xref: /linux/net/core/neighbour.c (revision 905e46acd3272d04566fec49afbd7ad9e2ed9ae3)
1 /*
2  *	Generic address resolution entity
3  *
4  *	Authors:
5  *	Pedro Roque		<roque@di.fc.ul.pt>
6  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
7  *
8  *	This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License
10  *      as published by the Free Software Foundation; either version
11  *      2 of the License, or (at your option) any later version.
12  *
13  *	Fixes:
14  *	Vitaly E. Lavrov	releasing NULL neighbor in neigh_add.
15  *	Harald Welte		Add neighbour cache statistics like rtstat
16  */
17 
18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19 
20 #include <linux/slab.h>
21 #include <linux/types.h>
22 #include <linux/kernel.h>
23 #include <linux/module.h>
24 #include <linux/socket.h>
25 #include <linux/netdevice.h>
26 #include <linux/proc_fs.h>
27 #ifdef CONFIG_SYSCTL
28 #include <linux/sysctl.h>
29 #endif
30 #include <linux/times.h>
31 #include <net/net_namespace.h>
32 #include <net/neighbour.h>
33 #include <net/dst.h>
34 #include <net/sock.h>
35 #include <net/netevent.h>
36 #include <net/netlink.h>
37 #include <linux/rtnetlink.h>
38 #include <linux/random.h>
39 #include <linux/string.h>
40 #include <linux/log2.h>
41 #include <linux/inetdevice.h>
42 #include <net/addrconf.h>
43 
44 #define DEBUG
45 #define NEIGH_DEBUG 1
46 #define neigh_dbg(level, fmt, ...)		\
47 do {						\
48 	if (level <= NEIGH_DEBUG)		\
49 		pr_debug(fmt, ##__VA_ARGS__);	\
50 } while (0)
51 
52 #define PNEIGH_HASHMASK		0xF
53 
54 static void neigh_timer_handler(unsigned long arg);
55 static void __neigh_notify(struct neighbour *n, int type, int flags,
56 			   u32 pid);
57 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
58 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
59 
60 #ifdef CONFIG_PROC_FS
61 static const struct file_operations neigh_stat_seq_fops;
62 #endif
63 
64 /*
65    Neighbour hash table buckets are protected with rwlock tbl->lock.
66 
67    - All the scans/updates to hash buckets MUST be made under this lock.
68    - NOTHING clever should be made under this lock: no callbacks
69      to protocol backends, no attempts to send something to network.
70      It will result in deadlocks, if backend/driver wants to use neighbour
71      cache.
72    - If the entry requires some non-trivial actions, increase
73      its reference count and release table lock.
74 
75    Neighbour entries are protected:
76    - with reference count.
77    - with rwlock neigh->lock
78 
79    Reference count prevents destruction.
80 
81    neigh->lock mainly serializes ll address data and its validity state.
82    However, the same lock is used to protect another entry fields:
83     - timer
84     - resolution queue
85 
86    Again, nothing clever shall be made under neigh->lock,
87    the most complicated procedure, which we allow is dev->hard_header.
88    It is supposed, that dev->hard_header is simplistic and does
89    not make callbacks to neighbour tables.
90  */
91 
92 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
93 {
94 	kfree_skb(skb);
95 	return -ENETDOWN;
96 }
97 
98 static void neigh_cleanup_and_release(struct neighbour *neigh)
99 {
100 	if (neigh->parms->neigh_cleanup)
101 		neigh->parms->neigh_cleanup(neigh);
102 
103 	__neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
104 	call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
105 	neigh_release(neigh);
106 }
107 
108 /*
109  * It is random distribution in the interval (1/2)*base...(3/2)*base.
110  * It corresponds to default IPv6 settings and is not overridable,
111  * because it is really reasonable choice.
112  */
113 
114 unsigned long neigh_rand_reach_time(unsigned long base)
115 {
116 	return base ? (prandom_u32() % base) + (base >> 1) : 0;
117 }
118 EXPORT_SYMBOL(neigh_rand_reach_time);
119 
120 
121 static int neigh_forced_gc(struct neigh_table *tbl)
122 {
123 	int shrunk = 0;
124 	int i;
125 	struct neigh_hash_table *nht;
126 
127 	NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
128 
129 	write_lock_bh(&tbl->lock);
130 	nht = rcu_dereference_protected(tbl->nht,
131 					lockdep_is_held(&tbl->lock));
132 	for (i = 0; i < (1 << nht->hash_shift); i++) {
133 		struct neighbour *n;
134 		struct neighbour __rcu **np;
135 
136 		np = &nht->hash_buckets[i];
137 		while ((n = rcu_dereference_protected(*np,
138 					lockdep_is_held(&tbl->lock))) != NULL) {
139 			/* Neighbour record may be discarded if:
140 			 * - nobody refers to it.
141 			 * - it is not permanent
142 			 */
143 			write_lock(&n->lock);
144 			if (atomic_read(&n->refcnt) == 1 &&
145 			    !(n->nud_state & NUD_PERMANENT)) {
146 				rcu_assign_pointer(*np,
147 					rcu_dereference_protected(n->next,
148 						  lockdep_is_held(&tbl->lock)));
149 				n->dead = 1;
150 				shrunk	= 1;
151 				write_unlock(&n->lock);
152 				neigh_cleanup_and_release(n);
153 				continue;
154 			}
155 			write_unlock(&n->lock);
156 			np = &n->next;
157 		}
158 	}
159 
160 	tbl->last_flush = jiffies;
161 
162 	write_unlock_bh(&tbl->lock);
163 
164 	return shrunk;
165 }
166 
167 static void neigh_add_timer(struct neighbour *n, unsigned long when)
168 {
169 	neigh_hold(n);
170 	if (unlikely(mod_timer(&n->timer, when))) {
171 		printk("NEIGH: BUG, double timer add, state is %x\n",
172 		       n->nud_state);
173 		dump_stack();
174 	}
175 }
176 
177 static int neigh_del_timer(struct neighbour *n)
178 {
179 	if ((n->nud_state & NUD_IN_TIMER) &&
180 	    del_timer(&n->timer)) {
181 		neigh_release(n);
182 		return 1;
183 	}
184 	return 0;
185 }
186 
187 static void pneigh_queue_purge(struct sk_buff_head *list)
188 {
189 	struct sk_buff *skb;
190 
191 	while ((skb = skb_dequeue(list)) != NULL) {
192 		dev_put(skb->dev);
193 		kfree_skb(skb);
194 	}
195 }
196 
197 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
198 {
199 	int i;
200 	struct neigh_hash_table *nht;
201 
202 	nht = rcu_dereference_protected(tbl->nht,
203 					lockdep_is_held(&tbl->lock));
204 
205 	for (i = 0; i < (1 << nht->hash_shift); i++) {
206 		struct neighbour *n;
207 		struct neighbour __rcu **np = &nht->hash_buckets[i];
208 
209 		while ((n = rcu_dereference_protected(*np,
210 					lockdep_is_held(&tbl->lock))) != NULL) {
211 			if (dev && n->dev != dev) {
212 				np = &n->next;
213 				continue;
214 			}
215 			rcu_assign_pointer(*np,
216 				   rcu_dereference_protected(n->next,
217 						lockdep_is_held(&tbl->lock)));
218 			write_lock(&n->lock);
219 			neigh_del_timer(n);
220 			n->dead = 1;
221 
222 			if (atomic_read(&n->refcnt) != 1) {
223 				/* The most unpleasant situation.
224 				   We must destroy neighbour entry,
225 				   but someone still uses it.
226 
227 				   The destroy will be delayed until
228 				   the last user releases us, but
229 				   we must kill timers etc. and move
230 				   it to safe state.
231 				 */
232 				__skb_queue_purge(&n->arp_queue);
233 				n->arp_queue_len_bytes = 0;
234 				n->output = neigh_blackhole;
235 				if (n->nud_state & NUD_VALID)
236 					n->nud_state = NUD_NOARP;
237 				else
238 					n->nud_state = NUD_NONE;
239 				neigh_dbg(2, "neigh %p is stray\n", n);
240 			}
241 			write_unlock(&n->lock);
242 			neigh_cleanup_and_release(n);
243 		}
244 	}
245 }
246 
247 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
248 {
249 	write_lock_bh(&tbl->lock);
250 	neigh_flush_dev(tbl, dev);
251 	write_unlock_bh(&tbl->lock);
252 }
253 EXPORT_SYMBOL(neigh_changeaddr);
254 
255 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
256 {
257 	write_lock_bh(&tbl->lock);
258 	neigh_flush_dev(tbl, dev);
259 	pneigh_ifdown(tbl, dev);
260 	write_unlock_bh(&tbl->lock);
261 
262 	del_timer_sync(&tbl->proxy_timer);
263 	pneigh_queue_purge(&tbl->proxy_queue);
264 	return 0;
265 }
266 EXPORT_SYMBOL(neigh_ifdown);
267 
268 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
269 {
270 	struct neighbour *n = NULL;
271 	unsigned long now = jiffies;
272 	int entries;
273 
274 	entries = atomic_inc_return(&tbl->entries) - 1;
275 	if (entries >= tbl->gc_thresh3 ||
276 	    (entries >= tbl->gc_thresh2 &&
277 	     time_after(now, tbl->last_flush + 5 * HZ))) {
278 		if (!neigh_forced_gc(tbl) &&
279 		    entries >= tbl->gc_thresh3) {
280 			net_info_ratelimited("%s: neighbor table overflow!\n",
281 					     tbl->id);
282 			NEIGH_CACHE_STAT_INC(tbl, table_fulls);
283 			goto out_entries;
284 		}
285 	}
286 
287 	n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
288 	if (!n)
289 		goto out_entries;
290 
291 	__skb_queue_head_init(&n->arp_queue);
292 	rwlock_init(&n->lock);
293 	seqlock_init(&n->ha_lock);
294 	n->updated	  = n->used = now;
295 	n->nud_state	  = NUD_NONE;
296 	n->output	  = neigh_blackhole;
297 	seqlock_init(&n->hh.hh_lock);
298 	n->parms	  = neigh_parms_clone(&tbl->parms);
299 	setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
300 
301 	NEIGH_CACHE_STAT_INC(tbl, allocs);
302 	n->tbl		  = tbl;
303 	atomic_set(&n->refcnt, 1);
304 	n->dead		  = 1;
305 out:
306 	return n;
307 
308 out_entries:
309 	atomic_dec(&tbl->entries);
310 	goto out;
311 }
312 
313 static void neigh_get_hash_rnd(u32 *x)
314 {
315 	get_random_bytes(x, sizeof(*x));
316 	*x |= 1;
317 }
318 
319 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
320 {
321 	size_t size = (1 << shift) * sizeof(struct neighbour *);
322 	struct neigh_hash_table *ret;
323 	struct neighbour __rcu **buckets;
324 	int i;
325 
326 	ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
327 	if (!ret)
328 		return NULL;
329 	if (size <= PAGE_SIZE)
330 		buckets = kzalloc(size, GFP_ATOMIC);
331 	else
332 		buckets = (struct neighbour __rcu **)
333 			  __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
334 					   get_order(size));
335 	if (!buckets) {
336 		kfree(ret);
337 		return NULL;
338 	}
339 	ret->hash_buckets = buckets;
340 	ret->hash_shift = shift;
341 	for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
342 		neigh_get_hash_rnd(&ret->hash_rnd[i]);
343 	return ret;
344 }
345 
346 static void neigh_hash_free_rcu(struct rcu_head *head)
347 {
348 	struct neigh_hash_table *nht = container_of(head,
349 						    struct neigh_hash_table,
350 						    rcu);
351 	size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
352 	struct neighbour __rcu **buckets = nht->hash_buckets;
353 
354 	if (size <= PAGE_SIZE)
355 		kfree(buckets);
356 	else
357 		free_pages((unsigned long)buckets, get_order(size));
358 	kfree(nht);
359 }
360 
361 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
362 						unsigned long new_shift)
363 {
364 	unsigned int i, hash;
365 	struct neigh_hash_table *new_nht, *old_nht;
366 
367 	NEIGH_CACHE_STAT_INC(tbl, hash_grows);
368 
369 	old_nht = rcu_dereference_protected(tbl->nht,
370 					    lockdep_is_held(&tbl->lock));
371 	new_nht = neigh_hash_alloc(new_shift);
372 	if (!new_nht)
373 		return old_nht;
374 
375 	for (i = 0; i < (1 << old_nht->hash_shift); i++) {
376 		struct neighbour *n, *next;
377 
378 		for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
379 						   lockdep_is_held(&tbl->lock));
380 		     n != NULL;
381 		     n = next) {
382 			hash = tbl->hash(n->primary_key, n->dev,
383 					 new_nht->hash_rnd);
384 
385 			hash >>= (32 - new_nht->hash_shift);
386 			next = rcu_dereference_protected(n->next,
387 						lockdep_is_held(&tbl->lock));
388 
389 			rcu_assign_pointer(n->next,
390 					   rcu_dereference_protected(
391 						new_nht->hash_buckets[hash],
392 						lockdep_is_held(&tbl->lock)));
393 			rcu_assign_pointer(new_nht->hash_buckets[hash], n);
394 		}
395 	}
396 
397 	rcu_assign_pointer(tbl->nht, new_nht);
398 	call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
399 	return new_nht;
400 }
401 
402 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
403 			       struct net_device *dev)
404 {
405 	struct neighbour *n;
406 
407 	NEIGH_CACHE_STAT_INC(tbl, lookups);
408 
409 	rcu_read_lock_bh();
410 	n = __neigh_lookup_noref(tbl, pkey, dev);
411 	if (n) {
412 		if (!atomic_inc_not_zero(&n->refcnt))
413 			n = NULL;
414 		NEIGH_CACHE_STAT_INC(tbl, hits);
415 	}
416 
417 	rcu_read_unlock_bh();
418 	return n;
419 }
420 EXPORT_SYMBOL(neigh_lookup);
421 
422 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
423 				     const void *pkey)
424 {
425 	struct neighbour *n;
426 	int key_len = tbl->key_len;
427 	u32 hash_val;
428 	struct neigh_hash_table *nht;
429 
430 	NEIGH_CACHE_STAT_INC(tbl, lookups);
431 
432 	rcu_read_lock_bh();
433 	nht = rcu_dereference_bh(tbl->nht);
434 	hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
435 
436 	for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
437 	     n != NULL;
438 	     n = rcu_dereference_bh(n->next)) {
439 		if (!memcmp(n->primary_key, pkey, key_len) &&
440 		    net_eq(dev_net(n->dev), net)) {
441 			if (!atomic_inc_not_zero(&n->refcnt))
442 				n = NULL;
443 			NEIGH_CACHE_STAT_INC(tbl, hits);
444 			break;
445 		}
446 	}
447 
448 	rcu_read_unlock_bh();
449 	return n;
450 }
451 EXPORT_SYMBOL(neigh_lookup_nodev);
452 
453 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
454 				 struct net_device *dev, bool want_ref)
455 {
456 	u32 hash_val;
457 	int key_len = tbl->key_len;
458 	int error;
459 	struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
460 	struct neigh_hash_table *nht;
461 
462 	if (!n) {
463 		rc = ERR_PTR(-ENOBUFS);
464 		goto out;
465 	}
466 
467 	memcpy(n->primary_key, pkey, key_len);
468 	n->dev = dev;
469 	dev_hold(dev);
470 
471 	/* Protocol specific setup. */
472 	if (tbl->constructor &&	(error = tbl->constructor(n)) < 0) {
473 		rc = ERR_PTR(error);
474 		goto out_neigh_release;
475 	}
476 
477 	if (dev->netdev_ops->ndo_neigh_construct) {
478 		error = dev->netdev_ops->ndo_neigh_construct(dev, n);
479 		if (error < 0) {
480 			rc = ERR_PTR(error);
481 			goto out_neigh_release;
482 		}
483 	}
484 
485 	/* Device specific setup. */
486 	if (n->parms->neigh_setup &&
487 	    (error = n->parms->neigh_setup(n)) < 0) {
488 		rc = ERR_PTR(error);
489 		goto out_neigh_release;
490 	}
491 
492 	n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
493 
494 	write_lock_bh(&tbl->lock);
495 	nht = rcu_dereference_protected(tbl->nht,
496 					lockdep_is_held(&tbl->lock));
497 
498 	if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
499 		nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
500 
501 	hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
502 
503 	if (n->parms->dead) {
504 		rc = ERR_PTR(-EINVAL);
505 		goto out_tbl_unlock;
506 	}
507 
508 	for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
509 					    lockdep_is_held(&tbl->lock));
510 	     n1 != NULL;
511 	     n1 = rcu_dereference_protected(n1->next,
512 			lockdep_is_held(&tbl->lock))) {
513 		if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
514 			if (want_ref)
515 				neigh_hold(n1);
516 			rc = n1;
517 			goto out_tbl_unlock;
518 		}
519 	}
520 
521 	n->dead = 0;
522 	if (want_ref)
523 		neigh_hold(n);
524 	rcu_assign_pointer(n->next,
525 			   rcu_dereference_protected(nht->hash_buckets[hash_val],
526 						     lockdep_is_held(&tbl->lock)));
527 	rcu_assign_pointer(nht->hash_buckets[hash_val], n);
528 	write_unlock_bh(&tbl->lock);
529 	neigh_dbg(2, "neigh %p is created\n", n);
530 	rc = n;
531 out:
532 	return rc;
533 out_tbl_unlock:
534 	write_unlock_bh(&tbl->lock);
535 out_neigh_release:
536 	neigh_release(n);
537 	goto out;
538 }
539 EXPORT_SYMBOL(__neigh_create);
540 
541 static u32 pneigh_hash(const void *pkey, int key_len)
542 {
543 	u32 hash_val = *(u32 *)(pkey + key_len - 4);
544 	hash_val ^= (hash_val >> 16);
545 	hash_val ^= hash_val >> 8;
546 	hash_val ^= hash_val >> 4;
547 	hash_val &= PNEIGH_HASHMASK;
548 	return hash_val;
549 }
550 
551 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
552 					      struct net *net,
553 					      const void *pkey,
554 					      int key_len,
555 					      struct net_device *dev)
556 {
557 	while (n) {
558 		if (!memcmp(n->key, pkey, key_len) &&
559 		    net_eq(pneigh_net(n), net) &&
560 		    (n->dev == dev || !n->dev))
561 			return n;
562 		n = n->next;
563 	}
564 	return NULL;
565 }
566 
567 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
568 		struct net *net, const void *pkey, struct net_device *dev)
569 {
570 	int key_len = tbl->key_len;
571 	u32 hash_val = pneigh_hash(pkey, key_len);
572 
573 	return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
574 				 net, pkey, key_len, dev);
575 }
576 EXPORT_SYMBOL_GPL(__pneigh_lookup);
577 
578 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
579 				    struct net *net, const void *pkey,
580 				    struct net_device *dev, int creat)
581 {
582 	struct pneigh_entry *n;
583 	int key_len = tbl->key_len;
584 	u32 hash_val = pneigh_hash(pkey, key_len);
585 
586 	read_lock_bh(&tbl->lock);
587 	n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
588 			      net, pkey, key_len, dev);
589 	read_unlock_bh(&tbl->lock);
590 
591 	if (n || !creat)
592 		goto out;
593 
594 	ASSERT_RTNL();
595 
596 	n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
597 	if (!n)
598 		goto out;
599 
600 	write_pnet(&n->net, net);
601 	memcpy(n->key, pkey, key_len);
602 	n->dev = dev;
603 	if (dev)
604 		dev_hold(dev);
605 
606 	if (tbl->pconstructor && tbl->pconstructor(n)) {
607 		if (dev)
608 			dev_put(dev);
609 		kfree(n);
610 		n = NULL;
611 		goto out;
612 	}
613 
614 	write_lock_bh(&tbl->lock);
615 	n->next = tbl->phash_buckets[hash_val];
616 	tbl->phash_buckets[hash_val] = n;
617 	write_unlock_bh(&tbl->lock);
618 out:
619 	return n;
620 }
621 EXPORT_SYMBOL(pneigh_lookup);
622 
623 
624 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
625 		  struct net_device *dev)
626 {
627 	struct pneigh_entry *n, **np;
628 	int key_len = tbl->key_len;
629 	u32 hash_val = pneigh_hash(pkey, key_len);
630 
631 	write_lock_bh(&tbl->lock);
632 	for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
633 	     np = &n->next) {
634 		if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
635 		    net_eq(pneigh_net(n), net)) {
636 			*np = n->next;
637 			write_unlock_bh(&tbl->lock);
638 			if (tbl->pdestructor)
639 				tbl->pdestructor(n);
640 			if (n->dev)
641 				dev_put(n->dev);
642 			kfree(n);
643 			return 0;
644 		}
645 	}
646 	write_unlock_bh(&tbl->lock);
647 	return -ENOENT;
648 }
649 
650 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
651 {
652 	struct pneigh_entry *n, **np;
653 	u32 h;
654 
655 	for (h = 0; h <= PNEIGH_HASHMASK; h++) {
656 		np = &tbl->phash_buckets[h];
657 		while ((n = *np) != NULL) {
658 			if (!dev || n->dev == dev) {
659 				*np = n->next;
660 				if (tbl->pdestructor)
661 					tbl->pdestructor(n);
662 				if (n->dev)
663 					dev_put(n->dev);
664 				kfree(n);
665 				continue;
666 			}
667 			np = &n->next;
668 		}
669 	}
670 	return -ENOENT;
671 }
672 
673 static void neigh_parms_destroy(struct neigh_parms *parms);
674 
675 static inline void neigh_parms_put(struct neigh_parms *parms)
676 {
677 	if (atomic_dec_and_test(&parms->refcnt))
678 		neigh_parms_destroy(parms);
679 }
680 
681 /*
682  *	neighbour must already be out of the table;
683  *
684  */
685 void neigh_destroy(struct neighbour *neigh)
686 {
687 	struct net_device *dev = neigh->dev;
688 
689 	NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
690 
691 	if (!neigh->dead) {
692 		pr_warn("Destroying alive neighbour %p\n", neigh);
693 		dump_stack();
694 		return;
695 	}
696 
697 	if (neigh_del_timer(neigh))
698 		pr_warn("Impossible event\n");
699 
700 	write_lock_bh(&neigh->lock);
701 	__skb_queue_purge(&neigh->arp_queue);
702 	write_unlock_bh(&neigh->lock);
703 	neigh->arp_queue_len_bytes = 0;
704 
705 	if (dev->netdev_ops->ndo_neigh_destroy)
706 		dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
707 
708 	dev_put(dev);
709 	neigh_parms_put(neigh->parms);
710 
711 	neigh_dbg(2, "neigh %p is destroyed\n", neigh);
712 
713 	atomic_dec(&neigh->tbl->entries);
714 	kfree_rcu(neigh, rcu);
715 }
716 EXPORT_SYMBOL(neigh_destroy);
717 
718 /* Neighbour state is suspicious;
719    disable fast path.
720 
721    Called with write_locked neigh.
722  */
723 static void neigh_suspect(struct neighbour *neigh)
724 {
725 	neigh_dbg(2, "neigh %p is suspected\n", neigh);
726 
727 	neigh->output = neigh->ops->output;
728 }
729 
730 /* Neighbour state is OK;
731    enable fast path.
732 
733    Called with write_locked neigh.
734  */
735 static void neigh_connect(struct neighbour *neigh)
736 {
737 	neigh_dbg(2, "neigh %p is connected\n", neigh);
738 
739 	neigh->output = neigh->ops->connected_output;
740 }
741 
742 static void neigh_periodic_work(struct work_struct *work)
743 {
744 	struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
745 	struct neighbour *n;
746 	struct neighbour __rcu **np;
747 	unsigned int i;
748 	struct neigh_hash_table *nht;
749 
750 	NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
751 
752 	write_lock_bh(&tbl->lock);
753 	nht = rcu_dereference_protected(tbl->nht,
754 					lockdep_is_held(&tbl->lock));
755 
756 	/*
757 	 *	periodically recompute ReachableTime from random function
758 	 */
759 
760 	if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
761 		struct neigh_parms *p;
762 		tbl->last_rand = jiffies;
763 		list_for_each_entry(p, &tbl->parms_list, list)
764 			p->reachable_time =
765 				neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
766 	}
767 
768 	if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
769 		goto out;
770 
771 	for (i = 0 ; i < (1 << nht->hash_shift); i++) {
772 		np = &nht->hash_buckets[i];
773 
774 		while ((n = rcu_dereference_protected(*np,
775 				lockdep_is_held(&tbl->lock))) != NULL) {
776 			unsigned int state;
777 
778 			write_lock(&n->lock);
779 
780 			state = n->nud_state;
781 			if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
782 				write_unlock(&n->lock);
783 				goto next_elt;
784 			}
785 
786 			if (time_before(n->used, n->confirmed))
787 				n->used = n->confirmed;
788 
789 			if (atomic_read(&n->refcnt) == 1 &&
790 			    (state == NUD_FAILED ||
791 			     time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
792 				*np = n->next;
793 				n->dead = 1;
794 				write_unlock(&n->lock);
795 				neigh_cleanup_and_release(n);
796 				continue;
797 			}
798 			write_unlock(&n->lock);
799 
800 next_elt:
801 			np = &n->next;
802 		}
803 		/*
804 		 * It's fine to release lock here, even if hash table
805 		 * grows while we are preempted.
806 		 */
807 		write_unlock_bh(&tbl->lock);
808 		cond_resched();
809 		write_lock_bh(&tbl->lock);
810 		nht = rcu_dereference_protected(tbl->nht,
811 						lockdep_is_held(&tbl->lock));
812 	}
813 out:
814 	/* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
815 	 * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
816 	 * BASE_REACHABLE_TIME.
817 	 */
818 	queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
819 			      NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
820 	write_unlock_bh(&tbl->lock);
821 }
822 
823 static __inline__ int neigh_max_probes(struct neighbour *n)
824 {
825 	struct neigh_parms *p = n->parms;
826 	return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
827 	       (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
828 	        NEIGH_VAR(p, MCAST_PROBES));
829 }
830 
831 static void neigh_invalidate(struct neighbour *neigh)
832 	__releases(neigh->lock)
833 	__acquires(neigh->lock)
834 {
835 	struct sk_buff *skb;
836 
837 	NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
838 	neigh_dbg(2, "neigh %p is failed\n", neigh);
839 	neigh->updated = jiffies;
840 
841 	/* It is very thin place. report_unreachable is very complicated
842 	   routine. Particularly, it can hit the same neighbour entry!
843 
844 	   So that, we try to be accurate and avoid dead loop. --ANK
845 	 */
846 	while (neigh->nud_state == NUD_FAILED &&
847 	       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
848 		write_unlock(&neigh->lock);
849 		neigh->ops->error_report(neigh, skb);
850 		write_lock(&neigh->lock);
851 	}
852 	__skb_queue_purge(&neigh->arp_queue);
853 	neigh->arp_queue_len_bytes = 0;
854 }
855 
856 static void neigh_probe(struct neighbour *neigh)
857 	__releases(neigh->lock)
858 {
859 	struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
860 	/* keep skb alive even if arp_queue overflows */
861 	if (skb)
862 		skb = skb_clone(skb, GFP_ATOMIC);
863 	write_unlock(&neigh->lock);
864 	if (neigh->ops->solicit)
865 		neigh->ops->solicit(neigh, skb);
866 	atomic_inc(&neigh->probes);
867 	kfree_skb(skb);
868 }
869 
870 /* Called when a timer expires for a neighbour entry. */
871 
872 static void neigh_timer_handler(unsigned long arg)
873 {
874 	unsigned long now, next;
875 	struct neighbour *neigh = (struct neighbour *)arg;
876 	unsigned int state;
877 	int notify = 0;
878 
879 	write_lock(&neigh->lock);
880 
881 	state = neigh->nud_state;
882 	now = jiffies;
883 	next = now + HZ;
884 
885 	if (!(state & NUD_IN_TIMER))
886 		goto out;
887 
888 	if (state & NUD_REACHABLE) {
889 		if (time_before_eq(now,
890 				   neigh->confirmed + neigh->parms->reachable_time)) {
891 			neigh_dbg(2, "neigh %p is still alive\n", neigh);
892 			next = neigh->confirmed + neigh->parms->reachable_time;
893 		} else if (time_before_eq(now,
894 					  neigh->used +
895 					  NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
896 			neigh_dbg(2, "neigh %p is delayed\n", neigh);
897 			neigh->nud_state = NUD_DELAY;
898 			neigh->updated = jiffies;
899 			neigh_suspect(neigh);
900 			next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
901 		} else {
902 			neigh_dbg(2, "neigh %p is suspected\n", neigh);
903 			neigh->nud_state = NUD_STALE;
904 			neigh->updated = jiffies;
905 			neigh_suspect(neigh);
906 			notify = 1;
907 		}
908 	} else if (state & NUD_DELAY) {
909 		if (time_before_eq(now,
910 				   neigh->confirmed +
911 				   NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
912 			neigh_dbg(2, "neigh %p is now reachable\n", neigh);
913 			neigh->nud_state = NUD_REACHABLE;
914 			neigh->updated = jiffies;
915 			neigh_connect(neigh);
916 			notify = 1;
917 			next = neigh->confirmed + neigh->parms->reachable_time;
918 		} else {
919 			neigh_dbg(2, "neigh %p is probed\n", neigh);
920 			neigh->nud_state = NUD_PROBE;
921 			neigh->updated = jiffies;
922 			atomic_set(&neigh->probes, 0);
923 			notify = 1;
924 			next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
925 		}
926 	} else {
927 		/* NUD_PROBE|NUD_INCOMPLETE */
928 		next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
929 	}
930 
931 	if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
932 	    atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
933 		neigh->nud_state = NUD_FAILED;
934 		notify = 1;
935 		neigh_invalidate(neigh);
936 		goto out;
937 	}
938 
939 	if (neigh->nud_state & NUD_IN_TIMER) {
940 		if (time_before(next, jiffies + HZ/2))
941 			next = jiffies + HZ/2;
942 		if (!mod_timer(&neigh->timer, next))
943 			neigh_hold(neigh);
944 	}
945 	if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
946 		neigh_probe(neigh);
947 	} else {
948 out:
949 		write_unlock(&neigh->lock);
950 	}
951 
952 	if (notify)
953 		neigh_update_notify(neigh, 0);
954 
955 	neigh_release(neigh);
956 }
957 
958 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
959 {
960 	int rc;
961 	bool immediate_probe = false;
962 
963 	write_lock_bh(&neigh->lock);
964 
965 	rc = 0;
966 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
967 		goto out_unlock_bh;
968 	if (neigh->dead)
969 		goto out_dead;
970 
971 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
972 		if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
973 		    NEIGH_VAR(neigh->parms, APP_PROBES)) {
974 			unsigned long next, now = jiffies;
975 
976 			atomic_set(&neigh->probes,
977 				   NEIGH_VAR(neigh->parms, UCAST_PROBES));
978 			neigh->nud_state     = NUD_INCOMPLETE;
979 			neigh->updated = now;
980 			next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
981 					 HZ/2);
982 			neigh_add_timer(neigh, next);
983 			immediate_probe = true;
984 		} else {
985 			neigh->nud_state = NUD_FAILED;
986 			neigh->updated = jiffies;
987 			write_unlock_bh(&neigh->lock);
988 
989 			kfree_skb(skb);
990 			return 1;
991 		}
992 	} else if (neigh->nud_state & NUD_STALE) {
993 		neigh_dbg(2, "neigh %p is delayed\n", neigh);
994 		neigh->nud_state = NUD_DELAY;
995 		neigh->updated = jiffies;
996 		neigh_add_timer(neigh, jiffies +
997 				NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
998 	}
999 
1000 	if (neigh->nud_state == NUD_INCOMPLETE) {
1001 		if (skb) {
1002 			while (neigh->arp_queue_len_bytes + skb->truesize >
1003 			       NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1004 				struct sk_buff *buff;
1005 
1006 				buff = __skb_dequeue(&neigh->arp_queue);
1007 				if (!buff)
1008 					break;
1009 				neigh->arp_queue_len_bytes -= buff->truesize;
1010 				kfree_skb(buff);
1011 				NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1012 			}
1013 			skb_dst_force(skb);
1014 			__skb_queue_tail(&neigh->arp_queue, skb);
1015 			neigh->arp_queue_len_bytes += skb->truesize;
1016 		}
1017 		rc = 1;
1018 	}
1019 out_unlock_bh:
1020 	if (immediate_probe)
1021 		neigh_probe(neigh);
1022 	else
1023 		write_unlock(&neigh->lock);
1024 	local_bh_enable();
1025 	return rc;
1026 
1027 out_dead:
1028 	if (neigh->nud_state & NUD_STALE)
1029 		goto out_unlock_bh;
1030 	write_unlock_bh(&neigh->lock);
1031 	kfree_skb(skb);
1032 	return 1;
1033 }
1034 EXPORT_SYMBOL(__neigh_event_send);
1035 
1036 static void neigh_update_hhs(struct neighbour *neigh)
1037 {
1038 	struct hh_cache *hh;
1039 	void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1040 		= NULL;
1041 
1042 	if (neigh->dev->header_ops)
1043 		update = neigh->dev->header_ops->cache_update;
1044 
1045 	if (update) {
1046 		hh = &neigh->hh;
1047 		if (hh->hh_len) {
1048 			write_seqlock_bh(&hh->hh_lock);
1049 			update(hh, neigh->dev, neigh->ha);
1050 			write_sequnlock_bh(&hh->hh_lock);
1051 		}
1052 	}
1053 }
1054 
1055 
1056 
1057 /* Generic update routine.
1058    -- lladdr is new lladdr or NULL, if it is not supplied.
1059    -- new    is new state.
1060    -- flags
1061 	NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1062 				if it is different.
1063 	NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1064 				lladdr instead of overriding it
1065 				if it is different.
1066 	NEIGH_UPDATE_F_ADMIN	means that the change is administrative.
1067 
1068 	NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1069 				NTF_ROUTER flag.
1070 	NEIGH_UPDATE_F_ISROUTER	indicates if the neighbour is known as
1071 				a router.
1072 
1073    Caller MUST hold reference count on the entry.
1074  */
1075 
1076 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1077 		 u32 flags, u32 nlmsg_pid)
1078 {
1079 	u8 old;
1080 	int err;
1081 	int notify = 0;
1082 	struct net_device *dev;
1083 	int update_isrouter = 0;
1084 
1085 	write_lock_bh(&neigh->lock);
1086 
1087 	dev    = neigh->dev;
1088 	old    = neigh->nud_state;
1089 	err    = -EPERM;
1090 
1091 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1092 	    (old & (NUD_NOARP | NUD_PERMANENT)))
1093 		goto out;
1094 	if (neigh->dead)
1095 		goto out;
1096 
1097 	if (!(new & NUD_VALID)) {
1098 		neigh_del_timer(neigh);
1099 		if (old & NUD_CONNECTED)
1100 			neigh_suspect(neigh);
1101 		neigh->nud_state = new;
1102 		err = 0;
1103 		notify = old & NUD_VALID;
1104 		if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1105 		    (new & NUD_FAILED)) {
1106 			neigh_invalidate(neigh);
1107 			notify = 1;
1108 		}
1109 		goto out;
1110 	}
1111 
1112 	/* Compare new lladdr with cached one */
1113 	if (!dev->addr_len) {
1114 		/* First case: device needs no address. */
1115 		lladdr = neigh->ha;
1116 	} else if (lladdr) {
1117 		/* The second case: if something is already cached
1118 		   and a new address is proposed:
1119 		   - compare new & old
1120 		   - if they are different, check override flag
1121 		 */
1122 		if ((old & NUD_VALID) &&
1123 		    !memcmp(lladdr, neigh->ha, dev->addr_len))
1124 			lladdr = neigh->ha;
1125 	} else {
1126 		/* No address is supplied; if we know something,
1127 		   use it, otherwise discard the request.
1128 		 */
1129 		err = -EINVAL;
1130 		if (!(old & NUD_VALID))
1131 			goto out;
1132 		lladdr = neigh->ha;
1133 	}
1134 
1135 	if (new & NUD_CONNECTED)
1136 		neigh->confirmed = jiffies;
1137 	neigh->updated = jiffies;
1138 
1139 	/* If entry was valid and address is not changed,
1140 	   do not change entry state, if new one is STALE.
1141 	 */
1142 	err = 0;
1143 	update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1144 	if (old & NUD_VALID) {
1145 		if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1146 			update_isrouter = 0;
1147 			if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1148 			    (old & NUD_CONNECTED)) {
1149 				lladdr = neigh->ha;
1150 				new = NUD_STALE;
1151 			} else
1152 				goto out;
1153 		} else {
1154 			if (lladdr == neigh->ha && new == NUD_STALE &&
1155 			    !(flags & NEIGH_UPDATE_F_ADMIN))
1156 				new = old;
1157 		}
1158 	}
1159 
1160 	if (new != old) {
1161 		neigh_del_timer(neigh);
1162 		if (new & NUD_PROBE)
1163 			atomic_set(&neigh->probes, 0);
1164 		if (new & NUD_IN_TIMER)
1165 			neigh_add_timer(neigh, (jiffies +
1166 						((new & NUD_REACHABLE) ?
1167 						 neigh->parms->reachable_time :
1168 						 0)));
1169 		neigh->nud_state = new;
1170 		notify = 1;
1171 	}
1172 
1173 	if (lladdr != neigh->ha) {
1174 		write_seqlock(&neigh->ha_lock);
1175 		memcpy(&neigh->ha, lladdr, dev->addr_len);
1176 		write_sequnlock(&neigh->ha_lock);
1177 		neigh_update_hhs(neigh);
1178 		if (!(new & NUD_CONNECTED))
1179 			neigh->confirmed = jiffies -
1180 				      (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1181 		notify = 1;
1182 	}
1183 	if (new == old)
1184 		goto out;
1185 	if (new & NUD_CONNECTED)
1186 		neigh_connect(neigh);
1187 	else
1188 		neigh_suspect(neigh);
1189 	if (!(old & NUD_VALID)) {
1190 		struct sk_buff *skb;
1191 
1192 		/* Again: avoid dead loop if something went wrong */
1193 
1194 		while (neigh->nud_state & NUD_VALID &&
1195 		       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1196 			struct dst_entry *dst = skb_dst(skb);
1197 			struct neighbour *n2, *n1 = neigh;
1198 			write_unlock_bh(&neigh->lock);
1199 
1200 			rcu_read_lock();
1201 
1202 			/* Why not just use 'neigh' as-is?  The problem is that
1203 			 * things such as shaper, eql, and sch_teql can end up
1204 			 * using alternative, different, neigh objects to output
1205 			 * the packet in the output path.  So what we need to do
1206 			 * here is re-lookup the top-level neigh in the path so
1207 			 * we can reinject the packet there.
1208 			 */
1209 			n2 = NULL;
1210 			if (dst) {
1211 				n2 = dst_neigh_lookup_skb(dst, skb);
1212 				if (n2)
1213 					n1 = n2;
1214 			}
1215 			n1->output(n1, skb);
1216 			if (n2)
1217 				neigh_release(n2);
1218 			rcu_read_unlock();
1219 
1220 			write_lock_bh(&neigh->lock);
1221 		}
1222 		__skb_queue_purge(&neigh->arp_queue);
1223 		neigh->arp_queue_len_bytes = 0;
1224 	}
1225 out:
1226 	if (update_isrouter) {
1227 		neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1228 			(neigh->flags | NTF_ROUTER) :
1229 			(neigh->flags & ~NTF_ROUTER);
1230 	}
1231 	write_unlock_bh(&neigh->lock);
1232 
1233 	if (notify)
1234 		neigh_update_notify(neigh, nlmsg_pid);
1235 
1236 	return err;
1237 }
1238 EXPORT_SYMBOL(neigh_update);
1239 
1240 /* Update the neigh to listen temporarily for probe responses, even if it is
1241  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1242  */
1243 void __neigh_set_probe_once(struct neighbour *neigh)
1244 {
1245 	if (neigh->dead)
1246 		return;
1247 	neigh->updated = jiffies;
1248 	if (!(neigh->nud_state & NUD_FAILED))
1249 		return;
1250 	neigh->nud_state = NUD_INCOMPLETE;
1251 	atomic_set(&neigh->probes, neigh_max_probes(neigh));
1252 	neigh_add_timer(neigh,
1253 			jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1254 }
1255 EXPORT_SYMBOL(__neigh_set_probe_once);
1256 
1257 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1258 				 u8 *lladdr, void *saddr,
1259 				 struct net_device *dev)
1260 {
1261 	struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1262 						 lladdr || !dev->addr_len);
1263 	if (neigh)
1264 		neigh_update(neigh, lladdr, NUD_STALE,
1265 			     NEIGH_UPDATE_F_OVERRIDE, 0);
1266 	return neigh;
1267 }
1268 EXPORT_SYMBOL(neigh_event_ns);
1269 
1270 /* called with read_lock_bh(&n->lock); */
1271 static void neigh_hh_init(struct neighbour *n)
1272 {
1273 	struct net_device *dev = n->dev;
1274 	__be16 prot = n->tbl->protocol;
1275 	struct hh_cache	*hh = &n->hh;
1276 
1277 	write_lock_bh(&n->lock);
1278 
1279 	/* Only one thread can come in here and initialize the
1280 	 * hh_cache entry.
1281 	 */
1282 	if (!hh->hh_len)
1283 		dev->header_ops->cache(n, hh, prot);
1284 
1285 	write_unlock_bh(&n->lock);
1286 }
1287 
1288 /* Slow and careful. */
1289 
1290 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1291 {
1292 	int rc = 0;
1293 
1294 	if (!neigh_event_send(neigh, skb)) {
1295 		int err;
1296 		struct net_device *dev = neigh->dev;
1297 		unsigned int seq;
1298 
1299 		if (dev->header_ops->cache && !neigh->hh.hh_len)
1300 			neigh_hh_init(neigh);
1301 
1302 		do {
1303 			__skb_pull(skb, skb_network_offset(skb));
1304 			seq = read_seqbegin(&neigh->ha_lock);
1305 			err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1306 					      neigh->ha, NULL, skb->len);
1307 		} while (read_seqretry(&neigh->ha_lock, seq));
1308 
1309 		if (err >= 0)
1310 			rc = dev_queue_xmit(skb);
1311 		else
1312 			goto out_kfree_skb;
1313 	}
1314 out:
1315 	return rc;
1316 out_kfree_skb:
1317 	rc = -EINVAL;
1318 	kfree_skb(skb);
1319 	goto out;
1320 }
1321 EXPORT_SYMBOL(neigh_resolve_output);
1322 
1323 /* As fast as possible without hh cache */
1324 
1325 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1326 {
1327 	struct net_device *dev = neigh->dev;
1328 	unsigned int seq;
1329 	int err;
1330 
1331 	do {
1332 		__skb_pull(skb, skb_network_offset(skb));
1333 		seq = read_seqbegin(&neigh->ha_lock);
1334 		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1335 				      neigh->ha, NULL, skb->len);
1336 	} while (read_seqretry(&neigh->ha_lock, seq));
1337 
1338 	if (err >= 0)
1339 		err = dev_queue_xmit(skb);
1340 	else {
1341 		err = -EINVAL;
1342 		kfree_skb(skb);
1343 	}
1344 	return err;
1345 }
1346 EXPORT_SYMBOL(neigh_connected_output);
1347 
1348 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1349 {
1350 	return dev_queue_xmit(skb);
1351 }
1352 EXPORT_SYMBOL(neigh_direct_output);
1353 
1354 static void neigh_proxy_process(unsigned long arg)
1355 {
1356 	struct neigh_table *tbl = (struct neigh_table *)arg;
1357 	long sched_next = 0;
1358 	unsigned long now = jiffies;
1359 	struct sk_buff *skb, *n;
1360 
1361 	spin_lock(&tbl->proxy_queue.lock);
1362 
1363 	skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1364 		long tdif = NEIGH_CB(skb)->sched_next - now;
1365 
1366 		if (tdif <= 0) {
1367 			struct net_device *dev = skb->dev;
1368 
1369 			__skb_unlink(skb, &tbl->proxy_queue);
1370 			if (tbl->proxy_redo && netif_running(dev)) {
1371 				rcu_read_lock();
1372 				tbl->proxy_redo(skb);
1373 				rcu_read_unlock();
1374 			} else {
1375 				kfree_skb(skb);
1376 			}
1377 
1378 			dev_put(dev);
1379 		} else if (!sched_next || tdif < sched_next)
1380 			sched_next = tdif;
1381 	}
1382 	del_timer(&tbl->proxy_timer);
1383 	if (sched_next)
1384 		mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1385 	spin_unlock(&tbl->proxy_queue.lock);
1386 }
1387 
1388 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1389 		    struct sk_buff *skb)
1390 {
1391 	unsigned long now = jiffies;
1392 
1393 	unsigned long sched_next = now + (prandom_u32() %
1394 					  NEIGH_VAR(p, PROXY_DELAY));
1395 
1396 	if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1397 		kfree_skb(skb);
1398 		return;
1399 	}
1400 
1401 	NEIGH_CB(skb)->sched_next = sched_next;
1402 	NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1403 
1404 	spin_lock(&tbl->proxy_queue.lock);
1405 	if (del_timer(&tbl->proxy_timer)) {
1406 		if (time_before(tbl->proxy_timer.expires, sched_next))
1407 			sched_next = tbl->proxy_timer.expires;
1408 	}
1409 	skb_dst_drop(skb);
1410 	dev_hold(skb->dev);
1411 	__skb_queue_tail(&tbl->proxy_queue, skb);
1412 	mod_timer(&tbl->proxy_timer, sched_next);
1413 	spin_unlock(&tbl->proxy_queue.lock);
1414 }
1415 EXPORT_SYMBOL(pneigh_enqueue);
1416 
1417 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1418 						      struct net *net, int ifindex)
1419 {
1420 	struct neigh_parms *p;
1421 
1422 	list_for_each_entry(p, &tbl->parms_list, list) {
1423 		if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1424 		    (!p->dev && !ifindex && net_eq(net, &init_net)))
1425 			return p;
1426 	}
1427 
1428 	return NULL;
1429 }
1430 
1431 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1432 				      struct neigh_table *tbl)
1433 {
1434 	struct neigh_parms *p;
1435 	struct net *net = dev_net(dev);
1436 	const struct net_device_ops *ops = dev->netdev_ops;
1437 
1438 	p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1439 	if (p) {
1440 		p->tbl		  = tbl;
1441 		atomic_set(&p->refcnt, 1);
1442 		p->reachable_time =
1443 				neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1444 		dev_hold(dev);
1445 		p->dev = dev;
1446 		write_pnet(&p->net, net);
1447 		p->sysctl_table = NULL;
1448 
1449 		if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1450 			dev_put(dev);
1451 			kfree(p);
1452 			return NULL;
1453 		}
1454 
1455 		write_lock_bh(&tbl->lock);
1456 		list_add(&p->list, &tbl->parms.list);
1457 		write_unlock_bh(&tbl->lock);
1458 
1459 		neigh_parms_data_state_cleanall(p);
1460 	}
1461 	return p;
1462 }
1463 EXPORT_SYMBOL(neigh_parms_alloc);
1464 
1465 static void neigh_rcu_free_parms(struct rcu_head *head)
1466 {
1467 	struct neigh_parms *parms =
1468 		container_of(head, struct neigh_parms, rcu_head);
1469 
1470 	neigh_parms_put(parms);
1471 }
1472 
1473 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1474 {
1475 	if (!parms || parms == &tbl->parms)
1476 		return;
1477 	write_lock_bh(&tbl->lock);
1478 	list_del(&parms->list);
1479 	parms->dead = 1;
1480 	write_unlock_bh(&tbl->lock);
1481 	if (parms->dev)
1482 		dev_put(parms->dev);
1483 	call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1484 }
1485 EXPORT_SYMBOL(neigh_parms_release);
1486 
1487 static void neigh_parms_destroy(struct neigh_parms *parms)
1488 {
1489 	kfree(parms);
1490 }
1491 
1492 static struct lock_class_key neigh_table_proxy_queue_class;
1493 
1494 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1495 
1496 void neigh_table_init(int index, struct neigh_table *tbl)
1497 {
1498 	unsigned long now = jiffies;
1499 	unsigned long phsize;
1500 
1501 	INIT_LIST_HEAD(&tbl->parms_list);
1502 	list_add(&tbl->parms.list, &tbl->parms_list);
1503 	write_pnet(&tbl->parms.net, &init_net);
1504 	atomic_set(&tbl->parms.refcnt, 1);
1505 	tbl->parms.reachable_time =
1506 			  neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1507 
1508 	tbl->stats = alloc_percpu(struct neigh_statistics);
1509 	if (!tbl->stats)
1510 		panic("cannot create neighbour cache statistics");
1511 
1512 #ifdef CONFIG_PROC_FS
1513 	if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1514 			      &neigh_stat_seq_fops, tbl))
1515 		panic("cannot create neighbour proc dir entry");
1516 #endif
1517 
1518 	RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1519 
1520 	phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1521 	tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1522 
1523 	if (!tbl->nht || !tbl->phash_buckets)
1524 		panic("cannot allocate neighbour cache hashes");
1525 
1526 	if (!tbl->entry_size)
1527 		tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1528 					tbl->key_len, NEIGH_PRIV_ALIGN);
1529 	else
1530 		WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1531 
1532 	rwlock_init(&tbl->lock);
1533 	INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1534 	queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1535 			tbl->parms.reachable_time);
1536 	setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1537 	skb_queue_head_init_class(&tbl->proxy_queue,
1538 			&neigh_table_proxy_queue_class);
1539 
1540 	tbl->last_flush = now;
1541 	tbl->last_rand	= now + tbl->parms.reachable_time * 20;
1542 
1543 	neigh_tables[index] = tbl;
1544 }
1545 EXPORT_SYMBOL(neigh_table_init);
1546 
1547 int neigh_table_clear(int index, struct neigh_table *tbl)
1548 {
1549 	neigh_tables[index] = NULL;
1550 	/* It is not clean... Fix it to unload IPv6 module safely */
1551 	cancel_delayed_work_sync(&tbl->gc_work);
1552 	del_timer_sync(&tbl->proxy_timer);
1553 	pneigh_queue_purge(&tbl->proxy_queue);
1554 	neigh_ifdown(tbl, NULL);
1555 	if (atomic_read(&tbl->entries))
1556 		pr_crit("neighbour leakage\n");
1557 
1558 	call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1559 		 neigh_hash_free_rcu);
1560 	tbl->nht = NULL;
1561 
1562 	kfree(tbl->phash_buckets);
1563 	tbl->phash_buckets = NULL;
1564 
1565 	remove_proc_entry(tbl->id, init_net.proc_net_stat);
1566 
1567 	free_percpu(tbl->stats);
1568 	tbl->stats = NULL;
1569 
1570 	return 0;
1571 }
1572 EXPORT_SYMBOL(neigh_table_clear);
1573 
1574 static struct neigh_table *neigh_find_table(int family)
1575 {
1576 	struct neigh_table *tbl = NULL;
1577 
1578 	switch (family) {
1579 	case AF_INET:
1580 		tbl = neigh_tables[NEIGH_ARP_TABLE];
1581 		break;
1582 	case AF_INET6:
1583 		tbl = neigh_tables[NEIGH_ND_TABLE];
1584 		break;
1585 	case AF_DECnet:
1586 		tbl = neigh_tables[NEIGH_DN_TABLE];
1587 		break;
1588 	}
1589 
1590 	return tbl;
1591 }
1592 
1593 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1594 			struct netlink_ext_ack *extack)
1595 {
1596 	struct net *net = sock_net(skb->sk);
1597 	struct ndmsg *ndm;
1598 	struct nlattr *dst_attr;
1599 	struct neigh_table *tbl;
1600 	struct neighbour *neigh;
1601 	struct net_device *dev = NULL;
1602 	int err = -EINVAL;
1603 
1604 	ASSERT_RTNL();
1605 	if (nlmsg_len(nlh) < sizeof(*ndm))
1606 		goto out;
1607 
1608 	dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1609 	if (dst_attr == NULL)
1610 		goto out;
1611 
1612 	ndm = nlmsg_data(nlh);
1613 	if (ndm->ndm_ifindex) {
1614 		dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1615 		if (dev == NULL) {
1616 			err = -ENODEV;
1617 			goto out;
1618 		}
1619 	}
1620 
1621 	tbl = neigh_find_table(ndm->ndm_family);
1622 	if (tbl == NULL)
1623 		return -EAFNOSUPPORT;
1624 
1625 	if (nla_len(dst_attr) < tbl->key_len)
1626 		goto out;
1627 
1628 	if (ndm->ndm_flags & NTF_PROXY) {
1629 		err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1630 		goto out;
1631 	}
1632 
1633 	if (dev == NULL)
1634 		goto out;
1635 
1636 	neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1637 	if (neigh == NULL) {
1638 		err = -ENOENT;
1639 		goto out;
1640 	}
1641 
1642 	err = neigh_update(neigh, NULL, NUD_FAILED,
1643 			   NEIGH_UPDATE_F_OVERRIDE |
1644 			   NEIGH_UPDATE_F_ADMIN,
1645 			   NETLINK_CB(skb).portid);
1646 	neigh_release(neigh);
1647 
1648 out:
1649 	return err;
1650 }
1651 
1652 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1653 		     struct netlink_ext_ack *extack)
1654 {
1655 	int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1656 	struct net *net = sock_net(skb->sk);
1657 	struct ndmsg *ndm;
1658 	struct nlattr *tb[NDA_MAX+1];
1659 	struct neigh_table *tbl;
1660 	struct net_device *dev = NULL;
1661 	struct neighbour *neigh;
1662 	void *dst, *lladdr;
1663 	int err;
1664 
1665 	ASSERT_RTNL();
1666 	err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL, extack);
1667 	if (err < 0)
1668 		goto out;
1669 
1670 	err = -EINVAL;
1671 	if (tb[NDA_DST] == NULL)
1672 		goto out;
1673 
1674 	ndm = nlmsg_data(nlh);
1675 	if (ndm->ndm_ifindex) {
1676 		dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1677 		if (dev == NULL) {
1678 			err = -ENODEV;
1679 			goto out;
1680 		}
1681 
1682 		if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1683 			goto out;
1684 	}
1685 
1686 	tbl = neigh_find_table(ndm->ndm_family);
1687 	if (tbl == NULL)
1688 		return -EAFNOSUPPORT;
1689 
1690 	if (nla_len(tb[NDA_DST]) < tbl->key_len)
1691 		goto out;
1692 	dst = nla_data(tb[NDA_DST]);
1693 	lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1694 
1695 	if (ndm->ndm_flags & NTF_PROXY) {
1696 		struct pneigh_entry *pn;
1697 
1698 		err = -ENOBUFS;
1699 		pn = pneigh_lookup(tbl, net, dst, dev, 1);
1700 		if (pn) {
1701 			pn->flags = ndm->ndm_flags;
1702 			err = 0;
1703 		}
1704 		goto out;
1705 	}
1706 
1707 	if (dev == NULL)
1708 		goto out;
1709 
1710 	neigh = neigh_lookup(tbl, dst, dev);
1711 	if (neigh == NULL) {
1712 		if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1713 			err = -ENOENT;
1714 			goto out;
1715 		}
1716 
1717 		neigh = __neigh_lookup_errno(tbl, dst, dev);
1718 		if (IS_ERR(neigh)) {
1719 			err = PTR_ERR(neigh);
1720 			goto out;
1721 		}
1722 	} else {
1723 		if (nlh->nlmsg_flags & NLM_F_EXCL) {
1724 			err = -EEXIST;
1725 			neigh_release(neigh);
1726 			goto out;
1727 		}
1728 
1729 		if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1730 			flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1731 	}
1732 
1733 	if (ndm->ndm_flags & NTF_USE) {
1734 		neigh_event_send(neigh, NULL);
1735 		err = 0;
1736 	} else
1737 		err = neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1738 				   NETLINK_CB(skb).portid);
1739 	neigh_release(neigh);
1740 
1741 out:
1742 	return err;
1743 }
1744 
1745 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1746 {
1747 	struct nlattr *nest;
1748 
1749 	nest = nla_nest_start(skb, NDTA_PARMS);
1750 	if (nest == NULL)
1751 		return -ENOBUFS;
1752 
1753 	if ((parms->dev &&
1754 	     nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1755 	    nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
1756 	    nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1757 			NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1758 	    /* approximative value for deprecated QUEUE_LEN (in packets) */
1759 	    nla_put_u32(skb, NDTPA_QUEUE_LEN,
1760 			NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1761 	    nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1762 	    nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1763 	    nla_put_u32(skb, NDTPA_UCAST_PROBES,
1764 			NEIGH_VAR(parms, UCAST_PROBES)) ||
1765 	    nla_put_u32(skb, NDTPA_MCAST_PROBES,
1766 			NEIGH_VAR(parms, MCAST_PROBES)) ||
1767 	    nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1768 			NEIGH_VAR(parms, MCAST_REPROBES)) ||
1769 	    nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
1770 			  NDTPA_PAD) ||
1771 	    nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1772 			  NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
1773 	    nla_put_msecs(skb, NDTPA_GC_STALETIME,
1774 			  NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
1775 	    nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1776 			  NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
1777 	    nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1778 			  NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
1779 	    nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1780 			  NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
1781 	    nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1782 			  NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
1783 	    nla_put_msecs(skb, NDTPA_LOCKTIME,
1784 			  NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
1785 		goto nla_put_failure;
1786 	return nla_nest_end(skb, nest);
1787 
1788 nla_put_failure:
1789 	nla_nest_cancel(skb, nest);
1790 	return -EMSGSIZE;
1791 }
1792 
1793 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1794 			      u32 pid, u32 seq, int type, int flags)
1795 {
1796 	struct nlmsghdr *nlh;
1797 	struct ndtmsg *ndtmsg;
1798 
1799 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1800 	if (nlh == NULL)
1801 		return -EMSGSIZE;
1802 
1803 	ndtmsg = nlmsg_data(nlh);
1804 
1805 	read_lock_bh(&tbl->lock);
1806 	ndtmsg->ndtm_family = tbl->family;
1807 	ndtmsg->ndtm_pad1   = 0;
1808 	ndtmsg->ndtm_pad2   = 0;
1809 
1810 	if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1811 	    nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
1812 	    nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1813 	    nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1814 	    nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1815 		goto nla_put_failure;
1816 	{
1817 		unsigned long now = jiffies;
1818 		unsigned int flush_delta = now - tbl->last_flush;
1819 		unsigned int rand_delta = now - tbl->last_rand;
1820 		struct neigh_hash_table *nht;
1821 		struct ndt_config ndc = {
1822 			.ndtc_key_len		= tbl->key_len,
1823 			.ndtc_entry_size	= tbl->entry_size,
1824 			.ndtc_entries		= atomic_read(&tbl->entries),
1825 			.ndtc_last_flush	= jiffies_to_msecs(flush_delta),
1826 			.ndtc_last_rand		= jiffies_to_msecs(rand_delta),
1827 			.ndtc_proxy_qlen	= tbl->proxy_queue.qlen,
1828 		};
1829 
1830 		rcu_read_lock_bh();
1831 		nht = rcu_dereference_bh(tbl->nht);
1832 		ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1833 		ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1834 		rcu_read_unlock_bh();
1835 
1836 		if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1837 			goto nla_put_failure;
1838 	}
1839 
1840 	{
1841 		int cpu;
1842 		struct ndt_stats ndst;
1843 
1844 		memset(&ndst, 0, sizeof(ndst));
1845 
1846 		for_each_possible_cpu(cpu) {
1847 			struct neigh_statistics	*st;
1848 
1849 			st = per_cpu_ptr(tbl->stats, cpu);
1850 			ndst.ndts_allocs		+= st->allocs;
1851 			ndst.ndts_destroys		+= st->destroys;
1852 			ndst.ndts_hash_grows		+= st->hash_grows;
1853 			ndst.ndts_res_failed		+= st->res_failed;
1854 			ndst.ndts_lookups		+= st->lookups;
1855 			ndst.ndts_hits			+= st->hits;
1856 			ndst.ndts_rcv_probes_mcast	+= st->rcv_probes_mcast;
1857 			ndst.ndts_rcv_probes_ucast	+= st->rcv_probes_ucast;
1858 			ndst.ndts_periodic_gc_runs	+= st->periodic_gc_runs;
1859 			ndst.ndts_forced_gc_runs	+= st->forced_gc_runs;
1860 			ndst.ndts_table_fulls		+= st->table_fulls;
1861 		}
1862 
1863 		if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
1864 				  NDTA_PAD))
1865 			goto nla_put_failure;
1866 	}
1867 
1868 	BUG_ON(tbl->parms.dev);
1869 	if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1870 		goto nla_put_failure;
1871 
1872 	read_unlock_bh(&tbl->lock);
1873 	nlmsg_end(skb, nlh);
1874 	return 0;
1875 
1876 nla_put_failure:
1877 	read_unlock_bh(&tbl->lock);
1878 	nlmsg_cancel(skb, nlh);
1879 	return -EMSGSIZE;
1880 }
1881 
1882 static int neightbl_fill_param_info(struct sk_buff *skb,
1883 				    struct neigh_table *tbl,
1884 				    struct neigh_parms *parms,
1885 				    u32 pid, u32 seq, int type,
1886 				    unsigned int flags)
1887 {
1888 	struct ndtmsg *ndtmsg;
1889 	struct nlmsghdr *nlh;
1890 
1891 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1892 	if (nlh == NULL)
1893 		return -EMSGSIZE;
1894 
1895 	ndtmsg = nlmsg_data(nlh);
1896 
1897 	read_lock_bh(&tbl->lock);
1898 	ndtmsg->ndtm_family = tbl->family;
1899 	ndtmsg->ndtm_pad1   = 0;
1900 	ndtmsg->ndtm_pad2   = 0;
1901 
1902 	if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1903 	    neightbl_fill_parms(skb, parms) < 0)
1904 		goto errout;
1905 
1906 	read_unlock_bh(&tbl->lock);
1907 	nlmsg_end(skb, nlh);
1908 	return 0;
1909 errout:
1910 	read_unlock_bh(&tbl->lock);
1911 	nlmsg_cancel(skb, nlh);
1912 	return -EMSGSIZE;
1913 }
1914 
1915 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1916 	[NDTA_NAME]		= { .type = NLA_STRING },
1917 	[NDTA_THRESH1]		= { .type = NLA_U32 },
1918 	[NDTA_THRESH2]		= { .type = NLA_U32 },
1919 	[NDTA_THRESH3]		= { .type = NLA_U32 },
1920 	[NDTA_GC_INTERVAL]	= { .type = NLA_U64 },
1921 	[NDTA_PARMS]		= { .type = NLA_NESTED },
1922 };
1923 
1924 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1925 	[NDTPA_IFINDEX]			= { .type = NLA_U32 },
1926 	[NDTPA_QUEUE_LEN]		= { .type = NLA_U32 },
1927 	[NDTPA_PROXY_QLEN]		= { .type = NLA_U32 },
1928 	[NDTPA_APP_PROBES]		= { .type = NLA_U32 },
1929 	[NDTPA_UCAST_PROBES]		= { .type = NLA_U32 },
1930 	[NDTPA_MCAST_PROBES]		= { .type = NLA_U32 },
1931 	[NDTPA_MCAST_REPROBES]		= { .type = NLA_U32 },
1932 	[NDTPA_BASE_REACHABLE_TIME]	= { .type = NLA_U64 },
1933 	[NDTPA_GC_STALETIME]		= { .type = NLA_U64 },
1934 	[NDTPA_DELAY_PROBE_TIME]	= { .type = NLA_U64 },
1935 	[NDTPA_RETRANS_TIME]		= { .type = NLA_U64 },
1936 	[NDTPA_ANYCAST_DELAY]		= { .type = NLA_U64 },
1937 	[NDTPA_PROXY_DELAY]		= { .type = NLA_U64 },
1938 	[NDTPA_LOCKTIME]		= { .type = NLA_U64 },
1939 };
1940 
1941 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
1942 			struct netlink_ext_ack *extack)
1943 {
1944 	struct net *net = sock_net(skb->sk);
1945 	struct neigh_table *tbl;
1946 	struct ndtmsg *ndtmsg;
1947 	struct nlattr *tb[NDTA_MAX+1];
1948 	bool found = false;
1949 	int err, tidx;
1950 
1951 	err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1952 			  nl_neightbl_policy, extack);
1953 	if (err < 0)
1954 		goto errout;
1955 
1956 	if (tb[NDTA_NAME] == NULL) {
1957 		err = -EINVAL;
1958 		goto errout;
1959 	}
1960 
1961 	ndtmsg = nlmsg_data(nlh);
1962 
1963 	for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
1964 		tbl = neigh_tables[tidx];
1965 		if (!tbl)
1966 			continue;
1967 		if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1968 			continue;
1969 		if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
1970 			found = true;
1971 			break;
1972 		}
1973 	}
1974 
1975 	if (!found)
1976 		return -ENOENT;
1977 
1978 	/*
1979 	 * We acquire tbl->lock to be nice to the periodic timers and
1980 	 * make sure they always see a consistent set of values.
1981 	 */
1982 	write_lock_bh(&tbl->lock);
1983 
1984 	if (tb[NDTA_PARMS]) {
1985 		struct nlattr *tbp[NDTPA_MAX+1];
1986 		struct neigh_parms *p;
1987 		int i, ifindex = 0;
1988 
1989 		err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
1990 				       nl_ntbl_parm_policy, extack);
1991 		if (err < 0)
1992 			goto errout_tbl_lock;
1993 
1994 		if (tbp[NDTPA_IFINDEX])
1995 			ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
1996 
1997 		p = lookup_neigh_parms(tbl, net, ifindex);
1998 		if (p == NULL) {
1999 			err = -ENOENT;
2000 			goto errout_tbl_lock;
2001 		}
2002 
2003 		for (i = 1; i <= NDTPA_MAX; i++) {
2004 			if (tbp[i] == NULL)
2005 				continue;
2006 
2007 			switch (i) {
2008 			case NDTPA_QUEUE_LEN:
2009 				NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2010 					      nla_get_u32(tbp[i]) *
2011 					      SKB_TRUESIZE(ETH_FRAME_LEN));
2012 				break;
2013 			case NDTPA_QUEUE_LENBYTES:
2014 				NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2015 					      nla_get_u32(tbp[i]));
2016 				break;
2017 			case NDTPA_PROXY_QLEN:
2018 				NEIGH_VAR_SET(p, PROXY_QLEN,
2019 					      nla_get_u32(tbp[i]));
2020 				break;
2021 			case NDTPA_APP_PROBES:
2022 				NEIGH_VAR_SET(p, APP_PROBES,
2023 					      nla_get_u32(tbp[i]));
2024 				break;
2025 			case NDTPA_UCAST_PROBES:
2026 				NEIGH_VAR_SET(p, UCAST_PROBES,
2027 					      nla_get_u32(tbp[i]));
2028 				break;
2029 			case NDTPA_MCAST_PROBES:
2030 				NEIGH_VAR_SET(p, MCAST_PROBES,
2031 					      nla_get_u32(tbp[i]));
2032 				break;
2033 			case NDTPA_MCAST_REPROBES:
2034 				NEIGH_VAR_SET(p, MCAST_REPROBES,
2035 					      nla_get_u32(tbp[i]));
2036 				break;
2037 			case NDTPA_BASE_REACHABLE_TIME:
2038 				NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2039 					      nla_get_msecs(tbp[i]));
2040 				/* update reachable_time as well, otherwise, the change will
2041 				 * only be effective after the next time neigh_periodic_work
2042 				 * decides to recompute it (can be multiple minutes)
2043 				 */
2044 				p->reachable_time =
2045 					neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2046 				break;
2047 			case NDTPA_GC_STALETIME:
2048 				NEIGH_VAR_SET(p, GC_STALETIME,
2049 					      nla_get_msecs(tbp[i]));
2050 				break;
2051 			case NDTPA_DELAY_PROBE_TIME:
2052 				NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2053 					      nla_get_msecs(tbp[i]));
2054 				call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2055 				break;
2056 			case NDTPA_RETRANS_TIME:
2057 				NEIGH_VAR_SET(p, RETRANS_TIME,
2058 					      nla_get_msecs(tbp[i]));
2059 				break;
2060 			case NDTPA_ANYCAST_DELAY:
2061 				NEIGH_VAR_SET(p, ANYCAST_DELAY,
2062 					      nla_get_msecs(tbp[i]));
2063 				break;
2064 			case NDTPA_PROXY_DELAY:
2065 				NEIGH_VAR_SET(p, PROXY_DELAY,
2066 					      nla_get_msecs(tbp[i]));
2067 				break;
2068 			case NDTPA_LOCKTIME:
2069 				NEIGH_VAR_SET(p, LOCKTIME,
2070 					      nla_get_msecs(tbp[i]));
2071 				break;
2072 			}
2073 		}
2074 	}
2075 
2076 	err = -ENOENT;
2077 	if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2078 	     tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2079 	    !net_eq(net, &init_net))
2080 		goto errout_tbl_lock;
2081 
2082 	if (tb[NDTA_THRESH1])
2083 		tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2084 
2085 	if (tb[NDTA_THRESH2])
2086 		tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2087 
2088 	if (tb[NDTA_THRESH3])
2089 		tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2090 
2091 	if (tb[NDTA_GC_INTERVAL])
2092 		tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2093 
2094 	err = 0;
2095 
2096 errout_tbl_lock:
2097 	write_unlock_bh(&tbl->lock);
2098 errout:
2099 	return err;
2100 }
2101 
2102 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2103 {
2104 	struct net *net = sock_net(skb->sk);
2105 	int family, tidx, nidx = 0;
2106 	int tbl_skip = cb->args[0];
2107 	int neigh_skip = cb->args[1];
2108 	struct neigh_table *tbl;
2109 
2110 	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2111 
2112 	for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2113 		struct neigh_parms *p;
2114 
2115 		tbl = neigh_tables[tidx];
2116 		if (!tbl)
2117 			continue;
2118 
2119 		if (tidx < tbl_skip || (family && tbl->family != family))
2120 			continue;
2121 
2122 		if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2123 				       cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2124 				       NLM_F_MULTI) < 0)
2125 			break;
2126 
2127 		nidx = 0;
2128 		p = list_next_entry(&tbl->parms, list);
2129 		list_for_each_entry_from(p, &tbl->parms_list, list) {
2130 			if (!net_eq(neigh_parms_net(p), net))
2131 				continue;
2132 
2133 			if (nidx < neigh_skip)
2134 				goto next;
2135 
2136 			if (neightbl_fill_param_info(skb, tbl, p,
2137 						     NETLINK_CB(cb->skb).portid,
2138 						     cb->nlh->nlmsg_seq,
2139 						     RTM_NEWNEIGHTBL,
2140 						     NLM_F_MULTI) < 0)
2141 				goto out;
2142 		next:
2143 			nidx++;
2144 		}
2145 
2146 		neigh_skip = 0;
2147 	}
2148 out:
2149 	cb->args[0] = tidx;
2150 	cb->args[1] = nidx;
2151 
2152 	return skb->len;
2153 }
2154 
2155 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2156 			   u32 pid, u32 seq, int type, unsigned int flags)
2157 {
2158 	unsigned long now = jiffies;
2159 	struct nda_cacheinfo ci;
2160 	struct nlmsghdr *nlh;
2161 	struct ndmsg *ndm;
2162 
2163 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2164 	if (nlh == NULL)
2165 		return -EMSGSIZE;
2166 
2167 	ndm = nlmsg_data(nlh);
2168 	ndm->ndm_family	 = neigh->ops->family;
2169 	ndm->ndm_pad1    = 0;
2170 	ndm->ndm_pad2    = 0;
2171 	ndm->ndm_flags	 = neigh->flags;
2172 	ndm->ndm_type	 = neigh->type;
2173 	ndm->ndm_ifindex = neigh->dev->ifindex;
2174 
2175 	if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2176 		goto nla_put_failure;
2177 
2178 	read_lock_bh(&neigh->lock);
2179 	ndm->ndm_state	 = neigh->nud_state;
2180 	if (neigh->nud_state & NUD_VALID) {
2181 		char haddr[MAX_ADDR_LEN];
2182 
2183 		neigh_ha_snapshot(haddr, neigh, neigh->dev);
2184 		if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2185 			read_unlock_bh(&neigh->lock);
2186 			goto nla_put_failure;
2187 		}
2188 	}
2189 
2190 	ci.ndm_used	 = jiffies_to_clock_t(now - neigh->used);
2191 	ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2192 	ci.ndm_updated	 = jiffies_to_clock_t(now - neigh->updated);
2193 	ci.ndm_refcnt	 = atomic_read(&neigh->refcnt) - 1;
2194 	read_unlock_bh(&neigh->lock);
2195 
2196 	if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2197 	    nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2198 		goto nla_put_failure;
2199 
2200 	nlmsg_end(skb, nlh);
2201 	return 0;
2202 
2203 nla_put_failure:
2204 	nlmsg_cancel(skb, nlh);
2205 	return -EMSGSIZE;
2206 }
2207 
2208 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2209 			    u32 pid, u32 seq, int type, unsigned int flags,
2210 			    struct neigh_table *tbl)
2211 {
2212 	struct nlmsghdr *nlh;
2213 	struct ndmsg *ndm;
2214 
2215 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2216 	if (nlh == NULL)
2217 		return -EMSGSIZE;
2218 
2219 	ndm = nlmsg_data(nlh);
2220 	ndm->ndm_family	 = tbl->family;
2221 	ndm->ndm_pad1    = 0;
2222 	ndm->ndm_pad2    = 0;
2223 	ndm->ndm_flags	 = pn->flags | NTF_PROXY;
2224 	ndm->ndm_type	 = RTN_UNICAST;
2225 	ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2226 	ndm->ndm_state	 = NUD_NONE;
2227 
2228 	if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2229 		goto nla_put_failure;
2230 
2231 	nlmsg_end(skb, nlh);
2232 	return 0;
2233 
2234 nla_put_failure:
2235 	nlmsg_cancel(skb, nlh);
2236 	return -EMSGSIZE;
2237 }
2238 
2239 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2240 {
2241 	call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2242 	__neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2243 }
2244 
2245 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2246 {
2247 	struct net_device *master;
2248 
2249 	if (!master_idx)
2250 		return false;
2251 
2252 	master = netdev_master_upper_dev_get(dev);
2253 	if (!master || master->ifindex != master_idx)
2254 		return true;
2255 
2256 	return false;
2257 }
2258 
2259 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2260 {
2261 	if (filter_idx && dev->ifindex != filter_idx)
2262 		return true;
2263 
2264 	return false;
2265 }
2266 
2267 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2268 			    struct netlink_callback *cb)
2269 {
2270 	struct net *net = sock_net(skb->sk);
2271 	const struct nlmsghdr *nlh = cb->nlh;
2272 	struct nlattr *tb[NDA_MAX + 1];
2273 	struct neighbour *n;
2274 	int rc, h, s_h = cb->args[1];
2275 	int idx, s_idx = idx = cb->args[2];
2276 	struct neigh_hash_table *nht;
2277 	int filter_master_idx = 0, filter_idx = 0;
2278 	unsigned int flags = NLM_F_MULTI;
2279 	int err;
2280 
2281 	err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL);
2282 	if (!err) {
2283 		if (tb[NDA_IFINDEX])
2284 			filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
2285 
2286 		if (tb[NDA_MASTER])
2287 			filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
2288 
2289 		if (filter_idx || filter_master_idx)
2290 			flags |= NLM_F_DUMP_FILTERED;
2291 	}
2292 
2293 	rcu_read_lock_bh();
2294 	nht = rcu_dereference_bh(tbl->nht);
2295 
2296 	for (h = s_h; h < (1 << nht->hash_shift); h++) {
2297 		if (h > s_h)
2298 			s_idx = 0;
2299 		for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2300 		     n != NULL;
2301 		     n = rcu_dereference_bh(n->next)) {
2302 			if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2303 				goto next;
2304 			if (neigh_ifindex_filtered(n->dev, filter_idx) ||
2305 			    neigh_master_filtered(n->dev, filter_master_idx))
2306 				goto next;
2307 			if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2308 					    cb->nlh->nlmsg_seq,
2309 					    RTM_NEWNEIGH,
2310 					    flags) < 0) {
2311 				rc = -1;
2312 				goto out;
2313 			}
2314 next:
2315 			idx++;
2316 		}
2317 	}
2318 	rc = skb->len;
2319 out:
2320 	rcu_read_unlock_bh();
2321 	cb->args[1] = h;
2322 	cb->args[2] = idx;
2323 	return rc;
2324 }
2325 
2326 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2327 			     struct netlink_callback *cb)
2328 {
2329 	struct pneigh_entry *n;
2330 	struct net *net = sock_net(skb->sk);
2331 	int rc, h, s_h = cb->args[3];
2332 	int idx, s_idx = idx = cb->args[4];
2333 
2334 	read_lock_bh(&tbl->lock);
2335 
2336 	for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2337 		if (h > s_h)
2338 			s_idx = 0;
2339 		for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2340 			if (idx < s_idx || pneigh_net(n) != net)
2341 				goto next;
2342 			if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2343 					    cb->nlh->nlmsg_seq,
2344 					    RTM_NEWNEIGH,
2345 					    NLM_F_MULTI, tbl) < 0) {
2346 				read_unlock_bh(&tbl->lock);
2347 				rc = -1;
2348 				goto out;
2349 			}
2350 		next:
2351 			idx++;
2352 		}
2353 	}
2354 
2355 	read_unlock_bh(&tbl->lock);
2356 	rc = skb->len;
2357 out:
2358 	cb->args[3] = h;
2359 	cb->args[4] = idx;
2360 	return rc;
2361 
2362 }
2363 
2364 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2365 {
2366 	struct neigh_table *tbl;
2367 	int t, family, s_t;
2368 	int proxy = 0;
2369 	int err;
2370 
2371 	family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2372 
2373 	/* check for full ndmsg structure presence, family member is
2374 	 * the same for both structures
2375 	 */
2376 	if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2377 	    ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2378 		proxy = 1;
2379 
2380 	s_t = cb->args[0];
2381 
2382 	for (t = 0; t < NEIGH_NR_TABLES; t++) {
2383 		tbl = neigh_tables[t];
2384 
2385 		if (!tbl)
2386 			continue;
2387 		if (t < s_t || (family && tbl->family != family))
2388 			continue;
2389 		if (t > s_t)
2390 			memset(&cb->args[1], 0, sizeof(cb->args) -
2391 						sizeof(cb->args[0]));
2392 		if (proxy)
2393 			err = pneigh_dump_table(tbl, skb, cb);
2394 		else
2395 			err = neigh_dump_table(tbl, skb, cb);
2396 		if (err < 0)
2397 			break;
2398 	}
2399 
2400 	cb->args[0] = t;
2401 	return skb->len;
2402 }
2403 
2404 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2405 {
2406 	int chain;
2407 	struct neigh_hash_table *nht;
2408 
2409 	rcu_read_lock_bh();
2410 	nht = rcu_dereference_bh(tbl->nht);
2411 
2412 	read_lock(&tbl->lock); /* avoid resizes */
2413 	for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2414 		struct neighbour *n;
2415 
2416 		for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2417 		     n != NULL;
2418 		     n = rcu_dereference_bh(n->next))
2419 			cb(n, cookie);
2420 	}
2421 	read_unlock(&tbl->lock);
2422 	rcu_read_unlock_bh();
2423 }
2424 EXPORT_SYMBOL(neigh_for_each);
2425 
2426 /* The tbl->lock must be held as a writer and BH disabled. */
2427 void __neigh_for_each_release(struct neigh_table *tbl,
2428 			      int (*cb)(struct neighbour *))
2429 {
2430 	int chain;
2431 	struct neigh_hash_table *nht;
2432 
2433 	nht = rcu_dereference_protected(tbl->nht,
2434 					lockdep_is_held(&tbl->lock));
2435 	for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2436 		struct neighbour *n;
2437 		struct neighbour __rcu **np;
2438 
2439 		np = &nht->hash_buckets[chain];
2440 		while ((n = rcu_dereference_protected(*np,
2441 					lockdep_is_held(&tbl->lock))) != NULL) {
2442 			int release;
2443 
2444 			write_lock(&n->lock);
2445 			release = cb(n);
2446 			if (release) {
2447 				rcu_assign_pointer(*np,
2448 					rcu_dereference_protected(n->next,
2449 						lockdep_is_held(&tbl->lock)));
2450 				n->dead = 1;
2451 			} else
2452 				np = &n->next;
2453 			write_unlock(&n->lock);
2454 			if (release)
2455 				neigh_cleanup_and_release(n);
2456 		}
2457 	}
2458 }
2459 EXPORT_SYMBOL(__neigh_for_each_release);
2460 
2461 int neigh_xmit(int index, struct net_device *dev,
2462 	       const void *addr, struct sk_buff *skb)
2463 {
2464 	int err = -EAFNOSUPPORT;
2465 	if (likely(index < NEIGH_NR_TABLES)) {
2466 		struct neigh_table *tbl;
2467 		struct neighbour *neigh;
2468 
2469 		tbl = neigh_tables[index];
2470 		if (!tbl)
2471 			goto out;
2472 		rcu_read_lock_bh();
2473 		neigh = __neigh_lookup_noref(tbl, addr, dev);
2474 		if (!neigh)
2475 			neigh = __neigh_create(tbl, addr, dev, false);
2476 		err = PTR_ERR(neigh);
2477 		if (IS_ERR(neigh)) {
2478 			rcu_read_unlock_bh();
2479 			goto out_kfree_skb;
2480 		}
2481 		err = neigh->output(neigh, skb);
2482 		rcu_read_unlock_bh();
2483 	}
2484 	else if (index == NEIGH_LINK_TABLE) {
2485 		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2486 				      addr, NULL, skb->len);
2487 		if (err < 0)
2488 			goto out_kfree_skb;
2489 		err = dev_queue_xmit(skb);
2490 	}
2491 out:
2492 	return err;
2493 out_kfree_skb:
2494 	kfree_skb(skb);
2495 	goto out;
2496 }
2497 EXPORT_SYMBOL(neigh_xmit);
2498 
2499 #ifdef CONFIG_PROC_FS
2500 
2501 static struct neighbour *neigh_get_first(struct seq_file *seq)
2502 {
2503 	struct neigh_seq_state *state = seq->private;
2504 	struct net *net = seq_file_net(seq);
2505 	struct neigh_hash_table *nht = state->nht;
2506 	struct neighbour *n = NULL;
2507 	int bucket = state->bucket;
2508 
2509 	state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2510 	for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2511 		n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2512 
2513 		while (n) {
2514 			if (!net_eq(dev_net(n->dev), net))
2515 				goto next;
2516 			if (state->neigh_sub_iter) {
2517 				loff_t fakep = 0;
2518 				void *v;
2519 
2520 				v = state->neigh_sub_iter(state, n, &fakep);
2521 				if (!v)
2522 					goto next;
2523 			}
2524 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2525 				break;
2526 			if (n->nud_state & ~NUD_NOARP)
2527 				break;
2528 next:
2529 			n = rcu_dereference_bh(n->next);
2530 		}
2531 
2532 		if (n)
2533 			break;
2534 	}
2535 	state->bucket = bucket;
2536 
2537 	return n;
2538 }
2539 
2540 static struct neighbour *neigh_get_next(struct seq_file *seq,
2541 					struct neighbour *n,
2542 					loff_t *pos)
2543 {
2544 	struct neigh_seq_state *state = seq->private;
2545 	struct net *net = seq_file_net(seq);
2546 	struct neigh_hash_table *nht = state->nht;
2547 
2548 	if (state->neigh_sub_iter) {
2549 		void *v = state->neigh_sub_iter(state, n, pos);
2550 		if (v)
2551 			return n;
2552 	}
2553 	n = rcu_dereference_bh(n->next);
2554 
2555 	while (1) {
2556 		while (n) {
2557 			if (!net_eq(dev_net(n->dev), net))
2558 				goto next;
2559 			if (state->neigh_sub_iter) {
2560 				void *v = state->neigh_sub_iter(state, n, pos);
2561 				if (v)
2562 					return n;
2563 				goto next;
2564 			}
2565 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2566 				break;
2567 
2568 			if (n->nud_state & ~NUD_NOARP)
2569 				break;
2570 next:
2571 			n = rcu_dereference_bh(n->next);
2572 		}
2573 
2574 		if (n)
2575 			break;
2576 
2577 		if (++state->bucket >= (1 << nht->hash_shift))
2578 			break;
2579 
2580 		n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2581 	}
2582 
2583 	if (n && pos)
2584 		--(*pos);
2585 	return n;
2586 }
2587 
2588 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2589 {
2590 	struct neighbour *n = neigh_get_first(seq);
2591 
2592 	if (n) {
2593 		--(*pos);
2594 		while (*pos) {
2595 			n = neigh_get_next(seq, n, pos);
2596 			if (!n)
2597 				break;
2598 		}
2599 	}
2600 	return *pos ? NULL : n;
2601 }
2602 
2603 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2604 {
2605 	struct neigh_seq_state *state = seq->private;
2606 	struct net *net = seq_file_net(seq);
2607 	struct neigh_table *tbl = state->tbl;
2608 	struct pneigh_entry *pn = NULL;
2609 	int bucket = state->bucket;
2610 
2611 	state->flags |= NEIGH_SEQ_IS_PNEIGH;
2612 	for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2613 		pn = tbl->phash_buckets[bucket];
2614 		while (pn && !net_eq(pneigh_net(pn), net))
2615 			pn = pn->next;
2616 		if (pn)
2617 			break;
2618 	}
2619 	state->bucket = bucket;
2620 
2621 	return pn;
2622 }
2623 
2624 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2625 					    struct pneigh_entry *pn,
2626 					    loff_t *pos)
2627 {
2628 	struct neigh_seq_state *state = seq->private;
2629 	struct net *net = seq_file_net(seq);
2630 	struct neigh_table *tbl = state->tbl;
2631 
2632 	do {
2633 		pn = pn->next;
2634 	} while (pn && !net_eq(pneigh_net(pn), net));
2635 
2636 	while (!pn) {
2637 		if (++state->bucket > PNEIGH_HASHMASK)
2638 			break;
2639 		pn = tbl->phash_buckets[state->bucket];
2640 		while (pn && !net_eq(pneigh_net(pn), net))
2641 			pn = pn->next;
2642 		if (pn)
2643 			break;
2644 	}
2645 
2646 	if (pn && pos)
2647 		--(*pos);
2648 
2649 	return pn;
2650 }
2651 
2652 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2653 {
2654 	struct pneigh_entry *pn = pneigh_get_first(seq);
2655 
2656 	if (pn) {
2657 		--(*pos);
2658 		while (*pos) {
2659 			pn = pneigh_get_next(seq, pn, pos);
2660 			if (!pn)
2661 				break;
2662 		}
2663 	}
2664 	return *pos ? NULL : pn;
2665 }
2666 
2667 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2668 {
2669 	struct neigh_seq_state *state = seq->private;
2670 	void *rc;
2671 	loff_t idxpos = *pos;
2672 
2673 	rc = neigh_get_idx(seq, &idxpos);
2674 	if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2675 		rc = pneigh_get_idx(seq, &idxpos);
2676 
2677 	return rc;
2678 }
2679 
2680 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2681 	__acquires(rcu_bh)
2682 {
2683 	struct neigh_seq_state *state = seq->private;
2684 
2685 	state->tbl = tbl;
2686 	state->bucket = 0;
2687 	state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2688 
2689 	rcu_read_lock_bh();
2690 	state->nht = rcu_dereference_bh(tbl->nht);
2691 
2692 	return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2693 }
2694 EXPORT_SYMBOL(neigh_seq_start);
2695 
2696 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2697 {
2698 	struct neigh_seq_state *state;
2699 	void *rc;
2700 
2701 	if (v == SEQ_START_TOKEN) {
2702 		rc = neigh_get_first(seq);
2703 		goto out;
2704 	}
2705 
2706 	state = seq->private;
2707 	if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2708 		rc = neigh_get_next(seq, v, NULL);
2709 		if (rc)
2710 			goto out;
2711 		if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2712 			rc = pneigh_get_first(seq);
2713 	} else {
2714 		BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2715 		rc = pneigh_get_next(seq, v, NULL);
2716 	}
2717 out:
2718 	++(*pos);
2719 	return rc;
2720 }
2721 EXPORT_SYMBOL(neigh_seq_next);
2722 
2723 void neigh_seq_stop(struct seq_file *seq, void *v)
2724 	__releases(rcu_bh)
2725 {
2726 	rcu_read_unlock_bh();
2727 }
2728 EXPORT_SYMBOL(neigh_seq_stop);
2729 
2730 /* statistics via seq_file */
2731 
2732 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2733 {
2734 	struct neigh_table *tbl = seq->private;
2735 	int cpu;
2736 
2737 	if (*pos == 0)
2738 		return SEQ_START_TOKEN;
2739 
2740 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2741 		if (!cpu_possible(cpu))
2742 			continue;
2743 		*pos = cpu+1;
2744 		return per_cpu_ptr(tbl->stats, cpu);
2745 	}
2746 	return NULL;
2747 }
2748 
2749 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2750 {
2751 	struct neigh_table *tbl = seq->private;
2752 	int cpu;
2753 
2754 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2755 		if (!cpu_possible(cpu))
2756 			continue;
2757 		*pos = cpu+1;
2758 		return per_cpu_ptr(tbl->stats, cpu);
2759 	}
2760 	return NULL;
2761 }
2762 
2763 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2764 {
2765 
2766 }
2767 
2768 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2769 {
2770 	struct neigh_table *tbl = seq->private;
2771 	struct neigh_statistics *st = v;
2772 
2773 	if (v == SEQ_START_TOKEN) {
2774 		seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
2775 		return 0;
2776 	}
2777 
2778 	seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2779 			"%08lx %08lx  %08lx %08lx %08lx %08lx\n",
2780 		   atomic_read(&tbl->entries),
2781 
2782 		   st->allocs,
2783 		   st->destroys,
2784 		   st->hash_grows,
2785 
2786 		   st->lookups,
2787 		   st->hits,
2788 
2789 		   st->res_failed,
2790 
2791 		   st->rcv_probes_mcast,
2792 		   st->rcv_probes_ucast,
2793 
2794 		   st->periodic_gc_runs,
2795 		   st->forced_gc_runs,
2796 		   st->unres_discards,
2797 		   st->table_fulls
2798 		   );
2799 
2800 	return 0;
2801 }
2802 
2803 static const struct seq_operations neigh_stat_seq_ops = {
2804 	.start	= neigh_stat_seq_start,
2805 	.next	= neigh_stat_seq_next,
2806 	.stop	= neigh_stat_seq_stop,
2807 	.show	= neigh_stat_seq_show,
2808 };
2809 
2810 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2811 {
2812 	int ret = seq_open(file, &neigh_stat_seq_ops);
2813 
2814 	if (!ret) {
2815 		struct seq_file *sf = file->private_data;
2816 		sf->private = PDE_DATA(inode);
2817 	}
2818 	return ret;
2819 };
2820 
2821 static const struct file_operations neigh_stat_seq_fops = {
2822 	.owner	 = THIS_MODULE,
2823 	.open 	 = neigh_stat_seq_open,
2824 	.read	 = seq_read,
2825 	.llseek	 = seq_lseek,
2826 	.release = seq_release,
2827 };
2828 
2829 #endif /* CONFIG_PROC_FS */
2830 
2831 static inline size_t neigh_nlmsg_size(void)
2832 {
2833 	return NLMSG_ALIGN(sizeof(struct ndmsg))
2834 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2835 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2836 	       + nla_total_size(sizeof(struct nda_cacheinfo))
2837 	       + nla_total_size(4); /* NDA_PROBES */
2838 }
2839 
2840 static void __neigh_notify(struct neighbour *n, int type, int flags,
2841 			   u32 pid)
2842 {
2843 	struct net *net = dev_net(n->dev);
2844 	struct sk_buff *skb;
2845 	int err = -ENOBUFS;
2846 
2847 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2848 	if (skb == NULL)
2849 		goto errout;
2850 
2851 	err = neigh_fill_info(skb, n, pid, 0, type, flags);
2852 	if (err < 0) {
2853 		/* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2854 		WARN_ON(err == -EMSGSIZE);
2855 		kfree_skb(skb);
2856 		goto errout;
2857 	}
2858 	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2859 	return;
2860 errout:
2861 	if (err < 0)
2862 		rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2863 }
2864 
2865 void neigh_app_ns(struct neighbour *n)
2866 {
2867 	__neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
2868 }
2869 EXPORT_SYMBOL(neigh_app_ns);
2870 
2871 #ifdef CONFIG_SYSCTL
2872 static int zero;
2873 static int int_max = INT_MAX;
2874 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2875 
2876 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2877 			   void __user *buffer, size_t *lenp, loff_t *ppos)
2878 {
2879 	int size, ret;
2880 	struct ctl_table tmp = *ctl;
2881 
2882 	tmp.extra1 = &zero;
2883 	tmp.extra2 = &unres_qlen_max;
2884 	tmp.data = &size;
2885 
2886 	size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2887 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2888 
2889 	if (write && !ret)
2890 		*(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2891 	return ret;
2892 }
2893 
2894 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2895 						   int family)
2896 {
2897 	switch (family) {
2898 	case AF_INET:
2899 		return __in_dev_arp_parms_get_rcu(dev);
2900 	case AF_INET6:
2901 		return __in6_dev_nd_parms_get_rcu(dev);
2902 	}
2903 	return NULL;
2904 }
2905 
2906 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2907 				  int index)
2908 {
2909 	struct net_device *dev;
2910 	int family = neigh_parms_family(p);
2911 
2912 	rcu_read_lock();
2913 	for_each_netdev_rcu(net, dev) {
2914 		struct neigh_parms *dst_p =
2915 				neigh_get_dev_parms_rcu(dev, family);
2916 
2917 		if (dst_p && !test_bit(index, dst_p->data_state))
2918 			dst_p->data[index] = p->data[index];
2919 	}
2920 	rcu_read_unlock();
2921 }
2922 
2923 static void neigh_proc_update(struct ctl_table *ctl, int write)
2924 {
2925 	struct net_device *dev = ctl->extra1;
2926 	struct neigh_parms *p = ctl->extra2;
2927 	struct net *net = neigh_parms_net(p);
2928 	int index = (int *) ctl->data - p->data;
2929 
2930 	if (!write)
2931 		return;
2932 
2933 	set_bit(index, p->data_state);
2934 	if (index == NEIGH_VAR_DELAY_PROBE_TIME)
2935 		call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2936 	if (!dev) /* NULL dev means this is default value */
2937 		neigh_copy_dflt_parms(net, p, index);
2938 }
2939 
2940 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2941 					   void __user *buffer,
2942 					   size_t *lenp, loff_t *ppos)
2943 {
2944 	struct ctl_table tmp = *ctl;
2945 	int ret;
2946 
2947 	tmp.extra1 = &zero;
2948 	tmp.extra2 = &int_max;
2949 
2950 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2951 	neigh_proc_update(ctl, write);
2952 	return ret;
2953 }
2954 
2955 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2956 			void __user *buffer, size_t *lenp, loff_t *ppos)
2957 {
2958 	int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
2959 
2960 	neigh_proc_update(ctl, write);
2961 	return ret;
2962 }
2963 EXPORT_SYMBOL(neigh_proc_dointvec);
2964 
2965 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
2966 				void __user *buffer,
2967 				size_t *lenp, loff_t *ppos)
2968 {
2969 	int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
2970 
2971 	neigh_proc_update(ctl, write);
2972 	return ret;
2973 }
2974 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
2975 
2976 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
2977 					      void __user *buffer,
2978 					      size_t *lenp, loff_t *ppos)
2979 {
2980 	int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
2981 
2982 	neigh_proc_update(ctl, write);
2983 	return ret;
2984 }
2985 
2986 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
2987 				   void __user *buffer,
2988 				   size_t *lenp, loff_t *ppos)
2989 {
2990 	int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
2991 
2992 	neigh_proc_update(ctl, write);
2993 	return ret;
2994 }
2995 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
2996 
2997 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
2998 					  void __user *buffer,
2999 					  size_t *lenp, loff_t *ppos)
3000 {
3001 	int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3002 
3003 	neigh_proc_update(ctl, write);
3004 	return ret;
3005 }
3006 
3007 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3008 					  void __user *buffer,
3009 					  size_t *lenp, loff_t *ppos)
3010 {
3011 	struct neigh_parms *p = ctl->extra2;
3012 	int ret;
3013 
3014 	if (strcmp(ctl->procname, "base_reachable_time") == 0)
3015 		ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3016 	else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3017 		ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3018 	else
3019 		ret = -1;
3020 
3021 	if (write && ret == 0) {
3022 		/* update reachable_time as well, otherwise, the change will
3023 		 * only be effective after the next time neigh_periodic_work
3024 		 * decides to recompute it
3025 		 */
3026 		p->reachable_time =
3027 			neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3028 	}
3029 	return ret;
3030 }
3031 
3032 #define NEIGH_PARMS_DATA_OFFSET(index)	\
3033 	(&((struct neigh_parms *) 0)->data[index])
3034 
3035 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3036 	[NEIGH_VAR_ ## attr] = { \
3037 		.procname	= name, \
3038 		.data		= NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3039 		.maxlen		= sizeof(int), \
3040 		.mode		= mval, \
3041 		.proc_handler	= proc, \
3042 	}
3043 
3044 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3045 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3046 
3047 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3048 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3049 
3050 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3051 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3052 
3053 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3054 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3055 
3056 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3057 	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3058 
3059 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3060 	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3061 
3062 static struct neigh_sysctl_table {
3063 	struct ctl_table_header *sysctl_header;
3064 	struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3065 } neigh_sysctl_template __read_mostly = {
3066 	.neigh_vars = {
3067 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3068 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3069 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3070 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3071 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3072 		NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3073 		NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3074 		NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3075 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3076 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3077 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3078 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3079 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3080 		NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3081 		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3082 		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3083 		[NEIGH_VAR_GC_INTERVAL] = {
3084 			.procname	= "gc_interval",
3085 			.maxlen		= sizeof(int),
3086 			.mode		= 0644,
3087 			.proc_handler	= proc_dointvec_jiffies,
3088 		},
3089 		[NEIGH_VAR_GC_THRESH1] = {
3090 			.procname	= "gc_thresh1",
3091 			.maxlen		= sizeof(int),
3092 			.mode		= 0644,
3093 			.extra1 	= &zero,
3094 			.extra2		= &int_max,
3095 			.proc_handler	= proc_dointvec_minmax,
3096 		},
3097 		[NEIGH_VAR_GC_THRESH2] = {
3098 			.procname	= "gc_thresh2",
3099 			.maxlen		= sizeof(int),
3100 			.mode		= 0644,
3101 			.extra1 	= &zero,
3102 			.extra2		= &int_max,
3103 			.proc_handler	= proc_dointvec_minmax,
3104 		},
3105 		[NEIGH_VAR_GC_THRESH3] = {
3106 			.procname	= "gc_thresh3",
3107 			.maxlen		= sizeof(int),
3108 			.mode		= 0644,
3109 			.extra1 	= &zero,
3110 			.extra2		= &int_max,
3111 			.proc_handler	= proc_dointvec_minmax,
3112 		},
3113 		{},
3114 	},
3115 };
3116 
3117 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3118 			  proc_handler *handler)
3119 {
3120 	int i;
3121 	struct neigh_sysctl_table *t;
3122 	const char *dev_name_source;
3123 	char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3124 	char *p_name;
3125 
3126 	t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3127 	if (!t)
3128 		goto err;
3129 
3130 	for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3131 		t->neigh_vars[i].data += (long) p;
3132 		t->neigh_vars[i].extra1 = dev;
3133 		t->neigh_vars[i].extra2 = p;
3134 	}
3135 
3136 	if (dev) {
3137 		dev_name_source = dev->name;
3138 		/* Terminate the table early */
3139 		memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3140 		       sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3141 	} else {
3142 		struct neigh_table *tbl = p->tbl;
3143 		dev_name_source = "default";
3144 		t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3145 		t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3146 		t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3147 		t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3148 	}
3149 
3150 	if (handler) {
3151 		/* RetransTime */
3152 		t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3153 		/* ReachableTime */
3154 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3155 		/* RetransTime (in milliseconds)*/
3156 		t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3157 		/* ReachableTime (in milliseconds) */
3158 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3159 	} else {
3160 		/* Those handlers will update p->reachable_time after
3161 		 * base_reachable_time(_ms) is set to ensure the new timer starts being
3162 		 * applied after the next neighbour update instead of waiting for
3163 		 * neigh_periodic_work to update its value (can be multiple minutes)
3164 		 * So any handler that replaces them should do this as well
3165 		 */
3166 		/* ReachableTime */
3167 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3168 			neigh_proc_base_reachable_time;
3169 		/* ReachableTime (in milliseconds) */
3170 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3171 			neigh_proc_base_reachable_time;
3172 	}
3173 
3174 	/* Don't export sysctls to unprivileged users */
3175 	if (neigh_parms_net(p)->user_ns != &init_user_ns)
3176 		t->neigh_vars[0].procname = NULL;
3177 
3178 	switch (neigh_parms_family(p)) {
3179 	case AF_INET:
3180 	      p_name = "ipv4";
3181 	      break;
3182 	case AF_INET6:
3183 	      p_name = "ipv6";
3184 	      break;
3185 	default:
3186 	      BUG();
3187 	}
3188 
3189 	snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3190 		p_name, dev_name_source);
3191 	t->sysctl_header =
3192 		register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3193 	if (!t->sysctl_header)
3194 		goto free;
3195 
3196 	p->sysctl_table = t;
3197 	return 0;
3198 
3199 free:
3200 	kfree(t);
3201 err:
3202 	return -ENOBUFS;
3203 }
3204 EXPORT_SYMBOL(neigh_sysctl_register);
3205 
3206 void neigh_sysctl_unregister(struct neigh_parms *p)
3207 {
3208 	if (p->sysctl_table) {
3209 		struct neigh_sysctl_table *t = p->sysctl_table;
3210 		p->sysctl_table = NULL;
3211 		unregister_net_sysctl_table(t->sysctl_header);
3212 		kfree(t);
3213 	}
3214 }
3215 EXPORT_SYMBOL(neigh_sysctl_unregister);
3216 
3217 #endif	/* CONFIG_SYSCTL */
3218 
3219 static int __init neigh_init(void)
3220 {
3221 	rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3222 	rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3223 	rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3224 
3225 	rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3226 		      NULL);
3227 	rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3228 
3229 	return 0;
3230 }
3231 
3232 subsys_initcall(neigh_init);
3233 
3234