xref: /linux/net/ipv6/addrconf.c (revision 1fc31357ad194fb98691f3d122bcd47e59239e83)
1 /*
2  *	IPv6 Address [auto]configuration
3  *	Linux INET6 implementation
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
8  *
9  *	This program is free software; you can redistribute it and/or
10  *      modify it under the terms of the GNU General Public License
11  *      as published by the Free Software Foundation; either version
12  *      2 of the License, or (at your option) any later version.
13  */
14 
15 /*
16  *	Changes:
17  *
18  *	Janos Farkas			:	delete timer on ifdown
19  *	<chexum@bankinf.banki.hu>
20  *	Andi Kleen			:	kill double kfree on module
21  *						unload.
22  *	Maciej W. Rozycki		:	FDDI support
23  *	sekiya@USAGI			:	Don't send too many RS
24  *						packets.
25  *	yoshfuji@USAGI			:       Fixed interval between DAD
26  *						packets.
27  *	YOSHIFUJI Hideaki @USAGI	:	improved accuracy of
28  *						address validation timer.
29  *	YOSHIFUJI Hideaki @USAGI	:	Privacy Extensions (RFC3041)
30  *						support.
31  *	Yuji SEKIYA @USAGI		:	Don't assign a same IPv6
32  *						address on a same interface.
33  *	YOSHIFUJI Hideaki @USAGI	:	ARCnet support
34  *	YOSHIFUJI Hideaki @USAGI	:	convert /proc/net/if_inet6 to
35  *						seq_file.
36  *	YOSHIFUJI Hideaki @USAGI	:	improved source address
37  *						selection; consider scope,
38  *						status etc.
39  */
40 
41 #define pr_fmt(fmt) "IPv6: " fmt
42 
43 #include <linux/errno.h>
44 #include <linux/types.h>
45 #include <linux/kernel.h>
46 #include <linux/socket.h>
47 #include <linux/sockios.h>
48 #include <linux/net.h>
49 #include <linux/inet.h>
50 #include <linux/in6.h>
51 #include <linux/netdevice.h>
52 #include <linux/if_addr.h>
53 #include <linux/if_arp.h>
54 #include <linux/if_arcnet.h>
55 #include <linux/if_infiniband.h>
56 #include <linux/route.h>
57 #include <linux/inetdevice.h>
58 #include <linux/init.h>
59 #include <linux/slab.h>
60 #ifdef CONFIG_SYSCTL
61 #include <linux/sysctl.h>
62 #endif
63 #include <linux/capability.h>
64 #include <linux/delay.h>
65 #include <linux/notifier.h>
66 #include <linux/string.h>
67 #include <linux/hash.h>
68 
69 #include <net/net_namespace.h>
70 #include <net/sock.h>
71 #include <net/snmp.h>
72 
73 #include <net/6lowpan.h>
74 #include <net/firewire.h>
75 #include <net/ipv6.h>
76 #include <net/protocol.h>
77 #include <net/ndisc.h>
78 #include <net/ip6_route.h>
79 #include <net/addrconf.h>
80 #include <net/tcp.h>
81 #include <net/ip.h>
82 #include <net/netlink.h>
83 #include <net/pkt_sched.h>
84 #include <net/l3mdev.h>
85 #include <linux/if_tunnel.h>
86 #include <linux/rtnetlink.h>
87 #include <linux/netconf.h>
88 #include <linux/random.h>
89 #include <linux/uaccess.h>
90 #include <asm/unaligned.h>
91 
92 #include <linux/proc_fs.h>
93 #include <linux/seq_file.h>
94 #include <linux/export.h>
95 
96 /* Set to 3 to get tracing... */
97 #define ACONF_DEBUG 2
98 
99 #if ACONF_DEBUG >= 3
100 #define ADBG(fmt, ...) printk(fmt, ##__VA_ARGS__)
101 #else
102 #define ADBG(fmt, ...) do { if (0) printk(fmt, ##__VA_ARGS__); } while (0)
103 #endif
104 
105 #define	INFINITY_LIFE_TIME	0xFFFFFFFF
106 
107 #define IPV6_MAX_STRLEN \
108 	sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")
109 
110 static inline u32 cstamp_delta(unsigned long cstamp)
111 {
112 	return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
113 }
114 
115 static inline s32 rfc3315_s14_backoff_init(s32 irt)
116 {
117 	/* multiply 'initial retransmission time' by 0.9 .. 1.1 */
118 	u64 tmp = (900000 + prandom_u32() % 200001) * (u64)irt;
119 	do_div(tmp, 1000000);
120 	return (s32)tmp;
121 }
122 
123 static inline s32 rfc3315_s14_backoff_update(s32 rt, s32 mrt)
124 {
125 	/* multiply 'retransmission timeout' by 1.9 .. 2.1 */
126 	u64 tmp = (1900000 + prandom_u32() % 200001) * (u64)rt;
127 	do_div(tmp, 1000000);
128 	if ((s32)tmp > mrt) {
129 		/* multiply 'maximum retransmission time' by 0.9 .. 1.1 */
130 		tmp = (900000 + prandom_u32() % 200001) * (u64)mrt;
131 		do_div(tmp, 1000000);
132 	}
133 	return (s32)tmp;
134 }
135 
136 #ifdef CONFIG_SYSCTL
137 static int addrconf_sysctl_register(struct inet6_dev *idev);
138 static void addrconf_sysctl_unregister(struct inet6_dev *idev);
139 #else
140 static inline int addrconf_sysctl_register(struct inet6_dev *idev)
141 {
142 	return 0;
143 }
144 
145 static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
146 {
147 }
148 #endif
149 
150 static void ipv6_regen_rndid(struct inet6_dev *idev);
151 static void ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
152 
153 static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);
154 static int ipv6_count_addresses(struct inet6_dev *idev);
155 static int ipv6_generate_stable_address(struct in6_addr *addr,
156 					u8 dad_count,
157 					const struct inet6_dev *idev);
158 
159 /*
160  *	Configured unicast address hash table
161  */
162 static struct hlist_head inet6_addr_lst[IN6_ADDR_HSIZE];
163 static DEFINE_SPINLOCK(addrconf_hash_lock);
164 
165 static void addrconf_verify(void);
166 static void addrconf_verify_rtnl(void);
167 static void addrconf_verify_work(struct work_struct *);
168 
169 static struct workqueue_struct *addrconf_wq;
170 static DECLARE_DELAYED_WORK(addr_chk_work, addrconf_verify_work);
171 
172 static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
173 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);
174 
175 static void addrconf_type_change(struct net_device *dev,
176 				 unsigned long event);
177 static int addrconf_ifdown(struct net_device *dev, int how);
178 
179 static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
180 						  int plen,
181 						  const struct net_device *dev,
182 						  u32 flags, u32 noflags);
183 
184 static void addrconf_dad_start(struct inet6_ifaddr *ifp);
185 static void addrconf_dad_work(struct work_struct *w);
186 static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id);
187 static void addrconf_dad_run(struct inet6_dev *idev);
188 static void addrconf_rs_timer(unsigned long data);
189 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
190 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
191 
192 static void inet6_prefix_notify(int event, struct inet6_dev *idev,
193 				struct prefix_info *pinfo);
194 static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
195 			       struct net_device *dev);
196 
197 static struct ipv6_devconf ipv6_devconf __read_mostly = {
198 	.forwarding		= 0,
199 	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
200 	.mtu6			= IPV6_MIN_MTU,
201 	.accept_ra		= 1,
202 	.accept_redirects	= 1,
203 	.autoconf		= 1,
204 	.force_mld_version	= 0,
205 	.mldv1_unsolicited_report_interval = 10 * HZ,
206 	.mldv2_unsolicited_report_interval = HZ,
207 	.dad_transmits		= 1,
208 	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
209 	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
210 	.rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
211 	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
212 	.use_tempaddr		= 0,
213 	.temp_valid_lft		= TEMP_VALID_LIFETIME,
214 	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
215 	.regen_max_retry	= REGEN_MAX_RETRY,
216 	.max_desync_factor	= MAX_DESYNC_FACTOR,
217 	.max_addresses		= IPV6_MAX_ADDRESSES,
218 	.accept_ra_defrtr	= 1,
219 	.accept_ra_from_local	= 0,
220 	.accept_ra_min_hop_limit= 1,
221 	.accept_ra_pinfo	= 1,
222 #ifdef CONFIG_IPV6_ROUTER_PREF
223 	.accept_ra_rtr_pref	= 1,
224 	.rtr_probe_interval	= 60 * HZ,
225 #ifdef CONFIG_IPV6_ROUTE_INFO
226 	.accept_ra_rt_info_max_plen = 0,
227 #endif
228 #endif
229 	.proxy_ndp		= 0,
230 	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
231 	.disable_ipv6		= 0,
232 	.accept_dad		= 1,
233 	.suppress_frag_ndisc	= 1,
234 	.accept_ra_mtu		= 1,
235 	.stable_secret		= {
236 		.initialized = false,
237 	},
238 	.use_oif_addrs_only	= 0,
239 	.ignore_routes_with_linkdown = 0,
240 	.keep_addr_on_down	= 0,
241 	.seg6_enabled		= 0,
242 #ifdef CONFIG_IPV6_SEG6_HMAC
243 	.seg6_require_hmac	= 0,
244 #endif
245 };
246 
247 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
248 	.forwarding		= 0,
249 	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
250 	.mtu6			= IPV6_MIN_MTU,
251 	.accept_ra		= 1,
252 	.accept_redirects	= 1,
253 	.autoconf		= 1,
254 	.force_mld_version	= 0,
255 	.mldv1_unsolicited_report_interval = 10 * HZ,
256 	.mldv2_unsolicited_report_interval = HZ,
257 	.dad_transmits		= 1,
258 	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
259 	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
260 	.rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
261 	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
262 	.use_tempaddr		= 0,
263 	.temp_valid_lft		= TEMP_VALID_LIFETIME,
264 	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
265 	.regen_max_retry	= REGEN_MAX_RETRY,
266 	.max_desync_factor	= MAX_DESYNC_FACTOR,
267 	.max_addresses		= IPV6_MAX_ADDRESSES,
268 	.accept_ra_defrtr	= 1,
269 	.accept_ra_from_local	= 0,
270 	.accept_ra_min_hop_limit= 1,
271 	.accept_ra_pinfo	= 1,
272 #ifdef CONFIG_IPV6_ROUTER_PREF
273 	.accept_ra_rtr_pref	= 1,
274 	.rtr_probe_interval	= 60 * HZ,
275 #ifdef CONFIG_IPV6_ROUTE_INFO
276 	.accept_ra_rt_info_max_plen = 0,
277 #endif
278 #endif
279 	.proxy_ndp		= 0,
280 	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
281 	.disable_ipv6		= 0,
282 	.accept_dad		= 1,
283 	.suppress_frag_ndisc	= 1,
284 	.accept_ra_mtu		= 1,
285 	.stable_secret		= {
286 		.initialized = false,
287 	},
288 	.use_oif_addrs_only	= 0,
289 	.ignore_routes_with_linkdown = 0,
290 	.keep_addr_on_down	= 0,
291 	.seg6_enabled		= 0,
292 #ifdef CONFIG_IPV6_SEG6_HMAC
293 	.seg6_require_hmac	= 0,
294 #endif
295 };
296 
297 /* Check if a valid qdisc is available */
298 static inline bool addrconf_qdisc_ok(const struct net_device *dev)
299 {
300 	return !qdisc_tx_is_noop(dev);
301 }
302 
303 static void addrconf_del_rs_timer(struct inet6_dev *idev)
304 {
305 	if (del_timer(&idev->rs_timer))
306 		__in6_dev_put(idev);
307 }
308 
309 static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
310 {
311 	if (cancel_delayed_work(&ifp->dad_work))
312 		__in6_ifa_put(ifp);
313 }
314 
315 static void addrconf_mod_rs_timer(struct inet6_dev *idev,
316 				  unsigned long when)
317 {
318 	if (!timer_pending(&idev->rs_timer))
319 		in6_dev_hold(idev);
320 	mod_timer(&idev->rs_timer, jiffies + when);
321 }
322 
323 static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
324 				   unsigned long delay)
325 {
326 	if (!delayed_work_pending(&ifp->dad_work))
327 		in6_ifa_hold(ifp);
328 	mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
329 }
330 
331 static int snmp6_alloc_dev(struct inet6_dev *idev)
332 {
333 	int i;
334 
335 	idev->stats.ipv6 = alloc_percpu(struct ipstats_mib);
336 	if (!idev->stats.ipv6)
337 		goto err_ip;
338 
339 	for_each_possible_cpu(i) {
340 		struct ipstats_mib *addrconf_stats;
341 		addrconf_stats = per_cpu_ptr(idev->stats.ipv6, i);
342 		u64_stats_init(&addrconf_stats->syncp);
343 	}
344 
345 
346 	idev->stats.icmpv6dev = kzalloc(sizeof(struct icmpv6_mib_device),
347 					GFP_KERNEL);
348 	if (!idev->stats.icmpv6dev)
349 		goto err_icmp;
350 	idev->stats.icmpv6msgdev = kzalloc(sizeof(struct icmpv6msg_mib_device),
351 					   GFP_KERNEL);
352 	if (!idev->stats.icmpv6msgdev)
353 		goto err_icmpmsg;
354 
355 	return 0;
356 
357 err_icmpmsg:
358 	kfree(idev->stats.icmpv6dev);
359 err_icmp:
360 	free_percpu(idev->stats.ipv6);
361 err_ip:
362 	return -ENOMEM;
363 }
364 
365 static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
366 {
367 	struct inet6_dev *ndev;
368 	int err = -ENOMEM;
369 
370 	ASSERT_RTNL();
371 
372 	if (dev->mtu < IPV6_MIN_MTU)
373 		return ERR_PTR(-EINVAL);
374 
375 	ndev = kzalloc(sizeof(struct inet6_dev), GFP_KERNEL);
376 	if (!ndev)
377 		return ERR_PTR(err);
378 
379 	rwlock_init(&ndev->lock);
380 	ndev->dev = dev;
381 	INIT_LIST_HEAD(&ndev->addr_list);
382 	setup_timer(&ndev->rs_timer, addrconf_rs_timer,
383 		    (unsigned long)ndev);
384 	memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
385 
386 	if (ndev->cnf.stable_secret.initialized)
387 		ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
388 	else
389 		ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_EUI64;
390 
391 	ndev->cnf.mtu6 = dev->mtu;
392 	ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
393 	if (!ndev->nd_parms) {
394 		kfree(ndev);
395 		return ERR_PTR(err);
396 	}
397 	if (ndev->cnf.forwarding)
398 		dev_disable_lro(dev);
399 	/* We refer to the device */
400 	dev_hold(dev);
401 
402 	if (snmp6_alloc_dev(ndev) < 0) {
403 		ADBG(KERN_WARNING
404 			"%s: cannot allocate memory for statistics; dev=%s.\n",
405 			__func__, dev->name);
406 		neigh_parms_release(&nd_tbl, ndev->nd_parms);
407 		dev_put(dev);
408 		kfree(ndev);
409 		return ERR_PTR(err);
410 	}
411 
412 	if (snmp6_register_dev(ndev) < 0) {
413 		ADBG(KERN_WARNING
414 			"%s: cannot create /proc/net/dev_snmp6/%s\n",
415 			__func__, dev->name);
416 		goto err_release;
417 	}
418 
419 	/* One reference from device. */
420 	in6_dev_hold(ndev);
421 
422 	if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
423 		ndev->cnf.accept_dad = -1;
424 
425 #if IS_ENABLED(CONFIG_IPV6_SIT)
426 	if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
427 		pr_info("%s: Disabled Multicast RS\n", dev->name);
428 		ndev->cnf.rtr_solicits = 0;
429 	}
430 #endif
431 
432 	INIT_LIST_HEAD(&ndev->tempaddr_list);
433 	ndev->desync_factor = U32_MAX;
434 	if ((dev->flags&IFF_LOOPBACK) ||
435 	    dev->type == ARPHRD_TUNNEL ||
436 	    dev->type == ARPHRD_TUNNEL6 ||
437 	    dev->type == ARPHRD_SIT ||
438 	    dev->type == ARPHRD_NONE) {
439 		ndev->cnf.use_tempaddr = -1;
440 	} else
441 		ipv6_regen_rndid(ndev);
442 
443 	ndev->token = in6addr_any;
444 
445 	if (netif_running(dev) && addrconf_qdisc_ok(dev))
446 		ndev->if_flags |= IF_READY;
447 
448 	ipv6_mc_init_dev(ndev);
449 	ndev->tstamp = jiffies;
450 	err = addrconf_sysctl_register(ndev);
451 	if (err) {
452 		ipv6_mc_destroy_dev(ndev);
453 		snmp6_unregister_dev(ndev);
454 		goto err_release;
455 	}
456 	/* protected by rtnl_lock */
457 	rcu_assign_pointer(dev->ip6_ptr, ndev);
458 
459 	/* Join interface-local all-node multicast group */
460 	ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allnodes);
461 
462 	/* Join all-node multicast group */
463 	ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
464 
465 	/* Join all-router multicast group if forwarding is set */
466 	if (ndev->cnf.forwarding && (dev->flags & IFF_MULTICAST))
467 		ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
468 
469 	return ndev;
470 
471 err_release:
472 	neigh_parms_release(&nd_tbl, ndev->nd_parms);
473 	ndev->dead = 1;
474 	in6_dev_finish_destroy(ndev);
475 	return ERR_PTR(err);
476 }
477 
478 static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
479 {
480 	struct inet6_dev *idev;
481 
482 	ASSERT_RTNL();
483 
484 	idev = __in6_dev_get(dev);
485 	if (!idev) {
486 		idev = ipv6_add_dev(dev);
487 		if (IS_ERR(idev))
488 			return NULL;
489 	}
490 
491 	if (dev->flags&IFF_UP)
492 		ipv6_mc_up(idev);
493 	return idev;
494 }
495 
496 static int inet6_netconf_msgsize_devconf(int type)
497 {
498 	int size =  NLMSG_ALIGN(sizeof(struct netconfmsg))
499 		    + nla_total_size(4);	/* NETCONFA_IFINDEX */
500 	bool all = false;
501 
502 	if (type == NETCONFA_ALL)
503 		all = true;
504 
505 	if (all || type == NETCONFA_FORWARDING)
506 		size += nla_total_size(4);
507 #ifdef CONFIG_IPV6_MROUTE
508 	if (all || type == NETCONFA_MC_FORWARDING)
509 		size += nla_total_size(4);
510 #endif
511 	if (all || type == NETCONFA_PROXY_NEIGH)
512 		size += nla_total_size(4);
513 
514 	if (all || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN)
515 		size += nla_total_size(4);
516 
517 	return size;
518 }
519 
520 static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
521 				      struct ipv6_devconf *devconf, u32 portid,
522 				      u32 seq, int event, unsigned int flags,
523 				      int type)
524 {
525 	struct nlmsghdr  *nlh;
526 	struct netconfmsg *ncm;
527 	bool all = false;
528 
529 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct netconfmsg),
530 			flags);
531 	if (!nlh)
532 		return -EMSGSIZE;
533 
534 	if (type == NETCONFA_ALL)
535 		all = true;
536 
537 	ncm = nlmsg_data(nlh);
538 	ncm->ncm_family = AF_INET6;
539 
540 	if (nla_put_s32(skb, NETCONFA_IFINDEX, ifindex) < 0)
541 		goto nla_put_failure;
542 
543 	if ((all || type == NETCONFA_FORWARDING) &&
544 	    nla_put_s32(skb, NETCONFA_FORWARDING, devconf->forwarding) < 0)
545 		goto nla_put_failure;
546 #ifdef CONFIG_IPV6_MROUTE
547 	if ((all || type == NETCONFA_MC_FORWARDING) &&
548 	    nla_put_s32(skb, NETCONFA_MC_FORWARDING,
549 			devconf->mc_forwarding) < 0)
550 		goto nla_put_failure;
551 #endif
552 	if ((all || type == NETCONFA_PROXY_NEIGH) &&
553 	    nla_put_s32(skb, NETCONFA_PROXY_NEIGH, devconf->proxy_ndp) < 0)
554 		goto nla_put_failure;
555 
556 	if ((all || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN) &&
557 	    nla_put_s32(skb, NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
558 			devconf->ignore_routes_with_linkdown) < 0)
559 		goto nla_put_failure;
560 
561 	nlmsg_end(skb, nlh);
562 	return 0;
563 
564 nla_put_failure:
565 	nlmsg_cancel(skb, nlh);
566 	return -EMSGSIZE;
567 }
568 
569 void inet6_netconf_notify_devconf(struct net *net, int type, int ifindex,
570 				  struct ipv6_devconf *devconf)
571 {
572 	struct sk_buff *skb;
573 	int err = -ENOBUFS;
574 
575 	skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_KERNEL);
576 	if (!skb)
577 		goto errout;
578 
579 	err = inet6_netconf_fill_devconf(skb, ifindex, devconf, 0, 0,
580 					 RTM_NEWNETCONF, 0, type);
581 	if (err < 0) {
582 		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
583 		WARN_ON(err == -EMSGSIZE);
584 		kfree_skb(skb);
585 		goto errout;
586 	}
587 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_KERNEL);
588 	return;
589 errout:
590 	rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err);
591 }
592 
593 static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
594 	[NETCONFA_IFINDEX]	= { .len = sizeof(int) },
595 	[NETCONFA_FORWARDING]	= { .len = sizeof(int) },
596 	[NETCONFA_PROXY_NEIGH]	= { .len = sizeof(int) },
597 	[NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN]	= { .len = sizeof(int) },
598 };
599 
600 static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
601 				     struct nlmsghdr *nlh)
602 {
603 	struct net *net = sock_net(in_skb->sk);
604 	struct nlattr *tb[NETCONFA_MAX+1];
605 	struct netconfmsg *ncm;
606 	struct sk_buff *skb;
607 	struct ipv6_devconf *devconf;
608 	struct inet6_dev *in6_dev;
609 	struct net_device *dev;
610 	int ifindex;
611 	int err;
612 
613 	err = nlmsg_parse(nlh, sizeof(*ncm), tb, NETCONFA_MAX,
614 			  devconf_ipv6_policy);
615 	if (err < 0)
616 		goto errout;
617 
618 	err = -EINVAL;
619 	if (!tb[NETCONFA_IFINDEX])
620 		goto errout;
621 
622 	ifindex = nla_get_s32(tb[NETCONFA_IFINDEX]);
623 	switch (ifindex) {
624 	case NETCONFA_IFINDEX_ALL:
625 		devconf = net->ipv6.devconf_all;
626 		break;
627 	case NETCONFA_IFINDEX_DEFAULT:
628 		devconf = net->ipv6.devconf_dflt;
629 		break;
630 	default:
631 		dev = __dev_get_by_index(net, ifindex);
632 		if (!dev)
633 			goto errout;
634 		in6_dev = __in6_dev_get(dev);
635 		if (!in6_dev)
636 			goto errout;
637 		devconf = &in6_dev->cnf;
638 		break;
639 	}
640 
641 	err = -ENOBUFS;
642 	skb = nlmsg_new(inet6_netconf_msgsize_devconf(NETCONFA_ALL), GFP_ATOMIC);
643 	if (!skb)
644 		goto errout;
645 
646 	err = inet6_netconf_fill_devconf(skb, ifindex, devconf,
647 					 NETLINK_CB(in_skb).portid,
648 					 nlh->nlmsg_seq, RTM_NEWNETCONF, 0,
649 					 NETCONFA_ALL);
650 	if (err < 0) {
651 		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
652 		WARN_ON(err == -EMSGSIZE);
653 		kfree_skb(skb);
654 		goto errout;
655 	}
656 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
657 errout:
658 	return err;
659 }
660 
661 static int inet6_netconf_dump_devconf(struct sk_buff *skb,
662 				      struct netlink_callback *cb)
663 {
664 	struct net *net = sock_net(skb->sk);
665 	int h, s_h;
666 	int idx, s_idx;
667 	struct net_device *dev;
668 	struct inet6_dev *idev;
669 	struct hlist_head *head;
670 
671 	s_h = cb->args[0];
672 	s_idx = idx = cb->args[1];
673 
674 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
675 		idx = 0;
676 		head = &net->dev_index_head[h];
677 		rcu_read_lock();
678 		cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^
679 			  net->dev_base_seq;
680 		hlist_for_each_entry_rcu(dev, head, index_hlist) {
681 			if (idx < s_idx)
682 				goto cont;
683 			idev = __in6_dev_get(dev);
684 			if (!idev)
685 				goto cont;
686 
687 			if (inet6_netconf_fill_devconf(skb, dev->ifindex,
688 						       &idev->cnf,
689 						       NETLINK_CB(cb->skb).portid,
690 						       cb->nlh->nlmsg_seq,
691 						       RTM_NEWNETCONF,
692 						       NLM_F_MULTI,
693 						       NETCONFA_ALL) < 0) {
694 				rcu_read_unlock();
695 				goto done;
696 			}
697 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
698 cont:
699 			idx++;
700 		}
701 		rcu_read_unlock();
702 	}
703 	if (h == NETDEV_HASHENTRIES) {
704 		if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_ALL,
705 					       net->ipv6.devconf_all,
706 					       NETLINK_CB(cb->skb).portid,
707 					       cb->nlh->nlmsg_seq,
708 					       RTM_NEWNETCONF, NLM_F_MULTI,
709 					       NETCONFA_ALL) < 0)
710 			goto done;
711 		else
712 			h++;
713 	}
714 	if (h == NETDEV_HASHENTRIES + 1) {
715 		if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_DEFAULT,
716 					       net->ipv6.devconf_dflt,
717 					       NETLINK_CB(cb->skb).portid,
718 					       cb->nlh->nlmsg_seq,
719 					       RTM_NEWNETCONF, NLM_F_MULTI,
720 					       NETCONFA_ALL) < 0)
721 			goto done;
722 		else
723 			h++;
724 	}
725 done:
726 	cb->args[0] = h;
727 	cb->args[1] = idx;
728 
729 	return skb->len;
730 }
731 
732 #ifdef CONFIG_SYSCTL
733 static void dev_forward_change(struct inet6_dev *idev)
734 {
735 	struct net_device *dev;
736 	struct inet6_ifaddr *ifa;
737 
738 	if (!idev)
739 		return;
740 	dev = idev->dev;
741 	if (idev->cnf.forwarding)
742 		dev_disable_lro(dev);
743 	if (dev->flags & IFF_MULTICAST) {
744 		if (idev->cnf.forwarding) {
745 			ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
746 			ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allrouters);
747 			ipv6_dev_mc_inc(dev, &in6addr_sitelocal_allrouters);
748 		} else {
749 			ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);
750 			ipv6_dev_mc_dec(dev, &in6addr_interfacelocal_allrouters);
751 			ipv6_dev_mc_dec(dev, &in6addr_sitelocal_allrouters);
752 		}
753 	}
754 
755 	list_for_each_entry(ifa, &idev->addr_list, if_list) {
756 		if (ifa->flags&IFA_F_TENTATIVE)
757 			continue;
758 		if (idev->cnf.forwarding)
759 			addrconf_join_anycast(ifa);
760 		else
761 			addrconf_leave_anycast(ifa);
762 	}
763 	inet6_netconf_notify_devconf(dev_net(dev), NETCONFA_FORWARDING,
764 				     dev->ifindex, &idev->cnf);
765 }
766 
767 
768 static void addrconf_forward_change(struct net *net, __s32 newf)
769 {
770 	struct net_device *dev;
771 	struct inet6_dev *idev;
772 
773 	for_each_netdev(net, dev) {
774 		idev = __in6_dev_get(dev);
775 		if (idev) {
776 			int changed = (!idev->cnf.forwarding) ^ (!newf);
777 			idev->cnf.forwarding = newf;
778 			if (changed)
779 				dev_forward_change(idev);
780 		}
781 	}
782 }
783 
784 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
785 {
786 	struct net *net;
787 	int old;
788 
789 	if (!rtnl_trylock())
790 		return restart_syscall();
791 
792 	net = (struct net *)table->extra2;
793 	old = *p;
794 	*p = newf;
795 
796 	if (p == &net->ipv6.devconf_dflt->forwarding) {
797 		if ((!newf) ^ (!old))
798 			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
799 						     NETCONFA_IFINDEX_DEFAULT,
800 						     net->ipv6.devconf_dflt);
801 		rtnl_unlock();
802 		return 0;
803 	}
804 
805 	if (p == &net->ipv6.devconf_all->forwarding) {
806 		int old_dflt = net->ipv6.devconf_dflt->forwarding;
807 
808 		net->ipv6.devconf_dflt->forwarding = newf;
809 		if ((!newf) ^ (!old_dflt))
810 			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
811 						     NETCONFA_IFINDEX_DEFAULT,
812 						     net->ipv6.devconf_dflt);
813 
814 		addrconf_forward_change(net, newf);
815 		if ((!newf) ^ (!old))
816 			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
817 						     NETCONFA_IFINDEX_ALL,
818 						     net->ipv6.devconf_all);
819 	} else if ((!newf) ^ (!old))
820 		dev_forward_change((struct inet6_dev *)table->extra1);
821 	rtnl_unlock();
822 
823 	if (newf)
824 		rt6_purge_dflt_routers(net);
825 	return 1;
826 }
827 
828 static void addrconf_linkdown_change(struct net *net, __s32 newf)
829 {
830 	struct net_device *dev;
831 	struct inet6_dev *idev;
832 
833 	for_each_netdev(net, dev) {
834 		idev = __in6_dev_get(dev);
835 		if (idev) {
836 			int changed = (!idev->cnf.ignore_routes_with_linkdown) ^ (!newf);
837 
838 			idev->cnf.ignore_routes_with_linkdown = newf;
839 			if (changed)
840 				inet6_netconf_notify_devconf(dev_net(dev),
841 							     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
842 							     dev->ifindex,
843 							     &idev->cnf);
844 		}
845 	}
846 }
847 
848 static int addrconf_fixup_linkdown(struct ctl_table *table, int *p, int newf)
849 {
850 	struct net *net;
851 	int old;
852 
853 	if (!rtnl_trylock())
854 		return restart_syscall();
855 
856 	net = (struct net *)table->extra2;
857 	old = *p;
858 	*p = newf;
859 
860 	if (p == &net->ipv6.devconf_dflt->ignore_routes_with_linkdown) {
861 		if ((!newf) ^ (!old))
862 			inet6_netconf_notify_devconf(net,
863 						     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
864 						     NETCONFA_IFINDEX_DEFAULT,
865 						     net->ipv6.devconf_dflt);
866 		rtnl_unlock();
867 		return 0;
868 	}
869 
870 	if (p == &net->ipv6.devconf_all->ignore_routes_with_linkdown) {
871 		net->ipv6.devconf_dflt->ignore_routes_with_linkdown = newf;
872 		addrconf_linkdown_change(net, newf);
873 		if ((!newf) ^ (!old))
874 			inet6_netconf_notify_devconf(net,
875 						     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
876 						     NETCONFA_IFINDEX_ALL,
877 						     net->ipv6.devconf_all);
878 	}
879 	rtnl_unlock();
880 
881 	return 1;
882 }
883 
884 #endif
885 
886 /* Nobody refers to this ifaddr, destroy it */
887 void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
888 {
889 	WARN_ON(!hlist_unhashed(&ifp->addr_lst));
890 
891 #ifdef NET_REFCNT_DEBUG
892 	pr_debug("%s\n", __func__);
893 #endif
894 
895 	in6_dev_put(ifp->idev);
896 
897 	if (cancel_delayed_work(&ifp->dad_work))
898 		pr_notice("delayed DAD work was pending while freeing ifa=%p\n",
899 			  ifp);
900 
901 	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
902 		pr_warn("Freeing alive inet6 address %p\n", ifp);
903 		return;
904 	}
905 	ip6_rt_put(ifp->rt);
906 
907 	kfree_rcu(ifp, rcu);
908 }
909 
910 static void
911 ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
912 {
913 	struct list_head *p;
914 	int ifp_scope = ipv6_addr_src_scope(&ifp->addr);
915 
916 	/*
917 	 * Each device address list is sorted in order of scope -
918 	 * global before linklocal.
919 	 */
920 	list_for_each(p, &idev->addr_list) {
921 		struct inet6_ifaddr *ifa
922 			= list_entry(p, struct inet6_ifaddr, if_list);
923 		if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))
924 			break;
925 	}
926 
927 	list_add_tail(&ifp->if_list, p);
928 }
929 
930 static u32 inet6_addr_hash(const struct in6_addr *addr)
931 {
932 	return hash_32(ipv6_addr_hash(addr), IN6_ADDR_HSIZE_SHIFT);
933 }
934 
935 /* On success it returns ifp with increased reference count */
936 
937 static struct inet6_ifaddr *
938 ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
939 	      const struct in6_addr *peer_addr, int pfxlen,
940 	      int scope, u32 flags, u32 valid_lft, u32 prefered_lft)
941 {
942 	struct inet6_ifaddr *ifa = NULL;
943 	struct rt6_info *rt;
944 	unsigned int hash;
945 	int err = 0;
946 	int addr_type = ipv6_addr_type(addr);
947 
948 	if (addr_type == IPV6_ADDR_ANY ||
949 	    addr_type & IPV6_ADDR_MULTICAST ||
950 	    (!(idev->dev->flags & IFF_LOOPBACK) &&
951 	     addr_type & IPV6_ADDR_LOOPBACK))
952 		return ERR_PTR(-EADDRNOTAVAIL);
953 
954 	rcu_read_lock_bh();
955 	if (idev->dead) {
956 		err = -ENODEV;			/*XXX*/
957 		goto out2;
958 	}
959 
960 	if (idev->cnf.disable_ipv6) {
961 		err = -EACCES;
962 		goto out2;
963 	}
964 
965 	spin_lock(&addrconf_hash_lock);
966 
967 	/* Ignore adding duplicate addresses on an interface */
968 	if (ipv6_chk_same_addr(dev_net(idev->dev), addr, idev->dev)) {
969 		ADBG("ipv6_add_addr: already assigned\n");
970 		err = -EEXIST;
971 		goto out;
972 	}
973 
974 	ifa = kzalloc(sizeof(struct inet6_ifaddr), GFP_ATOMIC);
975 
976 	if (!ifa) {
977 		ADBG("ipv6_add_addr: malloc failed\n");
978 		err = -ENOBUFS;
979 		goto out;
980 	}
981 
982 	rt = addrconf_dst_alloc(idev, addr, false);
983 	if (IS_ERR(rt)) {
984 		err = PTR_ERR(rt);
985 		goto out;
986 	}
987 
988 	neigh_parms_data_state_setall(idev->nd_parms);
989 
990 	ifa->addr = *addr;
991 	if (peer_addr)
992 		ifa->peer_addr = *peer_addr;
993 
994 	spin_lock_init(&ifa->lock);
995 	INIT_DELAYED_WORK(&ifa->dad_work, addrconf_dad_work);
996 	INIT_HLIST_NODE(&ifa->addr_lst);
997 	ifa->scope = scope;
998 	ifa->prefix_len = pfxlen;
999 	ifa->flags = flags | IFA_F_TENTATIVE;
1000 	ifa->valid_lft = valid_lft;
1001 	ifa->prefered_lft = prefered_lft;
1002 	ifa->cstamp = ifa->tstamp = jiffies;
1003 	ifa->tokenized = false;
1004 
1005 	ifa->rt = rt;
1006 
1007 	ifa->idev = idev;
1008 	in6_dev_hold(idev);
1009 	/* For caller */
1010 	in6_ifa_hold(ifa);
1011 
1012 	/* Add to big hash table */
1013 	hash = inet6_addr_hash(addr);
1014 
1015 	hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);
1016 	spin_unlock(&addrconf_hash_lock);
1017 
1018 	write_lock(&idev->lock);
1019 	/* Add to inet6_dev unicast addr list. */
1020 	ipv6_link_dev_addr(idev, ifa);
1021 
1022 	if (ifa->flags&IFA_F_TEMPORARY) {
1023 		list_add(&ifa->tmp_list, &idev->tempaddr_list);
1024 		in6_ifa_hold(ifa);
1025 	}
1026 
1027 	in6_ifa_hold(ifa);
1028 	write_unlock(&idev->lock);
1029 out2:
1030 	rcu_read_unlock_bh();
1031 
1032 	if (likely(err == 0))
1033 		inet6addr_notifier_call_chain(NETDEV_UP, ifa);
1034 	else {
1035 		kfree(ifa);
1036 		ifa = ERR_PTR(err);
1037 	}
1038 
1039 	return ifa;
1040 out:
1041 	spin_unlock(&addrconf_hash_lock);
1042 	goto out2;
1043 }
1044 
1045 enum cleanup_prefix_rt_t {
1046 	CLEANUP_PREFIX_RT_NOP,    /* no cleanup action for prefix route */
1047 	CLEANUP_PREFIX_RT_DEL,    /* delete the prefix route */
1048 	CLEANUP_PREFIX_RT_EXPIRE, /* update the lifetime of the prefix route */
1049 };
1050 
1051 /*
1052  * Check, whether the prefix for ifp would still need a prefix route
1053  * after deleting ifp. The function returns one of the CLEANUP_PREFIX_RT_*
1054  * constants.
1055  *
1056  * 1) we don't purge prefix if address was not permanent.
1057  *    prefix is managed by its own lifetime.
1058  * 2) we also don't purge, if the address was IFA_F_NOPREFIXROUTE.
1059  * 3) if there are no addresses, delete prefix.
1060  * 4) if there are still other permanent address(es),
1061  *    corresponding prefix is still permanent.
1062  * 5) if there are still other addresses with IFA_F_NOPREFIXROUTE,
1063  *    don't purge the prefix, assume user space is managing it.
1064  * 6) otherwise, update prefix lifetime to the
1065  *    longest valid lifetime among the corresponding
1066  *    addresses on the device.
1067  *    Note: subsequent RA will update lifetime.
1068  **/
1069 static enum cleanup_prefix_rt_t
1070 check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
1071 {
1072 	struct inet6_ifaddr *ifa;
1073 	struct inet6_dev *idev = ifp->idev;
1074 	unsigned long lifetime;
1075 	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_DEL;
1076 
1077 	*expires = jiffies;
1078 
1079 	list_for_each_entry(ifa, &idev->addr_list, if_list) {
1080 		if (ifa == ifp)
1081 			continue;
1082 		if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
1083 				       ifp->prefix_len))
1084 			continue;
1085 		if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
1086 			return CLEANUP_PREFIX_RT_NOP;
1087 
1088 		action = CLEANUP_PREFIX_RT_EXPIRE;
1089 
1090 		spin_lock(&ifa->lock);
1091 
1092 		lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
1093 		/*
1094 		 * Note: Because this address is
1095 		 * not permanent, lifetime <
1096 		 * LONG_MAX / HZ here.
1097 		 */
1098 		if (time_before(*expires, ifa->tstamp + lifetime * HZ))
1099 			*expires = ifa->tstamp + lifetime * HZ;
1100 		spin_unlock(&ifa->lock);
1101 	}
1102 
1103 	return action;
1104 }
1105 
1106 static void
1107 cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires, bool del_rt)
1108 {
1109 	struct rt6_info *rt;
1110 
1111 	rt = addrconf_get_prefix_route(&ifp->addr,
1112 				       ifp->prefix_len,
1113 				       ifp->idev->dev,
1114 				       0, RTF_GATEWAY | RTF_DEFAULT);
1115 	if (rt) {
1116 		if (del_rt)
1117 			ip6_del_rt(rt);
1118 		else {
1119 			if (!(rt->rt6i_flags & RTF_EXPIRES))
1120 				rt6_set_expires(rt, expires);
1121 			ip6_rt_put(rt);
1122 		}
1123 	}
1124 }
1125 
1126 
1127 /* This function wants to get referenced ifp and releases it before return */
1128 
1129 static void ipv6_del_addr(struct inet6_ifaddr *ifp)
1130 {
1131 	int state;
1132 	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_NOP;
1133 	unsigned long expires;
1134 
1135 	ASSERT_RTNL();
1136 
1137 	spin_lock_bh(&ifp->lock);
1138 	state = ifp->state;
1139 	ifp->state = INET6_IFADDR_STATE_DEAD;
1140 	spin_unlock_bh(&ifp->lock);
1141 
1142 	if (state == INET6_IFADDR_STATE_DEAD)
1143 		goto out;
1144 
1145 	spin_lock_bh(&addrconf_hash_lock);
1146 	hlist_del_init_rcu(&ifp->addr_lst);
1147 	spin_unlock_bh(&addrconf_hash_lock);
1148 
1149 	write_lock_bh(&ifp->idev->lock);
1150 
1151 	if (ifp->flags&IFA_F_TEMPORARY) {
1152 		list_del(&ifp->tmp_list);
1153 		if (ifp->ifpub) {
1154 			in6_ifa_put(ifp->ifpub);
1155 			ifp->ifpub = NULL;
1156 		}
1157 		__in6_ifa_put(ifp);
1158 	}
1159 
1160 	if (ifp->flags & IFA_F_PERMANENT && !(ifp->flags & IFA_F_NOPREFIXROUTE))
1161 		action = check_cleanup_prefix_route(ifp, &expires);
1162 
1163 	list_del_init(&ifp->if_list);
1164 	__in6_ifa_put(ifp);
1165 
1166 	write_unlock_bh(&ifp->idev->lock);
1167 
1168 	addrconf_del_dad_work(ifp);
1169 
1170 	ipv6_ifa_notify(RTM_DELADDR, ifp);
1171 
1172 	inet6addr_notifier_call_chain(NETDEV_DOWN, ifp);
1173 
1174 	if (action != CLEANUP_PREFIX_RT_NOP) {
1175 		cleanup_prefix_route(ifp, expires,
1176 			action == CLEANUP_PREFIX_RT_DEL);
1177 	}
1178 
1179 	/* clean up prefsrc entries */
1180 	rt6_remove_prefsrc(ifp);
1181 out:
1182 	in6_ifa_put(ifp);
1183 }
1184 
1185 static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *ift)
1186 {
1187 	struct inet6_dev *idev = ifp->idev;
1188 	struct in6_addr addr, *tmpaddr;
1189 	unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_tstamp, age;
1190 	unsigned long regen_advance;
1191 	int tmp_plen;
1192 	int ret = 0;
1193 	u32 addr_flags;
1194 	unsigned long now = jiffies;
1195 	long max_desync_factor;
1196 	s32 cnf_temp_preferred_lft;
1197 
1198 	write_lock_bh(&idev->lock);
1199 	if (ift) {
1200 		spin_lock_bh(&ift->lock);
1201 		memcpy(&addr.s6_addr[8], &ift->addr.s6_addr[8], 8);
1202 		spin_unlock_bh(&ift->lock);
1203 		tmpaddr = &addr;
1204 	} else {
1205 		tmpaddr = NULL;
1206 	}
1207 retry:
1208 	in6_dev_hold(idev);
1209 	if (idev->cnf.use_tempaddr <= 0) {
1210 		write_unlock_bh(&idev->lock);
1211 		pr_info("%s: use_tempaddr is disabled\n", __func__);
1212 		in6_dev_put(idev);
1213 		ret = -1;
1214 		goto out;
1215 	}
1216 	spin_lock_bh(&ifp->lock);
1217 	if (ifp->regen_count++ >= idev->cnf.regen_max_retry) {
1218 		idev->cnf.use_tempaddr = -1;	/*XXX*/
1219 		spin_unlock_bh(&ifp->lock);
1220 		write_unlock_bh(&idev->lock);
1221 		pr_warn("%s: regeneration time exceeded - disabled temporary address support\n",
1222 			__func__);
1223 		in6_dev_put(idev);
1224 		ret = -1;
1225 		goto out;
1226 	}
1227 	in6_ifa_hold(ifp);
1228 	memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);
1229 	ipv6_try_regen_rndid(idev, tmpaddr);
1230 	memcpy(&addr.s6_addr[8], idev->rndid, 8);
1231 	age = (now - ifp->tstamp) / HZ;
1232 
1233 	regen_advance = idev->cnf.regen_max_retry *
1234 			idev->cnf.dad_transmits *
1235 			NEIGH_VAR(idev->nd_parms, RETRANS_TIME) / HZ;
1236 
1237 	/* recalculate max_desync_factor each time and update
1238 	 * idev->desync_factor if it's larger
1239 	 */
1240 	cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft);
1241 	max_desync_factor = min_t(__u32,
1242 				  idev->cnf.max_desync_factor,
1243 				  cnf_temp_preferred_lft - regen_advance);
1244 
1245 	if (unlikely(idev->desync_factor > max_desync_factor)) {
1246 		if (max_desync_factor > 0) {
1247 			get_random_bytes(&idev->desync_factor,
1248 					 sizeof(idev->desync_factor));
1249 			idev->desync_factor %= max_desync_factor;
1250 		} else {
1251 			idev->desync_factor = 0;
1252 		}
1253 	}
1254 
1255 	tmp_valid_lft = min_t(__u32,
1256 			      ifp->valid_lft,
1257 			      idev->cnf.temp_valid_lft + age);
1258 	tmp_prefered_lft = cnf_temp_preferred_lft + age -
1259 			    idev->desync_factor;
1260 	tmp_prefered_lft = min_t(__u32, ifp->prefered_lft, tmp_prefered_lft);
1261 	tmp_plen = ifp->prefix_len;
1262 	tmp_tstamp = ifp->tstamp;
1263 	spin_unlock_bh(&ifp->lock);
1264 
1265 	write_unlock_bh(&idev->lock);
1266 
1267 	/* A temporary address is created only if this calculated Preferred
1268 	 * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
1269 	 * an implementation must not create a temporary address with a zero
1270 	 * Preferred Lifetime.
1271 	 * Use age calculation as in addrconf_verify to avoid unnecessary
1272 	 * temporary addresses being generated.
1273 	 */
1274 	age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
1275 	if (tmp_prefered_lft <= regen_advance + age) {
1276 		in6_ifa_put(ifp);
1277 		in6_dev_put(idev);
1278 		ret = -1;
1279 		goto out;
1280 	}
1281 
1282 	addr_flags = IFA_F_TEMPORARY;
1283 	/* set in addrconf_prefix_rcv() */
1284 	if (ifp->flags & IFA_F_OPTIMISTIC)
1285 		addr_flags |= IFA_F_OPTIMISTIC;
1286 
1287 	ift = ipv6_add_addr(idev, &addr, NULL, tmp_plen,
1288 			    ipv6_addr_scope(&addr), addr_flags,
1289 			    tmp_valid_lft, tmp_prefered_lft);
1290 	if (IS_ERR(ift)) {
1291 		in6_ifa_put(ifp);
1292 		in6_dev_put(idev);
1293 		pr_info("%s: retry temporary address regeneration\n", __func__);
1294 		tmpaddr = &addr;
1295 		write_lock_bh(&idev->lock);
1296 		goto retry;
1297 	}
1298 
1299 	spin_lock_bh(&ift->lock);
1300 	ift->ifpub = ifp;
1301 	ift->cstamp = now;
1302 	ift->tstamp = tmp_tstamp;
1303 	spin_unlock_bh(&ift->lock);
1304 
1305 	addrconf_dad_start(ift);
1306 	in6_ifa_put(ift);
1307 	in6_dev_put(idev);
1308 out:
1309 	return ret;
1310 }
1311 
1312 /*
1313  *	Choose an appropriate source address (RFC3484)
1314  */
1315 enum {
1316 	IPV6_SADDR_RULE_INIT = 0,
1317 	IPV6_SADDR_RULE_LOCAL,
1318 	IPV6_SADDR_RULE_SCOPE,
1319 	IPV6_SADDR_RULE_PREFERRED,
1320 #ifdef CONFIG_IPV6_MIP6
1321 	IPV6_SADDR_RULE_HOA,
1322 #endif
1323 	IPV6_SADDR_RULE_OIF,
1324 	IPV6_SADDR_RULE_LABEL,
1325 	IPV6_SADDR_RULE_PRIVACY,
1326 	IPV6_SADDR_RULE_ORCHID,
1327 	IPV6_SADDR_RULE_PREFIX,
1328 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1329 	IPV6_SADDR_RULE_NOT_OPTIMISTIC,
1330 #endif
1331 	IPV6_SADDR_RULE_MAX
1332 };
1333 
1334 struct ipv6_saddr_score {
1335 	int			rule;
1336 	int			addr_type;
1337 	struct inet6_ifaddr	*ifa;
1338 	DECLARE_BITMAP(scorebits, IPV6_SADDR_RULE_MAX);
1339 	int			scopedist;
1340 	int			matchlen;
1341 };
1342 
1343 struct ipv6_saddr_dst {
1344 	const struct in6_addr *addr;
1345 	int ifindex;
1346 	int scope;
1347 	int label;
1348 	unsigned int prefs;
1349 };
1350 
1351 static inline int ipv6_saddr_preferred(int type)
1352 {
1353 	if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))
1354 		return 1;
1355 	return 0;
1356 }
1357 
1358 static inline bool ipv6_use_optimistic_addr(struct inet6_dev *idev)
1359 {
1360 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1361 	return idev && idev->cnf.optimistic_dad && idev->cnf.use_optimistic;
1362 #else
1363 	return false;
1364 #endif
1365 }
1366 
1367 static int ipv6_get_saddr_eval(struct net *net,
1368 			       struct ipv6_saddr_score *score,
1369 			       struct ipv6_saddr_dst *dst,
1370 			       int i)
1371 {
1372 	int ret;
1373 
1374 	if (i <= score->rule) {
1375 		switch (i) {
1376 		case IPV6_SADDR_RULE_SCOPE:
1377 			ret = score->scopedist;
1378 			break;
1379 		case IPV6_SADDR_RULE_PREFIX:
1380 			ret = score->matchlen;
1381 			break;
1382 		default:
1383 			ret = !!test_bit(i, score->scorebits);
1384 		}
1385 		goto out;
1386 	}
1387 
1388 	switch (i) {
1389 	case IPV6_SADDR_RULE_INIT:
1390 		/* Rule 0: remember if hiscore is not ready yet */
1391 		ret = !!score->ifa;
1392 		break;
1393 	case IPV6_SADDR_RULE_LOCAL:
1394 		/* Rule 1: Prefer same address */
1395 		ret = ipv6_addr_equal(&score->ifa->addr, dst->addr);
1396 		break;
1397 	case IPV6_SADDR_RULE_SCOPE:
1398 		/* Rule 2: Prefer appropriate scope
1399 		 *
1400 		 *      ret
1401 		 *       ^
1402 		 *    -1 |  d 15
1403 		 *    ---+--+-+---> scope
1404 		 *       |
1405 		 *       |             d is scope of the destination.
1406 		 *  B-d  |  \
1407 		 *       |   \      <- smaller scope is better if
1408 		 *  B-15 |    \        if scope is enough for destination.
1409 		 *       |             ret = B - scope (-1 <= scope >= d <= 15).
1410 		 * d-C-1 | /
1411 		 *       |/         <- greater is better
1412 		 *   -C  /             if scope is not enough for destination.
1413 		 *      /|             ret = scope - C (-1 <= d < scope <= 15).
1414 		 *
1415 		 * d - C - 1 < B -15 (for all -1 <= d <= 15).
1416 		 * C > d + 14 - B >= 15 + 14 - B = 29 - B.
1417 		 * Assume B = 0 and we get C > 29.
1418 		 */
1419 		ret = __ipv6_addr_src_scope(score->addr_type);
1420 		if (ret >= dst->scope)
1421 			ret = -ret;
1422 		else
1423 			ret -= 128;	/* 30 is enough */
1424 		score->scopedist = ret;
1425 		break;
1426 	case IPV6_SADDR_RULE_PREFERRED:
1427 	    {
1428 		/* Rule 3: Avoid deprecated and optimistic addresses */
1429 		u8 avoid = IFA_F_DEPRECATED;
1430 
1431 		if (!ipv6_use_optimistic_addr(score->ifa->idev))
1432 			avoid |= IFA_F_OPTIMISTIC;
1433 		ret = ipv6_saddr_preferred(score->addr_type) ||
1434 		      !(score->ifa->flags & avoid);
1435 		break;
1436 	    }
1437 #ifdef CONFIG_IPV6_MIP6
1438 	case IPV6_SADDR_RULE_HOA:
1439 	    {
1440 		/* Rule 4: Prefer home address */
1441 		int prefhome = !(dst->prefs & IPV6_PREFER_SRC_COA);
1442 		ret = !(score->ifa->flags & IFA_F_HOMEADDRESS) ^ prefhome;
1443 		break;
1444 	    }
1445 #endif
1446 	case IPV6_SADDR_RULE_OIF:
1447 		/* Rule 5: Prefer outgoing interface */
1448 		ret = (!dst->ifindex ||
1449 		       dst->ifindex == score->ifa->idev->dev->ifindex);
1450 		break;
1451 	case IPV6_SADDR_RULE_LABEL:
1452 		/* Rule 6: Prefer matching label */
1453 		ret = ipv6_addr_label(net,
1454 				      &score->ifa->addr, score->addr_type,
1455 				      score->ifa->idev->dev->ifindex) == dst->label;
1456 		break;
1457 	case IPV6_SADDR_RULE_PRIVACY:
1458 	    {
1459 		/* Rule 7: Prefer public address
1460 		 * Note: prefer temporary address if use_tempaddr >= 2
1461 		 */
1462 		int preftmp = dst->prefs & (IPV6_PREFER_SRC_PUBLIC|IPV6_PREFER_SRC_TMP) ?
1463 				!!(dst->prefs & IPV6_PREFER_SRC_TMP) :
1464 				score->ifa->idev->cnf.use_tempaddr >= 2;
1465 		ret = (!(score->ifa->flags & IFA_F_TEMPORARY)) ^ preftmp;
1466 		break;
1467 	    }
1468 	case IPV6_SADDR_RULE_ORCHID:
1469 		/* Rule 8-: Prefer ORCHID vs ORCHID or
1470 		 *	    non-ORCHID vs non-ORCHID
1471 		 */
1472 		ret = !(ipv6_addr_orchid(&score->ifa->addr) ^
1473 			ipv6_addr_orchid(dst->addr));
1474 		break;
1475 	case IPV6_SADDR_RULE_PREFIX:
1476 		/* Rule 8: Use longest matching prefix */
1477 		ret = ipv6_addr_diff(&score->ifa->addr, dst->addr);
1478 		if (ret > score->ifa->prefix_len)
1479 			ret = score->ifa->prefix_len;
1480 		score->matchlen = ret;
1481 		break;
1482 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1483 	case IPV6_SADDR_RULE_NOT_OPTIMISTIC:
1484 		/* Optimistic addresses still have lower precedence than other
1485 		 * preferred addresses.
1486 		 */
1487 		ret = !(score->ifa->flags & IFA_F_OPTIMISTIC);
1488 		break;
1489 #endif
1490 	default:
1491 		ret = 0;
1492 	}
1493 
1494 	if (ret)
1495 		__set_bit(i, score->scorebits);
1496 	score->rule = i;
1497 out:
1498 	return ret;
1499 }
1500 
1501 static int __ipv6_dev_get_saddr(struct net *net,
1502 				struct ipv6_saddr_dst *dst,
1503 				struct inet6_dev *idev,
1504 				struct ipv6_saddr_score *scores,
1505 				int hiscore_idx)
1506 {
1507 	struct ipv6_saddr_score *score = &scores[1 - hiscore_idx], *hiscore = &scores[hiscore_idx];
1508 
1509 	read_lock_bh(&idev->lock);
1510 	list_for_each_entry(score->ifa, &idev->addr_list, if_list) {
1511 		int i;
1512 
1513 		/*
1514 		 * - Tentative Address (RFC2462 section 5.4)
1515 		 *  - A tentative address is not considered
1516 		 *    "assigned to an interface" in the traditional
1517 		 *    sense, unless it is also flagged as optimistic.
1518 		 * - Candidate Source Address (section 4)
1519 		 *  - In any case, anycast addresses, multicast
1520 		 *    addresses, and the unspecified address MUST
1521 		 *    NOT be included in a candidate set.
1522 		 */
1523 		if ((score->ifa->flags & IFA_F_TENTATIVE) &&
1524 		    (!(score->ifa->flags & IFA_F_OPTIMISTIC)))
1525 			continue;
1526 
1527 		score->addr_type = __ipv6_addr_type(&score->ifa->addr);
1528 
1529 		if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
1530 			     score->addr_type & IPV6_ADDR_MULTICAST)) {
1531 			net_dbg_ratelimited("ADDRCONF: unspecified / multicast address assigned as unicast address on %s",
1532 					    idev->dev->name);
1533 			continue;
1534 		}
1535 
1536 		score->rule = -1;
1537 		bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
1538 
1539 		for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
1540 			int minihiscore, miniscore;
1541 
1542 			minihiscore = ipv6_get_saddr_eval(net, hiscore, dst, i);
1543 			miniscore = ipv6_get_saddr_eval(net, score, dst, i);
1544 
1545 			if (minihiscore > miniscore) {
1546 				if (i == IPV6_SADDR_RULE_SCOPE &&
1547 				    score->scopedist > 0) {
1548 					/*
1549 					 * special case:
1550 					 * each remaining entry
1551 					 * has too small (not enough)
1552 					 * scope, because ifa entries
1553 					 * are sorted by their scope
1554 					 * values.
1555 					 */
1556 					goto out;
1557 				}
1558 				break;
1559 			} else if (minihiscore < miniscore) {
1560 				if (hiscore->ifa)
1561 					in6_ifa_put(hiscore->ifa);
1562 
1563 				in6_ifa_hold(score->ifa);
1564 
1565 				swap(hiscore, score);
1566 				hiscore_idx = 1 - hiscore_idx;
1567 
1568 				/* restore our iterator */
1569 				score->ifa = hiscore->ifa;
1570 
1571 				break;
1572 			}
1573 		}
1574 	}
1575 out:
1576 	read_unlock_bh(&idev->lock);
1577 	return hiscore_idx;
1578 }
1579 
1580 static int ipv6_get_saddr_master(struct net *net,
1581 				 const struct net_device *dst_dev,
1582 				 const struct net_device *master,
1583 				 struct ipv6_saddr_dst *dst,
1584 				 struct ipv6_saddr_score *scores,
1585 				 int hiscore_idx)
1586 {
1587 	struct inet6_dev *idev;
1588 
1589 	idev = __in6_dev_get(dst_dev);
1590 	if (idev)
1591 		hiscore_idx = __ipv6_dev_get_saddr(net, dst, idev,
1592 						   scores, hiscore_idx);
1593 
1594 	idev = __in6_dev_get(master);
1595 	if (idev)
1596 		hiscore_idx = __ipv6_dev_get_saddr(net, dst, idev,
1597 						   scores, hiscore_idx);
1598 
1599 	return hiscore_idx;
1600 }
1601 
1602 int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
1603 		       const struct in6_addr *daddr, unsigned int prefs,
1604 		       struct in6_addr *saddr)
1605 {
1606 	struct ipv6_saddr_score scores[2], *hiscore;
1607 	struct ipv6_saddr_dst dst;
1608 	struct inet6_dev *idev;
1609 	struct net_device *dev;
1610 	int dst_type;
1611 	bool use_oif_addr = false;
1612 	int hiscore_idx = 0;
1613 
1614 	dst_type = __ipv6_addr_type(daddr);
1615 	dst.addr = daddr;
1616 	dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
1617 	dst.scope = __ipv6_addr_src_scope(dst_type);
1618 	dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);
1619 	dst.prefs = prefs;
1620 
1621 	scores[hiscore_idx].rule = -1;
1622 	scores[hiscore_idx].ifa = NULL;
1623 
1624 	rcu_read_lock();
1625 
1626 	/* Candidate Source Address (section 4)
1627 	 *  - multicast and link-local destination address,
1628 	 *    the set of candidate source address MUST only
1629 	 *    include addresses assigned to interfaces
1630 	 *    belonging to the same link as the outgoing
1631 	 *    interface.
1632 	 * (- For site-local destination addresses, the
1633 	 *    set of candidate source addresses MUST only
1634 	 *    include addresses assigned to interfaces
1635 	 *    belonging to the same site as the outgoing
1636 	 *    interface.)
1637 	 *  - "It is RECOMMENDED that the candidate source addresses
1638 	 *    be the set of unicast addresses assigned to the
1639 	 *    interface that will be used to send to the destination
1640 	 *    (the 'outgoing' interface)." (RFC 6724)
1641 	 */
1642 	if (dst_dev) {
1643 		idev = __in6_dev_get(dst_dev);
1644 		if ((dst_type & IPV6_ADDR_MULTICAST) ||
1645 		    dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL ||
1646 		    (idev && idev->cnf.use_oif_addrs_only)) {
1647 			use_oif_addr = true;
1648 		}
1649 	}
1650 
1651 	if (use_oif_addr) {
1652 		if (idev)
1653 			hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
1654 	} else {
1655 		const struct net_device *master;
1656 		int master_idx = 0;
1657 
1658 		/* if dst_dev exists and is enslaved to an L3 device, then
1659 		 * prefer addresses from dst_dev and then the master over
1660 		 * any other enslaved devices in the L3 domain.
1661 		 */
1662 		master = l3mdev_master_dev_rcu(dst_dev);
1663 		if (master) {
1664 			master_idx = master->ifindex;
1665 
1666 			hiscore_idx = ipv6_get_saddr_master(net, dst_dev,
1667 							    master, &dst,
1668 							    scores, hiscore_idx);
1669 
1670 			if (scores[hiscore_idx].ifa)
1671 				goto out;
1672 		}
1673 
1674 		for_each_netdev_rcu(net, dev) {
1675 			/* only consider addresses on devices in the
1676 			 * same L3 domain
1677 			 */
1678 			if (l3mdev_master_ifindex_rcu(dev) != master_idx)
1679 				continue;
1680 			idev = __in6_dev_get(dev);
1681 			if (!idev)
1682 				continue;
1683 			hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
1684 		}
1685 	}
1686 
1687 out:
1688 	rcu_read_unlock();
1689 
1690 	hiscore = &scores[hiscore_idx];
1691 	if (!hiscore->ifa)
1692 		return -EADDRNOTAVAIL;
1693 
1694 	*saddr = hiscore->ifa->addr;
1695 	in6_ifa_put(hiscore->ifa);
1696 	return 0;
1697 }
1698 EXPORT_SYMBOL(ipv6_dev_get_saddr);
1699 
1700 int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
1701 		      u32 banned_flags)
1702 {
1703 	struct inet6_ifaddr *ifp;
1704 	int err = -EADDRNOTAVAIL;
1705 
1706 	list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
1707 		if (ifp->scope > IFA_LINK)
1708 			break;
1709 		if (ifp->scope == IFA_LINK &&
1710 		    !(ifp->flags & banned_flags)) {
1711 			*addr = ifp->addr;
1712 			err = 0;
1713 			break;
1714 		}
1715 	}
1716 	return err;
1717 }
1718 
1719 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
1720 		    u32 banned_flags)
1721 {
1722 	struct inet6_dev *idev;
1723 	int err = -EADDRNOTAVAIL;
1724 
1725 	rcu_read_lock();
1726 	idev = __in6_dev_get(dev);
1727 	if (idev) {
1728 		read_lock_bh(&idev->lock);
1729 		err = __ipv6_get_lladdr(idev, addr, banned_flags);
1730 		read_unlock_bh(&idev->lock);
1731 	}
1732 	rcu_read_unlock();
1733 	return err;
1734 }
1735 
1736 static int ipv6_count_addresses(struct inet6_dev *idev)
1737 {
1738 	int cnt = 0;
1739 	struct inet6_ifaddr *ifp;
1740 
1741 	read_lock_bh(&idev->lock);
1742 	list_for_each_entry(ifp, &idev->addr_list, if_list)
1743 		cnt++;
1744 	read_unlock_bh(&idev->lock);
1745 	return cnt;
1746 }
1747 
1748 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
1749 		  const struct net_device *dev, int strict)
1750 {
1751 	return ipv6_chk_addr_and_flags(net, addr, dev, strict, IFA_F_TENTATIVE);
1752 }
1753 EXPORT_SYMBOL(ipv6_chk_addr);
1754 
1755 int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
1756 			    const struct net_device *dev, int strict,
1757 			    u32 banned_flags)
1758 {
1759 	struct inet6_ifaddr *ifp;
1760 	unsigned int hash = inet6_addr_hash(addr);
1761 	u32 ifp_flags;
1762 
1763 	rcu_read_lock_bh();
1764 	hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
1765 		if (!net_eq(dev_net(ifp->idev->dev), net))
1766 			continue;
1767 		/* Decouple optimistic from tentative for evaluation here.
1768 		 * Ban optimistic addresses explicitly, when required.
1769 		 */
1770 		ifp_flags = (ifp->flags&IFA_F_OPTIMISTIC)
1771 			    ? (ifp->flags&~IFA_F_TENTATIVE)
1772 			    : ifp->flags;
1773 		if (ipv6_addr_equal(&ifp->addr, addr) &&
1774 		    !(ifp_flags&banned_flags) &&
1775 		    (!dev || ifp->idev->dev == dev ||
1776 		     !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
1777 			rcu_read_unlock_bh();
1778 			return 1;
1779 		}
1780 	}
1781 
1782 	rcu_read_unlock_bh();
1783 	return 0;
1784 }
1785 EXPORT_SYMBOL(ipv6_chk_addr_and_flags);
1786 
1787 static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
1788 			       struct net_device *dev)
1789 {
1790 	unsigned int hash = inet6_addr_hash(addr);
1791 	struct inet6_ifaddr *ifp;
1792 
1793 	hlist_for_each_entry(ifp, &inet6_addr_lst[hash], addr_lst) {
1794 		if (!net_eq(dev_net(ifp->idev->dev), net))
1795 			continue;
1796 		if (ipv6_addr_equal(&ifp->addr, addr)) {
1797 			if (!dev || ifp->idev->dev == dev)
1798 				return true;
1799 		}
1800 	}
1801 	return false;
1802 }
1803 
1804 /* Compares an address/prefix_len with addresses on device @dev.
1805  * If one is found it returns true.
1806  */
1807 bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
1808 	const unsigned int prefix_len, struct net_device *dev)
1809 {
1810 	struct inet6_dev *idev;
1811 	struct inet6_ifaddr *ifa;
1812 	bool ret = false;
1813 
1814 	rcu_read_lock();
1815 	idev = __in6_dev_get(dev);
1816 	if (idev) {
1817 		read_lock_bh(&idev->lock);
1818 		list_for_each_entry(ifa, &idev->addr_list, if_list) {
1819 			ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
1820 			if (ret)
1821 				break;
1822 		}
1823 		read_unlock_bh(&idev->lock);
1824 	}
1825 	rcu_read_unlock();
1826 
1827 	return ret;
1828 }
1829 EXPORT_SYMBOL(ipv6_chk_custom_prefix);
1830 
1831 int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
1832 {
1833 	struct inet6_dev *idev;
1834 	struct inet6_ifaddr *ifa;
1835 	int	onlink;
1836 
1837 	onlink = 0;
1838 	rcu_read_lock();
1839 	idev = __in6_dev_get(dev);
1840 	if (idev) {
1841 		read_lock_bh(&idev->lock);
1842 		list_for_each_entry(ifa, &idev->addr_list, if_list) {
1843 			onlink = ipv6_prefix_equal(addr, &ifa->addr,
1844 						   ifa->prefix_len);
1845 			if (onlink)
1846 				break;
1847 		}
1848 		read_unlock_bh(&idev->lock);
1849 	}
1850 	rcu_read_unlock();
1851 	return onlink;
1852 }
1853 EXPORT_SYMBOL(ipv6_chk_prefix);
1854 
1855 struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,
1856 				     struct net_device *dev, int strict)
1857 {
1858 	struct inet6_ifaddr *ifp, *result = NULL;
1859 	unsigned int hash = inet6_addr_hash(addr);
1860 
1861 	rcu_read_lock_bh();
1862 	hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
1863 		if (!net_eq(dev_net(ifp->idev->dev), net))
1864 			continue;
1865 		if (ipv6_addr_equal(&ifp->addr, addr)) {
1866 			if (!dev || ifp->idev->dev == dev ||
1867 			    !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {
1868 				result = ifp;
1869 				in6_ifa_hold(ifp);
1870 				break;
1871 			}
1872 		}
1873 	}
1874 	rcu_read_unlock_bh();
1875 
1876 	return result;
1877 }
1878 
1879 /* Gets referenced address, destroys ifaddr */
1880 
1881 static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
1882 {
1883 	if (dad_failed)
1884 		ifp->flags |= IFA_F_DADFAILED;
1885 
1886 	if (ifp->flags&IFA_F_PERMANENT) {
1887 		spin_lock_bh(&ifp->lock);
1888 		addrconf_del_dad_work(ifp);
1889 		ifp->flags |= IFA_F_TENTATIVE;
1890 		spin_unlock_bh(&ifp->lock);
1891 		if (dad_failed)
1892 			ipv6_ifa_notify(0, ifp);
1893 		in6_ifa_put(ifp);
1894 	} else if (ifp->flags&IFA_F_TEMPORARY) {
1895 		struct inet6_ifaddr *ifpub;
1896 		spin_lock_bh(&ifp->lock);
1897 		ifpub = ifp->ifpub;
1898 		if (ifpub) {
1899 			in6_ifa_hold(ifpub);
1900 			spin_unlock_bh(&ifp->lock);
1901 			ipv6_create_tempaddr(ifpub, ifp);
1902 			in6_ifa_put(ifpub);
1903 		} else {
1904 			spin_unlock_bh(&ifp->lock);
1905 		}
1906 		ipv6_del_addr(ifp);
1907 	} else {
1908 		ipv6_del_addr(ifp);
1909 	}
1910 }
1911 
1912 static int addrconf_dad_end(struct inet6_ifaddr *ifp)
1913 {
1914 	int err = -ENOENT;
1915 
1916 	spin_lock_bh(&ifp->lock);
1917 	if (ifp->state == INET6_IFADDR_STATE_DAD) {
1918 		ifp->state = INET6_IFADDR_STATE_POSTDAD;
1919 		err = 0;
1920 	}
1921 	spin_unlock_bh(&ifp->lock);
1922 
1923 	return err;
1924 }
1925 
1926 void addrconf_dad_failure(struct inet6_ifaddr *ifp)
1927 {
1928 	struct inet6_dev *idev = ifp->idev;
1929 	struct net *net = dev_net(ifp->idev->dev);
1930 
1931 	if (addrconf_dad_end(ifp)) {
1932 		in6_ifa_put(ifp);
1933 		return;
1934 	}
1935 
1936 	net_info_ratelimited("%s: IPv6 duplicate address %pI6c detected!\n",
1937 			     ifp->idev->dev->name, &ifp->addr);
1938 
1939 	spin_lock_bh(&ifp->lock);
1940 
1941 	if (ifp->flags & IFA_F_STABLE_PRIVACY) {
1942 		int scope = ifp->scope;
1943 		u32 flags = ifp->flags;
1944 		struct in6_addr new_addr;
1945 		struct inet6_ifaddr *ifp2;
1946 		u32 valid_lft, preferred_lft;
1947 		int pfxlen = ifp->prefix_len;
1948 		int retries = ifp->stable_privacy_retry + 1;
1949 
1950 		if (retries > net->ipv6.sysctl.idgen_retries) {
1951 			net_info_ratelimited("%s: privacy stable address generation failed because of DAD conflicts!\n",
1952 					     ifp->idev->dev->name);
1953 			goto errdad;
1954 		}
1955 
1956 		new_addr = ifp->addr;
1957 		if (ipv6_generate_stable_address(&new_addr, retries,
1958 						 idev))
1959 			goto errdad;
1960 
1961 		valid_lft = ifp->valid_lft;
1962 		preferred_lft = ifp->prefered_lft;
1963 
1964 		spin_unlock_bh(&ifp->lock);
1965 
1966 		if (idev->cnf.max_addresses &&
1967 		    ipv6_count_addresses(idev) >=
1968 		    idev->cnf.max_addresses)
1969 			goto lock_errdad;
1970 
1971 		net_info_ratelimited("%s: generating new stable privacy address because of DAD conflict\n",
1972 				     ifp->idev->dev->name);
1973 
1974 		ifp2 = ipv6_add_addr(idev, &new_addr, NULL, pfxlen,
1975 				     scope, flags, valid_lft,
1976 				     preferred_lft);
1977 		if (IS_ERR(ifp2))
1978 			goto lock_errdad;
1979 
1980 		spin_lock_bh(&ifp2->lock);
1981 		ifp2->stable_privacy_retry = retries;
1982 		ifp2->state = INET6_IFADDR_STATE_PREDAD;
1983 		spin_unlock_bh(&ifp2->lock);
1984 
1985 		addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
1986 		in6_ifa_put(ifp2);
1987 lock_errdad:
1988 		spin_lock_bh(&ifp->lock);
1989 	}
1990 
1991 errdad:
1992 	/* transition from _POSTDAD to _ERRDAD */
1993 	ifp->state = INET6_IFADDR_STATE_ERRDAD;
1994 	spin_unlock_bh(&ifp->lock);
1995 
1996 	addrconf_mod_dad_work(ifp, 0);
1997 	in6_ifa_put(ifp);
1998 }
1999 
2000 /* Join to solicited addr multicast group.
2001  * caller must hold RTNL */
2002 void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
2003 {
2004 	struct in6_addr maddr;
2005 
2006 	if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
2007 		return;
2008 
2009 	addrconf_addr_solict_mult(addr, &maddr);
2010 	ipv6_dev_mc_inc(dev, &maddr);
2011 }
2012 
2013 /* caller must hold RTNL */
2014 void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
2015 {
2016 	struct in6_addr maddr;
2017 
2018 	if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
2019 		return;
2020 
2021 	addrconf_addr_solict_mult(addr, &maddr);
2022 	__ipv6_dev_mc_dec(idev, &maddr);
2023 }
2024 
2025 /* caller must hold RTNL */
2026 static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
2027 {
2028 	struct in6_addr addr;
2029 
2030 	if (ifp->prefix_len >= 127) /* RFC 6164 */
2031 		return;
2032 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
2033 	if (ipv6_addr_any(&addr))
2034 		return;
2035 	__ipv6_dev_ac_inc(ifp->idev, &addr);
2036 }
2037 
2038 /* caller must hold RTNL */
2039 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
2040 {
2041 	struct in6_addr addr;
2042 
2043 	if (ifp->prefix_len >= 127) /* RFC 6164 */
2044 		return;
2045 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
2046 	if (ipv6_addr_any(&addr))
2047 		return;
2048 	__ipv6_dev_ac_dec(ifp->idev, &addr);
2049 }
2050 
2051 static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
2052 {
2053 	if (dev->addr_len != EUI64_ADDR_LEN)
2054 		return -1;
2055 	memcpy(eui, dev->dev_addr, EUI64_ADDR_LEN);
2056 	eui[0] ^= 2;
2057 	return 0;
2058 }
2059 
2060 static int addrconf_ifid_ieee1394(u8 *eui, struct net_device *dev)
2061 {
2062 	union fwnet_hwaddr *ha;
2063 
2064 	if (dev->addr_len != FWNET_ALEN)
2065 		return -1;
2066 
2067 	ha = (union fwnet_hwaddr *)dev->dev_addr;
2068 
2069 	memcpy(eui, &ha->uc.uniq_id, sizeof(ha->uc.uniq_id));
2070 	eui[0] ^= 2;
2071 	return 0;
2072 }
2073 
2074 static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
2075 {
2076 	/* XXX: inherit EUI-64 from other interface -- yoshfuji */
2077 	if (dev->addr_len != ARCNET_ALEN)
2078 		return -1;
2079 	memset(eui, 0, 7);
2080 	eui[7] = *(u8 *)dev->dev_addr;
2081 	return 0;
2082 }
2083 
2084 static int addrconf_ifid_infiniband(u8 *eui, struct net_device *dev)
2085 {
2086 	if (dev->addr_len != INFINIBAND_ALEN)
2087 		return -1;
2088 	memcpy(eui, dev->dev_addr + 12, 8);
2089 	eui[0] |= 2;
2090 	return 0;
2091 }
2092 
2093 static int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
2094 {
2095 	if (addr == 0)
2096 		return -1;
2097 	eui[0] = (ipv4_is_zeronet(addr) || ipv4_is_private_10(addr) ||
2098 		  ipv4_is_loopback(addr) || ipv4_is_linklocal_169(addr) ||
2099 		  ipv4_is_private_172(addr) || ipv4_is_test_192(addr) ||
2100 		  ipv4_is_anycast_6to4(addr) || ipv4_is_private_192(addr) ||
2101 		  ipv4_is_test_198(addr) || ipv4_is_multicast(addr) ||
2102 		  ipv4_is_lbcast(addr)) ? 0x00 : 0x02;
2103 	eui[1] = 0;
2104 	eui[2] = 0x5E;
2105 	eui[3] = 0xFE;
2106 	memcpy(eui + 4, &addr, 4);
2107 	return 0;
2108 }
2109 
2110 static int addrconf_ifid_sit(u8 *eui, struct net_device *dev)
2111 {
2112 	if (dev->priv_flags & IFF_ISATAP)
2113 		return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
2114 	return -1;
2115 }
2116 
2117 static int addrconf_ifid_gre(u8 *eui, struct net_device *dev)
2118 {
2119 	return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
2120 }
2121 
2122 static int addrconf_ifid_ip6tnl(u8 *eui, struct net_device *dev)
2123 {
2124 	memcpy(eui, dev->perm_addr, 3);
2125 	memcpy(eui + 5, dev->perm_addr + 3, 3);
2126 	eui[3] = 0xFF;
2127 	eui[4] = 0xFE;
2128 	eui[0] ^= 2;
2129 	return 0;
2130 }
2131 
2132 static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
2133 {
2134 	switch (dev->type) {
2135 	case ARPHRD_ETHER:
2136 	case ARPHRD_FDDI:
2137 		return addrconf_ifid_eui48(eui, dev);
2138 	case ARPHRD_ARCNET:
2139 		return addrconf_ifid_arcnet(eui, dev);
2140 	case ARPHRD_INFINIBAND:
2141 		return addrconf_ifid_infiniband(eui, dev);
2142 	case ARPHRD_SIT:
2143 		return addrconf_ifid_sit(eui, dev);
2144 	case ARPHRD_IPGRE:
2145 		return addrconf_ifid_gre(eui, dev);
2146 	case ARPHRD_6LOWPAN:
2147 		return addrconf_ifid_eui64(eui, dev);
2148 	case ARPHRD_IEEE1394:
2149 		return addrconf_ifid_ieee1394(eui, dev);
2150 	case ARPHRD_TUNNEL6:
2151 		return addrconf_ifid_ip6tnl(eui, dev);
2152 	}
2153 	return -1;
2154 }
2155 
2156 static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
2157 {
2158 	int err = -1;
2159 	struct inet6_ifaddr *ifp;
2160 
2161 	read_lock_bh(&idev->lock);
2162 	list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
2163 		if (ifp->scope > IFA_LINK)
2164 			break;
2165 		if (ifp->scope == IFA_LINK && !(ifp->flags&IFA_F_TENTATIVE)) {
2166 			memcpy(eui, ifp->addr.s6_addr+8, 8);
2167 			err = 0;
2168 			break;
2169 		}
2170 	}
2171 	read_unlock_bh(&idev->lock);
2172 	return err;
2173 }
2174 
2175 /* (re)generation of randomized interface identifier (RFC 3041 3.2, 3.5) */
2176 static void ipv6_regen_rndid(struct inet6_dev *idev)
2177 {
2178 regen:
2179 	get_random_bytes(idev->rndid, sizeof(idev->rndid));
2180 	idev->rndid[0] &= ~0x02;
2181 
2182 	/*
2183 	 * <draft-ietf-ipngwg-temp-addresses-v2-00.txt>:
2184 	 * check if generated address is not inappropriate
2185 	 *
2186 	 *  - Reserved subnet anycast (RFC 2526)
2187 	 *	11111101 11....11 1xxxxxxx
2188 	 *  - ISATAP (RFC4214) 6.1
2189 	 *	00-00-5E-FE-xx-xx-xx-xx
2190 	 *  - value 0
2191 	 *  - XXX: already assigned to an address on the device
2192 	 */
2193 	if (idev->rndid[0] == 0xfd &&
2194 	    (idev->rndid[1]&idev->rndid[2]&idev->rndid[3]&idev->rndid[4]&idev->rndid[5]&idev->rndid[6]) == 0xff &&
2195 	    (idev->rndid[7]&0x80))
2196 		goto regen;
2197 	if ((idev->rndid[0]|idev->rndid[1]) == 0) {
2198 		if (idev->rndid[2] == 0x5e && idev->rndid[3] == 0xfe)
2199 			goto regen;
2200 		if ((idev->rndid[2]|idev->rndid[3]|idev->rndid[4]|idev->rndid[5]|idev->rndid[6]|idev->rndid[7]) == 0x00)
2201 			goto regen;
2202 	}
2203 }
2204 
2205 static void  ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr)
2206 {
2207 	if (tmpaddr && memcmp(idev->rndid, &tmpaddr->s6_addr[8], 8) == 0)
2208 		ipv6_regen_rndid(idev);
2209 }
2210 
2211 /*
2212  *	Add prefix route.
2213  */
2214 
2215 static void
2216 addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
2217 		      unsigned long expires, u32 flags)
2218 {
2219 	struct fib6_config cfg = {
2220 		.fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_PREFIX,
2221 		.fc_metric = IP6_RT_PRIO_ADDRCONF,
2222 		.fc_ifindex = dev->ifindex,
2223 		.fc_expires = expires,
2224 		.fc_dst_len = plen,
2225 		.fc_flags = RTF_UP | flags,
2226 		.fc_nlinfo.nl_net = dev_net(dev),
2227 		.fc_protocol = RTPROT_KERNEL,
2228 	};
2229 
2230 	cfg.fc_dst = *pfx;
2231 
2232 	/* Prevent useless cloning on PtP SIT.
2233 	   This thing is done here expecting that the whole
2234 	   class of non-broadcast devices need not cloning.
2235 	 */
2236 #if IS_ENABLED(CONFIG_IPV6_SIT)
2237 	if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
2238 		cfg.fc_flags |= RTF_NONEXTHOP;
2239 #endif
2240 
2241 	ip6_route_add(&cfg);
2242 }
2243 
2244 
2245 static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
2246 						  int plen,
2247 						  const struct net_device *dev,
2248 						  u32 flags, u32 noflags)
2249 {
2250 	struct fib6_node *fn;
2251 	struct rt6_info *rt = NULL;
2252 	struct fib6_table *table;
2253 	u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_PREFIX;
2254 
2255 	table = fib6_get_table(dev_net(dev), tb_id);
2256 	if (!table)
2257 		return NULL;
2258 
2259 	read_lock_bh(&table->tb6_lock);
2260 	fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0);
2261 	if (!fn)
2262 		goto out;
2263 
2264 	noflags |= RTF_CACHE;
2265 	for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
2266 		if (rt->dst.dev->ifindex != dev->ifindex)
2267 			continue;
2268 		if ((rt->rt6i_flags & flags) != flags)
2269 			continue;
2270 		if ((rt->rt6i_flags & noflags) != 0)
2271 			continue;
2272 		dst_hold(&rt->dst);
2273 		break;
2274 	}
2275 out:
2276 	read_unlock_bh(&table->tb6_lock);
2277 	return rt;
2278 }
2279 
2280 
2281 /* Create "default" multicast route to the interface */
2282 
2283 static void addrconf_add_mroute(struct net_device *dev)
2284 {
2285 	struct fib6_config cfg = {
2286 		.fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_LOCAL,
2287 		.fc_metric = IP6_RT_PRIO_ADDRCONF,
2288 		.fc_ifindex = dev->ifindex,
2289 		.fc_dst_len = 8,
2290 		.fc_flags = RTF_UP,
2291 		.fc_nlinfo.nl_net = dev_net(dev),
2292 	};
2293 
2294 	ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
2295 
2296 	ip6_route_add(&cfg);
2297 }
2298 
2299 static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
2300 {
2301 	struct inet6_dev *idev;
2302 
2303 	ASSERT_RTNL();
2304 
2305 	idev = ipv6_find_idev(dev);
2306 	if (!idev)
2307 		return ERR_PTR(-ENOBUFS);
2308 
2309 	if (idev->cnf.disable_ipv6)
2310 		return ERR_PTR(-EACCES);
2311 
2312 	/* Add default multicast route */
2313 	if (!(dev->flags & IFF_LOOPBACK) && !netif_is_l3_master(dev))
2314 		addrconf_add_mroute(dev);
2315 
2316 	return idev;
2317 }
2318 
2319 static void manage_tempaddrs(struct inet6_dev *idev,
2320 			     struct inet6_ifaddr *ifp,
2321 			     __u32 valid_lft, __u32 prefered_lft,
2322 			     bool create, unsigned long now)
2323 {
2324 	u32 flags;
2325 	struct inet6_ifaddr *ift;
2326 
2327 	read_lock_bh(&idev->lock);
2328 	/* update all temporary addresses in the list */
2329 	list_for_each_entry(ift, &idev->tempaddr_list, tmp_list) {
2330 		int age, max_valid, max_prefered;
2331 
2332 		if (ifp != ift->ifpub)
2333 			continue;
2334 
2335 		/* RFC 4941 section 3.3:
2336 		 * If a received option will extend the lifetime of a public
2337 		 * address, the lifetimes of temporary addresses should
2338 		 * be extended, subject to the overall constraint that no
2339 		 * temporary addresses should ever remain "valid" or "preferred"
2340 		 * for a time longer than (TEMP_VALID_LIFETIME) or
2341 		 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR), respectively.
2342 		 */
2343 		age = (now - ift->cstamp) / HZ;
2344 		max_valid = idev->cnf.temp_valid_lft - age;
2345 		if (max_valid < 0)
2346 			max_valid = 0;
2347 
2348 		max_prefered = idev->cnf.temp_prefered_lft -
2349 			       idev->desync_factor - age;
2350 		if (max_prefered < 0)
2351 			max_prefered = 0;
2352 
2353 		if (valid_lft > max_valid)
2354 			valid_lft = max_valid;
2355 
2356 		if (prefered_lft > max_prefered)
2357 			prefered_lft = max_prefered;
2358 
2359 		spin_lock(&ift->lock);
2360 		flags = ift->flags;
2361 		ift->valid_lft = valid_lft;
2362 		ift->prefered_lft = prefered_lft;
2363 		ift->tstamp = now;
2364 		if (prefered_lft > 0)
2365 			ift->flags &= ~IFA_F_DEPRECATED;
2366 
2367 		spin_unlock(&ift->lock);
2368 		if (!(flags&IFA_F_TENTATIVE))
2369 			ipv6_ifa_notify(0, ift);
2370 	}
2371 
2372 	if ((create || list_empty(&idev->tempaddr_list)) &&
2373 	    idev->cnf.use_tempaddr > 0) {
2374 		/* When a new public address is created as described
2375 		 * in [ADDRCONF], also create a new temporary address.
2376 		 * Also create a temporary address if it's enabled but
2377 		 * no temporary address currently exists.
2378 		 */
2379 		read_unlock_bh(&idev->lock);
2380 		ipv6_create_tempaddr(ifp, NULL);
2381 	} else {
2382 		read_unlock_bh(&idev->lock);
2383 	}
2384 }
2385 
2386 static bool is_addr_mode_generate_stable(struct inet6_dev *idev)
2387 {
2388 	return idev->addr_gen_mode == IN6_ADDR_GEN_MODE_STABLE_PRIVACY ||
2389 	       idev->addr_gen_mode == IN6_ADDR_GEN_MODE_RANDOM;
2390 }
2391 
2392 int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,
2393 				 const struct prefix_info *pinfo,
2394 				 struct inet6_dev *in6_dev,
2395 				 const struct in6_addr *addr, int addr_type,
2396 				 u32 addr_flags, bool sllao, bool tokenized,
2397 				 __u32 valid_lft, u32 prefered_lft)
2398 {
2399 	struct inet6_ifaddr *ifp = ipv6_get_ifaddr(net, addr, dev, 1);
2400 	int create = 0, update_lft = 0;
2401 
2402 	if (!ifp && valid_lft) {
2403 		int max_addresses = in6_dev->cnf.max_addresses;
2404 
2405 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
2406 		if (in6_dev->cnf.optimistic_dad &&
2407 		    !net->ipv6.devconf_all->forwarding && sllao)
2408 			addr_flags |= IFA_F_OPTIMISTIC;
2409 #endif
2410 
2411 		/* Do not allow to create too much of autoconfigured
2412 		 * addresses; this would be too easy way to crash kernel.
2413 		 */
2414 		if (!max_addresses ||
2415 		    ipv6_count_addresses(in6_dev) < max_addresses)
2416 			ifp = ipv6_add_addr(in6_dev, addr, NULL,
2417 					    pinfo->prefix_len,
2418 					    addr_type&IPV6_ADDR_SCOPE_MASK,
2419 					    addr_flags, valid_lft,
2420 					    prefered_lft);
2421 
2422 		if (IS_ERR_OR_NULL(ifp))
2423 			return -1;
2424 
2425 		update_lft = 0;
2426 		create = 1;
2427 		spin_lock_bh(&ifp->lock);
2428 		ifp->flags |= IFA_F_MANAGETEMPADDR;
2429 		ifp->cstamp = jiffies;
2430 		ifp->tokenized = tokenized;
2431 		spin_unlock_bh(&ifp->lock);
2432 		addrconf_dad_start(ifp);
2433 	}
2434 
2435 	if (ifp) {
2436 		u32 flags;
2437 		unsigned long now;
2438 		u32 stored_lft;
2439 
2440 		/* update lifetime (RFC2462 5.5.3 e) */
2441 		spin_lock_bh(&ifp->lock);
2442 		now = jiffies;
2443 		if (ifp->valid_lft > (now - ifp->tstamp) / HZ)
2444 			stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
2445 		else
2446 			stored_lft = 0;
2447 		if (!update_lft && !create && stored_lft) {
2448 			const u32 minimum_lft = min_t(u32,
2449 				stored_lft, MIN_VALID_LIFETIME);
2450 			valid_lft = max(valid_lft, minimum_lft);
2451 
2452 			/* RFC4862 Section 5.5.3e:
2453 			 * "Note that the preferred lifetime of the
2454 			 *  corresponding address is always reset to
2455 			 *  the Preferred Lifetime in the received
2456 			 *  Prefix Information option, regardless of
2457 			 *  whether the valid lifetime is also reset or
2458 			 *  ignored."
2459 			 *
2460 			 * So we should always update prefered_lft here.
2461 			 */
2462 			update_lft = 1;
2463 		}
2464 
2465 		if (update_lft) {
2466 			ifp->valid_lft = valid_lft;
2467 			ifp->prefered_lft = prefered_lft;
2468 			ifp->tstamp = now;
2469 			flags = ifp->flags;
2470 			ifp->flags &= ~IFA_F_DEPRECATED;
2471 			spin_unlock_bh(&ifp->lock);
2472 
2473 			if (!(flags&IFA_F_TENTATIVE))
2474 				ipv6_ifa_notify(0, ifp);
2475 		} else
2476 			spin_unlock_bh(&ifp->lock);
2477 
2478 		manage_tempaddrs(in6_dev, ifp, valid_lft, prefered_lft,
2479 				 create, now);
2480 
2481 		in6_ifa_put(ifp);
2482 		addrconf_verify();
2483 	}
2484 
2485 	return 0;
2486 }
2487 EXPORT_SYMBOL_GPL(addrconf_prefix_rcv_add_addr);
2488 
2489 void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
2490 {
2491 	struct prefix_info *pinfo;
2492 	__u32 valid_lft;
2493 	__u32 prefered_lft;
2494 	int addr_type, err;
2495 	u32 addr_flags = 0;
2496 	struct inet6_dev *in6_dev;
2497 	struct net *net = dev_net(dev);
2498 
2499 	pinfo = (struct prefix_info *) opt;
2500 
2501 	if (len < sizeof(struct prefix_info)) {
2502 		ADBG("addrconf: prefix option too short\n");
2503 		return;
2504 	}
2505 
2506 	/*
2507 	 *	Validation checks ([ADDRCONF], page 19)
2508 	 */
2509 
2510 	addr_type = ipv6_addr_type(&pinfo->prefix);
2511 
2512 	if (addr_type & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL))
2513 		return;
2514 
2515 	valid_lft = ntohl(pinfo->valid);
2516 	prefered_lft = ntohl(pinfo->prefered);
2517 
2518 	if (prefered_lft > valid_lft) {
2519 		net_warn_ratelimited("addrconf: prefix option has invalid lifetime\n");
2520 		return;
2521 	}
2522 
2523 	in6_dev = in6_dev_get(dev);
2524 
2525 	if (!in6_dev) {
2526 		net_dbg_ratelimited("addrconf: device %s not configured\n",
2527 				    dev->name);
2528 		return;
2529 	}
2530 
2531 	/*
2532 	 *	Two things going on here:
2533 	 *	1) Add routes for on-link prefixes
2534 	 *	2) Configure prefixes with the auto flag set
2535 	 */
2536 
2537 	if (pinfo->onlink) {
2538 		struct rt6_info *rt;
2539 		unsigned long rt_expires;
2540 
2541 		/* Avoid arithmetic overflow. Really, we could
2542 		 * save rt_expires in seconds, likely valid_lft,
2543 		 * but it would require division in fib gc, that it
2544 		 * not good.
2545 		 */
2546 		if (HZ > USER_HZ)
2547 			rt_expires = addrconf_timeout_fixup(valid_lft, HZ);
2548 		else
2549 			rt_expires = addrconf_timeout_fixup(valid_lft, USER_HZ);
2550 
2551 		if (addrconf_finite_timeout(rt_expires))
2552 			rt_expires *= HZ;
2553 
2554 		rt = addrconf_get_prefix_route(&pinfo->prefix,
2555 					       pinfo->prefix_len,
2556 					       dev,
2557 					       RTF_ADDRCONF | RTF_PREFIX_RT,
2558 					       RTF_GATEWAY | RTF_DEFAULT);
2559 
2560 		if (rt) {
2561 			/* Autoconf prefix route */
2562 			if (valid_lft == 0) {
2563 				ip6_del_rt(rt);
2564 				rt = NULL;
2565 			} else if (addrconf_finite_timeout(rt_expires)) {
2566 				/* not infinity */
2567 				rt6_set_expires(rt, jiffies + rt_expires);
2568 			} else {
2569 				rt6_clean_expires(rt);
2570 			}
2571 		} else if (valid_lft) {
2572 			clock_t expires = 0;
2573 			int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
2574 			if (addrconf_finite_timeout(rt_expires)) {
2575 				/* not infinity */
2576 				flags |= RTF_EXPIRES;
2577 				expires = jiffies_to_clock_t(rt_expires);
2578 			}
2579 			addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
2580 					      dev, expires, flags);
2581 		}
2582 		ip6_rt_put(rt);
2583 	}
2584 
2585 	/* Try to figure out our local address for this prefix */
2586 
2587 	if (pinfo->autoconf && in6_dev->cnf.autoconf) {
2588 		struct in6_addr addr;
2589 		bool tokenized = false, dev_addr_generated = false;
2590 
2591 		if (pinfo->prefix_len == 64) {
2592 			memcpy(&addr, &pinfo->prefix, 8);
2593 
2594 			if (!ipv6_addr_any(&in6_dev->token)) {
2595 				read_lock_bh(&in6_dev->lock);
2596 				memcpy(addr.s6_addr + 8,
2597 				       in6_dev->token.s6_addr + 8, 8);
2598 				read_unlock_bh(&in6_dev->lock);
2599 				tokenized = true;
2600 			} else if (is_addr_mode_generate_stable(in6_dev) &&
2601 				   !ipv6_generate_stable_address(&addr, 0,
2602 								 in6_dev)) {
2603 				addr_flags |= IFA_F_STABLE_PRIVACY;
2604 				goto ok;
2605 			} else if (ipv6_generate_eui64(addr.s6_addr + 8, dev) &&
2606 				   ipv6_inherit_eui64(addr.s6_addr + 8, in6_dev)) {
2607 				goto put;
2608 			} else {
2609 				dev_addr_generated = true;
2610 			}
2611 			goto ok;
2612 		}
2613 		net_dbg_ratelimited("IPv6 addrconf: prefix with wrong length %d\n",
2614 				    pinfo->prefix_len);
2615 		goto put;
2616 
2617 ok:
2618 		err = addrconf_prefix_rcv_add_addr(net, dev, pinfo, in6_dev,
2619 						   &addr, addr_type,
2620 						   addr_flags, sllao,
2621 						   tokenized, valid_lft,
2622 						   prefered_lft);
2623 		if (err)
2624 			goto put;
2625 
2626 		/* Ignore error case here because previous prefix add addr was
2627 		 * successful which will be notified.
2628 		 */
2629 		ndisc_ops_prefix_rcv_add_addr(net, dev, pinfo, in6_dev, &addr,
2630 					      addr_type, addr_flags, sllao,
2631 					      tokenized, valid_lft,
2632 					      prefered_lft,
2633 					      dev_addr_generated);
2634 	}
2635 	inet6_prefix_notify(RTM_NEWPREFIX, in6_dev, pinfo);
2636 put:
2637 	in6_dev_put(in6_dev);
2638 }
2639 
2640 /*
2641  *	Set destination address.
2642  *	Special case for SIT interfaces where we create a new "virtual"
2643  *	device.
2644  */
2645 int addrconf_set_dstaddr(struct net *net, void __user *arg)
2646 {
2647 	struct in6_ifreq ireq;
2648 	struct net_device *dev;
2649 	int err = -EINVAL;
2650 
2651 	rtnl_lock();
2652 
2653 	err = -EFAULT;
2654 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2655 		goto err_exit;
2656 
2657 	dev = __dev_get_by_index(net, ireq.ifr6_ifindex);
2658 
2659 	err = -ENODEV;
2660 	if (!dev)
2661 		goto err_exit;
2662 
2663 #if IS_ENABLED(CONFIG_IPV6_SIT)
2664 	if (dev->type == ARPHRD_SIT) {
2665 		const struct net_device_ops *ops = dev->netdev_ops;
2666 		struct ifreq ifr;
2667 		struct ip_tunnel_parm p;
2668 
2669 		err = -EADDRNOTAVAIL;
2670 		if (!(ipv6_addr_type(&ireq.ifr6_addr) & IPV6_ADDR_COMPATv4))
2671 			goto err_exit;
2672 
2673 		memset(&p, 0, sizeof(p));
2674 		p.iph.daddr = ireq.ifr6_addr.s6_addr32[3];
2675 		p.iph.saddr = 0;
2676 		p.iph.version = 4;
2677 		p.iph.ihl = 5;
2678 		p.iph.protocol = IPPROTO_IPV6;
2679 		p.iph.ttl = 64;
2680 		ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
2681 
2682 		if (ops->ndo_do_ioctl) {
2683 			mm_segment_t oldfs = get_fs();
2684 
2685 			set_fs(KERNEL_DS);
2686 			err = ops->ndo_do_ioctl(dev, &ifr, SIOCADDTUNNEL);
2687 			set_fs(oldfs);
2688 		} else
2689 			err = -EOPNOTSUPP;
2690 
2691 		if (err == 0) {
2692 			err = -ENOBUFS;
2693 			dev = __dev_get_by_name(net, p.name);
2694 			if (!dev)
2695 				goto err_exit;
2696 			err = dev_open(dev);
2697 		}
2698 	}
2699 #endif
2700 
2701 err_exit:
2702 	rtnl_unlock();
2703 	return err;
2704 }
2705 
2706 static int ipv6_mc_config(struct sock *sk, bool join,
2707 			  const struct in6_addr *addr, int ifindex)
2708 {
2709 	int ret;
2710 
2711 	ASSERT_RTNL();
2712 
2713 	lock_sock(sk);
2714 	if (join)
2715 		ret = ipv6_sock_mc_join(sk, ifindex, addr);
2716 	else
2717 		ret = ipv6_sock_mc_drop(sk, ifindex, addr);
2718 	release_sock(sk);
2719 
2720 	return ret;
2721 }
2722 
2723 /*
2724  *	Manual configuration of address on an interface
2725  */
2726 static int inet6_addr_add(struct net *net, int ifindex,
2727 			  const struct in6_addr *pfx,
2728 			  const struct in6_addr *peer_pfx,
2729 			  unsigned int plen, __u32 ifa_flags,
2730 			  __u32 prefered_lft, __u32 valid_lft)
2731 {
2732 	struct inet6_ifaddr *ifp;
2733 	struct inet6_dev *idev;
2734 	struct net_device *dev;
2735 	unsigned long timeout;
2736 	clock_t expires;
2737 	int scope;
2738 	u32 flags;
2739 
2740 	ASSERT_RTNL();
2741 
2742 	if (plen > 128)
2743 		return -EINVAL;
2744 
2745 	/* check the lifetime */
2746 	if (!valid_lft || prefered_lft > valid_lft)
2747 		return -EINVAL;
2748 
2749 	if (ifa_flags & IFA_F_MANAGETEMPADDR && plen != 64)
2750 		return -EINVAL;
2751 
2752 	dev = __dev_get_by_index(net, ifindex);
2753 	if (!dev)
2754 		return -ENODEV;
2755 
2756 	idev = addrconf_add_dev(dev);
2757 	if (IS_ERR(idev))
2758 		return PTR_ERR(idev);
2759 
2760 	if (ifa_flags & IFA_F_MCAUTOJOIN) {
2761 		int ret = ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2762 					 true, pfx, ifindex);
2763 
2764 		if (ret < 0)
2765 			return ret;
2766 	}
2767 
2768 	scope = ipv6_addr_scope(pfx);
2769 
2770 	timeout = addrconf_timeout_fixup(valid_lft, HZ);
2771 	if (addrconf_finite_timeout(timeout)) {
2772 		expires = jiffies_to_clock_t(timeout * HZ);
2773 		valid_lft = timeout;
2774 		flags = RTF_EXPIRES;
2775 	} else {
2776 		expires = 0;
2777 		flags = 0;
2778 		ifa_flags |= IFA_F_PERMANENT;
2779 	}
2780 
2781 	timeout = addrconf_timeout_fixup(prefered_lft, HZ);
2782 	if (addrconf_finite_timeout(timeout)) {
2783 		if (timeout == 0)
2784 			ifa_flags |= IFA_F_DEPRECATED;
2785 		prefered_lft = timeout;
2786 	}
2787 
2788 	ifp = ipv6_add_addr(idev, pfx, peer_pfx, plen, scope, ifa_flags,
2789 			    valid_lft, prefered_lft);
2790 
2791 	if (!IS_ERR(ifp)) {
2792 		if (!(ifa_flags & IFA_F_NOPREFIXROUTE)) {
2793 			addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
2794 					      expires, flags);
2795 		}
2796 
2797 		/*
2798 		 * Note that section 3.1 of RFC 4429 indicates
2799 		 * that the Optimistic flag should not be set for
2800 		 * manually configured addresses
2801 		 */
2802 		addrconf_dad_start(ifp);
2803 		if (ifa_flags & IFA_F_MANAGETEMPADDR)
2804 			manage_tempaddrs(idev, ifp, valid_lft, prefered_lft,
2805 					 true, jiffies);
2806 		in6_ifa_put(ifp);
2807 		addrconf_verify_rtnl();
2808 		return 0;
2809 	} else if (ifa_flags & IFA_F_MCAUTOJOIN) {
2810 		ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2811 			       false, pfx, ifindex);
2812 	}
2813 
2814 	return PTR_ERR(ifp);
2815 }
2816 
2817 static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,
2818 			  const struct in6_addr *pfx, unsigned int plen)
2819 {
2820 	struct inet6_ifaddr *ifp;
2821 	struct inet6_dev *idev;
2822 	struct net_device *dev;
2823 
2824 	if (plen > 128)
2825 		return -EINVAL;
2826 
2827 	dev = __dev_get_by_index(net, ifindex);
2828 	if (!dev)
2829 		return -ENODEV;
2830 
2831 	idev = __in6_dev_get(dev);
2832 	if (!idev)
2833 		return -ENXIO;
2834 
2835 	read_lock_bh(&idev->lock);
2836 	list_for_each_entry(ifp, &idev->addr_list, if_list) {
2837 		if (ifp->prefix_len == plen &&
2838 		    ipv6_addr_equal(pfx, &ifp->addr)) {
2839 			in6_ifa_hold(ifp);
2840 			read_unlock_bh(&idev->lock);
2841 
2842 			if (!(ifp->flags & IFA_F_TEMPORARY) &&
2843 			    (ifa_flags & IFA_F_MANAGETEMPADDR))
2844 				manage_tempaddrs(idev, ifp, 0, 0, false,
2845 						 jiffies);
2846 			ipv6_del_addr(ifp);
2847 			addrconf_verify_rtnl();
2848 			if (ipv6_addr_is_multicast(pfx)) {
2849 				ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2850 					       false, pfx, dev->ifindex);
2851 			}
2852 			return 0;
2853 		}
2854 	}
2855 	read_unlock_bh(&idev->lock);
2856 	return -EADDRNOTAVAIL;
2857 }
2858 
2859 
2860 int addrconf_add_ifaddr(struct net *net, void __user *arg)
2861 {
2862 	struct in6_ifreq ireq;
2863 	int err;
2864 
2865 	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2866 		return -EPERM;
2867 
2868 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2869 		return -EFAULT;
2870 
2871 	rtnl_lock();
2872 	err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr, NULL,
2873 			     ireq.ifr6_prefixlen, IFA_F_PERMANENT,
2874 			     INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
2875 	rtnl_unlock();
2876 	return err;
2877 }
2878 
2879 int addrconf_del_ifaddr(struct net *net, void __user *arg)
2880 {
2881 	struct in6_ifreq ireq;
2882 	int err;
2883 
2884 	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2885 		return -EPERM;
2886 
2887 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2888 		return -EFAULT;
2889 
2890 	rtnl_lock();
2891 	err = inet6_addr_del(net, ireq.ifr6_ifindex, 0, &ireq.ifr6_addr,
2892 			     ireq.ifr6_prefixlen);
2893 	rtnl_unlock();
2894 	return err;
2895 }
2896 
2897 static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
2898 		     int plen, int scope)
2899 {
2900 	struct inet6_ifaddr *ifp;
2901 
2902 	ifp = ipv6_add_addr(idev, addr, NULL, plen,
2903 			    scope, IFA_F_PERMANENT,
2904 			    INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
2905 	if (!IS_ERR(ifp)) {
2906 		spin_lock_bh(&ifp->lock);
2907 		ifp->flags &= ~IFA_F_TENTATIVE;
2908 		spin_unlock_bh(&ifp->lock);
2909 		rt_genid_bump_ipv6(dev_net(idev->dev));
2910 		ipv6_ifa_notify(RTM_NEWADDR, ifp);
2911 		in6_ifa_put(ifp);
2912 	}
2913 }
2914 
2915 #if IS_ENABLED(CONFIG_IPV6_SIT)
2916 static void sit_add_v4_addrs(struct inet6_dev *idev)
2917 {
2918 	struct in6_addr addr;
2919 	struct net_device *dev;
2920 	struct net *net = dev_net(idev->dev);
2921 	int scope, plen;
2922 	u32 pflags = 0;
2923 
2924 	ASSERT_RTNL();
2925 
2926 	memset(&addr, 0, sizeof(struct in6_addr));
2927 	memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4);
2928 
2929 	if (idev->dev->flags&IFF_POINTOPOINT) {
2930 		addr.s6_addr32[0] = htonl(0xfe800000);
2931 		scope = IFA_LINK;
2932 		plen = 64;
2933 	} else {
2934 		scope = IPV6_ADDR_COMPATv4;
2935 		plen = 96;
2936 		pflags |= RTF_NONEXTHOP;
2937 	}
2938 
2939 	if (addr.s6_addr32[3]) {
2940 		add_addr(idev, &addr, plen, scope);
2941 		addrconf_prefix_route(&addr, plen, idev->dev, 0, pflags);
2942 		return;
2943 	}
2944 
2945 	for_each_netdev(net, dev) {
2946 		struct in_device *in_dev = __in_dev_get_rtnl(dev);
2947 		if (in_dev && (dev->flags & IFF_UP)) {
2948 			struct in_ifaddr *ifa;
2949 
2950 			int flag = scope;
2951 
2952 			for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
2953 
2954 				addr.s6_addr32[3] = ifa->ifa_local;
2955 
2956 				if (ifa->ifa_scope == RT_SCOPE_LINK)
2957 					continue;
2958 				if (ifa->ifa_scope >= RT_SCOPE_HOST) {
2959 					if (idev->dev->flags&IFF_POINTOPOINT)
2960 						continue;
2961 					flag |= IFA_HOST;
2962 				}
2963 
2964 				add_addr(idev, &addr, plen, flag);
2965 				addrconf_prefix_route(&addr, plen, idev->dev, 0,
2966 						      pflags);
2967 			}
2968 		}
2969 	}
2970 }
2971 #endif
2972 
2973 static void init_loopback(struct net_device *dev)
2974 {
2975 	struct inet6_dev  *idev;
2976 	struct net_device *sp_dev;
2977 	struct inet6_ifaddr *sp_ifa;
2978 	struct rt6_info *sp_rt;
2979 
2980 	/* ::1 */
2981 
2982 	ASSERT_RTNL();
2983 
2984 	idev = ipv6_find_idev(dev);
2985 	if (!idev) {
2986 		pr_debug("%s: add_dev failed\n", __func__);
2987 		return;
2988 	}
2989 
2990 	add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
2991 
2992 	/* Add routes to other interface's IPv6 addresses */
2993 	for_each_netdev(dev_net(dev), sp_dev) {
2994 		if (!strcmp(sp_dev->name, dev->name))
2995 			continue;
2996 
2997 		idev = __in6_dev_get(sp_dev);
2998 		if (!idev)
2999 			continue;
3000 
3001 		read_lock_bh(&idev->lock);
3002 		list_for_each_entry(sp_ifa, &idev->addr_list, if_list) {
3003 
3004 			if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
3005 				continue;
3006 
3007 			if (sp_ifa->rt) {
3008 				/* This dst has been added to garbage list when
3009 				 * lo device down, release this obsolete dst and
3010 				 * reallocate a new router for ifa.
3011 				 */
3012 				if (!atomic_read(&sp_ifa->rt->rt6i_ref)) {
3013 					ip6_rt_put(sp_ifa->rt);
3014 					sp_ifa->rt = NULL;
3015 				} else {
3016 					continue;
3017 				}
3018 			}
3019 
3020 			sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, false);
3021 
3022 			/* Failure cases are ignored */
3023 			if (!IS_ERR(sp_rt)) {
3024 				sp_ifa->rt = sp_rt;
3025 				ip6_ins_rt(sp_rt);
3026 			}
3027 		}
3028 		read_unlock_bh(&idev->lock);
3029 	}
3030 }
3031 
3032 void addrconf_add_linklocal(struct inet6_dev *idev,
3033 			    const struct in6_addr *addr, u32 flags)
3034 {
3035 	struct inet6_ifaddr *ifp;
3036 	u32 addr_flags = flags | IFA_F_PERMANENT;
3037 
3038 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
3039 	if (idev->cnf.optimistic_dad &&
3040 	    !dev_net(idev->dev)->ipv6.devconf_all->forwarding)
3041 		addr_flags |= IFA_F_OPTIMISTIC;
3042 #endif
3043 
3044 	ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags,
3045 			    INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
3046 	if (!IS_ERR(ifp)) {
3047 		addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
3048 		addrconf_dad_start(ifp);
3049 		in6_ifa_put(ifp);
3050 	}
3051 }
3052 EXPORT_SYMBOL_GPL(addrconf_add_linklocal);
3053 
3054 static bool ipv6_reserved_interfaceid(struct in6_addr address)
3055 {
3056 	if ((address.s6_addr32[2] | address.s6_addr32[3]) == 0)
3057 		return true;
3058 
3059 	if (address.s6_addr32[2] == htonl(0x02005eff) &&
3060 	    ((address.s6_addr32[3] & htonl(0xfe000000)) == htonl(0xfe000000)))
3061 		return true;
3062 
3063 	if (address.s6_addr32[2] == htonl(0xfdffffff) &&
3064 	    ((address.s6_addr32[3] & htonl(0xffffff80)) == htonl(0xffffff80)))
3065 		return true;
3066 
3067 	return false;
3068 }
3069 
3070 static int ipv6_generate_stable_address(struct in6_addr *address,
3071 					u8 dad_count,
3072 					const struct inet6_dev *idev)
3073 {
3074 	static DEFINE_SPINLOCK(lock);
3075 	static __u32 digest[SHA_DIGEST_WORDS];
3076 	static __u32 workspace[SHA_WORKSPACE_WORDS];
3077 
3078 	static union {
3079 		char __data[SHA_MESSAGE_BYTES];
3080 		struct {
3081 			struct in6_addr secret;
3082 			__be32 prefix[2];
3083 			unsigned char hwaddr[MAX_ADDR_LEN];
3084 			u8 dad_count;
3085 		} __packed;
3086 	} data;
3087 
3088 	struct in6_addr secret;
3089 	struct in6_addr temp;
3090 	struct net *net = dev_net(idev->dev);
3091 
3092 	BUILD_BUG_ON(sizeof(data.__data) != sizeof(data));
3093 
3094 	if (idev->cnf.stable_secret.initialized)
3095 		secret = idev->cnf.stable_secret.secret;
3096 	else if (net->ipv6.devconf_dflt->stable_secret.initialized)
3097 		secret = net->ipv6.devconf_dflt->stable_secret.secret;
3098 	else
3099 		return -1;
3100 
3101 retry:
3102 	spin_lock_bh(&lock);
3103 
3104 	sha_init(digest);
3105 	memset(&data, 0, sizeof(data));
3106 	memset(workspace, 0, sizeof(workspace));
3107 	memcpy(data.hwaddr, idev->dev->perm_addr, idev->dev->addr_len);
3108 	data.prefix[0] = address->s6_addr32[0];
3109 	data.prefix[1] = address->s6_addr32[1];
3110 	data.secret = secret;
3111 	data.dad_count = dad_count;
3112 
3113 	sha_transform(digest, data.__data, workspace);
3114 
3115 	temp = *address;
3116 	temp.s6_addr32[2] = (__force __be32)digest[0];
3117 	temp.s6_addr32[3] = (__force __be32)digest[1];
3118 
3119 	spin_unlock_bh(&lock);
3120 
3121 	if (ipv6_reserved_interfaceid(temp)) {
3122 		dad_count++;
3123 		if (dad_count > dev_net(idev->dev)->ipv6.sysctl.idgen_retries)
3124 			return -1;
3125 		goto retry;
3126 	}
3127 
3128 	*address = temp;
3129 	return 0;
3130 }
3131 
3132 static void ipv6_gen_mode_random_init(struct inet6_dev *idev)
3133 {
3134 	struct ipv6_stable_secret *s = &idev->cnf.stable_secret;
3135 
3136 	if (s->initialized)
3137 		return;
3138 	s = &idev->cnf.stable_secret;
3139 	get_random_bytes(&s->secret, sizeof(s->secret));
3140 	s->initialized = true;
3141 }
3142 
3143 static void addrconf_addr_gen(struct inet6_dev *idev, bool prefix_route)
3144 {
3145 	struct in6_addr addr;
3146 
3147 	/* no link local addresses on L3 master devices */
3148 	if (netif_is_l3_master(idev->dev))
3149 		return;
3150 
3151 	ipv6_addr_set(&addr, htonl(0xFE800000), 0, 0, 0);
3152 
3153 	switch (idev->addr_gen_mode) {
3154 	case IN6_ADDR_GEN_MODE_RANDOM:
3155 		ipv6_gen_mode_random_init(idev);
3156 		/* fallthrough */
3157 	case IN6_ADDR_GEN_MODE_STABLE_PRIVACY:
3158 		if (!ipv6_generate_stable_address(&addr, 0, idev))
3159 			addrconf_add_linklocal(idev, &addr,
3160 					       IFA_F_STABLE_PRIVACY);
3161 		else if (prefix_route)
3162 			addrconf_prefix_route(&addr, 64, idev->dev, 0, 0);
3163 		break;
3164 	case IN6_ADDR_GEN_MODE_EUI64:
3165 		/* addrconf_add_linklocal also adds a prefix_route and we
3166 		 * only need to care about prefix routes if ipv6_generate_eui64
3167 		 * couldn't generate one.
3168 		 */
3169 		if (ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) == 0)
3170 			addrconf_add_linklocal(idev, &addr, 0);
3171 		else if (prefix_route)
3172 			addrconf_prefix_route(&addr, 64, idev->dev, 0, 0);
3173 		break;
3174 	case IN6_ADDR_GEN_MODE_NONE:
3175 	default:
3176 		/* will not add any link local address */
3177 		break;
3178 	}
3179 }
3180 
3181 static void addrconf_dev_config(struct net_device *dev)
3182 {
3183 	struct inet6_dev *idev;
3184 
3185 	ASSERT_RTNL();
3186 
3187 	if ((dev->type != ARPHRD_ETHER) &&
3188 	    (dev->type != ARPHRD_FDDI) &&
3189 	    (dev->type != ARPHRD_ARCNET) &&
3190 	    (dev->type != ARPHRD_INFINIBAND) &&
3191 	    (dev->type != ARPHRD_IEEE1394) &&
3192 	    (dev->type != ARPHRD_TUNNEL6) &&
3193 	    (dev->type != ARPHRD_6LOWPAN) &&
3194 	    (dev->type != ARPHRD_NONE)) {
3195 		/* Alas, we support only Ethernet autoconfiguration. */
3196 		return;
3197 	}
3198 
3199 	idev = addrconf_add_dev(dev);
3200 	if (IS_ERR(idev))
3201 		return;
3202 
3203 	/* this device type has no EUI support */
3204 	if (dev->type == ARPHRD_NONE &&
3205 	    idev->addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)
3206 		idev->addr_gen_mode = IN6_ADDR_GEN_MODE_RANDOM;
3207 
3208 	addrconf_addr_gen(idev, false);
3209 }
3210 
3211 #if IS_ENABLED(CONFIG_IPV6_SIT)
3212 static void addrconf_sit_config(struct net_device *dev)
3213 {
3214 	struct inet6_dev *idev;
3215 
3216 	ASSERT_RTNL();
3217 
3218 	/*
3219 	 * Configure the tunnel with one of our IPv4
3220 	 * addresses... we should configure all of
3221 	 * our v4 addrs in the tunnel
3222 	 */
3223 
3224 	idev = ipv6_find_idev(dev);
3225 	if (!idev) {
3226 		pr_debug("%s: add_dev failed\n", __func__);
3227 		return;
3228 	}
3229 
3230 	if (dev->priv_flags & IFF_ISATAP) {
3231 		addrconf_addr_gen(idev, false);
3232 		return;
3233 	}
3234 
3235 	sit_add_v4_addrs(idev);
3236 
3237 	if (dev->flags&IFF_POINTOPOINT)
3238 		addrconf_add_mroute(dev);
3239 }
3240 #endif
3241 
3242 #if IS_ENABLED(CONFIG_NET_IPGRE)
3243 static void addrconf_gre_config(struct net_device *dev)
3244 {
3245 	struct inet6_dev *idev;
3246 
3247 	ASSERT_RTNL();
3248 
3249 	idev = ipv6_find_idev(dev);
3250 	if (!idev) {
3251 		pr_debug("%s: add_dev failed\n", __func__);
3252 		return;
3253 	}
3254 
3255 	addrconf_addr_gen(idev, true);
3256 	if (dev->flags & IFF_POINTOPOINT)
3257 		addrconf_add_mroute(dev);
3258 }
3259 #endif
3260 
3261 static int fixup_permanent_addr(struct inet6_dev *idev,
3262 				struct inet6_ifaddr *ifp)
3263 {
3264 	if (!ifp->rt) {
3265 		struct rt6_info *rt;
3266 
3267 		rt = addrconf_dst_alloc(idev, &ifp->addr, false);
3268 		if (unlikely(IS_ERR(rt)))
3269 			return PTR_ERR(rt);
3270 
3271 		ifp->rt = rt;
3272 	}
3273 
3274 	if (!(ifp->flags & IFA_F_NOPREFIXROUTE)) {
3275 		addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
3276 				      idev->dev, 0, 0);
3277 	}
3278 
3279 	addrconf_dad_start(ifp);
3280 
3281 	return 0;
3282 }
3283 
3284 static void addrconf_permanent_addr(struct net_device *dev)
3285 {
3286 	struct inet6_ifaddr *ifp, *tmp;
3287 	struct inet6_dev *idev;
3288 
3289 	idev = __in6_dev_get(dev);
3290 	if (!idev)
3291 		return;
3292 
3293 	write_lock_bh(&idev->lock);
3294 
3295 	list_for_each_entry_safe(ifp, tmp, &idev->addr_list, if_list) {
3296 		if ((ifp->flags & IFA_F_PERMANENT) &&
3297 		    fixup_permanent_addr(idev, ifp) < 0) {
3298 			write_unlock_bh(&idev->lock);
3299 			ipv6_del_addr(ifp);
3300 			write_lock_bh(&idev->lock);
3301 
3302 			net_info_ratelimited("%s: Failed to add prefix route for address %pI6c; dropping\n",
3303 					     idev->dev->name, &ifp->addr);
3304 		}
3305 	}
3306 
3307 	write_unlock_bh(&idev->lock);
3308 }
3309 
3310 static int addrconf_notify(struct notifier_block *this, unsigned long event,
3311 			   void *ptr)
3312 {
3313 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
3314 	struct netdev_notifier_changeupper_info *info;
3315 	struct inet6_dev *idev = __in6_dev_get(dev);
3316 	int run_pending = 0;
3317 	int err;
3318 
3319 	switch (event) {
3320 	case NETDEV_REGISTER:
3321 		if (!idev && dev->mtu >= IPV6_MIN_MTU) {
3322 			idev = ipv6_add_dev(dev);
3323 			if (IS_ERR(idev))
3324 				return notifier_from_errno(PTR_ERR(idev));
3325 		}
3326 		break;
3327 
3328 	case NETDEV_CHANGEMTU:
3329 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
3330 		if (dev->mtu < IPV6_MIN_MTU) {
3331 			addrconf_ifdown(dev, 1);
3332 			break;
3333 		}
3334 
3335 		if (idev) {
3336 			rt6_mtu_change(dev, dev->mtu);
3337 			idev->cnf.mtu6 = dev->mtu;
3338 			break;
3339 		}
3340 
3341 		/* allocate new idev */
3342 		idev = ipv6_add_dev(dev);
3343 		if (IS_ERR(idev))
3344 			break;
3345 
3346 		/* device is still not ready */
3347 		if (!(idev->if_flags & IF_READY))
3348 			break;
3349 
3350 		run_pending = 1;
3351 
3352 		/* fall through */
3353 
3354 	case NETDEV_UP:
3355 	case NETDEV_CHANGE:
3356 		if (dev->flags & IFF_SLAVE)
3357 			break;
3358 
3359 		if (idev && idev->cnf.disable_ipv6)
3360 			break;
3361 
3362 		if (event == NETDEV_UP) {
3363 			/* restore routes for permanent addresses */
3364 			addrconf_permanent_addr(dev);
3365 
3366 			if (!addrconf_qdisc_ok(dev)) {
3367 				/* device is not ready yet. */
3368 				pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
3369 					dev->name);
3370 				break;
3371 			}
3372 
3373 			if (!idev && dev->mtu >= IPV6_MIN_MTU)
3374 				idev = ipv6_add_dev(dev);
3375 
3376 			if (!IS_ERR_OR_NULL(idev)) {
3377 				idev->if_flags |= IF_READY;
3378 				run_pending = 1;
3379 			}
3380 		} else if (event == NETDEV_CHANGE) {
3381 			if (!addrconf_qdisc_ok(dev)) {
3382 				/* device is still not ready. */
3383 				break;
3384 			}
3385 
3386 			if (idev) {
3387 				if (idev->if_flags & IF_READY)
3388 					/* device is already configured. */
3389 					break;
3390 				idev->if_flags |= IF_READY;
3391 			}
3392 
3393 			pr_info("ADDRCONF(NETDEV_CHANGE): %s: link becomes ready\n",
3394 				dev->name);
3395 
3396 			run_pending = 1;
3397 		}
3398 
3399 		switch (dev->type) {
3400 #if IS_ENABLED(CONFIG_IPV6_SIT)
3401 		case ARPHRD_SIT:
3402 			addrconf_sit_config(dev);
3403 			break;
3404 #endif
3405 #if IS_ENABLED(CONFIG_NET_IPGRE)
3406 		case ARPHRD_IPGRE:
3407 			addrconf_gre_config(dev);
3408 			break;
3409 #endif
3410 		case ARPHRD_LOOPBACK:
3411 			init_loopback(dev);
3412 			break;
3413 
3414 		default:
3415 			addrconf_dev_config(dev);
3416 			break;
3417 		}
3418 
3419 		if (!IS_ERR_OR_NULL(idev)) {
3420 			if (run_pending)
3421 				addrconf_dad_run(idev);
3422 
3423 			/*
3424 			 * If the MTU changed during the interface down,
3425 			 * when the interface up, the changed MTU must be
3426 			 * reflected in the idev as well as routers.
3427 			 */
3428 			if (idev->cnf.mtu6 != dev->mtu &&
3429 			    dev->mtu >= IPV6_MIN_MTU) {
3430 				rt6_mtu_change(dev, dev->mtu);
3431 				idev->cnf.mtu6 = dev->mtu;
3432 			}
3433 			idev->tstamp = jiffies;
3434 			inet6_ifinfo_notify(RTM_NEWLINK, idev);
3435 
3436 			/*
3437 			 * If the changed mtu during down is lower than
3438 			 * IPV6_MIN_MTU stop IPv6 on this interface.
3439 			 */
3440 			if (dev->mtu < IPV6_MIN_MTU)
3441 				addrconf_ifdown(dev, 1);
3442 		}
3443 		break;
3444 
3445 	case NETDEV_DOWN:
3446 	case NETDEV_UNREGISTER:
3447 		/*
3448 		 *	Remove all addresses from this interface.
3449 		 */
3450 		addrconf_ifdown(dev, event != NETDEV_DOWN);
3451 		break;
3452 
3453 	case NETDEV_CHANGENAME:
3454 		if (idev) {
3455 			snmp6_unregister_dev(idev);
3456 			addrconf_sysctl_unregister(idev);
3457 			err = addrconf_sysctl_register(idev);
3458 			if (err)
3459 				return notifier_from_errno(err);
3460 			err = snmp6_register_dev(idev);
3461 			if (err) {
3462 				addrconf_sysctl_unregister(idev);
3463 				return notifier_from_errno(err);
3464 			}
3465 		}
3466 		break;
3467 
3468 	case NETDEV_PRE_TYPE_CHANGE:
3469 	case NETDEV_POST_TYPE_CHANGE:
3470 		if (idev)
3471 			addrconf_type_change(dev, event);
3472 		break;
3473 
3474 	case NETDEV_CHANGEUPPER:
3475 		info = ptr;
3476 
3477 		/* flush all routes if dev is linked to or unlinked from
3478 		 * an L3 master device (e.g., VRF)
3479 		 */
3480 		if (info->upper_dev && netif_is_l3_master(info->upper_dev))
3481 			addrconf_ifdown(dev, 0);
3482 	}
3483 
3484 	return NOTIFY_OK;
3485 }
3486 
3487 /*
3488  *	addrconf module should be notified of a device going up
3489  */
3490 static struct notifier_block ipv6_dev_notf = {
3491 	.notifier_call = addrconf_notify,
3492 };
3493 
3494 static void addrconf_type_change(struct net_device *dev, unsigned long event)
3495 {
3496 	struct inet6_dev *idev;
3497 	ASSERT_RTNL();
3498 
3499 	idev = __in6_dev_get(dev);
3500 
3501 	if (event == NETDEV_POST_TYPE_CHANGE)
3502 		ipv6_mc_remap(idev);
3503 	else if (event == NETDEV_PRE_TYPE_CHANGE)
3504 		ipv6_mc_unmap(idev);
3505 }
3506 
3507 static bool addr_is_local(const struct in6_addr *addr)
3508 {
3509 	return ipv6_addr_type(addr) &
3510 		(IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
3511 }
3512 
3513 static int addrconf_ifdown(struct net_device *dev, int how)
3514 {
3515 	struct net *net = dev_net(dev);
3516 	struct inet6_dev *idev;
3517 	struct inet6_ifaddr *ifa, *tmp;
3518 	struct list_head del_list;
3519 	int _keep_addr;
3520 	bool keep_addr;
3521 	int state, i;
3522 
3523 	ASSERT_RTNL();
3524 
3525 	rt6_ifdown(net, dev);
3526 	neigh_ifdown(&nd_tbl, dev);
3527 
3528 	idev = __in6_dev_get(dev);
3529 	if (!idev)
3530 		return -ENODEV;
3531 
3532 	/*
3533 	 * Step 1: remove reference to ipv6 device from parent device.
3534 	 *	   Do not dev_put!
3535 	 */
3536 	if (how) {
3537 		idev->dead = 1;
3538 
3539 		/* protected by rtnl_lock */
3540 		RCU_INIT_POINTER(dev->ip6_ptr, NULL);
3541 
3542 		/* Step 1.5: remove snmp6 entry */
3543 		snmp6_unregister_dev(idev);
3544 
3545 	}
3546 
3547 	/* aggregate the system setting and interface setting */
3548 	_keep_addr = net->ipv6.devconf_all->keep_addr_on_down;
3549 	if (!_keep_addr)
3550 		_keep_addr = idev->cnf.keep_addr_on_down;
3551 
3552 	/* combine the user config with event to determine if permanent
3553 	 * addresses are to be removed from address hash table
3554 	 */
3555 	keep_addr = !(how || _keep_addr <= 0 || idev->cnf.disable_ipv6);
3556 
3557 	/* Step 2: clear hash table */
3558 	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
3559 		struct hlist_head *h = &inet6_addr_lst[i];
3560 
3561 		spin_lock_bh(&addrconf_hash_lock);
3562 restart:
3563 		hlist_for_each_entry_rcu(ifa, h, addr_lst) {
3564 			if (ifa->idev == idev) {
3565 				addrconf_del_dad_work(ifa);
3566 				/* combined flag + permanent flag decide if
3567 				 * address is retained on a down event
3568 				 */
3569 				if (!keep_addr ||
3570 				    !(ifa->flags & IFA_F_PERMANENT) ||
3571 				    addr_is_local(&ifa->addr)) {
3572 					hlist_del_init_rcu(&ifa->addr_lst);
3573 					goto restart;
3574 				}
3575 			}
3576 		}
3577 		spin_unlock_bh(&addrconf_hash_lock);
3578 	}
3579 
3580 	write_lock_bh(&idev->lock);
3581 
3582 	addrconf_del_rs_timer(idev);
3583 
3584 	/* Step 2: clear flags for stateless addrconf */
3585 	if (!how)
3586 		idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
3587 
3588 	/* Step 3: clear tempaddr list */
3589 	while (!list_empty(&idev->tempaddr_list)) {
3590 		ifa = list_first_entry(&idev->tempaddr_list,
3591 				       struct inet6_ifaddr, tmp_list);
3592 		list_del(&ifa->tmp_list);
3593 		write_unlock_bh(&idev->lock);
3594 		spin_lock_bh(&ifa->lock);
3595 
3596 		if (ifa->ifpub) {
3597 			in6_ifa_put(ifa->ifpub);
3598 			ifa->ifpub = NULL;
3599 		}
3600 		spin_unlock_bh(&ifa->lock);
3601 		in6_ifa_put(ifa);
3602 		write_lock_bh(&idev->lock);
3603 	}
3604 
3605 	/* re-combine the user config with event to determine if permanent
3606 	 * addresses are to be removed from the interface list
3607 	 */
3608 	keep_addr = (!how && _keep_addr > 0 && !idev->cnf.disable_ipv6);
3609 
3610 	INIT_LIST_HEAD(&del_list);
3611 	list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
3612 		struct rt6_info *rt = NULL;
3613 
3614 		addrconf_del_dad_work(ifa);
3615 
3616 		write_unlock_bh(&idev->lock);
3617 		spin_lock_bh(&ifa->lock);
3618 
3619 		if (keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
3620 		    !addr_is_local(&ifa->addr)) {
3621 			/* set state to skip the notifier below */
3622 			state = INET6_IFADDR_STATE_DEAD;
3623 			ifa->state = 0;
3624 			if (!(ifa->flags & IFA_F_NODAD))
3625 				ifa->flags |= IFA_F_TENTATIVE;
3626 
3627 			rt = ifa->rt;
3628 			ifa->rt = NULL;
3629 		} else {
3630 			state = ifa->state;
3631 			ifa->state = INET6_IFADDR_STATE_DEAD;
3632 
3633 			list_move(&ifa->if_list, &del_list);
3634 		}
3635 
3636 		spin_unlock_bh(&ifa->lock);
3637 
3638 		if (rt)
3639 			ip6_del_rt(rt);
3640 
3641 		if (state != INET6_IFADDR_STATE_DEAD) {
3642 			__ipv6_ifa_notify(RTM_DELADDR, ifa);
3643 			inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
3644 		} else {
3645 			if (idev->cnf.forwarding)
3646 				addrconf_leave_anycast(ifa);
3647 			addrconf_leave_solict(ifa->idev, &ifa->addr);
3648 		}
3649 
3650 		write_lock_bh(&idev->lock);
3651 	}
3652 
3653 	write_unlock_bh(&idev->lock);
3654 
3655 	/* now clean up addresses to be removed */
3656 	while (!list_empty(&del_list)) {
3657 		ifa = list_first_entry(&del_list,
3658 				       struct inet6_ifaddr, if_list);
3659 		list_del(&ifa->if_list);
3660 
3661 		in6_ifa_put(ifa);
3662 	}
3663 
3664 	/* Step 5: Discard anycast and multicast list */
3665 	if (how) {
3666 		ipv6_ac_destroy_dev(idev);
3667 		ipv6_mc_destroy_dev(idev);
3668 	} else {
3669 		ipv6_mc_down(idev);
3670 	}
3671 
3672 	idev->tstamp = jiffies;
3673 
3674 	/* Last: Shot the device (if unregistered) */
3675 	if (how) {
3676 		addrconf_sysctl_unregister(idev);
3677 		neigh_parms_release(&nd_tbl, idev->nd_parms);
3678 		neigh_ifdown(&nd_tbl, dev);
3679 		in6_dev_put(idev);
3680 	}
3681 	return 0;
3682 }
3683 
3684 static void addrconf_rs_timer(unsigned long data)
3685 {
3686 	struct inet6_dev *idev = (struct inet6_dev *)data;
3687 	struct net_device *dev = idev->dev;
3688 	struct in6_addr lladdr;
3689 
3690 	write_lock(&idev->lock);
3691 	if (idev->dead || !(idev->if_flags & IF_READY))
3692 		goto out;
3693 
3694 	if (!ipv6_accept_ra(idev))
3695 		goto out;
3696 
3697 	/* Announcement received after solicitation was sent */
3698 	if (idev->if_flags & IF_RA_RCVD)
3699 		goto out;
3700 
3701 	if (idev->rs_probes++ < idev->cnf.rtr_solicits || idev->cnf.rtr_solicits < 0) {
3702 		write_unlock(&idev->lock);
3703 		if (!ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
3704 			ndisc_send_rs(dev, &lladdr,
3705 				      &in6addr_linklocal_allrouters);
3706 		else
3707 			goto put;
3708 
3709 		write_lock(&idev->lock);
3710 		idev->rs_interval = rfc3315_s14_backoff_update(
3711 			idev->rs_interval, idev->cnf.rtr_solicit_max_interval);
3712 		/* The wait after the last probe can be shorter */
3713 		addrconf_mod_rs_timer(idev, (idev->rs_probes ==
3714 					     idev->cnf.rtr_solicits) ?
3715 				      idev->cnf.rtr_solicit_delay :
3716 				      idev->rs_interval);
3717 	} else {
3718 		/*
3719 		 * Note: we do not support deprecated "all on-link"
3720 		 * assumption any longer.
3721 		 */
3722 		pr_debug("%s: no IPv6 routers present\n", idev->dev->name);
3723 	}
3724 
3725 out:
3726 	write_unlock(&idev->lock);
3727 put:
3728 	in6_dev_put(idev);
3729 }
3730 
3731 /*
3732  *	Duplicate Address Detection
3733  */
3734 static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
3735 {
3736 	unsigned long rand_num;
3737 	struct inet6_dev *idev = ifp->idev;
3738 
3739 	if (ifp->flags & IFA_F_OPTIMISTIC)
3740 		rand_num = 0;
3741 	else
3742 		rand_num = prandom_u32() % (idev->cnf.rtr_solicit_delay ? : 1);
3743 
3744 	ifp->dad_probes = idev->cnf.dad_transmits;
3745 	addrconf_mod_dad_work(ifp, rand_num);
3746 }
3747 
3748 static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
3749 {
3750 	struct inet6_dev *idev = ifp->idev;
3751 	struct net_device *dev = idev->dev;
3752 	bool bump_id, notify = false;
3753 
3754 	addrconf_join_solict(dev, &ifp->addr);
3755 
3756 	prandom_seed((__force u32) ifp->addr.s6_addr32[3]);
3757 
3758 	read_lock_bh(&idev->lock);
3759 	spin_lock(&ifp->lock);
3760 	if (ifp->state == INET6_IFADDR_STATE_DEAD)
3761 		goto out;
3762 
3763 	if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
3764 	    idev->cnf.accept_dad < 1 ||
3765 	    !(ifp->flags&IFA_F_TENTATIVE) ||
3766 	    ifp->flags & IFA_F_NODAD) {
3767 		bump_id = ifp->flags & IFA_F_TENTATIVE;
3768 		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
3769 		spin_unlock(&ifp->lock);
3770 		read_unlock_bh(&idev->lock);
3771 
3772 		addrconf_dad_completed(ifp, bump_id);
3773 		return;
3774 	}
3775 
3776 	if (!(idev->if_flags & IF_READY)) {
3777 		spin_unlock(&ifp->lock);
3778 		read_unlock_bh(&idev->lock);
3779 		/*
3780 		 * If the device is not ready:
3781 		 * - keep it tentative if it is a permanent address.
3782 		 * - otherwise, kill it.
3783 		 */
3784 		in6_ifa_hold(ifp);
3785 		addrconf_dad_stop(ifp, 0);
3786 		return;
3787 	}
3788 
3789 	/*
3790 	 * Optimistic nodes can start receiving
3791 	 * Frames right away
3792 	 */
3793 	if (ifp->flags & IFA_F_OPTIMISTIC) {
3794 		ip6_ins_rt(ifp->rt);
3795 		if (ipv6_use_optimistic_addr(idev)) {
3796 			/* Because optimistic nodes can use this address,
3797 			 * notify listeners. If DAD fails, RTM_DELADDR is sent.
3798 			 */
3799 			notify = true;
3800 		}
3801 	}
3802 
3803 	addrconf_dad_kick(ifp);
3804 out:
3805 	spin_unlock(&ifp->lock);
3806 	read_unlock_bh(&idev->lock);
3807 	if (notify)
3808 		ipv6_ifa_notify(RTM_NEWADDR, ifp);
3809 }
3810 
3811 static void addrconf_dad_start(struct inet6_ifaddr *ifp)
3812 {
3813 	bool begin_dad = false;
3814 
3815 	spin_lock_bh(&ifp->lock);
3816 	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
3817 		ifp->state = INET6_IFADDR_STATE_PREDAD;
3818 		begin_dad = true;
3819 	}
3820 	spin_unlock_bh(&ifp->lock);
3821 
3822 	if (begin_dad)
3823 		addrconf_mod_dad_work(ifp, 0);
3824 }
3825 
3826 static void addrconf_dad_work(struct work_struct *w)
3827 {
3828 	struct inet6_ifaddr *ifp = container_of(to_delayed_work(w),
3829 						struct inet6_ifaddr,
3830 						dad_work);
3831 	struct inet6_dev *idev = ifp->idev;
3832 	bool bump_id, disable_ipv6 = false;
3833 	struct in6_addr mcaddr;
3834 
3835 	enum {
3836 		DAD_PROCESS,
3837 		DAD_BEGIN,
3838 		DAD_ABORT,
3839 	} action = DAD_PROCESS;
3840 
3841 	rtnl_lock();
3842 
3843 	spin_lock_bh(&ifp->lock);
3844 	if (ifp->state == INET6_IFADDR_STATE_PREDAD) {
3845 		action = DAD_BEGIN;
3846 		ifp->state = INET6_IFADDR_STATE_DAD;
3847 	} else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
3848 		action = DAD_ABORT;
3849 		ifp->state = INET6_IFADDR_STATE_POSTDAD;
3850 
3851 		if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6 &&
3852 		    !(ifp->flags & IFA_F_STABLE_PRIVACY)) {
3853 			struct in6_addr addr;
3854 
3855 			addr.s6_addr32[0] = htonl(0xfe800000);
3856 			addr.s6_addr32[1] = 0;
3857 
3858 			if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
3859 			    ipv6_addr_equal(&ifp->addr, &addr)) {
3860 				/* DAD failed for link-local based on MAC */
3861 				idev->cnf.disable_ipv6 = 1;
3862 
3863 				pr_info("%s: IPv6 being disabled!\n",
3864 					ifp->idev->dev->name);
3865 				disable_ipv6 = true;
3866 			}
3867 		}
3868 	}
3869 	spin_unlock_bh(&ifp->lock);
3870 
3871 	if (action == DAD_BEGIN) {
3872 		addrconf_dad_begin(ifp);
3873 		goto out;
3874 	} else if (action == DAD_ABORT) {
3875 		in6_ifa_hold(ifp);
3876 		addrconf_dad_stop(ifp, 1);
3877 		if (disable_ipv6)
3878 			addrconf_ifdown(idev->dev, 0);
3879 		goto out;
3880 	}
3881 
3882 	if (!ifp->dad_probes && addrconf_dad_end(ifp))
3883 		goto out;
3884 
3885 	write_lock_bh(&idev->lock);
3886 	if (idev->dead || !(idev->if_flags & IF_READY)) {
3887 		write_unlock_bh(&idev->lock);
3888 		goto out;
3889 	}
3890 
3891 	spin_lock(&ifp->lock);
3892 	if (ifp->state == INET6_IFADDR_STATE_DEAD) {
3893 		spin_unlock(&ifp->lock);
3894 		write_unlock_bh(&idev->lock);
3895 		goto out;
3896 	}
3897 
3898 	if (ifp->dad_probes == 0) {
3899 		/*
3900 		 * DAD was successful
3901 		 */
3902 
3903 		bump_id = ifp->flags & IFA_F_TENTATIVE;
3904 		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
3905 		spin_unlock(&ifp->lock);
3906 		write_unlock_bh(&idev->lock);
3907 
3908 		addrconf_dad_completed(ifp, bump_id);
3909 
3910 		goto out;
3911 	}
3912 
3913 	ifp->dad_probes--;
3914 	addrconf_mod_dad_work(ifp,
3915 			      NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME));
3916 	spin_unlock(&ifp->lock);
3917 	write_unlock_bh(&idev->lock);
3918 
3919 	/* send a neighbour solicitation for our addr */
3920 	addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
3921 	ndisc_send_ns(ifp->idev->dev, &ifp->addr, &mcaddr, &in6addr_any);
3922 out:
3923 	in6_ifa_put(ifp);
3924 	rtnl_unlock();
3925 }
3926 
3927 /* ifp->idev must be at least read locked */
3928 static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
3929 {
3930 	struct inet6_ifaddr *ifpiter;
3931 	struct inet6_dev *idev = ifp->idev;
3932 
3933 	list_for_each_entry_reverse(ifpiter, &idev->addr_list, if_list) {
3934 		if (ifpiter->scope > IFA_LINK)
3935 			break;
3936 		if (ifp != ifpiter && ifpiter->scope == IFA_LINK &&
3937 		    (ifpiter->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|
3938 				       IFA_F_OPTIMISTIC|IFA_F_DADFAILED)) ==
3939 		    IFA_F_PERMANENT)
3940 			return false;
3941 	}
3942 	return true;
3943 }
3944 
3945 static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id)
3946 {
3947 	struct net_device *dev = ifp->idev->dev;
3948 	struct in6_addr lladdr;
3949 	bool send_rs, send_mld;
3950 
3951 	addrconf_del_dad_work(ifp);
3952 
3953 	/*
3954 	 *	Configure the address for reception. Now it is valid.
3955 	 */
3956 
3957 	ipv6_ifa_notify(RTM_NEWADDR, ifp);
3958 
3959 	/* If added prefix is link local and we are prepared to process
3960 	   router advertisements, start sending router solicitations.
3961 	 */
3962 
3963 	read_lock_bh(&ifp->idev->lock);
3964 	send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
3965 	send_rs = send_mld &&
3966 		  ipv6_accept_ra(ifp->idev) &&
3967 		  ifp->idev->cnf.rtr_solicits != 0 &&
3968 		  (dev->flags&IFF_LOOPBACK) == 0;
3969 	read_unlock_bh(&ifp->idev->lock);
3970 
3971 	/* While dad is in progress mld report's source address is in6_addrany.
3972 	 * Resend with proper ll now.
3973 	 */
3974 	if (send_mld)
3975 		ipv6_mc_dad_complete(ifp->idev);
3976 
3977 	if (send_rs) {
3978 		/*
3979 		 *	If a host as already performed a random delay
3980 		 *	[...] as part of DAD [...] there is no need
3981 		 *	to delay again before sending the first RS
3982 		 */
3983 		if (ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
3984 			return;
3985 		ndisc_send_rs(dev, &lladdr, &in6addr_linklocal_allrouters);
3986 
3987 		write_lock_bh(&ifp->idev->lock);
3988 		spin_lock(&ifp->lock);
3989 		ifp->idev->rs_interval = rfc3315_s14_backoff_init(
3990 			ifp->idev->cnf.rtr_solicit_interval);
3991 		ifp->idev->rs_probes = 1;
3992 		ifp->idev->if_flags |= IF_RS_SENT;
3993 		addrconf_mod_rs_timer(ifp->idev, ifp->idev->rs_interval);
3994 		spin_unlock(&ifp->lock);
3995 		write_unlock_bh(&ifp->idev->lock);
3996 	}
3997 
3998 	if (bump_id)
3999 		rt_genid_bump_ipv6(dev_net(dev));
4000 }
4001 
4002 static void addrconf_dad_run(struct inet6_dev *idev)
4003 {
4004 	struct inet6_ifaddr *ifp;
4005 
4006 	read_lock_bh(&idev->lock);
4007 	list_for_each_entry(ifp, &idev->addr_list, if_list) {
4008 		spin_lock(&ifp->lock);
4009 		if (ifp->flags & IFA_F_TENTATIVE &&
4010 		    ifp->state == INET6_IFADDR_STATE_DAD)
4011 			addrconf_dad_kick(ifp);
4012 		spin_unlock(&ifp->lock);
4013 	}
4014 	read_unlock_bh(&idev->lock);
4015 }
4016 
4017 #ifdef CONFIG_PROC_FS
4018 struct if6_iter_state {
4019 	struct seq_net_private p;
4020 	int bucket;
4021 	int offset;
4022 };
4023 
4024 static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
4025 {
4026 	struct inet6_ifaddr *ifa = NULL;
4027 	struct if6_iter_state *state = seq->private;
4028 	struct net *net = seq_file_net(seq);
4029 	int p = 0;
4030 
4031 	/* initial bucket if pos is 0 */
4032 	if (pos == 0) {
4033 		state->bucket = 0;
4034 		state->offset = 0;
4035 	}
4036 
4037 	for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
4038 		hlist_for_each_entry_rcu_bh(ifa, &inet6_addr_lst[state->bucket],
4039 					 addr_lst) {
4040 			if (!net_eq(dev_net(ifa->idev->dev), net))
4041 				continue;
4042 			/* sync with offset */
4043 			if (p < state->offset) {
4044 				p++;
4045 				continue;
4046 			}
4047 			state->offset++;
4048 			return ifa;
4049 		}
4050 
4051 		/* prepare for next bucket */
4052 		state->offset = 0;
4053 		p = 0;
4054 	}
4055 	return NULL;
4056 }
4057 
4058 static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
4059 					 struct inet6_ifaddr *ifa)
4060 {
4061 	struct if6_iter_state *state = seq->private;
4062 	struct net *net = seq_file_net(seq);
4063 
4064 	hlist_for_each_entry_continue_rcu_bh(ifa, addr_lst) {
4065 		if (!net_eq(dev_net(ifa->idev->dev), net))
4066 			continue;
4067 		state->offset++;
4068 		return ifa;
4069 	}
4070 
4071 	while (++state->bucket < IN6_ADDR_HSIZE) {
4072 		state->offset = 0;
4073 		hlist_for_each_entry_rcu_bh(ifa,
4074 				     &inet6_addr_lst[state->bucket], addr_lst) {
4075 			if (!net_eq(dev_net(ifa->idev->dev), net))
4076 				continue;
4077 			state->offset++;
4078 			return ifa;
4079 		}
4080 	}
4081 
4082 	return NULL;
4083 }
4084 
4085 static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
4086 	__acquires(rcu_bh)
4087 {
4088 	rcu_read_lock_bh();
4089 	return if6_get_first(seq, *pos);
4090 }
4091 
4092 static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
4093 {
4094 	struct inet6_ifaddr *ifa;
4095 
4096 	ifa = if6_get_next(seq, v);
4097 	++*pos;
4098 	return ifa;
4099 }
4100 
4101 static void if6_seq_stop(struct seq_file *seq, void *v)
4102 	__releases(rcu_bh)
4103 {
4104 	rcu_read_unlock_bh();
4105 }
4106 
4107 static int if6_seq_show(struct seq_file *seq, void *v)
4108 {
4109 	struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
4110 	seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
4111 		   &ifp->addr,
4112 		   ifp->idev->dev->ifindex,
4113 		   ifp->prefix_len,
4114 		   ifp->scope,
4115 		   (u8) ifp->flags,
4116 		   ifp->idev->dev->name);
4117 	return 0;
4118 }
4119 
4120 static const struct seq_operations if6_seq_ops = {
4121 	.start	= if6_seq_start,
4122 	.next	= if6_seq_next,
4123 	.show	= if6_seq_show,
4124 	.stop	= if6_seq_stop,
4125 };
4126 
4127 static int if6_seq_open(struct inode *inode, struct file *file)
4128 {
4129 	return seq_open_net(inode, file, &if6_seq_ops,
4130 			    sizeof(struct if6_iter_state));
4131 }
4132 
4133 static const struct file_operations if6_fops = {
4134 	.owner		= THIS_MODULE,
4135 	.open		= if6_seq_open,
4136 	.read		= seq_read,
4137 	.llseek		= seq_lseek,
4138 	.release	= seq_release_net,
4139 };
4140 
4141 static int __net_init if6_proc_net_init(struct net *net)
4142 {
4143 	if (!proc_create("if_inet6", S_IRUGO, net->proc_net, &if6_fops))
4144 		return -ENOMEM;
4145 	return 0;
4146 }
4147 
4148 static void __net_exit if6_proc_net_exit(struct net *net)
4149 {
4150 	remove_proc_entry("if_inet6", net->proc_net);
4151 }
4152 
4153 static struct pernet_operations if6_proc_net_ops = {
4154 	.init = if6_proc_net_init,
4155 	.exit = if6_proc_net_exit,
4156 };
4157 
4158 int __init if6_proc_init(void)
4159 {
4160 	return register_pernet_subsys(&if6_proc_net_ops);
4161 }
4162 
4163 void if6_proc_exit(void)
4164 {
4165 	unregister_pernet_subsys(&if6_proc_net_ops);
4166 }
4167 #endif	/* CONFIG_PROC_FS */
4168 
4169 #if IS_ENABLED(CONFIG_IPV6_MIP6)
4170 /* Check if address is a home address configured on any interface. */
4171 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
4172 {
4173 	int ret = 0;
4174 	struct inet6_ifaddr *ifp = NULL;
4175 	unsigned int hash = inet6_addr_hash(addr);
4176 
4177 	rcu_read_lock_bh();
4178 	hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
4179 		if (!net_eq(dev_net(ifp->idev->dev), net))
4180 			continue;
4181 		if (ipv6_addr_equal(&ifp->addr, addr) &&
4182 		    (ifp->flags & IFA_F_HOMEADDRESS)) {
4183 			ret = 1;
4184 			break;
4185 		}
4186 	}
4187 	rcu_read_unlock_bh();
4188 	return ret;
4189 }
4190 #endif
4191 
4192 /*
4193  *	Periodic address status verification
4194  */
4195 
4196 static void addrconf_verify_rtnl(void)
4197 {
4198 	unsigned long now, next, next_sec, next_sched;
4199 	struct inet6_ifaddr *ifp;
4200 	int i;
4201 
4202 	ASSERT_RTNL();
4203 
4204 	rcu_read_lock_bh();
4205 	now = jiffies;
4206 	next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
4207 
4208 	cancel_delayed_work(&addr_chk_work);
4209 
4210 	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
4211 restart:
4212 		hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[i], addr_lst) {
4213 			unsigned long age;
4214 
4215 			/* When setting preferred_lft to a value not zero or
4216 			 * infinity, while valid_lft is infinity
4217 			 * IFA_F_PERMANENT has a non-infinity life time.
4218 			 */
4219 			if ((ifp->flags & IFA_F_PERMANENT) &&
4220 			    (ifp->prefered_lft == INFINITY_LIFE_TIME))
4221 				continue;
4222 
4223 			spin_lock(&ifp->lock);
4224 			/* We try to batch several events at once. */
4225 			age = (now - ifp->tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
4226 
4227 			if (ifp->valid_lft != INFINITY_LIFE_TIME &&
4228 			    age >= ifp->valid_lft) {
4229 				spin_unlock(&ifp->lock);
4230 				in6_ifa_hold(ifp);
4231 				ipv6_del_addr(ifp);
4232 				goto restart;
4233 			} else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
4234 				spin_unlock(&ifp->lock);
4235 				continue;
4236 			} else if (age >= ifp->prefered_lft) {
4237 				/* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
4238 				int deprecate = 0;
4239 
4240 				if (!(ifp->flags&IFA_F_DEPRECATED)) {
4241 					deprecate = 1;
4242 					ifp->flags |= IFA_F_DEPRECATED;
4243 				}
4244 
4245 				if ((ifp->valid_lft != INFINITY_LIFE_TIME) &&
4246 				    (time_before(ifp->tstamp + ifp->valid_lft * HZ, next)))
4247 					next = ifp->tstamp + ifp->valid_lft * HZ;
4248 
4249 				spin_unlock(&ifp->lock);
4250 
4251 				if (deprecate) {
4252 					in6_ifa_hold(ifp);
4253 
4254 					ipv6_ifa_notify(0, ifp);
4255 					in6_ifa_put(ifp);
4256 					goto restart;
4257 				}
4258 			} else if ((ifp->flags&IFA_F_TEMPORARY) &&
4259 				   !(ifp->flags&IFA_F_TENTATIVE)) {
4260 				unsigned long regen_advance = ifp->idev->cnf.regen_max_retry *
4261 					ifp->idev->cnf.dad_transmits *
4262 					NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME) / HZ;
4263 
4264 				if (age >= ifp->prefered_lft - regen_advance) {
4265 					struct inet6_ifaddr *ifpub = ifp->ifpub;
4266 					if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
4267 						next = ifp->tstamp + ifp->prefered_lft * HZ;
4268 					if (!ifp->regen_count && ifpub) {
4269 						ifp->regen_count++;
4270 						in6_ifa_hold(ifp);
4271 						in6_ifa_hold(ifpub);
4272 						spin_unlock(&ifp->lock);
4273 
4274 						spin_lock(&ifpub->lock);
4275 						ifpub->regen_count = 0;
4276 						spin_unlock(&ifpub->lock);
4277 						ipv6_create_tempaddr(ifpub, ifp);
4278 						in6_ifa_put(ifpub);
4279 						in6_ifa_put(ifp);
4280 						goto restart;
4281 					}
4282 				} else if (time_before(ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ, next))
4283 					next = ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ;
4284 				spin_unlock(&ifp->lock);
4285 			} else {
4286 				/* ifp->prefered_lft <= ifp->valid_lft */
4287 				if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
4288 					next = ifp->tstamp + ifp->prefered_lft * HZ;
4289 				spin_unlock(&ifp->lock);
4290 			}
4291 		}
4292 	}
4293 
4294 	next_sec = round_jiffies_up(next);
4295 	next_sched = next;
4296 
4297 	/* If rounded timeout is accurate enough, accept it. */
4298 	if (time_before(next_sec, next + ADDRCONF_TIMER_FUZZ))
4299 		next_sched = next_sec;
4300 
4301 	/* And minimum interval is ADDRCONF_TIMER_FUZZ_MAX. */
4302 	if (time_before(next_sched, jiffies + ADDRCONF_TIMER_FUZZ_MAX))
4303 		next_sched = jiffies + ADDRCONF_TIMER_FUZZ_MAX;
4304 
4305 	ADBG(KERN_DEBUG "now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
4306 	      now, next, next_sec, next_sched);
4307 	mod_delayed_work(addrconf_wq, &addr_chk_work, next_sched - now);
4308 	rcu_read_unlock_bh();
4309 }
4310 
4311 static void addrconf_verify_work(struct work_struct *w)
4312 {
4313 	rtnl_lock();
4314 	addrconf_verify_rtnl();
4315 	rtnl_unlock();
4316 }
4317 
4318 static void addrconf_verify(void)
4319 {
4320 	mod_delayed_work(addrconf_wq, &addr_chk_work, 0);
4321 }
4322 
4323 static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local,
4324 				     struct in6_addr **peer_pfx)
4325 {
4326 	struct in6_addr *pfx = NULL;
4327 
4328 	*peer_pfx = NULL;
4329 
4330 	if (addr)
4331 		pfx = nla_data(addr);
4332 
4333 	if (local) {
4334 		if (pfx && nla_memcmp(local, pfx, sizeof(*pfx)))
4335 			*peer_pfx = pfx;
4336 		pfx = nla_data(local);
4337 	}
4338 
4339 	return pfx;
4340 }
4341 
4342 static const struct nla_policy ifa_ipv6_policy[IFA_MAX+1] = {
4343 	[IFA_ADDRESS]		= { .len = sizeof(struct in6_addr) },
4344 	[IFA_LOCAL]		= { .len = sizeof(struct in6_addr) },
4345 	[IFA_CACHEINFO]		= { .len = sizeof(struct ifa_cacheinfo) },
4346 	[IFA_FLAGS]		= { .len = sizeof(u32) },
4347 };
4348 
4349 static int
4350 inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
4351 {
4352 	struct net *net = sock_net(skb->sk);
4353 	struct ifaddrmsg *ifm;
4354 	struct nlattr *tb[IFA_MAX+1];
4355 	struct in6_addr *pfx, *peer_pfx;
4356 	u32 ifa_flags;
4357 	int err;
4358 
4359 	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
4360 	if (err < 0)
4361 		return err;
4362 
4363 	ifm = nlmsg_data(nlh);
4364 	pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
4365 	if (!pfx)
4366 		return -EINVAL;
4367 
4368 	ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) : ifm->ifa_flags;
4369 
4370 	/* We ignore other flags so far. */
4371 	ifa_flags &= IFA_F_MANAGETEMPADDR;
4372 
4373 	return inet6_addr_del(net, ifm->ifa_index, ifa_flags, pfx,
4374 			      ifm->ifa_prefixlen);
4375 }
4376 
4377 static int inet6_addr_modify(struct inet6_ifaddr *ifp, u32 ifa_flags,
4378 			     u32 prefered_lft, u32 valid_lft)
4379 {
4380 	u32 flags;
4381 	clock_t expires;
4382 	unsigned long timeout;
4383 	bool was_managetempaddr;
4384 	bool had_prefixroute;
4385 
4386 	ASSERT_RTNL();
4387 
4388 	if (!valid_lft || (prefered_lft > valid_lft))
4389 		return -EINVAL;
4390 
4391 	if (ifa_flags & IFA_F_MANAGETEMPADDR &&
4392 	    (ifp->flags & IFA_F_TEMPORARY || ifp->prefix_len != 64))
4393 		return -EINVAL;
4394 
4395 	timeout = addrconf_timeout_fixup(valid_lft, HZ);
4396 	if (addrconf_finite_timeout(timeout)) {
4397 		expires = jiffies_to_clock_t(timeout * HZ);
4398 		valid_lft = timeout;
4399 		flags = RTF_EXPIRES;
4400 	} else {
4401 		expires = 0;
4402 		flags = 0;
4403 		ifa_flags |= IFA_F_PERMANENT;
4404 	}
4405 
4406 	timeout = addrconf_timeout_fixup(prefered_lft, HZ);
4407 	if (addrconf_finite_timeout(timeout)) {
4408 		if (timeout == 0)
4409 			ifa_flags |= IFA_F_DEPRECATED;
4410 		prefered_lft = timeout;
4411 	}
4412 
4413 	spin_lock_bh(&ifp->lock);
4414 	was_managetempaddr = ifp->flags & IFA_F_MANAGETEMPADDR;
4415 	had_prefixroute = ifp->flags & IFA_F_PERMANENT &&
4416 			  !(ifp->flags & IFA_F_NOPREFIXROUTE);
4417 	ifp->flags &= ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD |
4418 			IFA_F_HOMEADDRESS | IFA_F_MANAGETEMPADDR |
4419 			IFA_F_NOPREFIXROUTE);
4420 	ifp->flags |= ifa_flags;
4421 	ifp->tstamp = jiffies;
4422 	ifp->valid_lft = valid_lft;
4423 	ifp->prefered_lft = prefered_lft;
4424 
4425 	spin_unlock_bh(&ifp->lock);
4426 	if (!(ifp->flags&IFA_F_TENTATIVE))
4427 		ipv6_ifa_notify(0, ifp);
4428 
4429 	if (!(ifa_flags & IFA_F_NOPREFIXROUTE)) {
4430 		addrconf_prefix_route(&ifp->addr, ifp->prefix_len, ifp->idev->dev,
4431 				      expires, flags);
4432 	} else if (had_prefixroute) {
4433 		enum cleanup_prefix_rt_t action;
4434 		unsigned long rt_expires;
4435 
4436 		write_lock_bh(&ifp->idev->lock);
4437 		action = check_cleanup_prefix_route(ifp, &rt_expires);
4438 		write_unlock_bh(&ifp->idev->lock);
4439 
4440 		if (action != CLEANUP_PREFIX_RT_NOP) {
4441 			cleanup_prefix_route(ifp, rt_expires,
4442 				action == CLEANUP_PREFIX_RT_DEL);
4443 		}
4444 	}
4445 
4446 	if (was_managetempaddr || ifp->flags & IFA_F_MANAGETEMPADDR) {
4447 		if (was_managetempaddr && !(ifp->flags & IFA_F_MANAGETEMPADDR))
4448 			valid_lft = prefered_lft = 0;
4449 		manage_tempaddrs(ifp->idev, ifp, valid_lft, prefered_lft,
4450 				 !was_managetempaddr, jiffies);
4451 	}
4452 
4453 	addrconf_verify_rtnl();
4454 
4455 	return 0;
4456 }
4457 
4458 static int
4459 inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
4460 {
4461 	struct net *net = sock_net(skb->sk);
4462 	struct ifaddrmsg *ifm;
4463 	struct nlattr *tb[IFA_MAX+1];
4464 	struct in6_addr *pfx, *peer_pfx;
4465 	struct inet6_ifaddr *ifa;
4466 	struct net_device *dev;
4467 	u32 valid_lft = INFINITY_LIFE_TIME, preferred_lft = INFINITY_LIFE_TIME;
4468 	u32 ifa_flags;
4469 	int err;
4470 
4471 	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
4472 	if (err < 0)
4473 		return err;
4474 
4475 	ifm = nlmsg_data(nlh);
4476 	pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
4477 	if (!pfx)
4478 		return -EINVAL;
4479 
4480 	if (tb[IFA_CACHEINFO]) {
4481 		struct ifa_cacheinfo *ci;
4482 
4483 		ci = nla_data(tb[IFA_CACHEINFO]);
4484 		valid_lft = ci->ifa_valid;
4485 		preferred_lft = ci->ifa_prefered;
4486 	} else {
4487 		preferred_lft = INFINITY_LIFE_TIME;
4488 		valid_lft = INFINITY_LIFE_TIME;
4489 	}
4490 
4491 	dev =  __dev_get_by_index(net, ifm->ifa_index);
4492 	if (!dev)
4493 		return -ENODEV;
4494 
4495 	ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) : ifm->ifa_flags;
4496 
4497 	/* We ignore other flags so far. */
4498 	ifa_flags &= IFA_F_NODAD | IFA_F_HOMEADDRESS | IFA_F_MANAGETEMPADDR |
4499 		     IFA_F_NOPREFIXROUTE | IFA_F_MCAUTOJOIN;
4500 
4501 	ifa = ipv6_get_ifaddr(net, pfx, dev, 1);
4502 	if (!ifa) {
4503 		/*
4504 		 * It would be best to check for !NLM_F_CREATE here but
4505 		 * userspace already relies on not having to provide this.
4506 		 */
4507 		return inet6_addr_add(net, ifm->ifa_index, pfx, peer_pfx,
4508 				      ifm->ifa_prefixlen, ifa_flags,
4509 				      preferred_lft, valid_lft);
4510 	}
4511 
4512 	if (nlh->nlmsg_flags & NLM_F_EXCL ||
4513 	    !(nlh->nlmsg_flags & NLM_F_REPLACE))
4514 		err = -EEXIST;
4515 	else
4516 		err = inet6_addr_modify(ifa, ifa_flags, preferred_lft, valid_lft);
4517 
4518 	in6_ifa_put(ifa);
4519 
4520 	return err;
4521 }
4522 
4523 static void put_ifaddrmsg(struct nlmsghdr *nlh, u8 prefixlen, u32 flags,
4524 			  u8 scope, int ifindex)
4525 {
4526 	struct ifaddrmsg *ifm;
4527 
4528 	ifm = nlmsg_data(nlh);
4529 	ifm->ifa_family = AF_INET6;
4530 	ifm->ifa_prefixlen = prefixlen;
4531 	ifm->ifa_flags = flags;
4532 	ifm->ifa_scope = scope;
4533 	ifm->ifa_index = ifindex;
4534 }
4535 
4536 static int put_cacheinfo(struct sk_buff *skb, unsigned long cstamp,
4537 			 unsigned long tstamp, u32 preferred, u32 valid)
4538 {
4539 	struct ifa_cacheinfo ci;
4540 
4541 	ci.cstamp = cstamp_delta(cstamp);
4542 	ci.tstamp = cstamp_delta(tstamp);
4543 	ci.ifa_prefered = preferred;
4544 	ci.ifa_valid = valid;
4545 
4546 	return nla_put(skb, IFA_CACHEINFO, sizeof(ci), &ci);
4547 }
4548 
4549 static inline int rt_scope(int ifa_scope)
4550 {
4551 	if (ifa_scope & IFA_HOST)
4552 		return RT_SCOPE_HOST;
4553 	else if (ifa_scope & IFA_LINK)
4554 		return RT_SCOPE_LINK;
4555 	else if (ifa_scope & IFA_SITE)
4556 		return RT_SCOPE_SITE;
4557 	else
4558 		return RT_SCOPE_UNIVERSE;
4559 }
4560 
4561 static inline int inet6_ifaddr_msgsize(void)
4562 {
4563 	return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
4564 	       + nla_total_size(16) /* IFA_LOCAL */
4565 	       + nla_total_size(16) /* IFA_ADDRESS */
4566 	       + nla_total_size(sizeof(struct ifa_cacheinfo))
4567 	       + nla_total_size(4)  /* IFA_FLAGS */;
4568 }
4569 
4570 static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
4571 			     u32 portid, u32 seq, int event, unsigned int flags)
4572 {
4573 	struct nlmsghdr  *nlh;
4574 	u32 preferred, valid;
4575 
4576 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
4577 	if (!nlh)
4578 		return -EMSGSIZE;
4579 
4580 	put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
4581 		      ifa->idev->dev->ifindex);
4582 
4583 	if (!((ifa->flags&IFA_F_PERMANENT) &&
4584 	      (ifa->prefered_lft == INFINITY_LIFE_TIME))) {
4585 		preferred = ifa->prefered_lft;
4586 		valid = ifa->valid_lft;
4587 		if (preferred != INFINITY_LIFE_TIME) {
4588 			long tval = (jiffies - ifa->tstamp)/HZ;
4589 			if (preferred > tval)
4590 				preferred -= tval;
4591 			else
4592 				preferred = 0;
4593 			if (valid != INFINITY_LIFE_TIME) {
4594 				if (valid > tval)
4595 					valid -= tval;
4596 				else
4597 					valid = 0;
4598 			}
4599 		}
4600 	} else {
4601 		preferred = INFINITY_LIFE_TIME;
4602 		valid = INFINITY_LIFE_TIME;
4603 	}
4604 
4605 	if (!ipv6_addr_any(&ifa->peer_addr)) {
4606 		if (nla_put_in6_addr(skb, IFA_LOCAL, &ifa->addr) < 0 ||
4607 		    nla_put_in6_addr(skb, IFA_ADDRESS, &ifa->peer_addr) < 0)
4608 			goto error;
4609 	} else
4610 		if (nla_put_in6_addr(skb, IFA_ADDRESS, &ifa->addr) < 0)
4611 			goto error;
4612 
4613 	if (put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0)
4614 		goto error;
4615 
4616 	if (nla_put_u32(skb, IFA_FLAGS, ifa->flags) < 0)
4617 		goto error;
4618 
4619 	nlmsg_end(skb, nlh);
4620 	return 0;
4621 
4622 error:
4623 	nlmsg_cancel(skb, nlh);
4624 	return -EMSGSIZE;
4625 }
4626 
4627 static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
4628 				u32 portid, u32 seq, int event, u16 flags)
4629 {
4630 	struct nlmsghdr  *nlh;
4631 	u8 scope = RT_SCOPE_UNIVERSE;
4632 	int ifindex = ifmca->idev->dev->ifindex;
4633 
4634 	if (ipv6_addr_scope(&ifmca->mca_addr) & IFA_SITE)
4635 		scope = RT_SCOPE_SITE;
4636 
4637 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
4638 	if (!nlh)
4639 		return -EMSGSIZE;
4640 
4641 	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
4642 	if (nla_put_in6_addr(skb, IFA_MULTICAST, &ifmca->mca_addr) < 0 ||
4643 	    put_cacheinfo(skb, ifmca->mca_cstamp, ifmca->mca_tstamp,
4644 			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
4645 		nlmsg_cancel(skb, nlh);
4646 		return -EMSGSIZE;
4647 	}
4648 
4649 	nlmsg_end(skb, nlh);
4650 	return 0;
4651 }
4652 
4653 static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
4654 				u32 portid, u32 seq, int event, unsigned int flags)
4655 {
4656 	struct nlmsghdr  *nlh;
4657 	u8 scope = RT_SCOPE_UNIVERSE;
4658 	int ifindex = ifaca->aca_idev->dev->ifindex;
4659 
4660 	if (ipv6_addr_scope(&ifaca->aca_addr) & IFA_SITE)
4661 		scope = RT_SCOPE_SITE;
4662 
4663 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
4664 	if (!nlh)
4665 		return -EMSGSIZE;
4666 
4667 	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
4668 	if (nla_put_in6_addr(skb, IFA_ANYCAST, &ifaca->aca_addr) < 0 ||
4669 	    put_cacheinfo(skb, ifaca->aca_cstamp, ifaca->aca_tstamp,
4670 			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
4671 		nlmsg_cancel(skb, nlh);
4672 		return -EMSGSIZE;
4673 	}
4674 
4675 	nlmsg_end(skb, nlh);
4676 	return 0;
4677 }
4678 
4679 enum addr_type_t {
4680 	UNICAST_ADDR,
4681 	MULTICAST_ADDR,
4682 	ANYCAST_ADDR,
4683 };
4684 
4685 /* called with rcu_read_lock() */
4686 static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
4687 			  struct netlink_callback *cb, enum addr_type_t type,
4688 			  int s_ip_idx, int *p_ip_idx)
4689 {
4690 	struct ifmcaddr6 *ifmca;
4691 	struct ifacaddr6 *ifaca;
4692 	int err = 1;
4693 	int ip_idx = *p_ip_idx;
4694 
4695 	read_lock_bh(&idev->lock);
4696 	switch (type) {
4697 	case UNICAST_ADDR: {
4698 		struct inet6_ifaddr *ifa;
4699 
4700 		/* unicast address incl. temp addr */
4701 		list_for_each_entry(ifa, &idev->addr_list, if_list) {
4702 			if (++ip_idx < s_ip_idx)
4703 				continue;
4704 			err = inet6_fill_ifaddr(skb, ifa,
4705 						NETLINK_CB(cb->skb).portid,
4706 						cb->nlh->nlmsg_seq,
4707 						RTM_NEWADDR,
4708 						NLM_F_MULTI);
4709 			if (err < 0)
4710 				break;
4711 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4712 		}
4713 		break;
4714 	}
4715 	case MULTICAST_ADDR:
4716 		/* multicast address */
4717 		for (ifmca = idev->mc_list; ifmca;
4718 		     ifmca = ifmca->next, ip_idx++) {
4719 			if (ip_idx < s_ip_idx)
4720 				continue;
4721 			err = inet6_fill_ifmcaddr(skb, ifmca,
4722 						  NETLINK_CB(cb->skb).portid,
4723 						  cb->nlh->nlmsg_seq,
4724 						  RTM_GETMULTICAST,
4725 						  NLM_F_MULTI);
4726 			if (err < 0)
4727 				break;
4728 		}
4729 		break;
4730 	case ANYCAST_ADDR:
4731 		/* anycast address */
4732 		for (ifaca = idev->ac_list; ifaca;
4733 		     ifaca = ifaca->aca_next, ip_idx++) {
4734 			if (ip_idx < s_ip_idx)
4735 				continue;
4736 			err = inet6_fill_ifacaddr(skb, ifaca,
4737 						  NETLINK_CB(cb->skb).portid,
4738 						  cb->nlh->nlmsg_seq,
4739 						  RTM_GETANYCAST,
4740 						  NLM_F_MULTI);
4741 			if (err < 0)
4742 				break;
4743 		}
4744 		break;
4745 	default:
4746 		break;
4747 	}
4748 	read_unlock_bh(&idev->lock);
4749 	*p_ip_idx = ip_idx;
4750 	return err;
4751 }
4752 
4753 static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
4754 			   enum addr_type_t type)
4755 {
4756 	struct net *net = sock_net(skb->sk);
4757 	int h, s_h;
4758 	int idx, ip_idx;
4759 	int s_idx, s_ip_idx;
4760 	struct net_device *dev;
4761 	struct inet6_dev *idev;
4762 	struct hlist_head *head;
4763 
4764 	s_h = cb->args[0];
4765 	s_idx = idx = cb->args[1];
4766 	s_ip_idx = ip_idx = cb->args[2];
4767 
4768 	rcu_read_lock();
4769 	cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^ net->dev_base_seq;
4770 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
4771 		idx = 0;
4772 		head = &net->dev_index_head[h];
4773 		hlist_for_each_entry_rcu(dev, head, index_hlist) {
4774 			if (idx < s_idx)
4775 				goto cont;
4776 			if (h > s_h || idx > s_idx)
4777 				s_ip_idx = 0;
4778 			ip_idx = 0;
4779 			idev = __in6_dev_get(dev);
4780 			if (!idev)
4781 				goto cont;
4782 
4783 			if (in6_dump_addrs(idev, skb, cb, type,
4784 					   s_ip_idx, &ip_idx) < 0)
4785 				goto done;
4786 cont:
4787 			idx++;
4788 		}
4789 	}
4790 done:
4791 	rcu_read_unlock();
4792 	cb->args[0] = h;
4793 	cb->args[1] = idx;
4794 	cb->args[2] = ip_idx;
4795 
4796 	return skb->len;
4797 }
4798 
4799 static int inet6_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
4800 {
4801 	enum addr_type_t type = UNICAST_ADDR;
4802 
4803 	return inet6_dump_addr(skb, cb, type);
4804 }
4805 
4806 static int inet6_dump_ifmcaddr(struct sk_buff *skb, struct netlink_callback *cb)
4807 {
4808 	enum addr_type_t type = MULTICAST_ADDR;
4809 
4810 	return inet6_dump_addr(skb, cb, type);
4811 }
4812 
4813 
4814 static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
4815 {
4816 	enum addr_type_t type = ANYCAST_ADDR;
4817 
4818 	return inet6_dump_addr(skb, cb, type);
4819 }
4820 
4821 static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh)
4822 {
4823 	struct net *net = sock_net(in_skb->sk);
4824 	struct ifaddrmsg *ifm;
4825 	struct nlattr *tb[IFA_MAX+1];
4826 	struct in6_addr *addr = NULL, *peer;
4827 	struct net_device *dev = NULL;
4828 	struct inet6_ifaddr *ifa;
4829 	struct sk_buff *skb;
4830 	int err;
4831 
4832 	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
4833 	if (err < 0)
4834 		goto errout;
4835 
4836 	addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer);
4837 	if (!addr) {
4838 		err = -EINVAL;
4839 		goto errout;
4840 	}
4841 
4842 	ifm = nlmsg_data(nlh);
4843 	if (ifm->ifa_index)
4844 		dev = __dev_get_by_index(net, ifm->ifa_index);
4845 
4846 	ifa = ipv6_get_ifaddr(net, addr, dev, 1);
4847 	if (!ifa) {
4848 		err = -EADDRNOTAVAIL;
4849 		goto errout;
4850 	}
4851 
4852 	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_KERNEL);
4853 	if (!skb) {
4854 		err = -ENOBUFS;
4855 		goto errout_ifa;
4856 	}
4857 
4858 	err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).portid,
4859 				nlh->nlmsg_seq, RTM_NEWADDR, 0);
4860 	if (err < 0) {
4861 		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
4862 		WARN_ON(err == -EMSGSIZE);
4863 		kfree_skb(skb);
4864 		goto errout_ifa;
4865 	}
4866 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
4867 errout_ifa:
4868 	in6_ifa_put(ifa);
4869 errout:
4870 	return err;
4871 }
4872 
4873 static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
4874 {
4875 	struct sk_buff *skb;
4876 	struct net *net = dev_net(ifa->idev->dev);
4877 	int err = -ENOBUFS;
4878 
4879 	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_ATOMIC);
4880 	if (!skb)
4881 		goto errout;
4882 
4883 	err = inet6_fill_ifaddr(skb, ifa, 0, 0, event, 0);
4884 	if (err < 0) {
4885 		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
4886 		WARN_ON(err == -EMSGSIZE);
4887 		kfree_skb(skb);
4888 		goto errout;
4889 	}
4890 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
4891 	return;
4892 errout:
4893 	if (err < 0)
4894 		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err);
4895 }
4896 
4897 static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
4898 				__s32 *array, int bytes)
4899 {
4900 	BUG_ON(bytes < (DEVCONF_MAX * 4));
4901 
4902 	memset(array, 0, bytes);
4903 	array[DEVCONF_FORWARDING] = cnf->forwarding;
4904 	array[DEVCONF_HOPLIMIT] = cnf->hop_limit;
4905 	array[DEVCONF_MTU6] = cnf->mtu6;
4906 	array[DEVCONF_ACCEPT_RA] = cnf->accept_ra;
4907 	array[DEVCONF_ACCEPT_REDIRECTS] = cnf->accept_redirects;
4908 	array[DEVCONF_AUTOCONF] = cnf->autoconf;
4909 	array[DEVCONF_DAD_TRANSMITS] = cnf->dad_transmits;
4910 	array[DEVCONF_RTR_SOLICITS] = cnf->rtr_solicits;
4911 	array[DEVCONF_RTR_SOLICIT_INTERVAL] =
4912 		jiffies_to_msecs(cnf->rtr_solicit_interval);
4913 	array[DEVCONF_RTR_SOLICIT_MAX_INTERVAL] =
4914 		jiffies_to_msecs(cnf->rtr_solicit_max_interval);
4915 	array[DEVCONF_RTR_SOLICIT_DELAY] =
4916 		jiffies_to_msecs(cnf->rtr_solicit_delay);
4917 	array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version;
4918 	array[DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL] =
4919 		jiffies_to_msecs(cnf->mldv1_unsolicited_report_interval);
4920 	array[DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL] =
4921 		jiffies_to_msecs(cnf->mldv2_unsolicited_report_interval);
4922 	array[DEVCONF_USE_TEMPADDR] = cnf->use_tempaddr;
4923 	array[DEVCONF_TEMP_VALID_LFT] = cnf->temp_valid_lft;
4924 	array[DEVCONF_TEMP_PREFERED_LFT] = cnf->temp_prefered_lft;
4925 	array[DEVCONF_REGEN_MAX_RETRY] = cnf->regen_max_retry;
4926 	array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor;
4927 	array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
4928 	array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
4929 	array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] = cnf->accept_ra_min_hop_limit;
4930 	array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
4931 #ifdef CONFIG_IPV6_ROUTER_PREF
4932 	array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
4933 	array[DEVCONF_RTR_PROBE_INTERVAL] =
4934 		jiffies_to_msecs(cnf->rtr_probe_interval);
4935 #ifdef CONFIG_IPV6_ROUTE_INFO
4936 	array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
4937 #endif
4938 #endif
4939 	array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;
4940 	array[DEVCONF_ACCEPT_SOURCE_ROUTE] = cnf->accept_source_route;
4941 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
4942 	array[DEVCONF_OPTIMISTIC_DAD] = cnf->optimistic_dad;
4943 	array[DEVCONF_USE_OPTIMISTIC] = cnf->use_optimistic;
4944 #endif
4945 #ifdef CONFIG_IPV6_MROUTE
4946 	array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding;
4947 #endif
4948 	array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
4949 	array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
4950 	array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
4951 	array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
4952 	array[DEVCONF_SUPPRESS_FRAG_NDISC] = cnf->suppress_frag_ndisc;
4953 	array[DEVCONF_ACCEPT_RA_FROM_LOCAL] = cnf->accept_ra_from_local;
4954 	array[DEVCONF_ACCEPT_RA_MTU] = cnf->accept_ra_mtu;
4955 	array[DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN] = cnf->ignore_routes_with_linkdown;
4956 	/* we omit DEVCONF_STABLE_SECRET for now */
4957 	array[DEVCONF_USE_OIF_ADDRS_ONLY] = cnf->use_oif_addrs_only;
4958 	array[DEVCONF_DROP_UNICAST_IN_L2_MULTICAST] = cnf->drop_unicast_in_l2_multicast;
4959 	array[DEVCONF_DROP_UNSOLICITED_NA] = cnf->drop_unsolicited_na;
4960 	array[DEVCONF_KEEP_ADDR_ON_DOWN] = cnf->keep_addr_on_down;
4961 	array[DEVCONF_SEG6_ENABLED] = cnf->seg6_enabled;
4962 #ifdef CONFIG_IPV6_SEG6_HMAC
4963 	array[DEVCONF_SEG6_REQUIRE_HMAC] = cnf->seg6_require_hmac;
4964 #endif
4965 }
4966 
4967 static inline size_t inet6_ifla6_size(void)
4968 {
4969 	return nla_total_size(4) /* IFLA_INET6_FLAGS */
4970 	     + nla_total_size(sizeof(struct ifla_cacheinfo))
4971 	     + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
4972 	     + nla_total_size(IPSTATS_MIB_MAX * 8) /* IFLA_INET6_STATS */
4973 	     + nla_total_size(ICMP6_MIB_MAX * 8) /* IFLA_INET6_ICMP6STATS */
4974 	     + nla_total_size(sizeof(struct in6_addr)); /* IFLA_INET6_TOKEN */
4975 }
4976 
4977 static inline size_t inet6_if_nlmsg_size(void)
4978 {
4979 	return NLMSG_ALIGN(sizeof(struct ifinfomsg))
4980 	       + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
4981 	       + nla_total_size(MAX_ADDR_LEN) /* IFLA_ADDRESS */
4982 	       + nla_total_size(4) /* IFLA_MTU */
4983 	       + nla_total_size(4) /* IFLA_LINK */
4984 	       + nla_total_size(1) /* IFLA_OPERSTATE */
4985 	       + nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */
4986 }
4987 
4988 static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
4989 					int bytes)
4990 {
4991 	int i;
4992 	int pad = bytes - sizeof(u64) * ICMP6_MIB_MAX;
4993 	BUG_ON(pad < 0);
4994 
4995 	/* Use put_unaligned() because stats may not be aligned for u64. */
4996 	put_unaligned(ICMP6_MIB_MAX, &stats[0]);
4997 	for (i = 1; i < ICMP6_MIB_MAX; i++)
4998 		put_unaligned(atomic_long_read(&mib[i]), &stats[i]);
4999 
5000 	memset(&stats[ICMP6_MIB_MAX], 0, pad);
5001 }
5002 
5003 static inline void __snmp6_fill_stats64(u64 *stats, void __percpu *mib,
5004 					int bytes, size_t syncpoff)
5005 {
5006 	int i, c;
5007 	u64 buff[IPSTATS_MIB_MAX];
5008 	int pad = bytes - sizeof(u64) * IPSTATS_MIB_MAX;
5009 
5010 	BUG_ON(pad < 0);
5011 
5012 	memset(buff, 0, sizeof(buff));
5013 	buff[0] = IPSTATS_MIB_MAX;
5014 
5015 	for_each_possible_cpu(c) {
5016 		for (i = 1; i < IPSTATS_MIB_MAX; i++)
5017 			buff[i] += snmp_get_cpu_field64(mib, c, i, syncpoff);
5018 	}
5019 
5020 	memcpy(stats, buff, IPSTATS_MIB_MAX * sizeof(u64));
5021 	memset(&stats[IPSTATS_MIB_MAX], 0, pad);
5022 }
5023 
5024 static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
5025 			     int bytes)
5026 {
5027 	switch (attrtype) {
5028 	case IFLA_INET6_STATS:
5029 		__snmp6_fill_stats64(stats, idev->stats.ipv6, bytes,
5030 				     offsetof(struct ipstats_mib, syncp));
5031 		break;
5032 	case IFLA_INET6_ICMP6STATS:
5033 		__snmp6_fill_statsdev(stats, idev->stats.icmpv6dev->mibs, bytes);
5034 		break;
5035 	}
5036 }
5037 
5038 static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev,
5039 				  u32 ext_filter_mask)
5040 {
5041 	struct nlattr *nla;
5042 	struct ifla_cacheinfo ci;
5043 
5044 	if (nla_put_u32(skb, IFLA_INET6_FLAGS, idev->if_flags))
5045 		goto nla_put_failure;
5046 	ci.max_reasm_len = IPV6_MAXPLEN;
5047 	ci.tstamp = cstamp_delta(idev->tstamp);
5048 	ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
5049 	ci.retrans_time = jiffies_to_msecs(NEIGH_VAR(idev->nd_parms, RETRANS_TIME));
5050 	if (nla_put(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci))
5051 		goto nla_put_failure;
5052 	nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
5053 	if (!nla)
5054 		goto nla_put_failure;
5055 	ipv6_store_devconf(&idev->cnf, nla_data(nla), nla_len(nla));
5056 
5057 	/* XXX - MC not implemented */
5058 
5059 	if (ext_filter_mask & RTEXT_FILTER_SKIP_STATS)
5060 		return 0;
5061 
5062 	nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
5063 	if (!nla)
5064 		goto nla_put_failure;
5065 	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
5066 
5067 	nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
5068 	if (!nla)
5069 		goto nla_put_failure;
5070 	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
5071 
5072 	nla = nla_reserve(skb, IFLA_INET6_TOKEN, sizeof(struct in6_addr));
5073 	if (!nla)
5074 		goto nla_put_failure;
5075 
5076 	if (nla_put_u8(skb, IFLA_INET6_ADDR_GEN_MODE, idev->addr_gen_mode))
5077 		goto nla_put_failure;
5078 
5079 	read_lock_bh(&idev->lock);
5080 	memcpy(nla_data(nla), idev->token.s6_addr, nla_len(nla));
5081 	read_unlock_bh(&idev->lock);
5082 
5083 	return 0;
5084 
5085 nla_put_failure:
5086 	return -EMSGSIZE;
5087 }
5088 
5089 static size_t inet6_get_link_af_size(const struct net_device *dev,
5090 				     u32 ext_filter_mask)
5091 {
5092 	if (!__in6_dev_get(dev))
5093 		return 0;
5094 
5095 	return inet6_ifla6_size();
5096 }
5097 
5098 static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev,
5099 			      u32 ext_filter_mask)
5100 {
5101 	struct inet6_dev *idev = __in6_dev_get(dev);
5102 
5103 	if (!idev)
5104 		return -ENODATA;
5105 
5106 	if (inet6_fill_ifla6_attrs(skb, idev, ext_filter_mask) < 0)
5107 		return -EMSGSIZE;
5108 
5109 	return 0;
5110 }
5111 
5112 static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
5113 {
5114 	struct inet6_ifaddr *ifp;
5115 	struct net_device *dev = idev->dev;
5116 	bool clear_token, update_rs = false;
5117 	struct in6_addr ll_addr;
5118 
5119 	ASSERT_RTNL();
5120 
5121 	if (!token)
5122 		return -EINVAL;
5123 	if (dev->flags & (IFF_LOOPBACK | IFF_NOARP))
5124 		return -EINVAL;
5125 	if (!ipv6_accept_ra(idev))
5126 		return -EINVAL;
5127 	if (idev->cnf.rtr_solicits == 0)
5128 		return -EINVAL;
5129 
5130 	write_lock_bh(&idev->lock);
5131 
5132 	BUILD_BUG_ON(sizeof(token->s6_addr) != 16);
5133 	memcpy(idev->token.s6_addr + 8, token->s6_addr + 8, 8);
5134 
5135 	write_unlock_bh(&idev->lock);
5136 
5137 	clear_token = ipv6_addr_any(token);
5138 	if (clear_token)
5139 		goto update_lft;
5140 
5141 	if (!idev->dead && (idev->if_flags & IF_READY) &&
5142 	    !ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE |
5143 			     IFA_F_OPTIMISTIC)) {
5144 		/* If we're not ready, then normal ifup will take care
5145 		 * of this. Otherwise, we need to request our rs here.
5146 		 */
5147 		ndisc_send_rs(dev, &ll_addr, &in6addr_linklocal_allrouters);
5148 		update_rs = true;
5149 	}
5150 
5151 update_lft:
5152 	write_lock_bh(&idev->lock);
5153 
5154 	if (update_rs) {
5155 		idev->if_flags |= IF_RS_SENT;
5156 		idev->rs_interval = rfc3315_s14_backoff_init(
5157 			idev->cnf.rtr_solicit_interval);
5158 		idev->rs_probes = 1;
5159 		addrconf_mod_rs_timer(idev, idev->rs_interval);
5160 	}
5161 
5162 	/* Well, that's kinda nasty ... */
5163 	list_for_each_entry(ifp, &idev->addr_list, if_list) {
5164 		spin_lock(&ifp->lock);
5165 		if (ifp->tokenized) {
5166 			ifp->valid_lft = 0;
5167 			ifp->prefered_lft = 0;
5168 		}
5169 		spin_unlock(&ifp->lock);
5170 	}
5171 
5172 	write_unlock_bh(&idev->lock);
5173 	inet6_ifinfo_notify(RTM_NEWLINK, idev);
5174 	addrconf_verify_rtnl();
5175 	return 0;
5176 }
5177 
5178 static const struct nla_policy inet6_af_policy[IFLA_INET6_MAX + 1] = {
5179 	[IFLA_INET6_ADDR_GEN_MODE]	= { .type = NLA_U8 },
5180 	[IFLA_INET6_TOKEN]		= { .len = sizeof(struct in6_addr) },
5181 };
5182 
5183 static int inet6_validate_link_af(const struct net_device *dev,
5184 				  const struct nlattr *nla)
5185 {
5186 	struct nlattr *tb[IFLA_INET6_MAX + 1];
5187 
5188 	if (dev && !__in6_dev_get(dev))
5189 		return -EAFNOSUPPORT;
5190 
5191 	return nla_parse_nested(tb, IFLA_INET6_MAX, nla, inet6_af_policy);
5192 }
5193 
5194 static int inet6_set_link_af(struct net_device *dev, const struct nlattr *nla)
5195 {
5196 	int err = -EINVAL;
5197 	struct inet6_dev *idev = __in6_dev_get(dev);
5198 	struct nlattr *tb[IFLA_INET6_MAX + 1];
5199 
5200 	if (!idev)
5201 		return -EAFNOSUPPORT;
5202 
5203 	if (nla_parse_nested(tb, IFLA_INET6_MAX, nla, NULL) < 0)
5204 		BUG();
5205 
5206 	if (tb[IFLA_INET6_TOKEN]) {
5207 		err = inet6_set_iftoken(idev, nla_data(tb[IFLA_INET6_TOKEN]));
5208 		if (err)
5209 			return err;
5210 	}
5211 
5212 	if (tb[IFLA_INET6_ADDR_GEN_MODE]) {
5213 		u8 mode = nla_get_u8(tb[IFLA_INET6_ADDR_GEN_MODE]);
5214 
5215 		if (mode != IN6_ADDR_GEN_MODE_EUI64 &&
5216 		    mode != IN6_ADDR_GEN_MODE_NONE &&
5217 		    mode != IN6_ADDR_GEN_MODE_STABLE_PRIVACY &&
5218 		    mode != IN6_ADDR_GEN_MODE_RANDOM)
5219 			return -EINVAL;
5220 
5221 		if (mode == IN6_ADDR_GEN_MODE_STABLE_PRIVACY &&
5222 		    !idev->cnf.stable_secret.initialized &&
5223 		    !dev_net(dev)->ipv6.devconf_dflt->stable_secret.initialized)
5224 			return -EINVAL;
5225 
5226 		idev->addr_gen_mode = mode;
5227 		err = 0;
5228 	}
5229 
5230 	return err;
5231 }
5232 
5233 static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
5234 			     u32 portid, u32 seq, int event, unsigned int flags)
5235 {
5236 	struct net_device *dev = idev->dev;
5237 	struct ifinfomsg *hdr;
5238 	struct nlmsghdr *nlh;
5239 	void *protoinfo;
5240 
5241 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*hdr), flags);
5242 	if (!nlh)
5243 		return -EMSGSIZE;
5244 
5245 	hdr = nlmsg_data(nlh);
5246 	hdr->ifi_family = AF_INET6;
5247 	hdr->__ifi_pad = 0;
5248 	hdr->ifi_type = dev->type;
5249 	hdr->ifi_index = dev->ifindex;
5250 	hdr->ifi_flags = dev_get_flags(dev);
5251 	hdr->ifi_change = 0;
5252 
5253 	if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
5254 	    (dev->addr_len &&
5255 	     nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr)) ||
5256 	    nla_put_u32(skb, IFLA_MTU, dev->mtu) ||
5257 	    (dev->ifindex != dev_get_iflink(dev) &&
5258 	     nla_put_u32(skb, IFLA_LINK, dev_get_iflink(dev))) ||
5259 	    nla_put_u8(skb, IFLA_OPERSTATE,
5260 		       netif_running(dev) ? dev->operstate : IF_OPER_DOWN))
5261 		goto nla_put_failure;
5262 	protoinfo = nla_nest_start(skb, IFLA_PROTINFO);
5263 	if (!protoinfo)
5264 		goto nla_put_failure;
5265 
5266 	if (inet6_fill_ifla6_attrs(skb, idev, 0) < 0)
5267 		goto nla_put_failure;
5268 
5269 	nla_nest_end(skb, protoinfo);
5270 	nlmsg_end(skb, nlh);
5271 	return 0;
5272 
5273 nla_put_failure:
5274 	nlmsg_cancel(skb, nlh);
5275 	return -EMSGSIZE;
5276 }
5277 
5278 static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
5279 {
5280 	struct net *net = sock_net(skb->sk);
5281 	int h, s_h;
5282 	int idx = 0, s_idx;
5283 	struct net_device *dev;
5284 	struct inet6_dev *idev;
5285 	struct hlist_head *head;
5286 
5287 	s_h = cb->args[0];
5288 	s_idx = cb->args[1];
5289 
5290 	rcu_read_lock();
5291 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
5292 		idx = 0;
5293 		head = &net->dev_index_head[h];
5294 		hlist_for_each_entry_rcu(dev, head, index_hlist) {
5295 			if (idx < s_idx)
5296 				goto cont;
5297 			idev = __in6_dev_get(dev);
5298 			if (!idev)
5299 				goto cont;
5300 			if (inet6_fill_ifinfo(skb, idev,
5301 					      NETLINK_CB(cb->skb).portid,
5302 					      cb->nlh->nlmsg_seq,
5303 					      RTM_NEWLINK, NLM_F_MULTI) < 0)
5304 				goto out;
5305 cont:
5306 			idx++;
5307 		}
5308 	}
5309 out:
5310 	rcu_read_unlock();
5311 	cb->args[1] = idx;
5312 	cb->args[0] = h;
5313 
5314 	return skb->len;
5315 }
5316 
5317 void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
5318 {
5319 	struct sk_buff *skb;
5320 	struct net *net = dev_net(idev->dev);
5321 	int err = -ENOBUFS;
5322 
5323 	skb = nlmsg_new(inet6_if_nlmsg_size(), GFP_ATOMIC);
5324 	if (!skb)
5325 		goto errout;
5326 
5327 	err = inet6_fill_ifinfo(skb, idev, 0, 0, event, 0);
5328 	if (err < 0) {
5329 		/* -EMSGSIZE implies BUG in inet6_if_nlmsg_size() */
5330 		WARN_ON(err == -EMSGSIZE);
5331 		kfree_skb(skb);
5332 		goto errout;
5333 	}
5334 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFINFO, NULL, GFP_ATOMIC);
5335 	return;
5336 errout:
5337 	if (err < 0)
5338 		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFINFO, err);
5339 }
5340 
5341 static inline size_t inet6_prefix_nlmsg_size(void)
5342 {
5343 	return NLMSG_ALIGN(sizeof(struct prefixmsg))
5344 	       + nla_total_size(sizeof(struct in6_addr))
5345 	       + nla_total_size(sizeof(struct prefix_cacheinfo));
5346 }
5347 
5348 static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
5349 			     struct prefix_info *pinfo, u32 portid, u32 seq,
5350 			     int event, unsigned int flags)
5351 {
5352 	struct prefixmsg *pmsg;
5353 	struct nlmsghdr *nlh;
5354 	struct prefix_cacheinfo	ci;
5355 
5356 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*pmsg), flags);
5357 	if (!nlh)
5358 		return -EMSGSIZE;
5359 
5360 	pmsg = nlmsg_data(nlh);
5361 	pmsg->prefix_family = AF_INET6;
5362 	pmsg->prefix_pad1 = 0;
5363 	pmsg->prefix_pad2 = 0;
5364 	pmsg->prefix_ifindex = idev->dev->ifindex;
5365 	pmsg->prefix_len = pinfo->prefix_len;
5366 	pmsg->prefix_type = pinfo->type;
5367 	pmsg->prefix_pad3 = 0;
5368 	pmsg->prefix_flags = 0;
5369 	if (pinfo->onlink)
5370 		pmsg->prefix_flags |= IF_PREFIX_ONLINK;
5371 	if (pinfo->autoconf)
5372 		pmsg->prefix_flags |= IF_PREFIX_AUTOCONF;
5373 
5374 	if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix))
5375 		goto nla_put_failure;
5376 	ci.preferred_time = ntohl(pinfo->prefered);
5377 	ci.valid_time = ntohl(pinfo->valid);
5378 	if (nla_put(skb, PREFIX_CACHEINFO, sizeof(ci), &ci))
5379 		goto nla_put_failure;
5380 	nlmsg_end(skb, nlh);
5381 	return 0;
5382 
5383 nla_put_failure:
5384 	nlmsg_cancel(skb, nlh);
5385 	return -EMSGSIZE;
5386 }
5387 
5388 static void inet6_prefix_notify(int event, struct inet6_dev *idev,
5389 			 struct prefix_info *pinfo)
5390 {
5391 	struct sk_buff *skb;
5392 	struct net *net = dev_net(idev->dev);
5393 	int err = -ENOBUFS;
5394 
5395 	skb = nlmsg_new(inet6_prefix_nlmsg_size(), GFP_ATOMIC);
5396 	if (!skb)
5397 		goto errout;
5398 
5399 	err = inet6_fill_prefix(skb, idev, pinfo, 0, 0, event, 0);
5400 	if (err < 0) {
5401 		/* -EMSGSIZE implies BUG in inet6_prefix_nlmsg_size() */
5402 		WARN_ON(err == -EMSGSIZE);
5403 		kfree_skb(skb);
5404 		goto errout;
5405 	}
5406 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
5407 	return;
5408 errout:
5409 	if (err < 0)
5410 		rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
5411 }
5412 
5413 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
5414 {
5415 	struct net *net = dev_net(ifp->idev->dev);
5416 
5417 	if (event)
5418 		ASSERT_RTNL();
5419 
5420 	inet6_ifa_notify(event ? : RTM_NEWADDR, ifp);
5421 
5422 	switch (event) {
5423 	case RTM_NEWADDR:
5424 		/*
5425 		 * If the address was optimistic
5426 		 * we inserted the route at the start of
5427 		 * our DAD process, so we don't need
5428 		 * to do it again
5429 		 */
5430 		if (!(ifp->rt->rt6i_node))
5431 			ip6_ins_rt(ifp->rt);
5432 		if (ifp->idev->cnf.forwarding)
5433 			addrconf_join_anycast(ifp);
5434 		if (!ipv6_addr_any(&ifp->peer_addr))
5435 			addrconf_prefix_route(&ifp->peer_addr, 128,
5436 					      ifp->idev->dev, 0, 0);
5437 		break;
5438 	case RTM_DELADDR:
5439 		if (ifp->idev->cnf.forwarding)
5440 			addrconf_leave_anycast(ifp);
5441 		addrconf_leave_solict(ifp->idev, &ifp->addr);
5442 		if (!ipv6_addr_any(&ifp->peer_addr)) {
5443 			struct rt6_info *rt;
5444 
5445 			rt = addrconf_get_prefix_route(&ifp->peer_addr, 128,
5446 						       ifp->idev->dev, 0, 0);
5447 			if (rt)
5448 				ip6_del_rt(rt);
5449 		}
5450 		if (ifp->rt) {
5451 			dst_hold(&ifp->rt->dst);
5452 			ip6_del_rt(ifp->rt);
5453 		}
5454 		rt_genid_bump_ipv6(net);
5455 		break;
5456 	}
5457 	atomic_inc(&net->ipv6.dev_addr_genid);
5458 }
5459 
5460 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
5461 {
5462 	rcu_read_lock_bh();
5463 	if (likely(ifp->idev->dead == 0))
5464 		__ipv6_ifa_notify(event, ifp);
5465 	rcu_read_unlock_bh();
5466 }
5467 
5468 #ifdef CONFIG_SYSCTL
5469 
5470 static
5471 int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
5472 			   void __user *buffer, size_t *lenp, loff_t *ppos)
5473 {
5474 	int *valp = ctl->data;
5475 	int val = *valp;
5476 	loff_t pos = *ppos;
5477 	struct ctl_table lctl;
5478 	int ret;
5479 
5480 	/*
5481 	 * ctl->data points to idev->cnf.forwarding, we should
5482 	 * not modify it until we get the rtnl lock.
5483 	 */
5484 	lctl = *ctl;
5485 	lctl.data = &val;
5486 
5487 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
5488 
5489 	if (write)
5490 		ret = addrconf_fixup_forwarding(ctl, valp, val);
5491 	if (ret)
5492 		*ppos = pos;
5493 	return ret;
5494 }
5495 
5496 static
5497 int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
5498 			void __user *buffer, size_t *lenp, loff_t *ppos)
5499 {
5500 	struct inet6_dev *idev = ctl->extra1;
5501 	int min_mtu = IPV6_MIN_MTU;
5502 	struct ctl_table lctl;
5503 
5504 	lctl = *ctl;
5505 	lctl.extra1 = &min_mtu;
5506 	lctl.extra2 = idev ? &idev->dev->mtu : NULL;
5507 
5508 	return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
5509 }
5510 
5511 static void dev_disable_change(struct inet6_dev *idev)
5512 {
5513 	struct netdev_notifier_info info;
5514 
5515 	if (!idev || !idev->dev)
5516 		return;
5517 
5518 	netdev_notifier_info_init(&info, idev->dev);
5519 	if (idev->cnf.disable_ipv6)
5520 		addrconf_notify(NULL, NETDEV_DOWN, &info);
5521 	else
5522 		addrconf_notify(NULL, NETDEV_UP, &info);
5523 }
5524 
5525 static void addrconf_disable_change(struct net *net, __s32 newf)
5526 {
5527 	struct net_device *dev;
5528 	struct inet6_dev *idev;
5529 
5530 	rcu_read_lock();
5531 	for_each_netdev_rcu(net, dev) {
5532 		idev = __in6_dev_get(dev);
5533 		if (idev) {
5534 			int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
5535 			idev->cnf.disable_ipv6 = newf;
5536 			if (changed)
5537 				dev_disable_change(idev);
5538 		}
5539 	}
5540 	rcu_read_unlock();
5541 }
5542 
5543 static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
5544 {
5545 	struct net *net;
5546 	int old;
5547 
5548 	if (!rtnl_trylock())
5549 		return restart_syscall();
5550 
5551 	net = (struct net *)table->extra2;
5552 	old = *p;
5553 	*p = newf;
5554 
5555 	if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
5556 		rtnl_unlock();
5557 		return 0;
5558 	}
5559 
5560 	if (p == &net->ipv6.devconf_all->disable_ipv6) {
5561 		net->ipv6.devconf_dflt->disable_ipv6 = newf;
5562 		addrconf_disable_change(net, newf);
5563 	} else if ((!newf) ^ (!old))
5564 		dev_disable_change((struct inet6_dev *)table->extra1);
5565 
5566 	rtnl_unlock();
5567 	return 0;
5568 }
5569 
5570 static
5571 int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
5572 			    void __user *buffer, size_t *lenp, loff_t *ppos)
5573 {
5574 	int *valp = ctl->data;
5575 	int val = *valp;
5576 	loff_t pos = *ppos;
5577 	struct ctl_table lctl;
5578 	int ret;
5579 
5580 	/*
5581 	 * ctl->data points to idev->cnf.disable_ipv6, we should
5582 	 * not modify it until we get the rtnl lock.
5583 	 */
5584 	lctl = *ctl;
5585 	lctl.data = &val;
5586 
5587 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
5588 
5589 	if (write)
5590 		ret = addrconf_disable_ipv6(ctl, valp, val);
5591 	if (ret)
5592 		*ppos = pos;
5593 	return ret;
5594 }
5595 
5596 static
5597 int addrconf_sysctl_proxy_ndp(struct ctl_table *ctl, int write,
5598 			      void __user *buffer, size_t *lenp, loff_t *ppos)
5599 {
5600 	int *valp = ctl->data;
5601 	int ret;
5602 	int old, new;
5603 
5604 	old = *valp;
5605 	ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
5606 	new = *valp;
5607 
5608 	if (write && old != new) {
5609 		struct net *net = ctl->extra2;
5610 
5611 		if (!rtnl_trylock())
5612 			return restart_syscall();
5613 
5614 		if (valp == &net->ipv6.devconf_dflt->proxy_ndp)
5615 			inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
5616 						     NETCONFA_IFINDEX_DEFAULT,
5617 						     net->ipv6.devconf_dflt);
5618 		else if (valp == &net->ipv6.devconf_all->proxy_ndp)
5619 			inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
5620 						     NETCONFA_IFINDEX_ALL,
5621 						     net->ipv6.devconf_all);
5622 		else {
5623 			struct inet6_dev *idev = ctl->extra1;
5624 
5625 			inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
5626 						     idev->dev->ifindex,
5627 						     &idev->cnf);
5628 		}
5629 		rtnl_unlock();
5630 	}
5631 
5632 	return ret;
5633 }
5634 
5635 static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
5636 					 void __user *buffer, size_t *lenp,
5637 					 loff_t *ppos)
5638 {
5639 	int err;
5640 	struct in6_addr addr;
5641 	char str[IPV6_MAX_STRLEN];
5642 	struct ctl_table lctl = *ctl;
5643 	struct net *net = ctl->extra2;
5644 	struct ipv6_stable_secret *secret = ctl->data;
5645 
5646 	if (&net->ipv6.devconf_all->stable_secret == ctl->data)
5647 		return -EIO;
5648 
5649 	lctl.maxlen = IPV6_MAX_STRLEN;
5650 	lctl.data = str;
5651 
5652 	if (!rtnl_trylock())
5653 		return restart_syscall();
5654 
5655 	if (!write && !secret->initialized) {
5656 		err = -EIO;
5657 		goto out;
5658 	}
5659 
5660 	err = snprintf(str, sizeof(str), "%pI6", &secret->secret);
5661 	if (err >= sizeof(str)) {
5662 		err = -EIO;
5663 		goto out;
5664 	}
5665 
5666 	err = proc_dostring(&lctl, write, buffer, lenp, ppos);
5667 	if (err || !write)
5668 		goto out;
5669 
5670 	if (in6_pton(str, -1, addr.in6_u.u6_addr8, -1, NULL) != 1) {
5671 		err = -EIO;
5672 		goto out;
5673 	}
5674 
5675 	secret->initialized = true;
5676 	secret->secret = addr;
5677 
5678 	if (&net->ipv6.devconf_dflt->stable_secret == ctl->data) {
5679 		struct net_device *dev;
5680 
5681 		for_each_netdev(net, dev) {
5682 			struct inet6_dev *idev = __in6_dev_get(dev);
5683 
5684 			if (idev) {
5685 				idev->addr_gen_mode =
5686 					IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
5687 			}
5688 		}
5689 	} else {
5690 		struct inet6_dev *idev = ctl->extra1;
5691 
5692 		idev->addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
5693 	}
5694 
5695 out:
5696 	rtnl_unlock();
5697 
5698 	return err;
5699 }
5700 
5701 static
5702 int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
5703 						int write,
5704 						void __user *buffer,
5705 						size_t *lenp,
5706 						loff_t *ppos)
5707 {
5708 	int *valp = ctl->data;
5709 	int val = *valp;
5710 	loff_t pos = *ppos;
5711 	struct ctl_table lctl;
5712 	int ret;
5713 
5714 	/* ctl->data points to idev->cnf.ignore_routes_when_linkdown
5715 	 * we should not modify it until we get the rtnl lock.
5716 	 */
5717 	lctl = *ctl;
5718 	lctl.data = &val;
5719 
5720 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
5721 
5722 	if (write)
5723 		ret = addrconf_fixup_linkdown(ctl, valp, val);
5724 	if (ret)
5725 		*ppos = pos;
5726 	return ret;
5727 }
5728 
5729 static int minus_one = -1;
5730 static const int one = 1;
5731 static const int two_five_five = 255;
5732 
5733 static const struct ctl_table addrconf_sysctl[] = {
5734 	{
5735 		.procname	= "forwarding",
5736 		.data		= &ipv6_devconf.forwarding,
5737 		.maxlen		= sizeof(int),
5738 		.mode		= 0644,
5739 		.proc_handler	= addrconf_sysctl_forward,
5740 	},
5741 	{
5742 		.procname	= "hop_limit",
5743 		.data		= &ipv6_devconf.hop_limit,
5744 		.maxlen		= sizeof(int),
5745 		.mode		= 0644,
5746 		.proc_handler	= proc_dointvec_minmax,
5747 		.extra1		= (void *)&one,
5748 		.extra2		= (void *)&two_five_five,
5749 	},
5750 	{
5751 		.procname	= "mtu",
5752 		.data		= &ipv6_devconf.mtu6,
5753 		.maxlen		= sizeof(int),
5754 		.mode		= 0644,
5755 		.proc_handler	= addrconf_sysctl_mtu,
5756 	},
5757 	{
5758 		.procname	= "accept_ra",
5759 		.data		= &ipv6_devconf.accept_ra,
5760 		.maxlen		= sizeof(int),
5761 		.mode		= 0644,
5762 		.proc_handler	= proc_dointvec,
5763 	},
5764 	{
5765 		.procname	= "accept_redirects",
5766 		.data		= &ipv6_devconf.accept_redirects,
5767 		.maxlen		= sizeof(int),
5768 		.mode		= 0644,
5769 		.proc_handler	= proc_dointvec,
5770 	},
5771 	{
5772 		.procname	= "autoconf",
5773 		.data		= &ipv6_devconf.autoconf,
5774 		.maxlen		= sizeof(int),
5775 		.mode		= 0644,
5776 		.proc_handler	= proc_dointvec,
5777 	},
5778 	{
5779 		.procname	= "dad_transmits",
5780 		.data		= &ipv6_devconf.dad_transmits,
5781 		.maxlen		= sizeof(int),
5782 		.mode		= 0644,
5783 		.proc_handler	= proc_dointvec,
5784 	},
5785 	{
5786 		.procname	= "router_solicitations",
5787 		.data		= &ipv6_devconf.rtr_solicits,
5788 		.maxlen		= sizeof(int),
5789 		.mode		= 0644,
5790 		.proc_handler	= proc_dointvec_minmax,
5791 		.extra1		= &minus_one,
5792 	},
5793 	{
5794 		.procname	= "router_solicitation_interval",
5795 		.data		= &ipv6_devconf.rtr_solicit_interval,
5796 		.maxlen		= sizeof(int),
5797 		.mode		= 0644,
5798 		.proc_handler	= proc_dointvec_jiffies,
5799 	},
5800 	{
5801 		.procname	= "router_solicitation_max_interval",
5802 		.data		= &ipv6_devconf.rtr_solicit_max_interval,
5803 		.maxlen		= sizeof(int),
5804 		.mode		= 0644,
5805 		.proc_handler	= proc_dointvec_jiffies,
5806 	},
5807 	{
5808 		.procname	= "router_solicitation_delay",
5809 		.data		= &ipv6_devconf.rtr_solicit_delay,
5810 		.maxlen		= sizeof(int),
5811 		.mode		= 0644,
5812 		.proc_handler	= proc_dointvec_jiffies,
5813 	},
5814 	{
5815 		.procname	= "force_mld_version",
5816 		.data		= &ipv6_devconf.force_mld_version,
5817 		.maxlen		= sizeof(int),
5818 		.mode		= 0644,
5819 		.proc_handler	= proc_dointvec,
5820 	},
5821 	{
5822 		.procname	= "mldv1_unsolicited_report_interval",
5823 		.data		=
5824 			&ipv6_devconf.mldv1_unsolicited_report_interval,
5825 		.maxlen		= sizeof(int),
5826 		.mode		= 0644,
5827 		.proc_handler	= proc_dointvec_ms_jiffies,
5828 	},
5829 	{
5830 		.procname	= "mldv2_unsolicited_report_interval",
5831 		.data		=
5832 			&ipv6_devconf.mldv2_unsolicited_report_interval,
5833 		.maxlen		= sizeof(int),
5834 		.mode		= 0644,
5835 		.proc_handler	= proc_dointvec_ms_jiffies,
5836 	},
5837 	{
5838 		.procname	= "use_tempaddr",
5839 		.data		= &ipv6_devconf.use_tempaddr,
5840 		.maxlen		= sizeof(int),
5841 		.mode		= 0644,
5842 		.proc_handler	= proc_dointvec,
5843 	},
5844 	{
5845 		.procname	= "temp_valid_lft",
5846 		.data		= &ipv6_devconf.temp_valid_lft,
5847 		.maxlen		= sizeof(int),
5848 		.mode		= 0644,
5849 		.proc_handler	= proc_dointvec,
5850 	},
5851 	{
5852 		.procname	= "temp_prefered_lft",
5853 		.data		= &ipv6_devconf.temp_prefered_lft,
5854 		.maxlen		= sizeof(int),
5855 		.mode		= 0644,
5856 		.proc_handler	= proc_dointvec,
5857 	},
5858 	{
5859 		.procname	= "regen_max_retry",
5860 		.data		= &ipv6_devconf.regen_max_retry,
5861 		.maxlen		= sizeof(int),
5862 		.mode		= 0644,
5863 		.proc_handler	= proc_dointvec,
5864 	},
5865 	{
5866 		.procname	= "max_desync_factor",
5867 		.data		= &ipv6_devconf.max_desync_factor,
5868 		.maxlen		= sizeof(int),
5869 		.mode		= 0644,
5870 		.proc_handler	= proc_dointvec,
5871 	},
5872 	{
5873 		.procname	= "max_addresses",
5874 		.data		= &ipv6_devconf.max_addresses,
5875 		.maxlen		= sizeof(int),
5876 		.mode		= 0644,
5877 		.proc_handler	= proc_dointvec,
5878 	},
5879 	{
5880 		.procname	= "accept_ra_defrtr",
5881 		.data		= &ipv6_devconf.accept_ra_defrtr,
5882 		.maxlen		= sizeof(int),
5883 		.mode		= 0644,
5884 		.proc_handler	= proc_dointvec,
5885 	},
5886 	{
5887 		.procname	= "accept_ra_min_hop_limit",
5888 		.data		= &ipv6_devconf.accept_ra_min_hop_limit,
5889 		.maxlen		= sizeof(int),
5890 		.mode		= 0644,
5891 		.proc_handler	= proc_dointvec,
5892 	},
5893 	{
5894 		.procname	= "accept_ra_pinfo",
5895 		.data		= &ipv6_devconf.accept_ra_pinfo,
5896 		.maxlen		= sizeof(int),
5897 		.mode		= 0644,
5898 		.proc_handler	= proc_dointvec,
5899 	},
5900 #ifdef CONFIG_IPV6_ROUTER_PREF
5901 	{
5902 		.procname	= "accept_ra_rtr_pref",
5903 		.data		= &ipv6_devconf.accept_ra_rtr_pref,
5904 		.maxlen		= sizeof(int),
5905 		.mode		= 0644,
5906 		.proc_handler	= proc_dointvec,
5907 	},
5908 	{
5909 		.procname	= "router_probe_interval",
5910 		.data		= &ipv6_devconf.rtr_probe_interval,
5911 		.maxlen		= sizeof(int),
5912 		.mode		= 0644,
5913 		.proc_handler	= proc_dointvec_jiffies,
5914 	},
5915 #ifdef CONFIG_IPV6_ROUTE_INFO
5916 	{
5917 		.procname	= "accept_ra_rt_info_max_plen",
5918 		.data		= &ipv6_devconf.accept_ra_rt_info_max_plen,
5919 		.maxlen		= sizeof(int),
5920 		.mode		= 0644,
5921 		.proc_handler	= proc_dointvec,
5922 	},
5923 #endif
5924 #endif
5925 	{
5926 		.procname	= "proxy_ndp",
5927 		.data		= &ipv6_devconf.proxy_ndp,
5928 		.maxlen		= sizeof(int),
5929 		.mode		= 0644,
5930 		.proc_handler	= addrconf_sysctl_proxy_ndp,
5931 	},
5932 	{
5933 		.procname	= "accept_source_route",
5934 		.data		= &ipv6_devconf.accept_source_route,
5935 		.maxlen		= sizeof(int),
5936 		.mode		= 0644,
5937 		.proc_handler	= proc_dointvec,
5938 	},
5939 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
5940 	{
5941 		.procname	= "optimistic_dad",
5942 		.data		= &ipv6_devconf.optimistic_dad,
5943 		.maxlen		= sizeof(int),
5944 		.mode		= 0644,
5945 		.proc_handler   = proc_dointvec,
5946 	},
5947 	{
5948 		.procname	= "use_optimistic",
5949 		.data		= &ipv6_devconf.use_optimistic,
5950 		.maxlen		= sizeof(int),
5951 		.mode		= 0644,
5952 		.proc_handler	= proc_dointvec,
5953 	},
5954 #endif
5955 #ifdef CONFIG_IPV6_MROUTE
5956 	{
5957 		.procname	= "mc_forwarding",
5958 		.data		= &ipv6_devconf.mc_forwarding,
5959 		.maxlen		= sizeof(int),
5960 		.mode		= 0444,
5961 		.proc_handler	= proc_dointvec,
5962 	},
5963 #endif
5964 	{
5965 		.procname	= "disable_ipv6",
5966 		.data		= &ipv6_devconf.disable_ipv6,
5967 		.maxlen		= sizeof(int),
5968 		.mode		= 0644,
5969 		.proc_handler	= addrconf_sysctl_disable,
5970 	},
5971 	{
5972 		.procname	= "accept_dad",
5973 		.data		= &ipv6_devconf.accept_dad,
5974 		.maxlen		= sizeof(int),
5975 		.mode		= 0644,
5976 		.proc_handler	= proc_dointvec,
5977 	},
5978 	{
5979 		.procname	= "force_tllao",
5980 		.data		= &ipv6_devconf.force_tllao,
5981 		.maxlen		= sizeof(int),
5982 		.mode		= 0644,
5983 		.proc_handler	= proc_dointvec
5984 	},
5985 	{
5986 		.procname	= "ndisc_notify",
5987 		.data		= &ipv6_devconf.ndisc_notify,
5988 		.maxlen		= sizeof(int),
5989 		.mode		= 0644,
5990 		.proc_handler	= proc_dointvec
5991 	},
5992 	{
5993 		.procname	= "suppress_frag_ndisc",
5994 		.data		= &ipv6_devconf.suppress_frag_ndisc,
5995 		.maxlen		= sizeof(int),
5996 		.mode		= 0644,
5997 		.proc_handler	= proc_dointvec
5998 	},
5999 	{
6000 		.procname	= "accept_ra_from_local",
6001 		.data		= &ipv6_devconf.accept_ra_from_local,
6002 		.maxlen		= sizeof(int),
6003 		.mode		= 0644,
6004 		.proc_handler	= proc_dointvec,
6005 	},
6006 	{
6007 		.procname	= "accept_ra_mtu",
6008 		.data		= &ipv6_devconf.accept_ra_mtu,
6009 		.maxlen		= sizeof(int),
6010 		.mode		= 0644,
6011 		.proc_handler	= proc_dointvec,
6012 	},
6013 	{
6014 		.procname	= "stable_secret",
6015 		.data		= &ipv6_devconf.stable_secret,
6016 		.maxlen		= IPV6_MAX_STRLEN,
6017 		.mode		= 0600,
6018 		.proc_handler	= addrconf_sysctl_stable_secret,
6019 	},
6020 	{
6021 		.procname	= "use_oif_addrs_only",
6022 		.data		= &ipv6_devconf.use_oif_addrs_only,
6023 		.maxlen		= sizeof(int),
6024 		.mode		= 0644,
6025 		.proc_handler	= proc_dointvec,
6026 	},
6027 	{
6028 		.procname	= "ignore_routes_with_linkdown",
6029 		.data		= &ipv6_devconf.ignore_routes_with_linkdown,
6030 		.maxlen		= sizeof(int),
6031 		.mode		= 0644,
6032 		.proc_handler	= addrconf_sysctl_ignore_routes_with_linkdown,
6033 	},
6034 	{
6035 		.procname	= "drop_unicast_in_l2_multicast",
6036 		.data		= &ipv6_devconf.drop_unicast_in_l2_multicast,
6037 		.maxlen		= sizeof(int),
6038 		.mode		= 0644,
6039 		.proc_handler	= proc_dointvec,
6040 	},
6041 	{
6042 		.procname	= "drop_unsolicited_na",
6043 		.data		= &ipv6_devconf.drop_unsolicited_na,
6044 		.maxlen		= sizeof(int),
6045 		.mode		= 0644,
6046 		.proc_handler	= proc_dointvec,
6047 	},
6048 	{
6049 		.procname	= "keep_addr_on_down",
6050 		.data		= &ipv6_devconf.keep_addr_on_down,
6051 		.maxlen		= sizeof(int),
6052 		.mode		= 0644,
6053 		.proc_handler	= proc_dointvec,
6054 
6055 	},
6056 	{
6057 		.procname	= "seg6_enabled",
6058 		.data		= &ipv6_devconf.seg6_enabled,
6059 		.maxlen		= sizeof(int),
6060 		.mode		= 0644,
6061 		.proc_handler	= proc_dointvec,
6062 	},
6063 #ifdef CONFIG_IPV6_SEG6_HMAC
6064 	{
6065 		.procname	= "seg6_require_hmac",
6066 		.data		= &ipv6_devconf.seg6_require_hmac,
6067 		.maxlen		= sizeof(int),
6068 		.mode		= 0644,
6069 		.proc_handler	= proc_dointvec,
6070 	},
6071 #endif
6072 	{
6073 		/* sentinel */
6074 	}
6075 };
6076 
6077 static int __addrconf_sysctl_register(struct net *net, char *dev_name,
6078 		struct inet6_dev *idev, struct ipv6_devconf *p)
6079 {
6080 	int i, ifindex;
6081 	struct ctl_table *table;
6082 	char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
6083 
6084 	table = kmemdup(addrconf_sysctl, sizeof(addrconf_sysctl), GFP_KERNEL);
6085 	if (!table)
6086 		goto out;
6087 
6088 	for (i = 0; table[i].data; i++) {
6089 		table[i].data += (char *)p - (char *)&ipv6_devconf;
6090 		/* If one of these is already set, then it is not safe to
6091 		 * overwrite either of them: this makes proc_dointvec_minmax
6092 		 * usable.
6093 		 */
6094 		if (!table[i].extra1 && !table[i].extra2) {
6095 			table[i].extra1 = idev; /* embedded; no ref */
6096 			table[i].extra2 = net;
6097 		}
6098 	}
6099 
6100 	snprintf(path, sizeof(path), "net/ipv6/conf/%s", dev_name);
6101 
6102 	p->sysctl_header = register_net_sysctl(net, path, table);
6103 	if (!p->sysctl_header)
6104 		goto free;
6105 
6106 	if (!strcmp(dev_name, "all"))
6107 		ifindex = NETCONFA_IFINDEX_ALL;
6108 	else if (!strcmp(dev_name, "default"))
6109 		ifindex = NETCONFA_IFINDEX_DEFAULT;
6110 	else
6111 		ifindex = idev->dev->ifindex;
6112 	inet6_netconf_notify_devconf(net, NETCONFA_ALL, ifindex, p);
6113 	return 0;
6114 
6115 free:
6116 	kfree(table);
6117 out:
6118 	return -ENOBUFS;
6119 }
6120 
6121 static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
6122 {
6123 	struct ctl_table *table;
6124 
6125 	if (!p->sysctl_header)
6126 		return;
6127 
6128 	table = p->sysctl_header->ctl_table_arg;
6129 	unregister_net_sysctl_table(p->sysctl_header);
6130 	p->sysctl_header = NULL;
6131 	kfree(table);
6132 }
6133 
6134 static int addrconf_sysctl_register(struct inet6_dev *idev)
6135 {
6136 	int err;
6137 
6138 	if (!sysctl_dev_name_is_allowed(idev->dev->name))
6139 		return -EINVAL;
6140 
6141 	err = neigh_sysctl_register(idev->dev, idev->nd_parms,
6142 				    &ndisc_ifinfo_sysctl_change);
6143 	if (err)
6144 		return err;
6145 	err = __addrconf_sysctl_register(dev_net(idev->dev), idev->dev->name,
6146 					 idev, &idev->cnf);
6147 	if (err)
6148 		neigh_sysctl_unregister(idev->nd_parms);
6149 
6150 	return err;
6151 }
6152 
6153 static void addrconf_sysctl_unregister(struct inet6_dev *idev)
6154 {
6155 	__addrconf_sysctl_unregister(&idev->cnf);
6156 	neigh_sysctl_unregister(idev->nd_parms);
6157 }
6158 
6159 
6160 #endif
6161 
6162 static int __net_init addrconf_init_net(struct net *net)
6163 {
6164 	int err = -ENOMEM;
6165 	struct ipv6_devconf *all, *dflt;
6166 
6167 	all = kmemdup(&ipv6_devconf, sizeof(ipv6_devconf), GFP_KERNEL);
6168 	if (!all)
6169 		goto err_alloc_all;
6170 
6171 	dflt = kmemdup(&ipv6_devconf_dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
6172 	if (!dflt)
6173 		goto err_alloc_dflt;
6174 
6175 	/* these will be inherited by all namespaces */
6176 	dflt->autoconf = ipv6_defaults.autoconf;
6177 	dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
6178 
6179 	dflt->stable_secret.initialized = false;
6180 	all->stable_secret.initialized = false;
6181 
6182 	net->ipv6.devconf_all = all;
6183 	net->ipv6.devconf_dflt = dflt;
6184 
6185 #ifdef CONFIG_SYSCTL
6186 	err = __addrconf_sysctl_register(net, "all", NULL, all);
6187 	if (err < 0)
6188 		goto err_reg_all;
6189 
6190 	err = __addrconf_sysctl_register(net, "default", NULL, dflt);
6191 	if (err < 0)
6192 		goto err_reg_dflt;
6193 #endif
6194 	return 0;
6195 
6196 #ifdef CONFIG_SYSCTL
6197 err_reg_dflt:
6198 	__addrconf_sysctl_unregister(all);
6199 err_reg_all:
6200 	kfree(dflt);
6201 #endif
6202 err_alloc_dflt:
6203 	kfree(all);
6204 err_alloc_all:
6205 	return err;
6206 }
6207 
6208 static void __net_exit addrconf_exit_net(struct net *net)
6209 {
6210 #ifdef CONFIG_SYSCTL
6211 	__addrconf_sysctl_unregister(net->ipv6.devconf_dflt);
6212 	__addrconf_sysctl_unregister(net->ipv6.devconf_all);
6213 #endif
6214 	kfree(net->ipv6.devconf_dflt);
6215 	kfree(net->ipv6.devconf_all);
6216 }
6217 
6218 static struct pernet_operations addrconf_ops = {
6219 	.init = addrconf_init_net,
6220 	.exit = addrconf_exit_net,
6221 };
6222 
6223 static struct rtnl_af_ops inet6_ops __read_mostly = {
6224 	.family		  = AF_INET6,
6225 	.fill_link_af	  = inet6_fill_link_af,
6226 	.get_link_af_size = inet6_get_link_af_size,
6227 	.validate_link_af = inet6_validate_link_af,
6228 	.set_link_af	  = inet6_set_link_af,
6229 };
6230 
6231 /*
6232  *	Init / cleanup code
6233  */
6234 
6235 int __init addrconf_init(void)
6236 {
6237 	struct inet6_dev *idev;
6238 	int i, err;
6239 
6240 	err = ipv6_addr_label_init();
6241 	if (err < 0) {
6242 		pr_crit("%s: cannot initialize default policy table: %d\n",
6243 			__func__, err);
6244 		goto out;
6245 	}
6246 
6247 	err = register_pernet_subsys(&addrconf_ops);
6248 	if (err < 0)
6249 		goto out_addrlabel;
6250 
6251 	addrconf_wq = create_workqueue("ipv6_addrconf");
6252 	if (!addrconf_wq) {
6253 		err = -ENOMEM;
6254 		goto out_nowq;
6255 	}
6256 
6257 	/* The addrconf netdev notifier requires that loopback_dev
6258 	 * has it's ipv6 private information allocated and setup
6259 	 * before it can bring up and give link-local addresses
6260 	 * to other devices which are up.
6261 	 *
6262 	 * Unfortunately, loopback_dev is not necessarily the first
6263 	 * entry in the global dev_base list of net devices.  In fact,
6264 	 * it is likely to be the very last entry on that list.
6265 	 * So this causes the notifier registry below to try and
6266 	 * give link-local addresses to all devices besides loopback_dev
6267 	 * first, then loopback_dev, which cases all the non-loopback_dev
6268 	 * devices to fail to get a link-local address.
6269 	 *
6270 	 * So, as a temporary fix, allocate the ipv6 structure for
6271 	 * loopback_dev first by hand.
6272 	 * Longer term, all of the dependencies ipv6 has upon the loopback
6273 	 * device and it being up should be removed.
6274 	 */
6275 	rtnl_lock();
6276 	idev = ipv6_add_dev(init_net.loopback_dev);
6277 	rtnl_unlock();
6278 	if (IS_ERR(idev)) {
6279 		err = PTR_ERR(idev);
6280 		goto errlo;
6281 	}
6282 
6283 	for (i = 0; i < IN6_ADDR_HSIZE; i++)
6284 		INIT_HLIST_HEAD(&inet6_addr_lst[i]);
6285 
6286 	register_netdevice_notifier(&ipv6_dev_notf);
6287 
6288 	addrconf_verify();
6289 
6290 	rtnl_af_register(&inet6_ops);
6291 
6292 	err = __rtnl_register(PF_INET6, RTM_GETLINK, NULL, inet6_dump_ifinfo,
6293 			      NULL);
6294 	if (err < 0)
6295 		goto errout;
6296 
6297 	/* Only the first call to __rtnl_register can fail */
6298 	__rtnl_register(PF_INET6, RTM_NEWADDR, inet6_rtm_newaddr, NULL, NULL);
6299 	__rtnl_register(PF_INET6, RTM_DELADDR, inet6_rtm_deladdr, NULL, NULL);
6300 	__rtnl_register(PF_INET6, RTM_GETADDR, inet6_rtm_getaddr,
6301 			inet6_dump_ifaddr, NULL);
6302 	__rtnl_register(PF_INET6, RTM_GETMULTICAST, NULL,
6303 			inet6_dump_ifmcaddr, NULL);
6304 	__rtnl_register(PF_INET6, RTM_GETANYCAST, NULL,
6305 			inet6_dump_ifacaddr, NULL);
6306 	__rtnl_register(PF_INET6, RTM_GETNETCONF, inet6_netconf_get_devconf,
6307 			inet6_netconf_dump_devconf, NULL);
6308 
6309 	ipv6_addr_label_rtnl_register();
6310 
6311 	return 0;
6312 errout:
6313 	rtnl_af_unregister(&inet6_ops);
6314 	unregister_netdevice_notifier(&ipv6_dev_notf);
6315 errlo:
6316 	destroy_workqueue(addrconf_wq);
6317 out_nowq:
6318 	unregister_pernet_subsys(&addrconf_ops);
6319 out_addrlabel:
6320 	ipv6_addr_label_cleanup();
6321 out:
6322 	return err;
6323 }
6324 
6325 void addrconf_cleanup(void)
6326 {
6327 	struct net_device *dev;
6328 	int i;
6329 
6330 	unregister_netdevice_notifier(&ipv6_dev_notf);
6331 	unregister_pernet_subsys(&addrconf_ops);
6332 	ipv6_addr_label_cleanup();
6333 
6334 	rtnl_lock();
6335 
6336 	__rtnl_af_unregister(&inet6_ops);
6337 
6338 	/* clean dev list */
6339 	for_each_netdev(&init_net, dev) {
6340 		if (__in6_dev_get(dev) == NULL)
6341 			continue;
6342 		addrconf_ifdown(dev, 1);
6343 	}
6344 	addrconf_ifdown(init_net.loopback_dev, 2);
6345 
6346 	/*
6347 	 *	Check hash table.
6348 	 */
6349 	spin_lock_bh(&addrconf_hash_lock);
6350 	for (i = 0; i < IN6_ADDR_HSIZE; i++)
6351 		WARN_ON(!hlist_empty(&inet6_addr_lst[i]));
6352 	spin_unlock_bh(&addrconf_hash_lock);
6353 	cancel_delayed_work(&addr_chk_work);
6354 	rtnl_unlock();
6355 
6356 	destroy_workqueue(addrconf_wq);
6357 }
6358