root/net/core/neighbour.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. neigh_blackhole
  2. neigh_cleanup_and_release
  3. neigh_rand_reach_time
  4. neigh_mark_dead
  5. neigh_update_gc_list
  6. neigh_update_ext_learned
  7. neigh_del
  8. neigh_remove_one
  9. neigh_forced_gc
  10. neigh_add_timer
  11. neigh_del_timer
  12. pneigh_queue_purge
  13. neigh_flush_dev
  14. neigh_changeaddr
  15. __neigh_ifdown
  16. neigh_carrier_down
  17. neigh_ifdown
  18. neigh_alloc
  19. neigh_get_hash_rnd
  20. neigh_hash_alloc
  21. neigh_hash_free_rcu
  22. neigh_hash_grow
  23. neigh_lookup
  24. neigh_lookup_nodev
  25. ___neigh_create
  26. __neigh_create
  27. pneigh_hash
  28. __pneigh_lookup_1
  29. __pneigh_lookup
  30. pneigh_lookup
  31. pneigh_delete
  32. pneigh_ifdown_and_unlock
  33. neigh_parms_put
  34. neigh_destroy
  35. neigh_suspect
  36. neigh_connect
  37. neigh_periodic_work
  38. neigh_max_probes
  39. neigh_invalidate
  40. neigh_probe
  41. neigh_timer_handler
  42. __neigh_event_send
  43. neigh_update_hhs
  44. __neigh_update
  45. neigh_update
  46. __neigh_set_probe_once
  47. neigh_event_ns
  48. neigh_hh_init
  49. neigh_resolve_output
  50. neigh_connected_output
  51. neigh_direct_output
  52. neigh_proxy_process
  53. pneigh_enqueue
  54. lookup_neigh_parms
  55. neigh_parms_alloc
  56. neigh_rcu_free_parms
  57. neigh_parms_release
  58. neigh_parms_destroy
  59. neigh_table_init
  60. neigh_table_clear
  61. neigh_find_table
  62. neigh_delete
  63. neigh_add
  64. neightbl_fill_parms
  65. neightbl_fill_info
  66. neightbl_fill_param_info
  67. neightbl_set
  68. neightbl_valid_dump_info
  69. neightbl_dump_info
  70. neigh_fill_info
  71. pneigh_fill_info
  72. neigh_update_notify
  73. neigh_master_filtered
  74. neigh_ifindex_filtered
  75. neigh_dump_table
  76. pneigh_dump_table
  77. neigh_valid_dump_req
  78. neigh_dump_info
  79. neigh_valid_get_req
  80. neigh_nlmsg_size
  81. neigh_get_reply
  82. pneigh_nlmsg_size
  83. pneigh_get_reply
  84. neigh_get
  85. neigh_for_each
  86. __neigh_for_each_release
  87. neigh_xmit
  88. neigh_get_first
  89. neigh_get_next
  90. neigh_get_idx
  91. pneigh_get_first
  92. pneigh_get_next
  93. pneigh_get_idx
  94. neigh_get_idx_any
  95. neigh_seq_start
  96. neigh_seq_next
  97. neigh_seq_stop
  98. neigh_stat_seq_start
  99. neigh_stat_seq_next
  100. neigh_stat_seq_stop
  101. neigh_stat_seq_show
  102. __neigh_notify
  103. neigh_app_ns
  104. proc_unres_qlen
  105. neigh_get_dev_parms_rcu
  106. neigh_copy_dflt_parms
  107. neigh_proc_update
  108. neigh_proc_dointvec_zero_intmax
  109. neigh_proc_dointvec
  110. neigh_proc_dointvec_jiffies
  111. neigh_proc_dointvec_userhz_jiffies
  112. neigh_proc_dointvec_ms_jiffies
  113. neigh_proc_dointvec_unres_qlen
  114. neigh_proc_base_reachable_time
  115. neigh_sysctl_register
  116. neigh_sysctl_unregister
  117. neigh_init

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Generic address resolution entity
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   8  *
   9  *      Fixes:
  10  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  11  *      Harald Welte            Add neighbour cache statistics like rtstat
  12  */
  13 
  14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  15 
  16 #include <linux/slab.h>
  17 #include <linux/kmemleak.h>
  18 #include <linux/types.h>
  19 #include <linux/kernel.h>
  20 #include <linux/module.h>
  21 #include <linux/socket.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/proc_fs.h>
  24 #ifdef CONFIG_SYSCTL
  25 #include <linux/sysctl.h>
  26 #endif
  27 #include <linux/times.h>
  28 #include <net/net_namespace.h>
  29 #include <net/neighbour.h>
  30 #include <net/arp.h>
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/netevent.h>
  34 #include <net/netlink.h>
  35 #include <linux/rtnetlink.h>
  36 #include <linux/random.h>
  37 #include <linux/string.h>
  38 #include <linux/log2.h>
  39 #include <linux/inetdevice.h>
  40 #include <net/addrconf.h>
  41 
  42 #include <trace/events/neigh.h>
  43 
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51 
  52 #define PNEIGH_HASHMASK         0xF
  53 
  54 static void neigh_timer_handler(struct timer_list *t);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags,
  56                            u32 pid);
  57 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
  58 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
  59                                     struct net_device *dev);
  60 
  61 #ifdef CONFIG_PROC_FS
  62 static const struct seq_operations neigh_stat_seq_ops;
  63 #endif
  64 
  65 /*
  66    Neighbour hash table buckets are protected with rwlock tbl->lock.
  67 
  68    - All the scans/updates to hash buckets MUST be made under this lock.
  69    - NOTHING clever should be made under this lock: no callbacks
  70      to protocol backends, no attempts to send something to network.
  71      It will result in deadlocks, if backend/driver wants to use neighbour
  72      cache.
  73    - If the entry requires some non-trivial actions, increase
  74      its reference count and release table lock.
  75 
  76    Neighbour entries are protected:
  77    - with reference count.
  78    - with rwlock neigh->lock
  79 
  80    Reference count prevents destruction.
  81 
  82    neigh->lock mainly serializes ll address data and its validity state.
  83    However, the same lock is used to protect another entry fields:
  84     - timer
  85     - resolution queue
  86 
  87    Again, nothing clever shall be made under neigh->lock,
  88    the most complicated procedure, which we allow is dev->hard_header.
  89    It is supposed, that dev->hard_header is simplistic and does
  90    not make callbacks to neighbour tables.
  91  */
  92 
  93 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  94 {
  95         kfree_skb(skb);
  96         return -ENETDOWN;
  97 }
  98 
  99 static void neigh_cleanup_and_release(struct neighbour *neigh)
 100 {
 101         trace_neigh_cleanup_and_release(neigh, 0);
 102         __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
 103         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 104         neigh_release(neigh);
 105 }
 106 
 107 /*
 108  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 109  * It corresponds to default IPv6 settings and is not overridable,
 110  * because it is really reasonable choice.
 111  */
 112 
 113 unsigned long neigh_rand_reach_time(unsigned long base)
 114 {
 115         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 116 }
 117 EXPORT_SYMBOL(neigh_rand_reach_time);
 118 
 119 static void neigh_mark_dead(struct neighbour *n)
 120 {
 121         n->dead = 1;
 122         if (!list_empty(&n->gc_list)) {
 123                 list_del_init(&n->gc_list);
 124                 atomic_dec(&n->tbl->gc_entries);
 125         }
 126 }
 127 
 128 static void neigh_update_gc_list(struct neighbour *n)
 129 {
 130         bool on_gc_list, exempt_from_gc;
 131 
 132         write_lock_bh(&n->tbl->lock);
 133         write_lock(&n->lock);
 134 
 135         /* remove from the gc list if new state is permanent or if neighbor
 136          * is externally learned; otherwise entry should be on the gc list
 137          */
 138         exempt_from_gc = n->nud_state & NUD_PERMANENT ||
 139                          n->flags & NTF_EXT_LEARNED;
 140         on_gc_list = !list_empty(&n->gc_list);
 141 
 142         if (exempt_from_gc && on_gc_list) {
 143                 list_del_init(&n->gc_list);
 144                 atomic_dec(&n->tbl->gc_entries);
 145         } else if (!exempt_from_gc && !on_gc_list) {
 146                 /* add entries to the tail; cleaning removes from the front */
 147                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 148                 atomic_inc(&n->tbl->gc_entries);
 149         }
 150 
 151         write_unlock(&n->lock);
 152         write_unlock_bh(&n->tbl->lock);
 153 }
 154 
 155 static bool neigh_update_ext_learned(struct neighbour *neigh, u32 flags,
 156                                      int *notify)
 157 {
 158         bool rc = false;
 159         u8 ndm_flags;
 160 
 161         if (!(flags & NEIGH_UPDATE_F_ADMIN))
 162                 return rc;
 163 
 164         ndm_flags = (flags & NEIGH_UPDATE_F_EXT_LEARNED) ? NTF_EXT_LEARNED : 0;
 165         if ((neigh->flags ^ ndm_flags) & NTF_EXT_LEARNED) {
 166                 if (ndm_flags & NTF_EXT_LEARNED)
 167                         neigh->flags |= NTF_EXT_LEARNED;
 168                 else
 169                         neigh->flags &= ~NTF_EXT_LEARNED;
 170                 rc = true;
 171                 *notify = 1;
 172         }
 173 
 174         return rc;
 175 }
 176 
 177 static bool neigh_del(struct neighbour *n, struct neighbour __rcu **np,
 178                       struct neigh_table *tbl)
 179 {
 180         bool retval = false;
 181 
 182         write_lock(&n->lock);
 183         if (refcount_read(&n->refcnt) == 1) {
 184                 struct neighbour *neigh;
 185 
 186                 neigh = rcu_dereference_protected(n->next,
 187                                                   lockdep_is_held(&tbl->lock));
 188                 rcu_assign_pointer(*np, neigh);
 189                 neigh_mark_dead(n);
 190                 retval = true;
 191         }
 192         write_unlock(&n->lock);
 193         if (retval)
 194                 neigh_cleanup_and_release(n);
 195         return retval;
 196 }
 197 
 198 bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 199 {
 200         struct neigh_hash_table *nht;
 201         void *pkey = ndel->primary_key;
 202         u32 hash_val;
 203         struct neighbour *n;
 204         struct neighbour __rcu **np;
 205 
 206         nht = rcu_dereference_protected(tbl->nht,
 207                                         lockdep_is_held(&tbl->lock));
 208         hash_val = tbl->hash(pkey, ndel->dev, nht->hash_rnd);
 209         hash_val = hash_val >> (32 - nht->hash_shift);
 210 
 211         np = &nht->hash_buckets[hash_val];
 212         while ((n = rcu_dereference_protected(*np,
 213                                               lockdep_is_held(&tbl->lock)))) {
 214                 if (n == ndel)
 215                         return neigh_del(n, np, tbl);
 216                 np = &n->next;
 217         }
 218         return false;
 219 }
 220 
 221 static int neigh_forced_gc(struct neigh_table *tbl)
 222 {
 223         int max_clean = atomic_read(&tbl->gc_entries) - tbl->gc_thresh2;
 224         unsigned long tref = jiffies - 5 * HZ;
 225         struct neighbour *n, *tmp;
 226         int shrunk = 0;
 227 
 228         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 229 
 230         write_lock_bh(&tbl->lock);
 231 
 232         list_for_each_entry_safe(n, tmp, &tbl->gc_list, gc_list) {
 233                 if (refcount_read(&n->refcnt) == 1) {
 234                         bool remove = false;
 235 
 236                         write_lock(&n->lock);
 237                         if ((n->nud_state == NUD_FAILED) ||
 238                             time_after(tref, n->updated))
 239                                 remove = true;
 240                         write_unlock(&n->lock);
 241 
 242                         if (remove && neigh_remove_one(n, tbl))
 243                                 shrunk++;
 244                         if (shrunk >= max_clean)
 245                                 break;
 246                 }
 247         }
 248 
 249         tbl->last_flush = jiffies;
 250 
 251         write_unlock_bh(&tbl->lock);
 252 
 253         return shrunk;
 254 }
 255 
 256 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 257 {
 258         neigh_hold(n);
 259         if (unlikely(mod_timer(&n->timer, when))) {
 260                 printk("NEIGH: BUG, double timer add, state is %x\n",
 261                        n->nud_state);
 262                 dump_stack();
 263         }
 264 }
 265 
 266 static int neigh_del_timer(struct neighbour *n)
 267 {
 268         if ((n->nud_state & NUD_IN_TIMER) &&
 269             del_timer(&n->timer)) {
 270                 neigh_release(n);
 271                 return 1;
 272         }
 273         return 0;
 274 }
 275 
 276 static void pneigh_queue_purge(struct sk_buff_head *list)
 277 {
 278         struct sk_buff *skb;
 279 
 280         while ((skb = skb_dequeue(list)) != NULL) {
 281                 dev_put(skb->dev);
 282                 kfree_skb(skb);
 283         }
 284 }
 285 
 286 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev,
 287                             bool skip_perm)
 288 {
 289         int i;
 290         struct neigh_hash_table *nht;
 291 
 292         nht = rcu_dereference_protected(tbl->nht,
 293                                         lockdep_is_held(&tbl->lock));
 294 
 295         for (i = 0; i < (1 << nht->hash_shift); i++) {
 296                 struct neighbour *n;
 297                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 298 
 299                 while ((n = rcu_dereference_protected(*np,
 300                                         lockdep_is_held(&tbl->lock))) != NULL) {
 301                         if (dev && n->dev != dev) {
 302                                 np = &n->next;
 303                                 continue;
 304                         }
 305                         if (skip_perm && n->nud_state & NUD_PERMANENT) {
 306                                 np = &n->next;
 307                                 continue;
 308                         }
 309                         rcu_assign_pointer(*np,
 310                                    rcu_dereference_protected(n->next,
 311                                                 lockdep_is_held(&tbl->lock)));
 312                         write_lock(&n->lock);
 313                         neigh_del_timer(n);
 314                         neigh_mark_dead(n);
 315                         if (refcount_read(&n->refcnt) != 1) {
 316                                 /* The most unpleasant situation.
 317                                    We must destroy neighbour entry,
 318                                    but someone still uses it.
 319 
 320                                    The destroy will be delayed until
 321                                    the last user releases us, but
 322                                    we must kill timers etc. and move
 323                                    it to safe state.
 324                                  */
 325                                 __skb_queue_purge(&n->arp_queue);
 326                                 n->arp_queue_len_bytes = 0;
 327                                 n->output = neigh_blackhole;
 328                                 if (n->nud_state & NUD_VALID)
 329                                         n->nud_state = NUD_NOARP;
 330                                 else
 331                                         n->nud_state = NUD_NONE;
 332                                 neigh_dbg(2, "neigh %p is stray\n", n);
 333                         }
 334                         write_unlock(&n->lock);
 335                         neigh_cleanup_and_release(n);
 336                 }
 337         }
 338 }
 339 
 340 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 341 {
 342         write_lock_bh(&tbl->lock);
 343         neigh_flush_dev(tbl, dev, false);
 344         write_unlock_bh(&tbl->lock);
 345 }
 346 EXPORT_SYMBOL(neigh_changeaddr);
 347 
 348 static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
 349                           bool skip_perm)
 350 {
 351         write_lock_bh(&tbl->lock);
 352         neigh_flush_dev(tbl, dev, skip_perm);
 353         pneigh_ifdown_and_unlock(tbl, dev);
 354 
 355         del_timer_sync(&tbl->proxy_timer);
 356         pneigh_queue_purge(&tbl->proxy_queue);
 357         return 0;
 358 }
 359 
 360 int neigh_carrier_down(struct neigh_table *tbl, struct net_device *dev)
 361 {
 362         __neigh_ifdown(tbl, dev, true);
 363         return 0;
 364 }
 365 EXPORT_SYMBOL(neigh_carrier_down);
 366 
 367 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 368 {
 369         __neigh_ifdown(tbl, dev, false);
 370         return 0;
 371 }
 372 EXPORT_SYMBOL(neigh_ifdown);
 373 
 374 static struct neighbour *neigh_alloc(struct neigh_table *tbl,
 375                                      struct net_device *dev,
 376                                      bool exempt_from_gc)
 377 {
 378         struct neighbour *n = NULL;
 379         unsigned long now = jiffies;
 380         int entries;
 381 
 382         if (exempt_from_gc)
 383                 goto do_alloc;
 384 
 385         entries = atomic_inc_return(&tbl->gc_entries) - 1;
 386         if (entries >= tbl->gc_thresh3 ||
 387             (entries >= tbl->gc_thresh2 &&
 388              time_after(now, tbl->last_flush + 5 * HZ))) {
 389                 if (!neigh_forced_gc(tbl) &&
 390                     entries >= tbl->gc_thresh3) {
 391                         net_info_ratelimited("%s: neighbor table overflow!\n",
 392                                              tbl->id);
 393                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 394                         goto out_entries;
 395                 }
 396         }
 397 
 398 do_alloc:
 399         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 400         if (!n)
 401                 goto out_entries;
 402 
 403         __skb_queue_head_init(&n->arp_queue);
 404         rwlock_init(&n->lock);
 405         seqlock_init(&n->ha_lock);
 406         n->updated        = n->used = now;
 407         n->nud_state      = NUD_NONE;
 408         n->output         = neigh_blackhole;
 409         seqlock_init(&n->hh.hh_lock);
 410         n->parms          = neigh_parms_clone(&tbl->parms);
 411         timer_setup(&n->timer, neigh_timer_handler, 0);
 412 
 413         NEIGH_CACHE_STAT_INC(tbl, allocs);
 414         n->tbl            = tbl;
 415         refcount_set(&n->refcnt, 1);
 416         n->dead           = 1;
 417         INIT_LIST_HEAD(&n->gc_list);
 418 
 419         atomic_inc(&tbl->entries);
 420 out:
 421         return n;
 422 
 423 out_entries:
 424         if (!exempt_from_gc)
 425                 atomic_dec(&tbl->gc_entries);
 426         goto out;
 427 }
 428 
 429 static void neigh_get_hash_rnd(u32 *x)
 430 {
 431         *x = get_random_u32() | 1;
 432 }
 433 
 434 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 435 {
 436         size_t size = (1 << shift) * sizeof(struct neighbour *);
 437         struct neigh_hash_table *ret;
 438         struct neighbour __rcu **buckets;
 439         int i;
 440 
 441         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 442         if (!ret)
 443                 return NULL;
 444         if (size <= PAGE_SIZE) {
 445                 buckets = kzalloc(size, GFP_ATOMIC);
 446         } else {
 447                 buckets = (struct neighbour __rcu **)
 448                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 449                                            get_order(size));
 450                 kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
 451         }
 452         if (!buckets) {
 453                 kfree(ret);
 454                 return NULL;
 455         }
 456         ret->hash_buckets = buckets;
 457         ret->hash_shift = shift;
 458         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 459                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 460         return ret;
 461 }
 462 
 463 static void neigh_hash_free_rcu(struct rcu_head *head)
 464 {
 465         struct neigh_hash_table *nht = container_of(head,
 466                                                     struct neigh_hash_table,
 467                                                     rcu);
 468         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 469         struct neighbour __rcu **buckets = nht->hash_buckets;
 470 
 471         if (size <= PAGE_SIZE) {
 472                 kfree(buckets);
 473         } else {
 474                 kmemleak_free(buckets);
 475                 free_pages((unsigned long)buckets, get_order(size));
 476         }
 477         kfree(nht);
 478 }
 479 
 480 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 481                                                 unsigned long new_shift)
 482 {
 483         unsigned int i, hash;
 484         struct neigh_hash_table *new_nht, *old_nht;
 485 
 486         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 487 
 488         old_nht = rcu_dereference_protected(tbl->nht,
 489                                             lockdep_is_held(&tbl->lock));
 490         new_nht = neigh_hash_alloc(new_shift);
 491         if (!new_nht)
 492                 return old_nht;
 493 
 494         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 495                 struct neighbour *n, *next;
 496 
 497                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 498                                                    lockdep_is_held(&tbl->lock));
 499                      n != NULL;
 500                      n = next) {
 501                         hash = tbl->hash(n->primary_key, n->dev,
 502                                          new_nht->hash_rnd);
 503 
 504                         hash >>= (32 - new_nht->hash_shift);
 505                         next = rcu_dereference_protected(n->next,
 506                                                 lockdep_is_held(&tbl->lock));
 507 
 508                         rcu_assign_pointer(n->next,
 509                                            rcu_dereference_protected(
 510                                                 new_nht->hash_buckets[hash],
 511                                                 lockdep_is_held(&tbl->lock)));
 512                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 513                 }
 514         }
 515 
 516         rcu_assign_pointer(tbl->nht, new_nht);
 517         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 518         return new_nht;
 519 }
 520 
 521 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 522                                struct net_device *dev)
 523 {
 524         struct neighbour *n;
 525 
 526         NEIGH_CACHE_STAT_INC(tbl, lookups);
 527 
 528         rcu_read_lock_bh();
 529         n = __neigh_lookup_noref(tbl, pkey, dev);
 530         if (n) {
 531                 if (!refcount_inc_not_zero(&n->refcnt))
 532                         n = NULL;
 533                 NEIGH_CACHE_STAT_INC(tbl, hits);
 534         }
 535 
 536         rcu_read_unlock_bh();
 537         return n;
 538 }
 539 EXPORT_SYMBOL(neigh_lookup);
 540 
 541 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 542                                      const void *pkey)
 543 {
 544         struct neighbour *n;
 545         unsigned int key_len = tbl->key_len;
 546         u32 hash_val;
 547         struct neigh_hash_table *nht;
 548 
 549         NEIGH_CACHE_STAT_INC(tbl, lookups);
 550 
 551         rcu_read_lock_bh();
 552         nht = rcu_dereference_bh(tbl->nht);
 553         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 554 
 555         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 556              n != NULL;
 557              n = rcu_dereference_bh(n->next)) {
 558                 if (!memcmp(n->primary_key, pkey, key_len) &&
 559                     net_eq(dev_net(n->dev), net)) {
 560                         if (!refcount_inc_not_zero(&n->refcnt))
 561                                 n = NULL;
 562                         NEIGH_CACHE_STAT_INC(tbl, hits);
 563                         break;
 564                 }
 565         }
 566 
 567         rcu_read_unlock_bh();
 568         return n;
 569 }
 570 EXPORT_SYMBOL(neigh_lookup_nodev);
 571 
 572 static struct neighbour *___neigh_create(struct neigh_table *tbl,
 573                                          const void *pkey,
 574                                          struct net_device *dev,
 575                                          bool exempt_from_gc, bool want_ref)
 576 {
 577         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev, exempt_from_gc);
 578         u32 hash_val;
 579         unsigned int key_len = tbl->key_len;
 580         int error;
 581         struct neigh_hash_table *nht;
 582 
 583         trace_neigh_create(tbl, dev, pkey, n, exempt_from_gc);
 584 
 585         if (!n) {
 586                 rc = ERR_PTR(-ENOBUFS);
 587                 goto out;
 588         }
 589 
 590         memcpy(n->primary_key, pkey, key_len);
 591         n->dev = dev;
 592         dev_hold(dev);
 593 
 594         /* Protocol specific setup. */
 595         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 596                 rc = ERR_PTR(error);
 597                 goto out_neigh_release;
 598         }
 599 
 600         if (dev->netdev_ops->ndo_neigh_construct) {
 601                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 602                 if (error < 0) {
 603                         rc = ERR_PTR(error);
 604                         goto out_neigh_release;
 605                 }
 606         }
 607 
 608         /* Device specific setup. */
 609         if (n->parms->neigh_setup &&
 610             (error = n->parms->neigh_setup(n)) < 0) {
 611                 rc = ERR_PTR(error);
 612                 goto out_neigh_release;
 613         }
 614 
 615         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 616 
 617         write_lock_bh(&tbl->lock);
 618         nht = rcu_dereference_protected(tbl->nht,
 619                                         lockdep_is_held(&tbl->lock));
 620 
 621         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 622                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 623 
 624         hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 625 
 626         if (n->parms->dead) {
 627                 rc = ERR_PTR(-EINVAL);
 628                 goto out_tbl_unlock;
 629         }
 630 
 631         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 632                                             lockdep_is_held(&tbl->lock));
 633              n1 != NULL;
 634              n1 = rcu_dereference_protected(n1->next,
 635                         lockdep_is_held(&tbl->lock))) {
 636                 if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) {
 637                         if (want_ref)
 638                                 neigh_hold(n1);
 639                         rc = n1;
 640                         goto out_tbl_unlock;
 641                 }
 642         }
 643 
 644         n->dead = 0;
 645         if (!exempt_from_gc)
 646                 list_add_tail(&n->gc_list, &n->tbl->gc_list);
 647 
 648         if (want_ref)
 649                 neigh_hold(n);
 650         rcu_assign_pointer(n->next,
 651                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 652                                                      lockdep_is_held(&tbl->lock)));
 653         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 654         write_unlock_bh(&tbl->lock);
 655         neigh_dbg(2, "neigh %p is created\n", n);
 656         rc = n;
 657 out:
 658         return rc;
 659 out_tbl_unlock:
 660         write_unlock_bh(&tbl->lock);
 661 out_neigh_release:
 662         if (!exempt_from_gc)
 663                 atomic_dec(&tbl->gc_entries);
 664         neigh_release(n);
 665         goto out;
 666 }
 667 
 668 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 669                                  struct net_device *dev, bool want_ref)
 670 {
 671         return ___neigh_create(tbl, pkey, dev, false, want_ref);
 672 }
 673 EXPORT_SYMBOL(__neigh_create);
 674 
 675 static u32 pneigh_hash(const void *pkey, unsigned int key_len)
 676 {
 677         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 678         hash_val ^= (hash_val >> 16);
 679         hash_val ^= hash_val >> 8;
 680         hash_val ^= hash_val >> 4;
 681         hash_val &= PNEIGH_HASHMASK;
 682         return hash_val;
 683 }
 684 
 685 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 686                                               struct net *net,
 687                                               const void *pkey,
 688                                               unsigned int key_len,
 689                                               struct net_device *dev)
 690 {
 691         while (n) {
 692                 if (!memcmp(n->key, pkey, key_len) &&
 693                     net_eq(pneigh_net(n), net) &&
 694                     (n->dev == dev || !n->dev))
 695                         return n;
 696                 n = n->next;
 697         }
 698         return NULL;
 699 }
 700 
 701 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 702                 struct net *net, const void *pkey, struct net_device *dev)
 703 {
 704         unsigned int key_len = tbl->key_len;
 705         u32 hash_val = pneigh_hash(pkey, key_len);
 706 
 707         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 708                                  net, pkey, key_len, dev);
 709 }
 710 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 711 
 712 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 713                                     struct net *net, const void *pkey,
 714                                     struct net_device *dev, int creat)
 715 {
 716         struct pneigh_entry *n;
 717         unsigned int key_len = tbl->key_len;
 718         u32 hash_val = pneigh_hash(pkey, key_len);
 719 
 720         read_lock_bh(&tbl->lock);
 721         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 722                               net, pkey, key_len, dev);
 723         read_unlock_bh(&tbl->lock);
 724 
 725         if (n || !creat)
 726                 goto out;
 727 
 728         ASSERT_RTNL();
 729 
 730         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 731         if (!n)
 732                 goto out;
 733 
 734         n->protocol = 0;
 735         write_pnet(&n->net, net);
 736         memcpy(n->key, pkey, key_len);
 737         n->dev = dev;
 738         if (dev)
 739                 dev_hold(dev);
 740 
 741         if (tbl->pconstructor && tbl->pconstructor(n)) {
 742                 if (dev)
 743                         dev_put(dev);
 744                 kfree(n);
 745                 n = NULL;
 746                 goto out;
 747         }
 748 
 749         write_lock_bh(&tbl->lock);
 750         n->next = tbl->phash_buckets[hash_val];
 751         tbl->phash_buckets[hash_val] = n;
 752         write_unlock_bh(&tbl->lock);
 753 out:
 754         return n;
 755 }
 756 EXPORT_SYMBOL(pneigh_lookup);
 757 
 758 
 759 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 760                   struct net_device *dev)
 761 {
 762         struct pneigh_entry *n, **np;
 763         unsigned int key_len = tbl->key_len;
 764         u32 hash_val = pneigh_hash(pkey, key_len);
 765 
 766         write_lock_bh(&tbl->lock);
 767         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 768              np = &n->next) {
 769                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 770                     net_eq(pneigh_net(n), net)) {
 771                         *np = n->next;
 772                         write_unlock_bh(&tbl->lock);
 773                         if (tbl->pdestructor)
 774                                 tbl->pdestructor(n);
 775                         if (n->dev)
 776                                 dev_put(n->dev);
 777                         kfree(n);
 778                         return 0;
 779                 }
 780         }
 781         write_unlock_bh(&tbl->lock);
 782         return -ENOENT;
 783 }
 784 
 785 static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
 786                                     struct net_device *dev)
 787 {
 788         struct pneigh_entry *n, **np, *freelist = NULL;
 789         u32 h;
 790 
 791         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 792                 np = &tbl->phash_buckets[h];
 793                 while ((n = *np) != NULL) {
 794                         if (!dev || n->dev == dev) {
 795                                 *np = n->next;
 796                                 n->next = freelist;
 797                                 freelist = n;
 798                                 continue;
 799                         }
 800                         np = &n->next;
 801                 }
 802         }
 803         write_unlock_bh(&tbl->lock);
 804         while ((n = freelist)) {
 805                 freelist = n->next;
 806                 n->next = NULL;
 807                 if (tbl->pdestructor)
 808                         tbl->pdestructor(n);
 809                 if (n->dev)
 810                         dev_put(n->dev);
 811                 kfree(n);
 812         }
 813         return -ENOENT;
 814 }
 815 
 816 static void neigh_parms_destroy(struct neigh_parms *parms);
 817 
 818 static inline void neigh_parms_put(struct neigh_parms *parms)
 819 {
 820         if (refcount_dec_and_test(&parms->refcnt))
 821                 neigh_parms_destroy(parms);
 822 }
 823 
 824 /*
 825  *      neighbour must already be out of the table;
 826  *
 827  */
 828 void neigh_destroy(struct neighbour *neigh)
 829 {
 830         struct net_device *dev = neigh->dev;
 831 
 832         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 833 
 834         if (!neigh->dead) {
 835                 pr_warn("Destroying alive neighbour %p\n", neigh);
 836                 dump_stack();
 837                 return;
 838         }
 839 
 840         if (neigh_del_timer(neigh))
 841                 pr_warn("Impossible event\n");
 842 
 843         write_lock_bh(&neigh->lock);
 844         __skb_queue_purge(&neigh->arp_queue);
 845         write_unlock_bh(&neigh->lock);
 846         neigh->arp_queue_len_bytes = 0;
 847 
 848         if (dev->netdev_ops->ndo_neigh_destroy)
 849                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 850 
 851         dev_put(dev);
 852         neigh_parms_put(neigh->parms);
 853 
 854         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 855 
 856         atomic_dec(&neigh->tbl->entries);
 857         kfree_rcu(neigh, rcu);
 858 }
 859 EXPORT_SYMBOL(neigh_destroy);
 860 
 861 /* Neighbour state is suspicious;
 862    disable fast path.
 863 
 864    Called with write_locked neigh.
 865  */
 866 static void neigh_suspect(struct neighbour *neigh)
 867 {
 868         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 869 
 870         neigh->output = neigh->ops->output;
 871 }
 872 
 873 /* Neighbour state is OK;
 874    enable fast path.
 875 
 876    Called with write_locked neigh.
 877  */
 878 static void neigh_connect(struct neighbour *neigh)
 879 {
 880         neigh_dbg(2, "neigh %p is connected\n", neigh);
 881 
 882         neigh->output = neigh->ops->connected_output;
 883 }
 884 
 885 static void neigh_periodic_work(struct work_struct *work)
 886 {
 887         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 888         struct neighbour *n;
 889         struct neighbour __rcu **np;
 890         unsigned int i;
 891         struct neigh_hash_table *nht;
 892 
 893         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 894 
 895         write_lock_bh(&tbl->lock);
 896         nht = rcu_dereference_protected(tbl->nht,
 897                                         lockdep_is_held(&tbl->lock));
 898 
 899         /*
 900          *      periodically recompute ReachableTime from random function
 901          */
 902 
 903         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 904                 struct neigh_parms *p;
 905                 tbl->last_rand = jiffies;
 906                 list_for_each_entry(p, &tbl->parms_list, list)
 907                         p->reachable_time =
 908                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 909         }
 910 
 911         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 912                 goto out;
 913 
 914         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 915                 np = &nht->hash_buckets[i];
 916 
 917                 while ((n = rcu_dereference_protected(*np,
 918                                 lockdep_is_held(&tbl->lock))) != NULL) {
 919                         unsigned int state;
 920 
 921                         write_lock(&n->lock);
 922 
 923                         state = n->nud_state;
 924                         if ((state & (NUD_PERMANENT | NUD_IN_TIMER)) ||
 925                             (n->flags & NTF_EXT_LEARNED)) {
 926                                 write_unlock(&n->lock);
 927                                 goto next_elt;
 928                         }
 929 
 930                         if (time_before(n->used, n->confirmed))
 931                                 n->used = n->confirmed;
 932 
 933                         if (refcount_read(&n->refcnt) == 1 &&
 934                             (state == NUD_FAILED ||
 935                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 936                                 *np = n->next;
 937                                 neigh_mark_dead(n);
 938                                 write_unlock(&n->lock);
 939                                 neigh_cleanup_and_release(n);
 940                                 continue;
 941                         }
 942                         write_unlock(&n->lock);
 943 
 944 next_elt:
 945                         np = &n->next;
 946                 }
 947                 /*
 948                  * It's fine to release lock here, even if hash table
 949                  * grows while we are preempted.
 950                  */
 951                 write_unlock_bh(&tbl->lock);
 952                 cond_resched();
 953                 write_lock_bh(&tbl->lock);
 954                 nht = rcu_dereference_protected(tbl->nht,
 955                                                 lockdep_is_held(&tbl->lock));
 956         }
 957 out:
 958         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 959          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 960          * BASE_REACHABLE_TIME.
 961          */
 962         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 963                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 964         write_unlock_bh(&tbl->lock);
 965 }
 966 
 967 static __inline__ int neigh_max_probes(struct neighbour *n)
 968 {
 969         struct neigh_parms *p = n->parms;
 970         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 971                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 972                 NEIGH_VAR(p, MCAST_PROBES));
 973 }
 974 
 975 static void neigh_invalidate(struct neighbour *neigh)
 976         __releases(neigh->lock)
 977         __acquires(neigh->lock)
 978 {
 979         struct sk_buff *skb;
 980 
 981         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 982         neigh_dbg(2, "neigh %p is failed\n", neigh);
 983         neigh->updated = jiffies;
 984 
 985         /* It is very thin place. report_unreachable is very complicated
 986            routine. Particularly, it can hit the same neighbour entry!
 987 
 988            So that, we try to be accurate and avoid dead loop. --ANK
 989          */
 990         while (neigh->nud_state == NUD_FAILED &&
 991                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 992                 write_unlock(&neigh->lock);
 993                 neigh->ops->error_report(neigh, skb);
 994                 write_lock(&neigh->lock);
 995         }
 996         __skb_queue_purge(&neigh->arp_queue);
 997         neigh->arp_queue_len_bytes = 0;
 998 }
 999 
1000 static void neigh_probe(struct neighbour *neigh)
1001         __releases(neigh->lock)
1002 {
1003         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
1004         /* keep skb alive even if arp_queue overflows */
1005         if (skb)
1006                 skb = skb_clone(skb, GFP_ATOMIC);
1007         write_unlock(&neigh->lock);
1008         if (neigh->ops->solicit)
1009                 neigh->ops->solicit(neigh, skb);
1010         atomic_inc(&neigh->probes);
1011         consume_skb(skb);
1012 }
1013 
1014 /* Called when a timer expires for a neighbour entry. */
1015 
1016 static void neigh_timer_handler(struct timer_list *t)
1017 {
1018         unsigned long now, next;
1019         struct neighbour *neigh = from_timer(neigh, t, timer);
1020         unsigned int state;
1021         int notify = 0;
1022 
1023         write_lock(&neigh->lock);
1024 
1025         state = neigh->nud_state;
1026         now = jiffies;
1027         next = now + HZ;
1028 
1029         if (!(state & NUD_IN_TIMER))
1030                 goto out;
1031 
1032         if (state & NUD_REACHABLE) {
1033                 if (time_before_eq(now,
1034                                    neigh->confirmed + neigh->parms->reachable_time)) {
1035                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
1036                         next = neigh->confirmed + neigh->parms->reachable_time;
1037                 } else if (time_before_eq(now,
1038                                           neigh->used +
1039                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1040                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
1041                         neigh->nud_state = NUD_DELAY;
1042                         neigh->updated = jiffies;
1043                         neigh_suspect(neigh);
1044                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
1045                 } else {
1046                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
1047                         neigh->nud_state = NUD_STALE;
1048                         neigh->updated = jiffies;
1049                         neigh_suspect(neigh);
1050                         notify = 1;
1051                 }
1052         } else if (state & NUD_DELAY) {
1053                 if (time_before_eq(now,
1054                                    neigh->confirmed +
1055                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
1056                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
1057                         neigh->nud_state = NUD_REACHABLE;
1058                         neigh->updated = jiffies;
1059                         neigh_connect(neigh);
1060                         notify = 1;
1061                         next = neigh->confirmed + neigh->parms->reachable_time;
1062                 } else {
1063                         neigh_dbg(2, "neigh %p is probed\n", neigh);
1064                         neigh->nud_state = NUD_PROBE;
1065                         neigh->updated = jiffies;
1066                         atomic_set(&neigh->probes, 0);
1067                         notify = 1;
1068                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
1069                 }
1070         } else {
1071                 /* NUD_PROBE|NUD_INCOMPLETE */
1072                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
1073         }
1074 
1075         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
1076             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
1077                 neigh->nud_state = NUD_FAILED;
1078                 notify = 1;
1079                 neigh_invalidate(neigh);
1080                 goto out;
1081         }
1082 
1083         if (neigh->nud_state & NUD_IN_TIMER) {
1084                 if (time_before(next, jiffies + HZ/2))
1085                         next = jiffies + HZ/2;
1086                 if (!mod_timer(&neigh->timer, next))
1087                         neigh_hold(neigh);
1088         }
1089         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
1090                 neigh_probe(neigh);
1091         } else {
1092 out:
1093                 write_unlock(&neigh->lock);
1094         }
1095 
1096         if (notify)
1097                 neigh_update_notify(neigh, 0);
1098 
1099         trace_neigh_timer_handler(neigh, 0);
1100 
1101         neigh_release(neigh);
1102 }
1103 
1104 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
1105 {
1106         int rc;
1107         bool immediate_probe = false;
1108 
1109         write_lock_bh(&neigh->lock);
1110 
1111         rc = 0;
1112         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
1113                 goto out_unlock_bh;
1114         if (neigh->dead)
1115                 goto out_dead;
1116 
1117         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
1118                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
1119                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
1120                         unsigned long next, now = jiffies;
1121 
1122                         atomic_set(&neigh->probes,
1123                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
1124                         neigh_del_timer(neigh);
1125                         neigh->nud_state     = NUD_INCOMPLETE;
1126                         neigh->updated = now;
1127                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
1128                                          HZ/2);
1129                         neigh_add_timer(neigh, next);
1130                         immediate_probe = true;
1131                 } else {
1132                         neigh->nud_state = NUD_FAILED;
1133                         neigh->updated = jiffies;
1134                         write_unlock_bh(&neigh->lock);
1135 
1136                         kfree_skb(skb);
1137                         return 1;
1138                 }
1139         } else if (neigh->nud_state & NUD_STALE) {
1140                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1141                 neigh_del_timer(neigh);
1142                 neigh->nud_state = NUD_DELAY;
1143                 neigh->updated = jiffies;
1144                 neigh_add_timer(neigh, jiffies +
1145                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1146         }
1147 
1148         if (neigh->nud_state == NUD_INCOMPLETE) {
1149                 if (skb) {
1150                         while (neigh->arp_queue_len_bytes + skb->truesize >
1151                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1152                                 struct sk_buff *buff;
1153 
1154                                 buff = __skb_dequeue(&neigh->arp_queue);
1155                                 if (!buff)
1156                                         break;
1157                                 neigh->arp_queue_len_bytes -= buff->truesize;
1158                                 kfree_skb(buff);
1159                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1160                         }
1161                         skb_dst_force(skb);
1162                         __skb_queue_tail(&neigh->arp_queue, skb);
1163                         neigh->arp_queue_len_bytes += skb->truesize;
1164                 }
1165                 rc = 1;
1166         }
1167 out_unlock_bh:
1168         if (immediate_probe)
1169                 neigh_probe(neigh);
1170         else
1171                 write_unlock(&neigh->lock);
1172         local_bh_enable();
1173         trace_neigh_event_send_done(neigh, rc);
1174         return rc;
1175 
1176 out_dead:
1177         if (neigh->nud_state & NUD_STALE)
1178                 goto out_unlock_bh;
1179         write_unlock_bh(&neigh->lock);
1180         kfree_skb(skb);
1181         trace_neigh_event_send_dead(neigh, 1);
1182         return 1;
1183 }
1184 EXPORT_SYMBOL(__neigh_event_send);
1185 
1186 static void neigh_update_hhs(struct neighbour *neigh)
1187 {
1188         struct hh_cache *hh;
1189         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1190                 = NULL;
1191 
1192         if (neigh->dev->header_ops)
1193                 update = neigh->dev->header_ops->cache_update;
1194 
1195         if (update) {
1196                 hh = &neigh->hh;
1197                 if (READ_ONCE(hh->hh_len)) {
1198                         write_seqlock_bh(&hh->hh_lock);
1199                         update(hh, neigh->dev, neigh->ha);
1200                         write_sequnlock_bh(&hh->hh_lock);
1201                 }
1202         }
1203 }
1204 
1205 
1206 
1207 /* Generic update routine.
1208    -- lladdr is new lladdr or NULL, if it is not supplied.
1209    -- new    is new state.
1210    -- flags
1211         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1212                                 if it is different.
1213         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1214                                 lladdr instead of overriding it
1215                                 if it is different.
1216         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1217 
1218         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1219                                 NTF_ROUTER flag.
1220         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1221                                 a router.
1222 
1223    Caller MUST hold reference count on the entry.
1224  */
1225 
1226 static int __neigh_update(struct neighbour *neigh, const u8 *lladdr,
1227                           u8 new, u32 flags, u32 nlmsg_pid,
1228                           struct netlink_ext_ack *extack)
1229 {
1230         bool ext_learn_change = false;
1231         u8 old;
1232         int err;
1233         int notify = 0;
1234         struct net_device *dev;
1235         int update_isrouter = 0;
1236 
1237         trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid);
1238 
1239         write_lock_bh(&neigh->lock);
1240 
1241         dev    = neigh->dev;
1242         old    = neigh->nud_state;
1243         err    = -EPERM;
1244 
1245         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1246             (old & (NUD_NOARP | NUD_PERMANENT)))
1247                 goto out;
1248         if (neigh->dead) {
1249                 NL_SET_ERR_MSG(extack, "Neighbor entry is now dead");
1250                 goto out;
1251         }
1252 
1253         ext_learn_change = neigh_update_ext_learned(neigh, flags, &notify);
1254 
1255         if (!(new & NUD_VALID)) {
1256                 neigh_del_timer(neigh);
1257                 if (old & NUD_CONNECTED)
1258                         neigh_suspect(neigh);
1259                 neigh->nud_state = new;
1260                 err = 0;
1261                 notify = old & NUD_VALID;
1262                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1263                     (new & NUD_FAILED)) {
1264                         neigh_invalidate(neigh);
1265                         notify = 1;
1266                 }
1267                 goto out;
1268         }
1269 
1270         /* Compare new lladdr with cached one */
1271         if (!dev->addr_len) {
1272                 /* First case: device needs no address. */
1273                 lladdr = neigh->ha;
1274         } else if (lladdr) {
1275                 /* The second case: if something is already cached
1276                    and a new address is proposed:
1277                    - compare new & old
1278                    - if they are different, check override flag
1279                  */
1280                 if ((old & NUD_VALID) &&
1281                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1282                         lladdr = neigh->ha;
1283         } else {
1284                 /* No address is supplied; if we know something,
1285                    use it, otherwise discard the request.
1286                  */
1287                 err = -EINVAL;
1288                 if (!(old & NUD_VALID)) {
1289                         NL_SET_ERR_MSG(extack, "No link layer address given");
1290                         goto out;
1291                 }
1292                 lladdr = neigh->ha;
1293         }
1294 
1295         /* Update confirmed timestamp for neighbour entry after we
1296          * received ARP packet even if it doesn't change IP to MAC binding.
1297          */
1298         if (new & NUD_CONNECTED)
1299                 neigh->confirmed = jiffies;
1300 
1301         /* If entry was valid and address is not changed,
1302            do not change entry state, if new one is STALE.
1303          */
1304         err = 0;
1305         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1306         if (old & NUD_VALID) {
1307                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1308                         update_isrouter = 0;
1309                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1310                             (old & NUD_CONNECTED)) {
1311                                 lladdr = neigh->ha;
1312                                 new = NUD_STALE;
1313                         } else
1314                                 goto out;
1315                 } else {
1316                         if (lladdr == neigh->ha && new == NUD_STALE &&
1317                             !(flags & NEIGH_UPDATE_F_ADMIN))
1318                                 new = old;
1319                 }
1320         }
1321 
1322         /* Update timestamp only once we know we will make a change to the
1323          * neighbour entry. Otherwise we risk to move the locktime window with
1324          * noop updates and ignore relevant ARP updates.
1325          */
1326         if (new != old || lladdr != neigh->ha)
1327                 neigh->updated = jiffies;
1328 
1329         if (new != old) {
1330                 neigh_del_timer(neigh);
1331                 if (new & NUD_PROBE)
1332                         atomic_set(&neigh->probes, 0);
1333                 if (new & NUD_IN_TIMER)
1334                         neigh_add_timer(neigh, (jiffies +
1335                                                 ((new & NUD_REACHABLE) ?
1336                                                  neigh->parms->reachable_time :
1337                                                  0)));
1338                 neigh->nud_state = new;
1339                 notify = 1;
1340         }
1341 
1342         if (lladdr != neigh->ha) {
1343                 write_seqlock(&neigh->ha_lock);
1344                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1345                 write_sequnlock(&neigh->ha_lock);
1346                 neigh_update_hhs(neigh);
1347                 if (!(new & NUD_CONNECTED))
1348                         neigh->confirmed = jiffies -
1349                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1350                 notify = 1;
1351         }
1352         if (new == old)
1353                 goto out;
1354         if (new & NUD_CONNECTED)
1355                 neigh_connect(neigh);
1356         else
1357                 neigh_suspect(neigh);
1358         if (!(old & NUD_VALID)) {
1359                 struct sk_buff *skb;
1360 
1361                 /* Again: avoid dead loop if something went wrong */
1362 
1363                 while (neigh->nud_state & NUD_VALID &&
1364                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1365                         struct dst_entry *dst = skb_dst(skb);
1366                         struct neighbour *n2, *n1 = neigh;
1367                         write_unlock_bh(&neigh->lock);
1368 
1369                         rcu_read_lock();
1370 
1371                         /* Why not just use 'neigh' as-is?  The problem is that
1372                          * things such as shaper, eql, and sch_teql can end up
1373                          * using alternative, different, neigh objects to output
1374                          * the packet in the output path.  So what we need to do
1375                          * here is re-lookup the top-level neigh in the path so
1376                          * we can reinject the packet there.
1377                          */
1378                         n2 = NULL;
1379                         if (dst) {
1380                                 n2 = dst_neigh_lookup_skb(dst, skb);
1381                                 if (n2)
1382                                         n1 = n2;
1383                         }
1384                         n1->output(n1, skb);
1385                         if (n2)
1386                                 neigh_release(n2);
1387                         rcu_read_unlock();
1388 
1389                         write_lock_bh(&neigh->lock);
1390                 }
1391                 __skb_queue_purge(&neigh->arp_queue);
1392                 neigh->arp_queue_len_bytes = 0;
1393         }
1394 out:
1395         if (update_isrouter)
1396                 neigh_update_is_router(neigh, flags, &notify);
1397         write_unlock_bh(&neigh->lock);
1398 
1399         if (((new ^ old) & NUD_PERMANENT) || ext_learn_change)
1400                 neigh_update_gc_list(neigh);
1401 
1402         if (notify)
1403                 neigh_update_notify(neigh, nlmsg_pid);
1404 
1405         trace_neigh_update_done(neigh, err);
1406 
1407         return err;
1408 }
1409 
1410 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1411                  u32 flags, u32 nlmsg_pid)
1412 {
1413         return __neigh_update(neigh, lladdr, new, flags, nlmsg_pid, NULL);
1414 }
1415 EXPORT_SYMBOL(neigh_update);
1416 
1417 /* Update the neigh to listen temporarily for probe responses, even if it is
1418  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1419  */
1420 void __neigh_set_probe_once(struct neighbour *neigh)
1421 {
1422         if (neigh->dead)
1423                 return;
1424         neigh->updated = jiffies;
1425         if (!(neigh->nud_state & NUD_FAILED))
1426                 return;
1427         neigh->nud_state = NUD_INCOMPLETE;
1428         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1429         neigh_add_timer(neigh,
1430                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1431 }
1432 EXPORT_SYMBOL(__neigh_set_probe_once);
1433 
1434 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1435                                  u8 *lladdr, void *saddr,
1436                                  struct net_device *dev)
1437 {
1438         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1439                                                  lladdr || !dev->addr_len);
1440         if (neigh)
1441                 neigh_update(neigh, lladdr, NUD_STALE,
1442                              NEIGH_UPDATE_F_OVERRIDE, 0);
1443         return neigh;
1444 }
1445 EXPORT_SYMBOL(neigh_event_ns);
1446 
1447 /* called with read_lock_bh(&n->lock); */
1448 static void neigh_hh_init(struct neighbour *n)
1449 {
1450         struct net_device *dev = n->dev;
1451         __be16 prot = n->tbl->protocol;
1452         struct hh_cache *hh = &n->hh;
1453 
1454         write_lock_bh(&n->lock);
1455 
1456         /* Only one thread can come in here and initialize the
1457          * hh_cache entry.
1458          */
1459         if (!hh->hh_len)
1460                 dev->header_ops->cache(n, hh, prot);
1461 
1462         write_unlock_bh(&n->lock);
1463 }
1464 
1465 /* Slow and careful. */
1466 
1467 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1468 {
1469         int rc = 0;
1470 
1471         if (!neigh_event_send(neigh, skb)) {
1472                 int err;
1473                 struct net_device *dev = neigh->dev;
1474                 unsigned int seq;
1475 
1476                 if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
1477                         neigh_hh_init(neigh);
1478 
1479                 do {
1480                         __skb_pull(skb, skb_network_offset(skb));
1481                         seq = read_seqbegin(&neigh->ha_lock);
1482                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1483                                               neigh->ha, NULL, skb->len);
1484                 } while (read_seqretry(&neigh->ha_lock, seq));
1485 
1486                 if (err >= 0)
1487                         rc = dev_queue_xmit(skb);
1488                 else
1489                         goto out_kfree_skb;
1490         }
1491 out:
1492         return rc;
1493 out_kfree_skb:
1494         rc = -EINVAL;
1495         kfree_skb(skb);
1496         goto out;
1497 }
1498 EXPORT_SYMBOL(neigh_resolve_output);
1499 
1500 /* As fast as possible without hh cache */
1501 
1502 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1503 {
1504         struct net_device *dev = neigh->dev;
1505         unsigned int seq;
1506         int err;
1507 
1508         do {
1509                 __skb_pull(skb, skb_network_offset(skb));
1510                 seq = read_seqbegin(&neigh->ha_lock);
1511                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1512                                       neigh->ha, NULL, skb->len);
1513         } while (read_seqretry(&neigh->ha_lock, seq));
1514 
1515         if (err >= 0)
1516                 err = dev_queue_xmit(skb);
1517         else {
1518                 err = -EINVAL;
1519                 kfree_skb(skb);
1520         }
1521         return err;
1522 }
1523 EXPORT_SYMBOL(neigh_connected_output);
1524 
1525 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1526 {
1527         return dev_queue_xmit(skb);
1528 }
1529 EXPORT_SYMBOL(neigh_direct_output);
1530 
1531 static void neigh_proxy_process(struct timer_list *t)
1532 {
1533         struct neigh_table *tbl = from_timer(tbl, t, proxy_timer);
1534         long sched_next = 0;
1535         unsigned long now = jiffies;
1536         struct sk_buff *skb, *n;
1537 
1538         spin_lock(&tbl->proxy_queue.lock);
1539 
1540         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1541                 long tdif = NEIGH_CB(skb)->sched_next - now;
1542 
1543                 if (tdif <= 0) {
1544                         struct net_device *dev = skb->dev;
1545 
1546                         __skb_unlink(skb, &tbl->proxy_queue);
1547                         if (tbl->proxy_redo && netif_running(dev)) {
1548                                 rcu_read_lock();
1549                                 tbl->proxy_redo(skb);
1550                                 rcu_read_unlock();
1551                         } else {
1552                                 kfree_skb(skb);
1553                         }
1554 
1555                         dev_put(dev);
1556                 } else if (!sched_next || tdif < sched_next)
1557                         sched_next = tdif;
1558         }
1559         del_timer(&tbl->proxy_timer);
1560         if (sched_next)
1561                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1562         spin_unlock(&tbl->proxy_queue.lock);
1563 }
1564 
1565 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1566                     struct sk_buff *skb)
1567 {
1568         unsigned long now = jiffies;
1569 
1570         unsigned long sched_next = now + (prandom_u32() %
1571                                           NEIGH_VAR(p, PROXY_DELAY));
1572 
1573         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1574                 kfree_skb(skb);
1575                 return;
1576         }
1577 
1578         NEIGH_CB(skb)->sched_next = sched_next;
1579         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1580 
1581         spin_lock(&tbl->proxy_queue.lock);
1582         if (del_timer(&tbl->proxy_timer)) {
1583                 if (time_before(tbl->proxy_timer.expires, sched_next))
1584                         sched_next = tbl->proxy_timer.expires;
1585         }
1586         skb_dst_drop(skb);
1587         dev_hold(skb->dev);
1588         __skb_queue_tail(&tbl->proxy_queue, skb);
1589         mod_timer(&tbl->proxy_timer, sched_next);
1590         spin_unlock(&tbl->proxy_queue.lock);
1591 }
1592 EXPORT_SYMBOL(pneigh_enqueue);
1593 
1594 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1595                                                       struct net *net, int ifindex)
1596 {
1597         struct neigh_parms *p;
1598 
1599         list_for_each_entry(p, &tbl->parms_list, list) {
1600                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1601                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1602                         return p;
1603         }
1604 
1605         return NULL;
1606 }
1607 
1608 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1609                                       struct neigh_table *tbl)
1610 {
1611         struct neigh_parms *p;
1612         struct net *net = dev_net(dev);
1613         const struct net_device_ops *ops = dev->netdev_ops;
1614 
1615         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1616         if (p) {
1617                 p->tbl            = tbl;
1618                 refcount_set(&p->refcnt, 1);
1619                 p->reachable_time =
1620                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1621                 dev_hold(dev);
1622                 p->dev = dev;
1623                 write_pnet(&p->net, net);
1624                 p->sysctl_table = NULL;
1625 
1626                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1627                         dev_put(dev);
1628                         kfree(p);
1629                         return NULL;
1630                 }
1631 
1632                 write_lock_bh(&tbl->lock);
1633                 list_add(&p->list, &tbl->parms.list);
1634                 write_unlock_bh(&tbl->lock);
1635 
1636                 neigh_parms_data_state_cleanall(p);
1637         }
1638         return p;
1639 }
1640 EXPORT_SYMBOL(neigh_parms_alloc);
1641 
1642 static void neigh_rcu_free_parms(struct rcu_head *head)
1643 {
1644         struct neigh_parms *parms =
1645                 container_of(head, struct neigh_parms, rcu_head);
1646 
1647         neigh_parms_put(parms);
1648 }
1649 
1650 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1651 {
1652         if (!parms || parms == &tbl->parms)
1653                 return;
1654         write_lock_bh(&tbl->lock);
1655         list_del(&parms->list);
1656         parms->dead = 1;
1657         write_unlock_bh(&tbl->lock);
1658         if (parms->dev)
1659                 dev_put(parms->dev);
1660         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1661 }
1662 EXPORT_SYMBOL(neigh_parms_release);
1663 
1664 static void neigh_parms_destroy(struct neigh_parms *parms)
1665 {
1666         kfree(parms);
1667 }
1668 
1669 static struct lock_class_key neigh_table_proxy_queue_class;
1670 
1671 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1672 
1673 void neigh_table_init(int index, struct neigh_table *tbl)
1674 {
1675         unsigned long now = jiffies;
1676         unsigned long phsize;
1677 
1678         INIT_LIST_HEAD(&tbl->parms_list);
1679         INIT_LIST_HEAD(&tbl->gc_list);
1680         list_add(&tbl->parms.list, &tbl->parms_list);
1681         write_pnet(&tbl->parms.net, &init_net);
1682         refcount_set(&tbl->parms.refcnt, 1);
1683         tbl->parms.reachable_time =
1684                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1685 
1686         tbl->stats = alloc_percpu(struct neigh_statistics);
1687         if (!tbl->stats)
1688                 panic("cannot create neighbour cache statistics");
1689 
1690 #ifdef CONFIG_PROC_FS
1691         if (!proc_create_seq_data(tbl->id, 0, init_net.proc_net_stat,
1692                               &neigh_stat_seq_ops, tbl))
1693                 panic("cannot create neighbour proc dir entry");
1694 #endif
1695 
1696         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1697 
1698         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1699         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1700 
1701         if (!tbl->nht || !tbl->phash_buckets)
1702                 panic("cannot allocate neighbour cache hashes");
1703 
1704         if (!tbl->entry_size)
1705                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1706                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1707         else
1708                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1709 
1710         rwlock_init(&tbl->lock);
1711         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1712         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1713                         tbl->parms.reachable_time);
1714         timer_setup(&tbl->proxy_timer, neigh_proxy_process, 0);
1715         skb_queue_head_init_class(&tbl->proxy_queue,
1716                         &neigh_table_proxy_queue_class);
1717 
1718         tbl->last_flush = now;
1719         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1720 
1721         neigh_tables[index] = tbl;
1722 }
1723 EXPORT_SYMBOL(neigh_table_init);
1724 
1725 int neigh_table_clear(int index, struct neigh_table *tbl)
1726 {
1727         neigh_tables[index] = NULL;
1728         /* It is not clean... Fix it to unload IPv6 module safely */
1729         cancel_delayed_work_sync(&tbl->gc_work);
1730         del_timer_sync(&tbl->proxy_timer);
1731         pneigh_queue_purge(&tbl->proxy_queue);
1732         neigh_ifdown(tbl, NULL);
1733         if (atomic_read(&tbl->entries))
1734                 pr_crit("neighbour leakage\n");
1735 
1736         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1737                  neigh_hash_free_rcu);
1738         tbl->nht = NULL;
1739 
1740         kfree(tbl->phash_buckets);
1741         tbl->phash_buckets = NULL;
1742 
1743         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1744 
1745         free_percpu(tbl->stats);
1746         tbl->stats = NULL;
1747 
1748         return 0;
1749 }
1750 EXPORT_SYMBOL(neigh_table_clear);
1751 
1752 static struct neigh_table *neigh_find_table(int family)
1753 {
1754         struct neigh_table *tbl = NULL;
1755 
1756         switch (family) {
1757         case AF_INET:
1758                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1759                 break;
1760         case AF_INET6:
1761                 tbl = neigh_tables[NEIGH_ND_TABLE];
1762                 break;
1763         case AF_DECnet:
1764                 tbl = neigh_tables[NEIGH_DN_TABLE];
1765                 break;
1766         }
1767 
1768         return tbl;
1769 }
1770 
1771 const struct nla_policy nda_policy[NDA_MAX+1] = {
1772         [NDA_DST]               = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1773         [NDA_LLADDR]            = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
1774         [NDA_CACHEINFO]         = { .len = sizeof(struct nda_cacheinfo) },
1775         [NDA_PROBES]            = { .type = NLA_U32 },
1776         [NDA_VLAN]              = { .type = NLA_U16 },
1777         [NDA_PORT]              = { .type = NLA_U16 },
1778         [NDA_VNI]               = { .type = NLA_U32 },
1779         [NDA_IFINDEX]           = { .type = NLA_U32 },
1780         [NDA_MASTER]            = { .type = NLA_U32 },
1781         [NDA_PROTOCOL]          = { .type = NLA_U8 },
1782 };
1783 
1784 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh,
1785                         struct netlink_ext_ack *extack)
1786 {
1787         struct net *net = sock_net(skb->sk);
1788         struct ndmsg *ndm;
1789         struct nlattr *dst_attr;
1790         struct neigh_table *tbl;
1791         struct neighbour *neigh;
1792         struct net_device *dev = NULL;
1793         int err = -EINVAL;
1794 
1795         ASSERT_RTNL();
1796         if (nlmsg_len(nlh) < sizeof(*ndm))
1797                 goto out;
1798 
1799         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1800         if (!dst_attr) {
1801                 NL_SET_ERR_MSG(extack, "Network address not specified");
1802                 goto out;
1803         }
1804 
1805         ndm = nlmsg_data(nlh);
1806         if (ndm->ndm_ifindex) {
1807                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1808                 if (dev == NULL) {
1809                         err = -ENODEV;
1810                         goto out;
1811                 }
1812         }
1813 
1814         tbl = neigh_find_table(ndm->ndm_family);
1815         if (tbl == NULL)
1816                 return -EAFNOSUPPORT;
1817 
1818         if (nla_len(dst_attr) < (int)tbl->key_len) {
1819                 NL_SET_ERR_MSG(extack, "Invalid network address");
1820                 goto out;
1821         }
1822 
1823         if (ndm->ndm_flags & NTF_PROXY) {
1824                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1825                 goto out;
1826         }
1827 
1828         if (dev == NULL)
1829                 goto out;
1830 
1831         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1832         if (neigh == NULL) {
1833                 err = -ENOENT;
1834                 goto out;
1835         }
1836 
1837         err = __neigh_update(neigh, NULL, NUD_FAILED,
1838                              NEIGH_UPDATE_F_OVERRIDE | NEIGH_UPDATE_F_ADMIN,
1839                              NETLINK_CB(skb).portid, extack);
1840         write_lock_bh(&tbl->lock);
1841         neigh_release(neigh);
1842         neigh_remove_one(neigh, tbl);
1843         write_unlock_bh(&tbl->lock);
1844 
1845 out:
1846         return err;
1847 }
1848 
1849 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1850                      struct netlink_ext_ack *extack)
1851 {
1852         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE |
1853                 NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1854         struct net *net = sock_net(skb->sk);
1855         struct ndmsg *ndm;
1856         struct nlattr *tb[NDA_MAX+1];
1857         struct neigh_table *tbl;
1858         struct net_device *dev = NULL;
1859         struct neighbour *neigh;
1860         void *dst, *lladdr;
1861         u8 protocol = 0;
1862         int err;
1863 
1864         ASSERT_RTNL();
1865         err = nlmsg_parse_deprecated(nlh, sizeof(*ndm), tb, NDA_MAX,
1866                                      nda_policy, extack);
1867         if (err < 0)
1868                 goto out;
1869 
1870         err = -EINVAL;
1871         if (!tb[NDA_DST]) {
1872                 NL_SET_ERR_MSG(extack, "Network address not specified");
1873                 goto out;
1874         }
1875 
1876         ndm = nlmsg_data(nlh);
1877         if (ndm->ndm_ifindex) {
1878                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1879                 if (dev == NULL) {
1880                         err = -ENODEV;
1881                         goto out;
1882                 }
1883 
1884                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len) {
1885                         NL_SET_ERR_MSG(extack, "Invalid link address");
1886                         goto out;
1887                 }
1888         }
1889 
1890         tbl = neigh_find_table(ndm->ndm_family);
1891         if (tbl == NULL)
1892                 return -EAFNOSUPPORT;
1893 
1894         if (nla_len(tb[NDA_DST]) < (int)tbl->key_len) {
1895                 NL_SET_ERR_MSG(extack, "Invalid network address");
1896                 goto out;
1897         }
1898 
1899         dst = nla_data(tb[NDA_DST]);
1900         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1901 
1902         if (tb[NDA_PROTOCOL])
1903                 protocol = nla_get_u8(tb[NDA_PROTOCOL]);
1904 
1905         if (ndm->ndm_flags & NTF_PROXY) {
1906                 struct pneigh_entry *pn;
1907 
1908                 err = -ENOBUFS;
1909                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1910                 if (pn) {
1911                         pn->flags = ndm->ndm_flags;
1912                         if (protocol)
1913                                 pn->protocol = protocol;
1914                         err = 0;
1915                 }
1916                 goto out;
1917         }
1918 
1919         if (!dev) {
1920                 NL_SET_ERR_MSG(extack, "Device not specified");
1921                 goto out;
1922         }
1923 
1924         if (tbl->allow_add && !tbl->allow_add(dev, extack)) {
1925                 err = -EINVAL;
1926                 goto out;
1927         }
1928 
1929         neigh = neigh_lookup(tbl, dst, dev);
1930         if (neigh == NULL) {
1931                 bool exempt_from_gc;
1932 
1933                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1934                         err = -ENOENT;
1935                         goto out;
1936                 }
1937 
1938                 exempt_from_gc = ndm->ndm_state & NUD_PERMANENT ||
1939                                  ndm->ndm_flags & NTF_EXT_LEARNED;
1940                 neigh = ___neigh_create(tbl, dst, dev, exempt_from_gc, true);
1941                 if (IS_ERR(neigh)) {
1942                         err = PTR_ERR(neigh);
1943                         goto out;
1944                 }
1945         } else {
1946                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1947                         err = -EEXIST;
1948                         neigh_release(neigh);
1949                         goto out;
1950                 }
1951 
1952                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1953                         flags &= ~(NEIGH_UPDATE_F_OVERRIDE |
1954                                    NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1955         }
1956 
1957         if (protocol)
1958                 neigh->protocol = protocol;
1959 
1960         if (ndm->ndm_flags & NTF_EXT_LEARNED)
1961                 flags |= NEIGH_UPDATE_F_EXT_LEARNED;
1962 
1963         if (ndm->ndm_flags & NTF_ROUTER)
1964                 flags |= NEIGH_UPDATE_F_ISROUTER;
1965 
1966         if (ndm->ndm_flags & NTF_USE) {
1967                 neigh_event_send(neigh, NULL);
1968                 err = 0;
1969         } else
1970                 err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags,
1971                                      NETLINK_CB(skb).portid, extack);
1972 
1973         neigh_release(neigh);
1974 
1975 out:
1976         return err;
1977 }
1978 
1979 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1980 {
1981         struct nlattr *nest;
1982 
1983         nest = nla_nest_start_noflag(skb, NDTA_PARMS);
1984         if (nest == NULL)
1985                 return -ENOBUFS;
1986 
1987         if ((parms->dev &&
1988              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1989             nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
1990             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1991                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1992             /* approximative value for deprecated QUEUE_LEN (in packets) */
1993             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1994                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1995             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1996             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1997             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1998                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1999             nla_put_u32(skb, NDTPA_MCAST_PROBES,
2000                         NEIGH_VAR(parms, MCAST_PROBES)) ||
2001             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
2002                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
2003             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
2004                           NDTPA_PAD) ||
2005             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
2006                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
2007             nla_put_msecs(skb, NDTPA_GC_STALETIME,
2008                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
2009             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
2010                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
2011             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
2012                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
2013             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
2014                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
2015             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
2016                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
2017             nla_put_msecs(skb, NDTPA_LOCKTIME,
2018                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
2019                 goto nla_put_failure;
2020         return nla_nest_end(skb, nest);
2021 
2022 nla_put_failure:
2023         nla_nest_cancel(skb, nest);
2024         return -EMSGSIZE;
2025 }
2026 
2027 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
2028                               u32 pid, u32 seq, int type, int flags)
2029 {
2030         struct nlmsghdr *nlh;
2031         struct ndtmsg *ndtmsg;
2032 
2033         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2034         if (nlh == NULL)
2035                 return -EMSGSIZE;
2036 
2037         ndtmsg = nlmsg_data(nlh);
2038 
2039         read_lock_bh(&tbl->lock);
2040         ndtmsg->ndtm_family = tbl->family;
2041         ndtmsg->ndtm_pad1   = 0;
2042         ndtmsg->ndtm_pad2   = 0;
2043 
2044         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
2045             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
2046             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
2047             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
2048             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
2049                 goto nla_put_failure;
2050         {
2051                 unsigned long now = jiffies;
2052                 long flush_delta = now - tbl->last_flush;
2053                 long rand_delta = now - tbl->last_rand;
2054                 struct neigh_hash_table *nht;
2055                 struct ndt_config ndc = {
2056                         .ndtc_key_len           = tbl->key_len,
2057                         .ndtc_entry_size        = tbl->entry_size,
2058                         .ndtc_entries           = atomic_read(&tbl->entries),
2059                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
2060                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
2061                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
2062                 };
2063 
2064                 rcu_read_lock_bh();
2065                 nht = rcu_dereference_bh(tbl->nht);
2066                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
2067                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
2068                 rcu_read_unlock_bh();
2069 
2070                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
2071                         goto nla_put_failure;
2072         }
2073 
2074         {
2075                 int cpu;
2076                 struct ndt_stats ndst;
2077 
2078                 memset(&ndst, 0, sizeof(ndst));
2079 
2080                 for_each_possible_cpu(cpu) {
2081                         struct neigh_statistics *st;
2082 
2083                         st = per_cpu_ptr(tbl->stats, cpu);
2084                         ndst.ndts_allocs                += st->allocs;
2085                         ndst.ndts_destroys              += st->destroys;
2086                         ndst.ndts_hash_grows            += st->hash_grows;
2087                         ndst.ndts_res_failed            += st->res_failed;
2088                         ndst.ndts_lookups               += st->lookups;
2089                         ndst.ndts_hits                  += st->hits;
2090                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
2091                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
2092                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
2093                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
2094                         ndst.ndts_table_fulls           += st->table_fulls;
2095                 }
2096 
2097                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
2098                                   NDTA_PAD))
2099                         goto nla_put_failure;
2100         }
2101 
2102         BUG_ON(tbl->parms.dev);
2103         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
2104                 goto nla_put_failure;
2105 
2106         read_unlock_bh(&tbl->lock);
2107         nlmsg_end(skb, nlh);
2108         return 0;
2109 
2110 nla_put_failure:
2111         read_unlock_bh(&tbl->lock);
2112         nlmsg_cancel(skb, nlh);
2113         return -EMSGSIZE;
2114 }
2115 
2116 static int neightbl_fill_param_info(struct sk_buff *skb,
2117                                     struct neigh_table *tbl,
2118                                     struct neigh_parms *parms,
2119                                     u32 pid, u32 seq, int type,
2120                                     unsigned int flags)
2121 {
2122         struct ndtmsg *ndtmsg;
2123         struct nlmsghdr *nlh;
2124 
2125         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
2126         if (nlh == NULL)
2127                 return -EMSGSIZE;
2128 
2129         ndtmsg = nlmsg_data(nlh);
2130 
2131         read_lock_bh(&tbl->lock);
2132         ndtmsg->ndtm_family = tbl->family;
2133         ndtmsg->ndtm_pad1   = 0;
2134         ndtmsg->ndtm_pad2   = 0;
2135 
2136         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
2137             neightbl_fill_parms(skb, parms) < 0)
2138                 goto errout;
2139 
2140         read_unlock_bh(&tbl->lock);
2141         nlmsg_end(skb, nlh);
2142         return 0;
2143 errout:
2144         read_unlock_bh(&tbl->lock);
2145         nlmsg_cancel(skb, nlh);
2146         return -EMSGSIZE;
2147 }
2148 
2149 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
2150         [NDTA_NAME]             = { .type = NLA_STRING },
2151         [NDTA_THRESH1]          = { .type = NLA_U32 },
2152         [NDTA_THRESH2]          = { .type = NLA_U32 },
2153         [NDTA_THRESH3]          = { .type = NLA_U32 },
2154         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
2155         [NDTA_PARMS]            = { .type = NLA_NESTED },
2156 };
2157 
2158 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
2159         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
2160         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
2161         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
2162         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
2163         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
2164         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
2165         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
2166         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
2167         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
2168         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
2169         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
2170         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
2171         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
2172         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
2173 };
2174 
2175 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
2176                         struct netlink_ext_ack *extack)
2177 {
2178         struct net *net = sock_net(skb->sk);
2179         struct neigh_table *tbl;
2180         struct ndtmsg *ndtmsg;
2181         struct nlattr *tb[NDTA_MAX+1];
2182         bool found = false;
2183         int err, tidx;
2184 
2185         err = nlmsg_parse_deprecated(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
2186                                      nl_neightbl_policy, extack);
2187         if (err < 0)
2188                 goto errout;
2189 
2190         if (tb[NDTA_NAME] == NULL) {
2191                 err = -EINVAL;
2192                 goto errout;
2193         }
2194 
2195         ndtmsg = nlmsg_data(nlh);
2196 
2197         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2198                 tbl = neigh_tables[tidx];
2199                 if (!tbl)
2200                         continue;
2201                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2202                         continue;
2203                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
2204                         found = true;
2205                         break;
2206                 }
2207         }
2208 
2209         if (!found)
2210                 return -ENOENT;
2211 
2212         /*
2213          * We acquire tbl->lock to be nice to the periodic timers and
2214          * make sure they always see a consistent set of values.
2215          */
2216         write_lock_bh(&tbl->lock);
2217 
2218         if (tb[NDTA_PARMS]) {
2219                 struct nlattr *tbp[NDTPA_MAX+1];
2220                 struct neigh_parms *p;
2221                 int i, ifindex = 0;
2222 
2223                 err = nla_parse_nested_deprecated(tbp, NDTPA_MAX,
2224                                                   tb[NDTA_PARMS],
2225                                                   nl_ntbl_parm_policy, extack);
2226                 if (err < 0)
2227                         goto errout_tbl_lock;
2228 
2229                 if (tbp[NDTPA_IFINDEX])
2230                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2231 
2232                 p = lookup_neigh_parms(tbl, net, ifindex);
2233                 if (p == NULL) {
2234                         err = -ENOENT;
2235                         goto errout_tbl_lock;
2236                 }
2237 
2238                 for (i = 1; i <= NDTPA_MAX; i++) {
2239                         if (tbp[i] == NULL)
2240                                 continue;
2241 
2242                         switch (i) {
2243                         case NDTPA_QUEUE_LEN:
2244                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2245                                               nla_get_u32(tbp[i]) *
2246                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2247                                 break;
2248                         case NDTPA_QUEUE_LENBYTES:
2249                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2250                                               nla_get_u32(tbp[i]));
2251                                 break;
2252                         case NDTPA_PROXY_QLEN:
2253                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2254                                               nla_get_u32(tbp[i]));
2255                                 break;
2256                         case NDTPA_APP_PROBES:
2257                                 NEIGH_VAR_SET(p, APP_PROBES,
2258                                               nla_get_u32(tbp[i]));
2259                                 break;
2260                         case NDTPA_UCAST_PROBES:
2261                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2262                                               nla_get_u32(tbp[i]));
2263                                 break;
2264                         case NDTPA_MCAST_PROBES:
2265                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2266                                               nla_get_u32(tbp[i]));
2267                                 break;
2268                         case NDTPA_MCAST_REPROBES:
2269                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2270                                               nla_get_u32(tbp[i]));
2271                                 break;
2272                         case NDTPA_BASE_REACHABLE_TIME:
2273                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2274                                               nla_get_msecs(tbp[i]));
2275                                 /* update reachable_time as well, otherwise, the change will
2276                                  * only be effective after the next time neigh_periodic_work
2277                                  * decides to recompute it (can be multiple minutes)
2278                                  */
2279                                 p->reachable_time =
2280                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2281                                 break;
2282                         case NDTPA_GC_STALETIME:
2283                                 NEIGH_VAR_SET(p, GC_STALETIME,
2284                                               nla_get_msecs(tbp[i]));
2285                                 break;
2286                         case NDTPA_DELAY_PROBE_TIME:
2287                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2288                                               nla_get_msecs(tbp[i]));
2289                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2290                                 break;
2291                         case NDTPA_RETRANS_TIME:
2292                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2293                                               nla_get_msecs(tbp[i]));
2294                                 break;
2295                         case NDTPA_ANYCAST_DELAY:
2296                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2297                                               nla_get_msecs(tbp[i]));
2298                                 break;
2299                         case NDTPA_PROXY_DELAY:
2300                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2301                                               nla_get_msecs(tbp[i]));
2302                                 break;
2303                         case NDTPA_LOCKTIME:
2304                                 NEIGH_VAR_SET(p, LOCKTIME,
2305                                               nla_get_msecs(tbp[i]));
2306                                 break;
2307                         }
2308                 }
2309         }
2310 
2311         err = -ENOENT;
2312         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2313              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2314             !net_eq(net, &init_net))
2315                 goto errout_tbl_lock;
2316 
2317         if (tb[NDTA_THRESH1])
2318                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2319 
2320         if (tb[NDTA_THRESH2])
2321                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2322 
2323         if (tb[NDTA_THRESH3])
2324                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2325 
2326         if (tb[NDTA_GC_INTERVAL])
2327                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2328 
2329         err = 0;
2330 
2331 errout_tbl_lock:
2332         write_unlock_bh(&tbl->lock);
2333 errout:
2334         return err;
2335 }
2336 
2337 static int neightbl_valid_dump_info(const struct nlmsghdr *nlh,
2338                                     struct netlink_ext_ack *extack)
2339 {
2340         struct ndtmsg *ndtm;
2341 
2342         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndtm))) {
2343                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor table dump request");
2344                 return -EINVAL;
2345         }
2346 
2347         ndtm = nlmsg_data(nlh);
2348         if (ndtm->ndtm_pad1  || ndtm->ndtm_pad2) {
2349                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor table dump request");
2350                 return -EINVAL;
2351         }
2352 
2353         if (nlmsg_attrlen(nlh, sizeof(*ndtm))) {
2354                 NL_SET_ERR_MSG(extack, "Invalid data after header in neighbor table dump request");
2355                 return -EINVAL;
2356         }
2357 
2358         return 0;
2359 }
2360 
2361 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2362 {
2363         const struct nlmsghdr *nlh = cb->nlh;
2364         struct net *net = sock_net(skb->sk);
2365         int family, tidx, nidx = 0;
2366         int tbl_skip = cb->args[0];
2367         int neigh_skip = cb->args[1];
2368         struct neigh_table *tbl;
2369 
2370         if (cb->strict_check) {
2371                 int err = neightbl_valid_dump_info(nlh, cb->extack);
2372 
2373                 if (err < 0)
2374                         return err;
2375         }
2376 
2377         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2378 
2379         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2380                 struct neigh_parms *p;
2381 
2382                 tbl = neigh_tables[tidx];
2383                 if (!tbl)
2384                         continue;
2385 
2386                 if (tidx < tbl_skip || (family && tbl->family != family))
2387                         continue;
2388 
2389                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2390                                        nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2391                                        NLM_F_MULTI) < 0)
2392                         break;
2393 
2394                 nidx = 0;
2395                 p = list_next_entry(&tbl->parms, list);
2396                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2397                         if (!net_eq(neigh_parms_net(p), net))
2398                                 continue;
2399 
2400                         if (nidx < neigh_skip)
2401                                 goto next;
2402 
2403                         if (neightbl_fill_param_info(skb, tbl, p,
2404                                                      NETLINK_CB(cb->skb).portid,
2405                                                      nlh->nlmsg_seq,
2406                                                      RTM_NEWNEIGHTBL,
2407                                                      NLM_F_MULTI) < 0)
2408                                 goto out;
2409                 next:
2410                         nidx++;
2411                 }
2412 
2413                 neigh_skip = 0;
2414         }
2415 out:
2416         cb->args[0] = tidx;
2417         cb->args[1] = nidx;
2418 
2419         return skb->len;
2420 }
2421 
2422 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2423                            u32 pid, u32 seq, int type, unsigned int flags)
2424 {
2425         unsigned long now = jiffies;
2426         struct nda_cacheinfo ci;
2427         struct nlmsghdr *nlh;
2428         struct ndmsg *ndm;
2429 
2430         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2431         if (nlh == NULL)
2432                 return -EMSGSIZE;
2433 
2434         ndm = nlmsg_data(nlh);
2435         ndm->ndm_family  = neigh->ops->family;
2436         ndm->ndm_pad1    = 0;
2437         ndm->ndm_pad2    = 0;
2438         ndm->ndm_flags   = neigh->flags;
2439         ndm->ndm_type    = neigh->type;
2440         ndm->ndm_ifindex = neigh->dev->ifindex;
2441 
2442         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2443                 goto nla_put_failure;
2444 
2445         read_lock_bh(&neigh->lock);
2446         ndm->ndm_state   = neigh->nud_state;
2447         if (neigh->nud_state & NUD_VALID) {
2448                 char haddr[MAX_ADDR_LEN];
2449 
2450                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2451                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2452                         read_unlock_bh(&neigh->lock);
2453                         goto nla_put_failure;
2454                 }
2455         }
2456 
2457         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2458         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2459         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2460         ci.ndm_refcnt    = refcount_read(&neigh->refcnt) - 1;
2461         read_unlock_bh(&neigh->lock);
2462 
2463         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2464             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2465                 goto nla_put_failure;
2466 
2467         if (neigh->protocol && nla_put_u8(skb, NDA_PROTOCOL, neigh->protocol))
2468                 goto nla_put_failure;
2469 
2470         nlmsg_end(skb, nlh);
2471         return 0;
2472 
2473 nla_put_failure:
2474         nlmsg_cancel(skb, nlh);
2475         return -EMSGSIZE;
2476 }
2477 
2478 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2479                             u32 pid, u32 seq, int type, unsigned int flags,
2480                             struct neigh_table *tbl)
2481 {
2482         struct nlmsghdr *nlh;
2483         struct ndmsg *ndm;
2484 
2485         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2486         if (nlh == NULL)
2487                 return -EMSGSIZE;
2488 
2489         ndm = nlmsg_data(nlh);
2490         ndm->ndm_family  = tbl->family;
2491         ndm->ndm_pad1    = 0;
2492         ndm->ndm_pad2    = 0;
2493         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2494         ndm->ndm_type    = RTN_UNICAST;
2495         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2496         ndm->ndm_state   = NUD_NONE;
2497 
2498         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2499                 goto nla_put_failure;
2500 
2501         if (pn->protocol && nla_put_u8(skb, NDA_PROTOCOL, pn->protocol))
2502                 goto nla_put_failure;
2503 
2504         nlmsg_end(skb, nlh);
2505         return 0;
2506 
2507 nla_put_failure:
2508         nlmsg_cancel(skb, nlh);
2509         return -EMSGSIZE;
2510 }
2511 
2512 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid)
2513 {
2514         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2515         __neigh_notify(neigh, RTM_NEWNEIGH, 0, nlmsg_pid);
2516 }
2517 
2518 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2519 {
2520         struct net_device *master;
2521 
2522         if (!master_idx)
2523                 return false;
2524 
2525         master = dev ? netdev_master_upper_dev_get(dev) : NULL;
2526         if (!master || master->ifindex != master_idx)
2527                 return true;
2528 
2529         return false;
2530 }
2531 
2532 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2533 {
2534         if (filter_idx && (!dev || dev->ifindex != filter_idx))
2535                 return true;
2536 
2537         return false;
2538 }
2539 
2540 struct neigh_dump_filter {
2541         int master_idx;
2542         int dev_idx;
2543 };
2544 
2545 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2546                             struct netlink_callback *cb,
2547                             struct neigh_dump_filter *filter)
2548 {
2549         struct net *net = sock_net(skb->sk);
2550         struct neighbour *n;
2551         int rc, h, s_h = cb->args[1];
2552         int idx, s_idx = idx = cb->args[2];
2553         struct neigh_hash_table *nht;
2554         unsigned int flags = NLM_F_MULTI;
2555 
2556         if (filter->dev_idx || filter->master_idx)
2557                 flags |= NLM_F_DUMP_FILTERED;
2558 
2559         rcu_read_lock_bh();
2560         nht = rcu_dereference_bh(tbl->nht);
2561 
2562         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2563                 if (h > s_h)
2564                         s_idx = 0;
2565                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2566                      n != NULL;
2567                      n = rcu_dereference_bh(n->next)) {
2568                         if (idx < s_idx || !net_eq(dev_net(n->dev), net))
2569                                 goto next;
2570                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2571                             neigh_master_filtered(n->dev, filter->master_idx))
2572                                 goto next;
2573                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2574                                             cb->nlh->nlmsg_seq,
2575                                             RTM_NEWNEIGH,
2576                                             flags) < 0) {
2577                                 rc = -1;
2578                                 goto out;
2579                         }
2580 next:
2581                         idx++;
2582                 }
2583         }
2584         rc = skb->len;
2585 out:
2586         rcu_read_unlock_bh();
2587         cb->args[1] = h;
2588         cb->args[2] = idx;
2589         return rc;
2590 }
2591 
2592 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2593                              struct netlink_callback *cb,
2594                              struct neigh_dump_filter *filter)
2595 {
2596         struct pneigh_entry *n;
2597         struct net *net = sock_net(skb->sk);
2598         int rc, h, s_h = cb->args[3];
2599         int idx, s_idx = idx = cb->args[4];
2600         unsigned int flags = NLM_F_MULTI;
2601 
2602         if (filter->dev_idx || filter->master_idx)
2603                 flags |= NLM_F_DUMP_FILTERED;
2604 
2605         read_lock_bh(&tbl->lock);
2606 
2607         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2608                 if (h > s_h)
2609                         s_idx = 0;
2610                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2611                         if (idx < s_idx || pneigh_net(n) != net)
2612                                 goto next;
2613                         if (neigh_ifindex_filtered(n->dev, filter->dev_idx) ||
2614                             neigh_master_filtered(n->dev, filter->master_idx))
2615                                 goto next;
2616                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2617                                             cb->nlh->nlmsg_seq,
2618                                             RTM_NEWNEIGH, flags, tbl) < 0) {
2619                                 read_unlock_bh(&tbl->lock);
2620                                 rc = -1;
2621                                 goto out;
2622                         }
2623                 next:
2624                         idx++;
2625                 }
2626         }
2627 
2628         read_unlock_bh(&tbl->lock);
2629         rc = skb->len;
2630 out:
2631         cb->args[3] = h;
2632         cb->args[4] = idx;
2633         return rc;
2634 
2635 }
2636 
2637 static int neigh_valid_dump_req(const struct nlmsghdr *nlh,
2638                                 bool strict_check,
2639                                 struct neigh_dump_filter *filter,
2640                                 struct netlink_ext_ack *extack)
2641 {
2642         struct nlattr *tb[NDA_MAX + 1];
2643         int err, i;
2644 
2645         if (strict_check) {
2646                 struct ndmsg *ndm;
2647 
2648                 if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2649                         NL_SET_ERR_MSG(extack, "Invalid header for neighbor dump request");
2650                         return -EINVAL;
2651                 }
2652 
2653                 ndm = nlmsg_data(nlh);
2654                 if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_ifindex ||
2655                     ndm->ndm_state || ndm->ndm_type) {
2656                         NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor dump request");
2657                         return -EINVAL;
2658                 }
2659 
2660                 if (ndm->ndm_flags & ~NTF_PROXY) {
2661                         NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor dump request");
2662                         return -EINVAL;
2663                 }
2664 
2665                 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg),
2666                                                     tb, NDA_MAX, nda_policy,
2667                                                     extack);
2668         } else {
2669                 err = nlmsg_parse_deprecated(nlh, sizeof(struct ndmsg), tb,
2670                                              NDA_MAX, nda_policy, extack);
2671         }
2672         if (err < 0)
2673                 return err;
2674 
2675         for (i = 0; i <= NDA_MAX; ++i) {
2676                 if (!tb[i])
2677                         continue;
2678 
2679                 /* all new attributes should require strict_check */
2680                 switch (i) {
2681                 case NDA_IFINDEX:
2682                         filter->dev_idx = nla_get_u32(tb[i]);
2683                         break;
2684                 case NDA_MASTER:
2685                         filter->master_idx = nla_get_u32(tb[i]);
2686                         break;
2687                 default:
2688                         if (strict_check) {
2689                                 NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor dump request");
2690                                 return -EINVAL;
2691                         }
2692                 }
2693         }
2694 
2695         return 0;
2696 }
2697 
2698 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2699 {
2700         const struct nlmsghdr *nlh = cb->nlh;
2701         struct neigh_dump_filter filter = {};
2702         struct neigh_table *tbl;
2703         int t, family, s_t;
2704         int proxy = 0;
2705         int err;
2706 
2707         family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
2708 
2709         /* check for full ndmsg structure presence, family member is
2710          * the same for both structures
2711          */
2712         if (nlmsg_len(nlh) >= sizeof(struct ndmsg) &&
2713             ((struct ndmsg *)nlmsg_data(nlh))->ndm_flags == NTF_PROXY)
2714                 proxy = 1;
2715 
2716         err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack);
2717         if (err < 0 && cb->strict_check)
2718                 return err;
2719 
2720         s_t = cb->args[0];
2721 
2722         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2723                 tbl = neigh_tables[t];
2724 
2725                 if (!tbl)
2726                         continue;
2727                 if (t < s_t || (family && tbl->family != family))
2728                         continue;
2729                 if (t > s_t)
2730                         memset(&cb->args[1], 0, sizeof(cb->args) -
2731                                                 sizeof(cb->args[0]));
2732                 if (proxy)
2733                         err = pneigh_dump_table(tbl, skb, cb, &filter);
2734                 else
2735                         err = neigh_dump_table(tbl, skb, cb, &filter);
2736                 if (err < 0)
2737                         break;
2738         }
2739 
2740         cb->args[0] = t;
2741         return skb->len;
2742 }
2743 
2744 static int neigh_valid_get_req(const struct nlmsghdr *nlh,
2745                                struct neigh_table **tbl,
2746                                void **dst, int *dev_idx, u8 *ndm_flags,
2747                                struct netlink_ext_ack *extack)
2748 {
2749         struct nlattr *tb[NDA_MAX + 1];
2750         struct ndmsg *ndm;
2751         int err, i;
2752 
2753         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
2754                 NL_SET_ERR_MSG(extack, "Invalid header for neighbor get request");
2755                 return -EINVAL;
2756         }
2757 
2758         ndm = nlmsg_data(nlh);
2759         if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
2760             ndm->ndm_type) {
2761                 NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor get request");
2762                 return -EINVAL;
2763         }
2764 
2765         if (ndm->ndm_flags & ~NTF_PROXY) {
2766                 NL_SET_ERR_MSG(extack, "Invalid flags in header for neighbor get request");
2767                 return -EINVAL;
2768         }
2769 
2770         err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct ndmsg), tb,
2771                                             NDA_MAX, nda_policy, extack);
2772         if (err < 0)
2773                 return err;
2774 
2775         *ndm_flags = ndm->ndm_flags;
2776         *dev_idx = ndm->ndm_ifindex;
2777         *tbl = neigh_find_table(ndm->ndm_family);
2778         if (*tbl == NULL) {
2779                 NL_SET_ERR_MSG(extack, "Unsupported family in header for neighbor get request");
2780                 return -EAFNOSUPPORT;
2781         }
2782 
2783         for (i = 0; i <= NDA_MAX; ++i) {
2784                 if (!tb[i])
2785                         continue;
2786 
2787                 switch (i) {
2788                 case NDA_DST:
2789                         if (nla_len(tb[i]) != (int)(*tbl)->key_len) {
2790                                 NL_SET_ERR_MSG(extack, "Invalid network address in neighbor get request");
2791                                 return -EINVAL;
2792                         }
2793                         *dst = nla_data(tb[i]);
2794                         break;
2795                 default:
2796                         NL_SET_ERR_MSG(extack, "Unsupported attribute in neighbor get request");
2797                         return -EINVAL;
2798                 }
2799         }
2800 
2801         return 0;
2802 }
2803 
2804 static inline size_t neigh_nlmsg_size(void)
2805 {
2806         return NLMSG_ALIGN(sizeof(struct ndmsg))
2807                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2808                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2809                + nla_total_size(sizeof(struct nda_cacheinfo))
2810                + nla_total_size(4)  /* NDA_PROBES */
2811                + nla_total_size(1); /* NDA_PROTOCOL */
2812 }
2813 
2814 static int neigh_get_reply(struct net *net, struct neighbour *neigh,
2815                            u32 pid, u32 seq)
2816 {
2817         struct sk_buff *skb;
2818         int err = 0;
2819 
2820         skb = nlmsg_new(neigh_nlmsg_size(), GFP_KERNEL);
2821         if (!skb)
2822                 return -ENOBUFS;
2823 
2824         err = neigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0);
2825         if (err) {
2826                 kfree_skb(skb);
2827                 goto errout;
2828         }
2829 
2830         err = rtnl_unicast(skb, net, pid);
2831 errout:
2832         return err;
2833 }
2834 
2835 static inline size_t pneigh_nlmsg_size(void)
2836 {
2837         return NLMSG_ALIGN(sizeof(struct ndmsg))
2838                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2839                + nla_total_size(1); /* NDA_PROTOCOL */
2840 }
2841 
2842 static int pneigh_get_reply(struct net *net, struct pneigh_entry *neigh,
2843                             u32 pid, u32 seq, struct neigh_table *tbl)
2844 {
2845         struct sk_buff *skb;
2846         int err = 0;
2847 
2848         skb = nlmsg_new(pneigh_nlmsg_size(), GFP_KERNEL);
2849         if (!skb)
2850                 return -ENOBUFS;
2851 
2852         err = pneigh_fill_info(skb, neigh, pid, seq, RTM_NEWNEIGH, 0, tbl);
2853         if (err) {
2854                 kfree_skb(skb);
2855                 goto errout;
2856         }
2857 
2858         err = rtnl_unicast(skb, net, pid);
2859 errout:
2860         return err;
2861 }
2862 
2863 static int neigh_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
2864                      struct netlink_ext_ack *extack)
2865 {
2866         struct net *net = sock_net(in_skb->sk);
2867         struct net_device *dev = NULL;
2868         struct neigh_table *tbl = NULL;
2869         struct neighbour *neigh;
2870         void *dst = NULL;
2871         u8 ndm_flags = 0;
2872         int dev_idx = 0;
2873         int err;
2874 
2875         err = neigh_valid_get_req(nlh, &tbl, &dst, &dev_idx, &ndm_flags,
2876                                   extack);
2877         if (err < 0)
2878                 return err;
2879 
2880         if (dev_idx) {
2881                 dev = __dev_get_by_index(net, dev_idx);
2882                 if (!dev) {
2883                         NL_SET_ERR_MSG(extack, "Unknown device ifindex");
2884                         return -ENODEV;
2885                 }
2886         }
2887 
2888         if (!dst) {
2889                 NL_SET_ERR_MSG(extack, "Network address not specified");
2890                 return -EINVAL;
2891         }
2892 
2893         if (ndm_flags & NTF_PROXY) {
2894                 struct pneigh_entry *pn;
2895 
2896                 pn = pneigh_lookup(tbl, net, dst, dev, 0);
2897                 if (!pn) {
2898                         NL_SET_ERR_MSG(extack, "Proxy neighbour entry not found");
2899                         return -ENOENT;
2900                 }
2901                 return pneigh_get_reply(net, pn, NETLINK_CB(in_skb).portid,
2902                                         nlh->nlmsg_seq, tbl);
2903         }
2904 
2905         if (!dev) {
2906                 NL_SET_ERR_MSG(extack, "No device specified");
2907                 return -EINVAL;
2908         }
2909 
2910         neigh = neigh_lookup(tbl, dst, dev);
2911         if (!neigh) {
2912                 NL_SET_ERR_MSG(extack, "Neighbour entry not found");
2913                 return -ENOENT;
2914         }
2915 
2916         err = neigh_get_reply(net, neigh, NETLINK_CB(in_skb).portid,
2917                               nlh->nlmsg_seq);
2918 
2919         neigh_release(neigh);
2920 
2921         return err;
2922 }
2923 
2924 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2925 {
2926         int chain;
2927         struct neigh_hash_table *nht;
2928 
2929         rcu_read_lock_bh();
2930         nht = rcu_dereference_bh(tbl->nht);
2931 
2932         read_lock(&tbl->lock); /* avoid resizes */
2933         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2934                 struct neighbour *n;
2935 
2936                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2937                      n != NULL;
2938                      n = rcu_dereference_bh(n->next))
2939                         cb(n, cookie);
2940         }
2941         read_unlock(&tbl->lock);
2942         rcu_read_unlock_bh();
2943 }
2944 EXPORT_SYMBOL(neigh_for_each);
2945 
2946 /* The tbl->lock must be held as a writer and BH disabled. */
2947 void __neigh_for_each_release(struct neigh_table *tbl,
2948                               int (*cb)(struct neighbour *))
2949 {
2950         int chain;
2951         struct neigh_hash_table *nht;
2952 
2953         nht = rcu_dereference_protected(tbl->nht,
2954                                         lockdep_is_held(&tbl->lock));
2955         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2956                 struct neighbour *n;
2957                 struct neighbour __rcu **np;
2958 
2959                 np = &nht->hash_buckets[chain];
2960                 while ((n = rcu_dereference_protected(*np,
2961                                         lockdep_is_held(&tbl->lock))) != NULL) {
2962                         int release;
2963 
2964                         write_lock(&n->lock);
2965                         release = cb(n);
2966                         if (release) {
2967                                 rcu_assign_pointer(*np,
2968                                         rcu_dereference_protected(n->next,
2969                                                 lockdep_is_held(&tbl->lock)));
2970                                 neigh_mark_dead(n);
2971                         } else
2972                                 np = &n->next;
2973                         write_unlock(&n->lock);
2974                         if (release)
2975                                 neigh_cleanup_and_release(n);
2976                 }
2977         }
2978 }
2979 EXPORT_SYMBOL(__neigh_for_each_release);
2980 
2981 int neigh_xmit(int index, struct net_device *dev,
2982                const void *addr, struct sk_buff *skb)
2983 {
2984         int err = -EAFNOSUPPORT;
2985         if (likely(index < NEIGH_NR_TABLES)) {
2986                 struct neigh_table *tbl;
2987                 struct neighbour *neigh;
2988 
2989                 tbl = neigh_tables[index];
2990                 if (!tbl)
2991                         goto out;
2992                 rcu_read_lock_bh();
2993                 if (index == NEIGH_ARP_TABLE) {
2994                         u32 key = *((u32 *)addr);
2995 
2996                         neigh = __ipv4_neigh_lookup_noref(dev, key);
2997                 } else {
2998                         neigh = __neigh_lookup_noref(tbl, addr, dev);
2999                 }
3000                 if (!neigh)
3001                         neigh = __neigh_create(tbl, addr, dev, false);
3002                 err = PTR_ERR(neigh);
3003                 if (IS_ERR(neigh)) {
3004                         rcu_read_unlock_bh();
3005                         goto out_kfree_skb;
3006                 }
3007                 err = neigh->output(neigh, skb);
3008                 rcu_read_unlock_bh();
3009         }
3010         else if (index == NEIGH_LINK_TABLE) {
3011                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
3012                                       addr, NULL, skb->len);
3013                 if (err < 0)
3014                         goto out_kfree_skb;
3015                 err = dev_queue_xmit(skb);
3016         }
3017 out:
3018         return err;
3019 out_kfree_skb:
3020         kfree_skb(skb);
3021         goto out;
3022 }
3023 EXPORT_SYMBOL(neigh_xmit);
3024 
3025 #ifdef CONFIG_PROC_FS
3026 
3027 static struct neighbour *neigh_get_first(struct seq_file *seq)
3028 {
3029         struct neigh_seq_state *state = seq->private;
3030         struct net *net = seq_file_net(seq);
3031         struct neigh_hash_table *nht = state->nht;
3032         struct neighbour *n = NULL;
3033         int bucket;
3034 
3035         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
3036         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
3037                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
3038 
3039                 while (n) {
3040                         if (!net_eq(dev_net(n->dev), net))
3041                                 goto next;
3042                         if (state->neigh_sub_iter) {
3043                                 loff_t fakep = 0;
3044                                 void *v;
3045 
3046                                 v = state->neigh_sub_iter(state, n, &fakep);
3047                                 if (!v)
3048                                         goto next;
3049                         }
3050                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3051                                 break;
3052                         if (n->nud_state & ~NUD_NOARP)
3053                                 break;
3054 next:
3055                         n = rcu_dereference_bh(n->next);
3056                 }
3057 
3058                 if (n)
3059                         break;
3060         }
3061         state->bucket = bucket;
3062 
3063         return n;
3064 }
3065 
3066 static struct neighbour *neigh_get_next(struct seq_file *seq,
3067                                         struct neighbour *n,
3068                                         loff_t *pos)
3069 {
3070         struct neigh_seq_state *state = seq->private;
3071         struct net *net = seq_file_net(seq);
3072         struct neigh_hash_table *nht = state->nht;
3073 
3074         if (state->neigh_sub_iter) {
3075                 void *v = state->neigh_sub_iter(state, n, pos);
3076                 if (v)
3077                         return n;
3078         }
3079         n = rcu_dereference_bh(n->next);
3080 
3081         while (1) {
3082                 while (n) {
3083                         if (!net_eq(dev_net(n->dev), net))
3084                                 goto next;
3085                         if (state->neigh_sub_iter) {
3086                                 void *v = state->neigh_sub_iter(state, n, pos);
3087                                 if (v)
3088                                         return n;
3089                                 goto next;
3090                         }
3091                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
3092                                 break;
3093 
3094                         if (n->nud_state & ~NUD_NOARP)
3095                                 break;
3096 next:
3097                         n = rcu_dereference_bh(n->next);
3098                 }
3099 
3100                 if (n)
3101                         break;
3102 
3103                 if (++state->bucket >= (1 << nht->hash_shift))
3104                         break;
3105 
3106                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
3107         }
3108 
3109         if (n && pos)
3110                 --(*pos);
3111         return n;
3112 }
3113 
3114 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
3115 {
3116         struct neighbour *n = neigh_get_first(seq);
3117 
3118         if (n) {
3119                 --(*pos);
3120                 while (*pos) {
3121                         n = neigh_get_next(seq, n, pos);
3122                         if (!n)
3123                                 break;
3124                 }
3125         }
3126         return *pos ? NULL : n;
3127 }
3128 
3129 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
3130 {
3131         struct neigh_seq_state *state = seq->private;
3132         struct net *net = seq_file_net(seq);
3133         struct neigh_table *tbl = state->tbl;
3134         struct pneigh_entry *pn = NULL;
3135         int bucket = state->bucket;
3136 
3137         state->flags |= NEIGH_SEQ_IS_PNEIGH;
3138         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
3139                 pn = tbl->phash_buckets[bucket];
3140                 while (pn && !net_eq(pneigh_net(pn), net))
3141                         pn = pn->next;
3142                 if (pn)
3143                         break;
3144         }
3145         state->bucket = bucket;
3146 
3147         return pn;
3148 }
3149 
3150 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
3151                                             struct pneigh_entry *pn,
3152                                             loff_t *pos)
3153 {
3154         struct neigh_seq_state *state = seq->private;
3155         struct net *net = seq_file_net(seq);
3156         struct neigh_table *tbl = state->tbl;
3157 
3158         do {
3159                 pn = pn->next;
3160         } while (pn && !net_eq(pneigh_net(pn), net));
3161 
3162         while (!pn) {
3163                 if (++state->bucket > PNEIGH_HASHMASK)
3164                         break;
3165                 pn = tbl->phash_buckets[state->bucket];
3166                 while (pn && !net_eq(pneigh_net(pn), net))
3167                         pn = pn->next;
3168                 if (pn)
3169                         break;
3170         }
3171 
3172         if (pn && pos)
3173                 --(*pos);
3174 
3175         return pn;
3176 }
3177 
3178 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
3179 {
3180         struct pneigh_entry *pn = pneigh_get_first(seq);
3181 
3182         if (pn) {
3183                 --(*pos);
3184                 while (*pos) {
3185                         pn = pneigh_get_next(seq, pn, pos);
3186                         if (!pn)
3187                                 break;
3188                 }
3189         }
3190         return *pos ? NULL : pn;
3191 }
3192 
3193 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
3194 {
3195         struct neigh_seq_state *state = seq->private;
3196         void *rc;
3197         loff_t idxpos = *pos;
3198 
3199         rc = neigh_get_idx(seq, &idxpos);
3200         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3201                 rc = pneigh_get_idx(seq, &idxpos);
3202 
3203         return rc;
3204 }
3205 
3206 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
3207         __acquires(tbl->lock)
3208         __acquires(rcu_bh)
3209 {
3210         struct neigh_seq_state *state = seq->private;
3211 
3212         state->tbl = tbl;
3213         state->bucket = 0;
3214         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
3215 
3216         rcu_read_lock_bh();
3217         state->nht = rcu_dereference_bh(tbl->nht);
3218         read_lock(&tbl->lock);
3219 
3220         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
3221 }
3222 EXPORT_SYMBOL(neigh_seq_start);
3223 
3224 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3225 {
3226         struct neigh_seq_state *state;
3227         void *rc;
3228 
3229         if (v == SEQ_START_TOKEN) {
3230                 rc = neigh_get_first(seq);
3231                 goto out;
3232         }
3233 
3234         state = seq->private;
3235         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
3236                 rc = neigh_get_next(seq, v, NULL);
3237                 if (rc)
3238                         goto out;
3239                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
3240                         rc = pneigh_get_first(seq);
3241         } else {
3242                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
3243                 rc = pneigh_get_next(seq, v, NULL);
3244         }
3245 out:
3246         ++(*pos);
3247         return rc;
3248 }
3249 EXPORT_SYMBOL(neigh_seq_next);
3250 
3251 void neigh_seq_stop(struct seq_file *seq, void *v)
3252         __releases(tbl->lock)
3253         __releases(rcu_bh)
3254 {
3255         struct neigh_seq_state *state = seq->private;
3256         struct neigh_table *tbl = state->tbl;
3257 
3258         read_unlock(&tbl->lock);
3259         rcu_read_unlock_bh();
3260 }
3261 EXPORT_SYMBOL(neigh_seq_stop);
3262 
3263 /* statistics via seq_file */
3264 
3265 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
3266 {
3267         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3268         int cpu;
3269 
3270         if (*pos == 0)
3271                 return SEQ_START_TOKEN;
3272 
3273         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
3274                 if (!cpu_possible(cpu))
3275                         continue;
3276                 *pos = cpu+1;
3277                 return per_cpu_ptr(tbl->stats, cpu);
3278         }
3279         return NULL;
3280 }
3281 
3282 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3283 {
3284         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3285         int cpu;
3286 
3287         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
3288                 if (!cpu_possible(cpu))
3289                         continue;
3290                 *pos = cpu+1;
3291                 return per_cpu_ptr(tbl->stats, cpu);
3292         }
3293         return NULL;
3294 }
3295 
3296 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
3297 {
3298 
3299 }
3300 
3301 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
3302 {
3303         struct neigh_table *tbl = PDE_DATA(file_inode(seq->file));
3304         struct neigh_statistics *st = v;
3305 
3306         if (v == SEQ_START_TOKEN) {
3307                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
3308                 return 0;
3309         }
3310 
3311         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
3312                         "%08lx %08lx  %08lx %08lx %08lx %08lx\n",
3313                    atomic_read(&tbl->entries),
3314 
3315                    st->allocs,
3316                    st->destroys,
3317                    st->hash_grows,
3318 
3319                    st->lookups,
3320                    st->hits,
3321 
3322                    st->res_failed,
3323 
3324                    st->rcv_probes_mcast,
3325                    st->rcv_probes_ucast,
3326 
3327                    st->periodic_gc_runs,
3328                    st->forced_gc_runs,
3329                    st->unres_discards,
3330                    st->table_fulls
3331                    );
3332 
3333         return 0;
3334 }
3335 
3336 static const struct seq_operations neigh_stat_seq_ops = {
3337         .start  = neigh_stat_seq_start,
3338         .next   = neigh_stat_seq_next,
3339         .stop   = neigh_stat_seq_stop,
3340         .show   = neigh_stat_seq_show,
3341 };
3342 #endif /* CONFIG_PROC_FS */
3343 
3344 static void __neigh_notify(struct neighbour *n, int type, int flags,
3345                            u32 pid)
3346 {
3347         struct net *net = dev_net(n->dev);
3348         struct sk_buff *skb;
3349         int err = -ENOBUFS;
3350 
3351         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
3352         if (skb == NULL)
3353                 goto errout;
3354 
3355         err = neigh_fill_info(skb, n, pid, 0, type, flags);
3356         if (err < 0) {
3357                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
3358                 WARN_ON(err == -EMSGSIZE);
3359                 kfree_skb(skb);
3360                 goto errout;
3361         }
3362         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
3363         return;
3364 errout:
3365         if (err < 0)
3366                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
3367 }
3368 
3369 void neigh_app_ns(struct neighbour *n)
3370 {
3371         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST, 0);
3372 }
3373 EXPORT_SYMBOL(neigh_app_ns);
3374 
3375 #ifdef CONFIG_SYSCTL
3376 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
3377 
3378 static int proc_unres_qlen(struct ctl_table *ctl, int write,
3379                            void __user *buffer, size_t *lenp, loff_t *ppos)
3380 {
3381         int size, ret;
3382         struct ctl_table tmp = *ctl;
3383 
3384         tmp.extra1 = SYSCTL_ZERO;
3385         tmp.extra2 = &unres_qlen_max;
3386         tmp.data = &size;
3387 
3388         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
3389         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3390 
3391         if (write && !ret)
3392                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
3393         return ret;
3394 }
3395 
3396 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
3397                                                    int family)
3398 {
3399         switch (family) {
3400         case AF_INET:
3401                 return __in_dev_arp_parms_get_rcu(dev);
3402         case AF_INET6:
3403                 return __in6_dev_nd_parms_get_rcu(dev);
3404         }
3405         return NULL;
3406 }
3407 
3408 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
3409                                   int index)
3410 {
3411         struct net_device *dev;
3412         int family = neigh_parms_family(p);
3413 
3414         rcu_read_lock();
3415         for_each_netdev_rcu(net, dev) {
3416                 struct neigh_parms *dst_p =
3417                                 neigh_get_dev_parms_rcu(dev, family);
3418 
3419                 if (dst_p && !test_bit(index, dst_p->data_state))
3420                         dst_p->data[index] = p->data[index];
3421         }
3422         rcu_read_unlock();
3423 }
3424 
3425 static void neigh_proc_update(struct ctl_table *ctl, int write)
3426 {
3427         struct net_device *dev = ctl->extra1;
3428         struct neigh_parms *p = ctl->extra2;
3429         struct net *net = neigh_parms_net(p);
3430         int index = (int *) ctl->data - p->data;
3431 
3432         if (!write)
3433                 return;
3434 
3435         set_bit(index, p->data_state);
3436         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
3437                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
3438         if (!dev) /* NULL dev means this is default value */
3439                 neigh_copy_dflt_parms(net, p, index);
3440 }
3441 
3442 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
3443                                            void __user *buffer,
3444                                            size_t *lenp, loff_t *ppos)
3445 {
3446         struct ctl_table tmp = *ctl;
3447         int ret;
3448 
3449         tmp.extra1 = SYSCTL_ZERO;
3450         tmp.extra2 = SYSCTL_INT_MAX;
3451 
3452         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
3453         neigh_proc_update(ctl, write);
3454         return ret;
3455 }
3456 
3457 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
3458                         void __user *buffer, size_t *lenp, loff_t *ppos)
3459 {
3460         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
3461 
3462         neigh_proc_update(ctl, write);
3463         return ret;
3464 }
3465 EXPORT_SYMBOL(neigh_proc_dointvec);
3466 
3467 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
3468                                 void __user *buffer,
3469                                 size_t *lenp, loff_t *ppos)
3470 {
3471         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3472 
3473         neigh_proc_update(ctl, write);
3474         return ret;
3475 }
3476 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
3477 
3478 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
3479                                               void __user *buffer,
3480                                               size_t *lenp, loff_t *ppos)
3481 {
3482         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
3483 
3484         neigh_proc_update(ctl, write);
3485         return ret;
3486 }
3487 
3488 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
3489                                    void __user *buffer,
3490                                    size_t *lenp, loff_t *ppos)
3491 {
3492         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3493 
3494         neigh_proc_update(ctl, write);
3495         return ret;
3496 }
3497 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
3498 
3499 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
3500                                           void __user *buffer,
3501                                           size_t *lenp, loff_t *ppos)
3502 {
3503         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
3504 
3505         neigh_proc_update(ctl, write);
3506         return ret;
3507 }
3508 
3509 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3510                                           void __user *buffer,
3511                                           size_t *lenp, loff_t *ppos)
3512 {
3513         struct neigh_parms *p = ctl->extra2;
3514         int ret;
3515 
3516         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3517                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3518         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3519                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3520         else
3521                 ret = -1;
3522 
3523         if (write && ret == 0) {
3524                 /* update reachable_time as well, otherwise, the change will
3525                  * only be effective after the next time neigh_periodic_work
3526                  * decides to recompute it
3527                  */
3528                 p->reachable_time =
3529                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3530         }
3531         return ret;
3532 }
3533 
3534 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3535         (&((struct neigh_parms *) 0)->data[index])
3536 
3537 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3538         [NEIGH_VAR_ ## attr] = { \
3539                 .procname       = name, \
3540                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3541                 .maxlen         = sizeof(int), \
3542                 .mode           = mval, \
3543                 .proc_handler   = proc, \
3544         }
3545 
3546 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3547         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3548 
3549 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3550         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3551 
3552 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3553         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3554 
3555 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3556         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3557 
3558 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3559         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3560 
3561 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3562         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3563 
3564 static struct neigh_sysctl_table {
3565         struct ctl_table_header *sysctl_header;
3566         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3567 } neigh_sysctl_template __read_mostly = {
3568         .neigh_vars = {
3569                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3570                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3571                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3572                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3573                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3574                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3575                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3576                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3577                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3578                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3579                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3580                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3581                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3582                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3583                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3584                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3585                 [NEIGH_VAR_GC_INTERVAL] = {
3586                         .procname       = "gc_interval",
3587                         .maxlen         = sizeof(int),
3588                         .mode           = 0644,
3589                         .proc_handler   = proc_dointvec_jiffies,
3590                 },
3591                 [NEIGH_VAR_GC_THRESH1] = {
3592                         .procname       = "gc_thresh1",
3593                         .maxlen         = sizeof(int),
3594                         .mode           = 0644,
3595                         .extra1         = SYSCTL_ZERO,
3596                         .extra2         = SYSCTL_INT_MAX,
3597                         .proc_handler   = proc_dointvec_minmax,
3598                 },
3599                 [NEIGH_VAR_GC_THRESH2] = {
3600                         .procname       = "gc_thresh2",
3601                         .maxlen         = sizeof(int),
3602                         .mode           = 0644,
3603                         .extra1         = SYSCTL_ZERO,
3604                         .extra2         = SYSCTL_INT_MAX,
3605                         .proc_handler   = proc_dointvec_minmax,
3606                 },
3607                 [NEIGH_VAR_GC_THRESH3] = {
3608                         .procname       = "gc_thresh3",
3609                         .maxlen         = sizeof(int),
3610                         .mode           = 0644,
3611                         .extra1         = SYSCTL_ZERO,
3612                         .extra2         = SYSCTL_INT_MAX,
3613                         .proc_handler   = proc_dointvec_minmax,
3614                 },
3615                 {},
3616         },
3617 };
3618 
3619 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3620                           proc_handler *handler)
3621 {
3622         int i;
3623         struct neigh_sysctl_table *t;
3624         const char *dev_name_source;
3625         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3626         char *p_name;
3627 
3628         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3629         if (!t)
3630                 goto err;
3631 
3632         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3633                 t->neigh_vars[i].data += (long) p;
3634                 t->neigh_vars[i].extra1 = dev;
3635                 t->neigh_vars[i].extra2 = p;
3636         }
3637 
3638         if (dev) {
3639                 dev_name_source = dev->name;
3640                 /* Terminate the table early */
3641                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3642                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3643         } else {
3644                 struct neigh_table *tbl = p->tbl;
3645                 dev_name_source = "default";
3646                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3647                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3648                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3649                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3650         }
3651 
3652         if (handler) {
3653                 /* RetransTime */
3654                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3655                 /* ReachableTime */
3656                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3657                 /* RetransTime (in milliseconds)*/
3658                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3659                 /* ReachableTime (in milliseconds) */
3660                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3661         } else {
3662                 /* Those handlers will update p->reachable_time after
3663                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3664                  * applied after the next neighbour update instead of waiting for
3665                  * neigh_periodic_work to update its value (can be multiple minutes)
3666                  * So any handler that replaces them should do this as well
3667                  */
3668                 /* ReachableTime */
3669                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3670                         neigh_proc_base_reachable_time;
3671                 /* ReachableTime (in milliseconds) */
3672                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3673                         neigh_proc_base_reachable_time;
3674         }
3675 
3676         /* Don't export sysctls to unprivileged users */
3677         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3678                 t->neigh_vars[0].procname = NULL;
3679 
3680         switch (neigh_parms_family(p)) {
3681         case AF_INET:
3682               p_name = "ipv4";
3683               break;
3684         case AF_INET6:
3685               p_name = "ipv6";
3686               break;
3687         default:
3688               BUG();
3689         }
3690 
3691         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3692                 p_name, dev_name_source);
3693         t->sysctl_header =
3694                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3695         if (!t->sysctl_header)
3696                 goto free;
3697 
3698         p->sysctl_table = t;
3699         return 0;
3700 
3701 free:
3702         kfree(t);
3703 err:
3704         return -ENOBUFS;
3705 }
3706 EXPORT_SYMBOL(neigh_sysctl_register);
3707 
3708 void neigh_sysctl_unregister(struct neigh_parms *p)
3709 {
3710         if (p->sysctl_table) {
3711                 struct neigh_sysctl_table *t = p->sysctl_table;
3712                 p->sysctl_table = NULL;
3713                 unregister_net_sysctl_table(t->sysctl_header);
3714                 kfree(t);
3715         }
3716 }
3717 EXPORT_SYMBOL(neigh_sysctl_unregister);
3718 
3719 #endif  /* CONFIG_SYSCTL */
3720 
3721 static int __init neigh_init(void)
3722 {
3723         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, 0);
3724         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, 0);
3725         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, neigh_get, neigh_dump_info, 0);
3726 
3727         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3728                       0);
3729         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, 0);
3730 
3731         return 0;
3732 }
3733 
3734 subsys_initcall(neigh_init);

/* [<][>][^][v][top][bottom][index][help] */