1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *	IPv6 Address [auto]configuration
   4 *	Linux INET6 implementation
   5 *
   6 *	Authors:
   7 *	Pedro Roque		<roque@di.fc.ul.pt>
   8 *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
   9 */
  10
  11/*
  12 *	Changes:
  13 *
  14 *	Janos Farkas			:	delete timer on ifdown
  15 *	<chexum@bankinf.banki.hu>
  16 *	Andi Kleen			:	kill double kfree on module
  17 *						unload.
  18 *	Maciej W. Rozycki		:	FDDI support
  19 *	sekiya@USAGI			:	Don't send too many RS
  20 *						packets.
  21 *	yoshfuji@USAGI			:       Fixed interval between DAD
  22 *						packets.
  23 *	YOSHIFUJI Hideaki @USAGI	:	improved accuracy of
  24 *						address validation timer.
  25 *	YOSHIFUJI Hideaki @USAGI	:	Privacy Extensions (RFC3041)
  26 *						support.
  27 *	Yuji SEKIYA @USAGI		:	Don't assign a same IPv6
  28 *						address on a same interface.
  29 *	YOSHIFUJI Hideaki @USAGI	:	ARCnet support
  30 *	YOSHIFUJI Hideaki @USAGI	:	convert /proc/net/if_inet6 to
  31 *						seq_file.
  32 *	YOSHIFUJI Hideaki @USAGI	:	improved source address
  33 *						selection; consider scope,
  34 *						status etc.
  35 */
  36
  37#define pr_fmt(fmt) "IPv6: " fmt
  38
  39#include <linux/errno.h>
  40#include <linux/types.h>
  41#include <linux/kernel.h>
  42#include <linux/sched/signal.h>
  43#include <linux/socket.h>
  44#include <linux/sockios.h>
  45#include <linux/net.h>
  46#include <linux/inet.h>
  47#include <linux/in6.h>
  48#include <linux/netdevice.h>
  49#include <linux/if_addr.h>
  50#include <linux/if_arp.h>
  51#include <linux/if_arcnet.h>
  52#include <linux/if_infiniband.h>
  53#include <linux/route.h>
  54#include <linux/inetdevice.h>
  55#include <linux/init.h>
  56#include <linux/slab.h>
  57#ifdef CONFIG_SYSCTL
  58#include <linux/sysctl.h>
  59#endif
  60#include <linux/capability.h>
  61#include <linux/delay.h>
  62#include <linux/notifier.h>
  63#include <linux/string.h>
  64#include <linux/hash.h>
  65
  66#include <net/net_namespace.h>
  67#include <net/sock.h>
  68#include <net/snmp.h>
  69
  70#include <net/6lowpan.h>
  71#include <net/firewire.h>
  72#include <net/ipv6.h>
  73#include <net/protocol.h>
  74#include <net/ndisc.h>
  75#include <net/ip6_route.h>
  76#include <net/addrconf.h>
  77#include <net/tcp.h>
  78#include <net/ip.h>
  79#include <net/netlink.h>
  80#include <net/pkt_sched.h>
  81#include <net/l3mdev.h>
  82#include <linux/if_tunnel.h>
  83#include <linux/rtnetlink.h>
  84#include <linux/netconf.h>
  85#include <linux/random.h>
  86#include <linux/uaccess.h>
  87#include <asm/unaligned.h>
  88
  89#include <linux/proc_fs.h>
  90#include <linux/seq_file.h>
  91#include <linux/export.h>
  92#include <linux/ioam6.h>
  93
  94#define	INFINITY_LIFE_TIME	0xFFFFFFFF
  95
  96#define IPV6_MAX_STRLEN \
  97	sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")
  98
  99static inline u32 cstamp_delta(unsigned long cstamp)
 100{
 101	return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
 102}
 103
 104static inline s32 rfc3315_s14_backoff_init(s32 irt)
 105{
 106	/* multiply 'initial retransmission time' by 0.9 .. 1.1 */
 107	u64 tmp = get_random_u32_inclusive(900000, 1100000) * (u64)irt;
 108	do_div(tmp, 1000000);
 109	return (s32)tmp;
 110}
 111
 112static inline s32 rfc3315_s14_backoff_update(s32 rt, s32 mrt)
 113{
 114	/* multiply 'retransmission timeout' by 1.9 .. 2.1 */
 115	u64 tmp = get_random_u32_inclusive(1900000, 2100000) * (u64)rt;
 116	do_div(tmp, 1000000);
 117	if ((s32)tmp > mrt) {
 118		/* multiply 'maximum retransmission time' by 0.9 .. 1.1 */
 119		tmp = get_random_u32_inclusive(900000, 1100000) * (u64)mrt;
 120		do_div(tmp, 1000000);
 121	}
 122	return (s32)tmp;
 123}
 124
 125#ifdef CONFIG_SYSCTL
 126static int addrconf_sysctl_register(struct inet6_dev *idev);
 127static void addrconf_sysctl_unregister(struct inet6_dev *idev);
 128#else
 129static inline int addrconf_sysctl_register(struct inet6_dev *idev)
 130{
 131	return 0;
 132}
 133
 134static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
 135{
 136}
 137#endif
 138
 139static void ipv6_gen_rnd_iid(struct in6_addr *addr);
 140
 141static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);
 142static int ipv6_count_addresses(const struct inet6_dev *idev);
 143static int ipv6_generate_stable_address(struct in6_addr *addr,
 144					u8 dad_count,
 145					const struct inet6_dev *idev);
 146
 147#define IN6_ADDR_HSIZE_SHIFT	8
 148#define IN6_ADDR_HSIZE		(1 << IN6_ADDR_HSIZE_SHIFT)
 149
 150static void addrconf_verify(struct net *net);
 151static void addrconf_verify_rtnl(struct net *net);
 152
 153static struct workqueue_struct *addrconf_wq;
 154
 155static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
 156static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);
 157
 158static void addrconf_type_change(struct net_device *dev,
 159				 unsigned long event);
 160static int addrconf_ifdown(struct net_device *dev, bool unregister);
 161
 162static struct fib6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
 163						  int plen,
 164						  const struct net_device *dev,
 165						  u32 flags, u32 noflags,
 166						  bool no_gw);
 167
 168static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 169static void addrconf_dad_work(struct work_struct *w);
 170static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
 171				   bool send_na);
 172static void addrconf_dad_run(struct inet6_dev *idev, bool restart);
 173static void addrconf_rs_timer(struct timer_list *t);
 174static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 175static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 176
 177static void inet6_prefix_notify(int event, struct inet6_dev *idev,
 178				struct prefix_info *pinfo);
 179
 180static struct ipv6_devconf ipv6_devconf __read_mostly = {
 181	.forwarding		= 0,
 182	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
 183	.mtu6			= IPV6_MIN_MTU,
 184	.accept_ra		= 1,
 185	.accept_redirects	= 1,
 186	.autoconf		= 1,
 187	.force_mld_version	= 0,
 188	.mldv1_unsolicited_report_interval = 10 * HZ,
 189	.mldv2_unsolicited_report_interval = HZ,
 190	.dad_transmits		= 1,
 191	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
 192	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
 193	.rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
 194	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
 195	.use_tempaddr		= 0,
 196	.temp_valid_lft		= TEMP_VALID_LIFETIME,
 197	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
 198	.regen_min_advance	= REGEN_MIN_ADVANCE,
 199	.regen_max_retry	= REGEN_MAX_RETRY,
 200	.max_desync_factor	= MAX_DESYNC_FACTOR,
 201	.max_addresses		= IPV6_MAX_ADDRESSES,
 202	.accept_ra_defrtr	= 1,
 203	.ra_defrtr_metric	= IP6_RT_PRIO_USER,
 204	.accept_ra_from_local	= 0,
 205	.accept_ra_min_hop_limit= 1,
 206	.accept_ra_min_lft	= 0,
 207	.accept_ra_pinfo	= 1,
 208#ifdef CONFIG_IPV6_ROUTER_PREF
 209	.accept_ra_rtr_pref	= 1,
 210	.rtr_probe_interval	= 60 * HZ,
 211#ifdef CONFIG_IPV6_ROUTE_INFO
 212	.accept_ra_rt_info_min_plen = 0,
 213	.accept_ra_rt_info_max_plen = 0,
 214#endif
 215#endif
 216	.proxy_ndp		= 0,
 217	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
 218	.disable_ipv6		= 0,
 219	.accept_dad		= 0,
 220	.suppress_frag_ndisc	= 1,
 221	.accept_ra_mtu		= 1,
 222	.stable_secret		= {
 223		.initialized = false,
 224	},
 225	.use_oif_addrs_only	= 0,
 226	.ignore_routes_with_linkdown = 0,
 227	.keep_addr_on_down	= 0,
 228	.seg6_enabled		= 0,
 229#ifdef CONFIG_IPV6_SEG6_HMAC
 230	.seg6_require_hmac	= 0,
 231#endif
 232	.enhanced_dad           = 1,
 233	.addr_gen_mode		= IN6_ADDR_GEN_MODE_EUI64,
 234	.disable_policy		= 0,
 235	.rpl_seg_enabled	= 0,
 236	.ioam6_enabled		= 0,
 237	.ioam6_id               = IOAM6_DEFAULT_IF_ID,
 238	.ioam6_id_wide		= IOAM6_DEFAULT_IF_ID_WIDE,
 239	.ndisc_evict_nocarrier	= 1,
 240	.ra_honor_pio_life	= 0,
 241};
 242
 243static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 244	.forwarding		= 0,
 245	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
 246	.mtu6			= IPV6_MIN_MTU,
 247	.accept_ra		= 1,
 248	.accept_redirects	= 1,
 249	.autoconf		= 1,
 250	.force_mld_version	= 0,
 251	.mldv1_unsolicited_report_interval = 10 * HZ,
 252	.mldv2_unsolicited_report_interval = HZ,
 253	.dad_transmits		= 1,
 254	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
 255	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
 256	.rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
 257	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
 258	.use_tempaddr		= 0,
 259	.temp_valid_lft		= TEMP_VALID_LIFETIME,
 260	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
 261	.regen_min_advance	= REGEN_MIN_ADVANCE,
 262	.regen_max_retry	= REGEN_MAX_RETRY,
 263	.max_desync_factor	= MAX_DESYNC_FACTOR,
 264	.max_addresses		= IPV6_MAX_ADDRESSES,
 265	.accept_ra_defrtr	= 1,
 266	.ra_defrtr_metric	= IP6_RT_PRIO_USER,
 267	.accept_ra_from_local	= 0,
 268	.accept_ra_min_hop_limit= 1,
 269	.accept_ra_min_lft	= 0,
 270	.accept_ra_pinfo	= 1,
 271#ifdef CONFIG_IPV6_ROUTER_PREF
 272	.accept_ra_rtr_pref	= 1,
 273	.rtr_probe_interval	= 60 * HZ,
 274#ifdef CONFIG_IPV6_ROUTE_INFO
 275	.accept_ra_rt_info_min_plen = 0,
 276	.accept_ra_rt_info_max_plen = 0,
 277#endif
 278#endif
 279	.proxy_ndp		= 0,
 280	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
 281	.disable_ipv6		= 0,
 282	.accept_dad		= 1,
 283	.suppress_frag_ndisc	= 1,
 284	.accept_ra_mtu		= 1,
 285	.stable_secret		= {
 286		.initialized = false,
 287	},
 288	.use_oif_addrs_only	= 0,
 289	.ignore_routes_with_linkdown = 0,
 290	.keep_addr_on_down	= 0,
 291	.seg6_enabled		= 0,
 292#ifdef CONFIG_IPV6_SEG6_HMAC
 293	.seg6_require_hmac	= 0,
 294#endif
 295	.enhanced_dad           = 1,
 296	.addr_gen_mode		= IN6_ADDR_GEN_MODE_EUI64,
 297	.disable_policy		= 0,
 298	.rpl_seg_enabled	= 0,
 299	.ioam6_enabled		= 0,
 300	.ioam6_id               = IOAM6_DEFAULT_IF_ID,
 301	.ioam6_id_wide		= IOAM6_DEFAULT_IF_ID_WIDE,
 302	.ndisc_evict_nocarrier	= 1,
 303	.ra_honor_pio_life	= 0,
 304};
 305
 306/* Check if link is ready: is it up and is a valid qdisc available */
 307static inline bool addrconf_link_ready(const struct net_device *dev)
 308{
 309	return netif_oper_up(dev) && !qdisc_tx_is_noop(dev);
 310}
 311
 312static void addrconf_del_rs_timer(struct inet6_dev *idev)
 313{
 314	if (del_timer(&idev->rs_timer))
 315		__in6_dev_put(idev);
 316}
 317
 318static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
 319{
 320	if (cancel_delayed_work(&ifp->dad_work))
 321		__in6_ifa_put(ifp);
 322}
 323
 324static void addrconf_mod_rs_timer(struct inet6_dev *idev,
 325				  unsigned long when)
 326{
 327	if (!mod_timer(&idev->rs_timer, jiffies + when))
 328		in6_dev_hold(idev);
 
 329}
 330
 331static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
 332				   unsigned long delay)
 333{
 334	in6_ifa_hold(ifp);
 335	if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
 336		in6_ifa_put(ifp);
 337}
 338
 339static int snmp6_alloc_dev(struct inet6_dev *idev)
 340{
 341	int i;
 342
 343	idev->stats.ipv6 = alloc_percpu_gfp(struct ipstats_mib, GFP_KERNEL_ACCOUNT);
 344	if (!idev->stats.ipv6)
 345		goto err_ip;
 346
 347	for_each_possible_cpu(i) {
 348		struct ipstats_mib *addrconf_stats;
 349		addrconf_stats = per_cpu_ptr(idev->stats.ipv6, i);
 350		u64_stats_init(&addrconf_stats->syncp);
 351	}
 352
 353
 354	idev->stats.icmpv6dev = kzalloc(sizeof(struct icmpv6_mib_device),
 355					GFP_KERNEL);
 356	if (!idev->stats.icmpv6dev)
 357		goto err_icmp;
 358	idev->stats.icmpv6msgdev = kzalloc(sizeof(struct icmpv6msg_mib_device),
 359					   GFP_KERNEL_ACCOUNT);
 360	if (!idev->stats.icmpv6msgdev)
 361		goto err_icmpmsg;
 362
 363	return 0;
 364
 365err_icmpmsg:
 366	kfree(idev->stats.icmpv6dev);
 367err_icmp:
 368	free_percpu(idev->stats.ipv6);
 369err_ip:
 370	return -ENOMEM;
 371}
 372
 373static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
 374{
 375	struct inet6_dev *ndev;
 376	int err = -ENOMEM;
 377
 378	ASSERT_RTNL();
 379
 380	if (dev->mtu < IPV6_MIN_MTU && dev != blackhole_netdev)
 381		return ERR_PTR(-EINVAL);
 382
 383	ndev = kzalloc(sizeof(*ndev), GFP_KERNEL_ACCOUNT);
 384	if (!ndev)
 385		return ERR_PTR(err);
 386
 387	rwlock_init(&ndev->lock);
 388	ndev->dev = dev;
 389	INIT_LIST_HEAD(&ndev->addr_list);
 390	timer_setup(&ndev->rs_timer, addrconf_rs_timer, 0);
 391	memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
 392
 393	if (ndev->cnf.stable_secret.initialized)
 394		ndev->cnf.addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
 395
 396	ndev->cnf.mtu6 = dev->mtu;
 397	ndev->ra_mtu = 0;
 398	ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
 399	if (!ndev->nd_parms) {
 400		kfree(ndev);
 401		return ERR_PTR(err);
 402	}
 403	if (ndev->cnf.forwarding)
 404		dev_disable_lro(dev);
 405	/* We refer to the device */
 406	netdev_hold(dev, &ndev->dev_tracker, GFP_KERNEL);
 407
 408	if (snmp6_alloc_dev(ndev) < 0) {
 409		netdev_dbg(dev, "%s: cannot allocate memory for statistics\n",
 410			   __func__);
 411		neigh_parms_release(&nd_tbl, ndev->nd_parms);
 412		netdev_put(dev, &ndev->dev_tracker);
 413		kfree(ndev);
 414		return ERR_PTR(err);
 415	}
 416
 417	if (dev != blackhole_netdev) {
 418		if (snmp6_register_dev(ndev) < 0) {
 419			netdev_dbg(dev, "%s: cannot create /proc/net/dev_snmp6/%s\n",
 420				   __func__, dev->name);
 421			goto err_release;
 422		}
 423	}
 424	/* One reference from device. */
 425	refcount_set(&ndev->refcnt, 1);
 426
 427	if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
 428		ndev->cnf.accept_dad = -1;
 429
 430#if IS_ENABLED(CONFIG_IPV6_SIT)
 431	if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
 432		pr_info("%s: Disabled Multicast RS\n", dev->name);
 433		ndev->cnf.rtr_solicits = 0;
 434	}
 435#endif
 436
 437	INIT_LIST_HEAD(&ndev->tempaddr_list);
 438	ndev->desync_factor = U32_MAX;
 439	if ((dev->flags&IFF_LOOPBACK) ||
 440	    dev->type == ARPHRD_TUNNEL ||
 441	    dev->type == ARPHRD_TUNNEL6 ||
 442	    dev->type == ARPHRD_SIT ||
 443	    dev->type == ARPHRD_NONE) {
 444		ndev->cnf.use_tempaddr = -1;
 445	}
 446
 447	ndev->token = in6addr_any;
 448
 449	if (netif_running(dev) && addrconf_link_ready(dev))
 450		ndev->if_flags |= IF_READY;
 451
 452	ipv6_mc_init_dev(ndev);
 453	ndev->tstamp = jiffies;
 454	if (dev != blackhole_netdev) {
 455		err = addrconf_sysctl_register(ndev);
 456		if (err) {
 457			ipv6_mc_destroy_dev(ndev);
 458			snmp6_unregister_dev(ndev);
 459			goto err_release;
 460		}
 461	}
 462	/* protected by rtnl_lock */
 463	rcu_assign_pointer(dev->ip6_ptr, ndev);
 464
 465	if (dev != blackhole_netdev) {
 466		/* Join interface-local all-node multicast group */
 467		ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allnodes);
 468
 469		/* Join all-node multicast group */
 470		ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 471
 472		/* Join all-router multicast group if forwarding is set */
 473		if (ndev->cnf.forwarding && (dev->flags & IFF_MULTICAST))
 474			ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
 475	}
 476	return ndev;
 477
 478err_release:
 479	neigh_parms_release(&nd_tbl, ndev->nd_parms);
 480	ndev->dead = 1;
 481	in6_dev_finish_destroy(ndev);
 482	return ERR_PTR(err);
 483}
 484
 485static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
 486{
 487	struct inet6_dev *idev;
 488
 489	ASSERT_RTNL();
 490
 491	idev = __in6_dev_get(dev);
 492	if (!idev) {
 493		idev = ipv6_add_dev(dev);
 494		if (IS_ERR(idev))
 495			return idev;
 496	}
 497
 498	if (dev->flags&IFF_UP)
 499		ipv6_mc_up(idev);
 500	return idev;
 501}
 502
 503static int inet6_netconf_msgsize_devconf(int type)
 504{
 505	int size =  NLMSG_ALIGN(sizeof(struct netconfmsg))
 506		    + nla_total_size(4);	/* NETCONFA_IFINDEX */
 507	bool all = false;
 508
 509	if (type == NETCONFA_ALL)
 510		all = true;
 511
 512	if (all || type == NETCONFA_FORWARDING)
 513		size += nla_total_size(4);
 514#ifdef CONFIG_IPV6_MROUTE
 515	if (all || type == NETCONFA_MC_FORWARDING)
 516		size += nla_total_size(4);
 517#endif
 518	if (all || type == NETCONFA_PROXY_NEIGH)
 519		size += nla_total_size(4);
 520
 521	if (all || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN)
 522		size += nla_total_size(4);
 523
 524	return size;
 525}
 526
 527static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
 528				      struct ipv6_devconf *devconf, u32 portid,
 529				      u32 seq, int event, unsigned int flags,
 530				      int type)
 531{
 532	struct nlmsghdr  *nlh;
 533	struct netconfmsg *ncm;
 534	bool all = false;
 535
 536	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct netconfmsg),
 537			flags);
 538	if (!nlh)
 539		return -EMSGSIZE;
 540
 541	if (type == NETCONFA_ALL)
 542		all = true;
 543
 544	ncm = nlmsg_data(nlh);
 545	ncm->ncm_family = AF_INET6;
 546
 547	if (nla_put_s32(skb, NETCONFA_IFINDEX, ifindex) < 0)
 548		goto nla_put_failure;
 549
 550	if (!devconf)
 551		goto out;
 552
 553	if ((all || type == NETCONFA_FORWARDING) &&
 554	    nla_put_s32(skb, NETCONFA_FORWARDING,
 555			READ_ONCE(devconf->forwarding)) < 0)
 556		goto nla_put_failure;
 557#ifdef CONFIG_IPV6_MROUTE
 558	if ((all || type == NETCONFA_MC_FORWARDING) &&
 559	    nla_put_s32(skb, NETCONFA_MC_FORWARDING,
 560			atomic_read(&devconf->mc_forwarding)) < 0)
 561		goto nla_put_failure;
 562#endif
 563	if ((all || type == NETCONFA_PROXY_NEIGH) &&
 564	    nla_put_s32(skb, NETCONFA_PROXY_NEIGH,
 565			READ_ONCE(devconf->proxy_ndp)) < 0)
 566		goto nla_put_failure;
 567
 568	if ((all || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN) &&
 569	    nla_put_s32(skb, NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 570			READ_ONCE(devconf->ignore_routes_with_linkdown)) < 0)
 571		goto nla_put_failure;
 572
 573out:
 574	nlmsg_end(skb, nlh);
 575	return 0;
 576
 577nla_put_failure:
 578	nlmsg_cancel(skb, nlh);
 579	return -EMSGSIZE;
 580}
 581
 582void inet6_netconf_notify_devconf(struct net *net, int event, int type,
 583				  int ifindex, struct ipv6_devconf *devconf)
 584{
 585	struct sk_buff *skb;
 586	int err = -ENOBUFS;
 587
 588	skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_KERNEL);
 589	if (!skb)
 590		goto errout;
 591
 592	err = inet6_netconf_fill_devconf(skb, ifindex, devconf, 0, 0,
 593					 event, 0, type);
 594	if (err < 0) {
 595		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
 596		WARN_ON(err == -EMSGSIZE);
 597		kfree_skb(skb);
 598		goto errout;
 599	}
 600	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_KERNEL);
 601	return;
 602errout:
 603	rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err);
 604}
 605
 606static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
 607	[NETCONFA_IFINDEX]	= { .len = sizeof(int) },
 608	[NETCONFA_FORWARDING]	= { .len = sizeof(int) },
 609	[NETCONFA_PROXY_NEIGH]	= { .len = sizeof(int) },
 610	[NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN]	= { .len = sizeof(int) },
 611};
 612
 613static int inet6_netconf_valid_get_req(struct sk_buff *skb,
 614				       const struct nlmsghdr *nlh,
 615				       struct nlattr **tb,
 616				       struct netlink_ext_ack *extack)
 617{
 618	int i, err;
 619
 620	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(struct netconfmsg))) {
 621		NL_SET_ERR_MSG_MOD(extack, "Invalid header for netconf get request");
 622		return -EINVAL;
 623	}
 624
 625	if (!netlink_strict_get_check(skb))
 626		return nlmsg_parse_deprecated(nlh, sizeof(struct netconfmsg),
 627					      tb, NETCONFA_MAX,
 628					      devconf_ipv6_policy, extack);
 629
 630	err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct netconfmsg),
 631					    tb, NETCONFA_MAX,
 632					    devconf_ipv6_policy, extack);
 633	if (err)
 634		return err;
 635
 636	for (i = 0; i <= NETCONFA_MAX; i++) {
 637		if (!tb[i])
 638			continue;
 639
 640		switch (i) {
 641		case NETCONFA_IFINDEX:
 642			break;
 643		default:
 644			NL_SET_ERR_MSG_MOD(extack, "Unsupported attribute in netconf get request");
 645			return -EINVAL;
 646		}
 647	}
 648
 649	return 0;
 650}
 651
 652static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
 653				     struct nlmsghdr *nlh,
 654				     struct netlink_ext_ack *extack)
 655{
 656	struct net *net = sock_net(in_skb->sk);
 657	struct nlattr *tb[NETCONFA_MAX+1];
 658	struct inet6_dev *in6_dev = NULL;
 659	struct net_device *dev = NULL;
 660	struct sk_buff *skb;
 661	struct ipv6_devconf *devconf;
 662	int ifindex;
 663	int err;
 664
 665	err = inet6_netconf_valid_get_req(in_skb, nlh, tb, extack);
 666	if (err < 0)
 667		return err;
 668
 669	if (!tb[NETCONFA_IFINDEX])
 670		return -EINVAL;
 671
 672	err = -EINVAL;
 673	ifindex = nla_get_s32(tb[NETCONFA_IFINDEX]);
 674	switch (ifindex) {
 675	case NETCONFA_IFINDEX_ALL:
 676		devconf = net->ipv6.devconf_all;
 677		break;
 678	case NETCONFA_IFINDEX_DEFAULT:
 679		devconf = net->ipv6.devconf_dflt;
 680		break;
 681	default:
 682		dev = dev_get_by_index(net, ifindex);
 683		if (!dev)
 684			return -EINVAL;
 685		in6_dev = in6_dev_get(dev);
 686		if (!in6_dev)
 687			goto errout;
 688		devconf = &in6_dev->cnf;
 689		break;
 690	}
 691
 692	err = -ENOBUFS;
 693	skb = nlmsg_new(inet6_netconf_msgsize_devconf(NETCONFA_ALL), GFP_KERNEL);
 694	if (!skb)
 695		goto errout;
 696
 697	err = inet6_netconf_fill_devconf(skb, ifindex, devconf,
 698					 NETLINK_CB(in_skb).portid,
 699					 nlh->nlmsg_seq, RTM_NEWNETCONF, 0,
 700					 NETCONFA_ALL);
 701	if (err < 0) {
 702		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
 703		WARN_ON(err == -EMSGSIZE);
 704		kfree_skb(skb);
 705		goto errout;
 706	}
 707	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
 708errout:
 709	if (in6_dev)
 710		in6_dev_put(in6_dev);
 711	dev_put(dev);
 712	return err;
 713}
 714
 715/* Combine dev_addr_genid and dev_base_seq to detect changes.
 716 */
 717static u32 inet6_base_seq(const struct net *net)
 718{
 719	u32 res = atomic_read(&net->ipv6.dev_addr_genid) +
 720		  READ_ONCE(net->dev_base_seq);
 721
 722	/* Must not return 0 (see nl_dump_check_consistent()).
 723	 * Chose a value far away from 0.
 724	 */
 725	if (!res)
 726		res = 0x80000000;
 727	return res;
 728}
 729
 730static int inet6_netconf_dump_devconf(struct sk_buff *skb,
 731				      struct netlink_callback *cb)
 732{
 733	const struct nlmsghdr *nlh = cb->nlh;
 734	struct net *net = sock_net(skb->sk);
 735	struct {
 736		unsigned long ifindex;
 737		unsigned int all_default;
 738	} *ctx = (void *)cb->ctx;
 739	struct net_device *dev;
 740	struct inet6_dev *idev;
 741	int err = 0;
 742
 743	if (cb->strict_check) {
 744		struct netlink_ext_ack *extack = cb->extack;
 745		struct netconfmsg *ncm;
 746
 747		if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ncm))) {
 748			NL_SET_ERR_MSG_MOD(extack, "Invalid header for netconf dump request");
 749			return -EINVAL;
 750		}
 751
 752		if (nlmsg_attrlen(nlh, sizeof(*ncm))) {
 753			NL_SET_ERR_MSG_MOD(extack, "Invalid data after header in netconf dump request");
 754			return -EINVAL;
 755		}
 756	}
 757
 758	rcu_read_lock();
 759	for_each_netdev_dump(net, dev, ctx->ifindex) {
 760		idev = __in6_dev_get(dev);
 761		if (!idev)
 762			continue;
 763		err = inet6_netconf_fill_devconf(skb, dev->ifindex,
 764					         &idev->cnf,
 765						 NETLINK_CB(cb->skb).portid,
 766						 nlh->nlmsg_seq,
 767						 RTM_NEWNETCONF,
 768						 NLM_F_MULTI,
 769						 NETCONFA_ALL);
 770		if (err < 0)
 771			goto done;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 772	}
 773	if (ctx->all_default == 0) {
 774		err = inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_ALL,
 775						 net->ipv6.devconf_all,
 776						 NETLINK_CB(cb->skb).portid,
 777						 nlh->nlmsg_seq,
 778						 RTM_NEWNETCONF, NLM_F_MULTI,
 779						 NETCONFA_ALL);
 780		if (err < 0)
 781			goto done;
 782		ctx->all_default++;
 
 783	}
 784	if (ctx->all_default == 1) {
 785		err = inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_DEFAULT,
 786						 net->ipv6.devconf_dflt,
 787						 NETLINK_CB(cb->skb).portid,
 788						 nlh->nlmsg_seq,
 789						 RTM_NEWNETCONF, NLM_F_MULTI,
 790						 NETCONFA_ALL);
 791		if (err < 0)
 792			goto done;
 793		ctx->all_default++;
 
 794	}
 795done:
 796	rcu_read_unlock();
 797	return err;
 
 
 798}
 799
 800#ifdef CONFIG_SYSCTL
 801static void dev_forward_change(struct inet6_dev *idev)
 802{
 803	struct net_device *dev;
 804	struct inet6_ifaddr *ifa;
 805	LIST_HEAD(tmp_addr_list);
 806
 807	if (!idev)
 808		return;
 809	dev = idev->dev;
 810	if (idev->cnf.forwarding)
 811		dev_disable_lro(dev);
 812	if (dev->flags & IFF_MULTICAST) {
 813		if (idev->cnf.forwarding) {
 814			ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
 815			ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allrouters);
 816			ipv6_dev_mc_inc(dev, &in6addr_sitelocal_allrouters);
 817		} else {
 818			ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);
 819			ipv6_dev_mc_dec(dev, &in6addr_interfacelocal_allrouters);
 820			ipv6_dev_mc_dec(dev, &in6addr_sitelocal_allrouters);
 821		}
 822	}
 823
 824	read_lock_bh(&idev->lock);
 825	list_for_each_entry(ifa, &idev->addr_list, if_list) {
 826		if (ifa->flags&IFA_F_TENTATIVE)
 827			continue;
 828		list_add_tail(&ifa->if_list_aux, &tmp_addr_list);
 829	}
 830	read_unlock_bh(&idev->lock);
 831
 832	while (!list_empty(&tmp_addr_list)) {
 833		ifa = list_first_entry(&tmp_addr_list,
 834				       struct inet6_ifaddr, if_list_aux);
 835		list_del(&ifa->if_list_aux);
 836		if (idev->cnf.forwarding)
 837			addrconf_join_anycast(ifa);
 838		else
 839			addrconf_leave_anycast(ifa);
 840	}
 841
 842	inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF,
 843				     NETCONFA_FORWARDING,
 844				     dev->ifindex, &idev->cnf);
 845}
 846
 847
 848static void addrconf_forward_change(struct net *net, __s32 newf)
 849{
 850	struct net_device *dev;
 851	struct inet6_dev *idev;
 852
 853	for_each_netdev(net, dev) {
 854		idev = __in6_dev_get(dev);
 855		if (idev) {
 856			int changed = (!idev->cnf.forwarding) ^ (!newf);
 857
 858			WRITE_ONCE(idev->cnf.forwarding, newf);
 859			if (changed)
 860				dev_forward_change(idev);
 861		}
 862	}
 863}
 864
 865static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
 866{
 867	struct net *net;
 868	int old;
 869
 870	if (!rtnl_trylock())
 871		return restart_syscall();
 872
 873	net = (struct net *)table->extra2;
 874	old = *p;
 875	WRITE_ONCE(*p, newf);
 876
 877	if (p == &net->ipv6.devconf_dflt->forwarding) {
 878		if ((!newf) ^ (!old))
 879			inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
 880						     NETCONFA_FORWARDING,
 881						     NETCONFA_IFINDEX_DEFAULT,
 882						     net->ipv6.devconf_dflt);
 883		rtnl_unlock();
 884		return 0;
 885	}
 886
 887	if (p == &net->ipv6.devconf_all->forwarding) {
 888		int old_dflt = net->ipv6.devconf_dflt->forwarding;
 889
 890		WRITE_ONCE(net->ipv6.devconf_dflt->forwarding, newf);
 891		if ((!newf) ^ (!old_dflt))
 892			inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
 893						     NETCONFA_FORWARDING,
 894						     NETCONFA_IFINDEX_DEFAULT,
 895						     net->ipv6.devconf_dflt);
 896
 897		addrconf_forward_change(net, newf);
 898		if ((!newf) ^ (!old))
 899			inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
 900						     NETCONFA_FORWARDING,
 901						     NETCONFA_IFINDEX_ALL,
 902						     net->ipv6.devconf_all);
 903	} else if ((!newf) ^ (!old))
 904		dev_forward_change((struct inet6_dev *)table->extra1);
 905	rtnl_unlock();
 906
 907	if (newf)
 908		rt6_purge_dflt_routers(net);
 909	return 1;
 910}
 911
 912static void addrconf_linkdown_change(struct net *net, __s32 newf)
 913{
 914	struct net_device *dev;
 915	struct inet6_dev *idev;
 916
 917	for_each_netdev(net, dev) {
 918		idev = __in6_dev_get(dev);
 919		if (idev) {
 920			int changed = (!idev->cnf.ignore_routes_with_linkdown) ^ (!newf);
 921
 922			WRITE_ONCE(idev->cnf.ignore_routes_with_linkdown, newf);
 923			if (changed)
 924				inet6_netconf_notify_devconf(dev_net(dev),
 925							     RTM_NEWNETCONF,
 926							     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 927							     dev->ifindex,
 928							     &idev->cnf);
 929		}
 930	}
 931}
 932
 933static int addrconf_fixup_linkdown(struct ctl_table *table, int *p, int newf)
 934{
 935	struct net *net;
 936	int old;
 937
 938	if (!rtnl_trylock())
 939		return restart_syscall();
 940
 941	net = (struct net *)table->extra2;
 942	old = *p;
 943	WRITE_ONCE(*p, newf);
 944
 945	if (p == &net->ipv6.devconf_dflt->ignore_routes_with_linkdown) {
 946		if ((!newf) ^ (!old))
 947			inet6_netconf_notify_devconf(net,
 948						     RTM_NEWNETCONF,
 949						     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 950						     NETCONFA_IFINDEX_DEFAULT,
 951						     net->ipv6.devconf_dflt);
 952		rtnl_unlock();
 953		return 0;
 954	}
 955
 956	if (p == &net->ipv6.devconf_all->ignore_routes_with_linkdown) {
 957		WRITE_ONCE(net->ipv6.devconf_dflt->ignore_routes_with_linkdown, newf);
 958		addrconf_linkdown_change(net, newf);
 959		if ((!newf) ^ (!old))
 960			inet6_netconf_notify_devconf(net,
 961						     RTM_NEWNETCONF,
 962						     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 963						     NETCONFA_IFINDEX_ALL,
 964						     net->ipv6.devconf_all);
 965	}
 966	rtnl_unlock();
 967
 968	return 1;
 969}
 970
 971#endif
 972
 973/* Nobody refers to this ifaddr, destroy it */
 974void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 975{
 976	WARN_ON(!hlist_unhashed(&ifp->addr_lst));
 977
 978#ifdef NET_REFCNT_DEBUG
 979	pr_debug("%s\n", __func__);
 980#endif
 981
 982	in6_dev_put(ifp->idev);
 983
 984	if (cancel_delayed_work(&ifp->dad_work))
 985		pr_notice("delayed DAD work was pending while freeing ifa=%p\n",
 986			  ifp);
 987
 988	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
 989		pr_warn("Freeing alive inet6 address %p\n", ifp);
 990		return;
 991	}
 992
 993	kfree_rcu(ifp, rcu);
 994}
 995
 996static void
 997ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
 998{
 999	struct list_head *p;
1000	int ifp_scope = ipv6_addr_src_scope(&ifp->addr);
1001
1002	/*
1003	 * Each device address list is sorted in order of scope -
1004	 * global before linklocal.
1005	 */
1006	list_for_each(p, &idev->addr_list) {
1007		struct inet6_ifaddr *ifa
1008			= list_entry(p, struct inet6_ifaddr, if_list);
1009		if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))
1010			break;
1011	}
1012
1013	list_add_tail_rcu(&ifp->if_list, p);
1014}
1015
1016static u32 inet6_addr_hash(const struct net *net, const struct in6_addr *addr)
1017{
1018	u32 val = ipv6_addr_hash(addr) ^ net_hash_mix(net);
1019
1020	return hash_32(val, IN6_ADDR_HSIZE_SHIFT);
1021}
1022
1023static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
1024			       struct net_device *dev, unsigned int hash)
1025{
1026	struct inet6_ifaddr *ifp;
1027
1028	hlist_for_each_entry(ifp, &net->ipv6.inet6_addr_lst[hash], addr_lst) {
1029		if (ipv6_addr_equal(&ifp->addr, addr)) {
1030			if (!dev || ifp->idev->dev == dev)
1031				return true;
1032		}
1033	}
1034	return false;
1035}
1036
1037static int ipv6_add_addr_hash(struct net_device *dev, struct inet6_ifaddr *ifa)
1038{
1039	struct net *net = dev_net(dev);
1040	unsigned int hash = inet6_addr_hash(net, &ifa->addr);
1041	int err = 0;
1042
1043	spin_lock_bh(&net->ipv6.addrconf_hash_lock);
1044
1045	/* Ignore adding duplicate addresses on an interface */
1046	if (ipv6_chk_same_addr(net, &ifa->addr, dev, hash)) {
1047		netdev_dbg(dev, "ipv6_add_addr: already assigned\n");
1048		err = -EEXIST;
1049	} else {
1050		hlist_add_head_rcu(&ifa->addr_lst, &net->ipv6.inet6_addr_lst[hash]);
1051	}
1052
1053	spin_unlock_bh(&net->ipv6.addrconf_hash_lock);
1054
1055	return err;
1056}
1057
1058/* On success it returns ifp with increased reference count */
1059
1060static struct inet6_ifaddr *
1061ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
1062	      bool can_block, struct netlink_ext_ack *extack)
1063{
1064	gfp_t gfp_flags = can_block ? GFP_KERNEL : GFP_ATOMIC;
1065	int addr_type = ipv6_addr_type(cfg->pfx);
1066	struct net *net = dev_net(idev->dev);
1067	struct inet6_ifaddr *ifa = NULL;
1068	struct fib6_info *f6i = NULL;
1069	int err = 0;
1070
1071	if (addr_type == IPV6_ADDR_ANY) {
1072		NL_SET_ERR_MSG_MOD(extack, "Invalid address");
1073		return ERR_PTR(-EADDRNOTAVAIL);
1074	} else if (addr_type & IPV6_ADDR_MULTICAST &&
1075		   !(cfg->ifa_flags & IFA_F_MCAUTOJOIN)) {
1076		NL_SET_ERR_MSG_MOD(extack, "Cannot assign multicast address without \"IFA_F_MCAUTOJOIN\" flag");
1077		return ERR_PTR(-EADDRNOTAVAIL);
1078	} else if (!(idev->dev->flags & IFF_LOOPBACK) &&
1079		   !netif_is_l3_master(idev->dev) &&
1080		   addr_type & IPV6_ADDR_LOOPBACK) {
1081		NL_SET_ERR_MSG_MOD(extack, "Cannot assign loopback address on this device");
1082		return ERR_PTR(-EADDRNOTAVAIL);
1083	}
1084
1085	if (idev->dead) {
1086		NL_SET_ERR_MSG_MOD(extack, "device is going away");
1087		err = -ENODEV;
1088		goto out;
1089	}
1090
1091	if (idev->cnf.disable_ipv6) {
1092		NL_SET_ERR_MSG_MOD(extack, "IPv6 is disabled on this device");
1093		err = -EACCES;
1094		goto out;
1095	}
1096
1097	/* validator notifier needs to be blocking;
1098	 * do not call in atomic context
1099	 */
1100	if (can_block) {
1101		struct in6_validator_info i6vi = {
1102			.i6vi_addr = *cfg->pfx,
1103			.i6vi_dev = idev,
1104			.extack = extack,
1105		};
1106
1107		err = inet6addr_validator_notifier_call_chain(NETDEV_UP, &i6vi);
1108		err = notifier_to_errno(err);
1109		if (err < 0)
1110			goto out;
1111	}
1112
1113	ifa = kzalloc(sizeof(*ifa), gfp_flags | __GFP_ACCOUNT);
1114	if (!ifa) {
1115		err = -ENOBUFS;
1116		goto out;
1117	}
1118
1119	f6i = addrconf_f6i_alloc(net, idev, cfg->pfx, false, gfp_flags, extack);
1120	if (IS_ERR(f6i)) {
1121		err = PTR_ERR(f6i);
1122		f6i = NULL;
1123		goto out;
1124	}
1125
1126	neigh_parms_data_state_setall(idev->nd_parms);
1127
1128	ifa->addr = *cfg->pfx;
1129	if (cfg->peer_pfx)
1130		ifa->peer_addr = *cfg->peer_pfx;
1131
1132	spin_lock_init(&ifa->lock);
1133	INIT_DELAYED_WORK(&ifa->dad_work, addrconf_dad_work);
1134	INIT_HLIST_NODE(&ifa->addr_lst);
1135	ifa->scope = cfg->scope;
1136	ifa->prefix_len = cfg->plen;
1137	ifa->rt_priority = cfg->rt_priority;
1138	ifa->flags = cfg->ifa_flags;
1139	ifa->ifa_proto = cfg->ifa_proto;
1140	/* No need to add the TENTATIVE flag for addresses with NODAD */
1141	if (!(cfg->ifa_flags & IFA_F_NODAD))
1142		ifa->flags |= IFA_F_TENTATIVE;
1143	ifa->valid_lft = cfg->valid_lft;
1144	ifa->prefered_lft = cfg->preferred_lft;
1145	ifa->cstamp = ifa->tstamp = jiffies;
1146	ifa->tokenized = false;
1147
1148	ifa->rt = f6i;
1149
1150	ifa->idev = idev;
1151	in6_dev_hold(idev);
1152
1153	/* For caller */
1154	refcount_set(&ifa->refcnt, 1);
1155
1156	rcu_read_lock();
1157
1158	err = ipv6_add_addr_hash(idev->dev, ifa);
1159	if (err < 0) {
1160		rcu_read_unlock();
1161		goto out;
1162	}
1163
1164	write_lock_bh(&idev->lock);
1165
1166	/* Add to inet6_dev unicast addr list. */
1167	ipv6_link_dev_addr(idev, ifa);
1168
1169	if (ifa->flags&IFA_F_TEMPORARY) {
1170		list_add(&ifa->tmp_list, &idev->tempaddr_list);
1171		in6_ifa_hold(ifa);
1172	}
1173
1174	in6_ifa_hold(ifa);
1175	write_unlock_bh(&idev->lock);
1176
1177	rcu_read_unlock();
1178
1179	inet6addr_notifier_call_chain(NETDEV_UP, ifa);
1180out:
1181	if (unlikely(err < 0)) {
1182		fib6_info_release(f6i);
1183
1184		if (ifa) {
1185			if (ifa->idev)
1186				in6_dev_put(ifa->idev);
1187			kfree(ifa);
1188		}
1189		ifa = ERR_PTR(err);
1190	}
1191
1192	return ifa;
1193}
1194
1195enum cleanup_prefix_rt_t {
1196	CLEANUP_PREFIX_RT_NOP,    /* no cleanup action for prefix route */
1197	CLEANUP_PREFIX_RT_DEL,    /* delete the prefix route */
1198	CLEANUP_PREFIX_RT_EXPIRE, /* update the lifetime of the prefix route */
1199};
1200
1201/*
1202 * Check, whether the prefix for ifp would still need a prefix route
1203 * after deleting ifp. The function returns one of the CLEANUP_PREFIX_RT_*
1204 * constants.
1205 *
1206 * 1) we don't purge prefix if address was not permanent.
1207 *    prefix is managed by its own lifetime.
1208 * 2) we also don't purge, if the address was IFA_F_NOPREFIXROUTE.
1209 * 3) if there are no addresses, delete prefix.
1210 * 4) if there are still other permanent address(es),
1211 *    corresponding prefix is still permanent.
1212 * 5) if there are still other addresses with IFA_F_NOPREFIXROUTE,
1213 *    don't purge the prefix, assume user space is managing it.
1214 * 6) otherwise, update prefix lifetime to the
1215 *    longest valid lifetime among the corresponding
1216 *    addresses on the device.
1217 *    Note: subsequent RA will update lifetime.
1218 **/
1219static enum cleanup_prefix_rt_t
1220check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
1221{
1222	struct inet6_ifaddr *ifa;
1223	struct inet6_dev *idev = ifp->idev;
1224	unsigned long lifetime;
1225	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_DEL;
1226
1227	*expires = jiffies;
1228
1229	list_for_each_entry(ifa, &idev->addr_list, if_list) {
1230		if (ifa == ifp)
1231			continue;
1232		if (ifa->prefix_len != ifp->prefix_len ||
1233		    !ipv6_prefix_equal(&ifa->addr, &ifp->addr,
1234				       ifp->prefix_len))
1235			continue;
1236		if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
1237			return CLEANUP_PREFIX_RT_NOP;
1238
1239		action = CLEANUP_PREFIX_RT_EXPIRE;
1240
1241		spin_lock(&ifa->lock);
1242
1243		lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
1244		/*
1245		 * Note: Because this address is
1246		 * not permanent, lifetime <
1247		 * LONG_MAX / HZ here.
1248		 */
1249		if (time_before(*expires, ifa->tstamp + lifetime * HZ))
1250			*expires = ifa->tstamp + lifetime * HZ;
1251		spin_unlock(&ifa->lock);
1252	}
1253
1254	return action;
1255}
1256
1257static void
1258cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires,
1259		     bool del_rt, bool del_peer)
1260{
1261	struct fib6_table *table;
1262	struct fib6_info *f6i;
1263
1264	f6i = addrconf_get_prefix_route(del_peer ? &ifp->peer_addr : &ifp->addr,
1265					ifp->prefix_len,
1266					ifp->idev->dev, 0, RTF_DEFAULT, true);
1267	if (f6i) {
1268		if (del_rt)
1269			ip6_del_rt(dev_net(ifp->idev->dev), f6i, false);
1270		else {
1271			if (!(f6i->fib6_flags & RTF_EXPIRES)) {
1272				table = f6i->fib6_table;
1273				spin_lock_bh(&table->tb6_lock);
1274
1275				fib6_set_expires(f6i, expires);
1276				fib6_add_gc_list(f6i);
1277
1278				spin_unlock_bh(&table->tb6_lock);
1279			}
1280			fib6_info_release(f6i);
1281		}
1282	}
1283}
1284
1285
1286/* This function wants to get referenced ifp and releases it before return */
1287
1288static void ipv6_del_addr(struct inet6_ifaddr *ifp)
1289{
1290	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_NOP;
1291	struct net *net = dev_net(ifp->idev->dev);
1292	unsigned long expires;
1293	int state;
1294
1295	ASSERT_RTNL();
1296
1297	spin_lock_bh(&ifp->lock);
1298	state = ifp->state;
1299	ifp->state = INET6_IFADDR_STATE_DEAD;
1300	spin_unlock_bh(&ifp->lock);
1301
1302	if (state == INET6_IFADDR_STATE_DEAD)
1303		goto out;
1304
1305	spin_lock_bh(&net->ipv6.addrconf_hash_lock);
1306	hlist_del_init_rcu(&ifp->addr_lst);
1307	spin_unlock_bh(&net->ipv6.addrconf_hash_lock);
1308
1309	write_lock_bh(&ifp->idev->lock);
1310
1311	if (ifp->flags&IFA_F_TEMPORARY) {
1312		list_del(&ifp->tmp_list);
1313		if (ifp->ifpub) {
1314			in6_ifa_put(ifp->ifpub);
1315			ifp->ifpub = NULL;
1316		}
1317		__in6_ifa_put(ifp);
1318	}
1319
1320	if (ifp->flags & IFA_F_PERMANENT && !(ifp->flags & IFA_F_NOPREFIXROUTE))
1321		action = check_cleanup_prefix_route(ifp, &expires);
1322
1323	list_del_rcu(&ifp->if_list);
1324	__in6_ifa_put(ifp);
1325
1326	write_unlock_bh(&ifp->idev->lock);
1327
1328	addrconf_del_dad_work(ifp);
1329
1330	ipv6_ifa_notify(RTM_DELADDR, ifp);
1331
1332	inet6addr_notifier_call_chain(NETDEV_DOWN, ifp);
1333
1334	if (action != CLEANUP_PREFIX_RT_NOP) {
1335		cleanup_prefix_route(ifp, expires,
1336			action == CLEANUP_PREFIX_RT_DEL, false);
1337	}
1338
1339	/* clean up prefsrc entries */
1340	rt6_remove_prefsrc(ifp);
1341out:
1342	in6_ifa_put(ifp);
1343}
1344
1345static unsigned long ipv6_get_regen_advance(const struct inet6_dev *idev)
1346{
1347	return READ_ONCE(idev->cnf.regen_min_advance) +
1348		READ_ONCE(idev->cnf.regen_max_retry) *
1349		READ_ONCE(idev->cnf.dad_transmits) *
1350		max(NEIGH_VAR(idev->nd_parms, RETRANS_TIME), HZ/100) / HZ;
1351}
1352
1353static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
1354{
1355	struct inet6_dev *idev = ifp->idev;
1356	unsigned long tmp_tstamp, age;
1357	unsigned long regen_advance;
1358	unsigned long now = jiffies;
1359	u32 if_public_preferred_lft;
1360	s32 cnf_temp_preferred_lft;
1361	struct inet6_ifaddr *ift;
1362	struct ifa6_config cfg;
1363	long max_desync_factor;
1364	struct in6_addr addr;
1365	int ret = 0;
1366
1367	write_lock_bh(&idev->lock);
1368
1369retry:
1370	in6_dev_hold(idev);
1371	if (READ_ONCE(idev->cnf.use_tempaddr) <= 0) {
1372		write_unlock_bh(&idev->lock);
1373		pr_info("%s: use_tempaddr is disabled\n", __func__);
1374		in6_dev_put(idev);
1375		ret = -1;
1376		goto out;
1377	}
1378	spin_lock_bh(&ifp->lock);
1379	if (ifp->regen_count++ >= READ_ONCE(idev->cnf.regen_max_retry)) {
1380		WRITE_ONCE(idev->cnf.use_tempaddr, -1);	/*XXX*/
1381		spin_unlock_bh(&ifp->lock);
1382		write_unlock_bh(&idev->lock);
1383		pr_warn("%s: regeneration time exceeded - disabled temporary address support\n",
1384			__func__);
1385		in6_dev_put(idev);
1386		ret = -1;
1387		goto out;
1388	}
1389	in6_ifa_hold(ifp);
1390	memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);
1391	ipv6_gen_rnd_iid(&addr);
1392
1393	age = (now - ifp->tstamp) / HZ;
1394
1395	regen_advance = ipv6_get_regen_advance(idev);
 
 
1396
1397	/* recalculate max_desync_factor each time and update
1398	 * idev->desync_factor if it's larger
1399	 */
1400	cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft);
1401	max_desync_factor = min_t(long,
1402				  READ_ONCE(idev->cnf.max_desync_factor),
1403				  cnf_temp_preferred_lft - regen_advance);
1404
1405	if (unlikely(idev->desync_factor > max_desync_factor)) {
1406		if (max_desync_factor > 0) {
1407			get_random_bytes(&idev->desync_factor,
1408					 sizeof(idev->desync_factor));
1409			idev->desync_factor %= max_desync_factor;
1410		} else {
1411			idev->desync_factor = 0;
1412		}
1413	}
1414
1415	if_public_preferred_lft = ifp->prefered_lft;
1416
1417	memset(&cfg, 0, sizeof(cfg));
1418	cfg.valid_lft = min_t(__u32, ifp->valid_lft,
1419			      READ_ONCE(idev->cnf.temp_valid_lft) + age);
1420	cfg.preferred_lft = cnf_temp_preferred_lft + age - idev->desync_factor;
1421	cfg.preferred_lft = min_t(__u32, if_public_preferred_lft, cfg.preferred_lft);
1422	cfg.preferred_lft = min_t(__u32, cfg.valid_lft, cfg.preferred_lft);
1423
1424	cfg.plen = ifp->prefix_len;
1425	tmp_tstamp = ifp->tstamp;
1426	spin_unlock_bh(&ifp->lock);
1427
1428	write_unlock_bh(&idev->lock);
1429
1430	/* From RFC 4941:
1431	 *
1432	 *     A temporary address is created only if this calculated Preferred
1433	 *     Lifetime is greater than REGEN_ADVANCE time units.  In
1434	 *     particular, an implementation must not create a temporary address
1435	 *     with a zero Preferred Lifetime.
1436	 *
1437	 *     ...
1438	 *
1439	 *     When creating a temporary address, the lifetime values MUST be
1440	 *     derived from the corresponding prefix as follows:
1441	 *
1442	 *     ...
1443	 *
1444	 *     *  Its Preferred Lifetime is the lower of the Preferred Lifetime
1445	 *        of the public address or TEMP_PREFERRED_LIFETIME -
1446	 *        DESYNC_FACTOR.
1447	 *
1448	 * To comply with the RFC's requirements, clamp the preferred lifetime
1449	 * to a minimum of regen_advance, unless that would exceed valid_lft or
1450	 * ifp->prefered_lft.
1451	 *
1452	 * Use age calculation as in addrconf_verify to avoid unnecessary
1453	 * temporary addresses being generated.
1454	 */
1455	age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
1456	if (cfg.preferred_lft <= regen_advance + age) {
1457		cfg.preferred_lft = regen_advance + age + 1;
1458		if (cfg.preferred_lft > cfg.valid_lft ||
1459		    cfg.preferred_lft > if_public_preferred_lft) {
1460			in6_ifa_put(ifp);
1461			in6_dev_put(idev);
1462			ret = -1;
1463			goto out;
1464		}
1465	}
1466
1467	cfg.ifa_flags = IFA_F_TEMPORARY;
1468	/* set in addrconf_prefix_rcv() */
1469	if (ifp->flags & IFA_F_OPTIMISTIC)
1470		cfg.ifa_flags |= IFA_F_OPTIMISTIC;
1471
1472	cfg.pfx = &addr;
1473	cfg.scope = ipv6_addr_scope(cfg.pfx);
1474
1475	ift = ipv6_add_addr(idev, &cfg, block, NULL);
1476	if (IS_ERR(ift)) {
1477		in6_ifa_put(ifp);
1478		in6_dev_put(idev);
1479		pr_info("%s: retry temporary address regeneration\n", __func__);
1480		write_lock_bh(&idev->lock);
1481		goto retry;
1482	}
1483
1484	spin_lock_bh(&ift->lock);
1485	ift->ifpub = ifp;
1486	ift->cstamp = now;
1487	ift->tstamp = tmp_tstamp;
1488	spin_unlock_bh(&ift->lock);
1489
1490	addrconf_dad_start(ift);
1491	in6_ifa_put(ift);
1492	in6_dev_put(idev);
1493out:
1494	return ret;
1495}
1496
1497/*
1498 *	Choose an appropriate source address (RFC3484)
1499 */
1500enum {
1501	IPV6_SADDR_RULE_INIT = 0,
1502	IPV6_SADDR_RULE_LOCAL,
1503	IPV6_SADDR_RULE_SCOPE,
1504	IPV6_SADDR_RULE_PREFERRED,
1505#ifdef CONFIG_IPV6_MIP6
1506	IPV6_SADDR_RULE_HOA,
1507#endif
1508	IPV6_SADDR_RULE_OIF,
1509	IPV6_SADDR_RULE_LABEL,
1510	IPV6_SADDR_RULE_PRIVACY,
1511	IPV6_SADDR_RULE_ORCHID,
1512	IPV6_SADDR_RULE_PREFIX,
1513#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1514	IPV6_SADDR_RULE_NOT_OPTIMISTIC,
1515#endif
1516	IPV6_SADDR_RULE_MAX
1517};
1518
1519struct ipv6_saddr_score {
1520	int			rule;
1521	int			addr_type;
1522	struct inet6_ifaddr	*ifa;
1523	DECLARE_BITMAP(scorebits, IPV6_SADDR_RULE_MAX);
1524	int			scopedist;
1525	int			matchlen;
1526};
1527
1528struct ipv6_saddr_dst {
1529	const struct in6_addr *addr;
1530	int ifindex;
1531	int scope;
1532	int label;
1533	unsigned int prefs;
1534};
1535
1536static inline int ipv6_saddr_preferred(int type)
1537{
1538	if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))
1539		return 1;
1540	return 0;
1541}
1542
1543static bool ipv6_use_optimistic_addr(const struct net *net,
1544				     const struct inet6_dev *idev)
1545{
1546#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1547	if (!idev)
1548		return false;
1549	if (!READ_ONCE(net->ipv6.devconf_all->optimistic_dad) &&
1550	    !READ_ONCE(idev->cnf.optimistic_dad))
1551		return false;
1552	if (!READ_ONCE(net->ipv6.devconf_all->use_optimistic) &&
1553	    !READ_ONCE(idev->cnf.use_optimistic))
1554		return false;
1555
1556	return true;
1557#else
1558	return false;
1559#endif
1560}
1561
1562static bool ipv6_allow_optimistic_dad(const struct net *net,
1563				      const struct inet6_dev *idev)
1564{
1565#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1566	if (!idev)
1567		return false;
1568	if (!READ_ONCE(net->ipv6.devconf_all->optimistic_dad) &&
1569	    !READ_ONCE(idev->cnf.optimistic_dad))
1570		return false;
1571
1572	return true;
1573#else
1574	return false;
1575#endif
1576}
1577
1578static int ipv6_get_saddr_eval(struct net *net,
1579			       struct ipv6_saddr_score *score,
1580			       struct ipv6_saddr_dst *dst,
1581			       int i)
1582{
1583	int ret;
1584
1585	if (i <= score->rule) {
1586		switch (i) {
1587		case IPV6_SADDR_RULE_SCOPE:
1588			ret = score->scopedist;
1589			break;
1590		case IPV6_SADDR_RULE_PREFIX:
1591			ret = score->matchlen;
1592			break;
1593		default:
1594			ret = !!test_bit(i, score->scorebits);
1595		}
1596		goto out;
1597	}
1598
1599	switch (i) {
1600	case IPV6_SADDR_RULE_INIT:
1601		/* Rule 0: remember if hiscore is not ready yet */
1602		ret = !!score->ifa;
1603		break;
1604	case IPV6_SADDR_RULE_LOCAL:
1605		/* Rule 1: Prefer same address */
1606		ret = ipv6_addr_equal(&score->ifa->addr, dst->addr);
1607		break;
1608	case IPV6_SADDR_RULE_SCOPE:
1609		/* Rule 2: Prefer appropriate scope
1610		 *
1611		 *      ret
1612		 *       ^
1613		 *    -1 |  d 15
1614		 *    ---+--+-+---> scope
1615		 *       |
1616		 *       |             d is scope of the destination.
1617		 *  B-d  |  \
1618		 *       |   \      <- smaller scope is better if
1619		 *  B-15 |    \        if scope is enough for destination.
1620		 *       |             ret = B - scope (-1 <= scope >= d <= 15).
1621		 * d-C-1 | /
1622		 *       |/         <- greater is better
1623		 *   -C  /             if scope is not enough for destination.
1624		 *      /|             ret = scope - C (-1 <= d < scope <= 15).
1625		 *
1626		 * d - C - 1 < B -15 (for all -1 <= d <= 15).
1627		 * C > d + 14 - B >= 15 + 14 - B = 29 - B.
1628		 * Assume B = 0 and we get C > 29.
1629		 */
1630		ret = __ipv6_addr_src_scope(score->addr_type);
1631		if (ret >= dst->scope)
1632			ret = -ret;
1633		else
1634			ret -= 128;	/* 30 is enough */
1635		score->scopedist = ret;
1636		break;
1637	case IPV6_SADDR_RULE_PREFERRED:
1638	    {
1639		/* Rule 3: Avoid deprecated and optimistic addresses */
1640		u8 avoid = IFA_F_DEPRECATED;
1641
1642		if (!ipv6_use_optimistic_addr(net, score->ifa->idev))
1643			avoid |= IFA_F_OPTIMISTIC;
1644		ret = ipv6_saddr_preferred(score->addr_type) ||
1645		      !(score->ifa->flags & avoid);
1646		break;
1647	    }
1648#ifdef CONFIG_IPV6_MIP6
1649	case IPV6_SADDR_RULE_HOA:
1650	    {
1651		/* Rule 4: Prefer home address */
1652		int prefhome = !(dst->prefs & IPV6_PREFER_SRC_COA);
1653		ret = !(score->ifa->flags & IFA_F_HOMEADDRESS) ^ prefhome;
1654		break;
1655	    }
1656#endif
1657	case IPV6_SADDR_RULE_OIF:
1658		/* Rule 5: Prefer outgoing interface */
1659		ret = (!dst->ifindex ||
1660		       dst->ifindex == score->ifa->idev->dev->ifindex);
1661		break;
1662	case IPV6_SADDR_RULE_LABEL:
1663		/* Rule 6: Prefer matching label */
1664		ret = ipv6_addr_label(net,
1665				      &score->ifa->addr, score->addr_type,
1666				      score->ifa->idev->dev->ifindex) == dst->label;
1667		break;
1668	case IPV6_SADDR_RULE_PRIVACY:
1669	    {
1670		/* Rule 7: Prefer public address
1671		 * Note: prefer temporary address if use_tempaddr >= 2
1672		 */
1673		int preftmp = dst->prefs & (IPV6_PREFER_SRC_PUBLIC|IPV6_PREFER_SRC_TMP) ?
1674				!!(dst->prefs & IPV6_PREFER_SRC_TMP) :
1675				READ_ONCE(score->ifa->idev->cnf.use_tempaddr) >= 2;
1676		ret = (!(score->ifa->flags & IFA_F_TEMPORARY)) ^ preftmp;
1677		break;
1678	    }
1679	case IPV6_SADDR_RULE_ORCHID:
1680		/* Rule 8-: Prefer ORCHID vs ORCHID or
1681		 *	    non-ORCHID vs non-ORCHID
1682		 */
1683		ret = !(ipv6_addr_orchid(&score->ifa->addr) ^
1684			ipv6_addr_orchid(dst->addr));
1685		break;
1686	case IPV6_SADDR_RULE_PREFIX:
1687		/* Rule 8: Use longest matching prefix */
1688		ret = ipv6_addr_diff(&score->ifa->addr, dst->addr);
1689		if (ret > score->ifa->prefix_len)
1690			ret = score->ifa->prefix_len;
1691		score->matchlen = ret;
1692		break;
1693#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1694	case IPV6_SADDR_RULE_NOT_OPTIMISTIC:
1695		/* Optimistic addresses still have lower precedence than other
1696		 * preferred addresses.
1697		 */
1698		ret = !(score->ifa->flags & IFA_F_OPTIMISTIC);
1699		break;
1700#endif
1701	default:
1702		ret = 0;
1703	}
1704
1705	if (ret)
1706		__set_bit(i, score->scorebits);
1707	score->rule = i;
1708out:
1709	return ret;
1710}
1711
1712static int __ipv6_dev_get_saddr(struct net *net,
1713				struct ipv6_saddr_dst *dst,
1714				struct inet6_dev *idev,
1715				struct ipv6_saddr_score *scores,
1716				int hiscore_idx)
1717{
1718	struct ipv6_saddr_score *score = &scores[1 - hiscore_idx], *hiscore = &scores[hiscore_idx];
1719
1720	list_for_each_entry_rcu(score->ifa, &idev->addr_list, if_list) {
1721		int i;
1722
1723		/*
1724		 * - Tentative Address (RFC2462 section 5.4)
1725		 *  - A tentative address is not considered
1726		 *    "assigned to an interface" in the traditional
1727		 *    sense, unless it is also flagged as optimistic.
1728		 * - Candidate Source Address (section 4)
1729		 *  - In any case, anycast addresses, multicast
1730		 *    addresses, and the unspecified address MUST
1731		 *    NOT be included in a candidate set.
1732		 */
1733		if ((score->ifa->flags & IFA_F_TENTATIVE) &&
1734		    (!(score->ifa->flags & IFA_F_OPTIMISTIC)))
1735			continue;
1736
1737		score->addr_type = __ipv6_addr_type(&score->ifa->addr);
1738
1739		if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
1740			     score->addr_type & IPV6_ADDR_MULTICAST)) {
1741			net_dbg_ratelimited("ADDRCONF: unspecified / multicast address assigned as unicast address on %s",
1742					    idev->dev->name);
1743			continue;
1744		}
1745
1746		score->rule = -1;
1747		bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
1748
1749		for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
1750			int minihiscore, miniscore;
1751
1752			minihiscore = ipv6_get_saddr_eval(net, hiscore, dst, i);
1753			miniscore = ipv6_get_saddr_eval(net, score, dst, i);
1754
1755			if (minihiscore > miniscore) {
1756				if (i == IPV6_SADDR_RULE_SCOPE &&
1757				    score->scopedist > 0) {
1758					/*
1759					 * special case:
1760					 * each remaining entry
1761					 * has too small (not enough)
1762					 * scope, because ifa entries
1763					 * are sorted by their scope
1764					 * values.
1765					 */
1766					goto out;
1767				}
1768				break;
1769			} else if (minihiscore < miniscore) {
1770				swap(hiscore, score);
1771				hiscore_idx = 1 - hiscore_idx;
1772
1773				/* restore our iterator */
1774				score->ifa = hiscore->ifa;
1775
1776				break;
1777			}
1778		}
1779	}
1780out:
1781	return hiscore_idx;
1782}
1783
1784static int ipv6_get_saddr_master(struct net *net,
1785				 const struct net_device *dst_dev,
1786				 const struct net_device *master,
1787				 struct ipv6_saddr_dst *dst,
1788				 struct ipv6_saddr_score *scores,
1789				 int hiscore_idx)
1790{
1791	struct inet6_dev *idev;
1792
1793	idev = __in6_dev_get(dst_dev);
1794	if (idev)
1795		hiscore_idx = __ipv6_dev_get_saddr(net, dst, idev,
1796						   scores, hiscore_idx);
1797
1798	idev = __in6_dev_get(master);
1799	if (idev)
1800		hiscore_idx = __ipv6_dev_get_saddr(net, dst, idev,
1801						   scores, hiscore_idx);
1802
1803	return hiscore_idx;
1804}
1805
1806int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
1807		       const struct in6_addr *daddr, unsigned int prefs,
1808		       struct in6_addr *saddr)
1809{
1810	struct ipv6_saddr_score scores[2], *hiscore;
1811	struct ipv6_saddr_dst dst;
1812	struct inet6_dev *idev;
1813	struct net_device *dev;
1814	int dst_type;
1815	bool use_oif_addr = false;
1816	int hiscore_idx = 0;
1817	int ret = 0;
1818
1819	dst_type = __ipv6_addr_type(daddr);
1820	dst.addr = daddr;
1821	dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
1822	dst.scope = __ipv6_addr_src_scope(dst_type);
1823	dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);
1824	dst.prefs = prefs;
1825
1826	scores[hiscore_idx].rule = -1;
1827	scores[hiscore_idx].ifa = NULL;
1828
1829	rcu_read_lock();
1830
1831	/* Candidate Source Address (section 4)
1832	 *  - multicast and link-local destination address,
1833	 *    the set of candidate source address MUST only
1834	 *    include addresses assigned to interfaces
1835	 *    belonging to the same link as the outgoing
1836	 *    interface.
1837	 * (- For site-local destination addresses, the
1838	 *    set of candidate source addresses MUST only
1839	 *    include addresses assigned to interfaces
1840	 *    belonging to the same site as the outgoing
1841	 *    interface.)
1842	 *  - "It is RECOMMENDED that the candidate source addresses
1843	 *    be the set of unicast addresses assigned to the
1844	 *    interface that will be used to send to the destination
1845	 *    (the 'outgoing' interface)." (RFC 6724)
1846	 */
1847	if (dst_dev) {
1848		idev = __in6_dev_get(dst_dev);
1849		if ((dst_type & IPV6_ADDR_MULTICAST) ||
1850		    dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL ||
1851		    (idev && READ_ONCE(idev->cnf.use_oif_addrs_only))) {
1852			use_oif_addr = true;
1853		}
1854	}
1855
1856	if (use_oif_addr) {
1857		if (idev)
1858			hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
1859	} else {
1860		const struct net_device *master;
1861		int master_idx = 0;
1862
1863		/* if dst_dev exists and is enslaved to an L3 device, then
1864		 * prefer addresses from dst_dev and then the master over
1865		 * any other enslaved devices in the L3 domain.
1866		 */
1867		master = l3mdev_master_dev_rcu(dst_dev);
1868		if (master) {
1869			master_idx = master->ifindex;
1870
1871			hiscore_idx = ipv6_get_saddr_master(net, dst_dev,
1872							    master, &dst,
1873							    scores, hiscore_idx);
1874
1875			if (scores[hiscore_idx].ifa)
1876				goto out;
1877		}
1878
1879		for_each_netdev_rcu(net, dev) {
1880			/* only consider addresses on devices in the
1881			 * same L3 domain
1882			 */
1883			if (l3mdev_master_ifindex_rcu(dev) != master_idx)
1884				continue;
1885			idev = __in6_dev_get(dev);
1886			if (!idev)
1887				continue;
1888			hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
1889		}
1890	}
1891
1892out:
1893	hiscore = &scores[hiscore_idx];
1894	if (!hiscore->ifa)
1895		ret = -EADDRNOTAVAIL;
1896	else
1897		*saddr = hiscore->ifa->addr;
1898
1899	rcu_read_unlock();
1900	return ret;
1901}
1902EXPORT_SYMBOL(ipv6_dev_get_saddr);
1903
1904static int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
1905			      u32 banned_flags)
1906{
1907	struct inet6_ifaddr *ifp;
1908	int err = -EADDRNOTAVAIL;
1909
1910	list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
1911		if (ifp->scope > IFA_LINK)
1912			break;
1913		if (ifp->scope == IFA_LINK &&
1914		    !(ifp->flags & banned_flags)) {
1915			*addr = ifp->addr;
1916			err = 0;
1917			break;
1918		}
1919	}
1920	return err;
1921}
1922
1923int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
1924		    u32 banned_flags)
1925{
1926	struct inet6_dev *idev;
1927	int err = -EADDRNOTAVAIL;
1928
1929	rcu_read_lock();
1930	idev = __in6_dev_get(dev);
1931	if (idev) {
1932		read_lock_bh(&idev->lock);
1933		err = __ipv6_get_lladdr(idev, addr, banned_flags);
1934		read_unlock_bh(&idev->lock);
1935	}
1936	rcu_read_unlock();
1937	return err;
1938}
1939
1940static int ipv6_count_addresses(const struct inet6_dev *idev)
1941{
1942	const struct inet6_ifaddr *ifp;
1943	int cnt = 0;
1944
1945	rcu_read_lock();
1946	list_for_each_entry_rcu(ifp, &idev->addr_list, if_list)
1947		cnt++;
1948	rcu_read_unlock();
1949	return cnt;
1950}
1951
1952int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
1953		  const struct net_device *dev, int strict)
1954{
1955	return ipv6_chk_addr_and_flags(net, addr, dev, !dev,
1956				       strict, IFA_F_TENTATIVE);
1957}
1958EXPORT_SYMBOL(ipv6_chk_addr);
1959
1960/* device argument is used to find the L3 domain of interest. If
1961 * skip_dev_check is set, then the ifp device is not checked against
1962 * the passed in dev argument. So the 2 cases for addresses checks are:
1963 *   1. does the address exist in the L3 domain that dev is part of
1964 *      (skip_dev_check = true), or
1965 *
1966 *   2. does the address exist on the specific device
1967 *      (skip_dev_check = false)
1968 */
1969static struct net_device *
1970__ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
1971			  const struct net_device *dev, bool skip_dev_check,
1972			  int strict, u32 banned_flags)
1973{
1974	unsigned int hash = inet6_addr_hash(net, addr);
1975	struct net_device *l3mdev, *ndev;
1976	struct inet6_ifaddr *ifp;
1977	u32 ifp_flags;
1978
1979	rcu_read_lock();
1980
1981	l3mdev = l3mdev_master_dev_rcu(dev);
1982	if (skip_dev_check)
1983		dev = NULL;
1984
1985	hlist_for_each_entry_rcu(ifp, &net->ipv6.inet6_addr_lst[hash], addr_lst) {
1986		ndev = ifp->idev->dev;
1987
1988		if (l3mdev_master_dev_rcu(ndev) != l3mdev)
1989			continue;
1990
1991		/* Decouple optimistic from tentative for evaluation here.
1992		 * Ban optimistic addresses explicitly, when required.
1993		 */
1994		ifp_flags = (ifp->flags&IFA_F_OPTIMISTIC)
1995			    ? (ifp->flags&~IFA_F_TENTATIVE)
1996			    : ifp->flags;
1997		if (ipv6_addr_equal(&ifp->addr, addr) &&
1998		    !(ifp_flags&banned_flags) &&
1999		    (!dev || ndev == dev ||
2000		     !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
2001			rcu_read_unlock();
2002			return ndev;
2003		}
2004	}
2005
2006	rcu_read_unlock();
2007	return NULL;
2008}
2009
2010int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
2011			    const struct net_device *dev, bool skip_dev_check,
2012			    int strict, u32 banned_flags)
2013{
2014	return __ipv6_chk_addr_and_flags(net, addr, dev, skip_dev_check,
2015					 strict, banned_flags) ? 1 : 0;
2016}
2017EXPORT_SYMBOL(ipv6_chk_addr_and_flags);
2018
2019
2020/* Compares an address/prefix_len with addresses on device @dev.
2021 * If one is found it returns true.
2022 */
2023bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
2024	const unsigned int prefix_len, struct net_device *dev)
2025{
2026	const struct inet6_ifaddr *ifa;
2027	const struct inet6_dev *idev;
2028	bool ret = false;
2029
2030	rcu_read_lock();
2031	idev = __in6_dev_get(dev);
2032	if (idev) {
2033		list_for_each_entry_rcu(ifa, &idev->addr_list, if_list) {
2034			ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
2035			if (ret)
2036				break;
2037		}
2038	}
2039	rcu_read_unlock();
2040
2041	return ret;
2042}
2043EXPORT_SYMBOL(ipv6_chk_custom_prefix);
2044
2045int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
2046{
2047	const struct inet6_ifaddr *ifa;
2048	const struct inet6_dev *idev;
2049	int	onlink;
2050
2051	onlink = 0;
2052	rcu_read_lock();
2053	idev = __in6_dev_get(dev);
2054	if (idev) {
2055		list_for_each_entry_rcu(ifa, &idev->addr_list, if_list) {
2056			onlink = ipv6_prefix_equal(addr, &ifa->addr,
2057						   ifa->prefix_len);
2058			if (onlink)
2059				break;
2060		}
2061	}
2062	rcu_read_unlock();
2063	return onlink;
2064}
2065EXPORT_SYMBOL(ipv6_chk_prefix);
2066
2067/**
2068 * ipv6_dev_find - find the first device with a given source address.
2069 * @net: the net namespace
2070 * @addr: the source address
2071 * @dev: used to find the L3 domain of interest
2072 *
2073 * The caller should be protected by RCU, or RTNL.
2074 */
2075struct net_device *ipv6_dev_find(struct net *net, const struct in6_addr *addr,
2076				 struct net_device *dev)
2077{
2078	return __ipv6_chk_addr_and_flags(net, addr, dev, !dev, 1,
2079					 IFA_F_TENTATIVE);
2080}
2081EXPORT_SYMBOL(ipv6_dev_find);
2082
2083struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,
2084				     struct net_device *dev, int strict)
2085{
2086	unsigned int hash = inet6_addr_hash(net, addr);
2087	struct inet6_ifaddr *ifp, *result = NULL;
2088
2089	rcu_read_lock();
2090	hlist_for_each_entry_rcu(ifp, &net->ipv6.inet6_addr_lst[hash], addr_lst) {
2091		if (ipv6_addr_equal(&ifp->addr, addr)) {
2092			if (!dev || ifp->idev->dev == dev ||
2093			    !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {
2094				if (in6_ifa_hold_safe(ifp)) {
2095					result = ifp;
2096					break;
2097				}
2098			}
2099		}
2100	}
2101	rcu_read_unlock();
2102
2103	return result;
2104}
2105
2106/* Gets referenced address, destroys ifaddr */
2107
2108static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
2109{
2110	if (dad_failed)
2111		ifp->flags |= IFA_F_DADFAILED;
2112
2113	if (ifp->flags&IFA_F_TEMPORARY) {
2114		struct inet6_ifaddr *ifpub;
2115		spin_lock_bh(&ifp->lock);
2116		ifpub = ifp->ifpub;
2117		if (ifpub) {
2118			in6_ifa_hold(ifpub);
2119			spin_unlock_bh(&ifp->lock);
2120			ipv6_create_tempaddr(ifpub, true);
2121			in6_ifa_put(ifpub);
2122		} else {
2123			spin_unlock_bh(&ifp->lock);
2124		}
2125		ipv6_del_addr(ifp);
2126	} else if (ifp->flags&IFA_F_PERMANENT || !dad_failed) {
2127		spin_lock_bh(&ifp->lock);
2128		addrconf_del_dad_work(ifp);
2129		ifp->flags |= IFA_F_TENTATIVE;
2130		if (dad_failed)
2131			ifp->flags &= ~IFA_F_OPTIMISTIC;
2132		spin_unlock_bh(&ifp->lock);
2133		if (dad_failed)
2134			ipv6_ifa_notify(0, ifp);
2135		in6_ifa_put(ifp);
2136	} else {
2137		ipv6_del_addr(ifp);
2138	}
2139}
2140
2141static int addrconf_dad_end(struct inet6_ifaddr *ifp)
2142{
2143	int err = -ENOENT;
2144
2145	spin_lock_bh(&ifp->lock);
2146	if (ifp->state == INET6_IFADDR_STATE_DAD) {
2147		ifp->state = INET6_IFADDR_STATE_POSTDAD;
2148		err = 0;
2149	}
2150	spin_unlock_bh(&ifp->lock);
2151
2152	return err;
2153}
2154
2155void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
2156{
2157	struct inet6_dev *idev = ifp->idev;
2158	struct net *net = dev_net(idev->dev);
2159	int max_addresses;
2160
2161	if (addrconf_dad_end(ifp)) {
2162		in6_ifa_put(ifp);
2163		return;
2164	}
2165
2166	net_info_ratelimited("%s: IPv6 duplicate address %pI6c used by %pM detected!\n",
2167			     ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source);
2168
2169	spin_lock_bh(&ifp->lock);
2170
2171	if (ifp->flags & IFA_F_STABLE_PRIVACY) {
2172		struct in6_addr new_addr;
2173		struct inet6_ifaddr *ifp2;
2174		int retries = ifp->stable_privacy_retry + 1;
2175		struct ifa6_config cfg = {
2176			.pfx = &new_addr,
2177			.plen = ifp->prefix_len,
2178			.ifa_flags = ifp->flags,
2179			.valid_lft = ifp->valid_lft,
2180			.preferred_lft = ifp->prefered_lft,
2181			.scope = ifp->scope,
2182		};
2183
2184		if (retries > net->ipv6.sysctl.idgen_retries) {
2185			net_info_ratelimited("%s: privacy stable address generation failed because of DAD conflicts!\n",
2186					     ifp->idev->dev->name);
2187			goto errdad;
2188		}
2189
2190		new_addr = ifp->addr;
2191		if (ipv6_generate_stable_address(&new_addr, retries,
2192						 idev))
2193			goto errdad;
2194
2195		spin_unlock_bh(&ifp->lock);
2196
2197		max_addresses = READ_ONCE(idev->cnf.max_addresses);
2198		if (max_addresses &&
2199		    ipv6_count_addresses(idev) >= max_addresses)
2200			goto lock_errdad;
2201
2202		net_info_ratelimited("%s: generating new stable privacy address because of DAD conflict\n",
2203				     ifp->idev->dev->name);
2204
2205		ifp2 = ipv6_add_addr(idev, &cfg, false, NULL);
2206		if (IS_ERR(ifp2))
2207			goto lock_errdad;
2208
2209		spin_lock_bh(&ifp2->lock);
2210		ifp2->stable_privacy_retry = retries;
2211		ifp2->state = INET6_IFADDR_STATE_PREDAD;
2212		spin_unlock_bh(&ifp2->lock);
2213
2214		addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
2215		in6_ifa_put(ifp2);
2216lock_errdad:
2217		spin_lock_bh(&ifp->lock);
2218	}
2219
2220errdad:
2221	/* transition from _POSTDAD to _ERRDAD */
2222	ifp->state = INET6_IFADDR_STATE_ERRDAD;
2223	spin_unlock_bh(&ifp->lock);
2224
2225	addrconf_mod_dad_work(ifp, 0);
2226	in6_ifa_put(ifp);
2227}
2228
2229/* Join to solicited addr multicast group.
2230 * caller must hold RTNL */
2231void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
2232{
2233	struct in6_addr maddr;
2234
2235	if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
2236		return;
2237
2238	addrconf_addr_solict_mult(addr, &maddr);
2239	ipv6_dev_mc_inc(dev, &maddr);
2240}
2241
2242/* caller must hold RTNL */
2243void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
2244{
2245	struct in6_addr maddr;
2246
2247	if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
2248		return;
2249
2250	addrconf_addr_solict_mult(addr, &maddr);
2251	__ipv6_dev_mc_dec(idev, &maddr);
2252}
2253
2254/* caller must hold RTNL */
2255static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
2256{
2257	struct in6_addr addr;
2258
2259	if (ifp->prefix_len >= 127) /* RFC 6164 */
2260		return;
2261	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
2262	if (ipv6_addr_any(&addr))
2263		return;
2264	__ipv6_dev_ac_inc(ifp->idev, &addr);
2265}
2266
2267/* caller must hold RTNL */
2268static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
2269{
2270	struct in6_addr addr;
2271
2272	if (ifp->prefix_len >= 127) /* RFC 6164 */
2273		return;
2274	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
2275	if (ipv6_addr_any(&addr))
2276		return;
2277	__ipv6_dev_ac_dec(ifp->idev, &addr);
2278}
2279
2280static int addrconf_ifid_6lowpan(u8 *eui, struct net_device *dev)
2281{
2282	switch (dev->addr_len) {
2283	case ETH_ALEN:
2284		memcpy(eui, dev->dev_addr, 3);
2285		eui[3] = 0xFF;
2286		eui[4] = 0xFE;
2287		memcpy(eui + 5, dev->dev_addr + 3, 3);
2288		break;
2289	case EUI64_ADDR_LEN:
2290		memcpy(eui, dev->dev_addr, EUI64_ADDR_LEN);
2291		eui[0] ^= 2;
2292		break;
2293	default:
2294		return -1;
2295	}
2296
2297	return 0;
2298}
2299
2300static int addrconf_ifid_ieee1394(u8 *eui, struct net_device *dev)
2301{
2302	const union fwnet_hwaddr *ha;
2303
2304	if (dev->addr_len != FWNET_ALEN)
2305		return -1;
2306
2307	ha = (const union fwnet_hwaddr *)dev->dev_addr;
2308
2309	memcpy(eui, &ha->uc.uniq_id, sizeof(ha->uc.uniq_id));
2310	eui[0] ^= 2;
2311	return 0;
2312}
2313
2314static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
2315{
2316	/* XXX: inherit EUI-64 from other interface -- yoshfuji */
2317	if (dev->addr_len != ARCNET_ALEN)
2318		return -1;
2319	memset(eui, 0, 7);
2320	eui[7] = *(u8 *)dev->dev_addr;
2321	return 0;
2322}
2323
2324static int addrconf_ifid_infiniband(u8 *eui, struct net_device *dev)
2325{
2326	if (dev->addr_len != INFINIBAND_ALEN)
2327		return -1;
2328	memcpy(eui, dev->dev_addr + 12, 8);
2329	eui[0] |= 2;
2330	return 0;
2331}
2332
2333static int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
2334{
2335	if (addr == 0)
2336		return -1;
2337	eui[0] = (ipv4_is_zeronet(addr) || ipv4_is_private_10(addr) ||
2338		  ipv4_is_loopback(addr) || ipv4_is_linklocal_169(addr) ||
2339		  ipv4_is_private_172(addr) || ipv4_is_test_192(addr) ||
2340		  ipv4_is_anycast_6to4(addr) || ipv4_is_private_192(addr) ||
2341		  ipv4_is_test_198(addr) || ipv4_is_multicast(addr) ||
2342		  ipv4_is_lbcast(addr)) ? 0x00 : 0x02;
2343	eui[1] = 0;
2344	eui[2] = 0x5E;
2345	eui[3] = 0xFE;
2346	memcpy(eui + 4, &addr, 4);
2347	return 0;
2348}
2349
2350static int addrconf_ifid_sit(u8 *eui, struct net_device *dev)
2351{
2352	if (dev->priv_flags & IFF_ISATAP)
2353		return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
2354	return -1;
2355}
2356
2357static int addrconf_ifid_gre(u8 *eui, struct net_device *dev)
2358{
2359	return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
2360}
2361
2362static int addrconf_ifid_ip6tnl(u8 *eui, struct net_device *dev)
2363{
2364	memcpy(eui, dev->perm_addr, 3);
2365	memcpy(eui + 5, dev->perm_addr + 3, 3);
2366	eui[3] = 0xFF;
2367	eui[4] = 0xFE;
2368	eui[0] ^= 2;
2369	return 0;
2370}
2371
2372static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
2373{
2374	switch (dev->type) {
2375	case ARPHRD_ETHER:
2376	case ARPHRD_FDDI:
2377		return addrconf_ifid_eui48(eui, dev);
2378	case ARPHRD_ARCNET:
2379		return addrconf_ifid_arcnet(eui, dev);
2380	case ARPHRD_INFINIBAND:
2381		return addrconf_ifid_infiniband(eui, dev);
2382	case ARPHRD_SIT:
2383		return addrconf_ifid_sit(eui, dev);
2384	case ARPHRD_IPGRE:
2385	case ARPHRD_TUNNEL:
2386		return addrconf_ifid_gre(eui, dev);
2387	case ARPHRD_6LOWPAN:
2388		return addrconf_ifid_6lowpan(eui, dev);
2389	case ARPHRD_IEEE1394:
2390		return addrconf_ifid_ieee1394(eui, dev);
2391	case ARPHRD_TUNNEL6:
2392	case ARPHRD_IP6GRE:
2393	case ARPHRD_RAWIP:
2394		return addrconf_ifid_ip6tnl(eui, dev);
2395	}
2396	return -1;
2397}
2398
2399static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
2400{
2401	int err = -1;
2402	struct inet6_ifaddr *ifp;
2403
2404	read_lock_bh(&idev->lock);
2405	list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
2406		if (ifp->scope > IFA_LINK)
2407			break;
2408		if (ifp->scope == IFA_LINK && !(ifp->flags&IFA_F_TENTATIVE)) {
2409			memcpy(eui, ifp->addr.s6_addr+8, 8);
2410			err = 0;
2411			break;
2412		}
2413	}
2414	read_unlock_bh(&idev->lock);
2415	return err;
2416}
2417
2418/* Generation of a randomized Interface Identifier
2419 * draft-ietf-6man-rfc4941bis, Section 3.3.1
2420 */
2421
2422static void ipv6_gen_rnd_iid(struct in6_addr *addr)
2423{
2424regen:
2425	get_random_bytes(&addr->s6_addr[8], 8);
2426
2427	/* <draft-ietf-6man-rfc4941bis-08.txt>, Section 3.3.1:
2428	 * check if generated address is not inappropriate:
2429	 *
2430	 * - Reserved IPv6 Interface Identifiers
2431	 * - XXX: already assigned to an address on the device
2432	 */
2433
2434	/* Subnet-router anycast: 0000:0000:0000:0000 */
2435	if (!(addr->s6_addr32[2] | addr->s6_addr32[3]))
2436		goto regen;
2437
2438	/* IANA Ethernet block: 0200:5EFF:FE00:0000-0200:5EFF:FE00:5212
2439	 * Proxy Mobile IPv6:   0200:5EFF:FE00:5213
2440	 * IANA Ethernet block: 0200:5EFF:FE00:5214-0200:5EFF:FEFF:FFFF
2441	 */
2442	if (ntohl(addr->s6_addr32[2]) == 0x02005eff &&
2443	    (ntohl(addr->s6_addr32[3]) & 0Xff000000) == 0xfe000000)
2444		goto regen;
2445
2446	/* Reserved subnet anycast addresses */
2447	if (ntohl(addr->s6_addr32[2]) == 0xfdffffff &&
2448	    ntohl(addr->s6_addr32[3]) >= 0Xffffff80)
2449		goto regen;
2450}
2451
2452/*
2453 *	Add prefix route.
2454 */
2455
2456static void
2457addrconf_prefix_route(struct in6_addr *pfx, int plen, u32 metric,
2458		      struct net_device *dev, unsigned long expires,
2459		      u32 flags, gfp_t gfp_flags)
2460{
2461	struct fib6_config cfg = {
2462		.fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_PREFIX,
2463		.fc_metric = metric ? : IP6_RT_PRIO_ADDRCONF,
2464		.fc_ifindex = dev->ifindex,
2465		.fc_expires = expires,
2466		.fc_dst_len = plen,
2467		.fc_flags = RTF_UP | flags,
2468		.fc_nlinfo.nl_net = dev_net(dev),
2469		.fc_protocol = RTPROT_KERNEL,
2470		.fc_type = RTN_UNICAST,
2471	};
2472
2473	cfg.fc_dst = *pfx;
2474
2475	/* Prevent useless cloning on PtP SIT.
2476	   This thing is done here expecting that the whole
2477	   class of non-broadcast devices need not cloning.
2478	 */
2479#if IS_ENABLED(CONFIG_IPV6_SIT)
2480	if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
2481		cfg.fc_flags |= RTF_NONEXTHOP;
2482#endif
2483
2484	ip6_route_add(&cfg, gfp_flags, NULL);
2485}
2486
2487
2488static struct fib6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
2489						  int plen,
2490						  const struct net_device *dev,
2491						  u32 flags, u32 noflags,
2492						  bool no_gw)
2493{
2494	struct fib6_node *fn;
2495	struct fib6_info *rt = NULL;
2496	struct fib6_table *table;
2497	u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_PREFIX;
2498
2499	table = fib6_get_table(dev_net(dev), tb_id);
2500	if (!table)
2501		return NULL;
2502
2503	rcu_read_lock();
2504	fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0, true);
2505	if (!fn)
2506		goto out;
2507
2508	for_each_fib6_node_rt_rcu(fn) {
2509		/* prefix routes only use builtin fib6_nh */
2510		if (rt->nh)
2511			continue;
2512
2513		if (rt->fib6_nh->fib_nh_dev->ifindex != dev->ifindex)
2514			continue;
2515		if (no_gw && rt->fib6_nh->fib_nh_gw_family)
2516			continue;
2517		if ((rt->fib6_flags & flags) != flags)
2518			continue;
2519		if ((rt->fib6_flags & noflags) != 0)
2520			continue;
2521		if (!fib6_info_hold_safe(rt))
2522			continue;
2523		break;
2524	}
2525out:
2526	rcu_read_unlock();
2527	return rt;
2528}
2529
2530
2531/* Create "default" multicast route to the interface */
2532
2533static void addrconf_add_mroute(struct net_device *dev)
2534{
2535	struct fib6_config cfg = {
2536		.fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_LOCAL,
2537		.fc_metric = IP6_RT_PRIO_ADDRCONF,
2538		.fc_ifindex = dev->ifindex,
2539		.fc_dst_len = 8,
2540		.fc_flags = RTF_UP,
2541		.fc_type = RTN_MULTICAST,
2542		.fc_nlinfo.nl_net = dev_net(dev),
2543		.fc_protocol = RTPROT_KERNEL,
2544	};
2545
2546	ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
2547
2548	ip6_route_add(&cfg, GFP_KERNEL, NULL);
2549}
2550
2551static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
2552{
2553	struct inet6_dev *idev;
2554
2555	ASSERT_RTNL();
2556
2557	idev = ipv6_find_idev(dev);
2558	if (IS_ERR(idev))
2559		return idev;
2560
2561	if (idev->cnf.disable_ipv6)
2562		return ERR_PTR(-EACCES);
2563
2564	/* Add default multicast route */
2565	if (!(dev->flags & IFF_LOOPBACK) && !netif_is_l3_master(dev))
2566		addrconf_add_mroute(dev);
2567
2568	return idev;
2569}
2570
2571static void manage_tempaddrs(struct inet6_dev *idev,
2572			     struct inet6_ifaddr *ifp,
2573			     __u32 valid_lft, __u32 prefered_lft,
2574			     bool create, unsigned long now)
2575{
2576	u32 flags;
2577	struct inet6_ifaddr *ift;
2578
2579	read_lock_bh(&idev->lock);
2580	/* update all temporary addresses in the list */
2581	list_for_each_entry(ift, &idev->tempaddr_list, tmp_list) {
2582		int age, max_valid, max_prefered;
2583
2584		if (ifp != ift->ifpub)
2585			continue;
2586
2587		/* RFC 4941 section 3.3:
2588		 * If a received option will extend the lifetime of a public
2589		 * address, the lifetimes of temporary addresses should
2590		 * be extended, subject to the overall constraint that no
2591		 * temporary addresses should ever remain "valid" or "preferred"
2592		 * for a time longer than (TEMP_VALID_LIFETIME) or
2593		 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR), respectively.
2594		 */
2595		age = (now - ift->cstamp) / HZ;
2596		max_valid = READ_ONCE(idev->cnf.temp_valid_lft) - age;
2597		if (max_valid < 0)
2598			max_valid = 0;
2599
2600		max_prefered = READ_ONCE(idev->cnf.temp_prefered_lft) -
2601			       idev->desync_factor - age;
2602		if (max_prefered < 0)
2603			max_prefered = 0;
2604
2605		if (valid_lft > max_valid)
2606			valid_lft = max_valid;
2607
2608		if (prefered_lft > max_prefered)
2609			prefered_lft = max_prefered;
2610
2611		spin_lock(&ift->lock);
2612		flags = ift->flags;
2613		ift->valid_lft = valid_lft;
2614		ift->prefered_lft = prefered_lft;
2615		ift->tstamp = now;
2616		if (prefered_lft > 0)
2617			ift->flags &= ~IFA_F_DEPRECATED;
2618
2619		spin_unlock(&ift->lock);
2620		if (!(flags&IFA_F_TENTATIVE))
2621			ipv6_ifa_notify(0, ift);
2622	}
2623
2624	/* Also create a temporary address if it's enabled but no temporary
2625	 * address currently exists.
2626	 * However, we get called with valid_lft == 0, prefered_lft == 0, create == false
2627	 * as part of cleanup (ie. deleting the mngtmpaddr).
2628	 * We don't want that to result in creating a new temporary ip address.
2629	 */
2630	if (list_empty(&idev->tempaddr_list) && (valid_lft || prefered_lft))
2631		create = true;
2632
2633	if (create && READ_ONCE(idev->cnf.use_tempaddr) > 0) {
2634		/* When a new public address is created as described
2635		 * in [ADDRCONF], also create a new temporary address.
 
 
2636		 */
2637		read_unlock_bh(&idev->lock);
2638		ipv6_create_tempaddr(ifp, false);
2639	} else {
2640		read_unlock_bh(&idev->lock);
2641	}
2642}
2643
2644static bool is_addr_mode_generate_stable(struct inet6_dev *idev)
2645{
2646	return idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_STABLE_PRIVACY ||
2647	       idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_RANDOM;
2648}
2649
2650int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,
2651				 const struct prefix_info *pinfo,
2652				 struct inet6_dev *in6_dev,
2653				 const struct in6_addr *addr, int addr_type,
2654				 u32 addr_flags, bool sllao, bool tokenized,
2655				 __u32 valid_lft, u32 prefered_lft)
2656{
2657	struct inet6_ifaddr *ifp = ipv6_get_ifaddr(net, addr, dev, 1);
2658	int create = 0, update_lft = 0;
2659
2660	if (!ifp && valid_lft) {
2661		int max_addresses = READ_ONCE(in6_dev->cnf.max_addresses);
2662		struct ifa6_config cfg = {
2663			.pfx = addr,
2664			.plen = pinfo->prefix_len,
2665			.ifa_flags = addr_flags,
2666			.valid_lft = valid_lft,
2667			.preferred_lft = prefered_lft,
2668			.scope = addr_type & IPV6_ADDR_SCOPE_MASK,
2669			.ifa_proto = IFAPROT_KERNEL_RA
2670		};
2671
2672#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
2673		if ((READ_ONCE(net->ipv6.devconf_all->optimistic_dad) ||
2674		     READ_ONCE(in6_dev->cnf.optimistic_dad)) &&
2675		    !net->ipv6.devconf_all->forwarding && sllao)
2676			cfg.ifa_flags |= IFA_F_OPTIMISTIC;
2677#endif
2678
2679		/* Do not allow to create too much of autoconfigured
2680		 * addresses; this would be too easy way to crash kernel.
2681		 */
2682		if (!max_addresses ||
2683		    ipv6_count_addresses(in6_dev) < max_addresses)
2684			ifp = ipv6_add_addr(in6_dev, &cfg, false, NULL);
2685
2686		if (IS_ERR_OR_NULL(ifp))
2687			return -1;
2688
2689		create = 1;
2690		spin_lock_bh(&ifp->lock);
2691		ifp->flags |= IFA_F_MANAGETEMPADDR;
2692		ifp->cstamp = jiffies;
2693		ifp->tokenized = tokenized;
2694		spin_unlock_bh(&ifp->lock);
2695		addrconf_dad_start(ifp);
2696	}
2697
2698	if (ifp) {
2699		u32 flags;
2700		unsigned long now;
2701		u32 stored_lft;
2702
2703		/* update lifetime (RFC2462 5.5.3 e) */
2704		spin_lock_bh(&ifp->lock);
2705		now = jiffies;
2706		if (ifp->valid_lft > (now - ifp->tstamp) / HZ)
2707			stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
2708		else
2709			stored_lft = 0;
2710
2711		/* RFC4862 Section 5.5.3e:
2712		 * "Note that the preferred lifetime of the
2713		 *  corresponding address is always reset to
2714		 *  the Preferred Lifetime in the received
2715		 *  Prefix Information option, regardless of
2716		 *  whether the valid lifetime is also reset or
2717		 *  ignored."
2718		 *
2719		 * So we should always update prefered_lft here.
2720		 */
2721		update_lft = !create && stored_lft;
2722
2723		if (update_lft && !READ_ONCE(in6_dev->cnf.ra_honor_pio_life)) {
2724			const u32 minimum_lft = min_t(u32,
2725				stored_lft, MIN_VALID_LIFETIME);
2726			valid_lft = max(valid_lft, minimum_lft);
 
 
 
 
 
 
 
 
 
 
 
 
2727		}
2728
2729		if (update_lft) {
2730			ifp->valid_lft = valid_lft;
2731			ifp->prefered_lft = prefered_lft;
2732			WRITE_ONCE(ifp->tstamp, now);
2733			flags = ifp->flags;
2734			ifp->flags &= ~IFA_F_DEPRECATED;
2735			spin_unlock_bh(&ifp->lock);
2736
2737			if (!(flags&IFA_F_TENTATIVE))
2738				ipv6_ifa_notify(0, ifp);
2739		} else
2740			spin_unlock_bh(&ifp->lock);
2741
2742		manage_tempaddrs(in6_dev, ifp, valid_lft, prefered_lft,
2743				 create, now);
2744
2745		in6_ifa_put(ifp);
2746		addrconf_verify(net);
2747	}
2748
2749	return 0;
2750}
2751EXPORT_SYMBOL_GPL(addrconf_prefix_rcv_add_addr);
2752
2753void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
2754{
2755	struct prefix_info *pinfo;
2756	struct fib6_table *table;
2757	__u32 valid_lft;
2758	__u32 prefered_lft;
2759	int addr_type, err;
2760	u32 addr_flags = 0;
2761	struct inet6_dev *in6_dev;
2762	struct net *net = dev_net(dev);
2763
2764	pinfo = (struct prefix_info *) opt;
2765
2766	if (len < sizeof(struct prefix_info)) {
2767		netdev_dbg(dev, "addrconf: prefix option too short\n");
2768		return;
2769	}
2770
2771	/*
2772	 *	Validation checks ([ADDRCONF], page 19)
2773	 */
2774
2775	addr_type = ipv6_addr_type(&pinfo->prefix);
2776
2777	if (addr_type & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL))
2778		return;
2779
2780	valid_lft = ntohl(pinfo->valid);
2781	prefered_lft = ntohl(pinfo->prefered);
2782
2783	if (prefered_lft > valid_lft) {
2784		net_warn_ratelimited("addrconf: prefix option has invalid lifetime\n");
2785		return;
2786	}
2787
2788	in6_dev = in6_dev_get(dev);
2789
2790	if (!in6_dev) {
2791		net_dbg_ratelimited("addrconf: device %s not configured\n",
2792				    dev->name);
2793		return;
2794	}
2795
2796	if (valid_lft != 0 && valid_lft < in6_dev->cnf.accept_ra_min_lft)
2797		goto put;
2798
2799	/*
2800	 *	Two things going on here:
2801	 *	1) Add routes for on-link prefixes
2802	 *	2) Configure prefixes with the auto flag set
2803	 */
2804
2805	if (pinfo->onlink) {
2806		struct fib6_info *rt;
2807		unsigned long rt_expires;
2808
2809		/* Avoid arithmetic overflow. Really, we could
2810		 * save rt_expires in seconds, likely valid_lft,
2811		 * but it would require division in fib gc, that it
2812		 * not good.
2813		 */
2814		if (HZ > USER_HZ)
2815			rt_expires = addrconf_timeout_fixup(valid_lft, HZ);
2816		else
2817			rt_expires = addrconf_timeout_fixup(valid_lft, USER_HZ);
2818
2819		if (addrconf_finite_timeout(rt_expires))
2820			rt_expires *= HZ;
2821
2822		rt = addrconf_get_prefix_route(&pinfo->prefix,
2823					       pinfo->prefix_len,
2824					       dev,
2825					       RTF_ADDRCONF | RTF_PREFIX_RT,
2826					       RTF_DEFAULT, true);
2827
2828		if (rt) {
2829			/* Autoconf prefix route */
2830			if (valid_lft == 0) {
2831				ip6_del_rt(net, rt, false);
2832				rt = NULL;
 
 
 
2833			} else {
2834				table = rt->fib6_table;
2835				spin_lock_bh(&table->tb6_lock);
2836
2837				if (addrconf_finite_timeout(rt_expires)) {
2838					/* not infinity */
2839					fib6_set_expires(rt, jiffies + rt_expires);
2840					fib6_add_gc_list(rt);
2841				} else {
2842					fib6_clean_expires(rt);
2843					fib6_remove_gc_list(rt);
2844				}
2845
2846				spin_unlock_bh(&table->tb6_lock);
2847			}
2848		} else if (valid_lft) {
2849			clock_t expires = 0;
2850			int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
2851			if (addrconf_finite_timeout(rt_expires)) {
2852				/* not infinity */
2853				flags |= RTF_EXPIRES;
2854				expires = jiffies_to_clock_t(rt_expires);
2855			}
2856			addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
2857					      0, dev, expires, flags,
2858					      GFP_ATOMIC);
2859		}
2860		fib6_info_release(rt);
2861	}
2862
2863	/* Try to figure out our local address for this prefix */
2864
2865	if (pinfo->autoconf && in6_dev->cnf.autoconf) {
2866		struct in6_addr addr;
2867		bool tokenized = false, dev_addr_generated = false;
2868
2869		if (pinfo->prefix_len == 64) {
2870			memcpy(&addr, &pinfo->prefix, 8);
2871
2872			if (!ipv6_addr_any(&in6_dev->token)) {
2873				read_lock_bh(&in6_dev->lock);
2874				memcpy(addr.s6_addr + 8,
2875				       in6_dev->token.s6_addr + 8, 8);
2876				read_unlock_bh(&in6_dev->lock);
2877				tokenized = true;
2878			} else if (is_addr_mode_generate_stable(in6_dev) &&
2879				   !ipv6_generate_stable_address(&addr, 0,
2880								 in6_dev)) {
2881				addr_flags |= IFA_F_STABLE_PRIVACY;
2882				goto ok;
2883			} else if (ipv6_generate_eui64(addr.s6_addr + 8, dev) &&
2884				   ipv6_inherit_eui64(addr.s6_addr + 8, in6_dev)) {
2885				goto put;
2886			} else {
2887				dev_addr_generated = true;
2888			}
2889			goto ok;
2890		}
2891		net_dbg_ratelimited("IPv6 addrconf: prefix with wrong length %d\n",
2892				    pinfo->prefix_len);
2893		goto put;
2894
2895ok:
2896		err = addrconf_prefix_rcv_add_addr(net, dev, pinfo, in6_dev,
2897						   &addr, addr_type,
2898						   addr_flags, sllao,
2899						   tokenized, valid_lft,
2900						   prefered_lft);
2901		if (err)
2902			goto put;
2903
2904		/* Ignore error case here because previous prefix add addr was
2905		 * successful which will be notified.
2906		 */
2907		ndisc_ops_prefix_rcv_add_addr(net, dev, pinfo, in6_dev, &addr,
2908					      addr_type, addr_flags, sllao,
2909					      tokenized, valid_lft,
2910					      prefered_lft,
2911					      dev_addr_generated);
2912	}
2913	inet6_prefix_notify(RTM_NEWPREFIX, in6_dev, pinfo);
2914put:
2915	in6_dev_put(in6_dev);
2916}
2917
2918static int addrconf_set_sit_dstaddr(struct net *net, struct net_device *dev,
2919		struct in6_ifreq *ireq)
2920{
2921	struct ip_tunnel_parm p = { };
2922	int err;
2923
2924	if (!(ipv6_addr_type(&ireq->ifr6_addr) & IPV6_ADDR_COMPATv4))
2925		return -EADDRNOTAVAIL;
2926
2927	p.iph.daddr = ireq->ifr6_addr.s6_addr32[3];
2928	p.iph.version = 4;
2929	p.iph.ihl = 5;
2930	p.iph.protocol = IPPROTO_IPV6;
2931	p.iph.ttl = 64;
2932
2933	if (!dev->netdev_ops->ndo_tunnel_ctl)
2934		return -EOPNOTSUPP;
2935	err = dev->netdev_ops->ndo_tunnel_ctl(dev, &p, SIOCADDTUNNEL);
2936	if (err)
2937		return err;
2938
2939	dev = __dev_get_by_name(net, p.name);
2940	if (!dev)
2941		return -ENOBUFS;
2942	return dev_open(dev, NULL);
2943}
2944
2945/*
2946 *	Set destination address.
2947 *	Special case for SIT interfaces where we create a new "virtual"
2948 *	device.
2949 */
2950int addrconf_set_dstaddr(struct net *net, void __user *arg)
2951{
2952	struct net_device *dev;
2953	struct in6_ifreq ireq;
2954	int err = -ENODEV;
2955
2956	if (!IS_ENABLED(CONFIG_IPV6_SIT))
2957		return -ENODEV;
2958	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2959		return -EFAULT;
2960
2961	rtnl_lock();
2962	dev = __dev_get_by_index(net, ireq.ifr6_ifindex);
2963	if (dev && dev->type == ARPHRD_SIT)
2964		err = addrconf_set_sit_dstaddr(net, dev, &ireq);
2965	rtnl_unlock();
2966	return err;
2967}
2968
2969static int ipv6_mc_config(struct sock *sk, bool join,
2970			  const struct in6_addr *addr, int ifindex)
2971{
2972	int ret;
2973
2974	ASSERT_RTNL();
2975
2976	lock_sock(sk);
2977	if (join)
2978		ret = ipv6_sock_mc_join(sk, ifindex, addr);
2979	else
2980		ret = ipv6_sock_mc_drop(sk, ifindex, addr);
2981	release_sock(sk);
2982
2983	return ret;
2984}
2985
2986/*
2987 *	Manual configuration of address on an interface
2988 */
2989static int inet6_addr_add(struct net *net, int ifindex,
2990			  struct ifa6_config *cfg,
2991			  struct netlink_ext_ack *extack)
2992{
2993	struct inet6_ifaddr *ifp;
2994	struct inet6_dev *idev;
2995	struct net_device *dev;
2996	unsigned long timeout;
2997	clock_t expires;
2998	u32 flags;
2999
3000	ASSERT_RTNL();
3001
3002	if (cfg->plen > 128) {
3003		NL_SET_ERR_MSG_MOD(extack, "Invalid prefix length");
3004		return -EINVAL;
3005	}
3006
3007	/* check the lifetime */
3008	if (!cfg->valid_lft || cfg->preferred_lft > cfg->valid_lft) {
3009		NL_SET_ERR_MSG_MOD(extack, "address lifetime invalid");
3010		return -EINVAL;
3011	}
3012
3013	if (cfg->ifa_flags & IFA_F_MANAGETEMPADDR && cfg->plen != 64) {
3014		NL_SET_ERR_MSG_MOD(extack, "address with \"mngtmpaddr\" flag must have a prefix length of 64");
3015		return -EINVAL;
3016	}
3017
3018	dev = __dev_get_by_index(net, ifindex);
3019	if (!dev)
3020		return -ENODEV;
3021
3022	idev = addrconf_add_dev(dev);
3023	if (IS_ERR(idev)) {
3024		NL_SET_ERR_MSG_MOD(extack, "IPv6 is disabled on this device");
3025		return PTR_ERR(idev);
3026	}
3027
3028	if (cfg->ifa_flags & IFA_F_MCAUTOJOIN) {
3029		int ret = ipv6_mc_config(net->ipv6.mc_autojoin_sk,
3030					 true, cfg->pfx, ifindex);
3031
3032		if (ret < 0) {
3033			NL_SET_ERR_MSG_MOD(extack, "Multicast auto join failed");
3034			return ret;
3035		}
3036	}
3037
3038	cfg->scope = ipv6_addr_scope(cfg->pfx);
3039
3040	timeout = addrconf_timeout_fixup(cfg->valid_lft, HZ);
3041	if (addrconf_finite_timeout(timeout)) {
3042		expires = jiffies_to_clock_t(timeout * HZ);
3043		cfg->valid_lft = timeout;
3044		flags = RTF_EXPIRES;
3045	} else {
3046		expires = 0;
3047		flags = 0;
3048		cfg->ifa_flags |= IFA_F_PERMANENT;
3049	}
3050
3051	timeout = addrconf_timeout_fixup(cfg->preferred_lft, HZ);
3052	if (addrconf_finite_timeout(timeout)) {
3053		if (timeout == 0)
3054			cfg->ifa_flags |= IFA_F_DEPRECATED;
3055		cfg->preferred_lft = timeout;
3056	}
3057
3058	ifp = ipv6_add_addr(idev, cfg, true, extack);
3059	if (!IS_ERR(ifp)) {
3060		if (!(cfg->ifa_flags & IFA_F_NOPREFIXROUTE)) {
3061			addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
3062					      ifp->rt_priority, dev, expires,
3063					      flags, GFP_KERNEL);
3064		}
3065
3066		/* Send a netlink notification if DAD is enabled and
3067		 * optimistic flag is not set
3068		 */
3069		if (!(ifp->flags & (IFA_F_OPTIMISTIC | IFA_F_NODAD)))
3070			ipv6_ifa_notify(0, ifp);
3071		/*
3072		 * Note that section 3.1 of RFC 4429 indicates
3073		 * that the Optimistic flag should not be set for
3074		 * manually configured addresses
3075		 */
3076		addrconf_dad_start(ifp);
3077		if (cfg->ifa_flags & IFA_F_MANAGETEMPADDR)
3078			manage_tempaddrs(idev, ifp, cfg->valid_lft,
3079					 cfg->preferred_lft, true, jiffies);
3080		in6_ifa_put(ifp);
3081		addrconf_verify_rtnl(net);
3082		return 0;
3083	} else if (cfg->ifa_flags & IFA_F_MCAUTOJOIN) {
3084		ipv6_mc_config(net->ipv6.mc_autojoin_sk, false,
3085			       cfg->pfx, ifindex);
3086	}
3087
3088	return PTR_ERR(ifp);
3089}
3090
3091static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,
3092			  const struct in6_addr *pfx, unsigned int plen,
3093			  struct netlink_ext_ack *extack)
3094{
3095	struct inet6_ifaddr *ifp;
3096	struct inet6_dev *idev;
3097	struct net_device *dev;
3098
3099	if (plen > 128) {
3100		NL_SET_ERR_MSG_MOD(extack, "Invalid prefix length");
3101		return -EINVAL;
3102	}
3103
3104	dev = __dev_get_by_index(net, ifindex);
3105	if (!dev) {
3106		NL_SET_ERR_MSG_MOD(extack, "Unable to find the interface");
3107		return -ENODEV;
3108	}
3109
3110	idev = __in6_dev_get(dev);
3111	if (!idev) {
3112		NL_SET_ERR_MSG_MOD(extack, "IPv6 is disabled on this device");
3113		return -ENXIO;
3114	}
3115
3116	read_lock_bh(&idev->lock);
3117	list_for_each_entry(ifp, &idev->addr_list, if_list) {
3118		if (ifp->prefix_len == plen &&
3119		    ipv6_addr_equal(pfx, &ifp->addr)) {
3120			in6_ifa_hold(ifp);
3121			read_unlock_bh(&idev->lock);
3122
3123			if (!(ifp->flags & IFA_F_TEMPORARY) &&
3124			    (ifa_flags & IFA_F_MANAGETEMPADDR))
3125				manage_tempaddrs(idev, ifp, 0, 0, false,
3126						 jiffies);
3127			ipv6_del_addr(ifp);
3128			addrconf_verify_rtnl(net);
3129			if (ipv6_addr_is_multicast(pfx)) {
3130				ipv6_mc_config(net->ipv6.mc_autojoin_sk,
3131					       false, pfx, dev->ifindex);
3132			}
3133			return 0;
3134		}
3135	}
3136	read_unlock_bh(&idev->lock);
3137
3138	NL_SET_ERR_MSG_MOD(extack, "address not found");
3139	return -EADDRNOTAVAIL;
3140}
3141
3142
3143int addrconf_add_ifaddr(struct net *net, void __user *arg)
3144{
3145	struct ifa6_config cfg = {
3146		.ifa_flags = IFA_F_PERMANENT,
3147		.preferred_lft = INFINITY_LIFE_TIME,
3148		.valid_lft = INFINITY_LIFE_TIME,
3149	};
3150	struct in6_ifreq ireq;
3151	int err;
3152
3153	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
3154		return -EPERM;
3155
3156	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
3157		return -EFAULT;
3158
3159	cfg.pfx = &ireq.ifr6_addr;
3160	cfg.plen = ireq.ifr6_prefixlen;
3161
3162	rtnl_lock();
3163	err = inet6_addr_add(net, ireq.ifr6_ifindex, &cfg, NULL);
3164	rtnl_unlock();
3165	return err;
3166}
3167
3168int addrconf_del_ifaddr(struct net *net, void __user *arg)
3169{
3170	struct in6_ifreq ireq;
3171	int err;
3172
3173	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
3174		return -EPERM;
3175
3176	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
3177		return -EFAULT;
3178
3179	rtnl_lock();
3180	err = inet6_addr_del(net, ireq.ifr6_ifindex, 0, &ireq.ifr6_addr,
3181			     ireq.ifr6_prefixlen, NULL);
3182	rtnl_unlock();
3183	return err;
3184}
3185
3186static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
3187		     int plen, int scope, u8 proto)
3188{
3189	struct inet6_ifaddr *ifp;
3190	struct ifa6_config cfg = {
3191		.pfx = addr,
3192		.plen = plen,
3193		.ifa_flags = IFA_F_PERMANENT,
3194		.valid_lft = INFINITY_LIFE_TIME,
3195		.preferred_lft = INFINITY_LIFE_TIME,
3196		.scope = scope,
3197		.ifa_proto = proto
3198	};
3199
3200	ifp = ipv6_add_addr(idev, &cfg, true, NULL);
3201	if (!IS_ERR(ifp)) {
3202		spin_lock_bh(&ifp->lock);
3203		ifp->flags &= ~IFA_F_TENTATIVE;
3204		spin_unlock_bh(&ifp->lock);
3205		rt_genid_bump_ipv6(dev_net(idev->dev));
3206		ipv6_ifa_notify(RTM_NEWADDR, ifp);
3207		in6_ifa_put(ifp);
3208	}
3209}
3210
3211#if IS_ENABLED(CONFIG_IPV6_SIT) || IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE)
3212static void add_v4_addrs(struct inet6_dev *idev)
3213{
3214	struct in6_addr addr;
3215	struct net_device *dev;
3216	struct net *net = dev_net(idev->dev);
3217	int scope, plen, offset = 0;
3218	u32 pflags = 0;
3219
3220	ASSERT_RTNL();
3221
3222	memset(&addr, 0, sizeof(struct in6_addr));
3223	/* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */
3224	if (idev->dev->addr_len == sizeof(struct in6_addr))
3225		offset = sizeof(struct in6_addr) - 4;
3226	memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4);
3227
3228	if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) {
3229		scope = IPV6_ADDR_COMPATv4;
3230		plen = 96;
3231		pflags |= RTF_NONEXTHOP;
3232	} else {
3233		if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE)
3234			return;
3235
3236		addr.s6_addr32[0] = htonl(0xfe800000);
3237		scope = IFA_LINK;
3238		plen = 64;
3239	}
3240
3241	if (addr.s6_addr32[3]) {
3242		add_addr(idev, &addr, plen, scope, IFAPROT_UNSPEC);
3243		addrconf_prefix_route(&addr, plen, 0, idev->dev, 0, pflags,
3244				      GFP_KERNEL);
3245		return;
3246	}
3247
3248	for_each_netdev(net, dev) {
3249		struct in_device *in_dev = __in_dev_get_rtnl(dev);
3250		if (in_dev && (dev->flags & IFF_UP)) {
3251			struct in_ifaddr *ifa;
3252			int flag = scope;
3253
3254			in_dev_for_each_ifa_rtnl(ifa, in_dev) {
3255				addr.s6_addr32[3] = ifa->ifa_local;
3256
3257				if (ifa->ifa_scope == RT_SCOPE_LINK)
3258					continue;
3259				if (ifa->ifa_scope >= RT_SCOPE_HOST) {
3260					if (idev->dev->flags&IFF_POINTOPOINT)
3261						continue;
3262					flag |= IFA_HOST;
3263				}
3264
3265				add_addr(idev, &addr, plen, flag,
3266					 IFAPROT_UNSPEC);
3267				addrconf_prefix_route(&addr, plen, 0, idev->dev,
3268						      0, pflags, GFP_KERNEL);
3269			}
3270		}
3271	}
3272}
3273#endif
3274
3275static void init_loopback(struct net_device *dev)
3276{
3277	struct inet6_dev  *idev;
3278
3279	/* ::1 */
3280
3281	ASSERT_RTNL();
3282
3283	idev = ipv6_find_idev(dev);
3284	if (IS_ERR(idev)) {
3285		pr_debug("%s: add_dev failed\n", __func__);
3286		return;
3287	}
3288
3289	add_addr(idev, &in6addr_loopback, 128, IFA_HOST, IFAPROT_KERNEL_LO);
3290}
3291
3292void addrconf_add_linklocal(struct inet6_dev *idev,
3293			    const struct in6_addr *addr, u32 flags)
3294{
3295	struct ifa6_config cfg = {
3296		.pfx = addr,
3297		.plen = 64,
3298		.ifa_flags = flags | IFA_F_PERMANENT,
3299		.valid_lft = INFINITY_LIFE_TIME,
3300		.preferred_lft = INFINITY_LIFE_TIME,
3301		.scope = IFA_LINK,
3302		.ifa_proto = IFAPROT_KERNEL_LL
3303	};
3304	struct inet6_ifaddr *ifp;
3305
3306#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
3307	if ((READ_ONCE(dev_net(idev->dev)->ipv6.devconf_all->optimistic_dad) ||
3308	     READ_ONCE(idev->cnf.optimistic_dad)) &&
3309	    !dev_net(idev->dev)->ipv6.devconf_all->forwarding)
3310		cfg.ifa_flags |= IFA_F_OPTIMISTIC;
3311#endif
3312
3313	ifp = ipv6_add_addr(idev, &cfg, true, NULL);
3314	if (!IS_ERR(ifp)) {
3315		addrconf_prefix_route(&ifp->addr, ifp->prefix_len, 0, idev->dev,
3316				      0, 0, GFP_ATOMIC);
3317		addrconf_dad_start(ifp);
3318		in6_ifa_put(ifp);
3319	}
3320}
3321EXPORT_SYMBOL_GPL(addrconf_add_linklocal);
3322
3323static bool ipv6_reserved_interfaceid(struct in6_addr address)
3324{
3325	if ((address.s6_addr32[2] | address.s6_addr32[3]) == 0)
3326		return true;
3327
3328	if (address.s6_addr32[2] == htonl(0x02005eff) &&
3329	    ((address.s6_addr32[3] & htonl(0xfe000000)) == htonl(0xfe000000)))
3330		return true;
3331
3332	if (address.s6_addr32[2] == htonl(0xfdffffff) &&
3333	    ((address.s6_addr32[3] & htonl(0xffffff80)) == htonl(0xffffff80)))
3334		return true;
3335
3336	return false;
3337}
3338
3339static int ipv6_generate_stable_address(struct in6_addr *address,
3340					u8 dad_count,
3341					const struct inet6_dev *idev)
3342{
3343	static DEFINE_SPINLOCK(lock);
3344	static __u32 digest[SHA1_DIGEST_WORDS];
3345	static __u32 workspace[SHA1_WORKSPACE_WORDS];
3346
3347	static union {
3348		char __data[SHA1_BLOCK_SIZE];
3349		struct {
3350			struct in6_addr secret;
3351			__be32 prefix[2];
3352			unsigned char hwaddr[MAX_ADDR_LEN];
3353			u8 dad_count;
3354		} __packed;
3355	} data;
3356
3357	struct in6_addr secret;
3358	struct in6_addr temp;
3359	struct net *net = dev_net(idev->dev);
3360
3361	BUILD_BUG_ON(sizeof(data.__data) != sizeof(data));
3362
3363	if (idev->cnf.stable_secret.initialized)
3364		secret = idev->cnf.stable_secret.secret;
3365	else if (net->ipv6.devconf_dflt->stable_secret.initialized)
3366		secret = net->ipv6.devconf_dflt->stable_secret.secret;
3367	else
3368		return -1;
3369
3370retry:
3371	spin_lock_bh(&lock);
3372
3373	sha1_init(digest);
3374	memset(&data, 0, sizeof(data));
3375	memset(workspace, 0, sizeof(workspace));
3376	memcpy(data.hwaddr, idev->dev->perm_addr, idev->dev->addr_len);
3377	data.prefix[0] = address->s6_addr32[0];
3378	data.prefix[1] = address->s6_addr32[1];
3379	data.secret = secret;
3380	data.dad_count = dad_count;
3381
3382	sha1_transform(digest, data.__data, workspace);
3383
3384	temp = *address;
3385	temp.s6_addr32[2] = (__force __be32)digest[0];
3386	temp.s6_addr32[3] = (__force __be32)digest[1];
3387
3388	spin_unlock_bh(&lock);
3389
3390	if (ipv6_reserved_interfaceid(temp)) {
3391		dad_count++;
3392		if (dad_count > dev_net(idev->dev)->ipv6.sysctl.idgen_retries)
3393			return -1;
3394		goto retry;
3395	}
3396
3397	*address = temp;
3398	return 0;
3399}
3400
3401static void ipv6_gen_mode_random_init(struct inet6_dev *idev)
3402{
3403	struct ipv6_stable_secret *s = &idev->cnf.stable_secret;
3404
3405	if (s->initialized)
3406		return;
3407	s = &idev->cnf.stable_secret;
3408	get_random_bytes(&s->secret, sizeof(s->secret));
3409	s->initialized = true;
3410}
3411
3412static void addrconf_addr_gen(struct inet6_dev *idev, bool prefix_route)
3413{
3414	struct in6_addr addr;
3415
3416	/* no link local addresses on L3 master devices */
3417	if (netif_is_l3_master(idev->dev))
3418		return;
3419
3420	/* no link local addresses on devices flagged as slaves */
3421	if (idev->dev->priv_flags & IFF_NO_ADDRCONF)
3422		return;
3423
3424	ipv6_addr_set(&addr, htonl(0xFE800000), 0, 0, 0);
3425
3426	switch (idev->cnf.addr_gen_mode) {
3427	case IN6_ADDR_GEN_MODE_RANDOM:
3428		ipv6_gen_mode_random_init(idev);
3429		fallthrough;
3430	case IN6_ADDR_GEN_MODE_STABLE_PRIVACY:
3431		if (!ipv6_generate_stable_address(&addr, 0, idev))
3432			addrconf_add_linklocal(idev, &addr,
3433					       IFA_F_STABLE_PRIVACY);
3434		else if (prefix_route)
3435			addrconf_prefix_route(&addr, 64, 0, idev->dev,
3436					      0, 0, GFP_KERNEL);
3437		break;
3438	case IN6_ADDR_GEN_MODE_EUI64:
3439		/* addrconf_add_linklocal also adds a prefix_route and we
3440		 * only need to care about prefix routes if ipv6_generate_eui64
3441		 * couldn't generate one.
3442		 */
3443		if (ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) == 0)
3444			addrconf_add_linklocal(idev, &addr, 0);
3445		else if (prefix_route)
3446			addrconf_prefix_route(&addr, 64, 0, idev->dev,
3447					      0, 0, GFP_KERNEL);
3448		break;
3449	case IN6_ADDR_GEN_MODE_NONE:
3450	default:
3451		/* will not add any link local address */
3452		break;
3453	}
3454}
3455
3456static void addrconf_dev_config(struct net_device *dev)
3457{
3458	struct inet6_dev *idev;
3459
3460	ASSERT_RTNL();
3461
3462	if ((dev->type != ARPHRD_ETHER) &&
3463	    (dev->type != ARPHRD_FDDI) &&
3464	    (dev->type != ARPHRD_ARCNET) &&
3465	    (dev->type != ARPHRD_INFINIBAND) &&
3466	    (dev->type != ARPHRD_IEEE1394) &&
3467	    (dev->type != ARPHRD_TUNNEL6) &&
3468	    (dev->type != ARPHRD_6LOWPAN) &&
3469	    (dev->type != ARPHRD_TUNNEL) &&
3470	    (dev->type != ARPHRD_NONE) &&
3471	    (dev->type != ARPHRD_RAWIP)) {
3472		/* Alas, we support only Ethernet autoconfiguration. */
3473		idev = __in6_dev_get(dev);
3474		if (!IS_ERR_OR_NULL(idev) && dev->flags & IFF_UP &&
3475		    dev->flags & IFF_MULTICAST)
3476			ipv6_mc_up(idev);
3477		return;
3478	}
3479
3480	idev = addrconf_add_dev(dev);
3481	if (IS_ERR(idev))
3482		return;
3483
3484	/* this device type has no EUI support */
3485	if (dev->type == ARPHRD_NONE &&
3486	    idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)
3487		WRITE_ONCE(idev->cnf.addr_gen_mode,
3488			   IN6_ADDR_GEN_MODE_RANDOM);
3489
3490	addrconf_addr_gen(idev, false);
3491}
3492
3493#if IS_ENABLED(CONFIG_IPV6_SIT)
3494static void addrconf_sit_config(struct net_device *dev)
3495{
3496	struct inet6_dev *idev;
3497
3498	ASSERT_RTNL();
3499
3500	/*
3501	 * Configure the tunnel with one of our IPv4
3502	 * addresses... we should configure all of
3503	 * our v4 addrs in the tunnel
3504	 */
3505
3506	idev = ipv6_find_idev(dev);
3507	if (IS_ERR(idev)) {
3508		pr_debug("%s: add_dev failed\n", __func__);
3509		return;
3510	}
3511
3512	if (dev->priv_flags & IFF_ISATAP) {
3513		addrconf_addr_gen(idev, false);
3514		return;
3515	}
3516
3517	add_v4_addrs(idev);
3518
3519	if (dev->flags&IFF_POINTOPOINT)
3520		addrconf_add_mroute(dev);
3521}
3522#endif
3523
3524#if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE)
3525static void addrconf_gre_config(struct net_device *dev)
3526{
3527	struct inet6_dev *idev;
3528
3529	ASSERT_RTNL();
3530
3531	idev = ipv6_find_idev(dev);
3532	if (IS_ERR(idev)) {
3533		pr_debug("%s: add_dev failed\n", __func__);
3534		return;
3535	}
3536
3537	if (dev->type == ARPHRD_ETHER) {
3538		addrconf_addr_gen(idev, true);
3539		return;
3540	}
3541
3542	add_v4_addrs(idev);
3543
3544	if (dev->flags & IFF_POINTOPOINT)
3545		addrconf_add_mroute(dev);
3546}
3547#endif
3548
3549static void addrconf_init_auto_addrs(struct net_device *dev)
3550{
3551	switch (dev->type) {
3552#if IS_ENABLED(CONFIG_IPV6_SIT)
3553	case ARPHRD_SIT:
3554		addrconf_sit_config(dev);
3555		break;
3556#endif
3557#if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE)
3558	case ARPHRD_IP6GRE:
3559	case ARPHRD_IPGRE:
3560		addrconf_gre_config(dev);
3561		break;
3562#endif
3563	case ARPHRD_LOOPBACK:
3564		init_loopback(dev);
3565		break;
3566
3567	default:
3568		addrconf_dev_config(dev);
3569		break;
3570	}
3571}
3572
3573static int fixup_permanent_addr(struct net *net,
3574				struct inet6_dev *idev,
3575				struct inet6_ifaddr *ifp)
3576{
3577	/* !fib6_node means the host route was removed from the
3578	 * FIB, for example, if 'lo' device is taken down. In that
3579	 * case regenerate the host route.
3580	 */
3581	if (!ifp->rt || !ifp->rt->fib6_node) {
3582		struct fib6_info *f6i, *prev;
3583
3584		f6i = addrconf_f6i_alloc(net, idev, &ifp->addr, false,
3585					 GFP_ATOMIC, NULL);
3586		if (IS_ERR(f6i))
3587			return PTR_ERR(f6i);
3588
3589		/* ifp->rt can be accessed outside of rtnl */
3590		spin_lock(&ifp->lock);
3591		prev = ifp->rt;
3592		ifp->rt = f6i;
3593		spin_unlock(&ifp->lock);
3594
3595		fib6_info_release(prev);
3596	}
3597
3598	if (!(ifp->flags & IFA_F_NOPREFIXROUTE)) {
3599		addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
3600				      ifp->rt_priority, idev->dev, 0, 0,
3601				      GFP_ATOMIC);
3602	}
3603
3604	if (ifp->state == INET6_IFADDR_STATE_PREDAD)
3605		addrconf_dad_start(ifp);
3606
3607	return 0;
3608}
3609
3610static void addrconf_permanent_addr(struct net *net, struct net_device *dev)
3611{
3612	struct inet6_ifaddr *ifp, *tmp;
3613	struct inet6_dev *idev;
3614
3615	idev = __in6_dev_get(dev);
3616	if (!idev)
3617		return;
3618
3619	write_lock_bh(&idev->lock);
3620
3621	list_for_each_entry_safe(ifp, tmp, &idev->addr_list, if_list) {
3622		if ((ifp->flags & IFA_F_PERMANENT) &&
3623		    fixup_permanent_addr(net, idev, ifp) < 0) {
3624			write_unlock_bh(&idev->lock);
3625			in6_ifa_hold(ifp);
3626			ipv6_del_addr(ifp);
3627			write_lock_bh(&idev->lock);
3628
3629			net_info_ratelimited("%s: Failed to add prefix route for address %pI6c; dropping\n",
3630					     idev->dev->name, &ifp->addr);
3631		}
3632	}
3633
3634	write_unlock_bh(&idev->lock);
3635}
3636
3637static int addrconf_notify(struct notifier_block *this, unsigned long event,
3638			   void *ptr)
3639{
3640	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
3641	struct netdev_notifier_change_info *change_info;
3642	struct netdev_notifier_changeupper_info *info;
3643	struct inet6_dev *idev = __in6_dev_get(dev);
3644	struct net *net = dev_net(dev);
3645	int run_pending = 0;
3646	int err;
3647
3648	switch (event) {
3649	case NETDEV_REGISTER:
3650		if (!idev && dev->mtu >= IPV6_MIN_MTU) {
3651			idev = ipv6_add_dev(dev);
3652			if (IS_ERR(idev))
3653				return notifier_from_errno(PTR_ERR(idev));
3654		}
3655		break;
3656
3657	case NETDEV_CHANGEMTU:
3658		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
3659		if (dev->mtu < IPV6_MIN_MTU) {
3660			addrconf_ifdown(dev, dev != net->loopback_dev);
3661			break;
3662		}
3663
3664		if (idev) {
3665			rt6_mtu_change(dev, dev->mtu);
3666			WRITE_ONCE(idev->cnf.mtu6, dev->mtu);
3667			break;
3668		}
3669
3670		/* allocate new idev */
3671		idev = ipv6_add_dev(dev);
3672		if (IS_ERR(idev))
3673			break;
3674
3675		/* device is still not ready */
3676		if (!(idev->if_flags & IF_READY))
3677			break;
3678
3679		run_pending = 1;
3680		fallthrough;
3681	case NETDEV_UP:
3682	case NETDEV_CHANGE:
3683		if (idev && idev->cnf.disable_ipv6)
3684			break;
3685
3686		if (dev->priv_flags & IFF_NO_ADDRCONF) {
3687			if (event == NETDEV_UP && !IS_ERR_OR_NULL(idev) &&
3688			    dev->flags & IFF_UP && dev->flags & IFF_MULTICAST)
3689				ipv6_mc_up(idev);
3690			break;
3691		}
3692
3693		if (event == NETDEV_UP) {
3694			/* restore routes for permanent addresses */
3695			addrconf_permanent_addr(net, dev);
3696
3697			if (!addrconf_link_ready(dev)) {
3698				/* device is not ready yet. */
3699				pr_debug("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
3700					 dev->name);
3701				break;
3702			}
3703
3704			if (!idev && dev->mtu >= IPV6_MIN_MTU)
3705				idev = ipv6_add_dev(dev);
3706
3707			if (!IS_ERR_OR_NULL(idev)) {
3708				idev->if_flags |= IF_READY;
3709				run_pending = 1;
3710			}
3711		} else if (event == NETDEV_CHANGE) {
3712			if (!addrconf_link_ready(dev)) {
3713				/* device is still not ready. */
3714				rt6_sync_down_dev(dev, event);
3715				break;
3716			}
3717
3718			if (!IS_ERR_OR_NULL(idev)) {
3719				if (idev->if_flags & IF_READY) {
3720					/* device is already configured -
3721					 * but resend MLD reports, we might
3722					 * have roamed and need to update
3723					 * multicast snooping switches
3724					 */
3725					ipv6_mc_up(idev);
3726					change_info = ptr;
3727					if (change_info->flags_changed & IFF_NOARP)
3728						addrconf_dad_run(idev, true);
3729					rt6_sync_up(dev, RTNH_F_LINKDOWN);
3730					break;
3731				}
3732				idev->if_flags |= IF_READY;
3733			}
3734
3735			pr_debug("ADDRCONF(NETDEV_CHANGE): %s: link becomes ready\n",
3736				 dev->name);
3737
3738			run_pending = 1;
3739		}
3740
3741		addrconf_init_auto_addrs(dev);
3742
3743		if (!IS_ERR_OR_NULL(idev)) {
3744			if (run_pending)
3745				addrconf_dad_run(idev, false);
3746
3747			/* Device has an address by now */
3748			rt6_sync_up(dev, RTNH_F_DEAD);
3749
3750			/*
3751			 * If the MTU changed during the interface down,
3752			 * when the interface up, the changed MTU must be
3753			 * reflected in the idev as well as routers.
3754			 */
3755			if (idev->cnf.mtu6 != dev->mtu &&
3756			    dev->mtu >= IPV6_MIN_MTU) {
3757				rt6_mtu_change(dev, dev->mtu);
3758				WRITE_ONCE(idev->cnf.mtu6, dev->mtu);
3759			}
3760			WRITE_ONCE(idev->tstamp, jiffies);
3761			inet6_ifinfo_notify(RTM_NEWLINK, idev);
3762
3763			/*
3764			 * If the changed mtu during down is lower than
3765			 * IPV6_MIN_MTU stop IPv6 on this interface.
3766			 */
3767			if (dev->mtu < IPV6_MIN_MTU)
3768				addrconf_ifdown(dev, dev != net->loopback_dev);
3769		}
3770		break;
3771
3772	case NETDEV_DOWN:
3773	case NETDEV_UNREGISTER:
3774		/*
3775		 *	Remove all addresses from this interface.
3776		 */
3777		addrconf_ifdown(dev, event != NETDEV_DOWN);
3778		break;
3779
3780	case NETDEV_CHANGENAME:
3781		if (idev) {
3782			snmp6_unregister_dev(idev);
3783			addrconf_sysctl_unregister(idev);
3784			err = addrconf_sysctl_register(idev);
3785			if (err)
3786				return notifier_from_errno(err);
3787			err = snmp6_register_dev(idev);
3788			if (err) {
3789				addrconf_sysctl_unregister(idev);
3790				return notifier_from_errno(err);
3791			}
3792		}
3793		break;
3794
3795	case NETDEV_PRE_TYPE_CHANGE:
3796	case NETDEV_POST_TYPE_CHANGE:
3797		if (idev)
3798			addrconf_type_change(dev, event);
3799		break;
3800
3801	case NETDEV_CHANGEUPPER:
3802		info = ptr;
3803
3804		/* flush all routes if dev is linked to or unlinked from
3805		 * an L3 master device (e.g., VRF)
3806		 */
3807		if (info->upper_dev && netif_is_l3_master(info->upper_dev))
3808			addrconf_ifdown(dev, false);
3809	}
3810
3811	return NOTIFY_OK;
3812}
3813
3814/*
3815 *	addrconf module should be notified of a device going up
3816 */
3817static struct notifier_block ipv6_dev_notf = {
3818	.notifier_call = addrconf_notify,
3819	.priority = ADDRCONF_NOTIFY_PRIORITY,
3820};
3821
3822static void addrconf_type_change(struct net_device *dev, unsigned long event)
3823{
3824	struct inet6_dev *idev;
3825	ASSERT_RTNL();
3826
3827	idev = __in6_dev_get(dev);
3828
3829	if (event == NETDEV_POST_TYPE_CHANGE)
3830		ipv6_mc_remap(idev);
3831	else if (event == NETDEV_PRE_TYPE_CHANGE)
3832		ipv6_mc_unmap(idev);
3833}
3834
3835static bool addr_is_local(const struct in6_addr *addr)
3836{
3837	return ipv6_addr_type(addr) &
3838		(IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
3839}
3840
3841static int addrconf_ifdown(struct net_device *dev, bool unregister)
3842{
3843	unsigned long event = unregister ? NETDEV_UNREGISTER : NETDEV_DOWN;
3844	struct net *net = dev_net(dev);
3845	struct inet6_dev *idev;
3846	struct inet6_ifaddr *ifa;
3847	LIST_HEAD(tmp_addr_list);
3848	bool keep_addr = false;
3849	bool was_ready;
3850	int state, i;
3851
3852	ASSERT_RTNL();
3853
3854	rt6_disable_ip(dev, event);
3855
3856	idev = __in6_dev_get(dev);
3857	if (!idev)
3858		return -ENODEV;
3859
3860	/*
3861	 * Step 1: remove reference to ipv6 device from parent device.
3862	 *	   Do not dev_put!
3863	 */
3864	if (unregister) {
3865		idev->dead = 1;
3866
3867		/* protected by rtnl_lock */
3868		RCU_INIT_POINTER(dev->ip6_ptr, NULL);
3869
3870		/* Step 1.5: remove snmp6 entry */
3871		snmp6_unregister_dev(idev);
3872
3873	}
3874
3875	/* combine the user config with event to determine if permanent
3876	 * addresses are to be removed from address hash table
3877	 */
3878	if (!unregister && !idev->cnf.disable_ipv6) {
3879		/* aggregate the system setting and interface setting */
3880		int _keep_addr = READ_ONCE(net->ipv6.devconf_all->keep_addr_on_down);
3881
3882		if (!_keep_addr)
3883			_keep_addr = READ_ONCE(idev->cnf.keep_addr_on_down);
3884
3885		keep_addr = (_keep_addr > 0);
3886	}
3887
3888	/* Step 2: clear hash table */
3889	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
3890		struct hlist_head *h = &net->ipv6.inet6_addr_lst[i];
3891
3892		spin_lock_bh(&net->ipv6.addrconf_hash_lock);
3893restart:
3894		hlist_for_each_entry_rcu(ifa, h, addr_lst) {
3895			if (ifa->idev == idev) {
3896				addrconf_del_dad_work(ifa);
3897				/* combined flag + permanent flag decide if
3898				 * address is retained on a down event
3899				 */
3900				if (!keep_addr ||
3901				    !(ifa->flags & IFA_F_PERMANENT) ||
3902				    addr_is_local(&ifa->addr)) {
3903					hlist_del_init_rcu(&ifa->addr_lst);
3904					goto restart;
3905				}
3906			}
3907		}
3908		spin_unlock_bh(&net->ipv6.addrconf_hash_lock);
3909	}
3910
3911	write_lock_bh(&idev->lock);
3912
3913	addrconf_del_rs_timer(idev);
3914
3915	/* Step 2: clear flags for stateless addrconf, repeated down
3916	 *         detection
3917	 */
3918	was_ready = idev->if_flags & IF_READY;
3919	if (!unregister)
3920		idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
3921
3922	/* Step 3: clear tempaddr list */
3923	while (!list_empty(&idev->tempaddr_list)) {
3924		ifa = list_first_entry(&idev->tempaddr_list,
3925				       struct inet6_ifaddr, tmp_list);
3926		list_del(&ifa->tmp_list);
3927		write_unlock_bh(&idev->lock);
3928		spin_lock_bh(&ifa->lock);
3929
3930		if (ifa->ifpub) {
3931			in6_ifa_put(ifa->ifpub);
3932			ifa->ifpub = NULL;
3933		}
3934		spin_unlock_bh(&ifa->lock);
3935		in6_ifa_put(ifa);
3936		write_lock_bh(&idev->lock);
3937	}
3938
3939	list_for_each_entry(ifa, &idev->addr_list, if_list)
3940		list_add_tail(&ifa->if_list_aux, &tmp_addr_list);
3941	write_unlock_bh(&idev->lock);
3942
3943	while (!list_empty(&tmp_addr_list)) {
3944		struct fib6_info *rt = NULL;
3945		bool keep;
3946
3947		ifa = list_first_entry(&tmp_addr_list,
3948				       struct inet6_ifaddr, if_list_aux);
3949		list_del(&ifa->if_list_aux);
3950
3951		addrconf_del_dad_work(ifa);
3952
3953		keep = keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
3954			!addr_is_local(&ifa->addr);
3955
3956		spin_lock_bh(&ifa->lock);
3957
3958		if (keep) {
3959			/* set state to skip the notifier below */
3960			state = INET6_IFADDR_STATE_DEAD;
3961			ifa->state = INET6_IFADDR_STATE_PREDAD;
3962			if (!(ifa->flags & IFA_F_NODAD))
3963				ifa->flags |= IFA_F_TENTATIVE;
3964
3965			rt = ifa->rt;
3966			ifa->rt = NULL;
3967		} else {
3968			state = ifa->state;
3969			ifa->state = INET6_IFADDR_STATE_DEAD;
3970		}
3971
3972		spin_unlock_bh(&ifa->lock);
3973
3974		if (rt)
3975			ip6_del_rt(net, rt, false);
3976
3977		if (state != INET6_IFADDR_STATE_DEAD) {
3978			__ipv6_ifa_notify(RTM_DELADDR, ifa);
3979			inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
3980		} else {
3981			if (idev->cnf.forwarding)
3982				addrconf_leave_anycast(ifa);
3983			addrconf_leave_solict(ifa->idev, &ifa->addr);
3984		}
3985
3986		if (!keep) {
3987			write_lock_bh(&idev->lock);
3988			list_del_rcu(&ifa->if_list);
3989			write_unlock_bh(&idev->lock);
3990			in6_ifa_put(ifa);
3991		}
3992	}
3993
3994	/* Step 5: Discard anycast and multicast list */
3995	if (unregister) {
3996		ipv6_ac_destroy_dev(idev);
3997		ipv6_mc_destroy_dev(idev);
3998	} else if (was_ready) {
3999		ipv6_mc_down(idev);
4000	}
4001
4002	WRITE_ONCE(idev->tstamp, jiffies);
4003	idev->ra_mtu = 0;
4004
4005	/* Last: Shot the device (if unregistered) */
4006	if (unregister) {
4007		addrconf_sysctl_unregister(idev);
4008		neigh_parms_release(&nd_tbl, idev->nd_parms);
4009		neigh_ifdown(&nd_tbl, dev);
4010		in6_dev_put(idev);
4011	}
4012	return 0;
4013}
4014
4015static void addrconf_rs_timer(struct timer_list *t)
4016{
4017	struct inet6_dev *idev = from_timer(idev, t, rs_timer);
4018	struct net_device *dev = idev->dev;
4019	struct in6_addr lladdr;
4020	int rtr_solicits;
4021
4022	write_lock(&idev->lock);
4023	if (idev->dead || !(idev->if_flags & IF_READY))
4024		goto out;
4025
4026	if (!ipv6_accept_ra(idev))
4027		goto out;
4028
4029	/* Announcement received after solicitation was sent */
4030	if (idev->if_flags & IF_RA_RCVD)
4031		goto out;
4032
4033	rtr_solicits = READ_ONCE(idev->cnf.rtr_solicits);
4034
4035	if (idev->rs_probes++ < rtr_solicits || rtr_solicits < 0) {
4036		write_unlock(&idev->lock);
4037		if (!ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
4038			ndisc_send_rs(dev, &lladdr,
4039				      &in6addr_linklocal_allrouters);
4040		else
4041			goto put;
4042
4043		write_lock(&idev->lock);
4044		idev->rs_interval = rfc3315_s14_backoff_update(
4045				idev->rs_interval,
4046				READ_ONCE(idev->cnf.rtr_solicit_max_interval));
4047		/* The wait after the last probe can be shorter */
4048		addrconf_mod_rs_timer(idev, (idev->rs_probes ==
4049					     READ_ONCE(idev->cnf.rtr_solicits)) ?
4050				      READ_ONCE(idev->cnf.rtr_solicit_delay) :
4051				      idev->rs_interval);
4052	} else {
4053		/*
4054		 * Note: we do not support deprecated "all on-link"
4055		 * assumption any longer.
4056		 */
4057		pr_debug("%s: no IPv6 routers present\n", idev->dev->name);
4058	}
4059
4060out:
4061	write_unlock(&idev->lock);
4062put:
4063	in6_dev_put(idev);
4064}
4065
4066/*
4067 *	Duplicate Address Detection
4068 */
4069static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
4070{
4071	struct inet6_dev *idev = ifp->idev;
4072	unsigned long rand_num;
 
4073	u64 nonce;
4074
4075	if (ifp->flags & IFA_F_OPTIMISTIC)
4076		rand_num = 0;
4077	else
4078		rand_num = get_random_u32_below(
4079				READ_ONCE(idev->cnf.rtr_solicit_delay) ? : 1);
4080
4081	nonce = 0;
4082	if (READ_ONCE(idev->cnf.enhanced_dad) ||
4083	    READ_ONCE(dev_net(idev->dev)->ipv6.devconf_all->enhanced_dad)) {
4084		do
4085			get_random_bytes(&nonce, 6);
4086		while (nonce == 0);
4087	}
4088	ifp->dad_nonce = nonce;
4089	ifp->dad_probes = READ_ONCE(idev->cnf.dad_transmits);
4090	addrconf_mod_dad_work(ifp, rand_num);
4091}
4092
4093static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
4094{
4095	struct inet6_dev *idev = ifp->idev;
4096	struct net_device *dev = idev->dev;
4097	bool bump_id, notify = false;
4098	struct net *net;
4099
4100	addrconf_join_solict(dev, &ifp->addr);
4101
4102	read_lock_bh(&idev->lock);
4103	spin_lock(&ifp->lock);
4104	if (ifp->state == INET6_IFADDR_STATE_DEAD)
4105		goto out;
4106
4107	net = dev_net(dev);
4108	if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
4109	    (READ_ONCE(net->ipv6.devconf_all->accept_dad) < 1 &&
4110	     READ_ONCE(idev->cnf.accept_dad) < 1) ||
4111	    !(ifp->flags&IFA_F_TENTATIVE) ||
4112	    ifp->flags & IFA_F_NODAD) {
4113		bool send_na = false;
4114
4115		if (ifp->flags & IFA_F_TENTATIVE &&
4116		    !(ifp->flags & IFA_F_OPTIMISTIC))
4117			send_na = true;
4118		bump_id = ifp->flags & IFA_F_TENTATIVE;
4119		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
4120		spin_unlock(&ifp->lock);
4121		read_unlock_bh(&idev->lock);
4122
4123		addrconf_dad_completed(ifp, bump_id, send_na);
4124		return;
4125	}
4126
4127	if (!(idev->if_flags & IF_READY)) {
4128		spin_unlock(&ifp->lock);
4129		read_unlock_bh(&idev->lock);
4130		/*
4131		 * If the device is not ready:
4132		 * - keep it tentative if it is a permanent address.
4133		 * - otherwise, kill it.
4134		 */
4135		in6_ifa_hold(ifp);
4136		addrconf_dad_stop(ifp, 0);
4137		return;
4138	}
4139
4140	/*
4141	 * Optimistic nodes can start receiving
4142	 * Frames right away
4143	 */
4144	if (ifp->flags & IFA_F_OPTIMISTIC) {
4145		ip6_ins_rt(net, ifp->rt);
4146		if (ipv6_use_optimistic_addr(net, idev)) {
4147			/* Because optimistic nodes can use this address,
4148			 * notify listeners. If DAD fails, RTM_DELADDR is sent.
4149			 */
4150			notify = true;
4151		}
4152	}
4153
4154	addrconf_dad_kick(ifp);
4155out:
4156	spin_unlock(&ifp->lock);
4157	read_unlock_bh(&idev->lock);
4158	if (notify)
4159		ipv6_ifa_notify(RTM_NEWADDR, ifp);
4160}
4161
4162static void addrconf_dad_start(struct inet6_ifaddr *ifp)
4163{
4164	bool begin_dad = false;
4165
4166	spin_lock_bh(&ifp->lock);
4167	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
4168		ifp->state = INET6_IFADDR_STATE_PREDAD;
4169		begin_dad = true;
4170	}
4171	spin_unlock_bh(&ifp->lock);
4172
4173	if (begin_dad)
4174		addrconf_mod_dad_work(ifp, 0);
4175}
4176
4177static void addrconf_dad_work(struct work_struct *w)
4178{
4179	struct inet6_ifaddr *ifp = container_of(to_delayed_work(w),
4180						struct inet6_ifaddr,
4181						dad_work);
4182	struct inet6_dev *idev = ifp->idev;
4183	bool bump_id, disable_ipv6 = false;
4184	struct in6_addr mcaddr;
4185
4186	enum {
4187		DAD_PROCESS,
4188		DAD_BEGIN,
4189		DAD_ABORT,
4190	} action = DAD_PROCESS;
4191
4192	rtnl_lock();
4193
4194	spin_lock_bh(&ifp->lock);
4195	if (ifp->state == INET6_IFADDR_STATE_PREDAD) {
4196		action = DAD_BEGIN;
4197		ifp->state = INET6_IFADDR_STATE_DAD;
4198	} else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
4199		action = DAD_ABORT;
4200		ifp->state = INET6_IFADDR_STATE_POSTDAD;
4201
4202		if ((READ_ONCE(dev_net(idev->dev)->ipv6.devconf_all->accept_dad) > 1 ||
4203		     READ_ONCE(idev->cnf.accept_dad) > 1) &&
4204		    !idev->cnf.disable_ipv6 &&
4205		    !(ifp->flags & IFA_F_STABLE_PRIVACY)) {
4206			struct in6_addr addr;
4207
4208			addr.s6_addr32[0] = htonl(0xfe800000);
4209			addr.s6_addr32[1] = 0;
4210
4211			if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
4212			    ipv6_addr_equal(&ifp->addr, &addr)) {
4213				/* DAD failed for link-local based on MAC */
4214				WRITE_ONCE(idev->cnf.disable_ipv6, 1);
4215
4216				pr_info("%s: IPv6 being disabled!\n",
4217					ifp->idev->dev->name);
4218				disable_ipv6 = true;
4219			}
4220		}
4221	}
4222	spin_unlock_bh(&ifp->lock);
4223
4224	if (action == DAD_BEGIN) {
4225		addrconf_dad_begin(ifp);
4226		goto out;
4227	} else if (action == DAD_ABORT) {
4228		in6_ifa_hold(ifp);
4229		addrconf_dad_stop(ifp, 1);
4230		if (disable_ipv6)
4231			addrconf_ifdown(idev->dev, false);
4232		goto out;
4233	}
4234
4235	if (!ifp->dad_probes && addrconf_dad_end(ifp))
4236		goto out;
4237
4238	write_lock_bh(&idev->lock);
4239	if (idev->dead || !(idev->if_flags & IF_READY)) {
4240		write_unlock_bh(&idev->lock);
4241		goto out;
4242	}
4243
4244	spin_lock(&ifp->lock);
4245	if (ifp->state == INET6_IFADDR_STATE_DEAD) {
4246		spin_unlock(&ifp->lock);
4247		write_unlock_bh(&idev->lock);
4248		goto out;
4249	}
4250
4251	if (ifp->dad_probes == 0) {
4252		bool send_na = false;
4253
4254		/*
4255		 * DAD was successful
4256		 */
4257
4258		if (ifp->flags & IFA_F_TENTATIVE &&
4259		    !(ifp->flags & IFA_F_OPTIMISTIC))
4260			send_na = true;
4261		bump_id = ifp->flags & IFA_F_TENTATIVE;
4262		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
4263		spin_unlock(&ifp->lock);
4264		write_unlock_bh(&idev->lock);
4265
4266		addrconf_dad_completed(ifp, bump_id, send_na);
4267
4268		goto out;
4269	}
4270
4271	ifp->dad_probes--;
4272	addrconf_mod_dad_work(ifp,
4273			      max(NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME),
4274				  HZ/100));
4275	spin_unlock(&ifp->lock);
4276	write_unlock_bh(&idev->lock);
4277
4278	/* send a neighbour solicitation for our addr */
4279	addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
4280	ndisc_send_ns(ifp->idev->dev, &ifp->addr, &mcaddr, &in6addr_any,
4281		      ifp->dad_nonce);
4282out:
4283	in6_ifa_put(ifp);
4284	rtnl_unlock();
4285}
4286
4287/* ifp->idev must be at least read locked */
4288static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
4289{
4290	struct inet6_ifaddr *ifpiter;
4291	struct inet6_dev *idev = ifp->idev;
4292
4293	list_for_each_entry_reverse(ifpiter, &idev->addr_list, if_list) {
4294		if (ifpiter->scope > IFA_LINK)
4295			break;
4296		if (ifp != ifpiter && ifpiter->scope == IFA_LINK &&
4297		    (ifpiter->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|
4298				       IFA_F_OPTIMISTIC|IFA_F_DADFAILED)) ==
4299		    IFA_F_PERMANENT)
4300			return false;
4301	}
4302	return true;
4303}
4304
4305static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
4306				   bool send_na)
4307{
4308	struct net_device *dev = ifp->idev->dev;
4309	struct in6_addr lladdr;
4310	bool send_rs, send_mld;
4311
4312	addrconf_del_dad_work(ifp);
4313
4314	/*
4315	 *	Configure the address for reception. Now it is valid.
4316	 */
4317
4318	ipv6_ifa_notify(RTM_NEWADDR, ifp);
4319
4320	/* If added prefix is link local and we are prepared to process
4321	   router advertisements, start sending router solicitations.
4322	 */
4323
4324	read_lock_bh(&ifp->idev->lock);
4325	send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
4326	send_rs = send_mld &&
4327		  ipv6_accept_ra(ifp->idev) &&
4328		  READ_ONCE(ifp->idev->cnf.rtr_solicits) != 0 &&
4329		  (dev->flags & IFF_LOOPBACK) == 0 &&
4330		  (dev->type != ARPHRD_TUNNEL) &&
4331		  !netif_is_team_port(dev);
4332	read_unlock_bh(&ifp->idev->lock);
4333
4334	/* While dad is in progress mld report's source address is in6_addrany.
4335	 * Resend with proper ll now.
4336	 */
4337	if (send_mld)
4338		ipv6_mc_dad_complete(ifp->idev);
4339
4340	/* send unsolicited NA if enabled */
4341	if (send_na &&
4342	    (READ_ONCE(ifp->idev->cnf.ndisc_notify) ||
4343	     READ_ONCE(dev_net(dev)->ipv6.devconf_all->ndisc_notify))) {
4344		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifp->addr,
4345			      /*router=*/ !!ifp->idev->cnf.forwarding,
4346			      /*solicited=*/ false, /*override=*/ true,
4347			      /*inc_opt=*/ true);
4348	}
4349
4350	if (send_rs) {
4351		/*
4352		 *	If a host as already performed a random delay
4353		 *	[...] as part of DAD [...] there is no need
4354		 *	to delay again before sending the first RS
4355		 */
4356		if (ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
4357			return;
4358		ndisc_send_rs(dev, &lladdr, &in6addr_linklocal_allrouters);
4359
4360		write_lock_bh(&ifp->idev->lock);
4361		spin_lock(&ifp->lock);
4362		ifp->idev->rs_interval = rfc3315_s14_backoff_init(
4363			READ_ONCE(ifp->idev->cnf.rtr_solicit_interval));
4364		ifp->idev->rs_probes = 1;
4365		ifp->idev->if_flags |= IF_RS_SENT;
4366		addrconf_mod_rs_timer(ifp->idev, ifp->idev->rs_interval);
4367		spin_unlock(&ifp->lock);
4368		write_unlock_bh(&ifp->idev->lock);
4369	}
4370
4371	if (bump_id)
4372		rt_genid_bump_ipv6(dev_net(dev));
4373
4374	/* Make sure that a new temporary address will be created
4375	 * before this temporary address becomes deprecated.
4376	 */
4377	if (ifp->flags & IFA_F_TEMPORARY)
4378		addrconf_verify_rtnl(dev_net(dev));
4379}
4380
4381static void addrconf_dad_run(struct inet6_dev *idev, bool restart)
4382{
4383	struct inet6_ifaddr *ifp;
4384
4385	read_lock_bh(&idev->lock);
4386	list_for_each_entry(ifp, &idev->addr_list, if_list) {
4387		spin_lock(&ifp->lock);
4388		if ((ifp->flags & IFA_F_TENTATIVE &&
4389		     ifp->state == INET6_IFADDR_STATE_DAD) || restart) {
4390			if (restart)
4391				ifp->state = INET6_IFADDR_STATE_PREDAD;
4392			addrconf_dad_kick(ifp);
4393		}
4394		spin_unlock(&ifp->lock);
4395	}
4396	read_unlock_bh(&idev->lock);
4397}
4398
4399#ifdef CONFIG_PROC_FS
4400struct if6_iter_state {
4401	struct seq_net_private p;
4402	int bucket;
4403	int offset;
4404};
4405
4406static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
4407{
4408	struct if6_iter_state *state = seq->private;
4409	struct net *net = seq_file_net(seq);
4410	struct inet6_ifaddr *ifa = NULL;
4411	int p = 0;
4412
4413	/* initial bucket if pos is 0 */
4414	if (pos == 0) {
4415		state->bucket = 0;
4416		state->offset = 0;
4417	}
4418
4419	for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
4420		hlist_for_each_entry_rcu(ifa, &net->ipv6.inet6_addr_lst[state->bucket],
4421					 addr_lst) {
4422			/* sync with offset */
4423			if (p < state->offset) {
4424				p++;
4425				continue;
4426			}
4427			return ifa;
4428		}
4429
4430		/* prepare for next bucket */
4431		state->offset = 0;
4432		p = 0;
4433	}
4434	return NULL;
4435}
4436
4437static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
4438					 struct inet6_ifaddr *ifa)
4439{
4440	struct if6_iter_state *state = seq->private;
4441	struct net *net = seq_file_net(seq);
4442
4443	hlist_for_each_entry_continue_rcu(ifa, addr_lst) {
4444		state->offset++;
4445		return ifa;
4446	}
4447
4448	state->offset = 0;
4449	while (++state->bucket < IN6_ADDR_HSIZE) {
4450		hlist_for_each_entry_rcu(ifa,
4451				     &net->ipv6.inet6_addr_lst[state->bucket], addr_lst) {
4452			return ifa;
4453		}
4454	}
4455
4456	return NULL;
4457}
4458
4459static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
4460	__acquires(rcu)
4461{
4462	rcu_read_lock();
4463	return if6_get_first(seq, *pos);
4464}
4465
4466static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
4467{
4468	struct inet6_ifaddr *ifa;
4469
4470	ifa = if6_get_next(seq, v);
4471	++*pos;
4472	return ifa;
4473}
4474
4475static void if6_seq_stop(struct seq_file *seq, void *v)
4476	__releases(rcu)
4477{
4478	rcu_read_unlock();
4479}
4480
4481static int if6_seq_show(struct seq_file *seq, void *v)
4482{
4483	struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
4484	seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
4485		   &ifp->addr,
4486		   ifp->idev->dev->ifindex,
4487		   ifp->prefix_len,
4488		   ifp->scope,
4489		   (u8) ifp->flags,
4490		   ifp->idev->dev->name);
4491	return 0;
4492}
4493
4494static const struct seq_operations if6_seq_ops = {
4495	.start	= if6_seq_start,
4496	.next	= if6_seq_next,
4497	.show	= if6_seq_show,
4498	.stop	= if6_seq_stop,
4499};
4500
4501static int __net_init if6_proc_net_init(struct net *net)
4502{
4503	if (!proc_create_net("if_inet6", 0444, net->proc_net, &if6_seq_ops,
4504			sizeof(struct if6_iter_state)))
4505		return -ENOMEM;
4506	return 0;
4507}
4508
4509static void __net_exit if6_proc_net_exit(struct net *net)
4510{
4511	remove_proc_entry("if_inet6", net->proc_net);
4512}
4513
4514static struct pernet_operations if6_proc_net_ops = {
4515	.init = if6_proc_net_init,
4516	.exit = if6_proc_net_exit,
4517};
4518
4519int __init if6_proc_init(void)
4520{
4521	return register_pernet_subsys(&if6_proc_net_ops);
4522}
4523
4524void if6_proc_exit(void)
4525{
4526	unregister_pernet_subsys(&if6_proc_net_ops);
4527}
4528#endif	/* CONFIG_PROC_FS */
4529
4530#if IS_ENABLED(CONFIG_IPV6_MIP6)
4531/* Check if address is a home address configured on any interface. */
4532int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
4533{
4534	unsigned int hash = inet6_addr_hash(net, addr);
4535	struct inet6_ifaddr *ifp = NULL;
4536	int ret = 0;
4537
4538	rcu_read_lock();
4539	hlist_for_each_entry_rcu(ifp, &net->ipv6.inet6_addr_lst[hash], addr_lst) {
4540		if (ipv6_addr_equal(&ifp->addr, addr) &&
4541		    (ifp->flags & IFA_F_HOMEADDRESS)) {
4542			ret = 1;
4543			break;
4544		}
4545	}
4546	rcu_read_unlock();
4547	return ret;
4548}
4549#endif
4550
4551/* RFC6554 has some algorithm to avoid loops in segment routing by
4552 * checking if the segments contains any of a local interface address.
4553 *
4554 * Quote:
4555 *
4556 * To detect loops in the SRH, a router MUST determine if the SRH
4557 * includes multiple addresses assigned to any interface on that router.
4558 * If such addresses appear more than once and are separated by at least
4559 * one address not assigned to that router.
4560 */
4561int ipv6_chk_rpl_srh_loop(struct net *net, const struct in6_addr *segs,
4562			  unsigned char nsegs)
4563{
4564	const struct in6_addr *addr;
4565	int i, ret = 0, found = 0;
4566	struct inet6_ifaddr *ifp;
4567	bool separated = false;
4568	unsigned int hash;
4569	bool hash_found;
4570
4571	rcu_read_lock();
4572	for (i = 0; i < nsegs; i++) {
4573		addr = &segs[i];
4574		hash = inet6_addr_hash(net, addr);
4575
4576		hash_found = false;
4577		hlist_for_each_entry_rcu(ifp, &net->ipv6.inet6_addr_lst[hash], addr_lst) {
4578
4579			if (ipv6_addr_equal(&ifp->addr, addr)) {
4580				hash_found = true;
4581				break;
4582			}
4583		}
4584
4585		if (hash_found) {
4586			if (found > 1 && separated) {
4587				ret = 1;
4588				break;
4589			}
4590
4591			separated = false;
4592			found++;
4593		} else {
4594			separated = true;
4595		}
4596	}
4597	rcu_read_unlock();
4598
4599	return ret;
4600}
4601
4602/*
4603 *	Periodic address status verification
4604 */
4605
4606static void addrconf_verify_rtnl(struct net *net)
4607{
4608	unsigned long now, next, next_sec, next_sched;
4609	struct inet6_ifaddr *ifp;
4610	int i;
4611
4612	ASSERT_RTNL();
4613
4614	rcu_read_lock_bh();
4615	now = jiffies;
4616	next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
4617
4618	cancel_delayed_work(&net->ipv6.addr_chk_work);
4619
4620	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
4621restart:
4622		hlist_for_each_entry_rcu_bh(ifp, &net->ipv6.inet6_addr_lst[i], addr_lst) {
4623			unsigned long age;
4624
4625			/* When setting preferred_lft to a value not zero or
4626			 * infinity, while valid_lft is infinity
4627			 * IFA_F_PERMANENT has a non-infinity life time.
4628			 */
4629			if ((ifp->flags & IFA_F_PERMANENT) &&
4630			    (ifp->prefered_lft == INFINITY_LIFE_TIME))
4631				continue;
4632
4633			spin_lock(&ifp->lock);
4634			/* We try to batch several events at once. */
4635			age = (now - ifp->tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
4636
4637			if ((ifp->flags&IFA_F_TEMPORARY) &&
4638			    !(ifp->flags&IFA_F_TENTATIVE) &&
4639			    ifp->prefered_lft != INFINITY_LIFE_TIME &&
4640			    !ifp->regen_count && ifp->ifpub) {
4641				/* This is a non-regenerated temporary addr. */
4642
4643				unsigned long regen_advance = ipv6_get_regen_advance(ifp->idev);
 
 
4644
4645				if (age + regen_advance >= ifp->prefered_lft) {
4646					struct inet6_ifaddr *ifpub = ifp->ifpub;
4647					if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
4648						next = ifp->tstamp + ifp->prefered_lft * HZ;
4649
4650					ifp->regen_count++;
4651					in6_ifa_hold(ifp);
4652					in6_ifa_hold(ifpub);
4653					spin_unlock(&ifp->lock);
4654
4655					spin_lock(&ifpub->lock);
4656					ifpub->regen_count = 0;
4657					spin_unlock(&ifpub->lock);
4658					rcu_read_unlock_bh();
4659					ipv6_create_tempaddr(ifpub, true);
4660					in6_ifa_put(ifpub);
4661					in6_ifa_put(ifp);
4662					rcu_read_lock_bh();
4663					goto restart;
4664				} else if (time_before(ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ, next))
4665					next = ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ;
4666			}
4667
4668			if (ifp->valid_lft != INFINITY_LIFE_TIME &&
4669			    age >= ifp->valid_lft) {
4670				spin_unlock(&ifp->lock);
4671				in6_ifa_hold(ifp);
4672				rcu_read_unlock_bh();
4673				ipv6_del_addr(ifp);
4674				rcu_read_lock_bh();
4675				goto restart;
4676			} else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
4677				spin_unlock(&ifp->lock);
4678				continue;
4679			} else if (age >= ifp->prefered_lft) {
4680				/* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
4681				int deprecate = 0;
4682
4683				if (!(ifp->flags&IFA_F_DEPRECATED)) {
4684					deprecate = 1;
4685					ifp->flags |= IFA_F_DEPRECATED;
4686				}
4687
4688				if ((ifp->valid_lft != INFINITY_LIFE_TIME) &&
4689				    (time_before(ifp->tstamp + ifp->valid_lft * HZ, next)))
4690					next = ifp->tstamp + ifp->valid_lft * HZ;
4691
4692				spin_unlock(&ifp->lock);
4693
4694				if (deprecate) {
4695					in6_ifa_hold(ifp);
4696
4697					ipv6_ifa_notify(0, ifp);
4698					in6_ifa_put(ifp);
4699					goto restart;
4700				}
4701			} else {
4702				/* ifp->prefered_lft <= ifp->valid_lft */
4703				if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
4704					next = ifp->tstamp + ifp->prefered_lft * HZ;
4705				spin_unlock(&ifp->lock);
4706			}
4707		}
4708	}
4709
4710	next_sec = round_jiffies_up(next);
4711	next_sched = next;
4712
4713	/* If rounded timeout is accurate enough, accept it. */
4714	if (time_before(next_sec, next + ADDRCONF_TIMER_FUZZ))
4715		next_sched = next_sec;
4716
4717	/* And minimum interval is ADDRCONF_TIMER_FUZZ_MAX. */
4718	if (time_before(next_sched, jiffies + ADDRCONF_TIMER_FUZZ_MAX))
4719		next_sched = jiffies + ADDRCONF_TIMER_FUZZ_MAX;
4720
4721	pr_debug("now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
4722		 now, next, next_sec, next_sched);
4723	mod_delayed_work(addrconf_wq, &net->ipv6.addr_chk_work, next_sched - now);
4724	rcu_read_unlock_bh();
4725}
4726
4727static void addrconf_verify_work(struct work_struct *w)
4728{
4729	struct net *net = container_of(to_delayed_work(w), struct net,
4730				       ipv6.addr_chk_work);
4731
4732	rtnl_lock();
4733	addrconf_verify_rtnl(net);
4734	rtnl_unlock();
4735}
4736
4737static void addrconf_verify(struct net *net)
4738{
4739	mod_delayed_work(addrconf_wq, &net->ipv6.addr_chk_work, 0);
4740}
4741
4742static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local,
4743				     struct in6_addr **peer_pfx)
4744{
4745	struct in6_addr *pfx = NULL;
4746
4747	*peer_pfx = NULL;
4748
4749	if (addr)
4750		pfx = nla_data(addr);
4751
4752	if (local) {
4753		if (pfx && nla_memcmp(local, pfx, sizeof(*pfx)))
4754			*peer_pfx = pfx;
4755		pfx = nla_data(local);
4756	}
4757
4758	return pfx;
4759}
4760
4761static const struct nla_policy ifa_ipv6_policy[IFA_MAX+1] = {
4762	[IFA_ADDRESS]		= { .len = sizeof(struct in6_addr) },
4763	[IFA_LOCAL]		= { .len = sizeof(struct in6_addr) },
4764	[IFA_CACHEINFO]		= { .len = sizeof(struct ifa_cacheinfo) },
4765	[IFA_FLAGS]		= { .len = sizeof(u32) },
4766	[IFA_RT_PRIORITY]	= { .len = sizeof(u32) },
4767	[IFA_TARGET_NETNSID]	= { .type = NLA_S32 },
4768	[IFA_PROTO]		= { .type = NLA_U8 },
4769};
4770
4771static int
4772inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh,
4773		  struct netlink_ext_ack *extack)
4774{
4775	struct net *net = sock_net(skb->sk);
4776	struct ifaddrmsg *ifm;
4777	struct nlattr *tb[IFA_MAX+1];
4778	struct in6_addr *pfx, *peer_pfx;
4779	u32 ifa_flags;
4780	int err;
4781
4782	err = nlmsg_parse_deprecated(nlh, sizeof(*ifm), tb, IFA_MAX,
4783				     ifa_ipv6_policy, extack);
4784	if (err < 0)
4785		return err;
4786
4787	ifm = nlmsg_data(nlh);
4788	pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
4789	if (!pfx)
4790		return -EINVAL;
4791
4792	ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) : ifm->ifa_flags;
4793
4794	/* We ignore other flags so far. */
4795	ifa_flags &= IFA_F_MANAGETEMPADDR;
4796
4797	return inet6_addr_del(net, ifm->ifa_index, ifa_flags, pfx,
4798			      ifm->ifa_prefixlen, extack);
4799}
4800
4801static int modify_prefix_route(struct inet6_ifaddr *ifp,
4802			       unsigned long expires, u32 flags,
4803			       bool modify_peer)
4804{
4805	struct fib6_table *table;
4806	struct fib6_info *f6i;
4807	u32 prio;
4808
4809	f6i = addrconf_get_prefix_route(modify_peer ? &ifp->peer_addr : &ifp->addr,
4810					ifp->prefix_len,
4811					ifp->idev->dev, 0, RTF_DEFAULT, true);
4812	if (!f6i)
4813		return -ENOENT;
4814
4815	prio = ifp->rt_priority ? : IP6_RT_PRIO_ADDRCONF;
4816	if (f6i->fib6_metric != prio) {
4817		/* delete old one */
4818		ip6_del_rt(dev_net(ifp->idev->dev), f6i, false);
4819
4820		/* add new one */
4821		addrconf_prefix_route(modify_peer ? &ifp->peer_addr : &ifp->addr,
4822				      ifp->prefix_len,
4823				      ifp->rt_priority, ifp->idev->dev,
4824				      expires, flags, GFP_KERNEL);
4825	} else {
4826		table = f6i->fib6_table;
4827		spin_lock_bh(&table->tb6_lock);
4828
4829		if (!(flags & RTF_EXPIRES)) {
4830			fib6_clean_expires(f6i);
4831			fib6_remove_gc_list(f6i);
4832		} else {
4833			fib6_set_expires(f6i, expires);
4834			fib6_add_gc_list(f6i);
4835		}
4836
4837		spin_unlock_bh(&table->tb6_lock);
4838
4839		fib6_info_release(f6i);
4840	}
4841
4842	return 0;
4843}
4844
4845static int inet6_addr_modify(struct net *net, struct inet6_ifaddr *ifp,
4846			     struct ifa6_config *cfg)
4847{
4848	u32 flags;
4849	clock_t expires;
4850	unsigned long timeout;
4851	bool was_managetempaddr;
4852	bool had_prefixroute;
4853	bool new_peer = false;
4854
4855	ASSERT_RTNL();
4856
4857	if (!cfg->valid_lft || cfg->preferred_lft > cfg->valid_lft)
4858		return -EINVAL;
4859
4860	if (cfg->ifa_flags & IFA_F_MANAGETEMPADDR &&
4861	    (ifp->flags & IFA_F_TEMPORARY || ifp->prefix_len != 64))
4862		return -EINVAL;
4863
4864	if (!(ifp->flags & IFA_F_TENTATIVE) || ifp->flags & IFA_F_DADFAILED)
4865		cfg->ifa_flags &= ~IFA_F_OPTIMISTIC;
4866
4867	timeout = addrconf_timeout_fixup(cfg->valid_lft, HZ);
4868	if (addrconf_finite_timeout(timeout)) {
4869		expires = jiffies_to_clock_t(timeout * HZ);
4870		cfg->valid_lft = timeout;
4871		flags = RTF_EXPIRES;
4872	} else {
4873		expires = 0;
4874		flags = 0;
4875		cfg->ifa_flags |= IFA_F_PERMANENT;
4876	}
4877
4878	timeout = addrconf_timeout_fixup(cfg->preferred_lft, HZ);
4879	if (addrconf_finite_timeout(timeout)) {
4880		if (timeout == 0)
4881			cfg->ifa_flags |= IFA_F_DEPRECATED;
4882		cfg->preferred_lft = timeout;
4883	}
4884
4885	if (cfg->peer_pfx &&
4886	    memcmp(&ifp->peer_addr, cfg->peer_pfx, sizeof(struct in6_addr))) {
4887		if (!ipv6_addr_any(&ifp->peer_addr))
4888			cleanup_prefix_route(ifp, expires, true, true);
4889		new_peer = true;
4890	}
4891
4892	spin_lock_bh(&ifp->lock);
4893	was_managetempaddr = ifp->flags & IFA_F_MANAGETEMPADDR;
4894	had_prefixroute = ifp->flags & IFA_F_PERMANENT &&
4895			  !(ifp->flags & IFA_F_NOPREFIXROUTE);
4896	ifp->flags &= ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD |
4897			IFA_F_HOMEADDRESS | IFA_F_MANAGETEMPADDR |
4898			IFA_F_NOPREFIXROUTE);
4899	ifp->flags |= cfg->ifa_flags;
4900	WRITE_ONCE(ifp->tstamp, jiffies);
4901	WRITE_ONCE(ifp->valid_lft, cfg->valid_lft);
4902	WRITE_ONCE(ifp->prefered_lft, cfg->preferred_lft);
4903	WRITE_ONCE(ifp->ifa_proto, cfg->ifa_proto);
4904
4905	if (cfg->rt_priority && cfg->rt_priority != ifp->rt_priority)
4906		WRITE_ONCE(ifp->rt_priority, cfg->rt_priority);
4907
4908	if (new_peer)
4909		ifp->peer_addr = *cfg->peer_pfx;
4910
4911	spin_unlock_bh(&ifp->lock);
4912	if (!(ifp->flags&IFA_F_TENTATIVE))
4913		ipv6_ifa_notify(0, ifp);
4914
4915	if (!(cfg->ifa_flags & IFA_F_NOPREFIXROUTE)) {
4916		int rc = -ENOENT;
4917
4918		if (had_prefixroute)
4919			rc = modify_prefix_route(ifp, expires, flags, false);
4920
4921		/* prefix route could have been deleted; if so restore it */
4922		if (rc == -ENOENT) {
4923			addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
4924					      ifp->rt_priority, ifp->idev->dev,
4925					      expires, flags, GFP_KERNEL);
4926		}
4927
4928		if (had_prefixroute && !ipv6_addr_any(&ifp->peer_addr))
4929			rc = modify_prefix_route(ifp, expires, flags, true);
4930
4931		if (rc == -ENOENT && !ipv6_addr_any(&ifp->peer_addr)) {
4932			addrconf_prefix_route(&ifp->peer_addr, ifp->prefix_len,
4933					      ifp->rt_priority, ifp->idev->dev,
4934					      expires, flags, GFP_KERNEL);
4935		}
4936	} else if (had_prefixroute) {
4937		enum cleanup_prefix_rt_t action;
4938		unsigned long rt_expires;
4939
4940		write_lock_bh(&ifp->idev->lock);
4941		action = check_cleanup_prefix_route(ifp, &rt_expires);
4942		write_unlock_bh(&ifp->idev->lock);
4943
4944		if (action != CLEANUP_PREFIX_RT_NOP) {
4945			cleanup_prefix_route(ifp, rt_expires,
4946				action == CLEANUP_PREFIX_RT_DEL, false);
4947		}
4948	}
4949
4950	if (was_managetempaddr || ifp->flags & IFA_F_MANAGETEMPADDR) {
4951		if (was_managetempaddr &&
4952		    !(ifp->flags & IFA_F_MANAGETEMPADDR)) {
4953			cfg->valid_lft = 0;
4954			cfg->preferred_lft = 0;
4955		}
4956		manage_tempaddrs(ifp->idev, ifp, cfg->valid_lft,
4957				 cfg->preferred_lft, !was_managetempaddr,
4958				 jiffies);
4959	}
4960
4961	addrconf_verify_rtnl(net);
4962
4963	return 0;
4964}
4965
4966static int
4967inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh,
4968		  struct netlink_ext_ack *extack)
4969{
4970	struct net *net = sock_net(skb->sk);
4971	struct ifaddrmsg *ifm;
4972	struct nlattr *tb[IFA_MAX+1];
4973	struct in6_addr *peer_pfx;
4974	struct inet6_ifaddr *ifa;
4975	struct net_device *dev;
4976	struct inet6_dev *idev;
4977	struct ifa6_config cfg;
4978	int err;
4979
4980	err = nlmsg_parse_deprecated(nlh, sizeof(*ifm), tb, IFA_MAX,
4981				     ifa_ipv6_policy, extack);
4982	if (err < 0)
4983		return err;
4984
4985	memset(&cfg, 0, sizeof(cfg));
4986
4987	ifm = nlmsg_data(nlh);
4988	cfg.pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
4989	if (!cfg.pfx)
4990		return -EINVAL;
4991
4992	cfg.peer_pfx = peer_pfx;
4993	cfg.plen = ifm->ifa_prefixlen;
4994	if (tb[IFA_RT_PRIORITY])
4995		cfg.rt_priority = nla_get_u32(tb[IFA_RT_PRIORITY]);
4996
4997	if (tb[IFA_PROTO])
4998		cfg.ifa_proto = nla_get_u8(tb[IFA_PROTO]);
4999
5000	cfg.valid_lft = INFINITY_LIFE_TIME;
5001	cfg.preferred_lft = INFINITY_LIFE_TIME;
5002
5003	if (tb[IFA_CACHEINFO]) {
5004		struct ifa_cacheinfo *ci;
5005
5006		ci = nla_data(tb[IFA_CACHEINFO]);
5007		cfg.valid_lft = ci->ifa_valid;
5008		cfg.preferred_lft = ci->ifa_prefered;
5009	}
5010
5011	dev =  __dev_get_by_index(net, ifm->ifa_index);
5012	if (!dev) {
5013		NL_SET_ERR_MSG_MOD(extack, "Unable to find the interface");
5014		return -ENODEV;
5015	}
5016
5017	if (tb[IFA_FLAGS])
5018		cfg.ifa_flags = nla_get_u32(tb[IFA_FLAGS]);
5019	else
5020		cfg.ifa_flags = ifm->ifa_flags;
5021
5022	/* We ignore other flags so far. */
5023	cfg.ifa_flags &= IFA_F_NODAD | IFA_F_HOMEADDRESS |
5024			 IFA_F_MANAGETEMPADDR | IFA_F_NOPREFIXROUTE |
5025			 IFA_F_MCAUTOJOIN | IFA_F_OPTIMISTIC;
5026
5027	idev = ipv6_find_idev(dev);
5028	if (IS_ERR(idev))
5029		return PTR_ERR(idev);
5030
5031	if (!ipv6_allow_optimistic_dad(net, idev))
5032		cfg.ifa_flags &= ~IFA_F_OPTIMISTIC;
5033
5034	if (cfg.ifa_flags & IFA_F_NODAD &&
5035	    cfg.ifa_flags & IFA_F_OPTIMISTIC) {
5036		NL_SET_ERR_MSG(extack, "IFA_F_NODAD and IFA_F_OPTIMISTIC are mutually exclusive");
5037		return -EINVAL;
5038	}
5039
5040	ifa = ipv6_get_ifaddr(net, cfg.pfx, dev, 1);
5041	if (!ifa) {
5042		/*
5043		 * It would be best to check for !NLM_F_CREATE here but
5044		 * userspace already relies on not having to provide this.
5045		 */
5046		return inet6_addr_add(net, ifm->ifa_index, &cfg, extack);
5047	}
5048
5049	if (nlh->nlmsg_flags & NLM_F_EXCL ||
5050	    !(nlh->nlmsg_flags & NLM_F_REPLACE)) {
5051		NL_SET_ERR_MSG_MOD(extack, "address already assigned");
5052		err = -EEXIST;
5053	} else {
5054		err = inet6_addr_modify(net, ifa, &cfg);
5055	}
5056
5057	in6_ifa_put(ifa);
5058
5059	return err;
5060}
5061
5062static void put_ifaddrmsg(struct nlmsghdr *nlh, u8 prefixlen, u32 flags,
5063			  u8 scope, int ifindex)
5064{
5065	struct ifaddrmsg *ifm;
5066
5067	ifm = nlmsg_data(nlh);
5068	ifm->ifa_family = AF_INET6;
5069	ifm->ifa_prefixlen = prefixlen;
5070	ifm->ifa_flags = flags;
5071	ifm->ifa_scope = scope;
5072	ifm->ifa_index = ifindex;
5073}
5074
5075static int put_cacheinfo(struct sk_buff *skb, unsigned long cstamp,
5076			 unsigned long tstamp, u32 preferred, u32 valid)
5077{
5078	struct ifa_cacheinfo ci;
5079
5080	ci.cstamp = cstamp_delta(cstamp);
5081	ci.tstamp = cstamp_delta(tstamp);
5082	ci.ifa_prefered = preferred;
5083	ci.ifa_valid = valid;
5084
5085	return nla_put(skb, IFA_CACHEINFO, sizeof(ci), &ci);
5086}
5087
5088static inline int rt_scope(int ifa_scope)
5089{
5090	if (ifa_scope & IFA_HOST)
5091		return RT_SCOPE_HOST;
5092	else if (ifa_scope & IFA_LINK)
5093		return RT_SCOPE_LINK;
5094	else if (ifa_scope & IFA_SITE)
5095		return RT_SCOPE_SITE;
5096	else
5097		return RT_SCOPE_UNIVERSE;
5098}
5099
5100static inline int inet6_ifaddr_msgsize(void)
5101{
5102	return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
5103	       + nla_total_size(16) /* IFA_LOCAL */
5104	       + nla_total_size(16) /* IFA_ADDRESS */
5105	       + nla_total_size(sizeof(struct ifa_cacheinfo))
5106	       + nla_total_size(4)  /* IFA_FLAGS */
5107	       + nla_total_size(1)  /* IFA_PROTO */
5108	       + nla_total_size(4)  /* IFA_RT_PRIORITY */;
5109}
5110
5111enum addr_type_t {
5112	UNICAST_ADDR,
5113	MULTICAST_ADDR,
5114	ANYCAST_ADDR,
5115};
5116
5117struct inet6_fill_args {
5118	u32 portid;
5119	u32 seq;
5120	int event;
5121	unsigned int flags;
5122	int netnsid;
5123	int ifindex;
5124	enum addr_type_t type;
5125};
5126
5127static int inet6_fill_ifaddr(struct sk_buff *skb,
5128			     const struct inet6_ifaddr *ifa,
5129			     struct inet6_fill_args *args)
5130{
5131	struct nlmsghdr *nlh;
5132	u32 preferred, valid;
5133	u32 flags, priority;
5134	u8 proto;
5135
5136	nlh = nlmsg_put(skb, args->portid, args->seq, args->event,
5137			sizeof(struct ifaddrmsg), args->flags);
5138	if (!nlh)
5139		return -EMSGSIZE;
5140
5141	flags = READ_ONCE(ifa->flags);
5142	put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
5143		      ifa->idev->dev->ifindex);
5144
5145	if (args->netnsid >= 0 &&
5146	    nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid))
5147		goto error;
5148
5149	preferred = READ_ONCE(ifa->prefered_lft);
5150	valid = READ_ONCE(ifa->valid_lft);
5151
5152	if (!((flags & IFA_F_PERMANENT) &&
5153	      (preferred == INFINITY_LIFE_TIME))) {
5154		if (preferred != INFINITY_LIFE_TIME) {
5155			long tval = (jiffies - READ_ONCE(ifa->tstamp)) / HZ;
5156
5157			if (preferred > tval)
5158				preferred -= tval;
5159			else
5160				preferred = 0;
5161			if (valid != INFINITY_LIFE_TIME) {
5162				if (valid > tval)
5163					valid -= tval;
5164				else
5165					valid = 0;
5166			}
5167		}
5168	} else {
5169		preferred = INFINITY_LIFE_TIME;
5170		valid = INFINITY_LIFE_TIME;
5171	}
 
5172
5173	if (!ipv6_addr_any(&ifa->peer_addr)) {
5174		if (nla_put_in6_addr(skb, IFA_LOCAL, &ifa->addr) < 0 ||
5175		    nla_put_in6_addr(skb, IFA_ADDRESS, &ifa->peer_addr) < 0)
5176			goto error;
5177	} else {
5178		if (nla_put_in6_addr(skb, IFA_ADDRESS, &ifa->addr) < 0)
5179			goto error;
5180	}
5181
5182	priority = READ_ONCE(ifa->rt_priority);
5183	if (priority && nla_put_u32(skb, IFA_RT_PRIORITY, priority))
5184		goto error;
5185
5186	if (put_cacheinfo(skb, ifa->cstamp, READ_ONCE(ifa->tstamp),
5187			  preferred, valid) < 0)
5188		goto error;
5189
5190	if (nla_put_u32(skb, IFA_FLAGS, flags) < 0)
5191		goto error;
5192
5193	proto = READ_ONCE(ifa->ifa_proto);
5194	if (proto && nla_put_u8(skb, IFA_PROTO, proto))
5195		goto error;
5196
5197	nlmsg_end(skb, nlh);
5198	return 0;
5199
5200error:
5201	nlmsg_cancel(skb, nlh);
5202	return -EMSGSIZE;
5203}
5204
5205static int inet6_fill_ifmcaddr(struct sk_buff *skb,
5206			       const struct ifmcaddr6 *ifmca,
5207			       struct inet6_fill_args *args)
5208{
5209	int ifindex = ifmca->idev->dev->ifindex;
5210	u8 scope = RT_SCOPE_UNIVERSE;
5211	struct nlmsghdr *nlh;
5212
5213	if (ipv6_addr_scope(&ifmca->mca_addr) & IFA_SITE)
5214		scope = RT_SCOPE_SITE;
5215
5216	nlh = nlmsg_put(skb, args->portid, args->seq, args->event,
5217			sizeof(struct ifaddrmsg), args->flags);
5218	if (!nlh)
5219		return -EMSGSIZE;
5220
5221	if (args->netnsid >= 0 &&
5222	    nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
5223		nlmsg_cancel(skb, nlh);
5224		return -EMSGSIZE;
5225	}
5226
5227	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
5228	if (nla_put_in6_addr(skb, IFA_MULTICAST, &ifmca->mca_addr) < 0 ||
5229	    put_cacheinfo(skb, ifmca->mca_cstamp, READ_ONCE(ifmca->mca_tstamp),
5230			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
5231		nlmsg_cancel(skb, nlh);
5232		return -EMSGSIZE;
5233	}
5234
5235	nlmsg_end(skb, nlh);
5236	return 0;
5237}
5238
5239static int inet6_fill_ifacaddr(struct sk_buff *skb,
5240			       const struct ifacaddr6 *ifaca,
5241			       struct inet6_fill_args *args)
5242{
5243	struct net_device *dev = fib6_info_nh_dev(ifaca->aca_rt);
5244	int ifindex = dev ? dev->ifindex : 1;
 
5245	u8 scope = RT_SCOPE_UNIVERSE;
5246	struct nlmsghdr *nlh;
5247
5248	if (ipv6_addr_scope(&ifaca->aca_addr) & IFA_SITE)
5249		scope = RT_SCOPE_SITE;
5250
5251	nlh = nlmsg_put(skb, args->portid, args->seq, args->event,
5252			sizeof(struct ifaddrmsg), args->flags);
5253	if (!nlh)
5254		return -EMSGSIZE;
5255
5256	if (args->netnsid >= 0 &&
5257	    nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
5258		nlmsg_cancel(skb, nlh);
5259		return -EMSGSIZE;
5260	}
5261
5262	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
5263	if (nla_put_in6_addr(skb, IFA_ANYCAST, &ifaca->aca_addr) < 0 ||
5264	    put_cacheinfo(skb, ifaca->aca_cstamp, READ_ONCE(ifaca->aca_tstamp),
5265			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
5266		nlmsg_cancel(skb, nlh);
5267		return -EMSGSIZE;
5268	}
5269
5270	nlmsg_end(skb, nlh);
5271	return 0;
5272}
5273
5274/* called with rcu_read_lock() */
5275static int in6_dump_addrs(const struct inet6_dev *idev, struct sk_buff *skb,
5276			  struct netlink_callback *cb, int *s_ip_idx,
5277			  struct inet6_fill_args *fillargs)
5278{
5279	const struct ifmcaddr6 *ifmca;
5280	const struct ifacaddr6 *ifaca;
5281	int ip_idx = 0;
5282	int err = 0;
5283
 
5284	switch (fillargs->type) {
5285	case UNICAST_ADDR: {
5286		const struct inet6_ifaddr *ifa;
5287		fillargs->event = RTM_NEWADDR;
5288
5289		/* unicast address incl. temp addr */
5290		list_for_each_entry_rcu(ifa, &idev->addr_list, if_list) {
5291			if (ip_idx < *s_ip_idx)
5292				goto next;
5293			err = inet6_fill_ifaddr(skb, ifa, fillargs);
5294			if (err < 0)
5295				break;
5296			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
5297next:
5298			ip_idx++;
5299		}
5300		break;
5301	}
5302	case MULTICAST_ADDR:
 
5303		fillargs->event = RTM_GETMULTICAST;
5304
5305		/* multicast address */
5306		for (ifmca = rcu_dereference(idev->mc_list);
5307		     ifmca;
5308		     ifmca = rcu_dereference(ifmca->next), ip_idx++) {
5309			if (ip_idx < *s_ip_idx)
5310				continue;
5311			err = inet6_fill_ifmcaddr(skb, ifmca, fillargs);
5312			if (err < 0)
5313				break;
5314		}
 
5315		break;
5316	case ANYCAST_ADDR:
5317		fillargs->event = RTM_GETANYCAST;
5318		/* anycast address */
5319		for (ifaca = rcu_dereference(idev->ac_list); ifaca;
5320		     ifaca = rcu_dereference(ifaca->aca_next), ip_idx++) {
5321			if (ip_idx < *s_ip_idx)
5322				continue;
5323			err = inet6_fill_ifacaddr(skb, ifaca, fillargs);
5324			if (err < 0)
5325				break;
5326		}
5327		break;
5328	default:
5329		break;
5330	}
5331	*s_ip_idx = err ? ip_idx : 0;
 
5332	return err;
5333}
5334
5335static int inet6_valid_dump_ifaddr_req(const struct nlmsghdr *nlh,
5336				       struct inet6_fill_args *fillargs,
5337				       struct net **tgt_net, struct sock *sk,
5338				       struct netlink_callback *cb)
5339{
5340	struct netlink_ext_ack *extack = cb->extack;
5341	struct nlattr *tb[IFA_MAX+1];
5342	struct ifaddrmsg *ifm;
5343	int err, i;
5344
5345	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ifm))) {
5346		NL_SET_ERR_MSG_MOD(extack, "Invalid header for address dump request");
5347		return -EINVAL;
5348	}
5349
5350	ifm = nlmsg_data(nlh);
5351	if (ifm->ifa_prefixlen || ifm->ifa_flags || ifm->ifa_scope) {
5352		NL_SET_ERR_MSG_MOD(extack, "Invalid values in header for address dump request");
5353		return -EINVAL;
5354	}
5355
5356	fillargs->ifindex = ifm->ifa_index;
5357	if (fillargs->ifindex) {
5358		cb->answer_flags |= NLM_F_DUMP_FILTERED;
5359		fillargs->flags |= NLM_F_DUMP_FILTERED;
5360	}
5361
5362	err = nlmsg_parse_deprecated_strict(nlh, sizeof(*ifm), tb, IFA_MAX,
5363					    ifa_ipv6_policy, extack);
5364	if (err < 0)
5365		return err;
5366
5367	for (i = 0; i <= IFA_MAX; ++i) {
5368		if (!tb[i])
5369			continue;
5370
5371		if (i == IFA_TARGET_NETNSID) {
5372			struct net *net;
5373
5374			fillargs->netnsid = nla_get_s32(tb[i]);
5375			net = rtnl_get_net_ns_capable(sk, fillargs->netnsid);
5376			if (IS_ERR(net)) {
5377				fillargs->netnsid = -1;
5378				NL_SET_ERR_MSG_MOD(extack, "Invalid target network namespace id");
5379				return PTR_ERR(net);
5380			}
5381			*tgt_net = net;
5382		} else {
5383			NL_SET_ERR_MSG_MOD(extack, "Unsupported attribute in dump request");
5384			return -EINVAL;
5385		}
5386	}
5387
5388	return 0;
5389}
5390
5391static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
5392			   enum addr_type_t type)
5393{
5394	struct net *tgt_net = sock_net(skb->sk);
5395	const struct nlmsghdr *nlh = cb->nlh;
5396	struct inet6_fill_args fillargs = {
5397		.portid = NETLINK_CB(cb->skb).portid,
5398		.seq = cb->nlh->nlmsg_seq,
5399		.flags = NLM_F_MULTI,
5400		.netnsid = -1,
5401		.type = type,
5402	};
5403	struct {
5404		unsigned long ifindex;
5405		int ip_idx;
5406	} *ctx = (void *)cb->ctx;
5407	struct net_device *dev;
5408	struct inet6_dev *idev;
 
5409	int err = 0;
5410
5411	rcu_read_lock();
 
 
 
5412	if (cb->strict_check) {
5413		err = inet6_valid_dump_ifaddr_req(nlh, &fillargs, &tgt_net,
5414						  skb->sk, cb);
5415		if (err < 0)
5416			goto done;
5417
5418		err = 0;
5419		if (fillargs.ifindex) {
5420			dev = dev_get_by_index_rcu(tgt_net, fillargs.ifindex);
5421			if (!dev) {
5422				err = -ENODEV;
5423				goto done;
5424			}
5425			idev = __in6_dev_get(dev);
5426			if (idev)
5427				err = in6_dump_addrs(idev, skb, cb,
5428						     &ctx->ip_idx,
5429						     &fillargs);
5430			goto done;
 
 
 
5431		}
5432	}
5433
5434	cb->seq = inet6_base_seq(tgt_net);
5435	for_each_netdev_dump(tgt_net, dev, ctx->ifindex) {
5436		idev = __in6_dev_get(dev);
5437		if (!idev)
5438			continue;
5439		err = in6_dump_addrs(idev, skb, cb, &ctx->ip_idx,
5440				     &fillargs);
5441		if (err < 0)
5442			goto done;
 
 
 
 
 
 
 
 
 
 
 
5443	}
5444done:
5445	rcu_read_unlock();
 
 
 
5446	if (fillargs.netnsid >= 0)
5447		put_net(tgt_net);
5448
5449	return err;
5450}
5451
5452static int inet6_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
5453{
5454	enum addr_type_t type = UNICAST_ADDR;
5455
5456	return inet6_dump_addr(skb, cb, type);
5457}
5458
5459static int inet6_dump_ifmcaddr(struct sk_buff *skb, struct netlink_callback *cb)
5460{
5461	enum addr_type_t type = MULTICAST_ADDR;
5462
5463	return inet6_dump_addr(skb, cb, type);
5464}
5465
5466
5467static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
5468{
5469	enum addr_type_t type = ANYCAST_ADDR;
5470
5471	return inet6_dump_addr(skb, cb, type);
5472}
5473
5474static int inet6_rtm_valid_getaddr_req(struct sk_buff *skb,
5475				       const struct nlmsghdr *nlh,
5476				       struct nlattr **tb,
5477				       struct netlink_ext_ack *extack)
5478{
5479	struct ifaddrmsg *ifm;
5480	int i, err;
5481
5482	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ifm))) {
5483		NL_SET_ERR_MSG_MOD(extack, "Invalid header for get address request");
5484		return -EINVAL;
5485	}
5486
5487	if (!netlink_strict_get_check(skb))
5488		return nlmsg_parse_deprecated(nlh, sizeof(*ifm), tb, IFA_MAX,
5489					      ifa_ipv6_policy, extack);
5490
5491	ifm = nlmsg_data(nlh);
5492	if (ifm->ifa_prefixlen || ifm->ifa_flags || ifm->ifa_scope) {
5493		NL_SET_ERR_MSG_MOD(extack, "Invalid values in header for get address request");
5494		return -EINVAL;
5495	}
5496
5497	err = nlmsg_parse_deprecated_strict(nlh, sizeof(*ifm), tb, IFA_MAX,
5498					    ifa_ipv6_policy, extack);
5499	if (err)
5500		return err;
5501
5502	for (i = 0; i <= IFA_MAX; i++) {
5503		if (!tb[i])
5504			continue;
5505
5506		switch (i) {
5507		case IFA_TARGET_NETNSID:
5508		case IFA_ADDRESS:
5509		case IFA_LOCAL:
5510			break;
5511		default:
5512			NL_SET_ERR_MSG_MOD(extack, "Unsupported attribute in get address request");
5513			return -EINVAL;
5514		}
5515	}
5516
5517	return 0;
5518}
5519
5520static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh,
5521			     struct netlink_ext_ack *extack)
5522{
5523	struct net *tgt_net = sock_net(in_skb->sk);
5524	struct inet6_fill_args fillargs = {
5525		.portid = NETLINK_CB(in_skb).portid,
5526		.seq = nlh->nlmsg_seq,
5527		.event = RTM_NEWADDR,
5528		.flags = 0,
5529		.netnsid = -1,
5530	};
5531	struct ifaddrmsg *ifm;
5532	struct nlattr *tb[IFA_MAX+1];
5533	struct in6_addr *addr = NULL, *peer;
5534	struct net_device *dev = NULL;
5535	struct inet6_ifaddr *ifa;
5536	struct sk_buff *skb;
5537	int err;
5538
5539	err = inet6_rtm_valid_getaddr_req(in_skb, nlh, tb, extack);
5540	if (err < 0)
5541		return err;
5542
5543	if (tb[IFA_TARGET_NETNSID]) {
5544		fillargs.netnsid = nla_get_s32(tb[IFA_TARGET_NETNSID]);
5545
5546		tgt_net = rtnl_get_net_ns_capable(NETLINK_CB(in_skb).sk,
5547						  fillargs.netnsid);
5548		if (IS_ERR(tgt_net))
5549			return PTR_ERR(tgt_net);
5550	}
5551
5552	addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer);
5553	if (!addr) {
5554		err = -EINVAL;
5555		goto errout;
5556	}
5557	ifm = nlmsg_data(nlh);
5558	if (ifm->ifa_index)
5559		dev = dev_get_by_index(tgt_net, ifm->ifa_index);
5560
5561	ifa = ipv6_get_ifaddr(tgt_net, addr, dev, 1);
5562	if (!ifa) {
5563		err = -EADDRNOTAVAIL;
5564		goto errout;
5565	}
5566
5567	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_KERNEL);
5568	if (!skb) {
5569		err = -ENOBUFS;
5570		goto errout_ifa;
5571	}
5572
5573	err = inet6_fill_ifaddr(skb, ifa, &fillargs);
5574	if (err < 0) {
5575		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
5576		WARN_ON(err == -EMSGSIZE);
5577		kfree_skb(skb);
5578		goto errout_ifa;
5579	}
5580	err = rtnl_unicast(skb, tgt_net, NETLINK_CB(in_skb).portid);
5581errout_ifa:
5582	in6_ifa_put(ifa);
5583errout:
5584	dev_put(dev);
5585	if (fillargs.netnsid >= 0)
5586		put_net(tgt_net);
5587
5588	return err;
5589}
5590
5591static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
5592{
5593	struct sk_buff *skb;
5594	struct net *net = dev_net(ifa->idev->dev);
5595	struct inet6_fill_args fillargs = {
5596		.portid = 0,
5597		.seq = 0,
5598		.event = event,
5599		.flags = 0,
5600		.netnsid = -1,
5601	};
5602	int err = -ENOBUFS;
5603
5604	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_ATOMIC);
5605	if (!skb)
5606		goto errout;
5607
5608	err = inet6_fill_ifaddr(skb, ifa, &fillargs);
5609	if (err < 0) {
5610		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
5611		WARN_ON(err == -EMSGSIZE);
5612		kfree_skb(skb);
5613		goto errout;
5614	}
5615	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
5616	return;
5617errout:
5618	if (err < 0)
5619		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err);
5620}
5621
5622static void ipv6_store_devconf(const struct ipv6_devconf *cnf,
5623			       __s32 *array, int bytes)
5624{
5625	BUG_ON(bytes < (DEVCONF_MAX * 4));
5626
5627	memset(array, 0, bytes);
5628	array[DEVCONF_FORWARDING] = READ_ONCE(cnf->forwarding);
5629	array[DEVCONF_HOPLIMIT] = READ_ONCE(cnf->hop_limit);
5630	array[DEVCONF_MTU6] = READ_ONCE(cnf->mtu6);
5631	array[DEVCONF_ACCEPT_RA] = READ_ONCE(cnf->accept_ra);
5632	array[DEVCONF_ACCEPT_REDIRECTS] = READ_ONCE(cnf->accept_redirects);
5633	array[DEVCONF_AUTOCONF] = READ_ONCE(cnf->autoconf);
5634	array[DEVCONF_DAD_TRANSMITS] = READ_ONCE(cnf->dad_transmits);
5635	array[DEVCONF_RTR_SOLICITS] = READ_ONCE(cnf->rtr_solicits);
5636	array[DEVCONF_RTR_SOLICIT_INTERVAL] =
5637		jiffies_to_msecs(READ_ONCE(cnf->rtr_solicit_interval));
5638	array[DEVCONF_RTR_SOLICIT_MAX_INTERVAL] =
5639		jiffies_to_msecs(READ_ONCE(cnf->rtr_solicit_max_interval));
5640	array[DEVCONF_RTR_SOLICIT_DELAY] =
5641		jiffies_to_msecs(READ_ONCE(cnf->rtr_solicit_delay));
5642	array[DEVCONF_FORCE_MLD_VERSION] = READ_ONCE(cnf->force_mld_version);
5643	array[DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL] =
5644		jiffies_to_msecs(READ_ONCE(cnf->mldv1_unsolicited_report_interval));
5645	array[DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL] =
5646		jiffies_to_msecs(READ_ONCE(cnf->mldv2_unsolicited_report_interval));
5647	array[DEVCONF_USE_TEMPADDR] = READ_ONCE(cnf->use_tempaddr);
5648	array[DEVCONF_TEMP_VALID_LFT] = READ_ONCE(cnf->temp_valid_lft);
5649	array[DEVCONF_TEMP_PREFERED_LFT] = READ_ONCE(cnf->temp_prefered_lft);
5650	array[DEVCONF_REGEN_MAX_RETRY] = READ_ONCE(cnf->regen_max_retry);
5651	array[DEVCONF_MAX_DESYNC_FACTOR] = READ_ONCE(cnf->max_desync_factor);
5652	array[DEVCONF_MAX_ADDRESSES] = READ_ONCE(cnf->max_addresses);
5653	array[DEVCONF_ACCEPT_RA_DEFRTR] = READ_ONCE(cnf->accept_ra_defrtr);
5654	array[DEVCONF_RA_DEFRTR_METRIC] = READ_ONCE(cnf->ra_defrtr_metric);
5655	array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] =
5656		READ_ONCE(cnf->accept_ra_min_hop_limit);
5657	array[DEVCONF_ACCEPT_RA_PINFO] = READ_ONCE(cnf->accept_ra_pinfo);
5658#ifdef CONFIG_IPV6_ROUTER_PREF
5659	array[DEVCONF_ACCEPT_RA_RTR_PREF] = READ_ONCE(cnf->accept_ra_rtr_pref);
5660	array[DEVCONF_RTR_PROBE_INTERVAL] =
5661		jiffies_to_msecs(READ_ONCE(cnf->rtr_probe_interval));
5662#ifdef CONFIG_IPV6_ROUTE_INFO
5663	array[DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN] =
5664		READ_ONCE(cnf->accept_ra_rt_info_min_plen);
5665	array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] =
5666		READ_ONCE(cnf->accept_ra_rt_info_max_plen);
5667#endif
5668#endif
5669	array[DEVCONF_PROXY_NDP] = READ_ONCE(cnf->proxy_ndp);
5670	array[DEVCONF_ACCEPT_SOURCE_ROUTE] =
5671		READ_ONCE(cnf->accept_source_route);
5672#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
5673	array[DEVCONF_OPTIMISTIC_DAD] = READ_ONCE(cnf->optimistic_dad);
5674	array[DEVCONF_USE_OPTIMISTIC] = READ_ONCE(cnf->use_optimistic);
5675#endif
5676#ifdef CONFIG_IPV6_MROUTE
5677	array[DEVCONF_MC_FORWARDING] = atomic_read(&cnf->mc_forwarding);
5678#endif
5679	array[DEVCONF_DISABLE_IPV6] = READ_ONCE(cnf->disable_ipv6);
5680	array[DEVCONF_ACCEPT_DAD] = READ_ONCE(cnf->accept_dad);
5681	array[DEVCONF_FORCE_TLLAO] = READ_ONCE(cnf->force_tllao);
5682	array[DEVCONF_NDISC_NOTIFY] = READ_ONCE(cnf->ndisc_notify);
5683	array[DEVCONF_SUPPRESS_FRAG_NDISC] =
5684		READ_ONCE(cnf->suppress_frag_ndisc);
5685	array[DEVCONF_ACCEPT_RA_FROM_LOCAL] =
5686		READ_ONCE(cnf->accept_ra_from_local);
5687	array[DEVCONF_ACCEPT_RA_MTU] = READ_ONCE(cnf->accept_ra_mtu);
5688	array[DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN] =
5689		READ_ONCE(cnf->ignore_routes_with_linkdown);
5690	/* we omit DEVCONF_STABLE_SECRET for now */
5691	array[DEVCONF_USE_OIF_ADDRS_ONLY] = READ_ONCE(cnf->use_oif_addrs_only);
5692	array[DEVCONF_DROP_UNICAST_IN_L2_MULTICAST] =
5693		READ_ONCE(cnf->drop_unicast_in_l2_multicast);
5694	array[DEVCONF_DROP_UNSOLICITED_NA] = READ_ONCE(cnf->drop_unsolicited_na);
5695	array[DEVCONF_KEEP_ADDR_ON_DOWN] = READ_ONCE(cnf->keep_addr_on_down);
5696	array[DEVCONF_SEG6_ENABLED] = READ_ONCE(cnf->seg6_enabled);
5697#ifdef CONFIG_IPV6_SEG6_HMAC
5698	array[DEVCONF_SEG6_REQUIRE_HMAC] = READ_ONCE(cnf->seg6_require_hmac);
5699#endif
5700	array[DEVCONF_ENHANCED_DAD] = READ_ONCE(cnf->enhanced_dad);
5701	array[DEVCONF_ADDR_GEN_MODE] = READ_ONCE(cnf->addr_gen_mode);
5702	array[DEVCONF_DISABLE_POLICY] = READ_ONCE(cnf->disable_policy);
5703	array[DEVCONF_NDISC_TCLASS] = READ_ONCE(cnf->ndisc_tclass);
5704	array[DEVCONF_RPL_SEG_ENABLED] = READ_ONCE(cnf->rpl_seg_enabled);
5705	array[DEVCONF_IOAM6_ENABLED] = READ_ONCE(cnf->ioam6_enabled);
5706	array[DEVCONF_IOAM6_ID] = READ_ONCE(cnf->ioam6_id);
5707	array[DEVCONF_IOAM6_ID_WIDE] = READ_ONCE(cnf->ioam6_id_wide);
5708	array[DEVCONF_NDISC_EVICT_NOCARRIER] =
5709		READ_ONCE(cnf->ndisc_evict_nocarrier);
5710	array[DEVCONF_ACCEPT_UNTRACKED_NA] =
5711		READ_ONCE(cnf->accept_untracked_na);
5712	array[DEVCONF_ACCEPT_RA_MIN_LFT] = READ_ONCE(cnf->accept_ra_min_lft);
5713}
5714
5715static inline size_t inet6_ifla6_size(void)
5716{
5717	return nla_total_size(4) /* IFLA_INET6_FLAGS */
5718	     + nla_total_size(sizeof(struct ifla_cacheinfo))
5719	     + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
5720	     + nla_total_size(IPSTATS_MIB_MAX * 8) /* IFLA_INET6_STATS */
5721	     + nla_total_size(ICMP6_MIB_MAX * 8) /* IFLA_INET6_ICMP6STATS */
5722	     + nla_total_size(sizeof(struct in6_addr)) /* IFLA_INET6_TOKEN */
5723	     + nla_total_size(1) /* IFLA_INET6_ADDR_GEN_MODE */
5724	     + nla_total_size(4) /* IFLA_INET6_RA_MTU */
5725	     + 0;
5726}
5727
5728static inline size_t inet6_if_nlmsg_size(void)
5729{
5730	return NLMSG_ALIGN(sizeof(struct ifinfomsg))
5731	       + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
5732	       + nla_total_size(MAX_ADDR_LEN) /* IFLA_ADDRESS */
5733	       + nla_total_size(4) /* IFLA_MTU */
5734	       + nla_total_size(4) /* IFLA_LINK */
5735	       + nla_total_size(1) /* IFLA_OPERSTATE */
5736	       + nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */
5737}
5738
5739static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
5740					int bytes)
5741{
5742	int i;
5743	int pad = bytes - sizeof(u64) * ICMP6_MIB_MAX;
5744	BUG_ON(pad < 0);
5745
5746	/* Use put_unaligned() because stats may not be aligned for u64. */
5747	put_unaligned(ICMP6_MIB_MAX, &stats[0]);
5748	for (i = 1; i < ICMP6_MIB_MAX; i++)
5749		put_unaligned(atomic_long_read(&mib[i]), &stats[i]);
5750
5751	memset(&stats[ICMP6_MIB_MAX], 0, pad);
5752}
5753
5754static inline void __snmp6_fill_stats64(u64 *stats, void __percpu *mib,
5755					int bytes, size_t syncpoff)
5756{
5757	int i, c;
5758	u64 buff[IPSTATS_MIB_MAX];
5759	int pad = bytes - sizeof(u64) * IPSTATS_MIB_MAX;
5760
5761	BUG_ON(pad < 0);
5762
5763	memset(buff, 0, sizeof(buff));
5764	buff[0] = IPSTATS_MIB_MAX;
5765
5766	for_each_possible_cpu(c) {
5767		for (i = 1; i < IPSTATS_MIB_MAX; i++)
5768			buff[i] += snmp_get_cpu_field64(mib, c, i, syncpoff);
5769	}
5770
5771	memcpy(stats, buff, IPSTATS_MIB_MAX * sizeof(u64));
5772	memset(&stats[IPSTATS_MIB_MAX], 0, pad);
5773}
5774
5775static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
5776			     int bytes)
5777{
5778	switch (attrtype) {
5779	case IFLA_INET6_STATS:
5780		__snmp6_fill_stats64(stats, idev->stats.ipv6, bytes,
5781				     offsetof(struct ipstats_mib, syncp));
5782		break;
5783	case IFLA_INET6_ICMP6STATS:
5784		__snmp6_fill_statsdev(stats, idev->stats.icmpv6dev->mibs, bytes);
5785		break;
5786	}
5787}
5788
5789static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev,
5790				  u32 ext_filter_mask)
5791{
5792	struct ifla_cacheinfo ci;
5793	struct nlattr *nla;
5794	u32 ra_mtu;
5795
5796	if (nla_put_u32(skb, IFLA_INET6_FLAGS, READ_ONCE(idev->if_flags)))
5797		goto nla_put_failure;
5798	ci.max_reasm_len = IPV6_MAXPLEN;
5799	ci.tstamp = cstamp_delta(READ_ONCE(idev->tstamp));
5800	ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
5801	ci.retrans_time = jiffies_to_msecs(NEIGH_VAR(idev->nd_parms, RETRANS_TIME));
5802	if (nla_put(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci))
5803		goto nla_put_failure;
5804	nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
5805	if (!nla)
5806		goto nla_put_failure;
5807	ipv6_store_devconf(&idev->cnf, nla_data(nla), nla_len(nla));
5808
5809	/* XXX - MC not implemented */
5810
5811	if (ext_filter_mask & RTEXT_FILTER_SKIP_STATS)
5812		return 0;
5813
5814	nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
5815	if (!nla)
5816		goto nla_put_failure;
5817	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
5818
5819	nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
5820	if (!nla)
5821		goto nla_put_failure;
5822	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
5823
5824	nla = nla_reserve(skb, IFLA_INET6_TOKEN, sizeof(struct in6_addr));
5825	if (!nla)
5826		goto nla_put_failure;
5827	read_lock_bh(&idev->lock);
5828	memcpy(nla_data(nla), idev->token.s6_addr, nla_len(nla));
5829	read_unlock_bh(&idev->lock);
5830
5831	if (nla_put_u8(skb, IFLA_INET6_ADDR_GEN_MODE,
5832		       READ_ONCE(idev->cnf.addr_gen_mode)))
5833		goto nla_put_failure;
5834
5835	ra_mtu = READ_ONCE(idev->ra_mtu);
5836	if (ra_mtu && nla_put_u32(skb, IFLA_INET6_RA_MTU, ra_mtu))
5837		goto nla_put_failure;
5838
5839	return 0;
5840
5841nla_put_failure:
5842	return -EMSGSIZE;
5843}
5844
5845static size_t inet6_get_link_af_size(const struct net_device *dev,
5846				     u32 ext_filter_mask)
5847{
5848	if (!__in6_dev_get(dev))
5849		return 0;
5850
5851	return inet6_ifla6_size();
5852}
5853
5854static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev,
5855			      u32 ext_filter_mask)
5856{
5857	struct inet6_dev *idev = __in6_dev_get(dev);
5858
5859	if (!idev)
5860		return -ENODATA;
5861
5862	if (inet6_fill_ifla6_attrs(skb, idev, ext_filter_mask) < 0)
5863		return -EMSGSIZE;
5864
5865	return 0;
5866}
5867
5868static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token,
5869			     struct netlink_ext_ack *extack)
5870{
5871	struct inet6_ifaddr *ifp;
5872	struct net_device *dev = idev->dev;
5873	bool clear_token, update_rs = false;
5874	struct in6_addr ll_addr;
5875
5876	ASSERT_RTNL();
5877
5878	if (!token)
5879		return -EINVAL;
5880
5881	if (dev->flags & IFF_LOOPBACK) {
5882		NL_SET_ERR_MSG_MOD(extack, "Device is loopback");
5883		return -EINVAL;
5884	}
5885
5886	if (dev->flags & IFF_NOARP) {
5887		NL_SET_ERR_MSG_MOD(extack,
5888				   "Device does not do neighbour discovery");
5889		return -EINVAL;
5890	}
5891
5892	if (!ipv6_accept_ra(idev)) {
5893		NL_SET_ERR_MSG_MOD(extack,
5894				   "Router advertisement is disabled on device");
5895		return -EINVAL;
5896	}
5897
5898	if (READ_ONCE(idev->cnf.rtr_solicits) == 0) {
5899		NL_SET_ERR_MSG(extack,
5900			       "Router solicitation is disabled on device");
5901		return -EINVAL;
5902	}
5903
5904	write_lock_bh(&idev->lock);
5905
5906	BUILD_BUG_ON(sizeof(token->s6_addr) != 16);
5907	memcpy(idev->token.s6_addr + 8, token->s6_addr + 8, 8);
5908
5909	write_unlock_bh(&idev->lock);
5910
5911	clear_token = ipv6_addr_any(token);
5912	if (clear_token)
5913		goto update_lft;
5914
5915	if (!idev->dead && (idev->if_flags & IF_READY) &&
5916	    !ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE |
5917			     IFA_F_OPTIMISTIC)) {
5918		/* If we're not ready, then normal ifup will take care
5919		 * of this. Otherwise, we need to request our rs here.
5920		 */
5921		ndisc_send_rs(dev, &ll_addr, &in6addr_linklocal_allrouters);
5922		update_rs = true;
5923	}
5924
5925update_lft:
5926	write_lock_bh(&idev->lock);
5927
5928	if (update_rs) {
5929		idev->if_flags |= IF_RS_SENT;
5930		idev->rs_interval = rfc3315_s14_backoff_init(
5931			READ_ONCE(idev->cnf.rtr_solicit_interval));
5932		idev->rs_probes = 1;
5933		addrconf_mod_rs_timer(idev, idev->rs_interval);
5934	}
5935
5936	/* Well, that's kinda nasty ... */
5937	list_for_each_entry(ifp, &idev->addr_list, if_list) {
5938		spin_lock(&ifp->lock);
5939		if (ifp->tokenized) {
5940			ifp->valid_lft = 0;
5941			ifp->prefered_lft = 0;
5942		}
5943		spin_unlock(&ifp->lock);
5944	}
5945
5946	write_unlock_bh(&idev->lock);
5947	inet6_ifinfo_notify(RTM_NEWLINK, idev);
5948	addrconf_verify_rtnl(dev_net(dev));
5949	return 0;
5950}
5951
5952static const struct nla_policy inet6_af_policy[IFLA_INET6_MAX + 1] = {
5953	[IFLA_INET6_ADDR_GEN_MODE]	= { .type = NLA_U8 },
5954	[IFLA_INET6_TOKEN]		= { .len = sizeof(struct in6_addr) },
5955	[IFLA_INET6_RA_MTU]		= { .type = NLA_REJECT,
5956					    .reject_message =
5957						"IFLA_INET6_RA_MTU can not be set" },
5958};
5959
5960static int check_addr_gen_mode(int mode)
5961{
5962	if (mode != IN6_ADDR_GEN_MODE_EUI64 &&
5963	    mode != IN6_ADDR_GEN_MODE_NONE &&
5964	    mode != IN6_ADDR_GEN_MODE_STABLE_PRIVACY &&
5965	    mode != IN6_ADDR_GEN_MODE_RANDOM)
5966		return -EINVAL;
5967	return 1;
5968}
5969
5970static int check_stable_privacy(struct inet6_dev *idev, struct net *net,
5971				int mode)
5972{
5973	if (mode == IN6_ADDR_GEN_MODE_STABLE_PRIVACY &&
5974	    !idev->cnf.stable_secret.initialized &&
5975	    !net->ipv6.devconf_dflt->stable_secret.initialized)
5976		return -EINVAL;
5977	return 1;
5978}
5979
5980static int inet6_validate_link_af(const struct net_device *dev,
5981				  const struct nlattr *nla,
5982				  struct netlink_ext_ack *extack)
5983{
5984	struct nlattr *tb[IFLA_INET6_MAX + 1];
5985	struct inet6_dev *idev = NULL;
5986	int err;
5987
5988	if (dev) {
5989		idev = __in6_dev_get(dev);
5990		if (!idev)
5991			return -EAFNOSUPPORT;
5992	}
5993
5994	err = nla_parse_nested_deprecated(tb, IFLA_INET6_MAX, nla,
5995					  inet6_af_policy, extack);
5996	if (err)
5997		return err;
5998
5999	if (!tb[IFLA_INET6_TOKEN] && !tb[IFLA_INET6_ADDR_GEN_MODE])
6000		return -EINVAL;
6001
6002	if (tb[IFLA_INET6_ADDR_GEN_MODE]) {
6003		u8 mode = nla_get_u8(tb[IFLA_INET6_ADDR_GEN_MODE]);
6004
6005		if (check_addr_gen_mode(mode) < 0)
6006			return -EINVAL;
6007		if (dev && check_stable_privacy(idev, dev_net(dev), mode) < 0)
6008			return -EINVAL;
6009	}
6010
6011	return 0;
6012}
6013
6014static int inet6_set_link_af(struct net_device *dev, const struct nlattr *nla,
6015			     struct netlink_ext_ack *extack)
6016{
6017	struct inet6_dev *idev = __in6_dev_get(dev);
6018	struct nlattr *tb[IFLA_INET6_MAX + 1];
6019	int err;
6020
6021	if (!idev)
6022		return -EAFNOSUPPORT;
6023
6024	if (nla_parse_nested_deprecated(tb, IFLA_INET6_MAX, nla, NULL, NULL) < 0)
6025		return -EINVAL;
6026
6027	if (tb[IFLA_INET6_TOKEN]) {
6028		err = inet6_set_iftoken(idev, nla_data(tb[IFLA_INET6_TOKEN]),
6029					extack);
6030		if (err)
6031			return err;
6032	}
6033
6034	if (tb[IFLA_INET6_ADDR_GEN_MODE]) {
6035		u8 mode = nla_get_u8(tb[IFLA_INET6_ADDR_GEN_MODE]);
6036
6037		WRITE_ONCE(idev->cnf.addr_gen_mode, mode);
6038	}
6039
6040	return 0;
6041}
6042
6043static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
6044			     u32 portid, u32 seq, int event, unsigned int flags)
6045{
6046	struct net_device *dev = idev->dev;
6047	struct ifinfomsg *hdr;
6048	struct nlmsghdr *nlh;
6049	int ifindex, iflink;
6050	void *protoinfo;
6051
6052	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*hdr), flags);
6053	if (!nlh)
6054		return -EMSGSIZE;
6055
6056	hdr = nlmsg_data(nlh);
6057	hdr->ifi_family = AF_INET6;
6058	hdr->__ifi_pad = 0;
6059	hdr->ifi_type = dev->type;
6060	ifindex = READ_ONCE(dev->ifindex);
6061	hdr->ifi_index = ifindex;
6062	hdr->ifi_flags = dev_get_flags(dev);
6063	hdr->ifi_change = 0;
6064
6065	iflink = dev_get_iflink(dev);
6066	if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
6067	    (dev->addr_len &&
6068	     nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr)) ||
6069	    nla_put_u32(skb, IFLA_MTU, READ_ONCE(dev->mtu)) ||
6070	    (ifindex != iflink &&
6071	     nla_put_u32(skb, IFLA_LINK, iflink)) ||
6072	    nla_put_u8(skb, IFLA_OPERSTATE,
6073		       netif_running(dev) ? READ_ONCE(dev->operstate) : IF_OPER_DOWN))
6074		goto nla_put_failure;
6075	protoinfo = nla_nest_start_noflag(skb, IFLA_PROTINFO);
6076	if (!protoinfo)
6077		goto nla_put_failure;
6078
6079	if (inet6_fill_ifla6_attrs(skb, idev, 0) < 0)
6080		goto nla_put_failure;
6081
6082	nla_nest_end(skb, protoinfo);
6083	nlmsg_end(skb, nlh);
6084	return 0;
6085
6086nla_put_failure:
6087	nlmsg_cancel(skb, nlh);
6088	return -EMSGSIZE;
6089}
6090
6091static int inet6_valid_dump_ifinfo(const struct nlmsghdr *nlh,
6092				   struct netlink_ext_ack *extack)
6093{
6094	struct ifinfomsg *ifm;
6095
6096	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ifm))) {
6097		NL_SET_ERR_MSG_MOD(extack, "Invalid header for link dump request");
6098		return -EINVAL;
6099	}
6100
6101	if (nlmsg_attrlen(nlh, sizeof(*ifm))) {
6102		NL_SET_ERR_MSG_MOD(extack, "Invalid data after header");
6103		return -EINVAL;
6104	}
6105
6106	ifm = nlmsg_data(nlh);
6107	if (ifm->__ifi_pad || ifm->ifi_type || ifm->ifi_flags ||
6108	    ifm->ifi_change || ifm->ifi_index) {
6109		NL_SET_ERR_MSG_MOD(extack, "Invalid values in header for dump request");
6110		return -EINVAL;
6111	}
6112
6113	return 0;
6114}
6115
6116static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
6117{
6118	struct net *net = sock_net(skb->sk);
6119	struct {
6120		unsigned long ifindex;
6121	} *ctx = (void *)cb->ctx;
6122	struct net_device *dev;
6123	struct inet6_dev *idev;
6124	int err;
6125
6126	/* only requests using strict checking can pass data to
6127	 * influence the dump
6128	 */
6129	if (cb->strict_check) {
6130		err = inet6_valid_dump_ifinfo(cb->nlh, cb->extack);
6131
6132		if (err < 0)
6133			return err;
6134	}
6135
6136	err = 0;
 
 
6137	rcu_read_lock();
6138	for_each_netdev_dump(net, dev, ctx->ifindex) {
6139		idev = __in6_dev_get(dev);
6140		if (!idev)
6141			continue;
6142		err = inet6_fill_ifinfo(skb, idev,
6143					NETLINK_CB(cb->skb).portid,
6144					cb->nlh->nlmsg_seq,
6145					RTM_NEWLINK, NLM_F_MULTI);
6146		if (err < 0)
6147			break;
 
 
 
 
 
 
 
6148	}
 
6149	rcu_read_unlock();
 
 
6150
6151	return err;
6152}
6153
6154void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
6155{
6156	struct sk_buff *skb;
6157	struct net *net = dev_net(idev->dev);
6158	int err = -ENOBUFS;
6159
6160	skb = nlmsg_new(inet6_if_nlmsg_size(), GFP_ATOMIC);
6161	if (!skb)
6162		goto errout;
6163
6164	err = inet6_fill_ifinfo(skb, idev, 0, 0, event, 0);
6165	if (err < 0) {
6166		/* -EMSGSIZE implies BUG in inet6_if_nlmsg_size() */
6167		WARN_ON(err == -EMSGSIZE);
6168		kfree_skb(skb);
6169		goto errout;
6170	}
6171	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFINFO, NULL, GFP_ATOMIC);
6172	return;
6173errout:
6174	if (err < 0)
6175		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFINFO, err);
6176}
6177
6178static inline size_t inet6_prefix_nlmsg_size(void)
6179{
6180	return NLMSG_ALIGN(sizeof(struct prefixmsg))
6181	       + nla_total_size(sizeof(struct in6_addr))
6182	       + nla_total_size(sizeof(struct prefix_cacheinfo));
6183}
6184
6185static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
6186			     struct prefix_info *pinfo, u32 portid, u32 seq,
6187			     int event, unsigned int flags)
6188{
6189	struct prefixmsg *pmsg;
6190	struct nlmsghdr *nlh;
6191	struct prefix_cacheinfo	ci;
6192
6193	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*pmsg), flags);
6194	if (!nlh)
6195		return -EMSGSIZE;
6196
6197	pmsg = nlmsg_data(nlh);
6198	pmsg->prefix_family = AF_INET6;
6199	pmsg->prefix_pad1 = 0;
6200	pmsg->prefix_pad2 = 0;
6201	pmsg->prefix_ifindex = idev->dev->ifindex;
6202	pmsg->prefix_len = pinfo->prefix_len;
6203	pmsg->prefix_type = pinfo->type;
6204	pmsg->prefix_pad3 = 0;
6205	pmsg->prefix_flags = pinfo->flags;
 
 
 
 
6206
6207	if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix))
6208		goto nla_put_failure;
6209	ci.preferred_time = ntohl(pinfo->prefered);
6210	ci.valid_time = ntohl(pinfo->valid);
6211	if (nla_put(skb, PREFIX_CACHEINFO, sizeof(ci), &ci))
6212		goto nla_put_failure;
6213	nlmsg_end(skb, nlh);
6214	return 0;
6215
6216nla_put_failure:
6217	nlmsg_cancel(skb, nlh);
6218	return -EMSGSIZE;
6219}
6220
6221static void inet6_prefix_notify(int event, struct inet6_dev *idev,
6222			 struct prefix_info *pinfo)
6223{
6224	struct sk_buff *skb;
6225	struct net *net = dev_net(idev->dev);
6226	int err = -ENOBUFS;
6227
6228	skb = nlmsg_new(inet6_prefix_nlmsg_size(), GFP_ATOMIC);
6229	if (!skb)
6230		goto errout;
6231
6232	err = inet6_fill_prefix(skb, idev, pinfo, 0, 0, event, 0);
6233	if (err < 0) {
6234		/* -EMSGSIZE implies BUG in inet6_prefix_nlmsg_size() */
6235		WARN_ON(err == -EMSGSIZE);
6236		kfree_skb(skb);
6237		goto errout;
6238	}
6239	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
6240	return;
6241errout:
6242	if (err < 0)
6243		rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
6244}
6245
6246static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
6247{
6248	struct net *net = dev_net(ifp->idev->dev);
6249
6250	if (event)
6251		ASSERT_RTNL();
6252
6253	inet6_ifa_notify(event ? : RTM_NEWADDR, ifp);
6254
6255	switch (event) {
6256	case RTM_NEWADDR:
6257		/*
6258		 * If the address was optimistic we inserted the route at the
6259		 * start of our DAD process, so we don't need to do it again.
6260		 * If the device was taken down in the middle of the DAD
6261		 * cycle there is a race where we could get here without a
6262		 * host route, so nothing to insert. That will be fixed when
6263		 * the device is brought up.
6264		 */
6265		if (ifp->rt && !rcu_access_pointer(ifp->rt->fib6_node)) {
6266			ip6_ins_rt(net, ifp->rt);
6267		} else if (!ifp->rt && (ifp->idev->dev->flags & IFF_UP)) {
6268			pr_warn("BUG: Address %pI6c on device %s is missing its host route.\n",
6269				&ifp->addr, ifp->idev->dev->name);
6270		}
6271
6272		if (ifp->idev->cnf.forwarding)
6273			addrconf_join_anycast(ifp);
6274		if (!ipv6_addr_any(&ifp->peer_addr))
6275			addrconf_prefix_route(&ifp->peer_addr, 128,
6276					      ifp->rt_priority, ifp->idev->dev,
6277					      0, 0, GFP_ATOMIC);
6278		break;
6279	case RTM_DELADDR:
6280		if (ifp->idev->cnf.forwarding)
6281			addrconf_leave_anycast(ifp);
6282		addrconf_leave_solict(ifp->idev, &ifp->addr);
6283		if (!ipv6_addr_any(&ifp->peer_addr)) {
6284			struct fib6_info *rt;
6285
6286			rt = addrconf_get_prefix_route(&ifp->peer_addr, 128,
6287						       ifp->idev->dev, 0, 0,
6288						       false);
6289			if (rt)
6290				ip6_del_rt(net, rt, false);
6291		}
6292		if (ifp->rt) {
6293			ip6_del_rt(net, ifp->rt, false);
6294			ifp->rt = NULL;
6295		}
6296		rt_genid_bump_ipv6(net);
6297		break;
6298	}
6299	atomic_inc(&net->ipv6.dev_addr_genid);
6300}
6301
6302static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
6303{
6304	if (likely(ifp->idev->dead == 0))
6305		__ipv6_ifa_notify(event, ifp);
6306}
6307
6308#ifdef CONFIG_SYSCTL
6309
6310static int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
6311		void *buffer, size_t *lenp, loff_t *ppos)
6312{
6313	int *valp = ctl->data;
6314	int val = *valp;
6315	loff_t pos = *ppos;
6316	struct ctl_table lctl;
6317	int ret;
6318
6319	/*
6320	 * ctl->data points to idev->cnf.forwarding, we should
6321	 * not modify it until we get the rtnl lock.
6322	 */
6323	lctl = *ctl;
6324	lctl.data = &val;
6325
6326	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
6327
6328	if (write)
6329		ret = addrconf_fixup_forwarding(ctl, valp, val);
6330	if (ret)
6331		*ppos = pos;
6332	return ret;
6333}
6334
6335static int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
6336		void *buffer, size_t *lenp, loff_t *ppos)
6337{
6338	struct inet6_dev *idev = ctl->extra1;
6339	int min_mtu = IPV6_MIN_MTU;
6340	struct ctl_table lctl;
6341
6342	lctl = *ctl;
6343	lctl.extra1 = &min_mtu;
6344	lctl.extra2 = idev ? &idev->dev->mtu : NULL;
6345
6346	return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
6347}
6348
6349static void dev_disable_change(struct inet6_dev *idev)
6350{
6351	struct netdev_notifier_info info;
6352
6353	if (!idev || !idev->dev)
6354		return;
6355
6356	netdev_notifier_info_init(&info, idev->dev);
6357	if (idev->cnf.disable_ipv6)
6358		addrconf_notify(NULL, NETDEV_DOWN, &info);
6359	else
6360		addrconf_notify(NULL, NETDEV_UP, &info);
6361}
6362
6363static void addrconf_disable_change(struct net *net, __s32 newf)
6364{
6365	struct net_device *dev;
6366	struct inet6_dev *idev;
6367
6368	for_each_netdev(net, dev) {
6369		idev = __in6_dev_get(dev);
6370		if (idev) {
6371			int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
6372
6373			WRITE_ONCE(idev->cnf.disable_ipv6, newf);
6374			if (changed)
6375				dev_disable_change(idev);
6376		}
6377	}
6378}
6379
6380static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
6381{
6382	struct net *net = (struct net *)table->extra2;
6383	int old;
6384
6385	if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
6386		WRITE_ONCE(*p, newf);
6387		return 0;
6388	}
6389
6390	if (!rtnl_trylock())
6391		return restart_syscall();
6392
 
6393	old = *p;
6394	WRITE_ONCE(*p, newf);
 
 
 
 
 
6395
6396	if (p == &net->ipv6.devconf_all->disable_ipv6) {
6397		WRITE_ONCE(net->ipv6.devconf_dflt->disable_ipv6, newf);
6398		addrconf_disable_change(net, newf);
6399	} else if ((!newf) ^ (!old))
6400		dev_disable_change((struct inet6_dev *)table->extra1);
6401
6402	rtnl_unlock();
6403	return 0;
6404}
6405
6406static int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
6407		void *buffer, size_t *lenp, loff_t *ppos)
6408{
6409	int *valp = ctl->data;
6410	int val = *valp;
6411	loff_t pos = *ppos;
6412	struct ctl_table lctl;
6413	int ret;
6414
6415	/*
6416	 * ctl->data points to idev->cnf.disable_ipv6, we should
6417	 * not modify it until we get the rtnl lock.
6418	 */
6419	lctl = *ctl;
6420	lctl.data = &val;
6421
6422	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
6423
6424	if (write)
6425		ret = addrconf_disable_ipv6(ctl, valp, val);
6426	if (ret)
6427		*ppos = pos;
6428	return ret;
6429}
6430
6431static int addrconf_sysctl_proxy_ndp(struct ctl_table *ctl, int write,
6432		void *buffer, size_t *lenp, loff_t *ppos)
6433{
6434	int *valp = ctl->data;
6435	int ret;
6436	int old, new;
6437
6438	old = *valp;
6439	ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
6440	new = *valp;
6441
6442	if (write && old != new) {
6443		struct net *net = ctl->extra2;
6444
6445		if (!rtnl_trylock())
6446			return restart_syscall();
6447
6448		if (valp == &net->ipv6.devconf_dflt->proxy_ndp)
6449			inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
6450						     NETCONFA_PROXY_NEIGH,
6451						     NETCONFA_IFINDEX_DEFAULT,
6452						     net->ipv6.devconf_dflt);
6453		else if (valp == &net->ipv6.devconf_all->proxy_ndp)
6454			inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
6455						     NETCONFA_PROXY_NEIGH,
6456						     NETCONFA_IFINDEX_ALL,
6457						     net->ipv6.devconf_all);
6458		else {
6459			struct inet6_dev *idev = ctl->extra1;
6460
6461			inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
6462						     NETCONFA_PROXY_NEIGH,
6463						     idev->dev->ifindex,
6464						     &idev->cnf);
6465		}
6466		rtnl_unlock();
6467	}
6468
6469	return ret;
6470}
6471
6472static int addrconf_sysctl_addr_gen_mode(struct ctl_table *ctl, int write,
6473					 void *buffer, size_t *lenp,
6474					 loff_t *ppos)
6475{
6476	int ret = 0;
6477	u32 new_val;
6478	struct inet6_dev *idev = (struct inet6_dev *)ctl->extra1;
6479	struct net *net = (struct net *)ctl->extra2;
6480	struct ctl_table tmp = {
6481		.data = &new_val,
6482		.maxlen = sizeof(new_val),
6483		.mode = ctl->mode,
6484	};
6485
6486	if (!rtnl_trylock())
6487		return restart_syscall();
6488
6489	new_val = *((u32 *)ctl->data);
6490
6491	ret = proc_douintvec(&tmp, write, buffer, lenp, ppos);
6492	if (ret != 0)
6493		goto out;
6494
6495	if (write) {
6496		if (check_addr_gen_mode(new_val) < 0) {
6497			ret = -EINVAL;
6498			goto out;
6499		}
6500
6501		if (idev) {
6502			if (check_stable_privacy(idev, net, new_val) < 0) {
6503				ret = -EINVAL;
6504				goto out;
6505			}
6506
6507			if (idev->cnf.addr_gen_mode != new_val) {
6508				WRITE_ONCE(idev->cnf.addr_gen_mode, new_val);
6509				addrconf_init_auto_addrs(idev->dev);
6510			}
6511		} else if (&net->ipv6.devconf_all->addr_gen_mode == ctl->data) {
6512			struct net_device *dev;
6513
6514			WRITE_ONCE(net->ipv6.devconf_dflt->addr_gen_mode, new_val);
6515			for_each_netdev(net, dev) {
6516				idev = __in6_dev_get(dev);
6517				if (idev &&
6518				    idev->cnf.addr_gen_mode != new_val) {
6519					WRITE_ONCE(idev->cnf.addr_gen_mode,
6520						  new_val);
6521					addrconf_init_auto_addrs(idev->dev);
6522				}
6523			}
6524		}
6525
6526		WRITE_ONCE(*((u32 *)ctl->data), new_val);
6527	}
6528
6529out:
6530	rtnl_unlock();
6531
6532	return ret;
6533}
6534
6535static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
6536					 void *buffer, size_t *lenp,
6537					 loff_t *ppos)
6538{
6539	int err;
6540	struct in6_addr addr;
6541	char str[IPV6_MAX_STRLEN];
6542	struct ctl_table lctl = *ctl;
6543	struct net *net = ctl->extra2;
6544	struct ipv6_stable_secret *secret = ctl->data;
6545
6546	if (&net->ipv6.devconf_all->stable_secret == ctl->data)
6547		return -EIO;
6548
6549	lctl.maxlen = IPV6_MAX_STRLEN;
6550	lctl.data = str;
6551
6552	if (!rtnl_trylock())
6553		return restart_syscall();
6554
6555	if (!write && !secret->initialized) {
6556		err = -EIO;
6557		goto out;
6558	}
6559
6560	err = snprintf(str, sizeof(str), "%pI6", &secret->secret);
6561	if (err >= sizeof(str)) {
6562		err = -EIO;
6563		goto out;
6564	}
6565
6566	err = proc_dostring(&lctl, write, buffer, lenp, ppos);
6567	if (err || !write)
6568		goto out;
6569
6570	if (in6_pton(str, -1, addr.in6_u.u6_addr8, -1, NULL) != 1) {
6571		err = -EIO;
6572		goto out;
6573	}
6574
6575	secret->initialized = true;
6576	secret->secret = addr;
6577
6578	if (&net->ipv6.devconf_dflt->stable_secret == ctl->data) {
6579		struct net_device *dev;
6580
6581		for_each_netdev(net, dev) {
6582			struct inet6_dev *idev = __in6_dev_get(dev);
6583
6584			if (idev) {
6585				WRITE_ONCE(idev->cnf.addr_gen_mode,
6586					   IN6_ADDR_GEN_MODE_STABLE_PRIVACY);
6587			}
6588		}
6589	} else {
6590		struct inet6_dev *idev = ctl->extra1;
6591
6592		WRITE_ONCE(idev->cnf.addr_gen_mode,
6593			   IN6_ADDR_GEN_MODE_STABLE_PRIVACY);
6594	}
6595
6596out:
6597	rtnl_unlock();
6598
6599	return err;
6600}
6601
6602static
6603int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
6604						int write, void *buffer,
6605						size_t *lenp,
6606						loff_t *ppos)
6607{
6608	int *valp = ctl->data;
6609	int val = *valp;
6610	loff_t pos = *ppos;
6611	struct ctl_table lctl;
6612	int ret;
6613
6614	/* ctl->data points to idev->cnf.ignore_routes_when_linkdown
6615	 * we should not modify it until we get the rtnl lock.
6616	 */
6617	lctl = *ctl;
6618	lctl.data = &val;
6619
6620	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
6621
6622	if (write)
6623		ret = addrconf_fixup_linkdown(ctl, valp, val);
6624	if (ret)
6625		*ppos = pos;
6626	return ret;
6627}
6628
6629static
6630void addrconf_set_nopolicy(struct rt6_info *rt, int action)
6631{
6632	if (rt) {
6633		if (action)
6634			rt->dst.flags |= DST_NOPOLICY;
6635		else
6636			rt->dst.flags &= ~DST_NOPOLICY;
6637	}
6638}
6639
6640static
6641void addrconf_disable_policy_idev(struct inet6_dev *idev, int val)
6642{
6643	struct inet6_ifaddr *ifa;
6644
6645	read_lock_bh(&idev->lock);
6646	list_for_each_entry(ifa, &idev->addr_list, if_list) {
6647		spin_lock(&ifa->lock);
6648		if (ifa->rt) {
6649			/* host routes only use builtin fib6_nh */
6650			struct fib6_nh *nh = ifa->rt->fib6_nh;
6651			int cpu;
6652
6653			rcu_read_lock();
6654			ifa->rt->dst_nopolicy = val ? true : false;
6655			if (nh->rt6i_pcpu) {
6656				for_each_possible_cpu(cpu) {
6657					struct rt6_info **rtp;
6658
6659					rtp = per_cpu_ptr(nh->rt6i_pcpu, cpu);
6660					addrconf_set_nopolicy(*rtp, val);
6661				}
6662			}
6663			rcu_read_unlock();
6664		}
6665		spin_unlock(&ifa->lock);
6666	}
6667	read_unlock_bh(&idev->lock);
6668}
6669
6670static
6671int addrconf_disable_policy(struct ctl_table *ctl, int *valp, int val)
6672{
6673	struct net *net = (struct net *)ctl->extra2;
6674	struct inet6_dev *idev;
6675
6676	if (valp == &net->ipv6.devconf_dflt->disable_policy) {
6677		WRITE_ONCE(*valp, val);
6678		return 0;
6679	}
6680
6681	if (!rtnl_trylock())
6682		return restart_syscall();
6683
6684	WRITE_ONCE(*valp, val);
 
 
 
 
 
 
6685
6686	if (valp == &net->ipv6.devconf_all->disable_policy)  {
6687		struct net_device *dev;
6688
6689		for_each_netdev(net, dev) {
6690			idev = __in6_dev_get(dev);
6691			if (idev)
6692				addrconf_disable_policy_idev(idev, val);
6693		}
6694	} else {
6695		idev = (struct inet6_dev *)ctl->extra1;
6696		addrconf_disable_policy_idev(idev, val);
6697	}
6698
6699	rtnl_unlock();
6700	return 0;
6701}
6702
6703static int addrconf_sysctl_disable_policy(struct ctl_table *ctl, int write,
6704				   void *buffer, size_t *lenp, loff_t *ppos)
6705{
6706	int *valp = ctl->data;
6707	int val = *valp;
6708	loff_t pos = *ppos;
6709	struct ctl_table lctl;
6710	int ret;
6711
6712	lctl = *ctl;
6713	lctl.data = &val;
6714	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
6715
6716	if (write && (*valp != val))
6717		ret = addrconf_disable_policy(ctl, valp, val);
6718
6719	if (ret)
6720		*ppos = pos;
6721
6722	return ret;
6723}
6724
6725static int minus_one = -1;
6726static const int two_five_five = 255;
6727static u32 ioam6_if_id_max = U16_MAX;
6728
6729static const struct ctl_table addrconf_sysctl[] = {
6730	{
6731		.procname	= "forwarding",
6732		.data		= &ipv6_devconf.forwarding,
6733		.maxlen		= sizeof(int),
6734		.mode		= 0644,
6735		.proc_handler	= addrconf_sysctl_forward,
6736	},
6737	{
6738		.procname	= "hop_limit",
6739		.data		= &ipv6_devconf.hop_limit,
6740		.maxlen		= sizeof(int),
6741		.mode		= 0644,
6742		.proc_handler	= proc_dointvec_minmax,
6743		.extra1		= (void *)SYSCTL_ONE,
6744		.extra2		= (void *)&two_five_five,
6745	},
6746	{
6747		.procname	= "mtu",
6748		.data		= &ipv6_devconf.mtu6,
6749		.maxlen		= sizeof(int),
6750		.mode		= 0644,
6751		.proc_handler	= addrconf_sysctl_mtu,
6752	},
6753	{
6754		.procname	= "accept_ra",
6755		.data		= &ipv6_devconf.accept_ra,
6756		.maxlen		= sizeof(int),
6757		.mode		= 0644,
6758		.proc_handler	= proc_dointvec,
6759	},
6760	{
6761		.procname	= "accept_redirects",
6762		.data		= &ipv6_devconf.accept_redirects,
6763		.maxlen		= sizeof(int),
6764		.mode		= 0644,
6765		.proc_handler	= proc_dointvec,
6766	},
6767	{
6768		.procname	= "autoconf",
6769		.data		= &ipv6_devconf.autoconf,
6770		.maxlen		= sizeof(int),
6771		.mode		= 0644,
6772		.proc_handler	= proc_dointvec,
6773	},
6774	{
6775		.procname	= "dad_transmits",
6776		.data		= &ipv6_devconf.dad_transmits,
6777		.maxlen		= sizeof(int),
6778		.mode		= 0644,
6779		.proc_handler	= proc_dointvec,
6780	},
6781	{
6782		.procname	= "router_solicitations",
6783		.data		= &ipv6_devconf.rtr_solicits,
6784		.maxlen		= sizeof(int),
6785		.mode		= 0644,
6786		.proc_handler	= proc_dointvec_minmax,
6787		.extra1		= &minus_one,
6788	},
6789	{
6790		.procname	= "router_solicitation_interval",
6791		.data		= &ipv6_devconf.rtr_solicit_interval,
6792		.maxlen		= sizeof(int),
6793		.mode		= 0644,
6794		.proc_handler	= proc_dointvec_jiffies,
6795	},
6796	{
6797		.procname	= "router_solicitation_max_interval",
6798		.data		= &ipv6_devconf.rtr_solicit_max_interval,
6799		.maxlen		= sizeof(int),
6800		.mode		= 0644,
6801		.proc_handler	= proc_dointvec_jiffies,
6802	},
6803	{
6804		.procname	= "router_solicitation_delay",
6805		.data		= &ipv6_devconf.rtr_solicit_delay,
6806		.maxlen		= sizeof(int),
6807		.mode		= 0644,
6808		.proc_handler	= proc_dointvec_jiffies,
6809	},
6810	{
6811		.procname	= "force_mld_version",
6812		.data		= &ipv6_devconf.force_mld_version,
6813		.maxlen		= sizeof(int),
6814		.mode		= 0644,
6815		.proc_handler	= proc_dointvec,
6816	},
6817	{
6818		.procname	= "mldv1_unsolicited_report_interval",
6819		.data		=
6820			&ipv6_devconf.mldv1_unsolicited_report_interval,
6821		.maxlen		= sizeof(int),
6822		.mode		= 0644,
6823		.proc_handler	= proc_dointvec_ms_jiffies,
6824	},
6825	{
6826		.procname	= "mldv2_unsolicited_report_interval",
6827		.data		=
6828			&ipv6_devconf.mldv2_unsolicited_report_interval,
6829		.maxlen		= sizeof(int),
6830		.mode		= 0644,
6831		.proc_handler	= proc_dointvec_ms_jiffies,
6832	},
6833	{
6834		.procname	= "use_tempaddr",
6835		.data		= &ipv6_devconf.use_tempaddr,
6836		.maxlen		= sizeof(int),
6837		.mode		= 0644,
6838		.proc_handler	= proc_dointvec,
6839	},
6840	{
6841		.procname	= "temp_valid_lft",
6842		.data		= &ipv6_devconf.temp_valid_lft,
6843		.maxlen		= sizeof(int),
6844		.mode		= 0644,
6845		.proc_handler	= proc_dointvec,
6846	},
6847	{
6848		.procname	= "temp_prefered_lft",
6849		.data		= &ipv6_devconf.temp_prefered_lft,
6850		.maxlen		= sizeof(int),
6851		.mode		= 0644,
6852		.proc_handler	= proc_dointvec,
6853	},
6854	{
6855		.procname       = "regen_min_advance",
6856		.data           = &ipv6_devconf.regen_min_advance,
6857		.maxlen         = sizeof(int),
6858		.mode           = 0644,
6859		.proc_handler   = proc_dointvec,
6860	},
6861	{
6862		.procname	= "regen_max_retry",
6863		.data		= &ipv6_devconf.regen_max_retry,
6864		.maxlen		= sizeof(int),
6865		.mode		= 0644,
6866		.proc_handler	= proc_dointvec,
6867	},
6868	{
6869		.procname	= "max_desync_factor",
6870		.data		= &ipv6_devconf.max_desync_factor,
6871		.maxlen		= sizeof(int),
6872		.mode		= 0644,
6873		.proc_handler	= proc_dointvec,
6874	},
6875	{
6876		.procname	= "max_addresses",
6877		.data		= &ipv6_devconf.max_addresses,
6878		.maxlen		= sizeof(int),
6879		.mode		= 0644,
6880		.proc_handler	= proc_dointvec,
6881	},
6882	{
6883		.procname	= "accept_ra_defrtr",
6884		.data		= &ipv6_devconf.accept_ra_defrtr,
6885		.maxlen		= sizeof(int),
6886		.mode		= 0644,
6887		.proc_handler	= proc_dointvec,
6888	},
6889	{
6890		.procname	= "ra_defrtr_metric",
6891		.data		= &ipv6_devconf.ra_defrtr_metric,
6892		.maxlen		= sizeof(u32),
6893		.mode		= 0644,
6894		.proc_handler	= proc_douintvec_minmax,
6895		.extra1		= (void *)SYSCTL_ONE,
6896	},
6897	{
6898		.procname	= "accept_ra_min_hop_limit",
6899		.data		= &ipv6_devconf.accept_ra_min_hop_limit,
6900		.maxlen		= sizeof(int),
6901		.mode		= 0644,
6902		.proc_handler	= proc_dointvec,
6903	},
6904	{
6905		.procname	= "accept_ra_min_lft",
6906		.data		= &ipv6_devconf.accept_ra_min_lft,
6907		.maxlen		= sizeof(int),
6908		.mode		= 0644,
6909		.proc_handler	= proc_dointvec,
6910	},
6911	{
6912		.procname	= "accept_ra_pinfo",
6913		.data		= &ipv6_devconf.accept_ra_pinfo,
6914		.maxlen		= sizeof(int),
6915		.mode		= 0644,
6916		.proc_handler	= proc_dointvec,
6917	},
6918	{
6919		.procname	= "ra_honor_pio_life",
6920		.data		= &ipv6_devconf.ra_honor_pio_life,
6921		.maxlen		= sizeof(u8),
6922		.mode		= 0644,
6923		.proc_handler	= proc_dou8vec_minmax,
6924		.extra1		= SYSCTL_ZERO,
6925		.extra2		= SYSCTL_ONE,
6926	},
6927#ifdef CONFIG_IPV6_ROUTER_PREF
6928	{
6929		.procname	= "accept_ra_rtr_pref",
6930		.data		= &ipv6_devconf.accept_ra_rtr_pref,
6931		.maxlen		= sizeof(int),
6932		.mode		= 0644,
6933		.proc_handler	= proc_dointvec,
6934	},
6935	{
6936		.procname	= "router_probe_interval",
6937		.data		= &ipv6_devconf.rtr_probe_interval,
6938		.maxlen		= sizeof(int),
6939		.mode		= 0644,
6940		.proc_handler	= proc_dointvec_jiffies,
6941	},
6942#ifdef CONFIG_IPV6_ROUTE_INFO
6943	{
6944		.procname	= "accept_ra_rt_info_min_plen",
6945		.data		= &ipv6_devconf.accept_ra_rt_info_min_plen,
6946		.maxlen		= sizeof(int),
6947		.mode		= 0644,
6948		.proc_handler	= proc_dointvec,
6949	},
6950	{
6951		.procname	= "accept_ra_rt_info_max_plen",
6952		.data		= &ipv6_devconf.accept_ra_rt_info_max_plen,
6953		.maxlen		= sizeof(int),
6954		.mode		= 0644,
6955		.proc_handler	= proc_dointvec,
6956	},
6957#endif
6958#endif
6959	{
6960		.procname	= "proxy_ndp",
6961		.data		= &ipv6_devconf.proxy_ndp,
6962		.maxlen		= sizeof(int),
6963		.mode		= 0644,
6964		.proc_handler	= addrconf_sysctl_proxy_ndp,
6965	},
6966	{
6967		.procname	= "accept_source_route",
6968		.data		= &ipv6_devconf.accept_source_route,
6969		.maxlen		= sizeof(int),
6970		.mode		= 0644,
6971		.proc_handler	= proc_dointvec,
6972	},
6973#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
6974	{
6975		.procname	= "optimistic_dad",
6976		.data		= &ipv6_devconf.optimistic_dad,
6977		.maxlen		= sizeof(int),
6978		.mode		= 0644,
6979		.proc_handler   = proc_dointvec,
6980	},
6981	{
6982		.procname	= "use_optimistic",
6983		.data		= &ipv6_devconf.use_optimistic,
6984		.maxlen		= sizeof(int),
6985		.mode		= 0644,
6986		.proc_handler	= proc_dointvec,
6987	},
6988#endif
6989#ifdef CONFIG_IPV6_MROUTE
6990	{
6991		.procname	= "mc_forwarding",
6992		.data		= &ipv6_devconf.mc_forwarding,
6993		.maxlen		= sizeof(int),
6994		.mode		= 0444,
6995		.proc_handler	= proc_dointvec,
6996	},
6997#endif
6998	{
6999		.procname	= "disable_ipv6",
7000		.data		= &ipv6_devconf.disable_ipv6,
7001		.maxlen		= sizeof(int),
7002		.mode		= 0644,
7003		.proc_handler	= addrconf_sysctl_disable,
7004	},
7005	{
7006		.procname	= "accept_dad",
7007		.data		= &ipv6_devconf.accept_dad,
7008		.maxlen		= sizeof(int),
7009		.mode		= 0644,
7010		.proc_handler	= proc_dointvec,
7011	},
7012	{
7013		.procname	= "force_tllao",
7014		.data		= &ipv6_devconf.force_tllao,
7015		.maxlen		= sizeof(int),
7016		.mode		= 0644,
7017		.proc_handler	= proc_dointvec
7018	},
7019	{
7020		.procname	= "ndisc_notify",
7021		.data		= &ipv6_devconf.ndisc_notify,
7022		.maxlen		= sizeof(int),
7023		.mode		= 0644,
7024		.proc_handler	= proc_dointvec
7025	},
7026	{
7027		.procname	= "suppress_frag_ndisc",
7028		.data		= &ipv6_devconf.suppress_frag_ndisc,
7029		.maxlen		= sizeof(int),
7030		.mode		= 0644,
7031		.proc_handler	= proc_dointvec
7032	},
7033	{
7034		.procname	= "accept_ra_from_local",
7035		.data		= &ipv6_devconf.accept_ra_from_local,
7036		.maxlen		= sizeof(int),
7037		.mode		= 0644,
7038		.proc_handler	= proc_dointvec,
7039	},
7040	{
7041		.procname	= "accept_ra_mtu",
7042		.data		= &ipv6_devconf.accept_ra_mtu,
7043		.maxlen		= sizeof(int),
7044		.mode		= 0644,
7045		.proc_handler	= proc_dointvec,
7046	},
7047	{
7048		.procname	= "stable_secret",
7049		.data		= &ipv6_devconf.stable_secret,
7050		.maxlen		= IPV6_MAX_STRLEN,
7051		.mode		= 0600,
7052		.proc_handler	= addrconf_sysctl_stable_secret,
7053	},
7054	{
7055		.procname	= "use_oif_addrs_only",
7056		.data		= &ipv6_devconf.use_oif_addrs_only,
7057		.maxlen		= sizeof(int),
7058		.mode		= 0644,
7059		.proc_handler	= proc_dointvec,
7060	},
7061	{
7062		.procname	= "ignore_routes_with_linkdown",
7063		.data		= &ipv6_devconf.ignore_routes_with_linkdown,
7064		.maxlen		= sizeof(int),
7065		.mode		= 0644,
7066		.proc_handler	= addrconf_sysctl_ignore_routes_with_linkdown,
7067	},
7068	{
7069		.procname	= "drop_unicast_in_l2_multicast",
7070		.data		= &ipv6_devconf.drop_unicast_in_l2_multicast,
7071		.maxlen		= sizeof(int),
7072		.mode		= 0644,
7073		.proc_handler	= proc_dointvec,
7074	},
7075	{
7076		.procname	= "drop_unsolicited_na",
7077		.data		= &ipv6_devconf.drop_unsolicited_na,
7078		.maxlen		= sizeof(int),
7079		.mode		= 0644,
7080		.proc_handler	= proc_dointvec,
7081	},
7082	{
7083		.procname	= "keep_addr_on_down",
7084		.data		= &ipv6_devconf.keep_addr_on_down,
7085		.maxlen		= sizeof(int),
7086		.mode		= 0644,
7087		.proc_handler	= proc_dointvec,
7088
7089	},
7090	{
7091		.procname	= "seg6_enabled",
7092		.data		= &ipv6_devconf.seg6_enabled,
7093		.maxlen		= sizeof(int),
7094		.mode		= 0644,
7095		.proc_handler	= proc_dointvec,
7096	},
7097#ifdef CONFIG_IPV6_SEG6_HMAC
7098	{
7099		.procname	= "seg6_require_hmac",
7100		.data		= &ipv6_devconf.seg6_require_hmac,
7101		.maxlen		= sizeof(int),
7102		.mode		= 0644,
7103		.proc_handler	= proc_dointvec,
7104	},
7105#endif
7106	{
7107		.procname       = "enhanced_dad",
7108		.data           = &ipv6_devconf.enhanced_dad,
7109		.maxlen         = sizeof(int),
7110		.mode           = 0644,
7111		.proc_handler   = proc_dointvec,
7112	},
7113	{
7114		.procname	= "addr_gen_mode",
7115		.data		= &ipv6_devconf.addr_gen_mode,
7116		.maxlen		= sizeof(int),
7117		.mode		= 0644,
7118		.proc_handler	= addrconf_sysctl_addr_gen_mode,
7119	},
7120	{
7121		.procname       = "disable_policy",
7122		.data           = &ipv6_devconf.disable_policy,
7123		.maxlen         = sizeof(int),
7124		.mode           = 0644,
7125		.proc_handler   = addrconf_sysctl_disable_policy,
7126	},
7127	{
7128		.procname	= "ndisc_tclass",
7129		.data		= &ipv6_devconf.ndisc_tclass,
7130		.maxlen		= sizeof(int),
7131		.mode		= 0644,
7132		.proc_handler	= proc_dointvec_minmax,
7133		.extra1		= (void *)SYSCTL_ZERO,
7134		.extra2		= (void *)&two_five_five,
7135	},
7136	{
7137		.procname	= "rpl_seg_enabled",
7138		.data		= &ipv6_devconf.rpl_seg_enabled,
7139		.maxlen		= sizeof(int),
7140		.mode		= 0644,
7141		.proc_handler	= proc_dointvec,
7142	},
7143	{
7144		.procname	= "ioam6_enabled",
7145		.data		= &ipv6_devconf.ioam6_enabled,
7146		.maxlen		= sizeof(u8),
7147		.mode		= 0644,
7148		.proc_handler	= proc_dou8vec_minmax,
7149		.extra1		= (void *)SYSCTL_ZERO,
7150		.extra2		= (void *)SYSCTL_ONE,
7151	},
7152	{
7153		.procname	= "ioam6_id",
7154		.data		= &ipv6_devconf.ioam6_id,
7155		.maxlen		= sizeof(u32),
7156		.mode		= 0644,
7157		.proc_handler	= proc_douintvec_minmax,
7158		.extra1		= (void *)SYSCTL_ZERO,
7159		.extra2		= (void *)&ioam6_if_id_max,
7160	},
7161	{
7162		.procname	= "ioam6_id_wide",
7163		.data		= &ipv6_devconf.ioam6_id_wide,
7164		.maxlen		= sizeof(u32),
7165		.mode		= 0644,
7166		.proc_handler	= proc_douintvec,
7167	},
7168	{
7169		.procname	= "ndisc_evict_nocarrier",
7170		.data		= &ipv6_devconf.ndisc_evict_nocarrier,
7171		.maxlen		= sizeof(u8),
7172		.mode		= 0644,
7173		.proc_handler	= proc_dou8vec_minmax,
7174		.extra1		= (void *)SYSCTL_ZERO,
7175		.extra2		= (void *)SYSCTL_ONE,
7176	},
7177	{
7178		.procname	= "accept_untracked_na",
7179		.data		= &ipv6_devconf.accept_untracked_na,
7180		.maxlen		= sizeof(int),
7181		.mode		= 0644,
7182		.proc_handler	= proc_dointvec_minmax,
7183		.extra1		= SYSCTL_ZERO,
7184		.extra2		= SYSCTL_TWO,
7185	},
7186	{
7187		/* sentinel */
7188	}
7189};
7190
7191static int __addrconf_sysctl_register(struct net *net, char *dev_name,
7192		struct inet6_dev *idev, struct ipv6_devconf *p)
7193{
7194	int i, ifindex;
7195	struct ctl_table *table;
7196	char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
7197
7198	table = kmemdup(addrconf_sysctl, sizeof(addrconf_sysctl), GFP_KERNEL_ACCOUNT);
7199	if (!table)
7200		goto out;
7201
7202	for (i = 0; table[i].data; i++) {
7203		table[i].data += (char *)p - (char *)&ipv6_devconf;
7204		/* If one of these is already set, then it is not safe to
7205		 * overwrite either of them: this makes proc_dointvec_minmax
7206		 * usable.
7207		 */
7208		if (!table[i].extra1 && !table[i].extra2) {
7209			table[i].extra1 = idev; /* embedded; no ref */
7210			table[i].extra2 = net;
7211		}
7212	}
7213
7214	snprintf(path, sizeof(path), "net/ipv6/conf/%s", dev_name);
7215
7216	p->sysctl_header = register_net_sysctl_sz(net, path, table,
7217						  ARRAY_SIZE(addrconf_sysctl));
7218	if (!p->sysctl_header)
7219		goto free;
7220
7221	if (!strcmp(dev_name, "all"))
7222		ifindex = NETCONFA_IFINDEX_ALL;
7223	else if (!strcmp(dev_name, "default"))
7224		ifindex = NETCONFA_IFINDEX_DEFAULT;
7225	else
7226		ifindex = idev->dev->ifindex;
7227	inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, NETCONFA_ALL,
7228				     ifindex, p);
7229	return 0;
7230
7231free:
7232	kfree(table);
7233out:
7234	return -ENOBUFS;
7235}
7236
7237static void __addrconf_sysctl_unregister(struct net *net,
7238					 struct ipv6_devconf *p, int ifindex)
7239{
7240	struct ctl_table *table;
7241
7242	if (!p->sysctl_header)
7243		return;
7244
7245	table = p->sysctl_header->ctl_table_arg;
7246	unregister_net_sysctl_table(p->sysctl_header);
7247	p->sysctl_header = NULL;
7248	kfree(table);
7249
7250	inet6_netconf_notify_devconf(net, RTM_DELNETCONF, 0, ifindex, NULL);
7251}
7252
7253static int addrconf_sysctl_register(struct inet6_dev *idev)
7254{
7255	int err;
7256
7257	if (!sysctl_dev_name_is_allowed(idev->dev->name))
7258		return -EINVAL;
7259
7260	err = neigh_sysctl_register(idev->dev, idev->nd_parms,
7261				    &ndisc_ifinfo_sysctl_change);
7262	if (err)
7263		return err;
7264	err = __addrconf_sysctl_register(dev_net(idev->dev), idev->dev->name,
7265					 idev, &idev->cnf);
7266	if (err)
7267		neigh_sysctl_unregister(idev->nd_parms);
7268
7269	return err;
7270}
7271
7272static void addrconf_sysctl_unregister(struct inet6_dev *idev)
7273{
7274	__addrconf_sysctl_unregister(dev_net(idev->dev), &idev->cnf,
7275				     idev->dev->ifindex);
7276	neigh_sysctl_unregister(idev->nd_parms);
7277}
7278
7279
7280#endif
7281
7282static int __net_init addrconf_init_net(struct net *net)
7283{
7284	int err = -ENOMEM;
7285	struct ipv6_devconf *all, *dflt;
7286
7287	spin_lock_init(&net->ipv6.addrconf_hash_lock);
7288	INIT_DEFERRABLE_WORK(&net->ipv6.addr_chk_work, addrconf_verify_work);
7289	net->ipv6.inet6_addr_lst = kcalloc(IN6_ADDR_HSIZE,
7290					   sizeof(struct hlist_head),
7291					   GFP_KERNEL);
7292	if (!net->ipv6.inet6_addr_lst)
7293		goto err_alloc_addr;
7294
7295	all = kmemdup(&ipv6_devconf, sizeof(ipv6_devconf), GFP_KERNEL);
7296	if (!all)
7297		goto err_alloc_all;
7298
7299	dflt = kmemdup(&ipv6_devconf_dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
7300	if (!dflt)
7301		goto err_alloc_dflt;
7302
7303	if (!net_eq(net, &init_net)) {
7304		switch (net_inherit_devconf()) {
7305		case 1:  /* copy from init_net */
7306			memcpy(all, init_net.ipv6.devconf_all,
7307			       sizeof(ipv6_devconf));
7308			memcpy(dflt, init_net.ipv6.devconf_dflt,
7309			       sizeof(ipv6_devconf_dflt));
7310			break;
7311		case 3: /* copy from the current netns */
7312			memcpy(all, current->nsproxy->net_ns->ipv6.devconf_all,
7313			       sizeof(ipv6_devconf));
7314			memcpy(dflt,
7315			       current->nsproxy->net_ns->ipv6.devconf_dflt,
7316			       sizeof(ipv6_devconf_dflt));
7317			break;
7318		case 0:
7319		case 2:
7320			/* use compiled values */
7321			break;
7322		}
7323	}
7324
7325	/* these will be inherited by all namespaces */
7326	dflt->autoconf = ipv6_defaults.autoconf;
7327	dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
7328
7329	dflt->stable_secret.initialized = false;
7330	all->stable_secret.initialized = false;
7331
7332	net->ipv6.devconf_all = all;
7333	net->ipv6.devconf_dflt = dflt;
7334
7335#ifdef CONFIG_SYSCTL
7336	err = __addrconf_sysctl_register(net, "all", NULL, all);
7337	if (err < 0)
7338		goto err_reg_all;
7339
7340	err = __addrconf_sysctl_register(net, "default", NULL, dflt);
7341	if (err < 0)
7342		goto err_reg_dflt;
7343#endif
7344	return 0;
7345
7346#ifdef CONFIG_SYSCTL
7347err_reg_dflt:
7348	__addrconf_sysctl_unregister(net, all, NETCONFA_IFINDEX_ALL);
7349err_reg_all:
7350	kfree(dflt);
7351	net->ipv6.devconf_dflt = NULL;
7352#endif
7353err_alloc_dflt:
7354	kfree(all);
7355	net->ipv6.devconf_all = NULL;
7356err_alloc_all:
7357	kfree(net->ipv6.inet6_addr_lst);
7358err_alloc_addr:
7359	return err;
7360}
7361
7362static void __net_exit addrconf_exit_net(struct net *net)
7363{
7364	int i;
7365
7366#ifdef CONFIG_SYSCTL
7367	__addrconf_sysctl_unregister(net, net->ipv6.devconf_dflt,
7368				     NETCONFA_IFINDEX_DEFAULT);
7369	__addrconf_sysctl_unregister(net, net->ipv6.devconf_all,
7370				     NETCONFA_IFINDEX_ALL);
7371#endif
7372	kfree(net->ipv6.devconf_dflt);
7373	net->ipv6.devconf_dflt = NULL;
7374	kfree(net->ipv6.devconf_all);
7375	net->ipv6.devconf_all = NULL;
7376
7377	cancel_delayed_work_sync(&net->ipv6.addr_chk_work);
7378	/*
7379	 *	Check hash table, then free it.
7380	 */
7381	for (i = 0; i < IN6_ADDR_HSIZE; i++)
7382		WARN_ON_ONCE(!hlist_empty(&net->ipv6.inet6_addr_lst[i]));
7383
7384	kfree(net->ipv6.inet6_addr_lst);
7385	net->ipv6.inet6_addr_lst = NULL;
7386}
7387
7388static struct pernet_operations addrconf_ops = {
7389	.init = addrconf_init_net,
7390	.exit = addrconf_exit_net,
7391};
7392
7393static struct rtnl_af_ops inet6_ops __read_mostly = {
7394	.family		  = AF_INET6,
7395	.fill_link_af	  = inet6_fill_link_af,
7396	.get_link_af_size = inet6_get_link_af_size,
7397	.validate_link_af = inet6_validate_link_af,
7398	.set_link_af	  = inet6_set_link_af,
7399};
7400
7401/*
7402 *	Init / cleanup code
7403 */
7404
7405int __init addrconf_init(void)
7406{
7407	struct inet6_dev *idev;
7408	int err;
7409
7410	err = ipv6_addr_label_init();
7411	if (err < 0) {
7412		pr_crit("%s: cannot initialize default policy table: %d\n",
7413			__func__, err);
7414		goto out;
7415	}
7416
7417	err = register_pernet_subsys(&addrconf_ops);
7418	if (err < 0)
7419		goto out_addrlabel;
7420
7421	/* All works using addrconf_wq need to lock rtnl. */
7422	addrconf_wq = create_singlethread_workqueue("ipv6_addrconf");
7423	if (!addrconf_wq) {
7424		err = -ENOMEM;
7425		goto out_nowq;
7426	}
7427
7428	rtnl_lock();
7429	idev = ipv6_add_dev(blackhole_netdev);
7430	rtnl_unlock();
7431	if (IS_ERR(idev)) {
7432		err = PTR_ERR(idev);
7433		goto errlo;
7434	}
7435
7436	ip6_route_init_special_entries();
7437
7438	register_netdevice_notifier(&ipv6_dev_notf);
7439
7440	addrconf_verify(&init_net);
7441
7442	rtnl_af_register(&inet6_ops);
7443
7444	err = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_GETLINK,
7445				   NULL, inet6_dump_ifinfo, RTNL_FLAG_DUMP_UNLOCKED);
7446	if (err < 0)
7447		goto errout;
7448
7449	err = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_NEWADDR,
7450				   inet6_rtm_newaddr, NULL, 0);
7451	if (err < 0)
7452		goto errout;
7453	err = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_DELADDR,
7454				   inet6_rtm_deladdr, NULL, 0);
7455	if (err < 0)
7456		goto errout;
7457	err = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_GETADDR,
7458				   inet6_rtm_getaddr, inet6_dump_ifaddr,
7459				   RTNL_FLAG_DOIT_UNLOCKED |
7460				   RTNL_FLAG_DUMP_UNLOCKED);
7461	if (err < 0)
7462		goto errout;
7463	err = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_GETMULTICAST,
7464				   NULL, inet6_dump_ifmcaddr,
7465				   RTNL_FLAG_DUMP_UNLOCKED);
7466	if (err < 0)
7467		goto errout;
7468	err = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_GETANYCAST,
7469				   NULL, inet6_dump_ifacaddr,
7470				   RTNL_FLAG_DUMP_UNLOCKED);
7471	if (err < 0)
7472		goto errout;
7473	err = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_GETNETCONF,
7474				   inet6_netconf_get_devconf,
7475				   inet6_netconf_dump_devconf,
7476				   RTNL_FLAG_DOIT_UNLOCKED |
7477				   RTNL_FLAG_DUMP_UNLOCKED);
7478	if (err < 0)
7479		goto errout;
7480	err = ipv6_addr_label_rtnl_register();
7481	if (err < 0)
7482		goto errout;
7483
7484	return 0;
7485errout:
7486	rtnl_unregister_all(PF_INET6);
7487	rtnl_af_unregister(&inet6_ops);
7488	unregister_netdevice_notifier(&ipv6_dev_notf);
7489errlo:
7490	destroy_workqueue(addrconf_wq);
7491out_nowq:
7492	unregister_pernet_subsys(&addrconf_ops);
7493out_addrlabel:
7494	ipv6_addr_label_cleanup();
7495out:
7496	return err;
7497}
7498
7499void addrconf_cleanup(void)
7500{
7501	struct net_device *dev;
7502
7503	unregister_netdevice_notifier(&ipv6_dev_notf);
7504	unregister_pernet_subsys(&addrconf_ops);
7505	ipv6_addr_label_cleanup();
7506
7507	rtnl_af_unregister(&inet6_ops);
7508
7509	rtnl_lock();
7510
7511	/* clean dev list */
7512	for_each_netdev(&init_net, dev) {
7513		if (__in6_dev_get(dev) == NULL)
7514			continue;
7515		addrconf_ifdown(dev, true);
7516	}
7517	addrconf_ifdown(init_net.loopback_dev, true);
7518
7519	rtnl_unlock();
7520
7521	destroy_workqueue(addrconf_wq);
7522}