next;
401 				continue;
402 			}
403 			rcu_assign_pointer(*np,
404 				   rcu_dereference_protected(n->next,
405 						lockdep_is_held(&tbl->lock)));
406 			write_lock(&n->lock);
407 			neigh_del_timer(n);
408 			neigh_mark_dead(n);
409 			if (refcount_read(&n->refcnt) != 1) {
410 				/* The most unpleasant situation.
411 				   We must destroy neighbour entry,
412 				   but someone still uses it.
413 
414 				   The destroy will be delayed until
415 				   the last user releases us, but
416 				   we must kill timers etc. and move
417 				   it to safe state.
418 				 */
419 				__skb_queue_purge(&n->arp_queue);
420 				n->arp_queue_len_bytes = 0;
421 				WRITE_ONCE(n->output, neigh_blackhole);
422 				if (n->nud_state & NUD_VALID)
423 					n->nud_state = NUD_NOARP;
424 				else
425 					n->nud_state = NUD_NONE;
426 				neigh_dbg(2, "neigh %p is stray\n", n);
427 			}
428 			write_unlock(&n->lock);
429 			neigh_cleanup_and_release(n);
430 		}
431 	}
432 }
433 
neigh_changeaddr(struct neigh_table * tbl,struct net_device * dev)434 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
435 {
436 	write_lock_bh(&tbl->lock);
437 	neigh_flush_dev(tbl, dev, false);
438 	write_unlock_bh(&tbl->lock);
439 }
440 EXPORT_SYMBOL(neigh_changeaddr);
441 
__neigh_ifdown(struct neigh_table * tbl,struct net_device * dev,bool skip_perm)442 static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
443 			  bool skip_perm)
444 {
445 	write_lock_bh(&tbl->lock);
446 	neigh_flush_dev(tbl, dev, skip_perm);
447 	pneigh_ifdown_and_unlock(tbl, dev);
448 	pneigh_queue_purge(&tbl->proxy_queue, dev ? dev_net(dev) : NULL,
449 			   tbl->family);
450 	if (skb_queue_empty_lockless(&tbl->proxy_queue))
451 		del_timer_sync(&tbl->proxy_timer);
452 	return 0;
453 }
454 
neigh_carrier_down(struct neigh_table * tbl,struct net_device * dev)455 int neigh_carrier_down(struct neigh_table *tbl, struct net_device *dev)
456 {
457 	__neigh_ifdown(tbl, dev, true);
458 	return 0;
459 }
460 EXPORT_SYMBOL(neigh_carrier_down);
461 
neigh_ifdown(struct neigh_table * tbl,struct net_device * dev)462 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
463 {
464 	__neigh_ifdown(tbl, dev, false);
465 	return 0;
466 }
467 EXPORT_SYMBOL(neigh_ifdown);
468 
neigh_alloc(struct neigh_table * tbl,struct net_device * dev,u32 flags,bool exempt_from_gc)469 static struct neighbour *neigh_alloc(struct neigh_table *tbl,
470 				     struct net_device *dev,
471 				     u32 flags, bool exempt_from_gc)
472 {
473 	struct neighbour *n = NULL;
474 	unsigned long now = jiffies;
475 	int entries, gc_thresh3;
476 
477 	if (exempt_from_gc)
478 		goto do_alloc;
479 
480 	entries = atomic_inc_return(&tbl->gc_entries) - 1;
481 	gc_thresh3 = READ_ONCE(tbl->gc_thresh3);
482 	if (entries >= gc_thresh3 ||
483 	    (entries >= READ_ONCE(tbl->gc_thresh2) &&
484 	     time_after(now, READ_ONCE(tbl->last_flush) + 5 * HZ))) {
485 		if (!neigh_forced_gc(tbl) && entries >= gc_thresh3) {
486 			net_info_ratelimited("%s: neighbor table overflow!\n",
487 					     tbl->id);
488 			NEIGH_CACHE_STAT_INC(tbl, table_fulls);
489 			goto out_entries;
490 		}
491 	}
492 
493 do_alloc:
494 	n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
495 	if (!n)
496 		goto out_entries;
497 
498 	__skb_queue_head_init(&n->arp_queue);
499 	rwlock_init(&n->lock);
500 	seqlock_init(&n->ha_lock);
501 	n->updated	  = n->used = now;
502 	n->nud_state	  = NUD_NONE;
503 	n->output	  = neigh_blackhole;
504 	n->flags	  = flags;
505 	seqlock_init(&n->hh.hh_lock);
506 	n->parms	  = neigh_parms_clone(&tbl->parms);
507 	timer_setup(&n->timer, neigh_timer_handler, 0);
508 
509 	NEIGH_CACHE_STAT_INC(tbl, allocs);
510 	n->tbl		  = tbl;
511 	refcount_set(&n->refcnt, 1);
512 	n->dead		  = 1;
513 	INIT_LIST_HEAD(&n->gc_list);
514 	INIT_LIST_HEAD(&n->managed_list);
515 
516 	atomic_inc(&tbl->entries);
517 out:
518 	return n;
519 
520 out_entries:
521 	if (!exempt_from_gc)
522 		atomic_dec(&tbl->gc_entries);
523 	goto out;
524 }
525 
neigh_get_hash_rnd(u32 * x)526 static void neigh_get_hash_rnd(u32 *x)
527 {
528 	*x = get_random_u32() | 1;
529 }
530 
neigh_hash_alloc(unsigned int shift)531 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
532 {
533 	size_t size = (1 << shift) * sizeof(struct neighbour *);
534 	struct neigh_hash_table *ret;
535 	struct neighbour __rcu **buckets;
536 	int i;
537 
538 	ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
539 	if (!ret)
540 		return NULL;
541 	if (size <= PAGE_SIZE) {
542 		buckets = kzalloc(size, GFP_ATOMIC);
543 	} else {
544 		buckets = (struct neighbour __rcu **)
545 			  __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
546 					   get_order(size));
547 		kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
548 	}
549 	if (!buckets) {
550 		kfree(ret);
551 		return NULL;
552 	}
553 	ret->hash_buckets = buckets;
554 	ret->hash_shift = shift;
555 	for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
556 		neigh_get_hash_rnd(&ret->hash_rnd[i]);
557 	return ret;
558 }
559 
neigh_hash_free_rcu(struct rcu_head * head)560 static void neigh_hash_free_rcu(struct rcu_head *head)
561 {
562 	struct neigh_hash_table *nht = container_of(head,
563 						    struct neigh_hash_table,
564 						    rcu);
565 	size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
566 	struct neighbour __rcu **buckets = nht->hash_buckets;
567 
568 	if (size <= PAGE_SIZE) {
569 		kfree(buckets);
570 	} else {
571 		kmemleak_free(buckets);
572 		free_pages((unsigned long)buckets, get_order(size));
573 	}
574 	kfree(nht);
575 }
576 
neigh_hash_grow(struct neigh_table * tbl,unsigned long new_shift)577 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
578 						unsigned long new_shift)
579 {
580 	unsigned int i, hash;
581 	struct neigh_hash_table *new_nht, *old_nht;
582 
583 	NEIGH_CACHE_STAT_INC(tbl, hash_grows);
584 
585 	old_nht = rcu_dereference_protected(tbl->nht,
586 					    lockdep_is_held(&tbl->lock));
587 	new_nht = neigh_hash_alloc(new_shift);
588 	if (!new_nht)
589 		return old_nht;
590 
591 	for (i = 0; i < (1 << old_nht->hash_shift); i++) {
592 		struct neighbour *n, *next;
593 
594 		for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
595 						   lockdep_is_held(&tbl->lock));
596 		     n != NULL;
597 		     n = next) {
598 			hash = tbl->hash(n->primary_key, n->dev,
599 					 new_nht->hash_rnd);
600 
601 			hash >>= (32 - new_nht->hash_shift);
602 			next = rcu_dereference_protected(n->next,
603 						lockdep_is_held(&tbl->lock));
604 
605 			rcu_assign_pointer(n->next,
606 					   rcu_dereference_protected(
607 						new_nht->hash_buckets[hash],
608 						lockdep_is_held(&tbl->lock)));
609 			rcu_assign_pointer(new_nht->hash_buckets[hash], n);
610 		}
611 	}
612 
613 	rcu_assign_pointer(tbl->nht, new_nht);
614 	call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
615 	return new_nht;
616 }
617 
neigh_lookup(struct neigh_table * tbl,const void * pkey,struct net_device * dev)618 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
619 			       struct net_device *dev)
620 {
621 	struct neighbour *n;
622 
623 	NEIGH_CACHE_STAT_INC(tbl, lookups);
624 
625 	rcu_read_lock();
626 	n = __neigh_lookup_noref(tbl, pkey, dev);
627 	if (n) {
628 		if (!refcount_inc_not_zero(&n->refcnt))
629 			n = NULL;
630 		NEIGH_CACHE_STAT_INC(tbl, hits);
631 	}
632 
633 	rcu_read_unlock();
634 	return n;
635 }
636 EXPORT_SYMBOL(neigh_lookup);
637 
638 static struct neighbour *
___neigh_create(struct neigh_table * tbl,const void * pkey,struct net_device * dev,u32 flags,bool exempt_from_gc,bool want_ref)639 ___neigh_create(struct neigh_table *tbl, const void *pkey,
640 		struct net_device *dev, u32 flags,
641 		bool exempt_from_gc, bool want_ref)
642 {
643 	u32 hash_val, key_len = tbl->key_len;
644 	struct neighbour *n1, *rc, *n;
645 	struct neigh_hash_table *nht;
646 	int error;
647 
648 	n = neigh_alloc(tbl, dev, flags, exempt_from_gc);
649 	trace_neigh_create(tbl, dev, pkey, n, exempt_from_gc);
650 	if (!n) {
651 		rc = ERR_PTR(-ENOBUFS);
652 		goto out;
653 	}
654 
655 	memcpy(n->primary_key, pkey, key_len);
656 	n->dev = dev;
657 	netdev_hold(dev, &n->dev_tracker, GFP_ATOMIC);
658 
659 	/* Protocol specific setup. */
660 	if (tbl->constructor &&	(error = tbl->constructor(n)) < 0) {
661 		rc = ERR_PTR(error);
662 		goto out_neigh_release;
663 	}
664 
665 	if (dev->netdev_ops->ndo_neigh_construct) {
666 		error = dev->netdev_ops->ndo_neigh_construct(dev, n);
667 		if (error < 0) {
668 			rc = ERR_PTR(error);
669 			goto out_neigh_release;
670 		}
671 	}
672 
673 	/* Device specific setup. */
674 	if (n->parms->neigh_setup &&
675 	    (error = n->parms->neigh_setup(n)) < 0) {
676 		rc = ERR_PTR(error);
677 		goto out_neigh_release;
678 	}
679 
680 	n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
681 
682 	write_lock_bh(&tbl->lock);
683 	nht = rcu_dereference_protected(tbl->nht,
684 					lockdep_is_held(&tbl->lock));
685 
686 	if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
687 		nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
688 
689 	hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
690 
691 	if (n->parms->dead) {
692 		rc = ERR_PTR(-EINVAL);
693 		goto out_tbl_unlock;
694 	}
695 
696 	for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
697 					    lockdep_is_held(&tbl->lock));
698 	     n1 != NULL;
699 	     n1 = rcu_dereference_protected(n1->next,
700 			lockdep_is_held(&tbl->lock))) {
701 		if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) {
702 			if (want_ref)
703 				neigh_hold(n1);
704 			rc = n1;
705 			goto out_tbl_unlock;
706 		}
707 	}
708 
709 	n->dead = 0;
710 	if (!exempt_from_gc)
711 		list_add_tail(&n->gc_list, &n->tbl->gc_list);
712 	if (n->flags & NTF_MANAGED)
713 		list_add_tail(&n->managed_list, &n->tbl->managed_list);
714 	if (want_ref)
715 		neigh_hold(n);
716 	rcu_assign_pointer(n->next,
717 			   rcu_dereference_protected(nht->hash_buckets[hash_val],
718 						     lockdep_is_held(&tbl->lock)));
719 	rcu_assign_pointer(nht->hash_buckets[hash_val], n);
720 	write_unlock_bh(&tbl->lock);
721 	neigh_dbg(2, "neigh %p is created\n", n);
722 	rc = n;
723 out:
724 	return rc;
725 out_tbl_unlock:
726 	write_unlock_bh(&tbl->lock);
727 out_neigh_release:
728 	if (!exempt_from_gc)
729 		atomic_dec(&tbl->gc_entries);
730 	neigh_release(n);
731 	goto out;
732 }
733 
__neigh_create(struct neigh_table * tbl,const void * pkey,struct net_device * dev,bool want_ref)734 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
735 				 struct net_device *dev, bool want_ref)
736 {
737 	bool exempt_from_gc = !!(dev->flags & IFF_LOOPBACK);
738 
739 	return ___neigh_create(tbl, pkey, dev, 0, exempt_from_gc, want_ref);
740 }
741 EXPORT_SYMBOL(__neigh_create);
742 
pneigh_hash(const void * pkey,unsigned int key_len)743 static u32 pneigh_hash(const void *pkey, unsigned int key_len)
744 {
745 	u32 hash_val = *(u32 *)(pkey + key_len - 4);
746 	hash_val ^= (hash_val >> 16);
747 	hash_val ^= hash_val >> 8;
748 	hash_val ^= hash_val >> 4;
749 	hash_val &= PNEIGH_HASHMASK;
750 	return hash_val;
751 }
752 
__pneigh_lookup_1(struct pneigh_entry * n,struct net * net,const void * pkey,unsigned int key_len,struct net_device * dev)753 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
754 					      struct net *net,
755 					      const void *pkey,
756 					      unsigned int key_len,
757 					      struct net_device *dev)
758 {
759 	while (n) {
760 		if (!memcmp(n->key, pkey, key_len) &&
761 		    net_eq(pneigh_net(n), net) &&
762 		    (n->dev == dev || !n->dev))
763 			return n;
764 		n = n->next;
765 	}
766 	return NULL;
767 }
768 
__pneigh_lookup(struct neigh_table * tbl,struct net * net,const void * pkey,struct net_device * dev)769 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
770 		struct net *net, const void *pkey, struct net_device *dev)
771 {
772 	unsigned int key_len = tbl->key_len;
773 	u32 hash_val = pneigh_hash(pkey, key_len);
774 
775 	return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
776 				 net, pkey, key_len, dev);
777 }
778 EXPORT_SYMBOL_GPL(__pneigh_lookup);
779 
pneigh_lookup(struct neigh_table * tbl,struct net * net,const void * pkey,struct net_device * dev,int creat)780 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
781 				    struct net *net, const void *pkey,
782 				    struct net_device *dev, int creat)
783 {
784 	struct pneigh_entry *n;
785 	unsigned int key_len = tbl->key_len;
786 	u32 hash_val = pneigh_hash(pkey, key_len);
787 
788 	read_lock_bh(&tbl->lock);
789 	n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
790 			      net, pkey, key_len, dev);
791 	read_unlock_bh(&tbl->lock);
792 
793 	if (n || !creat)
794 		goto out;
795 
796 	ASSERT_RTNL();
797 
798 	n = kzalloc(sizeof(*n) + key_len, GFP_KERNEL);
799 	if (!n)
800 		goto out;
801 
802 	write_pnet(&n->net, net);
803 	memcpy(n->key, pkey, key_len);
804 	n->dev = dev;
805 	netdev_hold(dev, &n->dev_tracker, GFP_KERNEL);
806 
807 	if (tbl->pconstructor && tbl->pconstructor(n)) {
808 		netdev_put(dev, &n->dev_tracker);
809 		kfree(n);
810 		n = NULL;
811 		goto out;
812 	}
813 
814 	write_lock_bh(&tbl->lock);
815 	n->next = tbl->phash_buckets[hash_val];
816 	tbl->phash_buckets[hash_val] = n;
817 	write_unlock_bh(&tbl->lock);
818 out:
819 	return n;
820 }
821 EXPORT_SYMBOL(pneigh_lookup);
822 
823 
pneigh_delete(struct neigh_table * tbl,struct net * net,const void * pkey,struct net_device * dev)824 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
825 		  struct net_device *dev)
826 {
827 	struct pneigh_entry *n, **np;
828 	unsigned int key_len = tbl->key_len;
829 	u32 hash_val = pneigh_hash(pkey, key_len);
830 
831 	write_lock_bh(&tbl->lock);
832 	for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
833 	     np = &n->next) {
834 		if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
835 		    net_eq(pneigh_net(n), net)) {
836 			*np = n->next;
837 			write_unlock_bh(&tbl->lock);
838 			if (tbl->pdestructor)
839 				tbl->pdestructor(n);
840 			netdev_put(n->dev, &n->dev_tracker);
841 			kfree(n);
842 			return 0;
843 		}
844 	}
845 	write_unlock_bh(&tbl->lock);
846 	return -ENOENT;
847 }
848 
pneigh_ifdown_and_unlock(struct neigh_table * tbl,struct net_device * dev)849 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
850 				    struct net_device *dev)
851 {
852 	struct pneigh_entry *n, **np, *freelist = NULL;
853 	u32 h;
854 
855 	for (h = 0; h <= PNEIGH_HASHMASK; h++) {
856 		np = &tbl->phash_buckets[h];
857 		while ((n = *np) != NULL) {
858 			if (!dev || n->dev == dev) {
859 				*np = n->next;
860 				n->next = freelist;
861 				freelist = n;
862 				continue;
863 			}
864 			np = &n->next;
865 		}
866 	}
867 	write_unlock_bh(&tbl->lock);
868 	while ((n = freelist)) {
869 		freelist = n->next;
870 		n->next = NULL;
871 		if (tbl->pdestructor)
872 			tbl->pdestructor(n);
873 		netdev_put(n->dev, &n->dev_tracker);
874 		kfree(n);
875 	}
876 	return -ENOENT;
877 }
878 
879 static void neigh_parms_destroy(struct neigh_parms *parms);
880 
neigh_parms_put(struct neigh_parms * parms)881 static inline void neigh_parms_put(struct neigh_parms *parms)
882 {
883 	if (refcount_dec_and_test(&parms->refcnt))
884 		neigh_parms_destroy(parms);
885 }
886 
887 /*
888  *	neighbour must already be out of the table;
889  *
890  */
neigh_destroy(struct neighbour * neigh)891 void neigh_destroy(struct neighbour *neigh)
892 {
893 	struct net_device *dev = neigh->dev;
894 
895 	NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
896 
897 	if (!neigh->dead) {
898 		pr_warn("Destroying alive neighbour %p\n", neigh);
899 		dump_stack();
900 		return;
901 	}
902 
903 	if (neigh_del_timer(neigh))
904 		pr_warn("Impossible event\n");
905 
906 	write_lock_bh(&neigh->lock);
907 	__skb_queue_purge(&neigh->arp_queue);
908 	write_unlock_bh(&neigh->lock);
909 	neigh->arp_queue_len_bytes = 0;
910 
911 	if (dev->netdev_ops->ndo_neigh_destroy)
912 		dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
913 
914 	netdev_put(dev, &neigh->dev_tracker);
915 	neigh_parms_put(neigh->parms);
916 
917 	neigh_dbg(2, "neigh %p is destroyed\n", neigh);
918 
919 	atomic_dec(&neigh->tbl->entries);
920 	kfree_rcu(neigh, rcu);
921 }
922 EXPORT_SYMBOL(neigh_destroy);
923 
924 /* Neighbour state is suspicious;
925    disable fast path.
926 
927    Called with write_locked neigh.
928  */
neigh_suspect(struct neighbour * neigh)929 static void neigh_suspect(struct neighbour *neigh)
930 {
931 	neigh_dbg(2, "neigh %p is suspected\n", neigh);
932 
933 	WRITE_ONCE(neigh->output, neigh->ops->output);
934 }
935 
936 /* Neighbour state is OK;
937    enable fast path.
938 
939    Called with write_locked neigh.
940  */
neigh_connect(struct neighbour * neigh)941 static void neigh_connect(struct neighbour *neigh)
942 {
943 	neigh_dbg(2, "neigh %p is connected\n", neigh);
944 
945 	WRITE_ONCE(neigh->output, neigh->ops->connected_output);
946 }
947 
neigh_periodic_work(struct work_struct * work)948 static void neigh_periodic_work(struct work_struct *work)
949 {
950 	struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
951 	struct neighbour *n;
952 	struct neighbour __rcu **np;
953 	unsigned int i;
954 	struct neigh_hash_table *nht;
955 
956 	NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
957 
958 	write_lock_bh(&tbl->lock);
959 	nht = rcu_dereference_protected(tbl->nht,
960 					lockdep_is_held(&tbl->lock));
961 
962 	/*
963 	 *	periodically recompute ReachableTime from random function
964 	 */
965 
966 	if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
967 		struct neigh_parms *p;
968 
969 		WRITE_ONCE(tbl->last_rand, jiffies);
970 		list_for_each_entry(p, &tbl->parms_list, list)
971 			p->reachable_time =
972 				neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
973 	}
974 
975 	if (atomic_read(&tbl->entries) < READ_ONCE(tbl->gc_thresh1))
976 		goto out;
977 
978 	for (i = 0 ; i < (1 << nht->hash_shift); i++) {
979 		np = &nht->hash_buckets[i];
980 
981 		while ((n = rcu_dereference_protected(*np,
982 				lockdep_is_held(&tbl->lock))) != NULL) {
983 			unsigned int state;
984 
985 			write_lock(&n->lock);
986 
987 			state = n->nud_state;
988 			if ((state & (NUD_PERMANENT | NUD_IN_TIMER)) ||
989 			    (n->flags & NTF_EXT_LEARNED)) {
990 				write_unlock(&n->lock);
991 				goto next_elt;
992 			}
993 
994 			if (time_before(n->used, n->confirmed) &&
995 			    time_is_before_eq_jiffies(n->confirmed))
996 				n->used = n->confirmed;
997 
998 			if (refcount_read(&n->refcnt) == 1 &&
999 			    (state == NUD_FAILED ||
1000 			     !time_in_range_open(jiffies, n->used,
1001 						 n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
1002 				rcu_assign_pointer(*np,
1003 					rcu_dereference_protected(n->next,
1004 						lockdep_is_held(&tbl->lock)));
1005 				neigh_mark_dead(n);
1006 				write_unlock(&n->lock);
1007 				neigh_cleanup_and_release(n);
1008 				continue;
1009 			}
1010 			write_unlock(&n->lock);
1011 
1012 next_elt:
1013 			np = &n->next;
1014 		}
1015 		/*
1016 		 * It's fine to release lock here, even if hash table
1017 		 * grows while we are preempted.
1018 		 */
1019 		write_unlock_bh(&tbl->lock);
1020 		cond_resched();
1021 		write_lock_bh(&tbl->lock);
1022 		nht = rcu_dereference_protected(tbl->nht,
1023 						lockdep_is_held(&tbl->lock));
1024 	}
1025 out:
1026 	/* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
1027 	 * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
1028 	 * BASE_REACHABLE_TIME.
1029 	 */
1030 	queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1031 			      NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
1032 	write_unlock_bh(&tbl->lock);
1033 }
1034 
neigh_max_probes(struct neighbour * n)1035 static __inline__ int neigh_max_probes(struct neighbour *n)
1036 {
1037 	struct neigh_parms *p = n->parms;
1038 	return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
1039 	       (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
1040 	        NEIGH_VAR(p, MCAST_PROBES));
1041 }
1042 
neigh_invalidate(struct neighbour * neigh)1043 static void neigh_invalidate(struct neighbour *neigh)
1044 	__releases(neigh->lock)
1045 	__acquires(neigh->lock)
1046 {
1047 	struct sk_buff *skb;
1048 
1049 	NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
1050 	neigh_dbg(2, "neigh %p is failed\n", neigh);
1051 	neigh->updated = jiffies;
1052 
1053 	/* It is very thin place. report_unreachable is very complicated
1054 	   routine. Particularly, it can hit the same neighbour entry!
1055 
1056 	   So that, we try to be accurate and avoid dead loop. --ANK
1057 	 */
1058 	while (neigh->nud_state == NUD_FAILED &&
1059 	       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1060 		write_unlock(&neigh->lock);
1061 		neigh->ops->error_report(neigh, skb);
1062 		write_lock(&neigh->lock);
1063 	}
1064 	__skb_queue_purge(&neigh->arp_queue);
1065 	neigh->arp_queue_len_bytes = 0;
1066 }
1067 
neigh_probe(struct neighbour * neigh)1068 static void neigh_probe(struct neighbour *neigh)
1069 	__releases(neigh->lock)
1070 {
1071 	struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
1072 	/* keep skb alive even if arp_queue overflows */
1073 	if (skb)
1074 		skb = skb_clone(skb, GFP_ATOMIC);
1075 	write_unlock(&neigh->lock);
1076 	if (neigh->ops->solicit)
1077 		neigh->ops->solicit(neigh, skb);
1078 	atomic_inc(&neigh->probes);
1079 	consume_skb(skb);
1080 }
1081 
1082 /* Called when a timer expires for a neighbour entry. */
1083 
neigh_timer_handler(struct timer_list * t)1084 static void neigh_timer_handler(struct timer_list *t)
1085 {
1086 	unsigned long now, next;
1087 	struct neighbour *neigh = from_timer(neigh, t, timer);
1088 	unsigned int state;
1089 	int notify = 0;
1090 
1091 	write_lock(&neigh->lock);
1092 
1093 	state = neigh->nud_state;
1094 	now = jiffies;
1095 	next = now + HZ;
1096 
1097 	if (!(state & NUD_IN_TIMER))
1098 		goto out;
1099 
1100 	if (state & NUD_REACHABLE) {
1101 		if (time_before_eq(now,
1102 				   neigh->confirmed + neigh->parms->reachable_time)) {
1103 			neigh_dbg(2, "neigh %p is still alive\n", neigh);
1104 			next = neigh->confirmed + neigh->parms->reachable_time;
1105 		} else if (time_before_eq(now,
1106 					  neigh->used +
1107 					  NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1108 			neigh_dbg(2, "neigh %p is delayed\n", neigh);
1109 			WRITE_ONCE(neigh->nud_state, NUD_DELAY);
1110 			neigh->updated = jiffies;
1111 			neigh_suspect(neigh);
1112 			next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
1113 		} else {
1114 			neigh_dbg(2, "neigh %p is suspected\n", neigh);
1115 			WRITE_ONCE(neigh->nud_state, NUD_STALE);
1116 			neigh->updated = jiffies;
1117 			neigh_suspect(neigh);
1118 			notify = 1;
1119 		}
1120 	} else if (state & NUD_DELAY) {
1121 		if (time_before_eq(now,
1122 				   neigh->confirmed +
1123 				   NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1124 			neigh_dbg(2, "neigh %p is now reachable\n", neigh);
1125 			WRITE_ONCE(neigh->nud_state, NUD_REACHABLE);
1126 			neigh->updated = jiffies;
1127 			neigh_connect(neigh);
1128 			notify = 1;
1129 			next = neigh->confirmed + neigh->parms->reachable_time;
1130 		} else {
1131 			neigh_dbg(2, "neigh %p is probed\n", neigh);
1132 			WRITE_ONCE(neigh->nud_state, NUD_PROBE);
1133 			neigh->updated = jiffies;
1134 			atomic_set(&neigh->probes, 0);
1135 			notify = 1;
1136 			next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1137 					 HZ/100);
1138 		}
1139 	} else {
1140 		/* NUD_PROBE|NUD_INCOMPLETE */
1141 		next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME), HZ/100);
1142 	}
1143 
1144 	if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
1145 	    atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
1146 		WRITE_ONCE(neigh->nud_state, NUD_FAILED);
1147 		notify = 1;
1148 		neigh_invalidate(neigh);
1149 		goto out;
1150 	}
1151 
1152 	if (neigh->nud_state & NUD_IN_TIMER) {
1153 		if (time_before(next, jiffies + HZ/100))
1154 			next = jiffies + HZ/100;
1155 		if (!mod_timer(&neigh->timer, next))
1156 			neigh_hold(neigh);
1157 	}
1158 	if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
1159 		neigh_probe(neigh);
1160 	} else {
1161 out:
1162 		write_unlock(&neigh->lock);
1163 	}
1164 
1165 	if (notify)
1166 		neigh_update_notify(neigh, 0);
1167 
1168 	trace_neigh_timer_handler(neigh, 0);
1169 
1170 	neigh_release(neigh);
1171 }
1172 
__neigh_event_send(struct neighbour * neigh,struct sk_buff * skb,const bool immediate_ok)1173 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb,
1174 		       const bool immediate_ok)
1175 {
1176 	int rc;
1177 	bool immediate_probe = false;
1178 
1179 	write_lock_bh(&neigh->lock);
1180 
1181 	rc = 0;
1182 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1183 		goto out_unlock_bh;
1184 	if (neigh->dead)
1185 		goto out_dead;
1186 
1187 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1188 		if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1189 		    NEIGH_VAR(neigh->parms, APP_PROBES)) {
1190 			unsigned long next, now = jiffies;
1191 
1192 			atomic_set(&neigh->probes,
1193 				   NEIGH_VAR(neigh->parms, UCAST_PROBES));
1194 			neigh_del_timer(neigh);
1195 			WRITE_ONCE(neigh->nud_state, NUD_INCOMPLETE);
1196 			neigh->updated = now;
1197 			if (!immediate_ok) {
1198 				next = now + 1;
1199 			} else {
1200 				immediate_probe = true;
1201 				next = now + max(NEIGH_VAR(neigh->parms,
1202 							   RETRANS_TIME),
1203 						 HZ / 100);
1204 			}
1205 			neigh_add_timer(neigh, next);
1206 		} else {
1207 			WRITE_ONCE(neigh->nud_state, NUD_FAILED);
1208 			neigh->updated = jiffies;
1209 			write_unlock_bh(&neigh->lock);
1210 
1211 			kfree_skb_reason(skb, SKB_DROP_REASON_NEIGH_FAILED);
1212 			return 1;
1213 		}
1214 	} else if (neigh->nud_state & NUD_STALE) {
1215 		neigh_dbg(2, "neigh %p is delayed\n", neigh);
1216 		neigh_del_timer(neigh);
1217 		WRITE_ONCE(neigh->nud_state, NUD_DELAY);
1218 		neigh->updated = jiffies;
1219 		neigh_add_timer(neigh, jiffies +
1220 				NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1221 	}
1222 
1223 	if (neigh->nud_state == NUD_INCOMPLETE) {
1224 		if (skb) {
1225 			while (neigh->arp_queue_len_bytes + skb->truesize >
1226 			       NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1227 				struct sk_buff *buff;
1228 
1229 				buff = __skb_dequeue(&neigh->arp_queue);
1230 				if (!buff)
1231 					break;
1232 				neigh->arp_queue_len_bytes -= buff->truesize;
1233 				kfree_skb_reason(buff, SKB_DROP_REASON_NEIGH_QUEUEFULL);
1234 				NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1235 			}
1236 			skb_dst_force(skb);
1237 			__skb_queue_tail(&neigh->arp_queue, skb);
1238 			neigh->arp_queue_len_bytes += skb->truesize;
1239 		}
1240 		rc = 1;
1241 	}
1242 out_unlock_bh:
1243 	if (immediate_probe)
1244 		neigh_probe(neigh);
1245 	else
1246 		write_unlock(&neigh->lock);
1247 	local_bh_enable();
1248 	trace_neigh_event_send_done(neigh, rc);
1249 	return rc;
1250 
1251 out_dead:
1252 	if (neigh->nud_state & NUD_STALE)
1253 		goto out_unlock_bh;
1254 	write_unlock_bh(&neigh->lock);
1255 	kfree_skb_reason(skb, SKB_DROP_REASON_NEIGH_DEAD);
1256 	trace_neigh_event_send_dead(neigh, 1);
1257 	return 1;
1258 }
1259 EXPORT_SYMBOL(__neigh_event_send);
1260 
neigh_update_hhs(struct neighbour * neigh)1261 static void neigh_update_hhs(struct neighbour *neigh)
1262 {
1263 	struct hh_cache *hh;
1264 	void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1265 		= NULL;
1266 
1267 	if (neigh->dev->header_ops)
1268 		update = neigh->dev->header_ops->cache_update;
1269 
1270 	if (update) {
1271 		hh = &neigh->hh;
1272 		if (READ_ONCE(hh->hh_len)) {
1273 			write_seqlock_bh(&hh->hh_lock);
1274 			update(hh, neigh->dev, neigh->ha);
1275 			write_sequnlock_bh(&hh->hh_lock);
1276 		}
1277 	}
1278 }
1279 
1280 /* Generic update routine.
1281    -- lladdr is new lladdr or NULL, if it is not supplied.
1282    -- new    is new state.
1283    -- flags
1284 	NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1285 				if it is different.
1286 	NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1287 				lladdr instead of overriding it
1288 				if it is different.
1289 	NEIGH_UPDATE_F_ADMIN	means that the change is administrative.
1290 	NEIGH_UPDATE_F_USE	means that the entry is user triggered.
1291 	NEIGH_UPDATE_F_MANAGED	means that the entry will be auto-refreshed.
1292 	NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1293 				NTF_ROUTER flag.
1294 	NEIGH_UPDATE_F_ISROUTER	indicates if the neighbour is known as
1295 				a router.
1296 
1297    Caller MUST hold reference count on the entry.
1298  */
__neigh_update(struct neighbour * neigh,const u8 * lladdr,u8 new,u32 flags,u32 nlmsg_pid,struct netlink_ext_ack * extack)1299 static int __neigh_update(struct neighbour *neigh, const u8 *lladdr,
1300 			  u8 new, u32 flags, u32 nlmsg_pid,
1301 			  struct netlink_ext_ack *extack)
1302 {
1303 	bool gc_update = false, managed_update = false;
1304 	int update_isrouter = 0;
1305 	struct net_device *dev;
1306 	int err, notify = 0;
1307 	u8 old;
1308 
1309 	trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid);
1310 
1311 	write_lock_bh(&neigh->lock);
1312 
1313 	dev    = neigh->dev;
1314 	old    = neigh->nud_state;
1315 	err    = -EPERM;
1316 
1317 	if (neigh->dead) {
1318 		NL_SET_ERR_MSG(extack, "Neighbor entry is now dead");
1319 		new = old;
1320 		goto out;
1321 	}
1322 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1323 	    (old & (NUD_NOARP | NUD_PERMANENT)))
1324 		goto out;
1325 
1326 	neigh_update_flags(neigh, flags, &notify, &gc_update, &managed_update);
1327 	if (flags & (NEIGH_UPDATE_F_USE | NEIGH_UPDATE_F_MANAGED)) {
1328 		new = old & ~NUD_PERMANENT;
1329 		WRITE_ONCE(neigh->nud_state, new);
1330 		err = 0;
1331 		goto out;
1332 	}
1333 
1334 	if (!(new & NUD_VALID)) {
1335 		neigh_del_timer(neigh);
1336 		if (old & NUD_CONNECTED)
1337 			neigh_suspect(neigh);
1338 		WRITE_ONCE(neigh->nud_state, new);
1339 		err = 0;
1340 		notify = old & NUD_VALID;
1341 		if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1342 		    (new & NUD_FAILED)) {
1343 			neigh_invalidate(neigh);
1344 			notify = 1;
1345 		}
1346 		goto out;
1347 	}
1348 
1349 	/* Compare new lladdr with cached one */
1350 	if (!dev->addr_len) {
1351 		/* First case: device needs no address. */
1352 		lladdr = neigh->ha;
1353 	} else if (lladdr) {
1354 		/* The second case: if something is already cached
1355 		   and a new address is proposed:
1356 		   - compare new & old
1357 		   - if they are different, check override flag
1358 		 */
1359 		if ((old & NUD_VALID) &&
1360 		    !memcmp(lladdr, neigh->ha, dev->addr_len))
1361 			lladdr = neigh->ha;
1362 	} else {
1363 		/* No address is supplied; if we know something,
1364 		   use it, otherwise discard the request.
1365 		 */
1366 		err = -EINVAL;
1367 		if (!(old & NUD_VALID)) {
1368 			NL_SET_ERR_MSG(extack, "No link layer address given");
1369 			goto out;
1370 		}
1371 		lladdr = neigh->ha;
1372 	}
1373 
1374 	/* Update confirmed timestamp for neighbour entry after we
1375 	 * received ARP packet even if it doesn't change IP to MAC binding.
1376 	 */
1377 	if (new & NUD_CONNECTED)
1378 		neigh->confirmed = jiffies;
1379 
1380 	/* If entry was valid and address is not changed,
1381 	   do not change entry state, if new one is STALE.
1382 	 */
1383 	err = 0;
1384 	update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1385 	if (old & NUD_VALID) {
1386 		if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1387 			update_isrouter = 0;
1388 			if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1389 			    (old & NUD_CONNECTED)) {
1390 				lladdr = neigh->ha;
1391 				new = NUD_STALE;
1392 			} else
1393 				goto out;
1394 		} else {
1395 			if (lladdr == neigh->ha && new == NUD_STALE &&
1396 			    !(flags & NEIGH_UPDATE_F_ADMIN))
1397 				new = old;
1398 		}
1399 	}
1400 
1401 	/* Update timestamp only once we know we will make a change to the
1402 	 * neighbour entry. Otherwise we risk to move the locktime window with
1403 	 * noop updates and ignore relevant ARP updates.
1404 	 */
1405 	if (new != old || lladdr != neigh->ha)
1406 		neigh->updated = jiffies;
1407 
1408 	if (new != old) {
1409 		neigh_del_timer(neigh);
1410 		if (new & NUD_PROBE)
1411 			atomic_set(&neigh->probes, 0);
1412 		if (new & NUD_IN_TIMER)
1413 			neigh_add_timer(neigh, (jiffies +
1414 						((new & NUD_REACHABLE) ?
1415 						 neigh->parms->reachable_time :
1416 						 0)));
1417 		WRITE_ONCE(neigh->nud_state, new);
1418 		notify = 1;
1419 	}
1420 
1421 	if (lladdr != neigh->ha) {
1422 		write_seqlock(&neigh->ha_lock);
1423 		memcpy(&neigh->ha, lladdr, dev->addr_len);
1424 		write_sequnlock(&neigh->ha_lock);
1425 		neigh_update_hhs(neigh);
1426 		if (!(new & NUD_CONNECTED))
1427 			neigh->confirmed = jiffies -
1428 				      (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1429 		notify = 1;
1430 	}
1431 	if (new == old)
1432 		goto out;
1433 	if (new & NUD_CONNECTED)
1434 		neigh_connect(neigh);
1435 	else
1436 		neigh_suspect(neigh);
1437 	if (!(old & NUD_VALID)) {
1438 		struct sk_buff *skb;
1439 
1440 		/* Again: avoid dead loop if something went wrong */
1441 
1442 		while (neigh->nud_state & NUD_VALID &&
1443 		       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1444 			struct dst_entry *dst = skb_dst(skb);
1445 			struct neighbour *n2, *n1 = neigh;
1446 			write_unlock_bh(&neigh->lock);
1447 
1448 			rcu_read_lock();
1449 
1450 			/* Why not just use 'neigh' as-is?  The problem is that
1451 			 * things such as shaper, eql, and sch_teql can end up
1452 			 * using alternative, different, neigh objects to output
1453 			 * the packet in the output path.  So what we need to do
1454 			 * here is re-lookup the top-level neigh in the path so
1455 			 * we can reinject the packet there.
1456 			 */
1457 			n2 = NULL;
1458 			if (dst && dst->obsolete != DST_OBSOLETE_DEAD) {
1459 				n2 = dst_neigh_lookup_skb(dst, skb);
1460 				if (n2)
1461 					n1 = n2;
1462 			}
1463 			READ_ONCE(n1->output)(n1, skb);
1464 			if (n2)
1465 				neigh_release(n2);
1466 			rcu_read_unlock();
1467 
1468 			write_lock_bh(&neigh->lock);
1469 		}
1470 		__skb_queue_purge(&neigh->arp_queue);
1471 		neigh->arp_queue_len_bytes = 0;
1472 	}
1473 out:
1474 	if (update_isrouter)
1475 		neigh_update_is_router(neigh, flags, &notify);
1476 	write_unlock_bh(&neigh->lock);
1477 	if (((new ^ old) & NUD_PERMANENT) || gc_update)
1478 		neigh_update_gc_list(neigh);
1479 	if (managed_update)
1480 		neigh_update_managed_list(neigh);
1481 	if (notify)
1482 		neigh_update_notify(neigh, nlmsg_pid);
1483 	trace_neigh_update_done(neigh, err);
1484 	return err;
1485 }
1486 
neigh_update(struct neighbour * neigh,const u8 * lladdr,u8 new,u32 flags,u32 nlmsg_pid)1487 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1488 		 u32 flags, u32 nlmsg_pid)
1489 {
1490 	return __neigh_update(neigh, lladdr, new, flags, nlmsg_pid, NULL);
1491 }
1492 EXPORT_SYMBOL(neigh_update);
1493 
1494 /* Update the neigh to listen temporarily for probe responses, even if it is
1495  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1496  */
__neigh_set_probe_once(struct neighbour * neigh)1497 void __neigh_set_probe_once(struct neighbour *neigh)
1498 {
1499 	if (neigh->dead)
1500 		return;
1501 	neigh->updated = jiffies;
1502 	if (!(neigh->nud_state & NUD_FAILED))
1503 		return;
1504 	WRITE_ONCE(neigh->nud_state, NUD_INCOMPLETE);
1505 	atomic_set(&neigh->probes, neigh_max_probes(neigh));
1506 	neigh_add_timer(neigh,
1507 			jiffies + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1508 				      HZ/100));
1509 }
1510 EXPORT_SYMBOL(__neigh_set_probe_once);
1511 
neigh_event_ns(struct neigh_table * tbl,u8 * lladdr,void * saddr,struct net_device * dev)1512 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1513 				 u8 *lladdr, void *saddr,
1514 				 struct net_device *dev)
1515 {
1516 	struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1517 						 lladdr || !dev->addr_len);
1518 	if (neigh)
1519 		neigh_update(neigh, lladdr, NUD_STALE,
1520 			     NEIGH_UPDATE_F_OVERRIDE, 0);
1521 	return neigh;
1522 }
1523 EXPORT_SYMBOL(neigh_event_ns);
1524 
1525 /* called with read_lock_bh(&n->lock); */
neigh_hh_init(struct neighbour * n)1526 static void neigh_hh_init(struct neighbour *n)
1527 {
1528 	struct net_device *dev = n->dev;
1529 	__be16 prot = n->tbl->protocol;
1530 	struct hh_cache	*hh = &n->hh;
1531 
1532 	write_lock_bh(&n->lock);
1533 
1534 	/* Only one thread can come in here and initialize the
1535 	 * hh_cache entry.
1536 	 */
1537 	if (!hh->hh_len)
1538 		dev->header_ops->cache(n, hh, prot);
1539 
1540 	write_unlock_bh(&n->lock);
1541 }
1542 
1543 /* Slow and careful. */
1544 
neigh_resolve_output(struct neighbour * neigh,struct sk_buff * skb)1545 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1546 {
1547 	int rc = 0;
1548 
1549 	if (!neigh_event_send(neigh, skb)) {
1550 		int err;
1551 		struct net_device *dev = neigh->dev;
1552 		unsigned int seq;
1553 
1554 		if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
1555 			neigh_hh_init(neigh);
1556 
1557 		do {
1558 			__skb_pull(skb, skb_network_offset(skb));
1559 			seq = read_seqbegin(&neigh->ha_lock);
1560 			err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1561 					      neigh->ha, NULL, skb->len);
1562 		} while (read_seqretry(&neigh->ha_lock, seq));
1563 
1564 		if (err >= 0)
1565 			rc = dev_queue_xmit(skb);
1566 		else
1567 			goto out_kfree_skb;
1568 	}
1569 out:
1570 	return rc;
1571 out_kfree_skb:
1572 	rc = -EINVAL;
1573 	kfree_skb(skb);
1574 	goto out;
1575 }
1576 EXPORT_SYMBOL(neigh_resolve_output);
1577 
1578 /* As fast as possible without hh cache */
1579 
neigh_connected_output(struct neighbour * neigh,struct sk_buff * skb)1580 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1581 {
1582 	struct net_device *dev = neigh->dev;
1583 	unsigned int seq;
1584 	int err;
1585 
1586 	do {
1587 		__skb_pull(skb, skb_network_offset(skb));
1588 		seq = read_seqbegin(&neigh->ha_lock);
1589 		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1590 				      neigh->ha, NULL, skb->len);
1591 	} while (read_seqretry(&neigh->ha_lock, seq));
1592 
1593 	if (err >= 0)
1594 		err = dev_queue_xmit(skb);
1595 	else {
1596 		err = -EINVAL;
1597 		kfree_skb(skb);
1598 	}
1599 	return err;
1600 }
1601 EXPORT_SYMBOL(neigh_connected_output);
1602 
neigh_direct_output(struct neighbour * neigh,struct sk_buff * skb)1603 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1604 {
1605 	return dev_queue_xmit(skb);
1606 }
1607 EXPORT_SYMBOL(neigh_direct_output);
1608 
neigh_managed_work(struct work_struct * work)1609 static void neigh_managed_work(struct work_struct *work)
1610 {
1611 	struct neigh_table *tbl = container_of(work, struct neigh_table,
1612 					       managed_work.work);
1613 	struct neighbour *neigh;
1614 
1615 	write_lock_bh(&tbl->lock);
1616 	list_for_each_entry(neigh, &tbl->managed_list, managed_list)
1617 		neigh_event_send_probe(neigh, NULL, false);
1618 	queue_delayed_work(system_power_efficient_wq, &tbl->managed_work,
1619 			   NEIGH_VAR(&tbl->parms, INTERVAL_PROBE_TIME_MS));
1620 	write_unlock_bh(&tbl->lock);
1621 }
1622 
neigh_proxy_process(struct timer_list * t)1623 static void neigh_proxy_process(struct timer_list *t)
1624 {
1625 	struct neigh_table *tbl = from_timer(tbl, t, proxy_timer);
1626 	long sched_next = 0;
1627 	unsigned long now = jiffies;
1628 	struct sk_buff *skb, *n;
1629 
1630 	spin_lock(&tbl->proxy_queue.lock);
1631 
1632 	skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1633 		long tdif = NEIGH_CB(skb)->sched_next - now;
1634 
1635 		if (tdif <= 0) {
1636 			struct net_device *dev = skb->dev;
1637 
1638 			neigh_parms_qlen_dec(dev, tbl->family);
1639 			__skb_unlink(skb, &tbl->proxy_queue);
1640 
1641 			if (tbl->proxy_redo && netif_running(dev)) {
1642 				rcu_read_lock();
1643 				tbl->proxy_redo(skb);
1644 				rcu_read_unlock();
1645 			} else {
1646 				kfree_skb(skb);
1647 			}
1648 
1649 			dev_put(dev);
1650 		} else if (!sched_next || tdif < sched_next)
1651 			sched_next = tdif;
1652 	}
1653 	del_timer(&tbl->proxy_timer);
1654 	if (sched_next)
1655 		mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1656 	spin_unlock(&tbl->proxy_queue.lock);
1657 }
1658 
neigh_proxy_delay(struct neigh_parms * p)1659 static unsigned long neigh_proxy_delay(struct neigh_parms *p)
1660 {
1661 	/* If proxy_delay is zero, do not call get_random_u32_below()
1662 	 * as it is undefined behavior.
1663 	 */
1664 	unsigned long proxy_delay = NEIGH_VAR(p, PROXY_DELAY);
1665 
1666 	return proxy_delay ?
1667 	       jiffies + get_random_u32_below(proxy_delay) : jiffies;
1668 }
1669 
pneigh_enqueue(struct neigh_table * tbl,struct neigh_parms * p,struct sk_buff * skb)1670 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1671 		    struct sk_buff *skb)
1672 {
1673 	unsigned long sched_next = neigh_proxy_delay(p);
1674 
1675 	if (p->qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1676 		kfree_skb(skb);
1677 		return;
1678 	}
1679 
1680 	NEIGH_CB(skb)->sched_next = sched_next;
1681 	NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1682 
1683 	spin_lock(&tbl->proxy_queue.lock);
1684 	if (del_timer(&tbl->proxy_timer)) {
1685 		if (time_before(tbl->proxy_timer.expires, sched_next))
1686 			sched_next = tbl->proxy_timer.expires;
1687 	}
1688 	skb_dst_drop(skb);
1689 	dev_hold(skb->dev);
1690 	__skb_queue_tail(&tbl->proxy_queue, skb);
1691 	p->qlen++;
1692 	mod_timer(&tbl->proxy_timer, sched_next);
1693 	spin_unlock(&tbl->proxy_queue.lock);
1694 }
1695 EXPORT_SYMBOL(pneigh_enqueue);
1696 
lookup_neigh_parms(struct neigh_table * tbl,struct net * net,int ifindex)1697 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1698 						      struct net *net, int ifindex)
1699 {
1700 	struct neigh_parms *p;
1701 
1702 	list_for_each_entry(p, &tbl->parms_list, list) {
1703 		if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1704 		    (!p->dev && !ifindex && net_eq(net, &init_net)))
1705 			return p;
1706 	}
1707 
1708 	return NULL;
1709 }
1710 
neigh_parms_alloc(struct net_device * dev,struct neigh_table * tbl)1711 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1712 				      struct neigh_table *tbl)
1713 {
1714 	struct neigh_parms *p;
1715 	struct net *net = dev_net(dev);
1716 	const struct net_device_ops *ops = dev->netdev_ops;
1717 
1718 	p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1719 	if (p) {
1720 		p->tbl		  = tbl;
1721 		refcount_set(&p->refcnt, 1);
1722 		p->reachable_time =
1723 				neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1724 		p->qlen = 0;
1725 		netdev_hold(dev, &p->dev_tracker, GFP_KERNEL);
1726 		p->dev = dev;
1727 		write_pnet(&p->net, net);
1728 		p->sysctl_table = NULL;
1729 
1730 		if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1731 			netdev_put(dev, &p->dev_tracker);
1732 			kfree(p);
1733 			return NULL;
1734 		}
1735 
1736 		write_lock_bh(&tbl->lock);
1737 		list_add(&p->list, &tbl->parms.list);
1738 		write_unlock_bh(&tbl->lock);
1739 
1740 		neigh_parms_data_state_cleanall(p);
1741 	}
1742 	return p;
1743 }
1744 EXPORT_SYMBOL(neigh_parms_alloc);
1745 
neigh_rcu_free_parms(struct rcu_head * head)1746 static void neigh_rcu_free_parms(struct rcu_head *head)
1747 {
1748 	struct neigh_parms *parms =
1749 		container_of(head, struct neigh_parms, rcu_head);
1750 
1751 	neigh_parms_put(parms);
1752 }
1753 
neigh_parms_release(struct neigh_table * tbl,struct neigh_parms * parms)1754 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1755 {
1756 	if (!parms || parms == &tbl->parms)
1757 		return;
1758 	write_lock_bh(&tbl->lock);
1759 	list_del(&parms->list);
1760 	parms->dead = 1;
1761 	write_unlock_bh(&tbl->lock);
1762 	netdev_put(parms->dev, &parms->dev_tracker);
1763 	call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1764 }
1765 EXPORT_SYMBOL(neigh_parms_release);
1766 
neigh_parms_destroy(struct neigh_parms * parms)1767 static void neigh_parms_destroy(struct neigh_parms *parms)
1768 {
1769 	kfree(parms);
1770 }
1771 
1772 static struct lock_class_key neigh_table_proxy_queue_class;
1773 
1774 static struct neigh_table __rcu *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1775 
neigh_table_init(int index,struct neigh_table * tbl)1776 void neigh_table_init(int index, struct neigh_table *tbl)
1777 {
1778 	unsigned long now = jiffies;
1779 	unsigned long phsize;
1780 
1781 	INIT_LIST_HEAD(&tbl->parms_list);
1782 	INIT_LIST_HEAD(&tbl->gc_list);
1783 	INIT_LIST_HEAD(&tbl->managed_list);
1784 
1785 	list_add(&tbl->parms.list, &tbl->parms_list);
1786 	write_pnet(&tbl->parms.net, &init_net);
1787 	refcount_set(&tbl->parms.refcnt, 1);
1788 	tbl->parms.reachable_time =
1789 			  neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1790 	tbl->parms.qlen = 0;
1791 
1792 	tbl->stats = alloc_percpu(struct neigh_statistics);
1793 	if (!tbl->stats)
1794 		panic("cannot create neighbour cache statistics");
1795 
1796 #ifdef CONFIG_PROC_FS
1797 	if (!proc_create_seq_data(tbl->id, 0, init_net.proc_net_stat,
1798 			      &neigh_stat_seq_ops, tbl))
1799 		panic("cannot create neighbour proc dir entry");
1800 #endif
1801 
1802 	RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1803 
1804 	phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1805 	tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1806 
1807 	if (!tbl->nht || !tbl->phash_buckets)
1808 		panic("cannot allocate neighbour cache hashes");
1809 
1810 	if (!tbl->entry_size)
1811 		tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1812 					tbl->key_len, NEIGH_PRIV_ALIGN);
1813 	else
1814 		WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1815 
1816 	rwlock_init(&tbl->lock);
1817 
1818 	INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1819 	queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1820 			tbl->parms.reachable_time);
1821 	INIT_DEFERRABLE_WORK(&tbl->managed_work, neigh_managed_work);
1822 	queue_delayed_work(system_power_efficient_wq, &tbl->managed_work, 0);
1823 
1824 	timer_setup(&tbl->proxy_timer, neigh_proxy_process, 0);
1825 	skb_queue_head_init_class(&tbl->proxy_queue,
1826 			&neigh_table_proxy_queue_class);
1827 
1828 	tbl->last_flush = now;
1829 	tbl->last_rand	= now + tbl->parms.reachable_time * 20;
1830 
1831 	rcu_assign_pointer(neigh_tables[index], tbl);
1832 }
1833 EXPORT_SYMBOL(neigh_table_init);
1834 
1835 /*
1836  * Only called from ndisc_cleanup(), which means this is dead code
1837  * because we no longer can unload IPv6 module.
1838  */
neigh_table_clear(int index,struct neigh_table * tbl)1839 int neigh_table_clear(int index, struct neigh_table *tbl)
1840 {
1841 	RCU_INIT_POINTER(neigh_tables[index], NULL);
1842 	synchronize_rcu();
1843 
1844 	/* It is not clean... Fix it to unload IPv6 module safely */
1845 	cancel_delayed_work_sync(&tbl->managed_work);
1846 	cancel_delayed_work_sync(&tbl->gc_work);
1847 	del_timer_sync(&tbl->proxy_timer);
1848 	pneigh_queue_purge(&tbl->proxy_queue, NULL, tbl->family);
1849 	neigh_ifdown(tbl, NULL);
1850 	if (atomic_read(&tbl->entries))
1851 		pr_crit("neighbour leakage\n");
1852 
1853 	call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1854 		 neigh_hash_free_rcu);
1855 	tbl->nht = NULL;
1856 
1857 	kfree(tbl->phash_buckets);
1858 	tbl->phash_buckets = NULL;
1859 
1860 	remove_proc_entry(tbl->id, init_net.proc_net_stat);
1861 
1862 	free_percpu(tbl->stats);
1863 	tbl->stats = NULL;
1864 
1865 	return 0;
1866 }
1867 EXPORT_SYMBOL(neigh_table_clear);
1868 
neigh_find_table(int family)1869 static struct neigh_table *neigh_find_table(int family)
1870 {
1871 	struct neigh_table *tbl = NULL;
1872 
1873 	switch (family) {
1874 	case AF_INET:
1875 		tbl = rcu_dereference_rtnl(neigh_tables[NEIGH_ARP_TABLE]);
1876 		break;
1877 	case AF_INET6:
1878 		tbl = rcu_dereference_rtnl(neigh_tables[NEIGH_ND_TABLE]);
1879 		break;
1880 	}
1881 
1882 	return tbl;
1883 }
1884 
1885 const struct nla_policy nda_policy[NDA_MAX+1] = {
1886 	[NDA_UNSPEC]		= { .strict_start_type = NDA_NH_ID },
1887 	[NDA_DST]		= { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1888 	[NDA_LLADDR]		= { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1889 	[NDA_CACHEINFO]		= { .len = sizeof(struct nda_cacheinfo) },
1890 	[NDA_PROBES]		= { .type = NLA_U32 },
1891 	[NDA_VLAN]		= { .type = NLA_U16 },
1892 	[NDA_PORT]		= { .type = NLA_U16 },
1893 	[NDA_VNI]		= { .type = NLA_U32 },
1894 	[NDA_IFINDEX]		= { .type = NLA_U32 },
1895 	[NDA_MASTER]		= { .type = NLA_U32 },
1896 	[NDA_PROTOCOL]		= { .type = NLA_U8 },
1897 	[NDA_NH_ID]		= { .type = NLA_U32 },
1898 	[NDA_FLAGS_EXT]		= NLA_POLICY_MASK(NLA_U32, NTF_EXT_MASK),
1899 	[NDA_FDB_EXT_ATTRS]	= { .type = NLA_NESTED },
1900 };
1901 
neigh_delete(struct sk_buff * skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)1902 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1903 			struct netlink_ext_ack *extack)
1904 {
1905 	struct net *net = sock_net(skb->sk);
1906 	struct ndmsg *ndm;
1907 	struct nlattr *dst_attr;
1908 	struct neigh_table *tbl;
1909 	struct neighbour *neigh;
1910 	struct net_device *dev = NULL;
1911 	int err = -EINVAL;
1912 
1913 	ASSERT_RTNL();
1914 	if (nlmsg_len(nlh) < sizeof(*ndm))
1915 		goto out;
1916 
1917 	dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1918 	if (!dst_attr) {
1919 		NL_SET_ERR_MSG(extack, "Network address not specified");
1920 		goto out;
1921 	}
1922 
1923 	ndm = nlmsg_data(nlh);
1924 	if (ndm->ndm_ifindex) {
1925 		dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1926 		if (dev == NULL) {
1927 			err = -ENODEV;
1928 			goto out;
1929 		}
1930 	}
1931 
1932 	tbl = neigh_find_table(ndm->ndm_family);
1933 	if (tbl == NULL)
1934 		return -EAFNOSUPPORT;
1935 
1936 	if (nla_len(dst_attr) < (int)tbl->key_len) {
1937 		NL_SET_ERR_MSG(extack, "Invalid network address");
1938 		goto out;
1939 	}
1940 
1941 	if (ndm->ndm_flags & NTF_PROXY) {
1942 		err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1943 		goto out;
1944 	}
1945 
1946 	if (dev == NULL)
1947 		goto out;
1948 
1949 	neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1950 	if (neigh == NULL) {
1951 		err = -ENOENT;
1952 		goto out;
1953 	}
1954 
1955 	err = __neigh_update(neigh, NULL, NUD_FAILED,
1956 			     NEIGH_UPDATE_F_OVERRIDE | NEIGH_UPDATE_F_ADMIN,
1957 			     NETLINK_CB(skb).portid, extack);
1958 	write_lock_bh(&tbl->lock);
1959 	neigh_release(neigh);
1960 	neigh_remove_one(neigh, tbl);
1961 	write_unlock_bh(&tbl->lock);
1962 
1963 out:
1964 	return err;
1965 }
1966 
neigh_add(struct sk_buff * skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)1967 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1968 		     struct netlink_ext_ack *extack)
1969 {
1970 	int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE |
1971 		    NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1972 	struct net *net = sock_net(skb->sk);
1973 	struct ndmsg *ndm;
1974 	struct nlattr *tb[NDA_MAX+1];
1975 	struct neigh_table *tbl;
1976 	struct net_device *dev = NULL;
1977 	struct neighbour *neigh;
1978 	void *dst, *lladdr;
1979 	u8 protocol = 0;
1980 	u32 ndm_flags;
1981 	int err;
1982 
1983 	ASSERT_RTNL();
1984 	err = nlmsg_parse_deprecated(nlh, sizeof(*ndm), tb, NDA_MAX,
1985 				     nda_policy, extack);
1986 	if (err < 0)
1987 		goto out;
1988 
1989 	err = -EINVAL;
1990 	if (!tb[NDA_DST]) {
1991 		NL_SET_ERR_MSG(extack, "Network address not specified");
1992 		goto out;
1993 	}
1994 
1995 	ndm = nlmsg_data(nlh);
1996 	ndm_flags = ndm->ndm_flags;
1997 	if (tb[NDA_FLAGS_EXT]) {
1998 		u32 ext = nla_get_u32(tb[NDA_FLAGS_EXT]);
1999 
2000 		BUILD_BUG_ON(sizeof(neigh->flags) * BITS_PER_BYTE <
2001 			     (sizeof(ndm->ndm_flags) * BITS_PER_BYTE +
2002 			      hweight32(NTF_EXT_MASK)));
2003 		ndm_flags |= (ext << NTF_EXT_SHIFT);
2004 	}
2005 	if (ndm->ndm_ifindex) {
2006 		dev = __dev_get_by_index(net, ndm->ndm_ifindex);
2007 		if (dev == NULL) {
2008 			err = -ENODEV;
2009 			goto out;
2010 		}
2011 
2012 		if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len) {
2013 			NL_SET_ERR_MSG(extack, "Invalid link address");
2014 			goto out;
2015 		}
2016 	}
2017 
2018 	tbl = neigh_find_table(ndm->ndm_family);
2019 	if (tbl == NULL)
2020 		return -EAFNOSUPPORT;
2021 
2022 	if (nla_len(tb[NDA_DST]) < (int)tbl->key_len) {
2023 		NL_SET_ERR_MSG(extack, "Invalid network address");
2024 		goto out;
2025 	}
2026 
2027 	dst = nla_data(tb[NDA_DST]);
2028 	lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
2029 
2030 	if (tb[NDA_PROTOCOL])
2031 		protocol = nla_get_u8(tb[NDA_PROTOCOL]);
2032 	if (ndm_flags & NTF_PROXY) {
2033 		struct pneigh_entry *pn;
2034 
2035 		if (ndm_flags & NTF_MANAGED) {
2036 			NL_SET_ERR_MSG(extack, "Invalid NTF_* flag combination");
2037 			goto out;
2038 		}
2039 
2040 		err = -ENOBUFS;
2041 		pn = pneigh_lookup(tbl, net, dst, dev, 1);
2042 		if (pn) {
2043 			pn->flags = ndm_flags;
2044 			if (protocol)
2045 				pn->protocol = protocol;
2046 			err = 0;
2047 		}
2048 		goto out;
2049 	}
2050 
2051 	if (!dev) {
2052 		NL_SET_ERR_MSG(extack, "Device not specified");
2053 		goto out;
2054 	}
2055 
2056 	if (tbl->allow_add && !tbl->allow_add(dev, extack)) {
2057 		err = -EINVAL;
2058 		goto out;
2059 	}
2060 
2061 	neigh = neigh_lookup(tbl, dst, dev);
2062 	if (neigh == NULL) {
2063 		bool ndm_permanent  = ndm->ndm_state & NUD_PERMANENT;
2064 		bool exempt_from_gc = ndm_permanent ||
2065 				      ndm_flags & NTF_EXT_LEARNED;
2066 
2067 		if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
2068 			err = -ENOENT;
2069 			goto out;
2070 		}
2071 		if (ndm_permanent && (ndm_flags & NTF_MANAGED)) {
2072 			NL_SET_ERR_MSG(extack, "Invalid NTF_* flag for permanent entry");
2073 			err = -EINVAL;
2074 			goto out;
2075 		}
2076 
2077 		neigh = ___neigh_create(tbl, dst, dev,
2078 					ndm_flags &
2079 					(NTF_EXT_LEARNED | NTF_MANAGED),
2080 					exempt_from_gc, true);
2081 		if (IS_ERR(neigh)) {
2082 			err = PTR_ERR(neigh);
2083 			goto out;
2084 		}
2085 	} else {
2086 		if (nlh->nlmsg_flags & NLM_F_EXCL) {
2087 			err = -EEXIST;
2088 			neigh_release(neigh);
2089 			goto out;
2090 		}
2091 
2092 		if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
2093 			flags &= ~(NEIGH_UPDATE_F_OVERRIDE |
2094 				   NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
2095 	}
2096 
2097 	if (protocol)
2098 		neigh->protocol = protocol;
2099 	if (ndm_flags & NTF_EXT_LEARNED)
2100 		flags |= NEIGH_UPDATE_F_EXT_LEARNED;
2101 	if (ndm_flags & NTF_ROUTER)
2102 		flags |= NEIGH_UPDATE_F_ISROUTER;
2103 	if (ndm_flags & NTF_MANAGED)
2104 		flags |= NEIGH_UPDATE_F_MANAGED;
2105 	if (ndm_flags & NTF_USE)
2106 		flags |= NEIGH_UPDATE_F_USE;
2107 
2108 	err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags,
2109 			     NETLINK_CB(skb).portid, extack);
2110 	if (!err && ndm_flags & (NTF_USE | NTF_MANAGED)) {
2111 		neigh_event_send(neigh, NULL);
2112 		err = 0;
2113 	}
2114 	neigh_release(neigh);
2115 out:
2116 	return err;
2117 }
2118 
neightbl_fill_parms(struct sk_buff * skb,struct neigh_parms * parms)2119 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
2120 {
2121 	struct nlattr *nest;
2122 
2123 	nest = nla_nest_start_noflag(skb, NDTA_PARMS);
2124 	if (nest == NULL)
2125 		return -ENOBUFS;
2126 
2127 	if ((parms->dev &&
2128 	     nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
2129 	    nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
2130 	    nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
2131 			NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
2132 	    /* approximative value for deprecated QUEUE_LEN (in packets) */
2133 	    nla_put_u32(skb, NDTPA_QUEUE_LEN,
2134 			NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
2135 	    nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
2136 	    nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
2137 	    nla_put_u32(skb, NDTPA_UCAST_PROBES,
2138 			NEIGH_VAR(parms, UCAST_PROBES)) ||
2139 	    nla_put_u32(skb, NDTPA_MCAST_PROBES,
2140 			NEIGH_VAR(parms, MCAST_PROBES)) ||
2141 	    nla_put_u32(skb, NDTPA_MCAST_REPROBES,
2142 			NEIGH_VAR(parms, MCAST_REPROBES)) ||
2143 	    nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
2144 			  NDTPA_PAD) ||
2145 	    nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
2146 			  NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
2147 	    nla_put_msecs(skb, NDTPA_GC_STALETIME,
2148 			  NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
2149 	    nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
2150 			  NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
2151 	    nla_put_msecs(skb, NDTPA_RETRANS_TIME,
2152 			  NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
2153 	    nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
2154 			  NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
2155 	    nla_put_msecs(skb, NDTPA_PROXY_DELAY,
2156 			  NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
2157 	    nla_put_msecs(skb, NDTPA_LOCKTIME,
2158 			  NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD) ||
2159 	    nla_put_msecs(skb, NDTPA_INTERVAL_PROBE_TIME_MS,
2160 			  NEIGH_VAR(parms, INTERVAL_PROBE_TIME_MS), NDTPA_PAD))
2161 		goto nla_put_failure;
2162 	return nla_nest_end(skb, nest);
2163 
2164 nla_put_failure:
2165 	nla_nest_cancel(skb, nest);
2166 	return -EMSGSIZE;
2167 }
2168 
neightbl_fill_info(struct sk_buff * skb,struct neigh_table * tbl,u32 pid,u32 seq,int type,int flags)2169 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
2170 			      u32 pid, u32 seq, int type, int flags)
2171 {
2172 	struct nlmsghdr *nlh;
2173 	struct ndtmsg *ndtmsg;
2174 
2175 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2176 	if (nlh == NULL)
2177 		return -EMSGSIZE;
2178 
2179 	ndtmsg = nlmsg_data(nlh);
2180 
2181 	read_lock_bh(&tbl->lock);
2182 	ndtmsg->ndtm_family = tbl->family;
2183 	ndtmsg->ndtm_pad1   = 0;
2184 	ndtmsg->ndtm_pad2   = 0;
2185 
2186 	if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
2187 	    nla_put_msecs(skb, NDTA_GC_INTERVAL, READ_ONCE(tbl->gc_interval),
2188 			  NDTA_PAD) ||
2189 	    nla_put_u32(skb, NDTA_THRESH1, READ_ONCE(tbl->gc_thresh1)) ||
2190 	    nla_put_u32(skb, NDTA_THRESH2, READ_ONCE(tbl->gc_thresh2)) ||
2191 	    nla_put_u32(skb, NDTA_THRESH3, READ_ONCE(tbl->gc_thresh3)))
2192 		goto nla_put_failure;
2193 	{
2194 		unsigned long now = jiffies;
2195 		long flush_delta = now - READ_ONCE(tbl->last_flush);
2196 		long rand_delta = now - READ_ONCE(tbl->last_rand);
2197 		struct neigh_hash_table *nht;
2198 		struct ndt_config ndc = {
2199 			.ndtc_key_len		= tbl->key_len,
2200 			.ndtc_entry_size	= tbl->entry_size,
2201 			.ndtc_entries		= atomic_read(&tbl->entries),
2202 			.ndtc_last_flush	= jiffies_to_msecs(flush_delta),
2203 			.ndtc_last_rand		= jiffies_to_msecs(rand_delta),
2204 			.ndtc_proxy_qlen	= READ_ONCE(tbl->proxy_queue.qlen),
2205 		};
2206 
2207 		rcu_read_lock();
2208 		nht = rcu_dereference(tbl->nht);
2209 		ndc.ndtc_hash_rnd = nht->hash_rnd[0];
2210 		ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
2211 		rcu_read_unlock();
2212 
2213 		if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
2214 			goto nla_put_failure;
2215 	}
2216 
2217 	{
2218 		int cpu;
2219 		struct ndt_stats ndst;
2220 
2221 		memset(&ndst, 0, sizeof(ndst));
2222 
2223 		for_each_possible_cpu(cpu) {
2224 			struct neigh_statistics	*st;
2225 
2226 			st = per_cpu_ptr(tbl->stats, cpu);
2227 			ndst.ndts_allocs		+= READ_ONCE(st->allocs);
2228 			ndst.ndts_destroys		+= READ_ONCE(st->destroys);
2229 			ndst.ndts_hash_grows		+= READ_ONCE(st->hash_grows);
2230 			ndst.ndts_res_failed		+= READ_ONCE(st->res_failed);
2231 			ndst.ndts_lookups		+= READ_ONCE(st->lookups);
2232 			ndst.ndts_hits			+= READ_ONCE(st->hits);
2233 			ndst.ndts_rcv_probes_mcast	+= READ_ONCE(st->rcv_probes_mcast);
2234 			ndst.ndts_rcv_probes_ucast	+= READ_ONCE(st->rcv_probes_ucast);
2235 			ndst.ndts_periodic_gc_runs	+= READ_ONCE(st->periodic_gc_runs);
2236 			ndst.ndts_forced_gc_runs	+= READ_ONCE(st->forced_gc_runs);
2237 			ndst.ndts_table_fulls		+= READ_ONCE(st->table_fulls);
2238 		}
2239 
2240 		if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
2241 				  NDTA_PAD))
2242 			goto nla_put_failure;
2243 	}
2244 
2245 	BUG_ON(tbl->parms.dev);
2246 	if (neightbl_fill_parms(skb, &tbl->parms) < 0)
2247 		goto nla_put_failure;
2248 
2249 	read_unlock_bh(&tbl->lock);
2250 	nlmsg_end(skb, nlh);
2251 	return 0;
2252 
2253 nla_put_failure:
2254 	read_unlock_bh(&tbl->lock);
2255 	nlmsg_cancel(skb, nlh);
2256 	return -EMSGSIZE;
2257 }
2258 
neightbl_fill_param_info(struct sk_buff * skb,struct neigh_table * tbl,struct neigh_parms * parms,u32 pid,u32 seq,int type,unsigned int flags)2259 static int neightbl_fill_param_info(struct sk_buff *skb,
2260 				    struct neigh_table *tbl,
2261 				    struct neigh_parms *parms,
2262 				    u32 pid, u32 seq, int type,
2263 				    unsigned int flags)
2264 {
2265 	struct ndtmsg *ndtmsg;
2266 	struct nlmsghdr *nlh;
2267 
2268 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2269 	if (nlh == NULL)
2270 		return -EMSGSIZE;
2271 
2272 	ndtmsg = nlmsg_data(nlh);
2273 
2274 	read_lock_bh(&tbl->lock);
2275 	ndtmsg->ndtm_family = tbl->family;
2276 	ndtmsg->ndtm_pad1   = 0;
2277 	ndtmsg->ndtm_pad2   = 0;
2278 
2279 	if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
2280 	    neightbl_fill_parms(skb, parms) < 0)
2281 		goto errout;
2282 
2283 	read_unlock_bh(&tbl->lock);
2284 	nlmsg_end(skb, nlh);
2285 	return 0;
2286 errout:
2287 	read_unlock_bh(&tbl->lock);
2288 	nlmsg_cancel(skb, nlh);
2289 	return -EMSGSIZE;
2290 }
2291 
2292 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
2293 	[NDTA_NAME]		= { .type = NLA_STRING },
2294 	[NDTA_THRESH1]		= { .type = NLA_U32 },
2295 	[NDTA_THRESH2]		= { .type = NLA_U32 },
2296 	[NDTA_THRESH3]		= { .type = NLA_U32 },
2297 	[NDTA_GC_INTERVAL]	= { .type = NLA_U64 },
2298 	[NDTA_PARMS]		= { .type = NLA_NESTED },
2299 };
2300 
2301 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
2302 	[NDTPA_IFINDEX]			= { .type = NLA_U32 },
2303 	[NDTPA_QUEUE_LEN]		= { .type = NLA_U32 },
2304 	[NDTPA_PROXY_QLEN]		= { .type = NLA_U32 },
2305 	[NDTPA_APP_PROBES]		= { .type = NLA_U32 },
2306 	[NDTPA_UCAST_PROBES]		= { .type = NLA_U32 },
2307 	[NDTPA_MCAST_PROBES]		= { .type = NLA_U32 },
2308 	[NDTPA_MCAST_REPROBES]		= { .type = NLA_U32 },
2309 	[NDTPA_BASE_REACHABLE_TIME]	= { .type = NLA_U64 },
2310 	[NDTPA_GC_STALETIME]		= { .type = NLA_U64 },
2311 	[NDTPA_DELAY_PROBE_TIME]	= { .type = NLA_U64 },
2312 	[NDTPA_RETRANS_TIME]		= { .type = NLA_U64 },
2313 	[NDTPA_ANYCAST_DELAY]		= { .type = NLA_U64 },
2314 	[NDTPA_PROXY_DELAY]		= { .type = NLA_U64 },
2315 	[NDTPA_LOCKTIME]		= { .type = NLA_U64 },
2316 	[NDTPA_INTERVAL_PROBE_TIME_MS]	= { .type = NLA_U64, .min = 1 },
2317 };
2318 
neightbl_set(struct sk_buff * skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)2319 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
2320 			struct netlink_ext_ack *extack)
2321 {
2322 	struct net *net = sock_net(skb->sk);
2323 	struct neigh_table *tbl;
2324 	struct ndtmsg *ndtmsg;
2325 	struct nlattr *tb[NDTA_MAX+1];
2326 	bool found = false;
2327 	int err, tidx;
2328 
2329 	err = nlmsg_parse_deprecated(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
2330 				     nl_neightbl_policy, extack);
2331 	if (err < 0)
2332 		goto errout;
2333 
2334 	if (tb[NDTA_NAME] == NULL) {
2335 		err = -EINVAL;
2336 		goto errout;
2337 	}
2338 
2339 	ndtmsg = nlmsg_data(nlh);
2340 
2341 	for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2342 		tbl = rcu_dereference_rtnl(neigh_tables[tidx]);
2343 		if (!tbl)
2344 			continue;
2345 		if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2346 			continue;
2347 		if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2348 			found = true;
2349 			break;
2350 		}
2351 	}
2352 
2353 	if (!found)
2354 		return -ENOENT;
2355 
2356 	/*
2357 	 * We acquire tbl->lock to be nice to the periodic timers and
2358 	 * make sure they always see a consistent set of values.
2359 	 */
2360 	write_lock_bh(&tbl->lock);
2361 
2362 	if (tb[NDTA_PARMS]) {
2363 		struct nlattr *tbp[NDTPA_MAX+1];
2364 		struct neigh_parms *p;
2365 		int i, ifindex = 0;
2366 
2367 		err = nla_parse_nested_deprecated(tbp, NDTPA_MAX,
2368 						  tb[NDTA_PARMS],
2369 						  nl_ntbl_parm_policy, extack);
2370 		if (err < 0)
2371 			goto errout_tbl_lock;
2372 
2373 		if (tbp[NDTPA_IFINDEX])
2374 			ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2375 
2376 		p = lookup_neigh_parms(tbl, net, ifindex);
2377 		if (p == NULL) {
2378 			err = -ENOENT;
2379 			goto errout_tbl_lock;
2380 		}
2381 
2382 		for (i = 1; i <= NDTPA_MAX; i++) {
2383 			if (tbp[i] == NULL)
2384 				continue;
2385 
2386 			switch (i) {
2387 			case NDTPA_QUEUE_LEN:
2388 				NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2389 					      nla_get_u32(tbp[i]) *
2390 					      SKB_TRUESIZE(ETH_FRAME_LEN));
2391 				break;
2392 			case NDTPA_QUEUE_LENBYTES:
2393 				NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2394 					      nla_get_u32(tbp[i]));
2395 				break;
2396 			case NDTPA_PROXY_QLEN:
2397 				NEIGH_VAR_SET(p, PROXY_QLEN,
2398 					      nla_get_u32(tbp[i]));
2399 				break;
2400 			case NDTPA_APP_PROBES:
2401 				NEIGH_VAR_SET(p, APP_PROBES,
2402 					      nla_get_u32(tbp[i]));
2403 				break;
2404 			case NDTPA_UCAST_PROBES:
2405 				NEIGH_VAR_SET(p, UCAST_PROBES,
2406 					      nla_get_u32(tbp[i]));
2407 				break;
2408 			case NDTPA_MCAST_PROBES:
2409 				NEIGH_VAR_SET(p, MCAST_PROBES,
2410 					      nla_get_u32(tbp[i]));
2411 				break;
2412 			case NDTPA_MCAST_REPROBES:
2413 				NEIGH_VAR_SET(p, MCAST_REPROBES,
2414 					      nla_get_u32(tbp[i]));
2415 				break;
2416 			case NDTPA_BASE_REACHABLE_TIME:
2417 				NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2418 					      nla_get_msecs(tbp[i]));
2419 				/* update reachable_time as well, otherwise, the change will
2420 				 * only be effective after the next time neigh_periodic_work
2421 				 * decides to recompute it (can be multiple minutes)
2422 				 */
2423 				p->reachable_time =
2424 					neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2425 				break;
2426 			case NDTPA_GC_STALETIME:
2427 				NEIGH_VAR_SET(p, GC_STALETIME,
2428 					      nla_get_msecs(tbp[i]));
2429 				break;
2430 			case NDTPA_DELAY_PROBE_TIME:
2431 				NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2432 					      nla_get_msecs(tbp[i]));
2433 				call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2434 				break;
2435 			case NDTPA_INTERVAL_PROBE_TIME_MS:
2436 				NEIGH_VAR_SET(p, INTERVAL_PROBE_TIME_MS,
2437 					      nla_get_msecs(tbp[i]));
2438 				break;
2439 			case NDTPA_RETRANS_TIME:
2440 				NEIGH_VAR_SET(p, RETRANS_TIME,
2441 					      nla_get_msecs(tbp[i]));
2442 				break;
2443 			case NDTPA_ANYCAST_DELAY:
2444 				NEIGH_VAR_SET(p, ANYCAST_DELAY,
2445 					      nla_get_msecs(tbp[i]));
2446 				break;
2447 			case NDTPA_PROXY_DELAY:
2448 				NEIGH_VAR_SET(p, PROXY_DELAY,
2449 					      nla_get_msecs(tbp[i]));
2450 				break;
2451 			case NDTPA_LOCKTIME:
2452 				NEIGH_VAR_SET(p, LOCKTIME,
2453 					      nla_get_msecs(tbp[i]));
2454 				break;
2455 			}
2456 		}
2457 	}
2458 
2459 	err = -ENOENT;
2460 	if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2461 	     tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2462 	    !net_eq(net, &init_net))
2463 		goto errout_tbl_lock;
2464 
2465 	if (tb[NDTA_THRESH1])
2466 		WRITE_ONCE(tbl->gc_thresh1, nla_get_u32(tb[NDTA_THRESH1]));
2467 
2468 	if (tb[NDTA_THRESH2])
2469 		WRITE_ONCE(tbl->gc_thresh2, nla_get_u32(tb[NDTA_THRESH2]));
2470 
2471 	if (tb[NDTA_THRESH3])
2472 		WRITE_ONCE(tbl->gc_thresh3, nla_get_u32(tb[NDTA_THRESH3]));
2473 
2474 	if (tb[NDTA_GC_INTERVAL])
2475 		WRITE_ONCE(tbl->gc_interval, nla_get_msecs(tb[NDTA_GC_INTERVAL]));
2476 
2477 	err = 0;
2478 
2479 errout_tbl_lock:
2480 	write_unlock_bh(&tbl->lock);
2481 errout:
2482 	return err;
2483 }
2484 
neightbl_valid_dump_info(const struct nlmsghdr * nlh,struct netlink_ext_ack * extack)2485 static int neightbl_valid_dump_info(const struct nlmsghdr *nlh,
2486 				    struct netlink_ext_ack *extack)
2487 {
2488 	struct ndtmsg *ndtm;
2489 
2490 	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndtm))) {
2491 		NL_SET_ERR_MSG(extack, "Invalid header for neighbor table dump request");
2492 		return -EINVAL;
2493 	}
2494 
2495 	ndtm = nlmsg_data(nlh);
2496 	if (ndtm->ndtm_pad1  || ndtm->ndtm_pad2) {
2497 		NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor table dump request");
2498 		return -EINVAL;
2499 	}
2500 
2501 	if (nlmsg_attrlen(nlh, sizeof(*ndtm))) {
2502 		NL_SET_ERR_MSG(extack, "Invalid data after header in neighbor table dump request");
2503 		return -EINVAL;
2504 	}
2505 
2506 	return 0;
2507 }
2508 
neightbl_dump_info(struct sk_buff * skb,struct netlink_callback * cb)2509 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2510 {
2511 	const struct nlmsghdr *nlh = cb->nlh;
2512 	struct net *net = sock_net(skb->sk);
2513 	int family, tidx, nidx = 0;
2514 	int tbl_skip = cb->args[0];
2515 	int neigh_skip = cb->args[1];
2516 	struct neigh_table *tbl;
2517 
2518 	if (cb->strict_check) {
2519 		int err = neightbl_valid_dump_info(nlh, cb->extack);
2520 
2521 		if (err < 0)
2522 			return err;
2523 	}
2524 
2525 	family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2526 
2527 	for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2528 		struct neigh_parms *p;
2529 
2530 		tbl = rcu_dereference_rtnl(neigh_tables[tidx]);
2531 		if (!tbl)
2532 			continue;
2533 
2534 		if (tidx < tbl_skip || (family && tbl->family != family))
2535 			continue;
2536 
2537 		if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2538 				       nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2539 				       NLM_F_MULTI) < 0)
2540 			break;
2541 
2542 		nidx = 0;
2543 		p = list_next_entry(&tbl->parms, list);
2544 		list_for_each_entry_from(p, &tbl->parms_list, list) {
2545 			if (!net_eq(neigh_parms_net(p), net))
2546 				continue;
2547 
2548 			if (nidx < neigh_skip)
2549 				goto next;
2550 
2551 			if (neightbl_fill_param_info(skb, tbl, p,
2552 						     NETLINK_CB(cb->skb).portid,
2553 						     nlh->nlmsg_seq,
2554 						     RTM_NEWNEIGHTBL,
2555 						     NLM_F_MULTI) < 0)
2556 				goto out;
2557 		next:
2558 			nidx++;
2559 		}
2560 
2561 		neigh_skip = 0;
2562 	}
2563 out:
2564 	cb->args[0] = tidx;
2565 	cb->args[1] = nidx;
2566 
2567 	return skb->len;
2568 }
2569 
neigh_fill_info(struct sk_buff * skb,struct neighbour * neigh,u32 pid,u32 seq,int type,unsigned int flags)2570 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2571 			   u32 pid, u32 seq, int type, unsigned int flags)
2572 {
2573 	u32 neigh_flags, neigh_flags_ext;
2574 	unsigned long now = jiffies;
2575 	struct nda_cacheinfo ci;
2576 	struct nlmsghdr *nlh;
2577 	struct ndmsg *ndm;
2578 
2579 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2580 	if (nlh == NULL)
2581 		return -EMSGSIZE;
2582 
2583 	neigh_flags_ext = neigh->flags >> NTF_EXT_SHIFT;
2584 	neigh_flags     = neigh->flags & NTF_OLD_MASK;
2585 
2586 	ndm = nlmsg_data(nlh);
2587 	ndm->ndm_family	 = neigh->ops->family;
2588 	ndm->ndm_pad1    = 0;
2589 	ndm->ndm_pad2    = 0;
2590 	ndm->ndm_flags	 = neigh_flags;
2591 	ndm->ndm_type	 = neigh->type;
2592 	ndm->ndm_ifindex = neigh->dev->ifindex;
2593 
2594 	if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2595 		goto nla_put_failure;
2596 
2597 	read_lock_bh(&neigh->lock);
2598 	ndm->ndm_state	 = neigh->nud_state;
2599 	if (neigh->nud_state & NUD_VALID) {
2600 		char haddr[MAX_ADDR_LEN];
2601 
2602 		neigh_ha_snapshot(haddr, neigh, neigh->dev);
2603 		if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2604 			read_unlock_bh(&neigh->lock);
2605 			goto nla_put_failure;
2606 		}
2607 	}
2608 
2609 	ci.ndm_used	 = jiffies_to_clock_t(now - neigh->used);
2610 	ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2611 	ci.ndm_updated	 = jiffies_to_clock_t(now - neigh->updated);
2612 	ci.ndm_refcnt	 = refcount_read(&neigh->refcnt) - 1;
2613 	read_unlock_bh(&neigh->lock);
2614 
2615 	if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2616 	    nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2617 		goto nla_put_failure;
2618 
2619 	if (neigh->protocol && nla_put_u8(skb, NDA_PROTOCOL, neigh->protocol))
2620 		goto nla_put_failure;
2621 	if (neigh_flags_ext && nla_put_u32(skb, NDA_FLAGS_EXT, neigh_flags_ext))
2622 		goto nla_put_failure;
2623 
2624 	nlmsg_end(skb, nlh);
2625 	return 0;
2626 
2627 nla_put_failure:
2628 	nlmsg_cancel(skb, nlh);
2629 	return -EMSGSIZE;
2630 }
2631 
pneigh_fill_info(struct sk_buff * skb,struct pneigh_entry * pn,u32 pid,u32 seq,int type,unsigned int flags,struct neigh_table * tbl)2632 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2633 			    u32 pid, u32 seq, int type, unsigned int flags,
2634 			    struct neigh_table *tbl)
2635 {
2636 	u32 neigh_flags, neigh_flags_ext;
2637 	struct nlmsghdr *nlh;
2638 	struct ndmsg *ndm;
2639 
2640 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2641 	if (nlh == NULL)
2642 		return -EMSGSIZE;
2643 
2644 	neigh_flags_ext = pn->flags >> NTF_EXT_SHIFT;
2645 	neigh_flags     = pn->flags & NTF_OLD_MASK;
2646 
2647 	ndm = nlmsg_data(nlh);
2648 	ndm->ndm_family	 = tbl->family;
2649 	ndm->ndm_pad1    = 0;
2650 	ndm->ndm_pad2    = 0;
2651 	ndm->ndm_flags	 = neigh_flags | NTF_PROXY;
2652 	ndm->ndm_type	 = RTN_UNICAST;
2653 	ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2654 	ndm->ndm_state	 = NUD_NONE;
2655 
2656 	if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2657 		goto nla_put_failure;
2658 
2659 	if (pn->protocol && nla_put_u8(skb, NDA_PROTOCOL, pn->protocol))
2660 		goto nla_put_failure;
2661 	if (neigh_flags_ext && nla_put_u32(skb, NDA_FLAGS_EXT, neigh_flags_ext))
2662 		goto nla_put_failure;
2663 
2664 	nlmsg_end(skb, nlh);
2665 	return 0;
2666 
2667 nla_put_failure:
2668 	nlmsg_cancel(skb, nlh);
2669 	return -EMSGSIZE;
2670 }
2671 
neigh_update_notify(struct neighbour * neigh,u32 nlmsg_pid)2672 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2673 {
2674 	call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2675 	__neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2676 }
2677 
neigh_master_filtered(struct net_device * dev,int master_idx)2678 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2679 {
2680 	struct net_device *master;
2681 
2682 	if (!master_idx)
2683 		return false;
2684 
2685 	master = dev ? netdev_master_upper_dev_get_rcu(dev) : NULL;
2686 
2687 	/* 0 is already used to denote NDA_MASTER wasn't passed, therefore need another
2688 	 * invalid value for ifindex to denote "no master".
2689 	 */
2690 	if (master_idx == -1)
2691 		return !!master;
2692 
2693 	if (!master || master->ifindex != master_idx)
2694 		return true;
2695 
2696 	return false;
2697 }
2698 
neigh_ifindex_filtered(struct net_device * dev,int filter_idx)2699 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2700 {
2701 	if (filter_idx && (!dev || dev->ifindex != filter_idx))
2702 		return true;
2703 
2704 	return false;
2705 }
2706 
2707 struct neigh_dump_filter {
2708 	int master_idx;
2709 	int dev_idx;
2710 };
2711 
neigh_dump_table(struct neigh_table * tbl,struct sk_buff * skb,struct netlink_callback * cb,struct neigh_dump_filter * filter)2712 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2713 			    struct netlink_callback *cb,
2714 			    struct neigh_dump_filter *filter)
2715 {
2716 	struct net *net = sock_net(skb->sk);
2717 	struct neighbour *n;
2718 	int err = 0, h, s_h = cb->args[1];
2719 	int idx, s_idx = idx = cb->args[2];
2720 	struct neigh_hash_table *nht;
2721 	unsigned int flags = NLM_F_MULTI;
2722 
2723 	if (filter->dev_idx || filter->master_idx)
2724 		flags |= NLM_F_DUMP_FILTERED;
2725 
2726 	nht = rcu_dereference(tbl->nht);
2727 
2728 	for (h = s_h; h < (1 << nht->hash_shift); h++) {
2729 		if (h > s_h)
2730 			s_idx = 0;
2731 		for (n = rcu_dereference(nht->hash_buckets[h]), idx = 0;
2732 		     n != NULL;
2733 		     n = rcu_dereference(n->next)) {
2734 			if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2735 				goto next;
2736 			if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2737 			    neigh_master_filtered(n->dev, filter->master_idx))
2738 				goto next;
2739 			err = neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2740 					      cb->nlh->nlmsg_seq,
2741 					      RTM_NEWNEIGH, flags);
2742 			if (err < 0)
2743 				goto out;
2744 next:
2745 			idx++;
2746 		}
2747 	}
2748 out:
2749 	cb->args[1] = h;
2750 	cb->args[2] = idx;
2751 	return err;
2752 }
2753 
pneigh_dump_table(struct neigh_table * tbl,struct sk_buff * skb,struct netlink_callback * cb,struct neigh_dump_filter * filter)2754 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2755 			     struct netlink_callback *cb,
2756 			     struct neigh_dump_filter *filter)
2757 {
2758 	struct pneigh_entry *n;
2759 	struct net *net = sock_net(skb->sk);
2760 	int err = 0, h, s_h = cb->args[3];
2761 	int idx, s_idx = idx = cb->args[4];
2762 	unsigned int flags = NLM_F_MULTI;
2763 
2764 	if (filter->dev_idx || filter->master_idx)
2765 		flags |= NLM_F_DUMP_FILTERED;
2766 
2767 	read_lock_bh(&tbl->lock);
2768 
2769 	for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2770 		if (h > s_h)
2771 			s_idx = 0;
2772 		for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2773 			if (idx < s_idx || pneigh_net(n) != net)
2774 				goto next;
2775 			if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2776 			    neigh_master_filtered(n->dev, filter->master_idx))
2777 				goto next;
2778 			err = pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2779 					       cb->nlh->nlmsg_seq,
2780 					       RTM_NEWNEIGH, flags, tbl);
2781 			if (err < 0) {
2782 				read_unlock_bh(&tbl->lock);
2783 				goto out;
2784 			}
2785 		next:
2786 			idx++;
2787 		}
2788 	}
2789 
2790 	read_unlock_bh(&tbl->lock);
2791 out:
2792 	cb->args[3] = h;
2793 	cb->args[4] = idx;
2794 	return err;
2795 }
2796 
neigh_valid_dump_req(const struct nlmsghdr * nlh,bool strict_check,struct neigh_dump_filter * filter,struct netlink_ext_ack * extack)2797 static int neigh_valid_dump_req(const struct nlmsghdr *nlh,
2798 				bool strict_check,
2799 				struct neigh_dump_filter *filter,
2800 				struct netlink_ext_ack *extack)
2801 {
2802 	struct nlattr *tb[NDA_MAX + 1];
2803 	int err, i;
2804 
2805 	if (strict_check) {
2806 		struct ndmsg *ndm;
2807 
2808 		if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2809 			NL_SET_ERR_MSG(extack, "Invalid header for neighbor dump request");
2810 			return -EINVAL;
2811 		}
2812 
2813 		ndm = nlmsg_data(nlh);
2814 		if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_ifindex ||
2815 		    ndm->ndm_state || ndm->ndm_type) {
2816 			NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor dump request");
2817 			return -EINVAL;
2818 		}
2819 
2820 		if (ndm->ndm_flags & ~NTF_PROXY) {
2821 			NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor dump request");
2822 			return -EINVAL;
2823 		}
2824 
2825 		err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg),
2826 						    tb, NDA_MAX, nda_policy,
2827 						    extack);
2828 	} else {
2829 		err = nlmsg_parse_deprecated(nlh, sizeof(struct ndmsg), tb,
2830 					     NDA_MAX, nda_policy, extack);
2831 	}
2832 	if (err < 0)
2833 		return err;
2834 
2835 	for (i = 0; i <= NDA_MAX; ++i) {
2836 		if (!tb[i])
2837 			continue;
2838 
2839 		/* all new attributes should require strict_check */
2840 		switch (i) {
2841 		case NDA_IFINDEX:
2842 			filter->dev_idx = nla_get_u32(tb[i]);
2843 			break;
2844 		case NDA_MASTER:
2845 			filter->master_idx = nla_get_u32(tb[i]);
2846 			break;
2847 		default:
2848 			if (strict_check) {
2849 				NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor dump request");
2850 				return -EINVAL;
2851 			}
2852 		}
2853 	}
2854 
2855 	return 0;
2856 }
2857 
neigh_dump_info(struct sk_buff * skb,struct netlink_callback * cb)2858 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2859 {
2860 	const struct nlmsghdr *nlh = cb->nlh;
2861 	struct neigh_dump_filter filter = {};
2862 	struct neigh_table *tbl;
2863 	int t, family, s_t;
2864 	int proxy = 0;
2865 	int err;
2866 
2867 	family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2868 
2869 	/* check for full ndmsg structure presence, family member is
2870 	 * the same for both structures
2871 	 */
2872 	if (nlmsg_len(nlh) >= sizeof(struct ndmsg) &&
2873 	    ((struct ndmsg *)nlmsg_data(nlh))->ndm_flags == NTF_PROXY)
2874 		proxy = 1;
2875 
2876 	err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack);
2877 	if (err < 0 && cb->strict_check)
2878 		return err;
2879 
2880 	s_t = cb->args[0];
2881 
2882 	rcu_read_lock();
2883 	for (t = 0; t < NEIGH_NR_TABLES; t++) {
2884 		tbl = rcu_dereference(neigh_tables[t]);
2885 
2886 		if (!tbl)
2887 			continue;
2888 		if (t < s_t || (family && tbl->family != family))
2889 			continue;
2890 		if (t > s_t)
2891 			memset(&cb->args[1], 0, sizeof(cb->args) -
2892 						sizeof(cb->args[0]));
2893 		if (proxy)
2894 			err = pneigh_dump_table(tbl, skb, cb, &filter);
2895 		else
2896 			err = neigh_dump_table(tbl, skb, cb, &filter);
2897 		if (err < 0)
2898 			break;
2899 	}
2900 	rcu_read_unlock();
2901 
2902 	cb->args[0] = t;
2903 	return err;
2904 }
2905 
neigh_valid_get_req(const struct nlmsghdr * nlh,struct neigh_table ** tbl,void ** dst,int * dev_idx,u8 * ndm_flags,struct netlink_ext_ack * extack)2906 static int neigh_valid_get_req(const struct nlmsghdr *nlh,
2907 			       struct neigh_table **tbl,
2908 			       void **dst, int *dev_idx, u8 *ndm_flags,
2909 			       struct netlink_ext_ack *extack)
2910 {
2911 	struct nlattr *tb[NDA_MAX + 1];
2912 	struct ndmsg *ndm;
2913 	int err, i;
2914 
2915 	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2916 		NL_SET_ERR_MSG(extack, "Invalid header for neighbor get request");
2917 		return -EINVAL;
2918 	}
2919 
2920 	ndm = nlmsg_data(nlh);
2921 	if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
2922 	    ndm->ndm_type) {
2923 		NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor get request");
2924 		return -EINVAL;
2925 	}
2926 
2927 	if (ndm->ndm_flags & ~NTF_PROXY) {
2928 		NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor get request");
2929 		return -EINVAL;
2930 	}
2931 
2932 	err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg), tb,
2933 					    NDA_MAX, nda_policy, extack);
2934 	if (err < 0)
2935 		return err;
2936 
2937 	*ndm_flags = ndm->ndm_flags;
2938 	*dev_idx = ndm->ndm_ifindex;
2939 	*tbl = neigh_find_table(ndm->ndm_family);
2940 	if (*tbl == NULL) {
2941 		NL_SET_ERR_MSG(extack, "Unsupported family in header for neighbor get request");
2942 		return -EAFNOSUPPORT;
2943 	}
2944 
2945 	for (i = 0; i <= NDA_MAX; ++i) {
2946 		if (!tb[i])
2947 			continue;
2948 
2949 		switch (i) {
2950 		case NDA_DST:
2951 			if (nla_len(tb[i]) != (int)(*tbl)->key_len) {
2952 				NL_SET_ERR_MSG(extack, "Invalid network address in neighbor get request");
2953 				return -EINVAL;
2954 			}
2955 			*dst = nla_data(tb[i]);
2956 			break;
2957 		default:
2958 			NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor get request");
2959 			return -EINVAL;
2960 		}
2961 	}
2962 
2963 	return 0;
2964 }
2965 
neigh_nlmsg_size(void)2966 static inline size_t neigh_nlmsg_size(void)
2967 {
2968 	return NLMSG_ALIGN(sizeof(struct ndmsg))
2969 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2970 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2971 	       + nla_total_size(sizeof(struct nda_cacheinfo))
2972 	       + nla_total_size(4)  /* NDA_PROBES */
2973 	       + nla_total_size(4)  /* NDA_FLAGS_EXT */
2974 	       + nla_total_size(1); /* NDA_PROTOCOL */
2975 }
2976 
neigh_get_reply(struct net * net,struct neighbour * neigh,u32 pid,u32 seq)2977 static int neigh_get_reply(struct net *net, struct neighbour *neigh,
2978 			   u32 pid, u32 seq)
2979 {
2980 	struct sk_buff *skb;
2981 	int err = 0;
2982 
2983 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_KERNEL);
2984 	if (!skb)
2985 		return -ENOBUFS;
2986 
2987 	err = neigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0);
2988 	if (err) {
2989 		kfree_skb(skb);
2990 		goto errout;
2991 	}
2992 
2993 	err = rtnl_unicast(skb, net, pid);
2994 errout:
2995 	return err;
2996 }
2997 
pneigh_nlmsg_size(void)2998 static inline size_t pneigh_nlmsg_size(void)
2999 {
3000 	return NLMSG_ALIGN(sizeof(struct ndmsg))
3001 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
3002 	       + nla_total_size(4)  /* NDA_FLAGS_EXT */
3003 	       + nla_total_size(1); /* NDA_PROTOCOL */
3004 }
3005 
pneigh_get_reply(struct net * net,struct pneigh_entry * neigh,u32 pid,u32 seq,struct neigh_table * tbl)3006 static int pneigh_get_reply(struct net *net, struct pneigh_entry *neigh,
3007 			    u32 pid, u32 seq, struct neigh_table *tbl)
3008 {
3009 	struct sk_buff *skb;
3010 	int err = 0;
3011 
3012 	skb = nlmsg_new(pneigh_nlmsg_size(), GFP_KERNEL);
3013 	if (!skb)
3014 		return -ENOBUFS;
3015 
3016 	err = pneigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0, tbl);
3017 	if (err) {
3018 		kfree_skb(skb);
3019 		goto errout;
3020 	}
3021 
3022 	err = rtnl_unicast(skb, net, pid);
3023 errout:
3024 	return err;
3025 }
3026 
neigh_get(struct sk_buff * in_skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)3027 static int neigh_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
3028 		     struct netlink_ext_ack *extack)
3029 {
3030 	struct net *net = sock_net(in_skb->sk);
3031 	struct net_device *dev = NULL;
3032 	struct neigh_table *tbl = NULL;
3033 	struct neighbour *neigh;
3034 	void *dst = NULL;
3035 	u8 ndm_flags = 0;
3036 	int dev_idx = 0;
3037 	int err;
3038 
3039 	err = neigh_valid_get_req(nlh, &tbl, &dst, &dev_idx, &ndm_flags,
3040 				  extack);
3041 	if (err < 0)
3042 		return err;
3043 
3044 	if (dev_idx) {
3045 		dev = __dev_get_by_index(net, dev_idx);
3046 		if (!dev) {
3047 			NL_SET_ERR_MSG(extack, "Unknown device ifindex");
3048 			return -ENODEV;
3049 		}
3050 	}
3051 
3052 	if (!dst) {
3053 		NL_SET_ERR_MSG(extack, "Network address not specified");
3054 		return -EINVAL;
3055 	}
3056 
3057 	if (ndm_flags & NTF_PROXY) {
3058 		struct pneigh_entry *pn;
3059 
3060 		pn = pneigh_lookup(tbl, net, dst, dev, 0);
3061 		if (!pn) {
3062 			NL_SET_ERR_MSG(extack, "Proxy neighbour entry not found");
3063 			return -ENOENT;
3064 		}
3065 		return pneigh_get_reply(net, pn, NETLINK_CB(in_skb).portid,
3066 					nlh->nlmsg_seq, tbl);
3067 	}
3068 
3069 	if (!dev) {
3070 		NL_SET_ERR_MSG(extack, "No device specified");
3071 		return -EINVAL;
3072 	}
3073 
3074 	neigh = neigh_lookup(tbl, dst, dev);
3075 	if (!neigh) {
3076 		NL_SET_ERR_MSG(extack, "Neighbour entry not found");
3077 		return -ENOENT;
3078 	}
3079 
3080 	err = neigh_get_reply(net, neigh, NETLINK_CB(in_skb).portid,
3081 			      nlh->nlmsg_seq);
3082 
3083 	neigh_release(neigh);
3084 
3085 	return err;
3086 }
3087 
neigh_for_each(struct neigh_table * tbl,void (* cb)(struct neighbour *,void *),void * cookie)3088 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
3089 {
3090 	int chain;
3091 	struct neigh_hash_table *nht;
3092 
3093 	rcu_read_lock();
3094 	nht = rcu_dereference(tbl->nht);
3095 
3096 	read_lock_bh(&tbl->lock); /* avoid resizes */
3097 	for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
3098 		struct neighbour *n;
3099 
3100 		for (n = rcu_dereference(nht->hash_buckets[chain]);
3101 		     n != NULL;
3102 		     n = rcu_dereference(n->next))
3103 			cb(n, cookie);
3104 	}
3105 	read_unlock_bh(&tbl->lock);
3106 	rcu_read_unlock();
3107 }
3108 EXPORT_SYMBOL(neigh_for_each);
3109 
3110 /* The tbl->lock must be held as a writer and BH disabled. */
__neigh_for_each_release(struct neigh_table * tbl,int (* cb)(struct neighbour *))3111 void __neigh_for_each_release(struct neigh_table *tbl,
3112 			      int (*cb)(struct neighbour *))
3113 {
3114 	int chain;
3115 	struct neigh_hash_table *nht;
3116 
3117 	nht = rcu_dereference_protected(tbl->nht,
3118 					lockdep_is_held(&tbl->lock));
3119 	for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
3120 		struct neighbour *n;
3121 		struct neighbour __rcu **np;
3122 
3123 		np = &nht->hash_buckets[chain];
3124 		while ((n = rcu_dereference_protected(*np,
3125 					lockdep_is_held(&tbl->lock))) != NULL) {
3126 			int release;
3127 
3128 			write_lock(&n->lock);
3129 			release = cb(n);
3130 			if (release) {
3131 				rcu_assign_pointer(*np,
3132 					rcu_dereference_protected(n->next,
3133 						lockdep_is_held(&tbl->lock)));
3134 				neigh_mark_dead(n);
3135 			} else
3136 				np = &n->next;
3137 			write_unlock(&n->lock);
3138 			if (release)
3139 				neigh_cleanup_and_release(n);
3140 		}
3141 	}
3142 }
3143 EXPORT_SYMBOL(__neigh_for_each_release);
3144 
neigh_xmit(int index,struct net_device * dev,const void * addr,struct sk_buff * skb)3145 int neigh_xmit(int index, struct net_device *dev,
3146 	       const void *addr, struct sk_buff *skb)
3147 {
3148 	int err = -EAFNOSUPPORT;
3149 
3150 	if (likely(index < NEIGH_NR_TABLES)) {
3151 		struct neigh_table *tbl;
3152 		struct neighbour *neigh;
3153 
3154 		rcu_read_lock();
3155 		tbl = rcu_dereference(neigh_tables[index]);
3156 		if (!tbl)
3157 			goto out_unlock;
3158 		if (index == NEIGH_ARP_TABLE) {
3159 			u32 key = *((u32 *)addr);
3160 
3161 			neigh = __ipv4_neigh_lookup_noref(dev, key);
3162 		} else {
3163 			neigh = __neigh_lookup_noref(tbl, addr, dev);
3164 		}
3165 		if (!neigh)
3166 			neigh = __neigh_create(tbl, addr, dev, false);
3167 		err = PTR_ERR(neigh);
3168 		if (IS_ERR(neigh)) {
3169 			rcu_read_unlock();
3170 			goto out_kfree_skb;
3171 		}
3172 		err = READ_ONCE(neigh->output)(neigh, skb);
3173 out_unlock:
3174 		rcu_read_unlock();
3175 	}
3176 	else if (index == NEIGH_LINK_TABLE) {
3177 		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
3178 				      addr, NULL, skb->len);
3179 		if (err < 0)
3180 			goto out_kfree_skb;
3181 		err = dev_queue_xmit(skb);
3182 	}
3183 out:
3184 	return err;
3185 out_kfree_skb:
3186 	kfree_skb(skb);
3187 	goto out;
3188 }
3189 EXPORT_SYMBOL(neigh_xmit);
3190 
3191 #ifdef CONFIG_PROC_FS
3192 
neigh_get_first(struct seq_file * seq)3193 static struct neighbour *neigh_get_first(struct seq_file *seq)
3194 {
3195 	struct neigh_seq_state *state = seq->private;
3196 	struct net *net = seq_file_net(seq);
3197 	struct neigh_hash_table *nht = state->nht;
3198 	struct neighbour *n = NULL;
3199 	int bucket;
3200 
3201 	state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
3202 	for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
3203 		n = rcu_dereference(nht->hash_buckets[bucket]);
3204 
3205 		while (n) {
3206 			if (!net_eq(dev_net(n->dev), net))
3207 				goto next;
3208 			if (state->neigh_sub_iter) {
3209 				loff_t fakep = 0;
3210 				void *v;
3211 
3212 				v = state->neigh_sub_iter(state, n, &fakep);
3213 				if (!v)
3214 					goto next;
3215 			}
3216 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3217 				break;
3218 			if (READ_ONCE(n->nud_state) & ~NUD_NOARP)
3219 				break;
3220 next:
3221 			n = rcu_dereference(n->next);
3222 		}
3223 
3224 		if (n)
3225 			break;
3226 	}
3227 	state->bucket = bucket;
3228 
3229 	return n;
3230 }
3231 
neigh_get_next(struct seq_file * seq,struct neighbour * n,loff_t * pos)3232 static struct neighbour *neigh_get_next(struct seq_file *seq,
3233 					struct neighbour *n,
3234 					loff_t *pos)
3235 {
3236 	struct neigh_seq_state *state = seq->private;
3237 	struct net *net = seq_file_net(seq);
3238 	struct neigh_hash_table *nht = state->nht;
3239 
3240 	if (state->neigh_sub_iter) {
3241 		void *v = state->neigh_sub_iter(state, n, pos);
3242 		if (v)
3243 			return n;
3244 	}
3245 	n = rcu_dereference(n->next);
3246 
3247 	while (1) {
3248 		while (n) {
3249 			if (!net_eq(dev_net(n->dev), net))
3250 				goto next;
3251 			if (state->neigh_sub_iter) {
3252 				void *v = state->neigh_sub_iter(state, n, pos);
3253 				if (v)
3254 					return n;
3255 				goto next;
3256 			}
3257 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3258 				break;
3259 
3260 			if (READ_ONCE(n->nud_state) & ~NUD_NOARP)
3261 				break;
3262 next:
3263 			n = rcu_dereference(n->next);
3264 		}
3265 
3266 		if (n)
3267 			break;
3268 
3269 		if (++state->bucket >= (1 << nht->hash_shift))
3270 			break;
3271 
3272 		n = rcu_dereference(nht->hash_buckets[state->bucket]);
3273 	}
3274 
3275 	if (n && pos)
3276 		--(*pos);
3277 	return n;
3278 }
3279 
neigh_get_idx(struct seq_file * seq,loff_t * pos)3280 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
3281 {
3282 	struct neighbour *n = neigh_get_first(seq);
3283 
3284 	if (n) {
3285 		--(*pos);
3286 		while (*pos) {
3287 			n = neigh_get_next(seq, n, pos);
3288 			if (!n)
3289 				break;
3290 		}
3291 	}
3292 	return *pos ? NULL : n;
3293 }
3294 
pneigh_get_first(struct seq_file * seq)3295 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
3296 {
3297 	struct neigh_seq_state *state = seq->private;
3298 	struct net *net = seq_file_net(seq);
3299 	struct neigh_table *tbl = state->tbl;
3300 	struct pneigh_entry *pn = NULL;
3301 	int bucket;
3302 
3303 	state->flags |= NEIGH_SEQ_IS_PNEIGH;
3304 	for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
3305 		pn = tbl->phash_buckets[bucket];
3306 		while (pn && !net_eq(pneigh_net(pn), net))
3307 			pn = pn->next;
3308 		if (pn)
3309 			break;
3310 	}
3311 	state->bucket = bucket;
3312 
3313 	return pn;
3314 }
3315 
pneigh_get_next(struct seq_file * seq,struct pneigh_entry * pn,loff_t * pos)3316 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
3317 					    struct pneigh_entry *pn,
3318 					    loff_t *pos)
3319 {
3320 	struct neigh_seq_state *state = seq->private;
3321 	struct net *net = seq_file_net(seq);
3322 	struct neigh_table *tbl = state->tbl;
3323 
3324 	do {
3325 		pn = pn->next;
3326 	} while (pn && !net_eq(pneigh_net(pn), net));
3327 
3328 	while (!pn) {
3329 		if (++state->bucket > PNEIGH_HASHMASK)
3330 			break;
3331 		pn = tbl->phash_buckets[state->bucket];
3332 		while (pn && !net_eq(pneigh_net(pn), net))
3333 			pn = pn->next;
3334 		if (pn)
3335 			break;
3336 	}
3337 
3338 	if (pn && pos)
3339 		--(*pos);
3340 
3341 	return pn;
3342 }
3343 
pneigh_get_idx(struct seq_file * seq,loff_t * pos)3344 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
3345 {
3346 	struct pneigh_entry *pn = pneigh_get_first(seq);
3347 
3348 	if (pn) {
3349 		--(*pos);
3350 		while (*pos) {
3351 			pn = pneigh_get_next(seq, pn, pos);
3352 			if (!pn)
3353 				break;
3354 		}
3355 	}
3356 	return *pos ? NULL : pn;
3357 }
3358 
neigh_get_idx_any(struct seq_file * seq,loff_t * pos)3359 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
3360 {
3361 	struct neigh_seq_state *state = seq->private;
3362 	void *rc;
3363 	loff_t idxpos = *pos;
3364 
3365 	rc = neigh_get_idx(seq, &idxpos);
3366 	if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3367 		rc = pneigh_get_idx(seq, &idxpos);
3368 
3369 	return rc;
3370 }
3371 
neigh_seq_start(struct seq_file * seq,loff_t * pos,struct neigh_table * tbl,unsigned int neigh_seq_flags)3372 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
3373 	__acquires(tbl->lock)
3374 	__acquires(rcu)
3375 {
3376 	struct neigh_seq_state *state = seq->private;
3377 
3378 	state->tbl = tbl;
3379 	state->bucket = 0;
3380 	state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
3381 
3382 	rcu_read_lock();
3383 	state->nht = rcu_dereference(tbl->nht);
3384 	read_lock_bh(&tbl->lock);
3385 
3386 	return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
3387 }
3388 EXPORT_SYMBOL(neigh_seq_start);
3389 
neigh_seq_next(struct seq_file * seq,void * v,loff_t * pos)3390 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3391 {
3392 	struct neigh_seq_state *state;
3393 	void *rc;
3394 
3395 	if (v == SEQ_START_TOKEN) {
3396 		rc = neigh_get_first(seq);
3397 		goto out;
3398 	}
3399 
3400 	state = seq->private;
3401 	if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
3402 		rc = neigh_get_next(seq, v, NULL);
3403 		if (rc)
3404 			goto out;
3405 		if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3406 			rc = pneigh_get_first(seq);
3407 	} else {
3408 		BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
3409 		rc = pneigh_get_next(seq, v, NULL);
3410 	}
3411 out:
3412 	++(*pos);
3413 	return rc;
3414 }
3415 EXPORT_SYMBOL(neigh_seq_next);
3416 
neigh_seq_stop(struct seq_file * seq,void * v)3417 void neigh_seq_stop(struct seq_file *seq, void *v)
3418 	__releases(tbl->lock)
3419 	__releases(rcu)
3420 {
3421 	struct neigh_seq_state *state = seq->private;
3422 	struct neigh_table *tbl = state->tbl;
3423 
3424 	read_unlock_bh(&tbl->lock);
3425 	rcu_read_unlock();
3426 }
3427 EXPORT_SYMBOL(neigh_seq_stop);
3428 
3429 /* statistics via seq_file */
3430 
neigh_stat_seq_start(struct seq_file * seq,loff_t * pos)3431 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
3432 {
3433 	struct neigh_table *tbl = pde_data(file_inode(seq->file));
3434 	int cpu;
3435 
3436 	if (*pos == 0)
3437 		return SEQ_START_TOKEN;
3438 
3439 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
3440 		if (!cpu_possible(cpu))
3441 			continue;
3442 		*pos = cpu+1;
3443 		return per_cpu_ptr(tbl->stats, cpu);
3444 	}
3445 	return NULL;
3446 }
3447 
neigh_stat_seq_next(struct seq_file * seq,void * v,loff_t * pos)3448 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3449 {
3450 	struct neigh_table *tbl = pde_data(file_inode(seq->file));
3451 	int cpu;
3452 
3453 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
3454 		if (!cpu_possible(cpu))
3455 			continue;
3456 		*pos = cpu+1;
3457 		return per_cpu_ptr(tbl->stats, cpu);
3458 	}
3459 	(*pos)++;
3460 	return NULL;
3461 }
3462 
neigh_stat_seq_stop(struct seq_file * seq,void * v)3463 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
3464 {
3465 
3466 }
3467 
neigh_stat_seq_show(struct seq_file * seq,void * v)3468 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
3469 {
3470 	struct neigh_table *tbl = pde_data(file_inode(seq->file));
3471 	struct neigh_statistics *st = v;
3472 
3473 	if (v == SEQ_START_TOKEN) {
3474 		seq_puts(seq, "entries  allocs   destroys hash_grows lookups  hits     res_failed rcv_probes_mcast rcv_probes_ucast periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
3475 		return 0;
3476 	}
3477 
3478 	seq_printf(seq, "%08x %08lx %08lx %08lx   %08lx %08lx %08lx   "
3479 			"%08lx         %08lx         %08lx         "
3480 			"%08lx       %08lx            %08lx\n",
3481 		   atomic_read(&tbl->entries),
3482 
3483 		   st->allocs,
3484 		   st->destroys,
3485 		   st->hash_grows,
3486 
3487 		   st->lookups,
3488 		   st->hits,
3489 
3490 		   st->res_failed,
3491 
3492 		   st->rcv_probes_mcast,
3493 		   st->rcv_probes_ucast,
3494 
3495 		   st->periodic_gc_runs,
3496 		   st->forced_gc_runs,
3497 		   st->unres_discards,
3498 		   st->table_fulls
3499 		   );
3500 
3501 	return 0;
3502 }
3503 
3504 static const struct seq_operations neigh_stat_seq_ops = {
3505 	.start	= neigh_stat_seq_start,
3506 	.next	= neigh_stat_seq_next,
3507 	.stop	= neigh_stat_seq_stop,
3508 	.show	= neigh_stat_seq_show,
3509 };
3510 #endif /* CONFIG_PROC_FS */
3511 
__neigh_notify(struct neighbour * n,int type,int flags,u32 pid)3512 static void __neigh_notify(struct neighbour *n, int type, int flags,
3513 			   u32 pid)
3514 {
3515 	struct net *net = dev_net(n->dev);
3516 	struct sk_buff *skb;
3517 	int err = -ENOBUFS;
3518 
3519 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
3520 	if (skb == NULL)
3521 		goto errout;
3522 
3523 	err = neigh_fill_info(skb, n, pid, 0, type, flags);
3524 	if (err < 0) {
3525 		/* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
3526 		WARN_ON(err == -EMSGSIZE);
3527 		kfree_skb(skb);
3528 		goto errout;
3529 	}
3530 	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
3531 	return;
3532 errout:
3533 	rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
3534 }
3535 
neigh_app_ns(struct neighbour * n)3536 void neigh_app_ns(struct neighbour *n)
3537 {
3538 	__neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
3539 }
3540 EXPORT_SYMBOL(neigh_app_ns);
3541 
3542 #ifdef CONFIG_SYSCTL
3543 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
3544 
proc_unres_qlen(const struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3545 static int proc_unres_qlen(const struct ctl_table *ctl, int write,
3546 			   void *buffer, size_t *lenp, loff_t *ppos)
3547 {
3548 	int size, ret;
3549 	struct ctl_table tmp = *ctl;
3550 
3551 	tmp.extra1 = SYSCTL_ZERO;
3552 	tmp.extra2 = &unres_qlen_max;
3553 	tmp.data = &size;
3554 
3555 	size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
3556 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3557 
3558 	if (write && !ret)
3559 		*(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
3560 	return ret;
3561 }
3562 
neigh_copy_dflt_parms(struct net * net,struct neigh_parms * p,int index)3563 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
3564 				  int index)
3565 {
3566 	struct net_device *dev;
3567 	int family = neigh_parms_family(p);
3568 
3569 	rcu_read_lock();
3570 	for_each_netdev_rcu(net, dev) {
3571 		struct neigh_parms *dst_p =
3572 				neigh_get_dev_parms_rcu(dev, family);
3573 
3574 		if (dst_p && !test_bit(index, dst_p->data_state))
3575 			dst_p->data[index] = p->data[index];
3576 	}
3577 	rcu_read_unlock();
3578 }
3579 
neigh_proc_update(const struct ctl_table * ctl,int write)3580 static void neigh_proc_update(const struct ctl_table *ctl, int write)
3581 {
3582 	struct net_device *dev = ctl->extra1;
3583 	struct neigh_parms *p = ctl->extra2;
3584 	struct net *net = neigh_parms_net(p);
3585 	int index = (int *) ctl->data - p->data;
3586 
3587 	if (!write)
3588 		return;
3589 
3590 	set_bit(index, p->data_state);
3591 	if (index == NEIGH_VAR_DELAY_PROBE_TIME)
3592 		call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
3593 	if (!dev) /* NULL dev means this is default value */
3594 		neigh_copy_dflt_parms(net, p, index);
3595 }
3596 
neigh_proc_dointvec_zero_intmax(const struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3597 static int neigh_proc_dointvec_zero_intmax(const struct ctl_table *ctl, int write,
3598 					   void *buffer, size_t *lenp,
3599 					   loff_t *ppos)
3600 {
3601 	struct ctl_table tmp = *ctl;
3602 	int ret;
3603 
3604 	tmp.extra1 = SYSCTL_ZERO;
3605 	tmp.extra2 = SYSCTL_INT_MAX;
3606 
3607 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3608 	neigh_proc_update(ctl, write);
3609 	return ret;
3610 }
3611 
neigh_proc_dointvec_ms_jiffies_positive(const struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3612 static int neigh_proc_dointvec_ms_jiffies_positive(const struct ctl_table *ctl, int write,
3613 						   void *buffer, size_t *lenp, loff_t *ppos)
3614 {
3615 	struct ctl_table tmp = *ctl;
3616 	int ret;
3617 
3618 	int min = msecs_to_jiffies(1);
3619 
3620 	tmp.extra1 = &min;
3621 	tmp.extra2 = NULL;
3622 
3623 	ret = proc_dointvec_ms_jiffies_minmax(&tmp, write, buffer, lenp, ppos);
3624 	neigh_proc_update(ctl, write);
3625 	return ret;
3626 }
3627 
neigh_proc_dointvec(const struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3628 int neigh_proc_dointvec(const struct ctl_table *ctl, int write, void *buffer,
3629 			size_t *lenp, loff_t *ppos)
3630 {
3631 	int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3632 
3633 	neigh_proc_update(ctl, write);
3634 	return ret;
3635 }
3636 EXPORT_SYMBOL(neigh_proc_dointvec);
3637 
neigh_proc_dointvec_jiffies(const struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3638 int neigh_proc_dointvec_jiffies(const struct ctl_table *ctl, int write, void *buffer,
3639 				size_t *lenp, loff_t *ppos)
3640 {
3641 	int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3642 
3643 	neigh_proc_update(ctl, write);
3644 	return ret;
3645 }
3646 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3647 
neigh_proc_dointvec_userhz_jiffies(const struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3648 static int neigh_proc_dointvec_userhz_jiffies(const struct ctl_table *ctl, int write,
3649 					      void *buffer, size_t *lenp,
3650 					      loff_t *ppos)
3651 {
3652 	int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3653 
3654 	neigh_proc_update(ctl, write);
3655 	return ret;
3656 }
3657 
neigh_proc_dointvec_ms_jiffies(const struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3658 int neigh_proc_dointvec_ms_jiffies(const struct ctl_table *ctl, int write,
3659 				   void *buffer, size_t *lenp, loff_t *ppos)
3660 {
3661 	int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3662 
3663 	neigh_proc_update(ctl, write);
3664 	return ret;
3665 }
3666 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3667 
neigh_proc_dointvec_unres_qlen(const struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3668 static int neigh_proc_dointvec_unres_qlen(const struct ctl_table *ctl, int write,
3669 					  void *buffer, size_t *lenp,
3670 					  loff_t *ppos)
3671 {
3672 	int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3673 
3674 	neigh_proc_update(ctl, write);
3675 	return ret;
3676 }
3677 
neigh_proc_base_reachable_time(const struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3678 static int neigh_proc_base_reachable_time(const struct ctl_table *ctl, int write,
3679 					  void *buffer, size_t *lenp,
3680 					  loff_t *ppos)
3681 {
3682 	struct neigh_parms *p = ctl->extra2;
3683 	int ret;
3684 
3685 	if (strcmp(ctl->procname, "base_reachable_time") == 0)
3686 		ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3687 	else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3688 		ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3689 	else
3690 		ret = -1;
3691 
3692 	if (write && ret == 0) {
3693 		/* update reachable_time as well, otherwise, the change will
3694 		 * only be effective after the next time neigh_periodic_work
3695 		 * decides to recompute it
3696 		 */
3697 		p->reachable_time =
3698 			neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3699 	}
3700 	return ret;
3701 }
3702 
3703 #define NEIGH_PARMS_DATA_OFFSET(index)	\
3704 	(&((struct neigh_parms *) 0)->data[index])
3705 
3706 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3707 	[NEIGH_VAR_ ## attr] = { \
3708 		.procname	= name, \
3709 		.data		= NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3710 		.maxlen		= sizeof(int), \
3711 		.mode		= mval, \
3712 		.proc_handler	= proc, \
3713 	}
3714 
3715 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3716 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3717 
3718 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3719 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3720 
3721 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3722 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3723 
3724 #define NEIGH_SYSCTL_MS_JIFFIES_POSITIVE_ENTRY(attr, name) \
3725 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies_positive)
3726 
3727 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3728 	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3729 
3730 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3731 	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3732 
3733 static struct neigh_sysctl_table {
3734 	struct ctl_table_header *sysctl_header;
3735 	struct ctl_table neigh_vars[NEIGH_VAR_MAX];
3736 } neigh_sysctl_template __read_mostly = {
3737 	.neigh_vars = {
3738 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3739 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3740 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3741 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3742 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3743 		NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3744 		NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3745 		NEIGH_SYSCTL_MS_JIFFIES_POSITIVE_ENTRY(INTERVAL_PROBE_TIME_MS,
3746 						       "interval_probe_time_ms"),
3747 		NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3748 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3749 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3750 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3751 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3752 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3753 		NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3754 		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3755 		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3756 		[NEIGH_VAR_GC_INTERVAL] = {
3757 			.procname	= "gc_interval",
3758 			.maxlen		= sizeof(int),
3759 			.mode		= 0644,
3760 			.proc_handler	= proc_dointvec_jiffies,
3761 		},
3762 		[NEIGH_VAR_GC_THRESH1] = {
3763 			.procname	= "gc_thresh1",
3764 			.maxlen		= sizeof(int),
3765 			.mode		= 0644,
3766 			.extra1		= SYSCTL_ZERO,
3767 			.extra2		= SYSCTL_INT_MAX,
3768 			.proc_handler	= proc_dointvec_minmax,
3769 		},
3770 		[NEIGH_VAR_GC_THRESH2] = {
3771 			.procname	= "gc_thresh2",
3772 			.maxlen		= sizeof(int),
3773 			.mode		= 0644,
3774 			.extra1		= SYSCTL_ZERO,
3775 			.extra2		= SYSCTL_INT_MAX,
3776 			.proc_handler	= proc_dointvec_minmax,
3777 		},
3778 		[NEIGH_VAR_GC_THRESH3] = {
3779 			.procname	= "gc_thresh3",
3780 			.maxlen		= sizeof(int),
3781 			.mode		= 0644,
3782 			.extra1		= SYSCTL_ZERO,
3783 			.extra2		= SYSCTL_INT_MAX,
3784 			.proc_handler	= proc_dointvec_minmax,
3785 		},
3786 	},
3787 };
3788 
neigh_sysctl_register(struct net_device * dev,struct neigh_parms * p,proc_handler * handler)3789 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3790 			  proc_handler *handler)
3791 {
3792 	int i;
3793 	struct neigh_sysctl_table *t;
3794 	const char *dev_name_source;
3795 	char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3796 	char *p_name;
3797 	size_t neigh_vars_size;
3798 
3799 	t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL_ACCOUNT);
3800 	if (!t)
3801 		goto err;
3802 
3803 	for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3804 		t->neigh_vars[i].data += (long) p;
3805 		t->neigh_vars[i].extra1 = dev;
3806 		t->neigh_vars[i].extra2 = p;
3807 	}
3808 
3809 	neigh_vars_size = ARRAY_SIZE(t->neigh_vars);
3810 	if (dev) {
3811 		dev_name_source = dev->name;
3812 		/* Terminate the table early */
3813 		neigh_vars_size = NEIGH_VAR_BASE_REACHABLE_TIME_MS + 1;
3814 	} else {
3815 		struct neigh_table *tbl = p->tbl;
3816 		dev_name_source = "default";
3817 		t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3818 		t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3819 		t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3820 		t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3821 	}
3822 
3823 	if (handler) {
3824 		/* RetransTime */
3825 		t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3826 		/* ReachableTime */
3827 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3828 		/* RetransTime (in milliseconds)*/
3829 		t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3830 		/* ReachableTime (in milliseconds) */
3831 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3832 	} else {
3833 		/* Those handlers will update p->reachable_time after
3834 		 * base_reachable_time(_ms) is set to ensure the new timer starts being
3835 		 * applied after the next neighbour update instead of waiting for
3836 		 * neigh_periodic_work to update its value (can be multiple minutes)
3837 		 * So any handler that replaces them should do this as well
3838 		 */
3839 		/* ReachableTime */
3840 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3841 			neigh_proc_base_reachable_time;
3842 		/* ReachableTime (in milliseconds) */
3843 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3844 			neigh_proc_base_reachable_time;
3845 	}
3846 
3847 	switch (neigh_parms_family(p)) {
3848 	case AF_INET:
3849 	      p_name = "ipv4";
3850 	      break;
3851 	case AF_INET6:
3852 	      p_name = "ipv6";
3853 	      break;
3854 	default:
3855 	      BUG();
3856 	}
3857 
3858 	snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3859 		p_name, dev_name_source);
3860 	t->sysctl_header = register_net_sysctl_sz(neigh_parms_net(p),
3861 						  neigh_path, t->neigh_vars,
3862 						  neigh_vars_size);
3863 	if (!t->sysctl_header)
3864 		goto free;
3865 
3866 	p->sysctl_table = t;
3867 	return 0;
3868 
3869 free:
3870 	kfree(t);
3871 err:
3872 	return -ENOBUFS;
3873 }
3874 EXPORT_SYMBOL(neigh_sysctl_register);
3875 
neigh_sysctl_unregister(struct neigh_parms * p)3876 void neigh_sysctl_unregister(struct neigh_parms *p)
3877 {
3878 	if (p->sysctl_table) {
3879 		struct neigh_sysctl_table *t = p->sysctl_table;
3880 		p->sysctl_table = NULL;
3881 		unregister_net_sysctl_table(t->sysctl_header);
3882 		kfree(t);
3883 	}
3884 }
3885 EXPORT_SYMBOL(neigh_sysctl_unregister);
3886 
3887 #endif	/* CONFIG_SYSCTL */
3888 
neigh_init(void)3889 static int __init neigh_init(void)
3890 {
3891 	rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, 0);
3892 	rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, 0);
3893 	rtnl_register(PF_UNSPEC, RTM_GETNEIGH, neigh_get, neigh_dump_info,
3894 		      RTNL_FLAG_DUMP_UNLOCKED);
3895 
3896 	rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3897 		      0);
3898 	rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0);
3899 
3900 	return 0;
3901 }
3902 
3903 subsys_initcall(neigh_init);
3904