xref: /openbmc/linux/net/ipv6/addrconf.c (revision af31f412c7c7a3c0fda4bf4beaf0c85af1f263c8)
1 /*
2  *	IPv6 Address [auto]configuration
3  *	Linux INET6 implementation
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
8  *
9  *	This program is free software; you can redistribute it and/or
10  *      modify it under the terms of the GNU General Public License
11  *      as published by the Free Software Foundation; either version
12  *      2 of the License, or (at your option) any later version.
13  */
14 
15 /*
16  *	Changes:
17  *
18  *	Janos Farkas			:	delete timer on ifdown
19  *	<chexum@bankinf.banki.hu>
20  *	Andi Kleen			:	kill double kfree on module
21  *						unload.
22  *	Maciej W. Rozycki		:	FDDI support
23  *	sekiya@USAGI			:	Don't send too many RS
24  *						packets.
25  *	yoshfuji@USAGI			:       Fixed interval between DAD
26  *						packets.
27  *	YOSHIFUJI Hideaki @USAGI	:	improved accuracy of
28  *						address validation timer.
29  *	YOSHIFUJI Hideaki @USAGI	:	Privacy Extensions (RFC3041)
30  *						support.
31  *	Yuji SEKIYA @USAGI		:	Don't assign a same IPv6
32  *						address on a same interface.
33  *	YOSHIFUJI Hideaki @USAGI	:	ARCnet support
34  *	YOSHIFUJI Hideaki @USAGI	:	convert /proc/net/if_inet6 to
35  *						seq_file.
36  *	YOSHIFUJI Hideaki @USAGI	:	improved source address
37  *						selection; consider scope,
38  *						status etc.
39  */
40 
41 #define pr_fmt(fmt) "IPv6: " fmt
42 
43 #include <linux/errno.h>
44 #include <linux/types.h>
45 #include <linux/kernel.h>
46 #include <linux/socket.h>
47 #include <linux/sockios.h>
48 #include <linux/net.h>
49 #include <linux/in6.h>
50 #include <linux/netdevice.h>
51 #include <linux/if_addr.h>
52 #include <linux/if_arp.h>
53 #include <linux/if_arcnet.h>
54 #include <linux/if_infiniband.h>
55 #include <linux/route.h>
56 #include <linux/inetdevice.h>
57 #include <linux/init.h>
58 #include <linux/slab.h>
59 #ifdef CONFIG_SYSCTL
60 #include <linux/sysctl.h>
61 #endif
62 #include <linux/capability.h>
63 #include <linux/delay.h>
64 #include <linux/notifier.h>
65 #include <linux/string.h>
66 #include <linux/hash.h>
67 
68 #include <net/net_namespace.h>
69 #include <net/sock.h>
70 #include <net/snmp.h>
71 
72 #include <net/af_ieee802154.h>
73 #include <net/ipv6.h>
74 #include <net/protocol.h>
75 #include <net/ndisc.h>
76 #include <net/ip6_route.h>
77 #include <net/addrconf.h>
78 #include <net/tcp.h>
79 #include <net/ip.h>
80 #include <net/netlink.h>
81 #include <net/pkt_sched.h>
82 #include <linux/if_tunnel.h>
83 #include <linux/rtnetlink.h>
84 #include <linux/netconf.h>
85 
86 #ifdef CONFIG_IPV6_PRIVACY
87 #include <linux/random.h>
88 #endif
89 
90 #include <linux/uaccess.h>
91 #include <asm/unaligned.h>
92 
93 #include <linux/proc_fs.h>
94 #include <linux/seq_file.h>
95 #include <linux/export.h>
96 
97 /* Set to 3 to get tracing... */
98 #define ACONF_DEBUG 2
99 
100 #if ACONF_DEBUG >= 3
101 #define ADBG(x) printk x
102 #else
103 #define ADBG(x)
104 #endif
105 
106 #define	INFINITY_LIFE_TIME	0xFFFFFFFF
107 
108 static inline u32 cstamp_delta(unsigned long cstamp)
109 {
110 	return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
111 }
112 
113 #define ADDRCONF_TIMER_FUZZ_MINUS	(HZ > 50 ? HZ/50 : 1)
114 #define ADDRCONF_TIMER_FUZZ		(HZ / 4)
115 #define ADDRCONF_TIMER_FUZZ_MAX		(HZ)
116 
117 #ifdef CONFIG_SYSCTL
118 static void addrconf_sysctl_register(struct inet6_dev *idev);
119 static void addrconf_sysctl_unregister(struct inet6_dev *idev);
120 #else
121 static inline void addrconf_sysctl_register(struct inet6_dev *idev)
122 {
123 }
124 
125 static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
126 {
127 }
128 #endif
129 
130 #ifdef CONFIG_IPV6_PRIVACY
131 static void __ipv6_regen_rndid(struct inet6_dev *idev);
132 static void __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
133 static void ipv6_regen_rndid(unsigned long data);
134 #endif
135 
136 static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);
137 static int ipv6_count_addresses(struct inet6_dev *idev);
138 
139 /*
140  *	Configured unicast address hash table
141  */
142 static struct hlist_head inet6_addr_lst[IN6_ADDR_HSIZE];
143 static DEFINE_SPINLOCK(addrconf_hash_lock);
144 
145 static void addrconf_verify(unsigned long);
146 
147 static DEFINE_TIMER(addr_chk_timer, addrconf_verify, 0, 0);
148 static DEFINE_SPINLOCK(addrconf_verify_lock);
149 
150 static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
151 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);
152 
153 static void addrconf_type_change(struct net_device *dev,
154 				 unsigned long event);
155 static int addrconf_ifdown(struct net_device *dev, int how);
156 
157 static void addrconf_dad_start(struct inet6_ifaddr *ifp);
158 static void addrconf_dad_timer(unsigned long data);
159 static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
160 static void addrconf_dad_run(struct inet6_dev *idev);
161 static void addrconf_rs_timer(unsigned long data);
162 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
163 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
164 
165 static void inet6_prefix_notify(int event, struct inet6_dev *idev,
166 				struct prefix_info *pinfo);
167 static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
168 			       struct net_device *dev);
169 
170 static ATOMIC_NOTIFIER_HEAD(inet6addr_chain);
171 
172 static struct ipv6_devconf ipv6_devconf __read_mostly = {
173 	.forwarding		= 0,
174 	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
175 	.mtu6			= IPV6_MIN_MTU,
176 	.accept_ra		= 1,
177 	.accept_redirects	= 1,
178 	.autoconf		= 1,
179 	.force_mld_version	= 0,
180 	.dad_transmits		= 1,
181 	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
182 	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
183 	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
184 #ifdef CONFIG_IPV6_PRIVACY
185 	.use_tempaddr 		= 0,
186 	.temp_valid_lft		= TEMP_VALID_LIFETIME,
187 	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
188 	.regen_max_retry	= REGEN_MAX_RETRY,
189 	.max_desync_factor	= MAX_DESYNC_FACTOR,
190 #endif
191 	.max_addresses		= IPV6_MAX_ADDRESSES,
192 	.accept_ra_defrtr	= 1,
193 	.accept_ra_pinfo	= 1,
194 #ifdef CONFIG_IPV6_ROUTER_PREF
195 	.accept_ra_rtr_pref	= 1,
196 	.rtr_probe_interval	= 60 * HZ,
197 #ifdef CONFIG_IPV6_ROUTE_INFO
198 	.accept_ra_rt_info_max_plen = 0,
199 #endif
200 #endif
201 	.proxy_ndp		= 0,
202 	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
203 	.disable_ipv6		= 0,
204 	.accept_dad		= 1,
205 };
206 
207 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
208 	.forwarding		= 0,
209 	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
210 	.mtu6			= IPV6_MIN_MTU,
211 	.accept_ra		= 1,
212 	.accept_redirects	= 1,
213 	.autoconf		= 1,
214 	.dad_transmits		= 1,
215 	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
216 	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
217 	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
218 #ifdef CONFIG_IPV6_PRIVACY
219 	.use_tempaddr		= 0,
220 	.temp_valid_lft		= TEMP_VALID_LIFETIME,
221 	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
222 	.regen_max_retry	= REGEN_MAX_RETRY,
223 	.max_desync_factor	= MAX_DESYNC_FACTOR,
224 #endif
225 	.max_addresses		= IPV6_MAX_ADDRESSES,
226 	.accept_ra_defrtr	= 1,
227 	.accept_ra_pinfo	= 1,
228 #ifdef CONFIG_IPV6_ROUTER_PREF
229 	.accept_ra_rtr_pref	= 1,
230 	.rtr_probe_interval	= 60 * HZ,
231 #ifdef CONFIG_IPV6_ROUTE_INFO
232 	.accept_ra_rt_info_max_plen = 0,
233 #endif
234 #endif
235 	.proxy_ndp		= 0,
236 	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
237 	.disable_ipv6		= 0,
238 	.accept_dad		= 1,
239 };
240 
241 /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
242 const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
243 const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
244 const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
245 const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
246 
247 /* Check if a valid qdisc is available */
248 static inline bool addrconf_qdisc_ok(const struct net_device *dev)
249 {
250 	return !qdisc_tx_is_noop(dev);
251 }
252 
253 /* Check if a route is valid prefix route */
254 static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
255 {
256 	return (rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0;
257 }
258 
259 static void addrconf_del_timer(struct inet6_ifaddr *ifp)
260 {
261 	if (del_timer(&ifp->timer))
262 		__in6_ifa_put(ifp);
263 }
264 
265 enum addrconf_timer_t {
266 	AC_NONE,
267 	AC_DAD,
268 	AC_RS,
269 };
270 
271 static void addrconf_mod_timer(struct inet6_ifaddr *ifp,
272 			       enum addrconf_timer_t what,
273 			       unsigned long when)
274 {
275 	if (!del_timer(&ifp->timer))
276 		in6_ifa_hold(ifp);
277 
278 	switch (what) {
279 	case AC_DAD:
280 		ifp->timer.function = addrconf_dad_timer;
281 		break;
282 	case AC_RS:
283 		ifp->timer.function = addrconf_rs_timer;
284 		break;
285 	default:
286 		break;
287 	}
288 	ifp->timer.expires = jiffies + when;
289 	add_timer(&ifp->timer);
290 }
291 
292 static int snmp6_alloc_dev(struct inet6_dev *idev)
293 {
294 	if (snmp_mib_init((void __percpu **)idev->stats.ipv6,
295 			  sizeof(struct ipstats_mib),
296 			  __alignof__(struct ipstats_mib)) < 0)
297 		goto err_ip;
298 	idev->stats.icmpv6dev = kzalloc(sizeof(struct icmpv6_mib_device),
299 					GFP_KERNEL);
300 	if (!idev->stats.icmpv6dev)
301 		goto err_icmp;
302 	idev->stats.icmpv6msgdev = kzalloc(sizeof(struct icmpv6msg_mib_device),
303 					   GFP_KERNEL);
304 	if (!idev->stats.icmpv6msgdev)
305 		goto err_icmpmsg;
306 
307 	return 0;
308 
309 err_icmpmsg:
310 	kfree(idev->stats.icmpv6dev);
311 err_icmp:
312 	snmp_mib_free((void __percpu **)idev->stats.ipv6);
313 err_ip:
314 	return -ENOMEM;
315 }
316 
317 static void snmp6_free_dev(struct inet6_dev *idev)
318 {
319 	kfree(idev->stats.icmpv6msgdev);
320 	kfree(idev->stats.icmpv6dev);
321 	snmp_mib_free((void __percpu **)idev->stats.ipv6);
322 }
323 
324 /* Nobody refers to this device, we may destroy it. */
325 
326 void in6_dev_finish_destroy(struct inet6_dev *idev)
327 {
328 	struct net_device *dev = idev->dev;
329 
330 	WARN_ON(!list_empty(&idev->addr_list));
331 	WARN_ON(idev->mc_list != NULL);
332 
333 #ifdef NET_REFCNT_DEBUG
334 	pr_debug("%s: %s\n", __func__, dev ? dev->name : "NIL");
335 #endif
336 	dev_put(dev);
337 	if (!idev->dead) {
338 		pr_warn("Freeing alive inet6 device %p\n", idev);
339 		return;
340 	}
341 	snmp6_free_dev(idev);
342 	kfree_rcu(idev, rcu);
343 }
344 EXPORT_SYMBOL(in6_dev_finish_destroy);
345 
346 static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
347 {
348 	struct inet6_dev *ndev;
349 
350 	ASSERT_RTNL();
351 
352 	if (dev->mtu < IPV6_MIN_MTU)
353 		return NULL;
354 
355 	ndev = kzalloc(sizeof(struct inet6_dev), GFP_KERNEL);
356 
357 	if (ndev == NULL)
358 		return NULL;
359 
360 	rwlock_init(&ndev->lock);
361 	ndev->dev = dev;
362 	INIT_LIST_HEAD(&ndev->addr_list);
363 
364 	memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
365 	ndev->cnf.mtu6 = dev->mtu;
366 	ndev->cnf.sysctl = NULL;
367 	ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
368 	if (ndev->nd_parms == NULL) {
369 		kfree(ndev);
370 		return NULL;
371 	}
372 	if (ndev->cnf.forwarding)
373 		dev_disable_lro(dev);
374 	/* We refer to the device */
375 	dev_hold(dev);
376 
377 	if (snmp6_alloc_dev(ndev) < 0) {
378 		ADBG((KERN_WARNING
379 			"%s: cannot allocate memory for statistics; dev=%s.\n",
380 			__func__, dev->name));
381 		neigh_parms_release(&nd_tbl, ndev->nd_parms);
382 		dev_put(dev);
383 		kfree(ndev);
384 		return NULL;
385 	}
386 
387 	if (snmp6_register_dev(ndev) < 0) {
388 		ADBG((KERN_WARNING
389 			"%s: cannot create /proc/net/dev_snmp6/%s\n",
390 			__func__, dev->name));
391 		neigh_parms_release(&nd_tbl, ndev->nd_parms);
392 		ndev->dead = 1;
393 		in6_dev_finish_destroy(ndev);
394 		return NULL;
395 	}
396 
397 	/* One reference from device.  We must do this before
398 	 * we invoke __ipv6_regen_rndid().
399 	 */
400 	in6_dev_hold(ndev);
401 
402 	if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
403 		ndev->cnf.accept_dad = -1;
404 
405 #if IS_ENABLED(CONFIG_IPV6_SIT)
406 	if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
407 		pr_info("%s: Disabled Multicast RS\n", dev->name);
408 		ndev->cnf.rtr_solicits = 0;
409 	}
410 #endif
411 
412 #ifdef CONFIG_IPV6_PRIVACY
413 	INIT_LIST_HEAD(&ndev->tempaddr_list);
414 	setup_timer(&ndev->regen_timer, ipv6_regen_rndid, (unsigned long)ndev);
415 	if ((dev->flags&IFF_LOOPBACK) ||
416 	    dev->type == ARPHRD_TUNNEL ||
417 	    dev->type == ARPHRD_TUNNEL6 ||
418 	    dev->type == ARPHRD_SIT ||
419 	    dev->type == ARPHRD_NONE) {
420 		ndev->cnf.use_tempaddr = -1;
421 	} else {
422 		in6_dev_hold(ndev);
423 		ipv6_regen_rndid((unsigned long) ndev);
424 	}
425 #endif
426 
427 	if (netif_running(dev) && addrconf_qdisc_ok(dev))
428 		ndev->if_flags |= IF_READY;
429 
430 	ipv6_mc_init_dev(ndev);
431 	ndev->tstamp = jiffies;
432 	addrconf_sysctl_register(ndev);
433 	/* protected by rtnl_lock */
434 	rcu_assign_pointer(dev->ip6_ptr, ndev);
435 
436 	/* Join all-node multicast group */
437 	ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
438 
439 	/* Join all-router multicast group if forwarding is set */
440 	if (ndev->cnf.forwarding && (dev->flags & IFF_MULTICAST))
441 		ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
442 
443 	return ndev;
444 }
445 
446 static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
447 {
448 	struct inet6_dev *idev;
449 
450 	ASSERT_RTNL();
451 
452 	idev = __in6_dev_get(dev);
453 	if (!idev) {
454 		idev = ipv6_add_dev(dev);
455 		if (!idev)
456 			return NULL;
457 	}
458 
459 	if (dev->flags&IFF_UP)
460 		ipv6_mc_up(idev);
461 	return idev;
462 }
463 
464 static int inet6_netconf_msgsize_devconf(int type)
465 {
466 	int size =  NLMSG_ALIGN(sizeof(struct netconfmsg))
467 		    + nla_total_size(4);	/* NETCONFA_IFINDEX */
468 
469 	/* type -1 is used for ALL */
470 	if (type == -1 || type == NETCONFA_FORWARDING)
471 		size += nla_total_size(4);
472 
473 	return size;
474 }
475 
476 static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
477 				      struct ipv6_devconf *devconf, u32 portid,
478 				      u32 seq, int event, unsigned int flags,
479 				      int type)
480 {
481 	struct nlmsghdr  *nlh;
482 	struct netconfmsg *ncm;
483 
484 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct netconfmsg),
485 			flags);
486 	if (nlh == NULL)
487 		return -EMSGSIZE;
488 
489 	ncm = nlmsg_data(nlh);
490 	ncm->ncm_family = AF_INET6;
491 
492 	if (nla_put_s32(skb, NETCONFA_IFINDEX, ifindex) < 0)
493 		goto nla_put_failure;
494 
495 	/* type -1 is used for ALL */
496 	if ((type == -1 || type == NETCONFA_FORWARDING) &&
497 	    nla_put_s32(skb, NETCONFA_FORWARDING, devconf->forwarding) < 0)
498 		goto nla_put_failure;
499 
500 	return nlmsg_end(skb, nlh);
501 
502 nla_put_failure:
503 	nlmsg_cancel(skb, nlh);
504 	return -EMSGSIZE;
505 }
506 
507 static void inet6_netconf_notify_devconf(struct net *net, int type, int ifindex,
508 					 struct ipv6_devconf *devconf)
509 {
510 	struct sk_buff *skb;
511 	int err = -ENOBUFS;
512 
513 	skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_ATOMIC);
514 	if (skb == NULL)
515 		goto errout;
516 
517 	err = inet6_netconf_fill_devconf(skb, ifindex, devconf, 0, 0,
518 					 RTM_NEWNETCONF, 0, type);
519 	if (err < 0) {
520 		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
521 		WARN_ON(err == -EMSGSIZE);
522 		kfree_skb(skb);
523 		goto errout;
524 	}
525 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_ATOMIC);
526 	return;
527 errout:
528 	if (err < 0)
529 		rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err);
530 }
531 
532 static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
533 	[NETCONFA_IFINDEX]	= { .len = sizeof(int) },
534 	[NETCONFA_FORWARDING]	= { .len = sizeof(int) },
535 };
536 
537 static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
538 				     struct nlmsghdr *nlh,
539 				     void *arg)
540 {
541 	struct net *net = sock_net(in_skb->sk);
542 	struct nlattr *tb[NETCONFA_MAX+1];
543 	struct netconfmsg *ncm;
544 	struct sk_buff *skb;
545 	struct ipv6_devconf *devconf;
546 	struct inet6_dev *in6_dev;
547 	struct net_device *dev;
548 	int ifindex;
549 	int err;
550 
551 	err = nlmsg_parse(nlh, sizeof(*ncm), tb, NETCONFA_MAX,
552 			  devconf_ipv6_policy);
553 	if (err < 0)
554 		goto errout;
555 
556 	err = EINVAL;
557 	if (!tb[NETCONFA_IFINDEX])
558 		goto errout;
559 
560 	ifindex = nla_get_s32(tb[NETCONFA_IFINDEX]);
561 	switch (ifindex) {
562 	case NETCONFA_IFINDEX_ALL:
563 		devconf = net->ipv6.devconf_all;
564 		break;
565 	case NETCONFA_IFINDEX_DEFAULT:
566 		devconf = net->ipv6.devconf_dflt;
567 		break;
568 	default:
569 		dev = __dev_get_by_index(net, ifindex);
570 		if (dev == NULL)
571 			goto errout;
572 		in6_dev = __in6_dev_get(dev);
573 		if (in6_dev == NULL)
574 			goto errout;
575 		devconf = &in6_dev->cnf;
576 		break;
577 	}
578 
579 	err = -ENOBUFS;
580 	skb = nlmsg_new(inet6_netconf_msgsize_devconf(-1), GFP_ATOMIC);
581 	if (skb == NULL)
582 		goto errout;
583 
584 	err = inet6_netconf_fill_devconf(skb, ifindex, devconf,
585 					 NETLINK_CB(in_skb).portid,
586 					 nlh->nlmsg_seq, RTM_NEWNETCONF, 0,
587 					 -1);
588 	if (err < 0) {
589 		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
590 		WARN_ON(err == -EMSGSIZE);
591 		kfree_skb(skb);
592 		goto errout;
593 	}
594 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
595 errout:
596 	return err;
597 }
598 
599 #ifdef CONFIG_SYSCTL
600 static void dev_forward_change(struct inet6_dev *idev)
601 {
602 	struct net_device *dev;
603 	struct inet6_ifaddr *ifa;
604 
605 	if (!idev)
606 		return;
607 	dev = idev->dev;
608 	if (idev->cnf.forwarding)
609 		dev_disable_lro(dev);
610 	if (dev->flags & IFF_MULTICAST) {
611 		if (idev->cnf.forwarding)
612 			ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
613 		else
614 			ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);
615 	}
616 
617 	list_for_each_entry(ifa, &idev->addr_list, if_list) {
618 		if (ifa->flags&IFA_F_TENTATIVE)
619 			continue;
620 		if (idev->cnf.forwarding)
621 			addrconf_join_anycast(ifa);
622 		else
623 			addrconf_leave_anycast(ifa);
624 	}
625 	inet6_netconf_notify_devconf(dev_net(dev), NETCONFA_FORWARDING,
626 				     dev->ifindex, &idev->cnf);
627 }
628 
629 
630 static void addrconf_forward_change(struct net *net, __s32 newf)
631 {
632 	struct net_device *dev;
633 	struct inet6_dev *idev;
634 
635 	for_each_netdev(net, dev) {
636 		idev = __in6_dev_get(dev);
637 		if (idev) {
638 			int changed = (!idev->cnf.forwarding) ^ (!newf);
639 			idev->cnf.forwarding = newf;
640 			if (changed)
641 				dev_forward_change(idev);
642 		}
643 	}
644 }
645 
646 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
647 {
648 	struct net *net;
649 	int old;
650 
651 	if (!rtnl_trylock())
652 		return restart_syscall();
653 
654 	net = (struct net *)table->extra2;
655 	old = *p;
656 	*p = newf;
657 
658 	if (p == &net->ipv6.devconf_dflt->forwarding) {
659 		if ((!newf) ^ (!old))
660 			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
661 						     NETCONFA_IFINDEX_DEFAULT,
662 						     net->ipv6.devconf_dflt);
663 		rtnl_unlock();
664 		return 0;
665 	}
666 
667 	if (p == &net->ipv6.devconf_all->forwarding) {
668 		net->ipv6.devconf_dflt->forwarding = newf;
669 		addrconf_forward_change(net, newf);
670 		if ((!newf) ^ (!old))
671 			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
672 						     NETCONFA_IFINDEX_ALL,
673 						     net->ipv6.devconf_all);
674 	} else if ((!newf) ^ (!old))
675 		dev_forward_change((struct inet6_dev *)table->extra1);
676 	rtnl_unlock();
677 
678 	if (newf)
679 		rt6_purge_dflt_routers(net);
680 	return 1;
681 }
682 #endif
683 
684 /* Nobody refers to this ifaddr, destroy it */
685 void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
686 {
687 	WARN_ON(!hlist_unhashed(&ifp->addr_lst));
688 
689 #ifdef NET_REFCNT_DEBUG
690 	pr_debug("%s\n", __func__);
691 #endif
692 
693 	in6_dev_put(ifp->idev);
694 
695 	if (del_timer(&ifp->timer))
696 		pr_notice("Timer is still running, when freeing ifa=%p\n", ifp);
697 
698 	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
699 		pr_warn("Freeing alive inet6 address %p\n", ifp);
700 		return;
701 	}
702 	ip6_rt_put(ifp->rt);
703 
704 	kfree_rcu(ifp, rcu);
705 }
706 
707 static void
708 ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
709 {
710 	struct list_head *p;
711 	int ifp_scope = ipv6_addr_src_scope(&ifp->addr);
712 
713 	/*
714 	 * Each device address list is sorted in order of scope -
715 	 * global before linklocal.
716 	 */
717 	list_for_each(p, &idev->addr_list) {
718 		struct inet6_ifaddr *ifa
719 			= list_entry(p, struct inet6_ifaddr, if_list);
720 		if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))
721 			break;
722 	}
723 
724 	list_add_tail(&ifp->if_list, p);
725 }
726 
727 static u32 inet6_addr_hash(const struct in6_addr *addr)
728 {
729 	return hash_32(ipv6_addr_hash(addr), IN6_ADDR_HSIZE_SHIFT);
730 }
731 
732 /* On success it returns ifp with increased reference count */
733 
734 static struct inet6_ifaddr *
735 ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
736 	      int scope, u32 flags)
737 {
738 	struct inet6_ifaddr *ifa = NULL;
739 	struct rt6_info *rt;
740 	unsigned int hash;
741 	int err = 0;
742 	int addr_type = ipv6_addr_type(addr);
743 
744 	if (addr_type == IPV6_ADDR_ANY ||
745 	    addr_type & IPV6_ADDR_MULTICAST ||
746 	    (!(idev->dev->flags & IFF_LOOPBACK) &&
747 	     addr_type & IPV6_ADDR_LOOPBACK))
748 		return ERR_PTR(-EADDRNOTAVAIL);
749 
750 	rcu_read_lock_bh();
751 	if (idev->dead) {
752 		err = -ENODEV;			/*XXX*/
753 		goto out2;
754 	}
755 
756 	if (idev->cnf.disable_ipv6) {
757 		err = -EACCES;
758 		goto out2;
759 	}
760 
761 	spin_lock(&addrconf_hash_lock);
762 
763 	/* Ignore adding duplicate addresses on an interface */
764 	if (ipv6_chk_same_addr(dev_net(idev->dev), addr, idev->dev)) {
765 		ADBG(("ipv6_add_addr: already assigned\n"));
766 		err = -EEXIST;
767 		goto out;
768 	}
769 
770 	ifa = kzalloc(sizeof(struct inet6_ifaddr), GFP_ATOMIC);
771 
772 	if (ifa == NULL) {
773 		ADBG(("ipv6_add_addr: malloc failed\n"));
774 		err = -ENOBUFS;
775 		goto out;
776 	}
777 
778 	rt = addrconf_dst_alloc(idev, addr, false);
779 	if (IS_ERR(rt)) {
780 		err = PTR_ERR(rt);
781 		goto out;
782 	}
783 
784 	ifa->addr = *addr;
785 
786 	spin_lock_init(&ifa->lock);
787 	spin_lock_init(&ifa->state_lock);
788 	init_timer(&ifa->timer);
789 	INIT_HLIST_NODE(&ifa->addr_lst);
790 	ifa->timer.data = (unsigned long) ifa;
791 	ifa->scope = scope;
792 	ifa->prefix_len = pfxlen;
793 	ifa->flags = flags | IFA_F_TENTATIVE;
794 	ifa->cstamp = ifa->tstamp = jiffies;
795 
796 	ifa->rt = rt;
797 
798 	ifa->idev = idev;
799 	in6_dev_hold(idev);
800 	/* For caller */
801 	in6_ifa_hold(ifa);
802 
803 	/* Add to big hash table */
804 	hash = inet6_addr_hash(addr);
805 
806 	hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);
807 	spin_unlock(&addrconf_hash_lock);
808 
809 	write_lock(&idev->lock);
810 	/* Add to inet6_dev unicast addr list. */
811 	ipv6_link_dev_addr(idev, ifa);
812 
813 #ifdef CONFIG_IPV6_PRIVACY
814 	if (ifa->flags&IFA_F_TEMPORARY) {
815 		list_add(&ifa->tmp_list, &idev->tempaddr_list);
816 		in6_ifa_hold(ifa);
817 	}
818 #endif
819 
820 	in6_ifa_hold(ifa);
821 	write_unlock(&idev->lock);
822 out2:
823 	rcu_read_unlock_bh();
824 
825 	if (likely(err == 0))
826 		atomic_notifier_call_chain(&inet6addr_chain, NETDEV_UP, ifa);
827 	else {
828 		kfree(ifa);
829 		ifa = ERR_PTR(err);
830 	}
831 
832 	return ifa;
833 out:
834 	spin_unlock(&addrconf_hash_lock);
835 	goto out2;
836 }
837 
838 /* This function wants to get referenced ifp and releases it before return */
839 
840 static void ipv6_del_addr(struct inet6_ifaddr *ifp)
841 {
842 	struct inet6_ifaddr *ifa, *ifn;
843 	struct inet6_dev *idev = ifp->idev;
844 	int state;
845 	int deleted = 0, onlink = 0;
846 	unsigned long expires = jiffies;
847 
848 	spin_lock_bh(&ifp->state_lock);
849 	state = ifp->state;
850 	ifp->state = INET6_IFADDR_STATE_DEAD;
851 	spin_unlock_bh(&ifp->state_lock);
852 
853 	if (state == INET6_IFADDR_STATE_DEAD)
854 		goto out;
855 
856 	spin_lock_bh(&addrconf_hash_lock);
857 	hlist_del_init_rcu(&ifp->addr_lst);
858 	spin_unlock_bh(&addrconf_hash_lock);
859 
860 	write_lock_bh(&idev->lock);
861 #ifdef CONFIG_IPV6_PRIVACY
862 	if (ifp->flags&IFA_F_TEMPORARY) {
863 		list_del(&ifp->tmp_list);
864 		if (ifp->ifpub) {
865 			in6_ifa_put(ifp->ifpub);
866 			ifp->ifpub = NULL;
867 		}
868 		__in6_ifa_put(ifp);
869 	}
870 #endif
871 
872 	list_for_each_entry_safe(ifa, ifn, &idev->addr_list, if_list) {
873 		if (ifa == ifp) {
874 			list_del_init(&ifp->if_list);
875 			__in6_ifa_put(ifp);
876 
877 			if (!(ifp->flags & IFA_F_PERMANENT) || onlink > 0)
878 				break;
879 			deleted = 1;
880 			continue;
881 		} else if (ifp->flags & IFA_F_PERMANENT) {
882 			if (ipv6_prefix_equal(&ifa->addr, &ifp->addr,
883 					      ifp->prefix_len)) {
884 				if (ifa->flags & IFA_F_PERMANENT) {
885 					onlink = 1;
886 					if (deleted)
887 						break;
888 				} else {
889 					unsigned long lifetime;
890 
891 					if (!onlink)
892 						onlink = -1;
893 
894 					spin_lock(&ifa->lock);
895 
896 					lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
897 					/*
898 					 * Note: Because this address is
899 					 * not permanent, lifetime <
900 					 * LONG_MAX / HZ here.
901 					 */
902 					if (time_before(expires,
903 							ifa->tstamp + lifetime * HZ))
904 						expires = ifa->tstamp + lifetime * HZ;
905 					spin_unlock(&ifa->lock);
906 				}
907 			}
908 		}
909 	}
910 	write_unlock_bh(&idev->lock);
911 
912 	addrconf_del_timer(ifp);
913 
914 	ipv6_ifa_notify(RTM_DELADDR, ifp);
915 
916 	atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifp);
917 
918 	/*
919 	 * Purge or update corresponding prefix
920 	 *
921 	 * 1) we don't purge prefix here if address was not permanent.
922 	 *    prefix is managed by its own lifetime.
923 	 * 2) if there're no addresses, delete prefix.
924 	 * 3) if there're still other permanent address(es),
925 	 *    corresponding prefix is still permanent.
926 	 * 4) otherwise, update prefix lifetime to the
927 	 *    longest valid lifetime among the corresponding
928 	 *    addresses on the device.
929 	 *    Note: subsequent RA will update lifetime.
930 	 *
931 	 * --yoshfuji
932 	 */
933 	if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) {
934 		struct in6_addr prefix;
935 		struct rt6_info *rt;
936 		struct net *net = dev_net(ifp->idev->dev);
937 		struct flowi6 fl6 = {};
938 
939 		ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);
940 		fl6.flowi6_oif = ifp->idev->dev->ifindex;
941 		fl6.daddr = prefix;
942 		rt = (struct rt6_info *)ip6_route_lookup(net, &fl6,
943 							 RT6_LOOKUP_F_IFACE);
944 
945 		if (rt != net->ipv6.ip6_null_entry &&
946 		    addrconf_is_prefix_route(rt)) {
947 			if (onlink == 0) {
948 				ip6_del_rt(rt);
949 				rt = NULL;
950 			} else if (!(rt->rt6i_flags & RTF_EXPIRES)) {
951 				rt6_set_expires(rt, expires);
952 			}
953 		}
954 		ip6_rt_put(rt);
955 	}
956 
957 	/* clean up prefsrc entries */
958 	rt6_remove_prefsrc(ifp);
959 out:
960 	in6_ifa_put(ifp);
961 }
962 
963 #ifdef CONFIG_IPV6_PRIVACY
964 static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *ift)
965 {
966 	struct inet6_dev *idev = ifp->idev;
967 	struct in6_addr addr, *tmpaddr;
968 	unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_tstamp, age;
969 	unsigned long regen_advance;
970 	int tmp_plen;
971 	int ret = 0;
972 	int max_addresses;
973 	u32 addr_flags;
974 	unsigned long now = jiffies;
975 
976 	write_lock(&idev->lock);
977 	if (ift) {
978 		spin_lock_bh(&ift->lock);
979 		memcpy(&addr.s6_addr[8], &ift->addr.s6_addr[8], 8);
980 		spin_unlock_bh(&ift->lock);
981 		tmpaddr = &addr;
982 	} else {
983 		tmpaddr = NULL;
984 	}
985 retry:
986 	in6_dev_hold(idev);
987 	if (idev->cnf.use_tempaddr <= 0) {
988 		write_unlock(&idev->lock);
989 		pr_info("%s: use_tempaddr is disabled\n", __func__);
990 		in6_dev_put(idev);
991 		ret = -1;
992 		goto out;
993 	}
994 	spin_lock_bh(&ifp->lock);
995 	if (ifp->regen_count++ >= idev->cnf.regen_max_retry) {
996 		idev->cnf.use_tempaddr = -1;	/*XXX*/
997 		spin_unlock_bh(&ifp->lock);
998 		write_unlock(&idev->lock);
999 		pr_warn("%s: regeneration time exceeded - disabled temporary address support\n",
1000 			__func__);
1001 		in6_dev_put(idev);
1002 		ret = -1;
1003 		goto out;
1004 	}
1005 	in6_ifa_hold(ifp);
1006 	memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);
1007 	__ipv6_try_regen_rndid(idev, tmpaddr);
1008 	memcpy(&addr.s6_addr[8], idev->rndid, 8);
1009 	age = (now - ifp->tstamp) / HZ;
1010 	tmp_valid_lft = min_t(__u32,
1011 			      ifp->valid_lft,
1012 			      idev->cnf.temp_valid_lft + age);
1013 	tmp_prefered_lft = min_t(__u32,
1014 				 ifp->prefered_lft,
1015 				 idev->cnf.temp_prefered_lft + age -
1016 				 idev->cnf.max_desync_factor);
1017 	tmp_plen = ifp->prefix_len;
1018 	max_addresses = idev->cnf.max_addresses;
1019 	tmp_tstamp = ifp->tstamp;
1020 	spin_unlock_bh(&ifp->lock);
1021 
1022 	regen_advance = idev->cnf.regen_max_retry *
1023 	                idev->cnf.dad_transmits *
1024 	                idev->nd_parms->retrans_time / HZ;
1025 	write_unlock(&idev->lock);
1026 
1027 	/* A temporary address is created only if this calculated Preferred
1028 	 * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
1029 	 * an implementation must not create a temporary address with a zero
1030 	 * Preferred Lifetime.
1031 	 */
1032 	if (tmp_prefered_lft <= regen_advance) {
1033 		in6_ifa_put(ifp);
1034 		in6_dev_put(idev);
1035 		ret = -1;
1036 		goto out;
1037 	}
1038 
1039 	addr_flags = IFA_F_TEMPORARY;
1040 	/* set in addrconf_prefix_rcv() */
1041 	if (ifp->flags & IFA_F_OPTIMISTIC)
1042 		addr_flags |= IFA_F_OPTIMISTIC;
1043 
1044 	ift = !max_addresses ||
1045 	      ipv6_count_addresses(idev) < max_addresses ?
1046 		ipv6_add_addr(idev, &addr, tmp_plen,
1047 			      ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
1048 			      addr_flags) : NULL;
1049 	if (!ift || IS_ERR(ift)) {
1050 		in6_ifa_put(ifp);
1051 		in6_dev_put(idev);
1052 		pr_info("%s: retry temporary address regeneration\n", __func__);
1053 		tmpaddr = &addr;
1054 		write_lock(&idev->lock);
1055 		goto retry;
1056 	}
1057 
1058 	spin_lock_bh(&ift->lock);
1059 	ift->ifpub = ifp;
1060 	ift->valid_lft = tmp_valid_lft;
1061 	ift->prefered_lft = tmp_prefered_lft;
1062 	ift->cstamp = now;
1063 	ift->tstamp = tmp_tstamp;
1064 	spin_unlock_bh(&ift->lock);
1065 
1066 	addrconf_dad_start(ift);
1067 	in6_ifa_put(ift);
1068 	in6_dev_put(idev);
1069 out:
1070 	return ret;
1071 }
1072 #endif
1073 
1074 /*
1075  *	Choose an appropriate source address (RFC3484)
1076  */
1077 enum {
1078 	IPV6_SADDR_RULE_INIT = 0,
1079 	IPV6_SADDR_RULE_LOCAL,
1080 	IPV6_SADDR_RULE_SCOPE,
1081 	IPV6_SADDR_RULE_PREFERRED,
1082 #ifdef CONFIG_IPV6_MIP6
1083 	IPV6_SADDR_RULE_HOA,
1084 #endif
1085 	IPV6_SADDR_RULE_OIF,
1086 	IPV6_SADDR_RULE_LABEL,
1087 #ifdef CONFIG_IPV6_PRIVACY
1088 	IPV6_SADDR_RULE_PRIVACY,
1089 #endif
1090 	IPV6_SADDR_RULE_ORCHID,
1091 	IPV6_SADDR_RULE_PREFIX,
1092 	IPV6_SADDR_RULE_MAX
1093 };
1094 
1095 struct ipv6_saddr_score {
1096 	int			rule;
1097 	int			addr_type;
1098 	struct inet6_ifaddr	*ifa;
1099 	DECLARE_BITMAP(scorebits, IPV6_SADDR_RULE_MAX);
1100 	int			scopedist;
1101 	int			matchlen;
1102 };
1103 
1104 struct ipv6_saddr_dst {
1105 	const struct in6_addr *addr;
1106 	int ifindex;
1107 	int scope;
1108 	int label;
1109 	unsigned int prefs;
1110 };
1111 
1112 static inline int ipv6_saddr_preferred(int type)
1113 {
1114 	if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))
1115 		return 1;
1116 	return 0;
1117 }
1118 
1119 static int ipv6_get_saddr_eval(struct net *net,
1120 			       struct ipv6_saddr_score *score,
1121 			       struct ipv6_saddr_dst *dst,
1122 			       int i)
1123 {
1124 	int ret;
1125 
1126 	if (i <= score->rule) {
1127 		switch (i) {
1128 		case IPV6_SADDR_RULE_SCOPE:
1129 			ret = score->scopedist;
1130 			break;
1131 		case IPV6_SADDR_RULE_PREFIX:
1132 			ret = score->matchlen;
1133 			break;
1134 		default:
1135 			ret = !!test_bit(i, score->scorebits);
1136 		}
1137 		goto out;
1138 	}
1139 
1140 	switch (i) {
1141 	case IPV6_SADDR_RULE_INIT:
1142 		/* Rule 0: remember if hiscore is not ready yet */
1143 		ret = !!score->ifa;
1144 		break;
1145 	case IPV6_SADDR_RULE_LOCAL:
1146 		/* Rule 1: Prefer same address */
1147 		ret = ipv6_addr_equal(&score->ifa->addr, dst->addr);
1148 		break;
1149 	case IPV6_SADDR_RULE_SCOPE:
1150 		/* Rule 2: Prefer appropriate scope
1151 		 *
1152 		 *      ret
1153 		 *       ^
1154 		 *    -1 |  d 15
1155 		 *    ---+--+-+---> scope
1156 		 *       |
1157 		 *       |             d is scope of the destination.
1158 		 *  B-d  |  \
1159 		 *       |   \      <- smaller scope is better if
1160 		 *  B-15 |    \        if scope is enough for destinaion.
1161 		 *       |             ret = B - scope (-1 <= scope >= d <= 15).
1162 		 * d-C-1 | /
1163 		 *       |/         <- greater is better
1164 		 *   -C  /             if scope is not enough for destination.
1165 		 *      /|             ret = scope - C (-1 <= d < scope <= 15).
1166 		 *
1167 		 * d - C - 1 < B -15 (for all -1 <= d <= 15).
1168 		 * C > d + 14 - B >= 15 + 14 - B = 29 - B.
1169 		 * Assume B = 0 and we get C > 29.
1170 		 */
1171 		ret = __ipv6_addr_src_scope(score->addr_type);
1172 		if (ret >= dst->scope)
1173 			ret = -ret;
1174 		else
1175 			ret -= 128;	/* 30 is enough */
1176 		score->scopedist = ret;
1177 		break;
1178 	case IPV6_SADDR_RULE_PREFERRED:
1179 		/* Rule 3: Avoid deprecated and optimistic addresses */
1180 		ret = ipv6_saddr_preferred(score->addr_type) ||
1181 		      !(score->ifa->flags & (IFA_F_DEPRECATED|IFA_F_OPTIMISTIC));
1182 		break;
1183 #ifdef CONFIG_IPV6_MIP6
1184 	case IPV6_SADDR_RULE_HOA:
1185 	    {
1186 		/* Rule 4: Prefer home address */
1187 		int prefhome = !(dst->prefs & IPV6_PREFER_SRC_COA);
1188 		ret = !(score->ifa->flags & IFA_F_HOMEADDRESS) ^ prefhome;
1189 		break;
1190 	    }
1191 #endif
1192 	case IPV6_SADDR_RULE_OIF:
1193 		/* Rule 5: Prefer outgoing interface */
1194 		ret = (!dst->ifindex ||
1195 		       dst->ifindex == score->ifa->idev->dev->ifindex);
1196 		break;
1197 	case IPV6_SADDR_RULE_LABEL:
1198 		/* Rule 6: Prefer matching label */
1199 		ret = ipv6_addr_label(net,
1200 				      &score->ifa->addr, score->addr_type,
1201 				      score->ifa->idev->dev->ifindex) == dst->label;
1202 		break;
1203 #ifdef CONFIG_IPV6_PRIVACY
1204 	case IPV6_SADDR_RULE_PRIVACY:
1205 	    {
1206 		/* Rule 7: Prefer public address
1207 		 * Note: prefer temporary address if use_tempaddr >= 2
1208 		 */
1209 		int preftmp = dst->prefs & (IPV6_PREFER_SRC_PUBLIC|IPV6_PREFER_SRC_TMP) ?
1210 				!!(dst->prefs & IPV6_PREFER_SRC_TMP) :
1211 				score->ifa->idev->cnf.use_tempaddr >= 2;
1212 		ret = (!(score->ifa->flags & IFA_F_TEMPORARY)) ^ preftmp;
1213 		break;
1214 	    }
1215 #endif
1216 	case IPV6_SADDR_RULE_ORCHID:
1217 		/* Rule 8-: Prefer ORCHID vs ORCHID or
1218 		 *	    non-ORCHID vs non-ORCHID
1219 		 */
1220 		ret = !(ipv6_addr_orchid(&score->ifa->addr) ^
1221 			ipv6_addr_orchid(dst->addr));
1222 		break;
1223 	case IPV6_SADDR_RULE_PREFIX:
1224 		/* Rule 8: Use longest matching prefix */
1225 		ret = ipv6_addr_diff(&score->ifa->addr, dst->addr);
1226 		if (ret > score->ifa->prefix_len)
1227 			ret = score->ifa->prefix_len;
1228 		score->matchlen = ret;
1229 		break;
1230 	default:
1231 		ret = 0;
1232 	}
1233 
1234 	if (ret)
1235 		__set_bit(i, score->scorebits);
1236 	score->rule = i;
1237 out:
1238 	return ret;
1239 }
1240 
1241 int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
1242 		       const struct in6_addr *daddr, unsigned int prefs,
1243 		       struct in6_addr *saddr)
1244 {
1245 	struct ipv6_saddr_score scores[2],
1246 				*score = &scores[0], *hiscore = &scores[1];
1247 	struct ipv6_saddr_dst dst;
1248 	struct net_device *dev;
1249 	int dst_type;
1250 
1251 	dst_type = __ipv6_addr_type(daddr);
1252 	dst.addr = daddr;
1253 	dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
1254 	dst.scope = __ipv6_addr_src_scope(dst_type);
1255 	dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);
1256 	dst.prefs = prefs;
1257 
1258 	hiscore->rule = -1;
1259 	hiscore->ifa = NULL;
1260 
1261 	rcu_read_lock();
1262 
1263 	for_each_netdev_rcu(net, dev) {
1264 		struct inet6_dev *idev;
1265 
1266 		/* Candidate Source Address (section 4)
1267 		 *  - multicast and link-local destination address,
1268 		 *    the set of candidate source address MUST only
1269 		 *    include addresses assigned to interfaces
1270 		 *    belonging to the same link as the outgoing
1271 		 *    interface.
1272 		 * (- For site-local destination addresses, the
1273 		 *    set of candidate source addresses MUST only
1274 		 *    include addresses assigned to interfaces
1275 		 *    belonging to the same site as the outgoing
1276 		 *    interface.)
1277 		 */
1278 		if (((dst_type & IPV6_ADDR_MULTICAST) ||
1279 		     dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL) &&
1280 		    dst.ifindex && dev->ifindex != dst.ifindex)
1281 			continue;
1282 
1283 		idev = __in6_dev_get(dev);
1284 		if (!idev)
1285 			continue;
1286 
1287 		read_lock_bh(&idev->lock);
1288 		list_for_each_entry(score->ifa, &idev->addr_list, if_list) {
1289 			int i;
1290 
1291 			/*
1292 			 * - Tentative Address (RFC2462 section 5.4)
1293 			 *  - A tentative address is not considered
1294 			 *    "assigned to an interface" in the traditional
1295 			 *    sense, unless it is also flagged as optimistic.
1296 			 * - Candidate Source Address (section 4)
1297 			 *  - In any case, anycast addresses, multicast
1298 			 *    addresses, and the unspecified address MUST
1299 			 *    NOT be included in a candidate set.
1300 			 */
1301 			if ((score->ifa->flags & IFA_F_TENTATIVE) &&
1302 			    (!(score->ifa->flags & IFA_F_OPTIMISTIC)))
1303 				continue;
1304 
1305 			score->addr_type = __ipv6_addr_type(&score->ifa->addr);
1306 
1307 			if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
1308 				     score->addr_type & IPV6_ADDR_MULTICAST)) {
1309 				LIMIT_NETDEBUG(KERN_DEBUG
1310 					       "ADDRCONF: unspecified / multicast address "
1311 					       "assigned as unicast address on %s",
1312 					       dev->name);
1313 				continue;
1314 			}
1315 
1316 			score->rule = -1;
1317 			bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
1318 
1319 			for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
1320 				int minihiscore, miniscore;
1321 
1322 				minihiscore = ipv6_get_saddr_eval(net, hiscore, &dst, i);
1323 				miniscore = ipv6_get_saddr_eval(net, score, &dst, i);
1324 
1325 				if (minihiscore > miniscore) {
1326 					if (i == IPV6_SADDR_RULE_SCOPE &&
1327 					    score->scopedist > 0) {
1328 						/*
1329 						 * special case:
1330 						 * each remaining entry
1331 						 * has too small (not enough)
1332 						 * scope, because ifa entries
1333 						 * are sorted by their scope
1334 						 * values.
1335 						 */
1336 						goto try_nextdev;
1337 					}
1338 					break;
1339 				} else if (minihiscore < miniscore) {
1340 					if (hiscore->ifa)
1341 						in6_ifa_put(hiscore->ifa);
1342 
1343 					in6_ifa_hold(score->ifa);
1344 
1345 					swap(hiscore, score);
1346 
1347 					/* restore our iterator */
1348 					score->ifa = hiscore->ifa;
1349 
1350 					break;
1351 				}
1352 			}
1353 		}
1354 try_nextdev:
1355 		read_unlock_bh(&idev->lock);
1356 	}
1357 	rcu_read_unlock();
1358 
1359 	if (!hiscore->ifa)
1360 		return -EADDRNOTAVAIL;
1361 
1362 	*saddr = hiscore->ifa->addr;
1363 	in6_ifa_put(hiscore->ifa);
1364 	return 0;
1365 }
1366 EXPORT_SYMBOL(ipv6_dev_get_saddr);
1367 
1368 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
1369 		    unsigned char banned_flags)
1370 {
1371 	struct inet6_dev *idev;
1372 	int err = -EADDRNOTAVAIL;
1373 
1374 	rcu_read_lock();
1375 	idev = __in6_dev_get(dev);
1376 	if (idev) {
1377 		struct inet6_ifaddr *ifp;
1378 
1379 		read_lock_bh(&idev->lock);
1380 		list_for_each_entry(ifp, &idev->addr_list, if_list) {
1381 			if (ifp->scope == IFA_LINK &&
1382 			    !(ifp->flags & banned_flags)) {
1383 				*addr = ifp->addr;
1384 				err = 0;
1385 				break;
1386 			}
1387 		}
1388 		read_unlock_bh(&idev->lock);
1389 	}
1390 	rcu_read_unlock();
1391 	return err;
1392 }
1393 
1394 static int ipv6_count_addresses(struct inet6_dev *idev)
1395 {
1396 	int cnt = 0;
1397 	struct inet6_ifaddr *ifp;
1398 
1399 	read_lock_bh(&idev->lock);
1400 	list_for_each_entry(ifp, &idev->addr_list, if_list)
1401 		cnt++;
1402 	read_unlock_bh(&idev->lock);
1403 	return cnt;
1404 }
1405 
1406 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
1407 		  struct net_device *dev, int strict)
1408 {
1409 	struct inet6_ifaddr *ifp;
1410 	struct hlist_node *node;
1411 	unsigned int hash = inet6_addr_hash(addr);
1412 
1413 	rcu_read_lock_bh();
1414 	hlist_for_each_entry_rcu(ifp, node, &inet6_addr_lst[hash], addr_lst) {
1415 		if (!net_eq(dev_net(ifp->idev->dev), net))
1416 			continue;
1417 		if (ipv6_addr_equal(&ifp->addr, addr) &&
1418 		    !(ifp->flags&IFA_F_TENTATIVE) &&
1419 		    (dev == NULL || ifp->idev->dev == dev ||
1420 		     !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
1421 			rcu_read_unlock_bh();
1422 			return 1;
1423 		}
1424 	}
1425 
1426 	rcu_read_unlock_bh();
1427 	return 0;
1428 }
1429 EXPORT_SYMBOL(ipv6_chk_addr);
1430 
1431 static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
1432 			       struct net_device *dev)
1433 {
1434 	unsigned int hash = inet6_addr_hash(addr);
1435 	struct inet6_ifaddr *ifp;
1436 	struct hlist_node *node;
1437 
1438 	hlist_for_each_entry(ifp, node, &inet6_addr_lst[hash], addr_lst) {
1439 		if (!net_eq(dev_net(ifp->idev->dev), net))
1440 			continue;
1441 		if (ipv6_addr_equal(&ifp->addr, addr)) {
1442 			if (dev == NULL || ifp->idev->dev == dev)
1443 				return true;
1444 		}
1445 	}
1446 	return false;
1447 }
1448 
1449 int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
1450 {
1451 	struct inet6_dev *idev;
1452 	struct inet6_ifaddr *ifa;
1453 	int	onlink;
1454 
1455 	onlink = 0;
1456 	rcu_read_lock();
1457 	idev = __in6_dev_get(dev);
1458 	if (idev) {
1459 		read_lock_bh(&idev->lock);
1460 		list_for_each_entry(ifa, &idev->addr_list, if_list) {
1461 			onlink = ipv6_prefix_equal(addr, &ifa->addr,
1462 						   ifa->prefix_len);
1463 			if (onlink)
1464 				break;
1465 		}
1466 		read_unlock_bh(&idev->lock);
1467 	}
1468 	rcu_read_unlock();
1469 	return onlink;
1470 }
1471 EXPORT_SYMBOL(ipv6_chk_prefix);
1472 
1473 struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,
1474 				     struct net_device *dev, int strict)
1475 {
1476 	struct inet6_ifaddr *ifp, *result = NULL;
1477 	unsigned int hash = inet6_addr_hash(addr);
1478 	struct hlist_node *node;
1479 
1480 	rcu_read_lock_bh();
1481 	hlist_for_each_entry_rcu_bh(ifp, node, &inet6_addr_lst[hash], addr_lst) {
1482 		if (!net_eq(dev_net(ifp->idev->dev), net))
1483 			continue;
1484 		if (ipv6_addr_equal(&ifp->addr, addr)) {
1485 			if (dev == NULL || ifp->idev->dev == dev ||
1486 			    !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {
1487 				result = ifp;
1488 				in6_ifa_hold(ifp);
1489 				break;
1490 			}
1491 		}
1492 	}
1493 	rcu_read_unlock_bh();
1494 
1495 	return result;
1496 }
1497 
1498 /* Gets referenced address, destroys ifaddr */
1499 
1500 static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
1501 {
1502 	if (ifp->flags&IFA_F_PERMANENT) {
1503 		spin_lock_bh(&ifp->lock);
1504 		addrconf_del_timer(ifp);
1505 		ifp->flags |= IFA_F_TENTATIVE;
1506 		if (dad_failed)
1507 			ifp->flags |= IFA_F_DADFAILED;
1508 		spin_unlock_bh(&ifp->lock);
1509 		if (dad_failed)
1510 			ipv6_ifa_notify(0, ifp);
1511 		in6_ifa_put(ifp);
1512 #ifdef CONFIG_IPV6_PRIVACY
1513 	} else if (ifp->flags&IFA_F_TEMPORARY) {
1514 		struct inet6_ifaddr *ifpub;
1515 		spin_lock_bh(&ifp->lock);
1516 		ifpub = ifp->ifpub;
1517 		if (ifpub) {
1518 			in6_ifa_hold(ifpub);
1519 			spin_unlock_bh(&ifp->lock);
1520 			ipv6_create_tempaddr(ifpub, ifp);
1521 			in6_ifa_put(ifpub);
1522 		} else {
1523 			spin_unlock_bh(&ifp->lock);
1524 		}
1525 		ipv6_del_addr(ifp);
1526 #endif
1527 	} else
1528 		ipv6_del_addr(ifp);
1529 }
1530 
1531 static int addrconf_dad_end(struct inet6_ifaddr *ifp)
1532 {
1533 	int err = -ENOENT;
1534 
1535 	spin_lock(&ifp->state_lock);
1536 	if (ifp->state == INET6_IFADDR_STATE_DAD) {
1537 		ifp->state = INET6_IFADDR_STATE_POSTDAD;
1538 		err = 0;
1539 	}
1540 	spin_unlock(&ifp->state_lock);
1541 
1542 	return err;
1543 }
1544 
1545 void addrconf_dad_failure(struct inet6_ifaddr *ifp)
1546 {
1547 	struct inet6_dev *idev = ifp->idev;
1548 
1549 	if (addrconf_dad_end(ifp)) {
1550 		in6_ifa_put(ifp);
1551 		return;
1552 	}
1553 
1554 	net_info_ratelimited("%s: IPv6 duplicate address %pI6c detected!\n",
1555 			     ifp->idev->dev->name, &ifp->addr);
1556 
1557 	if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
1558 		struct in6_addr addr;
1559 
1560 		addr.s6_addr32[0] = htonl(0xfe800000);
1561 		addr.s6_addr32[1] = 0;
1562 
1563 		if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
1564 		    ipv6_addr_equal(&ifp->addr, &addr)) {
1565 			/* DAD failed for link-local based on MAC address */
1566 			idev->cnf.disable_ipv6 = 1;
1567 
1568 			pr_info("%s: IPv6 being disabled!\n",
1569 				ifp->idev->dev->name);
1570 		}
1571 	}
1572 
1573 	addrconf_dad_stop(ifp, 1);
1574 }
1575 
1576 /* Join to solicited addr multicast group. */
1577 
1578 void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
1579 {
1580 	struct in6_addr maddr;
1581 
1582 	if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
1583 		return;
1584 
1585 	addrconf_addr_solict_mult(addr, &maddr);
1586 	ipv6_dev_mc_inc(dev, &maddr);
1587 }
1588 
1589 void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
1590 {
1591 	struct in6_addr maddr;
1592 
1593 	if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
1594 		return;
1595 
1596 	addrconf_addr_solict_mult(addr, &maddr);
1597 	__ipv6_dev_mc_dec(idev, &maddr);
1598 }
1599 
1600 static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
1601 {
1602 	struct in6_addr addr;
1603 	if (ifp->prefix_len == 127) /* RFC 6164 */
1604 		return;
1605 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
1606 	if (ipv6_addr_any(&addr))
1607 		return;
1608 	ipv6_dev_ac_inc(ifp->idev->dev, &addr);
1609 }
1610 
1611 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
1612 {
1613 	struct in6_addr addr;
1614 	if (ifp->prefix_len == 127) /* RFC 6164 */
1615 		return;
1616 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
1617 	if (ipv6_addr_any(&addr))
1618 		return;
1619 	__ipv6_dev_ac_dec(ifp->idev, &addr);
1620 }
1621 
1622 static int addrconf_ifid_eui48(u8 *eui, struct net_device *dev)
1623 {
1624 	if (dev->addr_len != ETH_ALEN)
1625 		return -1;
1626 	memcpy(eui, dev->dev_addr, 3);
1627 	memcpy(eui + 5, dev->dev_addr + 3, 3);
1628 
1629 	/*
1630 	 * The zSeries OSA network cards can be shared among various
1631 	 * OS instances, but the OSA cards have only one MAC address.
1632 	 * This leads to duplicate address conflicts in conjunction
1633 	 * with IPv6 if more than one instance uses the same card.
1634 	 *
1635 	 * The driver for these cards can deliver a unique 16-bit
1636 	 * identifier for each instance sharing the same card.  It is
1637 	 * placed instead of 0xFFFE in the interface identifier.  The
1638 	 * "u" bit of the interface identifier is not inverted in this
1639 	 * case.  Hence the resulting interface identifier has local
1640 	 * scope according to RFC2373.
1641 	 */
1642 	if (dev->dev_id) {
1643 		eui[3] = (dev->dev_id >> 8) & 0xFF;
1644 		eui[4] = dev->dev_id & 0xFF;
1645 	} else {
1646 		eui[3] = 0xFF;
1647 		eui[4] = 0xFE;
1648 		eui[0] ^= 2;
1649 	}
1650 	return 0;
1651 }
1652 
1653 static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
1654 {
1655 	if (dev->addr_len != IEEE802154_ADDR_LEN)
1656 		return -1;
1657 	memcpy(eui, dev->dev_addr, 8);
1658 	return 0;
1659 }
1660 
1661 static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
1662 {
1663 	/* XXX: inherit EUI-64 from other interface -- yoshfuji */
1664 	if (dev->addr_len != ARCNET_ALEN)
1665 		return -1;
1666 	memset(eui, 0, 7);
1667 	eui[7] = *(u8 *)dev->dev_addr;
1668 	return 0;
1669 }
1670 
1671 static int addrconf_ifid_infiniband(u8 *eui, struct net_device *dev)
1672 {
1673 	if (dev->addr_len != INFINIBAND_ALEN)
1674 		return -1;
1675 	memcpy(eui, dev->dev_addr + 12, 8);
1676 	eui[0] |= 2;
1677 	return 0;
1678 }
1679 
1680 static int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
1681 {
1682 	if (addr == 0)
1683 		return -1;
1684 	eui[0] = (ipv4_is_zeronet(addr) || ipv4_is_private_10(addr) ||
1685 		  ipv4_is_loopback(addr) || ipv4_is_linklocal_169(addr) ||
1686 		  ipv4_is_private_172(addr) || ipv4_is_test_192(addr) ||
1687 		  ipv4_is_anycast_6to4(addr) || ipv4_is_private_192(addr) ||
1688 		  ipv4_is_test_198(addr) || ipv4_is_multicast(addr) ||
1689 		  ipv4_is_lbcast(addr)) ? 0x00 : 0x02;
1690 	eui[1] = 0;
1691 	eui[2] = 0x5E;
1692 	eui[3] = 0xFE;
1693 	memcpy(eui + 4, &addr, 4);
1694 	return 0;
1695 }
1696 
1697 static int addrconf_ifid_sit(u8 *eui, struct net_device *dev)
1698 {
1699 	if (dev->priv_flags & IFF_ISATAP)
1700 		return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
1701 	return -1;
1702 }
1703 
1704 static int addrconf_ifid_gre(u8 *eui, struct net_device *dev)
1705 {
1706 	return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
1707 }
1708 
1709 static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
1710 {
1711 	switch (dev->type) {
1712 	case ARPHRD_ETHER:
1713 	case ARPHRD_FDDI:
1714 		return addrconf_ifid_eui48(eui, dev);
1715 	case ARPHRD_ARCNET:
1716 		return addrconf_ifid_arcnet(eui, dev);
1717 	case ARPHRD_INFINIBAND:
1718 		return addrconf_ifid_infiniband(eui, dev);
1719 	case ARPHRD_SIT:
1720 		return addrconf_ifid_sit(eui, dev);
1721 	case ARPHRD_IPGRE:
1722 		return addrconf_ifid_gre(eui, dev);
1723 	case ARPHRD_IEEE802154:
1724 		return addrconf_ifid_eui64(eui, dev);
1725 	}
1726 	return -1;
1727 }
1728 
1729 static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
1730 {
1731 	int err = -1;
1732 	struct inet6_ifaddr *ifp;
1733 
1734 	read_lock_bh(&idev->lock);
1735 	list_for_each_entry(ifp, &idev->addr_list, if_list) {
1736 		if (ifp->scope == IFA_LINK && !(ifp->flags&IFA_F_TENTATIVE)) {
1737 			memcpy(eui, ifp->addr.s6_addr+8, 8);
1738 			err = 0;
1739 			break;
1740 		}
1741 	}
1742 	read_unlock_bh(&idev->lock);
1743 	return err;
1744 }
1745 
1746 #ifdef CONFIG_IPV6_PRIVACY
1747 /* (re)generation of randomized interface identifier (RFC 3041 3.2, 3.5) */
1748 static void __ipv6_regen_rndid(struct inet6_dev *idev)
1749 {
1750 regen:
1751 	get_random_bytes(idev->rndid, sizeof(idev->rndid));
1752 	idev->rndid[0] &= ~0x02;
1753 
1754 	/*
1755 	 * <draft-ietf-ipngwg-temp-addresses-v2-00.txt>:
1756 	 * check if generated address is not inappropriate
1757 	 *
1758 	 *  - Reserved subnet anycast (RFC 2526)
1759 	 *	11111101 11....11 1xxxxxxx
1760 	 *  - ISATAP (RFC4214) 6.1
1761 	 *	00-00-5E-FE-xx-xx-xx-xx
1762 	 *  - value 0
1763 	 *  - XXX: already assigned to an address on the device
1764 	 */
1765 	if (idev->rndid[0] == 0xfd &&
1766 	    (idev->rndid[1]&idev->rndid[2]&idev->rndid[3]&idev->rndid[4]&idev->rndid[5]&idev->rndid[6]) == 0xff &&
1767 	    (idev->rndid[7]&0x80))
1768 		goto regen;
1769 	if ((idev->rndid[0]|idev->rndid[1]) == 0) {
1770 		if (idev->rndid[2] == 0x5e && idev->rndid[3] == 0xfe)
1771 			goto regen;
1772 		if ((idev->rndid[2]|idev->rndid[3]|idev->rndid[4]|idev->rndid[5]|idev->rndid[6]|idev->rndid[7]) == 0x00)
1773 			goto regen;
1774 	}
1775 }
1776 
1777 static void ipv6_regen_rndid(unsigned long data)
1778 {
1779 	struct inet6_dev *idev = (struct inet6_dev *) data;
1780 	unsigned long expires;
1781 
1782 	rcu_read_lock_bh();
1783 	write_lock_bh(&idev->lock);
1784 
1785 	if (idev->dead)
1786 		goto out;
1787 
1788 	__ipv6_regen_rndid(idev);
1789 
1790 	expires = jiffies +
1791 		idev->cnf.temp_prefered_lft * HZ -
1792 		idev->cnf.regen_max_retry * idev->cnf.dad_transmits * idev->nd_parms->retrans_time -
1793 		idev->cnf.max_desync_factor * HZ;
1794 	if (time_before(expires, jiffies)) {
1795 		pr_warn("%s: too short regeneration interval; timer disabled for %s\n",
1796 			__func__, idev->dev->name);
1797 		goto out;
1798 	}
1799 
1800 	if (!mod_timer(&idev->regen_timer, expires))
1801 		in6_dev_hold(idev);
1802 
1803 out:
1804 	write_unlock_bh(&idev->lock);
1805 	rcu_read_unlock_bh();
1806 	in6_dev_put(idev);
1807 }
1808 
1809 static void  __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr)
1810 {
1811 	if (tmpaddr && memcmp(idev->rndid, &tmpaddr->s6_addr[8], 8) == 0)
1812 		__ipv6_regen_rndid(idev);
1813 }
1814 #endif
1815 
1816 /*
1817  *	Add prefix route.
1818  */
1819 
1820 static void
1821 addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
1822 		      unsigned long expires, u32 flags)
1823 {
1824 	struct fib6_config cfg = {
1825 		.fc_table = RT6_TABLE_PREFIX,
1826 		.fc_metric = IP6_RT_PRIO_ADDRCONF,
1827 		.fc_ifindex = dev->ifindex,
1828 		.fc_expires = expires,
1829 		.fc_dst_len = plen,
1830 		.fc_flags = RTF_UP | flags,
1831 		.fc_nlinfo.nl_net = dev_net(dev),
1832 		.fc_protocol = RTPROT_KERNEL,
1833 	};
1834 
1835 	cfg.fc_dst = *pfx;
1836 
1837 	/* Prevent useless cloning on PtP SIT.
1838 	   This thing is done here expecting that the whole
1839 	   class of non-broadcast devices need not cloning.
1840 	 */
1841 #if IS_ENABLED(CONFIG_IPV6_SIT)
1842 	if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
1843 		cfg.fc_flags |= RTF_NONEXTHOP;
1844 #endif
1845 
1846 	ip6_route_add(&cfg);
1847 }
1848 
1849 
1850 static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
1851 						  int plen,
1852 						  const struct net_device *dev,
1853 						  u32 flags, u32 noflags)
1854 {
1855 	struct fib6_node *fn;
1856 	struct rt6_info *rt = NULL;
1857 	struct fib6_table *table;
1858 
1859 	table = fib6_get_table(dev_net(dev), RT6_TABLE_PREFIX);
1860 	if (table == NULL)
1861 		return NULL;
1862 
1863 	read_lock_bh(&table->tb6_lock);
1864 	fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0);
1865 	if (!fn)
1866 		goto out;
1867 	for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
1868 		if (rt->dst.dev->ifindex != dev->ifindex)
1869 			continue;
1870 		if ((rt->rt6i_flags & flags) != flags)
1871 			continue;
1872 		if ((noflags != 0) && ((rt->rt6i_flags & flags) != 0))
1873 			continue;
1874 		dst_hold(&rt->dst);
1875 		break;
1876 	}
1877 out:
1878 	read_unlock_bh(&table->tb6_lock);
1879 	return rt;
1880 }
1881 
1882 
1883 /* Create "default" multicast route to the interface */
1884 
1885 static void addrconf_add_mroute(struct net_device *dev)
1886 {
1887 	struct fib6_config cfg = {
1888 		.fc_table = RT6_TABLE_LOCAL,
1889 		.fc_metric = IP6_RT_PRIO_ADDRCONF,
1890 		.fc_ifindex = dev->ifindex,
1891 		.fc_dst_len = 8,
1892 		.fc_flags = RTF_UP,
1893 		.fc_nlinfo.nl_net = dev_net(dev),
1894 	};
1895 
1896 	ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
1897 
1898 	ip6_route_add(&cfg);
1899 }
1900 
1901 #if IS_ENABLED(CONFIG_IPV6_SIT)
1902 static void sit_route_add(struct net_device *dev)
1903 {
1904 	struct fib6_config cfg = {
1905 		.fc_table = RT6_TABLE_MAIN,
1906 		.fc_metric = IP6_RT_PRIO_ADDRCONF,
1907 		.fc_ifindex = dev->ifindex,
1908 		.fc_dst_len = 96,
1909 		.fc_flags = RTF_UP | RTF_NONEXTHOP,
1910 		.fc_nlinfo.nl_net = dev_net(dev),
1911 	};
1912 
1913 	/* prefix length - 96 bits "::d.d.d.d" */
1914 	ip6_route_add(&cfg);
1915 }
1916 #endif
1917 
1918 static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
1919 {
1920 	struct inet6_dev *idev;
1921 
1922 	ASSERT_RTNL();
1923 
1924 	idev = ipv6_find_idev(dev);
1925 	if (!idev)
1926 		return ERR_PTR(-ENOBUFS);
1927 
1928 	if (idev->cnf.disable_ipv6)
1929 		return ERR_PTR(-EACCES);
1930 
1931 	/* Add default multicast route */
1932 	if (!(dev->flags & IFF_LOOPBACK))
1933 		addrconf_add_mroute(dev);
1934 
1935 	return idev;
1936 }
1937 
1938 void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
1939 {
1940 	struct prefix_info *pinfo;
1941 	__u32 valid_lft;
1942 	__u32 prefered_lft;
1943 	int addr_type;
1944 	struct inet6_dev *in6_dev;
1945 	struct net *net = dev_net(dev);
1946 
1947 	pinfo = (struct prefix_info *) opt;
1948 
1949 	if (len < sizeof(struct prefix_info)) {
1950 		ADBG(("addrconf: prefix option too short\n"));
1951 		return;
1952 	}
1953 
1954 	/*
1955 	 *	Validation checks ([ADDRCONF], page 19)
1956 	 */
1957 
1958 	addr_type = ipv6_addr_type(&pinfo->prefix);
1959 
1960 	if (addr_type & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL))
1961 		return;
1962 
1963 	valid_lft = ntohl(pinfo->valid);
1964 	prefered_lft = ntohl(pinfo->prefered);
1965 
1966 	if (prefered_lft > valid_lft) {
1967 		net_warn_ratelimited("addrconf: prefix option has invalid lifetime\n");
1968 		return;
1969 	}
1970 
1971 	in6_dev = in6_dev_get(dev);
1972 
1973 	if (in6_dev == NULL) {
1974 		net_dbg_ratelimited("addrconf: device %s not configured\n",
1975 				    dev->name);
1976 		return;
1977 	}
1978 
1979 	/*
1980 	 *	Two things going on here:
1981 	 *	1) Add routes for on-link prefixes
1982 	 *	2) Configure prefixes with the auto flag set
1983 	 */
1984 
1985 	if (pinfo->onlink) {
1986 		struct rt6_info *rt;
1987 		unsigned long rt_expires;
1988 
1989 		/* Avoid arithmetic overflow. Really, we could
1990 		 * save rt_expires in seconds, likely valid_lft,
1991 		 * but it would require division in fib gc, that it
1992 		 * not good.
1993 		 */
1994 		if (HZ > USER_HZ)
1995 			rt_expires = addrconf_timeout_fixup(valid_lft, HZ);
1996 		else
1997 			rt_expires = addrconf_timeout_fixup(valid_lft, USER_HZ);
1998 
1999 		if (addrconf_finite_timeout(rt_expires))
2000 			rt_expires *= HZ;
2001 
2002 		rt = addrconf_get_prefix_route(&pinfo->prefix,
2003 					       pinfo->prefix_len,
2004 					       dev,
2005 					       RTF_ADDRCONF | RTF_PREFIX_RT,
2006 					       RTF_GATEWAY | RTF_DEFAULT);
2007 
2008 		if (rt) {
2009 			/* Autoconf prefix route */
2010 			if (valid_lft == 0) {
2011 				ip6_del_rt(rt);
2012 				rt = NULL;
2013 			} else if (addrconf_finite_timeout(rt_expires)) {
2014 				/* not infinity */
2015 				rt6_set_expires(rt, jiffies + rt_expires);
2016 			} else {
2017 				rt6_clean_expires(rt);
2018 			}
2019 		} else if (valid_lft) {
2020 			clock_t expires = 0;
2021 			int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
2022 			if (addrconf_finite_timeout(rt_expires)) {
2023 				/* not infinity */
2024 				flags |= RTF_EXPIRES;
2025 				expires = jiffies_to_clock_t(rt_expires);
2026 			}
2027 			addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
2028 					      dev, expires, flags);
2029 		}
2030 		ip6_rt_put(rt);
2031 	}
2032 
2033 	/* Try to figure out our local address for this prefix */
2034 
2035 	if (pinfo->autoconf && in6_dev->cnf.autoconf) {
2036 		struct inet6_ifaddr *ifp;
2037 		struct in6_addr addr;
2038 		int create = 0, update_lft = 0;
2039 
2040 		if (pinfo->prefix_len == 64) {
2041 			memcpy(&addr, &pinfo->prefix, 8);
2042 			if (ipv6_generate_eui64(addr.s6_addr + 8, dev) &&
2043 			    ipv6_inherit_eui64(addr.s6_addr + 8, in6_dev)) {
2044 				in6_dev_put(in6_dev);
2045 				return;
2046 			}
2047 			goto ok;
2048 		}
2049 		net_dbg_ratelimited("IPv6 addrconf: prefix with wrong length %d\n",
2050 				    pinfo->prefix_len);
2051 		in6_dev_put(in6_dev);
2052 		return;
2053 
2054 ok:
2055 
2056 		ifp = ipv6_get_ifaddr(net, &addr, dev, 1);
2057 
2058 		if (ifp == NULL && valid_lft) {
2059 			int max_addresses = in6_dev->cnf.max_addresses;
2060 			u32 addr_flags = 0;
2061 
2062 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
2063 			if (in6_dev->cnf.optimistic_dad &&
2064 			    !net->ipv6.devconf_all->forwarding && sllao)
2065 				addr_flags = IFA_F_OPTIMISTIC;
2066 #endif
2067 
2068 			/* Do not allow to create too much of autoconfigured
2069 			 * addresses; this would be too easy way to crash kernel.
2070 			 */
2071 			if (!max_addresses ||
2072 			    ipv6_count_addresses(in6_dev) < max_addresses)
2073 				ifp = ipv6_add_addr(in6_dev, &addr, pinfo->prefix_len,
2074 						    addr_type&IPV6_ADDR_SCOPE_MASK,
2075 						    addr_flags);
2076 
2077 			if (!ifp || IS_ERR(ifp)) {
2078 				in6_dev_put(in6_dev);
2079 				return;
2080 			}
2081 
2082 			update_lft = create = 1;
2083 			ifp->cstamp = jiffies;
2084 			addrconf_dad_start(ifp);
2085 		}
2086 
2087 		if (ifp) {
2088 			int flags;
2089 			unsigned long now;
2090 #ifdef CONFIG_IPV6_PRIVACY
2091 			struct inet6_ifaddr *ift;
2092 #endif
2093 			u32 stored_lft;
2094 
2095 			/* update lifetime (RFC2462 5.5.3 e) */
2096 			spin_lock(&ifp->lock);
2097 			now = jiffies;
2098 			if (ifp->valid_lft > (now - ifp->tstamp) / HZ)
2099 				stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
2100 			else
2101 				stored_lft = 0;
2102 			if (!update_lft && stored_lft) {
2103 				if (valid_lft > MIN_VALID_LIFETIME ||
2104 				    valid_lft > stored_lft)
2105 					update_lft = 1;
2106 				else if (stored_lft <= MIN_VALID_LIFETIME) {
2107 					/* valid_lft <= stored_lft is always true */
2108 					/*
2109 					 * RFC 4862 Section 5.5.3e:
2110 					 * "Note that the preferred lifetime of
2111 					 *  the corresponding address is always
2112 					 *  reset to the Preferred Lifetime in
2113 					 *  the received Prefix Information
2114 					 *  option, regardless of whether the
2115 					 *  valid lifetime is also reset or
2116 					 *  ignored."
2117 					 *
2118 					 *  So if the preferred lifetime in
2119 					 *  this advertisement is different
2120 					 *  than what we have stored, but the
2121 					 *  valid lifetime is invalid, just
2122 					 *  reset prefered_lft.
2123 					 *
2124 					 *  We must set the valid lifetime
2125 					 *  to the stored lifetime since we'll
2126 					 *  be updating the timestamp below,
2127 					 *  else we'll set it back to the
2128 					 *  minimum.
2129 					 */
2130 					if (prefered_lft != ifp->prefered_lft) {
2131 						valid_lft = stored_lft;
2132 						update_lft = 1;
2133 					}
2134 				} else {
2135 					valid_lft = MIN_VALID_LIFETIME;
2136 					if (valid_lft < prefered_lft)
2137 						prefered_lft = valid_lft;
2138 					update_lft = 1;
2139 				}
2140 			}
2141 
2142 			if (update_lft) {
2143 				ifp->valid_lft = valid_lft;
2144 				ifp->prefered_lft = prefered_lft;
2145 				ifp->tstamp = now;
2146 				flags = ifp->flags;
2147 				ifp->flags &= ~IFA_F_DEPRECATED;
2148 				spin_unlock(&ifp->lock);
2149 
2150 				if (!(flags&IFA_F_TENTATIVE))
2151 					ipv6_ifa_notify(0, ifp);
2152 			} else
2153 				spin_unlock(&ifp->lock);
2154 
2155 #ifdef CONFIG_IPV6_PRIVACY
2156 			read_lock_bh(&in6_dev->lock);
2157 			/* update all temporary addresses in the list */
2158 			list_for_each_entry(ift, &in6_dev->tempaddr_list,
2159 					    tmp_list) {
2160 				int age, max_valid, max_prefered;
2161 
2162 				if (ifp != ift->ifpub)
2163 					continue;
2164 
2165 				/*
2166 				 * RFC 4941 section 3.3:
2167 				 * If a received option will extend the lifetime
2168 				 * of a public address, the lifetimes of
2169 				 * temporary addresses should be extended,
2170 				 * subject to the overall constraint that no
2171 				 * temporary addresses should ever remain
2172 				 * "valid" or "preferred" for a time longer than
2173 				 * (TEMP_VALID_LIFETIME) or
2174 				 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR),
2175 				 * respectively.
2176 				 */
2177 				age = (now - ift->cstamp) / HZ;
2178 				max_valid = in6_dev->cnf.temp_valid_lft - age;
2179 				if (max_valid < 0)
2180 					max_valid = 0;
2181 
2182 				max_prefered = in6_dev->cnf.temp_prefered_lft -
2183 					       in6_dev->cnf.max_desync_factor -
2184 					       age;
2185 				if (max_prefered < 0)
2186 					max_prefered = 0;
2187 
2188 				if (valid_lft > max_valid)
2189 					valid_lft = max_valid;
2190 
2191 				if (prefered_lft > max_prefered)
2192 					prefered_lft = max_prefered;
2193 
2194 				spin_lock(&ift->lock);
2195 				flags = ift->flags;
2196 				ift->valid_lft = valid_lft;
2197 				ift->prefered_lft = prefered_lft;
2198 				ift->tstamp = now;
2199 				if (prefered_lft > 0)
2200 					ift->flags &= ~IFA_F_DEPRECATED;
2201 
2202 				spin_unlock(&ift->lock);
2203 				if (!(flags&IFA_F_TENTATIVE))
2204 					ipv6_ifa_notify(0, ift);
2205 			}
2206 
2207 			if ((create || list_empty(&in6_dev->tempaddr_list)) && in6_dev->cnf.use_tempaddr > 0) {
2208 				/*
2209 				 * When a new public address is created as
2210 				 * described in [ADDRCONF], also create a new
2211 				 * temporary address. Also create a temporary
2212 				 * address if it's enabled but no temporary
2213 				 * address currently exists.
2214 				 */
2215 				read_unlock_bh(&in6_dev->lock);
2216 				ipv6_create_tempaddr(ifp, NULL);
2217 			} else {
2218 				read_unlock_bh(&in6_dev->lock);
2219 			}
2220 #endif
2221 			in6_ifa_put(ifp);
2222 			addrconf_verify(0);
2223 		}
2224 	}
2225 	inet6_prefix_notify(RTM_NEWPREFIX, in6_dev, pinfo);
2226 	in6_dev_put(in6_dev);
2227 }
2228 
2229 /*
2230  *	Set destination address.
2231  *	Special case for SIT interfaces where we create a new "virtual"
2232  *	device.
2233  */
2234 int addrconf_set_dstaddr(struct net *net, void __user *arg)
2235 {
2236 	struct in6_ifreq ireq;
2237 	struct net_device *dev;
2238 	int err = -EINVAL;
2239 
2240 	rtnl_lock();
2241 
2242 	err = -EFAULT;
2243 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2244 		goto err_exit;
2245 
2246 	dev = __dev_get_by_index(net, ireq.ifr6_ifindex);
2247 
2248 	err = -ENODEV;
2249 	if (dev == NULL)
2250 		goto err_exit;
2251 
2252 #if IS_ENABLED(CONFIG_IPV6_SIT)
2253 	if (dev->type == ARPHRD_SIT) {
2254 		const struct net_device_ops *ops = dev->netdev_ops;
2255 		struct ifreq ifr;
2256 		struct ip_tunnel_parm p;
2257 
2258 		err = -EADDRNOTAVAIL;
2259 		if (!(ipv6_addr_type(&ireq.ifr6_addr) & IPV6_ADDR_COMPATv4))
2260 			goto err_exit;
2261 
2262 		memset(&p, 0, sizeof(p));
2263 		p.iph.daddr = ireq.ifr6_addr.s6_addr32[3];
2264 		p.iph.saddr = 0;
2265 		p.iph.version = 4;
2266 		p.iph.ihl = 5;
2267 		p.iph.protocol = IPPROTO_IPV6;
2268 		p.iph.ttl = 64;
2269 		ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
2270 
2271 		if (ops->ndo_do_ioctl) {
2272 			mm_segment_t oldfs = get_fs();
2273 
2274 			set_fs(KERNEL_DS);
2275 			err = ops->ndo_do_ioctl(dev, &ifr, SIOCADDTUNNEL);
2276 			set_fs(oldfs);
2277 		} else
2278 			err = -EOPNOTSUPP;
2279 
2280 		if (err == 0) {
2281 			err = -ENOBUFS;
2282 			dev = __dev_get_by_name(net, p.name);
2283 			if (!dev)
2284 				goto err_exit;
2285 			err = dev_open(dev);
2286 		}
2287 	}
2288 #endif
2289 
2290 err_exit:
2291 	rtnl_unlock();
2292 	return err;
2293 }
2294 
2295 /*
2296  *	Manual configuration of address on an interface
2297  */
2298 static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *pfx,
2299 			  unsigned int plen, __u8 ifa_flags, __u32 prefered_lft,
2300 			  __u32 valid_lft)
2301 {
2302 	struct inet6_ifaddr *ifp;
2303 	struct inet6_dev *idev;
2304 	struct net_device *dev;
2305 	int scope;
2306 	u32 flags;
2307 	clock_t expires;
2308 	unsigned long timeout;
2309 
2310 	ASSERT_RTNL();
2311 
2312 	if (plen > 128)
2313 		return -EINVAL;
2314 
2315 	/* check the lifetime */
2316 	if (!valid_lft || prefered_lft > valid_lft)
2317 		return -EINVAL;
2318 
2319 	dev = __dev_get_by_index(net, ifindex);
2320 	if (!dev)
2321 		return -ENODEV;
2322 
2323 	idev = addrconf_add_dev(dev);
2324 	if (IS_ERR(idev))
2325 		return PTR_ERR(idev);
2326 
2327 	scope = ipv6_addr_scope(pfx);
2328 
2329 	timeout = addrconf_timeout_fixup(valid_lft, HZ);
2330 	if (addrconf_finite_timeout(timeout)) {
2331 		expires = jiffies_to_clock_t(timeout * HZ);
2332 		valid_lft = timeout;
2333 		flags = RTF_EXPIRES;
2334 	} else {
2335 		expires = 0;
2336 		flags = 0;
2337 		ifa_flags |= IFA_F_PERMANENT;
2338 	}
2339 
2340 	timeout = addrconf_timeout_fixup(prefered_lft, HZ);
2341 	if (addrconf_finite_timeout(timeout)) {
2342 		if (timeout == 0)
2343 			ifa_flags |= IFA_F_DEPRECATED;
2344 		prefered_lft = timeout;
2345 	}
2346 
2347 	ifp = ipv6_add_addr(idev, pfx, plen, scope, ifa_flags);
2348 
2349 	if (!IS_ERR(ifp)) {
2350 		spin_lock_bh(&ifp->lock);
2351 		ifp->valid_lft = valid_lft;
2352 		ifp->prefered_lft = prefered_lft;
2353 		ifp->tstamp = jiffies;
2354 		spin_unlock_bh(&ifp->lock);
2355 
2356 		addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
2357 				      expires, flags);
2358 		/*
2359 		 * Note that section 3.1 of RFC 4429 indicates
2360 		 * that the Optimistic flag should not be set for
2361 		 * manually configured addresses
2362 		 */
2363 		addrconf_dad_start(ifp);
2364 		in6_ifa_put(ifp);
2365 		addrconf_verify(0);
2366 		return 0;
2367 	}
2368 
2369 	return PTR_ERR(ifp);
2370 }
2371 
2372 static int inet6_addr_del(struct net *net, int ifindex, const struct in6_addr *pfx,
2373 			  unsigned int plen)
2374 {
2375 	struct inet6_ifaddr *ifp;
2376 	struct inet6_dev *idev;
2377 	struct net_device *dev;
2378 
2379 	if (plen > 128)
2380 		return -EINVAL;
2381 
2382 	dev = __dev_get_by_index(net, ifindex);
2383 	if (!dev)
2384 		return -ENODEV;
2385 
2386 	if ((idev = __in6_dev_get(dev)) == NULL)
2387 		return -ENXIO;
2388 
2389 	read_lock_bh(&idev->lock);
2390 	list_for_each_entry(ifp, &idev->addr_list, if_list) {
2391 		if (ifp->prefix_len == plen &&
2392 		    ipv6_addr_equal(pfx, &ifp->addr)) {
2393 			in6_ifa_hold(ifp);
2394 			read_unlock_bh(&idev->lock);
2395 
2396 			ipv6_del_addr(ifp);
2397 
2398 			/* If the last address is deleted administratively,
2399 			   disable IPv6 on this interface.
2400 			 */
2401 			if (list_empty(&idev->addr_list))
2402 				addrconf_ifdown(idev->dev, 1);
2403 			return 0;
2404 		}
2405 	}
2406 	read_unlock_bh(&idev->lock);
2407 	return -EADDRNOTAVAIL;
2408 }
2409 
2410 
2411 int addrconf_add_ifaddr(struct net *net, void __user *arg)
2412 {
2413 	struct in6_ifreq ireq;
2414 	int err;
2415 
2416 	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2417 		return -EPERM;
2418 
2419 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2420 		return -EFAULT;
2421 
2422 	rtnl_lock();
2423 	err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr,
2424 			     ireq.ifr6_prefixlen, IFA_F_PERMANENT,
2425 			     INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
2426 	rtnl_unlock();
2427 	return err;
2428 }
2429 
2430 int addrconf_del_ifaddr(struct net *net, void __user *arg)
2431 {
2432 	struct in6_ifreq ireq;
2433 	int err;
2434 
2435 	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2436 		return -EPERM;
2437 
2438 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2439 		return -EFAULT;
2440 
2441 	rtnl_lock();
2442 	err = inet6_addr_del(net, ireq.ifr6_ifindex, &ireq.ifr6_addr,
2443 			     ireq.ifr6_prefixlen);
2444 	rtnl_unlock();
2445 	return err;
2446 }
2447 
2448 static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
2449 		     int plen, int scope)
2450 {
2451 	struct inet6_ifaddr *ifp;
2452 
2453 	ifp = ipv6_add_addr(idev, addr, plen, scope, IFA_F_PERMANENT);
2454 	if (!IS_ERR(ifp)) {
2455 		spin_lock_bh(&ifp->lock);
2456 		ifp->flags &= ~IFA_F_TENTATIVE;
2457 		spin_unlock_bh(&ifp->lock);
2458 		ipv6_ifa_notify(RTM_NEWADDR, ifp);
2459 		in6_ifa_put(ifp);
2460 	}
2461 }
2462 
2463 #if IS_ENABLED(CONFIG_IPV6_SIT)
2464 static void sit_add_v4_addrs(struct inet6_dev *idev)
2465 {
2466 	struct in6_addr addr;
2467 	struct net_device *dev;
2468 	struct net *net = dev_net(idev->dev);
2469 	int scope;
2470 
2471 	ASSERT_RTNL();
2472 
2473 	memset(&addr, 0, sizeof(struct in6_addr));
2474 	memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4);
2475 
2476 	if (idev->dev->flags&IFF_POINTOPOINT) {
2477 		addr.s6_addr32[0] = htonl(0xfe800000);
2478 		scope = IFA_LINK;
2479 	} else {
2480 		scope = IPV6_ADDR_COMPATv4;
2481 	}
2482 
2483 	if (addr.s6_addr32[3]) {
2484 		add_addr(idev, &addr, 128, scope);
2485 		return;
2486 	}
2487 
2488 	for_each_netdev(net, dev) {
2489 		struct in_device *in_dev = __in_dev_get_rtnl(dev);
2490 		if (in_dev && (dev->flags & IFF_UP)) {
2491 			struct in_ifaddr *ifa;
2492 
2493 			int flag = scope;
2494 
2495 			for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
2496 				int plen;
2497 
2498 				addr.s6_addr32[3] = ifa->ifa_local;
2499 
2500 				if (ifa->ifa_scope == RT_SCOPE_LINK)
2501 					continue;
2502 				if (ifa->ifa_scope >= RT_SCOPE_HOST) {
2503 					if (idev->dev->flags&IFF_POINTOPOINT)
2504 						continue;
2505 					flag |= IFA_HOST;
2506 				}
2507 				if (idev->dev->flags&IFF_POINTOPOINT)
2508 					plen = 64;
2509 				else
2510 					plen = 96;
2511 
2512 				add_addr(idev, &addr, plen, flag);
2513 			}
2514 		}
2515 	}
2516 }
2517 #endif
2518 
2519 static void init_loopback(struct net_device *dev)
2520 {
2521 	struct inet6_dev  *idev;
2522 
2523 	/* ::1 */
2524 
2525 	ASSERT_RTNL();
2526 
2527 	if ((idev = ipv6_find_idev(dev)) == NULL) {
2528 		pr_debug("%s: add_dev failed\n", __func__);
2529 		return;
2530 	}
2531 
2532 	add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
2533 }
2534 
2535 static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr *addr)
2536 {
2537 	struct inet6_ifaddr *ifp;
2538 	u32 addr_flags = IFA_F_PERMANENT;
2539 
2540 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
2541 	if (idev->cnf.optimistic_dad &&
2542 	    !dev_net(idev->dev)->ipv6.devconf_all->forwarding)
2543 		addr_flags |= IFA_F_OPTIMISTIC;
2544 #endif
2545 
2546 
2547 	ifp = ipv6_add_addr(idev, addr, 64, IFA_LINK, addr_flags);
2548 	if (!IS_ERR(ifp)) {
2549 		addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
2550 		addrconf_dad_start(ifp);
2551 		in6_ifa_put(ifp);
2552 	}
2553 }
2554 
2555 static void addrconf_dev_config(struct net_device *dev)
2556 {
2557 	struct in6_addr addr;
2558 	struct inet6_dev *idev;
2559 
2560 	ASSERT_RTNL();
2561 
2562 	if ((dev->type != ARPHRD_ETHER) &&
2563 	    (dev->type != ARPHRD_FDDI) &&
2564 	    (dev->type != ARPHRD_ARCNET) &&
2565 	    (dev->type != ARPHRD_INFINIBAND) &&
2566 	    (dev->type != ARPHRD_IEEE802154)) {
2567 		/* Alas, we support only Ethernet autoconfiguration. */
2568 		return;
2569 	}
2570 
2571 	idev = addrconf_add_dev(dev);
2572 	if (IS_ERR(idev))
2573 		return;
2574 
2575 	memset(&addr, 0, sizeof(struct in6_addr));
2576 	addr.s6_addr32[0] = htonl(0xFE800000);
2577 
2578 	if (ipv6_generate_eui64(addr.s6_addr + 8, dev) == 0)
2579 		addrconf_add_linklocal(idev, &addr);
2580 }
2581 
2582 #if IS_ENABLED(CONFIG_IPV6_SIT)
2583 static void addrconf_sit_config(struct net_device *dev)
2584 {
2585 	struct inet6_dev *idev;
2586 
2587 	ASSERT_RTNL();
2588 
2589 	/*
2590 	 * Configure the tunnel with one of our IPv4
2591 	 * addresses... we should configure all of
2592 	 * our v4 addrs in the tunnel
2593 	 */
2594 
2595 	if ((idev = ipv6_find_idev(dev)) == NULL) {
2596 		pr_debug("%s: add_dev failed\n", __func__);
2597 		return;
2598 	}
2599 
2600 	if (dev->priv_flags & IFF_ISATAP) {
2601 		struct in6_addr addr;
2602 
2603 		ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
2604 		addrconf_prefix_route(&addr, 64, dev, 0, 0);
2605 		if (!ipv6_generate_eui64(addr.s6_addr + 8, dev))
2606 			addrconf_add_linklocal(idev, &addr);
2607 		return;
2608 	}
2609 
2610 	sit_add_v4_addrs(idev);
2611 
2612 	if (dev->flags&IFF_POINTOPOINT)
2613 		addrconf_add_mroute(dev);
2614 	else
2615 		sit_route_add(dev);
2616 }
2617 #endif
2618 
2619 #if IS_ENABLED(CONFIG_NET_IPGRE)
2620 static void addrconf_gre_config(struct net_device *dev)
2621 {
2622 	struct inet6_dev *idev;
2623 	struct in6_addr addr;
2624 
2625 	pr_info("%s(%s)\n", __func__, dev->name);
2626 
2627 	ASSERT_RTNL();
2628 
2629 	if ((idev = ipv6_find_idev(dev)) == NULL) {
2630 		pr_debug("%s: add_dev failed\n", __func__);
2631 		return;
2632 	}
2633 
2634 	ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
2635 	addrconf_prefix_route(&addr, 64, dev, 0, 0);
2636 
2637 	if (!ipv6_generate_eui64(addr.s6_addr + 8, dev))
2638 		addrconf_add_linklocal(idev, &addr);
2639 }
2640 #endif
2641 
2642 static inline int
2643 ipv6_inherit_linklocal(struct inet6_dev *idev, struct net_device *link_dev)
2644 {
2645 	struct in6_addr lladdr;
2646 
2647 	if (!ipv6_get_lladdr(link_dev, &lladdr, IFA_F_TENTATIVE)) {
2648 		addrconf_add_linklocal(idev, &lladdr);
2649 		return 0;
2650 	}
2651 	return -1;
2652 }
2653 
2654 static void ip6_tnl_add_linklocal(struct inet6_dev *idev)
2655 {
2656 	struct net_device *link_dev;
2657 	struct net *net = dev_net(idev->dev);
2658 
2659 	/* first try to inherit the link-local address from the link device */
2660 	if (idev->dev->iflink &&
2661 	    (link_dev = __dev_get_by_index(net, idev->dev->iflink))) {
2662 		if (!ipv6_inherit_linklocal(idev, link_dev))
2663 			return;
2664 	}
2665 	/* then try to inherit it from any device */
2666 	for_each_netdev(net, link_dev) {
2667 		if (!ipv6_inherit_linklocal(idev, link_dev))
2668 			return;
2669 	}
2670 	pr_debug("init ip6-ip6: add_linklocal failed\n");
2671 }
2672 
2673 /*
2674  * Autoconfigure tunnel with a link-local address so routing protocols,
2675  * DHCPv6, MLD etc. can be run over the virtual link
2676  */
2677 
2678 static void addrconf_ip6_tnl_config(struct net_device *dev)
2679 {
2680 	struct inet6_dev *idev;
2681 
2682 	ASSERT_RTNL();
2683 
2684 	idev = addrconf_add_dev(dev);
2685 	if (IS_ERR(idev)) {
2686 		pr_debug("init ip6-ip6: add_dev failed\n");
2687 		return;
2688 	}
2689 	ip6_tnl_add_linklocal(idev);
2690 }
2691 
2692 static int addrconf_notify(struct notifier_block *this, unsigned long event,
2693 			   void *data)
2694 {
2695 	struct net_device *dev = (struct net_device *) data;
2696 	struct inet6_dev *idev = __in6_dev_get(dev);
2697 	int run_pending = 0;
2698 	int err;
2699 
2700 	switch (event) {
2701 	case NETDEV_REGISTER:
2702 		if (!idev && dev->mtu >= IPV6_MIN_MTU) {
2703 			idev = ipv6_add_dev(dev);
2704 			if (!idev)
2705 				return notifier_from_errno(-ENOMEM);
2706 		}
2707 		break;
2708 
2709 	case NETDEV_UP:
2710 	case NETDEV_CHANGE:
2711 		if (dev->flags & IFF_SLAVE)
2712 			break;
2713 
2714 		if (event == NETDEV_UP) {
2715 			if (!addrconf_qdisc_ok(dev)) {
2716 				/* device is not ready yet. */
2717 				pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
2718 					dev->name);
2719 				break;
2720 			}
2721 
2722 			if (!idev && dev->mtu >= IPV6_MIN_MTU)
2723 				idev = ipv6_add_dev(dev);
2724 
2725 			if (idev) {
2726 				idev->if_flags |= IF_READY;
2727 				run_pending = 1;
2728 			}
2729 		} else {
2730 			if (!addrconf_qdisc_ok(dev)) {
2731 				/* device is still not ready. */
2732 				break;
2733 			}
2734 
2735 			if (idev) {
2736 				if (idev->if_flags & IF_READY)
2737 					/* device is already configured. */
2738 					break;
2739 				idev->if_flags |= IF_READY;
2740 			}
2741 
2742 			pr_info("ADDRCONF(NETDEV_CHANGE): %s: link becomes ready\n",
2743 				dev->name);
2744 
2745 			run_pending = 1;
2746 		}
2747 
2748 		switch (dev->type) {
2749 #if IS_ENABLED(CONFIG_IPV6_SIT)
2750 		case ARPHRD_SIT:
2751 			addrconf_sit_config(dev);
2752 			break;
2753 #endif
2754 #if IS_ENABLED(CONFIG_NET_IPGRE)
2755 		case ARPHRD_IPGRE:
2756 			addrconf_gre_config(dev);
2757 			break;
2758 #endif
2759 		case ARPHRD_TUNNEL6:
2760 			addrconf_ip6_tnl_config(dev);
2761 			break;
2762 		case ARPHRD_LOOPBACK:
2763 			init_loopback(dev);
2764 			break;
2765 
2766 		default:
2767 			addrconf_dev_config(dev);
2768 			break;
2769 		}
2770 
2771 		if (idev) {
2772 			if (run_pending)
2773 				addrconf_dad_run(idev);
2774 
2775 			/*
2776 			 * If the MTU changed during the interface down,
2777 			 * when the interface up, the changed MTU must be
2778 			 * reflected in the idev as well as routers.
2779 			 */
2780 			if (idev->cnf.mtu6 != dev->mtu &&
2781 			    dev->mtu >= IPV6_MIN_MTU) {
2782 				rt6_mtu_change(dev, dev->mtu);
2783 				idev->cnf.mtu6 = dev->mtu;
2784 			}
2785 			idev->tstamp = jiffies;
2786 			inet6_ifinfo_notify(RTM_NEWLINK, idev);
2787 
2788 			/*
2789 			 * If the changed mtu during down is lower than
2790 			 * IPV6_MIN_MTU stop IPv6 on this interface.
2791 			 */
2792 			if (dev->mtu < IPV6_MIN_MTU)
2793 				addrconf_ifdown(dev, 1);
2794 		}
2795 		break;
2796 
2797 	case NETDEV_CHANGEMTU:
2798 		if (idev && dev->mtu >= IPV6_MIN_MTU) {
2799 			rt6_mtu_change(dev, dev->mtu);
2800 			idev->cnf.mtu6 = dev->mtu;
2801 			break;
2802 		}
2803 
2804 		if (!idev && dev->mtu >= IPV6_MIN_MTU) {
2805 			idev = ipv6_add_dev(dev);
2806 			if (idev)
2807 				break;
2808 		}
2809 
2810 		/*
2811 		 * MTU falled under IPV6_MIN_MTU.
2812 		 * Stop IPv6 on this interface.
2813 		 */
2814 
2815 	case NETDEV_DOWN:
2816 	case NETDEV_UNREGISTER:
2817 		/*
2818 		 *	Remove all addresses from this interface.
2819 		 */
2820 		addrconf_ifdown(dev, event != NETDEV_DOWN);
2821 		break;
2822 
2823 	case NETDEV_CHANGENAME:
2824 		if (idev) {
2825 			snmp6_unregister_dev(idev);
2826 			addrconf_sysctl_unregister(idev);
2827 			addrconf_sysctl_register(idev);
2828 			err = snmp6_register_dev(idev);
2829 			if (err)
2830 				return notifier_from_errno(err);
2831 		}
2832 		break;
2833 
2834 	case NETDEV_PRE_TYPE_CHANGE:
2835 	case NETDEV_POST_TYPE_CHANGE:
2836 		addrconf_type_change(dev, event);
2837 		break;
2838 	}
2839 
2840 	return NOTIFY_OK;
2841 }
2842 
2843 /*
2844  *	addrconf module should be notified of a device going up
2845  */
2846 static struct notifier_block ipv6_dev_notf = {
2847 	.notifier_call = addrconf_notify,
2848 };
2849 
2850 static void addrconf_type_change(struct net_device *dev, unsigned long event)
2851 {
2852 	struct inet6_dev *idev;
2853 	ASSERT_RTNL();
2854 
2855 	idev = __in6_dev_get(dev);
2856 
2857 	if (event == NETDEV_POST_TYPE_CHANGE)
2858 		ipv6_mc_remap(idev);
2859 	else if (event == NETDEV_PRE_TYPE_CHANGE)
2860 		ipv6_mc_unmap(idev);
2861 }
2862 
2863 static int addrconf_ifdown(struct net_device *dev, int how)
2864 {
2865 	struct net *net = dev_net(dev);
2866 	struct inet6_dev *idev;
2867 	struct inet6_ifaddr *ifa;
2868 	int state, i;
2869 
2870 	ASSERT_RTNL();
2871 
2872 	rt6_ifdown(net, dev);
2873 	neigh_ifdown(&nd_tbl, dev);
2874 
2875 	idev = __in6_dev_get(dev);
2876 	if (idev == NULL)
2877 		return -ENODEV;
2878 
2879 	/*
2880 	 * Step 1: remove reference to ipv6 device from parent device.
2881 	 *	   Do not dev_put!
2882 	 */
2883 	if (how) {
2884 		idev->dead = 1;
2885 
2886 		/* protected by rtnl_lock */
2887 		RCU_INIT_POINTER(dev->ip6_ptr, NULL);
2888 
2889 		/* Step 1.5: remove snmp6 entry */
2890 		snmp6_unregister_dev(idev);
2891 
2892 	}
2893 
2894 	/* Step 2: clear hash table */
2895 	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
2896 		struct hlist_head *h = &inet6_addr_lst[i];
2897 		struct hlist_node *n;
2898 
2899 		spin_lock_bh(&addrconf_hash_lock);
2900 	restart:
2901 		hlist_for_each_entry_rcu(ifa, n, h, addr_lst) {
2902 			if (ifa->idev == idev) {
2903 				hlist_del_init_rcu(&ifa->addr_lst);
2904 				addrconf_del_timer(ifa);
2905 				goto restart;
2906 			}
2907 		}
2908 		spin_unlock_bh(&addrconf_hash_lock);
2909 	}
2910 
2911 	write_lock_bh(&idev->lock);
2912 
2913 	/* Step 2: clear flags for stateless addrconf */
2914 	if (!how)
2915 		idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
2916 
2917 #ifdef CONFIG_IPV6_PRIVACY
2918 	if (how && del_timer(&idev->regen_timer))
2919 		in6_dev_put(idev);
2920 
2921 	/* Step 3: clear tempaddr list */
2922 	while (!list_empty(&idev->tempaddr_list)) {
2923 		ifa = list_first_entry(&idev->tempaddr_list,
2924 				       struct inet6_ifaddr, tmp_list);
2925 		list_del(&ifa->tmp_list);
2926 		write_unlock_bh(&idev->lock);
2927 		spin_lock_bh(&ifa->lock);
2928 
2929 		if (ifa->ifpub) {
2930 			in6_ifa_put(ifa->ifpub);
2931 			ifa->ifpub = NULL;
2932 		}
2933 		spin_unlock_bh(&ifa->lock);
2934 		in6_ifa_put(ifa);
2935 		write_lock_bh(&idev->lock);
2936 	}
2937 #endif
2938 
2939 	while (!list_empty(&idev->addr_list)) {
2940 		ifa = list_first_entry(&idev->addr_list,
2941 				       struct inet6_ifaddr, if_list);
2942 		addrconf_del_timer(ifa);
2943 
2944 		list_del(&ifa->if_list);
2945 
2946 		write_unlock_bh(&idev->lock);
2947 
2948 		spin_lock_bh(&ifa->state_lock);
2949 		state = ifa->state;
2950 		ifa->state = INET6_IFADDR_STATE_DEAD;
2951 		spin_unlock_bh(&ifa->state_lock);
2952 
2953 		if (state != INET6_IFADDR_STATE_DEAD) {
2954 			__ipv6_ifa_notify(RTM_DELADDR, ifa);
2955 			atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
2956 		}
2957 		in6_ifa_put(ifa);
2958 
2959 		write_lock_bh(&idev->lock);
2960 	}
2961 
2962 	write_unlock_bh(&idev->lock);
2963 
2964 	/* Step 5: Discard multicast list */
2965 	if (how)
2966 		ipv6_mc_destroy_dev(idev);
2967 	else
2968 		ipv6_mc_down(idev);
2969 
2970 	idev->tstamp = jiffies;
2971 
2972 	/* Last: Shot the device (if unregistered) */
2973 	if (how) {
2974 		addrconf_sysctl_unregister(idev);
2975 		neigh_parms_release(&nd_tbl, idev->nd_parms);
2976 		neigh_ifdown(&nd_tbl, dev);
2977 		in6_dev_put(idev);
2978 	}
2979 	return 0;
2980 }
2981 
2982 static void addrconf_rs_timer(unsigned long data)
2983 {
2984 	struct inet6_ifaddr *ifp = (struct inet6_ifaddr *) data;
2985 	struct inet6_dev *idev = ifp->idev;
2986 
2987 	read_lock(&idev->lock);
2988 	if (idev->dead || !(idev->if_flags & IF_READY))
2989 		goto out;
2990 
2991 	if (idev->cnf.forwarding)
2992 		goto out;
2993 
2994 	/* Announcement received after solicitation was sent */
2995 	if (idev->if_flags & IF_RA_RCVD)
2996 		goto out;
2997 
2998 	spin_lock(&ifp->lock);
2999 	if (ifp->probes++ < idev->cnf.rtr_solicits) {
3000 		/* The wait after the last probe can be shorter */
3001 		addrconf_mod_timer(ifp, AC_RS,
3002 				   (ifp->probes == idev->cnf.rtr_solicits) ?
3003 				   idev->cnf.rtr_solicit_delay :
3004 				   idev->cnf.rtr_solicit_interval);
3005 		spin_unlock(&ifp->lock);
3006 
3007 		ndisc_send_rs(idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
3008 	} else {
3009 		spin_unlock(&ifp->lock);
3010 		/*
3011 		 * Note: we do not support deprecated "all on-link"
3012 		 * assumption any longer.
3013 		 */
3014 		pr_debug("%s: no IPv6 routers present\n", idev->dev->name);
3015 	}
3016 
3017 out:
3018 	read_unlock(&idev->lock);
3019 	in6_ifa_put(ifp);
3020 }
3021 
3022 /*
3023  *	Duplicate Address Detection
3024  */
3025 static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
3026 {
3027 	unsigned long rand_num;
3028 	struct inet6_dev *idev = ifp->idev;
3029 
3030 	if (ifp->flags & IFA_F_OPTIMISTIC)
3031 		rand_num = 0;
3032 	else
3033 		rand_num = net_random() % (idev->cnf.rtr_solicit_delay ? : 1);
3034 
3035 	ifp->probes = idev->cnf.dad_transmits;
3036 	addrconf_mod_timer(ifp, AC_DAD, rand_num);
3037 }
3038 
3039 static void addrconf_dad_start(struct inet6_ifaddr *ifp)
3040 {
3041 	struct inet6_dev *idev = ifp->idev;
3042 	struct net_device *dev = idev->dev;
3043 
3044 	addrconf_join_solict(dev, &ifp->addr);
3045 
3046 	net_srandom(ifp->addr.s6_addr32[3]);
3047 
3048 	read_lock_bh(&idev->lock);
3049 	spin_lock(&ifp->lock);
3050 	if (ifp->state == INET6_IFADDR_STATE_DEAD)
3051 		goto out;
3052 
3053 	if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
3054 	    idev->cnf.accept_dad < 1 ||
3055 	    !(ifp->flags&IFA_F_TENTATIVE) ||
3056 	    ifp->flags & IFA_F_NODAD) {
3057 		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
3058 		spin_unlock(&ifp->lock);
3059 		read_unlock_bh(&idev->lock);
3060 
3061 		addrconf_dad_completed(ifp);
3062 		return;
3063 	}
3064 
3065 	if (!(idev->if_flags & IF_READY)) {
3066 		spin_unlock(&ifp->lock);
3067 		read_unlock_bh(&idev->lock);
3068 		/*
3069 		 * If the device is not ready:
3070 		 * - keep it tentative if it is a permanent address.
3071 		 * - otherwise, kill it.
3072 		 */
3073 		in6_ifa_hold(ifp);
3074 		addrconf_dad_stop(ifp, 0);
3075 		return;
3076 	}
3077 
3078 	/*
3079 	 * Optimistic nodes can start receiving
3080 	 * Frames right away
3081 	 */
3082 	if (ifp->flags & IFA_F_OPTIMISTIC)
3083 		ip6_ins_rt(ifp->rt);
3084 
3085 	addrconf_dad_kick(ifp);
3086 out:
3087 	spin_unlock(&ifp->lock);
3088 	read_unlock_bh(&idev->lock);
3089 }
3090 
3091 static void addrconf_dad_timer(unsigned long data)
3092 {
3093 	struct inet6_ifaddr *ifp = (struct inet6_ifaddr *) data;
3094 	struct inet6_dev *idev = ifp->idev;
3095 	struct in6_addr mcaddr;
3096 
3097 	if (!ifp->probes && addrconf_dad_end(ifp))
3098 		goto out;
3099 
3100 	read_lock(&idev->lock);
3101 	if (idev->dead || !(idev->if_flags & IF_READY)) {
3102 		read_unlock(&idev->lock);
3103 		goto out;
3104 	}
3105 
3106 	spin_lock(&ifp->lock);
3107 	if (ifp->state == INET6_IFADDR_STATE_DEAD) {
3108 		spin_unlock(&ifp->lock);
3109 		read_unlock(&idev->lock);
3110 		goto out;
3111 	}
3112 
3113 	if (ifp->probes == 0) {
3114 		/*
3115 		 * DAD was successful
3116 		 */
3117 
3118 		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
3119 		spin_unlock(&ifp->lock);
3120 		read_unlock(&idev->lock);
3121 
3122 		addrconf_dad_completed(ifp);
3123 
3124 		goto out;
3125 	}
3126 
3127 	ifp->probes--;
3128 	addrconf_mod_timer(ifp, AC_DAD, ifp->idev->nd_parms->retrans_time);
3129 	spin_unlock(&ifp->lock);
3130 	read_unlock(&idev->lock);
3131 
3132 	/* send a neighbour solicitation for our addr */
3133 	addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
3134 	ndisc_send_ns(ifp->idev->dev, NULL, &ifp->addr, &mcaddr, &in6addr_any);
3135 out:
3136 	in6_ifa_put(ifp);
3137 }
3138 
3139 static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
3140 {
3141 	struct net_device *dev = ifp->idev->dev;
3142 
3143 	/*
3144 	 *	Configure the address for reception. Now it is valid.
3145 	 */
3146 
3147 	ipv6_ifa_notify(RTM_NEWADDR, ifp);
3148 
3149 	/* If added prefix is link local and we are prepared to process
3150 	   router advertisements, start sending router solicitations.
3151 	 */
3152 
3153 	if (((ifp->idev->cnf.accept_ra == 1 && !ifp->idev->cnf.forwarding) ||
3154 	     ifp->idev->cnf.accept_ra == 2) &&
3155 	    ifp->idev->cnf.rtr_solicits > 0 &&
3156 	    (dev->flags&IFF_LOOPBACK) == 0 &&
3157 	    (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) {
3158 		/*
3159 		 *	If a host as already performed a random delay
3160 		 *	[...] as part of DAD [...] there is no need
3161 		 *	to delay again before sending the first RS
3162 		 */
3163 		ndisc_send_rs(ifp->idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
3164 
3165 		spin_lock_bh(&ifp->lock);
3166 		ifp->probes = 1;
3167 		ifp->idev->if_flags |= IF_RS_SENT;
3168 		addrconf_mod_timer(ifp, AC_RS, ifp->idev->cnf.rtr_solicit_interval);
3169 		spin_unlock_bh(&ifp->lock);
3170 	}
3171 }
3172 
3173 static void addrconf_dad_run(struct inet6_dev *idev)
3174 {
3175 	struct inet6_ifaddr *ifp;
3176 
3177 	read_lock_bh(&idev->lock);
3178 	list_for_each_entry(ifp, &idev->addr_list, if_list) {
3179 		spin_lock(&ifp->lock);
3180 		if (ifp->flags & IFA_F_TENTATIVE &&
3181 		    ifp->state == INET6_IFADDR_STATE_DAD)
3182 			addrconf_dad_kick(ifp);
3183 		spin_unlock(&ifp->lock);
3184 	}
3185 	read_unlock_bh(&idev->lock);
3186 }
3187 
3188 #ifdef CONFIG_PROC_FS
3189 struct if6_iter_state {
3190 	struct seq_net_private p;
3191 	int bucket;
3192 	int offset;
3193 };
3194 
3195 static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
3196 {
3197 	struct inet6_ifaddr *ifa = NULL;
3198 	struct if6_iter_state *state = seq->private;
3199 	struct net *net = seq_file_net(seq);
3200 	int p = 0;
3201 
3202 	/* initial bucket if pos is 0 */
3203 	if (pos == 0) {
3204 		state->bucket = 0;
3205 		state->offset = 0;
3206 	}
3207 
3208 	for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
3209 		struct hlist_node *n;
3210 		hlist_for_each_entry_rcu_bh(ifa, n, &inet6_addr_lst[state->bucket],
3211 					 addr_lst) {
3212 			if (!net_eq(dev_net(ifa->idev->dev), net))
3213 				continue;
3214 			/* sync with offset */
3215 			if (p < state->offset) {
3216 				p++;
3217 				continue;
3218 			}
3219 			state->offset++;
3220 			return ifa;
3221 		}
3222 
3223 		/* prepare for next bucket */
3224 		state->offset = 0;
3225 		p = 0;
3226 	}
3227 	return NULL;
3228 }
3229 
3230 static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
3231 					 struct inet6_ifaddr *ifa)
3232 {
3233 	struct if6_iter_state *state = seq->private;
3234 	struct net *net = seq_file_net(seq);
3235 	struct hlist_node *n = &ifa->addr_lst;
3236 
3237 	hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst) {
3238 		if (!net_eq(dev_net(ifa->idev->dev), net))
3239 			continue;
3240 		state->offset++;
3241 		return ifa;
3242 	}
3243 
3244 	while (++state->bucket < IN6_ADDR_HSIZE) {
3245 		state->offset = 0;
3246 		hlist_for_each_entry_rcu_bh(ifa, n,
3247 				     &inet6_addr_lst[state->bucket], addr_lst) {
3248 			if (!net_eq(dev_net(ifa->idev->dev), net))
3249 				continue;
3250 			state->offset++;
3251 			return ifa;
3252 		}
3253 	}
3254 
3255 	return NULL;
3256 }
3257 
3258 static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
3259 	__acquires(rcu_bh)
3260 {
3261 	rcu_read_lock_bh();
3262 	return if6_get_first(seq, *pos);
3263 }
3264 
3265 static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3266 {
3267 	struct inet6_ifaddr *ifa;
3268 
3269 	ifa = if6_get_next(seq, v);
3270 	++*pos;
3271 	return ifa;
3272 }
3273 
3274 static void if6_seq_stop(struct seq_file *seq, void *v)
3275 	__releases(rcu_bh)
3276 {
3277 	rcu_read_unlock_bh();
3278 }
3279 
3280 static int if6_seq_show(struct seq_file *seq, void *v)
3281 {
3282 	struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
3283 	seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
3284 		   &ifp->addr,
3285 		   ifp->idev->dev->ifindex,
3286 		   ifp->prefix_len,
3287 		   ifp->scope,
3288 		   ifp->flags,
3289 		   ifp->idev->dev->name);
3290 	return 0;
3291 }
3292 
3293 static const struct seq_operations if6_seq_ops = {
3294 	.start	= if6_seq_start,
3295 	.next	= if6_seq_next,
3296 	.show	= if6_seq_show,
3297 	.stop	= if6_seq_stop,
3298 };
3299 
3300 static int if6_seq_open(struct inode *inode, struct file *file)
3301 {
3302 	return seq_open_net(inode, file, &if6_seq_ops,
3303 			    sizeof(struct if6_iter_state));
3304 }
3305 
3306 static const struct file_operations if6_fops = {
3307 	.owner		= THIS_MODULE,
3308 	.open		= if6_seq_open,
3309 	.read		= seq_read,
3310 	.llseek		= seq_lseek,
3311 	.release	= seq_release_net,
3312 };
3313 
3314 static int __net_init if6_proc_net_init(struct net *net)
3315 {
3316 	if (!proc_net_fops_create(net, "if_inet6", S_IRUGO, &if6_fops))
3317 		return -ENOMEM;
3318 	return 0;
3319 }
3320 
3321 static void __net_exit if6_proc_net_exit(struct net *net)
3322 {
3323        proc_net_remove(net, "if_inet6");
3324 }
3325 
3326 static struct pernet_operations if6_proc_net_ops = {
3327        .init = if6_proc_net_init,
3328        .exit = if6_proc_net_exit,
3329 };
3330 
3331 int __init if6_proc_init(void)
3332 {
3333 	return register_pernet_subsys(&if6_proc_net_ops);
3334 }
3335 
3336 void if6_proc_exit(void)
3337 {
3338 	unregister_pernet_subsys(&if6_proc_net_ops);
3339 }
3340 #endif	/* CONFIG_PROC_FS */
3341 
3342 #if IS_ENABLED(CONFIG_IPV6_MIP6)
3343 /* Check if address is a home address configured on any interface. */
3344 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
3345 {
3346 	int ret = 0;
3347 	struct inet6_ifaddr *ifp = NULL;
3348 	struct hlist_node *n;
3349 	unsigned int hash = inet6_addr_hash(addr);
3350 
3351 	rcu_read_lock_bh();
3352 	hlist_for_each_entry_rcu_bh(ifp, n, &inet6_addr_lst[hash], addr_lst) {
3353 		if (!net_eq(dev_net(ifp->idev->dev), net))
3354 			continue;
3355 		if (ipv6_addr_equal(&ifp->addr, addr) &&
3356 		    (ifp->flags & IFA_F_HOMEADDRESS)) {
3357 			ret = 1;
3358 			break;
3359 		}
3360 	}
3361 	rcu_read_unlock_bh();
3362 	return ret;
3363 }
3364 #endif
3365 
3366 /*
3367  *	Periodic address status verification
3368  */
3369 
3370 static void addrconf_verify(unsigned long foo)
3371 {
3372 	unsigned long now, next, next_sec, next_sched;
3373 	struct inet6_ifaddr *ifp;
3374 	struct hlist_node *node;
3375 	int i;
3376 
3377 	rcu_read_lock_bh();
3378 	spin_lock(&addrconf_verify_lock);
3379 	now = jiffies;
3380 	next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
3381 
3382 	del_timer(&addr_chk_timer);
3383 
3384 	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
3385 restart:
3386 		hlist_for_each_entry_rcu_bh(ifp, node,
3387 					 &inet6_addr_lst[i], addr_lst) {
3388 			unsigned long age;
3389 
3390 			if (ifp->flags & IFA_F_PERMANENT)
3391 				continue;
3392 
3393 			spin_lock(&ifp->lock);
3394 			/* We try to batch several events at once. */
3395 			age = (now - ifp->tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
3396 
3397 			if (ifp->valid_lft != INFINITY_LIFE_TIME &&
3398 			    age >= ifp->valid_lft) {
3399 				spin_unlock(&ifp->lock);
3400 				in6_ifa_hold(ifp);
3401 				ipv6_del_addr(ifp);
3402 				goto restart;
3403 			} else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
3404 				spin_unlock(&ifp->lock);
3405 				continue;
3406 			} else if (age >= ifp->prefered_lft) {
3407 				/* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
3408 				int deprecate = 0;
3409 
3410 				if (!(ifp->flags&IFA_F_DEPRECATED)) {
3411 					deprecate = 1;
3412 					ifp->flags |= IFA_F_DEPRECATED;
3413 				}
3414 
3415 				if (time_before(ifp->tstamp + ifp->valid_lft * HZ, next))
3416 					next = ifp->tstamp + ifp->valid_lft * HZ;
3417 
3418 				spin_unlock(&ifp->lock);
3419 
3420 				if (deprecate) {
3421 					in6_ifa_hold(ifp);
3422 
3423 					ipv6_ifa_notify(0, ifp);
3424 					in6_ifa_put(ifp);
3425 					goto restart;
3426 				}
3427 #ifdef CONFIG_IPV6_PRIVACY
3428 			} else if ((ifp->flags&IFA_F_TEMPORARY) &&
3429 				   !(ifp->flags&IFA_F_TENTATIVE)) {
3430 				unsigned long regen_advance = ifp->idev->cnf.regen_max_retry *
3431 					ifp->idev->cnf.dad_transmits *
3432 					ifp->idev->nd_parms->retrans_time / HZ;
3433 
3434 				if (age >= ifp->prefered_lft - regen_advance) {
3435 					struct inet6_ifaddr *ifpub = ifp->ifpub;
3436 					if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
3437 						next = ifp->tstamp + ifp->prefered_lft * HZ;
3438 					if (!ifp->regen_count && ifpub) {
3439 						ifp->regen_count++;
3440 						in6_ifa_hold(ifp);
3441 						in6_ifa_hold(ifpub);
3442 						spin_unlock(&ifp->lock);
3443 
3444 						spin_lock(&ifpub->lock);
3445 						ifpub->regen_count = 0;
3446 						spin_unlock(&ifpub->lock);
3447 						ipv6_create_tempaddr(ifpub, ifp);
3448 						in6_ifa_put(ifpub);
3449 						in6_ifa_put(ifp);
3450 						goto restart;
3451 					}
3452 				} else if (time_before(ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ, next))
3453 					next = ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ;
3454 				spin_unlock(&ifp->lock);
3455 #endif
3456 			} else {
3457 				/* ifp->prefered_lft <= ifp->valid_lft */
3458 				if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
3459 					next = ifp->tstamp + ifp->prefered_lft * HZ;
3460 				spin_unlock(&ifp->lock);
3461 			}
3462 		}
3463 	}
3464 
3465 	next_sec = round_jiffies_up(next);
3466 	next_sched = next;
3467 
3468 	/* If rounded timeout is accurate enough, accept it. */
3469 	if (time_before(next_sec, next + ADDRCONF_TIMER_FUZZ))
3470 		next_sched = next_sec;
3471 
3472 	/* And minimum interval is ADDRCONF_TIMER_FUZZ_MAX. */
3473 	if (time_before(next_sched, jiffies + ADDRCONF_TIMER_FUZZ_MAX))
3474 		next_sched = jiffies + ADDRCONF_TIMER_FUZZ_MAX;
3475 
3476 	ADBG((KERN_DEBUG "now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
3477 	      now, next, next_sec, next_sched));
3478 
3479 	addr_chk_timer.expires = next_sched;
3480 	add_timer(&addr_chk_timer);
3481 	spin_unlock(&addrconf_verify_lock);
3482 	rcu_read_unlock_bh();
3483 }
3484 
3485 static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local)
3486 {
3487 	struct in6_addr *pfx = NULL;
3488 
3489 	if (addr)
3490 		pfx = nla_data(addr);
3491 
3492 	if (local) {
3493 		if (pfx && nla_memcmp(local, pfx, sizeof(*pfx)))
3494 			pfx = NULL;
3495 		else
3496 			pfx = nla_data(local);
3497 	}
3498 
3499 	return pfx;
3500 }
3501 
3502 static const struct nla_policy ifa_ipv6_policy[IFA_MAX+1] = {
3503 	[IFA_ADDRESS]		= { .len = sizeof(struct in6_addr) },
3504 	[IFA_LOCAL]		= { .len = sizeof(struct in6_addr) },
3505 	[IFA_CACHEINFO]		= { .len = sizeof(struct ifa_cacheinfo) },
3506 };
3507 
3508 static int
3509 inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
3510 {
3511 	struct net *net = sock_net(skb->sk);
3512 	struct ifaddrmsg *ifm;
3513 	struct nlattr *tb[IFA_MAX+1];
3514 	struct in6_addr *pfx;
3515 	int err;
3516 
3517 	if (!capable(CAP_NET_ADMIN))
3518 		return -EPERM;
3519 
3520 	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
3521 	if (err < 0)
3522 		return err;
3523 
3524 	ifm = nlmsg_data(nlh);
3525 	pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
3526 	if (pfx == NULL)
3527 		return -EINVAL;
3528 
3529 	return inet6_addr_del(net, ifm->ifa_index, pfx, ifm->ifa_prefixlen);
3530 }
3531 
3532 static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
3533 			     u32 prefered_lft, u32 valid_lft)
3534 {
3535 	u32 flags;
3536 	clock_t expires;
3537 	unsigned long timeout;
3538 
3539 	if (!valid_lft || (prefered_lft > valid_lft))
3540 		return -EINVAL;
3541 
3542 	timeout = addrconf_timeout_fixup(valid_lft, HZ);
3543 	if (addrconf_finite_timeout(timeout)) {
3544 		expires = jiffies_to_clock_t(timeout * HZ);
3545 		valid_lft = timeout;
3546 		flags = RTF_EXPIRES;
3547 	} else {
3548 		expires = 0;
3549 		flags = 0;
3550 		ifa_flags |= IFA_F_PERMANENT;
3551 	}
3552 
3553 	timeout = addrconf_timeout_fixup(prefered_lft, HZ);
3554 	if (addrconf_finite_timeout(timeout)) {
3555 		if (timeout == 0)
3556 			ifa_flags |= IFA_F_DEPRECATED;
3557 		prefered_lft = timeout;
3558 	}
3559 
3560 	spin_lock_bh(&ifp->lock);
3561 	ifp->flags = (ifp->flags & ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD | IFA_F_HOMEADDRESS)) | ifa_flags;
3562 	ifp->tstamp = jiffies;
3563 	ifp->valid_lft = valid_lft;
3564 	ifp->prefered_lft = prefered_lft;
3565 
3566 	spin_unlock_bh(&ifp->lock);
3567 	if (!(ifp->flags&IFA_F_TENTATIVE))
3568 		ipv6_ifa_notify(0, ifp);
3569 
3570 	addrconf_prefix_route(&ifp->addr, ifp->prefix_len, ifp->idev->dev,
3571 			      expires, flags);
3572 	addrconf_verify(0);
3573 
3574 	return 0;
3575 }
3576 
3577 static int
3578 inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
3579 {
3580 	struct net *net = sock_net(skb->sk);
3581 	struct ifaddrmsg *ifm;
3582 	struct nlattr *tb[IFA_MAX+1];
3583 	struct in6_addr *pfx;
3584 	struct inet6_ifaddr *ifa;
3585 	struct net_device *dev;
3586 	u32 valid_lft = INFINITY_LIFE_TIME, preferred_lft = INFINITY_LIFE_TIME;
3587 	u8 ifa_flags;
3588 	int err;
3589 
3590 	if (!capable(CAP_NET_ADMIN))
3591 		return -EPERM;
3592 
3593 	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
3594 	if (err < 0)
3595 		return err;
3596 
3597 	ifm = nlmsg_data(nlh);
3598 	pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
3599 	if (pfx == NULL)
3600 		return -EINVAL;
3601 
3602 	if (tb[IFA_CACHEINFO]) {
3603 		struct ifa_cacheinfo *ci;
3604 
3605 		ci = nla_data(tb[IFA_CACHEINFO]);
3606 		valid_lft = ci->ifa_valid;
3607 		preferred_lft = ci->ifa_prefered;
3608 	} else {
3609 		preferred_lft = INFINITY_LIFE_TIME;
3610 		valid_lft = INFINITY_LIFE_TIME;
3611 	}
3612 
3613 	dev =  __dev_get_by_index(net, ifm->ifa_index);
3614 	if (dev == NULL)
3615 		return -ENODEV;
3616 
3617 	/* We ignore other flags so far. */
3618 	ifa_flags = ifm->ifa_flags & (IFA_F_NODAD | IFA_F_HOMEADDRESS);
3619 
3620 	ifa = ipv6_get_ifaddr(net, pfx, dev, 1);
3621 	if (ifa == NULL) {
3622 		/*
3623 		 * It would be best to check for !NLM_F_CREATE here but
3624 		 * userspace alreay relies on not having to provide this.
3625 		 */
3626 		return inet6_addr_add(net, ifm->ifa_index, pfx,
3627 				      ifm->ifa_prefixlen, ifa_flags,
3628 				      preferred_lft, valid_lft);
3629 	}
3630 
3631 	if (nlh->nlmsg_flags & NLM_F_EXCL ||
3632 	    !(nlh->nlmsg_flags & NLM_F_REPLACE))
3633 		err = -EEXIST;
3634 	else
3635 		err = inet6_addr_modify(ifa, ifa_flags, preferred_lft, valid_lft);
3636 
3637 	in6_ifa_put(ifa);
3638 
3639 	return err;
3640 }
3641 
3642 static void put_ifaddrmsg(struct nlmsghdr *nlh, u8 prefixlen, u8 flags,
3643 			  u8 scope, int ifindex)
3644 {
3645 	struct ifaddrmsg *ifm;
3646 
3647 	ifm = nlmsg_data(nlh);
3648 	ifm->ifa_family = AF_INET6;
3649 	ifm->ifa_prefixlen = prefixlen;
3650 	ifm->ifa_flags = flags;
3651 	ifm->ifa_scope = scope;
3652 	ifm->ifa_index = ifindex;
3653 }
3654 
3655 static int put_cacheinfo(struct sk_buff *skb, unsigned long cstamp,
3656 			 unsigned long tstamp, u32 preferred, u32 valid)
3657 {
3658 	struct ifa_cacheinfo ci;
3659 
3660 	ci.cstamp = cstamp_delta(cstamp);
3661 	ci.tstamp = cstamp_delta(tstamp);
3662 	ci.ifa_prefered = preferred;
3663 	ci.ifa_valid = valid;
3664 
3665 	return nla_put(skb, IFA_CACHEINFO, sizeof(ci), &ci);
3666 }
3667 
3668 static inline int rt_scope(int ifa_scope)
3669 {
3670 	if (ifa_scope & IFA_HOST)
3671 		return RT_SCOPE_HOST;
3672 	else if (ifa_scope & IFA_LINK)
3673 		return RT_SCOPE_LINK;
3674 	else if (ifa_scope & IFA_SITE)
3675 		return RT_SCOPE_SITE;
3676 	else
3677 		return RT_SCOPE_UNIVERSE;
3678 }
3679 
3680 static inline int inet6_ifaddr_msgsize(void)
3681 {
3682 	return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
3683 	       + nla_total_size(16) /* IFA_ADDRESS */
3684 	       + nla_total_size(sizeof(struct ifa_cacheinfo));
3685 }
3686 
3687 static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
3688 			     u32 portid, u32 seq, int event, unsigned int flags)
3689 {
3690 	struct nlmsghdr  *nlh;
3691 	u32 preferred, valid;
3692 
3693 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
3694 	if (nlh == NULL)
3695 		return -EMSGSIZE;
3696 
3697 	put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
3698 		      ifa->idev->dev->ifindex);
3699 
3700 	if (!(ifa->flags&IFA_F_PERMANENT)) {
3701 		preferred = ifa->prefered_lft;
3702 		valid = ifa->valid_lft;
3703 		if (preferred != INFINITY_LIFE_TIME) {
3704 			long tval = (jiffies - ifa->tstamp)/HZ;
3705 			if (preferred > tval)
3706 				preferred -= tval;
3707 			else
3708 				preferred = 0;
3709 			if (valid != INFINITY_LIFE_TIME) {
3710 				if (valid > tval)
3711 					valid -= tval;
3712 				else
3713 					valid = 0;
3714 			}
3715 		}
3716 	} else {
3717 		preferred = INFINITY_LIFE_TIME;
3718 		valid = INFINITY_LIFE_TIME;
3719 	}
3720 
3721 	if (nla_put(skb, IFA_ADDRESS, 16, &ifa->addr) < 0 ||
3722 	    put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0) {
3723 		nlmsg_cancel(skb, nlh);
3724 		return -EMSGSIZE;
3725 	}
3726 
3727 	return nlmsg_end(skb, nlh);
3728 }
3729 
3730 static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
3731 				u32 portid, u32 seq, int event, u16 flags)
3732 {
3733 	struct nlmsghdr  *nlh;
3734 	u8 scope = RT_SCOPE_UNIVERSE;
3735 	int ifindex = ifmca->idev->dev->ifindex;
3736 
3737 	if (ipv6_addr_scope(&ifmca->mca_addr) & IFA_SITE)
3738 		scope = RT_SCOPE_SITE;
3739 
3740 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
3741 	if (nlh == NULL)
3742 		return -EMSGSIZE;
3743 
3744 	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
3745 	if (nla_put(skb, IFA_MULTICAST, 16, &ifmca->mca_addr) < 0 ||
3746 	    put_cacheinfo(skb, ifmca->mca_cstamp, ifmca->mca_tstamp,
3747 			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
3748 		nlmsg_cancel(skb, nlh);
3749 		return -EMSGSIZE;
3750 	}
3751 
3752 	return nlmsg_end(skb, nlh);
3753 }
3754 
3755 static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
3756 				u32 portid, u32 seq, int event, unsigned int flags)
3757 {
3758 	struct nlmsghdr  *nlh;
3759 	u8 scope = RT_SCOPE_UNIVERSE;
3760 	int ifindex = ifaca->aca_idev->dev->ifindex;
3761 
3762 	if (ipv6_addr_scope(&ifaca->aca_addr) & IFA_SITE)
3763 		scope = RT_SCOPE_SITE;
3764 
3765 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
3766 	if (nlh == NULL)
3767 		return -EMSGSIZE;
3768 
3769 	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
3770 	if (nla_put(skb, IFA_ANYCAST, 16, &ifaca->aca_addr) < 0 ||
3771 	    put_cacheinfo(skb, ifaca->aca_cstamp, ifaca->aca_tstamp,
3772 			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
3773 		nlmsg_cancel(skb, nlh);
3774 		return -EMSGSIZE;
3775 	}
3776 
3777 	return nlmsg_end(skb, nlh);
3778 }
3779 
3780 enum addr_type_t {
3781 	UNICAST_ADDR,
3782 	MULTICAST_ADDR,
3783 	ANYCAST_ADDR,
3784 };
3785 
3786 /* called with rcu_read_lock() */
3787 static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
3788 			  struct netlink_callback *cb, enum addr_type_t type,
3789 			  int s_ip_idx, int *p_ip_idx)
3790 {
3791 	struct ifmcaddr6 *ifmca;
3792 	struct ifacaddr6 *ifaca;
3793 	int err = 1;
3794 	int ip_idx = *p_ip_idx;
3795 
3796 	read_lock_bh(&idev->lock);
3797 	switch (type) {
3798 	case UNICAST_ADDR: {
3799 		struct inet6_ifaddr *ifa;
3800 
3801 		/* unicast address incl. temp addr */
3802 		list_for_each_entry(ifa, &idev->addr_list, if_list) {
3803 			if (++ip_idx < s_ip_idx)
3804 				continue;
3805 			err = inet6_fill_ifaddr(skb, ifa,
3806 						NETLINK_CB(cb->skb).portid,
3807 						cb->nlh->nlmsg_seq,
3808 						RTM_NEWADDR,
3809 						NLM_F_MULTI);
3810 			if (err <= 0)
3811 				break;
3812 		}
3813 		break;
3814 	}
3815 	case MULTICAST_ADDR:
3816 		/* multicast address */
3817 		for (ifmca = idev->mc_list; ifmca;
3818 		     ifmca = ifmca->next, ip_idx++) {
3819 			if (ip_idx < s_ip_idx)
3820 				continue;
3821 			err = inet6_fill_ifmcaddr(skb, ifmca,
3822 						  NETLINK_CB(cb->skb).portid,
3823 						  cb->nlh->nlmsg_seq,
3824 						  RTM_GETMULTICAST,
3825 						  NLM_F_MULTI);
3826 			if (err <= 0)
3827 				break;
3828 		}
3829 		break;
3830 	case ANYCAST_ADDR:
3831 		/* anycast address */
3832 		for (ifaca = idev->ac_list; ifaca;
3833 		     ifaca = ifaca->aca_next, ip_idx++) {
3834 			if (ip_idx < s_ip_idx)
3835 				continue;
3836 			err = inet6_fill_ifacaddr(skb, ifaca,
3837 						  NETLINK_CB(cb->skb).portid,
3838 						  cb->nlh->nlmsg_seq,
3839 						  RTM_GETANYCAST,
3840 						  NLM_F_MULTI);
3841 			if (err <= 0)
3842 				break;
3843 		}
3844 		break;
3845 	default:
3846 		break;
3847 	}
3848 	read_unlock_bh(&idev->lock);
3849 	*p_ip_idx = ip_idx;
3850 	return err;
3851 }
3852 
3853 static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
3854 			   enum addr_type_t type)
3855 {
3856 	struct net *net = sock_net(skb->sk);
3857 	int h, s_h;
3858 	int idx, ip_idx;
3859 	int s_idx, s_ip_idx;
3860 	struct net_device *dev;
3861 	struct inet6_dev *idev;
3862 	struct hlist_head *head;
3863 	struct hlist_node *node;
3864 
3865 	s_h = cb->args[0];
3866 	s_idx = idx = cb->args[1];
3867 	s_ip_idx = ip_idx = cb->args[2];
3868 
3869 	rcu_read_lock();
3870 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
3871 		idx = 0;
3872 		head = &net->dev_index_head[h];
3873 		hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
3874 			if (idx < s_idx)
3875 				goto cont;
3876 			if (h > s_h || idx > s_idx)
3877 				s_ip_idx = 0;
3878 			ip_idx = 0;
3879 			idev = __in6_dev_get(dev);
3880 			if (!idev)
3881 				goto cont;
3882 
3883 			if (in6_dump_addrs(idev, skb, cb, type,
3884 					   s_ip_idx, &ip_idx) <= 0)
3885 				goto done;
3886 cont:
3887 			idx++;
3888 		}
3889 	}
3890 done:
3891 	rcu_read_unlock();
3892 	cb->args[0] = h;
3893 	cb->args[1] = idx;
3894 	cb->args[2] = ip_idx;
3895 
3896 	return skb->len;
3897 }
3898 
3899 static int inet6_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
3900 {
3901 	enum addr_type_t type = UNICAST_ADDR;
3902 
3903 	return inet6_dump_addr(skb, cb, type);
3904 }
3905 
3906 static int inet6_dump_ifmcaddr(struct sk_buff *skb, struct netlink_callback *cb)
3907 {
3908 	enum addr_type_t type = MULTICAST_ADDR;
3909 
3910 	return inet6_dump_addr(skb, cb, type);
3911 }
3912 
3913 
3914 static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
3915 {
3916 	enum addr_type_t type = ANYCAST_ADDR;
3917 
3918 	return inet6_dump_addr(skb, cb, type);
3919 }
3920 
3921 static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh,
3922 			     void *arg)
3923 {
3924 	struct net *net = sock_net(in_skb->sk);
3925 	struct ifaddrmsg *ifm;
3926 	struct nlattr *tb[IFA_MAX+1];
3927 	struct in6_addr *addr = NULL;
3928 	struct net_device *dev = NULL;
3929 	struct inet6_ifaddr *ifa;
3930 	struct sk_buff *skb;
3931 	int err;
3932 
3933 	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
3934 	if (err < 0)
3935 		goto errout;
3936 
3937 	addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
3938 	if (addr == NULL) {
3939 		err = -EINVAL;
3940 		goto errout;
3941 	}
3942 
3943 	ifm = nlmsg_data(nlh);
3944 	if (ifm->ifa_index)
3945 		dev = __dev_get_by_index(net, ifm->ifa_index);
3946 
3947 	ifa = ipv6_get_ifaddr(net, addr, dev, 1);
3948 	if (!ifa) {
3949 		err = -EADDRNOTAVAIL;
3950 		goto errout;
3951 	}
3952 
3953 	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_KERNEL);
3954 	if (!skb) {
3955 		err = -ENOBUFS;
3956 		goto errout_ifa;
3957 	}
3958 
3959 	err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).portid,
3960 				nlh->nlmsg_seq, RTM_NEWADDR, 0);
3961 	if (err < 0) {
3962 		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
3963 		WARN_ON(err == -EMSGSIZE);
3964 		kfree_skb(skb);
3965 		goto errout_ifa;
3966 	}
3967 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
3968 errout_ifa:
3969 	in6_ifa_put(ifa);
3970 errout:
3971 	return err;
3972 }
3973 
3974 static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
3975 {
3976 	struct sk_buff *skb;
3977 	struct net *net = dev_net(ifa->idev->dev);
3978 	int err = -ENOBUFS;
3979 
3980 	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_ATOMIC);
3981 	if (skb == NULL)
3982 		goto errout;
3983 
3984 	err = inet6_fill_ifaddr(skb, ifa, 0, 0, event, 0);
3985 	if (err < 0) {
3986 		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
3987 		WARN_ON(err == -EMSGSIZE);
3988 		kfree_skb(skb);
3989 		goto errout;
3990 	}
3991 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
3992 	return;
3993 errout:
3994 	if (err < 0)
3995 		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err);
3996 }
3997 
3998 static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
3999 				__s32 *array, int bytes)
4000 {
4001 	BUG_ON(bytes < (DEVCONF_MAX * 4));
4002 
4003 	memset(array, 0, bytes);
4004 	array[DEVCONF_FORWARDING] = cnf->forwarding;
4005 	array[DEVCONF_HOPLIMIT] = cnf->hop_limit;
4006 	array[DEVCONF_MTU6] = cnf->mtu6;
4007 	array[DEVCONF_ACCEPT_RA] = cnf->accept_ra;
4008 	array[DEVCONF_ACCEPT_REDIRECTS] = cnf->accept_redirects;
4009 	array[DEVCONF_AUTOCONF] = cnf->autoconf;
4010 	array[DEVCONF_DAD_TRANSMITS] = cnf->dad_transmits;
4011 	array[DEVCONF_RTR_SOLICITS] = cnf->rtr_solicits;
4012 	array[DEVCONF_RTR_SOLICIT_INTERVAL] =
4013 		jiffies_to_msecs(cnf->rtr_solicit_interval);
4014 	array[DEVCONF_RTR_SOLICIT_DELAY] =
4015 		jiffies_to_msecs(cnf->rtr_solicit_delay);
4016 	array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version;
4017 #ifdef CONFIG_IPV6_PRIVACY
4018 	array[DEVCONF_USE_TEMPADDR] = cnf->use_tempaddr;
4019 	array[DEVCONF_TEMP_VALID_LFT] = cnf->temp_valid_lft;
4020 	array[DEVCONF_TEMP_PREFERED_LFT] = cnf->temp_prefered_lft;
4021 	array[DEVCONF_REGEN_MAX_RETRY] = cnf->regen_max_retry;
4022 	array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor;
4023 #endif
4024 	array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
4025 	array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
4026 	array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
4027 #ifdef CONFIG_IPV6_ROUTER_PREF
4028 	array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
4029 	array[DEVCONF_RTR_PROBE_INTERVAL] =
4030 		jiffies_to_msecs(cnf->rtr_probe_interval);
4031 #ifdef CONFIG_IPV6_ROUTE_INFO
4032 	array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
4033 #endif
4034 #endif
4035 	array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;
4036 	array[DEVCONF_ACCEPT_SOURCE_ROUTE] = cnf->accept_source_route;
4037 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
4038 	array[DEVCONF_OPTIMISTIC_DAD] = cnf->optimistic_dad;
4039 #endif
4040 #ifdef CONFIG_IPV6_MROUTE
4041 	array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding;
4042 #endif
4043 	array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
4044 	array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
4045 	array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
4046 	array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
4047 }
4048 
4049 static inline size_t inet6_ifla6_size(void)
4050 {
4051 	return nla_total_size(4) /* IFLA_INET6_FLAGS */
4052 	     + nla_total_size(sizeof(struct ifla_cacheinfo))
4053 	     + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
4054 	     + nla_total_size(IPSTATS_MIB_MAX * 8) /* IFLA_INET6_STATS */
4055 	     + nla_total_size(ICMP6_MIB_MAX * 8); /* IFLA_INET6_ICMP6STATS */
4056 }
4057 
4058 static inline size_t inet6_if_nlmsg_size(void)
4059 {
4060 	return NLMSG_ALIGN(sizeof(struct ifinfomsg))
4061 	       + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
4062 	       + nla_total_size(MAX_ADDR_LEN) /* IFLA_ADDRESS */
4063 	       + nla_total_size(4) /* IFLA_MTU */
4064 	       + nla_total_size(4) /* IFLA_LINK */
4065 	       + nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */
4066 }
4067 
4068 static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
4069 				      int items, int bytes)
4070 {
4071 	int i;
4072 	int pad = bytes - sizeof(u64) * items;
4073 	BUG_ON(pad < 0);
4074 
4075 	/* Use put_unaligned() because stats may not be aligned for u64. */
4076 	put_unaligned(items, &stats[0]);
4077 	for (i = 1; i < items; i++)
4078 		put_unaligned(atomic_long_read(&mib[i]), &stats[i]);
4079 
4080 	memset(&stats[items], 0, pad);
4081 }
4082 
4083 static inline void __snmp6_fill_stats64(u64 *stats, void __percpu **mib,
4084 				      int items, int bytes, size_t syncpoff)
4085 {
4086 	int i;
4087 	int pad = bytes - sizeof(u64) * items;
4088 	BUG_ON(pad < 0);
4089 
4090 	/* Use put_unaligned() because stats may not be aligned for u64. */
4091 	put_unaligned(items, &stats[0]);
4092 	for (i = 1; i < items; i++)
4093 		put_unaligned(snmp_fold_field64(mib, i, syncpoff), &stats[i]);
4094 
4095 	memset(&stats[items], 0, pad);
4096 }
4097 
4098 static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
4099 			     int bytes)
4100 {
4101 	switch (attrtype) {
4102 	case IFLA_INET6_STATS:
4103 		__snmp6_fill_stats64(stats, (void __percpu **)idev->stats.ipv6,
4104 				     IPSTATS_MIB_MAX, bytes, offsetof(struct ipstats_mib, syncp));
4105 		break;
4106 	case IFLA_INET6_ICMP6STATS:
4107 		__snmp6_fill_statsdev(stats, idev->stats.icmpv6dev->mibs, ICMP6_MIB_MAX, bytes);
4108 		break;
4109 	}
4110 }
4111 
4112 static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev)
4113 {
4114 	struct nlattr *nla;
4115 	struct ifla_cacheinfo ci;
4116 
4117 	if (nla_put_u32(skb, IFLA_INET6_FLAGS, idev->if_flags))
4118 		goto nla_put_failure;
4119 	ci.max_reasm_len = IPV6_MAXPLEN;
4120 	ci.tstamp = cstamp_delta(idev->tstamp);
4121 	ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
4122 	ci.retrans_time = jiffies_to_msecs(idev->nd_parms->retrans_time);
4123 	if (nla_put(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci))
4124 		goto nla_put_failure;
4125 	nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
4126 	if (nla == NULL)
4127 		goto nla_put_failure;
4128 	ipv6_store_devconf(&idev->cnf, nla_data(nla), nla_len(nla));
4129 
4130 	/* XXX - MC not implemented */
4131 
4132 	nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
4133 	if (nla == NULL)
4134 		goto nla_put_failure;
4135 	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
4136 
4137 	nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
4138 	if (nla == NULL)
4139 		goto nla_put_failure;
4140 	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
4141 
4142 	return 0;
4143 
4144 nla_put_failure:
4145 	return -EMSGSIZE;
4146 }
4147 
4148 static size_t inet6_get_link_af_size(const struct net_device *dev)
4149 {
4150 	if (!__in6_dev_get(dev))
4151 		return 0;
4152 
4153 	return inet6_ifla6_size();
4154 }
4155 
4156 static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev)
4157 {
4158 	struct inet6_dev *idev = __in6_dev_get(dev);
4159 
4160 	if (!idev)
4161 		return -ENODATA;
4162 
4163 	if (inet6_fill_ifla6_attrs(skb, idev) < 0)
4164 		return -EMSGSIZE;
4165 
4166 	return 0;
4167 }
4168 
4169 static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
4170 			     u32 portid, u32 seq, int event, unsigned int flags)
4171 {
4172 	struct net_device *dev = idev->dev;
4173 	struct ifinfomsg *hdr;
4174 	struct nlmsghdr *nlh;
4175 	void *protoinfo;
4176 
4177 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*hdr), flags);
4178 	if (nlh == NULL)
4179 		return -EMSGSIZE;
4180 
4181 	hdr = nlmsg_data(nlh);
4182 	hdr->ifi_family = AF_INET6;
4183 	hdr->__ifi_pad = 0;
4184 	hdr->ifi_type = dev->type;
4185 	hdr->ifi_index = dev->ifindex;
4186 	hdr->ifi_flags = dev_get_flags(dev);
4187 	hdr->ifi_change = 0;
4188 
4189 	if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
4190 	    (dev->addr_len &&
4191 	     nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr)) ||
4192 	    nla_put_u32(skb, IFLA_MTU, dev->mtu) ||
4193 	    (dev->ifindex != dev->iflink &&
4194 	     nla_put_u32(skb, IFLA_LINK, dev->iflink)))
4195 		goto nla_put_failure;
4196 	protoinfo = nla_nest_start(skb, IFLA_PROTINFO);
4197 	if (protoinfo == NULL)
4198 		goto nla_put_failure;
4199 
4200 	if (inet6_fill_ifla6_attrs(skb, idev) < 0)
4201 		goto nla_put_failure;
4202 
4203 	nla_nest_end(skb, protoinfo);
4204 	return nlmsg_end(skb, nlh);
4205 
4206 nla_put_failure:
4207 	nlmsg_cancel(skb, nlh);
4208 	return -EMSGSIZE;
4209 }
4210 
4211 static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
4212 {
4213 	struct net *net = sock_net(skb->sk);
4214 	int h, s_h;
4215 	int idx = 0, s_idx;
4216 	struct net_device *dev;
4217 	struct inet6_dev *idev;
4218 	struct hlist_head *head;
4219 	struct hlist_node *node;
4220 
4221 	s_h = cb->args[0];
4222 	s_idx = cb->args[1];
4223 
4224 	rcu_read_lock();
4225 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
4226 		idx = 0;
4227 		head = &net->dev_index_head[h];
4228 		hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
4229 			if (idx < s_idx)
4230 				goto cont;
4231 			idev = __in6_dev_get(dev);
4232 			if (!idev)
4233 				goto cont;
4234 			if (inet6_fill_ifinfo(skb, idev,
4235 					      NETLINK_CB(cb->skb).portid,
4236 					      cb->nlh->nlmsg_seq,
4237 					      RTM_NEWLINK, NLM_F_MULTI) <= 0)
4238 				goto out;
4239 cont:
4240 			idx++;
4241 		}
4242 	}
4243 out:
4244 	rcu_read_unlock();
4245 	cb->args[1] = idx;
4246 	cb->args[0] = h;
4247 
4248 	return skb->len;
4249 }
4250 
4251 void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
4252 {
4253 	struct sk_buff *skb;
4254 	struct net *net = dev_net(idev->dev);
4255 	int err = -ENOBUFS;
4256 
4257 	skb = nlmsg_new(inet6_if_nlmsg_size(), GFP_ATOMIC);
4258 	if (skb == NULL)
4259 		goto errout;
4260 
4261 	err = inet6_fill_ifinfo(skb, idev, 0, 0, event, 0);
4262 	if (err < 0) {
4263 		/* -EMSGSIZE implies BUG in inet6_if_nlmsg_size() */
4264 		WARN_ON(err == -EMSGSIZE);
4265 		kfree_skb(skb);
4266 		goto errout;
4267 	}
4268 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFINFO, NULL, GFP_ATOMIC);
4269 	return;
4270 errout:
4271 	if (err < 0)
4272 		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFINFO, err);
4273 }
4274 
4275 static inline size_t inet6_prefix_nlmsg_size(void)
4276 {
4277 	return NLMSG_ALIGN(sizeof(struct prefixmsg))
4278 	       + nla_total_size(sizeof(struct in6_addr))
4279 	       + nla_total_size(sizeof(struct prefix_cacheinfo));
4280 }
4281 
4282 static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
4283 			     struct prefix_info *pinfo, u32 portid, u32 seq,
4284 			     int event, unsigned int flags)
4285 {
4286 	struct prefixmsg *pmsg;
4287 	struct nlmsghdr *nlh;
4288 	struct prefix_cacheinfo	ci;
4289 
4290 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*pmsg), flags);
4291 	if (nlh == NULL)
4292 		return -EMSGSIZE;
4293 
4294 	pmsg = nlmsg_data(nlh);
4295 	pmsg->prefix_family = AF_INET6;
4296 	pmsg->prefix_pad1 = 0;
4297 	pmsg->prefix_pad2 = 0;
4298 	pmsg->prefix_ifindex = idev->dev->ifindex;
4299 	pmsg->prefix_len = pinfo->prefix_len;
4300 	pmsg->prefix_type = pinfo->type;
4301 	pmsg->prefix_pad3 = 0;
4302 	pmsg->prefix_flags = 0;
4303 	if (pinfo->onlink)
4304 		pmsg->prefix_flags |= IF_PREFIX_ONLINK;
4305 	if (pinfo->autoconf)
4306 		pmsg->prefix_flags |= IF_PREFIX_AUTOCONF;
4307 
4308 	if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix))
4309 		goto nla_put_failure;
4310 	ci.preferred_time = ntohl(pinfo->prefered);
4311 	ci.valid_time = ntohl(pinfo->valid);
4312 	if (nla_put(skb, PREFIX_CACHEINFO, sizeof(ci), &ci))
4313 		goto nla_put_failure;
4314 	return nlmsg_end(skb, nlh);
4315 
4316 nla_put_failure:
4317 	nlmsg_cancel(skb, nlh);
4318 	return -EMSGSIZE;
4319 }
4320 
4321 static void inet6_prefix_notify(int event, struct inet6_dev *idev,
4322 			 struct prefix_info *pinfo)
4323 {
4324 	struct sk_buff *skb;
4325 	struct net *net = dev_net(idev->dev);
4326 	int err = -ENOBUFS;
4327 
4328 	skb = nlmsg_new(inet6_prefix_nlmsg_size(), GFP_ATOMIC);
4329 	if (skb == NULL)
4330 		goto errout;
4331 
4332 	err = inet6_fill_prefix(skb, idev, pinfo, 0, 0, event, 0);
4333 	if (err < 0) {
4334 		/* -EMSGSIZE implies BUG in inet6_prefix_nlmsg_size() */
4335 		WARN_ON(err == -EMSGSIZE);
4336 		kfree_skb(skb);
4337 		goto errout;
4338 	}
4339 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
4340 	return;
4341 errout:
4342 	if (err < 0)
4343 		rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
4344 }
4345 
4346 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
4347 {
4348 	inet6_ifa_notify(event ? : RTM_NEWADDR, ifp);
4349 
4350 	switch (event) {
4351 	case RTM_NEWADDR:
4352 		/*
4353 		 * If the address was optimistic
4354 		 * we inserted the route at the start of
4355 		 * our DAD process, so we don't need
4356 		 * to do it again
4357 		 */
4358 		if (!(ifp->rt->rt6i_node))
4359 			ip6_ins_rt(ifp->rt);
4360 		if (ifp->idev->cnf.forwarding)
4361 			addrconf_join_anycast(ifp);
4362 		break;
4363 	case RTM_DELADDR:
4364 		if (ifp->idev->cnf.forwarding)
4365 			addrconf_leave_anycast(ifp);
4366 		addrconf_leave_solict(ifp->idev, &ifp->addr);
4367 		dst_hold(&ifp->rt->dst);
4368 
4369 		if (ip6_del_rt(ifp->rt))
4370 			dst_free(&ifp->rt->dst);
4371 		break;
4372 	}
4373 }
4374 
4375 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
4376 {
4377 	rcu_read_lock_bh();
4378 	if (likely(ifp->idev->dead == 0))
4379 		__ipv6_ifa_notify(event, ifp);
4380 	rcu_read_unlock_bh();
4381 }
4382 
4383 #ifdef CONFIG_SYSCTL
4384 
4385 static
4386 int addrconf_sysctl_forward(ctl_table *ctl, int write,
4387 			   void __user *buffer, size_t *lenp, loff_t *ppos)
4388 {
4389 	int *valp = ctl->data;
4390 	int val = *valp;
4391 	loff_t pos = *ppos;
4392 	ctl_table lctl;
4393 	int ret;
4394 
4395 	/*
4396 	 * ctl->data points to idev->cnf.forwarding, we should
4397 	 * not modify it until we get the rtnl lock.
4398 	 */
4399 	lctl = *ctl;
4400 	lctl.data = &val;
4401 
4402 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
4403 
4404 	if (write)
4405 		ret = addrconf_fixup_forwarding(ctl, valp, val);
4406 	if (ret)
4407 		*ppos = pos;
4408 	return ret;
4409 }
4410 
4411 static void dev_disable_change(struct inet6_dev *idev)
4412 {
4413 	if (!idev || !idev->dev)
4414 		return;
4415 
4416 	if (idev->cnf.disable_ipv6)
4417 		addrconf_notify(NULL, NETDEV_DOWN, idev->dev);
4418 	else
4419 		addrconf_notify(NULL, NETDEV_UP, idev->dev);
4420 }
4421 
4422 static void addrconf_disable_change(struct net *net, __s32 newf)
4423 {
4424 	struct net_device *dev;
4425 	struct inet6_dev *idev;
4426 
4427 	rcu_read_lock();
4428 	for_each_netdev_rcu(net, dev) {
4429 		idev = __in6_dev_get(dev);
4430 		if (idev) {
4431 			int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
4432 			idev->cnf.disable_ipv6 = newf;
4433 			if (changed)
4434 				dev_disable_change(idev);
4435 		}
4436 	}
4437 	rcu_read_unlock();
4438 }
4439 
4440 static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
4441 {
4442 	struct net *net;
4443 	int old;
4444 
4445 	if (!rtnl_trylock())
4446 		return restart_syscall();
4447 
4448 	net = (struct net *)table->extra2;
4449 	old = *p;
4450 	*p = newf;
4451 
4452 	if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
4453 		rtnl_unlock();
4454 		return 0;
4455 	}
4456 
4457 	if (p == &net->ipv6.devconf_all->disable_ipv6) {
4458 		net->ipv6.devconf_dflt->disable_ipv6 = newf;
4459 		addrconf_disable_change(net, newf);
4460 	} else if ((!newf) ^ (!old))
4461 		dev_disable_change((struct inet6_dev *)table->extra1);
4462 
4463 	rtnl_unlock();
4464 	return 0;
4465 }
4466 
4467 static
4468 int addrconf_sysctl_disable(ctl_table *ctl, int write,
4469 			    void __user *buffer, size_t *lenp, loff_t *ppos)
4470 {
4471 	int *valp = ctl->data;
4472 	int val = *valp;
4473 	loff_t pos = *ppos;
4474 	ctl_table lctl;
4475 	int ret;
4476 
4477 	/*
4478 	 * ctl->data points to idev->cnf.disable_ipv6, we should
4479 	 * not modify it until we get the rtnl lock.
4480 	 */
4481 	lctl = *ctl;
4482 	lctl.data = &val;
4483 
4484 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
4485 
4486 	if (write)
4487 		ret = addrconf_disable_ipv6(ctl, valp, val);
4488 	if (ret)
4489 		*ppos = pos;
4490 	return ret;
4491 }
4492 
4493 static struct addrconf_sysctl_table
4494 {
4495 	struct ctl_table_header *sysctl_header;
4496 	ctl_table addrconf_vars[DEVCONF_MAX+1];
4497 } addrconf_sysctl __read_mostly = {
4498 	.sysctl_header = NULL,
4499 	.addrconf_vars = {
4500 		{
4501 			.procname	= "forwarding",
4502 			.data		= &ipv6_devconf.forwarding,
4503 			.maxlen		= sizeof(int),
4504 			.mode		= 0644,
4505 			.proc_handler	= addrconf_sysctl_forward,
4506 		},
4507 		{
4508 			.procname	= "hop_limit",
4509 			.data		= &ipv6_devconf.hop_limit,
4510 			.maxlen		= sizeof(int),
4511 			.mode		= 0644,
4512 			.proc_handler	= proc_dointvec,
4513 		},
4514 		{
4515 			.procname	= "mtu",
4516 			.data		= &ipv6_devconf.mtu6,
4517 			.maxlen		= sizeof(int),
4518 			.mode		= 0644,
4519 			.proc_handler	= proc_dointvec,
4520 		},
4521 		{
4522 			.procname	= "accept_ra",
4523 			.data		= &ipv6_devconf.accept_ra,
4524 			.maxlen		= sizeof(int),
4525 			.mode		= 0644,
4526 			.proc_handler	= proc_dointvec,
4527 		},
4528 		{
4529 			.procname	= "accept_redirects",
4530 			.data		= &ipv6_devconf.accept_redirects,
4531 			.maxlen		= sizeof(int),
4532 			.mode		= 0644,
4533 			.proc_handler	= proc_dointvec,
4534 		},
4535 		{
4536 			.procname	= "autoconf",
4537 			.data		= &ipv6_devconf.autoconf,
4538 			.maxlen		= sizeof(int),
4539 			.mode		= 0644,
4540 			.proc_handler	= proc_dointvec,
4541 		},
4542 		{
4543 			.procname	= "dad_transmits",
4544 			.data		= &ipv6_devconf.dad_transmits,
4545 			.maxlen		= sizeof(int),
4546 			.mode		= 0644,
4547 			.proc_handler	= proc_dointvec,
4548 		},
4549 		{
4550 			.procname	= "router_solicitations",
4551 			.data		= &ipv6_devconf.rtr_solicits,
4552 			.maxlen		= sizeof(int),
4553 			.mode		= 0644,
4554 			.proc_handler	= proc_dointvec,
4555 		},
4556 		{
4557 			.procname	= "router_solicitation_interval",
4558 			.data		= &ipv6_devconf.rtr_solicit_interval,
4559 			.maxlen		= sizeof(int),
4560 			.mode		= 0644,
4561 			.proc_handler	= proc_dointvec_jiffies,
4562 		},
4563 		{
4564 			.procname	= "router_solicitation_delay",
4565 			.data		= &ipv6_devconf.rtr_solicit_delay,
4566 			.maxlen		= sizeof(int),
4567 			.mode		= 0644,
4568 			.proc_handler	= proc_dointvec_jiffies,
4569 		},
4570 		{
4571 			.procname	= "force_mld_version",
4572 			.data		= &ipv6_devconf.force_mld_version,
4573 			.maxlen		= sizeof(int),
4574 			.mode		= 0644,
4575 			.proc_handler	= proc_dointvec,
4576 		},
4577 #ifdef CONFIG_IPV6_PRIVACY
4578 		{
4579 			.procname	= "use_tempaddr",
4580 			.data		= &ipv6_devconf.use_tempaddr,
4581 			.maxlen		= sizeof(int),
4582 			.mode		= 0644,
4583 			.proc_handler	= proc_dointvec,
4584 		},
4585 		{
4586 			.procname	= "temp_valid_lft",
4587 			.data		= &ipv6_devconf.temp_valid_lft,
4588 			.maxlen		= sizeof(int),
4589 			.mode		= 0644,
4590 			.proc_handler	= proc_dointvec,
4591 		},
4592 		{
4593 			.procname	= "temp_prefered_lft",
4594 			.data		= &ipv6_devconf.temp_prefered_lft,
4595 			.maxlen		= sizeof(int),
4596 			.mode		= 0644,
4597 			.proc_handler	= proc_dointvec,
4598 		},
4599 		{
4600 			.procname	= "regen_max_retry",
4601 			.data		= &ipv6_devconf.regen_max_retry,
4602 			.maxlen		= sizeof(int),
4603 			.mode		= 0644,
4604 			.proc_handler	= proc_dointvec,
4605 		},
4606 		{
4607 			.procname	= "max_desync_factor",
4608 			.data		= &ipv6_devconf.max_desync_factor,
4609 			.maxlen		= sizeof(int),
4610 			.mode		= 0644,
4611 			.proc_handler	= proc_dointvec,
4612 		},
4613 #endif
4614 		{
4615 			.procname	= "max_addresses",
4616 			.data		= &ipv6_devconf.max_addresses,
4617 			.maxlen		= sizeof(int),
4618 			.mode		= 0644,
4619 			.proc_handler	= proc_dointvec,
4620 		},
4621 		{
4622 			.procname	= "accept_ra_defrtr",
4623 			.data		= &ipv6_devconf.accept_ra_defrtr,
4624 			.maxlen		= sizeof(int),
4625 			.mode		= 0644,
4626 			.proc_handler	= proc_dointvec,
4627 		},
4628 		{
4629 			.procname	= "accept_ra_pinfo",
4630 			.data		= &ipv6_devconf.accept_ra_pinfo,
4631 			.maxlen		= sizeof(int),
4632 			.mode		= 0644,
4633 			.proc_handler	= proc_dointvec,
4634 		},
4635 #ifdef CONFIG_IPV6_ROUTER_PREF
4636 		{
4637 			.procname	= "accept_ra_rtr_pref",
4638 			.data		= &ipv6_devconf.accept_ra_rtr_pref,
4639 			.maxlen		= sizeof(int),
4640 			.mode		= 0644,
4641 			.proc_handler	= proc_dointvec,
4642 		},
4643 		{
4644 			.procname	= "router_probe_interval",
4645 			.data		= &ipv6_devconf.rtr_probe_interval,
4646 			.maxlen		= sizeof(int),
4647 			.mode		= 0644,
4648 			.proc_handler	= proc_dointvec_jiffies,
4649 		},
4650 #ifdef CONFIG_IPV6_ROUTE_INFO
4651 		{
4652 			.procname	= "accept_ra_rt_info_max_plen",
4653 			.data		= &ipv6_devconf.accept_ra_rt_info_max_plen,
4654 			.maxlen		= sizeof(int),
4655 			.mode		= 0644,
4656 			.proc_handler	= proc_dointvec,
4657 		},
4658 #endif
4659 #endif
4660 		{
4661 			.procname	= "proxy_ndp",
4662 			.data		= &ipv6_devconf.proxy_ndp,
4663 			.maxlen		= sizeof(int),
4664 			.mode		= 0644,
4665 			.proc_handler	= proc_dointvec,
4666 		},
4667 		{
4668 			.procname	= "accept_source_route",
4669 			.data		= &ipv6_devconf.accept_source_route,
4670 			.maxlen		= sizeof(int),
4671 			.mode		= 0644,
4672 			.proc_handler	= proc_dointvec,
4673 		},
4674 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
4675 		{
4676 			.procname       = "optimistic_dad",
4677 			.data           = &ipv6_devconf.optimistic_dad,
4678 			.maxlen         = sizeof(int),
4679 			.mode           = 0644,
4680 			.proc_handler   = proc_dointvec,
4681 
4682 		},
4683 #endif
4684 #ifdef CONFIG_IPV6_MROUTE
4685 		{
4686 			.procname	= "mc_forwarding",
4687 			.data		= &ipv6_devconf.mc_forwarding,
4688 			.maxlen		= sizeof(int),
4689 			.mode		= 0444,
4690 			.proc_handler	= proc_dointvec,
4691 		},
4692 #endif
4693 		{
4694 			.procname	= "disable_ipv6",
4695 			.data		= &ipv6_devconf.disable_ipv6,
4696 			.maxlen		= sizeof(int),
4697 			.mode		= 0644,
4698 			.proc_handler	= addrconf_sysctl_disable,
4699 		},
4700 		{
4701 			.procname	= "accept_dad",
4702 			.data		= &ipv6_devconf.accept_dad,
4703 			.maxlen		= sizeof(int),
4704 			.mode		= 0644,
4705 			.proc_handler	= proc_dointvec,
4706 		},
4707 		{
4708 			.procname       = "force_tllao",
4709 			.data           = &ipv6_devconf.force_tllao,
4710 			.maxlen         = sizeof(int),
4711 			.mode           = 0644,
4712 			.proc_handler   = proc_dointvec
4713 		},
4714 		{
4715 			.procname       = "ndisc_notify",
4716 			.data           = &ipv6_devconf.ndisc_notify,
4717 			.maxlen         = sizeof(int),
4718 			.mode           = 0644,
4719 			.proc_handler   = proc_dointvec
4720 		},
4721 		{
4722 			/* sentinel */
4723 		}
4724 	},
4725 };
4726 
4727 static int __addrconf_sysctl_register(struct net *net, char *dev_name,
4728 		struct inet6_dev *idev, struct ipv6_devconf *p)
4729 {
4730 	int i;
4731 	struct addrconf_sysctl_table *t;
4732 	char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
4733 
4734 	t = kmemdup(&addrconf_sysctl, sizeof(*t), GFP_KERNEL);
4735 	if (t == NULL)
4736 		goto out;
4737 
4738 	for (i = 0; t->addrconf_vars[i].data; i++) {
4739 		t->addrconf_vars[i].data += (char *)p - (char *)&ipv6_devconf;
4740 		t->addrconf_vars[i].extra1 = idev; /* embedded; no ref */
4741 		t->addrconf_vars[i].extra2 = net;
4742 	}
4743 
4744 	/* Don't export sysctls to unprivileged users */
4745 	if (net->user_ns != &init_user_ns)
4746 		t->addrconf_vars[0].procname = NULL;
4747 
4748 	snprintf(path, sizeof(path), "net/ipv6/conf/%s", dev_name);
4749 
4750 	t->sysctl_header = register_net_sysctl(net, path, t->addrconf_vars);
4751 	if (t->sysctl_header == NULL)
4752 		goto free;
4753 
4754 	p->sysctl = t;
4755 	return 0;
4756 
4757 free:
4758 	kfree(t);
4759 out:
4760 	return -ENOBUFS;
4761 }
4762 
4763 static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
4764 {
4765 	struct addrconf_sysctl_table *t;
4766 
4767 	if (p->sysctl == NULL)
4768 		return;
4769 
4770 	t = p->sysctl;
4771 	p->sysctl = NULL;
4772 	unregister_net_sysctl_table(t->sysctl_header);
4773 	kfree(t);
4774 }
4775 
4776 static void addrconf_sysctl_register(struct inet6_dev *idev)
4777 {
4778 	neigh_sysctl_register(idev->dev, idev->nd_parms, "ipv6",
4779 			      &ndisc_ifinfo_sysctl_change);
4780 	__addrconf_sysctl_register(dev_net(idev->dev), idev->dev->name,
4781 					idev, &idev->cnf);
4782 }
4783 
4784 static void addrconf_sysctl_unregister(struct inet6_dev *idev)
4785 {
4786 	__addrconf_sysctl_unregister(&idev->cnf);
4787 	neigh_sysctl_unregister(idev->nd_parms);
4788 }
4789 
4790 
4791 #endif
4792 
4793 static int __net_init addrconf_init_net(struct net *net)
4794 {
4795 	int err;
4796 	struct ipv6_devconf *all, *dflt;
4797 
4798 	err = -ENOMEM;
4799 	all = &ipv6_devconf;
4800 	dflt = &ipv6_devconf_dflt;
4801 
4802 	if (!net_eq(net, &init_net)) {
4803 		all = kmemdup(all, sizeof(ipv6_devconf), GFP_KERNEL);
4804 		if (all == NULL)
4805 			goto err_alloc_all;
4806 
4807 		dflt = kmemdup(dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
4808 		if (dflt == NULL)
4809 			goto err_alloc_dflt;
4810 	} else {
4811 		/* these will be inherited by all namespaces */
4812 		dflt->autoconf = ipv6_defaults.autoconf;
4813 		dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
4814 	}
4815 
4816 	net->ipv6.devconf_all = all;
4817 	net->ipv6.devconf_dflt = dflt;
4818 
4819 #ifdef CONFIG_SYSCTL
4820 	err = __addrconf_sysctl_register(net, "all", NULL, all);
4821 	if (err < 0)
4822 		goto err_reg_all;
4823 
4824 	err = __addrconf_sysctl_register(net, "default", NULL, dflt);
4825 	if (err < 0)
4826 		goto err_reg_dflt;
4827 #endif
4828 	return 0;
4829 
4830 #ifdef CONFIG_SYSCTL
4831 err_reg_dflt:
4832 	__addrconf_sysctl_unregister(all);
4833 err_reg_all:
4834 	kfree(dflt);
4835 #endif
4836 err_alloc_dflt:
4837 	kfree(all);
4838 err_alloc_all:
4839 	return err;
4840 }
4841 
4842 static void __net_exit addrconf_exit_net(struct net *net)
4843 {
4844 #ifdef CONFIG_SYSCTL
4845 	__addrconf_sysctl_unregister(net->ipv6.devconf_dflt);
4846 	__addrconf_sysctl_unregister(net->ipv6.devconf_all);
4847 #endif
4848 	if (!net_eq(net, &init_net)) {
4849 		kfree(net->ipv6.devconf_dflt);
4850 		kfree(net->ipv6.devconf_all);
4851 	}
4852 }
4853 
4854 static struct pernet_operations addrconf_ops = {
4855 	.init = addrconf_init_net,
4856 	.exit = addrconf_exit_net,
4857 };
4858 
4859 /*
4860  *      Device notifier
4861  */
4862 
4863 int register_inet6addr_notifier(struct notifier_block *nb)
4864 {
4865 	return atomic_notifier_chain_register(&inet6addr_chain, nb);
4866 }
4867 EXPORT_SYMBOL(register_inet6addr_notifier);
4868 
4869 int unregister_inet6addr_notifier(struct notifier_block *nb)
4870 {
4871 	return atomic_notifier_chain_unregister(&inet6addr_chain, nb);
4872 }
4873 EXPORT_SYMBOL(unregister_inet6addr_notifier);
4874 
4875 static struct rtnl_af_ops inet6_ops = {
4876 	.family		  = AF_INET6,
4877 	.fill_link_af	  = inet6_fill_link_af,
4878 	.get_link_af_size = inet6_get_link_af_size,
4879 };
4880 
4881 /*
4882  *	Init / cleanup code
4883  */
4884 
4885 int __init addrconf_init(void)
4886 {
4887 	int i, err;
4888 
4889 	err = ipv6_addr_label_init();
4890 	if (err < 0) {
4891 		pr_crit("%s: cannot initialize default policy table: %d\n",
4892 			__func__, err);
4893 		goto out;
4894 	}
4895 
4896 	err = register_pernet_subsys(&addrconf_ops);
4897 	if (err < 0)
4898 		goto out_addrlabel;
4899 
4900 	/* The addrconf netdev notifier requires that loopback_dev
4901 	 * has it's ipv6 private information allocated and setup
4902 	 * before it can bring up and give link-local addresses
4903 	 * to other devices which are up.
4904 	 *
4905 	 * Unfortunately, loopback_dev is not necessarily the first
4906 	 * entry in the global dev_base list of net devices.  In fact,
4907 	 * it is likely to be the very last entry on that list.
4908 	 * So this causes the notifier registry below to try and
4909 	 * give link-local addresses to all devices besides loopback_dev
4910 	 * first, then loopback_dev, which cases all the non-loopback_dev
4911 	 * devices to fail to get a link-local address.
4912 	 *
4913 	 * So, as a temporary fix, allocate the ipv6 structure for
4914 	 * loopback_dev first by hand.
4915 	 * Longer term, all of the dependencies ipv6 has upon the loopback
4916 	 * device and it being up should be removed.
4917 	 */
4918 	rtnl_lock();
4919 	if (!ipv6_add_dev(init_net.loopback_dev))
4920 		err = -ENOMEM;
4921 	rtnl_unlock();
4922 	if (err)
4923 		goto errlo;
4924 
4925 	for (i = 0; i < IN6_ADDR_HSIZE; i++)
4926 		INIT_HLIST_HEAD(&inet6_addr_lst[i]);
4927 
4928 	register_netdevice_notifier(&ipv6_dev_notf);
4929 
4930 	addrconf_verify(0);
4931 
4932 	err = rtnl_af_register(&inet6_ops);
4933 	if (err < 0)
4934 		goto errout_af;
4935 
4936 	err = __rtnl_register(PF_INET6, RTM_GETLINK, NULL, inet6_dump_ifinfo,
4937 			      NULL);
4938 	if (err < 0)
4939 		goto errout;
4940 
4941 	/* Only the first call to __rtnl_register can fail */
4942 	__rtnl_register(PF_INET6, RTM_NEWADDR, inet6_rtm_newaddr, NULL, NULL);
4943 	__rtnl_register(PF_INET6, RTM_DELADDR, inet6_rtm_deladdr, NULL, NULL);
4944 	__rtnl_register(PF_INET6, RTM_GETADDR, inet6_rtm_getaddr,
4945 			inet6_dump_ifaddr, NULL);
4946 	__rtnl_register(PF_INET6, RTM_GETMULTICAST, NULL,
4947 			inet6_dump_ifmcaddr, NULL);
4948 	__rtnl_register(PF_INET6, RTM_GETANYCAST, NULL,
4949 			inet6_dump_ifacaddr, NULL);
4950 	__rtnl_register(PF_INET6, RTM_GETNETCONF, inet6_netconf_get_devconf,
4951 			NULL, NULL);
4952 
4953 	ipv6_addr_label_rtnl_register();
4954 
4955 	return 0;
4956 errout:
4957 	rtnl_af_unregister(&inet6_ops);
4958 errout_af:
4959 	unregister_netdevice_notifier(&ipv6_dev_notf);
4960 errlo:
4961 	unregister_pernet_subsys(&addrconf_ops);
4962 out_addrlabel:
4963 	ipv6_addr_label_cleanup();
4964 out:
4965 	return err;
4966 }
4967 
4968 void addrconf_cleanup(void)
4969 {
4970 	struct net_device *dev;
4971 	int i;
4972 
4973 	unregister_netdevice_notifier(&ipv6_dev_notf);
4974 	unregister_pernet_subsys(&addrconf_ops);
4975 	ipv6_addr_label_cleanup();
4976 
4977 	rtnl_lock();
4978 
4979 	__rtnl_af_unregister(&inet6_ops);
4980 
4981 	/* clean dev list */
4982 	for_each_netdev(&init_net, dev) {
4983 		if (__in6_dev_get(dev) == NULL)
4984 			continue;
4985 		addrconf_ifdown(dev, 1);
4986 	}
4987 	addrconf_ifdown(init_net.loopback_dev, 2);
4988 
4989 	/*
4990 	 *	Check hash table.
4991 	 */
4992 	spin_lock_bh(&addrconf_hash_lock);
4993 	for (i = 0; i < IN6_ADDR_HSIZE; i++)
4994 		WARN_ON(!hlist_empty(&inet6_addr_lst[i]));
4995 	spin_unlock_bh(&addrconf_hash_lock);
4996 
4997 	del_timer(&addr_chk_timer);
4998 	rtnl_unlock();
4999 }
5000