1/*
2 *	IPv6 Address [auto]configuration
3 *	Linux INET6 implementation
4 *
5 *	Authors:
6 *	Pedro Roque		<roque@di.fc.ul.pt>
7 *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
8 *
9 *	This program is free software; you can redistribute it and/or
10 *      modify it under the terms of the GNU General Public License
11 *      as published by the Free Software Foundation; either version
12 *      2 of the License, or (at your option) any later version.
13 */
14
15/*
16 *	Changes:
17 *
18 *	Janos Farkas			:	delete timer on ifdown
19 *	<chexum@bankinf.banki.hu>
20 *	Andi Kleen			:	kill double kfree on module
21 *						unload.
22 *	Maciej W. Rozycki		:	FDDI support
23 *	sekiya@USAGI			:	Don't send too many RS
24 *						packets.
25 *	yoshfuji@USAGI			:       Fixed interval between DAD
26 *						packets.
27 *	YOSHIFUJI Hideaki @USAGI	:	improved accuracy of
28 *						address validation timer.
29 *	YOSHIFUJI Hideaki @USAGI	:	Privacy Extensions (RFC3041)
30 *						support.
31 *	Yuji SEKIYA @USAGI		:	Don't assign a same IPv6
32 *						address on a same interface.
33 *	YOSHIFUJI Hideaki @USAGI	:	ARCnet support
34 *	YOSHIFUJI Hideaki @USAGI	:	convert /proc/net/if_inet6 to
35 *						seq_file.
36 *	YOSHIFUJI Hideaki @USAGI	:	improved source address
37 *						selection; consider scope,
38 *						status etc.
39 */
40
41#define pr_fmt(fmt) "IPv6: " fmt
42
43#include <linux/errno.h>
44#include <linux/types.h>
45#include <linux/kernel.h>
46#include <linux/socket.h>
47#include <linux/sockios.h>
48#include <linux/net.h>
49#include <linux/inet.h>
50#include <linux/in6.h>
51#include <linux/netdevice.h>
52#include <linux/if_addr.h>
53#include <linux/if_arp.h>
54#include <linux/if_arcnet.h>
55#include <linux/if_infiniband.h>
56#include <linux/route.h>
57#include <linux/inetdevice.h>
58#include <linux/init.h>
59#include <linux/slab.h>
60#ifdef CONFIG_SYSCTL
61#include <linux/sysctl.h>
62#endif
63#include <linux/capability.h>
64#include <linux/delay.h>
65#include <linux/notifier.h>
66#include <linux/string.h>
67#include <linux/hash.h>
68
69#include <net/net_namespace.h>
70#include <net/sock.h>
71#include <net/snmp.h>
72
73#include <net/af_ieee802154.h>
74#include <net/firewire.h>
75#include <net/ipv6.h>
76#include <net/protocol.h>
77#include <net/ndisc.h>
78#include <net/ip6_route.h>
79#include <net/addrconf.h>
80#include <net/tcp.h>
81#include <net/ip.h>
82#include <net/netlink.h>
83#include <net/pkt_sched.h>
84#include <linux/if_tunnel.h>
85#include <linux/rtnetlink.h>
86#include <linux/netconf.h>
87#include <linux/random.h>
88#include <linux/uaccess.h>
89#include <asm/unaligned.h>
90
91#include <linux/proc_fs.h>
92#include <linux/seq_file.h>
93#include <linux/export.h>
94
95/* Set to 3 to get tracing... */
96#define ACONF_DEBUG 2
97
98#if ACONF_DEBUG >= 3
99#define ADBG(fmt, ...) printk(fmt, ##__VA_ARGS__)
100#else
101#define ADBG(fmt, ...) do { if (0) printk(fmt, ##__VA_ARGS__); } while (0)
102#endif
103
104#define	INFINITY_LIFE_TIME	0xFFFFFFFF
105
106#define IPV6_MAX_STRLEN \
107	sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")
108
109static inline u32 cstamp_delta(unsigned long cstamp)
110{
111	return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
112}
113
114#ifdef CONFIG_SYSCTL
115static int addrconf_sysctl_register(struct inet6_dev *idev);
116static void addrconf_sysctl_unregister(struct inet6_dev *idev);
117#else
118static inline int addrconf_sysctl_register(struct inet6_dev *idev)
119{
120	return 0;
121}
122
123static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
124{
125}
126#endif
127
128static void __ipv6_regen_rndid(struct inet6_dev *idev);
129static void __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
130static void ipv6_regen_rndid(unsigned long data);
131
132static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);
133static int ipv6_count_addresses(struct inet6_dev *idev);
134static int ipv6_generate_stable_address(struct in6_addr *addr,
135					u8 dad_count,
136					const struct inet6_dev *idev);
137
138/*
139 *	Configured unicast address hash table
140 */
141static struct hlist_head inet6_addr_lst[IN6_ADDR_HSIZE];
142static DEFINE_SPINLOCK(addrconf_hash_lock);
143
144static void addrconf_verify(void);
145static void addrconf_verify_rtnl(void);
146static void addrconf_verify_work(struct work_struct *);
147
148static struct workqueue_struct *addrconf_wq;
149static DECLARE_DELAYED_WORK(addr_chk_work, addrconf_verify_work);
150
151static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
152static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);
153
154static void addrconf_type_change(struct net_device *dev,
155				 unsigned long event);
156static int addrconf_ifdown(struct net_device *dev, int how);
157
158static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
159						  int plen,
160						  const struct net_device *dev,
161						  u32 flags, u32 noflags);
162
163static void addrconf_dad_start(struct inet6_ifaddr *ifp);
164static void addrconf_dad_work(struct work_struct *w);
165static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
166static void addrconf_dad_run(struct inet6_dev *idev);
167static void addrconf_rs_timer(unsigned long data);
168static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
169static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
170
171static void inet6_prefix_notify(int event, struct inet6_dev *idev,
172				struct prefix_info *pinfo);
173static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
174			       struct net_device *dev);
175
176static struct ipv6_devconf ipv6_devconf __read_mostly = {
177	.forwarding		= 0,
178	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
179	.mtu6			= IPV6_MIN_MTU,
180	.accept_ra		= 1,
181	.accept_redirects	= 1,
182	.autoconf		= 1,
183	.force_mld_version	= 0,
184	.mldv1_unsolicited_report_interval = 10 * HZ,
185	.mldv2_unsolicited_report_interval = HZ,
186	.dad_transmits		= 1,
187	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
188	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
189	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
190	.use_tempaddr		= 0,
191	.temp_valid_lft		= TEMP_VALID_LIFETIME,
192	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
193	.regen_max_retry	= REGEN_MAX_RETRY,
194	.max_desync_factor	= MAX_DESYNC_FACTOR,
195	.max_addresses		= IPV6_MAX_ADDRESSES,
196	.accept_ra_defrtr	= 1,
197	.accept_ra_from_local	= 0,
198	.accept_ra_min_hop_limit= 1,
199	.accept_ra_pinfo	= 1,
200#ifdef CONFIG_IPV6_ROUTER_PREF
201	.accept_ra_rtr_pref	= 1,
202	.rtr_probe_interval	= 60 * HZ,
203#ifdef CONFIG_IPV6_ROUTE_INFO
204	.accept_ra_rt_info_max_plen = 0,
205#endif
206#endif
207	.proxy_ndp		= 0,
208	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
209	.disable_ipv6		= 0,
210	.accept_dad		= 1,
211	.suppress_frag_ndisc	= 1,
212	.accept_ra_mtu		= 1,
213	.stable_secret		= {
214		.initialized = false,
215	}
216};
217
218static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
219	.forwarding		= 0,
220	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
221	.mtu6			= IPV6_MIN_MTU,
222	.accept_ra		= 1,
223	.accept_redirects	= 1,
224	.autoconf		= 1,
225	.force_mld_version	= 0,
226	.mldv1_unsolicited_report_interval = 10 * HZ,
227	.mldv2_unsolicited_report_interval = HZ,
228	.dad_transmits		= 1,
229	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
230	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
231	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
232	.use_tempaddr		= 0,
233	.temp_valid_lft		= TEMP_VALID_LIFETIME,
234	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
235	.regen_max_retry	= REGEN_MAX_RETRY,
236	.max_desync_factor	= MAX_DESYNC_FACTOR,
237	.max_addresses		= IPV6_MAX_ADDRESSES,
238	.accept_ra_defrtr	= 1,
239	.accept_ra_from_local	= 0,
240	.accept_ra_min_hop_limit= 1,
241	.accept_ra_pinfo	= 1,
242#ifdef CONFIG_IPV6_ROUTER_PREF
243	.accept_ra_rtr_pref	= 1,
244	.rtr_probe_interval	= 60 * HZ,
245#ifdef CONFIG_IPV6_ROUTE_INFO
246	.accept_ra_rt_info_max_plen = 0,
247#endif
248#endif
249	.proxy_ndp		= 0,
250	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
251	.disable_ipv6		= 0,
252	.accept_dad		= 1,
253	.suppress_frag_ndisc	= 1,
254	.accept_ra_mtu		= 1,
255	.stable_secret		= {
256		.initialized = false,
257	},
258};
259
260/* Check if a valid qdisc is available */
261static inline bool addrconf_qdisc_ok(const struct net_device *dev)
262{
263	return !qdisc_tx_is_noop(dev);
264}
265
266static void addrconf_del_rs_timer(struct inet6_dev *idev)
267{
268	if (del_timer(&idev->rs_timer))
269		__in6_dev_put(idev);
270}
271
272static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
273{
274	if (cancel_delayed_work(&ifp->dad_work))
275		__in6_ifa_put(ifp);
276}
277
278static void addrconf_mod_rs_timer(struct inet6_dev *idev,
279				  unsigned long when)
280{
281	if (!timer_pending(&idev->rs_timer))
282		in6_dev_hold(idev);
283	mod_timer(&idev->rs_timer, jiffies + when);
284}
285
286static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
287				   unsigned long delay)
288{
289	if (!delayed_work_pending(&ifp->dad_work))
290		in6_ifa_hold(ifp);
291	mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
292}
293
294static int snmp6_alloc_dev(struct inet6_dev *idev)
295{
296	int i;
297
298	idev->stats.ipv6 = alloc_percpu(struct ipstats_mib);
299	if (!idev->stats.ipv6)
300		goto err_ip;
301
302	for_each_possible_cpu(i) {
303		struct ipstats_mib *addrconf_stats;
304		addrconf_stats = per_cpu_ptr(idev->stats.ipv6, i);
305		u64_stats_init(&addrconf_stats->syncp);
306	}
307
308
309	idev->stats.icmpv6dev = kzalloc(sizeof(struct icmpv6_mib_device),
310					GFP_KERNEL);
311	if (!idev->stats.icmpv6dev)
312		goto err_icmp;
313	idev->stats.icmpv6msgdev = kzalloc(sizeof(struct icmpv6msg_mib_device),
314					   GFP_KERNEL);
315	if (!idev->stats.icmpv6msgdev)
316		goto err_icmpmsg;
317
318	return 0;
319
320err_icmpmsg:
321	kfree(idev->stats.icmpv6dev);
322err_icmp:
323	free_percpu(idev->stats.ipv6);
324err_ip:
325	return -ENOMEM;
326}
327
328static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
329{
330	struct inet6_dev *ndev;
331	int err = -ENOMEM;
332
333	ASSERT_RTNL();
334
335	if (dev->mtu < IPV6_MIN_MTU)
336		return ERR_PTR(-EINVAL);
337
338	ndev = kzalloc(sizeof(struct inet6_dev), GFP_KERNEL);
339	if (!ndev)
340		return ERR_PTR(err);
341
342	rwlock_init(&ndev->lock);
343	ndev->dev = dev;
344	INIT_LIST_HEAD(&ndev->addr_list);
345	setup_timer(&ndev->rs_timer, addrconf_rs_timer,
346		    (unsigned long)ndev);
347	memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
348
349	if (ndev->cnf.stable_secret.initialized)
350		ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
351	else
352		ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_EUI64;
353
354	ndev->cnf.mtu6 = dev->mtu;
355	ndev->cnf.sysctl = NULL;
356	ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
357	if (!ndev->nd_parms) {
358		kfree(ndev);
359		return ERR_PTR(err);
360	}
361	if (ndev->cnf.forwarding)
362		dev_disable_lro(dev);
363	/* We refer to the device */
364	dev_hold(dev);
365
366	if (snmp6_alloc_dev(ndev) < 0) {
367		ADBG(KERN_WARNING
368			"%s: cannot allocate memory for statistics; dev=%s.\n",
369			__func__, dev->name);
370		neigh_parms_release(&nd_tbl, ndev->nd_parms);
371		dev_put(dev);
372		kfree(ndev);
373		return ERR_PTR(err);
374	}
375
376	if (snmp6_register_dev(ndev) < 0) {
377		ADBG(KERN_WARNING
378			"%s: cannot create /proc/net/dev_snmp6/%s\n",
379			__func__, dev->name);
380		goto err_release;
381	}
382
383	/* One reference from device.  We must do this before
384	 * we invoke __ipv6_regen_rndid().
385	 */
386	in6_dev_hold(ndev);
387
388	if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
389		ndev->cnf.accept_dad = -1;
390
391#if IS_ENABLED(CONFIG_IPV6_SIT)
392	if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
393		pr_info("%s: Disabled Multicast RS\n", dev->name);
394		ndev->cnf.rtr_solicits = 0;
395	}
396#endif
397
398	INIT_LIST_HEAD(&ndev->tempaddr_list);
399	setup_timer(&ndev->regen_timer, ipv6_regen_rndid, (unsigned long)ndev);
400	if ((dev->flags&IFF_LOOPBACK) ||
401	    dev->type == ARPHRD_TUNNEL ||
402	    dev->type == ARPHRD_TUNNEL6 ||
403	    dev->type == ARPHRD_SIT ||
404	    dev->type == ARPHRD_NONE) {
405		ndev->cnf.use_tempaddr = -1;
406	} else {
407		in6_dev_hold(ndev);
408		ipv6_regen_rndid((unsigned long) ndev);
409	}
410
411	ndev->token = in6addr_any;
412
413	if (netif_running(dev) && addrconf_qdisc_ok(dev))
414		ndev->if_flags |= IF_READY;
415
416	ipv6_mc_init_dev(ndev);
417	ndev->tstamp = jiffies;
418	err = addrconf_sysctl_register(ndev);
419	if (err) {
420		ipv6_mc_destroy_dev(ndev);
421		del_timer(&ndev->regen_timer);
422		snmp6_unregister_dev(ndev);
423		goto err_release;
424	}
425	/* protected by rtnl_lock */
426	rcu_assign_pointer(dev->ip6_ptr, ndev);
427
428	/* Join interface-local all-node multicast group */
429	ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allnodes);
430
431	/* Join all-node multicast group */
432	ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
433
434	/* Join all-router multicast group if forwarding is set */
435	if (ndev->cnf.forwarding && (dev->flags & IFF_MULTICAST))
436		ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
437
438	return ndev;
439
440err_release:
441	neigh_parms_release(&nd_tbl, ndev->nd_parms);
442	ndev->dead = 1;
443	in6_dev_finish_destroy(ndev);
444	return ERR_PTR(err);
445}
446
447static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
448{
449	struct inet6_dev *idev;
450
451	ASSERT_RTNL();
452
453	idev = __in6_dev_get(dev);
454	if (!idev) {
455		idev = ipv6_add_dev(dev);
456		if (IS_ERR(idev))
457			return NULL;
458	}
459
460	if (dev->flags&IFF_UP)
461		ipv6_mc_up(idev);
462	return idev;
463}
464
465static int inet6_netconf_msgsize_devconf(int type)
466{
467	int size =  NLMSG_ALIGN(sizeof(struct netconfmsg))
468		    + nla_total_size(4);	/* NETCONFA_IFINDEX */
469
470	/* type -1 is used for ALL */
471	if (type == -1 || type == NETCONFA_FORWARDING)
472		size += nla_total_size(4);
473#ifdef CONFIG_IPV6_MROUTE
474	if (type == -1 || type == NETCONFA_MC_FORWARDING)
475		size += nla_total_size(4);
476#endif
477	if (type == -1 || type == NETCONFA_PROXY_NEIGH)
478		size += nla_total_size(4);
479
480	return size;
481}
482
483static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
484				      struct ipv6_devconf *devconf, u32 portid,
485				      u32 seq, int event, unsigned int flags,
486				      int type)
487{
488	struct nlmsghdr  *nlh;
489	struct netconfmsg *ncm;
490
491	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct netconfmsg),
492			flags);
493	if (!nlh)
494		return -EMSGSIZE;
495
496	ncm = nlmsg_data(nlh);
497	ncm->ncm_family = AF_INET6;
498
499	if (nla_put_s32(skb, NETCONFA_IFINDEX, ifindex) < 0)
500		goto nla_put_failure;
501
502	/* type -1 is used for ALL */
503	if ((type == -1 || type == NETCONFA_FORWARDING) &&
504	    nla_put_s32(skb, NETCONFA_FORWARDING, devconf->forwarding) < 0)
505		goto nla_put_failure;
506#ifdef CONFIG_IPV6_MROUTE
507	if ((type == -1 || type == NETCONFA_MC_FORWARDING) &&
508	    nla_put_s32(skb, NETCONFA_MC_FORWARDING,
509			devconf->mc_forwarding) < 0)
510		goto nla_put_failure;
511#endif
512	if ((type == -1 || type == NETCONFA_PROXY_NEIGH) &&
513	    nla_put_s32(skb, NETCONFA_PROXY_NEIGH, devconf->proxy_ndp) < 0)
514		goto nla_put_failure;
515
516	nlmsg_end(skb, nlh);
517	return 0;
518
519nla_put_failure:
520	nlmsg_cancel(skb, nlh);
521	return -EMSGSIZE;
522}
523
524void inet6_netconf_notify_devconf(struct net *net, int type, int ifindex,
525				  struct ipv6_devconf *devconf)
526{
527	struct sk_buff *skb;
528	int err = -ENOBUFS;
529
530	skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_ATOMIC);
531	if (!skb)
532		goto errout;
533
534	err = inet6_netconf_fill_devconf(skb, ifindex, devconf, 0, 0,
535					 RTM_NEWNETCONF, 0, type);
536	if (err < 0) {
537		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
538		WARN_ON(err == -EMSGSIZE);
539		kfree_skb(skb);
540		goto errout;
541	}
542	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_ATOMIC);
543	return;
544errout:
545	rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err);
546}
547
548static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
549	[NETCONFA_IFINDEX]	= { .len = sizeof(int) },
550	[NETCONFA_FORWARDING]	= { .len = sizeof(int) },
551	[NETCONFA_PROXY_NEIGH]	= { .len = sizeof(int) },
552};
553
554static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
555				     struct nlmsghdr *nlh)
556{
557	struct net *net = sock_net(in_skb->sk);
558	struct nlattr *tb[NETCONFA_MAX+1];
559	struct netconfmsg *ncm;
560	struct sk_buff *skb;
561	struct ipv6_devconf *devconf;
562	struct inet6_dev *in6_dev;
563	struct net_device *dev;
564	int ifindex;
565	int err;
566
567	err = nlmsg_parse(nlh, sizeof(*ncm), tb, NETCONFA_MAX,
568			  devconf_ipv6_policy);
569	if (err < 0)
570		goto errout;
571
572	err = -EINVAL;
573	if (!tb[NETCONFA_IFINDEX])
574		goto errout;
575
576	ifindex = nla_get_s32(tb[NETCONFA_IFINDEX]);
577	switch (ifindex) {
578	case NETCONFA_IFINDEX_ALL:
579		devconf = net->ipv6.devconf_all;
580		break;
581	case NETCONFA_IFINDEX_DEFAULT:
582		devconf = net->ipv6.devconf_dflt;
583		break;
584	default:
585		dev = __dev_get_by_index(net, ifindex);
586		if (!dev)
587			goto errout;
588		in6_dev = __in6_dev_get(dev);
589		if (!in6_dev)
590			goto errout;
591		devconf = &in6_dev->cnf;
592		break;
593	}
594
595	err = -ENOBUFS;
596	skb = nlmsg_new(inet6_netconf_msgsize_devconf(-1), GFP_ATOMIC);
597	if (!skb)
598		goto errout;
599
600	err = inet6_netconf_fill_devconf(skb, ifindex, devconf,
601					 NETLINK_CB(in_skb).portid,
602					 nlh->nlmsg_seq, RTM_NEWNETCONF, 0,
603					 -1);
604	if (err < 0) {
605		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
606		WARN_ON(err == -EMSGSIZE);
607		kfree_skb(skb);
608		goto errout;
609	}
610	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
611errout:
612	return err;
613}
614
615static int inet6_netconf_dump_devconf(struct sk_buff *skb,
616				      struct netlink_callback *cb)
617{
618	struct net *net = sock_net(skb->sk);
619	int h, s_h;
620	int idx, s_idx;
621	struct net_device *dev;
622	struct inet6_dev *idev;
623	struct hlist_head *head;
624
625	s_h = cb->args[0];
626	s_idx = idx = cb->args[1];
627
628	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
629		idx = 0;
630		head = &net->dev_index_head[h];
631		rcu_read_lock();
632		cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^
633			  net->dev_base_seq;
634		hlist_for_each_entry_rcu(dev, head, index_hlist) {
635			if (idx < s_idx)
636				goto cont;
637			idev = __in6_dev_get(dev);
638			if (!idev)
639				goto cont;
640
641			if (inet6_netconf_fill_devconf(skb, dev->ifindex,
642						       &idev->cnf,
643						       NETLINK_CB(cb->skb).portid,
644						       cb->nlh->nlmsg_seq,
645						       RTM_NEWNETCONF,
646						       NLM_F_MULTI,
647						       -1) < 0) {
648				rcu_read_unlock();
649				goto done;
650			}
651			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
652cont:
653			idx++;
654		}
655		rcu_read_unlock();
656	}
657	if (h == NETDEV_HASHENTRIES) {
658		if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_ALL,
659					       net->ipv6.devconf_all,
660					       NETLINK_CB(cb->skb).portid,
661					       cb->nlh->nlmsg_seq,
662					       RTM_NEWNETCONF, NLM_F_MULTI,
663					       -1) < 0)
664			goto done;
665		else
666			h++;
667	}
668	if (h == NETDEV_HASHENTRIES + 1) {
669		if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_DEFAULT,
670					       net->ipv6.devconf_dflt,
671					       NETLINK_CB(cb->skb).portid,
672					       cb->nlh->nlmsg_seq,
673					       RTM_NEWNETCONF, NLM_F_MULTI,
674					       -1) < 0)
675			goto done;
676		else
677			h++;
678	}
679done:
680	cb->args[0] = h;
681	cb->args[1] = idx;
682
683	return skb->len;
684}
685
686#ifdef CONFIG_SYSCTL
687static void dev_forward_change(struct inet6_dev *idev)
688{
689	struct net_device *dev;
690	struct inet6_ifaddr *ifa;
691
692	if (!idev)
693		return;
694	dev = idev->dev;
695	if (idev->cnf.forwarding)
696		dev_disable_lro(dev);
697	if (dev->flags & IFF_MULTICAST) {
698		if (idev->cnf.forwarding) {
699			ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
700			ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allrouters);
701			ipv6_dev_mc_inc(dev, &in6addr_sitelocal_allrouters);
702		} else {
703			ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);
704			ipv6_dev_mc_dec(dev, &in6addr_interfacelocal_allrouters);
705			ipv6_dev_mc_dec(dev, &in6addr_sitelocal_allrouters);
706		}
707	}
708
709	list_for_each_entry(ifa, &idev->addr_list, if_list) {
710		if (ifa->flags&IFA_F_TENTATIVE)
711			continue;
712		if (idev->cnf.forwarding)
713			addrconf_join_anycast(ifa);
714		else
715			addrconf_leave_anycast(ifa);
716	}
717	inet6_netconf_notify_devconf(dev_net(dev), NETCONFA_FORWARDING,
718				     dev->ifindex, &idev->cnf);
719}
720
721
722static void addrconf_forward_change(struct net *net, __s32 newf)
723{
724	struct net_device *dev;
725	struct inet6_dev *idev;
726
727	for_each_netdev(net, dev) {
728		idev = __in6_dev_get(dev);
729		if (idev) {
730			int changed = (!idev->cnf.forwarding) ^ (!newf);
731			idev->cnf.forwarding = newf;
732			if (changed)
733				dev_forward_change(idev);
734		}
735	}
736}
737
738static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
739{
740	struct net *net;
741	int old;
742
743	if (!rtnl_trylock())
744		return restart_syscall();
745
746	net = (struct net *)table->extra2;
747	old = *p;
748	*p = newf;
749
750	if (p == &net->ipv6.devconf_dflt->forwarding) {
751		if ((!newf) ^ (!old))
752			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
753						     NETCONFA_IFINDEX_DEFAULT,
754						     net->ipv6.devconf_dflt);
755		rtnl_unlock();
756		return 0;
757	}
758
759	if (p == &net->ipv6.devconf_all->forwarding) {
760		net->ipv6.devconf_dflt->forwarding = newf;
761		addrconf_forward_change(net, newf);
762		if ((!newf) ^ (!old))
763			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
764						     NETCONFA_IFINDEX_ALL,
765						     net->ipv6.devconf_all);
766	} else if ((!newf) ^ (!old))
767		dev_forward_change((struct inet6_dev *)table->extra1);
768	rtnl_unlock();
769
770	if (newf)
771		rt6_purge_dflt_routers(net);
772	return 1;
773}
774#endif
775
776/* Nobody refers to this ifaddr, destroy it */
777void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
778{
779	WARN_ON(!hlist_unhashed(&ifp->addr_lst));
780
781#ifdef NET_REFCNT_DEBUG
782	pr_debug("%s\n", __func__);
783#endif
784
785	in6_dev_put(ifp->idev);
786
787	if (cancel_delayed_work(&ifp->dad_work))
788		pr_notice("delayed DAD work was pending while freeing ifa=%p\n",
789			  ifp);
790
791	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
792		pr_warn("Freeing alive inet6 address %p\n", ifp);
793		return;
794	}
795	ip6_rt_put(ifp->rt);
796
797	kfree_rcu(ifp, rcu);
798}
799
800static void
801ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
802{
803	struct list_head *p;
804	int ifp_scope = ipv6_addr_src_scope(&ifp->addr);
805
806	/*
807	 * Each device address list is sorted in order of scope -
808	 * global before linklocal.
809	 */
810	list_for_each(p, &idev->addr_list) {
811		struct inet6_ifaddr *ifa
812			= list_entry(p, struct inet6_ifaddr, if_list);
813		if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))
814			break;
815	}
816
817	list_add_tail(&ifp->if_list, p);
818}
819
820static u32 inet6_addr_hash(const struct in6_addr *addr)
821{
822	return hash_32(ipv6_addr_hash(addr), IN6_ADDR_HSIZE_SHIFT);
823}
824
825/* On success it returns ifp with increased reference count */
826
827static struct inet6_ifaddr *
828ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
829	      const struct in6_addr *peer_addr, int pfxlen,
830	      int scope, u32 flags, u32 valid_lft, u32 prefered_lft)
831{
832	struct inet6_ifaddr *ifa = NULL;
833	struct rt6_info *rt;
834	unsigned int hash;
835	int err = 0;
836	int addr_type = ipv6_addr_type(addr);
837
838	if (addr_type == IPV6_ADDR_ANY ||
839	    addr_type & IPV6_ADDR_MULTICAST ||
840	    (!(idev->dev->flags & IFF_LOOPBACK) &&
841	     addr_type & IPV6_ADDR_LOOPBACK))
842		return ERR_PTR(-EADDRNOTAVAIL);
843
844	rcu_read_lock_bh();
845	if (idev->dead) {
846		err = -ENODEV;			/*XXX*/
847		goto out2;
848	}
849
850	if (idev->cnf.disable_ipv6) {
851		err = -EACCES;
852		goto out2;
853	}
854
855	spin_lock(&addrconf_hash_lock);
856
857	/* Ignore adding duplicate addresses on an interface */
858	if (ipv6_chk_same_addr(dev_net(idev->dev), addr, idev->dev)) {
859		ADBG("ipv6_add_addr: already assigned\n");
860		err = -EEXIST;
861		goto out;
862	}
863
864	ifa = kzalloc(sizeof(struct inet6_ifaddr), GFP_ATOMIC);
865
866	if (!ifa) {
867		ADBG("ipv6_add_addr: malloc failed\n");
868		err = -ENOBUFS;
869		goto out;
870	}
871
872	rt = addrconf_dst_alloc(idev, addr, false);
873	if (IS_ERR(rt)) {
874		err = PTR_ERR(rt);
875		goto out;
876	}
877
878	neigh_parms_data_state_setall(idev->nd_parms);
879
880	ifa->addr = *addr;
881	if (peer_addr)
882		ifa->peer_addr = *peer_addr;
883
884	spin_lock_init(&ifa->lock);
885	INIT_DELAYED_WORK(&ifa->dad_work, addrconf_dad_work);
886	INIT_HLIST_NODE(&ifa->addr_lst);
887	ifa->scope = scope;
888	ifa->prefix_len = pfxlen;
889	ifa->flags = flags | IFA_F_TENTATIVE;
890	ifa->valid_lft = valid_lft;
891	ifa->prefered_lft = prefered_lft;
892	ifa->cstamp = ifa->tstamp = jiffies;
893	ifa->tokenized = false;
894
895	ifa->rt = rt;
896
897	ifa->idev = idev;
898	in6_dev_hold(idev);
899	/* For caller */
900	in6_ifa_hold(ifa);
901
902	/* Add to big hash table */
903	hash = inet6_addr_hash(addr);
904
905	hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);
906	spin_unlock(&addrconf_hash_lock);
907
908	write_lock(&idev->lock);
909	/* Add to inet6_dev unicast addr list. */
910	ipv6_link_dev_addr(idev, ifa);
911
912	if (ifa->flags&IFA_F_TEMPORARY) {
913		list_add(&ifa->tmp_list, &idev->tempaddr_list);
914		in6_ifa_hold(ifa);
915	}
916
917	in6_ifa_hold(ifa);
918	write_unlock(&idev->lock);
919out2:
920	rcu_read_unlock_bh();
921
922	if (likely(err == 0))
923		inet6addr_notifier_call_chain(NETDEV_UP, ifa);
924	else {
925		kfree(ifa);
926		ifa = ERR_PTR(err);
927	}
928
929	return ifa;
930out:
931	spin_unlock(&addrconf_hash_lock);
932	goto out2;
933}
934
935enum cleanup_prefix_rt_t {
936	CLEANUP_PREFIX_RT_NOP,    /* no cleanup action for prefix route */
937	CLEANUP_PREFIX_RT_DEL,    /* delete the prefix route */
938	CLEANUP_PREFIX_RT_EXPIRE, /* update the lifetime of the prefix route */
939};
940
941/*
942 * Check, whether the prefix for ifp would still need a prefix route
943 * after deleting ifp. The function returns one of the CLEANUP_PREFIX_RT_*
944 * constants.
945 *
946 * 1) we don't purge prefix if address was not permanent.
947 *    prefix is managed by its own lifetime.
948 * 2) we also don't purge, if the address was IFA_F_NOPREFIXROUTE.
949 * 3) if there are no addresses, delete prefix.
950 * 4) if there are still other permanent address(es),
951 *    corresponding prefix is still permanent.
952 * 5) if there are still other addresses with IFA_F_NOPREFIXROUTE,
953 *    don't purge the prefix, assume user space is managing it.
954 * 6) otherwise, update prefix lifetime to the
955 *    longest valid lifetime among the corresponding
956 *    addresses on the device.
957 *    Note: subsequent RA will update lifetime.
958 **/
959static enum cleanup_prefix_rt_t
960check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
961{
962	struct inet6_ifaddr *ifa;
963	struct inet6_dev *idev = ifp->idev;
964	unsigned long lifetime;
965	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_DEL;
966
967	*expires = jiffies;
968
969	list_for_each_entry(ifa, &idev->addr_list, if_list) {
970		if (ifa == ifp)
971			continue;
972		if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
973				       ifp->prefix_len))
974			continue;
975		if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
976			return CLEANUP_PREFIX_RT_NOP;
977
978		action = CLEANUP_PREFIX_RT_EXPIRE;
979
980		spin_lock(&ifa->lock);
981
982		lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
983		/*
984		 * Note: Because this address is
985		 * not permanent, lifetime <
986		 * LONG_MAX / HZ here.
987		 */
988		if (time_before(*expires, ifa->tstamp + lifetime * HZ))
989			*expires = ifa->tstamp + lifetime * HZ;
990		spin_unlock(&ifa->lock);
991	}
992
993	return action;
994}
995
996static void
997cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires, bool del_rt)
998{
999	struct rt6_info *rt;
1000
1001	rt = addrconf_get_prefix_route(&ifp->addr,
1002				       ifp->prefix_len,
1003				       ifp->idev->dev,
1004				       0, RTF_GATEWAY | RTF_DEFAULT);
1005	if (rt) {
1006		if (del_rt)
1007			ip6_del_rt(rt);
1008		else {
1009			if (!(rt->rt6i_flags & RTF_EXPIRES))
1010				rt6_set_expires(rt, expires);
1011			ip6_rt_put(rt);
1012		}
1013	}
1014}
1015
1016
1017/* This function wants to get referenced ifp and releases it before return */
1018
1019static void ipv6_del_addr(struct inet6_ifaddr *ifp)
1020{
1021	int state;
1022	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_NOP;
1023	unsigned long expires;
1024
1025	ASSERT_RTNL();
1026
1027	spin_lock_bh(&ifp->lock);
1028	state = ifp->state;
1029	ifp->state = INET6_IFADDR_STATE_DEAD;
1030	spin_unlock_bh(&ifp->lock);
1031
1032	if (state == INET6_IFADDR_STATE_DEAD)
1033		goto out;
1034
1035	spin_lock_bh(&addrconf_hash_lock);
1036	hlist_del_init_rcu(&ifp->addr_lst);
1037	spin_unlock_bh(&addrconf_hash_lock);
1038
1039	write_lock_bh(&ifp->idev->lock);
1040
1041	if (ifp->flags&IFA_F_TEMPORARY) {
1042		list_del(&ifp->tmp_list);
1043		if (ifp->ifpub) {
1044			in6_ifa_put(ifp->ifpub);
1045			ifp->ifpub = NULL;
1046		}
1047		__in6_ifa_put(ifp);
1048	}
1049
1050	if (ifp->flags & IFA_F_PERMANENT && !(ifp->flags & IFA_F_NOPREFIXROUTE))
1051		action = check_cleanup_prefix_route(ifp, &expires);
1052
1053	list_del_init(&ifp->if_list);
1054	__in6_ifa_put(ifp);
1055
1056	write_unlock_bh(&ifp->idev->lock);
1057
1058	addrconf_del_dad_work(ifp);
1059
1060	ipv6_ifa_notify(RTM_DELADDR, ifp);
1061
1062	inet6addr_notifier_call_chain(NETDEV_DOWN, ifp);
1063
1064	if (action != CLEANUP_PREFIX_RT_NOP) {
1065		cleanup_prefix_route(ifp, expires,
1066			action == CLEANUP_PREFIX_RT_DEL);
1067	}
1068
1069	/* clean up prefsrc entries */
1070	rt6_remove_prefsrc(ifp);
1071out:
1072	in6_ifa_put(ifp);
1073}
1074
1075static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *ift)
1076{
1077	struct inet6_dev *idev = ifp->idev;
1078	struct in6_addr addr, *tmpaddr;
1079	unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_tstamp, age;
1080	unsigned long regen_advance;
1081	int tmp_plen;
1082	int ret = 0;
1083	u32 addr_flags;
1084	unsigned long now = jiffies;
1085
1086	write_lock_bh(&idev->lock);
1087	if (ift) {
1088		spin_lock_bh(&ift->lock);
1089		memcpy(&addr.s6_addr[8], &ift->addr.s6_addr[8], 8);
1090		spin_unlock_bh(&ift->lock);
1091		tmpaddr = &addr;
1092	} else {
1093		tmpaddr = NULL;
1094	}
1095retry:
1096	in6_dev_hold(idev);
1097	if (idev->cnf.use_tempaddr <= 0) {
1098		write_unlock_bh(&idev->lock);
1099		pr_info("%s: use_tempaddr is disabled\n", __func__);
1100		in6_dev_put(idev);
1101		ret = -1;
1102		goto out;
1103	}
1104	spin_lock_bh(&ifp->lock);
1105	if (ifp->regen_count++ >= idev->cnf.regen_max_retry) {
1106		idev->cnf.use_tempaddr = -1;	/*XXX*/
1107		spin_unlock_bh(&ifp->lock);
1108		write_unlock_bh(&idev->lock);
1109		pr_warn("%s: regeneration time exceeded - disabled temporary address support\n",
1110			__func__);
1111		in6_dev_put(idev);
1112		ret = -1;
1113		goto out;
1114	}
1115	in6_ifa_hold(ifp);
1116	memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);
1117	__ipv6_try_regen_rndid(idev, tmpaddr);
1118	memcpy(&addr.s6_addr[8], idev->rndid, 8);
1119	age = (now - ifp->tstamp) / HZ;
1120	tmp_valid_lft = min_t(__u32,
1121			      ifp->valid_lft,
1122			      idev->cnf.temp_valid_lft + age);
1123	tmp_prefered_lft = min_t(__u32,
1124				 ifp->prefered_lft,
1125				 idev->cnf.temp_prefered_lft + age -
1126				 idev->cnf.max_desync_factor);
1127	tmp_plen = ifp->prefix_len;
1128	tmp_tstamp = ifp->tstamp;
1129	spin_unlock_bh(&ifp->lock);
1130
1131	regen_advance = idev->cnf.regen_max_retry *
1132			idev->cnf.dad_transmits *
1133			NEIGH_VAR(idev->nd_parms, RETRANS_TIME) / HZ;
1134	write_unlock_bh(&idev->lock);
1135
1136	/* A temporary address is created only if this calculated Preferred
1137	 * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
1138	 * an implementation must not create a temporary address with a zero
1139	 * Preferred Lifetime.
1140	 * Use age calculation as in addrconf_verify to avoid unnecessary
1141	 * temporary addresses being generated.
1142	 */
1143	age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
1144	if (tmp_prefered_lft <= regen_advance + age) {
1145		in6_ifa_put(ifp);
1146		in6_dev_put(idev);
1147		ret = -1;
1148		goto out;
1149	}
1150
1151	addr_flags = IFA_F_TEMPORARY;
1152	/* set in addrconf_prefix_rcv() */
1153	if (ifp->flags & IFA_F_OPTIMISTIC)
1154		addr_flags |= IFA_F_OPTIMISTIC;
1155
1156	ift = ipv6_add_addr(idev, &addr, NULL, tmp_plen,
1157			    ipv6_addr_scope(&addr), addr_flags,
1158			    tmp_valid_lft, tmp_prefered_lft);
1159	if (IS_ERR(ift)) {
1160		in6_ifa_put(ifp);
1161		in6_dev_put(idev);
1162		pr_info("%s: retry temporary address regeneration\n", __func__);
1163		tmpaddr = &addr;
1164		write_lock_bh(&idev->lock);
1165		goto retry;
1166	}
1167
1168	spin_lock_bh(&ift->lock);
1169	ift->ifpub = ifp;
1170	ift->cstamp = now;
1171	ift->tstamp = tmp_tstamp;
1172	spin_unlock_bh(&ift->lock);
1173
1174	addrconf_dad_start(ift);
1175	in6_ifa_put(ift);
1176	in6_dev_put(idev);
1177out:
1178	return ret;
1179}
1180
1181/*
1182 *	Choose an appropriate source address (RFC3484)
1183 */
1184enum {
1185	IPV6_SADDR_RULE_INIT = 0,
1186	IPV6_SADDR_RULE_LOCAL,
1187	IPV6_SADDR_RULE_SCOPE,
1188	IPV6_SADDR_RULE_PREFERRED,
1189#ifdef CONFIG_IPV6_MIP6
1190	IPV6_SADDR_RULE_HOA,
1191#endif
1192	IPV6_SADDR_RULE_OIF,
1193	IPV6_SADDR_RULE_LABEL,
1194	IPV6_SADDR_RULE_PRIVACY,
1195	IPV6_SADDR_RULE_ORCHID,
1196	IPV6_SADDR_RULE_PREFIX,
1197#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1198	IPV6_SADDR_RULE_NOT_OPTIMISTIC,
1199#endif
1200	IPV6_SADDR_RULE_MAX
1201};
1202
1203struct ipv6_saddr_score {
1204	int			rule;
1205	int			addr_type;
1206	struct inet6_ifaddr	*ifa;
1207	DECLARE_BITMAP(scorebits, IPV6_SADDR_RULE_MAX);
1208	int			scopedist;
1209	int			matchlen;
1210};
1211
1212struct ipv6_saddr_dst {
1213	const struct in6_addr *addr;
1214	int ifindex;
1215	int scope;
1216	int label;
1217	unsigned int prefs;
1218};
1219
1220static inline int ipv6_saddr_preferred(int type)
1221{
1222	if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))
1223		return 1;
1224	return 0;
1225}
1226
1227static inline bool ipv6_use_optimistic_addr(struct inet6_dev *idev)
1228{
1229#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1230	return idev && idev->cnf.optimistic_dad && idev->cnf.use_optimistic;
1231#else
1232	return false;
1233#endif
1234}
1235
1236static int ipv6_get_saddr_eval(struct net *net,
1237			       struct ipv6_saddr_score *score,
1238			       struct ipv6_saddr_dst *dst,
1239			       int i)
1240{
1241	int ret;
1242
1243	if (i <= score->rule) {
1244		switch (i) {
1245		case IPV6_SADDR_RULE_SCOPE:
1246			ret = score->scopedist;
1247			break;
1248		case IPV6_SADDR_RULE_PREFIX:
1249			ret = score->matchlen;
1250			break;
1251		default:
1252			ret = !!test_bit(i, score->scorebits);
1253		}
1254		goto out;
1255	}
1256
1257	switch (i) {
1258	case IPV6_SADDR_RULE_INIT:
1259		/* Rule 0: remember if hiscore is not ready yet */
1260		ret = !!score->ifa;
1261		break;
1262	case IPV6_SADDR_RULE_LOCAL:
1263		/* Rule 1: Prefer same address */
1264		ret = ipv6_addr_equal(&score->ifa->addr, dst->addr);
1265		break;
1266	case IPV6_SADDR_RULE_SCOPE:
1267		/* Rule 2: Prefer appropriate scope
1268		 *
1269		 *      ret
1270		 *       ^
1271		 *    -1 |  d 15
1272		 *    ---+--+-+---> scope
1273		 *       |
1274		 *       |             d is scope of the destination.
1275		 *  B-d  |  \
1276		 *       |   \      <- smaller scope is better if
1277		 *  B-15 |    \        if scope is enough for destination.
1278		 *       |             ret = B - scope (-1 <= scope >= d <= 15).
1279		 * d-C-1 | /
1280		 *       |/         <- greater is better
1281		 *   -C  /             if scope is not enough for destination.
1282		 *      /|             ret = scope - C (-1 <= d < scope <= 15).
1283		 *
1284		 * d - C - 1 < B -15 (for all -1 <= d <= 15).
1285		 * C > d + 14 - B >= 15 + 14 - B = 29 - B.
1286		 * Assume B = 0 and we get C > 29.
1287		 */
1288		ret = __ipv6_addr_src_scope(score->addr_type);
1289		if (ret >= dst->scope)
1290			ret = -ret;
1291		else
1292			ret -= 128;	/* 30 is enough */
1293		score->scopedist = ret;
1294		break;
1295	case IPV6_SADDR_RULE_PREFERRED:
1296	    {
1297		/* Rule 3: Avoid deprecated and optimistic addresses */
1298		u8 avoid = IFA_F_DEPRECATED;
1299
1300		if (!ipv6_use_optimistic_addr(score->ifa->idev))
1301			avoid |= IFA_F_OPTIMISTIC;
1302		ret = ipv6_saddr_preferred(score->addr_type) ||
1303		      !(score->ifa->flags & avoid);
1304		break;
1305	    }
1306#ifdef CONFIG_IPV6_MIP6
1307	case IPV6_SADDR_RULE_HOA:
1308	    {
1309		/* Rule 4: Prefer home address */
1310		int prefhome = !(dst->prefs & IPV6_PREFER_SRC_COA);
1311		ret = !(score->ifa->flags & IFA_F_HOMEADDRESS) ^ prefhome;
1312		break;
1313	    }
1314#endif
1315	case IPV6_SADDR_RULE_OIF:
1316		/* Rule 5: Prefer outgoing interface */
1317		ret = (!dst->ifindex ||
1318		       dst->ifindex == score->ifa->idev->dev->ifindex);
1319		break;
1320	case IPV6_SADDR_RULE_LABEL:
1321		/* Rule 6: Prefer matching label */
1322		ret = ipv6_addr_label(net,
1323				      &score->ifa->addr, score->addr_type,
1324				      score->ifa->idev->dev->ifindex) == dst->label;
1325		break;
1326	case IPV6_SADDR_RULE_PRIVACY:
1327	    {
1328		/* Rule 7: Prefer public address
1329		 * Note: prefer temporary address if use_tempaddr >= 2
1330		 */
1331		int preftmp = dst->prefs & (IPV6_PREFER_SRC_PUBLIC|IPV6_PREFER_SRC_TMP) ?
1332				!!(dst->prefs & IPV6_PREFER_SRC_TMP) :
1333				score->ifa->idev->cnf.use_tempaddr >= 2;
1334		ret = (!(score->ifa->flags & IFA_F_TEMPORARY)) ^ preftmp;
1335		break;
1336	    }
1337	case IPV6_SADDR_RULE_ORCHID:
1338		/* Rule 8-: Prefer ORCHID vs ORCHID or
1339		 *	    non-ORCHID vs non-ORCHID
1340		 */
1341		ret = !(ipv6_addr_orchid(&score->ifa->addr) ^
1342			ipv6_addr_orchid(dst->addr));
1343		break;
1344	case IPV6_SADDR_RULE_PREFIX:
1345		/* Rule 8: Use longest matching prefix */
1346		ret = ipv6_addr_diff(&score->ifa->addr, dst->addr);
1347		if (ret > score->ifa->prefix_len)
1348			ret = score->ifa->prefix_len;
1349		score->matchlen = ret;
1350		break;
1351#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1352	case IPV6_SADDR_RULE_NOT_OPTIMISTIC:
1353		/* Optimistic addresses still have lower precedence than other
1354		 * preferred addresses.
1355		 */
1356		ret = !(score->ifa->flags & IFA_F_OPTIMISTIC);
1357		break;
1358#endif
1359	default:
1360		ret = 0;
1361	}
1362
1363	if (ret)
1364		__set_bit(i, score->scorebits);
1365	score->rule = i;
1366out:
1367	return ret;
1368}
1369
1370int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
1371		       const struct in6_addr *daddr, unsigned int prefs,
1372		       struct in6_addr *saddr)
1373{
1374	struct ipv6_saddr_score scores[2],
1375				*score = &scores[0], *hiscore = &scores[1];
1376	struct ipv6_saddr_dst dst;
1377	struct net_device *dev;
1378	int dst_type;
1379
1380	dst_type = __ipv6_addr_type(daddr);
1381	dst.addr = daddr;
1382	dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
1383	dst.scope = __ipv6_addr_src_scope(dst_type);
1384	dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);
1385	dst.prefs = prefs;
1386
1387	hiscore->rule = -1;
1388	hiscore->ifa = NULL;
1389
1390	rcu_read_lock();
1391
1392	for_each_netdev_rcu(net, dev) {
1393		struct inet6_dev *idev;
1394
1395		/* Candidate Source Address (section 4)
1396		 *  - multicast and link-local destination address,
1397		 *    the set of candidate source address MUST only
1398		 *    include addresses assigned to interfaces
1399		 *    belonging to the same link as the outgoing
1400		 *    interface.
1401		 * (- For site-local destination addresses, the
1402		 *    set of candidate source addresses MUST only
1403		 *    include addresses assigned to interfaces
1404		 *    belonging to the same site as the outgoing
1405		 *    interface.)
1406		 */
1407		if (((dst_type & IPV6_ADDR_MULTICAST) ||
1408		     dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL) &&
1409		    dst.ifindex && dev->ifindex != dst.ifindex)
1410			continue;
1411
1412		idev = __in6_dev_get(dev);
1413		if (!idev)
1414			continue;
1415
1416		read_lock_bh(&idev->lock);
1417		list_for_each_entry(score->ifa, &idev->addr_list, if_list) {
1418			int i;
1419
1420			/*
1421			 * - Tentative Address (RFC2462 section 5.4)
1422			 *  - A tentative address is not considered
1423			 *    "assigned to an interface" in the traditional
1424			 *    sense, unless it is also flagged as optimistic.
1425			 * - Candidate Source Address (section 4)
1426			 *  - In any case, anycast addresses, multicast
1427			 *    addresses, and the unspecified address MUST
1428			 *    NOT be included in a candidate set.
1429			 */
1430			if ((score->ifa->flags & IFA_F_TENTATIVE) &&
1431			    (!(score->ifa->flags & IFA_F_OPTIMISTIC)))
1432				continue;
1433
1434			score->addr_type = __ipv6_addr_type(&score->ifa->addr);
1435
1436			if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
1437				     score->addr_type & IPV6_ADDR_MULTICAST)) {
1438				net_dbg_ratelimited("ADDRCONF: unspecified / multicast address assigned as unicast address on %s",
1439						    dev->name);
1440				continue;
1441			}
1442
1443			score->rule = -1;
1444			bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
1445
1446			for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
1447				int minihiscore, miniscore;
1448
1449				minihiscore = ipv6_get_saddr_eval(net, hiscore, &dst, i);
1450				miniscore = ipv6_get_saddr_eval(net, score, &dst, i);
1451
1452				if (minihiscore > miniscore) {
1453					if (i == IPV6_SADDR_RULE_SCOPE &&
1454					    score->scopedist > 0) {
1455						/*
1456						 * special case:
1457						 * each remaining entry
1458						 * has too small (not enough)
1459						 * scope, because ifa entries
1460						 * are sorted by their scope
1461						 * values.
1462						 */
1463						goto try_nextdev;
1464					}
1465					break;
1466				} else if (minihiscore < miniscore) {
1467					if (hiscore->ifa)
1468						in6_ifa_put(hiscore->ifa);
1469
1470					in6_ifa_hold(score->ifa);
1471
1472					swap(hiscore, score);
1473
1474					/* restore our iterator */
1475					score->ifa = hiscore->ifa;
1476
1477					break;
1478				}
1479			}
1480		}
1481try_nextdev:
1482		read_unlock_bh(&idev->lock);
1483	}
1484	rcu_read_unlock();
1485
1486	if (!hiscore->ifa)
1487		return -EADDRNOTAVAIL;
1488
1489	*saddr = hiscore->ifa->addr;
1490	in6_ifa_put(hiscore->ifa);
1491	return 0;
1492}
1493EXPORT_SYMBOL(ipv6_dev_get_saddr);
1494
1495int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
1496		      u32 banned_flags)
1497{
1498	struct inet6_ifaddr *ifp;
1499	int err = -EADDRNOTAVAIL;
1500
1501	list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
1502		if (ifp->scope > IFA_LINK)
1503			break;
1504		if (ifp->scope == IFA_LINK &&
1505		    !(ifp->flags & banned_flags)) {
1506			*addr = ifp->addr;
1507			err = 0;
1508			break;
1509		}
1510	}
1511	return err;
1512}
1513
1514int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
1515		    u32 banned_flags)
1516{
1517	struct inet6_dev *idev;
1518	int err = -EADDRNOTAVAIL;
1519
1520	rcu_read_lock();
1521	idev = __in6_dev_get(dev);
1522	if (idev) {
1523		read_lock_bh(&idev->lock);
1524		err = __ipv6_get_lladdr(idev, addr, banned_flags);
1525		read_unlock_bh(&idev->lock);
1526	}
1527	rcu_read_unlock();
1528	return err;
1529}
1530
1531static int ipv6_count_addresses(struct inet6_dev *idev)
1532{
1533	int cnt = 0;
1534	struct inet6_ifaddr *ifp;
1535
1536	read_lock_bh(&idev->lock);
1537	list_for_each_entry(ifp, &idev->addr_list, if_list)
1538		cnt++;
1539	read_unlock_bh(&idev->lock);
1540	return cnt;
1541}
1542
1543int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
1544		  const struct net_device *dev, int strict)
1545{
1546	return ipv6_chk_addr_and_flags(net, addr, dev, strict, IFA_F_TENTATIVE);
1547}
1548EXPORT_SYMBOL(ipv6_chk_addr);
1549
1550int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
1551			    const struct net_device *dev, int strict,
1552			    u32 banned_flags)
1553{
1554	struct inet6_ifaddr *ifp;
1555	unsigned int hash = inet6_addr_hash(addr);
1556	u32 ifp_flags;
1557
1558	rcu_read_lock_bh();
1559	hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
1560		if (!net_eq(dev_net(ifp->idev->dev), net))
1561			continue;
1562		/* Decouple optimistic from tentative for evaluation here.
1563		 * Ban optimistic addresses explicitly, when required.
1564		 */
1565		ifp_flags = (ifp->flags&IFA_F_OPTIMISTIC)
1566			    ? (ifp->flags&~IFA_F_TENTATIVE)
1567			    : ifp->flags;
1568		if (ipv6_addr_equal(&ifp->addr, addr) &&
1569		    !(ifp_flags&banned_flags) &&
1570		    (!dev || ifp->idev->dev == dev ||
1571		     !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
1572			rcu_read_unlock_bh();
1573			return 1;
1574		}
1575	}
1576
1577	rcu_read_unlock_bh();
1578	return 0;
1579}
1580EXPORT_SYMBOL(ipv6_chk_addr_and_flags);
1581
1582static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
1583			       struct net_device *dev)
1584{
1585	unsigned int hash = inet6_addr_hash(addr);
1586	struct inet6_ifaddr *ifp;
1587
1588	hlist_for_each_entry(ifp, &inet6_addr_lst[hash], addr_lst) {
1589		if (!net_eq(dev_net(ifp->idev->dev), net))
1590			continue;
1591		if (ipv6_addr_equal(&ifp->addr, addr)) {
1592			if (!dev || ifp->idev->dev == dev)
1593				return true;
1594		}
1595	}
1596	return false;
1597}
1598
1599/* Compares an address/prefix_len with addresses on device @dev.
1600 * If one is found it returns true.
1601 */
1602bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
1603	const unsigned int prefix_len, struct net_device *dev)
1604{
1605	struct inet6_dev *idev;
1606	struct inet6_ifaddr *ifa;
1607	bool ret = false;
1608
1609	rcu_read_lock();
1610	idev = __in6_dev_get(dev);
1611	if (idev) {
1612		read_lock_bh(&idev->lock);
1613		list_for_each_entry(ifa, &idev->addr_list, if_list) {
1614			ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
1615			if (ret)
1616				break;
1617		}
1618		read_unlock_bh(&idev->lock);
1619	}
1620	rcu_read_unlock();
1621
1622	return ret;
1623}
1624EXPORT_SYMBOL(ipv6_chk_custom_prefix);
1625
1626int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
1627{
1628	struct inet6_dev *idev;
1629	struct inet6_ifaddr *ifa;
1630	int	onlink;
1631
1632	onlink = 0;
1633	rcu_read_lock();
1634	idev = __in6_dev_get(dev);
1635	if (idev) {
1636		read_lock_bh(&idev->lock);
1637		list_for_each_entry(ifa, &idev->addr_list, if_list) {
1638			onlink = ipv6_prefix_equal(addr, &ifa->addr,
1639						   ifa->prefix_len);
1640			if (onlink)
1641				break;
1642		}
1643		read_unlock_bh(&idev->lock);
1644	}
1645	rcu_read_unlock();
1646	return onlink;
1647}
1648EXPORT_SYMBOL(ipv6_chk_prefix);
1649
1650struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,
1651				     struct net_device *dev, int strict)
1652{
1653	struct inet6_ifaddr *ifp, *result = NULL;
1654	unsigned int hash = inet6_addr_hash(addr);
1655
1656	rcu_read_lock_bh();
1657	hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
1658		if (!net_eq(dev_net(ifp->idev->dev), net))
1659			continue;
1660		if (ipv6_addr_equal(&ifp->addr, addr)) {
1661			if (!dev || ifp->idev->dev == dev ||
1662			    !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {
1663				result = ifp;
1664				in6_ifa_hold(ifp);
1665				break;
1666			}
1667		}
1668	}
1669	rcu_read_unlock_bh();
1670
1671	return result;
1672}
1673
1674/* Gets referenced address, destroys ifaddr */
1675
1676static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
1677{
1678	if (ifp->flags&IFA_F_PERMANENT) {
1679		spin_lock_bh(&ifp->lock);
1680		addrconf_del_dad_work(ifp);
1681		ifp->flags |= IFA_F_TENTATIVE;
1682		if (dad_failed)
1683			ifp->flags |= IFA_F_DADFAILED;
1684		spin_unlock_bh(&ifp->lock);
1685		if (dad_failed)
1686			ipv6_ifa_notify(0, ifp);
1687		in6_ifa_put(ifp);
1688	} else if (ifp->flags&IFA_F_TEMPORARY) {
1689		struct inet6_ifaddr *ifpub;
1690		spin_lock_bh(&ifp->lock);
1691		ifpub = ifp->ifpub;
1692		if (ifpub) {
1693			in6_ifa_hold(ifpub);
1694			spin_unlock_bh(&ifp->lock);
1695			ipv6_create_tempaddr(ifpub, ifp);
1696			in6_ifa_put(ifpub);
1697		} else {
1698			spin_unlock_bh(&ifp->lock);
1699		}
1700		ipv6_del_addr(ifp);
1701	} else {
1702		ipv6_del_addr(ifp);
1703	}
1704}
1705
1706static int addrconf_dad_end(struct inet6_ifaddr *ifp)
1707{
1708	int err = -ENOENT;
1709
1710	spin_lock_bh(&ifp->lock);
1711	if (ifp->state == INET6_IFADDR_STATE_DAD) {
1712		ifp->state = INET6_IFADDR_STATE_POSTDAD;
1713		err = 0;
1714	}
1715	spin_unlock_bh(&ifp->lock);
1716
1717	return err;
1718}
1719
1720void addrconf_dad_failure(struct inet6_ifaddr *ifp)
1721{
1722	struct in6_addr addr;
1723	struct inet6_dev *idev = ifp->idev;
1724	struct net *net = dev_net(ifp->idev->dev);
1725
1726	if (addrconf_dad_end(ifp)) {
1727		in6_ifa_put(ifp);
1728		return;
1729	}
1730
1731	net_info_ratelimited("%s: IPv6 duplicate address %pI6c detected!\n",
1732			     ifp->idev->dev->name, &ifp->addr);
1733
1734	spin_lock_bh(&ifp->lock);
1735
1736	if (ifp->flags & IFA_F_STABLE_PRIVACY) {
1737		int scope = ifp->scope;
1738		u32 flags = ifp->flags;
1739		struct in6_addr new_addr;
1740		struct inet6_ifaddr *ifp2;
1741		u32 valid_lft, preferred_lft;
1742		int pfxlen = ifp->prefix_len;
1743		int retries = ifp->stable_privacy_retry + 1;
1744
1745		if (retries > net->ipv6.sysctl.idgen_retries) {
1746			net_info_ratelimited("%s: privacy stable address generation failed because of DAD conflicts!\n",
1747					     ifp->idev->dev->name);
1748			goto errdad;
1749		}
1750
1751		new_addr = ifp->addr;
1752		if (ipv6_generate_stable_address(&new_addr, retries,
1753						 idev))
1754			goto errdad;
1755
1756		valid_lft = ifp->valid_lft;
1757		preferred_lft = ifp->prefered_lft;
1758
1759		spin_unlock_bh(&ifp->lock);
1760
1761		if (idev->cnf.max_addresses &&
1762		    ipv6_count_addresses(idev) >=
1763		    idev->cnf.max_addresses)
1764			goto lock_errdad;
1765
1766		net_info_ratelimited("%s: generating new stable privacy address because of DAD conflict\n",
1767				     ifp->idev->dev->name);
1768
1769		ifp2 = ipv6_add_addr(idev, &new_addr, NULL, pfxlen,
1770				     scope, flags, valid_lft,
1771				     preferred_lft);
1772		if (IS_ERR(ifp2))
1773			goto lock_errdad;
1774
1775		spin_lock_bh(&ifp2->lock);
1776		ifp2->stable_privacy_retry = retries;
1777		ifp2->state = INET6_IFADDR_STATE_PREDAD;
1778		spin_unlock_bh(&ifp2->lock);
1779
1780		addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
1781		in6_ifa_put(ifp2);
1782lock_errdad:
1783		spin_lock_bh(&ifp->lock);
1784	} else if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
1785		addr.s6_addr32[0] = htonl(0xfe800000);
1786		addr.s6_addr32[1] = 0;
1787
1788		if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
1789		    ipv6_addr_equal(&ifp->addr, &addr)) {
1790			/* DAD failed for link-local based on MAC address */
1791			idev->cnf.disable_ipv6 = 1;
1792
1793			pr_info("%s: IPv6 being disabled!\n",
1794				ifp->idev->dev->name);
1795		}
1796	}
1797
1798errdad:
1799	/* transition from _POSTDAD to _ERRDAD */
1800	ifp->state = INET6_IFADDR_STATE_ERRDAD;
1801	spin_unlock_bh(&ifp->lock);
1802
1803	addrconf_mod_dad_work(ifp, 0);
1804}
1805
1806/* Join to solicited addr multicast group.
1807 * caller must hold RTNL */
1808void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
1809{
1810	struct in6_addr maddr;
1811
1812	if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
1813		return;
1814
1815	addrconf_addr_solict_mult(addr, &maddr);
1816	ipv6_dev_mc_inc(dev, &maddr);
1817}
1818
1819/* caller must hold RTNL */
1820void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
1821{
1822	struct in6_addr maddr;
1823
1824	if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
1825		return;
1826
1827	addrconf_addr_solict_mult(addr, &maddr);
1828	__ipv6_dev_mc_dec(idev, &maddr);
1829}
1830
1831/* caller must hold RTNL */
1832static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
1833{
1834	struct in6_addr addr;
1835
1836	if (ifp->prefix_len >= 127) /* RFC 6164 */
1837		return;
1838	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
1839	if (ipv6_addr_any(&addr))
1840		return;
1841	__ipv6_dev_ac_inc(ifp->idev, &addr);
1842}
1843
1844/* caller must hold RTNL */
1845static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
1846{
1847	struct in6_addr addr;
1848
1849	if (ifp->prefix_len >= 127) /* RFC 6164 */
1850		return;
1851	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
1852	if (ipv6_addr_any(&addr))
1853		return;
1854	__ipv6_dev_ac_dec(ifp->idev, &addr);
1855}
1856
1857static int addrconf_ifid_eui48(u8 *eui, struct net_device *dev)
1858{
1859	if (dev->addr_len != ETH_ALEN)
1860		return -1;
1861	memcpy(eui, dev->dev_addr, 3);
1862	memcpy(eui + 5, dev->dev_addr + 3, 3);
1863
1864	/*
1865	 * The zSeries OSA network cards can be shared among various
1866	 * OS instances, but the OSA cards have only one MAC address.
1867	 * This leads to duplicate address conflicts in conjunction
1868	 * with IPv6 if more than one instance uses the same card.
1869	 *
1870	 * The driver for these cards can deliver a unique 16-bit
1871	 * identifier for each instance sharing the same card.  It is
1872	 * placed instead of 0xFFFE in the interface identifier.  The
1873	 * "u" bit of the interface identifier is not inverted in this
1874	 * case.  Hence the resulting interface identifier has local
1875	 * scope according to RFC2373.
1876	 */
1877	if (dev->dev_id) {
1878		eui[3] = (dev->dev_id >> 8) & 0xFF;
1879		eui[4] = dev->dev_id & 0xFF;
1880	} else {
1881		eui[3] = 0xFF;
1882		eui[4] = 0xFE;
1883		eui[0] ^= 2;
1884	}
1885	return 0;
1886}
1887
1888static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
1889{
1890	if (dev->addr_len != IEEE802154_ADDR_LEN)
1891		return -1;
1892	memcpy(eui, dev->dev_addr, 8);
1893	eui[0] ^= 2;
1894	return 0;
1895}
1896
1897static int addrconf_ifid_ieee1394(u8 *eui, struct net_device *dev)
1898{
1899	union fwnet_hwaddr *ha;
1900
1901	if (dev->addr_len != FWNET_ALEN)
1902		return -1;
1903
1904	ha = (union fwnet_hwaddr *)dev->dev_addr;
1905
1906	memcpy(eui, &ha->uc.uniq_id, sizeof(ha->uc.uniq_id));
1907	eui[0] ^= 2;
1908	return 0;
1909}
1910
1911static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
1912{
1913	/* XXX: inherit EUI-64 from other interface -- yoshfuji */
1914	if (dev->addr_len != ARCNET_ALEN)
1915		return -1;
1916	memset(eui, 0, 7);
1917	eui[7] = *(u8 *)dev->dev_addr;
1918	return 0;
1919}
1920
1921static int addrconf_ifid_infiniband(u8 *eui, struct net_device *dev)
1922{
1923	if (dev->addr_len != INFINIBAND_ALEN)
1924		return -1;
1925	memcpy(eui, dev->dev_addr + 12, 8);
1926	eui[0] |= 2;
1927	return 0;
1928}
1929
1930static int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
1931{
1932	if (addr == 0)
1933		return -1;
1934	eui[0] = (ipv4_is_zeronet(addr) || ipv4_is_private_10(addr) ||
1935		  ipv4_is_loopback(addr) || ipv4_is_linklocal_169(addr) ||
1936		  ipv4_is_private_172(addr) || ipv4_is_test_192(addr) ||
1937		  ipv4_is_anycast_6to4(addr) || ipv4_is_private_192(addr) ||
1938		  ipv4_is_test_198(addr) || ipv4_is_multicast(addr) ||
1939		  ipv4_is_lbcast(addr)) ? 0x00 : 0x02;
1940	eui[1] = 0;
1941	eui[2] = 0x5E;
1942	eui[3] = 0xFE;
1943	memcpy(eui + 4, &addr, 4);
1944	return 0;
1945}
1946
1947static int addrconf_ifid_sit(u8 *eui, struct net_device *dev)
1948{
1949	if (dev->priv_flags & IFF_ISATAP)
1950		return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
1951	return -1;
1952}
1953
1954static int addrconf_ifid_gre(u8 *eui, struct net_device *dev)
1955{
1956	return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
1957}
1958
1959static int addrconf_ifid_ip6tnl(u8 *eui, struct net_device *dev)
1960{
1961	memcpy(eui, dev->perm_addr, 3);
1962	memcpy(eui + 5, dev->perm_addr + 3, 3);
1963	eui[3] = 0xFF;
1964	eui[4] = 0xFE;
1965	eui[0] ^= 2;
1966	return 0;
1967}
1968
1969static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
1970{
1971	switch (dev->type) {
1972	case ARPHRD_ETHER:
1973	case ARPHRD_FDDI:
1974		return addrconf_ifid_eui48(eui, dev);
1975	case ARPHRD_ARCNET:
1976		return addrconf_ifid_arcnet(eui, dev);
1977	case ARPHRD_INFINIBAND:
1978		return addrconf_ifid_infiniband(eui, dev);
1979	case ARPHRD_SIT:
1980		return addrconf_ifid_sit(eui, dev);
1981	case ARPHRD_IPGRE:
1982		return addrconf_ifid_gre(eui, dev);
1983	case ARPHRD_6LOWPAN:
1984	case ARPHRD_IEEE802154:
1985		return addrconf_ifid_eui64(eui, dev);
1986	case ARPHRD_IEEE1394:
1987		return addrconf_ifid_ieee1394(eui, dev);
1988	case ARPHRD_TUNNEL6:
1989		return addrconf_ifid_ip6tnl(eui, dev);
1990	}
1991	return -1;
1992}
1993
1994static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
1995{
1996	int err = -1;
1997	struct inet6_ifaddr *ifp;
1998
1999	read_lock_bh(&idev->lock);
2000	list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
2001		if (ifp->scope > IFA_LINK)
2002			break;
2003		if (ifp->scope == IFA_LINK && !(ifp->flags&IFA_F_TENTATIVE)) {
2004			memcpy(eui, ifp->addr.s6_addr+8, 8);
2005			err = 0;
2006			break;
2007		}
2008	}
2009	read_unlock_bh(&idev->lock);
2010	return err;
2011}
2012
2013/* (re)generation of randomized interface identifier (RFC 3041 3.2, 3.5) */
2014static void __ipv6_regen_rndid(struct inet6_dev *idev)
2015{
2016regen:
2017	get_random_bytes(idev->rndid, sizeof(idev->rndid));
2018	idev->rndid[0] &= ~0x02;
2019
2020	/*
2021	 * <draft-ietf-ipngwg-temp-addresses-v2-00.txt>:
2022	 * check if generated address is not inappropriate
2023	 *
2024	 *  - Reserved subnet anycast (RFC 2526)
2025	 *	11111101 11....11 1xxxxxxx
2026	 *  - ISATAP (RFC4214) 6.1
2027	 *	00-00-5E-FE-xx-xx-xx-xx
2028	 *  - value 0
2029	 *  - XXX: already assigned to an address on the device
2030	 */
2031	if (idev->rndid[0] == 0xfd &&
2032	    (idev->rndid[1]&idev->rndid[2]&idev->rndid[3]&idev->rndid[4]&idev->rndid[5]&idev->rndid[6]) == 0xff &&
2033	    (idev->rndid[7]&0x80))
2034		goto regen;
2035	if ((idev->rndid[0]|idev->rndid[1]) == 0) {
2036		if (idev->rndid[2] == 0x5e && idev->rndid[3] == 0xfe)
2037			goto regen;
2038		if ((idev->rndid[2]|idev->rndid[3]|idev->rndid[4]|idev->rndid[5]|idev->rndid[6]|idev->rndid[7]) == 0x00)
2039			goto regen;
2040	}
2041}
2042
2043static void ipv6_regen_rndid(unsigned long data)
2044{
2045	struct inet6_dev *idev = (struct inet6_dev *) data;
2046	unsigned long expires;
2047
2048	rcu_read_lock_bh();
2049	write_lock_bh(&idev->lock);
2050
2051	if (idev->dead)
2052		goto out;
2053
2054	__ipv6_regen_rndid(idev);
2055
2056	expires = jiffies +
2057		idev->cnf.temp_prefered_lft * HZ -
2058		idev->cnf.regen_max_retry * idev->cnf.dad_transmits *
2059		NEIGH_VAR(idev->nd_parms, RETRANS_TIME) -
2060		idev->cnf.max_desync_factor * HZ;
2061	if (time_before(expires, jiffies)) {
2062		pr_warn("%s: too short regeneration interval; timer disabled for %s\n",
2063			__func__, idev->dev->name);
2064		goto out;
2065	}
2066
2067	if (!mod_timer(&idev->regen_timer, expires))
2068		in6_dev_hold(idev);
2069
2070out:
2071	write_unlock_bh(&idev->lock);
2072	rcu_read_unlock_bh();
2073	in6_dev_put(idev);
2074}
2075
2076static void  __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr)
2077{
2078	if (tmpaddr && memcmp(idev->rndid, &tmpaddr->s6_addr[8], 8) == 0)
2079		__ipv6_regen_rndid(idev);
2080}
2081
2082/*
2083 *	Add prefix route.
2084 */
2085
2086static void
2087addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
2088		      unsigned long expires, u32 flags)
2089{
2090	struct fib6_config cfg = {
2091		.fc_table = RT6_TABLE_PREFIX,
2092		.fc_metric = IP6_RT_PRIO_ADDRCONF,
2093		.fc_ifindex = dev->ifindex,
2094		.fc_expires = expires,
2095		.fc_dst_len = plen,
2096		.fc_flags = RTF_UP | flags,
2097		.fc_nlinfo.nl_net = dev_net(dev),
2098		.fc_protocol = RTPROT_KERNEL,
2099	};
2100
2101	cfg.fc_dst = *pfx;
2102
2103	/* Prevent useless cloning on PtP SIT.
2104	   This thing is done here expecting that the whole
2105	   class of non-broadcast devices need not cloning.
2106	 */
2107#if IS_ENABLED(CONFIG_IPV6_SIT)
2108	if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
2109		cfg.fc_flags |= RTF_NONEXTHOP;
2110#endif
2111
2112	ip6_route_add(&cfg);
2113}
2114
2115
2116static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
2117						  int plen,
2118						  const struct net_device *dev,
2119						  u32 flags, u32 noflags)
2120{
2121	struct fib6_node *fn;
2122	struct rt6_info *rt = NULL;
2123	struct fib6_table *table;
2124
2125	table = fib6_get_table(dev_net(dev), RT6_TABLE_PREFIX);
2126	if (!table)
2127		return NULL;
2128
2129	read_lock_bh(&table->tb6_lock);
2130	fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0);
2131	if (!fn)
2132		goto out;
2133	for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
2134		if (rt->dst.dev->ifindex != dev->ifindex)
2135			continue;
2136		if ((rt->rt6i_flags & flags) != flags)
2137			continue;
2138		if ((rt->rt6i_flags & noflags) != 0)
2139			continue;
2140		dst_hold(&rt->dst);
2141		break;
2142	}
2143out:
2144	read_unlock_bh(&table->tb6_lock);
2145	return rt;
2146}
2147
2148
2149/* Create "default" multicast route to the interface */
2150
2151static void addrconf_add_mroute(struct net_device *dev)
2152{
2153	struct fib6_config cfg = {
2154		.fc_table = RT6_TABLE_LOCAL,
2155		.fc_metric = IP6_RT_PRIO_ADDRCONF,
2156		.fc_ifindex = dev->ifindex,
2157		.fc_dst_len = 8,
2158		.fc_flags = RTF_UP,
2159		.fc_nlinfo.nl_net = dev_net(dev),
2160	};
2161
2162	ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
2163
2164	ip6_route_add(&cfg);
2165}
2166
2167static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
2168{
2169	struct inet6_dev *idev;
2170
2171	ASSERT_RTNL();
2172
2173	idev = ipv6_find_idev(dev);
2174	if (!idev)
2175		return ERR_PTR(-ENOBUFS);
2176
2177	if (idev->cnf.disable_ipv6)
2178		return ERR_PTR(-EACCES);
2179
2180	/* Add default multicast route */
2181	if (!(dev->flags & IFF_LOOPBACK))
2182		addrconf_add_mroute(dev);
2183
2184	return idev;
2185}
2186
2187static void manage_tempaddrs(struct inet6_dev *idev,
2188			     struct inet6_ifaddr *ifp,
2189			     __u32 valid_lft, __u32 prefered_lft,
2190			     bool create, unsigned long now)
2191{
2192	u32 flags;
2193	struct inet6_ifaddr *ift;
2194
2195	read_lock_bh(&idev->lock);
2196	/* update all temporary addresses in the list */
2197	list_for_each_entry(ift, &idev->tempaddr_list, tmp_list) {
2198		int age, max_valid, max_prefered;
2199
2200		if (ifp != ift->ifpub)
2201			continue;
2202
2203		/* RFC 4941 section 3.3:
2204		 * If a received option will extend the lifetime of a public
2205		 * address, the lifetimes of temporary addresses should
2206		 * be extended, subject to the overall constraint that no
2207		 * temporary addresses should ever remain "valid" or "preferred"
2208		 * for a time longer than (TEMP_VALID_LIFETIME) or
2209		 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR), respectively.
2210		 */
2211		age = (now - ift->cstamp) / HZ;
2212		max_valid = idev->cnf.temp_valid_lft - age;
2213		if (max_valid < 0)
2214			max_valid = 0;
2215
2216		max_prefered = idev->cnf.temp_prefered_lft -
2217			       idev->cnf.max_desync_factor - age;
2218		if (max_prefered < 0)
2219			max_prefered = 0;
2220
2221		if (valid_lft > max_valid)
2222			valid_lft = max_valid;
2223
2224		if (prefered_lft > max_prefered)
2225			prefered_lft = max_prefered;
2226
2227		spin_lock(&ift->lock);
2228		flags = ift->flags;
2229		ift->valid_lft = valid_lft;
2230		ift->prefered_lft = prefered_lft;
2231		ift->tstamp = now;
2232		if (prefered_lft > 0)
2233			ift->flags &= ~IFA_F_DEPRECATED;
2234
2235		spin_unlock(&ift->lock);
2236		if (!(flags&IFA_F_TENTATIVE))
2237			ipv6_ifa_notify(0, ift);
2238	}
2239
2240	if ((create || list_empty(&idev->tempaddr_list)) &&
2241	    idev->cnf.use_tempaddr > 0) {
2242		/* When a new public address is created as described
2243		 * in [ADDRCONF], also create a new temporary address.
2244		 * Also create a temporary address if it's enabled but
2245		 * no temporary address currently exists.
2246		 */
2247		read_unlock_bh(&idev->lock);
2248		ipv6_create_tempaddr(ifp, NULL);
2249	} else {
2250		read_unlock_bh(&idev->lock);
2251	}
2252}
2253
2254void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
2255{
2256	struct prefix_info *pinfo;
2257	__u32 valid_lft;
2258	__u32 prefered_lft;
2259	int addr_type;
2260	u32 addr_flags = 0;
2261	struct inet6_dev *in6_dev;
2262	struct net *net = dev_net(dev);
2263
2264	pinfo = (struct prefix_info *) opt;
2265
2266	if (len < sizeof(struct prefix_info)) {
2267		ADBG("addrconf: prefix option too short\n");
2268		return;
2269	}
2270
2271	/*
2272	 *	Validation checks ([ADDRCONF], page 19)
2273	 */
2274
2275	addr_type = ipv6_addr_type(&pinfo->prefix);
2276
2277	if (addr_type & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL))
2278		return;
2279
2280	valid_lft = ntohl(pinfo->valid);
2281	prefered_lft = ntohl(pinfo->prefered);
2282
2283	if (prefered_lft > valid_lft) {
2284		net_warn_ratelimited("addrconf: prefix option has invalid lifetime\n");
2285		return;
2286	}
2287
2288	in6_dev = in6_dev_get(dev);
2289
2290	if (!in6_dev) {
2291		net_dbg_ratelimited("addrconf: device %s not configured\n",
2292				    dev->name);
2293		return;
2294	}
2295
2296	/*
2297	 *	Two things going on here:
2298	 *	1) Add routes for on-link prefixes
2299	 *	2) Configure prefixes with the auto flag set
2300	 */
2301
2302	if (pinfo->onlink) {
2303		struct rt6_info *rt;
2304		unsigned long rt_expires;
2305
2306		/* Avoid arithmetic overflow. Really, we could
2307		 * save rt_expires in seconds, likely valid_lft,
2308		 * but it would require division in fib gc, that it
2309		 * not good.
2310		 */
2311		if (HZ > USER_HZ)
2312			rt_expires = addrconf_timeout_fixup(valid_lft, HZ);
2313		else
2314			rt_expires = addrconf_timeout_fixup(valid_lft, USER_HZ);
2315
2316		if (addrconf_finite_timeout(rt_expires))
2317			rt_expires *= HZ;
2318
2319		rt = addrconf_get_prefix_route(&pinfo->prefix,
2320					       pinfo->prefix_len,
2321					       dev,
2322					       RTF_ADDRCONF | RTF_PREFIX_RT,
2323					       RTF_GATEWAY | RTF_DEFAULT);
2324
2325		if (rt) {
2326			/* Autoconf prefix route */
2327			if (valid_lft == 0) {
2328				ip6_del_rt(rt);
2329				rt = NULL;
2330			} else if (addrconf_finite_timeout(rt_expires)) {
2331				/* not infinity */
2332				rt6_set_expires(rt, jiffies + rt_expires);
2333			} else {
2334				rt6_clean_expires(rt);
2335			}
2336		} else if (valid_lft) {
2337			clock_t expires = 0;
2338			int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
2339			if (addrconf_finite_timeout(rt_expires)) {
2340				/* not infinity */
2341				flags |= RTF_EXPIRES;
2342				expires = jiffies_to_clock_t(rt_expires);
2343			}
2344			addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
2345					      dev, expires, flags);
2346		}
2347		ip6_rt_put(rt);
2348	}
2349
2350	/* Try to figure out our local address for this prefix */
2351
2352	if (pinfo->autoconf && in6_dev->cnf.autoconf) {
2353		struct inet6_ifaddr *ifp;
2354		struct in6_addr addr;
2355		int create = 0, update_lft = 0;
2356		bool tokenized = false;
2357
2358		if (pinfo->prefix_len == 64) {
2359			memcpy(&addr, &pinfo->prefix, 8);
2360
2361			if (!ipv6_addr_any(&in6_dev->token)) {
2362				read_lock_bh(&in6_dev->lock);
2363				memcpy(addr.s6_addr + 8,
2364				       in6_dev->token.s6_addr + 8, 8);
2365				read_unlock_bh(&in6_dev->lock);
2366				tokenized = true;
2367			} else if (in6_dev->addr_gen_mode ==
2368				   IN6_ADDR_GEN_MODE_STABLE_PRIVACY &&
2369				   !ipv6_generate_stable_address(&addr, 0,
2370								 in6_dev)) {
2371				addr_flags |= IFA_F_STABLE_PRIVACY;
2372				goto ok;
2373			} else if (ipv6_generate_eui64(addr.s6_addr + 8, dev) &&
2374				   ipv6_inherit_eui64(addr.s6_addr + 8, in6_dev)) {
2375				in6_dev_put(in6_dev);
2376				return;
2377			}
2378			goto ok;
2379		}
2380		net_dbg_ratelimited("IPv6 addrconf: prefix with wrong length %d\n",
2381				    pinfo->prefix_len);
2382		in6_dev_put(in6_dev);
2383		return;
2384
2385ok:
2386
2387		ifp = ipv6_get_ifaddr(net, &addr, dev, 1);
2388
2389		if (!ifp && valid_lft) {
2390			int max_addresses = in6_dev->cnf.max_addresses;
2391
2392#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
2393			if (in6_dev->cnf.optimistic_dad &&
2394			    !net->ipv6.devconf_all->forwarding && sllao)
2395				addr_flags |= IFA_F_OPTIMISTIC;
2396#endif
2397
2398			/* Do not allow to create too much of autoconfigured
2399			 * addresses; this would be too easy way to crash kernel.
2400			 */
2401			if (!max_addresses ||
2402			    ipv6_count_addresses(in6_dev) < max_addresses)
2403				ifp = ipv6_add_addr(in6_dev, &addr, NULL,
2404						    pinfo->prefix_len,
2405						    addr_type&IPV6_ADDR_SCOPE_MASK,
2406						    addr_flags, valid_lft,
2407						    prefered_lft);
2408
2409			if (IS_ERR_OR_NULL(ifp)) {
2410				in6_dev_put(in6_dev);
2411				return;
2412			}
2413
2414			update_lft = 0;
2415			create = 1;
2416			spin_lock_bh(&ifp->lock);
2417			ifp->flags |= IFA_F_MANAGETEMPADDR;
2418			ifp->cstamp = jiffies;
2419			ifp->tokenized = tokenized;
2420			spin_unlock_bh(&ifp->lock);
2421			addrconf_dad_start(ifp);
2422		}
2423
2424		if (ifp) {
2425			u32 flags;
2426			unsigned long now;
2427			u32 stored_lft;
2428
2429			/* update lifetime (RFC2462 5.5.3 e) */
2430			spin_lock_bh(&ifp->lock);
2431			now = jiffies;
2432			if (ifp->valid_lft > (now - ifp->tstamp) / HZ)
2433				stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
2434			else
2435				stored_lft = 0;
2436			if (!update_lft && !create && stored_lft) {
2437				const u32 minimum_lft = min_t(u32,
2438					stored_lft, MIN_VALID_LIFETIME);
2439				valid_lft = max(valid_lft, minimum_lft);
2440
2441				/* RFC4862 Section 5.5.3e:
2442				 * "Note that the preferred lifetime of the
2443				 *  corresponding address is always reset to
2444				 *  the Preferred Lifetime in the received
2445				 *  Prefix Information option, regardless of
2446				 *  whether the valid lifetime is also reset or
2447				 *  ignored."
2448				 *
2449				 * So we should always update prefered_lft here.
2450				 */
2451				update_lft = 1;
2452			}
2453
2454			if (update_lft) {
2455				ifp->valid_lft = valid_lft;
2456				ifp->prefered_lft = prefered_lft;
2457				ifp->tstamp = now;
2458				flags = ifp->flags;
2459				ifp->flags &= ~IFA_F_DEPRECATED;
2460				spin_unlock_bh(&ifp->lock);
2461
2462				if (!(flags&IFA_F_TENTATIVE))
2463					ipv6_ifa_notify(0, ifp);
2464			} else
2465				spin_unlock_bh(&ifp->lock);
2466
2467			manage_tempaddrs(in6_dev, ifp, valid_lft, prefered_lft,
2468					 create, now);
2469
2470			in6_ifa_put(ifp);
2471			addrconf_verify();
2472		}
2473	}
2474	inet6_prefix_notify(RTM_NEWPREFIX, in6_dev, pinfo);
2475	in6_dev_put(in6_dev);
2476}
2477
2478/*
2479 *	Set destination address.
2480 *	Special case for SIT interfaces where we create a new "virtual"
2481 *	device.
2482 */
2483int addrconf_set_dstaddr(struct net *net, void __user *arg)
2484{
2485	struct in6_ifreq ireq;
2486	struct net_device *dev;
2487	int err = -EINVAL;
2488
2489	rtnl_lock();
2490
2491	err = -EFAULT;
2492	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2493		goto err_exit;
2494
2495	dev = __dev_get_by_index(net, ireq.ifr6_ifindex);
2496
2497	err = -ENODEV;
2498	if (!dev)
2499		goto err_exit;
2500
2501#if IS_ENABLED(CONFIG_IPV6_SIT)
2502	if (dev->type == ARPHRD_SIT) {
2503		const struct net_device_ops *ops = dev->netdev_ops;
2504		struct ifreq ifr;
2505		struct ip_tunnel_parm p;
2506
2507		err = -EADDRNOTAVAIL;
2508		if (!(ipv6_addr_type(&ireq.ifr6_addr) & IPV6_ADDR_COMPATv4))
2509			goto err_exit;
2510
2511		memset(&p, 0, sizeof(p));
2512		p.iph.daddr = ireq.ifr6_addr.s6_addr32[3];
2513		p.iph.saddr = 0;
2514		p.iph.version = 4;
2515		p.iph.ihl = 5;
2516		p.iph.protocol = IPPROTO_IPV6;
2517		p.iph.ttl = 64;
2518		ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
2519
2520		if (ops->ndo_do_ioctl) {
2521			mm_segment_t oldfs = get_fs();
2522
2523			set_fs(KERNEL_DS);
2524			err = ops->ndo_do_ioctl(dev, &ifr, SIOCADDTUNNEL);
2525			set_fs(oldfs);
2526		} else
2527			err = -EOPNOTSUPP;
2528
2529		if (err == 0) {
2530			err = -ENOBUFS;
2531			dev = __dev_get_by_name(net, p.name);
2532			if (!dev)
2533				goto err_exit;
2534			err = dev_open(dev);
2535		}
2536	}
2537#endif
2538
2539err_exit:
2540	rtnl_unlock();
2541	return err;
2542}
2543
2544static int ipv6_mc_config(struct sock *sk, bool join,
2545			  const struct in6_addr *addr, int ifindex)
2546{
2547	int ret;
2548
2549	ASSERT_RTNL();
2550
2551	lock_sock(sk);
2552	if (join)
2553		ret = ipv6_sock_mc_join(sk, ifindex, addr);
2554	else
2555		ret = ipv6_sock_mc_drop(sk, ifindex, addr);
2556	release_sock(sk);
2557
2558	return ret;
2559}
2560
2561/*
2562 *	Manual configuration of address on an interface
2563 */
2564static int inet6_addr_add(struct net *net, int ifindex,
2565			  const struct in6_addr *pfx,
2566			  const struct in6_addr *peer_pfx,
2567			  unsigned int plen, __u32 ifa_flags,
2568			  __u32 prefered_lft, __u32 valid_lft)
2569{
2570	struct inet6_ifaddr *ifp;
2571	struct inet6_dev *idev;
2572	struct net_device *dev;
2573	unsigned long timeout;
2574	clock_t expires;
2575	int scope;
2576	u32 flags;
2577
2578	ASSERT_RTNL();
2579
2580	if (plen > 128)
2581		return -EINVAL;
2582
2583	/* check the lifetime */
2584	if (!valid_lft || prefered_lft > valid_lft)
2585		return -EINVAL;
2586
2587	if (ifa_flags & IFA_F_MANAGETEMPADDR && plen != 64)
2588		return -EINVAL;
2589
2590	dev = __dev_get_by_index(net, ifindex);
2591	if (!dev)
2592		return -ENODEV;
2593
2594	idev = addrconf_add_dev(dev);
2595	if (IS_ERR(idev))
2596		return PTR_ERR(idev);
2597
2598	if (ifa_flags & IFA_F_MCAUTOJOIN) {
2599		int ret = ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2600					 true, pfx, ifindex);
2601
2602		if (ret < 0)
2603			return ret;
2604	}
2605
2606	scope = ipv6_addr_scope(pfx);
2607
2608	timeout = addrconf_timeout_fixup(valid_lft, HZ);
2609	if (addrconf_finite_timeout(timeout)) {
2610		expires = jiffies_to_clock_t(timeout * HZ);
2611		valid_lft = timeout;
2612		flags = RTF_EXPIRES;
2613	} else {
2614		expires = 0;
2615		flags = 0;
2616		ifa_flags |= IFA_F_PERMANENT;
2617	}
2618
2619	timeout = addrconf_timeout_fixup(prefered_lft, HZ);
2620	if (addrconf_finite_timeout(timeout)) {
2621		if (timeout == 0)
2622			ifa_flags |= IFA_F_DEPRECATED;
2623		prefered_lft = timeout;
2624	}
2625
2626	ifp = ipv6_add_addr(idev, pfx, peer_pfx, plen, scope, ifa_flags,
2627			    valid_lft, prefered_lft);
2628
2629	if (!IS_ERR(ifp)) {
2630		if (!(ifa_flags & IFA_F_NOPREFIXROUTE)) {
2631			addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
2632					      expires, flags);
2633		}
2634
2635		/*
2636		 * Note that section 3.1 of RFC 4429 indicates
2637		 * that the Optimistic flag should not be set for
2638		 * manually configured addresses
2639		 */
2640		addrconf_dad_start(ifp);
2641		if (ifa_flags & IFA_F_MANAGETEMPADDR)
2642			manage_tempaddrs(idev, ifp, valid_lft, prefered_lft,
2643					 true, jiffies);
2644		in6_ifa_put(ifp);
2645		addrconf_verify_rtnl();
2646		return 0;
2647	} else if (ifa_flags & IFA_F_MCAUTOJOIN) {
2648		ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2649			       false, pfx, ifindex);
2650	}
2651
2652	return PTR_ERR(ifp);
2653}
2654
2655static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,
2656			  const struct in6_addr *pfx, unsigned int plen)
2657{
2658	struct inet6_ifaddr *ifp;
2659	struct inet6_dev *idev;
2660	struct net_device *dev;
2661
2662	if (plen > 128)
2663		return -EINVAL;
2664
2665	dev = __dev_get_by_index(net, ifindex);
2666	if (!dev)
2667		return -ENODEV;
2668
2669	idev = __in6_dev_get(dev);
2670	if (!idev)
2671		return -ENXIO;
2672
2673	read_lock_bh(&idev->lock);
2674	list_for_each_entry(ifp, &idev->addr_list, if_list) {
2675		if (ifp->prefix_len == plen &&
2676		    ipv6_addr_equal(pfx, &ifp->addr)) {
2677			in6_ifa_hold(ifp);
2678			read_unlock_bh(&idev->lock);
2679
2680			if (!(ifp->flags & IFA_F_TEMPORARY) &&
2681			    (ifa_flags & IFA_F_MANAGETEMPADDR))
2682				manage_tempaddrs(idev, ifp, 0, 0, false,
2683						 jiffies);
2684			ipv6_del_addr(ifp);
2685			addrconf_verify_rtnl();
2686			if (ipv6_addr_is_multicast(pfx)) {
2687				ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2688					       false, pfx, dev->ifindex);
2689			}
2690			return 0;
2691		}
2692	}
2693	read_unlock_bh(&idev->lock);
2694	return -EADDRNOTAVAIL;
2695}
2696
2697
2698int addrconf_add_ifaddr(struct net *net, void __user *arg)
2699{
2700	struct in6_ifreq ireq;
2701	int err;
2702
2703	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2704		return -EPERM;
2705
2706	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2707		return -EFAULT;
2708
2709	rtnl_lock();
2710	err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr, NULL,
2711			     ireq.ifr6_prefixlen, IFA_F_PERMANENT,
2712			     INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
2713	rtnl_unlock();
2714	return err;
2715}
2716
2717int addrconf_del_ifaddr(struct net *net, void __user *arg)
2718{
2719	struct in6_ifreq ireq;
2720	int err;
2721
2722	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2723		return -EPERM;
2724
2725	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2726		return -EFAULT;
2727
2728	rtnl_lock();
2729	err = inet6_addr_del(net, ireq.ifr6_ifindex, 0, &ireq.ifr6_addr,
2730			     ireq.ifr6_prefixlen);
2731	rtnl_unlock();
2732	return err;
2733}
2734
2735static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
2736		     int plen, int scope)
2737{
2738	struct inet6_ifaddr *ifp;
2739
2740	ifp = ipv6_add_addr(idev, addr, NULL, plen,
2741			    scope, IFA_F_PERMANENT,
2742			    INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
2743	if (!IS_ERR(ifp)) {
2744		spin_lock_bh(&ifp->lock);
2745		ifp->flags &= ~IFA_F_TENTATIVE;
2746		spin_unlock_bh(&ifp->lock);
2747		ipv6_ifa_notify(RTM_NEWADDR, ifp);
2748		in6_ifa_put(ifp);
2749	}
2750}
2751
2752#if IS_ENABLED(CONFIG_IPV6_SIT)
2753static void sit_add_v4_addrs(struct inet6_dev *idev)
2754{
2755	struct in6_addr addr;
2756	struct net_device *dev;
2757	struct net *net = dev_net(idev->dev);
2758	int scope, plen;
2759	u32 pflags = 0;
2760
2761	ASSERT_RTNL();
2762
2763	memset(&addr, 0, sizeof(struct in6_addr));
2764	memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4);
2765
2766	if (idev->dev->flags&IFF_POINTOPOINT) {
2767		addr.s6_addr32[0] = htonl(0xfe800000);
2768		scope = IFA_LINK;
2769		plen = 64;
2770	} else {
2771		scope = IPV6_ADDR_COMPATv4;
2772		plen = 96;
2773		pflags |= RTF_NONEXTHOP;
2774	}
2775
2776	if (addr.s6_addr32[3]) {
2777		add_addr(idev, &addr, plen, scope);
2778		addrconf_prefix_route(&addr, plen, idev->dev, 0, pflags);
2779		return;
2780	}
2781
2782	for_each_netdev(net, dev) {
2783		struct in_device *in_dev = __in_dev_get_rtnl(dev);
2784		if (in_dev && (dev->flags & IFF_UP)) {
2785			struct in_ifaddr *ifa;
2786
2787			int flag = scope;
2788
2789			for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
2790
2791				addr.s6_addr32[3] = ifa->ifa_local;
2792
2793				if (ifa->ifa_scope == RT_SCOPE_LINK)
2794					continue;
2795				if (ifa->ifa_scope >= RT_SCOPE_HOST) {
2796					if (idev->dev->flags&IFF_POINTOPOINT)
2797						continue;
2798					flag |= IFA_HOST;
2799				}
2800
2801				add_addr(idev, &addr, plen, flag);
2802				addrconf_prefix_route(&addr, plen, idev->dev, 0,
2803						      pflags);
2804			}
2805		}
2806	}
2807}
2808#endif
2809
2810static void init_loopback(struct net_device *dev)
2811{
2812	struct inet6_dev  *idev;
2813	struct net_device *sp_dev;
2814	struct inet6_ifaddr *sp_ifa;
2815	struct rt6_info *sp_rt;
2816
2817	/* ::1 */
2818
2819	ASSERT_RTNL();
2820
2821	idev = ipv6_find_idev(dev);
2822	if (!idev) {
2823		pr_debug("%s: add_dev failed\n", __func__);
2824		return;
2825	}
2826
2827	add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
2828
2829	/* Add routes to other interface's IPv6 addresses */
2830	for_each_netdev(dev_net(dev), sp_dev) {
2831		if (!strcmp(sp_dev->name, dev->name))
2832			continue;
2833
2834		idev = __in6_dev_get(sp_dev);
2835		if (!idev)
2836			continue;
2837
2838		read_lock_bh(&idev->lock);
2839		list_for_each_entry(sp_ifa, &idev->addr_list, if_list) {
2840
2841			if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
2842				continue;
2843
2844			if (sp_ifa->rt) {
2845				/* This dst has been added to garbage list when
2846				 * lo device down, release this obsolete dst and
2847				 * reallocate a new router for ifa.
2848				 */
2849				if (sp_ifa->rt->dst.obsolete > 0) {
2850					ip6_rt_put(sp_ifa->rt);
2851					sp_ifa->rt = NULL;
2852				} else {
2853					continue;
2854				}
2855			}
2856
2857			sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, false);
2858
2859			/* Failure cases are ignored */
2860			if (!IS_ERR(sp_rt)) {
2861				sp_ifa->rt = sp_rt;
2862				ip6_ins_rt(sp_rt);
2863			}
2864		}
2865		read_unlock_bh(&idev->lock);
2866	}
2867}
2868
2869static void addrconf_add_linklocal(struct inet6_dev *idev,
2870				   const struct in6_addr *addr, u32 flags)
2871{
2872	struct inet6_ifaddr *ifp;
2873	u32 addr_flags = flags | IFA_F_PERMANENT;
2874
2875#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
2876	if (idev->cnf.optimistic_dad &&
2877	    !dev_net(idev->dev)->ipv6.devconf_all->forwarding)
2878		addr_flags |= IFA_F_OPTIMISTIC;
2879#endif
2880
2881	ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags,
2882			    INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
2883	if (!IS_ERR(ifp)) {
2884		addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
2885		addrconf_dad_start(ifp);
2886		in6_ifa_put(ifp);
2887	}
2888}
2889
2890static bool ipv6_reserved_interfaceid(struct in6_addr address)
2891{
2892	if ((address.s6_addr32[2] | address.s6_addr32[3]) == 0)
2893		return true;
2894
2895	if (address.s6_addr32[2] == htonl(0x02005eff) &&
2896	    ((address.s6_addr32[3] & htonl(0xfe000000)) == htonl(0xfe000000)))
2897		return true;
2898
2899	if (address.s6_addr32[2] == htonl(0xfdffffff) &&
2900	    ((address.s6_addr32[3] & htonl(0xffffff80)) == htonl(0xffffff80)))
2901		return true;
2902
2903	return false;
2904}
2905
2906static int ipv6_generate_stable_address(struct in6_addr *address,
2907					u8 dad_count,
2908					const struct inet6_dev *idev)
2909{
2910	static DEFINE_SPINLOCK(lock);
2911	static __u32 digest[SHA_DIGEST_WORDS];
2912	static __u32 workspace[SHA_WORKSPACE_WORDS];
2913
2914	static union {
2915		char __data[SHA_MESSAGE_BYTES];
2916		struct {
2917			struct in6_addr secret;
2918			__be32 prefix[2];
2919			unsigned char hwaddr[MAX_ADDR_LEN];
2920			u8 dad_count;
2921		} __packed;
2922	} data;
2923
2924	struct in6_addr secret;
2925	struct in6_addr temp;
2926	struct net *net = dev_net(idev->dev);
2927
2928	BUILD_BUG_ON(sizeof(data.__data) != sizeof(data));
2929
2930	if (idev->cnf.stable_secret.initialized)
2931		secret = idev->cnf.stable_secret.secret;
2932	else if (net->ipv6.devconf_dflt->stable_secret.initialized)
2933		secret = net->ipv6.devconf_dflt->stable_secret.secret;
2934	else
2935		return -1;
2936
2937retry:
2938	spin_lock_bh(&lock);
2939
2940	sha_init(digest);
2941	memset(&data, 0, sizeof(data));
2942	memset(workspace, 0, sizeof(workspace));
2943	memcpy(data.hwaddr, idev->dev->perm_addr, idev->dev->addr_len);
2944	data.prefix[0] = address->s6_addr32[0];
2945	data.prefix[1] = address->s6_addr32[1];
2946	data.secret = secret;
2947	data.dad_count = dad_count;
2948
2949	sha_transform(digest, data.__data, workspace);
2950
2951	temp = *address;
2952	temp.s6_addr32[2] = (__force __be32)digest[0];
2953	temp.s6_addr32[3] = (__force __be32)digest[1];
2954
2955	spin_unlock_bh(&lock);
2956
2957	if (ipv6_reserved_interfaceid(temp)) {
2958		dad_count++;
2959		if (dad_count > dev_net(idev->dev)->ipv6.sysctl.idgen_retries)
2960			return -1;
2961		goto retry;
2962	}
2963
2964	*address = temp;
2965	return 0;
2966}
2967
2968static void addrconf_addr_gen(struct inet6_dev *idev, bool prefix_route)
2969{
2970	struct in6_addr addr;
2971
2972	ipv6_addr_set(&addr, htonl(0xFE800000), 0, 0, 0);
2973
2974	if (idev->addr_gen_mode == IN6_ADDR_GEN_MODE_STABLE_PRIVACY) {
2975		if (!ipv6_generate_stable_address(&addr, 0, idev))
2976			addrconf_add_linklocal(idev, &addr,
2977					       IFA_F_STABLE_PRIVACY);
2978		else if (prefix_route)
2979			addrconf_prefix_route(&addr, 64, idev->dev, 0, 0);
2980	} else if (idev->addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64) {
2981		/* addrconf_add_linklocal also adds a prefix_route and we
2982		 * only need to care about prefix routes if ipv6_generate_eui64
2983		 * couldn't generate one.
2984		 */
2985		if (ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) == 0)
2986			addrconf_add_linklocal(idev, &addr, 0);
2987		else if (prefix_route)
2988			addrconf_prefix_route(&addr, 64, idev->dev, 0, 0);
2989	}
2990}
2991
2992static void addrconf_dev_config(struct net_device *dev)
2993{
2994	struct inet6_dev *idev;
2995
2996	ASSERT_RTNL();
2997
2998	if ((dev->type != ARPHRD_ETHER) &&
2999	    (dev->type != ARPHRD_FDDI) &&
3000	    (dev->type != ARPHRD_ARCNET) &&
3001	    (dev->type != ARPHRD_INFINIBAND) &&
3002	    (dev->type != ARPHRD_IEEE802154) &&
3003	    (dev->type != ARPHRD_IEEE1394) &&
3004	    (dev->type != ARPHRD_TUNNEL6) &&
3005	    (dev->type != ARPHRD_6LOWPAN)) {
3006		/* Alas, we support only Ethernet autoconfiguration. */
3007		return;
3008	}
3009
3010	idev = addrconf_add_dev(dev);
3011	if (IS_ERR(idev))
3012		return;
3013
3014	addrconf_addr_gen(idev, false);
3015}
3016
3017#if IS_ENABLED(CONFIG_IPV6_SIT)
3018static void addrconf_sit_config(struct net_device *dev)
3019{
3020	struct inet6_dev *idev;
3021
3022	ASSERT_RTNL();
3023
3024	/*
3025	 * Configure the tunnel with one of our IPv4
3026	 * addresses... we should configure all of
3027	 * our v4 addrs in the tunnel
3028	 */
3029
3030	idev = ipv6_find_idev(dev);
3031	if (!idev) {
3032		pr_debug("%s: add_dev failed\n", __func__);
3033		return;
3034	}
3035
3036	if (dev->priv_flags & IFF_ISATAP) {
3037		addrconf_addr_gen(idev, false);
3038		return;
3039	}
3040
3041	sit_add_v4_addrs(idev);
3042
3043	if (dev->flags&IFF_POINTOPOINT)
3044		addrconf_add_mroute(dev);
3045}
3046#endif
3047
3048#if IS_ENABLED(CONFIG_NET_IPGRE)
3049static void addrconf_gre_config(struct net_device *dev)
3050{
3051	struct inet6_dev *idev;
3052
3053	ASSERT_RTNL();
3054
3055	idev = ipv6_find_idev(dev);
3056	if (!idev) {
3057		pr_debug("%s: add_dev failed\n", __func__);
3058		return;
3059	}
3060
3061	addrconf_addr_gen(idev, true);
3062}
3063#endif
3064
3065static int addrconf_notify(struct notifier_block *this, unsigned long event,
3066			   void *ptr)
3067{
3068	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
3069	struct inet6_dev *idev = __in6_dev_get(dev);
3070	int run_pending = 0;
3071	int err;
3072
3073	switch (event) {
3074	case NETDEV_REGISTER:
3075		if (!idev && dev->mtu >= IPV6_MIN_MTU) {
3076			idev = ipv6_add_dev(dev);
3077			if (IS_ERR(idev))
3078				return notifier_from_errno(PTR_ERR(idev));
3079		}
3080		break;
3081
3082	case NETDEV_UP:
3083	case NETDEV_CHANGE:
3084		if (dev->flags & IFF_SLAVE)
3085			break;
3086
3087		if (idev && idev->cnf.disable_ipv6)
3088			break;
3089
3090		if (event == NETDEV_UP) {
3091			if (!addrconf_qdisc_ok(dev)) {
3092				/* device is not ready yet. */
3093				pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
3094					dev->name);
3095				break;
3096			}
3097
3098			if (!idev && dev->mtu >= IPV6_MIN_MTU)
3099				idev = ipv6_add_dev(dev);
3100
3101			if (!IS_ERR_OR_NULL(idev)) {
3102				idev->if_flags |= IF_READY;
3103				run_pending = 1;
3104			}
3105		} else {
3106			if (!addrconf_qdisc_ok(dev)) {
3107				/* device is still not ready. */
3108				break;
3109			}
3110
3111			if (idev) {
3112				if (idev->if_flags & IF_READY)
3113					/* device is already configured. */
3114					break;
3115				idev->if_flags |= IF_READY;
3116			}
3117
3118			pr_info("ADDRCONF(NETDEV_CHANGE): %s: link becomes ready\n",
3119				dev->name);
3120
3121			run_pending = 1;
3122		}
3123
3124		switch (dev->type) {
3125#if IS_ENABLED(CONFIG_IPV6_SIT)
3126		case ARPHRD_SIT:
3127			addrconf_sit_config(dev);
3128			break;
3129#endif
3130#if IS_ENABLED(CONFIG_NET_IPGRE)
3131		case ARPHRD_IPGRE:
3132			addrconf_gre_config(dev);
3133			break;
3134#endif
3135		case ARPHRD_LOOPBACK:
3136			init_loopback(dev);
3137			break;
3138
3139		default:
3140			addrconf_dev_config(dev);
3141			break;
3142		}
3143
3144		if (!IS_ERR_OR_NULL(idev)) {
3145			if (run_pending)
3146				addrconf_dad_run(idev);
3147
3148			/*
3149			 * If the MTU changed during the interface down,
3150			 * when the interface up, the changed MTU must be
3151			 * reflected in the idev as well as routers.
3152			 */
3153			if (idev->cnf.mtu6 != dev->mtu &&
3154			    dev->mtu >= IPV6_MIN_MTU) {
3155				rt6_mtu_change(dev, dev->mtu);
3156				idev->cnf.mtu6 = dev->mtu;
3157			}
3158			idev->tstamp = jiffies;
3159			inet6_ifinfo_notify(RTM_NEWLINK, idev);
3160
3161			/*
3162			 * If the changed mtu during down is lower than
3163			 * IPV6_MIN_MTU stop IPv6 on this interface.
3164			 */
3165			if (dev->mtu < IPV6_MIN_MTU)
3166				addrconf_ifdown(dev, 1);
3167		}
3168		break;
3169
3170	case NETDEV_CHANGEMTU:
3171		if (idev && dev->mtu >= IPV6_MIN_MTU) {
3172			rt6_mtu_change(dev, dev->mtu);
3173			idev->cnf.mtu6 = dev->mtu;
3174			break;
3175		}
3176
3177		if (!idev && dev->mtu >= IPV6_MIN_MTU) {
3178			idev = ipv6_add_dev(dev);
3179			if (!IS_ERR(idev))
3180				break;
3181		}
3182
3183		/*
3184		 * if MTU under IPV6_MIN_MTU.
3185		 * Stop IPv6 on this interface.
3186		 */
3187
3188	case NETDEV_DOWN:
3189	case NETDEV_UNREGISTER:
3190		/*
3191		 *	Remove all addresses from this interface.
3192		 */
3193		addrconf_ifdown(dev, event != NETDEV_DOWN);
3194		break;
3195
3196	case NETDEV_CHANGENAME:
3197		if (idev) {
3198			snmp6_unregister_dev(idev);
3199			addrconf_sysctl_unregister(idev);
3200			err = addrconf_sysctl_register(idev);
3201			if (err)
3202				return notifier_from_errno(err);
3203			err = snmp6_register_dev(idev);
3204			if (err) {
3205				addrconf_sysctl_unregister(idev);
3206				return notifier_from_errno(err);
3207			}
3208		}
3209		break;
3210
3211	case NETDEV_PRE_TYPE_CHANGE:
3212	case NETDEV_POST_TYPE_CHANGE:
3213		addrconf_type_change(dev, event);
3214		break;
3215	}
3216
3217	return NOTIFY_OK;
3218}
3219
3220/*
3221 *	addrconf module should be notified of a device going up
3222 */
3223static struct notifier_block ipv6_dev_notf = {
3224	.notifier_call = addrconf_notify,
3225};
3226
3227static void addrconf_type_change(struct net_device *dev, unsigned long event)
3228{
3229	struct inet6_dev *idev;
3230	ASSERT_RTNL();
3231
3232	idev = __in6_dev_get(dev);
3233
3234	if (event == NETDEV_POST_TYPE_CHANGE)
3235		ipv6_mc_remap(idev);
3236	else if (event == NETDEV_PRE_TYPE_CHANGE)
3237		ipv6_mc_unmap(idev);
3238}
3239
3240static int addrconf_ifdown(struct net_device *dev, int how)
3241{
3242	struct net *net = dev_net(dev);
3243	struct inet6_dev *idev;
3244	struct inet6_ifaddr *ifa;
3245	int state, i;
3246
3247	ASSERT_RTNL();
3248
3249	rt6_ifdown(net, dev);
3250	neigh_ifdown(&nd_tbl, dev);
3251
3252	idev = __in6_dev_get(dev);
3253	if (!idev)
3254		return -ENODEV;
3255
3256	/*
3257	 * Step 1: remove reference to ipv6 device from parent device.
3258	 *	   Do not dev_put!
3259	 */
3260	if (how) {
3261		idev->dead = 1;
3262
3263		/* protected by rtnl_lock */
3264		RCU_INIT_POINTER(dev->ip6_ptr, NULL);
3265
3266		/* Step 1.5: remove snmp6 entry */
3267		snmp6_unregister_dev(idev);
3268
3269	}
3270
3271	/* Step 2: clear hash table */
3272	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
3273		struct hlist_head *h = &inet6_addr_lst[i];
3274
3275		spin_lock_bh(&addrconf_hash_lock);
3276restart:
3277		hlist_for_each_entry_rcu(ifa, h, addr_lst) {
3278			if (ifa->idev == idev) {
3279				hlist_del_init_rcu(&ifa->addr_lst);
3280				addrconf_del_dad_work(ifa);
3281				goto restart;
3282			}
3283		}
3284		spin_unlock_bh(&addrconf_hash_lock);
3285	}
3286
3287	write_lock_bh(&idev->lock);
3288
3289	addrconf_del_rs_timer(idev);
3290
3291	/* Step 2: clear flags for stateless addrconf */
3292	if (!how)
3293		idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
3294
3295	if (how && del_timer(&idev->regen_timer))
3296		in6_dev_put(idev);
3297
3298	/* Step 3: clear tempaddr list */
3299	while (!list_empty(&idev->tempaddr_list)) {
3300		ifa = list_first_entry(&idev->tempaddr_list,
3301				       struct inet6_ifaddr, tmp_list);
3302		list_del(&ifa->tmp_list);
3303		write_unlock_bh(&idev->lock);
3304		spin_lock_bh(&ifa->lock);
3305
3306		if (ifa->ifpub) {
3307			in6_ifa_put(ifa->ifpub);
3308			ifa->ifpub = NULL;
3309		}
3310		spin_unlock_bh(&ifa->lock);
3311		in6_ifa_put(ifa);
3312		write_lock_bh(&idev->lock);
3313	}
3314
3315	while (!list_empty(&idev->addr_list)) {
3316		ifa = list_first_entry(&idev->addr_list,
3317				       struct inet6_ifaddr, if_list);
3318		addrconf_del_dad_work(ifa);
3319
3320		list_del(&ifa->if_list);
3321
3322		write_unlock_bh(&idev->lock);
3323
3324		spin_lock_bh(&ifa->lock);
3325		state = ifa->state;
3326		ifa->state = INET6_IFADDR_STATE_DEAD;
3327		spin_unlock_bh(&ifa->lock);
3328
3329		if (state != INET6_IFADDR_STATE_DEAD) {
3330			__ipv6_ifa_notify(RTM_DELADDR, ifa);
3331			inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
3332		}
3333		in6_ifa_put(ifa);
3334
3335		write_lock_bh(&idev->lock);
3336	}
3337
3338	write_unlock_bh(&idev->lock);
3339
3340	/* Step 5: Discard anycast and multicast list */
3341	if (how) {
3342		ipv6_ac_destroy_dev(idev);
3343		ipv6_mc_destroy_dev(idev);
3344	} else {
3345		ipv6_mc_down(idev);
3346	}
3347
3348	idev->tstamp = jiffies;
3349
3350	/* Last: Shot the device (if unregistered) */
3351	if (how) {
3352		addrconf_sysctl_unregister(idev);
3353		neigh_parms_release(&nd_tbl, idev->nd_parms);
3354		neigh_ifdown(&nd_tbl, dev);
3355		in6_dev_put(idev);
3356	}
3357	return 0;
3358}
3359
3360static void addrconf_rs_timer(unsigned long data)
3361{
3362	struct inet6_dev *idev = (struct inet6_dev *)data;
3363	struct net_device *dev = idev->dev;
3364	struct in6_addr lladdr;
3365
3366	write_lock(&idev->lock);
3367	if (idev->dead || !(idev->if_flags & IF_READY))
3368		goto out;
3369
3370	if (!ipv6_accept_ra(idev))
3371		goto out;
3372
3373	/* Announcement received after solicitation was sent */
3374	if (idev->if_flags & IF_RA_RCVD)
3375		goto out;
3376
3377	if (idev->rs_probes++ < idev->cnf.rtr_solicits) {
3378		write_unlock(&idev->lock);
3379		if (!ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
3380			ndisc_send_rs(dev, &lladdr,
3381				      &in6addr_linklocal_allrouters);
3382		else
3383			goto put;
3384
3385		write_lock(&idev->lock);
3386		/* The wait after the last probe can be shorter */
3387		addrconf_mod_rs_timer(idev, (idev->rs_probes ==
3388					     idev->cnf.rtr_solicits) ?
3389				      idev->cnf.rtr_solicit_delay :
3390				      idev->cnf.rtr_solicit_interval);
3391	} else {
3392		/*
3393		 * Note: we do not support deprecated "all on-link"
3394		 * assumption any longer.
3395		 */
3396		pr_debug("%s: no IPv6 routers present\n", idev->dev->name);
3397	}
3398
3399out:
3400	write_unlock(&idev->lock);
3401put:
3402	in6_dev_put(idev);
3403}
3404
3405/*
3406 *	Duplicate Address Detection
3407 */
3408static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
3409{
3410	unsigned long rand_num;
3411	struct inet6_dev *idev = ifp->idev;
3412
3413	if (ifp->flags & IFA_F_OPTIMISTIC)
3414		rand_num = 0;
3415	else
3416		rand_num = prandom_u32() % (idev->cnf.rtr_solicit_delay ? : 1);
3417
3418	ifp->dad_probes = idev->cnf.dad_transmits;
3419	addrconf_mod_dad_work(ifp, rand_num);
3420}
3421
3422static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
3423{
3424	struct inet6_dev *idev = ifp->idev;
3425	struct net_device *dev = idev->dev;
3426	bool notify = false;
3427
3428	addrconf_join_solict(dev, &ifp->addr);
3429
3430	prandom_seed((__force u32) ifp->addr.s6_addr32[3]);
3431
3432	read_lock_bh(&idev->lock);
3433	spin_lock(&ifp->lock);
3434	if (ifp->state == INET6_IFADDR_STATE_DEAD)
3435		goto out;
3436
3437	if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
3438	    idev->cnf.accept_dad < 1 ||
3439	    !(ifp->flags&IFA_F_TENTATIVE) ||
3440	    ifp->flags & IFA_F_NODAD) {
3441		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
3442		spin_unlock(&ifp->lock);
3443		read_unlock_bh(&idev->lock);
3444
3445		addrconf_dad_completed(ifp);
3446		return;
3447	}
3448
3449	if (!(idev->if_flags & IF_READY)) {
3450		spin_unlock(&ifp->lock);
3451		read_unlock_bh(&idev->lock);
3452		/*
3453		 * If the device is not ready:
3454		 * - keep it tentative if it is a permanent address.
3455		 * - otherwise, kill it.
3456		 */
3457		in6_ifa_hold(ifp);
3458		addrconf_dad_stop(ifp, 0);
3459		return;
3460	}
3461
3462	/*
3463	 * Optimistic nodes can start receiving
3464	 * Frames right away
3465	 */
3466	if (ifp->flags & IFA_F_OPTIMISTIC) {
3467		ip6_ins_rt(ifp->rt);
3468		if (ipv6_use_optimistic_addr(idev)) {
3469			/* Because optimistic nodes can use this address,
3470			 * notify listeners. If DAD fails, RTM_DELADDR is sent.
3471			 */
3472			notify = true;
3473		}
3474	}
3475
3476	addrconf_dad_kick(ifp);
3477out:
3478	spin_unlock(&ifp->lock);
3479	read_unlock_bh(&idev->lock);
3480	if (notify)
3481		ipv6_ifa_notify(RTM_NEWADDR, ifp);
3482}
3483
3484static void addrconf_dad_start(struct inet6_ifaddr *ifp)
3485{
3486	bool begin_dad = false;
3487
3488	spin_lock_bh(&ifp->lock);
3489	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
3490		ifp->state = INET6_IFADDR_STATE_PREDAD;
3491		begin_dad = true;
3492	}
3493	spin_unlock_bh(&ifp->lock);
3494
3495	if (begin_dad)
3496		addrconf_mod_dad_work(ifp, 0);
3497}
3498
3499static void addrconf_dad_work(struct work_struct *w)
3500{
3501	struct inet6_ifaddr *ifp = container_of(to_delayed_work(w),
3502						struct inet6_ifaddr,
3503						dad_work);
3504	struct inet6_dev *idev = ifp->idev;
3505	struct in6_addr mcaddr;
3506
3507	enum {
3508		DAD_PROCESS,
3509		DAD_BEGIN,
3510		DAD_ABORT,
3511	} action = DAD_PROCESS;
3512
3513	rtnl_lock();
3514
3515	spin_lock_bh(&ifp->lock);
3516	if (ifp->state == INET6_IFADDR_STATE_PREDAD) {
3517		action = DAD_BEGIN;
3518		ifp->state = INET6_IFADDR_STATE_DAD;
3519	} else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
3520		action = DAD_ABORT;
3521		ifp->state = INET6_IFADDR_STATE_POSTDAD;
3522	}
3523	spin_unlock_bh(&ifp->lock);
3524
3525	if (action == DAD_BEGIN) {
3526		addrconf_dad_begin(ifp);
3527		goto out;
3528	} else if (action == DAD_ABORT) {
3529		addrconf_dad_stop(ifp, 1);
3530		goto out;
3531	}
3532
3533	if (!ifp->dad_probes && addrconf_dad_end(ifp))
3534		goto out;
3535
3536	write_lock_bh(&idev->lock);
3537	if (idev->dead || !(idev->if_flags & IF_READY)) {
3538		write_unlock_bh(&idev->lock);
3539		goto out;
3540	}
3541
3542	spin_lock(&ifp->lock);
3543	if (ifp->state == INET6_IFADDR_STATE_DEAD) {
3544		spin_unlock(&ifp->lock);
3545		write_unlock_bh(&idev->lock);
3546		goto out;
3547	}
3548
3549	if (ifp->dad_probes == 0) {
3550		/*
3551		 * DAD was successful
3552		 */
3553
3554		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
3555		spin_unlock(&ifp->lock);
3556		write_unlock_bh(&idev->lock);
3557
3558		addrconf_dad_completed(ifp);
3559
3560		goto out;
3561	}
3562
3563	ifp->dad_probes--;
3564	addrconf_mod_dad_work(ifp,
3565			      NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME));
3566	spin_unlock(&ifp->lock);
3567	write_unlock_bh(&idev->lock);
3568
3569	/* send a neighbour solicitation for our addr */
3570	addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
3571	ndisc_send_ns(ifp->idev->dev, NULL, &ifp->addr, &mcaddr, &in6addr_any);
3572out:
3573	in6_ifa_put(ifp);
3574	rtnl_unlock();
3575}
3576
3577/* ifp->idev must be at least read locked */
3578static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
3579{
3580	struct inet6_ifaddr *ifpiter;
3581	struct inet6_dev *idev = ifp->idev;
3582
3583	list_for_each_entry_reverse(ifpiter, &idev->addr_list, if_list) {
3584		if (ifpiter->scope > IFA_LINK)
3585			break;
3586		if (ifp != ifpiter && ifpiter->scope == IFA_LINK &&
3587		    (ifpiter->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|
3588				       IFA_F_OPTIMISTIC|IFA_F_DADFAILED)) ==
3589		    IFA_F_PERMANENT)
3590			return false;
3591	}
3592	return true;
3593}
3594
3595static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
3596{
3597	struct net_device *dev = ifp->idev->dev;
3598	struct in6_addr lladdr;
3599	bool send_rs, send_mld;
3600
3601	addrconf_del_dad_work(ifp);
3602
3603	/*
3604	 *	Configure the address for reception. Now it is valid.
3605	 */
3606
3607	ipv6_ifa_notify(RTM_NEWADDR, ifp);
3608
3609	/* If added prefix is link local and we are prepared to process
3610	   router advertisements, start sending router solicitations.
3611	 */
3612
3613	read_lock_bh(&ifp->idev->lock);
3614	send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
3615	send_rs = send_mld &&
3616		  ipv6_accept_ra(ifp->idev) &&
3617		  ifp->idev->cnf.rtr_solicits > 0 &&
3618		  (dev->flags&IFF_LOOPBACK) == 0;
3619	read_unlock_bh(&ifp->idev->lock);
3620
3621	/* While dad is in progress mld report's source address is in6_addrany.
3622	 * Resend with proper ll now.
3623	 */
3624	if (send_mld)
3625		ipv6_mc_dad_complete(ifp->idev);
3626
3627	if (send_rs) {
3628		/*
3629		 *	If a host as already performed a random delay
3630		 *	[...] as part of DAD [...] there is no need
3631		 *	to delay again before sending the first RS
3632		 */
3633		if (ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
3634			return;
3635		ndisc_send_rs(dev, &lladdr, &in6addr_linklocal_allrouters);
3636
3637		write_lock_bh(&ifp->idev->lock);
3638		spin_lock(&ifp->lock);
3639		ifp->idev->rs_probes = 1;
3640		ifp->idev->if_flags |= IF_RS_SENT;
3641		addrconf_mod_rs_timer(ifp->idev,
3642				      ifp->idev->cnf.rtr_solicit_interval);
3643		spin_unlock(&ifp->lock);
3644		write_unlock_bh(&ifp->idev->lock);
3645	}
3646}
3647
3648static void addrconf_dad_run(struct inet6_dev *idev)
3649{
3650	struct inet6_ifaddr *ifp;
3651
3652	read_lock_bh(&idev->lock);
3653	list_for_each_entry(ifp, &idev->addr_list, if_list) {
3654		spin_lock(&ifp->lock);
3655		if (ifp->flags & IFA_F_TENTATIVE &&
3656		    ifp->state == INET6_IFADDR_STATE_DAD)
3657			addrconf_dad_kick(ifp);
3658		spin_unlock(&ifp->lock);
3659	}
3660	read_unlock_bh(&idev->lock);
3661}
3662
3663#ifdef CONFIG_PROC_FS
3664struct if6_iter_state {
3665	struct seq_net_private p;
3666	int bucket;
3667	int offset;
3668};
3669
3670static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
3671{
3672	struct inet6_ifaddr *ifa = NULL;
3673	struct if6_iter_state *state = seq->private;
3674	struct net *net = seq_file_net(seq);
3675	int p = 0;
3676
3677	/* initial bucket if pos is 0 */
3678	if (pos == 0) {
3679		state->bucket = 0;
3680		state->offset = 0;
3681	}
3682
3683	for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
3684		hlist_for_each_entry_rcu_bh(ifa, &inet6_addr_lst[state->bucket],
3685					 addr_lst) {
3686			if (!net_eq(dev_net(ifa->idev->dev), net))
3687				continue;
3688			/* sync with offset */
3689			if (p < state->offset) {
3690				p++;
3691				continue;
3692			}
3693			state->offset++;
3694			return ifa;
3695		}
3696
3697		/* prepare for next bucket */
3698		state->offset = 0;
3699		p = 0;
3700	}
3701	return NULL;
3702}
3703
3704static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
3705					 struct inet6_ifaddr *ifa)
3706{
3707	struct if6_iter_state *state = seq->private;
3708	struct net *net = seq_file_net(seq);
3709
3710	hlist_for_each_entry_continue_rcu_bh(ifa, addr_lst) {
3711		if (!net_eq(dev_net(ifa->idev->dev), net))
3712			continue;
3713		state->offset++;
3714		return ifa;
3715	}
3716
3717	while (++state->bucket < IN6_ADDR_HSIZE) {
3718		state->offset = 0;
3719		hlist_for_each_entry_rcu_bh(ifa,
3720				     &inet6_addr_lst[state->bucket], addr_lst) {
3721			if (!net_eq(dev_net(ifa->idev->dev), net))
3722				continue;
3723			state->offset++;
3724			return ifa;
3725		}
3726	}
3727
3728	return NULL;
3729}
3730
3731static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
3732	__acquires(rcu_bh)
3733{
3734	rcu_read_lock_bh();
3735	return if6_get_first(seq, *pos);
3736}
3737
3738static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3739{
3740	struct inet6_ifaddr *ifa;
3741
3742	ifa = if6_get_next(seq, v);
3743	++*pos;
3744	return ifa;
3745}
3746
3747static void if6_seq_stop(struct seq_file *seq, void *v)
3748	__releases(rcu_bh)
3749{
3750	rcu_read_unlock_bh();
3751}
3752
3753static int if6_seq_show(struct seq_file *seq, void *v)
3754{
3755	struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
3756	seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
3757		   &ifp->addr,
3758		   ifp->idev->dev->ifindex,
3759		   ifp->prefix_len,
3760		   ifp->scope,
3761		   (u8) ifp->flags,
3762		   ifp->idev->dev->name);
3763	return 0;
3764}
3765
3766static const struct seq_operations if6_seq_ops = {
3767	.start	= if6_seq_start,
3768	.next	= if6_seq_next,
3769	.show	= if6_seq_show,
3770	.stop	= if6_seq_stop,
3771};
3772
3773static int if6_seq_open(struct inode *inode, struct file *file)
3774{
3775	return seq_open_net(inode, file, &if6_seq_ops,
3776			    sizeof(struct if6_iter_state));
3777}
3778
3779static const struct file_operations if6_fops = {
3780	.owner		= THIS_MODULE,
3781	.open		= if6_seq_open,
3782	.read		= seq_read,
3783	.llseek		= seq_lseek,
3784	.release	= seq_release_net,
3785};
3786
3787static int __net_init if6_proc_net_init(struct net *net)
3788{
3789	if (!proc_create("if_inet6", S_IRUGO, net->proc_net, &if6_fops))
3790		return -ENOMEM;
3791	return 0;
3792}
3793
3794static void __net_exit if6_proc_net_exit(struct net *net)
3795{
3796	remove_proc_entry("if_inet6", net->proc_net);
3797}
3798
3799static struct pernet_operations if6_proc_net_ops = {
3800	.init = if6_proc_net_init,
3801	.exit = if6_proc_net_exit,
3802};
3803
3804int __init if6_proc_init(void)
3805{
3806	return register_pernet_subsys(&if6_proc_net_ops);
3807}
3808
3809void if6_proc_exit(void)
3810{
3811	unregister_pernet_subsys(&if6_proc_net_ops);
3812}
3813#endif	/* CONFIG_PROC_FS */
3814
3815#if IS_ENABLED(CONFIG_IPV6_MIP6)
3816/* Check if address is a home address configured on any interface. */
3817int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
3818{
3819	int ret = 0;
3820	struct inet6_ifaddr *ifp = NULL;
3821	unsigned int hash = inet6_addr_hash(addr);
3822
3823	rcu_read_lock_bh();
3824	hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
3825		if (!net_eq(dev_net(ifp->idev->dev), net))
3826			continue;
3827		if (ipv6_addr_equal(&ifp->addr, addr) &&
3828		    (ifp->flags & IFA_F_HOMEADDRESS)) {
3829			ret = 1;
3830			break;
3831		}
3832	}
3833	rcu_read_unlock_bh();
3834	return ret;
3835}
3836#endif
3837
3838/*
3839 *	Periodic address status verification
3840 */
3841
3842static void addrconf_verify_rtnl(void)
3843{
3844	unsigned long now, next, next_sec, next_sched;
3845	struct inet6_ifaddr *ifp;
3846	int i;
3847
3848	ASSERT_RTNL();
3849
3850	rcu_read_lock_bh();
3851	now = jiffies;
3852	next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
3853
3854	cancel_delayed_work(&addr_chk_work);
3855
3856	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
3857restart:
3858		hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[i], addr_lst) {
3859			unsigned long age;
3860
3861			/* When setting preferred_lft to a value not zero or
3862			 * infinity, while valid_lft is infinity
3863			 * IFA_F_PERMANENT has a non-infinity life time.
3864			 */
3865			if ((ifp->flags & IFA_F_PERMANENT) &&
3866			    (ifp->prefered_lft == INFINITY_LIFE_TIME))
3867				continue;
3868
3869			spin_lock(&ifp->lock);
3870			/* We try to batch several events at once. */
3871			age = (now - ifp->tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
3872
3873			if (ifp->valid_lft != INFINITY_LIFE_TIME &&
3874			    age >= ifp->valid_lft) {
3875				spin_unlock(&ifp->lock);
3876				in6_ifa_hold(ifp);
3877				ipv6_del_addr(ifp);
3878				goto restart;
3879			} else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
3880				spin_unlock(&ifp->lock);
3881				continue;
3882			} else if (age >= ifp->prefered_lft) {
3883				/* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
3884				int deprecate = 0;
3885
3886				if (!(ifp->flags&IFA_F_DEPRECATED)) {
3887					deprecate = 1;
3888					ifp->flags |= IFA_F_DEPRECATED;
3889				}
3890
3891				if ((ifp->valid_lft != INFINITY_LIFE_TIME) &&
3892				    (time_before(ifp->tstamp + ifp->valid_lft * HZ, next)))
3893					next = ifp->tstamp + ifp->valid_lft * HZ;
3894
3895				spin_unlock(&ifp->lock);
3896
3897				if (deprecate) {
3898					in6_ifa_hold(ifp);
3899
3900					ipv6_ifa_notify(0, ifp);
3901					in6_ifa_put(ifp);
3902					goto restart;
3903				}
3904			} else if ((ifp->flags&IFA_F_TEMPORARY) &&
3905				   !(ifp->flags&IFA_F_TENTATIVE)) {
3906				unsigned long regen_advance = ifp->idev->cnf.regen_max_retry *
3907					ifp->idev->cnf.dad_transmits *
3908					NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME) / HZ;
3909
3910				if (age >= ifp->prefered_lft - regen_advance) {
3911					struct inet6_ifaddr *ifpub = ifp->ifpub;
3912					if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
3913						next = ifp->tstamp + ifp->prefered_lft * HZ;
3914					if (!ifp->regen_count && ifpub) {
3915						ifp->regen_count++;
3916						in6_ifa_hold(ifp);
3917						in6_ifa_hold(ifpub);
3918						spin_unlock(&ifp->lock);
3919
3920						spin_lock(&ifpub->lock);
3921						ifpub->regen_count = 0;
3922						spin_unlock(&ifpub->lock);
3923						ipv6_create_tempaddr(ifpub, ifp);
3924						in6_ifa_put(ifpub);
3925						in6_ifa_put(ifp);
3926						goto restart;
3927					}
3928				} else if (time_before(ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ, next))
3929					next = ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ;
3930				spin_unlock(&ifp->lock);
3931			} else {
3932				/* ifp->prefered_lft <= ifp->valid_lft */
3933				if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
3934					next = ifp->tstamp + ifp->prefered_lft * HZ;
3935				spin_unlock(&ifp->lock);
3936			}
3937		}
3938	}
3939
3940	next_sec = round_jiffies_up(next);
3941	next_sched = next;
3942
3943	/* If rounded timeout is accurate enough, accept it. */
3944	if (time_before(next_sec, next + ADDRCONF_TIMER_FUZZ))
3945		next_sched = next_sec;
3946
3947	/* And minimum interval is ADDRCONF_TIMER_FUZZ_MAX. */
3948	if (time_before(next_sched, jiffies + ADDRCONF_TIMER_FUZZ_MAX))
3949		next_sched = jiffies + ADDRCONF_TIMER_FUZZ_MAX;
3950
3951	ADBG(KERN_DEBUG "now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
3952	      now, next, next_sec, next_sched);
3953	mod_delayed_work(addrconf_wq, &addr_chk_work, next_sched - now);
3954	rcu_read_unlock_bh();
3955}
3956
3957static void addrconf_verify_work(struct work_struct *w)
3958{
3959	rtnl_lock();
3960	addrconf_verify_rtnl();
3961	rtnl_unlock();
3962}
3963
3964static void addrconf_verify(void)
3965{
3966	mod_delayed_work(addrconf_wq, &addr_chk_work, 0);
3967}
3968
3969static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local,
3970				     struct in6_addr **peer_pfx)
3971{
3972	struct in6_addr *pfx = NULL;
3973
3974	*peer_pfx = NULL;
3975
3976	if (addr)
3977		pfx = nla_data(addr);
3978
3979	if (local) {
3980		if (pfx && nla_memcmp(local, pfx, sizeof(*pfx)))
3981			*peer_pfx = pfx;
3982		pfx = nla_data(local);
3983	}
3984
3985	return pfx;
3986}
3987
3988static const struct nla_policy ifa_ipv6_policy[IFA_MAX+1] = {
3989	[IFA_ADDRESS]		= { .len = sizeof(struct in6_addr) },
3990	[IFA_LOCAL]		= { .len = sizeof(struct in6_addr) },
3991	[IFA_CACHEINFO]		= { .len = sizeof(struct ifa_cacheinfo) },
3992	[IFA_FLAGS]		= { .len = sizeof(u32) },
3993};
3994
3995static int
3996inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
3997{
3998	struct net *net = sock_net(skb->sk);
3999	struct ifaddrmsg *ifm;
4000	struct nlattr *tb[IFA_MAX+1];
4001	struct in6_addr *pfx, *peer_pfx;
4002	u32 ifa_flags;
4003	int err;
4004
4005	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
4006	if (err < 0)
4007		return err;
4008
4009	ifm = nlmsg_data(nlh);
4010	pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
4011	if (!pfx)
4012		return -EINVAL;
4013
4014	ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) : ifm->ifa_flags;
4015
4016	/* We ignore other flags so far. */
4017	ifa_flags &= IFA_F_MANAGETEMPADDR;
4018
4019	return inet6_addr_del(net, ifm->ifa_index, ifa_flags, pfx,
4020			      ifm->ifa_prefixlen);
4021}
4022
4023static int inet6_addr_modify(struct inet6_ifaddr *ifp, u32 ifa_flags,
4024			     u32 prefered_lft, u32 valid_lft)
4025{
4026	u32 flags;
4027	clock_t expires;
4028	unsigned long timeout;
4029	bool was_managetempaddr;
4030	bool had_prefixroute;
4031
4032	ASSERT_RTNL();
4033
4034	if (!valid_lft || (prefered_lft > valid_lft))
4035		return -EINVAL;
4036
4037	if (ifa_flags & IFA_F_MANAGETEMPADDR &&
4038	    (ifp->flags & IFA_F_TEMPORARY || ifp->prefix_len != 64))
4039		return -EINVAL;
4040
4041	timeout = addrconf_timeout_fixup(valid_lft, HZ);
4042	if (addrconf_finite_timeout(timeout)) {
4043		expires = jiffies_to_clock_t(timeout * HZ);
4044		valid_lft = timeout;
4045		flags = RTF_EXPIRES;
4046	} else {
4047		expires = 0;
4048		flags = 0;
4049		ifa_flags |= IFA_F_PERMANENT;
4050	}
4051
4052	timeout = addrconf_timeout_fixup(prefered_lft, HZ);
4053	if (addrconf_finite_timeout(timeout)) {
4054		if (timeout == 0)
4055			ifa_flags |= IFA_F_DEPRECATED;
4056		prefered_lft = timeout;
4057	}
4058
4059	spin_lock_bh(&ifp->lock);
4060	was_managetempaddr = ifp->flags & IFA_F_MANAGETEMPADDR;
4061	had_prefixroute = ifp->flags & IFA_F_PERMANENT &&
4062			  !(ifp->flags & IFA_F_NOPREFIXROUTE);
4063	ifp->flags &= ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD |
4064			IFA_F_HOMEADDRESS | IFA_F_MANAGETEMPADDR |
4065			IFA_F_NOPREFIXROUTE);
4066	ifp->flags |= ifa_flags;
4067	ifp->tstamp = jiffies;
4068	ifp->valid_lft = valid_lft;
4069	ifp->prefered_lft = prefered_lft;
4070
4071	spin_unlock_bh(&ifp->lock);
4072	if (!(ifp->flags&IFA_F_TENTATIVE))
4073		ipv6_ifa_notify(0, ifp);
4074
4075	if (!(ifa_flags & IFA_F_NOPREFIXROUTE)) {
4076		addrconf_prefix_route(&ifp->addr, ifp->prefix_len, ifp->idev->dev,
4077				      expires, flags);
4078	} else if (had_prefixroute) {
4079		enum cleanup_prefix_rt_t action;
4080		unsigned long rt_expires;
4081
4082		write_lock_bh(&ifp->idev->lock);
4083		action = check_cleanup_prefix_route(ifp, &rt_expires);
4084		write_unlock_bh(&ifp->idev->lock);
4085
4086		if (action != CLEANUP_PREFIX_RT_NOP) {
4087			cleanup_prefix_route(ifp, rt_expires,
4088				action == CLEANUP_PREFIX_RT_DEL);
4089		}
4090	}
4091
4092	if (was_managetempaddr || ifp->flags & IFA_F_MANAGETEMPADDR) {
4093		if (was_managetempaddr && !(ifp->flags & IFA_F_MANAGETEMPADDR))
4094			valid_lft = prefered_lft = 0;
4095		manage_tempaddrs(ifp->idev, ifp, valid_lft, prefered_lft,
4096				 !was_managetempaddr, jiffies);
4097	}
4098
4099	addrconf_verify_rtnl();
4100
4101	return 0;
4102}
4103
4104static int
4105inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
4106{
4107	struct net *net = sock_net(skb->sk);
4108	struct ifaddrmsg *ifm;
4109	struct nlattr *tb[IFA_MAX+1];
4110	struct in6_addr *pfx, *peer_pfx;
4111	struct inet6_ifaddr *ifa;
4112	struct net_device *dev;
4113	u32 valid_lft = INFINITY_LIFE_TIME, preferred_lft = INFINITY_LIFE_TIME;
4114	u32 ifa_flags;
4115	int err;
4116
4117	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
4118	if (err < 0)
4119		return err;
4120
4121	ifm = nlmsg_data(nlh);
4122	pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
4123	if (!pfx)
4124		return -EINVAL;
4125
4126	if (tb[IFA_CACHEINFO]) {
4127		struct ifa_cacheinfo *ci;
4128
4129		ci = nla_data(tb[IFA_CACHEINFO]);
4130		valid_lft = ci->ifa_valid;
4131		preferred_lft = ci->ifa_prefered;
4132	} else {
4133		preferred_lft = INFINITY_LIFE_TIME;
4134		valid_lft = INFINITY_LIFE_TIME;
4135	}
4136
4137	dev =  __dev_get_by_index(net, ifm->ifa_index);
4138	if (!dev)
4139		return -ENODEV;
4140
4141	ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) : ifm->ifa_flags;
4142
4143	/* We ignore other flags so far. */
4144	ifa_flags &= IFA_F_NODAD | IFA_F_HOMEADDRESS | IFA_F_MANAGETEMPADDR |
4145		     IFA_F_NOPREFIXROUTE | IFA_F_MCAUTOJOIN;
4146
4147	ifa = ipv6_get_ifaddr(net, pfx, dev, 1);
4148	if (!ifa) {
4149		/*
4150		 * It would be best to check for !NLM_F_CREATE here but
4151		 * userspace already relies on not having to provide this.
4152		 */
4153		return inet6_addr_add(net, ifm->ifa_index, pfx, peer_pfx,
4154				      ifm->ifa_prefixlen, ifa_flags,
4155				      preferred_lft, valid_lft);
4156	}
4157
4158	if (nlh->nlmsg_flags & NLM_F_EXCL ||
4159	    !(nlh->nlmsg_flags & NLM_F_REPLACE))
4160		err = -EEXIST;
4161	else
4162		err = inet6_addr_modify(ifa, ifa_flags, preferred_lft, valid_lft);
4163
4164	in6_ifa_put(ifa);
4165
4166	return err;
4167}
4168
4169static void put_ifaddrmsg(struct nlmsghdr *nlh, u8 prefixlen, u32 flags,
4170			  u8 scope, int ifindex)
4171{
4172	struct ifaddrmsg *ifm;
4173
4174	ifm = nlmsg_data(nlh);
4175	ifm->ifa_family = AF_INET6;
4176	ifm->ifa_prefixlen = prefixlen;
4177	ifm->ifa_flags = flags;
4178	ifm->ifa_scope = scope;
4179	ifm->ifa_index = ifindex;
4180}
4181
4182static int put_cacheinfo(struct sk_buff *skb, unsigned long cstamp,
4183			 unsigned long tstamp, u32 preferred, u32 valid)
4184{
4185	struct ifa_cacheinfo ci;
4186
4187	ci.cstamp = cstamp_delta(cstamp);
4188	ci.tstamp = cstamp_delta(tstamp);
4189	ci.ifa_prefered = preferred;
4190	ci.ifa_valid = valid;
4191
4192	return nla_put(skb, IFA_CACHEINFO, sizeof(ci), &ci);
4193}
4194
4195static inline int rt_scope(int ifa_scope)
4196{
4197	if (ifa_scope & IFA_HOST)
4198		return RT_SCOPE_HOST;
4199	else if (ifa_scope & IFA_LINK)
4200		return RT_SCOPE_LINK;
4201	else if (ifa_scope & IFA_SITE)
4202		return RT_SCOPE_SITE;
4203	else
4204		return RT_SCOPE_UNIVERSE;
4205}
4206
4207static inline int inet6_ifaddr_msgsize(void)
4208{
4209	return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
4210	       + nla_total_size(16) /* IFA_LOCAL */
4211	       + nla_total_size(16) /* IFA_ADDRESS */
4212	       + nla_total_size(sizeof(struct ifa_cacheinfo))
4213	       + nla_total_size(4)  /* IFA_FLAGS */;
4214}
4215
4216static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
4217			     u32 portid, u32 seq, int event, unsigned int flags)
4218{
4219	struct nlmsghdr  *nlh;
4220	u32 preferred, valid;
4221
4222	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
4223	if (!nlh)
4224		return -EMSGSIZE;
4225
4226	put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
4227		      ifa->idev->dev->ifindex);
4228
4229	if (!((ifa->flags&IFA_F_PERMANENT) &&
4230	      (ifa->prefered_lft == INFINITY_LIFE_TIME))) {
4231		preferred = ifa->prefered_lft;
4232		valid = ifa->valid_lft;
4233		if (preferred != INFINITY_LIFE_TIME) {
4234			long tval = (jiffies - ifa->tstamp)/HZ;
4235			if (preferred > tval)
4236				preferred -= tval;
4237			else
4238				preferred = 0;
4239			if (valid != INFINITY_LIFE_TIME) {
4240				if (valid > tval)
4241					valid -= tval;
4242				else
4243					valid = 0;
4244			}
4245		}
4246	} else {
4247		preferred = INFINITY_LIFE_TIME;
4248		valid = INFINITY_LIFE_TIME;
4249	}
4250
4251	if (!ipv6_addr_any(&ifa->peer_addr)) {
4252		if (nla_put_in6_addr(skb, IFA_LOCAL, &ifa->addr) < 0 ||
4253		    nla_put_in6_addr(skb, IFA_ADDRESS, &ifa->peer_addr) < 0)
4254			goto error;
4255	} else
4256		if (nla_put_in6_addr(skb, IFA_ADDRESS, &ifa->addr) < 0)
4257			goto error;
4258
4259	if (put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0)
4260		goto error;
4261
4262	if (nla_put_u32(skb, IFA_FLAGS, ifa->flags) < 0)
4263		goto error;
4264
4265	nlmsg_end(skb, nlh);
4266	return 0;
4267
4268error:
4269	nlmsg_cancel(skb, nlh);
4270	return -EMSGSIZE;
4271}
4272
4273static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
4274				u32 portid, u32 seq, int event, u16 flags)
4275{
4276	struct nlmsghdr  *nlh;
4277	u8 scope = RT_SCOPE_UNIVERSE;
4278	int ifindex = ifmca->idev->dev->ifindex;
4279
4280	if (ipv6_addr_scope(&ifmca->mca_addr) & IFA_SITE)
4281		scope = RT_SCOPE_SITE;
4282
4283	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
4284	if (!nlh)
4285		return -EMSGSIZE;
4286
4287	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
4288	if (nla_put_in6_addr(skb, IFA_MULTICAST, &ifmca->mca_addr) < 0 ||
4289	    put_cacheinfo(skb, ifmca->mca_cstamp, ifmca->mca_tstamp,
4290			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
4291		nlmsg_cancel(skb, nlh);
4292		return -EMSGSIZE;
4293	}
4294
4295	nlmsg_end(skb, nlh);
4296	return 0;
4297}
4298
4299static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
4300				u32 portid, u32 seq, int event, unsigned int flags)
4301{
4302	struct nlmsghdr  *nlh;
4303	u8 scope = RT_SCOPE_UNIVERSE;
4304	int ifindex = ifaca->aca_idev->dev->ifindex;
4305
4306	if (ipv6_addr_scope(&ifaca->aca_addr) & IFA_SITE)
4307		scope = RT_SCOPE_SITE;
4308
4309	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
4310	if (!nlh)
4311		return -EMSGSIZE;
4312
4313	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
4314	if (nla_put_in6_addr(skb, IFA_ANYCAST, &ifaca->aca_addr) < 0 ||
4315	    put_cacheinfo(skb, ifaca->aca_cstamp, ifaca->aca_tstamp,
4316			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
4317		nlmsg_cancel(skb, nlh);
4318		return -EMSGSIZE;
4319	}
4320
4321	nlmsg_end(skb, nlh);
4322	return 0;
4323}
4324
4325enum addr_type_t {
4326	UNICAST_ADDR,
4327	MULTICAST_ADDR,
4328	ANYCAST_ADDR,
4329};
4330
4331/* called with rcu_read_lock() */
4332static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
4333			  struct netlink_callback *cb, enum addr_type_t type,
4334			  int s_ip_idx, int *p_ip_idx)
4335{
4336	struct ifmcaddr6 *ifmca;
4337	struct ifacaddr6 *ifaca;
4338	int err = 1;
4339	int ip_idx = *p_ip_idx;
4340
4341	read_lock_bh(&idev->lock);
4342	switch (type) {
4343	case UNICAST_ADDR: {
4344		struct inet6_ifaddr *ifa;
4345
4346		/* unicast address incl. temp addr */
4347		list_for_each_entry(ifa, &idev->addr_list, if_list) {
4348			if (++ip_idx < s_ip_idx)
4349				continue;
4350			err = inet6_fill_ifaddr(skb, ifa,
4351						NETLINK_CB(cb->skb).portid,
4352						cb->nlh->nlmsg_seq,
4353						RTM_NEWADDR,
4354						NLM_F_MULTI);
4355			if (err < 0)
4356				break;
4357			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4358		}
4359		break;
4360	}
4361	case MULTICAST_ADDR:
4362		/* multicast address */
4363		for (ifmca = idev->mc_list; ifmca;
4364		     ifmca = ifmca->next, ip_idx++) {
4365			if (ip_idx < s_ip_idx)
4366				continue;
4367			err = inet6_fill_ifmcaddr(skb, ifmca,
4368						  NETLINK_CB(cb->skb).portid,
4369						  cb->nlh->nlmsg_seq,
4370						  RTM_GETMULTICAST,
4371						  NLM_F_MULTI);
4372			if (err < 0)
4373				break;
4374		}
4375		break;
4376	case ANYCAST_ADDR:
4377		/* anycast address */
4378		for (ifaca = idev->ac_list; ifaca;
4379		     ifaca = ifaca->aca_next, ip_idx++) {
4380			if (ip_idx < s_ip_idx)
4381				continue;
4382			err = inet6_fill_ifacaddr(skb, ifaca,
4383						  NETLINK_CB(cb->skb).portid,
4384						  cb->nlh->nlmsg_seq,
4385						  RTM_GETANYCAST,
4386						  NLM_F_MULTI);
4387			if (err < 0)
4388				break;
4389		}
4390		break;
4391	default:
4392		break;
4393	}
4394	read_unlock_bh(&idev->lock);
4395	*p_ip_idx = ip_idx;
4396	return err;
4397}
4398
4399static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
4400			   enum addr_type_t type)
4401{
4402	struct net *net = sock_net(skb->sk);
4403	int h, s_h;
4404	int idx, ip_idx;
4405	int s_idx, s_ip_idx;
4406	struct net_device *dev;
4407	struct inet6_dev *idev;
4408	struct hlist_head *head;
4409
4410	s_h = cb->args[0];
4411	s_idx = idx = cb->args[1];
4412	s_ip_idx = ip_idx = cb->args[2];
4413
4414	rcu_read_lock();
4415	cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^ net->dev_base_seq;
4416	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
4417		idx = 0;
4418		head = &net->dev_index_head[h];
4419		hlist_for_each_entry_rcu(dev, head, index_hlist) {
4420			if (idx < s_idx)
4421				goto cont;
4422			if (h > s_h || idx > s_idx)
4423				s_ip_idx = 0;
4424			ip_idx = 0;
4425			idev = __in6_dev_get(dev);
4426			if (!idev)
4427				goto cont;
4428
4429			if (in6_dump_addrs(idev, skb, cb, type,
4430					   s_ip_idx, &ip_idx) < 0)
4431				goto done;
4432cont:
4433			idx++;
4434		}
4435	}
4436done:
4437	rcu_read_unlock();
4438	cb->args[0] = h;
4439	cb->args[1] = idx;
4440	cb->args[2] = ip_idx;
4441
4442	return skb->len;
4443}
4444
4445static int inet6_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
4446{
4447	enum addr_type_t type = UNICAST_ADDR;
4448
4449	return inet6_dump_addr(skb, cb, type);
4450}
4451
4452static int inet6_dump_ifmcaddr(struct sk_buff *skb, struct netlink_callback *cb)
4453{
4454	enum addr_type_t type = MULTICAST_ADDR;
4455
4456	return inet6_dump_addr(skb, cb, type);
4457}
4458
4459
4460static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
4461{
4462	enum addr_type_t type = ANYCAST_ADDR;
4463
4464	return inet6_dump_addr(skb, cb, type);
4465}
4466
4467static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh)
4468{
4469	struct net *net = sock_net(in_skb->sk);
4470	struct ifaddrmsg *ifm;
4471	struct nlattr *tb[IFA_MAX+1];
4472	struct in6_addr *addr = NULL, *peer;
4473	struct net_device *dev = NULL;
4474	struct inet6_ifaddr *ifa;
4475	struct sk_buff *skb;
4476	int err;
4477
4478	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
4479	if (err < 0)
4480		goto errout;
4481
4482	addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer);
4483	if (!addr) {
4484		err = -EINVAL;
4485		goto errout;
4486	}
4487
4488	ifm = nlmsg_data(nlh);
4489	if (ifm->ifa_index)
4490		dev = __dev_get_by_index(net, ifm->ifa_index);
4491
4492	ifa = ipv6_get_ifaddr(net, addr, dev, 1);
4493	if (!ifa) {
4494		err = -EADDRNOTAVAIL;
4495		goto errout;
4496	}
4497
4498	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_KERNEL);
4499	if (!skb) {
4500		err = -ENOBUFS;
4501		goto errout_ifa;
4502	}
4503
4504	err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).portid,
4505				nlh->nlmsg_seq, RTM_NEWADDR, 0);
4506	if (err < 0) {
4507		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
4508		WARN_ON(err == -EMSGSIZE);
4509		kfree_skb(skb);
4510		goto errout_ifa;
4511	}
4512	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
4513errout_ifa:
4514	in6_ifa_put(ifa);
4515errout:
4516	return err;
4517}
4518
4519static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
4520{
4521	struct sk_buff *skb;
4522	struct net *net = dev_net(ifa->idev->dev);
4523	int err = -ENOBUFS;
4524
4525	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_ATOMIC);
4526	if (!skb)
4527		goto errout;
4528
4529	err = inet6_fill_ifaddr(skb, ifa, 0, 0, event, 0);
4530	if (err < 0) {
4531		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
4532		WARN_ON(err == -EMSGSIZE);
4533		kfree_skb(skb);
4534		goto errout;
4535	}
4536	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
4537	return;
4538errout:
4539	if (err < 0)
4540		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err);
4541}
4542
4543static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
4544				__s32 *array, int bytes)
4545{
4546	BUG_ON(bytes < (DEVCONF_MAX * 4));
4547
4548	memset(array, 0, bytes);
4549	array[DEVCONF_FORWARDING] = cnf->forwarding;
4550	array[DEVCONF_HOPLIMIT] = cnf->hop_limit;
4551	array[DEVCONF_MTU6] = cnf->mtu6;
4552	array[DEVCONF_ACCEPT_RA] = cnf->accept_ra;
4553	array[DEVCONF_ACCEPT_REDIRECTS] = cnf->accept_redirects;
4554	array[DEVCONF_AUTOCONF] = cnf->autoconf;
4555	array[DEVCONF_DAD_TRANSMITS] = cnf->dad_transmits;
4556	array[DEVCONF_RTR_SOLICITS] = cnf->rtr_solicits;
4557	array[DEVCONF_RTR_SOLICIT_INTERVAL] =
4558		jiffies_to_msecs(cnf->rtr_solicit_interval);
4559	array[DEVCONF_RTR_SOLICIT_DELAY] =
4560		jiffies_to_msecs(cnf->rtr_solicit_delay);
4561	array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version;
4562	array[DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL] =
4563		jiffies_to_msecs(cnf->mldv1_unsolicited_report_interval);
4564	array[DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL] =
4565		jiffies_to_msecs(cnf->mldv2_unsolicited_report_interval);
4566	array[DEVCONF_USE_TEMPADDR] = cnf->use_tempaddr;
4567	array[DEVCONF_TEMP_VALID_LFT] = cnf->temp_valid_lft;
4568	array[DEVCONF_TEMP_PREFERED_LFT] = cnf->temp_prefered_lft;
4569	array[DEVCONF_REGEN_MAX_RETRY] = cnf->regen_max_retry;
4570	array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor;
4571	array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
4572	array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
4573	array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] = cnf->accept_ra_min_hop_limit;
4574	array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
4575#ifdef CONFIG_IPV6_ROUTER_PREF
4576	array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
4577	array[DEVCONF_RTR_PROBE_INTERVAL] =
4578		jiffies_to_msecs(cnf->rtr_probe_interval);
4579#ifdef CONFIG_IPV6_ROUTE_INFO
4580	array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
4581#endif
4582#endif
4583	array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;
4584	array[DEVCONF_ACCEPT_SOURCE_ROUTE] = cnf->accept_source_route;
4585#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
4586	array[DEVCONF_OPTIMISTIC_DAD] = cnf->optimistic_dad;
4587	array[DEVCONF_USE_OPTIMISTIC] = cnf->use_optimistic;
4588#endif
4589#ifdef CONFIG_IPV6_MROUTE
4590	array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding;
4591#endif
4592	array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
4593	array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
4594	array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
4595	array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
4596	array[DEVCONF_SUPPRESS_FRAG_NDISC] = cnf->suppress_frag_ndisc;
4597	array[DEVCONF_ACCEPT_RA_FROM_LOCAL] = cnf->accept_ra_from_local;
4598	array[DEVCONF_ACCEPT_RA_MTU] = cnf->accept_ra_mtu;
4599	/* we omit DEVCONF_STABLE_SECRET for now */
4600}
4601
4602static inline size_t inet6_ifla6_size(void)
4603{
4604	return nla_total_size(4) /* IFLA_INET6_FLAGS */
4605	     + nla_total_size(sizeof(struct ifla_cacheinfo))
4606	     + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
4607	     + nla_total_size(IPSTATS_MIB_MAX * 8) /* IFLA_INET6_STATS */
4608	     + nla_total_size(ICMP6_MIB_MAX * 8) /* IFLA_INET6_ICMP6STATS */
4609	     + nla_total_size(sizeof(struct in6_addr)); /* IFLA_INET6_TOKEN */
4610}
4611
4612static inline size_t inet6_if_nlmsg_size(void)
4613{
4614	return NLMSG_ALIGN(sizeof(struct ifinfomsg))
4615	       + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
4616	       + nla_total_size(MAX_ADDR_LEN) /* IFLA_ADDRESS */
4617	       + nla_total_size(4) /* IFLA_MTU */
4618	       + nla_total_size(4) /* IFLA_LINK */
4619	       + nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */
4620}
4621
4622static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
4623				      int items, int bytes)
4624{
4625	int i;
4626	int pad = bytes - sizeof(u64) * items;
4627	BUG_ON(pad < 0);
4628
4629	/* Use put_unaligned() because stats may not be aligned for u64. */
4630	put_unaligned(items, &stats[0]);
4631	for (i = 1; i < items; i++)
4632		put_unaligned(atomic_long_read(&mib[i]), &stats[i]);
4633
4634	memset(&stats[items], 0, pad);
4635}
4636
4637static inline void __snmp6_fill_stats64(u64 *stats, void __percpu *mib,
4638				      int items, int bytes, size_t syncpoff)
4639{
4640	int i;
4641	int pad = bytes - sizeof(u64) * items;
4642	BUG_ON(pad < 0);
4643
4644	/* Use put_unaligned() because stats may not be aligned for u64. */
4645	put_unaligned(items, &stats[0]);
4646	for (i = 1; i < items; i++)
4647		put_unaligned(snmp_fold_field64(mib, i, syncpoff), &stats[i]);
4648
4649	memset(&stats[items], 0, pad);
4650}
4651
4652static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
4653			     int bytes)
4654{
4655	switch (attrtype) {
4656	case IFLA_INET6_STATS:
4657		__snmp6_fill_stats64(stats, idev->stats.ipv6,
4658				     IPSTATS_MIB_MAX, bytes, offsetof(struct ipstats_mib, syncp));
4659		break;
4660	case IFLA_INET6_ICMP6STATS:
4661		__snmp6_fill_statsdev(stats, idev->stats.icmpv6dev->mibs, ICMP6_MIB_MAX, bytes);
4662		break;
4663	}
4664}
4665
4666static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev)
4667{
4668	struct nlattr *nla;
4669	struct ifla_cacheinfo ci;
4670
4671	if (nla_put_u32(skb, IFLA_INET6_FLAGS, idev->if_flags))
4672		goto nla_put_failure;
4673	ci.max_reasm_len = IPV6_MAXPLEN;
4674	ci.tstamp = cstamp_delta(idev->tstamp);
4675	ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
4676	ci.retrans_time = jiffies_to_msecs(NEIGH_VAR(idev->nd_parms, RETRANS_TIME));
4677	if (nla_put(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci))
4678		goto nla_put_failure;
4679	nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
4680	if (!nla)
4681		goto nla_put_failure;
4682	ipv6_store_devconf(&idev->cnf, nla_data(nla), nla_len(nla));
4683
4684	/* XXX - MC not implemented */
4685
4686	nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
4687	if (!nla)
4688		goto nla_put_failure;
4689	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
4690
4691	nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
4692	if (!nla)
4693		goto nla_put_failure;
4694	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
4695
4696	nla = nla_reserve(skb, IFLA_INET6_TOKEN, sizeof(struct in6_addr));
4697	if (!nla)
4698		goto nla_put_failure;
4699
4700	if (nla_put_u8(skb, IFLA_INET6_ADDR_GEN_MODE, idev->addr_gen_mode))
4701		goto nla_put_failure;
4702
4703	read_lock_bh(&idev->lock);
4704	memcpy(nla_data(nla), idev->token.s6_addr, nla_len(nla));
4705	read_unlock_bh(&idev->lock);
4706
4707	return 0;
4708
4709nla_put_failure:
4710	return -EMSGSIZE;
4711}
4712
4713static size_t inet6_get_link_af_size(const struct net_device *dev)
4714{
4715	if (!__in6_dev_get(dev))
4716		return 0;
4717
4718	return inet6_ifla6_size();
4719}
4720
4721static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev)
4722{
4723	struct inet6_dev *idev = __in6_dev_get(dev);
4724
4725	if (!idev)
4726		return -ENODATA;
4727
4728	if (inet6_fill_ifla6_attrs(skb, idev) < 0)
4729		return -EMSGSIZE;
4730
4731	return 0;
4732}
4733
4734static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
4735{
4736	struct inet6_ifaddr *ifp;
4737	struct net_device *dev = idev->dev;
4738	bool update_rs = false;
4739	struct in6_addr ll_addr;
4740
4741	ASSERT_RTNL();
4742
4743	if (!token)
4744		return -EINVAL;
4745	if (ipv6_addr_any(token))
4746		return -EINVAL;
4747	if (dev->flags & (IFF_LOOPBACK | IFF_NOARP))
4748		return -EINVAL;
4749	if (!ipv6_accept_ra(idev))
4750		return -EINVAL;
4751	if (idev->cnf.rtr_solicits <= 0)
4752		return -EINVAL;
4753
4754	write_lock_bh(&idev->lock);
4755
4756	BUILD_BUG_ON(sizeof(token->s6_addr) != 16);
4757	memcpy(idev->token.s6_addr + 8, token->s6_addr + 8, 8);
4758
4759	write_unlock_bh(&idev->lock);
4760
4761	if (!idev->dead && (idev->if_flags & IF_READY) &&
4762	    !ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE |
4763			     IFA_F_OPTIMISTIC)) {
4764
4765		/* If we're not ready, then normal ifup will take care
4766		 * of this. Otherwise, we need to request our rs here.
4767		 */
4768		ndisc_send_rs(dev, &ll_addr, &in6addr_linklocal_allrouters);
4769		update_rs = true;
4770	}
4771
4772	write_lock_bh(&idev->lock);
4773
4774	if (update_rs) {
4775		idev->if_flags |= IF_RS_SENT;
4776		idev->rs_probes = 1;
4777		addrconf_mod_rs_timer(idev, idev->cnf.rtr_solicit_interval);
4778	}
4779
4780	/* Well, that's kinda nasty ... */
4781	list_for_each_entry(ifp, &idev->addr_list, if_list) {
4782		spin_lock(&ifp->lock);
4783		if (ifp->tokenized) {
4784			ifp->valid_lft = 0;
4785			ifp->prefered_lft = 0;
4786		}
4787		spin_unlock(&ifp->lock);
4788	}
4789
4790	write_unlock_bh(&idev->lock);
4791	inet6_ifinfo_notify(RTM_NEWLINK, idev);
4792	addrconf_verify_rtnl();
4793	return 0;
4794}
4795
4796static const struct nla_policy inet6_af_policy[IFLA_INET6_MAX + 1] = {
4797	[IFLA_INET6_ADDR_GEN_MODE]	= { .type = NLA_U8 },
4798	[IFLA_INET6_TOKEN]		= { .len = sizeof(struct in6_addr) },
4799};
4800
4801static int inet6_validate_link_af(const struct net_device *dev,
4802				  const struct nlattr *nla)
4803{
4804	struct nlattr *tb[IFLA_INET6_MAX + 1];
4805
4806	if (dev && !__in6_dev_get(dev))
4807		return -EAFNOSUPPORT;
4808
4809	return nla_parse_nested(tb, IFLA_INET6_MAX, nla, inet6_af_policy);
4810}
4811
4812static int inet6_set_link_af(struct net_device *dev, const struct nlattr *nla)
4813{
4814	int err = -EINVAL;
4815	struct inet6_dev *idev = __in6_dev_get(dev);
4816	struct nlattr *tb[IFLA_INET6_MAX + 1];
4817
4818	if (!idev)
4819		return -EAFNOSUPPORT;
4820
4821	if (nla_parse_nested(tb, IFLA_INET6_MAX, nla, NULL) < 0)
4822		BUG();
4823
4824	if (tb[IFLA_INET6_TOKEN]) {
4825		err = inet6_set_iftoken(idev, nla_data(tb[IFLA_INET6_TOKEN]));
4826		if (err)
4827			return err;
4828	}
4829
4830	if (tb[IFLA_INET6_ADDR_GEN_MODE]) {
4831		u8 mode = nla_get_u8(tb[IFLA_INET6_ADDR_GEN_MODE]);
4832
4833		if (mode != IN6_ADDR_GEN_MODE_EUI64 &&
4834		    mode != IN6_ADDR_GEN_MODE_NONE &&
4835		    mode != IN6_ADDR_GEN_MODE_STABLE_PRIVACY)
4836			return -EINVAL;
4837
4838		if (mode == IN6_ADDR_GEN_MODE_STABLE_PRIVACY &&
4839		    !idev->cnf.stable_secret.initialized &&
4840		    !dev_net(dev)->ipv6.devconf_dflt->stable_secret.initialized)
4841			return -EINVAL;
4842
4843		idev->addr_gen_mode = mode;
4844		err = 0;
4845	}
4846
4847	return err;
4848}
4849
4850static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
4851			     u32 portid, u32 seq, int event, unsigned int flags)
4852{
4853	struct net_device *dev = idev->dev;
4854	struct ifinfomsg *hdr;
4855	struct nlmsghdr *nlh;
4856	void *protoinfo;
4857
4858	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*hdr), flags);
4859	if (!nlh)
4860		return -EMSGSIZE;
4861
4862	hdr = nlmsg_data(nlh);
4863	hdr->ifi_family = AF_INET6;
4864	hdr->__ifi_pad = 0;
4865	hdr->ifi_type = dev->type;
4866	hdr->ifi_index = dev->ifindex;
4867	hdr->ifi_flags = dev_get_flags(dev);
4868	hdr->ifi_change = 0;
4869
4870	if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
4871	    (dev->addr_len &&
4872	     nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr)) ||
4873	    nla_put_u32(skb, IFLA_MTU, dev->mtu) ||
4874	    (dev->ifindex != dev_get_iflink(dev) &&
4875	     nla_put_u32(skb, IFLA_LINK, dev_get_iflink(dev))))
4876		goto nla_put_failure;
4877	protoinfo = nla_nest_start(skb, IFLA_PROTINFO);
4878	if (!protoinfo)
4879		goto nla_put_failure;
4880
4881	if (inet6_fill_ifla6_attrs(skb, idev) < 0)
4882		goto nla_put_failure;
4883
4884	nla_nest_end(skb, protoinfo);
4885	nlmsg_end(skb, nlh);
4886	return 0;
4887
4888nla_put_failure:
4889	nlmsg_cancel(skb, nlh);
4890	return -EMSGSIZE;
4891}
4892
4893static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
4894{
4895	struct net *net = sock_net(skb->sk);
4896	int h, s_h;
4897	int idx = 0, s_idx;
4898	struct net_device *dev;
4899	struct inet6_dev *idev;
4900	struct hlist_head *head;
4901
4902	s_h = cb->args[0];
4903	s_idx = cb->args[1];
4904
4905	rcu_read_lock();
4906	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
4907		idx = 0;
4908		head = &net->dev_index_head[h];
4909		hlist_for_each_entry_rcu(dev, head, index_hlist) {
4910			if (idx < s_idx)
4911				goto cont;
4912			idev = __in6_dev_get(dev);
4913			if (!idev)
4914				goto cont;
4915			if (inet6_fill_ifinfo(skb, idev,
4916					      NETLINK_CB(cb->skb).portid,
4917					      cb->nlh->nlmsg_seq,
4918					      RTM_NEWLINK, NLM_F_MULTI) < 0)
4919				goto out;
4920cont:
4921			idx++;
4922		}
4923	}
4924out:
4925	rcu_read_unlock();
4926	cb->args[1] = idx;
4927	cb->args[0] = h;
4928
4929	return skb->len;
4930}
4931
4932void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
4933{
4934	struct sk_buff *skb;
4935	struct net *net = dev_net(idev->dev);
4936	int err = -ENOBUFS;
4937
4938	skb = nlmsg_new(inet6_if_nlmsg_size(), GFP_ATOMIC);
4939	if (!skb)
4940		goto errout;
4941
4942	err = inet6_fill_ifinfo(skb, idev, 0, 0, event, 0);
4943	if (err < 0) {
4944		/* -EMSGSIZE implies BUG in inet6_if_nlmsg_size() */
4945		WARN_ON(err == -EMSGSIZE);
4946		kfree_skb(skb);
4947		goto errout;
4948	}
4949	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFINFO, NULL, GFP_ATOMIC);
4950	return;
4951errout:
4952	if (err < 0)
4953		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFINFO, err);
4954}
4955
4956static inline size_t inet6_prefix_nlmsg_size(void)
4957{
4958	return NLMSG_ALIGN(sizeof(struct prefixmsg))
4959	       + nla_total_size(sizeof(struct in6_addr))
4960	       + nla_total_size(sizeof(struct prefix_cacheinfo));
4961}
4962
4963static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
4964			     struct prefix_info *pinfo, u32 portid, u32 seq,
4965			     int event, unsigned int flags)
4966{
4967	struct prefixmsg *pmsg;
4968	struct nlmsghdr *nlh;
4969	struct prefix_cacheinfo	ci;
4970
4971	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*pmsg), flags);
4972	if (!nlh)
4973		return -EMSGSIZE;
4974
4975	pmsg = nlmsg_data(nlh);
4976	pmsg->prefix_family = AF_INET6;
4977	pmsg->prefix_pad1 = 0;
4978	pmsg->prefix_pad2 = 0;
4979	pmsg->prefix_ifindex = idev->dev->ifindex;
4980	pmsg->prefix_len = pinfo->prefix_len;
4981	pmsg->prefix_type = pinfo->type;
4982	pmsg->prefix_pad3 = 0;
4983	pmsg->prefix_flags = 0;
4984	if (pinfo->onlink)
4985		pmsg->prefix_flags |= IF_PREFIX_ONLINK;
4986	if (pinfo->autoconf)
4987		pmsg->prefix_flags |= IF_PREFIX_AUTOCONF;
4988
4989	if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix))
4990		goto nla_put_failure;
4991	ci.preferred_time = ntohl(pinfo->prefered);
4992	ci.valid_time = ntohl(pinfo->valid);
4993	if (nla_put(skb, PREFIX_CACHEINFO, sizeof(ci), &ci))
4994		goto nla_put_failure;
4995	nlmsg_end(skb, nlh);
4996	return 0;
4997
4998nla_put_failure:
4999	nlmsg_cancel(skb, nlh);
5000	return -EMSGSIZE;
5001}
5002
5003static void inet6_prefix_notify(int event, struct inet6_dev *idev,
5004			 struct prefix_info *pinfo)
5005{
5006	struct sk_buff *skb;
5007	struct net *net = dev_net(idev->dev);
5008	int err = -ENOBUFS;
5009
5010	skb = nlmsg_new(inet6_prefix_nlmsg_size(), GFP_ATOMIC);
5011	if (!skb)
5012		goto errout;
5013
5014	err = inet6_fill_prefix(skb, idev, pinfo, 0, 0, event, 0);
5015	if (err < 0) {
5016		/* -EMSGSIZE implies BUG in inet6_prefix_nlmsg_size() */
5017		WARN_ON(err == -EMSGSIZE);
5018		kfree_skb(skb);
5019		goto errout;
5020	}
5021	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
5022	return;
5023errout:
5024	if (err < 0)
5025		rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
5026}
5027
5028static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
5029{
5030	struct net *net = dev_net(ifp->idev->dev);
5031
5032	if (event)
5033		ASSERT_RTNL();
5034
5035	inet6_ifa_notify(event ? : RTM_NEWADDR, ifp);
5036
5037	switch (event) {
5038	case RTM_NEWADDR:
5039		/*
5040		 * If the address was optimistic
5041		 * we inserted the route at the start of
5042		 * our DAD process, so we don't need
5043		 * to do it again
5044		 */
5045		if (!(ifp->rt->rt6i_node))
5046			ip6_ins_rt(ifp->rt);
5047		if (ifp->idev->cnf.forwarding)
5048			addrconf_join_anycast(ifp);
5049		if (!ipv6_addr_any(&ifp->peer_addr))
5050			addrconf_prefix_route(&ifp->peer_addr, 128,
5051					      ifp->idev->dev, 0, 0);
5052		break;
5053	case RTM_DELADDR:
5054		if (ifp->idev->cnf.forwarding)
5055			addrconf_leave_anycast(ifp);
5056		addrconf_leave_solict(ifp->idev, &ifp->addr);
5057		if (!ipv6_addr_any(&ifp->peer_addr)) {
5058			struct rt6_info *rt;
5059
5060			rt = addrconf_get_prefix_route(&ifp->peer_addr, 128,
5061						       ifp->idev->dev, 0, 0);
5062			if (rt && ip6_del_rt(rt))
5063				dst_free(&rt->dst);
5064		}
5065		dst_hold(&ifp->rt->dst);
5066
5067		if (ip6_del_rt(ifp->rt))
5068			dst_free(&ifp->rt->dst);
5069
5070		rt_genid_bump_ipv6(net);
5071		break;
5072	}
5073	atomic_inc(&net->ipv6.dev_addr_genid);
5074}
5075
5076static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
5077{
5078	rcu_read_lock_bh();
5079	if (likely(ifp->idev->dead == 0))
5080		__ipv6_ifa_notify(event, ifp);
5081	rcu_read_unlock_bh();
5082}
5083
5084#ifdef CONFIG_SYSCTL
5085
5086static
5087int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
5088			   void __user *buffer, size_t *lenp, loff_t *ppos)
5089{
5090	int *valp = ctl->data;
5091	int val = *valp;
5092	loff_t pos = *ppos;
5093	struct ctl_table lctl;
5094	int ret;
5095
5096	/*
5097	 * ctl->data points to idev->cnf.forwarding, we should
5098	 * not modify it until we get the rtnl lock.
5099	 */
5100	lctl = *ctl;
5101	lctl.data = &val;
5102
5103	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
5104
5105	if (write)
5106		ret = addrconf_fixup_forwarding(ctl, valp, val);
5107	if (ret)
5108		*ppos = pos;
5109	return ret;
5110}
5111
5112static
5113int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
5114			void __user *buffer, size_t *lenp, loff_t *ppos)
5115{
5116	struct inet6_dev *idev = ctl->extra1;
5117	int min_mtu = IPV6_MIN_MTU;
5118	struct ctl_table lctl;
5119
5120	lctl = *ctl;
5121	lctl.extra1 = &min_mtu;
5122	lctl.extra2 = idev ? &idev->dev->mtu : NULL;
5123
5124	return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
5125}
5126
5127static void dev_disable_change(struct inet6_dev *idev)
5128{
5129	struct netdev_notifier_info info;
5130
5131	if (!idev || !idev->dev)
5132		return;
5133
5134	netdev_notifier_info_init(&info, idev->dev);
5135	if (idev->cnf.disable_ipv6)
5136		addrconf_notify(NULL, NETDEV_DOWN, &info);
5137	else
5138		addrconf_notify(NULL, NETDEV_UP, &info);
5139}
5140
5141static void addrconf_disable_change(struct net *net, __s32 newf)
5142{
5143	struct net_device *dev;
5144	struct inet6_dev *idev;
5145
5146	rcu_read_lock();
5147	for_each_netdev_rcu(net, dev) {
5148		idev = __in6_dev_get(dev);
5149		if (idev) {
5150			int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
5151			idev->cnf.disable_ipv6 = newf;
5152			if (changed)
5153				dev_disable_change(idev);
5154		}
5155	}
5156	rcu_read_unlock();
5157}
5158
5159static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
5160{
5161	struct net *net;
5162	int old;
5163
5164	if (!rtnl_trylock())
5165		return restart_syscall();
5166
5167	net = (struct net *)table->extra2;
5168	old = *p;
5169	*p = newf;
5170
5171	if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
5172		rtnl_unlock();
5173		return 0;
5174	}
5175
5176	if (p == &net->ipv6.devconf_all->disable_ipv6) {
5177		net->ipv6.devconf_dflt->disable_ipv6 = newf;
5178		addrconf_disable_change(net, newf);
5179	} else if ((!newf) ^ (!old))
5180		dev_disable_change((struct inet6_dev *)table->extra1);
5181
5182	rtnl_unlock();
5183	return 0;
5184}
5185
5186static
5187int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
5188			    void __user *buffer, size_t *lenp, loff_t *ppos)
5189{
5190	int *valp = ctl->data;
5191	int val = *valp;
5192	loff_t pos = *ppos;
5193	struct ctl_table lctl;
5194	int ret;
5195
5196	/*
5197	 * ctl->data points to idev->cnf.disable_ipv6, we should
5198	 * not modify it until we get the rtnl lock.
5199	 */
5200	lctl = *ctl;
5201	lctl.data = &val;
5202
5203	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
5204
5205	if (write)
5206		ret = addrconf_disable_ipv6(ctl, valp, val);
5207	if (ret)
5208		*ppos = pos;
5209	return ret;
5210}
5211
5212static
5213int addrconf_sysctl_proxy_ndp(struct ctl_table *ctl, int write,
5214			      void __user *buffer, size_t *lenp, loff_t *ppos)
5215{
5216	int *valp = ctl->data;
5217	int ret;
5218	int old, new;
5219
5220	old = *valp;
5221	ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
5222	new = *valp;
5223
5224	if (write && old != new) {
5225		struct net *net = ctl->extra2;
5226
5227		if (!rtnl_trylock())
5228			return restart_syscall();
5229
5230		if (valp == &net->ipv6.devconf_dflt->proxy_ndp)
5231			inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
5232						     NETCONFA_IFINDEX_DEFAULT,
5233						     net->ipv6.devconf_dflt);
5234		else if (valp == &net->ipv6.devconf_all->proxy_ndp)
5235			inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
5236						     NETCONFA_IFINDEX_ALL,
5237						     net->ipv6.devconf_all);
5238		else {
5239			struct inet6_dev *idev = ctl->extra1;
5240
5241			inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
5242						     idev->dev->ifindex,
5243						     &idev->cnf);
5244		}
5245		rtnl_unlock();
5246	}
5247
5248	return ret;
5249}
5250
5251static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
5252					 void __user *buffer, size_t *lenp,
5253					 loff_t *ppos)
5254{
5255	int err;
5256	struct in6_addr addr;
5257	char str[IPV6_MAX_STRLEN];
5258	struct ctl_table lctl = *ctl;
5259	struct net *net = ctl->extra2;
5260	struct ipv6_stable_secret *secret = ctl->data;
5261
5262	if (&net->ipv6.devconf_all->stable_secret == ctl->data)
5263		return -EIO;
5264
5265	lctl.maxlen = IPV6_MAX_STRLEN;
5266	lctl.data = str;
5267
5268	if (!rtnl_trylock())
5269		return restart_syscall();
5270
5271	if (!write && !secret->initialized) {
5272		err = -EIO;
5273		goto out;
5274	}
5275
5276	err = snprintf(str, sizeof(str), "%pI6", &secret->secret);
5277	if (err >= sizeof(str)) {
5278		err = -EIO;
5279		goto out;
5280	}
5281
5282	err = proc_dostring(&lctl, write, buffer, lenp, ppos);
5283	if (err || !write)
5284		goto out;
5285
5286	if (in6_pton(str, -1, addr.in6_u.u6_addr8, -1, NULL) != 1) {
5287		err = -EIO;
5288		goto out;
5289	}
5290
5291	secret->initialized = true;
5292	secret->secret = addr;
5293
5294	if (&net->ipv6.devconf_dflt->stable_secret == ctl->data) {
5295		struct net_device *dev;
5296
5297		for_each_netdev(net, dev) {
5298			struct inet6_dev *idev = __in6_dev_get(dev);
5299
5300			if (idev) {
5301				idev->addr_gen_mode =
5302					IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
5303			}
5304		}
5305	} else {
5306		struct inet6_dev *idev = ctl->extra1;
5307
5308		idev->addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
5309	}
5310
5311out:
5312	rtnl_unlock();
5313
5314	return err;
5315}
5316
5317static struct addrconf_sysctl_table
5318{
5319	struct ctl_table_header *sysctl_header;
5320	struct ctl_table addrconf_vars[DEVCONF_MAX+1];
5321} addrconf_sysctl __read_mostly = {
5322	.sysctl_header = NULL,
5323	.addrconf_vars = {
5324		{
5325			.procname	= "forwarding",
5326			.data		= &ipv6_devconf.forwarding,
5327			.maxlen		= sizeof(int),
5328			.mode		= 0644,
5329			.proc_handler	= addrconf_sysctl_forward,
5330		},
5331		{
5332			.procname	= "hop_limit",
5333			.data		= &ipv6_devconf.hop_limit,
5334			.maxlen		= sizeof(int),
5335			.mode		= 0644,
5336			.proc_handler	= proc_dointvec,
5337		},
5338		{
5339			.procname	= "mtu",
5340			.data		= &ipv6_devconf.mtu6,
5341			.maxlen		= sizeof(int),
5342			.mode		= 0644,
5343			.proc_handler	= addrconf_sysctl_mtu,
5344		},
5345		{
5346			.procname	= "accept_ra",
5347			.data		= &ipv6_devconf.accept_ra,
5348			.maxlen		= sizeof(int),
5349			.mode		= 0644,
5350			.proc_handler	= proc_dointvec,
5351		},
5352		{
5353			.procname	= "accept_redirects",
5354			.data		= &ipv6_devconf.accept_redirects,
5355			.maxlen		= sizeof(int),
5356			.mode		= 0644,
5357			.proc_handler	= proc_dointvec,
5358		},
5359		{
5360			.procname	= "autoconf",
5361			.data		= &ipv6_devconf.autoconf,
5362			.maxlen		= sizeof(int),
5363			.mode		= 0644,
5364			.proc_handler	= proc_dointvec,
5365		},
5366		{
5367			.procname	= "dad_transmits",
5368			.data		= &ipv6_devconf.dad_transmits,
5369			.maxlen		= sizeof(int),
5370			.mode		= 0644,
5371			.proc_handler	= proc_dointvec,
5372		},
5373		{
5374			.procname	= "router_solicitations",
5375			.data		= &ipv6_devconf.rtr_solicits,
5376			.maxlen		= sizeof(int),
5377			.mode		= 0644,
5378			.proc_handler	= proc_dointvec,
5379		},
5380		{
5381			.procname	= "router_solicitation_interval",
5382			.data		= &ipv6_devconf.rtr_solicit_interval,
5383			.maxlen		= sizeof(int),
5384			.mode		= 0644,
5385			.proc_handler	= proc_dointvec_jiffies,
5386		},
5387		{
5388			.procname	= "router_solicitation_delay",
5389			.data		= &ipv6_devconf.rtr_solicit_delay,
5390			.maxlen		= sizeof(int),
5391			.mode		= 0644,
5392			.proc_handler	= proc_dointvec_jiffies,
5393		},
5394		{
5395			.procname	= "force_mld_version",
5396			.data		= &ipv6_devconf.force_mld_version,
5397			.maxlen		= sizeof(int),
5398			.mode		= 0644,
5399			.proc_handler	= proc_dointvec,
5400		},
5401		{
5402			.procname	= "mldv1_unsolicited_report_interval",
5403			.data		=
5404				&ipv6_devconf.mldv1_unsolicited_report_interval,
5405			.maxlen		= sizeof(int),
5406			.mode		= 0644,
5407			.proc_handler	= proc_dointvec_ms_jiffies,
5408		},
5409		{
5410			.procname	= "mldv2_unsolicited_report_interval",
5411			.data		=
5412				&ipv6_devconf.mldv2_unsolicited_report_interval,
5413			.maxlen		= sizeof(int),
5414			.mode		= 0644,
5415			.proc_handler	= proc_dointvec_ms_jiffies,
5416		},
5417		{
5418			.procname	= "use_tempaddr",
5419			.data		= &ipv6_devconf.use_tempaddr,
5420			.maxlen		= sizeof(int),
5421			.mode		= 0644,
5422			.proc_handler	= proc_dointvec,
5423		},
5424		{
5425			.procname	= "temp_valid_lft",
5426			.data		= &ipv6_devconf.temp_valid_lft,
5427			.maxlen		= sizeof(int),
5428			.mode		= 0644,
5429			.proc_handler	= proc_dointvec,
5430		},
5431		{
5432			.procname	= "temp_prefered_lft",
5433			.data		= &ipv6_devconf.temp_prefered_lft,
5434			.maxlen		= sizeof(int),
5435			.mode		= 0644,
5436			.proc_handler	= proc_dointvec,
5437		},
5438		{
5439			.procname	= "regen_max_retry",
5440			.data		= &ipv6_devconf.regen_max_retry,
5441			.maxlen		= sizeof(int),
5442			.mode		= 0644,
5443			.proc_handler	= proc_dointvec,
5444		},
5445		{
5446			.procname	= "max_desync_factor",
5447			.data		= &ipv6_devconf.max_desync_factor,
5448			.maxlen		= sizeof(int),
5449			.mode		= 0644,
5450			.proc_handler	= proc_dointvec,
5451		},
5452		{
5453			.procname	= "max_addresses",
5454			.data		= &ipv6_devconf.max_addresses,
5455			.maxlen		= sizeof(int),
5456			.mode		= 0644,
5457			.proc_handler	= proc_dointvec,
5458		},
5459		{
5460			.procname	= "accept_ra_defrtr",
5461			.data		= &ipv6_devconf.accept_ra_defrtr,
5462			.maxlen		= sizeof(int),
5463			.mode		= 0644,
5464			.proc_handler	= proc_dointvec,
5465		},
5466		{
5467			.procname	= "accept_ra_min_hop_limit",
5468			.data		= &ipv6_devconf.accept_ra_min_hop_limit,
5469			.maxlen		= sizeof(int),
5470			.mode		= 0644,
5471			.proc_handler	= proc_dointvec,
5472		},
5473		{
5474			.procname	= "accept_ra_pinfo",
5475			.data		= &ipv6_devconf.accept_ra_pinfo,
5476			.maxlen		= sizeof(int),
5477			.mode		= 0644,
5478			.proc_handler	= proc_dointvec,
5479		},
5480#ifdef CONFIG_IPV6_ROUTER_PREF
5481		{
5482			.procname	= "accept_ra_rtr_pref",
5483			.data		= &ipv6_devconf.accept_ra_rtr_pref,
5484			.maxlen		= sizeof(int),
5485			.mode		= 0644,
5486			.proc_handler	= proc_dointvec,
5487		},
5488		{
5489			.procname	= "router_probe_interval",
5490			.data		= &ipv6_devconf.rtr_probe_interval,
5491			.maxlen		= sizeof(int),
5492			.mode		= 0644,
5493			.proc_handler	= proc_dointvec_jiffies,
5494		},
5495#ifdef CONFIG_IPV6_ROUTE_INFO
5496		{
5497			.procname	= "accept_ra_rt_info_max_plen",
5498			.data		= &ipv6_devconf.accept_ra_rt_info_max_plen,
5499			.maxlen		= sizeof(int),
5500			.mode		= 0644,
5501			.proc_handler	= proc_dointvec,
5502		},
5503#endif
5504#endif
5505		{
5506			.procname	= "proxy_ndp",
5507			.data		= &ipv6_devconf.proxy_ndp,
5508			.maxlen		= sizeof(int),
5509			.mode		= 0644,
5510			.proc_handler	= addrconf_sysctl_proxy_ndp,
5511		},
5512		{
5513			.procname	= "accept_source_route",
5514			.data		= &ipv6_devconf.accept_source_route,
5515			.maxlen		= sizeof(int),
5516			.mode		= 0644,
5517			.proc_handler	= proc_dointvec,
5518		},
5519#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
5520		{
5521			.procname       = "optimistic_dad",
5522			.data           = &ipv6_devconf.optimistic_dad,
5523			.maxlen         = sizeof(int),
5524			.mode           = 0644,
5525			.proc_handler   = proc_dointvec,
5526
5527		},
5528		{
5529			.procname       = "use_optimistic",
5530			.data           = &ipv6_devconf.use_optimistic,
5531			.maxlen         = sizeof(int),
5532			.mode           = 0644,
5533			.proc_handler   = proc_dointvec,
5534
5535		},
5536#endif
5537#ifdef CONFIG_IPV6_MROUTE
5538		{
5539			.procname	= "mc_forwarding",
5540			.data		= &ipv6_devconf.mc_forwarding,
5541			.maxlen		= sizeof(int),
5542			.mode		= 0444,
5543			.proc_handler	= proc_dointvec,
5544		},
5545#endif
5546		{
5547			.procname	= "disable_ipv6",
5548			.data		= &ipv6_devconf.disable_ipv6,
5549			.maxlen		= sizeof(int),
5550			.mode		= 0644,
5551			.proc_handler	= addrconf_sysctl_disable,
5552		},
5553		{
5554			.procname	= "accept_dad",
5555			.data		= &ipv6_devconf.accept_dad,
5556			.maxlen		= sizeof(int),
5557			.mode		= 0644,
5558			.proc_handler	= proc_dointvec,
5559		},
5560		{
5561			.procname       = "force_tllao",
5562			.data           = &ipv6_devconf.force_tllao,
5563			.maxlen         = sizeof(int),
5564			.mode           = 0644,
5565			.proc_handler   = proc_dointvec
5566		},
5567		{
5568			.procname       = "ndisc_notify",
5569			.data           = &ipv6_devconf.ndisc_notify,
5570			.maxlen         = sizeof(int),
5571			.mode           = 0644,
5572			.proc_handler   = proc_dointvec
5573		},
5574		{
5575			.procname	= "suppress_frag_ndisc",
5576			.data		= &ipv6_devconf.suppress_frag_ndisc,
5577			.maxlen		= sizeof(int),
5578			.mode		= 0644,
5579			.proc_handler	= proc_dointvec
5580		},
5581		{
5582			.procname	= "accept_ra_from_local",
5583			.data		= &ipv6_devconf.accept_ra_from_local,
5584			.maxlen		= sizeof(int),
5585			.mode		= 0644,
5586			.proc_handler	= proc_dointvec,
5587		},
5588		{
5589			.procname	= "accept_ra_mtu",
5590			.data		= &ipv6_devconf.accept_ra_mtu,
5591			.maxlen		= sizeof(int),
5592			.mode		= 0644,
5593			.proc_handler	= proc_dointvec,
5594		},
5595		{
5596			.procname	= "stable_secret",
5597			.data		= &ipv6_devconf.stable_secret,
5598			.maxlen		= IPV6_MAX_STRLEN,
5599			.mode		= 0600,
5600			.proc_handler	= addrconf_sysctl_stable_secret,
5601		},
5602		{
5603			/* sentinel */
5604		}
5605	},
5606};
5607
5608static int __addrconf_sysctl_register(struct net *net, char *dev_name,
5609		struct inet6_dev *idev, struct ipv6_devconf *p)
5610{
5611	int i;
5612	struct addrconf_sysctl_table *t;
5613	char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
5614
5615	t = kmemdup(&addrconf_sysctl, sizeof(*t), GFP_KERNEL);
5616	if (!t)
5617		goto out;
5618
5619	for (i = 0; t->addrconf_vars[i].data; i++) {
5620		t->addrconf_vars[i].data += (char *)p - (char *)&ipv6_devconf;
5621		t->addrconf_vars[i].extra1 = idev; /* embedded; no ref */
5622		t->addrconf_vars[i].extra2 = net;
5623	}
5624
5625	snprintf(path, sizeof(path), "net/ipv6/conf/%s", dev_name);
5626
5627	t->sysctl_header = register_net_sysctl(net, path, t->addrconf_vars);
5628	if (!t->sysctl_header)
5629		goto free;
5630
5631	p->sysctl = t;
5632	return 0;
5633
5634free:
5635	kfree(t);
5636out:
5637	return -ENOBUFS;
5638}
5639
5640static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
5641{
5642	struct addrconf_sysctl_table *t;
5643
5644	if (!p->sysctl)
5645		return;
5646
5647	t = p->sysctl;
5648	p->sysctl = NULL;
5649	unregister_net_sysctl_table(t->sysctl_header);
5650	kfree(t);
5651}
5652
5653static int addrconf_sysctl_register(struct inet6_dev *idev)
5654{
5655	int err;
5656
5657	if (!sysctl_dev_name_is_allowed(idev->dev->name))
5658		return -EINVAL;
5659
5660	err = neigh_sysctl_register(idev->dev, idev->nd_parms,
5661				    &ndisc_ifinfo_sysctl_change);
5662	if (err)
5663		return err;
5664	err = __addrconf_sysctl_register(dev_net(idev->dev), idev->dev->name,
5665					 idev, &idev->cnf);
5666	if (err)
5667		neigh_sysctl_unregister(idev->nd_parms);
5668
5669	return err;
5670}
5671
5672static void addrconf_sysctl_unregister(struct inet6_dev *idev)
5673{
5674	__addrconf_sysctl_unregister(&idev->cnf);
5675	neigh_sysctl_unregister(idev->nd_parms);
5676}
5677
5678
5679#endif
5680
5681static int __net_init addrconf_init_net(struct net *net)
5682{
5683	int err = -ENOMEM;
5684	struct ipv6_devconf *all, *dflt;
5685
5686	all = kmemdup(&ipv6_devconf, sizeof(ipv6_devconf), GFP_KERNEL);
5687	if (!all)
5688		goto err_alloc_all;
5689
5690	dflt = kmemdup(&ipv6_devconf_dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
5691	if (!dflt)
5692		goto err_alloc_dflt;
5693
5694	/* these will be inherited by all namespaces */
5695	dflt->autoconf = ipv6_defaults.autoconf;
5696	dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
5697
5698	dflt->stable_secret.initialized = false;
5699	all->stable_secret.initialized = false;
5700
5701	net->ipv6.devconf_all = all;
5702	net->ipv6.devconf_dflt = dflt;
5703
5704#ifdef CONFIG_SYSCTL
5705	err = __addrconf_sysctl_register(net, "all", NULL, all);
5706	if (err < 0)
5707		goto err_reg_all;
5708
5709	err = __addrconf_sysctl_register(net, "default", NULL, dflt);
5710	if (err < 0)
5711		goto err_reg_dflt;
5712#endif
5713	return 0;
5714
5715#ifdef CONFIG_SYSCTL
5716err_reg_dflt:
5717	__addrconf_sysctl_unregister(all);
5718err_reg_all:
5719	kfree(dflt);
5720#endif
5721err_alloc_dflt:
5722	kfree(all);
5723err_alloc_all:
5724	return err;
5725}
5726
5727static void __net_exit addrconf_exit_net(struct net *net)
5728{
5729#ifdef CONFIG_SYSCTL
5730	__addrconf_sysctl_unregister(net->ipv6.devconf_dflt);
5731	__addrconf_sysctl_unregister(net->ipv6.devconf_all);
5732#endif
5733	kfree(net->ipv6.devconf_dflt);
5734	kfree(net->ipv6.devconf_all);
5735}
5736
5737static struct pernet_operations addrconf_ops = {
5738	.init = addrconf_init_net,
5739	.exit = addrconf_exit_net,
5740};
5741
5742static struct rtnl_af_ops inet6_ops __read_mostly = {
5743	.family		  = AF_INET6,
5744	.fill_link_af	  = inet6_fill_link_af,
5745	.get_link_af_size = inet6_get_link_af_size,
5746	.validate_link_af = inet6_validate_link_af,
5747	.set_link_af	  = inet6_set_link_af,
5748};
5749
5750/*
5751 *	Init / cleanup code
5752 */
5753
5754int __init addrconf_init(void)
5755{
5756	struct inet6_dev *idev;
5757	int i, err;
5758
5759	err = ipv6_addr_label_init();
5760	if (err < 0) {
5761		pr_crit("%s: cannot initialize default policy table: %d\n",
5762			__func__, err);
5763		goto out;
5764	}
5765
5766	err = register_pernet_subsys(&addrconf_ops);
5767	if (err < 0)
5768		goto out_addrlabel;
5769
5770	addrconf_wq = create_workqueue("ipv6_addrconf");
5771	if (!addrconf_wq) {
5772		err = -ENOMEM;
5773		goto out_nowq;
5774	}
5775
5776	/* The addrconf netdev notifier requires that loopback_dev
5777	 * has it's ipv6 private information allocated and setup
5778	 * before it can bring up and give link-local addresses
5779	 * to other devices which are up.
5780	 *
5781	 * Unfortunately, loopback_dev is not necessarily the first
5782	 * entry in the global dev_base list of net devices.  In fact,
5783	 * it is likely to be the very last entry on that list.
5784	 * So this causes the notifier registry below to try and
5785	 * give link-local addresses to all devices besides loopback_dev
5786	 * first, then loopback_dev, which cases all the non-loopback_dev
5787	 * devices to fail to get a link-local address.
5788	 *
5789	 * So, as a temporary fix, allocate the ipv6 structure for
5790	 * loopback_dev first by hand.
5791	 * Longer term, all of the dependencies ipv6 has upon the loopback
5792	 * device and it being up should be removed.
5793	 */
5794	rtnl_lock();
5795	idev = ipv6_add_dev(init_net.loopback_dev);
5796	rtnl_unlock();
5797	if (IS_ERR(idev)) {
5798		err = PTR_ERR(idev);
5799		goto errlo;
5800	}
5801
5802	for (i = 0; i < IN6_ADDR_HSIZE; i++)
5803		INIT_HLIST_HEAD(&inet6_addr_lst[i]);
5804
5805	register_netdevice_notifier(&ipv6_dev_notf);
5806
5807	addrconf_verify();
5808
5809	rtnl_af_register(&inet6_ops);
5810
5811	err = __rtnl_register(PF_INET6, RTM_GETLINK, NULL, inet6_dump_ifinfo,
5812			      NULL);
5813	if (err < 0)
5814		goto errout;
5815
5816	/* Only the first call to __rtnl_register can fail */
5817	__rtnl_register(PF_INET6, RTM_NEWADDR, inet6_rtm_newaddr, NULL, NULL);
5818	__rtnl_register(PF_INET6, RTM_DELADDR, inet6_rtm_deladdr, NULL, NULL);
5819	__rtnl_register(PF_INET6, RTM_GETADDR, inet6_rtm_getaddr,
5820			inet6_dump_ifaddr, NULL);
5821	__rtnl_register(PF_INET6, RTM_GETMULTICAST, NULL,
5822			inet6_dump_ifmcaddr, NULL);
5823	__rtnl_register(PF_INET6, RTM_GETANYCAST, NULL,
5824			inet6_dump_ifacaddr, NULL);
5825	__rtnl_register(PF_INET6, RTM_GETNETCONF, inet6_netconf_get_devconf,
5826			inet6_netconf_dump_devconf, NULL);
5827
5828	ipv6_addr_label_rtnl_register();
5829
5830	return 0;
5831errout:
5832	rtnl_af_unregister(&inet6_ops);
5833	unregister_netdevice_notifier(&ipv6_dev_notf);
5834errlo:
5835	destroy_workqueue(addrconf_wq);
5836out_nowq:
5837	unregister_pernet_subsys(&addrconf_ops);
5838out_addrlabel:
5839	ipv6_addr_label_cleanup();
5840out:
5841	return err;
5842}
5843
5844void addrconf_cleanup(void)
5845{
5846	struct net_device *dev;
5847	int i;
5848
5849	unregister_netdevice_notifier(&ipv6_dev_notf);
5850	unregister_pernet_subsys(&addrconf_ops);
5851	ipv6_addr_label_cleanup();
5852
5853	rtnl_lock();
5854
5855	__rtnl_af_unregister(&inet6_ops);
5856
5857	/* clean dev list */
5858	for_each_netdev(&init_net, dev) {
5859		if (__in6_dev_get(dev) == NULL)
5860			continue;
5861		addrconf_ifdown(dev, 1);
5862	}
5863	addrconf_ifdown(init_net.loopback_dev, 2);
5864
5865	/*
5866	 *	Check hash table.
5867	 */
5868	spin_lock_bh(&addrconf_hash_lock);
5869	for (i = 0; i < IN6_ADDR_HSIZE; i++)
5870		WARN_ON(!hlist_empty(&inet6_addr_lst[i]));
5871	spin_unlock_bh(&addrconf_hash_lock);
5872	cancel_delayed_work(&addr_chk_work);
5873	rtnl_unlock();
5874
5875	destroy_workqueue(addrconf_wq);
5876}
5877