1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *	Generic address resolution entity
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
8  *
9  *	Fixes:
10  *	Vitaly E. Lavrov	releasing NULL neighbor in neigh_add.
11  *	Harald Welte		Add neighbour cache statistics like rtstat
12  */
13 
14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 
16 #include <linux/slab.h>
17 #include <linux/kmemleak.h>
18 #include <linux/types.h>
19 #include <linux/kernel.h>
20 #include <linux/module.h>
21 #include <linux/socket.h>
22 #include <linux/netdevice.h>
23 #include <linux/proc_fs.h>
24 #ifdef CONFIG_SYSCTL
25 #include <linux/sysctl.h>
26 #endif
27 #include <linux/times.h>
28 #include <net/net_namespace.h>
29 #include <net/neighbour.h>
30 #include <net/arp.h>
31 #include <net/dst.h>
32 #include <net/sock.h>
33 #include <net/netevent.h>
34 #include <net/netlink.h>
35 #include <linux/rtnetlink.h>
36 #include <linux/random.h>
37 #include <linux/string.h>
38 #include <linux/log2.h>
39 #include <linux/inetdevice.h>
40 #include <net/addrconf.h>
41 
42 #include <trace/events/neigh.h>
43 
44 #define NEIGH_DEBUG 1
45 #define neigh_dbg(level, fmt, ...)		\
46 do {						\
47 	if (level <= NEIGH_DEBUG)		\
48 		pr_debug(fmt, ##__VA_ARGS__);	\
49 } while (0)
50 
51 #define PNEIGH_HASHMASK		0xF
52 
53 static void neigh_timer_handler(struct timer_list *t);
54 static void __neigh_notify(struct neighbour *n, int type, int flags,
55 			   u32 pid);
56 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
57 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
58 				    struct net_device *dev);
59 
60 #ifdef CONFIG_PROC_FS
61 static const struct seq_operations neigh_stat_seq_ops;
62 #endif
63 
64 /*
65    Neighbour hash table buckets are protected with rwlock tbl->lock.
66 
67    - All the scans/updates to hash buckets MUST be made under this lock.
68    - NOTHING clever should be made under this lock: no callbacks
69      to protocol backends, no attempts to send something to network.
70      It will result in deadlocks, if backend/driver wants to use neighbour
71      cache.
72    - If the entry requires some non-trivial actions, increase
73      its reference count and release table lock.
74 
75    Neighbour entries are protected:
76    - with reference count.
77    - with rwlock neigh->lock
78 
79    Reference count prevents destruction.
80 
81    neigh->lock mainly serializes ll address data and its validity state.
82    However, the same lock is used to protect another entry fields:
83     - timer
84     - resolution queue
85 
86    Again, nothing clever shall be made under neigh->lock,
87    the most complicated procedure, which we allow is dev->hard_header.
88    It is supposed, that dev->hard_header is simplistic and does
89    not make callbacks to neighbour tables.
90  */
91 
neigh_blackhole(struct neighbour * neigh,struct sk_buff * skb)92 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
93 {
94 	kfree_skb(skb);
95 	return -ENETDOWN;
96 }
97 
neigh_cleanup_and_release(struct neighbour * neigh)98 static void neigh_cleanup_and_release(struct neighbour *neigh)
99 {
100 	trace_neigh_cleanup_and_release(neigh, 0);
101 	__neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
102 	call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
103 	neigh_release(neigh);
104 }
105 
106 /*
107  * It is random distribution in the interval (1/2)*base...(3/2)*base.
108  * It corresponds to default IPv6 settings and is not overridable,
109  * because it is really reasonable choice.
110  */
111 
neigh_rand_reach_time(unsigned long base)112 unsigned long neigh_rand_reach_time(unsigned long base)
113 {
114 	return base ? get_random_u32_below(base) + (base >> 1) : 0;
115 }
116 EXPORT_SYMBOL(neigh_rand_reach_time);
117 
neigh_mark_dead(struct neighbour * n)118 static void neigh_mark_dead(struct neighbour *n)
119 {
120 	n->dead = 1;
121 	if (!list_empty(&n->gc_list)) {
122 		list_del_init(&n->gc_list);
123 		atomic_dec(&n->tbl->gc_entries);
124 	}
125 	if (!list_empty(&n->managed_list))
126 		list_del_init(&n->managed_list);
127 }
128 
neigh_update_gc_list(struct neighbour * n)129 static void neigh_update_gc_list(struct neighbour *n)
130 {
131 	bool on_gc_list, exempt_from_gc;
132 
133 	write_lock_bh(&n->tbl->lock);
134 	write_lock(&n->lock);
135 	if (n->dead)
136 		goto out;
137 
138 	/* remove from the gc list if new state is permanent or if neighbor
139 	 * is externally learned; otherwise entry should be on the gc list
140 	 */
141 	exempt_from_gc = n->nud_state & NUD_PERMANENT ||
142 			 n->flags & NTF_EXT_LEARNED;
143 	on_gc_list = !list_empty(&n->gc_list);
144 
145 	if (exempt_from_gc && on_gc_list) {
146 		list_del_init(&n->gc_list);
147 		atomic_dec(&n->tbl->gc_entries);
148 	} else if (!exempt_from_gc && !on_gc_list) {
149 		/* add entries to the tail; cleaning removes from the front */
150 		list_add_tail(&n->gc_list, &n->tbl->gc_list);
151 		atomic_inc(&n->tbl->gc_entries);
152 	}
153 out:
154 	write_unlock(&n->lock);
155 	write_unlock_bh(&n->tbl->lock);
156 }
157 
neigh_update_managed_list(struct neighbour * n)158 static void neigh_update_managed_list(struct neighbour *n)
159 {
160 	bool on_managed_list, add_to_managed;
161 
162 	write_lock_bh(&n->tbl->lock);
163 	write_lock(&n->lock);
164 	if (n->dead)
165 		goto out;
166 
167 	add_to_managed = n->flags & NTF_MANAGED;
168 	on_managed_list = !list_empty(&n->managed_list);
169 
170 	if (!add_to_managed && on_managed_list)
171 		list_del_init(&n->managed_list);
172 	else if (add_to_managed && !on_managed_list)
173 		list_add_tail(&n->managed_list, &n->tbl->managed_list);
174 out:
175 	write_unlock(&n->lock);
176 	write_unlock_bh(&n->tbl->lock);
177 }
178 
neigh_update_flags(struct neighbour * neigh,u32 flags,int * notify,bool * gc_update,bool * managed_update)179 static void neigh_update_flags(struct neighbour *neigh, u32 flags, int *notify,
180 			       bool *gc_update, bool *managed_update)
181 {
182 	u32 ndm_flags, old_flags = neigh->flags;
183 
184 	if (!(flags & NEIGH_UPDATE_F_ADMIN))
185 		return;
186 
187 	ndm_flags  = (flags & NEIGH_UPDATE_F_EXT_LEARNED) ? NTF_EXT_LEARNED : 0;
188 	ndm_flags |= (flags & NEIGH_UPDATE_F_MANAGED) ? NTF_MANAGED : 0;
189 
190 	if ((old_flags ^ ndm_flags) & NTF_EXT_LEARNED) {
191 		if (ndm_flags & NTF_EXT_LEARNED)
192 			neigh->flags |= NTF_EXT_LEARNED;
193 		else
194 			neigh->flags &= ~NTF_EXT_LEARNED;
195 		*notify = 1;
196 		*gc_update = true;
197 	}
198 	if ((old_flags ^ ndm_flags) & NTF_MANAGED) {
199 		if (ndm_flags & NTF_MANAGED)
200 			neigh->flags |= NTF_MANAGED;
201 		else
202 			neigh->flags &= ~NTF_MANAGED;
203 		*notify = 1;
204 		*managed_update = true;
205 	}
206 }
207 
neigh_del(struct neighbour * n,struct neighbour __rcu ** np,struct neigh_table * tbl)208 static bool neigh_del(struct neighbour *n, struct neighbour __rcu **np,
209 		      struct neigh_table *tbl)
210 {
211 	bool retval = false;
212 
213 	write_lock(&n->lock);
214 	if (refcount_read(&n->refcnt) == 1) {
215 		struct neighbour *neigh;
216 
217 		neigh = rcu_dereference_protected(n->next,
218 						  lockdep_is_held(&tbl->lock));
219 		rcu_assign_pointer(*np, neigh);
220 		neigh_mark_dead(n);
221 		retval = true;
222 	}
223 	write_unlock(&n->lock);
224 	if (retval)
225 		neigh_cleanup_and_release(n);
226 	return retval;
227 }
228 
neigh_remove_one(struct neighbour * ndel,struct neigh_table * tbl)229 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
230 {
231 	struct neigh_hash_table *nht;
232 	void *pkey = ndel->primary_key;
233 	u32 hash_val;
234 	struct neighbour *n;
235 	struct neighbour __rcu **np;
236 
237 	nht = rcu_dereference_protected(tbl->nht,
238 					lockdep_is_held(&tbl->lock));
239 	hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
240 	hash_val = hash_val >> (32 - nht->hash_shift);
241 
242 	np = &nht->hash_buckets[hash_val];
243 	while ((n = rcu_dereference_protected(*np,
244 					      lockdep_is_held(&tbl->lock)))) {
245 		if (n == ndel)
246 			return neigh_del(n, np, tbl);
247 		np = &n->next;
248 	}
249 	return false;
250 }
251 
neigh_forced_gc(struct neigh_table * tbl)252 static int neigh_forced_gc(struct neigh_table *tbl)
253 {
254 	int max_clean = atomic_read(&tbl->gc_entries) -
255 			READ_ONCE(tbl->gc_thresh2);
256 	u64 tmax = ktime_get_ns() + NSEC_PER_MSEC;
257 	unsigned long tref = jiffies - 5 * HZ;
258 	struct neighbour *n, *tmp;
259 	int shrunk = 0;
260 	int loop = 0;
261 
262 	NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
263 
264 	write_lock_bh(&tbl->lock);
265 
266 	list_for_each_entry_safe(n, tmp, &tbl->gc_list, gc_list) {
267 		if (refcount_read(&n->refcnt) == 1) {
268 			bool remove = false;
269 
270 			write_lock(&n->lock);
271 			if ((n->nud_state == NUD_FAILED) ||
272 			    (n->nud_state == NUD_NOARP) ||
273 			    (tbl->is_multicast &&
274 			     tbl->is_multicast(n->primary_key)) ||
275 			    !time_in_range(n->updated, tref, jiffies))
276 				remove = true;
277 			write_unlock(&n->lock);
278 
279 			if (remove && neigh_remove_one(n, tbl))
280 				shrunk++;
281 			if (shrunk >= max_clean)
282 				break;
283 			if (++loop == 16) {
284 				if (ktime_get_ns() > tmax)
285 					goto unlock;
286 				loop = 0;
287 			}
288 		}
289 	}
290 
291 	WRITE_ONCE(tbl->last_flush, jiffies);
292 unlock:
293 	write_unlock_bh(&tbl->lock);
294 
295 	return shrunk;
296 }
297 
neigh_add_timer(struct neighbour * n,unsigned long when)298 static void neigh_add_timer(struct neighbour *n, unsigned long when)
299 {
300 	/* Use safe distance from the jiffies - LONG_MAX point while timer
301 	 * is running in DELAY/PROBE state but still show to user space
302 	 * large times in the past.
303 	 */
304 	unsigned long mint = jiffies - (LONG_MAX - 86400 * HZ);
305 
306 	neigh_hold(n);
307 	if (!time_in_range(n->confirmed, mint, jiffies))
308 		n->confirmed = mint;
309 	if (time_before(n->used, n->confirmed))
310 		n->used = n->confirmed;
311 	if (unlikely(mod_timer(&n->timer, when))) {
312 		printk("NEIGH: BUG, double timer add, state is %x\n",
313 		       n->nud_state);
314 		dump_stack();
315 	}
316 }
317 
neigh_del_timer(struct neighbour * n)318 static int neigh_del_timer(struct neighbour *n)
319 {
320 	if ((n->nud_state & NUD_IN_TIMER) &&
321 	    del_timer(&n->timer)) {
322 		neigh_release(n);
323 		return 1;
324 	}
325 	return 0;
326 }
327 
neigh_get_dev_parms_rcu(struct net_device * dev,int family)328 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
329 						   int family)
330 {
331 	switch (family) {
332 	case AF_INET:
333 		return __in_dev_arp_parms_get_rcu(dev);
334 	case AF_INET6:
335 		return __in6_dev_nd_parms_get_rcu(dev);
336 	}
337 	return NULL;
338 }
339 
neigh_parms_qlen_dec(struct net_device * dev,int family)340 static void neigh_parms_qlen_dec(struct net_device *dev, int family)
341 {
342 	struct neigh_parms *p;
343 
344 	rcu_read_lock();
345 	p = neigh_get_dev_parms_rcu(dev, family);
346 	if (p)
347 		p->qlen--;
348 	rcu_read_unlock();
349 }
350 
pneigh_queue_purge(struct sk_buff_head * list,struct net * net,int family)351 static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net,
352 			       int family)
353 {
354 	struct sk_buff_head tmp;
355 	unsigned long flags;
356 	struct sk_buff *skb;
357 
358 	skb_queue_head_init(&tmp);
359 	spin_lock_irqsave(&list->lock, flags);
360 	skb = skb_peek(list);
361 	while (skb != NULL) {
362 		struct sk_buff *skb_next = skb_peek_next(skb, list);
363 		struct net_device *dev = skb->dev;
364 
365 		if (net == NULL || net_eq(dev_net(dev), net)) {
366 			neigh_parms_qlen_dec(dev, family);
367 			__skb_unlink(skb, list);
368 			__skb_queue_tail(&tmp, skb);
369 		}
370 		skb = skb_next;
371 	}
372 	spin_unlock_irqrestore(&list->lock, flags);
373 
374 	while ((skb = __skb_dequeue(&tmp))) {
375 		dev_put(skb->dev);
376 		kfree_skb(skb);
377 	}
378 }
379 
neigh_flush_dev(struct neigh_table * tbl,struct net_device * dev,bool skip_perm)380 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev,
381 			    bool skip_perm)
382 {
383 	int i;
384 	struct neigh_hash_table *nht;
385 
386 	nht = rcu_dereference_protected(tbl->nht,
387 					lockdep_is_held(&tbl->lock));
388 
389 	for (i = 0; i < (1 << nht->hash_shift); i++) {
390 		struct neighbour *n;
391 		struct neighbour __rcu **np = &nht->hash_buckets[i];
392 
393 		while ((n = rcu_dereference_protected(*np,
394 					lockdep_is_held(&tbl->lock))) != NULL) {
395 			if (dev && n->dev != dev) {
396 				np = &n->next;
397 				continue;
398 			}
399 			if (skip_perm && n->nud_state & NUD_PERMANENT) {
400 				np = &n->next;
401 				continue;
402 			}
403 			rcu_assign_pointer(*np,
404 				   rcu_dereference_protected(n->next,
405 						lockdep_is_held(&tbl->lock)));
406 			write_lock(&n->lock);
407 			neigh_del_timer(n);
408 			neigh_mark_dead(n);
409 			if (refcount_read(&n->refcnt) != 1) {
410 				/* The most unpleasant situation.
411 				   We must destroy neighbour entry,
412 				   but someone still uses it.
413 
414 				   The destroy will be delayed until
415 				   the last user releases us, but
416 				   we must kill timers etc. and move
417 				   it to safe state.
418 				 */
419 				__skb_queue_purge(&n->arp_queue);
420 				n->arp_queue_len_bytes = 0;
421 				WRITE_ONCE(n->output, neigh_blackhole);
422 				if (n->nud_state & NUD_VALID)
423 					n->nud_state = NUD_NOARP;
424 				else
425 					n->nud_state = NUD_NONE;
426 				neigh_dbg(2, "neigh %p is stray\n", n);
427 			}
428 			write_unlock(&n->lock);
429 			neigh_cleanup_and_release(n);
430 		}
431 	}
432 }
433 
neigh_changeaddr(struct neigh_table * tbl,struct net_device * dev)434 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
435 {
436 	write_lock_bh(&tbl->lock);
437 	neigh_flush_dev(tbl, dev, false);
438 	write_unlock_bh(&tbl->lock);
439 }
440 EXPORT_SYMBOL(neigh_changeaddr);
441 
__neigh_ifdown(struct neigh_table * tbl,struct net_device * dev,bool skip_perm)442 static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
443 			  bool skip_perm)
444 {
445 	write_lock_bh(&tbl->lock);
446 	neigh_flush_dev(tbl, dev, skip_perm);
447 	pneigh_ifdown_and_unlock(tbl, dev);
448 	pneigh_queue_purge(&tbl->proxy_queue, dev ? dev_net(dev) : NULL,
449 			   tbl->family);
450 	if (skb_queue_empty_lockless(&tbl->proxy_queue))
451 		del_timer_sync(&tbl->proxy_timer);
452 	return 0;
453 }
454 
neigh_carrier_down(struct neigh_table * tbl,struct net_device * dev)455 int neigh_carrier_down(struct neigh_table *tbl, struct net_device *dev)
456 {
457 	__neigh_ifdown(tbl, dev, true);
458 	return 0;
459 }
460 EXPORT_SYMBOL(neigh_carrier_down);
461 
neigh_ifdown(struct neigh_table * tbl,struct net_device * dev)462 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
463 {
464 	__neigh_ifdown(tbl, dev, false);
465 	return 0;
466 }
467 EXPORT_SYMBOL(neigh_ifdown);
468 
neigh_alloc(struct neigh_table * tbl,struct net_device * dev,u32 flags,bool exempt_from_gc)469 static struct neighbour *neigh_alloc(struct neigh_table *tbl,
470 				     struct net_device *dev,
471 				     u32 flags, bool exempt_from_gc)
472 {
473 	struct neighbour *n = NULL;
474 	unsigned long now = jiffies;
475 	int entries, gc_thresh3;
476 
477 	if (exempt_from_gc)
478 		goto do_alloc;
479 
480 	entries = atomic_inc_return(&tbl->gc_entries) - 1;
481 	gc_thresh3 = READ_ONCE(tbl->gc_thresh3);
482 	if (entries >= gc_thresh3 ||
483 	    (entries >= READ_ONCE(tbl->gc_thresh2) &&
484 	     time_after(now, READ_ONCE(tbl->last_flush) + 5 * HZ))) {
485 		if (!neigh_forced_gc(tbl) && entries >= gc_thresh3) {
486 			net_info_ratelimited("%s: neighbor table overflow!\n",
487 					     tbl->id);
488 			NEIGH_CACHE_STAT_INC(tbl, table_fulls);
489 			goto out_entries;
490 		}
491 	}
492 
493 do_alloc:
494 	n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
495 	if (!n)
496 		goto out_entries;
497 
498 	__skb_queue_head_init(&n->arp_queue);
499 	rwlock_init(&n->lock);
500 	seqlock_init(&n->ha_lock);
501 	n->updated	  = n->used = now;
502 	n->nud_state	  = NUD_NONE;
503 	n->output	  = neigh_blackhole;
504 	n->flags	  = flags;
505 	seqlock_init(&n->hh.hh_lock);
506 	n->parms	  = neigh_parms_clone(&tbl->parms);
507 	timer_setup(&n->timer, neigh_timer_handler, 0);
508 
509 	NEIGH_CACHE_STAT_INC(tbl, allocs);
510 	n->tbl		  = tbl;
511 	refcount_set(&n->refcnt, 1);
512 	n->dead		  = 1;
513 	INIT_LIST_HEAD(&n->gc_list);
514 	INIT_LIST_HEAD(&n->managed_list);
515 
516 	atomic_inc(&tbl->entries);
517 out:
518 	return n;
519 
520 out_entries:
521 	if (!exempt_from_gc)
522 		atomic_dec(&tbl->gc_entries);
523 	goto out;
524 }
525 
neigh_get_hash_rnd(u32 * x)526 static void neigh_get_hash_rnd(u32 *x)
527 {
528 	*x = get_random_u32() | 1;
529 }
530 
neigh_hash_alloc(unsigned int shift)531 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
532 {
533 	size_t size = (1 << shift) * sizeof(struct neighbour *);
534 	struct neigh_hash_table *ret;
535 	struct neighbour __rcu **buckets;
536 	int i;
537 
538 	ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
539 	if (!ret)
540 		return NULL;
541 	if (size <= PAGE_SIZE) {
542 		buckets = kzalloc(size, GFP_ATOMIC);
543 	} else {
544 		buckets = (struct neighbour __rcu **)
545 			  __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
546 					   get_order(size));
547 		kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
548 	}
549 	if (!buckets) {
550 		kfree(ret);
551 		return NULL;
552 	}
553 	ret->hash_buckets = buckets;
554 	ret->hash_shift = shift;
555 	for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
556 		neigh_get_hash_rnd(&ret->hash_rnd[i]);
557 	return ret;
558 }
559 
neigh_hash_free_rcu(struct rcu_head * head)560 static void neigh_hash_free_rcu(struct rcu_head *head)
561 {
562 	struct neigh_hash_table *nht = container_of(head,
563 						    struct neigh_hash_table,
564 						    rcu);
565 	size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
566 	struct neighbour __rcu **buckets = nht->hash_buckets;
567 
568 	if (size <= PAGE_SIZE) {
569 		kfree(buckets);
570 	} else {
571 		kmemleak_free(buckets);
572 		free_pages((unsigned long)buckets, get_order(size));
573 	}
574 	kfree(nht);
575 }
576 
neigh_hash_grow(struct neigh_table * tbl,unsigned long new_shift)577 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
578 						unsigned long new_shift)
579 {
580 	unsigned int i, hash;
581 	struct neigh_hash_table *new_nht, *old_nht;
582 
583 	NEIGH_CACHE_STAT_INC(tbl, hash_grows);
584 
585 	old_nht = rcu_dereference_protected(tbl->nht,
586 					    lockdep_is_held(&tbl->lock));
587 	new_nht = neigh_hash_alloc(new_shift);
588 	if (!new_nht)
589 		return old_nht;
590 
591 	for (i = 0; i < (1 << old_nht->hash_shift); i++) {
592 		struct neighbour *n, *next;
593 
594 		for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
595 						   lockdep_is_held(&tbl->lock));
596 		     n != NULL;
597 		     n = next) {
598 			hash = tbl->hash(n->primary_key, n->dev,
599 					 new_nht->hash_rnd);
600 
601 			hash >>= (32 - new_nht->hash_shift);
602 			next = rcu_dereference_protected(n->next,
603 						lockdep_is_held(&tbl->lock));
604 
605 			rcu_assign_pointer(n->next,
606 					   rcu_dereference_protected(
607 						new_nht->hash_buckets[hash],
608 						lockdep_is_held(&tbl->lock)));
609 			rcu_assign_pointer(new_nht->hash_buckets[hash], n);
610 		}
611 	}
612 
613 	rcu_assign_pointer(tbl->nht, new_nht);
614 	call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
615 	return new_nht;
616 }
617 
neigh_lookup(struct neigh_table * tbl,const void * pkey,struct net_device * dev)618 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
619 			       struct net_device *dev)
620 {
621 	struct neighbour *n;
622 
623 	NEIGH_CACHE_STAT_INC(tbl, lookups);
624 
625 	rcu_read_lock();
626 	n = __neigh_lookup_noref(tbl, pkey, dev);
627 	if (n) {
628 		if (!refcount_inc_not_zero(&n->refcnt))
629 			n = NULL;
630 		NEIGH_CACHE_STAT_INC(tbl, hits);
631 	}
632 
633 	rcu_read_unlock();
634 	return n;
635 }
636 EXPORT_SYMBOL(neigh_lookup);
637 
638 static struct neighbour *
___neigh_create(struct neigh_table * tbl,const void * pkey,struct net_device * dev,u32 flags,bool exempt_from_gc,bool want_ref)639 ___neigh_create(struct neigh_table *tbl, const void *pkey,
640 		struct net_device *dev, u32 flags,
641 		bool exempt_from_gc, bool want_ref)
642 {
643 	u32 hash_val, key_len = tbl->key_len;
644 	struct neighbour *n1, *rc, *n;
645 	struct neigh_hash_table *nht;
646 	int error;
647 
648 	n = neigh_alloc(tbl, dev, flags, exempt_from_gc);
649 	trace_neigh_create(tbl, dev, pkey, n, exempt_from_gc);
650 	if (!n) {
651 		rc = ERR_PTR(-ENOBUFS);
652 		goto out;
653 	}
654 
655 	memcpy(n->primary_key, pkey, key_len);
656 	n->dev = dev;
657 	netdev_hold(dev, &n->dev_tracker, GFP_ATOMIC);
658 
659 	/* Protocol specific setup. */
660 	if (tbl->constructor &&	(error = tbl->constructor(n)) < 0) {
661 		rc = ERR_PTR(error);
662 		goto out_neigh_release;
663 	}
664 
665 	if (dev->netdev_ops->ndo_neigh_construct) {
666 		error = dev->netdev_ops->ndo_neigh_construct(dev, n);
667 		if (error < 0) {
668 			rc = ERR_PTR(error);
669 			goto out_neigh_release;
670 		}
671 	}
672 
673 	/* Device specific setup. */
674 	if (n->parms->neigh_setup &&
675 	    (error = n->parms->neigh_setup(n)) < 0) {
676 		rc = ERR_PTR(error);
677 		goto out_neigh_release;
678 	}
679 
680 	n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
681 
682 	write_lock_bh(&tbl->lock);
683 	nht = rcu_dereference_protected(tbl->nht,
684 					lockdep_is_held(&tbl->lock));
685 
686 	if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
687 		nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
688 
689 	hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
690 
691 	if (n->parms->dead) {
692 		rc = ERR_PTR(-EINVAL);
693 		goto out_tbl_unlock;
694 	}
695 
696 	for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
697 					    lockdep_is_held(&tbl->lock));
698 	     n1 != NULL;
699 	     n1 = rcu_dereference_protected(n1->next,
700 			lockdep_is_held(&tbl->lock))) {
701 		if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) {
702 			if (want_ref)
703 				neigh_hold(n1);
704 			rc = n1;
705 			goto out_tbl_unlock;
706 		}
707 	}
708 
709 	n->dead = 0;
710 	if (!exempt_from_gc)
711 		list_add_tail(&n->gc_list, &n->tbl->gc_list);
712 	if (n->flags & NTF_MANAGED)
713 		list_add_tail(&n->managed_list, &n->tbl->managed_list);
714 	if (want_ref)
715 		neigh_hold(n);
716 	rcu_assign_pointer(n->next,
717 			   rcu_dereference_protected(nht->hash_buckets[hash_val],
718 						     lockdep_is_held(&tbl->lock)));
719 	rcu_assign_pointer(nht->hash_buckets[hash_val], n);
720 	write_unlock_bh(&tbl->lock);
721 	neigh_dbg(2, "neigh %p is created\n", n);
722 	rc = n;
723 out:
724 	return rc;
725 out_tbl_unlock:
726 	write_unlock_bh(&tbl->lock);
727 out_neigh_release:
728 	if (!exempt_from_gc)
729 		atomic_dec(&tbl->gc_entries);
730 	neigh_release(n);
731 	goto out;
732 }
733 
__neigh_create(struct neigh_table * tbl,const void * pkey,struct net_device * dev,bool want_ref)734 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
735 				 struct net_device *dev, bool want_ref)
736 {
737 	return ___neigh_create(tbl, pkey, dev, 0, false, want_ref);
738 }
739 EXPORT_SYMBOL(__neigh_create);
740 
pneigh_hash(const void * pkey,unsigned int key_len)741 static u32 pneigh_hash(const void *pkey, unsigned int key_len)
742 {
743 	u32 hash_val = *(u32 *)(pkey + key_len - 4);
744 	hash_val ^= (hash_val >> 16);
745 	hash_val ^= hash_val >> 8;
746 	hash_val ^= hash_val >> 4;
747 	hash_val &= PNEIGH_HASHMASK;
748 	return hash_val;
749 }
750 
__pneigh_lookup_1(struct pneigh_entry * n,struct net * net,const void * pkey,unsigned int key_len,struct net_device * dev)751 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
752 					      struct net *net,
753 					      const void *pkey,
754 					      unsigned int key_len,
755 					      struct net_device *dev)
756 {
757 	while (n) {
758 		if (!memcmp(n->key, pkey, key_len) &&
759 		    net_eq(pneigh_net(n), net) &&
760 		    (n->dev == dev || !n->dev))
761 			return n;
762 		n = n->next;
763 	}
764 	return NULL;
765 }
766 
__pneigh_lookup(struct neigh_table * tbl,struct net * net,const void * pkey,struct net_device * dev)767 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
768 		struct net *net, const void *pkey, struct net_device *dev)
769 {
770 	unsigned int key_len = tbl->key_len;
771 	u32 hash_val = pneigh_hash(pkey, key_len);
772 
773 	return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
774 				 net, pkey, key_len, dev);
775 }
776 EXPORT_SYMBOL_GPL(__pneigh_lookup);
777 
pneigh_lookup(struct neigh_table * tbl,struct net * net,const void * pkey,struct net_device * dev,int creat)778 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
779 				    struct net *net, const void *pkey,
780 				    struct net_device *dev, int creat)
781 {
782 	struct pneigh_entry *n;
783 	unsigned int key_len = tbl->key_len;
784 	u32 hash_val = pneigh_hash(pkey, key_len);
785 
786 	read_lock_bh(&tbl->lock);
787 	n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
788 			      net, pkey, key_len, dev);
789 	read_unlock_bh(&tbl->lock);
790 
791 	if (n || !creat)
792 		goto out;
793 
794 	ASSERT_RTNL();
795 
796 	n = kzalloc(sizeof(*n) + key_len, GFP_KERNEL);
797 	if (!n)
798 		goto out;
799 
800 	write_pnet(&n->net, net);
801 	memcpy(n->key, pkey, key_len);
802 	n->dev = dev;
803 	netdev_hold(dev, &n->dev_tracker, GFP_KERNEL);
804 
805 	if (tbl->pconstructor && tbl->pconstructor(n)) {
806 		netdev_put(dev, &n->dev_tracker);
807 		kfree(n);
808 		n = NULL;
809 		goto out;
810 	}
811 
812 	write_lock_bh(&tbl->lock);
813 	n->next = tbl->phash_buckets[hash_val];
814 	tbl->phash_buckets[hash_val] = n;
815 	write_unlock_bh(&tbl->lock);
816 out:
817 	return n;
818 }
819 EXPORT_SYMBOL(pneigh_lookup);
820 
821 
pneigh_delete(struct neigh_table * tbl,struct net * net,const void * pkey,struct net_device * dev)822 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
823 		  struct net_device *dev)
824 {
825 	struct pneigh_entry *n, **np;
826 	unsigned int key_len = tbl->key_len;
827 	u32 hash_val = pneigh_hash(pkey, key_len);
828 
829 	write_lock_bh(&tbl->lock);
830 	for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
831 	     np = &n->next) {
832 		if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
833 		    net_eq(pneigh_net(n), net)) {
834 			*np = n->next;
835 			write_unlock_bh(&tbl->lock);
836 			if (tbl->pdestructor)
837 				tbl->pdestructor(n);
838 			netdev_put(n->dev, &n->dev_tracker);
839 			kfree(n);
840 			return 0;
841 		}
842 	}
843 	write_unlock_bh(&tbl->lock);
844 	return -ENOENT;
845 }
846 
pneigh_ifdown_and_unlock(struct neigh_table * tbl,struct net_device * dev)847 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
848 				    struct net_device *dev)
849 {
850 	struct pneigh_entry *n, **np, *freelist = NULL;
851 	u32 h;
852 
853 	for (h = 0; h <= PNEIGH_HASHMASK; h++) {
854 		np = &tbl->phash_buckets[h];
855 		while ((n = *np) != NULL) {
856 			if (!dev || n->dev == dev) {
857 				*np = n->next;
858 				n->next = freelist;
859 				freelist = n;
860 				continue;
861 			}
862 			np = &n->next;
863 		}
864 	}
865 	write_unlock_bh(&tbl->lock);
866 	while ((n = freelist)) {
867 		freelist = n->next;
868 		n->next = NULL;
869 		if (tbl->pdestructor)
870 			tbl->pdestructor(n);
871 		netdev_put(n->dev, &n->dev_tracker);
872 		kfree(n);
873 	}
874 	return -ENOENT;
875 }
876 
877 static void neigh_parms_destroy(struct neigh_parms *parms);
878 
neigh_parms_put(struct neigh_parms * parms)879 static inline void neigh_parms_put(struct neigh_parms *parms)
880 {
881 	if (refcount_dec_and_test(&parms->refcnt))
882 		neigh_parms_destroy(parms);
883 }
884 
885 /*
886  *	neighbour must already be out of the table;
887  *
888  */
neigh_destroy(struct neighbour * neigh)889 void neigh_destroy(struct neighbour *neigh)
890 {
891 	struct net_device *dev = neigh->dev;
892 
893 	NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
894 
895 	if (!neigh->dead) {
896 		pr_warn("Destroying alive neighbour %p\n", neigh);
897 		dump_stack();
898 		return;
899 	}
900 
901 	if (neigh_del_timer(neigh))
902 		pr_warn("Impossible event\n");
903 
904 	write_lock_bh(&neigh->lock);
905 	__skb_queue_purge(&neigh->arp_queue);
906 	write_unlock_bh(&neigh->lock);
907 	neigh->arp_queue_len_bytes = 0;
908 
909 	if (dev->netdev_ops->ndo_neigh_destroy)
910 		dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
911 
912 	netdev_put(dev, &neigh->dev_tracker);
913 	neigh_parms_put(neigh->parms);
914 
915 	neigh_dbg(2, "neigh %p is destroyed\n", neigh);
916 
917 	atomic_dec(&neigh->tbl->entries);
918 	kfree_rcu(neigh, rcu);
919 }
920 EXPORT_SYMBOL(neigh_destroy);
921 
922 /* Neighbour state is suspicious;
923    disable fast path.
924 
925    Called with write_locked neigh.
926  */
neigh_suspect(struct neighbour * neigh)927 static void neigh_suspect(struct neighbour *neigh)
928 {
929 	neigh_dbg(2, "neigh %p is suspected\n", neigh);
930 
931 	WRITE_ONCE(neigh->output, neigh->ops->output);
932 }
933 
934 /* Neighbour state is OK;
935    enable fast path.
936 
937    Called with write_locked neigh.
938  */
neigh_connect(struct neighbour * neigh)939 static void neigh_connect(struct neighbour *neigh)
940 {
941 	neigh_dbg(2, "neigh %p is connected\n", neigh);
942 
943 	WRITE_ONCE(neigh->output, neigh->ops->connected_output);
944 }
945 
neigh_periodic_work(struct work_struct * work)946 static void neigh_periodic_work(struct work_struct *work)
947 {
948 	struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
949 	struct neighbour *n;
950 	struct neighbour __rcu **np;
951 	unsigned int i;
952 	struct neigh_hash_table *nht;
953 
954 	NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
955 
956 	write_lock_bh(&tbl->lock);
957 	nht = rcu_dereference_protected(tbl->nht,
958 					lockdep_is_held(&tbl->lock));
959 
960 	/*
961 	 *	periodically recompute ReachableTime from random function
962 	 */
963 
964 	if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
965 		struct neigh_parms *p;
966 
967 		WRITE_ONCE(tbl->last_rand, jiffies);
968 		list_for_each_entry(p, &tbl->parms_list, list)
969 			p->reachable_time =
970 				neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
971 	}
972 
973 	if (atomic_read(&tbl->entries) < READ_ONCE(tbl->gc_thresh1))
974 		goto out;
975 
976 	for (i = 0 ; i < (1 << nht->hash_shift); i++) {
977 		np = &nht->hash_buckets[i];
978 
979 		while ((n = rcu_dereference_protected(*np,
980 				lockdep_is_held(&tbl->lock))) != NULL) {
981 			unsigned int state;
982 
983 			write_lock(&n->lock);
984 
985 			state = n->nud_state;
986 			if ((state & (NUD_PERMANENT | NUD_IN_TIMER)) ||
987 			    (n->flags & NTF_EXT_LEARNED)) {
988 				write_unlock(&n->lock);
989 				goto next_elt;
990 			}
991 
992 			if (time_before(n->used, n->confirmed) &&
993 			    time_is_before_eq_jiffies(n->confirmed))
994 				n->used = n->confirmed;
995 
996 			if (refcount_read(&n->refcnt) == 1 &&
997 			    (state == NUD_FAILED ||
998 			     !time_in_range_open(jiffies, n->used,
999 						 n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
1000 				rcu_assign_pointer(*np,
1001 					rcu_dereference_protected(n->next,
1002 						lockdep_is_held(&tbl->lock)));
1003 				neigh_mark_dead(n);
1004 				write_unlock(&n->lock);
1005 				neigh_cleanup_and_release(n);
1006 				continue;
1007 			}
1008 			write_unlock(&n->lock);
1009 
1010 next_elt:
1011 			np = &n->next;
1012 		}
1013 		/*
1014 		 * It's fine to release lock here, even if hash table
1015 		 * grows while we are preempted.
1016 		 */
1017 		write_unlock_bh(&tbl->lock);
1018 		cond_resched();
1019 		write_lock_bh(&tbl->lock);
1020 		nht = rcu_dereference_protected(tbl->nht,
1021 						lockdep_is_held(&tbl->lock));
1022 	}
1023 out:
1024 	/* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
1025 	 * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
1026 	 * BASE_REACHABLE_TIME.
1027 	 */
1028 	queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1029 			      NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
1030 	write_unlock_bh(&tbl->lock);
1031 }
1032 
neigh_max_probes(struct neighbour * n)1033 static __inline__ int neigh_max_probes(struct neighbour *n)
1034 {
1035 	struct neigh_parms *p = n->parms;
1036 	return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
1037 	       (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
1038 	        NEIGH_VAR(p, MCAST_PROBES));
1039 }
1040 
neigh_invalidate(struct neighbour * neigh)1041 static void neigh_invalidate(struct neighbour *neigh)
1042 	__releases(neigh->lock)
1043 	__acquires(neigh->lock)
1044 {
1045 	struct sk_buff *skb;
1046 
1047 	NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
1048 	neigh_dbg(2, "neigh %p is failed\n", neigh);
1049 	neigh->updated = jiffies;
1050 
1051 	/* It is very thin place. report_unreachable is very complicated
1052 	   routine. Particularly, it can hit the same neighbour entry!
1053 
1054 	   So that, we try to be accurate and avoid dead loop. --ANK
1055 	 */
1056 	while (neigh->nud_state == NUD_FAILED &&
1057 	       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1058 		write_unlock(&neigh->lock);
1059 		neigh->ops->error_report(neigh, skb);
1060 		write_lock(&neigh->lock);
1061 	}
1062 	__skb_queue_purge(&neigh->arp_queue);
1063 	neigh->arp_queue_len_bytes = 0;
1064 }
1065 
neigh_probe(struct neighbour * neigh)1066 static void neigh_probe(struct neighbour *neigh)
1067 	__releases(neigh->lock)
1068 {
1069 	struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
1070 	/* keep skb alive even if arp_queue overflows */
1071 	if (skb)
1072 		skb = skb_clone(skb, GFP_ATOMIC);
1073 	write_unlock(&neigh->lock);
1074 	if (neigh->ops->solicit)
1075 		neigh->ops->solicit(neigh, skb);
1076 	atomic_inc(&neigh->probes);
1077 	consume_skb(skb);
1078 }
1079 
1080 /* Called when a timer expires for a neighbour entry. */
1081 
neigh_timer_handler(struct timer_list * t)1082 static void neigh_timer_handler(struct timer_list *t)
1083 {
1084 	unsigned long now, next;
1085 	struct neighbour *neigh = from_timer(neigh, t, timer);
1086 	unsigned int state;
1087 	int notify = 0;
1088 
1089 	write_lock(&neigh->lock);
1090 
1091 	state = neigh->nud_state;
1092 	now = jiffies;
1093 	next = now + HZ;
1094 
1095 	if (!(state & NUD_IN_TIMER))
1096 		goto out;
1097 
1098 	if (state & NUD_REACHABLE) {
1099 		if (time_before_eq(now,
1100 				   neigh->confirmed + neigh->parms->reachable_time)) {
1101 			neigh_dbg(2, "neigh %p is still alive\n", neigh);
1102 			next = neigh->confirmed + neigh->parms->reachable_time;
1103 		} else if (time_before_eq(now,
1104 					  neigh->used +
1105 					  NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1106 			neigh_dbg(2, "neigh %p is delayed\n", neigh);
1107 			WRITE_ONCE(neigh->nud_state, NUD_DELAY);
1108 			neigh->updated = jiffies;
1109 			neigh_suspect(neigh);
1110 			next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
1111 		} else {
1112 			neigh_dbg(2, "neigh %p is suspected\n", neigh);
1113 			WRITE_ONCE(neigh->nud_state, NUD_STALE);
1114 			neigh->updated = jiffies;
1115 			neigh_suspect(neigh);
1116 			notify = 1;
1117 		}
1118 	} else if (state & NUD_DELAY) {
1119 		if (time_before_eq(now,
1120 				   neigh->confirmed +
1121 				   NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1122 			neigh_dbg(2, "neigh %p is now reachable\n", neigh);
1123 			WRITE_ONCE(neigh->nud_state, NUD_REACHABLE);
1124 			neigh->updated = jiffies;
1125 			neigh_connect(neigh);
1126 			notify = 1;
1127 			next = neigh->confirmed + neigh->parms->reachable_time;
1128 		} else {
1129 			neigh_dbg(2, "neigh %p is probed\n", neigh);
1130 			WRITE_ONCE(neigh->nud_state, NUD_PROBE);
1131 			neigh->updated = jiffies;
1132 			atomic_set(&neigh->probes, 0);
1133 			notify = 1;
1134 			next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1135 					 HZ/100);
1136 		}
1137 	} else {
1138 		/* NUD_PROBE|NUD_INCOMPLETE */
1139 		next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME), HZ/100);
1140 	}
1141 
1142 	if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
1143 	    atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
1144 		WRITE_ONCE(neigh->nud_state, NUD_FAILED);
1145 		notify = 1;
1146 		neigh_invalidate(neigh);
1147 		goto out;
1148 	}
1149 
1150 	if (neigh->nud_state & NUD_IN_TIMER) {
1151 		if (time_before(next, jiffies + HZ/100))
1152 			next = jiffies + HZ/100;
1153 		if (!mod_timer(&neigh->timer, next))
1154 			neigh_hold(neigh);
1155 	}
1156 	if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
1157 		neigh_probe(neigh);
1158 	} else {
1159 out:
1160 		write_unlock(&neigh->lock);
1161 	}
1162 
1163 	if (notify)
1164 		neigh_update_notify(neigh, 0);
1165 
1166 	trace_neigh_timer_handler(neigh, 0);
1167 
1168 	neigh_release(neigh);
1169 }
1170 
__neigh_event_send(struct neighbour * neigh,struct sk_buff * skb,const bool immediate_ok)1171 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb,
1172 		       const bool immediate_ok)
1173 {
1174 	int rc;
1175 	bool immediate_probe = false;
1176 
1177 	write_lock_bh(&neigh->lock);
1178 
1179 	rc = 0;
1180 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1181 		goto out_unlock_bh;
1182 	if (neigh->dead)
1183 		goto out_dead;
1184 
1185 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1186 		if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1187 		    NEIGH_VAR(neigh->parms, APP_PROBES)) {
1188 			unsigned long next, now = jiffies;
1189 
1190 			atomic_set(&neigh->probes,
1191 				   NEIGH_VAR(neigh->parms, UCAST_PROBES));
1192 			neigh_del_timer(neigh);
1193 			WRITE_ONCE(neigh->nud_state, NUD_INCOMPLETE);
1194 			neigh->updated = now;
1195 			if (!immediate_ok) {
1196 				next = now + 1;
1197 			} else {
1198 				immediate_probe = true;
1199 				next = now + max(NEIGH_VAR(neigh->parms,
1200 							   RETRANS_TIME),
1201 						 HZ / 100);
1202 			}
1203 			neigh_add_timer(neigh, next);
1204 		} else {
1205 			WRITE_ONCE(neigh->nud_state, NUD_FAILED);
1206 			neigh->updated = jiffies;
1207 			write_unlock_bh(&neigh->lock);
1208 
1209 			kfree_skb_reason(skb, SKB_DROP_REASON_NEIGH_FAILED);
1210 			return 1;
1211 		}
1212 	} else if (neigh->nud_state & NUD_STALE) {
1213 		neigh_dbg(2, "neigh %p is delayed\n", neigh);
1214 		neigh_del_timer(neigh);
1215 		WRITE_ONCE(neigh->nud_state, NUD_DELAY);
1216 		neigh->updated = jiffies;
1217 		neigh_add_timer(neigh, jiffies +
1218 				NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1219 	}
1220 
1221 	if (neigh->nud_state == NUD_INCOMPLETE) {
1222 		if (skb) {
1223 			while (neigh->arp_queue_len_bytes + skb->truesize >
1224 			       NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1225 				struct sk_buff *buff;
1226 
1227 				buff = __skb_dequeue(&neigh->arp_queue);
1228 				if (!buff)
1229 					break;
1230 				neigh->arp_queue_len_bytes -= buff->truesize;
1231 				kfree_skb_reason(buff, SKB_DROP_REASON_NEIGH_QUEUEFULL);
1232 				NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1233 			}
1234 			skb_dst_force(skb);
1235 			__skb_queue_tail(&neigh->arp_queue, skb);
1236 			neigh->arp_queue_len_bytes += skb->truesize;
1237 		}
1238 		rc = 1;
1239 	}
1240 out_unlock_bh:
1241 	if (immediate_probe)
1242 		neigh_probe(neigh);
1243 	else
1244 		write_unlock(&neigh->lock);
1245 	local_bh_enable();
1246 	trace_neigh_event_send_done(neigh, rc);
1247 	return rc;
1248 
1249 out_dead:
1250 	if (neigh->nud_state & NUD_STALE)
1251 		goto out_unlock_bh;
1252 	write_unlock_bh(&neigh->lock);
1253 	kfree_skb_reason(skb, SKB_DROP_REASON_NEIGH_DEAD);
1254 	trace_neigh_event_send_dead(neigh, 1);
1255 	return 1;
1256 }
1257 EXPORT_SYMBOL(__neigh_event_send);
1258 
neigh_update_hhs(struct neighbour * neigh)1259 static void neigh_update_hhs(struct neighbour *neigh)
1260 {
1261 	struct hh_cache *hh;
1262 	void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1263 		= NULL;
1264 
1265 	if (neigh->dev->header_ops)
1266 		update = neigh->dev->header_ops->cache_update;
1267 
1268 	if (update) {
1269 		hh = &neigh->hh;
1270 		if (READ_ONCE(hh->hh_len)) {
1271 			write_seqlock_bh(&hh->hh_lock);
1272 			update(hh, neigh->dev, neigh->ha);
1273 			write_sequnlock_bh(&hh->hh_lock);
1274 		}
1275 	}
1276 }
1277 
1278 /* Generic update routine.
1279    -- lladdr is new lladdr or NULL, if it is not supplied.
1280    -- new    is new state.
1281    -- flags
1282 	NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1283 				if it is different.
1284 	NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1285 				lladdr instead of overriding it
1286 				if it is different.
1287 	NEIGH_UPDATE_F_ADMIN	means that the change is administrative.
1288 	NEIGH_UPDATE_F_USE	means that the entry is user triggered.
1289 	NEIGH_UPDATE_F_MANAGED	means that the entry will be auto-refreshed.
1290 	NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1291 				NTF_ROUTER flag.
1292 	NEIGH_UPDATE_F_ISROUTER	indicates if the neighbour is known as
1293 				a router.
1294 
1295    Caller MUST hold reference count on the entry.
1296  */
__neigh_update(struct neighbour * neigh,const u8 * lladdr,u8 new,u32 flags,u32 nlmsg_pid,struct netlink_ext_ack * extack)1297 static int __neigh_update(struct neighbour *neigh, const u8 *lladdr,
1298 			  u8 new, u32 flags, u32 nlmsg_pid,
1299 			  struct netlink_ext_ack *extack)
1300 {
1301 	bool gc_update = false, managed_update = false;
1302 	int update_isrouter = 0;
1303 	struct net_device *dev;
1304 	int err, notify = 0;
1305 	u8 old;
1306 
1307 	trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid);
1308 
1309 	write_lock_bh(&neigh->lock);
1310 
1311 	dev    = neigh->dev;
1312 	old    = neigh->nud_state;
1313 	err    = -EPERM;
1314 
1315 	if (neigh->dead) {
1316 		NL_SET_ERR_MSG(extack, "Neighbor entry is now dead");
1317 		new = old;
1318 		goto out;
1319 	}
1320 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1321 	    (old & (NUD_NOARP | NUD_PERMANENT)))
1322 		goto out;
1323 
1324 	neigh_update_flags(neigh, flags, &notify, &gc_update, &managed_update);
1325 	if (flags & (NEIGH_UPDATE_F_USE | NEIGH_UPDATE_F_MANAGED)) {
1326 		new = old & ~NUD_PERMANENT;
1327 		WRITE_ONCE(neigh->nud_state, new);
1328 		err = 0;
1329 		goto out;
1330 	}
1331 
1332 	if (!(new & NUD_VALID)) {
1333 		neigh_del_timer(neigh);
1334 		if (old & NUD_CONNECTED)
1335 			neigh_suspect(neigh);
1336 		WRITE_ONCE(neigh->nud_state, new);
1337 		err = 0;
1338 		notify = old & NUD_VALID;
1339 		if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1340 		    (new & NUD_FAILED)) {
1341 			neigh_invalidate(neigh);
1342 			notify = 1;
1343 		}
1344 		goto out;
1345 	}
1346 
1347 	/* Compare new lladdr with cached one */
1348 	if (!dev->addr_len) {
1349 		/* First case: device needs no address. */
1350 		lladdr = neigh->ha;
1351 	} else if (lladdr) {
1352 		/* The second case: if something is already cached
1353 		   and a new address is proposed:
1354 		   - compare new & old
1355 		   - if they are different, check override flag
1356 		 */
1357 		if ((old & NUD_VALID) &&
1358 		    !memcmp(lladdr, neigh->ha, dev->addr_len))
1359 			lladdr = neigh->ha;
1360 	} else {
1361 		/* No address is supplied; if we know something,
1362 		   use it, otherwise discard the request.
1363 		 */
1364 		err = -EINVAL;
1365 		if (!(old & NUD_VALID)) {
1366 			NL_SET_ERR_MSG(extack, "No link layer address given");
1367 			goto out;
1368 		}
1369 		lladdr = neigh->ha;
1370 	}
1371 
1372 	/* Update confirmed timestamp for neighbour entry after we
1373 	 * received ARP packet even if it doesn't change IP to MAC binding.
1374 	 */
1375 	if (new & NUD_CONNECTED)
1376 		neigh->confirmed = jiffies;
1377 
1378 	/* If entry was valid and address is not changed,
1379 	   do not change entry state, if new one is STALE.
1380 	 */
1381 	err = 0;
1382 	update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1383 	if (old & NUD_VALID) {
1384 		if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1385 			update_isrouter = 0;
1386 			if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1387 			    (old & NUD_CONNECTED)) {
1388 				lladdr = neigh->ha;
1389 				new = NUD_STALE;
1390 			} else
1391 				goto out;
1392 		} else {
1393 			if (lladdr == neigh->ha && new == NUD_STALE &&
1394 			    !(flags & NEIGH_UPDATE_F_ADMIN))
1395 				new = old;
1396 		}
1397 	}
1398 
1399 	/* Update timestamp only once we know we will make a change to the
1400 	 * neighbour entry. Otherwise we risk to move the locktime window with
1401 	 * noop updates and ignore relevant ARP updates.
1402 	 */
1403 	if (new != old || lladdr != neigh->ha)
1404 		neigh->updated = jiffies;
1405 
1406 	if (new != old) {
1407 		neigh_del_timer(neigh);
1408 		if (new & NUD_PROBE)
1409 			atomic_set(&neigh->probes, 0);
1410 		if (new & NUD_IN_TIMER)
1411 			neigh_add_timer(neigh, (jiffies +
1412 						((new & NUD_REACHABLE) ?
1413 						 neigh->parms->reachable_time :
1414 						 0)));
1415 		WRITE_ONCE(neigh->nud_state, new);
1416 		notify = 1;
1417 	}
1418 
1419 	if (lladdr != neigh->ha) {
1420 		write_seqlock(&neigh->ha_lock);
1421 		memcpy(&neigh->ha, lladdr, dev->addr_len);
1422 		write_sequnlock(&neigh->ha_lock);
1423 		neigh_update_hhs(neigh);
1424 		if (!(new & NUD_CONNECTED))
1425 			neigh->confirmed = jiffies -
1426 				      (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1427 		notify = 1;
1428 	}
1429 	if (new == old)
1430 		goto out;
1431 	if (new & NUD_CONNECTED)
1432 		neigh_connect(neigh);
1433 	else
1434 		neigh_suspect(neigh);
1435 	if (!(old & NUD_VALID)) {
1436 		struct sk_buff *skb;
1437 
1438 		/* Again: avoid dead loop if something went wrong */
1439 
1440 		while (neigh->nud_state & NUD_VALID &&
1441 		       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1442 			struct dst_entry *dst = skb_dst(skb);
1443 			struct neighbour *n2, *n1 = neigh;
1444 			write_unlock_bh(&neigh->lock);
1445 
1446 			rcu_read_lock();
1447 
1448 			/* Why not just use 'neigh' as-is?  The problem is that
1449 			 * things such as shaper, eql, and sch_teql can end up
1450 			 * using alternative, different, neigh objects to output
1451 			 * the packet in the output path.  So what we need to do
1452 			 * here is re-lookup the top-level neigh in the path so
1453 			 * we can reinject the packet there.
1454 			 */
1455 			n2 = NULL;
1456 			if (dst && dst->obsolete != DST_OBSOLETE_DEAD) {
1457 				n2 = dst_neigh_lookup_skb(dst, skb);
1458 				if (n2)
1459 					n1 = n2;
1460 			}
1461 			READ_ONCE(n1->output)(n1, skb);
1462 			if (n2)
1463 				neigh_release(n2);
1464 			rcu_read_unlock();
1465 
1466 			write_lock_bh(&neigh->lock);
1467 		}
1468 		__skb_queue_purge(&neigh->arp_queue);
1469 		neigh->arp_queue_len_bytes = 0;
1470 	}
1471 out:
1472 	if (update_isrouter)
1473 		neigh_update_is_router(neigh, flags, &notify);
1474 	write_unlock_bh(&neigh->lock);
1475 	if (((new ^ old) & NUD_PERMANENT) || gc_update)
1476 		neigh_update_gc_list(neigh);
1477 	if (managed_update)
1478 		neigh_update_managed_list(neigh);
1479 	if (notify)
1480 		neigh_update_notify(neigh, nlmsg_pid);
1481 	trace_neigh_update_done(neigh, err);
1482 	return err;
1483 }
1484 
neigh_update(struct neighbour * neigh,const u8 * lladdr,u8 new,u32 flags,u32 nlmsg_pid)1485 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1486 		 u32 flags, u32 nlmsg_pid)
1487 {
1488 	return __neigh_update(neigh, lladdr, new, flags, nlmsg_pid, NULL);
1489 }
1490 EXPORT_SYMBOL(neigh_update);
1491 
1492 /* Update the neigh to listen temporarily for probe responses, even if it is
1493  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1494  */
__neigh_set_probe_once(struct neighbour * neigh)1495 void __neigh_set_probe_once(struct neighbour *neigh)
1496 {
1497 	if (neigh->dead)
1498 		return;
1499 	neigh->updated = jiffies;
1500 	if (!(neigh->nud_state & NUD_FAILED))
1501 		return;
1502 	WRITE_ONCE(neigh->nud_state, NUD_INCOMPLETE);
1503 	atomic_set(&neigh->probes, neigh_max_probes(neigh));
1504 	neigh_add_timer(neigh,
1505 			jiffies + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1506 				      HZ/100));
1507 }
1508 EXPORT_SYMBOL(__neigh_set_probe_once);
1509 
neigh_event_ns(struct neigh_table * tbl,u8 * lladdr,void * saddr,struct net_device * dev)1510 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1511 				 u8 *lladdr, void *saddr,
1512 				 struct net_device *dev)
1513 {
1514 	struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1515 						 lladdr || !dev->addr_len);
1516 	if (neigh)
1517 		neigh_update(neigh, lladdr, NUD_STALE,
1518 			     NEIGH_UPDATE_F_OVERRIDE, 0);
1519 	return neigh;
1520 }
1521 EXPORT_SYMBOL(neigh_event_ns);
1522 
1523 /* called with read_lock_bh(&n->lock); */
neigh_hh_init(struct neighbour * n)1524 static void neigh_hh_init(struct neighbour *n)
1525 {
1526 	struct net_device *dev = n->dev;
1527 	__be16 prot = n->tbl->protocol;
1528 	struct hh_cache	*hh = &n->hh;
1529 
1530 	write_lock_bh(&n->lock);
1531 
1532 	/* Only one thread can come in here and initialize the
1533 	 * hh_cache entry.
1534 	 */
1535 	if (!hh->hh_len)
1536 		dev->header_ops->cache(n, hh, prot);
1537 
1538 	write_unlock_bh(&n->lock);
1539 }
1540 
1541 /* Slow and careful. */
1542 
neigh_resolve_output(struct neighbour * neigh,struct sk_buff * skb)1543 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1544 {
1545 	int rc = 0;
1546 
1547 	if (!neigh_event_send(neigh, skb)) {
1548 		int err;
1549 		struct net_device *dev = neigh->dev;
1550 		unsigned int seq;
1551 
1552 		if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
1553 			neigh_hh_init(neigh);
1554 
1555 		do {
1556 			__skb_pull(skb, skb_network_offset(skb));
1557 			seq = read_seqbegin(&neigh->ha_lock);
1558 			err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1559 					      neigh->ha, NULL, skb->len);
1560 		} while (read_seqretry(&neigh->ha_lock, seq));
1561 
1562 		if (err >= 0)
1563 			rc = dev_queue_xmit(skb);
1564 		else
1565 			goto out_kfree_skb;
1566 	}
1567 out:
1568 	return rc;
1569 out_kfree_skb:
1570 	rc = -EINVAL;
1571 	kfree_skb(skb);
1572 	goto out;
1573 }
1574 EXPORT_SYMBOL(neigh_resolve_output);
1575 
1576 /* As fast as possible without hh cache */
1577 
neigh_connected_output(struct neighbour * neigh,struct sk_buff * skb)1578 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1579 {
1580 	struct net_device *dev = neigh->dev;
1581 	unsigned int seq;
1582 	int err;
1583 
1584 	do {
1585 		__skb_pull(skb, skb_network_offset(skb));
1586 		seq = read_seqbegin(&neigh->ha_lock);
1587 		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1588 				      neigh->ha, NULL, skb->len);
1589 	} while (read_seqretry(&neigh->ha_lock, seq));
1590 
1591 	if (err >= 0)
1592 		err = dev_queue_xmit(skb);
1593 	else {
1594 		err = -EINVAL;
1595 		kfree_skb(skb);
1596 	}
1597 	return err;
1598 }
1599 EXPORT_SYMBOL(neigh_connected_output);
1600 
neigh_direct_output(struct neighbour * neigh,struct sk_buff * skb)1601 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1602 {
1603 	return dev_queue_xmit(skb);
1604 }
1605 EXPORT_SYMBOL(neigh_direct_output);
1606 
neigh_managed_work(struct work_struct * work)1607 static void neigh_managed_work(struct work_struct *work)
1608 {
1609 	struct neigh_table *tbl = container_of(work, struct neigh_table,
1610 					       managed_work.work);
1611 	struct neighbour *neigh;
1612 
1613 	write_lock_bh(&tbl->lock);
1614 	list_for_each_entry(neigh, &tbl->managed_list, managed_list)
1615 		neigh_event_send_probe(neigh, NULL, false);
1616 	queue_delayed_work(system_power_efficient_wq, &tbl->managed_work,
1617 			   NEIGH_VAR(&tbl->parms, INTERVAL_PROBE_TIME_MS));
1618 	write_unlock_bh(&tbl->lock);
1619 }
1620 
neigh_proxy_process(struct timer_list * t)1621 static void neigh_proxy_process(struct timer_list *t)
1622 {
1623 	struct neigh_table *tbl = from_timer(tbl, t, proxy_timer);
1624 	long sched_next = 0;
1625 	unsigned long now = jiffies;
1626 	struct sk_buff *skb, *n;
1627 
1628 	spin_lock(&tbl->proxy_queue.lock);
1629 
1630 	skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1631 		long tdif = NEIGH_CB(skb)->sched_next - now;
1632 
1633 		if (tdif <= 0) {
1634 			struct net_device *dev = skb->dev;
1635 
1636 			neigh_parms_qlen_dec(dev, tbl->family);
1637 			__skb_unlink(skb, &tbl->proxy_queue);
1638 
1639 			if (tbl->proxy_redo && netif_running(dev)) {
1640 				rcu_read_lock();
1641 				tbl->proxy_redo(skb);
1642 				rcu_read_unlock();
1643 			} else {
1644 				kfree_skb(skb);
1645 			}
1646 
1647 			dev_put(dev);
1648 		} else if (!sched_next || tdif < sched_next)
1649 			sched_next = tdif;
1650 	}
1651 	del_timer(&tbl->proxy_timer);
1652 	if (sched_next)
1653 		mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1654 	spin_unlock(&tbl->proxy_queue.lock);
1655 }
1656 
neigh_proxy_delay(struct neigh_parms * p)1657 static unsigned long neigh_proxy_delay(struct neigh_parms *p)
1658 {
1659 	/* If proxy_delay is zero, do not call get_random_u32_below()
1660 	 * as it is undefined behavior.
1661 	 */
1662 	unsigned long proxy_delay = NEIGH_VAR(p, PROXY_DELAY);
1663 
1664 	return proxy_delay ?
1665 	       jiffies + get_random_u32_below(proxy_delay) : jiffies;
1666 }
1667 
pneigh_enqueue(struct neigh_table * tbl,struct neigh_parms * p,struct sk_buff * skb)1668 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1669 		    struct sk_buff *skb)
1670 {
1671 	unsigned long sched_next = neigh_proxy_delay(p);
1672 
1673 	if (p->qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1674 		kfree_skb(skb);
1675 		return;
1676 	}
1677 
1678 	NEIGH_CB(skb)->sched_next = sched_next;
1679 	NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1680 
1681 	spin_lock(&tbl->proxy_queue.lock);
1682 	if (del_timer(&tbl->proxy_timer)) {
1683 		if (time_before(tbl->proxy_timer.expires, sched_next))
1684 			sched_next = tbl->proxy_timer.expires;
1685 	}
1686 	skb_dst_drop(skb);
1687 	dev_hold(skb->dev);
1688 	__skb_queue_tail(&tbl->proxy_queue, skb);
1689 	p->qlen++;
1690 	mod_timer(&tbl->proxy_timer, sched_next);
1691 	spin_unlock(&tbl->proxy_queue.lock);
1692 }
1693 EXPORT_SYMBOL(pneigh_enqueue);
1694 
lookup_neigh_parms(struct neigh_table * tbl,struct net * net,int ifindex)1695 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1696 						      struct net *net, int ifindex)
1697 {
1698 	struct neigh_parms *p;
1699 
1700 	list_for_each_entry(p, &tbl->parms_list, list) {
1701 		if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1702 		    (!p->dev && !ifindex && net_eq(net, &init_net)))
1703 			return p;
1704 	}
1705 
1706 	return NULL;
1707 }
1708 
neigh_parms_alloc(struct net_device * dev,struct neigh_table * tbl)1709 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1710 				      struct neigh_table *tbl)
1711 {
1712 	struct neigh_parms *p;
1713 	struct net *net = dev_net(dev);
1714 	const struct net_device_ops *ops = dev->netdev_ops;
1715 
1716 	p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1717 	if (p) {
1718 		p->tbl		  = tbl;
1719 		refcount_set(&p->refcnt, 1);
1720 		p->reachable_time =
1721 				neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1722 		p->qlen = 0;
1723 		netdev_hold(dev, &p->dev_tracker, GFP_KERNEL);
1724 		p->dev = dev;
1725 		write_pnet(&p->net, net);
1726 		p->sysctl_table = NULL;
1727 
1728 		if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1729 			netdev_put(dev, &p->dev_tracker);
1730 			kfree(p);
1731 			return NULL;
1732 		}
1733 
1734 		write_lock_bh(&tbl->lock);
1735 		list_add(&p->list, &tbl->parms.list);
1736 		write_unlock_bh(&tbl->lock);
1737 
1738 		neigh_parms_data_state_cleanall(p);
1739 	}
1740 	return p;
1741 }
1742 EXPORT_SYMBOL(neigh_parms_alloc);
1743 
neigh_rcu_free_parms(struct rcu_head * head)1744 static void neigh_rcu_free_parms(struct rcu_head *head)
1745 {
1746 	struct neigh_parms *parms =
1747 		container_of(head, struct neigh_parms, rcu_head);
1748 
1749 	neigh_parms_put(parms);
1750 }
1751 
neigh_parms_release(struct neigh_table * tbl,struct neigh_parms * parms)1752 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1753 {
1754 	if (!parms || parms == &tbl->parms)
1755 		return;
1756 	write_lock_bh(&tbl->lock);
1757 	list_del(&parms->list);
1758 	parms->dead = 1;
1759 	write_unlock_bh(&tbl->lock);
1760 	netdev_put(parms->dev, &parms->dev_tracker);
1761 	call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1762 }
1763 EXPORT_SYMBOL(neigh_parms_release);
1764 
neigh_parms_destroy(struct neigh_parms * parms)1765 static void neigh_parms_destroy(struct neigh_parms *parms)
1766 {
1767 	kfree(parms);
1768 }
1769 
1770 static struct lock_class_key neigh_table_proxy_queue_class;
1771 
1772 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1773 
neigh_table_init(int index,struct neigh_table * tbl)1774 void neigh_table_init(int index, struct neigh_table *tbl)
1775 {
1776 	unsigned long now = jiffies;
1777 	unsigned long phsize;
1778 
1779 	INIT_LIST_HEAD(&tbl->parms_list);
1780 	INIT_LIST_HEAD(&tbl->gc_list);
1781 	INIT_LIST_HEAD(&tbl->managed_list);
1782 
1783 	list_add(&tbl->parms.list, &tbl->parms_list);
1784 	write_pnet(&tbl->parms.net, &init_net);
1785 	refcount_set(&tbl->parms.refcnt, 1);
1786 	tbl->parms.reachable_time =
1787 			  neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1788 	tbl->parms.qlen = 0;
1789 
1790 	tbl->stats = alloc_percpu(struct neigh_statistics);
1791 	if (!tbl->stats)
1792 		panic("cannot create neighbour cache statistics");
1793 
1794 #ifdef CONFIG_PROC_FS
1795 	if (!proc_create_seq_data(tbl->id, 0, init_net.proc_net_stat,
1796 			      &neigh_stat_seq_ops, tbl))
1797 		panic("cannot create neighbour proc dir entry");
1798 #endif
1799 
1800 	RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1801 
1802 	phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1803 	tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1804 
1805 	if (!tbl->nht || !tbl->phash_buckets)
1806 		panic("cannot allocate neighbour cache hashes");
1807 
1808 	if (!tbl->entry_size)
1809 		tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1810 					tbl->key_len, NEIGH_PRIV_ALIGN);
1811 	else
1812 		WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1813 
1814 	rwlock_init(&tbl->lock);
1815 
1816 	INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1817 	queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1818 			tbl->parms.reachable_time);
1819 	INIT_DEFERRABLE_WORK(&tbl->managed_work, neigh_managed_work);
1820 	queue_delayed_work(system_power_efficient_wq, &tbl->managed_work, 0);
1821 
1822 	timer_setup(&tbl->proxy_timer, neigh_proxy_process, 0);
1823 	skb_queue_head_init_class(&tbl->proxy_queue,
1824 			&neigh_table_proxy_queue_class);
1825 
1826 	tbl->last_flush = now;
1827 	tbl->last_rand	= now + tbl->parms.reachable_time * 20;
1828 
1829 	neigh_tables[index] = tbl;
1830 }
1831 EXPORT_SYMBOL(neigh_table_init);
1832 
neigh_table_clear(int index,struct neigh_table * tbl)1833 int neigh_table_clear(int index, struct neigh_table *tbl)
1834 {
1835 	neigh_tables[index] = NULL;
1836 	/* It is not clean... Fix it to unload IPv6 module safely */
1837 	cancel_delayed_work_sync(&tbl->managed_work);
1838 	cancel_delayed_work_sync(&tbl->gc_work);
1839 	del_timer_sync(&tbl->proxy_timer);
1840 	pneigh_queue_purge(&tbl->proxy_queue, NULL, tbl->family);
1841 	neigh_ifdown(tbl, NULL);
1842 	if (atomic_read(&tbl->entries))
1843 		pr_crit("neighbour leakage\n");
1844 
1845 	call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1846 		 neigh_hash_free_rcu);
1847 	tbl->nht = NULL;
1848 
1849 	kfree(tbl->phash_buckets);
1850 	tbl->phash_buckets = NULL;
1851 
1852 	remove_proc_entry(tbl->id, init_net.proc_net_stat);
1853 
1854 	free_percpu(tbl->stats);
1855 	tbl->stats = NULL;
1856 
1857 	return 0;
1858 }
1859 EXPORT_SYMBOL(neigh_table_clear);
1860 
neigh_find_table(int family)1861 static struct neigh_table *neigh_find_table(int family)
1862 {
1863 	struct neigh_table *tbl = NULL;
1864 
1865 	switch (family) {
1866 	case AF_INET:
1867 		tbl = neigh_tables[NEIGH_ARP_TABLE];
1868 		break;
1869 	case AF_INET6:
1870 		tbl = neigh_tables[NEIGH_ND_TABLE];
1871 		break;
1872 	}
1873 
1874 	return tbl;
1875 }
1876 
1877 const struct nla_policy nda_policy[NDA_MAX+1] = {
1878 	[NDA_UNSPEC]		= { .strict_start_type = NDA_NH_ID },
1879 	[NDA_DST]		= { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1880 	[NDA_LLADDR]		= { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1881 	[NDA_CACHEINFO]		= { .len = sizeof(struct nda_cacheinfo) },
1882 	[NDA_PROBES]		= { .type = NLA_U32 },
1883 	[NDA_VLAN]		= { .type = NLA_U16 },
1884 	[NDA_PORT]		= { .type = NLA_U16 },
1885 	[NDA_VNI]		= { .type = NLA_U32 },
1886 	[NDA_IFINDEX]		= { .type = NLA_U32 },
1887 	[NDA_MASTER]		= { .type = NLA_U32 },
1888 	[NDA_PROTOCOL]		= { .type = NLA_U8 },
1889 	[NDA_NH_ID]		= { .type = NLA_U32 },
1890 	[NDA_FLAGS_EXT]		= NLA_POLICY_MASK(NLA_U32, NTF_EXT_MASK),
1891 	[NDA_FDB_EXT_ATTRS]	= { .type = NLA_NESTED },
1892 };
1893 
neigh_delete(struct sk_buff * skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)1894 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1895 			struct netlink_ext_ack *extack)
1896 {
1897 	struct net *net = sock_net(skb->sk);
1898 	struct ndmsg *ndm;
1899 	struct nlattr *dst_attr;
1900 	struct neigh_table *tbl;
1901 	struct neighbour *neigh;
1902 	struct net_device *dev = NULL;
1903 	int err = -EINVAL;
1904 
1905 	ASSERT_RTNL();
1906 	if (nlmsg_len(nlh) < sizeof(*ndm))
1907 		goto out;
1908 
1909 	dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1910 	if (!dst_attr) {
1911 		NL_SET_ERR_MSG(extack, "Network address not specified");
1912 		goto out;
1913 	}
1914 
1915 	ndm = nlmsg_data(nlh);
1916 	if (ndm->ndm_ifindex) {
1917 		dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1918 		if (dev == NULL) {
1919 			err = -ENODEV;
1920 			goto out;
1921 		}
1922 	}
1923 
1924 	tbl = neigh_find_table(ndm->ndm_family);
1925 	if (tbl == NULL)
1926 		return -EAFNOSUPPORT;
1927 
1928 	if (nla_len(dst_attr) < (int)tbl->key_len) {
1929 		NL_SET_ERR_MSG(extack, "Invalid network address");
1930 		goto out;
1931 	}
1932 
1933 	if (ndm->ndm_flags & NTF_PROXY) {
1934 		err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1935 		goto out;
1936 	}
1937 
1938 	if (dev == NULL)
1939 		goto out;
1940 
1941 	neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1942 	if (neigh == NULL) {
1943 		err = -ENOENT;
1944 		goto out;
1945 	}
1946 
1947 	err = __neigh_update(neigh, NULL, NUD_FAILED,
1948 			     NEIGH_UPDATE_F_OVERRIDE | NEIGH_UPDATE_F_ADMIN,
1949 			     NETLINK_CB(skb).portid, extack);
1950 	write_lock_bh(&tbl->lock);
1951 	neigh_release(neigh);
1952 	neigh_remove_one(neigh, tbl);
1953 	write_unlock_bh(&tbl->lock);
1954 
1955 out:
1956 	return err;
1957 }
1958 
neigh_add(struct sk_buff * skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)1959 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1960 		     struct netlink_ext_ack *extack)
1961 {
1962 	int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE |
1963 		    NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1964 	struct net *net = sock_net(skb->sk);
1965 	struct ndmsg *ndm;
1966 	struct nlattr *tb[NDA_MAX+1];
1967 	struct neigh_table *tbl;
1968 	struct net_device *dev = NULL;
1969 	struct neighbour *neigh;
1970 	void *dst, *lladdr;
1971 	u8 protocol = 0;
1972 	u32 ndm_flags;
1973 	int err;
1974 
1975 	ASSERT_RTNL();
1976 	err = nlmsg_parse_deprecated(nlh, sizeof(*ndm), tb, NDA_MAX,
1977 				     nda_policy, extack);
1978 	if (err < 0)
1979 		goto out;
1980 
1981 	err = -EINVAL;
1982 	if (!tb[NDA_DST]) {
1983 		NL_SET_ERR_MSG(extack, "Network address not specified");
1984 		goto out;
1985 	}
1986 
1987 	ndm = nlmsg_data(nlh);
1988 	ndm_flags = ndm->ndm_flags;
1989 	if (tb[NDA_FLAGS_EXT]) {
1990 		u32 ext = nla_get_u32(tb[NDA_FLAGS_EXT]);
1991 
1992 		BUILD_BUG_ON(sizeof(neigh->flags) * BITS_PER_BYTE <
1993 			     (sizeof(ndm->ndm_flags) * BITS_PER_BYTE +
1994 			      hweight32(NTF_EXT_MASK)));
1995 		ndm_flags |= (ext << NTF_EXT_SHIFT);
1996 	}
1997 	if (ndm->ndm_ifindex) {
1998 		dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1999 		if (dev == NULL) {
2000 			err = -ENODEV;
2001 			goto out;
2002 		}
2003 
2004 		if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len) {
2005 			NL_SET_ERR_MSG(extack, "Invalid link address");
2006 			goto out;
2007 		}
2008 	}
2009 
2010 	tbl = neigh_find_table(ndm->ndm_family);
2011 	if (tbl == NULL)
2012 		return -EAFNOSUPPORT;
2013 
2014 	if (nla_len(tb[NDA_DST]) < (int)tbl->key_len) {
2015 		NL_SET_ERR_MSG(extack, "Invalid network address");
2016 		goto out;
2017 	}
2018 
2019 	dst = nla_data(tb[NDA_DST]);
2020 	lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
2021 
2022 	if (tb[NDA_PROTOCOL])
2023 		protocol = nla_get_u8(tb[NDA_PROTOCOL]);
2024 	if (ndm_flags & NTF_PROXY) {
2025 		struct pneigh_entry *pn;
2026 
2027 		if (ndm_flags & NTF_MANAGED) {
2028 			NL_SET_ERR_MSG(extack, "Invalid NTF_* flag combination");
2029 			goto out;
2030 		}
2031 
2032 		err = -ENOBUFS;
2033 		pn = pneigh_lookup(tbl, net, dst, dev, 1);
2034 		if (pn) {
2035 			pn->flags = ndm_flags;
2036 			if (protocol)
2037 				pn->protocol = protocol;
2038 			err = 0;
2039 		}
2040 		goto out;
2041 	}
2042 
2043 	if (!dev) {
2044 		NL_SET_ERR_MSG(extack, "Device not specified");
2045 		goto out;
2046 	}
2047 
2048 	if (tbl->allow_add && !tbl->allow_add(dev, extack)) {
2049 		err = -EINVAL;
2050 		goto out;
2051 	}
2052 
2053 	neigh = neigh_lookup(tbl, dst, dev);
2054 	if (neigh == NULL) {
2055 		bool ndm_permanent  = ndm->ndm_state & NUD_PERMANENT;
2056 		bool exempt_from_gc = ndm_permanent ||
2057 				      ndm_flags & NTF_EXT_LEARNED;
2058 
2059 		if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
2060 			err = -ENOENT;
2061 			goto out;
2062 		}
2063 		if (ndm_permanent && (ndm_flags & NTF_MANAGED)) {
2064 			NL_SET_ERR_MSG(extack, "Invalid NTF_* flag for permanent entry");
2065 			err = -EINVAL;
2066 			goto out;
2067 		}
2068 
2069 		neigh = ___neigh_create(tbl, dst, dev,
2070 					ndm_flags &
2071 					(NTF_EXT_LEARNED | NTF_MANAGED),
2072 					exempt_from_gc, true);
2073 		if (IS_ERR(neigh)) {
2074 			err = PTR_ERR(neigh);
2075 			goto out;
2076 		}
2077 	} else {
2078 		if (nlh->nlmsg_flags & NLM_F_EXCL) {
2079 			err = -EEXIST;
2080 			neigh_release(neigh);
2081 			goto out;
2082 		}
2083 
2084 		if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
2085 			flags &= ~(NEIGH_UPDATE_F_OVERRIDE |
2086 				   NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
2087 	}
2088 
2089 	if (protocol)
2090 		neigh->protocol = protocol;
2091 	if (ndm_flags & NTF_EXT_LEARNED)
2092 		flags |= NEIGH_UPDATE_F_EXT_LEARNED;
2093 	if (ndm_flags & NTF_ROUTER)
2094 		flags |= NEIGH_UPDATE_F_ISROUTER;
2095 	if (ndm_flags & NTF_MANAGED)
2096 		flags |= NEIGH_UPDATE_F_MANAGED;
2097 	if (ndm_flags & NTF_USE)
2098 		flags |= NEIGH_UPDATE_F_USE;
2099 
2100 	err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags,
2101 			     NETLINK_CB(skb).portid, extack);
2102 	if (!err && ndm_flags & (NTF_USE | NTF_MANAGED)) {
2103 		neigh_event_send(neigh, NULL);
2104 		err = 0;
2105 	}
2106 	neigh_release(neigh);
2107 out:
2108 	return err;
2109 }
2110 
neightbl_fill_parms(struct sk_buff * skb,struct neigh_parms * parms)2111 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
2112 {
2113 	struct nlattr *nest;
2114 
2115 	nest = nla_nest_start_noflag(skb, NDTA_PARMS);
2116 	if (nest == NULL)
2117 		return -ENOBUFS;
2118 
2119 	if ((parms->dev &&
2120 	     nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
2121 	    nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
2122 	    nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
2123 			NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
2124 	    /* approximative value for deprecated QUEUE_LEN (in packets) */
2125 	    nla_put_u32(skb, NDTPA_QUEUE_LEN,
2126 			NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
2127 	    nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
2128 	    nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
2129 	    nla_put_u32(skb, NDTPA_UCAST_PROBES,
2130 			NEIGH_VAR(parms, UCAST_PROBES)) ||
2131 	    nla_put_u32(skb, NDTPA_MCAST_PROBES,
2132 			NEIGH_VAR(parms, MCAST_PROBES)) ||
2133 	    nla_put_u32(skb, NDTPA_MCAST_REPROBES,
2134 			NEIGH_VAR(parms, MCAST_REPROBES)) ||
2135 	    nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
2136 			  NDTPA_PAD) ||
2137 	    nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
2138 			  NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
2139 	    nla_put_msecs(skb, NDTPA_GC_STALETIME,
2140 			  NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
2141 	    nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
2142 			  NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
2143 	    nla_put_msecs(skb, NDTPA_RETRANS_TIME,
2144 			  NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
2145 	    nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
2146 			  NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
2147 	    nla_put_msecs(skb, NDTPA_PROXY_DELAY,
2148 			  NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
2149 	    nla_put_msecs(skb, NDTPA_LOCKTIME,
2150 			  NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD) ||
2151 	    nla_put_msecs(skb, NDTPA_INTERVAL_PROBE_TIME_MS,
2152 			  NEIGH_VAR(parms, INTERVAL_PROBE_TIME_MS), NDTPA_PAD))
2153 		goto nla_put_failure;
2154 	return nla_nest_end(skb, nest);
2155 
2156 nla_put_failure:
2157 	nla_nest_cancel(skb, nest);
2158 	return -EMSGSIZE;
2159 }
2160 
neightbl_fill_info(struct sk_buff * skb,struct neigh_table * tbl,u32 pid,u32 seq,int type,int flags)2161 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
2162 			      u32 pid, u32 seq, int type, int flags)
2163 {
2164 	struct nlmsghdr *nlh;
2165 	struct ndtmsg *ndtmsg;
2166 
2167 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2168 	if (nlh == NULL)
2169 		return -EMSGSIZE;
2170 
2171 	ndtmsg = nlmsg_data(nlh);
2172 
2173 	read_lock_bh(&tbl->lock);
2174 	ndtmsg->ndtm_family = tbl->family;
2175 	ndtmsg->ndtm_pad1   = 0;
2176 	ndtmsg->ndtm_pad2   = 0;
2177 
2178 	if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
2179 	    nla_put_msecs(skb, NDTA_GC_INTERVAL, READ_ONCE(tbl->gc_interval),
2180 			  NDTA_PAD) ||
2181 	    nla_put_u32(skb, NDTA_THRESH1, READ_ONCE(tbl->gc_thresh1)) ||
2182 	    nla_put_u32(skb, NDTA_THRESH2, READ_ONCE(tbl->gc_thresh2)) ||
2183 	    nla_put_u32(skb, NDTA_THRESH3, READ_ONCE(tbl->gc_thresh3)))
2184 		goto nla_put_failure;
2185 	{
2186 		unsigned long now = jiffies;
2187 		long flush_delta = now - READ_ONCE(tbl->last_flush);
2188 		long rand_delta = now - READ_ONCE(tbl->last_rand);
2189 		struct neigh_hash_table *nht;
2190 		struct ndt_config ndc = {
2191 			.ndtc_key_len		= tbl->key_len,
2192 			.ndtc_entry_size	= tbl->entry_size,
2193 			.ndtc_entries		= atomic_read(&tbl->entries),
2194 			.ndtc_last_flush	= jiffies_to_msecs(flush_delta),
2195 			.ndtc_last_rand		= jiffies_to_msecs(rand_delta),
2196 			.ndtc_proxy_qlen	= READ_ONCE(tbl->proxy_queue.qlen),
2197 		};
2198 
2199 		rcu_read_lock();
2200 		nht = rcu_dereference(tbl->nht);
2201 		ndc.ndtc_hash_rnd = nht->hash_rnd[0];
2202 		ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
2203 		rcu_read_unlock();
2204 
2205 		if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
2206 			goto nla_put_failure;
2207 	}
2208 
2209 	{
2210 		int cpu;
2211 		struct ndt_stats ndst;
2212 
2213 		memset(&ndst, 0, sizeof(ndst));
2214 
2215 		for_each_possible_cpu(cpu) {
2216 			struct neigh_statistics	*st;
2217 
2218 			st = per_cpu_ptr(tbl->stats, cpu);
2219 			ndst.ndts_allocs		+= READ_ONCE(st->allocs);
2220 			ndst.ndts_destroys		+= READ_ONCE(st->destroys);
2221 			ndst.ndts_hash_grows		+= READ_ONCE(st->hash_grows);
2222 			ndst.ndts_res_failed		+= READ_ONCE(st->res_failed);
2223 			ndst.ndts_lookups		+= READ_ONCE(st->lookups);
2224 			ndst.ndts_hits			+= READ_ONCE(st->hits);
2225 			ndst.ndts_rcv_probes_mcast	+= READ_ONCE(st->rcv_probes_mcast);
2226 			ndst.ndts_rcv_probes_ucast	+= READ_ONCE(st->rcv_probes_ucast);
2227 			ndst.ndts_periodic_gc_runs	+= READ_ONCE(st->periodic_gc_runs);
2228 			ndst.ndts_forced_gc_runs	+= READ_ONCE(st->forced_gc_runs);
2229 			ndst.ndts_table_fulls		+= READ_ONCE(st->table_fulls);
2230 		}
2231 
2232 		if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
2233 				  NDTA_PAD))
2234 			goto nla_put_failure;
2235 	}
2236 
2237 	BUG_ON(tbl->parms.dev);
2238 	if (neightbl_fill_parms(skb, &tbl->parms) < 0)
2239 		goto nla_put_failure;
2240 
2241 	read_unlock_bh(&tbl->lock);
2242 	nlmsg_end(skb, nlh);
2243 	return 0;
2244 
2245 nla_put_failure:
2246 	read_unlock_bh(&tbl->lock);
2247 	nlmsg_cancel(skb, nlh);
2248 	return -EMSGSIZE;
2249 }
2250 
neightbl_fill_param_info(struct sk_buff * skb,struct neigh_table * tbl,struct neigh_parms * parms,u32 pid,u32 seq,int type,unsigned int flags)2251 static int neightbl_fill_param_info(struct sk_buff *skb,
2252 				    struct neigh_table *tbl,
2253 				    struct neigh_parms *parms,
2254 				    u32 pid, u32 seq, int type,
2255 				    unsigned int flags)
2256 {
2257 	struct ndtmsg *ndtmsg;
2258 	struct nlmsghdr *nlh;
2259 
2260 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2261 	if (nlh == NULL)
2262 		return -EMSGSIZE;
2263 
2264 	ndtmsg = nlmsg_data(nlh);
2265 
2266 	read_lock_bh(&tbl->lock);
2267 	ndtmsg->ndtm_family = tbl->family;
2268 	ndtmsg->ndtm_pad1   = 0;
2269 	ndtmsg->ndtm_pad2   = 0;
2270 
2271 	if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
2272 	    neightbl_fill_parms(skb, parms) < 0)
2273 		goto errout;
2274 
2275 	read_unlock_bh(&tbl->lock);
2276 	nlmsg_end(skb, nlh);
2277 	return 0;
2278 errout:
2279 	read_unlock_bh(&tbl->lock);
2280 	nlmsg_cancel(skb, nlh);
2281 	return -EMSGSIZE;
2282 }
2283 
2284 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
2285 	[NDTA_NAME]		= { .type = NLA_STRING },
2286 	[NDTA_THRESH1]		= { .type = NLA_U32 },
2287 	[NDTA_THRESH2]		= { .type = NLA_U32 },
2288 	[NDTA_THRESH3]		= { .type = NLA_U32 },
2289 	[NDTA_GC_INTERVAL]	= { .type = NLA_U64 },
2290 	[NDTA_PARMS]		= { .type = NLA_NESTED },
2291 };
2292 
2293 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
2294 	[NDTPA_IFINDEX]			= { .type = NLA_U32 },
2295 	[NDTPA_QUEUE_LEN]		= { .type = NLA_U32 },
2296 	[NDTPA_PROXY_QLEN]		= { .type = NLA_U32 },
2297 	[NDTPA_APP_PROBES]		= { .type = NLA_U32 },
2298 	[NDTPA_UCAST_PROBES]		= { .type = NLA_U32 },
2299 	[NDTPA_MCAST_PROBES]		= { .type = NLA_U32 },
2300 	[NDTPA_MCAST_REPROBES]		= { .type = NLA_U32 },
2301 	[NDTPA_BASE_REACHABLE_TIME]	= { .type = NLA_U64 },
2302 	[NDTPA_GC_STALETIME]		= { .type = NLA_U64 },
2303 	[NDTPA_DELAY_PROBE_TIME]	= { .type = NLA_U64 },
2304 	[NDTPA_RETRANS_TIME]		= { .type = NLA_U64 },
2305 	[NDTPA_ANYCAST_DELAY]		= { .type = NLA_U64 },
2306 	[NDTPA_PROXY_DELAY]		= { .type = NLA_U64 },
2307 	[NDTPA_LOCKTIME]		= { .type = NLA_U64 },
2308 	[NDTPA_INTERVAL_PROBE_TIME_MS]	= { .type = NLA_U64, .min = 1 },
2309 };
2310 
neightbl_set(struct sk_buff * skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)2311 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
2312 			struct netlink_ext_ack *extack)
2313 {
2314 	struct net *net = sock_net(skb->sk);
2315 	struct neigh_table *tbl;
2316 	struct ndtmsg *ndtmsg;
2317 	struct nlattr *tb[NDTA_MAX+1];
2318 	bool found = false;
2319 	int err, tidx;
2320 
2321 	err = nlmsg_parse_deprecated(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
2322 				     nl_neightbl_policy, extack);
2323 	if (err < 0)
2324 		goto errout;
2325 
2326 	if (tb[NDTA_NAME] == NULL) {
2327 		err = -EINVAL;
2328 		goto errout;
2329 	}
2330 
2331 	ndtmsg = nlmsg_data(nlh);
2332 
2333 	for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2334 		tbl = neigh_tables[tidx];
2335 		if (!tbl)
2336 			continue;
2337 		if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2338 			continue;
2339 		if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2340 			found = true;
2341 			break;
2342 		}
2343 	}
2344 
2345 	if (!found)
2346 		return -ENOENT;
2347 
2348 	/*
2349 	 * We acquire tbl->lock to be nice to the periodic timers and
2350 	 * make sure they always see a consistent set of values.
2351 	 */
2352 	write_lock_bh(&tbl->lock);
2353 
2354 	if (tb[NDTA_PARMS]) {
2355 		struct nlattr *tbp[NDTPA_MAX+1];
2356 		struct neigh_parms *p;
2357 		int i, ifindex = 0;
2358 
2359 		err = nla_parse_nested_deprecated(tbp, NDTPA_MAX,
2360 						  tb[NDTA_PARMS],
2361 						  nl_ntbl_parm_policy, extack);
2362 		if (err < 0)
2363 			goto errout_tbl_lock;
2364 
2365 		if (tbp[NDTPA_IFINDEX])
2366 			ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2367 
2368 		p = lookup_neigh_parms(tbl, net, ifindex);
2369 		if (p == NULL) {
2370 			err = -ENOENT;
2371 			goto errout_tbl_lock;
2372 		}
2373 
2374 		for (i = 1; i <= NDTPA_MAX; i++) {
2375 			if (tbp[i] == NULL)
2376 				continue;
2377 
2378 			switch (i) {
2379 			case NDTPA_QUEUE_LEN:
2380 				NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2381 					      nla_get_u32(tbp[i]) *
2382 					      SKB_TRUESIZE(ETH_FRAME_LEN));
2383 				break;
2384 			case NDTPA_QUEUE_LENBYTES:
2385 				NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2386 					      nla_get_u32(tbp[i]));
2387 				break;
2388 			case NDTPA_PROXY_QLEN:
2389 				NEIGH_VAR_SET(p, PROXY_QLEN,
2390 					      nla_get_u32(tbp[i]));
2391 				break;
2392 			case NDTPA_APP_PROBES:
2393 				NEIGH_VAR_SET(p, APP_PROBES,
2394 					      nla_get_u32(tbp[i]));
2395 				break;
2396 			case NDTPA_UCAST_PROBES:
2397 				NEIGH_VAR_SET(p, UCAST_PROBES,
2398 					      nla_get_u32(tbp[i]));
2399 				break;
2400 			case NDTPA_MCAST_PROBES:
2401 				NEIGH_VAR_SET(p, MCAST_PROBES,
2402 					      nla_get_u32(tbp[i]));
2403 				break;
2404 			case NDTPA_MCAST_REPROBES:
2405 				NEIGH_VAR_SET(p, MCAST_REPROBES,
2406 					      nla_get_u32(tbp[i]));
2407 				break;
2408 			case NDTPA_BASE_REACHABLE_TIME:
2409 				NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2410 					      nla_get_msecs(tbp[i]));
2411 				/* update reachable_time as well, otherwise, the change will
2412 				 * only be effective after the next time neigh_periodic_work
2413 				 * decides to recompute it (can be multiple minutes)
2414 				 */
2415 				p->reachable_time =
2416 					neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2417 				break;
2418 			case NDTPA_GC_STALETIME:
2419 				NEIGH_VAR_SET(p, GC_STALETIME,
2420 					      nla_get_msecs(tbp[i]));
2421 				break;
2422 			case NDTPA_DELAY_PROBE_TIME:
2423 				NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2424 					      nla_get_msecs(tbp[i]));
2425 				call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2426 				break;
2427 			case NDTPA_INTERVAL_PROBE_TIME_MS:
2428 				NEIGH_VAR_SET(p, INTERVAL_PROBE_TIME_MS,
2429 					      nla_get_msecs(tbp[i]));
2430 				break;
2431 			case NDTPA_RETRANS_TIME:
2432 				NEIGH_VAR_SET(p, RETRANS_TIME,
2433 					      nla_get_msecs(tbp[i]));
2434 				break;
2435 			case NDTPA_ANYCAST_DELAY:
2436 				NEIGH_VAR_SET(p, ANYCAST_DELAY,
2437 					      nla_get_msecs(tbp[i]));
2438 				break;
2439 			case NDTPA_PROXY_DELAY:
2440 				NEIGH_VAR_SET(p, PROXY_DELAY,
2441 					      nla_get_msecs(tbp[i]));
2442 				break;
2443 			case NDTPA_LOCKTIME:
2444 				NEIGH_VAR_SET(p, LOCKTIME,
2445 					      nla_get_msecs(tbp[i]));
2446 				break;
2447 			}
2448 		}
2449 	}
2450 
2451 	err = -ENOENT;
2452 	if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2453 	     tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2454 	    !net_eq(net, &init_net))
2455 		goto errout_tbl_lock;
2456 
2457 	if (tb[NDTA_THRESH1])
2458 		WRITE_ONCE(tbl->gc_thresh1, nla_get_u32(tb[NDTA_THRESH1]));
2459 
2460 	if (tb[NDTA_THRESH2])
2461 		WRITE_ONCE(tbl->gc_thresh2, nla_get_u32(tb[NDTA_THRESH2]));
2462 
2463 	if (tb[NDTA_THRESH3])
2464 		WRITE_ONCE(tbl->gc_thresh3, nla_get_u32(tb[NDTA_THRESH3]));
2465 
2466 	if (tb[NDTA_GC_INTERVAL])
2467 		WRITE_ONCE(tbl->gc_interval, nla_get_msecs(tb[NDTA_GC_INTERVAL]));
2468 
2469 	err = 0;
2470 
2471 errout_tbl_lock:
2472 	write_unlock_bh(&tbl->lock);
2473 errout:
2474 	return err;
2475 }
2476 
neightbl_valid_dump_info(const struct nlmsghdr * nlh,struct netlink_ext_ack * extack)2477 static int neightbl_valid_dump_info(const struct nlmsghdr *nlh,
2478 				    struct netlink_ext_ack *extack)
2479 {
2480 	struct ndtmsg *ndtm;
2481 
2482 	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndtm))) {
2483 		NL_SET_ERR_MSG(extack, "Invalid header for neighbor table dump request");
2484 		return -EINVAL;
2485 	}
2486 
2487 	ndtm = nlmsg_data(nlh);
2488 	if (ndtm->ndtm_pad1  || ndtm->ndtm_pad2) {
2489 		NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor table dump request");
2490 		return -EINVAL;
2491 	}
2492 
2493 	if (nlmsg_attrlen(nlh, sizeof(*ndtm))) {
2494 		NL_SET_ERR_MSG(extack, "Invalid data after header in neighbor table dump request");
2495 		return -EINVAL;
2496 	}
2497 
2498 	return 0;
2499 }
2500 
neightbl_dump_info(struct sk_buff * skb,struct netlink_callback * cb)2501 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2502 {
2503 	const struct nlmsghdr *nlh = cb->nlh;
2504 	struct net *net = sock_net(skb->sk);
2505 	int family, tidx, nidx = 0;
2506 	int tbl_skip = cb->args[0];
2507 	int neigh_skip = cb->args[1];
2508 	struct neigh_table *tbl;
2509 
2510 	if (cb->strict_check) {
2511 		int err = neightbl_valid_dump_info(nlh, cb->extack);
2512 
2513 		if (err < 0)
2514 			return err;
2515 	}
2516 
2517 	family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2518 
2519 	for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2520 		struct neigh_parms *p;
2521 
2522 		tbl = neigh_tables[tidx];
2523 		if (!tbl)
2524 			continue;
2525 
2526 		if (tidx < tbl_skip || (family && tbl->family != family))
2527 			continue;
2528 
2529 		if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2530 				       nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2531 				       NLM_F_MULTI) < 0)
2532 			break;
2533 
2534 		nidx = 0;
2535 		p = list_next_entry(&tbl->parms, list);
2536 		list_for_each_entry_from(p, &tbl->parms_list, list) {
2537 			if (!net_eq(neigh_parms_net(p), net))
2538 				continue;
2539 
2540 			if (nidx < neigh_skip)
2541 				goto next;
2542 
2543 			if (neightbl_fill_param_info(skb, tbl, p,
2544 						     NETLINK_CB(cb->skb).portid,
2545 						     nlh->nlmsg_seq,
2546 						     RTM_NEWNEIGHTBL,
2547 						     NLM_F_MULTI) < 0)
2548 				goto out;
2549 		next:
2550 			nidx++;
2551 		}
2552 
2553 		neigh_skip = 0;
2554 	}
2555 out:
2556 	cb->args[0] = tidx;
2557 	cb->args[1] = nidx;
2558 
2559 	return skb->len;
2560 }
2561 
neigh_fill_info(struct sk_buff * skb,struct neighbour * neigh,u32 pid,u32 seq,int type,unsigned int flags)2562 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2563 			   u32 pid, u32 seq, int type, unsigned int flags)
2564 {
2565 	u32 neigh_flags, neigh_flags_ext;
2566 	unsigned long now = jiffies;
2567 	struct nda_cacheinfo ci;
2568 	struct nlmsghdr *nlh;
2569 	struct ndmsg *ndm;
2570 
2571 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2572 	if (nlh == NULL)
2573 		return -EMSGSIZE;
2574 
2575 	neigh_flags_ext = neigh->flags >> NTF_EXT_SHIFT;
2576 	neigh_flags     = neigh->flags & NTF_OLD_MASK;
2577 
2578 	ndm = nlmsg_data(nlh);
2579 	ndm->ndm_family	 = neigh->ops->family;
2580 	ndm->ndm_pad1    = 0;
2581 	ndm->ndm_pad2    = 0;
2582 	ndm->ndm_flags	 = neigh_flags;
2583 	ndm->ndm_type	 = neigh->type;
2584 	ndm->ndm_ifindex = neigh->dev->ifindex;
2585 
2586 	if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2587 		goto nla_put_failure;
2588 
2589 	read_lock_bh(&neigh->lock);
2590 	ndm->ndm_state	 = neigh->nud_state;
2591 	if (neigh->nud_state & NUD_VALID) {
2592 		char haddr[MAX_ADDR_LEN];
2593 
2594 		neigh_ha_snapshot(haddr, neigh, neigh->dev);
2595 		if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2596 			read_unlock_bh(&neigh->lock);
2597 			goto nla_put_failure;
2598 		}
2599 	}
2600 
2601 	ci.ndm_used	 = jiffies_to_clock_t(now - neigh->used);
2602 	ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2603 	ci.ndm_updated	 = jiffies_to_clock_t(now - neigh->updated);
2604 	ci.ndm_refcnt	 = refcount_read(&neigh->refcnt) - 1;
2605 	read_unlock_bh(&neigh->lock);
2606 
2607 	if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2608 	    nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2609 		goto nla_put_failure;
2610 
2611 	if (neigh->protocol && nla_put_u8(skb, NDA_PROTOCOL, neigh->protocol))
2612 		goto nla_put_failure;
2613 	if (neigh_flags_ext && nla_put_u32(skb, NDA_FLAGS_EXT, neigh_flags_ext))
2614 		goto nla_put_failure;
2615 
2616 	nlmsg_end(skb, nlh);
2617 	return 0;
2618 
2619 nla_put_failure:
2620 	nlmsg_cancel(skb, nlh);
2621 	return -EMSGSIZE;
2622 }
2623 
pneigh_fill_info(struct sk_buff * skb,struct pneigh_entry * pn,u32 pid,u32 seq,int type,unsigned int flags,struct neigh_table * tbl)2624 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2625 			    u32 pid, u32 seq, int type, unsigned int flags,
2626 			    struct neigh_table *tbl)
2627 {
2628 	u32 neigh_flags, neigh_flags_ext;
2629 	struct nlmsghdr *nlh;
2630 	struct ndmsg *ndm;
2631 
2632 	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2633 	if (nlh == NULL)
2634 		return -EMSGSIZE;
2635 
2636 	neigh_flags_ext = pn->flags >> NTF_EXT_SHIFT;
2637 	neigh_flags     = pn->flags & NTF_OLD_MASK;
2638 
2639 	ndm = nlmsg_data(nlh);
2640 	ndm->ndm_family	 = tbl->family;
2641 	ndm->ndm_pad1    = 0;
2642 	ndm->ndm_pad2    = 0;
2643 	ndm->ndm_flags	 = neigh_flags | NTF_PROXY;
2644 	ndm->ndm_type	 = RTN_UNICAST;
2645 	ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2646 	ndm->ndm_state	 = NUD_NONE;
2647 
2648 	if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2649 		goto nla_put_failure;
2650 
2651 	if (pn->protocol && nla_put_u8(skb, NDA_PROTOCOL, pn->protocol))
2652 		goto nla_put_failure;
2653 	if (neigh_flags_ext && nla_put_u32(skb, NDA_FLAGS_EXT, neigh_flags_ext))
2654 		goto nla_put_failure;
2655 
2656 	nlmsg_end(skb, nlh);
2657 	return 0;
2658 
2659 nla_put_failure:
2660 	nlmsg_cancel(skb, nlh);
2661 	return -EMSGSIZE;
2662 }
2663 
neigh_update_notify(struct neighbour * neigh,u32 nlmsg_pid)2664 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2665 {
2666 	call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2667 	__neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2668 }
2669 
neigh_master_filtered(struct net_device * dev,int master_idx)2670 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2671 {
2672 	struct net_device *master;
2673 
2674 	if (!master_idx)
2675 		return false;
2676 
2677 	master = dev ? netdev_master_upper_dev_get(dev) : NULL;
2678 
2679 	/* 0 is already used to denote NDA_MASTER wasn't passed, therefore need another
2680 	 * invalid value for ifindex to denote "no master".
2681 	 */
2682 	if (master_idx == -1)
2683 		return !!master;
2684 
2685 	if (!master || master->ifindex != master_idx)
2686 		return true;
2687 
2688 	return false;
2689 }
2690 
neigh_ifindex_filtered(struct net_device * dev,int filter_idx)2691 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2692 {
2693 	if (filter_idx && (!dev || dev->ifindex != filter_idx))
2694 		return true;
2695 
2696 	return false;
2697 }
2698 
2699 struct neigh_dump_filter {
2700 	int master_idx;
2701 	int dev_idx;
2702 };
2703 
neigh_dump_table(struct neigh_table * tbl,struct sk_buff * skb,struct netlink_callback * cb,struct neigh_dump_filter * filter)2704 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2705 			    struct netlink_callback *cb,
2706 			    struct neigh_dump_filter *filter)
2707 {
2708 	struct net *net = sock_net(skb->sk);
2709 	struct neighbour *n;
2710 	int rc, h, s_h = cb->args[1];
2711 	int idx, s_idx = idx = cb->args[2];
2712 	struct neigh_hash_table *nht;
2713 	unsigned int flags = NLM_F_MULTI;
2714 
2715 	if (filter->dev_idx || filter->master_idx)
2716 		flags |= NLM_F_DUMP_FILTERED;
2717 
2718 	rcu_read_lock();
2719 	nht = rcu_dereference(tbl->nht);
2720 
2721 	for (h = s_h; h < (1 << nht->hash_shift); h++) {
2722 		if (h > s_h)
2723 			s_idx = 0;
2724 		for (n = rcu_dereference(nht->hash_buckets[h]), idx = 0;
2725 		     n != NULL;
2726 		     n = rcu_dereference(n->next)) {
2727 			if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2728 				goto next;
2729 			if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2730 			    neigh_master_filtered(n->dev, filter->master_idx))
2731 				goto next;
2732 			if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2733 					    cb->nlh->nlmsg_seq,
2734 					    RTM_NEWNEIGH,
2735 					    flags) < 0) {
2736 				rc = -1;
2737 				goto out;
2738 			}
2739 next:
2740 			idx++;
2741 		}
2742 	}
2743 	rc = skb->len;
2744 out:
2745 	rcu_read_unlock();
2746 	cb->args[1] = h;
2747 	cb->args[2] = idx;
2748 	return rc;
2749 }
2750 
pneigh_dump_table(struct neigh_table * tbl,struct sk_buff * skb,struct netlink_callback * cb,struct neigh_dump_filter * filter)2751 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2752 			     struct netlink_callback *cb,
2753 			     struct neigh_dump_filter *filter)
2754 {
2755 	struct pneigh_entry *n;
2756 	struct net *net = sock_net(skb->sk);
2757 	int rc, h, s_h = cb->args[3];
2758 	int idx, s_idx = idx = cb->args[4];
2759 	unsigned int flags = NLM_F_MULTI;
2760 
2761 	if (filter->dev_idx || filter->master_idx)
2762 		flags |= NLM_F_DUMP_FILTERED;
2763 
2764 	read_lock_bh(&tbl->lock);
2765 
2766 	for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2767 		if (h > s_h)
2768 			s_idx = 0;
2769 		for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2770 			if (idx < s_idx || pneigh_net(n) != net)
2771 				goto next;
2772 			if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2773 			    neigh_master_filtered(n->dev, filter->master_idx))
2774 				goto next;
2775 			if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2776 					    cb->nlh->nlmsg_seq,
2777 					    RTM_NEWNEIGH, flags, tbl) < 0) {
2778 				read_unlock_bh(&tbl->lock);
2779 				rc = -1;
2780 				goto out;
2781 			}
2782 		next:
2783 			idx++;
2784 		}
2785 	}
2786 
2787 	read_unlock_bh(&tbl->lock);
2788 	rc = skb->len;
2789 out:
2790 	cb->args[3] = h;
2791 	cb->args[4] = idx;
2792 	return rc;
2793 
2794 }
2795 
neigh_valid_dump_req(const struct nlmsghdr * nlh,bool strict_check,struct neigh_dump_filter * filter,struct netlink_ext_ack * extack)2796 static int neigh_valid_dump_req(const struct nlmsghdr *nlh,
2797 				bool strict_check,
2798 				struct neigh_dump_filter *filter,
2799 				struct netlink_ext_ack *extack)
2800 {
2801 	struct nlattr *tb[NDA_MAX + 1];
2802 	int err, i;
2803 
2804 	if (strict_check) {
2805 		struct ndmsg *ndm;
2806 
2807 		if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2808 			NL_SET_ERR_MSG(extack, "Invalid header for neighbor dump request");
2809 			return -EINVAL;
2810 		}
2811 
2812 		ndm = nlmsg_data(nlh);
2813 		if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_ifindex ||
2814 		    ndm->ndm_state || ndm->ndm_type) {
2815 			NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor dump request");
2816 			return -EINVAL;
2817 		}
2818 
2819 		if (ndm->ndm_flags & ~NTF_PROXY) {
2820 			NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor dump request");
2821 			return -EINVAL;
2822 		}
2823 
2824 		err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg),
2825 						    tb, NDA_MAX, nda_policy,
2826 						    extack);
2827 	} else {
2828 		err = nlmsg_parse_deprecated(nlh, sizeof(struct ndmsg), tb,
2829 					     NDA_MAX, nda_policy, extack);
2830 	}
2831 	if (err < 0)
2832 		return err;
2833 
2834 	for (i = 0; i <= NDA_MAX; ++i) {
2835 		if (!tb[i])
2836 			continue;
2837 
2838 		/* all new attributes should require strict_check */
2839 		switch (i) {
2840 		case NDA_IFINDEX:
2841 			filter->dev_idx = nla_get_u32(tb[i]);
2842 			break;
2843 		case NDA_MASTER:
2844 			filter->master_idx = nla_get_u32(tb[i]);
2845 			break;
2846 		default:
2847 			if (strict_check) {
2848 				NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor dump request");
2849 				return -EINVAL;
2850 			}
2851 		}
2852 	}
2853 
2854 	return 0;
2855 }
2856 
neigh_dump_info(struct sk_buff * skb,struct netlink_callback * cb)2857 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2858 {
2859 	const struct nlmsghdr *nlh = cb->nlh;
2860 	struct neigh_dump_filter filter = {};
2861 	struct neigh_table *tbl;
2862 	int t, family, s_t;
2863 	int proxy = 0;
2864 	int err;
2865 
2866 	family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2867 
2868 	/* check for full ndmsg structure presence, family member is
2869 	 * the same for both structures
2870 	 */
2871 	if (nlmsg_len(nlh) >= sizeof(struct ndmsg) &&
2872 	    ((struct ndmsg *)nlmsg_data(nlh))->ndm_flags == NTF_PROXY)
2873 		proxy = 1;
2874 
2875 	err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack);
2876 	if (err < 0 && cb->strict_check)
2877 		return err;
2878 
2879 	s_t = cb->args[0];
2880 
2881 	for (t = 0; t < NEIGH_NR_TABLES; t++) {
2882 		tbl = neigh_tables[t];
2883 
2884 		if (!tbl)
2885 			continue;
2886 		if (t < s_t || (family && tbl->family != family))
2887 			continue;
2888 		if (t > s_t)
2889 			memset(&cb->args[1], 0, sizeof(cb->args) -
2890 						sizeof(cb->args[0]));
2891 		if (proxy)
2892 			err = pneigh_dump_table(tbl, skb, cb, &filter);
2893 		else
2894 			err = neigh_dump_table(tbl, skb, cb, &filter);
2895 		if (err < 0)
2896 			break;
2897 	}
2898 
2899 	cb->args[0] = t;
2900 	return skb->len;
2901 }
2902 
neigh_valid_get_req(const struct nlmsghdr * nlh,struct neigh_table ** tbl,void ** dst,int * dev_idx,u8 * ndm_flags,struct netlink_ext_ack * extack)2903 static int neigh_valid_get_req(const struct nlmsghdr *nlh,
2904 			       struct neigh_table **tbl,
2905 			       void **dst, int *dev_idx, u8 *ndm_flags,
2906 			       struct netlink_ext_ack *extack)
2907 {
2908 	struct nlattr *tb[NDA_MAX + 1];
2909 	struct ndmsg *ndm;
2910 	int err, i;
2911 
2912 	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2913 		NL_SET_ERR_MSG(extack, "Invalid header for neighbor get request");
2914 		return -EINVAL;
2915 	}
2916 
2917 	ndm = nlmsg_data(nlh);
2918 	if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
2919 	    ndm->ndm_type) {
2920 		NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor get request");
2921 		return -EINVAL;
2922 	}
2923 
2924 	if (ndm->ndm_flags & ~NTF_PROXY) {
2925 		NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor get request");
2926 		return -EINVAL;
2927 	}
2928 
2929 	err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg), tb,
2930 					    NDA_MAX, nda_policy, extack);
2931 	if (err < 0)
2932 		return err;
2933 
2934 	*ndm_flags = ndm->ndm_flags;
2935 	*dev_idx = ndm->ndm_ifindex;
2936 	*tbl = neigh_find_table(ndm->ndm_family);
2937 	if (*tbl == NULL) {
2938 		NL_SET_ERR_MSG(extack, "Unsupported family in header for neighbor get request");
2939 		return -EAFNOSUPPORT;
2940 	}
2941 
2942 	for (i = 0; i <= NDA_MAX; ++i) {
2943 		if (!tb[i])
2944 			continue;
2945 
2946 		switch (i) {
2947 		case NDA_DST:
2948 			if (nla_len(tb[i]) != (int)(*tbl)->key_len) {
2949 				NL_SET_ERR_MSG(extack, "Invalid network address in neighbor get request");
2950 				return -EINVAL;
2951 			}
2952 			*dst = nla_data(tb[i]);
2953 			break;
2954 		default:
2955 			NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor get request");
2956 			return -EINVAL;
2957 		}
2958 	}
2959 
2960 	return 0;
2961 }
2962 
neigh_nlmsg_size(void)2963 static inline size_t neigh_nlmsg_size(void)
2964 {
2965 	return NLMSG_ALIGN(sizeof(struct ndmsg))
2966 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2967 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2968 	       + nla_total_size(sizeof(struct nda_cacheinfo))
2969 	       + nla_total_size(4)  /* NDA_PROBES */
2970 	       + nla_total_size(4)  /* NDA_FLAGS_EXT */
2971 	       + nla_total_size(1); /* NDA_PROTOCOL */
2972 }
2973 
neigh_get_reply(struct net * net,struct neighbour * neigh,u32 pid,u32 seq)2974 static int neigh_get_reply(struct net *net, struct neighbour *neigh,
2975 			   u32 pid, u32 seq)
2976 {
2977 	struct sk_buff *skb;
2978 	int err = 0;
2979 
2980 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_KERNEL);
2981 	if (!skb)
2982 		return -ENOBUFS;
2983 
2984 	err = neigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0);
2985 	if (err) {
2986 		kfree_skb(skb);
2987 		goto errout;
2988 	}
2989 
2990 	err = rtnl_unicast(skb, net, pid);
2991 errout:
2992 	return err;
2993 }
2994 
pneigh_nlmsg_size(void)2995 static inline size_t pneigh_nlmsg_size(void)
2996 {
2997 	return NLMSG_ALIGN(sizeof(struct ndmsg))
2998 	       + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2999 	       + nla_total_size(4)  /* NDA_FLAGS_EXT */
3000 	       + nla_total_size(1); /* NDA_PROTOCOL */
3001 }
3002 
pneigh_get_reply(struct net * net,struct pneigh_entry * neigh,u32 pid,u32 seq,struct neigh_table * tbl)3003 static int pneigh_get_reply(struct net *net, struct pneigh_entry *neigh,
3004 			    u32 pid, u32 seq, struct neigh_table *tbl)
3005 {
3006 	struct sk_buff *skb;
3007 	int err = 0;
3008 
3009 	skb = nlmsg_new(pneigh_nlmsg_size(), GFP_KERNEL);
3010 	if (!skb)
3011 		return -ENOBUFS;
3012 
3013 	err = pneigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0, tbl);
3014 	if (err) {
3015 		kfree_skb(skb);
3016 		goto errout;
3017 	}
3018 
3019 	err = rtnl_unicast(skb, net, pid);
3020 errout:
3021 	return err;
3022 }
3023 
neigh_get(struct sk_buff * in_skb,struct nlmsghdr * nlh,struct netlink_ext_ack * extack)3024 static int neigh_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
3025 		     struct netlink_ext_ack *extack)
3026 {
3027 	struct net *net = sock_net(in_skb->sk);
3028 	struct net_device *dev = NULL;
3029 	struct neigh_table *tbl = NULL;
3030 	struct neighbour *neigh;
3031 	void *dst = NULL;
3032 	u8 ndm_flags = 0;
3033 	int dev_idx = 0;
3034 	int err;
3035 
3036 	err = neigh_valid_get_req(nlh, &tbl, &dst, &dev_idx, &ndm_flags,
3037 				  extack);
3038 	if (err < 0)
3039 		return err;
3040 
3041 	if (dev_idx) {
3042 		dev = __dev_get_by_index(net, dev_idx);
3043 		if (!dev) {
3044 			NL_SET_ERR_MSG(extack, "Unknown device ifindex");
3045 			return -ENODEV;
3046 		}
3047 	}
3048 
3049 	if (!dst) {
3050 		NL_SET_ERR_MSG(extack, "Network address not specified");
3051 		return -EINVAL;
3052 	}
3053 
3054 	if (ndm_flags & NTF_PROXY) {
3055 		struct pneigh_entry *pn;
3056 
3057 		pn = pneigh_lookup(tbl, net, dst, dev, 0);
3058 		if (!pn) {
3059 			NL_SET_ERR_MSG(extack, "Proxy neighbour entry not found");
3060 			return -ENOENT;
3061 		}
3062 		return pneigh_get_reply(net, pn, NETLINK_CB(in_skb).portid,
3063 					nlh->nlmsg_seq, tbl);
3064 	}
3065 
3066 	if (!dev) {
3067 		NL_SET_ERR_MSG(extack, "No device specified");
3068 		return -EINVAL;
3069 	}
3070 
3071 	neigh = neigh_lookup(tbl, dst, dev);
3072 	if (!neigh) {
3073 		NL_SET_ERR_MSG(extack, "Neighbour entry not found");
3074 		return -ENOENT;
3075 	}
3076 
3077 	err = neigh_get_reply(net, neigh, NETLINK_CB(in_skb).portid,
3078 			      nlh->nlmsg_seq);
3079 
3080 	neigh_release(neigh);
3081 
3082 	return err;
3083 }
3084 
neigh_for_each(struct neigh_table * tbl,void (* cb)(struct neighbour *,void *),void * cookie)3085 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
3086 {
3087 	int chain;
3088 	struct neigh_hash_table *nht;
3089 
3090 	rcu_read_lock();
3091 	nht = rcu_dereference(tbl->nht);
3092 
3093 	read_lock_bh(&tbl->lock); /* avoid resizes */
3094 	for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
3095 		struct neighbour *n;
3096 
3097 		for (n = rcu_dereference(nht->hash_buckets[chain]);
3098 		     n != NULL;
3099 		     n = rcu_dereference(n->next))
3100 			cb(n, cookie);
3101 	}
3102 	read_unlock_bh(&tbl->lock);
3103 	rcu_read_unlock();
3104 }
3105 EXPORT_SYMBOL(neigh_for_each);
3106 
3107 /* The tbl->lock must be held as a writer and BH disabled. */
__neigh_for_each_release(struct neigh_table * tbl,int (* cb)(struct neighbour *))3108 void __neigh_for_each_release(struct neigh_table *tbl,
3109 			      int (*cb)(struct neighbour *))
3110 {
3111 	int chain;
3112 	struct neigh_hash_table *nht;
3113 
3114 	nht = rcu_dereference_protected(tbl->nht,
3115 					lockdep_is_held(&tbl->lock));
3116 	for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
3117 		struct neighbour *n;
3118 		struct neighbour __rcu **np;
3119 
3120 		np = &nht->hash_buckets[chain];
3121 		while ((n = rcu_dereference_protected(*np,
3122 					lockdep_is_held(&tbl->lock))) != NULL) {
3123 			int release;
3124 
3125 			write_lock(&n->lock);
3126 			release = cb(n);
3127 			if (release) {
3128 				rcu_assign_pointer(*np,
3129 					rcu_dereference_protected(n->next,
3130 						lockdep_is_held(&tbl->lock)));
3131 				neigh_mark_dead(n);
3132 			} else
3133 				np = &n->next;
3134 			write_unlock(&n->lock);
3135 			if (release)
3136 				neigh_cleanup_and_release(n);
3137 		}
3138 	}
3139 }
3140 EXPORT_SYMBOL(__neigh_for_each_release);
3141 
neigh_xmit(int index,struct net_device * dev,const void * addr,struct sk_buff * skb)3142 int neigh_xmit(int index, struct net_device *dev,
3143 	       const void *addr, struct sk_buff *skb)
3144 {
3145 	int err = -EAFNOSUPPORT;
3146 	if (likely(index < NEIGH_NR_TABLES)) {
3147 		struct neigh_table *tbl;
3148 		struct neighbour *neigh;
3149 
3150 		tbl = neigh_tables[index];
3151 		if (!tbl)
3152 			goto out;
3153 		rcu_read_lock();
3154 		if (index == NEIGH_ARP_TABLE) {
3155 			u32 key = *((u32 *)addr);
3156 
3157 			neigh = __ipv4_neigh_lookup_noref(dev, key);
3158 		} else {
3159 			neigh = __neigh_lookup_noref(tbl, addr, dev);
3160 		}
3161 		if (!neigh)
3162 			neigh = __neigh_create(tbl, addr, dev, false);
3163 		err = PTR_ERR(neigh);
3164 		if (IS_ERR(neigh)) {
3165 			rcu_read_unlock();
3166 			goto out_kfree_skb;
3167 		}
3168 		err = READ_ONCE(neigh->output)(neigh, skb);
3169 		rcu_read_unlock();
3170 	}
3171 	else if (index == NEIGH_LINK_TABLE) {
3172 		err = dev_hard_header(skb, dev, ntohs(skb->protocol),
3173 				      addr, NULL, skb->len);
3174 		if (err < 0)
3175 			goto out_kfree_skb;
3176 		err = dev_queue_xmit(skb);
3177 	}
3178 out:
3179 	return err;
3180 out_kfree_skb:
3181 	kfree_skb(skb);
3182 	goto out;
3183 }
3184 EXPORT_SYMBOL(neigh_xmit);
3185 
3186 #ifdef CONFIG_PROC_FS
3187 
neigh_get_first(struct seq_file * seq)3188 static struct neighbour *neigh_get_first(struct seq_file *seq)
3189 {
3190 	struct neigh_seq_state *state = seq->private;
3191 	struct net *net = seq_file_net(seq);
3192 	struct neigh_hash_table *nht = state->nht;
3193 	struct neighbour *n = NULL;
3194 	int bucket;
3195 
3196 	state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
3197 	for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
3198 		n = rcu_dereference(nht->hash_buckets[bucket]);
3199 
3200 		while (n) {
3201 			if (!net_eq(dev_net(n->dev), net))
3202 				goto next;
3203 			if (state->neigh_sub_iter) {
3204 				loff_t fakep = 0;
3205 				void *v;
3206 
3207 				v = state->neigh_sub_iter(state, n, &fakep);
3208 				if (!v)
3209 					goto next;
3210 			}
3211 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3212 				break;
3213 			if (READ_ONCE(n->nud_state) & ~NUD_NOARP)
3214 				break;
3215 next:
3216 			n = rcu_dereference(n->next);
3217 		}
3218 
3219 		if (n)
3220 			break;
3221 	}
3222 	state->bucket = bucket;
3223 
3224 	return n;
3225 }
3226 
neigh_get_next(struct seq_file * seq,struct neighbour * n,loff_t * pos)3227 static struct neighbour *neigh_get_next(struct seq_file *seq,
3228 					struct neighbour *n,
3229 					loff_t *pos)
3230 {
3231 	struct neigh_seq_state *state = seq->private;
3232 	struct net *net = seq_file_net(seq);
3233 	struct neigh_hash_table *nht = state->nht;
3234 
3235 	if (state->neigh_sub_iter) {
3236 		void *v = state->neigh_sub_iter(state, n, pos);
3237 		if (v)
3238 			return n;
3239 	}
3240 	n = rcu_dereference(n->next);
3241 
3242 	while (1) {
3243 		while (n) {
3244 			if (!net_eq(dev_net(n->dev), net))
3245 				goto next;
3246 			if (state->neigh_sub_iter) {
3247 				void *v = state->neigh_sub_iter(state, n, pos);
3248 				if (v)
3249 					return n;
3250 				goto next;
3251 			}
3252 			if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3253 				break;
3254 
3255 			if (READ_ONCE(n->nud_state) & ~NUD_NOARP)
3256 				break;
3257 next:
3258 			n = rcu_dereference(n->next);
3259 		}
3260 
3261 		if (n)
3262 			break;
3263 
3264 		if (++state->bucket >= (1 << nht->hash_shift))
3265 			break;
3266 
3267 		n = rcu_dereference(nht->hash_buckets[state->bucket]);
3268 	}
3269 
3270 	if (n && pos)
3271 		--(*pos);
3272 	return n;
3273 }
3274 
neigh_get_idx(struct seq_file * seq,loff_t * pos)3275 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
3276 {
3277 	struct neighbour *n = neigh_get_first(seq);
3278 
3279 	if (n) {
3280 		--(*pos);
3281 		while (*pos) {
3282 			n = neigh_get_next(seq, n, pos);
3283 			if (!n)
3284 				break;
3285 		}
3286 	}
3287 	return *pos ? NULL : n;
3288 }
3289 
pneigh_get_first(struct seq_file * seq)3290 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
3291 {
3292 	struct neigh_seq_state *state = seq->private;
3293 	struct net *net = seq_file_net(seq);
3294 	struct neigh_table *tbl = state->tbl;
3295 	struct pneigh_entry *pn = NULL;
3296 	int bucket;
3297 
3298 	state->flags |= NEIGH_SEQ_IS_PNEIGH;
3299 	for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
3300 		pn = tbl->phash_buckets[bucket];
3301 		while (pn && !net_eq(pneigh_net(pn), net))
3302 			pn = pn->next;
3303 		if (pn)
3304 			break;
3305 	}
3306 	state->bucket = bucket;
3307 
3308 	return pn;
3309 }
3310 
pneigh_get_next(struct seq_file * seq,struct pneigh_entry * pn,loff_t * pos)3311 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
3312 					    struct pneigh_entry *pn,
3313 					    loff_t *pos)
3314 {
3315 	struct neigh_seq_state *state = seq->private;
3316 	struct net *net = seq_file_net(seq);
3317 	struct neigh_table *tbl = state->tbl;
3318 
3319 	do {
3320 		pn = pn->next;
3321 	} while (pn && !net_eq(pneigh_net(pn), net));
3322 
3323 	while (!pn) {
3324 		if (++state->bucket > PNEIGH_HASHMASK)
3325 			break;
3326 		pn = tbl->phash_buckets[state->bucket];
3327 		while (pn && !net_eq(pneigh_net(pn), net))
3328 			pn = pn->next;
3329 		if (pn)
3330 			break;
3331 	}
3332 
3333 	if (pn && pos)
3334 		--(*pos);
3335 
3336 	return pn;
3337 }
3338 
pneigh_get_idx(struct seq_file * seq,loff_t * pos)3339 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
3340 {
3341 	struct pneigh_entry *pn = pneigh_get_first(seq);
3342 
3343 	if (pn) {
3344 		--(*pos);
3345 		while (*pos) {
3346 			pn = pneigh_get_next(seq, pn, pos);
3347 			if (!pn)
3348 				break;
3349 		}
3350 	}
3351 	return *pos ? NULL : pn;
3352 }
3353 
neigh_get_idx_any(struct seq_file * seq,loff_t * pos)3354 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
3355 {
3356 	struct neigh_seq_state *state = seq->private;
3357 	void *rc;
3358 	loff_t idxpos = *pos;
3359 
3360 	rc = neigh_get_idx(seq, &idxpos);
3361 	if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3362 		rc = pneigh_get_idx(seq, &idxpos);
3363 
3364 	return rc;
3365 }
3366 
neigh_seq_start(struct seq_file * seq,loff_t * pos,struct neigh_table * tbl,unsigned int neigh_seq_flags)3367 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
3368 	__acquires(tbl->lock)
3369 	__acquires(rcu)
3370 {
3371 	struct neigh_seq_state *state = seq->private;
3372 
3373 	state->tbl = tbl;
3374 	state->bucket = 0;
3375 	state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
3376 
3377 	rcu_read_lock();
3378 	state->nht = rcu_dereference(tbl->nht);
3379 	read_lock_bh(&tbl->lock);
3380 
3381 	return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
3382 }
3383 EXPORT_SYMBOL(neigh_seq_start);
3384 
neigh_seq_next(struct seq_file * seq,void * v,loff_t * pos)3385 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3386 {
3387 	struct neigh_seq_state *state;
3388 	void *rc;
3389 
3390 	if (v == SEQ_START_TOKEN) {
3391 		rc = neigh_get_first(seq);
3392 		goto out;
3393 	}
3394 
3395 	state = seq->private;
3396 	if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
3397 		rc = neigh_get_next(seq, v, NULL);
3398 		if (rc)
3399 			goto out;
3400 		if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3401 			rc = pneigh_get_first(seq);
3402 	} else {
3403 		BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
3404 		rc = pneigh_get_next(seq, v, NULL);
3405 	}
3406 out:
3407 	++(*pos);
3408 	return rc;
3409 }
3410 EXPORT_SYMBOL(neigh_seq_next);
3411 
neigh_seq_stop(struct seq_file * seq,void * v)3412 void neigh_seq_stop(struct seq_file *seq, void *v)
3413 	__releases(tbl->lock)
3414 	__releases(rcu)
3415 {
3416 	struct neigh_seq_state *state = seq->private;
3417 	struct neigh_table *tbl = state->tbl;
3418 
3419 	read_unlock_bh(&tbl->lock);
3420 	rcu_read_unlock();
3421 }
3422 EXPORT_SYMBOL(neigh_seq_stop);
3423 
3424 /* statistics via seq_file */
3425 
neigh_stat_seq_start(struct seq_file * seq,loff_t * pos)3426 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
3427 {
3428 	struct neigh_table *tbl = pde_data(file_inode(seq->file));
3429 	int cpu;
3430 
3431 	if (*pos == 0)
3432 		return SEQ_START_TOKEN;
3433 
3434 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
3435 		if (!cpu_possible(cpu))
3436 			continue;
3437 		*pos = cpu+1;
3438 		return per_cpu_ptr(tbl->stats, cpu);
3439 	}
3440 	return NULL;
3441 }
3442 
neigh_stat_seq_next(struct seq_file * seq,void * v,loff_t * pos)3443 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3444 {
3445 	struct neigh_table *tbl = pde_data(file_inode(seq->file));
3446 	int cpu;
3447 
3448 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
3449 		if (!cpu_possible(cpu))
3450 			continue;
3451 		*pos = cpu+1;
3452 		return per_cpu_ptr(tbl->stats, cpu);
3453 	}
3454 	(*pos)++;
3455 	return NULL;
3456 }
3457 
neigh_stat_seq_stop(struct seq_file * seq,void * v)3458 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
3459 {
3460 
3461 }
3462 
neigh_stat_seq_show(struct seq_file * seq,void * v)3463 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
3464 {
3465 	struct neigh_table *tbl = pde_data(file_inode(seq->file));
3466 	struct neigh_statistics *st = v;
3467 
3468 	if (v == SEQ_START_TOKEN) {
3469 		seq_puts(seq, "entries  allocs   destroys hash_grows lookups  hits     res_failed rcv_probes_mcast rcv_probes_ucast periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
3470 		return 0;
3471 	}
3472 
3473 	seq_printf(seq, "%08x %08lx %08lx %08lx   %08lx %08lx %08lx   "
3474 			"%08lx         %08lx         %08lx         "
3475 			"%08lx       %08lx            %08lx\n",
3476 		   atomic_read(&tbl->entries),
3477 
3478 		   st->allocs,
3479 		   st->destroys,
3480 		   st->hash_grows,
3481 
3482 		   st->lookups,
3483 		   st->hits,
3484 
3485 		   st->res_failed,
3486 
3487 		   st->rcv_probes_mcast,
3488 		   st->rcv_probes_ucast,
3489 
3490 		   st->periodic_gc_runs,
3491 		   st->forced_gc_runs,
3492 		   st->unres_discards,
3493 		   st->table_fulls
3494 		   );
3495 
3496 	return 0;
3497 }
3498 
3499 static const struct seq_operations neigh_stat_seq_ops = {
3500 	.start	= neigh_stat_seq_start,
3501 	.next	= neigh_stat_seq_next,
3502 	.stop	= neigh_stat_seq_stop,
3503 	.show	= neigh_stat_seq_show,
3504 };
3505 #endif /* CONFIG_PROC_FS */
3506 
__neigh_notify(struct neighbour * n,int type,int flags,u32 pid)3507 static void __neigh_notify(struct neighbour *n, int type, int flags,
3508 			   u32 pid)
3509 {
3510 	struct net *net = dev_net(n->dev);
3511 	struct sk_buff *skb;
3512 	int err = -ENOBUFS;
3513 
3514 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
3515 	if (skb == NULL)
3516 		goto errout;
3517 
3518 	err = neigh_fill_info(skb, n, pid, 0, type, flags);
3519 	if (err < 0) {
3520 		/* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
3521 		WARN_ON(err == -EMSGSIZE);
3522 		kfree_skb(skb);
3523 		goto errout;
3524 	}
3525 	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
3526 	return;
3527 errout:
3528 	if (err < 0)
3529 		rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
3530 }
3531 
neigh_app_ns(struct neighbour * n)3532 void neigh_app_ns(struct neighbour *n)
3533 {
3534 	__neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
3535 }
3536 EXPORT_SYMBOL(neigh_app_ns);
3537 
3538 #ifdef CONFIG_SYSCTL
3539 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
3540 
proc_unres_qlen(struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3541 static int proc_unres_qlen(struct ctl_table *ctl, int write,
3542 			   void *buffer, size_t *lenp, loff_t *ppos)
3543 {
3544 	int size, ret;
3545 	struct ctl_table tmp = *ctl;
3546 
3547 	tmp.extra1 = SYSCTL_ZERO;
3548 	tmp.extra2 = &unres_qlen_max;
3549 	tmp.data = &size;
3550 
3551 	size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
3552 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3553 
3554 	if (write && !ret)
3555 		*(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
3556 	return ret;
3557 }
3558 
neigh_copy_dflt_parms(struct net * net,struct neigh_parms * p,int index)3559 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
3560 				  int index)
3561 {
3562 	struct net_device *dev;
3563 	int family = neigh_parms_family(p);
3564 
3565 	rcu_read_lock();
3566 	for_each_netdev_rcu(net, dev) {
3567 		struct neigh_parms *dst_p =
3568 				neigh_get_dev_parms_rcu(dev, family);
3569 
3570 		if (dst_p && !test_bit(index, dst_p->data_state))
3571 			dst_p->data[index] = p->data[index];
3572 	}
3573 	rcu_read_unlock();
3574 }
3575 
neigh_proc_update(struct ctl_table * ctl,int write)3576 static void neigh_proc_update(struct ctl_table *ctl, int write)
3577 {
3578 	struct net_device *dev = ctl->extra1;
3579 	struct neigh_parms *p = ctl->extra2;
3580 	struct net *net = neigh_parms_net(p);
3581 	int index = (int *) ctl->data - p->data;
3582 
3583 	if (!write)
3584 		return;
3585 
3586 	set_bit(index, p->data_state);
3587 	if (index == NEIGH_VAR_DELAY_PROBE_TIME)
3588 		call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
3589 	if (!dev) /* NULL dev means this is default value */
3590 		neigh_copy_dflt_parms(net, p, index);
3591 }
3592 
neigh_proc_dointvec_zero_intmax(struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3593 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
3594 					   void *buffer, size_t *lenp,
3595 					   loff_t *ppos)
3596 {
3597 	struct ctl_table tmp = *ctl;
3598 	int ret;
3599 
3600 	tmp.extra1 = SYSCTL_ZERO;
3601 	tmp.extra2 = SYSCTL_INT_MAX;
3602 
3603 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3604 	neigh_proc_update(ctl, write);
3605 	return ret;
3606 }
3607 
neigh_proc_dointvec_ms_jiffies_positive(struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3608 static int neigh_proc_dointvec_ms_jiffies_positive(struct ctl_table *ctl, int write,
3609 						   void *buffer, size_t *lenp, loff_t *ppos)
3610 {
3611 	struct ctl_table tmp = *ctl;
3612 	int ret;
3613 
3614 	int min = msecs_to_jiffies(1);
3615 
3616 	tmp.extra1 = &min;
3617 	tmp.extra2 = NULL;
3618 
3619 	ret = proc_dointvec_ms_jiffies_minmax(&tmp, write, buffer, lenp, ppos);
3620 	neigh_proc_update(ctl, write);
3621 	return ret;
3622 }
3623 
neigh_proc_dointvec(struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3624 int neigh_proc_dointvec(struct ctl_table *ctl, int write, void *buffer,
3625 			size_t *lenp, loff_t *ppos)
3626 {
3627 	int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3628 
3629 	neigh_proc_update(ctl, write);
3630 	return ret;
3631 }
3632 EXPORT_SYMBOL(neigh_proc_dointvec);
3633 
neigh_proc_dointvec_jiffies(struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3634 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write, void *buffer,
3635 				size_t *lenp, loff_t *ppos)
3636 {
3637 	int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3638 
3639 	neigh_proc_update(ctl, write);
3640 	return ret;
3641 }
3642 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3643 
neigh_proc_dointvec_userhz_jiffies(struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3644 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3645 					      void *buffer, size_t *lenp,
3646 					      loff_t *ppos)
3647 {
3648 	int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3649 
3650 	neigh_proc_update(ctl, write);
3651 	return ret;
3652 }
3653 
neigh_proc_dointvec_ms_jiffies(struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3654 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3655 				   void *buffer, size_t *lenp, loff_t *ppos)
3656 {
3657 	int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3658 
3659 	neigh_proc_update(ctl, write);
3660 	return ret;
3661 }
3662 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3663 
neigh_proc_dointvec_unres_qlen(struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3664 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3665 					  void *buffer, size_t *lenp,
3666 					  loff_t *ppos)
3667 {
3668 	int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3669 
3670 	neigh_proc_update(ctl, write);
3671 	return ret;
3672 }
3673 
neigh_proc_base_reachable_time(struct ctl_table * ctl,int write,void * buffer,size_t * lenp,loff_t * ppos)3674 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3675 					  void *buffer, size_t *lenp,
3676 					  loff_t *ppos)
3677 {
3678 	struct neigh_parms *p = ctl->extra2;
3679 	int ret;
3680 
3681 	if (strcmp(ctl->procname, "base_reachable_time") == 0)
3682 		ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3683 	else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3684 		ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3685 	else
3686 		ret = -1;
3687 
3688 	if (write && ret == 0) {
3689 		/* update reachable_time as well, otherwise, the change will
3690 		 * only be effective after the next time neigh_periodic_work
3691 		 * decides to recompute it
3692 		 */
3693 		p->reachable_time =
3694 			neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3695 	}
3696 	return ret;
3697 }
3698 
3699 #define NEIGH_PARMS_DATA_OFFSET(index)	\
3700 	(&((struct neigh_parms *) 0)->data[index])
3701 
3702 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3703 	[NEIGH_VAR_ ## attr] = { \
3704 		.procname	= name, \
3705 		.data		= NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3706 		.maxlen		= sizeof(int), \
3707 		.mode		= mval, \
3708 		.proc_handler	= proc, \
3709 	}
3710 
3711 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3712 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3713 
3714 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3715 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3716 
3717 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3718 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3719 
3720 #define NEIGH_SYSCTL_MS_JIFFIES_POSITIVE_ENTRY(attr, name) \
3721 	NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies_positive)
3722 
3723 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3724 	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3725 
3726 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3727 	NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3728 
3729 static struct neigh_sysctl_table {
3730 	struct ctl_table_header *sysctl_header;
3731 	struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3732 } neigh_sysctl_template __read_mostly = {
3733 	.neigh_vars = {
3734 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3735 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3736 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3737 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3738 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3739 		NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3740 		NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3741 		NEIGH_SYSCTL_MS_JIFFIES_POSITIVE_ENTRY(INTERVAL_PROBE_TIME_MS,
3742 						       "interval_probe_time_ms"),
3743 		NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3744 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3745 		NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3746 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3747 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3748 		NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3749 		NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3750 		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3751 		NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3752 		[NEIGH_VAR_GC_INTERVAL] = {
3753 			.procname	= "gc_interval",
3754 			.maxlen		= sizeof(int),
3755 			.mode		= 0644,
3756 			.proc_handler	= proc_dointvec_jiffies,
3757 		},
3758 		[NEIGH_VAR_GC_THRESH1] = {
3759 			.procname	= "gc_thresh1",
3760 			.maxlen		= sizeof(int),
3761 			.mode		= 0644,
3762 			.extra1		= SYSCTL_ZERO,
3763 			.extra2		= SYSCTL_INT_MAX,
3764 			.proc_handler	= proc_dointvec_minmax,
3765 		},
3766 		[NEIGH_VAR_GC_THRESH2] = {
3767 			.procname	= "gc_thresh2",
3768 			.maxlen		= sizeof(int),
3769 			.mode		= 0644,
3770 			.extra1		= SYSCTL_ZERO,
3771 			.extra2		= SYSCTL_INT_MAX,
3772 			.proc_handler	= proc_dointvec_minmax,
3773 		},
3774 		[NEIGH_VAR_GC_THRESH3] = {
3775 			.procname	= "gc_thresh3",
3776 			.maxlen		= sizeof(int),
3777 			.mode		= 0644,
3778 			.extra1		= SYSCTL_ZERO,
3779 			.extra2		= SYSCTL_INT_MAX,
3780 			.proc_handler	= proc_dointvec_minmax,
3781 		},
3782 		{},
3783 	},
3784 };
3785 
neigh_sysctl_register(struct net_device * dev,struct neigh_parms * p,proc_handler * handler)3786 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3787 			  proc_handler *handler)
3788 {
3789 	int i;
3790 	struct neigh_sysctl_table *t;
3791 	const char *dev_name_source;
3792 	char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3793 	char *p_name;
3794 	size_t neigh_vars_size;
3795 
3796 	t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL_ACCOUNT);
3797 	if (!t)
3798 		goto err;
3799 
3800 	for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3801 		t->neigh_vars[i].data += (long) p;
3802 		t->neigh_vars[i].extra1 = dev;
3803 		t->neigh_vars[i].extra2 = p;
3804 	}
3805 
3806 	neigh_vars_size = ARRAY_SIZE(t->neigh_vars);
3807 	if (dev) {
3808 		dev_name_source = dev->name;
3809 		/* Terminate the table early */
3810 		memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3811 		       sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3812 		neigh_vars_size = NEIGH_VAR_BASE_REACHABLE_TIME_MS + 1;
3813 	} else {
3814 		struct neigh_table *tbl = p->tbl;
3815 		dev_name_source = "default";
3816 		t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3817 		t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3818 		t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3819 		t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3820 	}
3821 
3822 	if (handler) {
3823 		/* RetransTime */
3824 		t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3825 		/* ReachableTime */
3826 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3827 		/* RetransTime (in milliseconds)*/
3828 		t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3829 		/* ReachableTime (in milliseconds) */
3830 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3831 	} else {
3832 		/* Those handlers will update p->reachable_time after
3833 		 * base_reachable_time(_ms) is set to ensure the new timer starts being
3834 		 * applied after the next neighbour update instead of waiting for
3835 		 * neigh_periodic_work to update its value (can be multiple minutes)
3836 		 * So any handler that replaces them should do this as well
3837 		 */
3838 		/* ReachableTime */
3839 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3840 			neigh_proc_base_reachable_time;
3841 		/* ReachableTime (in milliseconds) */
3842 		t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3843 			neigh_proc_base_reachable_time;
3844 	}
3845 
3846 	switch (neigh_parms_family(p)) {
3847 	case AF_INET:
3848 	      p_name = "ipv4";
3849 	      break;
3850 	case AF_INET6:
3851 	      p_name = "ipv6";
3852 	      break;
3853 	default:
3854 	      BUG();
3855 	}
3856 
3857 	snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3858 		p_name, dev_name_source);
3859 	t->sysctl_header = register_net_sysctl_sz(neigh_parms_net(p),
3860 						  neigh_path, t->neigh_vars,
3861 						  neigh_vars_size);
3862 	if (!t->sysctl_header)
3863 		goto free;
3864 
3865 	p->sysctl_table = t;
3866 	return 0;
3867 
3868 free:
3869 	kfree(t);
3870 err:
3871 	return -ENOBUFS;
3872 }
3873 EXPORT_SYMBOL(neigh_sysctl_register);
3874 
neigh_sysctl_unregister(struct neigh_parms * p)3875 void neigh_sysctl_unregister(struct neigh_parms *p)
3876 {
3877 	if (p->sysctl_table) {
3878 		struct neigh_sysctl_table *t = p->sysctl_table;
3879 		p->sysctl_table = NULL;
3880 		unregister_net_sysctl_table(t->sysctl_header);
3881 		kfree(t);
3882 	}
3883 }
3884 EXPORT_SYMBOL(neigh_sysctl_unregister);
3885 
3886 #endif	/* CONFIG_SYSCTL */
3887 
neigh_init(void)3888 static int __init neigh_init(void)
3889 {
3890 	rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, 0);
3891 	rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, 0);
3892 	rtnl_register(PF_UNSPEC, RTM_GETNEIGH, neigh_get, neigh_dump_info, 0);
3893 
3894 	rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3895 		      0);
3896 	rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0);
3897 
3898 	return 0;
3899 }
3900 
3901 subsys_initcall(neigh_init);
3902