linux/net/ipv6/addrconf.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *      IPv6 Address [auto]configuration
   4 *      Linux INET6 implementation
   5 *
   6 *      Authors:
   7 *      Pedro Roque             <roque@di.fc.ul.pt>
   8 *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   9 */
  10
  11/*
  12 *      Changes:
  13 *
  14 *      Janos Farkas                    :       delete timer on ifdown
  15 *      <chexum@bankinf.banki.hu>
  16 *      Andi Kleen                      :       kill double kfree on module
  17 *                                              unload.
  18 *      Maciej W. Rozycki               :       FDDI support
  19 *      sekiya@USAGI                    :       Don't send too many RS
  20 *                                              packets.
  21 *      yoshfuji@USAGI                  :       Fixed interval between DAD
  22 *                                              packets.
  23 *      YOSHIFUJI Hideaki @USAGI        :       improved accuracy of
  24 *                                              address validation timer.
  25 *      YOSHIFUJI Hideaki @USAGI        :       Privacy Extensions (RFC3041)
  26 *                                              support.
  27 *      Yuji SEKIYA @USAGI              :       Don't assign a same IPv6
  28 *                                              address on a same interface.
  29 *      YOSHIFUJI Hideaki @USAGI        :       ARCnet support
  30 *      YOSHIFUJI Hideaki @USAGI        :       convert /proc/net/if_inet6 to
  31 *                                              seq_file.
  32 *      YOSHIFUJI Hideaki @USAGI        :       improved source address
  33 *                                              selection; consider scope,
  34 *                                              status etc.
  35 */
  36
  37#define pr_fmt(fmt) "IPv6: " fmt
  38
  39#include <linux/errno.h>
  40#include <linux/types.h>
  41#include <linux/kernel.h>
  42#include <linux/sched/signal.h>
  43#include <linux/socket.h>
  44#include <linux/sockios.h>
  45#include <linux/net.h>
  46#include <linux/inet.h>
  47#include <linux/in6.h>
  48#include <linux/netdevice.h>
  49#include <linux/if_addr.h>
  50#include <linux/if_arp.h>
  51#include <linux/if_arcnet.h>
  52#include <linux/if_infiniband.h>
  53#include <linux/route.h>
  54#include <linux/inetdevice.h>
  55#include <linux/init.h>
  56#include <linux/slab.h>
  57#ifdef CONFIG_SYSCTL
  58#include <linux/sysctl.h>
  59#endif
  60#include <linux/capability.h>
  61#include <linux/delay.h>
  62#include <linux/notifier.h>
  63#include <linux/string.h>
  64#include <linux/hash.h>
  65
  66#include <net/net_namespace.h>
  67#include <net/sock.h>
  68#include <net/snmp.h>
  69
  70#include <net/6lowpan.h>
  71#include <net/firewire.h>
  72#include <net/ipv6.h>
  73#include <net/protocol.h>
  74#include <net/ndisc.h>
  75#include <net/ip6_route.h>
  76#include <net/addrconf.h>
  77#include <net/tcp.h>
  78#include <net/ip.h>
  79#include <net/netlink.h>
  80#include <net/pkt_sched.h>
  81#include <net/l3mdev.h>
  82#include <linux/if_tunnel.h>
  83#include <linux/rtnetlink.h>
  84#include <linux/netconf.h>
  85#include <linux/random.h>
  86#include <linux/uaccess.h>
  87#include <asm/unaligned.h>
  88
  89#include <linux/proc_fs.h>
  90#include <linux/seq_file.h>
  91#include <linux/export.h>
  92
  93#define INFINITY_LIFE_TIME      0xFFFFFFFF
  94
  95#define IPV6_MAX_STRLEN \
  96        sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")
  97
  98static inline u32 cstamp_delta(unsigned long cstamp)
  99{
 100        return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
 101}
 102
 103static inline s32 rfc3315_s14_backoff_init(s32 irt)
 104{
 105        /* multiply 'initial retransmission time' by 0.9 .. 1.1 */
 106        u64 tmp = (900000 + prandom_u32() % 200001) * (u64)irt;
 107        do_div(tmp, 1000000);
 108        return (s32)tmp;
 109}
 110
 111static inline s32 rfc3315_s14_backoff_update(s32 rt, s32 mrt)
 112{
 113        /* multiply 'retransmission timeout' by 1.9 .. 2.1 */
 114        u64 tmp = (1900000 + prandom_u32() % 200001) * (u64)rt;
 115        do_div(tmp, 1000000);
 116        if ((s32)tmp > mrt) {
 117                /* multiply 'maximum retransmission time' by 0.9 .. 1.1 */
 118                tmp = (900000 + prandom_u32() % 200001) * (u64)mrt;
 119                do_div(tmp, 1000000);
 120        }
 121        return (s32)tmp;
 122}
 123
 124#ifdef CONFIG_SYSCTL
 125static int addrconf_sysctl_register(struct inet6_dev *idev);
 126static void addrconf_sysctl_unregister(struct inet6_dev *idev);
 127#else
 128static inline int addrconf_sysctl_register(struct inet6_dev *idev)
 129{
 130        return 0;
 131}
 132
 133static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
 134{
 135}
 136#endif
 137
 138static void ipv6_gen_rnd_iid(struct in6_addr *addr);
 139
 140static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);
 141static int ipv6_count_addresses(const struct inet6_dev *idev);
 142static int ipv6_generate_stable_address(struct in6_addr *addr,
 143                                        u8 dad_count,
 144                                        const struct inet6_dev *idev);
 145
 146#define IN6_ADDR_HSIZE_SHIFT    8
 147#define IN6_ADDR_HSIZE          (1 << IN6_ADDR_HSIZE_SHIFT)
 148/*
 149 *      Configured unicast address hash table
 150 */
 151static struct hlist_head inet6_addr_lst[IN6_ADDR_HSIZE];
 152static DEFINE_SPINLOCK(addrconf_hash_lock);
 153
 154static void addrconf_verify(void);
 155static void addrconf_verify_rtnl(void);
 156static void addrconf_verify_work(struct work_struct *);
 157
 158static struct workqueue_struct *addrconf_wq;
 159static DECLARE_DELAYED_WORK(addr_chk_work, addrconf_verify_work);
 160
 161static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
 162static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);
 163
 164static void addrconf_type_change(struct net_device *dev,
 165                                 unsigned long event);
 166static int addrconf_ifdown(struct net_device *dev, bool unregister);
 167
 168static struct fib6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
 169                                                  int plen,
 170                                                  const struct net_device *dev,
 171                                                  u32 flags, u32 noflags,
 172                                                  bool no_gw);
 173
 174static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 175static void addrconf_dad_work(struct work_struct *w);
 176static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
 177                                   bool send_na);
 178static void addrconf_dad_run(struct inet6_dev *idev, bool restart);
 179static void addrconf_rs_timer(struct timer_list *t);
 180static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 181static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 182
 183static void inet6_prefix_notify(int event, struct inet6_dev *idev,
 184                                struct prefix_info *pinfo);
 185
 186static struct ipv6_devconf ipv6_devconf __read_mostly = {
 187        .forwarding             = 0,
 188        .hop_limit              = IPV6_DEFAULT_HOPLIMIT,
 189        .mtu6                   = IPV6_MIN_MTU,
 190        .accept_ra              = 1,
 191        .accept_redirects       = 1,
 192        .autoconf               = 1,
 193        .force_mld_version      = 0,
 194        .mldv1_unsolicited_report_interval = 10 * HZ,
 195        .mldv2_unsolicited_report_interval = HZ,
 196        .dad_transmits          = 1,
 197        .rtr_solicits           = MAX_RTR_SOLICITATIONS,
 198        .rtr_solicit_interval   = RTR_SOLICITATION_INTERVAL,
 199        .rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
 200        .rtr_solicit_delay      = MAX_RTR_SOLICITATION_DELAY,
 201        .use_tempaddr           = 0,
 202        .temp_valid_lft         = TEMP_VALID_LIFETIME,
 203        .temp_prefered_lft      = TEMP_PREFERRED_LIFETIME,
 204        .regen_max_retry        = REGEN_MAX_RETRY,
 205        .max_desync_factor      = MAX_DESYNC_FACTOR,
 206        .max_addresses          = IPV6_MAX_ADDRESSES,
 207        .accept_ra_defrtr       = 1,
 208        .ra_defrtr_metric       = IP6_RT_PRIO_USER,
 209        .accept_ra_from_local   = 0,
 210        .accept_ra_min_hop_limit= 1,
 211        .accept_ra_pinfo        = 1,
 212#ifdef CONFIG_IPV6_ROUTER_PREF
 213        .accept_ra_rtr_pref     = 1,
 214        .rtr_probe_interval     = 60 * HZ,
 215#ifdef CONFIG_IPV6_ROUTE_INFO
 216        .accept_ra_rt_info_min_plen = 0,
 217        .accept_ra_rt_info_max_plen = 0,
 218#endif
 219#endif
 220        .proxy_ndp              = 0,
 221        .accept_source_route    = 0,    /* we do not accept RH0 by default. */
 222        .disable_ipv6           = 0,
 223        .accept_dad             = 0,
 224        .suppress_frag_ndisc    = 1,
 225        .accept_ra_mtu          = 1,
 226        .stable_secret          = {
 227                .initialized = false,
 228        },
 229        .use_oif_addrs_only     = 0,
 230        .ignore_routes_with_linkdown = 0,
 231        .keep_addr_on_down      = 0,
 232        .seg6_enabled           = 0,
 233#ifdef CONFIG_IPV6_SEG6_HMAC
 234        .seg6_require_hmac      = 0,
 235#endif
 236        .enhanced_dad           = 1,
 237        .addr_gen_mode          = IN6_ADDR_GEN_MODE_EUI64,
 238        .disable_policy         = 0,
 239        .rpl_seg_enabled        = 0,
 240};
 241
 242static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 243        .forwarding             = 0,
 244        .hop_limit              = IPV6_DEFAULT_HOPLIMIT,
 245        .mtu6                   = IPV6_MIN_MTU,
 246        .accept_ra              = 1,
 247        .accept_redirects       = 1,
 248        .autoconf               = 1,
 249        .force_mld_version      = 0,
 250        .mldv1_unsolicited_report_interval = 10 * HZ,
 251        .mldv2_unsolicited_report_interval = HZ,
 252        .dad_transmits          = 1,
 253        .rtr_solicits           = MAX_RTR_SOLICITATIONS,
 254        .rtr_solicit_interval   = RTR_SOLICITATION_INTERVAL,
 255        .rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
 256        .rtr_solicit_delay      = MAX_RTR_SOLICITATION_DELAY,
 257        .use_tempaddr           = 0,
 258        .temp_valid_lft         = TEMP_VALID_LIFETIME,
 259        .temp_prefered_lft      = TEMP_PREFERRED_LIFETIME,
 260        .regen_max_retry        = REGEN_MAX_RETRY,
 261        .max_desync_factor      = MAX_DESYNC_FACTOR,
 262        .max_addresses          = IPV6_MAX_ADDRESSES,
 263        .accept_ra_defrtr       = 1,
 264        .ra_defrtr_metric       = IP6_RT_PRIO_USER,
 265        .accept_ra_from_local   = 0,
 266        .accept_ra_min_hop_limit= 1,
 267        .accept_ra_pinfo        = 1,
 268#ifdef CONFIG_IPV6_ROUTER_PREF
 269        .accept_ra_rtr_pref     = 1,
 270        .rtr_probe_interval     = 60 * HZ,
 271#ifdef CONFIG_IPV6_ROUTE_INFO
 272        .accept_ra_rt_info_min_plen = 0,
 273        .accept_ra_rt_info_max_plen = 0,
 274#endif
 275#endif
 276        .proxy_ndp              = 0,
 277        .accept_source_route    = 0,    /* we do not accept RH0 by default. */
 278        .disable_ipv6           = 0,
 279        .accept_dad             = 1,
 280        .suppress_frag_ndisc    = 1,
 281        .accept_ra_mtu          = 1,
 282        .stable_secret          = {
 283                .initialized = false,
 284        },
 285        .use_oif_addrs_only     = 0,
 286        .ignore_routes_with_linkdown = 0,
 287        .keep_addr_on_down      = 0,
 288        .seg6_enabled           = 0,
 289#ifdef CONFIG_IPV6_SEG6_HMAC
 290        .seg6_require_hmac      = 0,
 291#endif
 292        .enhanced_dad           = 1,
 293        .addr_gen_mode          = IN6_ADDR_GEN_MODE_EUI64,
 294        .disable_policy         = 0,
 295        .rpl_seg_enabled        = 0,
 296};
 297
 298/* Check if link is ready: is it up and is a valid qdisc available */
 299static inline bool addrconf_link_ready(const struct net_device *dev)
 300{
 301        return netif_oper_up(dev) && !qdisc_tx_is_noop(dev);
 302}
 303
 304static void addrconf_del_rs_timer(struct inet6_dev *idev)
 305{
 306        if (del_timer(&idev->rs_timer))
 307                __in6_dev_put(idev);
 308}
 309
 310static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
 311{
 312        if (cancel_delayed_work(&ifp->dad_work))
 313                __in6_ifa_put(ifp);
 314}
 315
 316static void addrconf_mod_rs_timer(struct inet6_dev *idev,
 317                                  unsigned long when)
 318{
 319        if (!timer_pending(&idev->rs_timer))
 320                in6_dev_hold(idev);
 321        mod_timer(&idev->rs_timer, jiffies + when);
 322}
 323
 324static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
 325                                   unsigned long delay)
 326{
 327        in6_ifa_hold(ifp);
 328        if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
 329                in6_ifa_put(ifp);
 330}
 331
 332static int snmp6_alloc_dev(struct inet6_dev *idev)
 333{
 334        int i;
 335
 336        idev->stats.ipv6 = alloc_percpu(struct ipstats_mib);
 337        if (!idev->stats.ipv6)
 338                goto err_ip;
 339
 340        for_each_possible_cpu(i) {
 341                struct ipstats_mib *addrconf_stats;
 342                addrconf_stats = per_cpu_ptr(idev->stats.ipv6, i);
 343                u64_stats_init(&addrconf_stats->syncp);
 344        }
 345
 346
 347        idev->stats.icmpv6dev = kzalloc(sizeof(struct icmpv6_mib_device),
 348                                        GFP_KERNEL);
 349        if (!idev->stats.icmpv6dev)
 350                goto err_icmp;
 351        idev->stats.icmpv6msgdev = kzalloc(sizeof(struct icmpv6msg_mib_device),
 352                                           GFP_KERNEL);
 353        if (!idev->stats.icmpv6msgdev)
 354                goto err_icmpmsg;
 355
 356        return 0;
 357
 358err_icmpmsg:
 359        kfree(idev->stats.icmpv6dev);
 360err_icmp:
 361        free_percpu(idev->stats.ipv6);
 362err_ip:
 363        return -ENOMEM;
 364}
 365
 366static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
 367{
 368        struct inet6_dev *ndev;
 369        int err = -ENOMEM;
 370
 371        ASSERT_RTNL();
 372
 373        if (dev->mtu < IPV6_MIN_MTU)
 374                return ERR_PTR(-EINVAL);
 375
 376        ndev = kzalloc(sizeof(struct inet6_dev), GFP_KERNEL);
 377        if (!ndev)
 378                return ERR_PTR(err);
 379
 380        rwlock_init(&ndev->lock);
 381        ndev->dev = dev;
 382        INIT_LIST_HEAD(&ndev->addr_list);
 383        timer_setup(&ndev->rs_timer, addrconf_rs_timer, 0);
 384        memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
 385
 386        if (ndev->cnf.stable_secret.initialized)
 387                ndev->cnf.addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
 388
 389        ndev->cnf.mtu6 = dev->mtu;
 390        ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
 391        if (!ndev->nd_parms) {
 392                kfree(ndev);
 393                return ERR_PTR(err);
 394        }
 395        if (ndev->cnf.forwarding)
 396                dev_disable_lro(dev);
 397        /* We refer to the device */
 398        dev_hold(dev);
 399
 400        if (snmp6_alloc_dev(ndev) < 0) {
 401                netdev_dbg(dev, "%s: cannot allocate memory for statistics\n",
 402                           __func__);
 403                neigh_parms_release(&nd_tbl, ndev->nd_parms);
 404                dev_put(dev);
 405                kfree(ndev);
 406                return ERR_PTR(err);
 407        }
 408
 409        if (snmp6_register_dev(ndev) < 0) {
 410                netdev_dbg(dev, "%s: cannot create /proc/net/dev_snmp6/%s\n",
 411                           __func__, dev->name);
 412                goto err_release;
 413        }
 414
 415        /* One reference from device. */
 416        refcount_set(&ndev->refcnt, 1);
 417
 418        if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
 419                ndev->cnf.accept_dad = -1;
 420
 421#if IS_ENABLED(CONFIG_IPV6_SIT)
 422        if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
 423                pr_info("%s: Disabled Multicast RS\n", dev->name);
 424                ndev->cnf.rtr_solicits = 0;
 425        }
 426#endif
 427
 428        INIT_LIST_HEAD(&ndev->tempaddr_list);
 429        ndev->desync_factor = U32_MAX;
 430        if ((dev->flags&IFF_LOOPBACK) ||
 431            dev->type == ARPHRD_TUNNEL ||
 432            dev->type == ARPHRD_TUNNEL6 ||
 433            dev->type == ARPHRD_SIT ||
 434            dev->type == ARPHRD_NONE) {
 435                ndev->cnf.use_tempaddr = -1;
 436        }
 437
 438        ndev->token = in6addr_any;
 439
 440        if (netif_running(dev) && addrconf_link_ready(dev))
 441                ndev->if_flags |= IF_READY;
 442
 443        ipv6_mc_init_dev(ndev);
 444        ndev->tstamp = jiffies;
 445        err = addrconf_sysctl_register(ndev);
 446        if (err) {
 447                ipv6_mc_destroy_dev(ndev);
 448                snmp6_unregister_dev(ndev);
 449                goto err_release;
 450        }
 451        /* protected by rtnl_lock */
 452        rcu_assign_pointer(dev->ip6_ptr, ndev);
 453
 454        /* Join interface-local all-node multicast group */
 455        ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allnodes);
 456
 457        /* Join all-node multicast group */
 458        ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 459
 460        /* Join all-router multicast group if forwarding is set */
 461        if (ndev->cnf.forwarding && (dev->flags & IFF_MULTICAST))
 462                ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
 463
 464        return ndev;
 465
 466err_release:
 467        neigh_parms_release(&nd_tbl, ndev->nd_parms);
 468        ndev->dead = 1;
 469        in6_dev_finish_destroy(ndev);
 470        return ERR_PTR(err);
 471}
 472
 473static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
 474{
 475        struct inet6_dev *idev;
 476
 477        ASSERT_RTNL();
 478
 479        idev = __in6_dev_get(dev);
 480        if (!idev) {
 481                idev = ipv6_add_dev(dev);
 482                if (IS_ERR(idev))
 483                        return idev;
 484        }
 485
 486        if (dev->flags&IFF_UP)
 487                ipv6_mc_up(idev);
 488        return idev;
 489}
 490
 491static int inet6_netconf_msgsize_devconf(int type)
 492{
 493        int size =  NLMSG_ALIGN(sizeof(struct netconfmsg))
 494                    + nla_total_size(4);        /* NETCONFA_IFINDEX */
 495        bool all = false;
 496
 497        if (type == NETCONFA_ALL)
 498                all = true;
 499
 500        if (all || type == NETCONFA_FORWARDING)
 501                size += nla_total_size(4);
 502#ifdef CONFIG_IPV6_MROUTE
 503        if (all || type == NETCONFA_MC_FORWARDING)
 504                size += nla_total_size(4);
 505#endif
 506        if (all || type == NETCONFA_PROXY_NEIGH)
 507                size += nla_total_size(4);
 508
 509        if (all || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN)
 510                size += nla_total_size(4);
 511
 512        return size;
 513}
 514
 515static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
 516                                      struct ipv6_devconf *devconf, u32 portid,
 517                                      u32 seq, int event, unsigned int flags,
 518                                      int type)
 519{
 520        struct nlmsghdr  *nlh;
 521        struct netconfmsg *ncm;
 522        bool all = false;
 523
 524        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct netconfmsg),
 525                        flags);
 526        if (!nlh)
 527                return -EMSGSIZE;
 528
 529        if (type == NETCONFA_ALL)
 530                all = true;
 531
 532        ncm = nlmsg_data(nlh);
 533        ncm->ncm_family = AF_INET6;
 534
 535        if (nla_put_s32(skb, NETCONFA_IFINDEX, ifindex) < 0)
 536                goto nla_put_failure;
 537
 538        if (!devconf)
 539                goto out;
 540
 541        if ((all || type == NETCONFA_FORWARDING) &&
 542            nla_put_s32(skb, NETCONFA_FORWARDING, devconf->forwarding) < 0)
 543                goto nla_put_failure;
 544#ifdef CONFIG_IPV6_MROUTE
 545        if ((all || type == NETCONFA_MC_FORWARDING) &&
 546            nla_put_s32(skb, NETCONFA_MC_FORWARDING,
 547                        devconf->mc_forwarding) < 0)
 548                goto nla_put_failure;
 549#endif
 550        if ((all || type == NETCONFA_PROXY_NEIGH) &&
 551            nla_put_s32(skb, NETCONFA_PROXY_NEIGH, devconf->proxy_ndp) < 0)
 552                goto nla_put_failure;
 553
 554        if ((all || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN) &&
 555            nla_put_s32(skb, NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 556                        devconf->ignore_routes_with_linkdown) < 0)
 557                goto nla_put_failure;
 558
 559out:
 560        nlmsg_end(skb, nlh);
 561        return 0;
 562
 563nla_put_failure:
 564        nlmsg_cancel(skb, nlh);
 565        return -EMSGSIZE;
 566}
 567
 568void inet6_netconf_notify_devconf(struct net *net, int event, int type,
 569                                  int ifindex, struct ipv6_devconf *devconf)
 570{
 571        struct sk_buff *skb;
 572        int err = -ENOBUFS;
 573
 574        skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_KERNEL);
 575        if (!skb)
 576                goto errout;
 577
 578        err = inet6_netconf_fill_devconf(skb, ifindex, devconf, 0, 0,
 579                                         event, 0, type);
 580        if (err < 0) {
 581                /* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
 582                WARN_ON(err == -EMSGSIZE);
 583                kfree_skb(skb);
 584                goto errout;
 585        }
 586        rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_KERNEL);
 587        return;
 588errout:
 589        rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err);
 590}
 591
 592static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
 593        [NETCONFA_IFINDEX]      = { .len = sizeof(int) },
 594        [NETCONFA_FORWARDING]   = { .len = sizeof(int) },
 595        [NETCONFA_PROXY_NEIGH]  = { .len = sizeof(int) },
 596        [NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN]  = { .len = sizeof(int) },
 597};
 598
 599static int inet6_netconf_valid_get_req(struct sk_buff *skb,
 600                                       const struct nlmsghdr *nlh,
 601                                       struct nlattr **tb,
 602                                       struct netlink_ext_ack *extack)
 603{
 604        int i, err;
 605
 606        if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(struct netconfmsg))) {
 607                NL_SET_ERR_MSG_MOD(extack, "Invalid header for netconf get request");
 608                return -EINVAL;
 609        }
 610
 611        if (!netlink_strict_get_check(skb))
 612                return nlmsg_parse_deprecated(nlh, sizeof(struct netconfmsg),
 613                                              tb, NETCONFA_MAX,
 614                                              devconf_ipv6_policy, extack);
 615
 616        err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct netconfmsg),
 617                                            tb, NETCONFA_MAX,
 618                                            devconf_ipv6_policy, extack);
 619        if (err)
 620                return err;
 621
 622        for (i = 0; i <= NETCONFA_MAX; i++) {
 623                if (!tb[i])
 624                        continue;
 625
 626                switch (i) {
 627                case NETCONFA_IFINDEX:
 628                        break;
 629                default:
 630                        NL_SET_ERR_MSG_MOD(extack, "Unsupported attribute in netconf get request");
 631                        return -EINVAL;
 632                }
 633        }
 634
 635        return 0;
 636}
 637
 638static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
 639                                     struct nlmsghdr *nlh,
 640                                     struct netlink_ext_ack *extack)
 641{
 642        struct net *net = sock_net(in_skb->sk);
 643        struct nlattr *tb[NETCONFA_MAX+1];
 644        struct inet6_dev *in6_dev = NULL;
 645        struct net_device *dev = NULL;
 646        struct sk_buff *skb;
 647        struct ipv6_devconf *devconf;
 648        int ifindex;
 649        int err;
 650
 651        err = inet6_netconf_valid_get_req(in_skb, nlh, tb, extack);
 652        if (err < 0)
 653                return err;
 654
 655        if (!tb[NETCONFA_IFINDEX])
 656                return -EINVAL;
 657
 658        err = -EINVAL;
 659        ifindex = nla_get_s32(tb[NETCONFA_IFINDEX]);
 660        switch (ifindex) {
 661        case NETCONFA_IFINDEX_ALL:
 662                devconf = net->ipv6.devconf_all;
 663                break;
 664        case NETCONFA_IFINDEX_DEFAULT:
 665                devconf = net->ipv6.devconf_dflt;
 666                break;
 667        default:
 668                dev = dev_get_by_index(net, ifindex);
 669                if (!dev)
 670                        return -EINVAL;
 671                in6_dev = in6_dev_get(dev);
 672                if (!in6_dev)
 673                        goto errout;
 674                devconf = &in6_dev->cnf;
 675                break;
 676        }
 677
 678        err = -ENOBUFS;
 679        skb = nlmsg_new(inet6_netconf_msgsize_devconf(NETCONFA_ALL), GFP_KERNEL);
 680        if (!skb)
 681                goto errout;
 682
 683        err = inet6_netconf_fill_devconf(skb, ifindex, devconf,
 684                                         NETLINK_CB(in_skb).portid,
 685                                         nlh->nlmsg_seq, RTM_NEWNETCONF, 0,
 686                                         NETCONFA_ALL);
 687        if (err < 0) {
 688                /* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
 689                WARN_ON(err == -EMSGSIZE);
 690                kfree_skb(skb);
 691                goto errout;
 692        }
 693        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
 694errout:
 695        if (in6_dev)
 696                in6_dev_put(in6_dev);
 697        if (dev)
 698                dev_put(dev);
 699        return err;
 700}
 701
 702static int inet6_netconf_dump_devconf(struct sk_buff *skb,
 703                                      struct netlink_callback *cb)
 704{
 705        const struct nlmsghdr *nlh = cb->nlh;
 706        struct net *net = sock_net(skb->sk);
 707        int h, s_h;
 708        int idx, s_idx;
 709        struct net_device *dev;
 710        struct inet6_dev *idev;
 711        struct hlist_head *head;
 712
 713        if (cb->strict_check) {
 714                struct netlink_ext_ack *extack = cb->extack;
 715                struct netconfmsg *ncm;
 716
 717                if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ncm))) {
 718                        NL_SET_ERR_MSG_MOD(extack, "Invalid header for netconf dump request");
 719                        return -EINVAL;
 720                }
 721
 722                if (nlmsg_attrlen(nlh, sizeof(*ncm))) {
 723                        NL_SET_ERR_MSG_MOD(extack, "Invalid data after header in netconf dump request");
 724                        return -EINVAL;
 725                }
 726        }
 727
 728        s_h = cb->args[0];
 729        s_idx = idx = cb->args[1];
 730
 731        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
 732                idx = 0;
 733                head = &net->dev_index_head[h];
 734                rcu_read_lock();
 735                cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^
 736                          net->dev_base_seq;
 737                hlist_for_each_entry_rcu(dev, head, index_hlist) {
 738                        if (idx < s_idx)
 739                                goto cont;
 740                        idev = __in6_dev_get(dev);
 741                        if (!idev)
 742                                goto cont;
 743
 744                        if (inet6_netconf_fill_devconf(skb, dev->ifindex,
 745                                                       &idev->cnf,
 746                                                       NETLINK_CB(cb->skb).portid,
 747                                                       nlh->nlmsg_seq,
 748                                                       RTM_NEWNETCONF,
 749                                                       NLM_F_MULTI,
 750                                                       NETCONFA_ALL) < 0) {
 751                                rcu_read_unlock();
 752                                goto done;
 753                        }
 754                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 755cont:
 756                        idx++;
 757                }
 758                rcu_read_unlock();
 759        }
 760        if (h == NETDEV_HASHENTRIES) {
 761                if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_ALL,
 762                                               net->ipv6.devconf_all,
 763                                               NETLINK_CB(cb->skb).portid,
 764                                               nlh->nlmsg_seq,
 765                                               RTM_NEWNETCONF, NLM_F_MULTI,
 766                                               NETCONFA_ALL) < 0)
 767                        goto done;
 768                else
 769                        h++;
 770        }
 771        if (h == NETDEV_HASHENTRIES + 1) {
 772                if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_DEFAULT,
 773                                               net->ipv6.devconf_dflt,
 774                                               NETLINK_CB(cb->skb).portid,
 775                                               nlh->nlmsg_seq,
 776                                               RTM_NEWNETCONF, NLM_F_MULTI,
 777                                               NETCONFA_ALL) < 0)
 778                        goto done;
 779                else
 780                        h++;
 781        }
 782done:
 783        cb->args[0] = h;
 784        cb->args[1] = idx;
 785
 786        return skb->len;
 787}
 788
 789#ifdef CONFIG_SYSCTL
 790static void dev_forward_change(struct inet6_dev *idev)
 791{
 792        struct net_device *dev;
 793        struct inet6_ifaddr *ifa;
 794
 795        if (!idev)
 796                return;
 797        dev = idev->dev;
 798        if (idev->cnf.forwarding)
 799                dev_disable_lro(dev);
 800        if (dev->flags & IFF_MULTICAST) {
 801                if (idev->cnf.forwarding) {
 802                        ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
 803                        ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allrouters);
 804                        ipv6_dev_mc_inc(dev, &in6addr_sitelocal_allrouters);
 805                } else {
 806                        ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);
 807                        ipv6_dev_mc_dec(dev, &in6addr_interfacelocal_allrouters);
 808                        ipv6_dev_mc_dec(dev, &in6addr_sitelocal_allrouters);
 809                }
 810        }
 811
 812        list_for_each_entry(ifa, &idev->addr_list, if_list) {
 813                if (ifa->flags&IFA_F_TENTATIVE)
 814                        continue;
 815                if (idev->cnf.forwarding)
 816                        addrconf_join_anycast(ifa);
 817                else
 818                        addrconf_leave_anycast(ifa);
 819        }
 820        inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF,
 821                                     NETCONFA_FORWARDING,
 822                                     dev->ifindex, &idev->cnf);
 823}
 824
 825
 826static void addrconf_forward_change(struct net *net, __s32 newf)
 827{
 828        struct net_device *dev;
 829        struct inet6_dev *idev;
 830
 831        for_each_netdev(net, dev) {
 832                idev = __in6_dev_get(dev);
 833                if (idev) {
 834                        int changed = (!idev->cnf.forwarding) ^ (!newf);
 835                        idev->cnf.forwarding = newf;
 836                        if (changed)
 837                                dev_forward_change(idev);
 838                }
 839        }
 840}
 841
 842static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
 843{
 844        struct net *net;
 845        int old;
 846
 847        if (!rtnl_trylock())
 848                return restart_syscall();
 849
 850        net = (struct net *)table->extra2;
 851        old = *p;
 852        *p = newf;
 853
 854        if (p == &net->ipv6.devconf_dflt->forwarding) {
 855                if ((!newf) ^ (!old))
 856                        inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
 857                                                     NETCONFA_FORWARDING,
 858                                                     NETCONFA_IFINDEX_DEFAULT,
 859                                                     net->ipv6.devconf_dflt);
 860                rtnl_unlock();
 861                return 0;
 862        }
 863
 864        if (p == &net->ipv6.devconf_all->forwarding) {
 865                int old_dflt = net->ipv6.devconf_dflt->forwarding;
 866
 867                net->ipv6.devconf_dflt->forwarding = newf;
 868                if ((!newf) ^ (!old_dflt))
 869                        inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
 870                                                     NETCONFA_FORWARDING,
 871                                                     NETCONFA_IFINDEX_DEFAULT,
 872                                                     net->ipv6.devconf_dflt);
 873
 874                addrconf_forward_change(net, newf);
 875                if ((!newf) ^ (!old))
 876                        inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
 877                                                     NETCONFA_FORWARDING,
 878                                                     NETCONFA_IFINDEX_ALL,
 879                                                     net->ipv6.devconf_all);
 880        } else if ((!newf) ^ (!old))
 881                dev_forward_change((struct inet6_dev *)table->extra1);
 882        rtnl_unlock();
 883
 884        if (newf)
 885                rt6_purge_dflt_routers(net);
 886        return 1;
 887}
 888
 889static void addrconf_linkdown_change(struct net *net, __s32 newf)
 890{
 891        struct net_device *dev;
 892        struct inet6_dev *idev;
 893
 894        for_each_netdev(net, dev) {
 895                idev = __in6_dev_get(dev);
 896                if (idev) {
 897                        int changed = (!idev->cnf.ignore_routes_with_linkdown) ^ (!newf);
 898
 899                        idev->cnf.ignore_routes_with_linkdown = newf;
 900                        if (changed)
 901                                inet6_netconf_notify_devconf(dev_net(dev),
 902                                                             RTM_NEWNETCONF,
 903                                                             NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 904                                                             dev->ifindex,
 905                                                             &idev->cnf);
 906                }
 907        }
 908}
 909
 910static int addrconf_fixup_linkdown(struct ctl_table *table, int *p, int newf)
 911{
 912        struct net *net;
 913        int old;
 914
 915        if (!rtnl_trylock())
 916                return restart_syscall();
 917
 918        net = (struct net *)table->extra2;
 919        old = *p;
 920        *p = newf;
 921
 922        if (p == &net->ipv6.devconf_dflt->ignore_routes_with_linkdown) {
 923                if ((!newf) ^ (!old))
 924                        inet6_netconf_notify_devconf(net,
 925                                                     RTM_NEWNETCONF,
 926                                                     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 927                                                     NETCONFA_IFINDEX_DEFAULT,
 928                                                     net->ipv6.devconf_dflt);
 929                rtnl_unlock();
 930                return 0;
 931        }
 932
 933        if (p == &net->ipv6.devconf_all->ignore_routes_with_linkdown) {
 934                net->ipv6.devconf_dflt->ignore_routes_with_linkdown = newf;
 935                addrconf_linkdown_change(net, newf);
 936                if ((!newf) ^ (!old))
 937                        inet6_netconf_notify_devconf(net,
 938                                                     RTM_NEWNETCONF,
 939                                                     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 940                                                     NETCONFA_IFINDEX_ALL,
 941                                                     net->ipv6.devconf_all);
 942        }
 943        rtnl_unlock();
 944
 945        return 1;
 946}
 947
 948#endif
 949
 950/* Nobody refers to this ifaddr, destroy it */
 951void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 952{
 953        WARN_ON(!hlist_unhashed(&ifp->addr_lst));
 954
 955#ifdef NET_REFCNT_DEBUG
 956        pr_debug("%s\n", __func__);
 957#endif
 958
 959        in6_dev_put(ifp->idev);
 960
 961        if (cancel_delayed_work(&ifp->dad_work))
 962                pr_notice("delayed DAD work was pending while freeing ifa=%p\n",
 963                          ifp);
 964
 965        if (ifp->state != INET6_IFADDR_STATE_DEAD) {
 966                pr_warn("Freeing alive inet6 address %p\n", ifp);
 967                return;
 968        }
 969
 970        kfree_rcu(ifp, rcu);
 971}
 972
 973static void
 974ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
 975{
 976        struct list_head *p;
 977        int ifp_scope = ipv6_addr_src_scope(&ifp->addr);
 978
 979        /*
 980         * Each device address list is sorted in order of scope -
 981         * global before linklocal.
 982         */
 983        list_for_each(p, &idev->addr_list) {
 984                struct inet6_ifaddr *ifa
 985                        = list_entry(p, struct inet6_ifaddr, if_list);
 986                if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))
 987                        break;
 988        }
 989
 990        list_add_tail_rcu(&ifp->if_list, p);
 991}
 992
 993static u32 inet6_addr_hash(const struct net *net, const struct in6_addr *addr)
 994{
 995        u32 val = ipv6_addr_hash(addr) ^ net_hash_mix(net);
 996
 997        return hash_32(val, IN6_ADDR_HSIZE_SHIFT);
 998}
 999
1000static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
1001                               struct net_device *dev, unsigned int hash)
1002{
1003        struct inet6_ifaddr *ifp;
1004
1005        hlist_for_each_entry(ifp, &inet6_addr_lst[hash], addr_lst) {
1006                if (!net_eq(dev_net(ifp->idev->dev), net))
1007                        continue;
1008                if (ipv6_addr_equal(&ifp->addr, addr)) {
1009                        if (!dev || ifp->idev->dev == dev)
1010                                return true;
1011                }
1012        }
1013        return false;
1014}
1015
1016static int ipv6_add_addr_hash(struct net_device *dev, struct inet6_ifaddr *ifa)
1017{
1018        unsigned int hash = inet6_addr_hash(dev_net(dev), &ifa->addr);
1019        int err = 0;
1020
1021        spin_lock(&addrconf_hash_lock);
1022
1023        /* Ignore adding duplicate addresses on an interface */
1024        if (ipv6_chk_same_addr(dev_net(dev), &ifa->addr, dev, hash)) {
1025                netdev_dbg(dev, "ipv6_add_addr: already assigned\n");
1026                err = -EEXIST;
1027        } else {
1028                hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);
1029        }
1030
1031        spin_unlock(&addrconf_hash_lock);
1032
1033        return err;
1034}
1035
1036/* On success it returns ifp with increased reference count */
1037
1038static struct inet6_ifaddr *
1039ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
1040              bool can_block, struct netlink_ext_ack *extack)
1041{
1042        gfp_t gfp_flags = can_block ? GFP_KERNEL : GFP_ATOMIC;
1043        int addr_type = ipv6_addr_type(cfg->pfx);
1044        struct net *net = dev_net(idev->dev);
1045        struct inet6_ifaddr *ifa = NULL;
1046        struct fib6_info *f6i = NULL;
1047        int err = 0;
1048
1049        if (addr_type == IPV6_ADDR_ANY ||
1050            (addr_type & IPV6_ADDR_MULTICAST &&
1051             !(cfg->ifa_flags & IFA_F_MCAUTOJOIN)) ||
1052            (!(idev->dev->flags & IFF_LOOPBACK) &&
1053             !netif_is_l3_master(idev->dev) &&
1054             addr_type & IPV6_ADDR_LOOPBACK))
1055                return ERR_PTR(-EADDRNOTAVAIL);
1056
1057        if (idev->dead) {
1058                err = -ENODEV;                  /*XXX*/
1059                goto out;
1060        }
1061
1062        if (idev->cnf.disable_ipv6) {
1063                err = -EACCES;
1064                goto out;
1065        }
1066
1067        /* validator notifier needs to be blocking;
1068         * do not call in atomic context
1069         */
1070        if (can_block) {
1071                struct in6_validator_info i6vi = {
1072                        .i6vi_addr = *cfg->pfx,
1073                        .i6vi_dev = idev,
1074                        .extack = extack,
1075                };
1076
1077                err = inet6addr_validator_notifier_call_chain(NETDEV_UP, &i6vi);
1078                err = notifier_to_errno(err);
1079                if (err < 0)
1080                        goto out;
1081        }
1082
1083        ifa = kzalloc(sizeof(*ifa), gfp_flags);
1084        if (!ifa) {
1085                err = -ENOBUFS;
1086                goto out;
1087        }
1088
1089        f6i = addrconf_f6i_alloc(net, idev, cfg->pfx, false, gfp_flags);
1090        if (IS_ERR(f6i)) {
1091                err = PTR_ERR(f6i);
1092                f6i = NULL;
1093                goto out;
1094        }
1095
1096        if (net->ipv6.devconf_all->disable_policy ||
1097            idev->cnf.disable_policy)
1098                f6i->dst_nopolicy = true;
1099
1100        neigh_parms_data_state_setall(idev->nd_parms);
1101
1102        ifa->addr = *cfg->pfx;
1103        if (cfg->peer_pfx)
1104                ifa->peer_addr = *cfg->peer_pfx;
1105
1106        spin_lock_init(&ifa->lock);
1107        INIT_DELAYED_WORK(&ifa->dad_work, addrconf_dad_work);
1108        INIT_HLIST_NODE(&ifa->addr_lst);
1109        ifa->scope = cfg->scope;
1110        ifa->prefix_len = cfg->plen;
1111        ifa->rt_priority = cfg->rt_priority;
1112        ifa->flags = cfg->ifa_flags;
1113        /* No need to add the TENTATIVE flag for addresses with NODAD */
1114        if (!(cfg->ifa_flags & IFA_F_NODAD))
1115                ifa->flags |= IFA_F_TENTATIVE;
1116        ifa->valid_lft = cfg->valid_lft;
1117        ifa->prefered_lft = cfg->preferred_lft;
1118        ifa->cstamp = ifa->tstamp = jiffies;
1119        ifa->tokenized = false;
1120
1121        ifa->rt = f6i;
1122
1123        ifa->idev = idev;
1124        in6_dev_hold(idev);
1125
1126        /* For caller */
1127        refcount_set(&ifa->refcnt, 1);
1128
1129        rcu_read_lock_bh();
1130
1131        err = ipv6_add_addr_hash(idev->dev, ifa);
1132        if (err < 0) {
1133                rcu_read_unlock_bh();
1134                goto out;
1135        }
1136
1137        write_lock(&idev->lock);
1138
1139        /* Add to inet6_dev unicast addr list. */
1140        ipv6_link_dev_addr(idev, ifa);
1141
1142        if (ifa->flags&IFA_F_TEMPORARY) {
1143                list_add(&ifa->tmp_list, &idev->tempaddr_list);
1144                in6_ifa_hold(ifa);
1145        }
1146
1147        in6_ifa_hold(ifa);
1148        write_unlock(&idev->lock);
1149
1150        rcu_read_unlock_bh();
1151
1152        inet6addr_notifier_call_chain(NETDEV_UP, ifa);
1153out:
1154        if (unlikely(err < 0)) {
1155                fib6_info_release(f6i);
1156
1157                if (ifa) {
1158                        if (ifa->idev)
1159                                in6_dev_put(ifa->idev);
1160                        kfree(ifa);
1161                }
1162                ifa = ERR_PTR(err);
1163        }
1164
1165        return ifa;
1166}
1167
1168enum cleanup_prefix_rt_t {
1169        CLEANUP_PREFIX_RT_NOP,    /* no cleanup action for prefix route */
1170        CLEANUP_PREFIX_RT_DEL,    /* delete the prefix route */
1171        CLEANUP_PREFIX_RT_EXPIRE, /* update the lifetime of the prefix route */
1172};
1173
1174/*
1175 * Check, whether the prefix for ifp would still need a prefix route
1176 * after deleting ifp. The function returns one of the CLEANUP_PREFIX_RT_*
1177 * constants.
1178 *
1179 * 1) we don't purge prefix if address was not permanent.
1180 *    prefix is managed by its own lifetime.
1181 * 2) we also don't purge, if the address was IFA_F_NOPREFIXROUTE.
1182 * 3) if there are no addresses, delete prefix.
1183 * 4) if there are still other permanent address(es),
1184 *    corresponding prefix is still permanent.
1185 * 5) if there are still other addresses with IFA_F_NOPREFIXROUTE,
1186 *    don't purge the prefix, assume user space is managing it.
1187 * 6) otherwise, update prefix lifetime to the
1188 *    longest valid lifetime among the corresponding
1189 *    addresses on the device.
1190 *    Note: subsequent RA will update lifetime.
1191 **/
1192static enum cleanup_prefix_rt_t
1193check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
1194{
1195        struct inet6_ifaddr *ifa;
1196        struct inet6_dev *idev = ifp->idev;
1197        unsigned long lifetime;
1198        enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_DEL;
1199
1200        *expires = jiffies;
1201
1202        list_for_each_entry(ifa, &idev->addr_list, if_list) {
1203                if (ifa == ifp)
1204                        continue;
1205                if (ifa->prefix_len != ifp->prefix_len ||
1206                    !ipv6_prefix_equal(&ifa->addr, &ifp->addr,
1207                                       ifp->prefix_len))
1208                        continue;
1209                if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
1210                        return CLEANUP_PREFIX_RT_NOP;
1211
1212                action = CLEANUP_PREFIX_RT_EXPIRE;
1213
1214                spin_lock(&ifa->lock);
1215
1216                lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
1217                /*
1218                 * Note: Because this address is
1219                 * not permanent, lifetime <
1220                 * LONG_MAX / HZ here.
1221                 */
1222                if (time_before(*expires, ifa->tstamp + lifetime * HZ))
1223                        *expires = ifa->tstamp + lifetime * HZ;
1224                spin_unlock(&ifa->lock);
1225        }
1226
1227        return action;
1228}
1229
1230static void
1231cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires,
1232                     bool del_rt, bool del_peer)
1233{
1234        struct fib6_info *f6i;
1235
1236        f6i = addrconf_get_prefix_route(del_peer ? &ifp->peer_addr : &ifp->addr,
1237                                        ifp->prefix_len,
1238                                        ifp->idev->dev, 0, RTF_DEFAULT, true);
1239        if (f6i) {
1240                if (del_rt)
1241                        ip6_del_rt(dev_net(ifp->idev->dev), f6i, false);
1242                else {
1243                        if (!(f6i->fib6_flags & RTF_EXPIRES))
1244                                fib6_set_expires(f6i, expires);
1245                        fib6_info_release(f6i);
1246                }
1247        }
1248}
1249
1250
1251/* This function wants to get referenced ifp and releases it before return */
1252
1253static void ipv6_del_addr(struct inet6_ifaddr *ifp)
1254{
1255        int state;
1256        enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_NOP;
1257        unsigned long expires;
1258
1259        ASSERT_RTNL();
1260
1261        spin_lock_bh(&ifp->lock);
1262        state = ifp->state;
1263        ifp->state = INET6_IFADDR_STATE_DEAD;
1264        spin_unlock_bh(&ifp->lock);
1265
1266        if (state == INET6_IFADDR_STATE_DEAD)
1267                goto out;
1268
1269        spin_lock_bh(&addrconf_hash_lock);
1270        hlist_del_init_rcu(&ifp->addr_lst);
1271        spin_unlock_bh(&addrconf_hash_lock);
1272
1273        write_lock_bh(&ifp->idev->lock);
1274
1275        if (ifp->flags&IFA_F_TEMPORARY) {
1276                list_del(&ifp->tmp_list);
1277                if (ifp->ifpub) {
1278                        in6_ifa_put(ifp->ifpub);
1279                        ifp->ifpub = NULL;
1280                }
1281                __in6_ifa_put(ifp);
1282        }
1283
1284        if (ifp->flags & IFA_F_PERMANENT && !(ifp->flags & IFA_F_NOPREFIXROUTE))
1285                action = check_cleanup_prefix_route(ifp, &expires);
1286
1287        list_del_rcu(&ifp->if_list);
1288        __in6_ifa_put(ifp);
1289
1290        write_unlock_bh(&ifp->idev->lock);
1291
1292        addrconf_del_dad_work(ifp);
1293
1294        ipv6_ifa_notify(RTM_DELADDR, ifp);
1295
1296        inet6addr_notifier_call_chain(NETDEV_DOWN, ifp);
1297
1298        if (action != CLEANUP_PREFIX_RT_NOP) {
1299                cleanup_prefix_route(ifp, expires,
1300                        action == CLEANUP_PREFIX_RT_DEL, false);
1301        }
1302
1303        /* clean up prefsrc entries */
1304        rt6_remove_prefsrc(ifp);
1305out:
1306        in6_ifa_put(ifp);
1307}
1308
1309static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
1310{
1311        struct inet6_dev *idev = ifp->idev;
1312        unsigned long tmp_tstamp, age;
1313        unsigned long regen_advance;
1314        unsigned long now = jiffies;
1315        s32 cnf_temp_preferred_lft;
1316        struct inet6_ifaddr *ift;
1317        struct ifa6_config cfg;
1318        long max_desync_factor;
1319        struct in6_addr addr;
1320        int ret = 0;
1321
1322        write_lock_bh(&idev->lock);
1323
1324retry:
1325        in6_dev_hold(idev);
1326        if (idev->cnf.use_tempaddr <= 0) {
1327                write_unlock_bh(&idev->lock);
1328                pr_info("%s: use_tempaddr is disabled\n", __func__);
1329                in6_dev_put(idev);
1330                ret = -1;
1331                goto out;
1332        }
1333        spin_lock_bh(&ifp->lock);
1334        if (ifp->regen_count++ >= idev->cnf.regen_max_retry) {
1335                idev->cnf.use_tempaddr = -1;    /*XXX*/
1336                spin_unlock_bh(&ifp->lock);
1337                write_unlock_bh(&idev->lock);
1338                pr_warn("%s: regeneration time exceeded - disabled temporary address support\n",
1339                        __func__);
1340                in6_dev_put(idev);
1341                ret = -1;
1342                goto out;
1343        }
1344        in6_ifa_hold(ifp);
1345        memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);
1346        ipv6_gen_rnd_iid(&addr);
1347
1348        age = (now - ifp->tstamp) / HZ;
1349
1350        regen_advance = idev->cnf.regen_max_retry *
1351                        idev->cnf.dad_transmits *
1352                        max(NEIGH_VAR(idev->nd_parms, RETRANS_TIME), HZ/100) / HZ;
1353
1354        /* recalculate max_desync_factor each time and update
1355         * idev->desync_factor if it's larger
1356         */
1357        cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft);
1358        max_desync_factor = min_t(__u32,
1359                                  idev->cnf.max_desync_factor,
1360                                  cnf_temp_preferred_lft - regen_advance);
1361
1362        if (unlikely(idev->desync_factor > max_desync_factor)) {
1363                if (max_desync_factor > 0) {
1364                        get_random_bytes(&idev->desync_factor,
1365                                         sizeof(idev->desync_factor));
1366                        idev->desync_factor %= max_desync_factor;
1367                } else {
1368                        idev->desync_factor = 0;
1369                }
1370        }
1371
1372        memset(&cfg, 0, sizeof(cfg));
1373        cfg.valid_lft = min_t(__u32, ifp->valid_lft,
1374                              idev->cnf.temp_valid_lft + age);
1375        cfg.preferred_lft = cnf_temp_preferred_lft + age - idev->desync_factor;
1376        cfg.preferred_lft = min_t(__u32, ifp->prefered_lft, cfg.preferred_lft);
1377
1378        cfg.plen = ifp->prefix_len;
1379        tmp_tstamp = ifp->tstamp;
1380        spin_unlock_bh(&ifp->lock);
1381
1382        write_unlock_bh(&idev->lock);
1383
1384        /* A temporary address is created only if this calculated Preferred
1385         * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
1386         * an implementation must not create a temporary address with a zero
1387         * Preferred Lifetime.
1388         * Use age calculation as in addrconf_verify to avoid unnecessary
1389         * temporary addresses being generated.
1390         */
1391        age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
1392        if (cfg.preferred_lft <= regen_advance + age) {
1393                in6_ifa_put(ifp);
1394                in6_dev_put(idev);
1395                ret = -1;
1396                goto out;
1397        }
1398
1399        cfg.ifa_flags = IFA_F_TEMPORARY;
1400        /* set in addrconf_prefix_rcv() */
1401        if (ifp->flags & IFA_F_OPTIMISTIC)
1402                cfg.ifa_flags |= IFA_F_OPTIMISTIC;
1403
1404        cfg.pfx = &addr;
1405        cfg.scope = ipv6_addr_scope(cfg.pfx);
1406
1407        ift = ipv6_add_addr(idev, &cfg, block, NULL);
1408        if (IS_ERR(ift)) {
1409                in6_ifa_put(ifp);
1410                in6_dev_put(idev);
1411                pr_info("%s: retry temporary address regeneration\n", __func__);
1412                write_lock_bh(&idev->lock);
1413                goto retry;
1414        }
1415
1416        spin_lock_bh(&ift->lock);
1417        ift->ifpub = ifp;
1418        ift->cstamp = now;
1419        ift->tstamp = tmp_tstamp;
1420        spin_unlock_bh(&ift->lock);
1421
1422        addrconf_dad_start(ift);
1423        in6_ifa_put(ift);
1424        in6_dev_put(idev);
1425out:
1426        return ret;
1427}
1428
1429/*
1430 *      Choose an appropriate source address (RFC3484)
1431 */
1432enum {
1433        IPV6_SADDR_RULE_INIT = 0,
1434        IPV6_SADDR_RULE_LOCAL,
1435        IPV6_SADDR_RULE_SCOPE,
1436        IPV6_SADDR_RULE_PREFERRED,
1437#ifdef CONFIG_IPV6_MIP6
1438        IPV6_SADDR_RULE_HOA,
1439#endif
1440        IPV6_SADDR_RULE_OIF,
1441        IPV6_SADDR_RULE_LABEL,
1442        IPV6_SADDR_RULE_PRIVACY,
1443        IPV6_SADDR_RULE_ORCHID,
1444        IPV6_SADDR_RULE_PREFIX,
1445#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1446        IPV6_SADDR_RULE_NOT_OPTIMISTIC,
1447#endif
1448        IPV6_SADDR_RULE_MAX
1449};
1450
1451struct ipv6_saddr_score {
1452        int                     rule;
1453        int                     addr_type;
1454        struct inet6_ifaddr     *ifa;
1455        DECLARE_BITMAP(scorebits, IPV6_SADDR_RULE_MAX);
1456        int                     scopedist;
1457        int                     matchlen;
1458};
1459
1460struct ipv6_saddr_dst {
1461        const struct in6_addr *addr;
1462        int ifindex;
1463        int scope;
1464        int label;
1465        unsigned int prefs;
1466};
1467
1468static inline int ipv6_saddr_preferred(int type)
1469{
1470        if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))
1471                return 1;
1472        return 0;
1473}
1474
1475static bool ipv6_use_optimistic_addr(struct net *net,
1476                                     struct inet6_dev *idev)
1477{
1478#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1479        if (!idev)
1480                return false;
1481        if (!net->ipv6.devconf_all->optimistic_dad && !idev->cnf.optimistic_dad)
1482                return false;
1483        if (!net->ipv6.devconf_all->use_optimistic && !idev->cnf.use_optimistic)
1484                return false;
1485
1486        return true;
1487#else
1488        return false;
1489#endif
1490}
1491
1492static bool ipv6_allow_optimistic_dad(struct net *net,
1493                                      struct inet6_dev *idev)
1494{
1495#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1496        if (!idev)
1497                return false;
1498        if (!net->ipv6.devconf_all->optimistic_dad && !idev->cnf.optimistic_dad)
1499                return false;
1500
1501        return true;
1502#else
1503        return false;
1504#endif
1505}
1506
1507static int ipv6_get_saddr_eval(struct net *net,
1508                               struct ipv6_saddr_score *score,
1509                               struct ipv6_saddr_dst *dst,
1510                               int i)
1511{
1512        int ret;
1513
1514        if (i <= score->rule) {
1515                switch (i) {
1516                case IPV6_SADDR_RULE_SCOPE:
1517                        ret = score->scopedist;
1518                        break;
1519                case IPV6_SADDR_RULE_PREFIX:
1520                        ret = score->matchlen;
1521                        break;
1522                default:
1523                        ret = !!test_bit(i, score->scorebits);
1524                }
1525                goto out;
1526        }
1527
1528        switch (i) {
1529        case IPV6_SADDR_RULE_INIT:
1530                /* Rule 0: remember if hiscore is not ready yet */
1531                ret = !!score->ifa;
1532                break;
1533        case IPV6_SADDR_RULE_LOCAL:
1534                /* Rule 1: Prefer same address */
1535                ret = ipv6_addr_equal(&score->ifa->addr, dst->addr);
1536                break;
1537        case IPV6_SADDR_RULE_SCOPE:
1538                /* Rule 2: Prefer appropriate scope
1539                 *
1540                 *      ret
1541                 *       ^
1542                 *    -1 |  d 15
1543                 *    ---+--+-+---> scope
1544                 *       |
1545                 *       |             d is scope of the destination.
1546                 *  B-d  |  \
1547                 *       |   \      <- smaller scope is better if
1548                 *  B-15 |    \        if scope is enough for destination.
1549                 *       |             ret = B - scope (-1 <= scope >= d <= 15).
1550                 * d-C-1 | /
1551                 *       |/         <- greater is better
1552                 *   -C  /             if scope is not enough for destination.
1553                 *      /|             ret = scope - C (-1 <= d < scope <= 15).
1554                 *
1555                 * d - C - 1 < B -15 (for all -1 <= d <= 15).
1556                 * C > d + 14 - B >= 15 + 14 - B = 29 - B.
1557                 * Assume B = 0 and we get C > 29.
1558                 */
1559                ret = __ipv6_addr_src_scope(score->addr_type);
1560                if (ret >= dst->scope)
1561                        ret = -ret;
1562                else
1563                        ret -= 128;     /* 30 is enough */
1564                score->scopedist = ret;
1565                break;
1566        case IPV6_SADDR_RULE_PREFERRED:
1567            {
1568                /* Rule 3: Avoid deprecated and optimistic addresses */
1569                u8 avoid = IFA_F_DEPRECATED;
1570
1571                if (!ipv6_use_optimistic_addr(net, score->ifa->idev))
1572                        avoid |= IFA_F_OPTIMISTIC;
1573                ret = ipv6_saddr_preferred(score->addr_type) ||
1574                      !(score->ifa->flags & avoid);
1575                break;
1576            }
1577#ifdef CONFIG_IPV6_MIP6
1578        case IPV6_SADDR_RULE_HOA:
1579            {
1580                /* Rule 4: Prefer home address */
1581                int prefhome = !(dst->prefs & IPV6_PREFER_SRC_COA);
1582                ret = !(score->ifa->flags & IFA_F_HOMEADDRESS) ^ prefhome;
1583                break;
1584            }
1585#endif
1586        case IPV6_SADDR_RULE_OIF:
1587                /* Rule 5: Prefer outgoing interface */
1588                ret = (!dst->ifindex ||
1589                       dst->ifindex == score->ifa->idev->dev->ifindex);
1590                break;
1591        case IPV6_SADDR_RULE_LABEL:
1592                /* Rule 6: Prefer matching label */
1593                ret = ipv6_addr_label(net,
1594                                      &score->ifa->addr, score->addr_type,
1595                                      score->ifa->idev->dev->ifindex) == dst->label;
1596                break;
1597        case IPV6_SADDR_RULE_PRIVACY:
1598            {
1599                /* Rule 7: Prefer public address
1600                 * Note: prefer temporary address if use_tempaddr >= 2
1601                 */
1602                int preftmp = dst->prefs & (IPV6_PREFER_SRC_PUBLIC|IPV6_PREFER_SRC_TMP) ?
1603                                !!(dst->prefs & IPV6_PREFER_SRC_TMP) :
1604                                score->ifa->idev->cnf.use_tempaddr >= 2;
1605                ret = (!(score->ifa->flags & IFA_F_TEMPORARY)) ^ preftmp;
1606                break;
1607            }
1608        case IPV6_SADDR_RULE_ORCHID:
1609                /* Rule 8-: Prefer ORCHID vs ORCHID or
1610                 *          non-ORCHID vs non-ORCHID
1611                 */
1612                ret = !(ipv6_addr_orchid(&score->ifa->addr) ^
1613                        ipv6_addr_orchid(dst->addr));
1614                break;
1615        case IPV6_SADDR_RULE_PREFIX:
1616                /* Rule 8: Use longest matching prefix */
1617                ret = ipv6_addr_diff(&score->ifa->addr, dst->addr);
1618                if (ret > score->ifa->prefix_len)
1619                        ret = score->ifa->prefix_len;
1620                score->matchlen = ret;
1621                break;
1622#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1623        case IPV6_SADDR_RULE_NOT_OPTIMISTIC:
1624                /* Optimistic addresses still have lower precedence than other
1625                 * preferred addresses.
1626                 */
1627                ret = !(score->ifa->flags & IFA_F_OPTIMISTIC);
1628                break;
1629#endif
1630        default:
1631                ret = 0;
1632        }
1633
1634        if (ret)
1635                __set_bit(i, score->scorebits);
1636        score->rule = i;
1637out:
1638        return ret;
1639}
1640
1641static int __ipv6_dev_get_saddr(struct net *net,
1642                                struct ipv6_saddr_dst *dst,
1643                                struct inet6_dev *idev,
1644                                struct ipv6_saddr_score *scores,
1645                                int hiscore_idx)
1646{
1647        struct ipv6_saddr_score *score = &scores[1 - hiscore_idx], *hiscore = &scores[hiscore_idx];
1648
1649        list_for_each_entry_rcu(score->ifa, &idev->addr_list, if_list) {
1650                int i;
1651
1652                /*
1653                 * - Tentative Address (RFC2462 section 5.4)
1654                 *  - A tentative address is not considered
1655                 *    "assigned to an interface" in the traditional
1656                 *    sense, unless it is also flagged as optimistic.
1657                 * - Candidate Source Address (section 4)
1658                 *  - In any case, anycast addresses, multicast
1659                 *    addresses, and the unspecified address MUST
1660                 *    NOT be included in a candidate set.
1661                 */
1662                if ((score->ifa->flags & IFA_F_TENTATIVE) &&
1663                    (!(score->ifa->flags & IFA_F_OPTIMISTIC)))
1664                        continue;
1665
1666                score->addr_type = __ipv6_addr_type(&score->ifa->addr);
1667
1668                if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
1669                             score->addr_type & IPV6_ADDR_MULTICAST)) {
1670                        net_dbg_ratelimited("ADDRCONF: unspecified / multicast address assigned as unicast address on %s",
1671                                            idev->dev->name);
1672                        continue;
1673                }
1674
1675                score->rule = -1;
1676                bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
1677
1678                for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
1679                        int minihiscore, miniscore;
1680
1681                        minihiscore = ipv6_get_saddr_eval(net, hiscore, dst, i);
1682                        miniscore = ipv6_get_saddr_eval(net, score, dst, i);
1683
1684                        if (minihiscore > miniscore) {
1685                                if (i == IPV6_SADDR_RULE_SCOPE &&
1686                                    score->scopedist > 0) {
1687                                        /*
1688                                         * special case:
1689                                         * each remaining entry
1690                                         * has too small (not enough)
1691                                         * scope, because ifa entries
1692                                         * are sorted by their scope
1693                                         * values.
1694                                         */
1695                                        goto out;
1696                                }
1697                                break;
1698                        } else if (minihiscore < miniscore) {
1699                                swap(hiscore, score);
1700                                hiscore_idx = 1 - hiscore_idx;
1701
1702                                /* restore our iterator */
1703                                score->ifa = hiscore->ifa;
1704
1705                                break;
1706                        }
1707                }
1708        }
1709out:
1710        return hiscore_idx;
1711}
1712
1713static int ipv6_get_saddr_master(struct net *net,
1714                                 const struct net_device *dst_dev,
1715                                 const struct net_device *master,
1716                                 struct ipv6_saddr_dst *dst,
1717                                 struct ipv6_saddr_score *scores,
1718                                 int hiscore_idx)
1719{
1720        struct inet6_dev *idev;
1721
1722        idev = __in6_dev_get(dst_dev);
1723        if (idev)
1724                hiscore_idx = __ipv6_dev_get_saddr(net, dst, idev,
1725                                                   scores, hiscore_idx);
1726
1727        idev = __in6_dev_get(master);
1728        if (idev)
1729                hiscore_idx = __ipv6_dev_get_saddr(net, dst, idev,
1730                                                   scores, hiscore_idx);
1731
1732        return hiscore_idx;
1733}
1734
1735int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
1736                       const struct in6_addr *daddr, unsigned int prefs,
1737                       struct in6_addr *saddr)
1738{
1739        struct ipv6_saddr_score scores[2], *hiscore;
1740        struct ipv6_saddr_dst dst;
1741        struct inet6_dev *idev;
1742        struct net_device *dev;
1743        int dst_type;
1744        bool use_oif_addr = false;
1745        int hiscore_idx = 0;
1746        int ret = 0;
1747
1748        dst_type = __ipv6_addr_type(daddr);
1749        dst.addr = daddr;
1750        dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
1751        dst.scope = __ipv6_addr_src_scope(dst_type);
1752        dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);
1753        dst.prefs = prefs;
1754
1755        scores[hiscore_idx].rule = -1;
1756        scores[hiscore_idx].ifa = NULL;
1757
1758        rcu_read_lock();
1759
1760        /* Candidate Source Address (section 4)
1761         *  - multicast and link-local destination address,
1762         *    the set of candidate source address MUST only
1763         *    include addresses assigned to interfaces
1764         *    belonging to the same link as the outgoing
1765         *    interface.
1766         * (- For site-local destination addresses, the
1767         *    set of candidate source addresses MUST only
1768         *    include addresses assigned to interfaces
1769         *    belonging to the same site as the outgoing
1770         *    interface.)
1771         *  - "It is RECOMMENDED that the candidate source addresses
1772         *    be the set of unicast addresses assigned to the
1773         *    interface that will be used to send to the destination
1774         *    (the 'outgoing' interface)." (RFC 6724)
1775         */
1776        if (dst_dev) {
1777                idev = __in6_dev_get(dst_dev);
1778                if ((dst_type & IPV6_ADDR_MULTICAST) ||
1779                    dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL ||
1780                    (idev && idev->cnf.use_oif_addrs_only)) {
1781                        use_oif_addr = true;
1782                }
1783        }
1784
1785        if (use_oif_addr) {
1786                if (idev)
1787                        hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
1788        } else {
1789                const struct net_device *master;
1790                int master_idx = 0;
1791
1792                /* if dst_dev exists and is enslaved to an L3 device, then
1793                 * prefer addresses from dst_dev and then the master over
1794                 * any other enslaved devices in the L3 domain.
1795                 */
1796                master = l3mdev_master_dev_rcu(dst_dev);
1797                if (master) {
1798                        master_idx = master->ifindex;
1799
1800                        hiscore_idx = ipv6_get_saddr_master(net, dst_dev,
1801                                                            master, &dst,
1802                                                            scores, hiscore_idx);
1803
1804                        if (scores[hiscore_idx].ifa)
1805                                goto out;
1806                }
1807
1808                for_each_netdev_rcu(net, dev) {
1809                        /* only consider addresses on devices in the
1810                         * same L3 domain
1811                         */
1812                        if (l3mdev_master_ifindex_rcu(dev) != master_idx)
1813                                continue;
1814                        idev = __in6_dev_get(dev);
1815                        if (!idev)
1816                                continue;
1817                        hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
1818                }
1819        }
1820
1821out:
1822        hiscore = &scores[hiscore_idx];
1823        if (!hiscore->ifa)
1824                ret = -EADDRNOTAVAIL;
1825        else
1826                *saddr = hiscore->ifa->addr;
1827
1828        rcu_read_unlock();
1829        return ret;
1830}
1831EXPORT_SYMBOL(ipv6_dev_get_saddr);
1832
1833int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
1834                      u32 banned_flags)
1835{
1836        struct inet6_ifaddr *ifp;
1837        int err = -EADDRNOTAVAIL;
1838
1839        list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
1840                if (ifp->scope > IFA_LINK)
1841                        break;
1842                if (ifp->scope == IFA_LINK &&
1843                    !(ifp->flags & banned_flags)) {
1844                        *addr = ifp->addr;
1845                        err = 0;
1846                        break;
1847                }
1848        }
1849        return err;
1850}
1851
1852int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
1853                    u32 banned_flags)
1854{
1855        struct inet6_dev *idev;
1856        int err = -EADDRNOTAVAIL;
1857
1858        rcu_read_lock();
1859        idev = __in6_dev_get(dev);
1860        if (idev) {
1861                read_lock_bh(&idev->lock);
1862                err = __ipv6_get_lladdr(idev, addr, banned_flags);
1863                read_unlock_bh(&idev->lock);
1864        }
1865        rcu_read_unlock();
1866        return err;
1867}
1868
1869static int ipv6_count_addresses(const struct inet6_dev *idev)
1870{
1871        const struct inet6_ifaddr *ifp;
1872        int cnt = 0;
1873
1874        rcu_read_lock();
1875        list_for_each_entry_rcu(ifp, &idev->addr_list, if_list)
1876                cnt++;
1877        rcu_read_unlock();
1878        return cnt;
1879}
1880
1881int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
1882                  const struct net_device *dev, int strict)
1883{
1884        return ipv6_chk_addr_and_flags(net, addr, dev, !dev,
1885                                       strict, IFA_F_TENTATIVE);
1886}
1887EXPORT_SYMBOL(ipv6_chk_addr);
1888
1889/* device argument is used to find the L3 domain of interest. If
1890 * skip_dev_check is set, then the ifp device is not checked against
1891 * the passed in dev argument. So the 2 cases for addresses checks are:
1892 *   1. does the address exist in the L3 domain that dev is part of
1893 *      (skip_dev_check = true), or
1894 *
1895 *   2. does the address exist on the specific device
1896 *      (skip_dev_check = false)
1897 */
1898static struct net_device *
1899__ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
1900                          const struct net_device *dev, bool skip_dev_check,
1901                          int strict, u32 banned_flags)
1902{
1903        unsigned int hash = inet6_addr_hash(net, addr);
1904        struct net_device *l3mdev, *ndev;
1905        struct inet6_ifaddr *ifp;
1906        u32 ifp_flags;
1907
1908        rcu_read_lock();
1909
1910        l3mdev = l3mdev_master_dev_rcu(dev);
1911        if (skip_dev_check)
1912                dev = NULL;
1913
1914        hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
1915                ndev = ifp->idev->dev;
1916                if (!net_eq(dev_net(ndev), net))
1917                        continue;
1918
1919                if (l3mdev_master_dev_rcu(ndev) != l3mdev)
1920                        continue;
1921
1922                /* Decouple optimistic from tentative for evaluation here.
1923                 * Ban optimistic addresses explicitly, when required.
1924                 */
1925                ifp_flags = (ifp->flags&IFA_F_OPTIMISTIC)
1926                            ? (ifp->flags&~IFA_F_TENTATIVE)
1927                            : ifp->flags;
1928                if (ipv6_addr_equal(&ifp->addr, addr) &&
1929                    !(ifp_flags&banned_flags) &&
1930                    (!dev || ndev == dev ||
1931                     !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
1932                        rcu_read_unlock();
1933                        return ndev;
1934                }
1935        }
1936
1937        rcu_read_unlock();
1938        return NULL;
1939}
1940
1941int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
1942                            const struct net_device *dev, bool skip_dev_check,
1943                            int strict, u32 banned_flags)
1944{
1945        return __ipv6_chk_addr_and_flags(net, addr, dev, skip_dev_check,
1946                                         strict, banned_flags) ? 1 : 0;
1947}
1948EXPORT_SYMBOL(ipv6_chk_addr_and_flags);
1949
1950
1951/* Compares an address/prefix_len with addresses on device @dev.
1952 * If one is found it returns true.
1953 */
1954bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
1955        const unsigned int prefix_len, struct net_device *dev)
1956{
1957        const struct inet6_ifaddr *ifa;
1958        const struct inet6_dev *idev;
1959        bool ret = false;
1960
1961        rcu_read_lock();
1962        idev = __in6_dev_get(dev);
1963        if (idev) {
1964                list_for_each_entry_rcu(ifa, &idev->addr_list, if_list) {
1965                        ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
1966                        if (ret)
1967                                break;
1968                }
1969        }
1970        rcu_read_unlock();
1971
1972        return ret;
1973}
1974EXPORT_SYMBOL(ipv6_chk_custom_prefix);
1975
1976int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
1977{
1978        const struct inet6_ifaddr *ifa;
1979        const struct inet6_dev *idev;
1980        int     onlink;
1981
1982        onlink = 0;
1983        rcu_read_lock();
1984        idev = __in6_dev_get(dev);
1985        if (idev) {
1986                list_for_each_entry_rcu(ifa, &idev->addr_list, if_list) {
1987                        onlink = ipv6_prefix_equal(addr, &ifa->addr,
1988                                                   ifa->prefix_len);
1989                        if (onlink)
1990                                break;
1991                }
1992        }
1993        rcu_read_unlock();
1994        return onlink;
1995}
1996EXPORT_SYMBOL(ipv6_chk_prefix);
1997
1998/**
1999 * ipv6_dev_find - find the first device with a given source address.
2000 * @net: the net namespace
2001 * @addr: the source address
2002 * @dev: used to find the L3 domain of interest
2003 *
2004 * The caller should be protected by RCU, or RTNL.
2005 */
2006struct net_device *ipv6_dev_find(struct net *net, const struct in6_addr *addr,
2007                                 struct net_device *dev)
2008{
2009        return __ipv6_chk_addr_and_flags(net, addr, dev, !dev, 1,
2010                                         IFA_F_TENTATIVE);
2011}
2012EXPORT_SYMBOL(ipv6_dev_find);
2013
2014struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,
2015                                     struct net_device *dev, int strict)
2016{
2017        unsigned int hash = inet6_addr_hash(net, addr);
2018        struct inet6_ifaddr *ifp, *result = NULL;
2019
2020        rcu_read_lock();
2021        hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
2022                if (!net_eq(dev_net(ifp->idev->dev), net))
2023                        continue;
2024                if (ipv6_addr_equal(&ifp->addr, addr)) {
2025                        if (!dev || ifp->idev->dev == dev ||
2026                            !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {
2027                                result = ifp;
2028                                in6_ifa_hold(ifp);
2029                                break;
2030                        }
2031                }
2032        }
2033        rcu_read_unlock();
2034
2035        return result;
2036}
2037
2038/* Gets referenced address, destroys ifaddr */
2039
2040static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
2041{
2042        if (dad_failed)
2043                ifp->flags |= IFA_F_DADFAILED;
2044
2045        if (ifp->flags&IFA_F_TEMPORARY) {
2046                struct inet6_ifaddr *ifpub;
2047                spin_lock_bh(&ifp->lock);
2048                ifpub = ifp->ifpub;
2049                if (ifpub) {
2050                        in6_ifa_hold(ifpub);
2051                        spin_unlock_bh(&ifp->lock);
2052                        ipv6_create_tempaddr(ifpub, true);
2053                        in6_ifa_put(ifpub);
2054                } else {
2055                        spin_unlock_bh(&ifp->lock);
2056                }
2057                ipv6_del_addr(ifp);
2058        } else if (ifp->flags&IFA_F_PERMANENT || !dad_failed) {
2059                spin_lock_bh(&ifp->lock);
2060                addrconf_del_dad_work(ifp);
2061                ifp->flags |= IFA_F_TENTATIVE;
2062                if (dad_failed)
2063                        ifp->flags &= ~IFA_F_OPTIMISTIC;
2064                spin_unlock_bh(&ifp->lock);
2065                if (dad_failed)
2066                        ipv6_ifa_notify(0, ifp);
2067                in6_ifa_put(ifp);
2068        } else {
2069                ipv6_del_addr(ifp);
2070        }
2071}
2072
2073static int addrconf_dad_end(struct inet6_ifaddr *ifp)
2074{
2075        int err = -ENOENT;
2076
2077        spin_lock_bh(&ifp->lock);
2078        if (ifp->state == INET6_IFADDR_STATE_DAD) {
2079                ifp->state = INET6_IFADDR_STATE_POSTDAD;
2080                err = 0;
2081        }
2082        spin_unlock_bh(&ifp->lock);
2083
2084        return err;
2085}
2086
2087void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
2088{
2089        struct inet6_dev *idev = ifp->idev;
2090        struct net *net = dev_net(ifp->idev->dev);
2091
2092        if (addrconf_dad_end(ifp)) {
2093                in6_ifa_put(ifp);
2094                return;
2095        }
2096
2097        net_info_ratelimited("%s: IPv6 duplicate address %pI6c used by %pM detected!\n",
2098                             ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source);
2099
2100        spin_lock_bh(&ifp->lock);
2101
2102        if (ifp->flags & IFA_F_STABLE_PRIVACY) {
2103                struct in6_addr new_addr;
2104                struct inet6_ifaddr *ifp2;
2105                int retries = ifp->stable_privacy_retry + 1;
2106                struct ifa6_config cfg = {
2107                        .pfx = &new_addr,
2108                        .plen = ifp->prefix_len,
2109                        .ifa_flags = ifp->flags,
2110                        .valid_lft = ifp->valid_lft,
2111                        .preferred_lft = ifp->prefered_lft,
2112                        .scope = ifp->scope,
2113                };
2114
2115                if (retries > net->ipv6.sysctl.idgen_retries) {
2116                        net_info_ratelimited("%s: privacy stable address generation failed because of DAD conflicts!\n",
2117                                             ifp->idev->dev->name);
2118                        goto errdad;
2119                }
2120
2121                new_addr = ifp->addr;
2122                if (ipv6_generate_stable_address(&new_addr, retries,
2123                                                 idev))
2124                        goto errdad;
2125
2126                spin_unlock_bh(&ifp->lock);
2127
2128                if (idev->cnf.max_addresses &&
2129                    ipv6_count_addresses(idev) >=
2130                    idev->cnf.max_addresses)
2131                        goto lock_errdad;
2132
2133                net_info_ratelimited("%s: generating new stable privacy address because of DAD conflict\n",
2134                                     ifp->idev->dev->name);
2135
2136                ifp2 = ipv6_add_addr(idev, &cfg, false, NULL);
2137                if (IS_ERR(ifp2))
2138                        goto lock_errdad;
2139
2140                spin_lock_bh(&ifp2->lock);
2141                ifp2->stable_privacy_retry = retries;
2142                ifp2->state = INET6_IFADDR_STATE_PREDAD;
2143                spin_unlock_bh(&ifp2->lock);
2144
2145                addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
2146                in6_ifa_put(ifp2);
2147lock_errdad:
2148                spin_lock_bh(&ifp->lock);
2149        }
2150
2151errdad:
2152        /* transition from _POSTDAD to _ERRDAD */
2153        ifp->state = INET6_IFADDR_STATE_ERRDAD;
2154        spin_unlock_bh(&ifp->lock);
2155
2156        addrconf_mod_dad_work(ifp, 0);
2157        in6_ifa_put(ifp);
2158}
2159
2160/* Join to solicited addr multicast group.
2161 * caller must hold RTNL */
2162void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
2163{
2164        struct in6_addr maddr;
2165
2166        if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
2167                return;
2168
2169        addrconf_addr_solict_mult(addr, &maddr);
2170        ipv6_dev_mc_inc(dev, &maddr);
2171}
2172
2173/* caller must hold RTNL */
2174void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
2175{
2176        struct in6_addr maddr;
2177
2178        if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
2179                return;
2180
2181        addrconf_addr_solict_mult(addr, &maddr);
2182        __ipv6_dev_mc_dec(idev, &maddr);
2183}
2184
2185/* caller must hold RTNL */
2186static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
2187{
2188        struct in6_addr addr;
2189
2190        if (ifp->prefix_len >= 127) /* RFC 6164 */
2191                return;
2192        ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
2193        if (ipv6_addr_any(&addr))
2194                return;
2195        __ipv6_dev_ac_inc(ifp->idev, &addr);
2196}
2197
2198/* caller must hold RTNL */
2199static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
2200{
2201        struct in6_addr addr;
2202
2203        if (ifp->prefix_len >= 127) /* RFC 6164 */
2204                return;
2205        ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
2206        if (ipv6_addr_any(&addr))
2207                return;
2208        __ipv6_dev_ac_dec(ifp->idev, &addr);
2209}
2210
2211static int addrconf_ifid_6lowpan(u8 *eui, struct net_device *dev)
2212{
2213        switch (dev->addr_len) {
2214        case ETH_ALEN:
2215                memcpy(eui, dev->dev_addr, 3);
2216                eui[3] = 0xFF;
2217                eui[4] = 0xFE;
2218                memcpy(eui + 5, dev->dev_addr + 3, 3);
2219                break;
2220        case EUI64_ADDR_LEN:
2221                memcpy(eui, dev->dev_addr, EUI64_ADDR_LEN);
2222                eui[0] ^= 2;
2223                break;
2224        default:
2225                return -1;
2226        }
2227
2228        return 0;
2229}
2230
2231static int addrconf_ifid_ieee1394(u8 *eui, struct net_device *dev)
2232{
2233        union fwnet_hwaddr *ha;
2234
2235        if (dev->addr_len != FWNET_ALEN)
2236                return -1;
2237
2238        ha = (union fwnet_hwaddr *)dev->dev_addr;
2239
2240        memcpy(eui, &ha->uc.uniq_id, sizeof(ha->uc.uniq_id));
2241        eui[0] ^= 2;
2242        return 0;
2243}
2244
2245static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
2246{
2247        /* XXX: inherit EUI-64 from other interface -- yoshfuji */
2248        if (dev->addr_len != ARCNET_ALEN)
2249                return -1;
2250        memset(eui, 0, 7);
2251        eui[7] = *(u8 *)dev->dev_addr;
2252        return 0;
2253}
2254
2255static int addrconf_ifid_infiniband(u8 *eui, struct net_device *dev)
2256{
2257        if (dev->addr_len != INFINIBAND_ALEN)
2258                return -1;
2259        memcpy(eui, dev->dev_addr + 12, 8);
2260        eui[0] |= 2;
2261        return 0;
2262}
2263
2264static int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
2265{
2266        if (addr == 0)
2267                return -1;
2268        eui[0] = (ipv4_is_zeronet(addr) || ipv4_is_private_10(addr) ||
2269                  ipv4_is_loopback(addr) || ipv4_is_linklocal_169(addr) ||
2270                  ipv4_is_private_172(addr) || ipv4_is_test_192(addr) ||
2271                  ipv4_is_anycast_6to4(addr) || ipv4_is_private_192(addr) ||
2272                  ipv4_is_test_198(addr) || ipv4_is_multicast(addr) ||
2273                  ipv4_is_lbcast(addr)) ? 0x00 : 0x02;
2274        eui[1] = 0;
2275        eui[2] = 0x5E;
2276        eui[3] = 0xFE;
2277        memcpy(eui + 4, &addr, 4);
2278        return 0;
2279}
2280
2281static int addrconf_ifid_sit(u8 *eui, struct net_device *dev)
2282{
2283        if (dev->priv_flags & IFF_ISATAP)
2284                return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
2285        return -1;
2286}
2287
2288static int addrconf_ifid_gre(u8 *eui, struct net_device *dev)
2289{
2290        return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
2291}
2292
2293static int addrconf_ifid_ip6tnl(u8 *eui, struct net_device *dev)
2294{
2295        memcpy(eui, dev->perm_addr, 3);
2296        memcpy(eui + 5, dev->perm_addr + 3, 3);
2297        eui[3] = 0xFF;
2298        eui[4] = 0xFE;
2299        eui[0] ^= 2;
2300        return 0;
2301}
2302
2303static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
2304{
2305        switch (dev->type) {
2306        case ARPHRD_ETHER:
2307        case ARPHRD_FDDI:
2308                return addrconf_ifid_eui48(eui, dev);
2309        case ARPHRD_ARCNET:
2310                return addrconf_ifid_arcnet(eui, dev);
2311        case ARPHRD_INFINIBAND:
2312                return addrconf_ifid_infiniband(eui, dev);
2313        case ARPHRD_SIT:
2314                return addrconf_ifid_sit(eui, dev);
2315        case ARPHRD_IPGRE:
2316        case ARPHRD_TUNNEL:
2317                return addrconf_ifid_gre(eui, dev);
2318        case ARPHRD_6LOWPAN:
2319                return addrconf_ifid_6lowpan(eui, dev);
2320        case ARPHRD_IEEE1394:
2321                return addrconf_ifid_ieee1394(eui, dev);
2322        case ARPHRD_TUNNEL6:
2323        case ARPHRD_IP6GRE:
2324        case ARPHRD_RAWIP:
2325                return addrconf_ifid_ip6tnl(eui, dev);
2326        }
2327        return -1;
2328}
2329
2330static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
2331{
2332        int err = -1;
2333        struct inet6_ifaddr *ifp;
2334
2335        read_lock_bh(&idev->lock);
2336        list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
2337                if (ifp->scope > IFA_LINK)
2338                        break;
2339                if (ifp->scope == IFA_LINK && !(ifp->flags&IFA_F_TENTATIVE)) {
2340                        memcpy(eui, ifp->addr.s6_addr+8, 8);
2341                        err = 0;
2342                        break;
2343                }
2344        }
2345        read_unlock_bh(&idev->lock);
2346        return err;
2347}
2348
2349/* Generation of a randomized Interface Identifier
2350 * draft-ietf-6man-rfc4941bis, Section 3.3.1
2351 */
2352
2353static void ipv6_gen_rnd_iid(struct in6_addr *addr)
2354{
2355regen:
2356        get_random_bytes(&addr->s6_addr[8], 8);
2357
2358        /* <draft-ietf-6man-rfc4941bis-08.txt>, Section 3.3.1:
2359         * check if generated address is not inappropriate:
2360         *
2361         * - Reserved IPv6 Interface Identifiers
2362         * - XXX: already assigned to an address on the device
2363         */
2364
2365        /* Subnet-router anycast: 0000:0000:0000:0000 */
2366        if (!(addr->s6_addr32[2] | addr->s6_addr32[3]))
2367                goto regen;
2368
2369        /* IANA Ethernet block: 0200:5EFF:FE00:0000-0200:5EFF:FE00:5212
2370         * Proxy Mobile IPv6:   0200:5EFF:FE00:5213
2371         * IANA Ethernet block: 0200:5EFF:FE00:5214-0200:5EFF:FEFF:FFFF
2372         */
2373        if (ntohl(addr->s6_addr32[2]) == 0x02005eff &&
2374            (ntohl(addr->s6_addr32[3]) & 0Xff000000) == 0xfe000000)
2375                goto regen;
2376
2377        /* Reserved subnet anycast addresses */
2378        if (ntohl(addr->s6_addr32[2]) == 0xfdffffff &&
2379            ntohl(addr->s6_addr32[3]) >= 0Xffffff80)
2380                goto regen;
2381}
2382
2383/*
2384 *      Add prefix route.
2385 */
2386
2387static void
2388addrconf_prefix_route(struct in6_addr *pfx, int plen, u32 metric,
2389                      struct net_device *dev, unsigned long expires,
2390                      u32 flags, gfp_t gfp_flags)
2391{
2392        struct fib6_config cfg = {
2393                .fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_PREFIX,
2394                .fc_metric = metric ? : IP6_RT_PRIO_ADDRCONF,
2395                .fc_ifindex = dev->ifindex,
2396                .fc_expires = expires,
2397                .fc_dst_len = plen,
2398                .fc_flags = RTF_UP | flags,
2399                .fc_nlinfo.nl_net = dev_net(dev),
2400                .fc_protocol = RTPROT_KERNEL,
2401                .fc_type = RTN_UNICAST,
2402        };
2403
2404        cfg.fc_dst = *pfx;
2405
2406        /* Prevent useless cloning on PtP SIT.
2407           This thing is done here expecting that the whole
2408           class of non-broadcast devices need not cloning.
2409         */
2410#if IS_ENABLED(CONFIG_IPV6_SIT)
2411        if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
2412                cfg.fc_flags |= RTF_NONEXTHOP;
2413#endif
2414
2415        ip6_route_add(&cfg, gfp_flags, NULL);
2416}
2417
2418
2419static struct fib6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
2420                                                  int plen,
2421                                                  const struct net_device *dev,
2422                                                  u32 flags, u32 noflags,
2423                                                  bool no_gw)
2424{
2425        struct fib6_node *fn;
2426        struct fib6_info *rt = NULL;
2427        struct fib6_table *table;
2428        u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_PREFIX;
2429
2430        table = fib6_get_table(dev_net(dev), tb_id);
2431        if (!table)
2432                return NULL;
2433
2434        rcu_read_lock();
2435        fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0, true);
2436        if (!fn)
2437                goto out;
2438
2439        for_each_fib6_node_rt_rcu(fn) {
2440                /* prefix routes only use builtin fib6_nh */
2441                if (rt->nh)
2442                        continue;
2443
2444                if (rt->fib6_nh->fib_nh_dev->ifindex != dev->ifindex)
2445                        continue;
2446                if (no_gw && rt->fib6_nh->fib_nh_gw_family)
2447                        continue;
2448                if ((rt->fib6_flags & flags) != flags)
2449                        continue;
2450                if ((rt->fib6_flags & noflags) != 0)
2451                        continue;
2452                if (!fib6_info_hold_safe(rt))
2453                        continue;
2454                break;
2455        }
2456out:
2457        rcu_read_unlock();
2458        return rt;
2459}
2460
2461
2462/* Create "default" multicast route to the interface */
2463
2464static void addrconf_add_mroute(struct net_device *dev)
2465{
2466        struct fib6_config cfg = {
2467                .fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_LOCAL,
2468                .fc_metric = IP6_RT_PRIO_ADDRCONF,
2469                .fc_ifindex = dev->ifindex,
2470                .fc_dst_len = 8,
2471                .fc_flags = RTF_UP,
2472                .fc_type = RTN_MULTICAST,
2473                .fc_nlinfo.nl_net = dev_net(dev),
2474                .fc_protocol = RTPROT_KERNEL,
2475        };
2476
2477        ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
2478
2479        ip6_route_add(&cfg, GFP_KERNEL, NULL);
2480}
2481
2482static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
2483{
2484        struct inet6_dev *idev;
2485
2486        ASSERT_RTNL();
2487
2488        idev = ipv6_find_idev(dev);
2489        if (IS_ERR(idev))
2490                return idev;
2491
2492        if (idev->cnf.disable_ipv6)
2493                return ERR_PTR(-EACCES);
2494
2495        /* Add default multicast route */
2496        if (!(dev->flags & IFF_LOOPBACK) && !netif_is_l3_master(dev))
2497                addrconf_add_mroute(dev);
2498
2499        return idev;
2500}
2501
2502static void manage_tempaddrs(struct inet6_dev *idev,
2503                             struct inet6_ifaddr *ifp,
2504                             __u32 valid_lft, __u32 prefered_lft,
2505                             bool create, unsigned long now)
2506{
2507        u32 flags;
2508        struct inet6_ifaddr *ift;
2509
2510        read_lock_bh(&idev->lock);
2511        /* update all temporary addresses in the list */
2512        list_for_each_entry(ift, &idev->tempaddr_list, tmp_list) {
2513                int age, max_valid, max_prefered;
2514
2515                if (ifp != ift->ifpub)
2516                        continue;
2517
2518                /* RFC 4941 section 3.3:
2519                 * If a received option will extend the lifetime of a public
2520                 * address, the lifetimes of temporary addresses should
2521                 * be extended, subject to the overall constraint that no
2522                 * temporary addresses should ever remain "valid" or "preferred"
2523                 * for a time longer than (TEMP_VALID_LIFETIME) or
2524                 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR), respectively.
2525                 */
2526                age = (now - ift->cstamp) / HZ;
2527                max_valid = idev->cnf.temp_valid_lft - age;
2528                if (max_valid < 0)
2529                        max_valid = 0;
2530
2531                max_prefered = idev->cnf.temp_prefered_lft -
2532                               idev->desync_factor - age;
2533                if (max_prefered < 0)
2534                        max_prefered = 0;
2535
2536                if (valid_lft > max_valid)
2537                        valid_lft = max_valid;
2538
2539                if (prefered_lft > max_prefered)
2540                        prefered_lft = max_prefered;
2541
2542                spin_lock(&ift->lock);
2543                flags = ift->flags;
2544                ift->valid_lft = valid_lft;
2545                ift->prefered_lft = prefered_lft;
2546                ift->tstamp = now;
2547                if (prefered_lft > 0)
2548                        ift->flags &= ~IFA_F_DEPRECATED;
2549
2550                spin_unlock(&ift->lock);
2551                if (!(flags&IFA_F_TENTATIVE))
2552                        ipv6_ifa_notify(0, ift);
2553        }
2554
2555        if ((create || list_empty(&idev->tempaddr_list)) &&
2556            idev->cnf.use_tempaddr > 0) {
2557                /* When a new public address is created as described
2558                 * in [ADDRCONF], also create a new temporary address.
2559                 * Also create a temporary address if it's enabled but
2560                 * no temporary address currently exists.
2561                 */
2562                read_unlock_bh(&idev->lock);
2563                ipv6_create_tempaddr(ifp, false);
2564        } else {
2565                read_unlock_bh(&idev->lock);
2566        }
2567}
2568
2569static bool is_addr_mode_generate_stable(struct inet6_dev *idev)
2570{
2571        return idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_STABLE_PRIVACY ||
2572               idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_RANDOM;
2573}
2574
2575int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,
2576                                 const struct prefix_info *pinfo,
2577                                 struct inet6_dev *in6_dev,
2578                                 const struct in6_addr *addr, int addr_type,
2579                                 u32 addr_flags, bool sllao, bool tokenized,
2580                                 __u32 valid_lft, u32 prefered_lft)
2581{
2582        struct inet6_ifaddr *ifp = ipv6_get_ifaddr(net, addr, dev, 1);
2583        int create = 0;
2584
2585        if (!ifp && valid_lft) {
2586                int max_addresses = in6_dev->cnf.max_addresses;
2587                struct ifa6_config cfg = {
2588                        .pfx = addr,
2589                        .plen = pinfo->prefix_len,
2590                        .ifa_flags = addr_flags,
2591                        .valid_lft = valid_lft,
2592                        .preferred_lft = prefered_lft,
2593                        .scope = addr_type & IPV6_ADDR_SCOPE_MASK,
2594                };
2595
2596#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
2597                if ((net->ipv6.devconf_all->optimistic_dad ||
2598                     in6_dev->cnf.optimistic_dad) &&
2599                    !net->ipv6.devconf_all->forwarding && sllao)
2600                        cfg.ifa_flags |= IFA_F_OPTIMISTIC;
2601#endif
2602
2603                /* Do not allow to create too much of autoconfigured
2604                 * addresses; this would be too easy way to crash kernel.
2605                 */
2606                if (!max_addresses ||
2607                    ipv6_count_addresses(in6_dev) < max_addresses)
2608                        ifp = ipv6_add_addr(in6_dev, &cfg, false, NULL);
2609
2610                if (IS_ERR_OR_NULL(ifp))
2611                        return -1;
2612
2613                create = 1;
2614                spin_lock_bh(&ifp->lock);
2615                ifp->flags |= IFA_F_MANAGETEMPADDR;
2616                ifp->cstamp = jiffies;
2617                ifp->tokenized = tokenized;
2618                spin_unlock_bh(&ifp->lock);
2619                addrconf_dad_start(ifp);
2620        }
2621
2622        if (ifp) {
2623                u32 flags;
2624                unsigned long now;
2625                u32 stored_lft;
2626
2627                /* Update lifetime (RFC4862 5.5.3 e)
2628                 * We deviate from RFC4862 by honoring all Valid Lifetimes to
2629                 * improve the reaction of SLAAC to renumbering events
2630                 * (draft-gont-6man-slaac-renum-06, Section 4.2)
2631                 */
2632                spin_lock_bh(&ifp->lock);
2633                now = jiffies;
2634                if (ifp->valid_lft > (now - ifp->tstamp) / HZ)
2635                        stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
2636                else
2637                        stored_lft = 0;
2638
2639                if (!create && stored_lft) {
2640                        ifp->valid_lft = valid_lft;
2641                        ifp->prefered_lft = prefered_lft;
2642                        ifp->tstamp = now;
2643                        flags = ifp->flags;
2644                        ifp->flags &= ~IFA_F_DEPRECATED;
2645                        spin_unlock_bh(&ifp->lock);
2646
2647                        if (!(flags&IFA_F_TENTATIVE))
2648                                ipv6_ifa_notify(0, ifp);
2649                } else
2650                        spin_unlock_bh(&ifp->lock);
2651
2652                manage_tempaddrs(in6_dev, ifp, valid_lft, prefered_lft,
2653                                 create, now);
2654
2655                in6_ifa_put(ifp);
2656                addrconf_verify();
2657        }
2658
2659        return 0;
2660}
2661EXPORT_SYMBOL_GPL(addrconf_prefix_rcv_add_addr);
2662
2663void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
2664{
2665        struct prefix_info *pinfo;
2666        __u32 valid_lft;
2667        __u32 prefered_lft;
2668        int addr_type, err;
2669        u32 addr_flags = 0;
2670        struct inet6_dev *in6_dev;
2671        struct net *net = dev_net(dev);
2672
2673        pinfo = (struct prefix_info *) opt;
2674
2675        if (len < sizeof(struct prefix_info)) {
2676                netdev_dbg(dev, "addrconf: prefix option too short\n");
2677                return;
2678        }
2679
2680        /*
2681         *      Validation checks ([ADDRCONF], page 19)
2682         */
2683
2684        addr_type = ipv6_addr_type(&pinfo->prefix);
2685
2686        if (addr_type & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL))
2687                return;
2688
2689        valid_lft = ntohl(pinfo->valid);
2690        prefered_lft = ntohl(pinfo->prefered);
2691
2692        if (prefered_lft > valid_lft) {
2693                net_warn_ratelimited("addrconf: prefix option has invalid lifetime\n");
2694                return;
2695        }
2696
2697        in6_dev = in6_dev_get(dev);
2698
2699        if (!in6_dev) {
2700                net_dbg_ratelimited("addrconf: device %s not configured\n",
2701                                    dev->name);
2702                return;
2703        }
2704
2705        /*
2706         *      Two things going on here:
2707         *      1) Add routes for on-link prefixes
2708         *      2) Configure prefixes with the auto flag set
2709         */
2710
2711        if (pinfo->onlink) {
2712                struct fib6_info *rt;
2713                unsigned long rt_expires;
2714
2715                /* Avoid arithmetic overflow. Really, we could
2716                 * save rt_expires in seconds, likely valid_lft,
2717                 * but it would require division in fib gc, that it
2718                 * not good.
2719                 */
2720                if (HZ > USER_HZ)
2721                        rt_expires = addrconf_timeout_fixup(valid_lft, HZ);
2722                else
2723                        rt_expires = addrconf_timeout_fixup(valid_lft, USER_HZ);
2724
2725                if (addrconf_finite_timeout(rt_expires))
2726                        rt_expires *= HZ;
2727
2728                rt = addrconf_get_prefix_route(&pinfo->prefix,
2729                                               pinfo->prefix_len,
2730                                               dev,
2731                                               RTF_ADDRCONF | RTF_PREFIX_RT,
2732                                               RTF_DEFAULT, true);
2733
2734                if (rt) {
2735                        /* Autoconf prefix route */
2736                        if (valid_lft == 0) {
2737                                ip6_del_rt(net, rt, false);
2738                                rt = NULL;
2739                        } else if (addrconf_finite_timeout(rt_expires)) {
2740                                /* not infinity */
2741                                fib6_set_expires(rt, jiffies + rt_expires);
2742                        } else {
2743                                fib6_clean_expires(rt);
2744                        }
2745                } else if (valid_lft) {
2746                        clock_t expires = 0;
2747                        int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
2748                        if (addrconf_finite_timeout(rt_expires)) {
2749                                /* not infinity */
2750                                flags |= RTF_EXPIRES;
2751                                expires = jiffies_to_clock_t(rt_expires);
2752                        }
2753                        addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
2754                                              0, dev, expires, flags,
2755                                              GFP_ATOMIC);
2756                }
2757                fib6_info_release(rt);
2758        }
2759
2760        /* Try to figure out our local address for this prefix */
2761
2762        if (pinfo->autoconf && in6_dev->cnf.autoconf) {
2763                struct in6_addr addr;
2764                bool tokenized = false, dev_addr_generated = false;
2765
2766                if (pinfo->prefix_len == 64) {
2767                        memcpy(&addr, &pinfo->prefix, 8);
2768
2769                        if (!ipv6_addr_any(&in6_dev->token)) {
2770                                read_lock_bh(&in6_dev->lock);
2771                                memcpy(addr.s6_addr + 8,
2772                                       in6_dev->token.s6_addr + 8, 8);
2773                                read_unlock_bh(&in6_dev->lock);
2774                                tokenized = true;
2775                        } else if (is_addr_mode_generate_stable(in6_dev) &&
2776                                   !ipv6_generate_stable_address(&addr, 0,
2777                                                                 in6_dev)) {
2778                                addr_flags |= IFA_F_STABLE_PRIVACY;
2779                                goto ok;
2780                        } else if (ipv6_generate_eui64(addr.s6_addr + 8, dev) &&
2781                                   ipv6_inherit_eui64(addr.s6_addr + 8, in6_dev)) {
2782                                goto put;
2783                        } else {
2784                                dev_addr_generated = true;
2785                        }
2786                        goto ok;
2787                }
2788                net_dbg_ratelimited("IPv6 addrconf: prefix with wrong length %d\n",
2789                                    pinfo->prefix_len);
2790                goto put;
2791
2792ok:
2793                err = addrconf_prefix_rcv_add_addr(net, dev, pinfo, in6_dev,
2794                                                   &addr, addr_type,
2795                                                   addr_flags, sllao,
2796                                                   tokenized, valid_lft,
2797                                                   prefered_lft);
2798                if (err)
2799                        goto put;
2800
2801                /* Ignore error case here because previous prefix add addr was
2802                 * successful which will be notified.
2803                 */
2804                ndisc_ops_prefix_rcv_add_addr(net, dev, pinfo, in6_dev, &addr,
2805                                              addr_type, addr_flags, sllao,
2806                                              tokenized, valid_lft,
2807                                              prefered_lft,
2808                                              dev_addr_generated);
2809        }
2810        inet6_prefix_notify(RTM_NEWPREFIX, in6_dev, pinfo);
2811put:
2812        in6_dev_put(in6_dev);
2813}
2814
2815static int addrconf_set_sit_dstaddr(struct net *net, struct net_device *dev,
2816                struct in6_ifreq *ireq)
2817{
2818        struct ip_tunnel_parm p = { };
2819        int err;
2820
2821        if (!(ipv6_addr_type(&ireq->ifr6_addr) & IPV6_ADDR_COMPATv4))
2822                return -EADDRNOTAVAIL;
2823
2824        p.iph.daddr = ireq->ifr6_addr.s6_addr32[3];
2825        p.iph.version = 4;
2826        p.iph.ihl = 5;
2827        p.iph.protocol = IPPROTO_IPV6;
2828        p.iph.ttl = 64;
2829
2830        if (!dev->netdev_ops->ndo_tunnel_ctl)
2831                return -EOPNOTSUPP;
2832        err = dev->netdev_ops->ndo_tunnel_ctl(dev, &p, SIOCADDTUNNEL);
2833        if (err)
2834                return err;
2835
2836        dev = __dev_get_by_name(net, p.name);
2837        if (!dev)
2838                return -ENOBUFS;
2839        return dev_open(dev, NULL);
2840}
2841
2842/*
2843 *      Set destination address.
2844 *      Special case for SIT interfaces where we create a new "virtual"
2845 *      device.
2846 */
2847int addrconf_set_dstaddr(struct net *net, void __user *arg)
2848{
2849        struct net_device *dev;
2850        struct in6_ifreq ireq;
2851        int err = -ENODEV;
2852
2853        if (!IS_ENABLED(CONFIG_IPV6_SIT))
2854                return -ENODEV;
2855        if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2856                return -EFAULT;
2857
2858        rtnl_lock();
2859        dev = __dev_get_by_index(net, ireq.ifr6_ifindex);
2860        if (dev && dev->type == ARPHRD_SIT)
2861                err = addrconf_set_sit_dstaddr(net, dev, &ireq);
2862        rtnl_unlock();
2863        return err;
2864}
2865
2866static int ipv6_mc_config(struct sock *sk, bool join,
2867                          const struct in6_addr *addr, int ifindex)
2868{
2869        int ret;
2870
2871        ASSERT_RTNL();
2872
2873        lock_sock(sk);
2874        if (join)
2875                ret = ipv6_sock_mc_join(sk, ifindex, addr);
2876        else
2877                ret = ipv6_sock_mc_drop(sk, ifindex, addr);
2878        release_sock(sk);
2879
2880        return ret;
2881}
2882
2883/*
2884 *      Manual configuration of address on an interface
2885 */
2886static int inet6_addr_add(struct net *net, int ifindex,
2887                          struct ifa6_config *cfg,
2888                          struct netlink_ext_ack *extack)
2889{
2890        struct inet6_ifaddr *ifp;
2891        struct inet6_dev *idev;
2892        struct net_device *dev;
2893        unsigned long timeout;
2894        clock_t expires;
2895        u32 flags;
2896
2897        ASSERT_RTNL();
2898
2899        if (cfg->plen > 128)
2900                return -EINVAL;
2901
2902        /* check the lifetime */
2903        if (!cfg->valid_lft || cfg->preferred_lft > cfg->valid_lft)
2904                return -EINVAL;
2905
2906        if (cfg->ifa_flags & IFA_F_MANAGETEMPADDR && cfg->plen != 64)
2907                return -EINVAL;
2908
2909        dev = __dev_get_by_index(net, ifindex);
2910        if (!dev)
2911                return -ENODEV;
2912
2913        idev = addrconf_add_dev(dev);
2914        if (IS_ERR(idev))
2915                return PTR_ERR(idev);
2916
2917        if (cfg->ifa_flags & IFA_F_MCAUTOJOIN) {
2918                int ret = ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2919                                         true, cfg->pfx, ifindex);
2920
2921                if (ret < 0)
2922                        return ret;
2923        }
2924
2925        cfg->scope = ipv6_addr_scope(cfg->pfx);
2926
2927        timeout = addrconf_timeout_fixup(cfg->valid_lft, HZ);
2928        if (addrconf_finite_timeout(timeout)) {
2929                expires = jiffies_to_clock_t(timeout * HZ);
2930                cfg->valid_lft = timeout;
2931                flags = RTF_EXPIRES;
2932        } else {
2933                expires = 0;
2934                flags = 0;
2935                cfg->ifa_flags |= IFA_F_PERMANENT;
2936        }
2937
2938        timeout = addrconf_timeout_fixup(cfg->preferred_lft, HZ);
2939        if (addrconf_finite_timeout(timeout)) {
2940                if (timeout == 0)
2941                        cfg->ifa_flags |= IFA_F_DEPRECATED;
2942                cfg->preferred_lft = timeout;
2943        }
2944
2945        ifp = ipv6_add_addr(idev, cfg, true, extack);
2946        if (!IS_ERR(ifp)) {
2947                if (!(cfg->ifa_flags & IFA_F_NOPREFIXROUTE)) {
2948                        addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
2949                                              ifp->rt_priority, dev, expires,
2950                                              flags, GFP_KERNEL);
2951                }
2952
2953                /* Send a netlink notification if DAD is enabled and
2954                 * optimistic flag is not set
2955                 */
2956                if (!(ifp->flags & (IFA_F_OPTIMISTIC | IFA_F_NODAD)))
2957                        ipv6_ifa_notify(0, ifp);
2958                /*
2959                 * Note that section 3.1 of RFC 4429 indicates
2960                 * that the Optimistic flag should not be set for
2961                 * manually configured addresses
2962                 */
2963                addrconf_dad_start(ifp);
2964                if (cfg->ifa_flags & IFA_F_MANAGETEMPADDR)
2965                        manage_tempaddrs(idev, ifp, cfg->valid_lft,
2966                                         cfg->preferred_lft, true, jiffies);
2967                in6_ifa_put(ifp);
2968                addrconf_verify_rtnl();
2969                return 0;
2970        } else if (cfg->ifa_flags & IFA_F_MCAUTOJOIN) {
2971                ipv6_mc_config(net->ipv6.mc_autojoin_sk, false,
2972                               cfg->pfx, ifindex);
2973        }
2974
2975        return PTR_ERR(ifp);
2976}
2977
2978static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,
2979                          const struct in6_addr *pfx, unsigned int plen)
2980{
2981        struct inet6_ifaddr *ifp;
2982        struct inet6_dev *idev;
2983        struct net_device *dev;
2984
2985        if (plen > 128)
2986                return -EINVAL;
2987
2988        dev = __dev_get_by_index(net, ifindex);
2989        if (!dev)
2990                return -ENODEV;
2991
2992        idev = __in6_dev_get(dev);
2993        if (!idev)
2994                return -ENXIO;
2995
2996        read_lock_bh(&idev->lock);
2997        list_for_each_entry(ifp, &idev->addr_list, if_list) {
2998                if (ifp->prefix_len == plen &&
2999                    ipv6_addr_equal(pfx, &ifp->addr)) {
3000                        in6_ifa_hold(ifp);
3001                        read_unlock_bh(&idev->lock);
3002
3003                        if (!(ifp->flags & IFA_F_TEMPORARY) &&
3004                            (ifa_flags & IFA_F_MANAGETEMPADDR))
3005                                manage_tempaddrs(idev, ifp, 0, 0, false,
3006                                                 jiffies);
3007                        ipv6_del_addr(ifp);
3008                        addrconf_verify_rtnl();
3009                        if (ipv6_addr_is_multicast(pfx)) {
3010                                ipv6_mc_config(net->ipv6.mc_autojoin_sk,
3011                                               false, pfx, dev->ifindex);
3012                        }
3013                        return 0;
3014                }
3015        }
3016        read_unlock_bh(&idev->lock);
3017        return -EADDRNOTAVAIL;
3018}
3019
3020
3021int addrconf_add_ifaddr(struct net *net, void __user *arg)
3022{
3023        struct ifa6_config cfg = {
3024                .ifa_flags = IFA_F_PERMANENT,
3025                .preferred_lft = INFINITY_LIFE_TIME,
3026                .valid_lft = INFINITY_LIFE_TIME,
3027        };
3028        struct in6_ifreq ireq;
3029        int err;
3030
3031        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
3032                return -EPERM;
3033
3034        if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
3035                return -EFAULT;
3036
3037        cfg.pfx = &ireq.ifr6_addr;
3038        cfg.plen = ireq.ifr6_prefixlen;
3039
3040        rtnl_lock();
3041        err = inet6_addr_add(net, ireq.ifr6_ifindex, &cfg, NULL);
3042        rtnl_unlock();
3043        return err;
3044}
3045
3046int addrconf_del_ifaddr(struct net *net, void __user *arg)
3047{
3048        struct in6_ifreq ireq;
3049        int err;
3050
3051        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
3052                return -EPERM;
3053
3054        if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
3055                return -EFAULT;
3056
3057        rtnl_lock();
3058        err = inet6_addr_del(net, ireq.ifr6_ifindex, 0, &ireq.ifr6_addr,
3059                             ireq.ifr6_prefixlen);
3060        rtnl_unlock();
3061        return err;
3062}
3063
3064static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
3065                     int plen, int scope)
3066{
3067        struct inet6_ifaddr *ifp;
3068        struct ifa6_config cfg = {
3069                .pfx = addr,
3070                .plen = plen,
3071                .ifa_flags = IFA_F_PERMANENT,
3072                .valid_lft = INFINITY_LIFE_TIME,
3073                .preferred_lft = INFINITY_LIFE_TIME,
3074                .scope = scope
3075        };
3076
3077        ifp = ipv6_add_addr(idev, &cfg, true, NULL);
3078        if (!IS_ERR(ifp)) {
3079                spin_lock_bh(&ifp->lock);
3080                ifp->flags &= ~IFA_F_TENTATIVE;
3081                spin_unlock_bh(&ifp->lock);
3082                rt_genid_bump_ipv6(dev_net(idev->dev));
3083                ipv6_ifa_notify(RTM_NEWADDR, ifp);
3084                in6_ifa_put(ifp);
3085        }
3086}
3087
3088#if IS_ENABLED(CONFIG_IPV6_SIT)
3089static void sit_add_v4_addrs(struct inet6_dev *idev)
3090{
3091        struct in6_addr addr;
3092        struct net_device *dev;
3093        struct net *net = dev_net(idev->dev);
3094        int scope, plen;
3095        u32 pflags = 0;
3096
3097        ASSERT_RTNL();
3098
3099        memset(&addr, 0, sizeof(struct in6_addr));
3100        memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4);
3101
3102        if (idev->dev->flags&IFF_POINTOPOINT) {
3103                addr.s6_addr32[0] = htonl(0xfe800000);
3104                scope = IFA_LINK;
3105                plen = 64;
3106        } else {
3107                scope = IPV6_ADDR_COMPATv4;
3108                plen = 96;
3109                pflags |= RTF_NONEXTHOP;
3110        }
3111
3112        if (addr.s6_addr32[3]) {
3113                add_addr(idev, &addr, plen, scope);
3114                addrconf_prefix_route(&addr, plen, 0, idev->dev, 0, pflags,
3115                                      GFP_KERNEL);
3116                return;
3117        }
3118
3119        for_each_netdev(net, dev) {
3120                struct in_device *in_dev = __in_dev_get_rtnl(dev);
3121                if (in_dev && (dev->flags & IFF_UP)) {
3122                        struct in_ifaddr *ifa;
3123                        int flag = scope;
3124
3125                        in_dev_for_each_ifa_rtnl(ifa, in_dev) {
3126                                addr.s6_addr32[3] = ifa->ifa_local;
3127
3128                                if (ifa->ifa_scope == RT_SCOPE_LINK)
3129                                        continue;
3130                                if (ifa->ifa_scope >= RT_SCOPE_HOST) {
3131                                        if (idev->dev->flags&IFF_POINTOPOINT)
3132                                                continue;
3133                                        flag |= IFA_HOST;
3134                                }
3135
3136                                add_addr(idev, &addr, plen, flag);
3137                                addrconf_prefix_route(&addr, plen, 0, idev->dev,
3138                                                      0, pflags, GFP_KERNEL);
3139                        }
3140                }
3141        }
3142}
3143#endif
3144
3145static void init_loopback(struct net_device *dev)
3146{
3147        struct inet6_dev  *idev;
3148
3149        /* ::1 */
3150
3151        ASSERT_RTNL();
3152
3153        idev = ipv6_find_idev(dev);
3154        if (IS_ERR(idev)) {
3155                pr_debug("%s: add_dev failed\n", __func__);
3156                return;
3157        }
3158
3159        add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
3160}
3161
3162void addrconf_add_linklocal(struct inet6_dev *idev,
3163                            const struct in6_addr *addr, u32 flags)
3164{
3165        struct ifa6_config cfg = {
3166                .pfx = addr,
3167                .plen = 64,
3168                .ifa_flags = flags | IFA_F_PERMANENT,
3169                .valid_lft = INFINITY_LIFE_TIME,
3170                .preferred_lft = INFINITY_LIFE_TIME,
3171                .scope = IFA_LINK
3172        };
3173        struct inet6_ifaddr *ifp;
3174
3175#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
3176        if ((dev_net(idev->dev)->ipv6.devconf_all->optimistic_dad ||
3177             idev->cnf.optimistic_dad) &&
3178            !dev_net(idev->dev)->ipv6.devconf_all->forwarding)
3179                cfg.ifa_flags |= IFA_F_OPTIMISTIC;
3180#endif
3181
3182        ifp = ipv6_add_addr(idev, &cfg, true, NULL);
3183        if (!IS_ERR(ifp)) {
3184                addrconf_prefix_route(&ifp->addr, ifp->prefix_len, 0, idev->dev,
3185                                      0, 0, GFP_ATOMIC);
3186                addrconf_dad_start(ifp);
3187                in6_ifa_put(ifp);
3188        }
3189}
3190EXPORT_SYMBOL_GPL(addrconf_add_linklocal);
3191
3192static bool ipv6_reserved_interfaceid(struct in6_addr address)
3193{
3194        if ((address.s6_addr32[2] | address.s6_addr32[3]) == 0)
3195                return true;
3196
3197        if (address.s6_addr32[2] == htonl(0x02005eff) &&
3198            ((address.s6_addr32[3] & htonl(0xfe000000)) == htonl(0xfe000000)))
3199                return true;
3200
3201        if (address.s6_addr32[2] == htonl(0xfdffffff) &&
3202            ((address.s6_addr32[3] & htonl(0xffffff80)) == htonl(0xffffff80)))
3203                return true;
3204
3205        return false;
3206}
3207
3208static int ipv6_generate_stable_address(struct in6_addr *address,
3209                                        u8 dad_count,
3210                                        const struct inet6_dev *idev)
3211{
3212        static DEFINE_SPINLOCK(lock);
3213        static __u32 digest[SHA1_DIGEST_WORDS];
3214        static __u32 workspace[SHA1_WORKSPACE_WORDS];
3215
3216        static union {
3217                char __data[SHA1_BLOCK_SIZE];
3218                struct {
3219                        struct in6_addr secret;
3220                        __be32 prefix[2];
3221                        unsigned char hwaddr[MAX_ADDR_LEN];
3222                        u8 dad_count;
3223                } __packed;
3224        } data;
3225
3226        struct in6_addr secret;
3227        struct in6_addr temp;
3228        struct net *net = dev_net(idev->dev);
3229
3230        BUILD_BUG_ON(sizeof(data.__data) != sizeof(data));
3231
3232        if (idev->cnf.stable_secret.initialized)
3233                secret = idev->cnf.stable_secret.secret;
3234        else if (net->ipv6.devconf_dflt->stable_secret.initialized)
3235                secret = net->ipv6.devconf_dflt->stable_secret.secret;
3236        else
3237                return -1;
3238
3239retry:
3240        spin_lock_bh(&lock);
3241
3242        sha1_init(digest);
3243        memset(&data, 0, sizeof(data));
3244        memset(workspace, 0, sizeof(workspace));
3245        memcpy(data.hwaddr, idev->dev->perm_addr, idev->dev->addr_len);
3246        data.prefix[0] = address->s6_addr32[0];
3247        data.prefix[1] = address->s6_addr32[1];
3248        data.secret = secret;
3249        data.dad_count = dad_count;
3250
3251        sha1_transform(digest, data.__data, workspace);
3252
3253        temp = *address;
3254        temp.s6_addr32[2] = (__force __be32)digest[0];
3255        temp.s6_addr32[3] = (__force __be32)digest[1];
3256
3257        spin_unlock_bh(&lock);
3258
3259        if (ipv6_reserved_interfaceid(temp)) {
3260                dad_count++;
3261                if (dad_count > dev_net(idev->dev)->ipv6.sysctl.idgen_retries)
3262                        return -1;
3263                goto retry;
3264        }
3265
3266        *address = temp;
3267        return 0;
3268}
3269
3270static void ipv6_gen_mode_random_init(struct inet6_dev *idev)
3271{
3272        struct ipv6_stable_secret *s = &idev->cnf.stable_secret;
3273
3274        if (s->initialized)
3275                return;
3276        s = &idev->cnf.stable_secret;
3277        get_random_bytes(&s->secret, sizeof(s->secret));
3278        s->initialized = true;
3279}
3280
3281static void addrconf_addr_gen(struct inet6_dev *idev, bool prefix_route)
3282{
3283        struct in6_addr addr;
3284
3285        /* no link local addresses on L3 master devices */
3286        if (netif_is_l3_master(idev->dev))
3287                return;
3288
3289        /* no link local addresses on devices flagged as slaves */
3290        if (idev->dev->flags & IFF_SLAVE)
3291                return;
3292
3293        ipv6_addr_set(&addr, htonl(0xFE800000), 0, 0, 0);
3294
3295        switch (idev->cnf.addr_gen_mode) {
3296        case IN6_ADDR_GEN_MODE_RANDOM:
3297                ipv6_gen_mode_random_init(idev);
3298                fallthrough;
3299        case IN6_ADDR_GEN_MODE_STABLE_PRIVACY:
3300                if (!ipv6_generate_stable_address(&addr, 0, idev))
3301                        addrconf_add_linklocal(idev, &addr,
3302                                               IFA_F_STABLE_PRIVACY);
3303                else if (prefix_route)
3304                        addrconf_prefix_route(&addr, 64, 0, idev->dev,
3305                                              0, 0, GFP_KERNEL);
3306                break;
3307        case IN6_ADDR_GEN_MODE_EUI64:
3308                /* addrconf_add_linklocal also adds a prefix_route and we
3309                 * only need to care about prefix routes if ipv6_generate_eui64
3310                 * couldn't generate one.
3311                 */
3312                if (ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) == 0)
3313                        addrconf_add_linklocal(idev, &addr, 0);
3314                else if (prefix_route)
3315                        addrconf_prefix_route(&addr, 64, 0, idev->dev,
3316                                              0, 0, GFP_KERNEL);
3317                break;
3318        case IN6_ADDR_GEN_MODE_NONE:
3319        default:
3320                /* will not add any link local address */
3321                break;
3322        }
3323}
3324
3325static void addrconf_dev_config(struct net_device *dev)
3326{
3327        struct inet6_dev *idev;
3328
3329        ASSERT_RTNL();
3330
3331        if ((dev->type != ARPHRD_ETHER) &&
3332            (dev->type != ARPHRD_FDDI) &&
3333            (dev->type != ARPHRD_ARCNET) &&
3334            (dev->type != ARPHRD_INFINIBAND) &&
3335            (dev->type != ARPHRD_IEEE1394) &&
3336            (dev->type != ARPHRD_TUNNEL6) &&
3337            (dev->type != ARPHRD_6LOWPAN) &&
3338            (dev->type != ARPHRD_IP6GRE) &&
3339            (dev->type != ARPHRD_IPGRE) &&
3340            (dev->type != ARPHRD_TUNNEL) &&
3341            (dev->type != ARPHRD_NONE) &&
3342            (dev->type != ARPHRD_RAWIP)) {
3343                /* Alas, we support only Ethernet autoconfiguration. */
3344                idev = __in6_dev_get(dev);
3345                if (!IS_ERR_OR_NULL(idev) && dev->flags & IFF_UP &&
3346                    dev->flags & IFF_MULTICAST)
3347                        ipv6_mc_up(idev);
3348                return;
3349        }
3350
3351        idev = addrconf_add_dev(dev);
3352        if (IS_ERR(idev))
3353                return;
3354
3355        /* this device type has no EUI support */
3356        if (dev->type == ARPHRD_NONE &&
3357            idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)
3358                idev->cnf.addr_gen_mode = IN6_ADDR_GEN_MODE_RANDOM;
3359
3360        addrconf_addr_gen(idev, false);
3361}
3362
3363#if IS_ENABLED(CONFIG_IPV6_SIT)
3364static void addrconf_sit_config(struct net_device *dev)
3365{
3366        struct inet6_dev *idev;
3367
3368        ASSERT_RTNL();
3369
3370        /*
3371         * Configure the tunnel with one of our IPv4
3372         * addresses... we should configure all of
3373         * our v4 addrs in the tunnel
3374         */
3375
3376        idev = ipv6_find_idev(dev);
3377        if (IS_ERR(idev)) {
3378                pr_debug("%s: add_dev failed\n", __func__);
3379                return;
3380        }
3381
3382        if (dev->priv_flags & IFF_ISATAP) {
3383                addrconf_addr_gen(idev, false);
3384                return;
3385        }
3386
3387        sit_add_v4_addrs(idev);
3388
3389        if (dev->flags&IFF_POINTOPOINT)
3390                addrconf_add_mroute(dev);
3391}
3392#endif
3393
3394#if IS_ENABLED(CONFIG_NET_IPGRE)
3395static void addrconf_gre_config(struct net_device *dev)
3396{
3397        struct inet6_dev *idev;
3398
3399        ASSERT_RTNL();
3400
3401        idev = ipv6_find_idev(dev);
3402        if (IS_ERR(idev)) {
3403                pr_debug("%s: add_dev failed\n", __func__);
3404                return;
3405        }
3406
3407        addrconf_addr_gen(idev, true);
3408        if (dev->flags & IFF_POINTOPOINT)
3409                addrconf_add_mroute(dev);
3410}
3411#endif
3412
3413static int fixup_permanent_addr(struct net *net,
3414                                struct inet6_dev *idev,
3415                                struct inet6_ifaddr *ifp)
3416{
3417        /* !fib6_node means the host route was removed from the
3418         * FIB, for example, if 'lo' device is taken down. In that
3419         * case regenerate the host route.
3420         */
3421        if (!ifp->rt || !ifp->rt->fib6_node) {
3422                struct fib6_info *f6i, *prev;
3423
3424                f6i = addrconf_f6i_alloc(net, idev, &ifp->addr, false,
3425                                         GFP_ATOMIC);
3426                if (IS_ERR(f6i))
3427                        return PTR_ERR(f6i);
3428
3429                /* ifp->rt can be accessed outside of rtnl */
3430                spin_lock(&ifp->lock);
3431                prev = ifp->rt;
3432                ifp->rt = f6i;
3433                spin_unlock(&ifp->lock);
3434
3435                fib6_info_release(prev);
3436        }
3437
3438        if (!(ifp->flags & IFA_F_NOPREFIXROUTE)) {
3439                addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
3440                                      ifp->rt_priority, idev->dev, 0, 0,
3441                                      GFP_ATOMIC);
3442        }
3443
3444        if (ifp->state == INET6_IFADDR_STATE_PREDAD)
3445                addrconf_dad_start(ifp);
3446
3447        return 0;
3448}
3449
3450static void addrconf_permanent_addr(struct net *net, struct net_device *dev)
3451{
3452        struct inet6_ifaddr *ifp, *tmp;
3453        struct inet6_dev *idev;
3454
3455        idev = __in6_dev_get(dev);
3456        if (!idev)
3457                return;
3458
3459        write_lock_bh(&idev->lock);
3460
3461        list_for_each_entry_safe(ifp, tmp, &idev->addr_list, if_list) {
3462                if ((ifp->flags & IFA_F_PERMANENT) &&
3463                    fixup_permanent_addr(net, idev, ifp) < 0) {
3464                        write_unlock_bh(&idev->lock);
3465                        in6_ifa_hold(ifp);
3466                        ipv6_del_addr(ifp);
3467                        write_lock_bh(&idev->lock);
3468
3469                        net_info_ratelimited("%s: Failed to add prefix route for address %pI6c; dropping\n",
3470                                             idev->dev->name, &ifp->addr);
3471                }
3472        }
3473
3474        write_unlock_bh(&idev->lock);
3475}
3476
3477static int addrconf_notify(struct notifier_block *this, unsigned long event,
3478                           void *ptr)
3479{
3480        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
3481        struct netdev_notifier_change_info *change_info;
3482        struct netdev_notifier_changeupper_info *info;
3483        struct inet6_dev *idev = __in6_dev_get(dev);
3484        struct net *net = dev_net(dev);
3485        int run_pending = 0;
3486        int err;
3487
3488        switch (event) {
3489        case NETDEV_REGISTER:
3490                if (!idev && dev->mtu >= IPV6_MIN_MTU) {
3491                        idev = ipv6_add_dev(dev);
3492                        if (IS_ERR(idev))
3493                                return notifier_from_errno(PTR_ERR(idev));
3494                }
3495                break;
3496
3497        case NETDEV_CHANGEMTU:
3498                /* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
3499                if (dev->mtu < IPV6_MIN_MTU) {
3500                        addrconf_ifdown(dev, dev != net->loopback_dev);
3501                        break;
3502                }
3503
3504                if (idev) {
3505                        rt6_mtu_change(dev, dev->mtu);
3506                        idev->cnf.mtu6 = dev->mtu;
3507                        break;
3508                }
3509
3510                /* allocate new idev */
3511                idev = ipv6_add_dev(dev);
3512                if (IS_ERR(idev))
3513                        break;
3514
3515                /* device is still not ready */
3516                if (!(idev->if_flags & IF_READY))
3517                        break;
3518
3519                run_pending = 1;
3520                fallthrough;
3521        case NETDEV_UP:
3522        case NETDEV_CHANGE:
3523                if (dev->flags & IFF_SLAVE)
3524                        break;
3525
3526                if (idev && idev->cnf.disable_ipv6)
3527                        break;
3528
3529                if (event == NETDEV_UP) {
3530                        /* restore routes for permanent addresses */
3531                        addrconf_permanent_addr(net, dev);
3532
3533                        if (!addrconf_link_ready(dev)) {
3534                                /* device is not ready yet. */
3535                                pr_debug("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
3536                                         dev->name);
3537                                break;
3538                        }
3539
3540                        if (!idev && dev->mtu >= IPV6_MIN_MTU)
3541                                idev = ipv6_add_dev(dev);
3542
3543                        if (!IS_ERR_OR_NULL(idev)) {
3544                                idev->if_flags |= IF_READY;
3545                                run_pending = 1;
3546                        }
3547                } else if (event == NETDEV_CHANGE) {
3548                        if (!addrconf_link_ready(dev)) {
3549                                /* device is still not ready. */
3550                                rt6_sync_down_dev(dev, event);
3551                                break;
3552                        }
3553
3554                        if (!IS_ERR_OR_NULL(idev)) {
3555                                if (idev->if_flags & IF_READY) {
3556                                        /* device is already configured -
3557                                         * but resend MLD reports, we might
3558                                         * have roamed and need to update
3559                                         * multicast snooping switches
3560                                         */
3561                                        ipv6_mc_up(idev);
3562                                        change_info = ptr;
3563                                        if (change_info->flags_changed & IFF_NOARP)
3564                                                addrconf_dad_run(idev, true);
3565                                        rt6_sync_up(dev, RTNH_F_LINKDOWN);
3566                                        break;
3567                                }
3568                                idev->if_flags |= IF_READY;
3569                        }
3570
3571                        pr_info("ADDRCONF(NETDEV_CHANGE): %s: link becomes ready\n",
3572                                dev->name);
3573
3574                        run_pending = 1;
3575                }
3576
3577                switch (dev->type) {
3578#if IS_ENABLED(CONFIG_IPV6_SIT)
3579                case ARPHRD_SIT:
3580                        addrconf_sit_config(dev);
3581                        break;
3582#endif
3583#if IS_ENABLED(CONFIG_NET_IPGRE)
3584                case ARPHRD_IPGRE:
3585                        addrconf_gre_config(dev);
3586                        break;
3587#endif
3588                case ARPHRD_LOOPBACK:
3589                        init_loopback(dev);
3590                        break;
3591
3592                default:
3593                        addrconf_dev_config(dev);
3594                        break;
3595                }
3596
3597                if (!IS_ERR_OR_NULL(idev)) {
3598                        if (run_pending)
3599                                addrconf_dad_run(idev, false);
3600
3601                        /* Device has an address by now */
3602                        rt6_sync_up(dev, RTNH_F_DEAD);
3603
3604                        /*
3605                         * If the MTU changed during the interface down,
3606                         * when the interface up, the changed MTU must be
3607                         * reflected in the idev as well as routers.
3608                         */
3609                        if (idev->cnf.mtu6 != dev->mtu &&
3610                            dev->mtu >= IPV6_MIN_MTU) {
3611                                rt6_mtu_change(dev, dev->mtu);
3612                                idev->cnf.mtu6 = dev->mtu;
3613                        }
3614                        idev->tstamp = jiffies;
3615                        inet6_ifinfo_notify(RTM_NEWLINK, idev);
3616
3617                        /*
3618                         * If the changed mtu during down is lower than
3619                         * IPV6_MIN_MTU stop IPv6 on this interface.
3620                         */
3621                        if (dev->mtu < IPV6_MIN_MTU)
3622                                addrconf_ifdown(dev, dev != net->loopback_dev);
3623                }
3624                break;
3625
3626        case NETDEV_DOWN:
3627        case NETDEV_UNREGISTER:
3628                /*
3629                 *      Remove all addresses from this interface.
3630                 */
3631                addrconf_ifdown(dev, event != NETDEV_DOWN);
3632                break;
3633
3634        case NETDEV_CHANGENAME:
3635                if (idev) {
3636                        snmp6_unregister_dev(idev);
3637                        addrconf_sysctl_unregister(idev);
3638                        err = addrconf_sysctl_register(idev);
3639                        if (err)
3640                                return notifier_from_errno(err);
3641                        err = snmp6_register_dev(idev);
3642                        if (err) {
3643                                addrconf_sysctl_unregister(idev);
3644                                return notifier_from_errno(err);
3645                        }
3646                }
3647                break;
3648
3649        case NETDEV_PRE_TYPE_CHANGE:
3650        case NETDEV_POST_TYPE_CHANGE:
3651                if (idev)
3652                        addrconf_type_change(dev, event);
3653                break;
3654
3655        case NETDEV_CHANGEUPPER:
3656                info = ptr;
3657
3658                /* flush all routes if dev is linked to or unlinked from
3659                 * an L3 master device (e.g., VRF)
3660                 */
3661                if (info->upper_dev && netif_is_l3_master(info->upper_dev))
3662                        addrconf_ifdown(dev, false);
3663        }
3664
3665        return NOTIFY_OK;
3666}
3667
3668/*
3669 *      addrconf module should be notified of a device going up
3670 */
3671static struct notifier_block ipv6_dev_notf = {
3672        .notifier_call = addrconf_notify,
3673        .priority = ADDRCONF_NOTIFY_PRIORITY,
3674};
3675
3676static void addrconf_type_change(struct net_device *dev, unsigned long event)
3677{
3678        struct inet6_dev *idev;
3679        ASSERT_RTNL();
3680
3681        idev = __in6_dev_get(dev);
3682
3683        if (event == NETDEV_POST_TYPE_CHANGE)
3684                ipv6_mc_remap(idev);
3685        else if (event == NETDEV_PRE_TYPE_CHANGE)
3686                ipv6_mc_unmap(idev);
3687}
3688
3689static bool addr_is_local(const struct in6_addr *addr)
3690{
3691        return ipv6_addr_type(addr) &
3692                (IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
3693}
3694
3695static int addrconf_ifdown(struct net_device *dev, bool unregister)
3696{
3697        unsigned long event = unregister ? NETDEV_UNREGISTER : NETDEV_DOWN;
3698        struct net *net = dev_net(dev);
3699        struct inet6_dev *idev;
3700        struct inet6_ifaddr *ifa, *tmp;
3701        bool keep_addr = false;
3702        int state, i;
3703
3704        ASSERT_RTNL();
3705
3706        rt6_disable_ip(dev, event);
3707
3708        idev = __in6_dev_get(dev);
3709        if (!idev)
3710                return -ENODEV;
3711
3712        /*
3713         * Step 1: remove reference to ipv6 device from parent device.
3714         *         Do not dev_put!
3715         */
3716        if (unregister) {
3717                idev->dead = 1;
3718
3719                /* protected by rtnl_lock */
3720                RCU_INIT_POINTER(dev->ip6_ptr, NULL);
3721
3722                /* Step 1.5: remove snmp6 entry */
3723                snmp6_unregister_dev(idev);
3724
3725        }
3726
3727        /* combine the user config with event to determine if permanent
3728         * addresses are to be removed from address hash table
3729         */
3730        if (!unregister && !idev->cnf.disable_ipv6) {
3731                /* aggregate the system setting and interface setting */
3732                int _keep_addr = net->ipv6.devconf_all->keep_addr_on_down;
3733
3734                if (!_keep_addr)
3735                        _keep_addr = idev->cnf.keep_addr_on_down;
3736
3737                keep_addr = (_keep_addr > 0);
3738        }
3739
3740        /* Step 2: clear hash table */
3741        for (i = 0; i < IN6_ADDR_HSIZE; i++) {
3742                struct hlist_head *h = &inet6_addr_lst[i];
3743
3744                spin_lock_bh(&addrconf_hash_lock);
3745restart:
3746                hlist_for_each_entry_rcu(ifa, h, addr_lst) {
3747                        if (ifa->idev == idev) {
3748                                addrconf_del_dad_work(ifa);
3749                                /* combined flag + permanent flag decide if
3750                                 * address is retained on a down event
3751                                 */
3752                                if (!keep_addr ||
3753                                    !(ifa->flags & IFA_F_PERMANENT) ||
3754                                    addr_is_local(&ifa->addr)) {
3755                                        hlist_del_init_rcu(&ifa->addr_lst);
3756                                        goto restart;
3757                                }
3758                        }
3759                }
3760                spin_unlock_bh(&addrconf_hash_lock);
3761        }
3762
3763        write_lock_bh(&idev->lock);
3764
3765        addrconf_del_rs_timer(idev);
3766
3767        /* Step 2: clear flags for stateless addrconf */
3768        if (!unregister)
3769                idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
3770
3771        /* Step 3: clear tempaddr list */
3772        while (!list_empty(&idev->tempaddr_list)) {
3773                ifa = list_first_entry(&idev->tempaddr_list,
3774                                       struct inet6_ifaddr, tmp_list);
3775                list_del(&ifa->tmp_list);
3776                write_unlock_bh(&idev->lock);
3777                spin_lock_bh(&ifa->lock);
3778
3779                if (ifa->ifpub) {
3780                        in6_ifa_put(ifa->ifpub);
3781                        ifa->ifpub = NULL;
3782                }
3783                spin_unlock_bh(&ifa->lock);
3784                in6_ifa_put(ifa);
3785                write_lock_bh(&idev->lock);
3786        }
3787
3788        list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
3789                struct fib6_info *rt = NULL;
3790                bool keep;
3791
3792                addrconf_del_dad_work(ifa);
3793
3794                keep = keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
3795                        !addr_is_local(&ifa->addr);
3796
3797                write_unlock_bh(&idev->lock);
3798                spin_lock_bh(&ifa->lock);
3799
3800                if (keep) {
3801                        /* set state to skip the notifier below */
3802                        state = INET6_IFADDR_STATE_DEAD;
3803                        ifa->state = INET6_IFADDR_STATE_PREDAD;
3804                        if (!(ifa->flags & IFA_F_NODAD))
3805                                ifa->flags |= IFA_F_TENTATIVE;
3806
3807                        rt = ifa->rt;
3808                        ifa->rt = NULL;
3809                } else {
3810                        state = ifa->state;
3811                        ifa->state = INET6_IFADDR_STATE_DEAD;
3812                }
3813
3814                spin_unlock_bh(&ifa->lock);
3815
3816                if (rt)
3817                        ip6_del_rt(net, rt, false);
3818
3819                if (state != INET6_IFADDR_STATE_DEAD) {
3820                        __ipv6_ifa_notify(RTM_DELADDR, ifa);
3821                        inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
3822                } else {
3823                        if (idev->cnf.forwarding)
3824                                addrconf_leave_anycast(ifa);
3825                        addrconf_leave_solict(ifa->idev, &ifa->addr);
3826                }
3827
3828                write_lock_bh(&idev->lock);
3829                if (!keep) {
3830                        list_del_rcu(&ifa->if_list);
3831                        in6_ifa_put(ifa);
3832                }
3833        }
3834
3835        write_unlock_bh(&idev->lock);
3836
3837        /* Step 5: Discard anycast and multicast list */
3838        if (unregister) {
3839                ipv6_ac_destroy_dev(idev);
3840                ipv6_mc_destroy_dev(idev);
3841        } else {
3842                ipv6_mc_down(idev);
3843        }
3844
3845        idev->tstamp = jiffies;
3846
3847        /* Last: Shot the device (if unregistered) */
3848        if (unregister) {
3849                addrconf_sysctl_unregister(idev);
3850                neigh_parms_release(&nd_tbl, idev->nd_parms);
3851                neigh_ifdown(&nd_tbl, dev);
3852                in6_dev_put(idev);
3853        }
3854        return 0;
3855}
3856
3857static void addrconf_rs_timer(struct timer_list *t)
3858{
3859        struct inet6_dev *idev = from_timer(idev, t, rs_timer);
3860        struct net_device *dev = idev->dev;
3861        struct in6_addr lladdr;
3862
3863        write_lock(&idev->lock);
3864        if (idev->dead || !(idev->if_flags & IF_READY))
3865                goto out;
3866
3867        if (!ipv6_accept_ra(idev))
3868                goto out;
3869
3870        /* Announcement received after solicitation was sent */
3871        if (idev->if_flags & IF_RA_RCVD)
3872                goto out;
3873
3874        if (idev->rs_probes++ < idev->cnf.rtr_solicits || idev->cnf.rtr_solicits < 0) {
3875                write_unlock(&idev->lock);
3876                if (!ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
3877                        ndisc_send_rs(dev, &lladdr,
3878                                      &in6addr_linklocal_allrouters);
3879                else
3880                        goto put;
3881
3882                write_lock(&idev->lock);
3883                idev->rs_interval = rfc3315_s14_backoff_update(
3884                        idev->rs_interval, idev->cnf.rtr_solicit_max_interval);
3885                /* The wait after the last probe can be shorter */
3886                addrconf_mod_rs_timer(idev, (idev->rs_probes ==
3887                                             idev->cnf.rtr_solicits) ?
3888                                      idev->cnf.rtr_solicit_delay :
3889                                      idev->rs_interval);
3890        } else {
3891                /*
3892                 * Note: we do not support deprecated "all on-link"
3893                 * assumption any longer.
3894                 */
3895                pr_debug("%s: no IPv6 routers present\n", idev->dev->name);
3896        }
3897
3898out:
3899        write_unlock(&idev->lock);
3900put:
3901        in6_dev_put(idev);
3902}
3903
3904/*
3905 *      Duplicate Address Detection
3906 */
3907static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
3908{
3909        unsigned long rand_num;
3910        struct inet6_dev *idev = ifp->idev;
3911        u64 nonce;
3912
3913        if (ifp->flags & IFA_F_OPTIMISTIC)
3914                rand_num = 0;
3915        else
3916                rand_num = prandom_u32() % (idev->cnf.rtr_solicit_delay ? : 1);
3917
3918        nonce = 0;
3919        if (idev->cnf.enhanced_dad ||
3920            dev_net(idev->dev)->ipv6.devconf_all->enhanced_dad) {
3921                do
3922                        get_random_bytes(&nonce, 6);
3923                while (nonce == 0);
3924        }
3925        ifp->dad_nonce = nonce;
3926        ifp->dad_probes = idev->cnf.dad_transmits;
3927        addrconf_mod_dad_work(ifp, rand_num);
3928}
3929
3930static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
3931{
3932        struct inet6_dev *idev = ifp->idev;
3933        struct net_device *dev = idev->dev;
3934        bool bump_id, notify = false;
3935        struct net *net;
3936
3937        addrconf_join_solict(dev, &ifp->addr);
3938
3939        prandom_seed((__force u32) ifp->addr.s6_addr32[3]);
3940
3941        read_lock_bh(&idev->lock);
3942        spin_lock(&ifp->lock);
3943        if (ifp->state == INET6_IFADDR_STATE_DEAD)
3944                goto out;
3945
3946        net = dev_net(dev);
3947        if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
3948            (net->ipv6.devconf_all->accept_dad < 1 &&
3949             idev->cnf.accept_dad < 1) ||
3950            !(ifp->flags&IFA_F_TENTATIVE) ||
3951            ifp->flags & IFA_F_NODAD) {
3952                bool send_na = false;
3953
3954                if (ifp->flags & IFA_F_TENTATIVE &&
3955                    !(ifp->flags & IFA_F_OPTIMISTIC))
3956                        send_na = true;
3957                bump_id = ifp->flags & IFA_F_TENTATIVE;
3958                ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
3959                spin_unlock(&ifp->lock);
3960                read_unlock_bh(&idev->lock);
3961
3962                addrconf_dad_completed(ifp, bump_id, send_na);
3963                return;
3964        }
3965
3966        if (!(idev->if_flags & IF_READY)) {
3967                spin_unlock(&ifp->lock);
3968                read_unlock_bh(&idev->lock);
3969                /*
3970                 * If the device is not ready:
3971                 * - keep it tentative if it is a permanent address.
3972                 * - otherwise, kill it.
3973                 */
3974                in6_ifa_hold(ifp);
3975                addrconf_dad_stop(ifp, 0);
3976                return;
3977        }
3978
3979        /*
3980         * Optimistic nodes can start receiving
3981         * Frames right away
3982         */
3983        if (ifp->flags & IFA_F_OPTIMISTIC) {
3984                ip6_ins_rt(net, ifp->rt);
3985                if (ipv6_use_optimistic_addr(net, idev)) {
3986                        /* Because optimistic nodes can use this address,
3987                         * notify listeners. If DAD fails, RTM_DELADDR is sent.
3988                         */
3989                        notify = true;
3990                }
3991        }
3992
3993        addrconf_dad_kick(ifp);
3994out:
3995        spin_unlock(&ifp->lock);
3996        read_unlock_bh(&idev->lock);
3997        if (notify)
3998                ipv6_ifa_notify(RTM_NEWADDR, ifp);
3999}
4000
4001static void addrconf_dad_start(struct inet6_ifaddr *ifp)
4002{
4003        bool begin_dad = false;
4004
4005        spin_lock_bh(&ifp->lock);
4006        if (ifp->state != INET6_IFADDR_STATE_DEAD) {
4007                ifp->state = INET6_IFADDR_STATE_PREDAD;
4008                begin_dad = true;
4009        }
4010        spin_unlock_bh(&ifp->lock);
4011
4012        if (begin_dad)
4013                addrconf_mod_dad_work(ifp, 0);
4014}
4015
4016static void addrconf_dad_work(struct work_struct *w)
4017{
4018        struct inet6_ifaddr *ifp = container_of(to_delayed_work(w),
4019                                                struct inet6_ifaddr,
4020                                                dad_work);
4021        struct inet6_dev *idev = ifp->idev;
4022        bool bump_id, disable_ipv6 = false;
4023        struct in6_addr mcaddr;
4024
4025        enum {
4026                DAD_PROCESS,
4027                DAD_BEGIN,
4028                DAD_ABORT,
4029        } action = DAD_PROCESS;
4030
4031        rtnl_lock();
4032
4033        spin_lock_bh(&ifp->lock);
4034        if (ifp->state == INET6_IFADDR_STATE_PREDAD) {
4035                action = DAD_BEGIN;
4036                ifp->state = INET6_IFADDR_STATE_DAD;
4037        } else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
4038                action = DAD_ABORT;
4039                ifp->state = INET6_IFADDR_STATE_POSTDAD;
4040
4041                if ((dev_net(idev->dev)->ipv6.devconf_all->accept_dad > 1 ||
4042                     idev->cnf.accept_dad > 1) &&
4043                    !idev->cnf.disable_ipv6 &&
4044                    !(ifp->flags & IFA_F_STABLE_PRIVACY)) {
4045                        struct in6_addr addr;
4046
4047                        addr.s6_addr32[0] = htonl(0xfe800000);
4048                        addr.s6_addr32[1] = 0;
4049
4050                        if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
4051                            ipv6_addr_equal(&ifp->addr, &addr)) {
4052                                /* DAD failed for link-local based on MAC */
4053                                idev->cnf.disable_ipv6 = 1;
4054
4055                                pr_info("%s: IPv6 being disabled!\n",
4056                                        ifp->idev->dev->name);
4057                                disable_ipv6 = true;
4058                        }
4059                }
4060        }
4061        spin_unlock_bh(&ifp->lock);
4062
4063        if (action == DAD_BEGIN) {
4064                addrconf_dad_begin(ifp);
4065                goto out;
4066        } else if (action == DAD_ABORT) {
4067                in6_ifa_hold(ifp);
4068                addrconf_dad_stop(ifp, 1);
4069                if (disable_ipv6)
4070                        addrconf_ifdown(idev->dev, false);
4071                goto out;
4072        }
4073
4074        if (!ifp->dad_probes && addrconf_dad_end(ifp))
4075                goto out;
4076
4077        write_lock_bh(&idev->lock);
4078        if (idev->dead || !(idev->if_flags & IF_READY)) {
4079                write_unlock_bh(&idev->lock);
4080                goto out;
4081        }
4082
4083        spin_lock(&ifp->lock);
4084        if (ifp->state == INET6_IFADDR_STATE_DEAD) {
4085                spin_unlock(&ifp->lock);
4086                write_unlock_bh(&idev->lock);
4087                goto out;
4088        }
4089
4090        if (ifp->dad_probes == 0) {
4091                bool send_na = false;
4092
4093                /*
4094                 * DAD was successful
4095                 */
4096
4097                if (ifp->flags & IFA_F_TENTATIVE &&
4098                    !(ifp->flags & IFA_F_OPTIMISTIC))
4099                        send_na = true;
4100                bump_id = ifp->flags & IFA_F_TENTATIVE;
4101                ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
4102                spin_unlock(&ifp->lock);
4103                write_unlock_bh(&idev->lock);
4104
4105                addrconf_dad_completed(ifp, bump_id, send_na);
4106
4107                goto out;
4108        }
4109
4110        ifp->dad_probes--;
4111        addrconf_mod_dad_work(ifp,
4112                              max(NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME),
4113                                  HZ/100));
4114        spin_unlock(&ifp->lock);
4115        write_unlock_bh(&idev->lock);
4116
4117        /* send a neighbour solicitation for our addr */
4118        addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
4119        ndisc_send_ns(ifp->idev->dev, &ifp->addr, &mcaddr, &in6addr_any,
4120                      ifp->dad_nonce);
4121out:
4122        in6_ifa_put(ifp);
4123        rtnl_unlock();
4124}
4125
4126/* ifp->idev must be at least read locked */
4127static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
4128{
4129        struct inet6_ifaddr *ifpiter;
4130        struct inet6_dev *idev = ifp->idev;
4131
4132        list_for_each_entry_reverse(ifpiter, &idev->addr_list, if_list) {
4133                if (ifpiter->scope > IFA_LINK)
4134                        break;
4135                if (ifp != ifpiter && ifpiter->scope == IFA_LINK &&
4136                    (ifpiter->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|
4137                                       IFA_F_OPTIMISTIC|IFA_F_DADFAILED)) ==
4138                    IFA_F_PERMANENT)
4139                        return false;
4140        }
4141        return true;
4142}
4143
4144static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
4145                                   bool send_na)
4146{
4147        struct net_device *dev = ifp->idev->dev;
4148        struct in6_addr lladdr;
4149        bool send_rs, send_mld;
4150
4151        addrconf_del_dad_work(ifp);
4152
4153        /*
4154         *      Configure the address for reception. Now it is valid.
4155         */
4156
4157        ipv6_ifa_notify(RTM_NEWADDR, ifp);
4158
4159        /* If added prefix is link local and we are prepared to process
4160           router advertisements, start sending router solicitations.
4161         */
4162
4163        read_lock_bh(&ifp->idev->lock);
4164        send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
4165        send_rs = send_mld &&
4166                  ipv6_accept_ra(ifp->idev) &&
4167                  ifp->idev->cnf.rtr_solicits != 0 &&
4168                  (dev->flags&IFF_LOOPBACK) == 0;
4169        read_unlock_bh(&ifp->idev->lock);
4170
4171        /* While dad is in progress mld report's source address is in6_addrany.
4172         * Resend with proper ll now.
4173         */
4174        if (send_mld)
4175                ipv6_mc_dad_complete(ifp->idev);
4176
4177        /* send unsolicited NA if enabled */
4178        if (send_na &&
4179            (ifp->idev->cnf.ndisc_notify ||
4180             dev_net(dev)->ipv6.devconf_all->ndisc_notify)) {
4181                ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifp->addr,
4182                              /*router=*/ !!ifp->idev->cnf.forwarding,
4183                              /*solicited=*/ false, /*override=*/ true,
4184                              /*inc_opt=*/ true);
4185        }
4186
4187        if (send_rs) {
4188                /*
4189                 *      If a host as already performed a random delay
4190                 *      [...] as part of DAD [...] there is no need
4191                 *      to delay again before sending the first RS
4192                 */
4193                if (ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
4194                        return;
4195                ndisc_send_rs(dev, &lladdr, &in6addr_linklocal_allrouters);
4196
4197                write_lock_bh(&ifp->idev->lock);
4198                spin_lock(&ifp->lock);
4199                ifp->idev->rs_interval = rfc3315_s14_backoff_init(
4200                        ifp->idev->cnf.rtr_solicit_interval);
4201                ifp->idev->rs_probes = 1;
4202                ifp->idev->if_flags |= IF_RS_SENT;
4203                addrconf_mod_rs_timer(ifp->idev, ifp->idev->rs_interval);
4204                spin_unlock(&ifp->lock);
4205                write_unlock_bh(&ifp->idev->lock);
4206        }
4207
4208        if (bump_id)
4209                rt_genid_bump_ipv6(dev_net(dev));
4210
4211        /* Make sure that a new temporary address will be created
4212         * before this temporary address becomes deprecated.
4213         */
4214        if (ifp->flags & IFA_F_TEMPORARY)
4215                addrconf_verify_rtnl();
4216}
4217
4218static void addrconf_dad_run(struct inet6_dev *idev, bool restart)
4219{
4220        struct inet6_ifaddr *ifp;
4221
4222        read_lock_bh(&idev->lock);
4223        list_for_each_entry(ifp, &idev->addr_list, if_list) {
4224                spin_lock(&ifp->lock);
4225                if ((ifp->flags & IFA_F_TENTATIVE &&
4226                     ifp->state == INET6_IFADDR_STATE_DAD) || restart) {
4227                        if (restart)
4228                                ifp->state = INET6_IFADDR_STATE_PREDAD;
4229                        addrconf_dad_kick(ifp);
4230                }
4231                spin_unlock(&ifp->lock);
4232        }
4233        read_unlock_bh(&idev->lock);
4234}
4235
4236#ifdef CONFIG_PROC_FS
4237struct if6_iter_state {
4238        struct seq_net_private p;
4239        int bucket;
4240        int offset;
4241};
4242
4243static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
4244{
4245        struct if6_iter_state *state = seq->private;
4246        struct net *net = seq_file_net(seq);
4247        struct inet6_ifaddr *ifa = NULL;
4248        int p = 0;
4249
4250        /* initial bucket if pos is 0 */
4251        if (pos == 0) {
4252                state->bucket = 0;
4253                state->offset = 0;
4254        }
4255
4256        for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
4257                hlist_for_each_entry_rcu(ifa, &inet6_addr_lst[state->bucket],
4258                                         addr_lst) {
4259                        if (!net_eq(dev_net(ifa->idev->dev), net))
4260                                continue;
4261                        /* sync with offset */
4262                        if (p < state->offset) {
4263                                p++;
4264                                continue;
4265                        }
4266                        return ifa;
4267                }
4268
4269                /* prepare for next bucket */
4270                state->offset = 0;
4271                p = 0;
4272        }
4273        return NULL;
4274}
4275
4276static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
4277                                         struct inet6_ifaddr *ifa)
4278{
4279        struct if6_iter_state *state = seq->private;
4280        struct net *net = seq_file_net(seq);
4281
4282        hlist_for_each_entry_continue_rcu(ifa, addr_lst) {
4283                if (!net_eq(dev_net(ifa->idev->dev), net))
4284                        continue;
4285                state->offset++;
4286                return ifa;
4287        }
4288
4289        state->offset = 0;
4290        while (++state->bucket < IN6_ADDR_HSIZE) {
4291                hlist_for_each_entry_rcu(ifa,
4292                                     &inet6_addr_lst[state->bucket], addr_lst) {
4293                        if (!net_eq(dev_net(ifa->idev->dev), net))
4294                                continue;
4295                        return ifa;
4296                }
4297        }
4298
4299        return NULL;
4300}
4301
4302static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
4303        __acquires(rcu)
4304{
4305        rcu_read_lock();
4306        return if6_get_first(seq, *pos);
4307}
4308
4309static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
4310{
4311        struct inet6_ifaddr *ifa;
4312
4313        ifa = if6_get_next(seq, v);
4314        ++*pos;
4315        return ifa;
4316}
4317
4318static void if6_seq_stop(struct seq_file *seq, void *v)
4319        __releases(rcu)
4320{
4321        rcu_read_unlock();
4322}
4323
4324static int if6_seq_show(struct seq_file *seq, void *v)
4325{
4326        struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
4327        seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
4328                   &ifp->addr,
4329                   ifp->idev->dev->ifindex,
4330                   ifp->prefix_len,
4331                   ifp->scope,
4332                   (u8) ifp->flags,
4333                   ifp->idev->dev->name);
4334        return 0;
4335}
4336
4337static const struct seq_operations if6_seq_ops = {
4338        .start  = if6_seq_start,
4339        .next   = if6_seq_next,
4340        .show   = if6_seq_show,
4341        .stop   = if6_seq_stop,
4342};
4343
4344static int __net_init if6_proc_net_init(struct net *net)
4345{
4346        if (!proc_create_net("if_inet6", 0444, net->proc_net, &if6_seq_ops,
4347                        sizeof(struct if6_iter_state)))
4348                return -ENOMEM;
4349        return 0;
4350}
4351
4352static void __net_exit if6_proc_net_exit(struct net *net)
4353{
4354        remove_proc_entry("if_inet6", net->proc_net);
4355}
4356
4357static struct pernet_operations if6_proc_net_ops = {
4358        .init = if6_proc_net_init,
4359        .exit = if6_proc_net_exit,
4360};
4361
4362int __init if6_proc_init(void)
4363{
4364        return register_pernet_subsys(&if6_proc_net_ops);
4365}
4366
4367void if6_proc_exit(void)
4368{
4369        unregister_pernet_subsys(&if6_proc_net_ops);
4370}
4371#endif  /* CONFIG_PROC_FS */
4372
4373#if IS_ENABLED(CONFIG_IPV6_MIP6)
4374/* Check if address is a home address configured on any interface. */
4375int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
4376{
4377        unsigned int hash = inet6_addr_hash(net, addr);
4378        struct inet6_ifaddr *ifp = NULL;
4379        int ret = 0;
4380
4381        rcu_read_lock();
4382        hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
4383                if (!net_eq(dev_net(ifp->idev->dev), net))
4384                        continue;
4385                if (ipv6_addr_equal(&ifp->addr, addr) &&
4386                    (ifp->flags & IFA_F_HOMEADDRESS)) {
4387                        ret = 1;
4388                        break;
4389                }
4390        }
4391        rcu_read_unlock();
4392        return ret;
4393}
4394#endif
4395
4396/* RFC6554 has some algorithm to avoid loops in segment routing by
4397 * checking if the segments contains any of a local interface address.
4398 *
4399 * Quote:
4400 *
4401 * To detect loops in the SRH, a router MUST determine if the SRH
4402 * includes multiple addresses assigned to any interface on that router.
4403 * If such addresses appear more than once and are separated by at least
4404 * one address not assigned to that router.
4405 */
4406int ipv6_chk_rpl_srh_loop(struct net *net, const struct in6_addr *segs,
4407                          unsigned char nsegs)
4408{
4409        const struct in6_addr *addr;
4410        int i, ret = 0, found = 0;
4411        struct inet6_ifaddr *ifp;
4412        bool separated = false;
4413        unsigned int hash;
4414        bool hash_found;
4415
4416        rcu_read_lock();
4417        for (i = 0; i < nsegs; i++) {
4418                addr = &segs[i];
4419                hash = inet6_addr_hash(net, addr);
4420
4421                hash_found = false;
4422                hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
4423                        if (!net_eq(dev_net(ifp->idev->dev), net))
4424                                continue;
4425
4426                        if (ipv6_addr_equal(&ifp->addr, addr)) {
4427                                hash_found = true;
4428                                break;
4429                        }
4430                }
4431
4432                if (hash_found) {
4433                        if (found > 1 && separated) {
4434                                ret = 1;
4435                                break;
4436                        }
4437
4438                        separated = false;
4439                        found++;
4440                } else {
4441                        separated = true;
4442                }
4443        }
4444        rcu_read_unlock();
4445
4446        return ret;
4447}
4448
4449/*
4450 *      Periodic address status verification
4451 */
4452
4453static void addrconf_verify_rtnl(void)
4454{
4455        unsigned long now, next, next_sec, next_sched;
4456        struct inet6_ifaddr *ifp;
4457        int i;
4458
4459        ASSERT_RTNL();
4460
4461        rcu_read_lock_bh();
4462        now = jiffies;
4463        next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
4464
4465        cancel_delayed_work(&addr_chk_work);
4466
4467        for (i = 0; i < IN6_ADDR_HSIZE; i++) {
4468restart:
4469                hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[i], addr_lst) {
4470                        unsigned long age;
4471
4472                        /* When setting preferred_lft to a value not zero or
4473                         * infinity, while valid_lft is infinity
4474                         * IFA_F_PERMANENT has a non-infinity life time.
4475                         */
4476                        if ((ifp->flags & IFA_F_PERMANENT) &&
4477                            (ifp->prefered_lft == INFINITY_LIFE_TIME))
4478                                continue;
4479
4480                        spin_lock(&ifp->lock);
4481                        /* We try to batch several events at once. */
4482                        age = (now - ifp->tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
4483
4484                        if (ifp->valid_lft != INFINITY_LIFE_TIME &&
4485                            age >= ifp->valid_lft) {
4486                                spin_unlock(&ifp->lock);
4487                                in6_ifa_hold(ifp);
4488                                rcu_read_unlock_bh();
4489                                ipv6_del_addr(ifp);
4490                                rcu_read_lock_bh();
4491                                goto restart;
4492                        } else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
4493                                spin_unlock(&ifp->lock);
4494                                continue;
4495                        } else if (age >= ifp->prefered_lft) {
4496                                /* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
4497                                int deprecate = 0;
4498
4499                                if (!(ifp->flags&IFA_F_DEPRECATED)) {
4500                                        deprecate = 1;
4501                                        ifp->flags |= IFA_F_DEPRECATED;
4502                                }
4503
4504                                if ((ifp->valid_lft != INFINITY_LIFE_TIME) &&
4505                                    (time_before(ifp->tstamp + ifp->valid_lft * HZ, next)))
4506                                        next = ifp->tstamp + ifp->valid_lft * HZ;
4507
4508                                spin_unlock(&ifp->lock);
4509
4510                                if (deprecate) {
4511                                        in6_ifa_hold(ifp);
4512
4513                                        ipv6_ifa_notify(0, ifp);
4514                                        in6_ifa_put(ifp);
4515                                        goto restart;
4516                                }
4517                        } else if ((ifp->flags&IFA_F_TEMPORARY) &&
4518                                   !(ifp->flags&IFA_F_TENTATIVE)) {
4519                                unsigned long regen_advance = ifp->idev->cnf.regen_max_retry *
4520                                        ifp->idev->cnf.dad_transmits *
4521                                        max(NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME), HZ/100) / HZ;
4522
4523                                if (age >= ifp->prefered_lft - regen_advance) {
4524                                        struct inet6_ifaddr *ifpub = ifp->ifpub;
4525                                        if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
4526                                                next = ifp->tstamp + ifp->prefered_lft * HZ;
4527                                        if (!ifp->regen_count && ifpub) {
4528                                                ifp->regen_count++;
4529                                                in6_ifa_hold(ifp);
4530                                                in6_ifa_hold(ifpub);
4531                                                spin_unlock(&ifp->lock);
4532
4533                                                spin_lock(&ifpub->lock);
4534                                                ifpub->regen_count = 0;
4535                                                spin_unlock(&ifpub->lock);
4536                                                rcu_read_unlock_bh();
4537                                                ipv6_create_tempaddr(ifpub, true);
4538                                                in6_ifa_put(ifpub);
4539                                                in6_ifa_put(ifp);
4540                                                rcu_read_lock_bh();
4541                                                goto restart;
4542                                        }
4543                                } else if (time_before(ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ, next))
4544                                        next = ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ;
4545                                spin_unlock(&ifp->lock);
4546                        } else {
4547                                /* ifp->prefered_lft <= ifp->valid_lft */
4548                                if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
4549                                        next = ifp->tstamp + ifp->prefered_lft * HZ;
4550                                spin_unlock(&ifp->lock);
4551                        }
4552                }
4553        }
4554
4555        next_sec = round_jiffies_up(next);
4556        next_sched = next;
4557
4558        /* If rounded timeout is accurate enough, accept it. */
4559        if (time_before(next_sec, next + ADDRCONF_TIMER_FUZZ))
4560                next_sched = next_sec;
4561
4562        /* And minimum interval is ADDRCONF_TIMER_FUZZ_MAX. */
4563        if (time_before(next_sched, jiffies + ADDRCONF_TIMER_FUZZ_MAX))
4564                next_sched = jiffies + ADDRCONF_TIMER_FUZZ_MAX;
4565
4566        pr_debug("now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
4567                 now, next, next_sec, next_sched);
4568        mod_delayed_work(addrconf_wq, &addr_chk_work, next_sched - now);
4569        rcu_read_unlock_bh();
4570}
4571
4572static void addrconf_verify_work(struct work_struct *w)
4573{
4574        rtnl_lock();
4575        addrconf_verify_rtnl();
4576        rtnl_unlock();
4577}
4578
4579static void addrconf_verify(void)
4580{
4581        mod_delayed_work(addrconf_wq, &addr_chk_work, 0);
4582}
4583
4584static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local,
4585                                     struct