1/*
2 *	Linux NET3:	Internet Group Management Protocol  [IGMP]
3 *
4 *	This code implements the IGMP protocol as defined in RFC1112. There has
5 *	been a further revision of this protocol since which is now supported.
6 *
7 *	If you have trouble with this module be careful what gcc you have used,
8 *	the older version didn't come out right using gcc 2.5.8, the newer one
9 *	seems to fall out with gcc 2.6.2.
10 *
11 *	Authors:
12 *		Alan Cox <alan@lxorguk.ukuu.org.uk>
13 *
14 *	This program is free software; you can redistribute it and/or
15 *	modify it under the terms of the GNU General Public License
16 *	as published by the Free Software Foundation; either version
17 *	2 of the License, or (at your option) any later version.
18 *
19 *	Fixes:
20 *
21 *		Alan Cox	:	Added lots of __inline__ to optimise
22 *					the memory usage of all the tiny little
23 *					functions.
24 *		Alan Cox	:	Dumped the header building experiment.
25 *		Alan Cox	:	Minor tweaks ready for multicast routing
26 *					and extended IGMP protocol.
27 *		Alan Cox	:	Removed a load of inline directives. Gcc 2.5.8
28 *					writes utterly bogus code otherwise (sigh)
29 *					fixed IGMP loopback to behave in the manner
30 *					desired by mrouted, fixed the fact it has been
31 *					broken since 1.3.6 and cleaned up a few minor
32 *					points.
33 *
34 *		Chih-Jen Chang	:	Tried to revise IGMP to Version 2
35 *		Tsu-Sheng Tsao		E-mail: chihjenc@scf.usc.edu and tsusheng@scf.usc.edu
36 *					The enhancements are mainly based on Steve Deering's
37 * 					ipmulti-3.5 source code.
38 *		Chih-Jen Chang	:	Added the igmp_get_mrouter_info and
39 *		Tsu-Sheng Tsao		igmp_set_mrouter_info to keep track of
40 *					the mrouted version on that device.
41 *		Chih-Jen Chang	:	Added the max_resp_time parameter to
42 *		Tsu-Sheng Tsao		igmp_heard_query(). Using this parameter
43 *					to identify the multicast router version
44 *					and do what the IGMP version 2 specified.
45 *		Chih-Jen Chang	:	Added a timer to revert to IGMP V2 router
46 *		Tsu-Sheng Tsao		if the specified time expired.
47 *		Alan Cox	:	Stop IGMP from 0.0.0.0 being accepted.
48 *		Alan Cox	:	Use GFP_ATOMIC in the right places.
49 *		Christian Daudt :	igmp timer wasn't set for local group
50 *					memberships but was being deleted,
51 *					which caused a "del_timer() called
52 *					from %p with timer not initialized\n"
53 *					message (960131).
54 *		Christian Daudt :	removed del_timer from
55 *					igmp_timer_expire function (960205).
56 *             Christian Daudt :       igmp_heard_report now only calls
57 *                                     igmp_timer_expire if tm->running is
58 *                                     true (960216).
59 *		Malcolm Beattie :	ttl comparison wrong in igmp_rcv made
60 *					igmp_heard_query never trigger. Expiry
61 *					miscalculation fixed in igmp_heard_query
62 *					and random() made to return unsigned to
63 *					prevent negative expiry times.
64 *		Alexey Kuznetsov:	Wrong group leaving behaviour, backport
65 *					fix from pending 2.1.x patches.
66 *		Alan Cox:		Forget to enable FDDI support earlier.
67 *		Alexey Kuznetsov:	Fixed leaving groups on device down.
68 *		Alexey Kuznetsov:	Accordance to igmp-v2-06 draft.
69 *		David L Stevens:	IGMPv3 support, with help from
70 *					Vinay Kulkarni
71 */
72
73#include <linux/module.h>
74#include <linux/slab.h>
75#include <asm/uaccess.h>
76#include <linux/types.h>
77#include <linux/kernel.h>
78#include <linux/jiffies.h>
79#include <linux/string.h>
80#include <linux/socket.h>
81#include <linux/sockios.h>
82#include <linux/in.h>
83#include <linux/inet.h>
84#include <linux/netdevice.h>
85#include <linux/skbuff.h>
86#include <linux/inetdevice.h>
87#include <linux/igmp.h>
88#include <linux/if_arp.h>
89#include <linux/rtnetlink.h>
90#include <linux/times.h>
91#include <linux/pkt_sched.h>
92
93#include <net/net_namespace.h>
94#include <net/arp.h>
95#include <net/ip.h>
96#include <net/protocol.h>
97#include <net/route.h>
98#include <net/sock.h>
99#include <net/checksum.h>
100#include <net/inet_common.h>
101#include <linux/netfilter_ipv4.h>
102#ifdef CONFIG_IP_MROUTE
103#include <linux/mroute.h>
104#endif
105#ifdef CONFIG_PROC_FS
106#include <linux/proc_fs.h>
107#include <linux/seq_file.h>
108#endif
109
110#define IP_MAX_MEMBERSHIPS	20
111#define IP_MAX_MSF		10
112
113#ifdef CONFIG_IP_MULTICAST
114/* Parameter names and values are taken from igmp-v2-06 draft */
115
116#define IGMP_V1_ROUTER_PRESENT_TIMEOUT		(400*HZ)
117#define IGMP_V2_ROUTER_PRESENT_TIMEOUT		(400*HZ)
118#define IGMP_V2_UNSOLICITED_REPORT_INTERVAL	(10*HZ)
119#define IGMP_V3_UNSOLICITED_REPORT_INTERVAL	(1*HZ)
120#define IGMP_QUERY_RESPONSE_INTERVAL		(10*HZ)
121#define IGMP_QUERY_ROBUSTNESS_VARIABLE		2
122
123
124#define IGMP_INITIAL_REPORT_DELAY		(1)
125
126/* IGMP_INITIAL_REPORT_DELAY is not from IGMP specs!
127 * IGMP specs require to report membership immediately after
128 * joining a group, but we delay the first report by a
129 * small interval. It seems more natural and still does not
130 * contradict to specs provided this delay is small enough.
131 */
132
133#define IGMP_V1_SEEN(in_dev) \
134	(IPV4_DEVCONF_ALL(dev_net(in_dev->dev), FORCE_IGMP_VERSION) == 1 || \
135	 IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 1 || \
136	 ((in_dev)->mr_v1_seen && \
137	  time_before(jiffies, (in_dev)->mr_v1_seen)))
138#define IGMP_V2_SEEN(in_dev) \
139	(IPV4_DEVCONF_ALL(dev_net(in_dev->dev), FORCE_IGMP_VERSION) == 2 || \
140	 IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 2 || \
141	 ((in_dev)->mr_v2_seen && \
142	  time_before(jiffies, (in_dev)->mr_v2_seen)))
143
144static int unsolicited_report_interval(struct in_device *in_dev)
145{
146	int interval_ms, interval_jiffies;
147
148	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
149		interval_ms = IN_DEV_CONF_GET(
150			in_dev,
151			IGMPV2_UNSOLICITED_REPORT_INTERVAL);
152	else /* v3 */
153		interval_ms = IN_DEV_CONF_GET(
154			in_dev,
155			IGMPV3_UNSOLICITED_REPORT_INTERVAL);
156
157	interval_jiffies = msecs_to_jiffies(interval_ms);
158
159	/* _timer functions can't handle a delay of 0 jiffies so ensure
160	 *  we always return a positive value.
161	 */
162	if (interval_jiffies <= 0)
163		interval_jiffies = 1;
164	return interval_jiffies;
165}
166
167static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im);
168static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr);
169static void igmpv3_clear_delrec(struct in_device *in_dev);
170static int sf_setstate(struct ip_mc_list *pmc);
171static void sf_markstate(struct ip_mc_list *pmc);
172#endif
173static void ip_mc_clear_src(struct ip_mc_list *pmc);
174static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
175			 int sfcount, __be32 *psfsrc, int delta);
176
177static void ip_ma_put(struct ip_mc_list *im)
178{
179	if (atomic_dec_and_test(&im->refcnt)) {
180		in_dev_put(im->interface);
181		kfree_rcu(im, rcu);
182	}
183}
184
185#define for_each_pmc_rcu(in_dev, pmc)				\
186	for (pmc = rcu_dereference(in_dev->mc_list);		\
187	     pmc != NULL;					\
188	     pmc = rcu_dereference(pmc->next_rcu))
189
190#define for_each_pmc_rtnl(in_dev, pmc)				\
191	for (pmc = rtnl_dereference(in_dev->mc_list);		\
192	     pmc != NULL;					\
193	     pmc = rtnl_dereference(pmc->next_rcu))
194
195#ifdef CONFIG_IP_MULTICAST
196
197/*
198 *	Timer management
199 */
200
201static void igmp_stop_timer(struct ip_mc_list *im)
202{
203	spin_lock_bh(&im->lock);
204	if (del_timer(&im->timer))
205		atomic_dec(&im->refcnt);
206	im->tm_running = 0;
207	im->reporter = 0;
208	im->unsolicit_count = 0;
209	spin_unlock_bh(&im->lock);
210}
211
212/* It must be called with locked im->lock */
213static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
214{
215	int tv = prandom_u32() % max_delay;
216
217	im->tm_running = 1;
218	if (!mod_timer(&im->timer, jiffies+tv+2))
219		atomic_inc(&im->refcnt);
220}
221
222static void igmp_gq_start_timer(struct in_device *in_dev)
223{
224	int tv = prandom_u32() % in_dev->mr_maxdelay;
225
226	in_dev->mr_gq_running = 1;
227	if (!mod_timer(&in_dev->mr_gq_timer, jiffies+tv+2))
228		in_dev_hold(in_dev);
229}
230
231static void igmp_ifc_start_timer(struct in_device *in_dev, int delay)
232{
233	int tv = prandom_u32() % delay;
234
235	if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2))
236		in_dev_hold(in_dev);
237}
238
239static void igmp_mod_timer(struct ip_mc_list *im, int max_delay)
240{
241	spin_lock_bh(&im->lock);
242	im->unsolicit_count = 0;
243	if (del_timer(&im->timer)) {
244		if ((long)(im->timer.expires-jiffies) < max_delay) {
245			add_timer(&im->timer);
246			im->tm_running = 1;
247			spin_unlock_bh(&im->lock);
248			return;
249		}
250		atomic_dec(&im->refcnt);
251	}
252	igmp_start_timer(im, max_delay);
253	spin_unlock_bh(&im->lock);
254}
255
256
257/*
258 *	Send an IGMP report.
259 */
260
261#define IGMP_SIZE (sizeof(struct igmphdr)+sizeof(struct iphdr)+4)
262
263
264static int is_in(struct ip_mc_list *pmc, struct ip_sf_list *psf, int type,
265	int gdeleted, int sdeleted)
266{
267	switch (type) {
268	case IGMPV3_MODE_IS_INCLUDE:
269	case IGMPV3_MODE_IS_EXCLUDE:
270		if (gdeleted || sdeleted)
271			return 0;
272		if (!(pmc->gsquery && !psf->sf_gsresp)) {
273			if (pmc->sfmode == MCAST_INCLUDE)
274				return 1;
275			/* don't include if this source is excluded
276			 * in all filters
277			 */
278			if (psf->sf_count[MCAST_INCLUDE])
279				return type == IGMPV3_MODE_IS_INCLUDE;
280			return pmc->sfcount[MCAST_EXCLUDE] ==
281				psf->sf_count[MCAST_EXCLUDE];
282		}
283		return 0;
284	case IGMPV3_CHANGE_TO_INCLUDE:
285		if (gdeleted || sdeleted)
286			return 0;
287		return psf->sf_count[MCAST_INCLUDE] != 0;
288	case IGMPV3_CHANGE_TO_EXCLUDE:
289		if (gdeleted || sdeleted)
290			return 0;
291		if (pmc->sfcount[MCAST_EXCLUDE] == 0 ||
292		    psf->sf_count[MCAST_INCLUDE])
293			return 0;
294		return pmc->sfcount[MCAST_EXCLUDE] ==
295			psf->sf_count[MCAST_EXCLUDE];
296	case IGMPV3_ALLOW_NEW_SOURCES:
297		if (gdeleted || !psf->sf_crcount)
298			return 0;
299		return (pmc->sfmode == MCAST_INCLUDE) ^ sdeleted;
300	case IGMPV3_BLOCK_OLD_SOURCES:
301		if (pmc->sfmode == MCAST_INCLUDE)
302			return gdeleted || (psf->sf_crcount && sdeleted);
303		return psf->sf_crcount && !gdeleted && !sdeleted;
304	}
305	return 0;
306}
307
308static int
309igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
310{
311	struct ip_sf_list *psf;
312	int scount = 0;
313
314	for (psf = pmc->sources; psf; psf = psf->sf_next) {
315		if (!is_in(pmc, psf, type, gdeleted, sdeleted))
316			continue;
317		scount++;
318	}
319	return scount;
320}
321
322static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
323{
324	struct sk_buff *skb;
325	struct rtable *rt;
326	struct iphdr *pip;
327	struct igmpv3_report *pig;
328	struct net *net = dev_net(dev);
329	struct flowi4 fl4;
330	int hlen = LL_RESERVED_SPACE(dev);
331	int tlen = dev->needed_tailroom;
332	unsigned int size = mtu;
333
334	while (1) {
335		skb = alloc_skb(size + hlen + tlen,
336				GFP_ATOMIC | __GFP_NOWARN);
337		if (skb)
338			break;
339		size >>= 1;
340		if (size < 256)
341			return NULL;
342	}
343	skb->priority = TC_PRIO_CONTROL;
344
345	rt = ip_route_output_ports(net, &fl4, NULL, IGMPV3_ALL_MCR, 0,
346				   0, 0,
347				   IPPROTO_IGMP, 0, dev->ifindex);
348	if (IS_ERR(rt)) {
349		kfree_skb(skb);
350		return NULL;
351	}
352
353	skb_dst_set(skb, &rt->dst);
354	skb->dev = dev;
355
356	skb->reserved_tailroom = skb_end_offset(skb) -
357				 min(mtu, skb_end_offset(skb));
358	skb_reserve(skb, hlen);
359
360	skb_reset_network_header(skb);
361	pip = ip_hdr(skb);
362	skb_put(skb, sizeof(struct iphdr) + 4);
363
364	pip->version  = 4;
365	pip->ihl      = (sizeof(struct iphdr)+4)>>2;
366	pip->tos      = 0xc0;
367	pip->frag_off = htons(IP_DF);
368	pip->ttl      = 1;
369	pip->daddr    = fl4.daddr;
370	pip->saddr    = fl4.saddr;
371	pip->protocol = IPPROTO_IGMP;
372	pip->tot_len  = 0;	/* filled in later */
373	ip_select_ident(net, skb, NULL);
374	((u8 *)&pip[1])[0] = IPOPT_RA;
375	((u8 *)&pip[1])[1] = 4;
376	((u8 *)&pip[1])[2] = 0;
377	((u8 *)&pip[1])[3] = 0;
378
379	skb->transport_header = skb->network_header + sizeof(struct iphdr) + 4;
380	skb_put(skb, sizeof(*pig));
381	pig = igmpv3_report_hdr(skb);
382	pig->type = IGMPV3_HOST_MEMBERSHIP_REPORT;
383	pig->resv1 = 0;
384	pig->csum = 0;
385	pig->resv2 = 0;
386	pig->ngrec = 0;
387	return skb;
388}
389
390static int igmpv3_sendpack(struct sk_buff *skb)
391{
392	struct igmphdr *pig = igmp_hdr(skb);
393	const int igmplen = skb_tail_pointer(skb) - skb_transport_header(skb);
394
395	pig->csum = ip_compute_csum(igmp_hdr(skb), igmplen);
396
397	return ip_local_out(skb);
398}
399
400static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel)
401{
402	return sizeof(struct igmpv3_grec) + 4*igmp_scount(pmc, type, gdel, sdel);
403}
404
405static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
406	int type, struct igmpv3_grec **ppgr)
407{
408	struct net_device *dev = pmc->interface->dev;
409	struct igmpv3_report *pih;
410	struct igmpv3_grec *pgr;
411
412	if (!skb)
413		skb = igmpv3_newpack(dev, dev->mtu);
414	if (!skb)
415		return NULL;
416	pgr = (struct igmpv3_grec *)skb_put(skb, sizeof(struct igmpv3_grec));
417	pgr->grec_type = type;
418	pgr->grec_auxwords = 0;
419	pgr->grec_nsrcs = 0;
420	pgr->grec_mca = pmc->multiaddr;
421	pih = igmpv3_report_hdr(skb);
422	pih->ngrec = htons(ntohs(pih->ngrec)+1);
423	*ppgr = pgr;
424	return skb;
425}
426
427#define AVAILABLE(skb)	((skb) ? skb_availroom(skb) : 0)
428
429static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
430	int type, int gdeleted, int sdeleted)
431{
432	struct net_device *dev = pmc->interface->dev;
433	struct igmpv3_report *pih;
434	struct igmpv3_grec *pgr = NULL;
435	struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list;
436	int scount, stotal, first, isquery, truncate;
437
438	if (pmc->multiaddr == IGMP_ALL_HOSTS)
439		return skb;
440
441	isquery = type == IGMPV3_MODE_IS_INCLUDE ||
442		  type == IGMPV3_MODE_IS_EXCLUDE;
443	truncate = type == IGMPV3_MODE_IS_EXCLUDE ||
444		    type == IGMPV3_CHANGE_TO_EXCLUDE;
445
446	stotal = scount = 0;
447
448	psf_list = sdeleted ? &pmc->tomb : &pmc->sources;
449
450	if (!*psf_list)
451		goto empty_source;
452
453	pih = skb ? igmpv3_report_hdr(skb) : NULL;
454
455	/* EX and TO_EX get a fresh packet, if needed */
456	if (truncate) {
457		if (pih && pih->ngrec &&
458		    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
459			if (skb)
460				igmpv3_sendpack(skb);
461			skb = igmpv3_newpack(dev, dev->mtu);
462		}
463	}
464	first = 1;
465	psf_prev = NULL;
466	for (psf = *psf_list; psf; psf = psf_next) {
467		__be32 *psrc;
468
469		psf_next = psf->sf_next;
470
471		if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
472			psf_prev = psf;
473			continue;
474		}
475
476		/* clear marks on query responses */
477		if (isquery)
478			psf->sf_gsresp = 0;
479
480		if (AVAILABLE(skb) < sizeof(__be32) +
481		    first*sizeof(struct igmpv3_grec)) {
482			if (truncate && !first)
483				break;	 /* truncate these */
484			if (pgr)
485				pgr->grec_nsrcs = htons(scount);
486			if (skb)
487				igmpv3_sendpack(skb);
488			skb = igmpv3_newpack(dev, dev->mtu);
489			first = 1;
490			scount = 0;
491		}
492		if (first) {
493			skb = add_grhead(skb, pmc, type, &pgr);
494			first = 0;
495		}
496		if (!skb)
497			return NULL;
498		psrc = (__be32 *)skb_put(skb, sizeof(__be32));
499		*psrc = psf->sf_inaddr;
500		scount++; stotal++;
501		if ((type == IGMPV3_ALLOW_NEW_SOURCES ||
502		     type == IGMPV3_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
503			psf->sf_crcount--;
504			if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
505				if (psf_prev)
506					psf_prev->sf_next = psf->sf_next;
507				else
508					*psf_list = psf->sf_next;
509				kfree(psf);
510				continue;
511			}
512		}
513		psf_prev = psf;
514	}
515
516empty_source:
517	if (!stotal) {
518		if (type == IGMPV3_ALLOW_NEW_SOURCES ||
519		    type == IGMPV3_BLOCK_OLD_SOURCES)
520			return skb;
521		if (pmc->crcount || isquery) {
522			/* make sure we have room for group header */
523			if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)) {
524				igmpv3_sendpack(skb);
525				skb = NULL; /* add_grhead will get a new one */
526			}
527			skb = add_grhead(skb, pmc, type, &pgr);
528		}
529	}
530	if (pgr)
531		pgr->grec_nsrcs = htons(scount);
532
533	if (isquery)
534		pmc->gsquery = 0;	/* clear query state on report */
535	return skb;
536}
537
538static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
539{
540	struct sk_buff *skb = NULL;
541	int type;
542
543	if (!pmc) {
544		rcu_read_lock();
545		for_each_pmc_rcu(in_dev, pmc) {
546			if (pmc->multiaddr == IGMP_ALL_HOSTS)
547				continue;
548			spin_lock_bh(&pmc->lock);
549			if (pmc->sfcount[MCAST_EXCLUDE])
550				type = IGMPV3_MODE_IS_EXCLUDE;
551			else
552				type = IGMPV3_MODE_IS_INCLUDE;
553			skb = add_grec(skb, pmc, type, 0, 0);
554			spin_unlock_bh(&pmc->lock);
555		}
556		rcu_read_unlock();
557	} else {
558		spin_lock_bh(&pmc->lock);
559		if (pmc->sfcount[MCAST_EXCLUDE])
560			type = IGMPV3_MODE_IS_EXCLUDE;
561		else
562			type = IGMPV3_MODE_IS_INCLUDE;
563		skb = add_grec(skb, pmc, type, 0, 0);
564		spin_unlock_bh(&pmc->lock);
565	}
566	if (!skb)
567		return 0;
568	return igmpv3_sendpack(skb);
569}
570
571/*
572 * remove zero-count source records from a source filter list
573 */
574static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
575{
576	struct ip_sf_list *psf_prev, *psf_next, *psf;
577
578	psf_prev = NULL;
579	for (psf = *ppsf; psf; psf = psf_next) {
580		psf_next = psf->sf_next;
581		if (psf->sf_crcount == 0) {
582			if (psf_prev)
583				psf_prev->sf_next = psf->sf_next;
584			else
585				*ppsf = psf->sf_next;
586			kfree(psf);
587		} else
588			psf_prev = psf;
589	}
590}
591
592static void igmpv3_send_cr(struct in_device *in_dev)
593{
594	struct ip_mc_list *pmc, *pmc_prev, *pmc_next;
595	struct sk_buff *skb = NULL;
596	int type, dtype;
597
598	rcu_read_lock();
599	spin_lock_bh(&in_dev->mc_tomb_lock);
600
601	/* deleted MCA's */
602	pmc_prev = NULL;
603	for (pmc = in_dev->mc_tomb; pmc; pmc = pmc_next) {
604		pmc_next = pmc->next;
605		if (pmc->sfmode == MCAST_INCLUDE) {
606			type = IGMPV3_BLOCK_OLD_SOURCES;
607			dtype = IGMPV3_BLOCK_OLD_SOURCES;
608			skb = add_grec(skb, pmc, type, 1, 0);
609			skb = add_grec(skb, pmc, dtype, 1, 1);
610		}
611		if (pmc->crcount) {
612			if (pmc->sfmode == MCAST_EXCLUDE) {
613				type = IGMPV3_CHANGE_TO_INCLUDE;
614				skb = add_grec(skb, pmc, type, 1, 0);
615			}
616			pmc->crcount--;
617			if (pmc->crcount == 0) {
618				igmpv3_clear_zeros(&pmc->tomb);
619				igmpv3_clear_zeros(&pmc->sources);
620			}
621		}
622		if (pmc->crcount == 0 && !pmc->tomb && !pmc->sources) {
623			if (pmc_prev)
624				pmc_prev->next = pmc_next;
625			else
626				in_dev->mc_tomb = pmc_next;
627			in_dev_put(pmc->interface);
628			kfree(pmc);
629		} else
630			pmc_prev = pmc;
631	}
632	spin_unlock_bh(&in_dev->mc_tomb_lock);
633
634	/* change recs */
635	for_each_pmc_rcu(in_dev, pmc) {
636		spin_lock_bh(&pmc->lock);
637		if (pmc->sfcount[MCAST_EXCLUDE]) {
638			type = IGMPV3_BLOCK_OLD_SOURCES;
639			dtype = IGMPV3_ALLOW_NEW_SOURCES;
640		} else {
641			type = IGMPV3_ALLOW_NEW_SOURCES;
642			dtype = IGMPV3_BLOCK_OLD_SOURCES;
643		}
644		skb = add_grec(skb, pmc, type, 0, 0);
645		skb = add_grec(skb, pmc, dtype, 0, 1);	/* deleted sources */
646
647		/* filter mode changes */
648		if (pmc->crcount) {
649			if (pmc->sfmode == MCAST_EXCLUDE)
650				type = IGMPV3_CHANGE_TO_EXCLUDE;
651			else
652				type = IGMPV3_CHANGE_TO_INCLUDE;
653			skb = add_grec(skb, pmc, type, 0, 0);
654			pmc->crcount--;
655		}
656		spin_unlock_bh(&pmc->lock);
657	}
658	rcu_read_unlock();
659
660	if (!skb)
661		return;
662	(void) igmpv3_sendpack(skb);
663}
664
665static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
666	int type)
667{
668	struct sk_buff *skb;
669	struct iphdr *iph;
670	struct igmphdr *ih;
671	struct rtable *rt;
672	struct net_device *dev = in_dev->dev;
673	struct net *net = dev_net(dev);
674	__be32	group = pmc ? pmc->multiaddr : 0;
675	struct flowi4 fl4;
676	__be32	dst;
677	int hlen, tlen;
678
679	if (type == IGMPV3_HOST_MEMBERSHIP_REPORT)
680		return igmpv3_send_report(in_dev, pmc);
681	else if (type == IGMP_HOST_LEAVE_MESSAGE)
682		dst = IGMP_ALL_ROUTER;
683	else
684		dst = group;
685
686	rt = ip_route_output_ports(net, &fl4, NULL, dst, 0,
687				   0, 0,
688				   IPPROTO_IGMP, 0, dev->ifindex);
689	if (IS_ERR(rt))
690		return -1;
691
692	hlen = LL_RESERVED_SPACE(dev);
693	tlen = dev->needed_tailroom;
694	skb = alloc_skb(IGMP_SIZE + hlen + tlen, GFP_ATOMIC);
695	if (!skb) {
696		ip_rt_put(rt);
697		return -1;
698	}
699	skb->priority = TC_PRIO_CONTROL;
700
701	skb_dst_set(skb, &rt->dst);
702
703	skb_reserve(skb, hlen);
704
705	skb_reset_network_header(skb);
706	iph = ip_hdr(skb);
707	skb_put(skb, sizeof(struct iphdr) + 4);
708
709	iph->version  = 4;
710	iph->ihl      = (sizeof(struct iphdr)+4)>>2;
711	iph->tos      = 0xc0;
712	iph->frag_off = htons(IP_DF);
713	iph->ttl      = 1;
714	iph->daddr    = dst;
715	iph->saddr    = fl4.saddr;
716	iph->protocol = IPPROTO_IGMP;
717	ip_select_ident(net, skb, NULL);
718	((u8 *)&iph[1])[0] = IPOPT_RA;
719	((u8 *)&iph[1])[1] = 4;
720	((u8 *)&iph[1])[2] = 0;
721	((u8 *)&iph[1])[3] = 0;
722
723	ih = (struct igmphdr *)skb_put(skb, sizeof(struct igmphdr));
724	ih->type = type;
725	ih->code = 0;
726	ih->csum = 0;
727	ih->group = group;
728	ih->csum = ip_compute_csum((void *)ih, sizeof(struct igmphdr));
729
730	return ip_local_out(skb);
731}
732
733static void igmp_gq_timer_expire(unsigned long data)
734{
735	struct in_device *in_dev = (struct in_device *)data;
736
737	in_dev->mr_gq_running = 0;
738	igmpv3_send_report(in_dev, NULL);
739	in_dev_put(in_dev);
740}
741
742static void igmp_ifc_timer_expire(unsigned long data)
743{
744	struct in_device *in_dev = (struct in_device *)data;
745
746	igmpv3_send_cr(in_dev);
747	if (in_dev->mr_ifc_count) {
748		in_dev->mr_ifc_count--;
749		igmp_ifc_start_timer(in_dev,
750				     unsolicited_report_interval(in_dev));
751	}
752	in_dev_put(in_dev);
753}
754
755static void igmp_ifc_event(struct in_device *in_dev)
756{
757	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
758		return;
759	in_dev->mr_ifc_count = in_dev->mr_qrv ?: sysctl_igmp_qrv;
760	igmp_ifc_start_timer(in_dev, 1);
761}
762
763
764static void igmp_timer_expire(unsigned long data)
765{
766	struct ip_mc_list *im = (struct ip_mc_list *)data;
767	struct in_device *in_dev = im->interface;
768
769	spin_lock(&im->lock);
770	im->tm_running = 0;
771
772	if (im->unsolicit_count) {
773		im->unsolicit_count--;
774		igmp_start_timer(im, unsolicited_report_interval(in_dev));
775	}
776	im->reporter = 1;
777	spin_unlock(&im->lock);
778
779	if (IGMP_V1_SEEN(in_dev))
780		igmp_send_report(in_dev, im, IGMP_HOST_MEMBERSHIP_REPORT);
781	else if (IGMP_V2_SEEN(in_dev))
782		igmp_send_report(in_dev, im, IGMPV2_HOST_MEMBERSHIP_REPORT);
783	else
784		igmp_send_report(in_dev, im, IGMPV3_HOST_MEMBERSHIP_REPORT);
785
786	ip_ma_put(im);
787}
788
789/* mark EXCLUDE-mode sources */
790static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
791{
792	struct ip_sf_list *psf;
793	int i, scount;
794
795	scount = 0;
796	for (psf = pmc->sources; psf; psf = psf->sf_next) {
797		if (scount == nsrcs)
798			break;
799		for (i = 0; i < nsrcs; i++) {
800			/* skip inactive filters */
801			if (psf->sf_count[MCAST_INCLUDE] ||
802			    pmc->sfcount[MCAST_EXCLUDE] !=
803			    psf->sf_count[MCAST_EXCLUDE])
804				break;
805			if (srcs[i] == psf->sf_inaddr) {
806				scount++;
807				break;
808			}
809		}
810	}
811	pmc->gsquery = 0;
812	if (scount == nsrcs)	/* all sources excluded */
813		return 0;
814	return 1;
815}
816
817static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
818{
819	struct ip_sf_list *psf;
820	int i, scount;
821
822	if (pmc->sfmode == MCAST_EXCLUDE)
823		return igmp_xmarksources(pmc, nsrcs, srcs);
824
825	/* mark INCLUDE-mode sources */
826	scount = 0;
827	for (psf = pmc->sources; psf; psf = psf->sf_next) {
828		if (scount == nsrcs)
829			break;
830		for (i = 0; i < nsrcs; i++)
831			if (srcs[i] == psf->sf_inaddr) {
832				psf->sf_gsresp = 1;
833				scount++;
834				break;
835			}
836	}
837	if (!scount) {
838		pmc->gsquery = 0;
839		return 0;
840	}
841	pmc->gsquery = 1;
842	return 1;
843}
844
845/* return true if packet was dropped */
846static bool igmp_heard_report(struct in_device *in_dev, __be32 group)
847{
848	struct ip_mc_list *im;
849
850	/* Timers are only set for non-local groups */
851
852	if (group == IGMP_ALL_HOSTS)
853		return false;
854
855	rcu_read_lock();
856	for_each_pmc_rcu(in_dev, im) {
857		if (im->multiaddr == group) {
858			igmp_stop_timer(im);
859			break;
860		}
861	}
862	rcu_read_unlock();
863	return false;
864}
865
866/* return true if packet was dropped */
867static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
868	int len)
869{
870	struct igmphdr 		*ih = igmp_hdr(skb);
871	struct igmpv3_query *ih3 = igmpv3_query_hdr(skb);
872	struct ip_mc_list	*im;
873	__be32			group = ih->group;
874	int			max_delay;
875	int			mark = 0;
876
877
878	if (len == 8) {
879		if (ih->code == 0) {
880			/* Alas, old v1 router presents here. */
881
882			max_delay = IGMP_QUERY_RESPONSE_INTERVAL;
883			in_dev->mr_v1_seen = jiffies +
884				IGMP_V1_ROUTER_PRESENT_TIMEOUT;
885			group = 0;
886		} else {
887			/* v2 router present */
888			max_delay = ih->code*(HZ/IGMP_TIMER_SCALE);
889			in_dev->mr_v2_seen = jiffies +
890				IGMP_V2_ROUTER_PRESENT_TIMEOUT;
891		}
892		/* cancel the interface change timer */
893		in_dev->mr_ifc_count = 0;
894		if (del_timer(&in_dev->mr_ifc_timer))
895			__in_dev_put(in_dev);
896		/* clear deleted report items */
897		igmpv3_clear_delrec(in_dev);
898	} else if (len < 12) {
899		return true;	/* ignore bogus packet; freed by caller */
900	} else if (IGMP_V1_SEEN(in_dev)) {
901		/* This is a v3 query with v1 queriers present */
902		max_delay = IGMP_QUERY_RESPONSE_INTERVAL;
903		group = 0;
904	} else if (IGMP_V2_SEEN(in_dev)) {
905		/* this is a v3 query with v2 queriers present;
906		 * Interpretation of the max_delay code is problematic here.
907		 * A real v2 host would use ih_code directly, while v3 has a
908		 * different encoding. We use the v3 encoding as more likely
909		 * to be intended in a v3 query.
910		 */
911		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
912		if (!max_delay)
913			max_delay = 1;	/* can't mod w/ 0 */
914	} else { /* v3 */
915		if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
916			return true;
917
918		ih3 = igmpv3_query_hdr(skb);
919		if (ih3->nsrcs) {
920			if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)
921					   + ntohs(ih3->nsrcs)*sizeof(__be32)))
922				return true;
923			ih3 = igmpv3_query_hdr(skb);
924		}
925
926		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
927		if (!max_delay)
928			max_delay = 1;	/* can't mod w/ 0 */
929		in_dev->mr_maxdelay = max_delay;
930		if (ih3->qrv)
931			in_dev->mr_qrv = ih3->qrv;
932		if (!group) { /* general query */
933			if (ih3->nsrcs)
934				return true;	/* no sources allowed */
935			igmp_gq_start_timer(in_dev);
936			return false;
937		}
938		/* mark sources to include, if group & source-specific */
939		mark = ih3->nsrcs != 0;
940	}
941
942	/*
943	 * - Start the timers in all of our membership records
944	 *   that the query applies to for the interface on
945	 *   which the query arrived excl. those that belong
946	 *   to a "local" group (224.0.0.X)
947	 * - For timers already running check if they need to
948	 *   be reset.
949	 * - Use the igmp->igmp_code field as the maximum
950	 *   delay possible
951	 */
952	rcu_read_lock();
953	for_each_pmc_rcu(in_dev, im) {
954		int changed;
955
956		if (group && group != im->multiaddr)
957			continue;
958		if (im->multiaddr == IGMP_ALL_HOSTS)
959			continue;
960		spin_lock_bh(&im->lock);
961		if (im->tm_running)
962			im->gsquery = im->gsquery && mark;
963		else
964			im->gsquery = mark;
965		changed = !im->gsquery ||
966			igmp_marksources(im, ntohs(ih3->nsrcs), ih3->srcs);
967		spin_unlock_bh(&im->lock);
968		if (changed)
969			igmp_mod_timer(im, max_delay);
970	}
971	rcu_read_unlock();
972	return false;
973}
974
975/* called in rcu_read_lock() section */
976int igmp_rcv(struct sk_buff *skb)
977{
978	/* This basically follows the spec line by line -- see RFC1112 */
979	struct igmphdr *ih;
980	struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
981	int len = skb->len;
982	bool dropped = true;
983
984	if (!in_dev)
985		goto drop;
986
987	if (!pskb_may_pull(skb, sizeof(struct igmphdr)))
988		goto drop;
989
990	if (skb_checksum_simple_validate(skb))
991		goto drop;
992
993	ih = igmp_hdr(skb);
994	switch (ih->type) {
995	case IGMP_HOST_MEMBERSHIP_QUERY:
996		dropped = igmp_heard_query(in_dev, skb, len);
997		break;
998	case IGMP_HOST_MEMBERSHIP_REPORT:
999	case IGMPV2_HOST_MEMBERSHIP_REPORT:
1000		/* Is it our report looped back? */
1001		if (rt_is_output_route(skb_rtable(skb)))
1002			break;
1003		/* don't rely on MC router hearing unicast reports */
1004		if (skb->pkt_type == PACKET_MULTICAST ||
1005		    skb->pkt_type == PACKET_BROADCAST)
1006			dropped = igmp_heard_report(in_dev, ih->group);
1007		break;
1008	case IGMP_PIM:
1009#ifdef CONFIG_IP_PIMSM_V1
1010		return pim_rcv_v1(skb);
1011#endif
1012	case IGMPV3_HOST_MEMBERSHIP_REPORT:
1013	case IGMP_DVMRP:
1014	case IGMP_TRACE:
1015	case IGMP_HOST_LEAVE_MESSAGE:
1016	case IGMP_MTRACE:
1017	case IGMP_MTRACE_RESP:
1018		break;
1019	default:
1020		break;
1021	}
1022
1023drop:
1024	if (dropped)
1025		kfree_skb(skb);
1026	else
1027		consume_skb(skb);
1028	return 0;
1029}
1030
1031#endif
1032
1033
1034/*
1035 *	Add a filter to a device
1036 */
1037
1038static void ip_mc_filter_add(struct in_device *in_dev, __be32 addr)
1039{
1040	char buf[MAX_ADDR_LEN];
1041	struct net_device *dev = in_dev->dev;
1042
1043	/* Checking for IFF_MULTICAST here is WRONG-WRONG-WRONG.
1044	   We will get multicast token leakage, when IFF_MULTICAST
1045	   is changed. This check should be done in ndo_set_rx_mode
1046	   routine. Something sort of:
1047	   if (dev->mc_list && dev->flags&IFF_MULTICAST) { do it; }
1048	   --ANK
1049	   */
1050	if (arp_mc_map(addr, buf, dev, 0) == 0)
1051		dev_mc_add(dev, buf);
1052}
1053
1054/*
1055 *	Remove a filter from a device
1056 */
1057
1058static void ip_mc_filter_del(struct in_device *in_dev, __be32 addr)
1059{
1060	char buf[MAX_ADDR_LEN];
1061	struct net_device *dev = in_dev->dev;
1062
1063	if (arp_mc_map(addr, buf, dev, 0) == 0)
1064		dev_mc_del(dev, buf);
1065}
1066
1067#ifdef CONFIG_IP_MULTICAST
1068/*
1069 * deleted ip_mc_list manipulation
1070 */
1071static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
1072{
1073	struct ip_mc_list *pmc;
1074
1075	/* this is an "ip_mc_list" for convenience; only the fields below
1076	 * are actually used. In particular, the refcnt and users are not
1077	 * used for management of the delete list. Using the same structure
1078	 * for deleted items allows change reports to use common code with
1079	 * non-deleted or query-response MCA's.
1080	 */
1081	pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
1082	if (!pmc)
1083		return;
1084	spin_lock_bh(&im->lock);
1085	pmc->interface = im->interface;
1086	in_dev_hold(in_dev);
1087	pmc->multiaddr = im->multiaddr;
1088	pmc->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1089	pmc->sfmode = im->sfmode;
1090	if (pmc->sfmode == MCAST_INCLUDE) {
1091		struct ip_sf_list *psf;
1092
1093		pmc->tomb = im->tomb;
1094		pmc->sources = im->sources;
1095		im->tomb = im->sources = NULL;
1096		for (psf = pmc->sources; psf; psf = psf->sf_next)
1097			psf->sf_crcount = pmc->crcount;
1098	}
1099	spin_unlock_bh(&im->lock);
1100
1101	spin_lock_bh(&in_dev->mc_tomb_lock);
1102	pmc->next = in_dev->mc_tomb;
1103	in_dev->mc_tomb = pmc;
1104	spin_unlock_bh(&in_dev->mc_tomb_lock);
1105}
1106
1107static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
1108{
1109	struct ip_mc_list *pmc, *pmc_prev;
1110	struct ip_sf_list *psf, *psf_next;
1111
1112	spin_lock_bh(&in_dev->mc_tomb_lock);
1113	pmc_prev = NULL;
1114	for (pmc = in_dev->mc_tomb; pmc; pmc = pmc->next) {
1115		if (pmc->multiaddr == multiaddr)
1116			break;
1117		pmc_prev = pmc;
1118	}
1119	if (pmc) {
1120		if (pmc_prev)
1121			pmc_prev->next = pmc->next;
1122		else
1123			in_dev->mc_tomb = pmc->next;
1124	}
1125	spin_unlock_bh(&in_dev->mc_tomb_lock);
1126	if (pmc) {
1127		for (psf = pmc->tomb; psf; psf = psf_next) {
1128			psf_next = psf->sf_next;
1129			kfree(psf);
1130		}
1131		in_dev_put(pmc->interface);
1132		kfree(pmc);
1133	}
1134}
1135
1136static void igmpv3_clear_delrec(struct in_device *in_dev)
1137{
1138	struct ip_mc_list *pmc, *nextpmc;
1139
1140	spin_lock_bh(&in_dev->mc_tomb_lock);
1141	pmc = in_dev->mc_tomb;
1142	in_dev->mc_tomb = NULL;
1143	spin_unlock_bh(&in_dev->mc_tomb_lock);
1144
1145	for (; pmc; pmc = nextpmc) {
1146		nextpmc = pmc->next;
1147		ip_mc_clear_src(pmc);
1148		in_dev_put(pmc->interface);
1149		kfree(pmc);
1150	}
1151	/* clear dead sources, too */
1152	rcu_read_lock();
1153	for_each_pmc_rcu(in_dev, pmc) {
1154		struct ip_sf_list *psf, *psf_next;
1155
1156		spin_lock_bh(&pmc->lock);
1157		psf = pmc->tomb;
1158		pmc->tomb = NULL;
1159		spin_unlock_bh(&pmc->lock);
1160		for (; psf; psf = psf_next) {
1161			psf_next = psf->sf_next;
1162			kfree(psf);
1163		}
1164	}
1165	rcu_read_unlock();
1166}
1167#endif
1168
1169static void igmp_group_dropped(struct ip_mc_list *im)
1170{
1171	struct in_device *in_dev = im->interface;
1172#ifdef CONFIG_IP_MULTICAST
1173	int reporter;
1174#endif
1175
1176	if (im->loaded) {
1177		im->loaded = 0;
1178		ip_mc_filter_del(in_dev, im->multiaddr);
1179	}
1180
1181#ifdef CONFIG_IP_MULTICAST
1182	if (im->multiaddr == IGMP_ALL_HOSTS)
1183		return;
1184
1185	reporter = im->reporter;
1186	igmp_stop_timer(im);
1187
1188	if (!in_dev->dead) {
1189		if (IGMP_V1_SEEN(in_dev))
1190			return;
1191		if (IGMP_V2_SEEN(in_dev)) {
1192			if (reporter)
1193				igmp_send_report(in_dev, im, IGMP_HOST_LEAVE_MESSAGE);
1194			return;
1195		}
1196		/* IGMPv3 */
1197		igmpv3_add_delrec(in_dev, im);
1198
1199		igmp_ifc_event(in_dev);
1200	}
1201#endif
1202}
1203
1204static void igmp_group_added(struct ip_mc_list *im)
1205{
1206	struct in_device *in_dev = im->interface;
1207
1208	if (im->loaded == 0) {
1209		im->loaded = 1;
1210		ip_mc_filter_add(in_dev, im->multiaddr);
1211	}
1212
1213#ifdef CONFIG_IP_MULTICAST
1214	if (im->multiaddr == IGMP_ALL_HOSTS)
1215		return;
1216
1217	if (in_dev->dead)
1218		return;
1219	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev)) {
1220		spin_lock_bh(&im->lock);
1221		igmp_start_timer(im, IGMP_INITIAL_REPORT_DELAY);
1222		spin_unlock_bh(&im->lock);
1223		return;
1224	}
1225	/* else, v3 */
1226
1227	im->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1228	igmp_ifc_event(in_dev);
1229#endif
1230}
1231
1232
1233/*
1234 *	Multicast list managers
1235 */
1236
1237static u32 ip_mc_hash(const struct ip_mc_list *im)
1238{
1239	return hash_32((__force u32)im->multiaddr, MC_HASH_SZ_LOG);
1240}
1241
1242static void ip_mc_hash_add(struct in_device *in_dev,
1243			   struct ip_mc_list *im)
1244{
1245	struct ip_mc_list __rcu **mc_hash;
1246	u32 hash;
1247
1248	mc_hash = rtnl_dereference(in_dev->mc_hash);
1249	if (mc_hash) {
1250		hash = ip_mc_hash(im);
1251		im->next_hash = mc_hash[hash];
1252		rcu_assign_pointer(mc_hash[hash], im);
1253		return;
1254	}
1255
1256	/* do not use a hash table for small number of items */
1257	if (in_dev->mc_count < 4)
1258		return;
1259
1260	mc_hash = kzalloc(sizeof(struct ip_mc_list *) << MC_HASH_SZ_LOG,
1261			  GFP_KERNEL);
1262	if (!mc_hash)
1263		return;
1264
1265	for_each_pmc_rtnl(in_dev, im) {
1266		hash = ip_mc_hash(im);
1267		im->next_hash = mc_hash[hash];
1268		RCU_INIT_POINTER(mc_hash[hash], im);
1269	}
1270
1271	rcu_assign_pointer(in_dev->mc_hash, mc_hash);
1272}
1273
1274static void ip_mc_hash_remove(struct in_device *in_dev,
1275			      struct ip_mc_list *im)
1276{
1277	struct ip_mc_list __rcu **mc_hash = rtnl_dereference(in_dev->mc_hash);
1278	struct ip_mc_list *aux;
1279
1280	if (!mc_hash)
1281		return;
1282	mc_hash += ip_mc_hash(im);
1283	while ((aux = rtnl_dereference(*mc_hash)) != im)
1284		mc_hash = &aux->next_hash;
1285	*mc_hash = im->next_hash;
1286}
1287
1288
1289/*
1290 *	A socket has joined a multicast group on device dev.
1291 */
1292
1293void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
1294{
1295	struct ip_mc_list *im;
1296
1297	ASSERT_RTNL();
1298
1299	for_each_pmc_rtnl(in_dev, im) {
1300		if (im->multiaddr == addr) {
1301			im->users++;
1302			ip_mc_add_src(in_dev, &addr, MCAST_EXCLUDE, 0, NULL, 0);
1303			goto out;
1304		}
1305	}
1306
1307	im = kzalloc(sizeof(*im), GFP_KERNEL);
1308	if (!im)
1309		goto out;
1310
1311	im->users = 1;
1312	im->interface = in_dev;
1313	in_dev_hold(in_dev);
1314	im->multiaddr = addr;
1315	/* initial mode is (EX, empty) */
1316	im->sfmode = MCAST_EXCLUDE;
1317	im->sfcount[MCAST_EXCLUDE] = 1;
1318	atomic_set(&im->refcnt, 1);
1319	spin_lock_init(&im->lock);
1320#ifdef CONFIG_IP_MULTICAST
1321	setup_timer(&im->timer, igmp_timer_expire, (unsigned long)im);
1322	im->unsolicit_count = sysctl_igmp_qrv;
1323#endif
1324
1325	im->next_rcu = in_dev->mc_list;
1326	in_dev->mc_count++;
1327	rcu_assign_pointer(in_dev->mc_list, im);
1328
1329	ip_mc_hash_add(in_dev, im);
1330
1331#ifdef CONFIG_IP_MULTICAST
1332	igmpv3_del_delrec(in_dev, im->multiaddr);
1333#endif
1334	igmp_group_added(im);
1335	if (!in_dev->dead)
1336		ip_rt_multicast_event(in_dev);
1337out:
1338	return;
1339}
1340EXPORT_SYMBOL(ip_mc_inc_group);
1341
1342/*
1343 *	Resend IGMP JOIN report; used by netdev notifier.
1344 */
1345static void ip_mc_rejoin_groups(struct in_device *in_dev)
1346{
1347#ifdef CONFIG_IP_MULTICAST
1348	struct ip_mc_list *im;
1349	int type;
1350
1351	ASSERT_RTNL();
1352
1353	for_each_pmc_rtnl(in_dev, im) {
1354		if (im->multiaddr == IGMP_ALL_HOSTS)
1355			continue;
1356
1357		/* a failover is happening and switches
1358		 * must be notified immediately
1359		 */
1360		if (IGMP_V1_SEEN(in_dev))
1361			type = IGMP_HOST_MEMBERSHIP_REPORT;
1362		else if (IGMP_V2_SEEN(in_dev))
1363			type = IGMPV2_HOST_MEMBERSHIP_REPORT;
1364		else
1365			type = IGMPV3_HOST_MEMBERSHIP_REPORT;
1366		igmp_send_report(in_dev, im, type);
1367	}
1368#endif
1369}
1370
1371/*
1372 *	A socket has left a multicast group on device dev
1373 */
1374
1375void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
1376{
1377	struct ip_mc_list *i;
1378	struct ip_mc_list __rcu **ip;
1379
1380	ASSERT_RTNL();
1381
1382	for (ip = &in_dev->mc_list;
1383	     (i = rtnl_dereference(*ip)) != NULL;
1384	     ip = &i->next_rcu) {
1385		if (i->multiaddr == addr) {
1386			if (--i->users == 0) {
1387				ip_mc_hash_remove(in_dev, i);
1388				*ip = i->next_rcu;
1389				in_dev->mc_count--;
1390				igmp_group_dropped(i);
1391				ip_mc_clear_src(i);
1392
1393				if (!in_dev->dead)
1394					ip_rt_multicast_event(in_dev);
1395
1396				ip_ma_put(i);
1397				return;
1398			}
1399			break;
1400		}
1401	}
1402}
1403EXPORT_SYMBOL(ip_mc_dec_group);
1404
1405/* Device changing type */
1406
1407void ip_mc_unmap(struct in_device *in_dev)
1408{
1409	struct ip_mc_list *pmc;
1410
1411	ASSERT_RTNL();
1412
1413	for_each_pmc_rtnl(in_dev, pmc)
1414		igmp_group_dropped(pmc);
1415}
1416
1417void ip_mc_remap(struct in_device *in_dev)
1418{
1419	struct ip_mc_list *pmc;
1420
1421	ASSERT_RTNL();
1422
1423	for_each_pmc_rtnl(in_dev, pmc)
1424		igmp_group_added(pmc);
1425}
1426
1427/* Device going down */
1428
1429void ip_mc_down(struct in_device *in_dev)
1430{
1431	struct ip_mc_list *pmc;
1432
1433	ASSERT_RTNL();
1434
1435	for_each_pmc_rtnl(in_dev, pmc)
1436		igmp_group_dropped(pmc);
1437
1438#ifdef CONFIG_IP_MULTICAST
1439	in_dev->mr_ifc_count = 0;
1440	if (del_timer(&in_dev->mr_ifc_timer))
1441		__in_dev_put(in_dev);
1442	in_dev->mr_gq_running = 0;
1443	if (del_timer(&in_dev->mr_gq_timer))
1444		__in_dev_put(in_dev);
1445	igmpv3_clear_delrec(in_dev);
1446#endif
1447
1448	ip_mc_dec_group(in_dev, IGMP_ALL_HOSTS);
1449}
1450
1451void ip_mc_init_dev(struct in_device *in_dev)
1452{
1453	ASSERT_RTNL();
1454
1455#ifdef CONFIG_IP_MULTICAST
1456	setup_timer(&in_dev->mr_gq_timer, igmp_gq_timer_expire,
1457			(unsigned long)in_dev);
1458	setup_timer(&in_dev->mr_ifc_timer, igmp_ifc_timer_expire,
1459			(unsigned long)in_dev);
1460	in_dev->mr_qrv = sysctl_igmp_qrv;
1461#endif
1462
1463	spin_lock_init(&in_dev->mc_tomb_lock);
1464}
1465
1466/* Device going up */
1467
1468void ip_mc_up(struct in_device *in_dev)
1469{
1470	struct ip_mc_list *pmc;
1471
1472	ASSERT_RTNL();
1473
1474#ifdef CONFIG_IP_MULTICAST
1475	in_dev->mr_qrv = sysctl_igmp_qrv;
1476#endif
1477	ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
1478
1479	for_each_pmc_rtnl(in_dev, pmc)
1480		igmp_group_added(pmc);
1481}
1482
1483/*
1484 *	Device is about to be destroyed: clean up.
1485 */
1486
1487void ip_mc_destroy_dev(struct in_device *in_dev)
1488{
1489	struct ip_mc_list *i;
1490
1491	ASSERT_RTNL();
1492
1493	/* Deactivate timers */
1494	ip_mc_down(in_dev);
1495
1496	while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) {
1497		in_dev->mc_list = i->next_rcu;
1498		in_dev->mc_count--;
1499
1500		/* We've dropped the groups in ip_mc_down already */
1501		ip_mc_clear_src(i);
1502		ip_ma_put(i);
1503	}
1504}
1505
1506/* RTNL is locked */
1507static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
1508{
1509	struct net_device *dev = NULL;
1510	struct in_device *idev = NULL;
1511
1512	if (imr->imr_ifindex) {
1513		idev = inetdev_by_index(net, imr->imr_ifindex);
1514		return idev;
1515	}
1516	if (imr->imr_address.s_addr) {
1517		dev = __ip_dev_find(net, imr->imr_address.s_addr, false);
1518		if (!dev)
1519			return NULL;
1520	}
1521
1522	if (!dev) {
1523		struct rtable *rt = ip_route_output(net,
1524						    imr->imr_multiaddr.s_addr,
1525						    0, 0, 0);
1526		if (!IS_ERR(rt)) {
1527			dev = rt->dst.dev;
1528			ip_rt_put(rt);
1529		}
1530	}
1531	if (dev) {
1532		imr->imr_ifindex = dev->ifindex;
1533		idev = __in_dev_get_rtnl(dev);
1534	}
1535	return idev;
1536}
1537
1538/*
1539 *	Join a socket to a group
1540 */
1541int sysctl_igmp_max_memberships __read_mostly = IP_MAX_MEMBERSHIPS;
1542int sysctl_igmp_max_msf __read_mostly = IP_MAX_MSF;
1543#ifdef CONFIG_IP_MULTICAST
1544int sysctl_igmp_qrv __read_mostly = IGMP_QUERY_ROBUSTNESS_VARIABLE;
1545#endif
1546
1547static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
1548	__be32 *psfsrc)
1549{
1550	struct ip_sf_list *psf, *psf_prev;
1551	int rv = 0;
1552
1553	psf_prev = NULL;
1554	for (psf = pmc->sources; psf; psf = psf->sf_next) {
1555		if (psf->sf_inaddr == *psfsrc)
1556			break;
1557		psf_prev = psf;
1558	}
1559	if (!psf || psf->sf_count[sfmode] == 0) {
1560		/* source filter not found, or count wrong =>  bug */
1561		return -ESRCH;
1562	}
1563	psf->sf_count[sfmode]--;
1564	if (psf->sf_count[sfmode] == 0) {
1565		ip_rt_multicast_event(pmc->interface);
1566	}
1567	if (!psf->sf_count[MCAST_INCLUDE] && !psf->sf_count[MCAST_EXCLUDE]) {
1568#ifdef CONFIG_IP_MULTICAST
1569		struct in_device *in_dev = pmc->interface;
1570#endif
1571
1572		/* no more filters for this source */
1573		if (psf_prev)
1574			psf_prev->sf_next = psf->sf_next;
1575		else
1576			pmc->sources = psf->sf_next;
1577#ifdef CONFIG_IP_MULTICAST
1578		if (psf->sf_oldin &&
1579		    !IGMP_V1_SEEN(in_dev) && !IGMP_V2_SEEN(in_dev)) {
1580			psf->sf_crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1581			psf->sf_next = pmc->tomb;
1582			pmc->tomb = psf;
1583			rv = 1;
1584		} else
1585#endif
1586			kfree(psf);
1587	}
1588	return rv;
1589}
1590
1591#ifndef CONFIG_IP_MULTICAST
1592#define igmp_ifc_event(x)	do { } while (0)
1593#endif
1594
1595static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
1596			 int sfcount, __be32 *psfsrc, int delta)
1597{
1598	struct ip_mc_list *pmc;
1599	int	changerec = 0;
1600	int	i, err;
1601
1602	if (!in_dev)
1603		return -ENODEV;
1604	rcu_read_lock();
1605	for_each_pmc_rcu(in_dev, pmc) {
1606		if (*pmca == pmc->multiaddr)
1607			break;
1608	}
1609	if (!pmc) {
1610		/* MCA not found?? bug */
1611		rcu_read_unlock();
1612		return -ESRCH;
1613	}
1614	spin_lock_bh(&pmc->lock);
1615	rcu_read_unlock();
1616#ifdef CONFIG_IP_MULTICAST
1617	sf_markstate(pmc);
1618#endif
1619	if (!delta) {
1620		err = -EINVAL;
1621		if (!pmc->sfcount[sfmode])
1622			goto out_unlock;
1623		pmc->sfcount[sfmode]--;
1624	}
1625	err = 0;
1626	for (i = 0; i < sfcount; i++) {
1627		int rv = ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
1628
1629		changerec |= rv > 0;
1630		if (!err && rv < 0)
1631			err = rv;
1632	}
1633	if (pmc->sfmode == MCAST_EXCLUDE &&
1634	    pmc->sfcount[MCAST_EXCLUDE] == 0 &&
1635	    pmc->sfcount[MCAST_INCLUDE]) {
1636#ifdef CONFIG_IP_MULTICAST
1637		struct ip_sf_list *psf;
1638#endif
1639
1640		/* filter mode change */
1641		pmc->sfmode = MCAST_INCLUDE;
1642#ifdef CONFIG_IP_MULTICAST
1643		pmc->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1644		in_dev->mr_ifc_count = pmc->crcount;
1645		for (psf = pmc->sources; psf; psf = psf->sf_next)
1646			psf->sf_crcount = 0;
1647		igmp_ifc_event(pmc->interface);
1648	} else if (sf_setstate(pmc) || changerec) {
1649		igmp_ifc_event(pmc->interface);
1650#endif
1651	}
1652out_unlock:
1653	spin_unlock_bh(&pmc->lock);
1654	return err;
1655}
1656
1657/*
1658 * Add multicast single-source filter to the interface list
1659 */
1660static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
1661	__be32 *psfsrc)
1662{
1663	struct ip_sf_list *psf, *psf_prev;
1664
1665	psf_prev = NULL;
1666	for (psf = pmc->sources; psf; psf = psf->sf_next) {
1667		if (psf->sf_inaddr == *psfsrc)
1668			break;
1669		psf_prev = psf;
1670	}
1671	if (!psf) {
1672		psf = kzalloc(sizeof(*psf), GFP_ATOMIC);
1673		if (!psf)
1674			return -ENOBUFS;
1675		psf->sf_inaddr = *psfsrc;
1676		if (psf_prev) {
1677			psf_prev->sf_next = psf;
1678		} else
1679			pmc->sources = psf;
1680	}
1681	psf->sf_count[sfmode]++;
1682	if (psf->sf_count[sfmode] == 1) {
1683		ip_rt_multicast_event(pmc->interface);
1684	}
1685	return 0;
1686}
1687
1688#ifdef CONFIG_IP_MULTICAST
1689static void sf_markstate(struct ip_mc_list *pmc)
1690{
1691	struct ip_sf_list *psf;
1692	int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
1693
1694	for (psf = pmc->sources; psf; psf = psf->sf_next)
1695		if (pmc->sfcount[MCAST_EXCLUDE]) {
1696			psf->sf_oldin = mca_xcount ==
1697				psf->sf_count[MCAST_EXCLUDE] &&
1698				!psf->sf_count[MCAST_INCLUDE];
1699		} else
1700			psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
1701}
1702
1703static int sf_setstate(struct ip_mc_list *pmc)
1704{
1705	struct ip_sf_list *psf, *dpsf;
1706	int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
1707	int qrv = pmc->interface->mr_qrv;
1708	int new_in, rv;
1709
1710	rv = 0;
1711	for (psf = pmc->sources; psf; psf = psf->sf_next) {
1712		if (pmc->sfcount[MCAST_EXCLUDE]) {
1713			new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
1714				!psf->sf_count[MCAST_INCLUDE];
1715		} else
1716			new_in = psf->sf_count[MCAST_INCLUDE] != 0;
1717		if (new_in) {
1718			if (!psf->sf_oldin) {
1719				struct ip_sf_list *prev = NULL;
1720
1721				for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next) {
1722					if (dpsf->sf_inaddr == psf->sf_inaddr)
1723						break;
1724					prev = dpsf;
1725				}
1726				if (dpsf) {
1727					if (prev)
1728						prev->sf_next = dpsf->sf_next;
1729					else
1730						pmc->tomb = dpsf->sf_next;
1731					kfree(dpsf);
1732				}
1733				psf->sf_crcount = qrv;
1734				rv++;
1735			}
1736		} else if (psf->sf_oldin) {
1737
1738			psf->sf_crcount = 0;
1739			/*
1740			 * add or update "delete" records if an active filter
1741			 * is now inactive
1742			 */
1743			for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next)
1744				if (dpsf->sf_inaddr == psf->sf_inaddr)
1745					break;
1746			if (!dpsf) {
1747				dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
1748				if (!dpsf)
1749					continue;
1750				*dpsf = *psf;
1751				/* pmc->lock held by callers */
1752				dpsf->sf_next = pmc->tomb;
1753				pmc->tomb = dpsf;
1754			}
1755			dpsf->sf_crcount = qrv;
1756			rv++;
1757		}
1758	}
1759	return rv;
1760}
1761#endif
1762
1763/*
1764 * Add multicast source filter list to the interface list
1765 */
1766static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
1767			 int sfcount, __be32 *psfsrc, int delta)
1768{
1769	struct ip_mc_list *pmc;
1770	int	isexclude;
1771	int	i, err;
1772
1773	if (!in_dev)
1774		return -ENODEV;
1775	rcu_read_lock();
1776	for_each_pmc_rcu(in_dev, pmc) {
1777		if (*pmca == pmc->multiaddr)
1778			break;
1779	}
1780	if (!pmc) {
1781		/* MCA not found?? bug */
1782		rcu_read_unlock();
1783		return -ESRCH;
1784	}
1785	spin_lock_bh(&pmc->lock);
1786	rcu_read_unlock();
1787
1788#ifdef CONFIG_IP_MULTICAST
1789	sf_markstate(pmc);
1790#endif
1791	isexclude = pmc->sfmode == MCAST_EXCLUDE;
1792	if (!delta)
1793		pmc->sfcount[sfmode]++;
1794	err = 0;
1795	for (i = 0; i < sfcount; i++) {
1796		err = ip_mc_add1_src(pmc, sfmode, &psfsrc[i]);
1797		if (err)
1798			break;
1799	}
1800	if (err) {
1801		int j;
1802
1803		if (!delta)
1804			pmc->sfcount[sfmode]--;
1805		for (j = 0; j < i; j++)
1806			(void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
1807	} else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
1808#ifdef CONFIG_IP_MULTICAST
1809		struct ip_sf_list *psf;
1810		in_dev = pmc->interface;
1811#endif
1812
1813		/* filter mode change */
1814		if (pmc->sfcount[MCAST_EXCLUDE])
1815			pmc->sfmode = MCAST_EXCLUDE;
1816		else if (pmc->sfcount[MCAST_INCLUDE])
1817			pmc->sfmode = MCAST_INCLUDE;
1818#ifdef CONFIG_IP_MULTICAST
1819		/* else no filters; keep old mode for reports */
1820
1821		pmc->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1822		in_dev->mr_ifc_count = pmc->crcount;
1823		for (psf = pmc->sources; psf; psf = psf->sf_next)
1824			psf->sf_crcount = 0;
1825		igmp_ifc_event(in_dev);
1826	} else if (sf_setstate(pmc)) {
1827		igmp_ifc_event(in_dev);
1828#endif
1829	}
1830	spin_unlock_bh(&pmc->lock);
1831	return err;
1832}
1833
1834static void ip_mc_clear_src(struct ip_mc_list *pmc)
1835{
1836	struct ip_sf_list *psf, *nextpsf;
1837
1838	for (psf = pmc->tomb; psf; psf = nextpsf) {
1839		nextpsf = psf->sf_next;
1840		kfree(psf);
1841	}
1842	pmc->tomb = NULL;
1843	for (psf = pmc->sources; psf; psf = nextpsf) {
1844		nextpsf = psf->sf_next;
1845		kfree(psf);
1846	}
1847	pmc->sources = NULL;
1848	pmc->sfmode = MCAST_EXCLUDE;
1849	pmc->sfcount[MCAST_INCLUDE] = 0;
1850	pmc->sfcount[MCAST_EXCLUDE] = 1;
1851}
1852
1853/* Join a multicast group
1854 */
1855
1856int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
1857{
1858	__be32 addr = imr->imr_multiaddr.s_addr;
1859	struct ip_mc_socklist *iml, *i;
1860	struct in_device *in_dev;
1861	struct inet_sock *inet = inet_sk(sk);
1862	struct net *net = sock_net(sk);
1863	int ifindex;
1864	int count = 0;
1865	int err;
1866
1867	ASSERT_RTNL();
1868
1869	if (!ipv4_is_multicast(addr))
1870		return -EINVAL;
1871
1872	in_dev = ip_mc_find_dev(net, imr);
1873
1874	if (!in_dev) {
1875		err = -ENODEV;
1876		goto done;
1877	}
1878
1879	err = -EADDRINUSE;
1880	ifindex = imr->imr_ifindex;
1881	for_each_pmc_rtnl(inet, i) {
1882		if (i->multi.imr_multiaddr.s_addr == addr &&
1883		    i->multi.imr_ifindex == ifindex)
1884			goto done;
1885		count++;
1886	}
1887	err = -ENOBUFS;
1888	if (count >= sysctl_igmp_max_memberships)
1889		goto done;
1890	iml = sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
1891	if (!iml)
1892		goto done;
1893
1894	memcpy(&iml->multi, imr, sizeof(*imr));
1895	iml->next_rcu = inet->mc_list;
1896	iml->sflist = NULL;
1897	iml->sfmode = MCAST_EXCLUDE;
1898	rcu_assign_pointer(inet->mc_list, iml);
1899	ip_mc_inc_group(in_dev, addr);
1900	err = 0;
1901done:
1902	return err;
1903}
1904EXPORT_SYMBOL(ip_mc_join_group);
1905
1906static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
1907			   struct in_device *in_dev)
1908{
1909	struct ip_sf_socklist *psf = rtnl_dereference(iml->sflist);
1910	int err;
1911
1912	if (!psf) {
1913		/* any-source empty exclude case */
1914		return ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
1915			iml->sfmode, 0, NULL, 0);
1916	}
1917	err = ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
1918			iml->sfmode, psf->sl_count, psf->sl_addr, 0);
1919	RCU_INIT_POINTER(iml->sflist, NULL);
1920	/* decrease mem now to avoid the memleak warning */
1921	atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);
1922	kfree_rcu(psf, rcu);
1923	return err;
1924}
1925
1926int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
1927{
1928	struct inet_sock *inet = inet_sk(sk);
1929	struct ip_mc_socklist *iml;
1930	struct ip_mc_socklist __rcu **imlp;
1931	struct in_device *in_dev;
1932	struct net *net = sock_net(sk);
1933	__be32 group = imr->imr_multiaddr.s_addr;
1934	u32 ifindex;
1935	int ret = -EADDRNOTAVAIL;
1936
1937	ASSERT_RTNL();
1938
1939	in_dev = ip_mc_find_dev(net, imr);
1940	if (!in_dev) {
1941		ret = -ENODEV;
1942		goto out;
1943	}
1944	ifindex = imr->imr_ifindex;
1945	for (imlp = &inet->mc_list;
1946	     (iml = rtnl_dereference(*imlp)) != NULL;
1947	     imlp = &iml->next_rcu) {
1948		if (iml->multi.imr_multiaddr.s_addr != group)
1949			continue;
1950		if (ifindex) {
1951			if (iml->multi.imr_ifindex != ifindex)
1952				continue;
1953		} else if (imr->imr_address.s_addr && imr->imr_address.s_addr !=
1954				iml->multi.imr_address.s_addr)
1955			continue;
1956
1957		(void) ip_mc_leave_src(sk, iml, in_dev);
1958
1959		*imlp = iml->next_rcu;
1960
1961		ip_mc_dec_group(in_dev, group);
1962
1963		/* decrease mem now to avoid the memleak warning */
1964		atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
1965		kfree_rcu(iml, rcu);
1966		return 0;
1967	}
1968out:
1969	return ret;
1970}
1971EXPORT_SYMBOL(ip_mc_leave_group);
1972
1973int ip_mc_source(int add, int omode, struct sock *sk, struct
1974	ip_mreq_source *mreqs, int ifindex)
1975{
1976	int err;
1977	struct ip_mreqn imr;
1978	__be32 addr = mreqs->imr_multiaddr;
1979	struct ip_mc_socklist *pmc;
1980	struct in_device *in_dev = NULL;
1981	struct inet_sock *inet = inet_sk(sk);
1982	struct ip_sf_socklist *psl;
1983	struct net *net = sock_net(sk);
1984	int leavegroup = 0;
1985	int i, j, rv;
1986
1987	if (!ipv4_is_multicast(addr))
1988		return -EINVAL;
1989
1990	ASSERT_RTNL();
1991
1992	imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
1993	imr.imr_address.s_addr = mreqs->imr_interface;
1994	imr.imr_ifindex = ifindex;
1995	in_dev = ip_mc_find_dev(net, &imr);
1996
1997	if (!in_dev) {
1998		err = -ENODEV;
1999		goto done;
2000	}
2001	err = -EADDRNOTAVAIL;
2002
2003	for_each_pmc_rtnl(inet, pmc) {
2004		if ((pmc->multi.imr_multiaddr.s_addr ==
2005		     imr.imr_multiaddr.s_addr) &&
2006		    (pmc->multi.imr_ifindex == imr.imr_ifindex))
2007			break;
2008	}
2009	if (!pmc) {		/* must have a prior join */
2010		err = -EINVAL;
2011		goto done;
2012	}
2013	/* if a source filter was set, must be the same mode as before */
2014	if (pmc->sflist) {
2015		if (pmc->sfmode != omode) {
2016			err = -EINVAL;
2017			goto done;
2018		}
2019	} else if (pmc->sfmode != omode) {
2020		/* allow mode switches for empty-set filters */
2021		ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 0, NULL, 0);
2022		ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, pmc->sfmode, 0,
2023			NULL, 0);
2024		pmc->sfmode = omode;
2025	}
2026
2027	psl = rtnl_dereference(pmc->sflist);
2028	if (!add) {
2029		if (!psl)
2030			goto done;	/* err = -EADDRNOTAVAIL */
2031		rv = !0;
2032		for (i = 0; i < psl->sl_count; i++) {
2033			rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
2034				sizeof(__be32));
2035			if (rv == 0)
2036				break;
2037		}
2038		if (rv)		/* source not found */
2039			goto done;	/* err = -EADDRNOTAVAIL */
2040
2041		/* special case - (INCLUDE, empty) == LEAVE_GROUP */
2042		if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
2043			leavegroup = 1;
2044			goto done;
2045		}
2046
2047		/* update the interface filter */
2048		ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
2049			&mreqs->imr_sourceaddr, 1);
2050
2051		for (j = i+1; j < psl->sl_count; j++)
2052			psl->sl_addr[j-1] = psl->sl_addr[j];
2053		psl->sl_count--;
2054		err = 0;
2055		goto done;
2056	}
2057	/* else, add a new source to the filter */
2058
2059	if (psl && psl->sl_count >= sysctl_igmp_max_msf) {
2060		err = -ENOBUFS;
2061		goto done;
2062	}
2063	if (!psl || psl->sl_count == psl->sl_max) {
2064		struct ip_sf_socklist *newpsl;
2065		int count = IP_SFBLOCK;
2066
2067		if (psl)
2068			count += psl->sl_max;
2069		newpsl = sock_kmalloc(sk, IP_SFLSIZE(count), GFP_KERNEL);
2070		if (!newpsl) {
2071			err = -ENOBUFS;
2072			goto done;
2073		}
2074		newpsl->sl_max = count;
2075		newpsl->sl_count = count - IP_SFBLOCK;
2076		if (psl) {
2077			for (i = 0; i < psl->sl_count; i++)
2078				newpsl->sl_addr[i] = psl->sl_addr[i];
2079			/* decrease mem now to avoid the memleak warning */
2080			atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
2081			kfree_rcu(psl, rcu);
2082		}
2083		rcu_assign_pointer(pmc->sflist, newpsl);
2084		psl = newpsl;
2085	}
2086	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
2087	for (i = 0; i < psl->sl_count; i++) {
2088		rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
2089			sizeof(__be32));
2090		if (rv == 0)
2091			break;
2092	}
2093	if (rv == 0)		/* address already there is an error */
2094		goto done;
2095	for (j = psl->sl_count-1; j >= i; j--)
2096		psl->sl_addr[j+1] = psl->sl_addr[j];
2097	psl->sl_addr[i] = mreqs->imr_sourceaddr;
2098	psl->sl_count++;
2099	err = 0;
2100	/* update the interface list */
2101	ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
2102		&mreqs->imr_sourceaddr, 1);
2103done:
2104	if (leavegroup)
2105		err = ip_mc_leave_group(sk, &imr);
2106	return err;
2107}
2108
2109int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
2110{
2111	int err = 0;
2112	struct ip_mreqn	imr;
2113	__be32 addr = msf->imsf_multiaddr;
2114	struct ip_mc_socklist *pmc;
2115	struct in_device *in_dev;
2116	struct inet_sock *inet = inet_sk(sk);
2117	struct ip_sf_socklist *newpsl, *psl;
2118	struct net *net = sock_net(sk);
2119	int leavegroup = 0;
2120
2121	if (!ipv4_is_multicast(addr))
2122		return -EINVAL;
2123	if (msf->imsf_fmode != MCAST_INCLUDE &&
2124	    msf->imsf_fmode != MCAST_EXCLUDE)
2125		return -EINVAL;
2126
2127	ASSERT_RTNL();
2128
2129	imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
2130	imr.imr_address.s_addr = msf->imsf_interface;
2131	imr.imr_ifindex = ifindex;
2132	in_dev = ip_mc_find_dev(net, &imr);
2133
2134	if (!in_dev) {
2135		err = -ENODEV;
2136		goto done;
2137	}
2138
2139	/* special case - (INCLUDE, empty) == LEAVE_GROUP */
2140	if (msf->imsf_fmode == MCAST_INCLUDE && msf->imsf_numsrc == 0) {
2141		leavegroup = 1;
2142		goto done;
2143	}
2144
2145	for_each_pmc_rtnl(inet, pmc) {
2146		if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
2147		    pmc->multi.imr_ifindex == imr.imr_ifindex)
2148			break;
2149	}
2150	if (!pmc) {		/* must have a prior join */
2151		err = -EINVAL;
2152		goto done;
2153	}
2154	if (msf->imsf_numsrc) {
2155		newpsl = sock_kmalloc(sk, IP_SFLSIZE(msf->imsf_numsrc),
2156							   GFP_KERNEL);
2157		if (!newpsl) {
2158			err = -ENOBUFS;
2159			goto done;
2160		}
2161		newpsl->sl_max = newpsl->sl_count = msf->imsf_numsrc;
2162		memcpy(newpsl->sl_addr, msf->imsf_slist,
2163			msf->imsf_numsrc * sizeof(msf->imsf_slist[0]));
2164		err = ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
2165			msf->imsf_fmode, newpsl->sl_count, newpsl->sl_addr, 0);
2166		if (err) {
2167			sock_kfree_s(sk, newpsl, IP_SFLSIZE(newpsl->sl_max));
2168			goto done;
2169		}
2170	} else {
2171		newpsl = NULL;
2172		(void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
2173				     msf->imsf_fmode, 0, NULL, 0);
2174	}
2175	psl = rtnl_dereference(pmc->sflist);
2176	if (psl) {
2177		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
2178			psl->sl_count, psl->sl_addr, 0);
2179		/* decrease mem now to avoid the memleak warning */
2180		atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
2181		kfree_rcu(psl, rcu);
2182	} else
2183		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
2184			0, NULL, 0);
2185	rcu_assign_pointer(pmc->sflist, newpsl);
2186	pmc->sfmode = msf->imsf_fmode;
2187	err = 0;
2188done:
2189	if (leavegroup)
2190		err = ip_mc_leave_group(sk, &imr);
2191	return err;
2192}
2193
2194int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
2195	struct ip_msfilter __user *optval, int __user *optlen)
2196{
2197	int err, len, count, copycount;
2198	struct ip_mreqn	imr;
2199	__be32 addr = msf->imsf_multiaddr;
2200	struct ip_mc_socklist *pmc;
2201	struct in_device *in_dev;
2202	struct inet_sock *inet = inet_sk(sk);
2203	struct ip_sf_socklist *psl;
2204	struct net *net = sock_net(sk);
2205
2206	if (!ipv4_is_multicast(addr))
2207		return -EINVAL;
2208
2209	rtnl_lock();
2210
2211	imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
2212	imr.imr_address.s_addr = msf->imsf_interface;
2213	imr.imr_ifindex = 0;
2214	in_dev = ip_mc_find_dev(net, &imr);
2215
2216	if (!in_dev) {
2217		err = -ENODEV;
2218		goto done;
2219	}
2220	err = -EADDRNOTAVAIL;
2221
2222	for_each_pmc_rtnl(inet, pmc) {
2223		if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
2224		    pmc->multi.imr_ifindex == imr.imr_ifindex)
2225			break;
2226	}
2227	if (!pmc)		/* must have a prior join */
2228		goto done;
2229	msf->imsf_fmode = pmc->sfmode;
2230	psl = rtnl_dereference(pmc->sflist);
2231	rtnl_unlock();
2232	if (!psl) {
2233		len = 0;
2234		count = 0;
2235	} else {
2236		count = psl->sl_count;
2237	}
2238	copycount = count < msf->imsf_numsrc ? count : msf->imsf_numsrc;
2239	len = copycount * sizeof(psl->sl_addr[0]);
2240	msf->imsf_numsrc = count;
2241	if (put_user(IP_MSFILTER_SIZE(copycount), optlen) ||
2242	    copy_to_user(optval, msf, IP_MSFILTER_SIZE(0))) {
2243		return -EFAULT;
2244	}
2245	if (len &&
2246	    copy_to_user(&optval->imsf_slist[0], psl->sl_addr, len))
2247		return -EFAULT;
2248	return 0;
2249done:
2250	rtnl_unlock();
2251	return err;
2252}
2253
2254int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
2255	struct group_filter __user *optval, int __user *optlen)
2256{
2257	int err, i, count, copycount;
2258	struct sockaddr_in *psin;
2259	__be32 addr;
2260	struct ip_mc_socklist *pmc;
2261	struct inet_sock *inet = inet_sk(sk);
2262	struct ip_sf_socklist *psl;
2263
2264	psin = (struct sockaddr_in *)&gsf->gf_group;
2265	if (psin->sin_family != AF_INET)
2266		return -EINVAL;
2267	addr = psin->sin_addr.s_addr;
2268	if (!ipv4_is_multicast(addr))
2269		return -EINVAL;
2270
2271	rtnl_lock();
2272
2273	err = -EADDRNOTAVAIL;
2274
2275	for_each_pmc_rtnl(inet, pmc) {
2276		if (pmc->multi.imr_multiaddr.s_addr == addr &&
2277		    pmc->multi.imr_ifindex == gsf->gf_interface)
2278			break;
2279	}
2280	if (!pmc)		/* must have a prior join */
2281		goto done;
2282	gsf->gf_fmode = pmc->sfmode;
2283	psl = rtnl_dereference(pmc->sflist);
2284	rtnl_unlock();
2285	count = psl ? psl->sl_count : 0;
2286	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
2287	gsf->gf_numsrc = count;
2288	if (put_user(GROUP_FILTER_SIZE(copycount), optlen) ||
2289	    copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
2290		return -EFAULT;
2291	}
2292	for (i = 0; i < copycount; i++) {
2293		struct sockaddr_storage ss;
2294
2295		psin = (struct sockaddr_in *)&ss;
2296		memset(&ss, 0, sizeof(ss));
2297		psin->sin_family = AF_INET;
2298		psin->sin_addr.s_addr = psl->sl_addr[i];
2299		if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss)))
2300			return -EFAULT;
2301	}
2302	return 0;
2303done:
2304	rtnl_unlock();
2305	return err;
2306}
2307
2308/*
2309 * check if a multicast source filter allows delivery for a given <src,dst,intf>
2310 */
2311int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
2312{
2313	struct inet_sock *inet = inet_sk(sk);
2314	struct ip_mc_socklist *pmc;
2315	struct ip_sf_socklist *psl;
2316	int i;
2317	int ret;
2318
2319	ret = 1;
2320	if (!ipv4_is_multicast(loc_addr))
2321		goto out;
2322
2323	rcu_read_lock();
2324	for_each_pmc_rcu(inet, pmc) {
2325		if (pmc->multi.imr_multiaddr.s_addr == loc_addr &&
2326		    pmc->multi.imr_ifindex == dif)
2327			break;
2328	}
2329	ret = inet->mc_all;
2330	if (!pmc)
2331		goto unlock;
2332	psl = rcu_dereference(pmc->sflist);
2333	ret = (pmc->sfmode == MCAST_EXCLUDE);
2334	if (!psl)
2335		goto unlock;
2336
2337	for (i = 0; i < psl->sl_count; i++) {
2338		if (psl->sl_addr[i] == rmt_addr)
2339			break;
2340	}
2341	ret = 0;
2342	if (pmc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
2343		goto unlock;
2344	if (pmc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
2345		goto unlock;
2346	ret = 1;
2347unlock:
2348	rcu_read_unlock();
2349out:
2350	return ret;
2351}
2352
2353/*
2354 *	A socket is closing.
2355 */
2356
2357void ip_mc_drop_socket(struct sock *sk)
2358{
2359	struct inet_sock *inet = inet_sk(sk);
2360	struct ip_mc_socklist *iml;
2361	struct net *net = sock_net(sk);
2362
2363	if (!inet->mc_list)
2364		return;
2365
2366	rtnl_lock();
2367	while ((iml = rtnl_dereference(inet->mc_list)) != NULL) {
2368		struct in_device *in_dev;
2369
2370		inet->mc_list = iml->next_rcu;
2371		in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
2372		(void) ip_mc_leave_src(sk, iml, in_dev);
2373		if (in_dev)
2374			ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
2375		/* decrease mem now to avoid the memleak warning */
2376		atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
2377		kfree_rcu(iml, rcu);
2378	}
2379	rtnl_unlock();
2380}
2381
2382/* called with rcu_read_lock() */
2383int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u16 proto)
2384{
2385	struct ip_mc_list *im;
2386	struct ip_mc_list __rcu **mc_hash;
2387	struct ip_sf_list *psf;
2388	int rv = 0;
2389
2390	mc_hash = rcu_dereference(in_dev->mc_hash);
2391	if (mc_hash) {
2392		u32 hash = hash_32((__force u32)mc_addr, MC_HASH_SZ_LOG);
2393
2394		for (im = rcu_dereference(mc_hash[hash]);
2395		     im != NULL;
2396		     im = rcu_dereference(im->next_hash)) {
2397			if (im->multiaddr == mc_addr)
2398				break;
2399		}
2400	} else {
2401		for_each_pmc_rcu(in_dev, im) {
2402			if (im->multiaddr == mc_addr)
2403				break;
2404		}
2405	}
2406	if (im && proto == IPPROTO_IGMP) {
2407		rv = 1;
2408	} else if (im) {
2409		if (src_addr) {
2410			for (psf = im->sources; psf; psf = psf->sf_next) {
2411				if (psf->sf_inaddr == src_addr)
2412					break;
2413			}
2414			if (psf)
2415				rv = psf->sf_count[MCAST_INCLUDE] ||
2416					psf->sf_count[MCAST_EXCLUDE] !=
2417					im->sfcount[MCAST_EXCLUDE];
2418			else
2419				rv = im->sfcount[MCAST_EXCLUDE] != 0;
2420		} else
2421			rv = 1; /* unspecified source; tentatively allow */
2422	}
2423	return rv;
2424}
2425
2426#if defined(CONFIG_PROC_FS)
2427struct igmp_mc_iter_state {
2428	struct seq_net_private p;
2429	struct net_device *dev;
2430	struct in_device *in_dev;
2431};
2432
2433#define	igmp_mc_seq_private(seq)	((struct igmp_mc_iter_state *)(seq)->private)
2434
2435static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
2436{
2437	struct net *net = seq_file_net(seq);
2438	struct ip_mc_list *im = NULL;
2439	struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2440
2441	state->in_dev = NULL;
2442	for_each_netdev_rcu(net, state->dev) {
2443		struct in_device *in_dev;
2444
2445		in_dev = __in_dev_get_rcu(state->dev);
2446		if (!in_dev)
2447			continue;
2448		im = rcu_dereference(in_dev->mc_list);
2449		if (im) {
2450			state->in_dev = in_dev;
2451			break;
2452		}
2453	}
2454	return im;
2455}
2456
2457static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_list *im)
2458{
2459	struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2460
2461	im = rcu_dereference(im->next_rcu);
2462	while (!im) {
2463		state->dev = next_net_device_rcu(state->dev);
2464		if (!state->dev) {
2465			state->in_dev = NULL;
2466			break;
2467		}
2468		state->in_dev = __in_dev_get_rcu(state->dev);
2469		if (!state->in_dev)
2470			continue;
2471		im = rcu_dereference(state->in_dev->mc_list);
2472	}
2473	return im;
2474}
2475
2476static struct ip_mc_list *igmp_mc_get_idx(struct seq_file *seq, loff_t pos)
2477{
2478	struct ip_mc_list *im = igmp_mc_get_first(seq);
2479	if (im)
2480		while (pos && (im = igmp_mc_get_next(seq, im)) != NULL)
2481			--pos;
2482	return pos ? NULL : im;
2483}
2484
2485static void *igmp_mc_seq_start(struct seq_file *seq, loff_t *pos)
2486	__acquires(rcu)
2487{
2488	rcu_read_lock();
2489	return *pos ? igmp_mc_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2490}
2491
2492static void *igmp_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2493{
2494	struct ip_mc_list *im;
2495	if (v == SEQ_START_TOKEN)
2496		im = igmp_mc_get_first(seq);
2497	else
2498		im = igmp_mc_get_next(seq, v);
2499	++*pos;
2500	return im;
2501}
2502
2503static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
2504	__releases(rcu)
2505{
2506	struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2507
2508	state->in_dev = NULL;
2509	state->dev = NULL;
2510	rcu_read_unlock();
2511}
2512
2513static int igmp_mc_seq_show(struct seq_file *seq, void *v)
2514{
2515	if (v == SEQ_START_TOKEN)
2516		seq_puts(seq,
2517			 "Idx\tDevice    : Count Querier\tGroup    Users Timer\tReporter\n");
2518	else {
2519		struct ip_mc_list *im = (struct ip_mc_list *)v;
2520		struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2521		char   *querier;
2522		long delta;
2523
2524#ifdef CONFIG_IP_MULTICAST
2525		querier = IGMP_V1_SEEN(state->in_dev) ? "V1" :
2526			  IGMP_V2_SEEN(state->in_dev) ? "V2" :
2527			  "V3";
2528#else
2529		querier = "NONE";
2530#endif
2531
2532		if (rcu_access_pointer(state->in_dev->mc_list) == im) {
2533			seq_printf(seq, "%d\t%-10s: %5d %7s\n",
2534				   state->dev->ifindex, state->dev->name, state->in_dev->mc_count, querier);
2535		}
2536
2537		delta = im->timer.expires - jiffies;
2538		seq_printf(seq,
2539			   "\t\t\t\t%08X %5d %d:%08lX\t\t%d\n",
2540			   im->multiaddr, im->users,
2541			   im->tm_running,
2542			   im->tm_running ? jiffies_delta_to_clock_t(delta) : 0,
2543			   im->reporter);
2544	}
2545	return 0;
2546}
2547
2548static const struct seq_operations igmp_mc_seq_ops = {
2549	.start	=	igmp_mc_seq_start,
2550	.next	=	igmp_mc_seq_next,
2551	.stop	=	igmp_mc_seq_stop,
2552	.show	=	igmp_mc_seq_show,
2553};
2554
2555static int igmp_mc_seq_open(struct inode *inode, struct file *file)
2556{
2557	return seq_open_net(inode, file, &igmp_mc_seq_ops,
2558			sizeof(struct igmp_mc_iter_state));
2559}
2560
2561static const struct file_operations igmp_mc_seq_fops = {
2562	.owner		=	THIS_MODULE,
2563	.open		=	igmp_mc_seq_open,
2564	.read		=	seq_read,
2565	.llseek		=	seq_lseek,
2566	.release	=	seq_release_net,
2567};
2568
2569struct igmp_mcf_iter_state {
2570	struct seq_net_private p;
2571	struct net_device *dev;
2572	struct in_device *idev;
2573	struct ip_mc_list *im;
2574};
2575
2576#define igmp_mcf_seq_private(seq)	((struct igmp_mcf_iter_state *)(seq)->private)
2577
2578static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
2579{
2580	struct net *net = seq_file_net(seq);
2581	struct ip_sf_list *psf = NULL;
2582	struct ip_mc_list *im = NULL;
2583	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2584
2585	state->idev = NULL;
2586	state->im = NULL;
2587	for_each_netdev_rcu(net, state->dev) {
2588		struct in_device *idev;
2589		idev = __in_dev_get_rcu(state->dev);
2590		if (unlikely(!idev))
2591			continue;
2592		im = rcu_dereference(idev->mc_list);
2593		if (likely(im)) {
2594			spin_lock_bh(&im->lock);
2595			psf = im->sources;
2596			if (likely(psf)) {
2597				state->im = im;
2598				state->idev = idev;
2599				break;
2600			}
2601			spin_unlock_bh(&im->lock);
2602		}
2603	}
2604	return psf;
2605}
2606
2607static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_list *psf)
2608{
2609	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2610
2611	psf = psf->sf_next;
2612	while (!psf) {
2613		spin_unlock_bh(&state->im->lock);
2614		state->im = state->im->next;
2615		while (!state->im) {
2616			state->dev = next_net_device_rcu(state->dev);
2617			if (!state->dev) {
2618				state->idev = NULL;
2619				goto out;
2620			}
2621			state->idev = __in_dev_get_rcu(state->dev);
2622			if (!state->idev)
2623				continue;
2624			state->im = rcu_dereference(state->idev->mc_list);
2625		}
2626		if (!state->im)
2627			break;
2628		spin_lock_bh(&state->im->lock);
2629		psf = state->im->sources;
2630	}
2631out:
2632	return psf;
2633}
2634
2635static struct ip_sf_list *igmp_mcf_get_idx(struct seq_file *seq, loff_t pos)
2636{
2637	struct ip_sf_list *psf = igmp_mcf_get_first(seq);
2638	if (psf)
2639		while (pos && (psf = igmp_mcf_get_next(seq, psf)) != NULL)
2640			--pos;
2641	return pos ? NULL : psf;
2642}
2643
2644static void *igmp_mcf_seq_start(struct seq_file *seq, loff_t *pos)
2645	__acquires(rcu)
2646{
2647	rcu_read_lock();
2648	return *pos ? igmp_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2649}
2650
2651static void *igmp_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2652{
2653	struct ip_sf_list *psf;
2654	if (v == SEQ_START_TOKEN)
2655		psf = igmp_mcf_get_first(seq);
2656	else
2657		psf = igmp_mcf_get_next(seq, v);
2658	++*pos;
2659	return psf;
2660}
2661
2662static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
2663	__releases(rcu)
2664{
2665	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2666	if (likely(state->im)) {
2667		spin_unlock_bh(&state->im->lock);
2668		state->im = NULL;
2669	}
2670	state->idev = NULL;
2671	state->dev = NULL;
2672	rcu_read_unlock();
2673}
2674
2675static int igmp_mcf_seq_show(struct seq_file *seq, void *v)
2676{
2677	struct ip_sf_list *psf = (struct ip_sf_list *)v;
2678	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2679
2680	if (v == SEQ_START_TOKEN) {
2681		seq_puts(seq, "Idx Device        MCA        SRC    INC    EXC\n");
2682	} else {
2683		seq_printf(seq,
2684			   "%3d %6.6s 0x%08x "
2685			   "0x%08x %6lu %6lu\n",
2686			   state->dev->ifindex, state->dev->name,
2687			   ntohl(state->im->multiaddr),
2688			   ntohl(psf->sf_inaddr),
2689			   psf->sf_count[MCAST_INCLUDE],
2690			   psf->sf_count[MCAST_EXCLUDE]);
2691	}
2692	return 0;
2693}
2694
2695static const struct seq_operations igmp_mcf_seq_ops = {
2696	.start	=	igmp_mcf_seq_start,
2697	.next	=	igmp_mcf_seq_next,
2698	.stop	=	igmp_mcf_seq_stop,
2699	.show	=	igmp_mcf_seq_show,
2700};
2701
2702static int igmp_mcf_seq_open(struct inode *inode, struct file *file)
2703{
2704	return seq_open_net(inode, file, &igmp_mcf_seq_ops,
2705			sizeof(struct igmp_mcf_iter_state));
2706}
2707
2708static const struct file_operations igmp_mcf_seq_fops = {
2709	.owner		=	THIS_MODULE,
2710	.open		=	igmp_mcf_seq_open,
2711	.read		=	seq_read,
2712	.llseek		=	seq_lseek,
2713	.release	=	seq_release_net,
2714};
2715
2716static int __net_init igmp_net_init(struct net *net)
2717{
2718	struct proc_dir_entry *pde;
2719	int err;
2720
2721	pde = proc_create("igmp", S_IRUGO, net->proc_net, &igmp_mc_seq_fops);
2722	if (!pde)
2723		goto out_igmp;
2724	pde = proc_create("mcfilter", S_IRUGO, net->proc_net,
2725			  &igmp_mcf_seq_fops);
2726	if (!pde)
2727		goto out_mcfilter;
2728	err = inet_ctl_sock_create(&net->ipv4.mc_autojoin_sk, AF_INET,
2729				   SOCK_DGRAM, 0, net);
2730	if (err < 0) {
2731		pr_err("Failed to initialize the IGMP autojoin socket (err %d)\n",
2732		       err);
2733		goto out_sock;
2734	}
2735
2736	return 0;
2737
2738out_sock:
2739	remove_proc_entry("mcfilter", net->proc_net);
2740out_mcfilter:
2741	remove_proc_entry("igmp", net->proc_net);
2742out_igmp:
2743	return -ENOMEM;
2744}
2745
2746static void __net_exit igmp_net_exit(struct net *net)
2747{
2748	remove_proc_entry("mcfilter", net->proc_net);
2749	remove_proc_entry("igmp", net->proc_net);
2750	inet_ctl_sock_destroy(net->ipv4.mc_autojoin_sk);
2751}
2752
2753static struct pernet_operations igmp_net_ops = {
2754	.init = igmp_net_init,
2755	.exit = igmp_net_exit,
2756};
2757#endif
2758
2759static int igmp_netdev_event(struct notifier_block *this,
2760			     unsigned long event, void *ptr)
2761{
2762	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
2763	struct in_device *in_dev;
2764
2765	switch (event) {
2766	case NETDEV_RESEND_IGMP:
2767		in_dev = __in_dev_get_rtnl(dev);
2768		if (in_dev)
2769			ip_mc_rejoin_groups(in_dev);
2770		break;
2771	default:
2772		break;
2773	}
2774	return NOTIFY_DONE;
2775}
2776
2777static struct notifier_block igmp_notifier = {
2778	.notifier_call = igmp_netdev_event,
2779};
2780
2781int __init igmp_mc_init(void)
2782{
2783#if defined(CONFIG_PROC_FS)
2784	int err;
2785
2786	err = register_pernet_subsys(&igmp_net_ops);
2787	if (err)
2788		return err;
2789	err = register_netdevice_notifier(&igmp_notifier);
2790	if (err)
2791		goto reg_notif_fail;
2792	return 0;
2793
2794reg_notif_fail:
2795	unregister_pernet_subsys(&igmp_net_ops);
2796	return err;
2797#else
2798	return register_netdevice_notifier(&igmp_notifier);
2799#endif
2800}
2801