net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/slab.h>
  21 #include <linux/types.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/socket.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/proc_fs.h>
  27 #ifdef CONFIG_SYSCTL
  28 #include <linux/sysctl.h>
  29 #endif
  30 #include <linux/times.h>
  31 #include <net/net_namespace.h>
  32 #include <net/neighbour.h>
  33 #include <net/dst.h>
  34 #include <net/sock.h>
  35 #include <net/netevent.h>
  36 #include <net/netlink.h>
  37 #include <linux/rtnetlink.h>
  38 #include <linux/random.h>
  39 #include <linux/string.h>
  40 #include <linux/log2.h>
  41 #include <linux/inetdevice.h>
  42 #include <net/addrconf.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(unsigned long arg);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags);
  56 static void neigh_update_notify(struct neighbour *neigh);
  57 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  58
  59 static struct neigh_table *neigh_tables;
  60 #ifdef CONFIG_PROC_FS
  61 static const struct file_operations neigh_stat_seq_fops;
  62 #endif
  63
  64 /*
  65    Neighbour hash table buckets are protected with rwlock tbl->lock.
  66
  67    - All the scans/updates to hash buckets MUST be made under this lock.
  68    - NOTHING clever should be made under this lock: no callbacks
  69      to protocol backends, no attempts to send something to network.
  70      It will result in deadlocks, if backend/driver wants to use neighbour
  71      cache.
  72    - If the entry requires some non-trivial actions, increase
  73      its reference count and release table lock.
  74
  75    Neighbour entries are protected:
  76    - with reference count.
  77    - with rwlock neigh->lock
  78
  79    Reference count prevents destruction.
  80
  81    neigh->lock mainly serializes ll address data and its validity state.
  82    However, the same lock is used to protect another entry fields:
  83     - timer
  84     - resolution queue
  85
  86    Again, nothing clever shall be made under neigh->lock,
  87    the most complicated procedure, which we allow is dev->hard_header.
  88    It is supposed, that dev->hard_header is simplistic and does
  89    not make callbacks to neighbour tables.
  90
  91    The last lock is neigh_tbl_lock. It is pure SMP lock, protecting
  92    list of neighbour tables. This list is used only in process context,
  93  */
  94
  95 static DEFINE_RWLOCK(neigh_tbl_lock);
  96
  97 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  98 {
  99         kfree_skb(skb);
 100         return -ENETDOWN;
 101 }
 102
 103 static void neigh_cleanup_and_release(struct neighbour *neigh)
 104 {
 105         if (neigh->parms->neigh_cleanup)
 106                 neigh->parms->neigh_cleanup(neigh);
 107
 108         __neigh_notify(neigh, RTM_DELNEIGH, 0);
 109         neigh_release(neigh);
 110 }
 111
 112 /*
 113  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 114  * It corresponds to default IPv6 settings and is not overridable,
 115  * because it is really reasonable choice.
 116  */
 117
 118 unsigned long neigh_rand_reach_time(unsigned long base)
 119 {
 120         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 121 }
 122 EXPORT_SYMBOL(neigh_rand_reach_time);
 123
 124
 125 static int neigh_forced_gc(struct neigh_table *tbl)
 126 {
 127         int shrunk = 0;
 128         int i;
 129         struct neigh_hash_table *nht;
 130
 131         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 132
 133         write_lock_bh(&tbl->lock);
 134         nht = rcu_dereference_protected(tbl->nht,
 135                                         lockdep_is_held(&tbl->lock));
 136         for (i = 0; i < (1 << nht->hash_shift); i++) {
 137                 struct neighbour *n;
 138                 struct neighbour __rcu **np;
 139
 140                 np = &nht->hash_buckets[i];
 141                 while ((n = rcu_dereference_protected(*np,
 142                                         lockdep_is_held(&tbl->lock))) != NULL) {
 143                         /* Neighbour record may be discarded if:
 144                          * - nobody refers to it.
 145                          * - it is not permanent
 146                          */
 147                         write_lock(&n->lock);
 148                         if (atomic_read(&n->refcnt) == 1 &&
 149                             !(n->nud_state & NUD_PERMANENT)) {
 150                                 rcu_assign_pointer(*np,
 151                                         rcu_dereference_protected(n->next,
 152                                                   lockdep_is_held(&tbl->lock)));
 153                                 n->dead = 1;
 154                                 shrunk  = 1;
 155                                 write_unlock(&n->lock);
 156                                 neigh_cleanup_and_release(n);
 157                                 continue;
 158                         }
 159                         write_unlock(&n->lock);
 160                         np = &n->next;
 161                 }
 162         }
 163
 164         tbl->last_flush = jiffies;
 165
 166         write_unlock_bh(&tbl->lock);
 167
 168         return shrunk;
 169 }
 170
 171 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 172 {
 173         neigh_hold(n);
 174         if (unlikely(mod_timer(&n->timer, when))) {
 175                 printk("NEIGH: BUG, double timer add, state is %x\n",
 176                        n->nud_state);
 177                 dump_stack();
 178         }
 179 }
 180
 181 static int neigh_del_timer(struct neighbour *n)
 182 {
 183         if ((n->nud_state & NUD_IN_TIMER) &&
 184             del_timer(&n->timer)) {
 185                 neigh_release(n);
 186                 return 1;
 187         }
 188         return 0;
 189 }
 190
 191 static void pneigh_queue_purge(struct sk_buff_head *list)
 192 {
 193         struct sk_buff *skb;
 194
 195         while ((skb = skb_dequeue(list)) != NULL) {
 196                 dev_put(skb->dev);
 197                 kfree_skb(skb);
 198         }
 199 }
 200
 201 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 202 {
 203         int i;
 204         struct neigh_hash_table *nht;
 205
 206         nht = rcu_dereference_protected(tbl->nht,
 207                                         lockdep_is_held(&tbl->lock));
 208
 209         for (i = 0; i < (1 << nht->hash_shift); i++) {
 210                 struct neighbour *n;
 211                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 212
 213                 while ((n = rcu_dereference_protected(*np,
 214                                         lockdep_is_held(&tbl->lock))) != NULL) {
 215                         if (dev && n->dev != dev) {
 216                                 np = &n->next;
 217                                 continue;
 218                         }
 219                         rcu_assign_pointer(*np,
 220                                    rcu_dereference_protected(n->next,
 221                                                 lockdep_is_held(&tbl->lock)));
 222                         write_lock(&n->lock);
 223                         neigh_del_timer(n);
 224                         n->dead = 1;
 225
 226                         if (atomic_read(&n->refcnt) != 1) {
 227                                 /* The most unpleasant situation.
 228                                    We must destroy neighbour entry,
 229                                    but someone still uses it.
 230
 231                                    The destroy will be delayed until
 232                                    the last user releases us, but
 233                                    we must kill timers etc. and move
 234                                    it to safe state.
 235                                  */
 236                                 __skb_queue_purge(&n->arp_queue);
 237                                 n->arp_queue_len_bytes = 0;
 238                                 n->output = neigh_blackhole;
 239                                 if (n->nud_state & NUD_VALID)
 240                                         n->nud_state = NUD_NOARP;
 241                                 else
 242                                         n->nud_state = NUD_NONE;
 243                                 neigh_dbg(2, "neigh %p is stray\n", n);
 244                         }
 245                         write_unlock(&n->lock);
 246                         neigh_cleanup_and_release(n);
 247                 }
 248         }
 249 }
 250
 251 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 252 {
 253         write_lock_bh(&tbl->lock);
 254         neigh_flush_dev(tbl, dev);
 255         write_unlock_bh(&tbl->lock);
 256 }
 257 EXPORT_SYMBOL(neigh_changeaddr);
 258
 259 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 260 {
 261         write_lock_bh(&tbl->lock);
 262         neigh_flush_dev(tbl, dev);
 263         pneigh_ifdown(tbl, dev);
 264         write_unlock_bh(&tbl->lock);
 265
 266         del_timer_sync(&tbl->proxy_timer);
 267         pneigh_queue_purge(&tbl->proxy_queue);
 268         return 0;
 269 }
 270 EXPORT_SYMBOL(neigh_ifdown);
 271
 272 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 273 {
 274         struct neighbour *n = NULL;
 275         unsigned long now = jiffies;
 276         int entries;
 277
 278         entries = atomic_inc_return(&tbl->entries) - 1;
 279         if (entries >= tbl->gc_thresh3 ||
 280             (entries >= tbl->gc_thresh2 &&
 281              time_after(now, tbl->last_flush + 5 * HZ))) {
 282                 if (!neigh_forced_gc(tbl) &&
 283                     entries >= tbl->gc_thresh3)
 284                         goto out_entries;
 285         }
 286
 287         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 288         if (!n)
 289                 goto out_entries;
 290
 291         __skb_queue_head_init(&n->arp_queue);
 292         rwlock_init(&n->lock);
 293         seqlock_init(&n->ha_lock);
 294         n->updated        = n->used = now;
 295         n->nud_state      = NUD_NONE;
 296         n->output         = neigh_blackhole;
 297         seqlock_init(&n->hh.hh_lock);
 298         n->parms          = neigh_parms_clone(&tbl->parms);
 299         setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 300
 301         NEIGH_CACHE_STAT_INC(tbl, allocs);
 302         n->tbl            = tbl;
 303         atomic_set(&n->refcnt, 1);
 304         n->dead           = 1;
 305 out:
 306         return n;
 307
 308 out_entries:
 309         atomic_dec(&tbl->entries);
 310         goto out;
 311 }
 312
 313 static void neigh_get_hash_rnd(u32 *x)
 314 {
 315         get_random_bytes(x, sizeof(*x));
 316         *x |= 1;
 317 }
 318
 319 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 320 {
 321         size_t size = (1 << shift) * sizeof(struct neighbour *);
 322         struct neigh_hash_table *ret;
 323         struct neighbour __rcu **buckets;
 324         int i;
 325
 326         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 327         if (!ret)
 328                 return NULL;
 329         if (size <= PAGE_SIZE)
 330                 buckets = kzalloc(size, GFP_ATOMIC);
 331         else
 332                 buckets = (struct neighbour __rcu **)
 333                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 334                                            get_order(size));
 335         if (!buckets) {
 336                 kfree(ret);
 337                 return NULL;
 338         }
 339         ret->hash_buckets = buckets;
 340         ret->hash_shift = shift;
 341         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 342                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 343         return ret;
 344 }
 345
 346 static void neigh_hash_free_rcu(struct rcu_head *head)
 347 {
 348         struct neigh_hash_table *nht = container_of(head,
 349                                                     struct neigh_hash_table,
 350                                                     rcu);
 351         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 352         struct neighbour __rcu **buckets = nht->hash_buckets;
 353
 354         if (size <= PAGE_SIZE)
 355                 kfree(buckets);
 356         else
 357                 free_pages((unsigned long)buckets, get_order(size));
 358         kfree(nht);
 359 }
 360
 361 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 362                                                 unsigned long new_shift)
 363 {
 364         unsigned int i, hash;
 365         struct neigh_hash_table *new_nht, *old_nht;
 366
 367         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 368
 369         old_nht = rcu_dereference_protected(tbl->nht,
 370                                             lockdep_is_held(&tbl->lock));
 371         new_nht = neigh_hash_alloc(new_shift);
 372         if (!new_nht)
 373                 return old_nht;
 374
 375         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 376                 struct neighbour *n, *next;
 377
 378                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 379                                                    lockdep_is_held(&tbl->lock));
 380                      n != NULL;
 381                      n = next) {
 382                         hash = tbl->hash(n->primary_key, n->dev,
 383                                          new_nht->hash_rnd);
 384
 385                         hash >>= (32 - new_nht->hash_shift);
 386                         next = rcu_dereference_protected(n->next,
 387                                                 lockdep_is_held(&tbl->lock));
 388
 389                         rcu_assign_pointer(n->next,
 390                                            rcu_dereference_protected(
 391                                                 new_nht->hash_buckets[hash],
 392                                                 lockdep_is_held(&tbl->lock)));
 393                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 394                 }
 395         }
 396
 397         rcu_assign_pointer(tbl->nht, new_nht);
 398         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 399         return new_nht;
 400 }
 401
 402 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 403                                struct net_device *dev)
 404 {
 405         struct neighbour *n;
 406         int key_len = tbl->key_len;
 407         u32 hash_val;
 408         struct neigh_hash_table *nht;
 409
 410         NEIGH_CACHE_STAT_INC(tbl, lookups);
 411
 412         rcu_read_lock_bh();
 413         nht = rcu_dereference_bh(tbl->nht);
 414         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 415
 416         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 417              n != NULL;
 418              n = rcu_dereference_bh(n->next)) {
 419                 if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
 420                         if (!atomic_inc_not_zero(&n->refcnt))
 421                                 n = NULL;
 422                         NEIGH_CACHE_STAT_INC(tbl, hits);
 423                         break;
 424                 }
 425         }
 426
 427         rcu_read_unlock_bh();
 428         return n;
 429 }
 430 EXPORT_SYMBOL(neigh_lookup);
 431
 432 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 433                                      const void *pkey)
 434 {
 435         struct neighbour *n;
 436         int key_len = tbl->key_len;
 437         u32 hash_val;
 438         struct neigh_hash_table *nht;
 439
 440         NEIGH_CACHE_STAT_INC(tbl, lookups);
 441
 442         rcu_read_lock_bh();
 443         nht = rcu_dereference_bh(tbl->nht);
 444         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 445
 446         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 447              n != NULL;
 448              n = rcu_dereference_bh(n->next)) {
 449                 if (!memcmp(n->primary_key, pkey, key_len) &&
 450                     net_eq(dev_net(n->dev), net)) {
 451                         if (!atomic_inc_not_zero(&n->refcnt))
 452                                 n = NULL;
 453                         NEIGH_CACHE_STAT_INC(tbl, hits);
 454                         break;
 455                 }
 456         }
 457
 458         rcu_read_unlock_bh();
 459         return n;
 460 }
 461 EXPORT_SYMBOL(neigh_lookup_nodev);
 462
 463 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 464                                  struct net_device *dev, bool want_ref)
 465 {
 466         u32 hash_val;
 467         int key_len = tbl->key_len;
 468         int error;
 469         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 470         struct neigh_hash_table *nht;
 471
 472         if (!n) {
 473                 rc = ERR_PTR(-ENOBUFS);
 474                 goto out;
 475         }
 476
 477         memcpy(n->primary_key, pkey, key_len);
 478         n->dev = dev;
 479         dev_hold(dev);
 480
 481         /* Protocol specific setup. */
 482         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 483                 rc = ERR_PTR(error);
 484                 goto out_neigh_release;
 485         }
 486
 487         if (dev->netdev_ops->ndo_neigh_construct) {
 488                 error = dev->netdev_ops->ndo_neigh_construct(n);
 489                 if (error < 0) {
 490                         rc = ERR_PTR(error);
 491                         goto out_neigh_release;
 492                 }
 493         }
 494
 495         /* Device specific setup. */
 496         if (n->parms->neigh_setup &&
 497             (error = n->parms->neigh_setup(n)) < 0) {
 498                 rc = ERR_PTR(error);
 499                 goto out_neigh_release;
 500         }
 501
 502         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 503
 504         write_lock_bh(&tbl->lock);
 505         nht = rcu_dereference_protected(tbl->nht,
 506                                         lockdep_is_held(&tbl->lock));
 507
 508         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 509                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 510
 511         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 512
 513         if (n->parms->dead) {
 514                 rc = ERR_PTR(-EINVAL);
 515                 goto out_tbl_unlock;
 516         }
 517
 518         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 519                                             lockdep_is_held(&tbl->lock));
 520              n1 != NULL;
 521              n1 = rcu_dereference_protected(n1->next,
 522                         lockdep_is_held(&tbl->lock))) {
 523                 if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 524                         if (want_ref)
 525                                 neigh_hold(n1);
 526                         rc = n1;
 527                         goto out_tbl_unlock;
 528                 }
 529         }
 530
 531         n->dead = 0;
 532         if (want_ref)
 533                 neigh_hold(n);
 534         rcu_assign_pointer(n->next,
 535                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 536                                                      lockdep_is_held(&tbl->lock)));
 537         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 538         write_unlock_bh(&tbl->lock);
 539         neigh_dbg(2, "neigh %p is created\n", n);
 540         rc = n;
 541 out:
 542         return rc;
 543 out_tbl_unlock:
 544         write_unlock_bh(&tbl->lock);
 545 out_neigh_release:
 546         neigh_release(n);
 547         goto out;
 548 }
 549 EXPORT_SYMBOL(__neigh_create);
 550
 551 static u32 pneigh_hash(const void *pkey, int key_len)
 552 {
 553         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 554         hash_val ^= (hash_val >> 16);
 555         hash_val ^= hash_val >> 8;
 556         hash_val ^= hash_val >> 4;
 557         hash_val &= PNEIGH_HASHMASK;
 558         return hash_val;
 559 }
 560
 561 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 562                                               struct net *net,
 563                                               const void *pkey,
 564                                               int key_len,
 565                                               struct net_device *dev)
 566 {
 567         while (n) {
 568                 if (!memcmp(n->key, pkey, key_len) &&
 569                     net_eq(pneigh_net(n), net) &&
 570                     (n->dev == dev || !n->dev))
 571                         return n;
 572                 n = n->next;
 573         }
 574         return NULL;
 575 }
 576
 577 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 578                 struct net *net, const void *pkey, struct net_device *dev)
 579 {
 580         int key_len = tbl->key_len;
 581         u32 hash_val = pneigh_hash(pkey, key_len);
 582
 583         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 584                                  net, pkey, key_len, dev);
 585 }
 586 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 587
 588 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 589                                     struct net *net, const void *pkey,
 590                                     struct net_device *dev, int creat)
 591 {
 592         struct pneigh_entry *n;
 593         int key_len = tbl->key_len;
 594         u32 hash_val = pneigh_hash(pkey, key_len);
 595
 596         read_lock_bh(&tbl->lock);
 597         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 598                               net, pkey, key_len, dev);
 599         read_unlock_bh(&tbl->lock);
 600
 601         if (n || !creat)
 602                 goto out;
 603
 604         ASSERT_RTNL();
 605
 606         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 607         if (!n)
 608                 goto out;
 609
 610         write_pnet(&n->net, hold_net(net));
 611         memcpy(n->key, pkey, key_len);
 612         n->dev = dev;
 613         if (dev)
 614                 dev_hold(dev);
 615
 616         if (tbl->pconstructor && tbl->pconstructor(n)) {
 617                 if (dev)
 618                         dev_put(dev);
 619                 release_net(net);
 620                 kfree(n);
 621                 n = NULL;
 622                 goto out;
 623         }
 624
 625         write_lock_bh(&tbl->lock);
 626         n->next = tbl->phash_buckets[hash_val];
 627         tbl->phash_buckets[hash_val] = n;
 628         write_unlock_bh(&tbl->lock);
 629 out:
 630         return n;
 631 }
 632 EXPORT_SYMBOL(pneigh_lookup);
 633
 634
 635 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 636                   struct net_device *dev)
 637 {
 638         struct pneigh_entry *n, **np;
 639         int key_len = tbl->key_len;
 640         u32 hash_val = pneigh_hash(pkey, key_len);
 641
 642         write_lock_bh(&tbl->lock);
 643         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 644              np = &n->next) {
 645                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 646                     net_eq(pneigh_net(n), net)) {
 647                         *np = n->next;
 648                         write_unlock_bh(&tbl->lock);
 649                         if (tbl->pdestructor)
 650                                 tbl->pdestructor(n);
 651                         if (n->dev)
 652                                 dev_put(n->dev);
 653                         release_net(pneigh_net(n));
 654                         kfree(n);
 655                         return 0;
 656                 }
 657         }
 658         write_unlock_bh(&tbl->lock);
 659         return -ENOENT;
 660 }
 661
 662 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 663 {
 664         struct pneigh_entry *n, **np;
 665         u32 h;
 666
 667         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 668                 np = &tbl->phash_buckets[h];
 669                 while ((n = *np) != NULL) {
 670                         if (!dev || n->dev == dev) {
 671                                 *np = n->next;
 672                                 if (tbl->pdestructor)
 673                                         tbl->pdestructor(n);
 674                                 if (n->dev)
 675                                         dev_put(n->dev);
 676                                 release_net(pneigh_net(n));
 677                                 kfree(n);
 678                                 continue;
 679                         }
 680                         np = &n->next;
 681                 }
 682         }
 683         return -ENOENT;
 684 }
 685
 686 static void neigh_parms_destroy(struct neigh_parms *parms);
 687
 688 static inline void neigh_parms_put(struct neigh_parms *parms)
 689 {
 690         if (atomic_dec_and_test(&parms->refcnt))
 691                 neigh_parms_destroy(parms);
 692 }
 693
 694 /*
 695  *      neighbour must already be out of the table;
 696  *
 697  */
 698 void neigh_destroy(struct neighbour *neigh)
 699 {
 700         struct net_device *dev = neigh->dev;
 701
 702         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 703
 704         if (!neigh->dead) {
 705                 pr_warn("Destroying alive neighbour %p\n", neigh);
 706                 dump_stack();
 707                 return;
 708         }
 709
 710         if (neigh_del_timer(neigh))
 711                 pr_warn("Impossible event\n");
 712
 713         write_lock_bh(&neigh->lock);
 714         __skb_queue_purge(&neigh->arp_queue);
 715         write_unlock_bh(&neigh->lock);
 716         neigh->arp_queue_len_bytes = 0;
 717
 718         if (dev->netdev_ops->ndo_neigh_destroy)
 719                 dev->netdev_ops->ndo_neigh_destroy(neigh);
 720
 721         dev_put(dev);
 722         neigh_parms_put(neigh->parms);
 723
 724         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 725
 726         atomic_dec(&neigh->tbl->entries);
 727         kfree_rcu(neigh, rcu);
 728 }
 729 EXPORT_SYMBOL(neigh_destroy);
 730
 731 /* Neighbour state is suspicious;
 732    disable fast path.
 733
 734    Called with write_locked neigh.
 735  */
 736 static void neigh_suspect(struct neighbour *neigh)
 737 {
 738         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 739
 740         neigh->output = neigh->ops->output;
 741 }
 742
 743 /* Neighbour state is OK;
 744    enable fast path.
 745
 746    Called with write_locked neigh.
 747  */
 748 static void neigh_connect(struct neighbour *neigh)
 749 {
 750         neigh_dbg(2, "neigh %p is connected\n", neigh);
 751
 752         neigh->output = neigh->ops->connected_output;
 753 }
 754
 755 static void neigh_periodic_work(struct work_struct *work)
 756 {
 757         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 758         struct neighbour *n;
 759         struct neighbour __rcu **np;
 760         unsigned int i;
 761         struct neigh_hash_table *nht;
 762
 763         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 764
 765         write_lock_bh(&tbl->lock);
 766         nht = rcu_dereference_protected(tbl->nht,
 767                                         lockdep_is_held(&tbl->lock));
 768
 769         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 770                 goto out;
 771
 772         /*
 773          *      periodically recompute ReachableTime from random function
 774          */
 775
 776         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 777                 struct neigh_parms *p;
 778                 tbl->last_rand = jiffies;
 779                 for (p = &tbl->parms; p; p = p->next)
 780                         p->reachable_time =
 781                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 782         }
 783
 784         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 785                 np = &nht->hash_buckets[i];
 786
 787                 while ((n = rcu_dereference_protected(*np,
 788                                 lockdep_is_held(&tbl->lock))) != NULL) {
 789                         unsigned int state;
 790
 791                         write_lock(&n->lock);
 792
 793                         state = n->nud_state;
 794                         if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 795                                 write_unlock(&n->lock);
 796                                 goto next_elt;
 797                         }
 798
 799                         if (time_before(n->used, n->confirmed))
 800                                 n->used = n->confirmed;
 801
 802                         if (atomic_read(&n->refcnt) == 1 &&
 803                             (state == NUD_FAILED ||
 804                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 805                                 *np = n->next;
 806                                 n->dead = 1;
 807                                 write_unlock(&n->lock);
 808                                 neigh_cleanup_and_release(n);
 809                                 continue;
 810                         }
 811                         write_unlock(&n->lock);
 812
 813 next_elt:
 814                         np = &n->next;
 815                 }
 816                 /*
 817                  * It's fine to release lock here, even if hash table
 818                  * grows while we are preempted.
 819                  */
 820                 write_unlock_bh(&tbl->lock);
 821                 cond_resched();
 822                 write_lock_bh(&tbl->lock);
 823                 nht = rcu_dereference_protected(tbl->nht,
 824                                                 lockdep_is_held(&tbl->lock));
 825         }
 826 out:
 827         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 828          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 829          * BASE_REACHABLE_TIME.
 830          */
 831         schedule_delayed_work(&tbl->gc_work,
 832                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 833         write_unlock_bh(&tbl->lock);
 834 }
 835
 836 static __inline__ int neigh_max_probes(struct neighbour *n)
 837 {
 838         struct neigh_parms *p = n->parms;
 839         return (n->nud_state & NUD_PROBE) ?
 840                 NEIGH_VAR(p, UCAST_PROBES) :
 841                 NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 842                 NEIGH_VAR(p, MCAST_PROBES);
 843 }
 844
 845 static void neigh_invalidate(struct neighbour *neigh)
 846         __releases(neigh->lock)
 847         __acquires(neigh->lock)
 848 {
 849         struct sk_buff *skb;
 850
 851         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 852         neigh_dbg(2, "neigh %p is failed\n", neigh);
 853         neigh->updated = jiffies;
 854
 855         /* It is very thin place. report_unreachable is very complicated
 856            routine. Particularly, it can hit the same neighbour entry!
 857
 858            So that, we try to be accurate and avoid dead loop. --ANK
 859          */
 860         while (neigh->nud_state == NUD_FAILED &&
 861                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 862                 write_unlock(&neigh->lock);
 863                 neigh->ops->error_report(neigh, skb);
 864                 write_lock(&neigh->lock);
 865         }
 866         __skb_queue_purge(&neigh->arp_queue);
 867         neigh->arp_queue_len_bytes = 0;
 868 }
 869
 870 static void neigh_probe(struct neighbour *neigh)
 871         __releases(neigh->lock)
 872 {
 873         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 874         /* keep skb alive even if arp_queue overflows */
 875         if (skb)
 876                 skb = skb_copy(skb, GFP_ATOMIC);
 877         write_unlock(&neigh->lock);
 878         neigh->ops->solicit(neigh, skb);
 879         atomic_inc(&neigh->probes);
 880         kfree_skb(skb);
 881 }
 882
 883 /* Called when a timer expires for a neighbour entry. */
 884
 885 static void neigh_timer_handler(unsigned long arg)
 886 {
 887         unsigned long now, next;
 888         struct neighbour *neigh = (struct neighbour *)arg;
 889         unsigned int state;
 890         int notify = 0;
 891
 892         write_lock(&neigh->lock);
 893
 894         state = neigh->nud_state;
 895         now = jiffies;
 896         next = now + HZ;
 897
 898         if (!(state & NUD_IN_TIMER))
 899                 goto out;
 900
 901         if (state & NUD_REACHABLE) {
 902                 if (time_before_eq(now,
 903                                    neigh->confirmed + neigh->parms->reachable_time)) {
 904                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
 905                         next = neigh->confirmed + neigh->parms->reachable_time;
 906                 } else if (time_before_eq(now,
 907                                           neigh->used +
 908                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 909                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
 910                         neigh->nud_state = NUD_DELAY;
 911                         neigh->updated = jiffies;
 912                         neigh_suspect(neigh);
 913                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 914                 } else {
 915                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 916                         neigh->nud_state = NUD_STALE;
 917                         neigh->updated = jiffies;
 918                         neigh_suspect(neigh);
 919                         notify = 1;
 920                 }
 921         } else if (state & NUD_DELAY) {
 922                 if (time_before_eq(now,
 923                                    neigh->confirmed +
 924                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 925                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 926                         neigh->nud_state = NUD_REACHABLE;
 927                         neigh->updated = jiffies;
 928                         neigh_connect(neigh);
 929                         notify = 1;
 930                         next = neigh->confirmed + neigh->parms->reachable_time;
 931                 } else {
 932                         neigh_dbg(2, "neigh %p is probed\n", neigh);
 933                         neigh->nud_state = NUD_PROBE;
 934                         neigh->updated = jiffies;
 935                         atomic_set(&neigh->probes, 0);
 936                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 937                 }
 938         } else {
 939                 /* NUD_PROBE|NUD_INCOMPLETE */
 940                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 941         }
 942
 943         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 944             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 945                 neigh->nud_state = NUD_FAILED;
 946                 notify = 1;
 947                 neigh_invalidate(neigh);
 948         }
 949
 950         if (neigh->nud_state & NUD_IN_TIMER) {
 951                 if (time_before(next, jiffies + HZ/2))
 952                         next = jiffies + HZ/2;
 953                 if (!mod_timer(&neigh->timer, next))
 954                         neigh_hold(neigh);
 955         }
 956         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 957                 neigh_probe(neigh);
 958         } else {
 959 out:
 960                 write_unlock(&neigh->lock);
 961         }
 962
 963         if (notify)
 964                 neigh_update_notify(neigh);
 965
 966         neigh_release(neigh);
 967 }
 968
 969 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 970 {
 971         int rc;
 972         bool immediate_probe = false;
 973
 974         write_lock_bh(&neigh->lock);
 975
 976         rc = 0;
 977         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
 978                 goto out_unlock_bh;
 979
 980         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
 981                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
 982                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
 983                         unsigned long next, now = jiffies;
 984
 985                         atomic_set(&neigh->probes,
 986                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
 987                         neigh->nud_state     = NUD_INCOMPLETE;
 988                         neigh->updated = now;
 989                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
 990                                          HZ/2);
 991                         neigh_add_timer(neigh, next);
 992                         immediate_probe = true;
 993                 } else {
 994                         neigh->nud_state = NUD_FAILED;
 995                         neigh->updated = jiffies;
 996                         write_unlock_bh(&neigh->lock);
 997
 998                         kfree_skb(skb);
 999                         return 1;
1000                 }
1001         } else if (neigh->nud_state & NUD_STALE) {
1002                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
1003                 neigh->nud_state = NUD_DELAY;
1004                 neigh->updated = jiffies;
1005                 neigh_add_timer(neigh, jiffies +
1006                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
1007         }
1008
1009         if (neigh->nud_state == NUD_INCOMPLETE) {
1010                 if (skb) {
1011                         while (neigh->arp_queue_len_bytes + skb->truesize >
1012                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1013                                 struct sk_buff *buff;
1014
1015                                 buff = __skb_dequeue(&neigh->arp_queue);
1016                                 if (!buff)
1017                                         break;
1018                                 neigh->arp_queue_len_bytes -= buff->truesize;
1019                                 kfree_skb(buff);
1020                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1021                         }
1022                         skb_dst_force(skb);
1023                         __skb_queue_tail(&neigh->arp_queue, skb);
1024                         neigh->arp_queue_len_bytes += skb->truesize;
1025                 }
1026                 rc = 1;
1027         }
1028 out_unlock_bh:
1029         if (immediate_probe)
1030                 neigh_probe(neigh);
1031         else
1032                 write_unlock(&neigh->lock);
1033         local_bh_enable();
1034         return rc;
1035 }
1036 EXPORT_SYMBOL(__neigh_event_send);
1037
1038 static void neigh_update_hhs(struct neighbour *neigh)
1039 {
1040         struct hh_cache *hh;
1041         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1042                 = NULL;
1043
1044         if (neigh->dev->header_ops)
1045                 update = neigh->dev->header_ops->cache_update;
1046
1047         if (update) {
1048                 hh = &neigh->hh;
1049                 if (hh->hh_len) {
1050                         write_seqlock_bh(&hh->hh_lock);
1051                         update(hh, neigh->dev, neigh->ha);
1052                         write_sequnlock_bh(&hh->hh_lock);
1053                 }
1054         }
1055 }
1056
1057
1058
1059 /* Generic update routine.
1060    -- lladdr is new lladdr or NULL, if it is not supplied.
1061    -- new    is new state.
1062    -- flags
1063         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1064                                 if it is different.
1065         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1066                                 lladdr instead of overriding it
1067                                 if it is different.
1068                                 It also allows to retain current state
1069                                 if lladdr is unchanged.
1070         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1071
1072         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1073                                 NTF_ROUTER flag.
1074         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1075                                 a router.
1076
1077    Caller MUST hold reference count on the entry.
1078  */
1079
1080 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1081                  u32 flags)
1082 {
1083         u8 old;
1084         int err;
1085         int notify = 0;
1086         struct net_device *dev;
1087         int update_isrouter = 0;
1088
1089         write_lock_bh(&neigh->lock);
1090
1091         dev    = neigh->dev;
1092         old    = neigh->nud_state;
1093         err    = -EPERM;
1094
1095         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1096             (old & (NUD_NOARP | NUD_PERMANENT)))
1097                 goto out;
1098
1099         if (!(new & NUD_VALID)) {
1100                 neigh_del_timer(neigh);
1101                 if (old & NUD_CONNECTED)
1102                         neigh_suspect(neigh);
1103                 neigh->nud_state = new;
1104                 err = 0;
1105                 notify = old & NUD_VALID;
1106                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1107                     (new & NUD_FAILED)) {
1108                         neigh_invalidate(neigh);
1109                         notify = 1;
1110                 }
1111                 goto out;
1112         }
1113
1114         /* Compare new lladdr with cached one */
1115         if (!dev->addr_len) {
1116                 /* First case: device needs no address. */
1117                 lladdr = neigh->ha;
1118         } else if (lladdr) {
1119                 /* The second case: if something is already cached
1120                    and a new address is proposed:
1121                    - compare new & old
1122                    - if they are different, check override flag
1123                  */
1124                 if ((old & NUD_VALID) &&
1125                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1126                         lladdr = neigh->ha;
1127         } else {
1128                 /* No address is supplied; if we know something,
1129                    use it, otherwise discard the request.
1130                  */
1131                 err = -EINVAL;
1132                 if (!(old & NUD_VALID))
1133                         goto out;
1134                 lladdr = neigh->ha;
1135         }
1136
1137         if (new & NUD_CONNECTED)
1138                 neigh->confirmed = jiffies;
1139         neigh->updated = jiffies;
1140
1141         /* If entry was valid and address is not changed,
1142            do not change entry state, if new one is STALE.
1143          */
1144         err = 0;
1145         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1146         if (old & NUD_VALID) {
1147                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1148                         update_isrouter = 0;
1149                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1150                             (old & NUD_CONNECTED)) {
1151                                 lladdr = neigh->ha;
1152                                 new = NUD_STALE;
1153                         } else
1154                                 goto out;
1155                 } else {
1156                         if (lladdr == neigh->ha && new == NUD_STALE &&
1157                             ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) ||
1158                              (old & NUD_CONNECTED))
1159                             )
1160                                 new = old;
1161                 }
1162         }
1163
1164         if (new != old) {
1165                 neigh_del_timer(neigh);
1166                 if (new & NUD_IN_TIMER)
1167                         neigh_add_timer(neigh, (jiffies +
1168                                                 ((new & NUD_REACHABLE) ?
1169                                                  neigh->parms->reachable_time :
1170                                                  0)));
1171                 neigh->nud_state = new;
1172                 notify = 1;
1173         }
1174
1175         if (lladdr != neigh->ha) {
1176                 write_seqlock(&neigh->ha_lock);
1177                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1178                 write_sequnlock(&neigh->ha_lock);
1179                 neigh_update_hhs(neigh);
1180                 if (!(new & NUD_CONNECTED))
1181                         neigh->confirmed = jiffies -
1182                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1183                 notify = 1;
1184         }
1185         if (new == old)
1186                 goto out;
1187         if (new & NUD_CONNECTED)
1188                 neigh_connect(neigh);
1189         else
1190                 neigh_suspect(neigh);
1191         if (!(old & NUD_VALID)) {
1192                 struct sk_buff *skb;
1193
1194                 /* Again: avoid dead loop if something went wrong */
1195
1196                 while (neigh->nud_state & NUD_VALID &&
1197                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1198                         struct dst_entry *dst = skb_dst(skb);
1199                         struct neighbour *n2, *n1 = neigh;
1200                         write_unlock_bh(&neigh->lock);
1201
1202                         rcu_read_lock();
1203
1204                         /* Why not just use 'neigh' as-is?  The problem is that
1205                          * things such as shaper, eql, and sch_teql can end up
1206                          * using alternative, different, neigh objects to output
1207                          * the packet in the output path.  So what we need to do
1208                          * here is re-lookup the top-level neigh in the path so
1209                          * we can reinject the packet there.
1210                          */
1211                         n2 = NULL;
1212                         if (dst) {
1213                                 n2 = dst_neigh_lookup_skb(dst, skb);
1214                                 if (n2)
1215                                         n1 = n2;
1216                         }
1217                         n1->output(n1, skb);
1218                         if (n2)
1219                                 neigh_release(n2);
1220                         rcu_read_unlock();
1221
1222                         write_lock_bh(&neigh->lock);
1223                 }
1224                 __skb_queue_purge(&neigh->arp_queue);
1225                 neigh->arp_queue_len_bytes = 0;
1226         }
1227 out:
1228         if (update_isrouter) {
1229                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1230                         (neigh->flags | NTF_ROUTER) :
1231                         (neigh->flags & ~NTF_ROUTER);
1232         }
1233         write_unlock_bh(&neigh->lock);
1234
1235         if (notify)
1236                 neigh_update_notify(neigh);
1237
1238         return err;
1239 }
1240 EXPORT_SYMBOL(neigh_update);
1241
1242 /* Update the neigh to listen temporarily for probe responses, even if it is
1243  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1244  */
1245 void __neigh_set_probe_once(struct neighbour *neigh)
1246 {
1247         neigh->updated = jiffies;
1248         if (!(neigh->nud_state & NUD_FAILED))
1249                 return;
1250         neigh->nud_state = NUD_PROBE;
1251         atomic_set(&neigh->probes, NEIGH_VAR(neigh->parms, UCAST_PROBES));
1252         neigh_add_timer(neigh,
1253                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1254 }
1255 EXPORT_SYMBOL(__neigh_set_probe_once);
1256
1257 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1258                                  u8 *lladdr, void *saddr,
1259                                  struct net_device *dev)
1260 {
1261         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1262                                                  lladdr || !dev->addr_len);
1263         if (neigh)
1264                 neigh_update(neigh, lladdr, NUD_STALE,
1265                              NEIGH_UPDATE_F_OVERRIDE);
1266         return neigh;
1267 }
1268 EXPORT_SYMBOL(neigh_event_ns);
1269
1270 /* called with read_lock_bh(&n->lock); */
1271 static void neigh_hh_init(struct neighbour *n, struct dst_entry *dst)
1272 {
1273         struct net_device *dev = dst->dev;
1274         __be16 prot = dst->ops->protocol;
1275         struct hh_cache *hh = &n->hh;
1276
1277         write_lock_bh(&n->lock);
1278
1279         /* Only one thread can come in here and initialize the
1280          * hh_cache entry.
1281          */
1282         if (!hh->hh_len)
1283                 dev->header_ops->cache(n, hh, prot);
1284
1285         write_unlock_bh(&n->lock);
1286 }
1287
1288 /* This function can be used in contexts, where only old dev_queue_xmit
1289  * worked, f.e. if you want to override normal output path (eql, shaper),
1290  * but resolution is not made yet.
1291  */
1292
1293 int neigh_compat_output(struct neighbour *neigh, struct sk_buff *skb)
1294 {
1295         struct net_device *dev = skb->dev;
1296
1297         __skb_pull(skb, skb_network_offset(skb));
1298
1299         if (dev_hard_header(skb, dev, ntohs(skb->protocol), NULL, NULL,
1300                             skb->len) < 0 &&
1301             dev_rebuild_header(skb))
1302                 return 0;
1303
1304         return dev_queue_xmit(skb);
1305 }
1306 EXPORT_SYMBOL(neigh_compat_output);
1307
1308 /* Slow and careful. */
1309
1310 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1311 {
1312         struct dst_entry *dst = skb_dst(skb);
1313         int rc = 0;
1314
1315         if (!dst)
1316                 goto discard;
1317
1318         if (!neigh_event_send(neigh, skb)) {
1319                 int err;
1320                 struct net_device *dev = neigh->dev;
1321                 unsigned int seq;
1322
1323                 if (dev->header_ops->cache && !neigh->hh.hh_len)
1324                         neigh_hh_init(neigh, dst);
1325
1326                 do {
1327                         __skb_pull(skb, skb_network_offset(skb));
1328                         seq = read_seqbegin(&neigh->ha_lock);
1329                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1330                                               neigh->ha, NULL, skb->len);
1331                 } while (read_seqretry(&neigh->ha_lock, seq));
1332
1333                 if (err >= 0)
1334                         rc = dev_queue_xmit(skb);
1335                 else
1336                         goto out_kfree_skb;
1337         }
1338 out:
1339         return rc;
1340 discard:
1341         neigh_dbg(1, "%s: dst=%p neigh=%p\n", __func__, dst, neigh);
1342 out_kfree_skb:
1343         rc = -EINVAL;
1344         kfree_skb(skb);
1345         goto out;
1346 }
1347 EXPORT_SYMBOL(neigh_resolve_output);
1348
1349 /* As fast as possible without hh cache */
1350
1351 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1352 {
1353         struct net_device *dev = neigh->dev;
1354         unsigned int seq;
1355         int err;
1356
1357         do {
1358                 __skb_pull(skb, skb_network_offset(skb));
1359                 seq = read_seqbegin(&neigh->ha_lock);
1360                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1361                                       neigh->ha, NULL, skb->len);
1362         } while (read_seqretry(&neigh->ha_lock, seq));
1363
1364         if (err >= 0)
1365                 err = dev_queue_xmit(skb);
1366         else {
1367                 err = -EINVAL;
1368                 kfree_skb(skb);
1369         }
1370         return err;
1371 }
1372 EXPORT_SYMBOL(neigh_connected_output);
1373
1374 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1375 {
1376         return dev_queue_xmit(skb);
1377 }
1378 EXPORT_SYMBOL(neigh_direct_output);
1379
1380 static void neigh_proxy_process(unsigned long arg)
1381 {
1382         struct neigh_table *tbl = (struct neigh_table *)arg;
1383         long sched_next = 0;
1384         unsigned long now = jiffies;
1385         struct sk_buff *skb, *n;
1386
1387         spin_lock(&tbl->proxy_queue.lock);
1388
1389         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1390                 long tdif = NEIGH_CB(skb)->sched_next - now;
1391
1392                 if (tdif <= 0) {
1393                         struct net_device *dev = skb->dev;
1394
1395                         __skb_unlink(skb, &tbl->proxy_queue);
1396                         if (tbl->proxy_redo && netif_running(dev)) {
1397                                 rcu_read_lock();
1398                                 tbl->proxy_redo(skb);
1399                                 rcu_read_unlock();
1400                         } else {
1401                                 kfree_skb(skb);
1402                         }
1403
1404                         dev_put(dev);
1405                 } else if (!sched_next || tdif < sched_next)
1406                         sched_next = tdif;
1407         }
1408         del_timer(&tbl->proxy_timer);
1409         if (sched_next)
1410                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1411         spin_unlock(&tbl->proxy_queue.lock);
1412 }
1413
1414 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1415                     struct sk_buff *skb)
1416 {
1417         unsigned long now = jiffies;
1418
1419         unsigned long sched_next = now + (prandom_u32() %
1420                                           NEIGH_VAR(p, PROXY_DELAY));
1421
1422         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1423                 kfree_skb(skb);
1424                 return;
1425         }
1426
1427         NEIGH_CB(skb)->sched_next = sched_next;
1428         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1429
1430         spin_lock(&tbl->proxy_queue.lock);
1431         if (del_timer(&tbl->proxy_timer)) {
1432                 if (time_before(tbl->proxy_timer.expires, sched_next))
1433                         sched_next = tbl->proxy_timer.expires;
1434         }
1435         skb_dst_drop(skb);
1436         dev_hold(skb->dev);
1437         __skb_queue_tail(&tbl->proxy_queue, skb);
1438         mod_timer(&tbl->proxy_timer, sched_next);
1439         spin_unlock(&tbl->proxy_queue.lock);
1440 }
1441 EXPORT_SYMBOL(pneigh_enqueue);
1442
1443 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1444                                                       struct net *net, int ifindex)
1445 {
1446         struct neigh_parms *p;
1447
1448         for (p = &tbl->parms; p; p = p->next) {
1449                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1450                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1451                         return p;
1452         }
1453
1454         return NULL;
1455 }
1456
1457 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1458                                       struct neigh_table *tbl)
1459 {
1460         struct neigh_parms *p;
1461         struct net *net = dev_net(dev);
1462         const struct net_device_ops *ops = dev->netdev_ops;
1463
1464         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1465         if (p) {
1466                 p->tbl            = tbl;
1467                 atomic_set(&p->refcnt, 1);
1468                 p->reachable_time =
1469                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1470                 dev_hold(dev);
1471                 p->dev = dev;
1472                 write_pnet(&p->net, hold_net(net));
1473                 p->sysctl_table = NULL;
1474
1475                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1476                         release_net(net);
1477                         dev_put(dev);
1478                         kfree(p);
1479                         return NULL;
1480                 }
1481
1482                 write_lock_bh(&tbl->lock);
1483                 p->next         = tbl->parms.next;
1484                 tbl->parms.next = p;
1485                 write_unlock_bh(&tbl->lock);
1486
1487                 neigh_parms_data_state_cleanall(p);
1488         }
1489         return p;
1490 }
1491 EXPORT_SYMBOL(neigh_parms_alloc);
1492
1493 static void neigh_rcu_free_parms(struct rcu_head *head)
1494 {
1495         struct neigh_parms *parms =
1496                 container_of(head, struct neigh_parms, rcu_head);
1497
1498         neigh_parms_put(parms);
1499 }
1500
1501 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1502 {
1503         struct neigh_parms **p;
1504
1505         if (!parms || parms == &tbl->parms)
1506                 return;
1507         write_lock_bh(&tbl->lock);
1508         for (p = &tbl->parms.next; *p; p = &(*p)->next) {
1509                 if (*p == parms) {
1510                         *p = parms->next;
1511                         parms->dead = 1;
1512                         write_unlock_bh(&tbl->lock);
1513                         if (parms->dev)
1514                                 dev_put(parms->dev);
1515                         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1516                         return;
1517                 }
1518         }
1519         write_unlock_bh(&tbl->lock);
1520         neigh_dbg(1, "%s: not found\n", __func__);
1521 }
1522 EXPORT_SYMBOL(neigh_parms_release);
1523
1524 static void neigh_parms_destroy(struct neigh_parms *parms)
1525 {
1526         release_net(neigh_parms_net(parms));
1527         kfree(parms);
1528 }
1529
1530 static struct lock_class_key neigh_table_proxy_queue_class;
1531
1532 static void neigh_table_init_no_netlink(struct neigh_table *tbl)
1533 {
1534         unsigned long now = jiffies;
1535         unsigned long phsize;
1536
1537         write_pnet(&tbl->parms.net, &init_net);
1538         atomic_set(&tbl->parms.refcnt, 1);
1539         tbl->parms.reachable_time =
1540                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1541
1542         tbl->stats = alloc_percpu(struct neigh_statistics);
1543         if (!tbl->stats)
1544                 panic("cannot create neighbour cache statistics");
1545
1546 #ifdef CONFIG_PROC_FS
1547         if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1548                               &neigh_stat_seq_fops, tbl))
1549                 panic("cannot create neighbour proc dir entry");
1550 #endif
1551
1552         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1553
1554         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1555         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1556
1557         if (!tbl->nht || !tbl->phash_buckets)
1558                 panic("cannot allocate neighbour cache hashes");
1559
1560         if (!tbl->entry_size)
1561                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1562                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1563         else
1564                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1565
1566         rwlock_init(&tbl->lock);
1567         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1568         schedule_delayed_work(&tbl->gc_work, tbl->parms.reachable_time);
1569         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1570         skb_queue_head_init_class(&tbl->proxy_queue,
1571                         &neigh_table_proxy_queue_class);
1572
1573         tbl->last_flush = now;
1574         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1575 }
1576
1577 void neigh_table_init(struct neigh_table *tbl)
1578 {
1579         struct neigh_table *tmp;
1580
1581         neigh_table_init_no_netlink(tbl);
1582         write_lock(&neigh_tbl_lock);
1583         for (tmp = neigh_tables; tmp; tmp = tmp->next) {
1584                 if (tmp->family == tbl->family)
1585                         break;
1586         }
1587         tbl->next       = neigh_tables;
1588         neigh_tables    = tbl;
1589         write_unlock(&neigh_tbl_lock);
1590
1591         if (unlikely(tmp)) {
1592                 pr_err("Registering multiple tables for family %d\n",
1593                        tbl->family);
1594                 dump_stack();
1595         }
1596 }
1597 EXPORT_SYMBOL(neigh_table_init);
1598
1599 int neigh_table_clear(struct neigh_table *tbl)
1600 {
1601         struct neigh_table **tp;
1602
1603         /* It is not clean... Fix it to unload IPv6 module safely */
1604         cancel_delayed_work_sync(&tbl->gc_work);
1605         del_timer_sync(&tbl->proxy_timer);
1606         pneigh_queue_purge(&tbl->proxy_queue);
1607         neigh_ifdown(tbl, NULL);
1608         if (atomic_read(&tbl->entries))
1609                 pr_crit("neighbour leakage\n");
1610         write_lock(&neigh_tbl_lock);
1611         for (tp = &neigh_tables; *tp; tp = &(*tp)->next) {
1612                 if (*tp == tbl) {
1613                         *tp = tbl->next;
1614                         break;
1615                 }
1616         }
1617         write_unlock(&neigh_tbl_lock);
1618
1619         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1620                  neigh_hash_free_rcu);
1621         tbl->nht = NULL;
1622
1623         kfree(tbl->phash_buckets);
1624         tbl->phash_buckets = NULL;
1625
1626         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1627
1628         free_percpu(tbl->stats);
1629         tbl->stats = NULL;
1630
1631         return 0;
1632 }
1633 EXPORT_SYMBOL(neigh_table_clear);
1634
1635 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh)
1636 {
1637         struct net *net = sock_net(skb->sk);
1638         struct ndmsg *ndm;
1639         struct nlattr *dst_attr;
1640         struct neigh_table *tbl;
1641         struct net_device *dev = NULL;
1642         int err = -EINVAL;
1643
1644         ASSERT_RTNL();
1645         if (nlmsg_len(nlh) < sizeof(*ndm))
1646                 goto out;
1647
1648         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1649         if (dst_attr == NULL)
1650                 goto out;
1651
1652         ndm = nlmsg_data(nlh);
1653         if (ndm->ndm_ifindex) {
1654                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1655                 if (dev == NULL) {
1656                         err = -ENODEV;
1657                         goto out;
1658                 }
1659         }
1660
1661         read_lock(&neigh_tbl_lock);
1662         for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1663                 struct neighbour *neigh;
1664
1665                 if (tbl->family != ndm->ndm_family)
1666                         continue;
1667                 read_unlock(&neigh_tbl_lock);
1668
1669                 if (nla_len(dst_attr) < tbl->key_len)
1670                         goto out;
1671
1672                 if (ndm->ndm_flags & NTF_PROXY) {
1673                         err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1674                         goto out;
1675                 }
1676
1677                 if (dev == NULL)
1678                         goto out;
1679
1680                 neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1681                 if (neigh == NULL) {
1682                         err = -ENOENT;
1683                         goto out;
1684                 }
1685
1686                 err = neigh_update(neigh, NULL, NUD_FAILED,
1687                                    NEIGH_UPDATE_F_OVERRIDE |
1688                                    NEIGH_UPDATE_F_ADMIN);
1689                 neigh_release(neigh);
1690                 goto out;
1691         }
1692         read_unlock(&neigh_tbl_lock);
1693         err = -EAFNOSUPPORT;
1694
1695 out:
1696         return err;
1697 }
1698
1699 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh)
1700 {
1701         struct net *net = sock_net(skb->sk);
1702         struct ndmsg *ndm;
1703         struct nlattr *tb[NDA_MAX+1];
1704         struct neigh_table *tbl;
1705         struct net_device *dev = NULL;
1706         int err;
1707
1708         ASSERT_RTNL();
1709         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
1710         if (err < 0)
1711                 goto out;
1712
1713         err = -EINVAL;
1714         if (tb[NDA_DST] == NULL)
1715                 goto out;
1716
1717         ndm = nlmsg_data(nlh);
1718         if (ndm->ndm_ifindex) {
1719                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1720                 if (dev == NULL) {
1721                         err = -ENODEV;
1722                         goto out;
1723                 }
1724
1725                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1726                         goto out;
1727         }
1728
1729         read_lock(&neigh_tbl_lock);
1730         for (tbl = neigh_tables; tbl; tbl = tbl->next) {
1731                 int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1732                 struct neighbour *neigh;
1733                 void *dst, *lladdr;
1734
1735                 if (tbl->family != ndm->ndm_family)
1736                         continue;
1737                 read_unlock(&neigh_tbl_lock);
1738
1739                 if (nla_len(tb[NDA_DST]) < tbl->key_len)
1740                         goto out;
1741                 dst = nla_data(tb[NDA_DST]);
1742                 lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1743
1744                 if (ndm->ndm_flags & NTF_PROXY) {
1745                         struct pneigh_entry *pn;
1746
1747                         err = -ENOBUFS;
1748                         pn = pneigh_lookup(tbl, net, dst, dev, 1);
1749                         if (pn) {
1750                                 pn->flags = ndm->ndm_flags;
1751                                 err = 0;
1752                         }
1753                         goto out;
1754                 }
1755
1756                 if (dev == NULL)
1757                         goto out;
1758
1759                 neigh = neigh_lookup(tbl, dst, dev);
1760                 if (neigh == NULL) {
1761                         if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1762                                 err = -ENOENT;
1763                                 goto out;
1764                         }
1765
1766                         neigh = __neigh_lookup_errno(tbl, dst, dev);
1767                         if (IS_ERR(neigh)) {
1768                                 err = PTR_ERR(neigh);
1769                                 goto out;
1770                         }
1771                 } else {
1772                         if (nlh->nlmsg_flags & NLM_F_EXCL) {
1773                                 err = -EEXIST;
1774                                 neigh_release(neigh);
1775                                 goto out;
1776                         }
1777
1778                         if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1779                                 flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1780                 }
1781
1782                 if (ndm->ndm_flags & NTF_USE) {
1783                         neigh_event_send(neigh, NULL);
1784                         err = 0;
1785                 } else
1786                         err = neigh_update(neigh, lladdr, ndm->ndm_state, flags);
1787                 neigh_release(neigh);
1788                 goto out;
1789         }
1790
1791         read_unlock(&neigh_tbl_lock);
1792         err = -EAFNOSUPPORT;
1793 out:
1794         return err;
1795 }
1796
1797 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1798 {
1799         struct nlattr *nest;
1800
1801         nest = nla_nest_start(skb, NDTA_PARMS);
1802         if (nest == NULL)
1803                 return -ENOBUFS;
1804
1805         if ((parms->dev &&
1806              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1807             nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
1808             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1809                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1810             /* approximative value for deprecated QUEUE_LEN (in packets) */
1811             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1812                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1813             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1814             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1815             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1816                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1817             nla_put_u32(skb, NDTPA_MCAST_PROBES,
1818                         NEIGH_VAR(parms, MCAST_PROBES)) ||
1819             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time) ||
1820             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1821                           NEIGH_VAR(parms, BASE_REACHABLE_TIME)) ||
1822             nla_put_msecs(skb, NDTPA_GC_STALETIME,
1823                           NEIGH_VAR(parms, GC_STALETIME)) ||
1824             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1825                           NEIGH_VAR(parms, DELAY_PROBE_TIME)) ||
1826             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1827                           NEIGH_VAR(parms, RETRANS_TIME)) ||
1828             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1829                           NEIGH_VAR(parms, ANYCAST_DELAY)) ||
1830             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1831                           NEIGH_VAR(parms, PROXY_DELAY)) ||
1832             nla_put_msecs(skb, NDTPA_LOCKTIME,
1833                           NEIGH_VAR(parms, LOCKTIME)))
1834                 goto nla_put_failure;
1835         return nla_nest_end(skb, nest);
1836
1837 nla_put_failure:
1838         nla_nest_cancel(skb, nest);
1839         return -EMSGSIZE;
1840 }
1841
1842 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1843                               u32 pid, u32 seq, int type, int flags)
1844 {
1845         struct nlmsghdr *nlh;
1846         struct ndtmsg *ndtmsg;
1847
1848         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1849         if (nlh == NULL)
1850                 return -EMSGSIZE;
1851
1852         ndtmsg = nlmsg_data(nlh);
1853
1854         read_lock_bh(&tbl->lock);
1855         ndtmsg->ndtm_family = tbl->family;
1856         ndtmsg->ndtm_pad1   = 0;
1857         ndtmsg->ndtm_pad2   = 0;
1858
1859         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1860             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval) ||
1861             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1862             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1863             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1864                 goto nla_put_failure;
1865         {
1866                 unsigned long now = jiffies;
1867                 unsigned int flush_delta = now - tbl->last_flush;
1868                 unsigned int rand_delta = now - tbl->last_rand;
1869                 struct neigh_hash_table *nht;
1870                 struct ndt_config ndc = {
1871                         .ndtc_key_len           = tbl->key_len,
1872                         .ndtc_entry_size        = tbl->entry_size,
1873                         .ndtc_entries           = atomic_read(&tbl->entries),
1874                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1875                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1876                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1877                 };
1878
1879                 rcu_read_lock_bh();
1880                 nht = rcu_dereference_bh(tbl->nht);
1881                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1882                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1883                 rcu_read_unlock_bh();
1884
1885                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1886                         goto nla_put_failure;
1887         }
1888
1889         {
1890                 int cpu;
1891                 struct ndt_stats ndst;
1892
1893                 memset(&ndst, 0, sizeof(ndst));
1894
1895                 for_each_possible_cpu(cpu) {
1896                         struct neigh_statistics *st;
1897
1898                         st = per_cpu_ptr(tbl->stats, cpu);
1899                         ndst.ndts_allocs                += st->allocs;
1900                         ndst.ndts_destroys              += st->destroys;
1901                         ndst.ndts_hash_grows            += st->hash_grows;
1902                         ndst.ndts_res_failed            += st->res_failed;
1903                         ndst.ndts_lookups               += st->lookups;
1904                         ndst.ndts_hits                  += st->hits;
1905                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1906                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1907                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1908                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1909                 }
1910
1911                 if (nla_put(skb, NDTA_STATS, sizeof(ndst), &ndst))
1912                         goto nla_put_failure;
1913         }
1914
1915         BUG_ON(tbl->parms.dev);
1916         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1917                 goto nla_put_failure;
1918
1919         read_unlock_bh(&tbl->lock);
1920         return nlmsg_end(skb, nlh);
1921
1922 nla_put_failure:
1923         read_unlock_bh(&tbl->lock);
1924         nlmsg_cancel(skb, nlh);
1925         return -EMSGSIZE;
1926 }
1927
1928 static int neightbl_fill_param_info(struct sk_buff *skb,
1929                                     struct neigh_table *tbl,
1930                                     struct neigh_parms *parms,
1931                                     u32 pid, u32 seq, int type,
1932                                     unsigned int flags)
1933 {
1934         struct ndtmsg *ndtmsg;
1935         struct nlmsghdr *nlh;
1936
1937         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1938         if (nlh == NULL)
1939                 return -EMSGSIZE;
1940
1941         ndtmsg = nlmsg_data(nlh);
1942
1943         read_lock_bh(&tbl->lock);
1944         ndtmsg->ndtm_family = tbl->family;
1945         ndtmsg->ndtm_pad1   = 0;
1946         ndtmsg->ndtm_pad2   = 0;
1947
1948         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1949             neightbl_fill_parms(skb, parms) < 0)
1950                 goto errout;
1951
1952         read_unlock_bh(&tbl->lock);
1953         return nlmsg_end(skb, nlh);
1954 errout:
1955         read_unlock_bh(&tbl->lock);
1956         nlmsg_cancel(skb, nlh);
1957         return -EMSGSIZE;
1958 }
1959
1960 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1961         [NDTA_NAME]             = { .type = NLA_STRING },
1962         [NDTA_THRESH1]          = { .type = NLA_U32 },
1963         [NDTA_THRESH2]          = { .type = NLA_U32 },
1964         [NDTA_THRESH3]          = { .type = NLA_U32 },
1965         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1966         [NDTA_PARMS]            = { .type = NLA_NESTED },
1967 };
1968
1969 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1970         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1971         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1972         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1973         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1974         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1975         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1976         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1977         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1978         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1979         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1980         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1981         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1982         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1983 };
1984
1985 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
1986 {
1987         struct net *net = sock_net(skb->sk);
1988         struct neigh_table *tbl;
1989         struct ndtmsg *ndtmsg;
1990         struct nlattr *tb[NDTA_MAX+1];
1991         int err;
1992
1993         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1994                           nl_neightbl_policy);
1995         if (err < 0)
1996                 goto errout;
1997
1998         if (tb[NDTA_NAME] == NULL) {
1999                 err = -EINVAL;
2000                 goto errout;
2001         }
2002
2003         ndtmsg = nlmsg_data(nlh);
2004         read_lock(&neigh_tbl_lock);
2005         for (tbl = neigh_tables; tbl; tbl = tbl->next) {
2006                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
2007                         continue;
2008
2009                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0)
2010                         break;
2011         }
2012
2013         if (tbl == NULL) {
2014                 err = -ENOENT;
2015                 goto errout_locked;
2016         }
2017
2018         /*
2019          * We acquire tbl->lock to be nice to the periodic timers and
2020          * make sure they always see a consistent set of values.
2021          */
2022         write_lock_bh(&tbl->lock);
2023
2024         if (tb[NDTA_PARMS]) {
2025                 struct nlattr *tbp[NDTPA_MAX+1];
2026                 struct neigh_parms *p;
2027                 int i, ifindex = 0;
2028
2029                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
2030                                        nl_ntbl_parm_policy);
2031                 if (err < 0)
2032                         goto errout_tbl_lock;
2033
2034                 if (tbp[NDTPA_IFINDEX])
2035                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
2036
2037                 p = lookup_neigh_parms(tbl, net, ifindex);
2038                 if (p == NULL) {
2039                         err = -ENOENT;
2040                         goto errout_tbl_lock;
2041                 }
2042
2043                 for (i = 1; i <= NDTPA_MAX; i++) {
2044                         if (tbp[i] == NULL)
2045                                 continue;
2046
2047                         switch (i) {
2048                         case NDTPA_QUEUE_LEN:
2049                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2050                                               nla_get_u32(tbp[i]) *
2051                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2052                                 break;
2053                         case NDTPA_QUEUE_LENBYTES:
2054                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2055                                               nla_get_u32(tbp[i]));
2056                                 break;
2057                         case NDTPA_PROXY_QLEN:
2058                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2059                                               nla_get_u32(tbp[i]));
2060                                 break;
2061                         case NDTPA_APP_PROBES:
2062                                 NEIGH_VAR_SET(p, APP_PROBES,
2063                                               nla_get_u32(tbp[i]));
2064                                 break;
2065                         case NDTPA_UCAST_PROBES:
2066                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2067                                               nla_get_u32(tbp[i]));
2068                                 break;
2069                         case NDTPA_MCAST_PROBES:
2070                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2071                                               nla_get_u32(tbp[i]));
2072                                 break;
2073                         case NDTPA_BASE_REACHABLE_TIME:
2074                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2075                                               nla_get_msecs(tbp[i]));
2076                                 break;
2077                         case NDTPA_GC_STALETIME:
2078                                 NEIGH_VAR_SET(p, GC_STALETIME,
2079                                               nla_get_msecs(tbp[i]));
2080                                 break;
2081                         case NDTPA_DELAY_PROBE_TIME:
2082                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2083                                               nla_get_msecs(tbp[i]));
2084                                 break;
2085                         case NDTPA_RETRANS_TIME:
2086                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2087                                               nla_get_msecs(tbp[i]));
2088                                 break;
2089                         case NDTPA_ANYCAST_DELAY:
2090                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2091                                               nla_get_msecs(tbp[i]));
2092                                 break;
2093                         case NDTPA_PROXY_DELAY:
2094                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2095                                               nla_get_msecs(tbp[i]));
2096                                 break;
2097                         case NDTPA_LOCKTIME:
2098                                 NEIGH_VAR_SET(p, LOCKTIME,
2099                                               nla_get_msecs(tbp[i]));
2100                                 break;
2101                         }
2102                 }
2103         }
2104
2105         err = -ENOENT;
2106         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2107              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2108             !net_eq(net, &init_net))
2109                 goto errout_tbl_lock;
2110
2111         if (tb[NDTA_THRESH1])
2112                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2113
2114         if (tb[NDTA_THRESH2])
2115                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2116
2117         if (tb[NDTA_THRESH3])
2118                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2119
2120         if (tb[NDTA_GC_INTERVAL])
2121                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2122
2123         err = 0;
2124
2125 errout_tbl_lock:
2126         write_unlock_bh(&tbl->lock);
2127 errout_locked:
2128         read_unlock(&neigh_tbl_lock);
2129 errout:
2130         return err;
2131 }
2132
2133 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2134 {
2135         struct net *net = sock_net(skb->sk);
2136         int family, tidx, nidx = 0;
2137         int tbl_skip = cb->args[0];
2138         int neigh_skip = cb->args[1];
2139         struct neigh_table *tbl;
2140
2141         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2142
2143         read_lock(&neigh_tbl_lock);
2144         for (tbl = neigh_tables, tidx = 0; tbl; tbl = tbl->next, tidx++) {
2145                 struct neigh_parms *p;
2146
2147                 if (tidx < tbl_skip || (family && tbl->family != family))
2148                         continue;
2149
2150                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2151                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2152                                        NLM_F_MULTI) <= 0)
2153                         break;
2154
2155                 for (nidx = 0, p = tbl->parms.next; p; p = p->next) {
2156                         if (!net_eq(neigh_parms_net(p), net))
2157                                 continue;
2158
2159                         if (nidx < neigh_skip)
2160                                 goto next;
2161
2162                         if (neightbl_fill_param_info(skb, tbl, p,
2163                                                      NETLINK_CB(cb->skb).portid,
2164                                                      cb->nlh->nlmsg_seq,
2165                                                      RTM_NEWNEIGHTBL,
2166                                                      NLM_F_MULTI) <= 0)
2167                                 goto out;
2168                 next:
2169                         nidx++;
2170                 }
2171
2172                 neigh_skip = 0;
2173         }
2174 out:
2175         read_unlock(&neigh_tbl_lock);
2176         cb->args[0] = tidx;
2177         cb->args[1] = nidx;
2178
2179         return skb->len;
2180 }
2181
2182 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2183                            u32 pid, u32 seq, int type, unsigned int flags)
2184 {
2185         unsigned long now = jiffies;
2186         struct nda_cacheinfo ci;
2187         struct nlmsghdr *nlh;
2188         struct ndmsg *ndm;
2189
2190         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2191         if (nlh == NULL)
2192                 return -EMSGSIZE;
2193
2194         ndm = nlmsg_data(nlh);
2195         ndm->ndm_family  = neigh->ops->family;
2196         ndm->ndm_pad1    = 0;
2197         ndm->ndm_pad2    = 0;
2198         ndm->ndm_flags   = neigh->flags;
2199         ndm->ndm_type    = neigh->type;
2200         ndm->ndm_ifindex = neigh->dev->ifindex;
2201
2202         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2203                 goto nla_put_failure;
2204
2205         read_lock_bh(&neigh->lock);
2206         ndm->ndm_state   = neigh->nud_state;
2207         if (neigh->nud_state & NUD_VALID) {
2208                 char haddr[MAX_ADDR_LEN];
2209
2210                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2211                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2212                         read_unlock_bh(&neigh->lock);
2213                         goto nla_put_failure;
2214                 }
2215         }
2216
2217         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2218         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2219         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2220         ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
2221         read_unlock_bh(&neigh->lock);
2222
2223         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2224             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2225                 goto nla_put_failure;
2226
2227         return nlmsg_end(skb, nlh);
2228
2229 nla_put_failure:
2230         nlmsg_cancel(skb, nlh);
2231         return -EMSGSIZE;
2232 }
2233
2234 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2235                             u32 pid, u32 seq, int type, unsigned int flags,
2236                             struct neigh_table *tbl)
2237 {
2238         struct nlmsghdr *nlh;
2239         struct ndmsg *ndm;
2240
2241         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2242         if (nlh == NULL)
2243                 return -EMSGSIZE;
2244
2245         ndm = nlmsg_data(nlh);
2246         ndm->ndm_family  = tbl->family;
2247         ndm->ndm_pad1    = 0;
2248         ndm->ndm_pad2    = 0;
2249         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2250         ndm->ndm_type    = NDA_DST;
2251         ndm->ndm_ifindex = pn->dev->ifindex;
2252         ndm->ndm_state   = NUD_NONE;
2253
2254         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2255                 goto nla_put_failure;
2256
2257         return nlmsg_end(skb, nlh);
2258
2259 nla_put_failure:
2260         nlmsg_cancel(skb, nlh);
2261         return -EMSGSIZE;
2262 }
2263
2264 static void neigh_update_notify(struct neighbour *neigh)
2265 {
2266         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2267         __neigh_notify(neigh, RTM_NEWNEIGH, 0);
2268 }
2269
2270 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2271                             struct netlink_callback *cb)
2272 {
2273         struct net *net = sock_net(skb->sk);
2274         struct neighbour *n;
2275         int rc, h, s_h = cb->args[1];
2276         int idx, s_idx = idx = cb->args[2];
2277         struct neigh_hash_table *nht;
2278
2279         rcu_read_lock_bh();
2280         nht = rcu_dereference_bh(tbl->nht);
2281
2282         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2283                 if (h > s_h)
2284                         s_idx = 0;
2285                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2286                      n != NULL;
2287                      n = rcu_dereference_bh(n->next)) {
2288                         if (!net_eq(dev_net(n->dev), net))
2289                                 continue;
2290                         if (idx < s_idx)
2291                                 goto next;
2292                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2293                                             cb->nlh->nlmsg_seq,
2294                                             RTM_NEWNEIGH,
2295                                             NLM_F_MULTI) <= 0) {
2296                                 rc = -1;
2297                                 goto out;
2298                         }
2299 next:
2300                         idx++;
2301                 }
2302         }
2303         rc = skb->len;
2304 out:
2305         rcu_read_unlock_bh();
2306         cb->args[1] = h;
2307         cb->args[2] = idx;
2308         return rc;
2309 }
2310
2311 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2312                              struct netlink_callback *cb)
2313 {
2314         struct pneigh_entry *n;
2315         struct net *net = sock_net(skb->sk);
2316         int rc, h, s_h = cb->args[3];
2317         int idx, s_idx = idx = cb->args[4];
2318
2319         read_lock_bh(&tbl->lock);
2320
2321         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2322                 if (h > s_h)
2323                         s_idx = 0;
2324                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2325                         if (dev_net(n->dev) != net)
2326                                 continue;
2327                         if (idx < s_idx)
2328                                 goto next;
2329                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2330                                             cb->nlh->nlmsg_seq,
2331                                             RTM_NEWNEIGH,
2332                                             NLM_F_MULTI, tbl) <= 0) {
2333                                 read_unlock_bh(&tbl->lock);
2334                                 rc = -1;
2335                                 goto out;
2336                         }
2337                 next:
2338                         idx++;
2339                 }
2340         }
2341
2342         read_unlock_bh(&tbl->lock);
2343         rc = skb->len;
2344 out:
2345         cb->args[3] = h;
2346         cb->args[4] = idx;
2347         return rc;
2348
2349 }
2350
2351 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2352 {
2353         struct neigh_table *tbl;
2354         int t, family, s_t;
2355         int proxy = 0;
2356         int err;
2357
2358         read_lock(&neigh_tbl_lock);
2359         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2360
2361         /* check for full ndmsg structure presence, family member is
2362          * the same for both structures
2363          */
2364         if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2365             ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2366                 proxy = 1;
2367
2368         s_t = cb->args[0];
2369
2370         for (tbl = neigh_tables, t = 0; tbl;
2371              tbl = tbl->next, t++) {
2372                 if (t < s_t || (family && tbl->family != family))
2373                         continue;
2374                 if (t > s_t)
2375                         memset(&cb->args[1], 0, sizeof(cb->args) -
2376                                                 sizeof(cb->args[0]));
2377                 if (proxy)
2378                         err = pneigh_dump_table(tbl, skb, cb);
2379                 else
2380                         err = neigh_dump_table(tbl, skb, cb);
2381                 if (err < 0)
2382                         break;
2383         }
2384         read_unlock(&neigh_tbl_lock);
2385
2386         cb->args[0] = t;
2387         return skb->len;
2388 }
2389
2390 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2391 {
2392         int chain;
2393         struct neigh_hash_table *nht;
2394
2395         rcu_read_lock_bh();
2396         nht = rcu_dereference_bh(tbl->nht);
2397
2398         read_lock(&tbl->lock); /* avoid resizes */
2399         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2400                 struct neighbour *n;
2401
2402                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2403                      n != NULL;
2404                      n = rcu_dereference_bh(n->next))
2405                         cb(n, cookie);
2406         }
2407         read_unlock(&tbl->lock);
2408         rcu_read_unlock_bh();
2409 }
2410 EXPORT_SYMBOL(neigh_for_each);
2411
2412 /* The tbl->lock must be held as a writer and BH disabled. */
2413 void __neigh_for_each_release(struct neigh_table *tbl,
2414                               int (*cb)(struct neighbour *))
2415 {
2416         int chain;
2417         struct neigh_hash_table *nht;
2418
2419         nht = rcu_dereference_protected(tbl->nht,
2420                                         lockdep_is_held(&tbl->lock));
2421         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2422                 struct neighbour *n;
2423                 struct neighbour __rcu **np;
2424
2425                 np = &nht->hash_buckets[chain];
2426                 while ((n = rcu_dereference_protected(*np,
2427                                         lockdep_is_held(&tbl->lock))) != NULL) {
2428                         int release;
2429
2430                         write_lock(&n->lock);
2431                         release = cb(n);
2432                         if (release) {
2433                                 rcu_assign_pointer(*np,
2434                                         rcu_dereference_protected(n->next,
2435                                                 lockdep_is_held(&tbl->lock)));
2436                                 n->dead = 1;
2437                         } else
2438                                 np = &n->next;
2439                         write_unlock(&n->lock);
2440                         if (release)
2441                                 neigh_cleanup_and_release(n);
2442                 }
2443         }
2444 }
2445 EXPORT_SYMBOL(__neigh_for_each_release);
2446
2447 #ifdef CONFIG_PROC_FS
2448
2449 static struct neighbour *neigh_get_first(struct seq_file *seq)
2450 {
2451         struct neigh_seq_state *state = seq->private;
2452         struct net *net = seq_file_net(seq);
2453         struct neigh_hash_table *nht = state->nht;
2454         struct neighbour *n = NULL;
2455         int bucket = state->bucket;
2456
2457         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2458         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2459                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2460
2461                 while (n) {
2462                         if (!net_eq(dev_net(n->dev), net))
2463                                 goto next;
2464                         if (state->neigh_sub_iter) {
2465                                 loff_t fakep = 0;
2466                                 void *v;
2467
2468                                 v = state->neigh_sub_iter(state, n, &fakep);
2469                                 if (!v)
2470                                         goto next;
2471                         }
2472                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2473                                 break;
2474                         if (n->nud_state & ~NUD_NOARP)
2475                                 break;
2476 next:
2477                         n = rcu_dereference_bh(n->next);
2478                 }
2479
2480                 if (n)
2481                         break;
2482         }
2483         state->bucket = bucket;
2484
2485         return n;
2486 }
2487
2488 static struct neighbour *neigh_get_next(struct seq_file *seq,
2489                                         struct neighbour *n,
2490                                         loff_t *pos)
2491 {
2492         struct neigh_seq_state *state = seq->private;
2493         struct net *net = seq_file_net(seq);
2494         struct neigh_hash_table *nht = state->nht;
2495
2496         if (state->neigh_sub_iter) {
2497                 void *v = state->neigh_sub_iter(state, n, pos);
2498                 if (v)
2499                         return n;
2500         }
2501         n = rcu_dereference_bh(n->next);
2502
2503         while (1) {
2504                 while (n) {
2505                         if (!net_eq(dev_net(n->dev), net))
2506                                 goto next;
2507                         if (state->neigh_sub_iter) {
2508                                 void *v = state->neigh_sub_iter(state, n, pos);
2509                                 if (v)
2510                                         return n;
2511                                 goto next;
2512                         }
2513                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2514                                 break;
2515
2516                         if (n->nud_state & ~NUD_NOARP)
2517                                 break;
2518 next:
2519                         n = rcu_dereference_bh(n->next);
2520                 }
2521
2522                 if (n)
2523                         break;
2524
2525                 if (++state->bucket >= (1 << nht->hash_shift))
2526                         break;
2527
2528                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2529         }
2530
2531         if (n && pos)
2532                 --(*pos);
2533         return n;
2534 }
2535
2536 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2537 {
2538         struct neighbour *n = neigh_get_first(seq);
2539
2540         if (n) {
2541                 --(*pos);
2542                 while (*pos) {
2543                         n = neigh_get_next(seq, n, pos);
2544                         if (!n)
2545                                 break;
2546                 }
2547         }
2548         return *pos ? NULL : n;
2549 }
2550
2551 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2552 {
2553         struct neigh_seq_state *state = seq->private;
2554         struct net *net = seq_file_net(seq);
2555         struct neigh_table *tbl = state->tbl;
2556         struct pneigh_entry *pn = NULL;
2557         int bucket = state->bucket;
2558
2559         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2560         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2561                 pn = tbl->phash_buckets[bucket];
2562                 while (pn && !net_eq(pneigh_net(pn), net))
2563                         pn = pn->next;
2564                 if (pn)
2565                         break;
2566         }
2567         state->bucket = bucket;
2568
2569         return pn;
2570 }
2571
2572 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2573                                             struct pneigh_entry *pn,
2574                                             loff_t *pos)
2575 {
2576         struct neigh_seq_state *state = seq->private;
2577         struct net *net = seq_file_net(seq);
2578         struct neigh_table *tbl = state->tbl;
2579
2580         do {
2581                 pn = pn->next;
2582         } while (pn && !net_eq(pneigh_net(pn), net));
2583
2584         while (!pn) {
2585                 if (++state->bucket > PNEIGH_HASHMASK)
2586                         break;
2587                 pn = tbl->phash_buckets[state->bucket];
2588                 while (pn && !net_eq(pneigh_net(pn), net))
2589                         pn = pn->next;
2590                 if (pn)
2591                         break;
2592         }
2593
2594         if (pn && pos)
2595                 --(*pos);
2596
2597         return pn;
2598 }
2599
2600 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2601 {
2602         struct pneigh_entry *pn = pneigh_get_first(seq);
2603
2604         if (pn) {
2605                 --(*pos);
2606                 while (*pos) {
2607                         pn = pneigh_get_next(seq, pn, pos);
2608                         if (!pn)
2609                                 break;
2610                 }
2611         }
2612         return *pos ? NULL : pn;
2613 }
2614
2615 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2616 {
2617         struct neigh_seq_state *state = seq->private;
2618         void *rc;
2619         loff_t idxpos = *pos;
2620
2621         rc = neigh_get_idx(seq, &idxpos);
2622         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2623                 rc = pneigh_get_idx(seq, &idxpos);
2624
2625         return rc;
2626 }
2627
2628 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2629         __acquires(rcu_bh)
2630 {
2631         struct neigh_seq_state *state = seq->private;
2632
2633         state->tbl = tbl;
2634         state->bucket = 0;
2635         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2636
2637         rcu_read_lock_bh();
2638         state->nht = rcu_dereference_bh(tbl->nht);
2639
2640         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2641 }
2642 EXPORT_SYMBOL(neigh_seq_start);
2643
2644 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2645 {
2646         struct neigh_seq_state *state;
2647         void *rc;
2648
2649         if (v == SEQ_START_TOKEN) {
2650                 rc = neigh_get_first(seq);
2651                 goto out;
2652         }
2653
2654         state = seq->private;
2655         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2656                 rc = neigh_get_next(seq, v, NULL);
2657                 if (rc)
2658                         goto out;
2659                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2660                         rc = pneigh_get_first(seq);
2661         } else {
2662                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2663                 rc = pneigh_get_next(seq, v, NULL);
2664         }
2665 out:
2666         ++(*pos);
2667         return rc;
2668 }
2669 EXPORT_SYMBOL(neigh_seq_next);
2670
2671 void neigh_seq_stop(struct seq_file *seq, void *v)
2672         __releases(rcu_bh)
2673 {
2674         rcu_read_unlock_bh();
2675 }
2676 EXPORT_SYMBOL(neigh_seq_stop);
2677
2678 /* statistics via seq_file */
2679
2680 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2681 {
2682         struct neigh_table *tbl = seq->private;
2683         int cpu;
2684
2685         if (*pos == 0)
2686                 return SEQ_START_TOKEN;
2687
2688         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2689                 if (!cpu_possible(cpu))
2690                         continue;
2691                 *pos = cpu+1;
2692                 return per_cpu_ptr(tbl->stats, cpu);
2693         }
2694         return NULL;
2695 }
2696
2697 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2698 {
2699         struct neigh_table *tbl = seq->private;
2700         int cpu;
2701
2702         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2703                 if (!cpu_possible(cpu))
2704                         continue;
2705                 *pos = cpu+1;
2706                 return per_cpu_ptr(tbl->stats, cpu);
2707         }
2708         return NULL;
2709 }
2710
2711 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2712 {
2713
2714 }
2715
2716 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2717 {
2718         struct neigh_table *tbl = seq->private;
2719         struct neigh_statistics *st = v;
2720
2721         if (v == SEQ_START_TOKEN) {
2722                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards\n");
2723                 return 0;
2724         }
2725
2726         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2727                         "%08lx %08lx  %08lx %08lx %08lx\n",
2728                    atomic_read(&tbl->entries),
2729
2730                    st->allocs,
2731                    st->destroys,
2732                    st->hash_grows,
2733
2734                    st->lookups,
2735                    st->hits,
2736
2737                    st->res_failed,
2738
2739                    st->rcv_probes_mcast,
2740                    st->rcv_probes_ucast,
2741
2742                    st->periodic_gc_runs,
2743                    st->forced_gc_runs,
2744                    st->unres_discards
2745                    );
2746
2747         return 0;
2748 }
2749
2750 static const struct seq_operations neigh_stat_seq_ops = {
2751         .start  = neigh_stat_seq_start,
2752         .next   = neigh_stat_seq_next,
2753         .stop   = neigh_stat_seq_stop,
2754         .show   = neigh_stat_seq_show,
2755 };
2756
2757 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2758 {
2759         int ret = seq_open(file, &neigh_stat_seq_ops);
2760
2761         if (!ret) {
2762                 struct seq_file *sf = file->private_data;
2763                 sf->private = PDE_DATA(inode);
2764         }
2765         return ret;
2766 };
2767
2768 static const struct file_operations neigh_stat_seq_fops = {
2769         .owner   = THIS_MODULE,
2770         .open    = neigh_stat_seq_open,
2771         .read    = seq_read,
2772         .llseek  = seq_lseek,
2773         .release = seq_release,
2774 };
2775
2776 #endif /* CONFIG_PROC_FS */
2777
2778 static inline size_t neigh_nlmsg_size(void)
2779 {
2780         return NLMSG_ALIGN(sizeof(struct ndmsg))
2781                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2782                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2783                + nla_total_size(sizeof(struct nda_cacheinfo))
2784                + nla_total_size(4); /* NDA_PROBES */
2785 }
2786
2787 static void __neigh_notify(struct neighbour *n, int type, int flags)
2788 {
2789         struct net *net = dev_net(n->dev);
2790         struct sk_buff *skb;
2791         int err = -ENOBUFS;
2792
2793         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2794         if (skb == NULL)
2795                 goto errout;
2796
2797         err = neigh_fill_info(skb, n, 0, 0, type, flags);
2798         if (err < 0) {
2799                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2800                 WARN_ON(err == -EMSGSIZE);
2801                 kfree_skb(skb);
2802                 goto errout;
2803         }
2804         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2805         return;
2806 errout:
2807         if (err < 0)
2808                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2809 }
2810
2811 void neigh_app_ns(struct neighbour *n)
2812 {
2813         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
2814 }
2815 EXPORT_SYMBOL(neigh_app_ns);
2816
2817 #ifdef CONFIG_SYSCTL
2818 static int zero;
2819 static int int_max = INT_MAX;
2820 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2821
2822 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2823                            void __user *buffer, size_t *lenp, loff_t *ppos)
2824 {
2825         int size, ret;
2826         struct ctl_table tmp = *ctl;
2827
2828         tmp.extra1 = &zero;
2829         tmp.extra2 = &unres_qlen_max;
2830         tmp.data = &size;
2831
2832         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2833         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2834
2835         if (write && !ret)
2836                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2837         return ret;
2838 }
2839
2840 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2841                                                    int family)
2842 {
2843         switch (family) {
2844         case AF_INET:
2845                 return __in_dev_arp_parms_get_rcu(dev);
2846         case AF_INET6:
2847                 return __in6_dev_nd_parms_get_rcu(dev);
2848         }
2849         return NULL;
2850 }
2851
2852 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2853                                   int index)
2854 {
2855         struct net_device *dev;
2856         int family = neigh_parms_family(p);
2857
2858         rcu_read_lock();
2859         for_each_netdev_rcu(net, dev) {
2860                 struct neigh_parms *dst_p =
2861                                 neigh_get_dev_parms_rcu(dev, family);
2862
2863                 if (dst_p && !test_bit(index, dst_p->data_state))
2864                         dst_p->data[index] = p->data[index];
2865         }
2866         rcu_read_unlock();
2867 }
2868
2869 static void neigh_proc_update(struct ctl_table *ctl, int write)
2870 {
2871         struct net_device *dev = ctl->extra1;
2872         struct neigh_parms *p = ctl->extra2;
2873         struct net *net = neigh_parms_net(p);
2874         int index = (int *) ctl->data - p->data;
2875
2876         if (!write)
2877                 return;
2878
2879         set_bit(index, p->data_state);
2880         if (!dev) /* NULL dev means this is default value */
2881                 neigh_copy_dflt_parms(net, p, index);
2882 }
2883
2884 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2885                                            void __user *buffer,
2886                                            size_t *lenp, loff_t *ppos)
2887 {
2888         struct ctl_table tmp = *ctl;
2889         int ret;
2890
2891         tmp.extra1 = &zero;
2892         tmp.extra2 = &int_max;
2893
2894         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2895         neigh_proc_update(ctl, write);
2896         return ret;
2897 }
2898
2899 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2900                         void __user *buffer, size_t *lenp, loff_t *ppos)
2901 {
2902         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
2903
2904         neigh_proc_update(ctl, write);
2905         return ret;
2906 }
2907 EXPORT_SYMBOL(neigh_proc_dointvec);
2908
2909 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
2910                                 void __user *buffer,
2911                                 size_t *lenp, loff_t *ppos)
2912 {
2913         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
2914
2915         neigh_proc_update(ctl, write);
2916         return ret;
2917 }
2918 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
2919
2920 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
2921                                               void __user *buffer,
2922                                               size_t *lenp, loff_t *ppos)
2923 {
2924         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
2925
2926         neigh_proc_update(ctl, write);
2927         return ret;
2928 }
2929
2930 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
2931                                    void __user *buffer,
2932                                    size_t *lenp, loff_t *ppos)
2933 {
2934         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
2935
2936         neigh_proc_update(ctl, write);
2937         return ret;
2938 }
2939 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
2940
2941 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
2942                                           void __user *buffer,
2943                                           size_t *lenp, loff_t *ppos)
2944 {
2945         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
2946
2947         neigh_proc_update(ctl, write);
2948         return ret;
2949 }
2950
2951 #define NEIGH_PARMS_DATA_OFFSET(index)  \
2952         (&((struct neigh_parms *) 0)->data[index])
2953
2954 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
2955         [NEIGH_VAR_ ## attr] = { \
2956                 .procname       = name, \
2957                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
2958                 .maxlen         = sizeof(int), \
2959                 .mode           = mval, \
2960                 .proc_handler   = proc, \
2961         }
2962
2963 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
2964         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
2965
2966 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
2967         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
2968
2969 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
2970         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
2971
2972 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
2973         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
2974
2975 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
2976         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
2977
2978 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
2979         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
2980
2981 static struct neigh_sysctl_table {
2982         struct ctl_table_header *sysctl_header;
2983         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
2984 } neigh_sysctl_template __read_mostly = {
2985         .neigh_vars = {
2986                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
2987                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
2988                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
2989                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
2990                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
2991                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
2992                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
2993                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
2994                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
2995                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
2996                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
2997                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
2998                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
2999                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3000                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3001                 [NEIGH_VAR_GC_INTERVAL] = {
3002                         .procname       = "gc_interval",
3003                         .maxlen         = sizeof(int),
3004                         .mode           = 0644,
3005                         .proc_handler   = proc_dointvec_jiffies,
3006                 },
3007                 [NEIGH_VAR_GC_THRESH1] = {
3008                         .procname       = "gc_thresh1",
3009                         .maxlen         = sizeof(int),
3010                         .mode           = 0644,
3011                         .extra1         = &zero,
3012                         .extra2         = &int_max,
3013                         .proc_handler   = proc_dointvec_minmax,
3014                 },
3015                 [NEIGH_VAR_GC_THRESH2] = {
3016                         .procname       = "gc_thresh2",
3017                         .maxlen         = sizeof(int),
3018                         .mode           = 0644,
3019                         .extra1         = &zero,
3020                         .extra2         = &int_max,
3021                         .proc_handler   = proc_dointvec_minmax,
3022                 },
3023                 [NEIGH_VAR_GC_THRESH3] = {
3024                         .procname       = "gc_thresh3",
3025                         .maxlen         = sizeof(int),
3026                         .mode           = 0644,
3027                         .extra1         = &zero,
3028                         .extra2         = &int_max,
3029                         .proc_handler   = proc_dointvec_minmax,
3030                 },
3031                 {},
3032         },
3033 };
3034
3035 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3036                           proc_handler *handler)
3037 {
3038         int i;
3039         struct neigh_sysctl_table *t;
3040         const char *dev_name_source;
3041         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3042         char *p_name;
3043
3044         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3045         if (!t)
3046                 goto err;
3047
3048         for (i = 0; i < ARRAY_SIZE(t->neigh_vars); i++) {
3049                 t->neigh_vars[i].data += (long) p;
3050                 t->neigh_vars[i].extra1 = dev;
3051                 t->neigh_vars[i].extra2 = p;
3052         }
3053
3054         if (dev) {
3055                 dev_name_source = dev->name;
3056                 /* Terminate the table early */
3057                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3058                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3059         } else {
3060                 dev_name_source = "default";
3061                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = (int *)(p + 1);
3062                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = (int *)(p + 1) + 1;
3063                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = (int *)(p + 1) + 2;
3064                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = (int *)(p + 1) + 3;
3065         }
3066
3067         if (handler) {
3068                 /* RetransTime */
3069                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3070                 /* ReachableTime */
3071                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3072                 /* RetransTime (in milliseconds)*/
3073                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3074                 /* ReachableTime (in milliseconds) */
3075                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3076         }
3077
3078         /* Don't export sysctls to unprivileged users */
3079         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3080                 t->neigh_vars[0].procname = NULL;
3081
3082         switch (neigh_parms_family(p)) {
3083         case AF_INET:
3084               p_name = "ipv4";
3085               break;
3086         case AF_INET6:
3087               p_name = "ipv6";
3088               break;
3089         default:
3090               BUG();
3091         }
3092
3093         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3094                 p_name, dev_name_source);
3095         t->sysctl_header =
3096                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3097         if (!t->sysctl_header)
3098                 goto free;
3099
3100         p->sysctl_table = t;
3101         return 0;
3102
3103 free:
3104         kfree(t);
3105 err:
3106         return -ENOBUFS;
3107 }
3108 EXPORT_SYMBOL(neigh_sysctl_register);
3109
3110 void neigh_sysctl_unregister(struct neigh_parms *p)
3111 {
3112         if (p->sysctl_table) {
3113                 struct neigh_sysctl_table *t = p->sysctl_table;
3114                 p->sysctl_table = NULL;
3115                 unregister_net_sysctl_table(t->sysctl_header);
3116                 kfree(t);
3117         }
3118 }
3119 EXPORT_SYMBOL(neigh_sysctl_unregister);
3120
3121 #endif  /* CONFIG_SYSCTL */
3122
3123 static int __init neigh_init(void)
3124 {
3125         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3126         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3127         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3128
3129         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3130                       NULL);
3131         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3132
3133         return 0;
3134 }
3135
3136 subsys_initcall(neigh_init);
3137