xref: /linux/net/ipv6/ip6mr.c (revision d58ff35122847a83ba55394e2ae3a1527b6febf5)
1 /*
2  *	Linux IPv6 multicast routing support for BSD pim6sd
3  *	Based on net/ipv4/ipmr.c.
4  *
5  *	(c) 2004 Mickael Hoerdt, <hoerdt@clarinet.u-strasbg.fr>
6  *		LSIIT Laboratory, Strasbourg, France
7  *	(c) 2004 Jean-Philippe Andriot, <jean-philippe.andriot@6WIND.com>
8  *		6WIND, Paris, France
9  *	Copyright (C)2007,2008 USAGI/WIDE Project
10  *		YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
11  *
12  *	This program is free software; you can redistribute it and/or
13  *	modify it under the terms of the GNU General Public License
14  *	as published by the Free Software Foundation; either version
15  *	2 of the License, or (at your option) any later version.
16  *
17  */
18 
19 #include <linux/uaccess.h>
20 #include <linux/types.h>
21 #include <linux/sched.h>
22 #include <linux/errno.h>
23 #include <linux/timer.h>
24 #include <linux/mm.h>
25 #include <linux/kernel.h>
26 #include <linux/fcntl.h>
27 #include <linux/stat.h>
28 #include <linux/socket.h>
29 #include <linux/inet.h>
30 #include <linux/netdevice.h>
31 #include <linux/inetdevice.h>
32 #include <linux/proc_fs.h>
33 #include <linux/seq_file.h>
34 #include <linux/init.h>
35 #include <linux/slab.h>
36 #include <linux/compat.h>
37 #include <net/protocol.h>
38 #include <linux/skbuff.h>
39 #include <net/sock.h>
40 #include <net/raw.h>
41 #include <linux/notifier.h>
42 #include <linux/if_arp.h>
43 #include <net/checksum.h>
44 #include <net/netlink.h>
45 #include <net/fib_rules.h>
46 
47 #include <net/ipv6.h>
48 #include <net/ip6_route.h>
49 #include <linux/mroute6.h>
50 #include <linux/pim.h>
51 #include <net/addrconf.h>
52 #include <linux/netfilter_ipv6.h>
53 #include <linux/export.h>
54 #include <net/ip6_checksum.h>
55 #include <linux/netconf.h>
56 
57 struct mr6_table {
58 	struct list_head	list;
59 	possible_net_t		net;
60 	u32			id;
61 	struct sock		*mroute6_sk;
62 	struct timer_list	ipmr_expire_timer;
63 	struct list_head	mfc6_unres_queue;
64 	struct list_head	mfc6_cache_array[MFC6_LINES];
65 	struct mif_device	vif6_table[MAXMIFS];
66 	int			maxvif;
67 	atomic_t		cache_resolve_queue_len;
68 	bool			mroute_do_assert;
69 	bool			mroute_do_pim;
70 #ifdef CONFIG_IPV6_PIMSM_V2
71 	int			mroute_reg_vif_num;
72 #endif
73 };
74 
75 struct ip6mr_rule {
76 	struct fib_rule		common;
77 };
78 
79 struct ip6mr_result {
80 	struct mr6_table	*mrt;
81 };
82 
83 /* Big lock, protecting vif table, mrt cache and mroute socket state.
84    Note that the changes are semaphored via rtnl_lock.
85  */
86 
87 static DEFINE_RWLOCK(mrt_lock);
88 
89 /*
90  *	Multicast router control variables
91  */
92 
93 #define MIF_EXISTS(_mrt, _idx) ((_mrt)->vif6_table[_idx].dev != NULL)
94 
95 /* Special spinlock for queue of unresolved entries */
96 static DEFINE_SPINLOCK(mfc_unres_lock);
97 
98 /* We return to original Alan's scheme. Hash table of resolved
99    entries is changed only in process context and protected
100    with weak lock mrt_lock. Queue of unresolved entries is protected
101    with strong spinlock mfc_unres_lock.
102 
103    In this case data path is free of exclusive locks at all.
104  */
105 
106 static struct kmem_cache *mrt_cachep __read_mostly;
107 
108 static struct mr6_table *ip6mr_new_table(struct net *net, u32 id);
109 static void ip6mr_free_table(struct mr6_table *mrt);
110 
111 static void ip6_mr_forward(struct net *net, struct mr6_table *mrt,
112 			   struct sk_buff *skb, struct mfc6_cache *cache);
113 static int ip6mr_cache_report(struct mr6_table *mrt, struct sk_buff *pkt,
114 			      mifi_t mifi, int assert);
115 static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
116 			       struct mfc6_cache *c, struct rtmsg *rtm);
117 static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc,
118 			      int cmd);
119 static int ip6mr_rtm_dumproute(struct sk_buff *skb,
120 			       struct netlink_callback *cb);
121 static void mroute_clean_tables(struct mr6_table *mrt, bool all);
122 static void ipmr_expire_process(unsigned long arg);
123 
124 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
125 #define ip6mr_for_each_table(mrt, net) \
126 	list_for_each_entry_rcu(mrt, &net->ipv6.mr6_tables, list)
127 
128 static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
129 {
130 	struct mr6_table *mrt;
131 
132 	ip6mr_for_each_table(mrt, net) {
133 		if (mrt->id == id)
134 			return mrt;
135 	}
136 	return NULL;
137 }
138 
139 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
140 			    struct mr6_table **mrt)
141 {
142 	int err;
143 	struct ip6mr_result res;
144 	struct fib_lookup_arg arg = {
145 		.result = &res,
146 		.flags = FIB_LOOKUP_NOREF,
147 	};
148 
149 	err = fib_rules_lookup(net->ipv6.mr6_rules_ops,
150 			       flowi6_to_flowi(flp6), 0, &arg);
151 	if (err < 0)
152 		return err;
153 	*mrt = res.mrt;
154 	return 0;
155 }
156 
157 static int ip6mr_rule_action(struct fib_rule *rule, struct flowi *flp,
158 			     int flags, struct fib_lookup_arg *arg)
159 {
160 	struct ip6mr_result *res = arg->result;
161 	struct mr6_table *mrt;
162 
163 	switch (rule->action) {
164 	case FR_ACT_TO_TBL:
165 		break;
166 	case FR_ACT_UNREACHABLE:
167 		return -ENETUNREACH;
168 	case FR_ACT_PROHIBIT:
169 		return -EACCES;
170 	case FR_ACT_BLACKHOLE:
171 	default:
172 		return -EINVAL;
173 	}
174 
175 	mrt = ip6mr_get_table(rule->fr_net, rule->table);
176 	if (!mrt)
177 		return -EAGAIN;
178 	res->mrt = mrt;
179 	return 0;
180 }
181 
182 static int ip6mr_rule_match(struct fib_rule *rule, struct flowi *flp, int flags)
183 {
184 	return 1;
185 }
186 
187 static const struct nla_policy ip6mr_rule_policy[FRA_MAX + 1] = {
188 	FRA_GENERIC_POLICY,
189 };
190 
191 static int ip6mr_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
192 				struct fib_rule_hdr *frh, struct nlattr **tb)
193 {
194 	return 0;
195 }
196 
197 static int ip6mr_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
198 			      struct nlattr **tb)
199 {
200 	return 1;
201 }
202 
203 static int ip6mr_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
204 			   struct fib_rule_hdr *frh)
205 {
206 	frh->dst_len = 0;
207 	frh->src_len = 0;
208 	frh->tos     = 0;
209 	return 0;
210 }
211 
212 static const struct fib_rules_ops __net_initconst ip6mr_rules_ops_template = {
213 	.family		= RTNL_FAMILY_IP6MR,
214 	.rule_size	= sizeof(struct ip6mr_rule),
215 	.addr_size	= sizeof(struct in6_addr),
216 	.action		= ip6mr_rule_action,
217 	.match		= ip6mr_rule_match,
218 	.configure	= ip6mr_rule_configure,
219 	.compare	= ip6mr_rule_compare,
220 	.fill		= ip6mr_rule_fill,
221 	.nlgroup	= RTNLGRP_IPV6_RULE,
222 	.policy		= ip6mr_rule_policy,
223 	.owner		= THIS_MODULE,
224 };
225 
226 static int __net_init ip6mr_rules_init(struct net *net)
227 {
228 	struct fib_rules_ops *ops;
229 	struct mr6_table *mrt;
230 	int err;
231 
232 	ops = fib_rules_register(&ip6mr_rules_ops_template, net);
233 	if (IS_ERR(ops))
234 		return PTR_ERR(ops);
235 
236 	INIT_LIST_HEAD(&net->ipv6.mr6_tables);
237 
238 	mrt = ip6mr_new_table(net, RT6_TABLE_DFLT);
239 	if (!mrt) {
240 		err = -ENOMEM;
241 		goto err1;
242 	}
243 
244 	err = fib_default_rule_add(ops, 0x7fff, RT6_TABLE_DFLT, 0);
245 	if (err < 0)
246 		goto err2;
247 
248 	net->ipv6.mr6_rules_ops = ops;
249 	return 0;
250 
251 err2:
252 	ip6mr_free_table(mrt);
253 err1:
254 	fib_rules_unregister(ops);
255 	return err;
256 }
257 
258 static void __net_exit ip6mr_rules_exit(struct net *net)
259 {
260 	struct mr6_table *mrt, *next;
261 
262 	rtnl_lock();
263 	list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
264 		list_del(&mrt->list);
265 		ip6mr_free_table(mrt);
266 	}
267 	fib_rules_unregister(net->ipv6.mr6_rules_ops);
268 	rtnl_unlock();
269 }
270 #else
271 #define ip6mr_for_each_table(mrt, net) \
272 	for (mrt = net->ipv6.mrt6; mrt; mrt = NULL)
273 
274 static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
275 {
276 	return net->ipv6.mrt6;
277 }
278 
279 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
280 			    struct mr6_table **mrt)
281 {
282 	*mrt = net->ipv6.mrt6;
283 	return 0;
284 }
285 
286 static int __net_init ip6mr_rules_init(struct net *net)
287 {
288 	net->ipv6.mrt6 = ip6mr_new_table(net, RT6_TABLE_DFLT);
289 	return net->ipv6.mrt6 ? 0 : -ENOMEM;
290 }
291 
292 static void __net_exit ip6mr_rules_exit(struct net *net)
293 {
294 	rtnl_lock();
295 	ip6mr_free_table(net->ipv6.mrt6);
296 	net->ipv6.mrt6 = NULL;
297 	rtnl_unlock();
298 }
299 #endif
300 
301 static struct mr6_table *ip6mr_new_table(struct net *net, u32 id)
302 {
303 	struct mr6_table *mrt;
304 	unsigned int i;
305 
306 	mrt = ip6mr_get_table(net, id);
307 	if (mrt)
308 		return mrt;
309 
310 	mrt = kzalloc(sizeof(*mrt), GFP_KERNEL);
311 	if (!mrt)
312 		return NULL;
313 	mrt->id = id;
314 	write_pnet(&mrt->net, net);
315 
316 	/* Forwarding cache */
317 	for (i = 0; i < MFC6_LINES; i++)
318 		INIT_LIST_HEAD(&mrt->mfc6_cache_array[i]);
319 
320 	INIT_LIST_HEAD(&mrt->mfc6_unres_queue);
321 
322 	setup_timer(&mrt->ipmr_expire_timer, ipmr_expire_process,
323 		    (unsigned long)mrt);
324 
325 #ifdef CONFIG_IPV6_PIMSM_V2
326 	mrt->mroute_reg_vif_num = -1;
327 #endif
328 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
329 	list_add_tail_rcu(&mrt->list, &net->ipv6.mr6_tables);
330 #endif
331 	return mrt;
332 }
333 
334 static void ip6mr_free_table(struct mr6_table *mrt)
335 {
336 	del_timer_sync(&mrt->ipmr_expire_timer);
337 	mroute_clean_tables(mrt, true);
338 	kfree(mrt);
339 }
340 
341 #ifdef CONFIG_PROC_FS
342 
343 struct ipmr_mfc_iter {
344 	struct seq_net_private p;
345 	struct mr6_table *mrt;
346 	struct list_head *cache;
347 	int ct;
348 };
349 
350 
351 static struct mfc6_cache *ipmr_mfc_seq_idx(struct net *net,
352 					   struct ipmr_mfc_iter *it, loff_t pos)
353 {
354 	struct mr6_table *mrt = it->mrt;
355 	struct mfc6_cache *mfc;
356 
357 	read_lock(&mrt_lock);
358 	for (it->ct = 0; it->ct < MFC6_LINES; it->ct++) {
359 		it->cache = &mrt->mfc6_cache_array[it->ct];
360 		list_for_each_entry(mfc, it->cache, list)
361 			if (pos-- == 0)
362 				return mfc;
363 	}
364 	read_unlock(&mrt_lock);
365 
366 	spin_lock_bh(&mfc_unres_lock);
367 	it->cache = &mrt->mfc6_unres_queue;
368 	list_for_each_entry(mfc, it->cache, list)
369 		if (pos-- == 0)
370 			return mfc;
371 	spin_unlock_bh(&mfc_unres_lock);
372 
373 	it->cache = NULL;
374 	return NULL;
375 }
376 
377 /*
378  *	The /proc interfaces to multicast routing /proc/ip6_mr_cache /proc/ip6_mr_vif
379  */
380 
381 struct ipmr_vif_iter {
382 	struct seq_net_private p;
383 	struct mr6_table *mrt;
384 	int ct;
385 };
386 
387 static struct mif_device *ip6mr_vif_seq_idx(struct net *net,
388 					    struct ipmr_vif_iter *iter,
389 					    loff_t pos)
390 {
391 	struct mr6_table *mrt = iter->mrt;
392 
393 	for (iter->ct = 0; iter->ct < mrt->maxvif; ++iter->ct) {
394 		if (!MIF_EXISTS(mrt, iter->ct))
395 			continue;
396 		if (pos-- == 0)
397 			return &mrt->vif6_table[iter->ct];
398 	}
399 	return NULL;
400 }
401 
402 static void *ip6mr_vif_seq_start(struct seq_file *seq, loff_t *pos)
403 	__acquires(mrt_lock)
404 {
405 	struct ipmr_vif_iter *iter = seq->private;
406 	struct net *net = seq_file_net(seq);
407 	struct mr6_table *mrt;
408 
409 	mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
410 	if (!mrt)
411 		return ERR_PTR(-ENOENT);
412 
413 	iter->mrt = mrt;
414 
415 	read_lock(&mrt_lock);
416 	return *pos ? ip6mr_vif_seq_idx(net, seq->private, *pos - 1)
417 		: SEQ_START_TOKEN;
418 }
419 
420 static void *ip6mr_vif_seq_next(struct seq_file *seq, void *v, loff_t *pos)
421 {
422 	struct ipmr_vif_iter *iter = seq->private;
423 	struct net *net = seq_file_net(seq);
424 	struct mr6_table *mrt = iter->mrt;
425 
426 	++*pos;
427 	if (v == SEQ_START_TOKEN)
428 		return ip6mr_vif_seq_idx(net, iter, 0);
429 
430 	while (++iter->ct < mrt->maxvif) {
431 		if (!MIF_EXISTS(mrt, iter->ct))
432 			continue;
433 		return &mrt->vif6_table[iter->ct];
434 	}
435 	return NULL;
436 }
437 
438 static void ip6mr_vif_seq_stop(struct seq_file *seq, void *v)
439 	__releases(mrt_lock)
440 {
441 	read_unlock(&mrt_lock);
442 }
443 
444 static int ip6mr_vif_seq_show(struct seq_file *seq, void *v)
445 {
446 	struct ipmr_vif_iter *iter = seq->private;
447 	struct mr6_table *mrt = iter->mrt;
448 
449 	if (v == SEQ_START_TOKEN) {
450 		seq_puts(seq,
451 			 "Interface      BytesIn  PktsIn  BytesOut PktsOut Flags\n");
452 	} else {
453 		const struct mif_device *vif = v;
454 		const char *name = vif->dev ? vif->dev->name : "none";
455 
456 		seq_printf(seq,
457 			   "%2td %-10s %8ld %7ld  %8ld %7ld %05X\n",
458 			   vif - mrt->vif6_table,
459 			   name, vif->bytes_in, vif->pkt_in,
460 			   vif->bytes_out, vif->pkt_out,
461 			   vif->flags);
462 	}
463 	return 0;
464 }
465 
466 static const struct seq_operations ip6mr_vif_seq_ops = {
467 	.start = ip6mr_vif_seq_start,
468 	.next  = ip6mr_vif_seq_next,
469 	.stop  = ip6mr_vif_seq_stop,
470 	.show  = ip6mr_vif_seq_show,
471 };
472 
473 static int ip6mr_vif_open(struct inode *inode, struct file *file)
474 {
475 	return seq_open_net(inode, file, &ip6mr_vif_seq_ops,
476 			    sizeof(struct ipmr_vif_iter));
477 }
478 
479 static const struct file_operations ip6mr_vif_fops = {
480 	.owner	 = THIS_MODULE,
481 	.open    = ip6mr_vif_open,
482 	.read    = seq_read,
483 	.llseek  = seq_lseek,
484 	.release = seq_release_net,
485 };
486 
487 static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
488 {
489 	struct ipmr_mfc_iter *it = seq->private;
490 	struct net *net = seq_file_net(seq);
491 	struct mr6_table *mrt;
492 
493 	mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
494 	if (!mrt)
495 		return ERR_PTR(-ENOENT);
496 
497 	it->mrt = mrt;
498 	return *pos ? ipmr_mfc_seq_idx(net, seq->private, *pos - 1)
499 		: SEQ_START_TOKEN;
500 }
501 
502 static void *ipmr_mfc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
503 {
504 	struct mfc6_cache *mfc = v;
505 	struct ipmr_mfc_iter *it = seq->private;
506 	struct net *net = seq_file_net(seq);
507 	struct mr6_table *mrt = it->mrt;
508 
509 	++*pos;
510 
511 	if (v == SEQ_START_TOKEN)
512 		return ipmr_mfc_seq_idx(net, seq->private, 0);
513 
514 	if (mfc->list.next != it->cache)
515 		return list_entry(mfc->list.next, struct mfc6_cache, list);
516 
517 	if (it->cache == &mrt->mfc6_unres_queue)
518 		goto end_of_list;
519 
520 	BUG_ON(it->cache != &mrt->mfc6_cache_array[it->ct]);
521 
522 	while (++it->ct < MFC6_LINES) {
523 		it->cache = &mrt->mfc6_cache_array[it->ct];
524 		if (list_empty(it->cache))
525 			continue;
526 		return list_first_entry(it->cache, struct mfc6_cache, list);
527 	}
528 
529 	/* exhausted cache_array, show unresolved */
530 	read_unlock(&mrt_lock);
531 	it->cache = &mrt->mfc6_unres_queue;
532 	it->ct = 0;
533 
534 	spin_lock_bh(&mfc_unres_lock);
535 	if (!list_empty(it->cache))
536 		return list_first_entry(it->cache, struct mfc6_cache, list);
537 
538  end_of_list:
539 	spin_unlock_bh(&mfc_unres_lock);
540 	it->cache = NULL;
541 
542 	return NULL;
543 }
544 
545 static void ipmr_mfc_seq_stop(struct seq_file *seq, void *v)
546 {
547 	struct ipmr_mfc_iter *it = seq->private;
548 	struct mr6_table *mrt = it->mrt;
549 
550 	if (it->cache == &mrt->mfc6_unres_queue)
551 		spin_unlock_bh(&mfc_unres_lock);
552 	else if (it->cache == &mrt->mfc6_cache_array[it->ct])
553 		read_unlock(&mrt_lock);
554 }
555 
556 static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
557 {
558 	int n;
559 
560 	if (v == SEQ_START_TOKEN) {
561 		seq_puts(seq,
562 			 "Group                            "
563 			 "Origin                           "
564 			 "Iif      Pkts  Bytes     Wrong  Oifs\n");
565 	} else {
566 		const struct mfc6_cache *mfc = v;
567 		const struct ipmr_mfc_iter *it = seq->private;
568 		struct mr6_table *mrt = it->mrt;
569 
570 		seq_printf(seq, "%pI6 %pI6 %-3hd",
571 			   &mfc->mf6c_mcastgrp, &mfc->mf6c_origin,
572 			   mfc->mf6c_parent);
573 
574 		if (it->cache != &mrt->mfc6_unres_queue) {
575 			seq_printf(seq, " %8lu %8lu %8lu",
576 				   mfc->mfc_un.res.pkt,
577 				   mfc->mfc_un.res.bytes,
578 				   mfc->mfc_un.res.wrong_if);
579 			for (n = mfc->mfc_un.res.minvif;
580 			     n < mfc->mfc_un.res.maxvif; n++) {
581 				if (MIF_EXISTS(mrt, n) &&
582 				    mfc->mfc_un.res.ttls[n] < 255)
583 					seq_printf(seq,
584 						   " %2d:%-3d",
585 						   n, mfc->mfc_un.res.ttls[n]);
586 			}
587 		} else {
588 			/* unresolved mfc_caches don't contain
589 			 * pkt, bytes and wrong_if values
590 			 */
591 			seq_printf(seq, " %8lu %8lu %8lu", 0ul, 0ul, 0ul);
592 		}
593 		seq_putc(seq, '\n');
594 	}
595 	return 0;
596 }
597 
598 static const struct seq_operations ipmr_mfc_seq_ops = {
599 	.start = ipmr_mfc_seq_start,
600 	.next  = ipmr_mfc_seq_next,
601 	.stop  = ipmr_mfc_seq_stop,
602 	.show  = ipmr_mfc_seq_show,
603 };
604 
605 static int ipmr_mfc_open(struct inode *inode, struct file *file)
606 {
607 	return seq_open_net(inode, file, &ipmr_mfc_seq_ops,
608 			    sizeof(struct ipmr_mfc_iter));
609 }
610 
611 static const struct file_operations ip6mr_mfc_fops = {
612 	.owner	 = THIS_MODULE,
613 	.open    = ipmr_mfc_open,
614 	.read    = seq_read,
615 	.llseek  = seq_lseek,
616 	.release = seq_release_net,
617 };
618 #endif
619 
620 #ifdef CONFIG_IPV6_PIMSM_V2
621 
622 static int pim6_rcv(struct sk_buff *skb)
623 {
624 	struct pimreghdr *pim;
625 	struct ipv6hdr   *encap;
626 	struct net_device  *reg_dev = NULL;
627 	struct net *net = dev_net(skb->dev);
628 	struct mr6_table *mrt;
629 	struct flowi6 fl6 = {
630 		.flowi6_iif	= skb->dev->ifindex,
631 		.flowi6_mark	= skb->mark,
632 	};
633 	int reg_vif_num;
634 
635 	if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(*encap)))
636 		goto drop;
637 
638 	pim = (struct pimreghdr *)skb_transport_header(skb);
639 	if (pim->type != ((PIM_VERSION << 4) | PIM_TYPE_REGISTER) ||
640 	    (pim->flags & PIM_NULL_REGISTER) ||
641 	    (csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
642 			     sizeof(*pim), IPPROTO_PIM,
643 			     csum_partial((void *)pim, sizeof(*pim), 0)) &&
644 	     csum_fold(skb_checksum(skb, 0, skb->len, 0))))
645 		goto drop;
646 
647 	/* check if the inner packet is destined to mcast group */
648 	encap = (struct ipv6hdr *)(skb_transport_header(skb) +
649 				   sizeof(*pim));
650 
651 	if (!ipv6_addr_is_multicast(&encap->daddr) ||
652 	    encap->payload_len == 0 ||
653 	    ntohs(encap->payload_len) + sizeof(*pim) > skb->len)
654 		goto drop;
655 
656 	if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0)
657 		goto drop;
658 	reg_vif_num = mrt->mroute_reg_vif_num;
659 
660 	read_lock(&mrt_lock);
661 	if (reg_vif_num >= 0)
662 		reg_dev = mrt->vif6_table[reg_vif_num].dev;
663 	if (reg_dev)
664 		dev_hold(reg_dev);
665 	read_unlock(&mrt_lock);
666 
667 	if (!reg_dev)
668 		goto drop;
669 
670 	skb->mac_header = skb->network_header;
671 	skb_pull(skb, (u8 *)encap - skb->data);
672 	skb_reset_network_header(skb);
673 	skb->protocol = htons(ETH_P_IPV6);
674 	skb->ip_summed = CHECKSUM_NONE;
675 
676 	skb_tunnel_rx(skb, reg_dev, dev_net(reg_dev));
677 
678 	netif_rx(skb);
679 
680 	dev_put(reg_dev);
681 	return 0;
682  drop:
683 	kfree_skb(skb);
684 	return 0;
685 }
686 
687 static const struct inet6_protocol pim6_protocol = {
688 	.handler	=	pim6_rcv,
689 };
690 
691 /* Service routines creating virtual interfaces: PIMREG */
692 
693 static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
694 				      struct net_device *dev)
695 {
696 	struct net *net = dev_net(dev);
697 	struct mr6_table *mrt;
698 	struct flowi6 fl6 = {
699 		.flowi6_oif	= dev->ifindex,
700 		.flowi6_iif	= skb->skb_iif ? : LOOPBACK_IFINDEX,
701 		.flowi6_mark	= skb->mark,
702 	};
703 	int err;
704 
705 	err = ip6mr_fib_lookup(net, &fl6, &mrt);
706 	if (err < 0) {
707 		kfree_skb(skb);
708 		return err;
709 	}
710 
711 	read_lock(&mrt_lock);
712 	dev->stats.tx_bytes += skb->len;
713 	dev->stats.tx_packets++;
714 	ip6mr_cache_report(mrt, skb, mrt->mroute_reg_vif_num, MRT6MSG_WHOLEPKT);
715 	read_unlock(&mrt_lock);
716 	kfree_skb(skb);
717 	return NETDEV_TX_OK;
718 }
719 
720 static int reg_vif_get_iflink(const struct net_device *dev)
721 {
722 	return 0;
723 }
724 
725 static const struct net_device_ops reg_vif_netdev_ops = {
726 	.ndo_start_xmit	= reg_vif_xmit,
727 	.ndo_get_iflink = reg_vif_get_iflink,
728 };
729 
730 static void reg_vif_setup(struct net_device *dev)
731 {
732 	dev->type		= ARPHRD_PIMREG;
733 	dev->mtu		= 1500 - sizeof(struct ipv6hdr) - 8;
734 	dev->flags		= IFF_NOARP;
735 	dev->netdev_ops		= &reg_vif_netdev_ops;
736 	dev->needs_free_netdev	= true;
737 	dev->features		|= NETIF_F_NETNS_LOCAL;
738 }
739 
740 static struct net_device *ip6mr_reg_vif(struct net *net, struct mr6_table *mrt)
741 {
742 	struct net_device *dev;
743 	char name[IFNAMSIZ];
744 
745 	if (mrt->id == RT6_TABLE_DFLT)
746 		sprintf(name, "pim6reg");
747 	else
748 		sprintf(name, "pim6reg%u", mrt->id);
749 
750 	dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, reg_vif_setup);
751 	if (!dev)
752 		return NULL;
753 
754 	dev_net_set(dev, net);
755 
756 	if (register_netdevice(dev)) {
757 		free_netdev(dev);
758 		return NULL;
759 	}
760 
761 	if (dev_open(dev))
762 		goto failure;
763 
764 	dev_hold(dev);
765 	return dev;
766 
767 failure:
768 	unregister_netdevice(dev);
769 	return NULL;
770 }
771 #endif
772 
773 /*
774  *	Delete a VIF entry
775  */
776 
777 static int mif6_delete(struct mr6_table *mrt, int vifi, int notify,
778 		       struct list_head *head)
779 {
780 	struct mif_device *v;
781 	struct net_device *dev;
782 	struct inet6_dev *in6_dev;
783 
784 	if (vifi < 0 || vifi >= mrt->maxvif)
785 		return -EADDRNOTAVAIL;
786 
787 	v = &mrt->vif6_table[vifi];
788 
789 	write_lock_bh(&mrt_lock);
790 	dev = v->dev;
791 	v->dev = NULL;
792 
793 	if (!dev) {
794 		write_unlock_bh(&mrt_lock);
795 		return -EADDRNOTAVAIL;
796 	}
797 
798 #ifdef CONFIG_IPV6_PIMSM_V2
799 	if (vifi == mrt->mroute_reg_vif_num)
800 		mrt->mroute_reg_vif_num = -1;
801 #endif
802 
803 	if (vifi + 1 == mrt->maxvif) {
804 		int tmp;
805 		for (tmp = vifi - 1; tmp >= 0; tmp--) {
806 			if (MIF_EXISTS(mrt, tmp))
807 				break;
808 		}
809 		mrt->maxvif = tmp + 1;
810 	}
811 
812 	write_unlock_bh(&mrt_lock);
813 
814 	dev_set_allmulti(dev, -1);
815 
816 	in6_dev = __in6_dev_get(dev);
817 	if (in6_dev) {
818 		in6_dev->cnf.mc_forwarding--;
819 		inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF,
820 					     NETCONFA_MC_FORWARDING,
821 					     dev->ifindex, &in6_dev->cnf);
822 	}
823 
824 	if ((v->flags & MIFF_REGISTER) && !notify)
825 		unregister_netdevice_queue(dev, head);
826 
827 	dev_put(dev);
828 	return 0;
829 }
830 
831 static inline void ip6mr_cache_free(struct mfc6_cache *c)
832 {
833 	kmem_cache_free(mrt_cachep, c);
834 }
835 
836 /* Destroy an unresolved cache entry, killing queued skbs
837    and reporting error to netlink readers.
838  */
839 
840 static void ip6mr_destroy_unres(struct mr6_table *mrt, struct mfc6_cache *c)
841 {
842 	struct net *net = read_pnet(&mrt->net);
843 	struct sk_buff *skb;
844 
845 	atomic_dec(&mrt->cache_resolve_queue_len);
846 
847 	while ((skb = skb_dequeue(&c->mfc_un.unres.unresolved)) != NULL) {
848 		if (ipv6_hdr(skb)->version == 0) {
849 			struct nlmsghdr *nlh = skb_pull(skb,
850 							sizeof(struct ipv6hdr));
851 			nlh->nlmsg_type = NLMSG_ERROR;
852 			nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr));
853 			skb_trim(skb, nlh->nlmsg_len);
854 			((struct nlmsgerr *)nlmsg_data(nlh))->error = -ETIMEDOUT;
855 			rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
856 		} else
857 			kfree_skb(skb);
858 	}
859 
860 	ip6mr_cache_free(c);
861 }
862 
863 
864 /* Timer process for all the unresolved queue. */
865 
866 static void ipmr_do_expire_process(struct mr6_table *mrt)
867 {
868 	unsigned long now = jiffies;
869 	unsigned long expires = 10 * HZ;
870 	struct mfc6_cache *c, *next;
871 
872 	list_for_each_entry_safe(c, next, &mrt->mfc6_unres_queue, list) {
873 		if (time_after(c->mfc_un.unres.expires, now)) {
874 			/* not yet... */
875 			unsigned long interval = c->mfc_un.unres.expires - now;
876 			if (interval < expires)
877 				expires = interval;
878 			continue;
879 		}
880 
881 		list_del(&c->list);
882 		mr6_netlink_event(mrt, c, RTM_DELROUTE);
883 		ip6mr_destroy_unres(mrt, c);
884 	}
885 
886 	if (!list_empty(&mrt->mfc6_unres_queue))
887 		mod_timer(&mrt->ipmr_expire_timer, jiffies + expires);
888 }
889 
890 static void ipmr_expire_process(unsigned long arg)
891 {
892 	struct mr6_table *mrt = (struct mr6_table *)arg;
893 
894 	if (!spin_trylock(&mfc_unres_lock)) {
895 		mod_timer(&mrt->ipmr_expire_timer, jiffies + 1);
896 		return;
897 	}
898 
899 	if (!list_empty(&mrt->mfc6_unres_queue))
900 		ipmr_do_expire_process(mrt);
901 
902 	spin_unlock(&mfc_unres_lock);
903 }
904 
905 /* Fill oifs list. It is called under write locked mrt_lock. */
906 
907 static void ip6mr_update_thresholds(struct mr6_table *mrt, struct mfc6_cache *cache,
908 				    unsigned char *ttls)
909 {
910 	int vifi;
911 
912 	cache->mfc_un.res.minvif = MAXMIFS;
913 	cache->mfc_un.res.maxvif = 0;
914 	memset(cache->mfc_un.res.ttls, 255, MAXMIFS);
915 
916 	for (vifi = 0; vifi < mrt->maxvif; vifi++) {
917 		if (MIF_EXISTS(mrt, vifi) &&
918 		    ttls[vifi] && ttls[vifi] < 255) {
919 			cache->mfc_un.res.ttls[vifi] = ttls[vifi];
920 			if (cache->mfc_un.res.minvif > vifi)
921 				cache->mfc_un.res.minvif = vifi;
922 			if (cache->mfc_un.res.maxvif <= vifi)
923 				cache->mfc_un.res.maxvif = vifi + 1;
924 		}
925 	}
926 	cache->mfc_un.res.lastuse = jiffies;
927 }
928 
929 static int mif6_add(struct net *net, struct mr6_table *mrt,
930 		    struct mif6ctl *vifc, int mrtsock)
931 {
932 	int vifi = vifc->mif6c_mifi;
933 	struct mif_device *v = &mrt->vif6_table[vifi];
934 	struct net_device *dev;
935 	struct inet6_dev *in6_dev;
936 	int err;
937 
938 	/* Is vif busy ? */
939 	if (MIF_EXISTS(mrt, vifi))
940 		return -EADDRINUSE;
941 
942 	switch (vifc->mif6c_flags) {
943 #ifdef CONFIG_IPV6_PIMSM_V2
944 	case MIFF_REGISTER:
945 		/*
946 		 * Special Purpose VIF in PIM
947 		 * All the packets will be sent to the daemon
948 		 */
949 		if (mrt->mroute_reg_vif_num >= 0)
950 			return -EADDRINUSE;
951 		dev = ip6mr_reg_vif(net, mrt);
952 		if (!dev)
953 			return -ENOBUFS;
954 		err = dev_set_allmulti(dev, 1);
955 		if (err) {
956 			unregister_netdevice(dev);
957 			dev_put(dev);
958 			return err;
959 		}
960 		break;
961 #endif
962 	case 0:
963 		dev = dev_get_by_index(net, vifc->mif6c_pifi);
964 		if (!dev)
965 			return -EADDRNOTAVAIL;
966 		err = dev_set_allmulti(dev, 1);
967 		if (err) {
968 			dev_put(dev);
969 			return err;
970 		}
971 		break;
972 	default:
973 		return -EINVAL;
974 	}
975 
976 	in6_dev = __in6_dev_get(dev);
977 	if (in6_dev) {
978 		in6_dev->cnf.mc_forwarding++;
979 		inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF,
980 					     NETCONFA_MC_FORWARDING,
981 					     dev->ifindex, &in6_dev->cnf);
982 	}
983 
984 	/*
985 	 *	Fill in the VIF structures
986 	 */
987 	v->rate_limit = vifc->vifc_rate_limit;
988 	v->flags = vifc->mif6c_flags;
989 	if (!mrtsock)
990 		v->flags |= VIFF_STATIC;
991 	v->threshold = vifc->vifc_threshold;
992 	v->bytes_in = 0;
993 	v->bytes_out = 0;
994 	v->pkt_in = 0;
995 	v->pkt_out = 0;
996 	v->link = dev->ifindex;
997 	if (v->flags & MIFF_REGISTER)
998 		v->link = dev_get_iflink(dev);
999 
1000 	/* And finish update writing critical data */
1001 	write_lock_bh(&mrt_lock);
1002 	v->dev = dev;
1003 #ifdef CONFIG_IPV6_PIMSM_V2
1004 	if (v->flags & MIFF_REGISTER)
1005 		mrt->mroute_reg_vif_num = vifi;
1006 #endif
1007 	if (vifi + 1 > mrt->maxvif)
1008 		mrt->maxvif = vifi + 1;
1009 	write_unlock_bh(&mrt_lock);
1010 	return 0;
1011 }
1012 
1013 static struct mfc6_cache *ip6mr_cache_find(struct mr6_table *mrt,
1014 					   const struct in6_addr *origin,
1015 					   const struct in6_addr *mcastgrp)
1016 {
1017 	int line = MFC6_HASH(mcastgrp, origin);
1018 	struct mfc6_cache *c;
1019 
1020 	list_for_each_entry(c, &mrt->mfc6_cache_array[line], list) {
1021 		if (ipv6_addr_equal(&c->mf6c_origin, origin) &&
1022 		    ipv6_addr_equal(&c->mf6c_mcastgrp, mcastgrp))
1023 			return c;
1024 	}
1025 	return NULL;
1026 }
1027 
1028 /* Look for a (*,*,oif) entry */
1029 static struct mfc6_cache *ip6mr_cache_find_any_parent(struct mr6_table *mrt,
1030 						      mifi_t mifi)
1031 {
1032 	int line = MFC6_HASH(&in6addr_any, &in6addr_any);
1033 	struct mfc6_cache *c;
1034 
1035 	list_for_each_entry(c, &mrt->mfc6_cache_array[line], list)
1036 		if (ipv6_addr_any(&c->mf6c_origin) &&
1037 		    ipv6_addr_any(&c->mf6c_mcastgrp) &&
1038 		    (c->mfc_un.res.ttls[mifi] < 255))
1039 			return c;
1040 
1041 	return NULL;
1042 }
1043 
1044 /* Look for a (*,G) entry */
1045 static struct mfc6_cache *ip6mr_cache_find_any(struct mr6_table *mrt,
1046 					       struct in6_addr *mcastgrp,
1047 					       mifi_t mifi)
1048 {
1049 	int line = MFC6_HASH(mcastgrp, &in6addr_any);
1050 	struct mfc6_cache *c, *proxy;
1051 
1052 	if (ipv6_addr_any(mcastgrp))
1053 		goto skip;
1054 
1055 	list_for_each_entry(c, &mrt->mfc6_cache_array[line], list)
1056 		if (ipv6_addr_any(&c->mf6c_origin) &&
1057 		    ipv6_addr_equal(&c->mf6c_mcastgrp, mcastgrp)) {
1058 			if (c->mfc_un.res.ttls[mifi] < 255)
1059 				return c;
1060 
1061 			/* It's ok if the mifi is part of the static tree */
1062 			proxy = ip6mr_cache_find_any_parent(mrt,
1063 							    c->mf6c_parent);
1064 			if (proxy && proxy->mfc_un.res.ttls[mifi] < 255)
1065 				return c;
1066 		}
1067 
1068 skip:
1069 	return ip6mr_cache_find_any_parent(mrt, mifi);
1070 }
1071 
1072 /*
1073  *	Allocate a multicast cache entry
1074  */
1075 static struct mfc6_cache *ip6mr_cache_alloc(void)
1076 {
1077 	struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
1078 	if (!c)
1079 		return NULL;
1080 	c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
1081 	c->mfc_un.res.minvif = MAXMIFS;
1082 	return c;
1083 }
1084 
1085 static struct mfc6_cache *ip6mr_cache_alloc_unres(void)
1086 {
1087 	struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC);
1088 	if (!c)
1089 		return NULL;
1090 	skb_queue_head_init(&c->mfc_un.unres.unresolved);
1091 	c->mfc_un.unres.expires = jiffies + 10 * HZ;
1092 	return c;
1093 }
1094 
1095 /*
1096  *	A cache entry has gone into a resolved state from queued
1097  */
1098 
1099 static void ip6mr_cache_resolve(struct net *net, struct mr6_table *mrt,
1100 				struct mfc6_cache *uc, struct mfc6_cache *c)
1101 {
1102 	struct sk_buff *skb;
1103 
1104 	/*
1105 	 *	Play the pending entries through our router
1106 	 */
1107 
1108 	while ((skb = __skb_dequeue(&uc->mfc_un.unres.unresolved))) {
1109 		if (ipv6_hdr(skb)->version == 0) {
1110 			struct nlmsghdr *nlh = skb_pull(skb,
1111 							sizeof(struct ipv6hdr));
1112 
1113 			if (__ip6mr_fill_mroute(mrt, skb, c, nlmsg_data(nlh)) > 0) {
1114 				nlh->nlmsg_len = skb_tail_pointer(skb) - (u8 *)nlh;
1115 			} else {
1116 				nlh->nlmsg_type = NLMSG_ERROR;
1117 				nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr));
1118 				skb_trim(skb, nlh->nlmsg_len);
1119 				((struct nlmsgerr *)nlmsg_data(nlh))->error = -EMSGSIZE;
1120 			}
1121 			rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
1122 		} else
1123 			ip6_mr_forward(net, mrt, skb, c);
1124 	}
1125 }
1126 
1127 /*
1128  *	Bounce a cache query up to pim6sd. We could use netlink for this but pim6sd
1129  *	expects the following bizarre scheme.
1130  *
1131  *	Called under mrt_lock.
1132  */
1133 
1134 static int ip6mr_cache_report(struct mr6_table *mrt, struct sk_buff *pkt,
1135 			      mifi_t mifi, int assert)
1136 {
1137 	struct sk_buff *skb;
1138 	struct mrt6msg *msg;
1139 	int ret;
1140 
1141 #ifdef CONFIG_IPV6_PIMSM_V2
1142 	if (assert == MRT6MSG_WHOLEPKT)
1143 		skb = skb_realloc_headroom(pkt, -skb_network_offset(pkt)
1144 						+sizeof(*msg));
1145 	else
1146 #endif
1147 		skb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(*msg), GFP_ATOMIC);
1148 
1149 	if (!skb)
1150 		return -ENOBUFS;
1151 
1152 	/* I suppose that internal messages
1153 	 * do not require checksums */
1154 
1155 	skb->ip_summed = CHECKSUM_UNNECESSARY;
1156 
1157 #ifdef CONFIG_IPV6_PIMSM_V2
1158 	if (assert == MRT6MSG_WHOLEPKT) {
1159 		/* Ugly, but we have no choice with this interface.
1160 		   Duplicate old header, fix length etc.
1161 		   And all this only to mangle msg->im6_msgtype and
1162 		   to set msg->im6_mbz to "mbz" :-)
1163 		 */
1164 		skb_push(skb, -skb_network_offset(pkt));
1165 
1166 		skb_push(skb, sizeof(*msg));
1167 		skb_reset_transport_header(skb);
1168 		msg = (struct mrt6msg *)skb_transport_header(skb);
1169 		msg->im6_mbz = 0;
1170 		msg->im6_msgtype = MRT6MSG_WHOLEPKT;
1171 		msg->im6_mif = mrt->mroute_reg_vif_num;
1172 		msg->im6_pad = 0;
1173 		msg->im6_src = ipv6_hdr(pkt)->saddr;
1174 		msg->im6_dst = ipv6_hdr(pkt)->daddr;
1175 
1176 		skb->ip_summed = CHECKSUM_UNNECESSARY;
1177 	} else
1178 #endif
1179 	{
1180 	/*
1181 	 *	Copy the IP header
1182 	 */
1183 
1184 	skb_put(skb, sizeof(struct ipv6hdr));
1185 	skb_reset_network_header(skb);
1186 	skb_copy_to_linear_data(skb, ipv6_hdr(pkt), sizeof(struct ipv6hdr));
1187 
1188 	/*
1189 	 *	Add our header
1190 	 */
1191 	skb_put(skb, sizeof(*msg));
1192 	skb_reset_transport_header(skb);
1193 	msg = (struct mrt6msg *)skb_transport_header(skb);
1194 
1195 	msg->im6_mbz = 0;
1196 	msg->im6_msgtype = assert;
1197 	msg->im6_mif = mifi;
1198 	msg->im6_pad = 0;
1199 	msg->im6_src = ipv6_hdr(pkt)->saddr;
1200 	msg->im6_dst = ipv6_hdr(pkt)->daddr;
1201 
1202 	skb_dst_set(skb, dst_clone(skb_dst(pkt)));
1203 	skb->ip_summed = CHECKSUM_UNNECESSARY;
1204 	}
1205 
1206 	if (!mrt->mroute6_sk) {
1207 		kfree_skb(skb);
1208 		return -EINVAL;
1209 	}
1210 
1211 	/*
1212 	 *	Deliver to user space multicast routing algorithms
1213 	 */
1214 	ret = sock_queue_rcv_skb(mrt->mroute6_sk, skb);
1215 	if (ret < 0) {
1216 		net_warn_ratelimited("mroute6: pending queue full, dropping entries\n");
1217 		kfree_skb(skb);
1218 	}
1219 
1220 	return ret;
1221 }
1222 
1223 /*
1224  *	Queue a packet for resolution. It gets locked cache entry!
1225  */
1226 
1227 static int
1228 ip6mr_cache_unresolved(struct mr6_table *mrt, mifi_t mifi, struct sk_buff *skb)
1229 {
1230 	bool found = false;
1231 	int err;
1232 	struct mfc6_cache *c;
1233 
1234 	spin_lock_bh(&mfc_unres_lock);
1235 	list_for_each_entry(c, &mrt->mfc6_unres_queue, list) {
1236 		if (ipv6_addr_equal(&c->mf6c_mcastgrp, &ipv6_hdr(skb)->daddr) &&
1237 		    ipv6_addr_equal(&c->mf6c_origin, &ipv6_hdr(skb)->saddr)) {
1238 			found = true;
1239 			break;
1240 		}
1241 	}
1242 
1243 	if (!found) {
1244 		/*
1245 		 *	Create a new entry if allowable
1246 		 */
1247 
1248 		if (atomic_read(&mrt->cache_resolve_queue_len) >= 10 ||
1249 		    (c = ip6mr_cache_alloc_unres()) == NULL) {
1250 			spin_unlock_bh(&mfc_unres_lock);
1251 
1252 			kfree_skb(skb);
1253 			return -ENOBUFS;
1254 		}
1255 
1256 		/*
1257 		 *	Fill in the new cache entry
1258 		 */
1259 		c->mf6c_parent = -1;
1260 		c->mf6c_origin = ipv6_hdr(skb)->saddr;
1261 		c->mf6c_mcastgrp = ipv6_hdr(skb)->daddr;
1262 
1263 		/*
1264 		 *	Reflect first query at pim6sd
1265 		 */
1266 		err = ip6mr_cache_report(mrt, skb, mifi, MRT6MSG_NOCACHE);
1267 		if (err < 0) {
1268 			/* If the report failed throw the cache entry
1269 			   out - Brad Parker
1270 			 */
1271 			spin_unlock_bh(&mfc_unres_lock);
1272 
1273 			ip6mr_cache_free(c);
1274 			kfree_skb(skb);
1275 			return err;
1276 		}
1277 
1278 		atomic_inc(&mrt->cache_resolve_queue_len);
1279 		list_add(&c->list, &mrt->mfc6_unres_queue);
1280 		mr6_netlink_event(mrt, c, RTM_NEWROUTE);
1281 
1282 		ipmr_do_expire_process(mrt);
1283 	}
1284 
1285 	/*
1286 	 *	See if we can append the packet
1287 	 */
1288 	if (c->mfc_un.unres.unresolved.qlen > 3) {
1289 		kfree_skb(skb);
1290 		err = -ENOBUFS;
1291 	} else {
1292 		skb_queue_tail(&c->mfc_un.unres.unresolved, skb);
1293 		err = 0;
1294 	}
1295 
1296 	spin_unlock_bh(&mfc_unres_lock);
1297 	return err;
1298 }
1299 
1300 /*
1301  *	MFC6 cache manipulation by user space
1302  */
1303 
1304 static int ip6mr_mfc_delete(struct mr6_table *mrt, struct mf6cctl *mfc,
1305 			    int parent)
1306 {
1307 	int line;
1308 	struct mfc6_cache *c, *next;
1309 
1310 	line = MFC6_HASH(&mfc->mf6cc_mcastgrp.sin6_addr, &mfc->mf6cc_origin.sin6_addr);
1311 
1312 	list_for_each_entry_safe(c, next, &mrt->mfc6_cache_array[line], list) {
1313 		if (ipv6_addr_equal(&c->mf6c_origin, &mfc->mf6cc_origin.sin6_addr) &&
1314 		    ipv6_addr_equal(&c->mf6c_mcastgrp,
1315 				    &mfc->mf6cc_mcastgrp.sin6_addr) &&
1316 		    (parent == -1 || parent == c->mf6c_parent)) {
1317 			write_lock_bh(&mrt_lock);
1318 			list_del(&c->list);
1319 			write_unlock_bh(&mrt_lock);
1320 
1321 			mr6_netlink_event(mrt, c, RTM_DELROUTE);
1322 			ip6mr_cache_free(c);
1323 			return 0;
1324 		}
1325 	}
1326 	return -ENOENT;
1327 }
1328 
1329 static int ip6mr_device_event(struct notifier_block *this,
1330 			      unsigned long event, void *ptr)
1331 {
1332 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1333 	struct net *net = dev_net(dev);
1334 	struct mr6_table *mrt;
1335 	struct mif_device *v;
1336 	int ct;
1337 
1338 	if (event != NETDEV_UNREGISTER)
1339 		return NOTIFY_DONE;
1340 
1341 	ip6mr_for_each_table(mrt, net) {
1342 		v = &mrt->vif6_table[0];
1343 		for (ct = 0; ct < mrt->maxvif; ct++, v++) {
1344 			if (v->dev == dev)
1345 				mif6_delete(mrt, ct, 1, NULL);
1346 		}
1347 	}
1348 
1349 	return NOTIFY_DONE;
1350 }
1351 
1352 static struct notifier_block ip6_mr_notifier = {
1353 	.notifier_call = ip6mr_device_event
1354 };
1355 
1356 /*
1357  *	Setup for IP multicast routing
1358  */
1359 
1360 static int __net_init ip6mr_net_init(struct net *net)
1361 {
1362 	int err;
1363 
1364 	err = ip6mr_rules_init(net);
1365 	if (err < 0)
1366 		goto fail;
1367 
1368 #ifdef CONFIG_PROC_FS
1369 	err = -ENOMEM;
1370 	if (!proc_create("ip6_mr_vif", 0, net->proc_net, &ip6mr_vif_fops))
1371 		goto proc_vif_fail;
1372 	if (!proc_create("ip6_mr_cache", 0, net->proc_net, &ip6mr_mfc_fops))
1373 		goto proc_cache_fail;
1374 #endif
1375 
1376 	return 0;
1377 
1378 #ifdef CONFIG_PROC_FS
1379 proc_cache_fail:
1380 	remove_proc_entry("ip6_mr_vif", net->proc_net);
1381 proc_vif_fail:
1382 	ip6mr_rules_exit(net);
1383 #endif
1384 fail:
1385 	return err;
1386 }
1387 
1388 static void __net_exit ip6mr_net_exit(struct net *net)
1389 {
1390 #ifdef CONFIG_PROC_FS
1391 	remove_proc_entry("ip6_mr_cache", net->proc_net);
1392 	remove_proc_entry("ip6_mr_vif", net->proc_net);
1393 #endif
1394 	ip6mr_rules_exit(net);
1395 }
1396 
1397 static struct pernet_operations ip6mr_net_ops = {
1398 	.init = ip6mr_net_init,
1399 	.exit = ip6mr_net_exit,
1400 };
1401 
1402 int __init ip6_mr_init(void)
1403 {
1404 	int err;
1405 
1406 	mrt_cachep = kmem_cache_create("ip6_mrt_cache",
1407 				       sizeof(struct mfc6_cache),
1408 				       0, SLAB_HWCACHE_ALIGN,
1409 				       NULL);
1410 	if (!mrt_cachep)
1411 		return -ENOMEM;
1412 
1413 	err = register_pernet_subsys(&ip6mr_net_ops);
1414 	if (err)
1415 		goto reg_pernet_fail;
1416 
1417 	err = register_netdevice_notifier(&ip6_mr_notifier);
1418 	if (err)
1419 		goto reg_notif_fail;
1420 #ifdef CONFIG_IPV6_PIMSM_V2
1421 	if (inet6_add_protocol(&pim6_protocol, IPPROTO_PIM) < 0) {
1422 		pr_err("%s: can't add PIM protocol\n", __func__);
1423 		err = -EAGAIN;
1424 		goto add_proto_fail;
1425 	}
1426 #endif
1427 	rtnl_register(RTNL_FAMILY_IP6MR, RTM_GETROUTE, NULL,
1428 		      ip6mr_rtm_dumproute, NULL);
1429 	return 0;
1430 #ifdef CONFIG_IPV6_PIMSM_V2
1431 add_proto_fail:
1432 	unregister_netdevice_notifier(&ip6_mr_notifier);
1433 #endif
1434 reg_notif_fail:
1435 	unregister_pernet_subsys(&ip6mr_net_ops);
1436 reg_pernet_fail:
1437 	kmem_cache_destroy(mrt_cachep);
1438 	return err;
1439 }
1440 
1441 void ip6_mr_cleanup(void)
1442 {
1443 	rtnl_unregister(RTNL_FAMILY_IP6MR, RTM_GETROUTE);
1444 #ifdef CONFIG_IPV6_PIMSM_V2
1445 	inet6_del_protocol(&pim6_protocol, IPPROTO_PIM);
1446 #endif
1447 	unregister_netdevice_notifier(&ip6_mr_notifier);
1448 	unregister_pernet_subsys(&ip6mr_net_ops);
1449 	kmem_cache_destroy(mrt_cachep);
1450 }
1451 
1452 static int ip6mr_mfc_add(struct net *net, struct mr6_table *mrt,
1453 			 struct mf6cctl *mfc, int mrtsock, int parent)
1454 {
1455 	bool found = false;
1456 	int line;
1457 	struct mfc6_cache *uc, *c;
1458 	unsigned char ttls[MAXMIFS];
1459 	int i;
1460 
1461 	if (mfc->mf6cc_parent >= MAXMIFS)
1462 		return -ENFILE;
1463 
1464 	memset(ttls, 255, MAXMIFS);
1465 	for (i = 0; i < MAXMIFS; i++) {
1466 		if (IF_ISSET(i, &mfc->mf6cc_ifset))
1467 			ttls[i] = 1;
1468 
1469 	}
1470 
1471 	line = MFC6_HASH(&mfc->mf6cc_mcastgrp.sin6_addr, &mfc->mf6cc_origin.sin6_addr);
1472 
1473 	list_for_each_entry(c, &mrt->mfc6_cache_array[line], list) {
1474 		if (ipv6_addr_equal(&c->mf6c_origin, &mfc->mf6cc_origin.sin6_addr) &&
1475 		    ipv6_addr_equal(&c->mf6c_mcastgrp,
1476 				    &mfc->mf6cc_mcastgrp.sin6_addr) &&
1477 		    (parent == -1 || parent == mfc->mf6cc_parent)) {
1478 			found = true;
1479 			break;
1480 		}
1481 	}
1482 
1483 	if (found) {
1484 		write_lock_bh(&mrt_lock);
1485 		c->mf6c_parent = mfc->mf6cc_parent;
1486 		ip6mr_update_thresholds(mrt, c, ttls);
1487 		if (!mrtsock)
1488 			c->mfc_flags |= MFC_STATIC;
1489 		write_unlock_bh(&mrt_lock);
1490 		mr6_netlink_event(mrt, c, RTM_NEWROUTE);
1491 		return 0;
1492 	}
1493 
1494 	if (!ipv6_addr_any(&mfc->mf6cc_mcastgrp.sin6_addr) &&
1495 	    !ipv6_addr_is_multicast(&mfc->mf6cc_mcastgrp.sin6_addr))
1496 		return -EINVAL;
1497 
1498 	c = ip6mr_cache_alloc();
1499 	if (!c)
1500 		return -ENOMEM;
1501 
1502 	c->mf6c_origin = mfc->mf6cc_origin.sin6_addr;
1503 	c->mf6c_mcastgrp = mfc->mf6cc_mcastgrp.sin6_addr;
1504 	c->mf6c_parent = mfc->mf6cc_parent;
1505 	ip6mr_update_thresholds(mrt, c, ttls);
1506 	if (!mrtsock)
1507 		c->mfc_flags |= MFC_STATIC;
1508 
1509 	write_lock_bh(&mrt_lock);
1510 	list_add(&c->list, &mrt->mfc6_cache_array[line]);
1511 	write_unlock_bh(&mrt_lock);
1512 
1513 	/*
1514 	 *	Check to see if we resolved a queued list. If so we
1515 	 *	need to send on the frames and tidy up.
1516 	 */
1517 	found = false;
1518 	spin_lock_bh(&mfc_unres_lock);
1519 	list_for_each_entry(uc, &mrt->mfc6_unres_queue, list) {
1520 		if (ipv6_addr_equal(&uc->mf6c_origin, &c->mf6c_origin) &&
1521 		    ipv6_addr_equal(&uc->mf6c_mcastgrp, &c->mf6c_mcastgrp)) {
1522 			list_del(&uc->list);
1523 			atomic_dec(&mrt->cache_resolve_queue_len);
1524 			found = true;
1525 			break;
1526 		}
1527 	}
1528 	if (list_empty(&mrt->mfc6_unres_queue))
1529 		del_timer(&mrt->ipmr_expire_timer);
1530 	spin_unlock_bh(&mfc_unres_lock);
1531 
1532 	if (found) {
1533 		ip6mr_cache_resolve(net, mrt, uc, c);
1534 		ip6mr_cache_free(uc);
1535 	}
1536 	mr6_netlink_event(mrt, c, RTM_NEWROUTE);
1537 	return 0;
1538 }
1539 
1540 /*
1541  *	Close the multicast socket, and clear the vif tables etc
1542  */
1543 
1544 static void mroute_clean_tables(struct mr6_table *mrt, bool all)
1545 {
1546 	int i;
1547 	LIST_HEAD(list);
1548 	struct mfc6_cache *c, *next;
1549 
1550 	/*
1551 	 *	Shut down all active vif entries
1552 	 */
1553 	for (i = 0; i < mrt->maxvif; i++) {
1554 		if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC))
1555 			continue;
1556 		mif6_delete(mrt, i, 0, &list);
1557 	}
1558 	unregister_netdevice_many(&list);
1559 
1560 	/*
1561 	 *	Wipe the cache
1562 	 */
1563 	for (i = 0; i < MFC6_LINES; i++) {
1564 		list_for_each_entry_safe(c, next, &mrt->mfc6_cache_array[i], list) {
1565 			if (!all && (c->mfc_flags & MFC_STATIC))
1566 				continue;
1567 			write_lock_bh(&mrt_lock);
1568 			list_del(&c->list);
1569 			write_unlock_bh(&mrt_lock);
1570 
1571 			mr6_netlink_event(mrt, c, RTM_DELROUTE);
1572 			ip6mr_cache_free(c);
1573 		}
1574 	}
1575 
1576 	if (atomic_read(&mrt->cache_resolve_queue_len) != 0) {
1577 		spin_lock_bh(&mfc_unres_lock);
1578 		list_for_each_entry_safe(c, next, &mrt->mfc6_unres_queue, list) {
1579 			list_del(&c->list);
1580 			mr6_netlink_event(mrt, c, RTM_DELROUTE);
1581 			ip6mr_destroy_unres(mrt, c);
1582 		}
1583 		spin_unlock_bh(&mfc_unres_lock);
1584 	}
1585 }
1586 
1587 static int ip6mr_sk_init(struct mr6_table *mrt, struct sock *sk)
1588 {
1589 	int err = 0;
1590 	struct net *net = sock_net(sk);
1591 
1592 	rtnl_lock();
1593 	write_lock_bh(&mrt_lock);
1594 	if (likely(mrt->mroute6_sk == NULL)) {
1595 		mrt->mroute6_sk = sk;
1596 		net->ipv6.devconf_all->mc_forwarding++;
1597 	} else {
1598 		err = -EADDRINUSE;
1599 	}
1600 	write_unlock_bh(&mrt_lock);
1601 
1602 	if (!err)
1603 		inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
1604 					     NETCONFA_MC_FORWARDING,
1605 					     NETCONFA_IFINDEX_ALL,
1606 					     net->ipv6.devconf_all);
1607 	rtnl_unlock();
1608 
1609 	return err;
1610 }
1611 
1612 int ip6mr_sk_done(struct sock *sk)
1613 {
1614 	int err = -EACCES;
1615 	struct net *net = sock_net(sk);
1616 	struct mr6_table *mrt;
1617 
1618 	rtnl_lock();
1619 	ip6mr_for_each_table(mrt, net) {
1620 		if (sk == mrt->mroute6_sk) {
1621 			write_lock_bh(&mrt_lock);
1622 			mrt->mroute6_sk = NULL;
1623 			net->ipv6.devconf_all->mc_forwarding--;
1624 			write_unlock_bh(&mrt_lock);
1625 			inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
1626 						     NETCONFA_MC_FORWARDING,
1627 						     NETCONFA_IFINDEX_ALL,
1628 						     net->ipv6.devconf_all);
1629 
1630 			mroute_clean_tables(mrt, false);
1631 			err = 0;
1632 			break;
1633 		}
1634 	}
1635 	rtnl_unlock();
1636 
1637 	return err;
1638 }
1639 
1640 struct sock *mroute6_socket(struct net *net, struct sk_buff *skb)
1641 {
1642 	struct mr6_table *mrt;
1643 	struct flowi6 fl6 = {
1644 		.flowi6_iif	= skb->skb_iif ? : LOOPBACK_IFINDEX,
1645 		.flowi6_oif	= skb->dev->ifindex,
1646 		.flowi6_mark	= skb->mark,
1647 	};
1648 
1649 	if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0)
1650 		return NULL;
1651 
1652 	return mrt->mroute6_sk;
1653 }
1654 
1655 /*
1656  *	Socket options and virtual interface manipulation. The whole
1657  *	virtual interface system is a complete heap, but unfortunately
1658  *	that's how BSD mrouted happens to think. Maybe one day with a proper
1659  *	MOSPF/PIM router set up we can clean this up.
1660  */
1661 
1662 int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsigned int optlen)
1663 {
1664 	int ret, parent = 0;
1665 	struct mif6ctl vif;
1666 	struct mf6cctl mfc;
1667 	mifi_t mifi;
1668 	struct net *net = sock_net(sk);
1669 	struct mr6_table *mrt;
1670 
1671 	if (sk->sk_type != SOCK_RAW ||
1672 	    inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
1673 		return -EOPNOTSUPP;
1674 
1675 	mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
1676 	if (!mrt)
1677 		return -ENOENT;
1678 
1679 	if (optname != MRT6_INIT) {
1680 		if (sk != mrt->mroute6_sk && !ns_capable(net->user_ns, CAP_NET_ADMIN))
1681 			return -EACCES;
1682 	}
1683 
1684 	switch (optname) {
1685 	case MRT6_INIT:
1686 		if (optlen < sizeof(int))
1687 			return -EINVAL;
1688 
1689 		return ip6mr_sk_init(mrt, sk);
1690 
1691 	case MRT6_DONE:
1692 		return ip6mr_sk_done(sk);
1693 
1694 	case MRT6_ADD_MIF:
1695 		if (optlen < sizeof(vif))
1696 			return -EINVAL;
1697 		if (copy_from_user(&vif, optval, sizeof(vif)))
1698 			return -EFAULT;
1699 		if (vif.mif6c_mifi >= MAXMIFS)
1700 			return -ENFILE;
1701 		rtnl_lock();
1702 		ret = mif6_add(net, mrt, &vif, sk == mrt->mroute6_sk);
1703 		rtnl_unlock();
1704 		return ret;
1705 
1706 	case MRT6_DEL_MIF:
1707 		if (optlen < sizeof(mifi_t))
1708 			return -EINVAL;
1709 		if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
1710 			return -EFAULT;
1711 		rtnl_lock();
1712 		ret = mif6_delete(mrt, mifi, 0, NULL);
1713 		rtnl_unlock();
1714 		return ret;
1715 
1716 	/*
1717 	 *	Manipulate the forwarding caches. These live
1718 	 *	in a sort of kernel/user symbiosis.
1719 	 */
1720 	case MRT6_ADD_MFC:
1721 	case MRT6_DEL_MFC:
1722 		parent = -1;
1723 	case MRT6_ADD_MFC_PROXY:
1724 	case MRT6_DEL_MFC_PROXY:
1725 		if (optlen < sizeof(mfc))
1726 			return -EINVAL;
1727 		if (copy_from_user(&mfc, optval, sizeof(mfc)))
1728 			return -EFAULT;
1729 		if (parent == 0)
1730 			parent = mfc.mf6cc_parent;
1731 		rtnl_lock();
1732 		if (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY)
1733 			ret = ip6mr_mfc_delete(mrt, &mfc, parent);
1734 		else
1735 			ret = ip6mr_mfc_add(net, mrt, &mfc,
1736 					    sk == mrt->mroute6_sk, parent);
1737 		rtnl_unlock();
1738 		return ret;
1739 
1740 	/*
1741 	 *	Control PIM assert (to activate pim will activate assert)
1742 	 */
1743 	case MRT6_ASSERT:
1744 	{
1745 		int v;
1746 
1747 		if (optlen != sizeof(v))
1748 			return -EINVAL;
1749 		if (get_user(v, (int __user *)optval))
1750 			return -EFAULT;
1751 		mrt->mroute_do_assert = v;
1752 		return 0;
1753 	}
1754 
1755 #ifdef CONFIG_IPV6_PIMSM_V2
1756 	case MRT6_PIM:
1757 	{
1758 		int v;
1759 
1760 		if (optlen != sizeof(v))
1761 			return -EINVAL;
1762 		if (get_user(v, (int __user *)optval))
1763 			return -EFAULT;
1764 		v = !!v;
1765 		rtnl_lock();
1766 		ret = 0;
1767 		if (v != mrt->mroute_do_pim) {
1768 			mrt->mroute_do_pim = v;
1769 			mrt->mroute_do_assert = v;
1770 		}
1771 		rtnl_unlock();
1772 		return ret;
1773 	}
1774 
1775 #endif
1776 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
1777 	case MRT6_TABLE:
1778 	{
1779 		u32 v;
1780 
1781 		if (optlen != sizeof(u32))
1782 			return -EINVAL;
1783 		if (get_user(v, (u32 __user *)optval))
1784 			return -EFAULT;
1785 		/* "pim6reg%u" should not exceed 16 bytes (IFNAMSIZ) */
1786 		if (v != RT_TABLE_DEFAULT && v >= 100000000)
1787 			return -EINVAL;
1788 		if (sk == mrt->mroute6_sk)
1789 			return -EBUSY;
1790 
1791 		rtnl_lock();
1792 		ret = 0;
1793 		if (!ip6mr_new_table(net, v))
1794 			ret = -ENOMEM;
1795 		raw6_sk(sk)->ip6mr_table = v;
1796 		rtnl_unlock();
1797 		return ret;
1798 	}
1799 #endif
1800 	/*
1801 	 *	Spurious command, or MRT6_VERSION which you cannot
1802 	 *	set.
1803 	 */
1804 	default:
1805 		return -ENOPROTOOPT;
1806 	}
1807 }
1808 
1809 /*
1810  *	Getsock opt support for the multicast routing system.
1811  */
1812 
1813 int ip6_mroute_getsockopt(struct sock *sk, int optname, char __user *optval,
1814 			  int __user *optlen)
1815 {
1816 	int olr;
1817 	int val;
1818 	struct net *net = sock_net(sk);
1819 	struct mr6_table *mrt;
1820 
1821 	if (sk->sk_type != SOCK_RAW ||
1822 	    inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
1823 		return -EOPNOTSUPP;
1824 
1825 	mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
1826 	if (!mrt)
1827 		return -ENOENT;
1828 
1829 	switch (optname) {
1830 	case MRT6_VERSION:
1831 		val = 0x0305;
1832 		break;
1833 #ifdef CONFIG_IPV6_PIMSM_V2
1834 	case MRT6_PIM:
1835 		val = mrt->mroute_do_pim;
1836 		break;
1837 #endif
1838 	case MRT6_ASSERT:
1839 		val = mrt->mroute_do_assert;
1840 		break;
1841 	default:
1842 		return -ENOPROTOOPT;
1843 	}
1844 
1845 	if (get_user(olr, optlen))
1846 		return -EFAULT;
1847 
1848 	olr = min_t(int, olr, sizeof(int));
1849 	if (olr < 0)
1850 		return -EINVAL;
1851 
1852 	if (put_user(olr, optlen))
1853 		return -EFAULT;
1854 	if (copy_to_user(optval, &val, olr))
1855 		return -EFAULT;
1856 	return 0;
1857 }
1858 
1859 /*
1860  *	The IP multicast ioctl support routines.
1861  */
1862 
1863 int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg)
1864 {
1865 	struct sioc_sg_req6 sr;
1866 	struct sioc_mif_req6 vr;
1867 	struct mif_device *vif;
1868 	struct mfc6_cache *c;
1869 	struct net *net = sock_net(sk);
1870 	struct mr6_table *mrt;
1871 
1872 	mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
1873 	if (!mrt)
1874 		return -ENOENT;
1875 
1876 	switch (cmd) {
1877 	case SIOCGETMIFCNT_IN6:
1878 		if (copy_from_user(&vr, arg, sizeof(vr)))
1879 			return -EFAULT;
1880 		if (vr.mifi >= mrt->maxvif)
1881 			return -EINVAL;
1882 		read_lock(&mrt_lock);
1883 		vif = &mrt->vif6_table[vr.mifi];
1884 		if (MIF_EXISTS(mrt, vr.mifi)) {
1885 			vr.icount = vif->pkt_in;
1886 			vr.ocount = vif->pkt_out;
1887 			vr.ibytes = vif->bytes_in;
1888 			vr.obytes = vif->bytes_out;
1889 			read_unlock(&mrt_lock);
1890 
1891 			if (copy_to_user(arg, &vr, sizeof(vr)))
1892 				return -EFAULT;
1893 			return 0;
1894 		}
1895 		read_unlock(&mrt_lock);
1896 		return -EADDRNOTAVAIL;
1897 	case SIOCGETSGCNT_IN6:
1898 		if (copy_from_user(&sr, arg, sizeof(sr)))
1899 			return -EFAULT;
1900 
1901 		read_lock(&mrt_lock);
1902 		c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr);
1903 		if (c) {
1904 			sr.pktcnt = c->mfc_un.res.pkt;
1905 			sr.bytecnt = c->mfc_un.res.bytes;
1906 			sr.wrong_if = c->mfc_un.res.wrong_if;
1907 			read_unlock(&mrt_lock);
1908 
1909 			if (copy_to_user(arg, &sr, sizeof(sr)))
1910 				return -EFAULT;
1911 			return 0;
1912 		}
1913 		read_unlock(&mrt_lock);
1914 		return -EADDRNOTAVAIL;
1915 	default:
1916 		return -ENOIOCTLCMD;
1917 	}
1918 }
1919 
1920 #ifdef CONFIG_COMPAT
1921 struct compat_sioc_sg_req6 {
1922 	struct sockaddr_in6 src;
1923 	struct sockaddr_in6 grp;
1924 	compat_ulong_t pktcnt;
1925 	compat_ulong_t bytecnt;
1926 	compat_ulong_t wrong_if;
1927 };
1928 
1929 struct compat_sioc_mif_req6 {
1930 	mifi_t	mifi;
1931 	compat_ulong_t icount;
1932 	compat_ulong_t ocount;
1933 	compat_ulong_t ibytes;
1934 	compat_ulong_t obytes;
1935 };
1936 
1937 int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
1938 {
1939 	struct compat_sioc_sg_req6 sr;
1940 	struct compat_sioc_mif_req6 vr;
1941 	struct mif_device *vif;
1942 	struct mfc6_cache *c;
1943 	struct net *net = sock_net(sk);
1944 	struct mr6_table *mrt;
1945 
1946 	mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
1947 	if (!mrt)
1948 		return -ENOENT;
1949 
1950 	switch (cmd) {
1951 	case SIOCGETMIFCNT_IN6:
1952 		if (copy_from_user(&vr, arg, sizeof(vr)))
1953 			return -EFAULT;
1954 		if (vr.mifi >= mrt->maxvif)
1955 			return -EINVAL;
1956 		read_lock(&mrt_lock);
1957 		vif = &mrt->vif6_table[vr.mifi];
1958 		if (MIF_EXISTS(mrt, vr.mifi)) {
1959 			vr.icount = vif->pkt_in;
1960 			vr.ocount = vif->pkt_out;
1961 			vr.ibytes = vif->bytes_in;
1962 			vr.obytes = vif->bytes_out;
1963 			read_unlock(&mrt_lock);
1964 
1965 			if (copy_to_user(arg, &vr, sizeof(vr)))
1966 				return -EFAULT;
1967 			return 0;
1968 		}
1969 		read_unlock(&mrt_lock);
1970 		return -EADDRNOTAVAIL;
1971 	case SIOCGETSGCNT_IN6:
1972 		if (copy_from_user(&sr, arg, sizeof(sr)))
1973 			return -EFAULT;
1974 
1975 		read_lock(&mrt_lock);
1976 		c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr);
1977 		if (c) {
1978 			sr.pktcnt = c->mfc_un.res.pkt;
1979 			sr.bytecnt = c->mfc_un.res.bytes;
1980 			sr.wrong_if = c->mfc_un.res.wrong_if;
1981 			read_unlock(&mrt_lock);
1982 
1983 			if (copy_to_user(arg, &sr, sizeof(sr)))
1984 				return -EFAULT;
1985 			return 0;
1986 		}
1987 		read_unlock(&mrt_lock);
1988 		return -EADDRNOTAVAIL;
1989 	default:
1990 		return -ENOIOCTLCMD;
1991 	}
1992 }
1993 #endif
1994 
1995 static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
1996 {
1997 	__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
1998 			IPSTATS_MIB_OUTFORWDATAGRAMS);
1999 	__IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)),
2000 			IPSTATS_MIB_OUTOCTETS, skb->len);
2001 	return dst_output(net, sk, skb);
2002 }
2003 
2004 /*
2005  *	Processing handlers for ip6mr_forward
2006  */
2007 
2008 static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
2009 			  struct sk_buff *skb, struct mfc6_cache *c, int vifi)
2010 {
2011 	struct ipv6hdr *ipv6h;
2012 	struct mif_device *vif = &mrt->vif6_table[vifi];
2013 	struct net_device *dev;
2014 	struct dst_entry *dst;
2015 	struct flowi6 fl6;
2016 
2017 	if (!vif->dev)
2018 		goto out_free;
2019 
2020 #ifdef CONFIG_IPV6_PIMSM_V2
2021 	if (vif->flags & MIFF_REGISTER) {
2022 		vif->pkt_out++;
2023 		vif->bytes_out += skb->len;
2024 		vif->dev->stats.tx_bytes += skb->len;
2025 		vif->dev->stats.tx_packets++;
2026 		ip6mr_cache_report(mrt, skb, vifi, MRT6MSG_WHOLEPKT);
2027 		goto out_free;
2028 	}
2029 #endif
2030 
2031 	ipv6h = ipv6_hdr(skb);
2032 
2033 	fl6 = (struct flowi6) {
2034 		.flowi6_oif = vif->link,
2035 		.daddr = ipv6h->daddr,
2036 	};
2037 
2038 	dst = ip6_route_output(net, NULL, &fl6);
2039 	if (dst->error) {
2040 		dst_release(dst);
2041 		goto out_free;
2042 	}
2043 
2044 	skb_dst_drop(skb);
2045 	skb_dst_set(skb, dst);
2046 
2047 	/*
2048 	 * RFC1584 teaches, that DVMRP/PIM router must deliver packets locally
2049 	 * not only before forwarding, but after forwarding on all output
2050 	 * interfaces. It is clear, if mrouter runs a multicasting
2051 	 * program, it should receive packets not depending to what interface
2052 	 * program is joined.
2053 	 * If we will not make it, the program will have to join on all
2054 	 * interfaces. On the other hand, multihoming host (or router, but
2055 	 * not mrouter) cannot join to more than one interface - it will
2056 	 * result in receiving multiple packets.
2057 	 */
2058 	dev = vif->dev;
2059 	skb->dev = dev;
2060 	vif->pkt_out++;
2061 	vif->bytes_out += skb->len;
2062 
2063 	/* We are about to write */
2064 	/* XXX: extension headers? */
2065 	if (skb_cow(skb, sizeof(*ipv6h) + LL_RESERVED_SPACE(dev)))
2066 		goto out_free;
2067 
2068 	ipv6h = ipv6_hdr(skb);
2069 	ipv6h->hop_limit--;
2070 
2071 	IP6CB(skb)->flags |= IP6SKB_FORWARDED;
2072 
2073 	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
2074 		       net, NULL, skb, skb->dev, dev,
2075 		       ip6mr_forward2_finish);
2076 
2077 out_free:
2078 	kfree_skb(skb);
2079 	return 0;
2080 }
2081 
2082 static int ip6mr_find_vif(struct mr6_table *mrt, struct net_device *dev)
2083 {
2084 	int ct;
2085 
2086 	for (ct = mrt->maxvif - 1; ct >= 0; ct--) {
2087 		if (mrt->vif6_table[ct].dev == dev)
2088 			break;
2089 	}
2090 	return ct;
2091 }
2092 
2093 static void ip6_mr_forward(struct net *net, struct mr6_table *mrt,
2094 			   struct sk_buff *skb, struct mfc6_cache *cache)
2095 {
2096 	int psend = -1;
2097 	int vif, ct;
2098 	int true_vifi = ip6mr_find_vif(mrt, skb->dev);
2099 
2100 	vif = cache->mf6c_parent;
2101 	cache->mfc_un.res.pkt++;
2102 	cache->mfc_un.res.bytes += skb->len;
2103 	cache->mfc_un.res.lastuse = jiffies;
2104 
2105 	if (ipv6_addr_any(&cache->mf6c_origin) && true_vifi >= 0) {
2106 		struct mfc6_cache *cache_proxy;
2107 
2108 		/* For an (*,G) entry, we only check that the incoming
2109 		 * interface is part of the static tree.
2110 		 */
2111 		cache_proxy = ip6mr_cache_find_any_parent(mrt, vif);
2112 		if (cache_proxy &&
2113 		    cache_proxy->mfc_un.res.ttls[true_vifi] < 255)
2114 			goto forward;
2115 	}
2116 
2117 	/*
2118 	 * Wrong interface: drop packet and (maybe) send PIM assert.
2119 	 */
2120 	if (mrt->vif6_table[vif].dev != skb->dev) {
2121 		cache->mfc_un.res.wrong_if++;
2122 
2123 		if (true_vifi >= 0 && mrt->mroute_do_assert &&
2124 		    /* pimsm uses asserts, when switching from RPT to SPT,
2125 		       so that we cannot check that packet arrived on an oif.
2126 		       It is bad, but otherwise we would need to move pretty
2127 		       large chunk of pimd to kernel. Ough... --ANK
2128 		     */
2129 		    (mrt->mroute_do_pim ||
2130 		     cache->mfc_un.res.ttls[true_vifi] < 255) &&
2131 		    time_after(jiffies,
2132 			       cache->mfc_un.res.last_assert + MFC_ASSERT_THRESH)) {
2133 			cache->mfc_un.res.last_assert = jiffies;
2134 			ip6mr_cache_report(mrt, skb, true_vifi, MRT6MSG_WRONGMIF);
2135 		}
2136 		goto dont_forward;
2137 	}
2138 
2139 forward:
2140 	mrt->vif6_table[vif].pkt_in++;
2141 	mrt->vif6_table[vif].bytes_in += skb->len;
2142 
2143 	/*
2144 	 *	Forward the frame
2145 	 */
2146 	if (ipv6_addr_any(&cache->mf6c_origin) &&
2147 	    ipv6_addr_any(&cache->mf6c_mcastgrp)) {
2148 		if (true_vifi >= 0 &&
2149 		    true_vifi != cache->mf6c_parent &&
2150 		    ipv6_hdr(skb)->hop_limit >
2151 				cache->mfc_un.res.ttls[cache->mf6c_parent]) {
2152 			/* It's an (*,*) entry and the packet is not coming from
2153 			 * the upstream: forward the packet to the upstream
2154 			 * only.
2155 			 */
2156 			psend = cache->mf6c_parent;
2157 			goto last_forward;
2158 		}
2159 		goto dont_forward;
2160 	}
2161 	for (ct = cache->mfc_un.res.maxvif - 1; ct >= cache->mfc_un.res.minvif; ct--) {
2162 		/* For (*,G) entry, don't forward to the incoming interface */
2163 		if ((!ipv6_addr_any(&cache->mf6c_origin) || ct != true_vifi) &&
2164 		    ipv6_hdr(skb)->hop_limit > cache->mfc_un.res.ttls[ct]) {
2165 			if (psend != -1) {
2166 				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
2167 				if (skb2)
2168 					ip6mr_forward2(net, mrt, skb2, cache, psend);
2169 			}
2170 			psend = ct;
2171 		}
2172 	}
2173 last_forward:
2174 	if (psend != -1) {
2175 		ip6mr_forward2(net, mrt, skb, cache, psend);
2176 		return;
2177 	}
2178 
2179 dont_forward:
2180 	kfree_skb(skb);
2181 }
2182 
2183 
2184 /*
2185  *	Multicast packets for forwarding arrive here
2186  */
2187 
2188 int ip6_mr_input(struct sk_buff *skb)
2189 {
2190 	struct mfc6_cache *cache;
2191 	struct net *net = dev_net(skb->dev);
2192 	struct mr6_table *mrt;
2193 	struct flowi6 fl6 = {
2194 		.flowi6_iif	= skb->dev->ifindex,
2195 		.flowi6_mark	= skb->mark,
2196 	};
2197 	int err;
2198 
2199 	err = ip6mr_fib_lookup(net, &fl6, &mrt);
2200 	if (err < 0) {
2201 		kfree_skb(skb);
2202 		return err;
2203 	}
2204 
2205 	read_lock(&mrt_lock);
2206 	cache = ip6mr_cache_find(mrt,
2207 				 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr);
2208 	if (!cache) {
2209 		int vif = ip6mr_find_vif(mrt, skb->dev);
2210 
2211 		if (vif >= 0)
2212 			cache = ip6mr_cache_find_any(mrt,
2213 						     &ipv6_hdr(skb)->daddr,
2214 						     vif);
2215 	}
2216 
2217 	/*
2218 	 *	No usable cache entry
2219 	 */
2220 	if (!cache) {
2221 		int vif;
2222 
2223 		vif = ip6mr_find_vif(mrt, skb->dev);
2224 		if (vif >= 0) {
2225 			int err = ip6mr_cache_unresolved(mrt, vif, skb);
2226 			read_unlock(&mrt_lock);
2227 
2228 			return err;
2229 		}
2230 		read_unlock(&mrt_lock);
2231 		kfree_skb(skb);
2232 		return -ENODEV;
2233 	}
2234 
2235 	ip6_mr_forward(net, mrt, skb, cache);
2236 
2237 	read_unlock(&mrt_lock);
2238 
2239 	return 0;
2240 }
2241 
2242 
2243 static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
2244 			       struct mfc6_cache *c, struct rtmsg *rtm)
2245 {
2246 	struct rta_mfc_stats mfcs;
2247 	struct nlattr *mp_attr;
2248 	struct rtnexthop *nhp;
2249 	unsigned long lastuse;
2250 	int ct;
2251 
2252 	/* If cache is unresolved, don't try to parse IIF and OIF */
2253 	if (c->mf6c_parent >= MAXMIFS) {
2254 		rtm->rtm_flags |= RTNH_F_UNRESOLVED;
2255 		return -ENOENT;
2256 	}
2257 
2258 	if (MIF_EXISTS(mrt, c->mf6c_parent) &&
2259 	    nla_put_u32(skb, RTA_IIF, mrt->vif6_table[c->mf6c_parent].dev->ifindex) < 0)
2260 		return -EMSGSIZE;
2261 	mp_attr = nla_nest_start(skb, RTA_MULTIPATH);
2262 	if (!mp_attr)
2263 		return -EMSGSIZE;
2264 
2265 	for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
2266 		if (MIF_EXISTS(mrt, ct) && c->mfc_un.res.ttls[ct] < 255) {
2267 			nhp = nla_reserve_nohdr(skb, sizeof(*nhp));
2268 			if (!nhp) {
2269 				nla_nest_cancel(skb, mp_attr);
2270 				return -EMSGSIZE;
2271 			}
2272 
2273 			nhp->rtnh_flags = 0;
2274 			nhp->rtnh_hops = c->mfc_un.res.ttls[ct];
2275 			nhp->rtnh_ifindex = mrt->vif6_table[ct].dev->ifindex;
2276 			nhp->rtnh_len = sizeof(*nhp);
2277 		}
2278 	}
2279 
2280 	nla_nest_end(skb, mp_attr);
2281 
2282 	lastuse = READ_ONCE(c->mfc_un.res.lastuse);
2283 	lastuse = time_after_eq(jiffies, lastuse) ? jiffies - lastuse : 0;
2284 
2285 	mfcs.mfcs_packets = c->mfc_un.res.pkt;
2286 	mfcs.mfcs_bytes = c->mfc_un.res.bytes;
2287 	mfcs.mfcs_wrong_if = c->mfc_un.res.wrong_if;
2288 	if (nla_put_64bit(skb, RTA_MFC_STATS, sizeof(mfcs), &mfcs, RTA_PAD) ||
2289 	    nla_put_u64_64bit(skb, RTA_EXPIRES, jiffies_to_clock_t(lastuse),
2290 			      RTA_PAD))
2291 		return -EMSGSIZE;
2292 
2293 	rtm->rtm_type = RTN_MULTICAST;
2294 	return 1;
2295 }
2296 
2297 int ip6mr_get_route(struct net *net, struct sk_buff *skb, struct rtmsg *rtm,
2298 		    u32 portid)
2299 {
2300 	int err;
2301 	struct mr6_table *mrt;
2302 	struct mfc6_cache *cache;
2303 	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
2304 
2305 	mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
2306 	if (!mrt)
2307 		return -ENOENT;
2308 
2309 	read_lock(&mrt_lock);
2310 	cache = ip6mr_cache_find(mrt, &rt->rt6i_src.addr, &rt->rt6i_dst.addr);
2311 	if (!cache && skb->dev) {
2312 		int vif = ip6mr_find_vif(mrt, skb->dev);
2313 
2314 		if (vif >= 0)
2315 			cache = ip6mr_cache_find_any(mrt, &rt->rt6i_dst.addr,
2316 						     vif);
2317 	}
2318 
2319 	if (!cache) {
2320 		struct sk_buff *skb2;
2321 		struct ipv6hdr *iph;
2322 		struct net_device *dev;
2323 		int vif;
2324 
2325 		dev = skb->dev;
2326 		if (!dev || (vif = ip6mr_find_vif(mrt, dev)) < 0) {
2327 			read_unlock(&mrt_lock);
2328 			return -ENODEV;
2329 		}
2330 
2331 		/* really correct? */
2332 		skb2 = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC);
2333 		if (!skb2) {
2334 			read_unlock(&mrt_lock);
2335 			return -ENOMEM;
2336 		}
2337 
2338 		NETLINK_CB(skb2).portid = portid;
2339 		skb_reset_transport_header(skb2);
2340 
2341 		skb_put(skb2, sizeof(struct ipv6hdr));
2342 		skb_reset_network_header(skb2);
2343 
2344 		iph = ipv6_hdr(skb2);
2345 		iph->version = 0;
2346 		iph->priority = 0;
2347 		iph->flow_lbl[0] = 0;
2348 		iph->flow_lbl[1] = 0;
2349 		iph->flow_lbl[2] = 0;
2350 		iph->payload_len = 0;
2351 		iph->nexthdr = IPPROTO_NONE;
2352 		iph->hop_limit = 0;
2353 		iph->saddr = rt->rt6i_src.addr;
2354 		iph->daddr = rt->rt6i_dst.addr;
2355 
2356 		err = ip6mr_cache_unresolved(mrt, vif, skb2);
2357 		read_unlock(&mrt_lock);
2358 
2359 		return err;
2360 	}
2361 
2362 	if (rtm->rtm_flags & RTM_F_NOTIFY)
2363 		cache->mfc_flags |= MFC_NOTIFY;
2364 
2365 	err = __ip6mr_fill_mroute(mrt, skb, cache, rtm);
2366 	read_unlock(&mrt_lock);
2367 	return err;
2368 }
2369 
2370 static int ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
2371 			     u32 portid, u32 seq, struct mfc6_cache *c, int cmd,
2372 			     int flags)
2373 {
2374 	struct nlmsghdr *nlh;
2375 	struct rtmsg *rtm;
2376 	int err;
2377 
2378 	nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags);
2379 	if (!nlh)
2380 		return -EMSGSIZE;
2381 
2382 	rtm = nlmsg_data(nlh);
2383 	rtm->rtm_family   = RTNL_FAMILY_IP6MR;
2384 	rtm->rtm_dst_len  = 128;
2385 	rtm->rtm_src_len  = 128;
2386 	rtm->rtm_tos      = 0;
2387 	rtm->rtm_table    = mrt->id;
2388 	if (nla_put_u32(skb, RTA_TABLE, mrt->id))
2389 		goto nla_put_failure;
2390 	rtm->rtm_type = RTN_MULTICAST;
2391 	rtm->rtm_scope    = RT_SCOPE_UNIVERSE;
2392 	if (c->mfc_flags & MFC_STATIC)
2393 		rtm->rtm_protocol = RTPROT_STATIC;
2394 	else
2395 		rtm->rtm_protocol = RTPROT_MROUTED;
2396 	rtm->rtm_flags    = 0;
2397 
2398 	if (nla_put_in6_addr(skb, RTA_SRC, &c->mf6c_origin) ||
2399 	    nla_put_in6_addr(skb, RTA_DST, &c->mf6c_mcastgrp))
2400 		goto nla_put_failure;
2401 	err = __ip6mr_fill_mroute(mrt, skb, c, rtm);
2402 	/* do not break the dump if cache is unresolved */
2403 	if (err < 0 && err != -ENOENT)
2404 		goto nla_put_failure;
2405 
2406 	nlmsg_end(skb, nlh);
2407 	return 0;
2408 
2409 nla_put_failure:
2410 	nlmsg_cancel(skb, nlh);
2411 	return -EMSGSIZE;
2412 }
2413 
2414 static int mr6_msgsize(bool unresolved, int maxvif)
2415 {
2416 	size_t len =
2417 		NLMSG_ALIGN(sizeof(struct rtmsg))
2418 		+ nla_total_size(4)	/* RTA_TABLE */
2419 		+ nla_total_size(sizeof(struct in6_addr))	/* RTA_SRC */
2420 		+ nla_total_size(sizeof(struct in6_addr))	/* RTA_DST */
2421 		;
2422 
2423 	if (!unresolved)
2424 		len = len
2425 		      + nla_total_size(4)	/* RTA_IIF */
2426 		      + nla_total_size(0)	/* RTA_MULTIPATH */
2427 		      + maxvif * NLA_ALIGN(sizeof(struct rtnexthop))
2428 						/* RTA_MFC_STATS */
2429 		      + nla_total_size_64bit(sizeof(struct rta_mfc_stats))
2430 		;
2431 
2432 	return len;
2433 }
2434 
2435 static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc,
2436 			      int cmd)
2437 {
2438 	struct net *net = read_pnet(&mrt->net);
2439 	struct sk_buff *skb;
2440 	int err = -ENOBUFS;
2441 
2442 	skb = nlmsg_new(mr6_msgsize(mfc->mf6c_parent >= MAXMIFS, mrt->maxvif),
2443 			GFP_ATOMIC);
2444 	if (!skb)
2445 		goto errout;
2446 
2447 	err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0);
2448 	if (err < 0)
2449 		goto errout;
2450 
2451 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_MROUTE, NULL, GFP_ATOMIC);
2452 	return;
2453 
2454 errout:
2455 	kfree_skb(skb);
2456 	if (err < 0)
2457 		rtnl_set_sk_err(net, RTNLGRP_IPV6_MROUTE, err);
2458 }
2459 
2460 static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
2461 {
2462 	struct net *net = sock_net(skb->sk);
2463 	struct mr6_table *mrt;
2464 	struct mfc6_cache *mfc;
2465 	unsigned int t = 0, s_t;
2466 	unsigned int h = 0, s_h;
2467 	unsigned int e = 0, s_e;
2468 
2469 	s_t = cb->args[0];
2470 	s_h = cb->args[1];
2471 	s_e = cb->args[2];
2472 
2473 	read_lock(&mrt_lock);
2474 	ip6mr_for_each_table(mrt, net) {
2475 		if (t < s_t)
2476 			goto next_table;
2477 		if (t > s_t)
2478 			s_h = 0;
2479 		for (h = s_h; h < MFC6_LINES; h++) {
2480 			list_for_each_entry(mfc, &mrt->mfc6_cache_array[h], list) {
2481 				if (e < s_e)
2482 					goto next_entry;
2483 				if (ip6mr_fill_mroute(mrt, skb,
2484 						      NETLINK_CB(cb->skb).portid,
2485 						      cb->nlh->nlmsg_seq,
2486 						      mfc, RTM_NEWROUTE,
2487 						      NLM_F_MULTI) < 0)
2488 					goto done;
2489 next_entry:
2490 				e++;
2491 			}
2492 			e = s_e = 0;
2493 		}
2494 		spin_lock_bh(&mfc_unres_lock);
2495 		list_for_each_entry(mfc, &mrt->mfc6_unres_queue, list) {
2496 			if (e < s_e)
2497 				goto next_entry2;
2498 			if (ip6mr_fill_mroute(mrt, skb,
2499 					      NETLINK_CB(cb->skb).portid,
2500 					      cb->nlh->nlmsg_seq,
2501 					      mfc, RTM_NEWROUTE,
2502 					      NLM_F_MULTI) < 0) {
2503 				spin_unlock_bh(&mfc_unres_lock);
2504 				goto done;
2505 			}
2506 next_entry2:
2507 			e++;
2508 		}
2509 		spin_unlock_bh(&mfc_unres_lock);
2510 		e = s_e = 0;
2511 		s_h = 0;
2512 next_table:
2513 		t++;
2514 	}
2515 done:
2516 	read_unlock(&mrt_lock);
2517 
2518 	cb->args[2] = e;
2519 	cb->args[1] = h;
2520 	cb->args[0] = t;
2521 
2522 	return skb->len;
2523 }
2524