xref: /openbmc/linux/net/ipv6/ip6_output.c (revision 8571ab479a6e1ef46ead5ebee567e128a422767c)
11da177e4SLinus Torvalds /*
21da177e4SLinus Torvalds  *	IPv6 output functions
31da177e4SLinus Torvalds  *	Linux INET6 implementation
41da177e4SLinus Torvalds  *
51da177e4SLinus Torvalds  *	Authors:
61da177e4SLinus Torvalds  *	Pedro Roque		<roque@di.fc.ul.pt>
71da177e4SLinus Torvalds  *
81da177e4SLinus Torvalds  *	Based on linux/net/ipv4/ip_output.c
91da177e4SLinus Torvalds  *
101da177e4SLinus Torvalds  *	This program is free software; you can redistribute it and/or
111da177e4SLinus Torvalds  *      modify it under the terms of the GNU General Public License
121da177e4SLinus Torvalds  *      as published by the Free Software Foundation; either version
131da177e4SLinus Torvalds  *      2 of the License, or (at your option) any later version.
141da177e4SLinus Torvalds  *
151da177e4SLinus Torvalds  *	Changes:
161da177e4SLinus Torvalds  *	A.N.Kuznetsov	:	airthmetics in fragmentation.
171da177e4SLinus Torvalds  *				extension headers are implemented.
181da177e4SLinus Torvalds  *				route changes now work.
191da177e4SLinus Torvalds  *				ip6_forward does not confuse sniffers.
201da177e4SLinus Torvalds  *				etc.
211da177e4SLinus Torvalds  *
221da177e4SLinus Torvalds  *      H. von Brand    :       Added missing #include <linux/string.h>
231da177e4SLinus Torvalds  *	Imran Patel	:	frag id should be in NBO
241da177e4SLinus Torvalds  *      Kazunori MIYAZAWA @USAGI
251da177e4SLinus Torvalds  *			:       add ip6_append_data and related functions
261da177e4SLinus Torvalds  *				for datagram xmit
271da177e4SLinus Torvalds  */
281da177e4SLinus Torvalds 
291da177e4SLinus Torvalds #include <linux/errno.h>
30ef76bc23SHerbert Xu #include <linux/kernel.h>
311da177e4SLinus Torvalds #include <linux/string.h>
321da177e4SLinus Torvalds #include <linux/socket.h>
331da177e4SLinus Torvalds #include <linux/net.h>
341da177e4SLinus Torvalds #include <linux/netdevice.h>
351da177e4SLinus Torvalds #include <linux/if_arp.h>
361da177e4SLinus Torvalds #include <linux/in6.h>
371da177e4SLinus Torvalds #include <linux/tcp.h>
381da177e4SLinus Torvalds #include <linux/route.h>
39b59f45d0SHerbert Xu #include <linux/module.h>
405a0e3ad6STejun Heo #include <linux/slab.h>
411da177e4SLinus Torvalds 
4233b48679SDaniel Mack #include <linux/bpf-cgroup.h>
431da177e4SLinus Torvalds #include <linux/netfilter.h>
441da177e4SLinus Torvalds #include <linux/netfilter_ipv6.h>
451da177e4SLinus Torvalds 
461da177e4SLinus Torvalds #include <net/sock.h>
471da177e4SLinus Torvalds #include <net/snmp.h>
481da177e4SLinus Torvalds 
491da177e4SLinus Torvalds #include <net/ipv6.h>
501da177e4SLinus Torvalds #include <net/ndisc.h>
511da177e4SLinus Torvalds #include <net/protocol.h>
521da177e4SLinus Torvalds #include <net/ip6_route.h>
531da177e4SLinus Torvalds #include <net/addrconf.h>
541da177e4SLinus Torvalds #include <net/rawv6.h>
551da177e4SLinus Torvalds #include <net/icmp.h>
561da177e4SLinus Torvalds #include <net/xfrm.h>
571da177e4SLinus Torvalds #include <net/checksum.h>
587bc570c8SYOSHIFUJI Hideaki #include <linux/mroute6.h>
59ca254490SDavid Ahern #include <net/l3mdev.h>
6014972cbdSRoopa Prabhu #include <net/lwtunnel.h>
611da177e4SLinus Torvalds 
627d8c6e39SEric W. Biederman static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
631da177e4SLinus Torvalds {
64adf30907SEric Dumazet 	struct dst_entry *dst = skb_dst(skb);
651da177e4SLinus Torvalds 	struct net_device *dev = dst->dev;
66f6b72b62SDavid S. Miller 	struct neighbour *neigh;
676fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 	struct in6_addr *nexthop;
686fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 	int ret;
691da177e4SLinus Torvalds 
700660e03fSArnaldo Carvalho de Melo 	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
71adf30907SEric Dumazet 		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
721da177e4SLinus Torvalds 
737026b1ddSDavid Miller 		if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(sk) &&
74*8571ab47SYuval Mintz 		    ((mroute6_is_socket(net, skb) &&
75bd91b8bfSBenjamin Thery 		     !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
760660e03fSArnaldo Carvalho de Melo 		     ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
777bc570c8SYOSHIFUJI Hideaki 					 &ipv6_hdr(skb)->saddr))) {
781da177e4SLinus Torvalds 			struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
791da177e4SLinus Torvalds 
801da177e4SLinus Torvalds 			/* Do not check for IFF_ALLMULTI; multicast routing
811da177e4SLinus Torvalds 			   is not supported in any case.
821da177e4SLinus Torvalds 			 */
831da177e4SLinus Torvalds 			if (newskb)
84b2e0b385SJan Engelhardt 				NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
8529a26a56SEric W. Biederman 					net, sk, newskb, NULL, newskb->dev,
8695603e22SMichel Machado 					dev_loopback_xmit);
871da177e4SLinus Torvalds 
880660e03fSArnaldo Carvalho de Melo 			if (ipv6_hdr(skb)->hop_limit == 0) {
8978126c41SEric W. Biederman 				IP6_INC_STATS(net, idev,
903bd653c8SDenis V. Lunev 					      IPSTATS_MIB_OUTDISCARDS);
911da177e4SLinus Torvalds 				kfree_skb(skb);
921da177e4SLinus Torvalds 				return 0;
931da177e4SLinus Torvalds 			}
941da177e4SLinus Torvalds 		}
951da177e4SLinus Torvalds 
9678126c41SEric W. Biederman 		IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, skb->len);
97dd408515SHannes Frederic Sowa 
98dd408515SHannes Frederic Sowa 		if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
99dd408515SHannes Frederic Sowa 		    IPV6_ADDR_SCOPE_NODELOCAL &&
100dd408515SHannes Frederic Sowa 		    !(dev->flags & IFF_LOOPBACK)) {
101dd408515SHannes Frederic Sowa 			kfree_skb(skb);
102dd408515SHannes Frederic Sowa 			return 0;
103dd408515SHannes Frederic Sowa 		}
1041da177e4SLinus Torvalds 	}
1051da177e4SLinus Torvalds 
10614972cbdSRoopa Prabhu 	if (lwtunnel_xmit_redirect(dst->lwtstate)) {
10714972cbdSRoopa Prabhu 		int res = lwtunnel_xmit(skb);
10814972cbdSRoopa Prabhu 
10914972cbdSRoopa Prabhu 		if (res < 0 || res == LWTUNNEL_XMIT_DONE)
11014972cbdSRoopa Prabhu 			return res;
11114972cbdSRoopa Prabhu 	}
11214972cbdSRoopa Prabhu 
1136fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 	rcu_read_lock_bh();
1142647a9b0SMartin KaFai Lau 	nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
1156fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 	neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
1166fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 	if (unlikely(!neigh))
1176fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 		neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
1186fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 	if (!IS_ERR(neigh)) {
1194ff06203SJulian Anastasov 		sock_confirm_neigh(skb, neigh);
120c16ec185SJulian Anastasov 		ret = neigh_output(neigh, skb);
1216fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 		rcu_read_unlock_bh();
1226fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 		return ret;
1236fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 	}
1246fd6ce20SYOSHIFUJI Hideaki / 吉藤英明 	rcu_read_unlock_bh();
12505e3aa09SDavid S. Miller 
12678126c41SEric W. Biederman 	IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
1279e508490SJan Engelhardt 	kfree_skb(skb);
1289e508490SJan Engelhardt 	return -EINVAL;
1291da177e4SLinus Torvalds }
1301da177e4SLinus Torvalds 
1310c4b51f0SEric W. Biederman static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
1329e508490SJan Engelhardt {
13333b48679SDaniel Mack 	int ret;
13433b48679SDaniel Mack 
13533b48679SDaniel Mack 	ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
13633b48679SDaniel Mack 	if (ret) {
13733b48679SDaniel Mack 		kfree_skb(skb);
13833b48679SDaniel Mack 		return ret;
13933b48679SDaniel Mack 	}
14033b48679SDaniel Mack 
14109ee9dbaSTobias Brunner #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
14209ee9dbaSTobias Brunner 	/* Policy lookup after SNAT yielded a new policy */
14309ee9dbaSTobias Brunner 	if (skb_dst(skb)->xfrm) {
14409ee9dbaSTobias Brunner 		IPCB(skb)->flags |= IPSKB_REROUTED;
14509ee9dbaSTobias Brunner 		return dst_output(net, sk, skb);
14609ee9dbaSTobias Brunner 	}
14709ee9dbaSTobias Brunner #endif
14809ee9dbaSTobias Brunner 
1499e508490SJan Engelhardt 	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
1509037c357SJiri Pirko 	    dst_allfrag(skb_dst(skb)) ||
1519037c357SJiri Pirko 	    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
1527d8c6e39SEric W. Biederman 		return ip6_fragment(net, sk, skb, ip6_finish_output2);
1539e508490SJan Engelhardt 	else
1547d8c6e39SEric W. Biederman 		return ip6_finish_output2(net, sk, skb);
1559e508490SJan Engelhardt }
1569e508490SJan Engelhardt 
157ede2059dSEric W. Biederman int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
1581da177e4SLinus Torvalds {
1599e508490SJan Engelhardt 	struct net_device *dev = skb_dst(skb)->dev;
160adf30907SEric Dumazet 	struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
161be10de0aSEric W. Biederman 
16297a7a37aSChenbo Feng 	skb->protocol = htons(ETH_P_IPV6);
16397a7a37aSChenbo Feng 	skb->dev = dev;
16497a7a37aSChenbo Feng 
165778d80beSYOSHIFUJI Hideaki 	if (unlikely(idev->cnf.disable_ipv6)) {
16619a0644cSEric W. Biederman 		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
167778d80beSYOSHIFUJI Hideaki 		kfree_skb(skb);
168778d80beSYOSHIFUJI Hideaki 		return 0;
169778d80beSYOSHIFUJI Hideaki 	}
170778d80beSYOSHIFUJI Hideaki 
17129a26a56SEric W. Biederman 	return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
17229a26a56SEric W. Biederman 			    net, sk, skb, NULL, dev,
1739c6eb28aSJan Engelhardt 			    ip6_finish_output,
1749c6eb28aSJan Engelhardt 			    !(IP6CB(skb)->flags & IP6SKB_REROUTED));
1751da177e4SLinus Torvalds }
1761da177e4SLinus Torvalds 
177e9191ffbSBen Hutchings bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np)
178513674b5SShaohua Li {
179513674b5SShaohua Li 	if (!np->autoflowlabel_set)
180513674b5SShaohua Li 		return ip6_default_np_autolabel(net);
181513674b5SShaohua Li 	else
182513674b5SShaohua Li 		return np->autoflowlabel;
183513674b5SShaohua Li }
184513674b5SShaohua Li 
1851da177e4SLinus Torvalds /*
186b5d43998SShan Wei  * xmit an sk_buff (used by TCP, SCTP and DCCP)
1871c1e9d2bSEric Dumazet  * Note : socket lock is not held for SYNACK packets, but might be modified
1881c1e9d2bSEric Dumazet  * by calls to skb_set_owner_w() and ipv6_local_error(),
1891c1e9d2bSEric Dumazet  * which are using proper atomic operations or spinlocks.
1901da177e4SLinus Torvalds  */
1911c1e9d2bSEric Dumazet int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
19292e55f41SPablo Neira 	     __u32 mark, struct ipv6_txoptions *opt, int tclass)
1931da177e4SLinus Torvalds {
1943bd653c8SDenis V. Lunev 	struct net *net = sock_net(sk);
1951c1e9d2bSEric Dumazet 	const struct ipv6_pinfo *np = inet6_sk(sk);
1964c9483b2SDavid S. Miller 	struct in6_addr *first_hop = &fl6->daddr;
197adf30907SEric Dumazet 	struct dst_entry *dst = skb_dst(skb);
1981da177e4SLinus Torvalds 	struct ipv6hdr *hdr;
1994c9483b2SDavid S. Miller 	u8  proto = fl6->flowi6_proto;
2001da177e4SLinus Torvalds 	int seg_len = skb->len;
201e651f03aSGerrit Renker 	int hlimit = -1;
2021da177e4SLinus Torvalds 	u32 mtu;
2031da177e4SLinus Torvalds 
2041da177e4SLinus Torvalds 	if (opt) {
205c2636b4dSChuck Lever 		unsigned int head_room;
2061da177e4SLinus Torvalds 
2071da177e4SLinus Torvalds 		/* First: exthdrs may take lots of space (~8K for now)
2081da177e4SLinus Torvalds 		   MAX_HEADER is not enough.
2091da177e4SLinus Torvalds 		 */
2101da177e4SLinus Torvalds 		head_room = opt->opt_nflen + opt->opt_flen;
2111da177e4SLinus Torvalds 		seg_len += head_room;
2121da177e4SLinus Torvalds 		head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
2131da177e4SLinus Torvalds 
2141da177e4SLinus Torvalds 		if (skb_headroom(skb) < head_room) {
2151da177e4SLinus Torvalds 			struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
21663159f29SIan Morris 			if (!skb2) {
217adf30907SEric Dumazet 				IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
218a11d206dSYOSHIFUJI Hideaki 					      IPSTATS_MIB_OUTDISCARDS);
2191da177e4SLinus Torvalds 				kfree_skb(skb);
2201da177e4SLinus Torvalds 				return -ENOBUFS;
2211da177e4SLinus Torvalds 			}
222808db80aSEric Dumazet 			consume_skb(skb);
223a11d206dSYOSHIFUJI Hideaki 			skb = skb2;
2241c1e9d2bSEric Dumazet 			/* skb_set_owner_w() changes sk->sk_wmem_alloc atomically,
2251c1e9d2bSEric Dumazet 			 * it is safe to call in our context (socket lock not held)
2261c1e9d2bSEric Dumazet 			 */
2271c1e9d2bSEric Dumazet 			skb_set_owner_w(skb, (struct sock *)sk);
2281da177e4SLinus Torvalds 		}
2291da177e4SLinus Torvalds 		if (opt->opt_flen)
2301da177e4SLinus Torvalds 			ipv6_push_frag_opts(skb, opt, &proto);
2311da177e4SLinus Torvalds 		if (opt->opt_nflen)
232613fa3caSDavid Lebrun 			ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop,
233613fa3caSDavid Lebrun 					     &fl6->saddr);
2341da177e4SLinus Torvalds 	}
2351da177e4SLinus Torvalds 
236e2d1bca7SArnaldo Carvalho de Melo 	skb_push(skb, sizeof(struct ipv6hdr));
237e2d1bca7SArnaldo Carvalho de Melo 	skb_reset_network_header(skb);
2380660e03fSArnaldo Carvalho de Melo 	hdr = ipv6_hdr(skb);
2391da177e4SLinus Torvalds 
2401da177e4SLinus Torvalds 	/*
2411da177e4SLinus Torvalds 	 *	Fill in the IPv6 header
2421da177e4SLinus Torvalds 	 */
243b903d324SEric Dumazet 	if (np)
2441da177e4SLinus Torvalds 		hlimit = np->hop_limit;
2451da177e4SLinus Torvalds 	if (hlimit < 0)
2466b75d090SYOSHIFUJI Hideaki 		hlimit = ip6_dst_hoplimit(dst);
2471da177e4SLinus Torvalds 
248cb1ce2efSTom Herbert 	ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
249513674b5SShaohua Li 				ip6_autoflowlabel(net, np), fl6));
25041a1f8eaSYOSHIFUJI Hideaki 
2511da177e4SLinus Torvalds 	hdr->payload_len = htons(seg_len);
2521da177e4SLinus Torvalds 	hdr->nexthdr = proto;
2531da177e4SLinus Torvalds 	hdr->hop_limit = hlimit;
2541da177e4SLinus Torvalds 
2554e3fd7a0SAlexey Dobriyan 	hdr->saddr = fl6->saddr;
2564e3fd7a0SAlexey Dobriyan 	hdr->daddr = *first_hop;
2571da177e4SLinus Torvalds 
2589c9c9ad5SHannes Frederic Sowa 	skb->protocol = htons(ETH_P_IPV6);
259a2c2064fSPatrick McHardy 	skb->priority = sk->sk_priority;
26092e55f41SPablo Neira 	skb->mark = mark;
261a2c2064fSPatrick McHardy 
2621da177e4SLinus Torvalds 	mtu = dst_mtu(dst);
26360ff7467SWANG Cong 	if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
264adf30907SEric Dumazet 		IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
265edf391ffSNeil Horman 			      IPSTATS_MIB_OUT, skb->len);
266a8e3e1a9SDavid Ahern 
267a8e3e1a9SDavid Ahern 		/* if egress device is enslaved to an L3 master device pass the
268a8e3e1a9SDavid Ahern 		 * skb to its handler for processing
269a8e3e1a9SDavid Ahern 		 */
270a8e3e1a9SDavid Ahern 		skb = l3mdev_ip6_out((struct sock *)sk, skb);
271a8e3e1a9SDavid Ahern 		if (unlikely(!skb))
272a8e3e1a9SDavid Ahern 			return 0;
273a8e3e1a9SDavid Ahern 
2741c1e9d2bSEric Dumazet 		/* hooks should never assume socket lock is held.
2751c1e9d2bSEric Dumazet 		 * we promote our socket to non const
2761c1e9d2bSEric Dumazet 		 */
27729a26a56SEric W. Biederman 		return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
2781c1e9d2bSEric Dumazet 			       net, (struct sock *)sk, skb, NULL, dst->dev,
27913206b6bSEric W. Biederman 			       dst_output);
2801da177e4SLinus Torvalds 	}
2811da177e4SLinus Torvalds 
2821da177e4SLinus Torvalds 	skb->dev = dst->dev;
2831c1e9d2bSEric Dumazet 	/* ipv6_local_error() does not require socket lock,
2841c1e9d2bSEric Dumazet 	 * we promote our socket to non const
2851c1e9d2bSEric Dumazet 	 */
2861c1e9d2bSEric Dumazet 	ipv6_local_error((struct sock *)sk, EMSGSIZE, fl6, mtu);
2871c1e9d2bSEric Dumazet 
288adf30907SEric Dumazet 	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
2891da177e4SLinus Torvalds 	kfree_skb(skb);
2901da177e4SLinus Torvalds 	return -EMSGSIZE;
2911da177e4SLinus Torvalds }
2927159039aSYOSHIFUJI Hideaki EXPORT_SYMBOL(ip6_xmit);
2937159039aSYOSHIFUJI Hideaki 
2941da177e4SLinus Torvalds static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
2951da177e4SLinus Torvalds {
2961da177e4SLinus Torvalds 	struct ip6_ra_chain *ra;
2971da177e4SLinus Torvalds 	struct sock *last = NULL;
2981da177e4SLinus Torvalds 
2991da177e4SLinus Torvalds 	read_lock(&ip6_ra_lock);
3001da177e4SLinus Torvalds 	for (ra = ip6_ra_chain; ra; ra = ra->next) {
3011da177e4SLinus Torvalds 		struct sock *sk = ra->sk;
3020bd1b59bSAndrew McDonald 		if (sk && ra->sel == sel &&
3030bd1b59bSAndrew McDonald 		    (!sk->sk_bound_dev_if ||
3040bd1b59bSAndrew McDonald 		     sk->sk_bound_dev_if == skb->dev->ifindex)) {
3051da177e4SLinus Torvalds 			if (last) {
3061da177e4SLinus Torvalds 				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
3071da177e4SLinus Torvalds 				if (skb2)
3081da177e4SLinus Torvalds 					rawv6_rcv(last, skb2);
3091da177e4SLinus Torvalds 			}
3101da177e4SLinus Torvalds 			last = sk;
3111da177e4SLinus Torvalds 		}
3121da177e4SLinus Torvalds 	}
3131da177e4SLinus Torvalds 
3141da177e4SLinus Torvalds 	if (last) {
3151da177e4SLinus Torvalds 		rawv6_rcv(last, skb);
3161da177e4SLinus Torvalds 		read_unlock(&ip6_ra_lock);
3171da177e4SLinus Torvalds 		return 1;
3181da177e4SLinus Torvalds 	}
3191da177e4SLinus Torvalds 	read_unlock(&ip6_ra_lock);
3201da177e4SLinus Torvalds 	return 0;
3211da177e4SLinus Torvalds }
3221da177e4SLinus Torvalds 
323e21e0b5fSVille Nuorvala static int ip6_forward_proxy_check(struct sk_buff *skb)
324e21e0b5fSVille Nuorvala {
3250660e03fSArnaldo Carvalho de Melo 	struct ipv6hdr *hdr = ipv6_hdr(skb);
326e21e0b5fSVille Nuorvala 	u8 nexthdr = hdr->nexthdr;
32775f2811cSJesse Gross 	__be16 frag_off;
328e21e0b5fSVille Nuorvala 	int offset;
329e21e0b5fSVille Nuorvala 
330e21e0b5fSVille Nuorvala 	if (ipv6_ext_hdr(nexthdr)) {
33175f2811cSJesse Gross 		offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
332e21e0b5fSVille Nuorvala 		if (offset < 0)
333e21e0b5fSVille Nuorvala 			return 0;
334e21e0b5fSVille Nuorvala 	} else
335e21e0b5fSVille Nuorvala 		offset = sizeof(struct ipv6hdr);
336e21e0b5fSVille Nuorvala 
337e21e0b5fSVille Nuorvala 	if (nexthdr == IPPROTO_ICMPV6) {
338e21e0b5fSVille Nuorvala 		struct icmp6hdr *icmp6;
339e21e0b5fSVille Nuorvala 
340d56f90a7SArnaldo Carvalho de Melo 		if (!pskb_may_pull(skb, (skb_network_header(skb) +
341d56f90a7SArnaldo Carvalho de Melo 					 offset + 1 - skb->data)))
342e21e0b5fSVille Nuorvala 			return 0;
343e21e0b5fSVille Nuorvala 
344d56f90a7SArnaldo Carvalho de Melo 		icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
345e21e0b5fSVille Nuorvala 
346e21e0b5fSVille Nuorvala 		switch (icmp6->icmp6_type) {
347e21e0b5fSVille Nuorvala 		case NDISC_ROUTER_SOLICITATION:
348e21e0b5fSVille Nuorvala 		case NDISC_ROUTER_ADVERTISEMENT:
349e21e0b5fSVille Nuorvala 		case NDISC_NEIGHBOUR_SOLICITATION:
350e21e0b5fSVille Nuorvala 		case NDISC_NEIGHBOUR_ADVERTISEMENT:
351e21e0b5fSVille Nuorvala 		case NDISC_REDIRECT:
352e21e0b5fSVille Nuorvala 			/* For reaction involving unicast neighbor discovery
353e21e0b5fSVille Nuorvala 			 * message destined to the proxied address, pass it to
354e21e0b5fSVille Nuorvala 			 * input function.
355e21e0b5fSVille Nuorvala 			 */
356e21e0b5fSVille Nuorvala 			return 1;
357e21e0b5fSVille Nuorvala 		default:
358e21e0b5fSVille Nuorvala 			break;
359e21e0b5fSVille Nuorvala 		}
360e21e0b5fSVille Nuorvala 	}
361e21e0b5fSVille Nuorvala 
36274553b09SVille Nuorvala 	/*
36374553b09SVille Nuorvala 	 * The proxying router can't forward traffic sent to a link-local
36474553b09SVille Nuorvala 	 * address, so signal the sender and discard the packet. This
36574553b09SVille Nuorvala 	 * behavior is clarified by the MIPv6 specification.
36674553b09SVille Nuorvala 	 */
36774553b09SVille Nuorvala 	if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
36874553b09SVille Nuorvala 		dst_link_failure(skb);
36974553b09SVille Nuorvala 		return -1;
37074553b09SVille Nuorvala 	}
37174553b09SVille Nuorvala 
372e21e0b5fSVille Nuorvala 	return 0;
373e21e0b5fSVille Nuorvala }
374e21e0b5fSVille Nuorvala 
3750c4b51f0SEric W. Biederman static inline int ip6_forward_finish(struct net *net, struct sock *sk,
3760c4b51f0SEric W. Biederman 				     struct sk_buff *skb)
3771da177e4SLinus Torvalds {
37813206b6bSEric W. Biederman 	return dst_output(net, sk, skb);
3791da177e4SLinus Torvalds }
3801da177e4SLinus Torvalds 
38109952107SPablo Neira Ayuso unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
3820954cf9cSHannes Frederic Sowa {
3830954cf9cSHannes Frederic Sowa 	unsigned int mtu;
3840954cf9cSHannes Frederic Sowa 	struct inet6_dev *idev;
3850954cf9cSHannes Frederic Sowa 
3860954cf9cSHannes Frederic Sowa 	if (dst_metric_locked(dst, RTAX_MTU)) {
3870954cf9cSHannes Frederic Sowa 		mtu = dst_metric_raw(dst, RTAX_MTU);
3880954cf9cSHannes Frederic Sowa 		if (mtu)
3890954cf9cSHannes Frederic Sowa 			return mtu;
3900954cf9cSHannes Frederic Sowa 	}
3910954cf9cSHannes Frederic Sowa 
3920954cf9cSHannes Frederic Sowa 	mtu = IPV6_MIN_MTU;
3930954cf9cSHannes Frederic Sowa 	rcu_read_lock();
3940954cf9cSHannes Frederic Sowa 	idev = __in6_dev_get(dst->dev);
3950954cf9cSHannes Frederic Sowa 	if (idev)
3960954cf9cSHannes Frederic Sowa 		mtu = idev->cnf.mtu6;
3970954cf9cSHannes Frederic Sowa 	rcu_read_unlock();
3980954cf9cSHannes Frederic Sowa 
3990954cf9cSHannes Frederic Sowa 	return mtu;
4000954cf9cSHannes Frederic Sowa }
40109952107SPablo Neira Ayuso EXPORT_SYMBOL_GPL(ip6_dst_mtu_forward);
4020954cf9cSHannes Frederic Sowa 
403fe6cc55fSFlorian Westphal static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
404fe6cc55fSFlorian Westphal {
405418a3156SFlorian Westphal 	if (skb->len <= mtu)
406fe6cc55fSFlorian Westphal 		return false;
407fe6cc55fSFlorian Westphal 
40860ff7467SWANG Cong 	/* ipv6 conntrack defrag sets max_frag_size + ignore_df */
409fe6cc55fSFlorian Westphal 	if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
410fe6cc55fSFlorian Westphal 		return true;
411fe6cc55fSFlorian Westphal 
41260ff7467SWANG Cong 	if (skb->ignore_df)
413418a3156SFlorian Westphal 		return false;
414418a3156SFlorian Westphal 
415ae7ef81eSMarcelo Ricardo Leitner 	if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
416fe6cc55fSFlorian Westphal 		return false;
417fe6cc55fSFlorian Westphal 
418fe6cc55fSFlorian Westphal 	return true;
419fe6cc55fSFlorian Westphal }
420fe6cc55fSFlorian Westphal 
4211da177e4SLinus Torvalds int ip6_forward(struct sk_buff *skb)
4221da177e4SLinus Torvalds {
423adf30907SEric Dumazet 	struct dst_entry *dst = skb_dst(skb);
4240660e03fSArnaldo Carvalho de Melo 	struct ipv6hdr *hdr = ipv6_hdr(skb);
4251da177e4SLinus Torvalds 	struct inet6_skb_parm *opt = IP6CB(skb);
426c346dca1SYOSHIFUJI Hideaki 	struct net *net = dev_net(dst->dev);
42714f3ad6fSUlrich Weber 	u32 mtu;
4281da177e4SLinus Torvalds 
42953b7997fSYOSHIFUJI Hideaki 	if (net->ipv6.devconf_all->forwarding == 0)
4301da177e4SLinus Torvalds 		goto error;
4311da177e4SLinus Torvalds 
432090f1166SLi RongQing 	if (skb->pkt_type != PACKET_HOST)
433090f1166SLi RongQing 		goto drop;
434090f1166SLi RongQing 
4359ef2e965SHannes Frederic Sowa 	if (unlikely(skb->sk))
4369ef2e965SHannes Frederic Sowa 		goto drop;
4379ef2e965SHannes Frederic Sowa 
4384497b076SBen Hutchings 	if (skb_warn_if_lro(skb))
4394497b076SBen Hutchings 		goto drop;
4404497b076SBen Hutchings 
4411da177e4SLinus Torvalds 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
4421d015503SEric Dumazet 		__IP6_INC_STATS(net, ip6_dst_idev(dst),
44315c77d8bSEric Dumazet 				IPSTATS_MIB_INDISCARDS);
4441da177e4SLinus Torvalds 		goto drop;
4451da177e4SLinus Torvalds 	}
4461da177e4SLinus Torvalds 
44735fc92a9SHerbert Xu 	skb_forward_csum(skb);
4481da177e4SLinus Torvalds 
4491da177e4SLinus Torvalds 	/*
4501da177e4SLinus Torvalds 	 *	We DO NOT make any processing on
4511da177e4SLinus Torvalds 	 *	RA packets, pushing them to user level AS IS
4521da177e4SLinus Torvalds 	 *	without ane WARRANTY that application will be able
4531da177e4SLinus Torvalds 	 *	to interpret them. The reason is that we
4541da177e4SLinus Torvalds 	 *	cannot make anything clever here.
4551da177e4SLinus Torvalds 	 *
4561da177e4SLinus Torvalds 	 *	We are not end-node, so that if packet contains
4571da177e4SLinus Torvalds 	 *	AH/ESP, we cannot make anything.
4581da177e4SLinus Torvalds 	 *	Defragmentation also would be mistake, RA packets
4591da177e4SLinus Torvalds 	 *	cannot be fragmented, because there is no warranty
4601da177e4SLinus Torvalds 	 *	that different fragments will go along one path. --ANK
4611da177e4SLinus Torvalds 	 */
462ab4eb353SYOSHIFUJI Hideaki / 吉藤英明 	if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
463ab4eb353SYOSHIFUJI Hideaki / 吉藤英明 		if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
4641da177e4SLinus Torvalds 			return 0;
4651da177e4SLinus Torvalds 	}
4661da177e4SLinus Torvalds 
4671da177e4SLinus Torvalds 	/*
4681da177e4SLinus Torvalds 	 *	check and decrement ttl
4691da177e4SLinus Torvalds 	 */
4701da177e4SLinus Torvalds 	if (hdr->hop_limit <= 1) {
4711da177e4SLinus Torvalds 		/* Force OUTPUT device used as source address */
4721da177e4SLinus Torvalds 		skb->dev = dst->dev;
4733ffe533cSAlexey Dobriyan 		icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
4741d015503SEric Dumazet 		__IP6_INC_STATS(net, ip6_dst_idev(dst),
47515c77d8bSEric Dumazet 				IPSTATS_MIB_INHDRERRORS);
4761da177e4SLinus Torvalds 
4771da177e4SLinus Torvalds 		kfree_skb(skb);
4781da177e4SLinus Torvalds 		return -ETIMEDOUT;
4791da177e4SLinus Torvalds 	}
4801da177e4SLinus Torvalds 
481fbea49e1SYOSHIFUJI Hideaki 	/* XXX: idev->cnf.proxy_ndp? */
48253b7997fSYOSHIFUJI Hideaki 	if (net->ipv6.devconf_all->proxy_ndp &&
4838a3edd80SDaniel Lezcano 	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
48474553b09SVille Nuorvala 		int proxied = ip6_forward_proxy_check(skb);
48574553b09SVille Nuorvala 		if (proxied > 0)
486e21e0b5fSVille Nuorvala 			return ip6_input(skb);
48774553b09SVille Nuorvala 		else if (proxied < 0) {
4881d015503SEric Dumazet 			__IP6_INC_STATS(net, ip6_dst_idev(dst),
4893bd653c8SDenis V. Lunev 					IPSTATS_MIB_INDISCARDS);
49074553b09SVille Nuorvala 			goto drop;
49174553b09SVille Nuorvala 		}
492e21e0b5fSVille Nuorvala 	}
493e21e0b5fSVille Nuorvala 
4941da177e4SLinus Torvalds 	if (!xfrm6_route_forward(skb)) {
4951d015503SEric Dumazet 		__IP6_INC_STATS(net, ip6_dst_idev(dst),
49615c77d8bSEric Dumazet 				IPSTATS_MIB_INDISCARDS);
4971da177e4SLinus Torvalds 		goto drop;
4981da177e4SLinus Torvalds 	}
499adf30907SEric Dumazet 	dst = skb_dst(skb);
5001da177e4SLinus Torvalds 
5011da177e4SLinus Torvalds 	/* IPv6 specs say nothing about it, but it is clear that we cannot
5021da177e4SLinus Torvalds 	   send redirects to source routed frames.
5031e5dc146SMasahide NAKAMURA 	   We don't send redirects to frames decapsulated from IPsec.
5041da177e4SLinus Torvalds 	 */
505c45a3dfbSDavid S. Miller 	if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
5061da177e4SLinus Torvalds 		struct in6_addr *target = NULL;
507fbfe95a4SDavid S. Miller 		struct inet_peer *peer;
5081da177e4SLinus Torvalds 		struct rt6_info *rt;
5091da177e4SLinus Torvalds 
5101da177e4SLinus Torvalds 		/*
5111da177e4SLinus Torvalds 		 *	incoming and outgoing devices are the same
5121da177e4SLinus Torvalds 		 *	send a redirect.
5131da177e4SLinus Torvalds 		 */
5141da177e4SLinus Torvalds 
5151da177e4SLinus Torvalds 		rt = (struct rt6_info *) dst;
516c45a3dfbSDavid S. Miller 		if (rt->rt6i_flags & RTF_GATEWAY)
517c45a3dfbSDavid S. Miller 			target = &rt->rt6i_gateway;
5181da177e4SLinus Torvalds 		else
5191da177e4SLinus Torvalds 			target = &hdr->daddr;
5201da177e4SLinus Torvalds 
521fd0273d7SMartin KaFai Lau 		peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1);
52292d86829SDavid S. Miller 
5231da177e4SLinus Torvalds 		/* Limit redirects both by destination (here)
5241da177e4SLinus Torvalds 		   and by source (inside ndisc_send_redirect)
5251da177e4SLinus Torvalds 		 */
526fbfe95a4SDavid S. Miller 		if (inet_peer_xrlim_allow(peer, 1*HZ))
5274991969aSDavid S. Miller 			ndisc_send_redirect(skb, target);
5281d861aa4SDavid S. Miller 		if (peer)
5291d861aa4SDavid S. Miller 			inet_putpeer(peer);
5305bb1ab09SDavid L Stevens 	} else {
5315bb1ab09SDavid L Stevens 		int addrtype = ipv6_addr_type(&hdr->saddr);
5325bb1ab09SDavid L Stevens 
5331da177e4SLinus Torvalds 		/* This check is security critical. */
534f81b2e7dSYOSHIFUJI Hideaki 		if (addrtype == IPV6_ADDR_ANY ||
535f81b2e7dSYOSHIFUJI Hideaki 		    addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
5361da177e4SLinus Torvalds 			goto error;
5375bb1ab09SDavid L Stevens 		if (addrtype & IPV6_ADDR_LINKLOCAL) {
5385bb1ab09SDavid L Stevens 			icmpv6_send(skb, ICMPV6_DEST_UNREACH,
5393ffe533cSAlexey Dobriyan 				    ICMPV6_NOT_NEIGHBOUR, 0);
5405bb1ab09SDavid L Stevens 			goto error;
5415bb1ab09SDavid L Stevens 		}
5421da177e4SLinus Torvalds 	}
5431da177e4SLinus Torvalds 
5440954cf9cSHannes Frederic Sowa 	mtu = ip6_dst_mtu_forward(dst);
54514f3ad6fSUlrich Weber 	if (mtu < IPV6_MIN_MTU)
54614f3ad6fSUlrich Weber 		mtu = IPV6_MIN_MTU;
54714f3ad6fSUlrich Weber 
548fe6cc55fSFlorian Westphal 	if (ip6_pkt_too_big(skb, mtu)) {
5491da177e4SLinus Torvalds 		/* Again, force OUTPUT device used as source address */
5501da177e4SLinus Torvalds 		skb->dev = dst->dev;
55114f3ad6fSUlrich Weber 		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
5521d015503SEric Dumazet 		__IP6_INC_STATS(net, ip6_dst_idev(dst),
55315c77d8bSEric Dumazet 				IPSTATS_MIB_INTOOBIGERRORS);
5541d015503SEric Dumazet 		__IP6_INC_STATS(net, ip6_dst_idev(dst),
55515c77d8bSEric Dumazet 				IPSTATS_MIB_FRAGFAILS);
5561da177e4SLinus Torvalds 		kfree_skb(skb);
5571da177e4SLinus Torvalds 		return -EMSGSIZE;
5581da177e4SLinus Torvalds 	}
5591da177e4SLinus Torvalds 
5601da177e4SLinus Torvalds 	if (skb_cow(skb, dst->dev->hard_header_len)) {
5611d015503SEric Dumazet 		__IP6_INC_STATS(net, ip6_dst_idev(dst),
56215c77d8bSEric Dumazet 				IPSTATS_MIB_OUTDISCARDS);
5631da177e4SLinus Torvalds 		goto drop;
5641da177e4SLinus Torvalds 	}
5651da177e4SLinus Torvalds 
5660660e03fSArnaldo Carvalho de Melo 	hdr = ipv6_hdr(skb);
5671da177e4SLinus Torvalds 
5681da177e4SLinus Torvalds 	/* Mangling hops number delayed to point after skb COW */
5691da177e4SLinus Torvalds 
5701da177e4SLinus Torvalds 	hdr->hop_limit--;
5711da177e4SLinus Torvalds 
5721d015503SEric Dumazet 	__IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
5731d015503SEric Dumazet 	__IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
57429a26a56SEric W. Biederman 	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
57529a26a56SEric W. Biederman 		       net, NULL, skb, skb->dev, dst->dev,
5766e23ae2aSPatrick McHardy 		       ip6_forward_finish);
5771da177e4SLinus Torvalds 
5781da177e4SLinus Torvalds error:
5791d015503SEric Dumazet 	__IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
5801da177e4SLinus Torvalds drop:
5811da177e4SLinus Torvalds 	kfree_skb(skb);
5821da177e4SLinus Torvalds 	return -EINVAL;
5831da177e4SLinus Torvalds }
5841da177e4SLinus Torvalds 
5851da177e4SLinus Torvalds static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
5861da177e4SLinus Torvalds {
5871da177e4SLinus Torvalds 	to->pkt_type = from->pkt_type;
5881da177e4SLinus Torvalds 	to->priority = from->priority;
5891da177e4SLinus Torvalds 	to->protocol = from->protocol;
590adf30907SEric Dumazet 	skb_dst_drop(to);
591adf30907SEric Dumazet 	skb_dst_set(to, dst_clone(skb_dst(from)));
5921da177e4SLinus Torvalds 	to->dev = from->dev;
59382e91ffeSThomas Graf 	to->mark = from->mark;
5941da177e4SLinus Torvalds 
5951da177e4SLinus Torvalds #ifdef CONFIG_NET_SCHED
5961da177e4SLinus Torvalds 	to->tc_index = from->tc_index;
5971da177e4SLinus Torvalds #endif
598e7ac05f3SYasuyuki Kozakai 	nf_copy(to, from);
599984bc16cSJames Morris 	skb_copy_secmark(to, from);
6001da177e4SLinus Torvalds }
6011da177e4SLinus Torvalds 
6027d8c6e39SEric W. Biederman int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
6037d8c6e39SEric W. Biederman 		 int (*output)(struct net *, struct sock *, struct sk_buff *))
6041da177e4SLinus Torvalds {
6051da177e4SLinus Torvalds 	struct sk_buff *frag;
606adf30907SEric Dumazet 	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
607f60e5990Shannes@stressinduktion.org 	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
608f60e5990Shannes@stressinduktion.org 				inet6_sk(skb->sk) : NULL;
6091da177e4SLinus Torvalds 	struct ipv6hdr *tmp_hdr;
6101da177e4SLinus Torvalds 	struct frag_hdr *fh;
6111da177e4SLinus Torvalds 	unsigned int mtu, hlen, left, len;
612a7ae1992SHerbert Xu 	int hroom, troom;
613286c2349SMartin KaFai Lau 	__be32 frag_id;
6141da177e4SLinus Torvalds 	int ptr, offset = 0, err = 0;
6151da177e4SLinus Torvalds 	u8 *prevhdr, nexthdr = 0;
6161da177e4SLinus Torvalds 
6177dd7eb95SDavid S. Miller 	err = ip6_find_1stfragopt(skb, &prevhdr);
6187dd7eb95SDavid S. Miller 	if (err < 0)
6192423496aSCraig Gallek 		goto fail;
6207dd7eb95SDavid S. Miller 	hlen = err;
6211da177e4SLinus Torvalds 	nexthdr = *prevhdr;
6221da177e4SLinus Torvalds 
623628a5c56SJohn Heffner 	mtu = ip6_skb_dst_mtu(skb);
624b881ef76SJohn Heffner 
625b881ef76SJohn Heffner 	/* We must not fragment if the socket is set to force MTU discovery
62614f3ad6fSUlrich Weber 	 * or if the skb it not generated by a local socket.
627b881ef76SJohn Heffner 	 */
628485fca66SFlorian Westphal 	if (unlikely(!skb->ignore_df && skb->len > mtu))
629485fca66SFlorian Westphal 		goto fail_toobig;
630a34a101eSEric Dumazet 
631485fca66SFlorian Westphal 	if (IP6CB(skb)->frag_max_size) {
632485fca66SFlorian Westphal 		if (IP6CB(skb)->frag_max_size > mtu)
633485fca66SFlorian Westphal 			goto fail_toobig;
634485fca66SFlorian Westphal 
635485fca66SFlorian Westphal 		/* don't send fragments larger than what we received */
636485fca66SFlorian Westphal 		mtu = IP6CB(skb)->frag_max_size;
637485fca66SFlorian Westphal 		if (mtu < IPV6_MIN_MTU)
638485fca66SFlorian Westphal 			mtu = IPV6_MIN_MTU;
639b881ef76SJohn Heffner 	}
640b881ef76SJohn Heffner 
641d91675f9SYOSHIFUJI Hideaki 	if (np && np->frag_size < mtu) {
642d91675f9SYOSHIFUJI Hideaki 		if (np->frag_size)
643d91675f9SYOSHIFUJI Hideaki 			mtu = np->frag_size;
644d91675f9SYOSHIFUJI Hideaki 	}
64589bc7848SHannes Frederic Sowa 	if (mtu < hlen + sizeof(struct frag_hdr) + 8)
646b72a2b01SHannes Frederic Sowa 		goto fail_toobig;
6471e0d69a9SHannes Frederic Sowa 	mtu -= hlen + sizeof(struct frag_hdr);
6481da177e4SLinus Torvalds 
649fd0273d7SMartin KaFai Lau 	frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
650fd0273d7SMartin KaFai Lau 				    &ipv6_hdr(skb)->saddr);
651286c2349SMartin KaFai Lau 
652405c92f7SHannes Frederic Sowa 	if (skb->ip_summed == CHECKSUM_PARTIAL &&
653405c92f7SHannes Frederic Sowa 	    (err = skb_checksum_help(skb)))
654405c92f7SHannes Frederic Sowa 		goto fail;
655405c92f7SHannes Frederic Sowa 
6561d325d21SFlorian Westphal 	hroom = LL_RESERVED_SPACE(rt->dst.dev);
65721dc3301SDavid S. Miller 	if (skb_has_frag_list(skb)) {
658c72d8cdaSAlexey Dobriyan 		unsigned int first_len = skb_pagelen(skb);
6593d13008eSEric Dumazet 		struct sk_buff *frag2;
6601da177e4SLinus Torvalds 
6611da177e4SLinus Torvalds 		if (first_len - hlen > mtu ||
6621da177e4SLinus Torvalds 		    ((first_len - hlen) & 7) ||
6631d325d21SFlorian Westphal 		    skb_cloned(skb) ||
6641d325d21SFlorian Westphal 		    skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
6651da177e4SLinus Torvalds 			goto slow_path;
6661da177e4SLinus Torvalds 
6674d9092bbSDavid S. Miller 		skb_walk_frags(skb, frag) {
6681da177e4SLinus Torvalds 			/* Correct geometry. */
6691da177e4SLinus Torvalds 			if (frag->len > mtu ||
6701da177e4SLinus Torvalds 			    ((frag->len & 7) && frag->next) ||
6711d325d21SFlorian Westphal 			    skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))
6723d13008eSEric Dumazet 				goto slow_path_clean;
6731da177e4SLinus Torvalds 
6741da177e4SLinus Torvalds 			/* Partially cloned skb? */
6751da177e4SLinus Torvalds 			if (skb_shared(frag))
6763d13008eSEric Dumazet 				goto slow_path_clean;
6772fdba6b0SHerbert Xu 
6782fdba6b0SHerbert Xu 			BUG_ON(frag->sk);
6792fdba6b0SHerbert Xu 			if (skb->sk) {
6802fdba6b0SHerbert Xu 				frag->sk = skb->sk;
6812fdba6b0SHerbert Xu 				frag->destructor = sock_wfree;
6822fdba6b0SHerbert Xu 			}
6833d13008eSEric Dumazet 			skb->truesize -= frag->truesize;
6841da177e4SLinus Torvalds 		}
6851da177e4SLinus Torvalds 
6861da177e4SLinus Torvalds 		err = 0;
6871da177e4SLinus Torvalds 		offset = 0;
6881da177e4SLinus Torvalds 		/* BUILD HEADER */
6891da177e4SLinus Torvalds 
6909a217a1cSYOSHIFUJI Hideaki 		*prevhdr = NEXTHDR_FRAGMENT;
691d56f90a7SArnaldo Carvalho de Melo 		tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
6921da177e4SLinus Torvalds 		if (!tmp_hdr) {
6931d325d21SFlorian Westphal 			err = -ENOMEM;
6941d325d21SFlorian Westphal 			goto fail;
6951da177e4SLinus Torvalds 		}
6961d325d21SFlorian Westphal 		frag = skb_shinfo(skb)->frag_list;
6971d325d21SFlorian Westphal 		skb_frag_list_init(skb);
6981da177e4SLinus Torvalds 
6991da177e4SLinus Torvalds 		__skb_pull(skb, hlen);
700d58ff351SJohannes Berg 		fh = __skb_push(skb, sizeof(struct frag_hdr));
701e2d1bca7SArnaldo Carvalho de Melo 		__skb_push(skb, hlen);
702e2d1bca7SArnaldo Carvalho de Melo 		skb_reset_network_header(skb);
703d56f90a7SArnaldo Carvalho de Melo 		memcpy(skb_network_header(skb), tmp_hdr, hlen);
7041da177e4SLinus Torvalds 
7051da177e4SLinus Torvalds 		fh->nexthdr = nexthdr;
7061da177e4SLinus Torvalds 		fh->reserved = 0;
7071da177e4SLinus Torvalds 		fh->frag_off = htons(IP6_MF);
708286c2349SMartin KaFai Lau 		fh->identification = frag_id;
7091da177e4SLinus Torvalds 
7101da177e4SLinus Torvalds 		first_len = skb_pagelen(skb);
7111da177e4SLinus Torvalds 		skb->data_len = first_len - skb_headlen(skb);
7121da177e4SLinus Torvalds 		skb->len = first_len;
7130660e03fSArnaldo Carvalho de Melo 		ipv6_hdr(skb)->payload_len = htons(first_len -
7140660e03fSArnaldo Carvalho de Melo 						   sizeof(struct ipv6hdr));
7151da177e4SLinus Torvalds 
7161da177e4SLinus Torvalds 		for (;;) {
7171da177e4SLinus Torvalds 			/* Prepare header of the next frame,
7181da177e4SLinus Torvalds 			 * before previous one went down. */
7191da177e4SLinus Torvalds 			if (frag) {
7201da177e4SLinus Torvalds 				frag->ip_summed = CHECKSUM_NONE;
721badff6d0SArnaldo Carvalho de Melo 				skb_reset_transport_header(frag);
722d58ff351SJohannes Berg 				fh = __skb_push(frag, sizeof(struct frag_hdr));
723e2d1bca7SArnaldo Carvalho de Melo 				__skb_push(frag, hlen);
724e2d1bca7SArnaldo Carvalho de Melo 				skb_reset_network_header(frag);
725d56f90a7SArnaldo Carvalho de Melo 				memcpy(skb_network_header(frag), tmp_hdr,
726d56f90a7SArnaldo Carvalho de Melo 				       hlen);
7271da177e4SLinus Torvalds 				offset += skb->len - hlen - sizeof(struct frag_hdr);
7281da177e4SLinus Torvalds 				fh->nexthdr = nexthdr;
7291da177e4SLinus Torvalds 				fh->reserved = 0;
7301da177e4SLinus Torvalds 				fh->frag_off = htons(offset);
73153b24b8fSIan Morris 				if (frag->next)
7321da177e4SLinus Torvalds 					fh->frag_off |= htons(IP6_MF);
7331da177e4SLinus Torvalds 				fh->identification = frag_id;
7340660e03fSArnaldo Carvalho de Melo 				ipv6_hdr(frag)->payload_len =
7350660e03fSArnaldo Carvalho de Melo 						htons(frag->len -
7360660e03fSArnaldo Carvalho de Melo 						      sizeof(struct ipv6hdr));
7371da177e4SLinus Torvalds 				ip6_copy_metadata(frag, skb);
7381da177e4SLinus Torvalds 			}
7391da177e4SLinus Torvalds 
7407d8c6e39SEric W. Biederman 			err = output(net, sk, skb);
741dafee490SWei Dong 			if (!err)
742d8d1f30bSChangli Gao 				IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
7433bd653c8SDenis V. Lunev 					      IPSTATS_MIB_FRAGCREATES);
744dafee490SWei Dong 
7451da177e4SLinus Torvalds 			if (err || !frag)
7461da177e4SLinus Torvalds 				break;
7471da177e4SLinus Torvalds 
7481da177e4SLinus Torvalds 			skb = frag;
7491da177e4SLinus Torvalds 			frag = skb->next;
7501da177e4SLinus Torvalds 			skb->next = NULL;
7511da177e4SLinus Torvalds 		}
7521da177e4SLinus Torvalds 
7531da177e4SLinus Torvalds 		kfree(tmp_hdr);
7541da177e4SLinus Torvalds 
7551da177e4SLinus Torvalds 		if (err == 0) {
756d8d1f30bSChangli Gao 			IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
7573bd653c8SDenis V. Lunev 				      IPSTATS_MIB_FRAGOKS);
7581da177e4SLinus Torvalds 			return 0;
7591da177e4SLinus Torvalds 		}
7601da177e4SLinus Torvalds 
76146cfd725SFlorian Westphal 		kfree_skb_list(frag);
7621da177e4SLinus Torvalds 
763d8d1f30bSChangli Gao 		IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
7643bd653c8SDenis V. Lunev 			      IPSTATS_MIB_FRAGFAILS);
7651da177e4SLinus Torvalds 		return err;
7663d13008eSEric Dumazet 
7673d13008eSEric Dumazet slow_path_clean:
7683d13008eSEric Dumazet 		skb_walk_frags(skb, frag2) {
7693d13008eSEric Dumazet 			if (frag2 == frag)
7703d13008eSEric Dumazet 				break;
7713d13008eSEric Dumazet 			frag2->sk = NULL;
7723d13008eSEric Dumazet 			frag2->destructor = NULL;
7733d13008eSEric Dumazet 			skb->truesize += frag2->truesize;
7743d13008eSEric Dumazet 		}
7751da177e4SLinus Torvalds 	}
7761da177e4SLinus Torvalds 
7771da177e4SLinus Torvalds slow_path:
7781da177e4SLinus Torvalds 	left = skb->len - hlen;		/* Space per frame */
7791da177e4SLinus Torvalds 	ptr = hlen;			/* Where to start from */
7801da177e4SLinus Torvalds 
7811da177e4SLinus Torvalds 	/*
7821da177e4SLinus Torvalds 	 *	Fragment the datagram.
7831da177e4SLinus Torvalds 	 */
7841da177e4SLinus Torvalds 
785a7ae1992SHerbert Xu 	troom = rt->dst.dev->needed_tailroom;
7861da177e4SLinus Torvalds 
7871da177e4SLinus Torvalds 	/*
7881da177e4SLinus Torvalds 	 *	Keep copying data until we run out.
7891da177e4SLinus Torvalds 	 */
7901da177e4SLinus Torvalds 	while (left > 0)	{
79179e49503SFlorian Westphal 		u8 *fragnexthdr_offset;
79279e49503SFlorian Westphal 
7931da177e4SLinus Torvalds 		len = left;
7941da177e4SLinus Torvalds 		/* IF: it doesn't fit, use 'mtu' - the data space left */
7951da177e4SLinus Torvalds 		if (len > mtu)
7961da177e4SLinus Torvalds 			len = mtu;
7971da177e4SLinus Torvalds 		/* IF: we are not sending up to and including the packet end
7981da177e4SLinus Torvalds 		   then align the next start on an eight byte boundary */
7991da177e4SLinus Torvalds 		if (len < left)	{
8001da177e4SLinus Torvalds 			len &= ~7;
8011da177e4SLinus Torvalds 		}
8021da177e4SLinus Torvalds 
803cbffccc9SJoe Perches 		/* Allocate buffer */
804cbffccc9SJoe Perches 		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
805cbffccc9SJoe Perches 				 hroom + troom, GFP_ATOMIC);
806cbffccc9SJoe Perches 		if (!frag) {
8071da177e4SLinus Torvalds 			err = -ENOMEM;
8081da177e4SLinus Torvalds 			goto fail;
8091da177e4SLinus Torvalds 		}
8101da177e4SLinus Torvalds 
8111da177e4SLinus Torvalds 		/*
8121da177e4SLinus Torvalds 		 *	Set up data on packet
8131da177e4SLinus Torvalds 		 */
8141da177e4SLinus Torvalds 
8151da177e4SLinus Torvalds 		ip6_copy_metadata(frag, skb);
816a7ae1992SHerbert Xu 		skb_reserve(frag, hroom);
8171da177e4SLinus Torvalds 		skb_put(frag, len + hlen + sizeof(struct frag_hdr));
818c1d2bbe1SArnaldo Carvalho de Melo 		skb_reset_network_header(frag);
819badff6d0SArnaldo Carvalho de Melo 		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
820b0e380b1SArnaldo Carvalho de Melo 		frag->transport_header = (frag->network_header + hlen +
821b0e380b1SArnaldo Carvalho de Melo 					  sizeof(struct frag_hdr));
8221da177e4SLinus Torvalds 
8231da177e4SLinus Torvalds 		/*
8241da177e4SLinus Torvalds 		 *	Charge the memory for the fragment to any owner
8251da177e4SLinus Torvalds 		 *	it might possess
8261da177e4SLinus Torvalds 		 */
8271da177e4SLinus Torvalds 		if (skb->sk)
8281da177e4SLinus Torvalds 			skb_set_owner_w(frag, skb->sk);
8291da177e4SLinus Torvalds 
8301da177e4SLinus Torvalds 		/*
8311da177e4SLinus Torvalds 		 *	Copy the packet header into the new buffer.
8321da177e4SLinus Torvalds 		 */
833d626f62bSArnaldo Carvalho de Melo 		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
8341da177e4SLinus Torvalds 
83579e49503SFlorian Westphal 		fragnexthdr_offset = skb_network_header(frag);
83679e49503SFlorian Westphal 		fragnexthdr_offset += prevhdr - skb_network_header(skb);
83779e49503SFlorian Westphal 		*fragnexthdr_offset = NEXTHDR_FRAGMENT;
83879e49503SFlorian Westphal 
8391da177e4SLinus Torvalds 		/*
8401da177e4SLinus Torvalds 		 *	Build fragment header.
8411da177e4SLinus Torvalds 		 */
8421da177e4SLinus Torvalds 		fh->nexthdr = nexthdr;
8431da177e4SLinus Torvalds 		fh->reserved = 0;
8441da177e4SLinus Torvalds 		fh->identification = frag_id;
8451da177e4SLinus Torvalds 
8461da177e4SLinus Torvalds 		/*
8471da177e4SLinus Torvalds 		 *	Copy a block of the IP datagram.
8481da177e4SLinus Torvalds 		 */
849e3f0b86bSHimangi Saraogi 		BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),
850e3f0b86bSHimangi Saraogi 				     len));
8511da177e4SLinus Torvalds 		left -= len;
8521da177e4SLinus Torvalds 
8531da177e4SLinus Torvalds 		fh->frag_off = htons(offset);
8541da177e4SLinus Torvalds 		if (left > 0)
8551da177e4SLinus Torvalds 			fh->frag_off |= htons(IP6_MF);
8560660e03fSArnaldo Carvalho de Melo 		ipv6_hdr(frag)->payload_len = htons(frag->len -
8570660e03fSArnaldo Carvalho de Melo 						    sizeof(struct ipv6hdr));
8581da177e4SLinus Torvalds 
8591da177e4SLinus Torvalds 		ptr += len;
8601da177e4SLinus Torvalds 		offset += len;
8611da177e4SLinus Torvalds 
8621da177e4SLinus Torvalds 		/*
8631da177e4SLinus Torvalds 		 *	Put this fragment into the sending queue.
8641da177e4SLinus Torvalds 		 */
8657d8c6e39SEric W. Biederman 		err = output(net, sk, frag);
8661da177e4SLinus Torvalds 		if (err)
8671da177e4SLinus Torvalds 			goto fail;
868dafee490SWei Dong 
869adf30907SEric Dumazet 		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
8703bd653c8SDenis V. Lunev 			      IPSTATS_MIB_FRAGCREATES);
8711da177e4SLinus Torvalds 	}
872adf30907SEric Dumazet 	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
873a11d206dSYOSHIFUJI Hideaki 		      IPSTATS_MIB_FRAGOKS);
874808db80aSEric Dumazet 	consume_skb(skb);
8751da177e4SLinus Torvalds 	return err;
8761da177e4SLinus Torvalds 
877485fca66SFlorian Westphal fail_toobig:
878485fca66SFlorian Westphal 	if (skb->sk && dst_allfrag(skb_dst(skb)))
879485fca66SFlorian Westphal 		sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
880485fca66SFlorian Westphal 
881485fca66SFlorian Westphal 	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
882485fca66SFlorian Westphal 	err = -EMSGSIZE;
883485fca66SFlorian Westphal 
8841da177e4SLinus Torvalds fail:
885adf30907SEric Dumazet 	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
886a11d206dSYOSHIFUJI Hideaki 		      IPSTATS_MIB_FRAGFAILS);
8871da177e4SLinus Torvalds 	kfree_skb(skb);
8881da177e4SLinus Torvalds 	return err;
8891da177e4SLinus Torvalds }
8901da177e4SLinus Torvalds 
891b71d1d42SEric Dumazet static inline int ip6_rt_check(const struct rt6key *rt_key,
892b71d1d42SEric Dumazet 			       const struct in6_addr *fl_addr,
893b71d1d42SEric Dumazet 			       const struct in6_addr *addr_cache)
894cf6b1982SYOSHIFUJI Hideaki {
895a02cec21SEric Dumazet 	return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
89663159f29SIan Morris 		(!addr_cache || !ipv6_addr_equal(fl_addr, addr_cache));
897cf6b1982SYOSHIFUJI Hideaki }
898cf6b1982SYOSHIFUJI Hideaki 
899497c615aSHerbert Xu static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
900497c615aSHerbert Xu 					  struct dst_entry *dst,
901b71d1d42SEric Dumazet 					  const struct flowi6 *fl6)
9021da177e4SLinus Torvalds {
9031da177e4SLinus Torvalds 	struct ipv6_pinfo *np = inet6_sk(sk);
904a963a37dSEric Dumazet 	struct rt6_info *rt;
9051da177e4SLinus Torvalds 
906497c615aSHerbert Xu 	if (!dst)
907497c615aSHerbert Xu 		goto out;
9081da177e4SLinus Torvalds 
909a963a37dSEric Dumazet 	if (dst->ops->family != AF_INET6) {
910a963a37dSEric Dumazet 		dst_release(dst);
911a963a37dSEric Dumazet 		return NULL;
912a963a37dSEric Dumazet 	}
913a963a37dSEric Dumazet 
914a963a37dSEric Dumazet 	rt = (struct rt6_info *)dst;
9151da177e4SLinus Torvalds 	/* Yes, checking route validity in not connected
916d76e60a5SDavid S. Miller 	 * case is not very simple. Take into account,
917d76e60a5SDavid S. Miller 	 * that we do not support routing by source, TOS,
918d76e60a5SDavid S. Miller 	 * and MSG_DONTROUTE		--ANK (980726)
919d76e60a5SDavid S. Miller 	 *
920cf6b1982SYOSHIFUJI Hideaki 	 * 1. ip6_rt_check(): If route was host route,
921cf6b1982SYOSHIFUJI Hideaki 	 *    check that cached destination is current.
922d76e60a5SDavid S. Miller 	 *    If it is network route, we still may
923d76e60a5SDavid S. Miller 	 *    check its validity using saved pointer
924d76e60a5SDavid S. Miller 	 *    to the last used address: daddr_cache.
925d76e60a5SDavid S. Miller 	 *    We do not want to save whole address now,
926d76e60a5SDavid S. Miller 	 *    (because main consumer of this service
927d76e60a5SDavid S. Miller 	 *    is tcp, which has not this problem),
928d76e60a5SDavid S. Miller 	 *    so that the last trick works only on connected
929d76e60a5SDavid S. Miller 	 *    sockets.
930d76e60a5SDavid S. Miller 	 * 2. oif also should be the same.
9311da177e4SLinus Torvalds 	 */
9324c9483b2SDavid S. Miller 	if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
9338e1ef0a9SYOSHIFUJI Hideaki #ifdef CONFIG_IPV6_SUBTREES
9344c9483b2SDavid S. Miller 	    ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
9358e1ef0a9SYOSHIFUJI Hideaki #endif
936ca254490SDavid Ahern 	   (!(fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF) &&
937ca254490SDavid Ahern 	      (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex))) {
938497c615aSHerbert Xu 		dst_release(dst);
939497c615aSHerbert Xu 		dst = NULL;
9401da177e4SLinus Torvalds 	}
941497c615aSHerbert Xu 
942497c615aSHerbert Xu out:
943497c615aSHerbert Xu 	return dst;
9441da177e4SLinus Torvalds }
945497c615aSHerbert Xu 
9463aef934fSEric Dumazet static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
9474c9483b2SDavid S. Miller 			       struct dst_entry **dst, struct flowi6 *fl6)
948497c615aSHerbert Xu {
94969cce1d1SDavid S. Miller #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
95069cce1d1SDavid S. Miller 	struct neighbour *n;
95197cac082SDavid S. Miller 	struct rt6_info *rt;
95269cce1d1SDavid S. Miller #endif
95369cce1d1SDavid S. Miller 	int err;
9546f21c96aSPaolo Abeni 	int flags = 0;
9551da177e4SLinus Torvalds 
956e16e888bSMarkus Stenberg 	/* The correct way to handle this would be to do
957e16e888bSMarkus Stenberg 	 * ip6_route_get_saddr, and then ip6_route_output; however,
958e16e888bSMarkus Stenberg 	 * the route-specific preferred source forces the
959e16e888bSMarkus Stenberg 	 * ip6_route_output call _before_ ip6_route_get_saddr.
960e16e888bSMarkus Stenberg 	 *
961e16e888bSMarkus Stenberg 	 * In source specific routing (no src=any default route),
962e16e888bSMarkus Stenberg 	 * ip6_route_output will fail given src=any saddr, though, so
963e16e888bSMarkus Stenberg 	 * that's why we try it again later.
964e16e888bSMarkus Stenberg 	 */
965e16e888bSMarkus Stenberg 	if (ipv6_addr_any(&fl6->saddr) && (!*dst || !(*dst)->error)) {
966e16e888bSMarkus Stenberg 		struct rt6_info *rt;
967e16e888bSMarkus Stenberg 		bool had_dst = *dst != NULL;
968e16e888bSMarkus Stenberg 
969e16e888bSMarkus Stenberg 		if (!had_dst)
970e16e888bSMarkus Stenberg 			*dst = ip6_route_output(net, sk, fl6);
971e16e888bSMarkus Stenberg 		rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
972e16e888bSMarkus Stenberg 		err = ip6_route_get_saddr(net, rt, &fl6->daddr,
973e16e888bSMarkus Stenberg 					  sk ? inet6_sk(sk)->srcprefs : 0,
974e16e888bSMarkus Stenberg 					  &fl6->saddr);
975e16e888bSMarkus Stenberg 		if (err)
976e16e888bSMarkus Stenberg 			goto out_err_release;
977e16e888bSMarkus Stenberg 
978e16e888bSMarkus Stenberg 		/* If we had an erroneous initial result, pretend it
979e16e888bSMarkus Stenberg 		 * never existed and let the SA-enabled version take
980e16e888bSMarkus Stenberg 		 * over.
981e16e888bSMarkus Stenberg 		 */
982e16e888bSMarkus Stenberg 		if (!had_dst && (*dst)->error) {
983e16e888bSMarkus Stenberg 			dst_release(*dst);
984e16e888bSMarkus Stenberg 			*dst = NULL;
985e16e888bSMarkus Stenberg 		}
9866f21c96aSPaolo Abeni 
9876f21c96aSPaolo Abeni 		if (fl6->flowi6_oif)
9886f21c96aSPaolo Abeni 			flags |= RT6_LOOKUP_F_IFACE;
989e16e888bSMarkus Stenberg 	}
990e16e888bSMarkus Stenberg 
99163159f29SIan Morris 	if (!*dst)
9926f21c96aSPaolo Abeni 		*dst = ip6_route_output_flags(net, sk, fl6, flags);
9931da177e4SLinus Torvalds 
994e5d08d71SIan Morris 	err = (*dst)->error;
995e5d08d71SIan Morris 	if (err)
9961da177e4SLinus Torvalds 		goto out_err_release;
9971da177e4SLinus Torvalds 
99895c385b4SNeil Horman #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
99995c385b4SNeil Horman 	/*
100095c385b4SNeil Horman 	 * Here if the dst entry we've looked up
100195c385b4SNeil Horman 	 * has a neighbour entry that is in the INCOMPLETE
100295c385b4SNeil Horman 	 * state and the src address from the flow is
100395c385b4SNeil Horman 	 * marked as OPTIMISTIC, we release the found
100495c385b4SNeil Horman 	 * dst entry and replace it instead with the
100595c385b4SNeil Horman 	 * dst entry of the nexthop router
100695c385b4SNeil Horman 	 */
1007c56bf6feSEric Dumazet 	rt = (struct rt6_info *) *dst;
1008707be1ffSYOSHIFUJI Hideaki / 吉藤英明 	rcu_read_lock_bh();
10092647a9b0SMartin KaFai Lau 	n = __ipv6_neigh_lookup_noref(rt->dst.dev,
10102647a9b0SMartin KaFai Lau 				      rt6_nexthop(rt, &fl6->daddr));
1011707be1ffSYOSHIFUJI Hideaki / 吉藤英明 	err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
1012707be1ffSYOSHIFUJI Hideaki / 吉藤英明 	rcu_read_unlock_bh();
1013707be1ffSYOSHIFUJI Hideaki / 吉藤英明 
1014707be1ffSYOSHIFUJI Hideaki / 吉藤英明 	if (err) {
101595c385b4SNeil Horman 		struct inet6_ifaddr *ifp;
10164c9483b2SDavid S. Miller 		struct flowi6 fl_gw6;
101795c385b4SNeil Horman 		int redirect;
101895c385b4SNeil Horman 
10194c9483b2SDavid S. Miller 		ifp = ipv6_get_ifaddr(net, &fl6->saddr,
10201cab3da6SDaniel Lezcano 				      (*dst)->dev, 1);
102195c385b4SNeil Horman 
102295c385b4SNeil Horman 		redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
102395c385b4SNeil Horman 		if (ifp)
102495c385b4SNeil Horman 			in6_ifa_put(ifp);
102595c385b4SNeil Horman 
102695c385b4SNeil Horman 		if (redirect) {
102795c385b4SNeil Horman 			/*
102895c385b4SNeil Horman 			 * We need to get the dst entry for the
102995c385b4SNeil Horman 			 * default router instead
103095c385b4SNeil Horman 			 */
103195c385b4SNeil Horman 			dst_release(*dst);
10324c9483b2SDavid S. Miller 			memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
10334c9483b2SDavid S. Miller 			memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
10344c9483b2SDavid S. Miller 			*dst = ip6_route_output(net, sk, &fl_gw6);
1035e5d08d71SIan Morris 			err = (*dst)->error;
1036e5d08d71SIan Morris 			if (err)
103795c385b4SNeil Horman 				goto out_err_release;
103895c385b4SNeil Horman 		}
103995c385b4SNeil Horman 	}
104095c385b4SNeil Horman #endif
1041ec5e3b0aSJonathan T. Leighton 	if (ipv6_addr_v4mapped(&fl6->saddr) &&
104200ea1ceeSWillem de Bruijn 	    !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) {
104300ea1ceeSWillem de Bruijn 		err = -EAFNOSUPPORT;
104400ea1ceeSWillem de Bruijn 		goto out_err_release;
104500ea1ceeSWillem de Bruijn 	}
104695c385b4SNeil Horman 
10471da177e4SLinus Torvalds 	return 0;
10481da177e4SLinus Torvalds 
10491da177e4SLinus Torvalds out_err_release:
10501da177e4SLinus Torvalds 	dst_release(*dst);
10511da177e4SLinus Torvalds 	*dst = NULL;
10528a966fc0SDavid Ahern 
10530d240e78SDavid Ahern 	if (err == -ENETUNREACH)
10540d240e78SDavid Ahern 		IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
10551da177e4SLinus Torvalds 	return err;
10561da177e4SLinus Torvalds }
105734a0b3cdSAdrian Bunk 
1058497c615aSHerbert Xu /**
1059497c615aSHerbert Xu  *	ip6_dst_lookup - perform route lookup on flow
1060497c615aSHerbert Xu  *	@sk: socket which provides route info
1061497c615aSHerbert Xu  *	@dst: pointer to dst_entry * for result
10624c9483b2SDavid S. Miller  *	@fl6: flow to lookup
1063497c615aSHerbert Xu  *
1064497c615aSHerbert Xu  *	This function performs a route lookup on the given flow.
1065497c615aSHerbert Xu  *
1066497c615aSHerbert Xu  *	It returns zero on success, or a standard errno code on error.
1067497c615aSHerbert Xu  */
1068343d60aaSRoopa Prabhu int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
1069343d60aaSRoopa Prabhu 		   struct flowi6 *fl6)
1070497c615aSHerbert Xu {
1071497c615aSHerbert Xu 	*dst = NULL;
1072343d60aaSRoopa Prabhu 	return ip6_dst_lookup_tail(net, sk, dst, fl6);
1073497c615aSHerbert Xu }
10743cf3dc6cSArnaldo Carvalho de Melo EXPORT_SYMBOL_GPL(ip6_dst_lookup);
10753cf3dc6cSArnaldo Carvalho de Melo 
1076497c615aSHerbert Xu /**
107768d0c6d3SDavid S. Miller  *	ip6_dst_lookup_flow - perform route lookup on flow with ipsec
107868d0c6d3SDavid S. Miller  *	@sk: socket which provides route info
10794c9483b2SDavid S. Miller  *	@fl6: flow to lookup
108068d0c6d3SDavid S. Miller  *	@final_dst: final destination address for ipsec lookup
108168d0c6d3SDavid S. Miller  *
108268d0c6d3SDavid S. Miller  *	This function performs a route lookup on the given flow.
108368d0c6d3SDavid S. Miller  *
108468d0c6d3SDavid S. Miller  *	It returns a valid dst pointer on success, or a pointer encoded
108568d0c6d3SDavid S. Miller  *	error code.
108668d0c6d3SDavid S. Miller  */
10873aef934fSEric Dumazet struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6,
10880e0d44abSSteffen Klassert 				      const struct in6_addr *final_dst)
108968d0c6d3SDavid S. Miller {
109068d0c6d3SDavid S. Miller 	struct dst_entry *dst = NULL;
109168d0c6d3SDavid S. Miller 	int err;
109268d0c6d3SDavid S. Miller 
1093343d60aaSRoopa Prabhu 	err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
109468d0c6d3SDavid S. Miller 	if (err)
109568d0c6d3SDavid S. Miller 		return ERR_PTR(err);
109668d0c6d3SDavid S. Miller 	if (final_dst)
10974e3fd7a0SAlexey Dobriyan 		fl6->daddr = *final_dst;
10982774c131SDavid S. Miller 
1099f92ee619SSteffen Klassert 	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
110068d0c6d3SDavid S. Miller }
110168d0c6d3SDavid S. Miller EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
110268d0c6d3SDavid S. Miller 
110368d0c6d3SDavid S. Miller /**
110468d0c6d3SDavid S. Miller  *	ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
110568d0c6d3SDavid S. Miller  *	@sk: socket which provides the dst cache and route info
11064c9483b2SDavid S. Miller  *	@fl6: flow to lookup
110768d0c6d3SDavid S. Miller  *	@final_dst: final destination address for ipsec lookup
1108497c615aSHerbert Xu  *
1109497c615aSHerbert Xu  *	This function performs a route lookup on the given flow with the
1110497c615aSHerbert Xu  *	possibility of using the cached route in the socket if it is valid.
1111497c615aSHerbert Xu  *	It will take the socket dst lock when operating on the dst cache.
1112497c615aSHerbert Xu  *	As a result, this function can only be used in process context.
1113497c615aSHerbert Xu  *
111468d0c6d3SDavid S. Miller  *	It returns a valid dst pointer on success, or a pointer encoded
111568d0c6d3SDavid S. Miller  *	error code.
1116497c615aSHerbert Xu  */
11174c9483b2SDavid S. Miller struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
11180e0d44abSSteffen Klassert 					 const struct in6_addr *final_dst)
1119497c615aSHerbert Xu {
112068d0c6d3SDavid S. Miller 	struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1121497c615aSHerbert Xu 
11224c9483b2SDavid S. Miller 	dst = ip6_sk_dst_check(sk, dst, fl6);
112300bc0ef5SJakub Sitnicki 	if (!dst)
112400bc0ef5SJakub Sitnicki 		dst = ip6_dst_lookup_flow(sk, fl6, final_dst);
112568d0c6d3SDavid S. Miller 
112600bc0ef5SJakub Sitnicki 	return dst;
112768d0c6d3SDavid S. Miller }
112868d0c6d3SDavid S. Miller EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1129497c615aSHerbert Xu 
11300178b695SHerbert Xu static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
11310178b695SHerbert Xu 					       gfp_t gfp)
11320178b695SHerbert Xu {
11330178b695SHerbert Xu 	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
11340178b695SHerbert Xu }
11350178b695SHerbert Xu 
11360178b695SHerbert Xu static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
11370178b695SHerbert Xu 						gfp_t gfp)
11380178b695SHerbert Xu {
11390178b695SHerbert Xu 	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
11400178b695SHerbert Xu }
11410178b695SHerbert Xu 
114275a493e6SHannes Frederic Sowa static void ip6_append_data_mtu(unsigned int *mtu,
11430c183379SGao feng 				int *maxfraglen,
11440c183379SGao feng 				unsigned int fragheaderlen,
11450c183379SGao feng 				struct sk_buff *skb,
114675a493e6SHannes Frederic Sowa 				struct rt6_info *rt,
1147e367c2d0Slucien 				unsigned int orig_mtu)
11480c183379SGao feng {
11490c183379SGao feng 	if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
115063159f29SIan Morris 		if (!skb) {
11510c183379SGao feng 			/* first fragment, reserve header_len */
1152e367c2d0Slucien 			*mtu = orig_mtu - rt->dst.header_len;
11530c183379SGao feng 
11540c183379SGao feng 		} else {
11550c183379SGao feng 			/*
11560c183379SGao feng 			 * this fragment is not first, the headers
11570c183379SGao feng 			 * space is regarded as data space.
11580c183379SGao feng 			 */
1159e367c2d0Slucien 			*mtu = orig_mtu;
11600c183379SGao feng 		}
11610c183379SGao feng 		*maxfraglen = ((*mtu - fragheaderlen) & ~7)
11620c183379SGao feng 			      + fragheaderlen - sizeof(struct frag_hdr);
11630c183379SGao feng 	}
11640c183379SGao feng }
11650c183379SGao feng 
1166366e41d9SVlad Yasevich static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
116726879da5SWei Wang 			  struct inet6_cork *v6_cork, struct ipcm6_cookie *ipc6,
1168366e41d9SVlad Yasevich 			  struct rt6_info *rt, struct flowi6 *fl6)
1169366e41d9SVlad Yasevich {
1170366e41d9SVlad Yasevich 	struct ipv6_pinfo *np = inet6_sk(sk);
1171366e41d9SVlad Yasevich 	unsigned int mtu;
117226879da5SWei Wang 	struct ipv6_txoptions *opt = ipc6->opt;
1173366e41d9SVlad Yasevich 
1174366e41d9SVlad Yasevich 	/*
1175366e41d9SVlad Yasevich 	 * setup for corking
1176366e41d9SVlad Yasevich 	 */
1177366e41d9SVlad Yasevich 	if (opt) {
1178366e41d9SVlad Yasevich 		if (WARN_ON(v6_cork->opt))
1179366e41d9SVlad Yasevich 			return -EINVAL;
1180366e41d9SVlad Yasevich 
1181864e2a1fSEric Dumazet 		v6_cork->opt = kzalloc(sizeof(*opt), sk->sk_allocation);
118263159f29SIan Morris 		if (unlikely(!v6_cork->opt))
1183366e41d9SVlad Yasevich 			return -ENOBUFS;
1184366e41d9SVlad Yasevich 
1185864e2a1fSEric Dumazet 		v6_cork->opt->tot_len = sizeof(*opt);
1186366e41d9SVlad Yasevich 		v6_cork->opt->opt_flen = opt->opt_flen;
1187366e41d9SVlad Yasevich 		v6_cork->opt->opt_nflen = opt->opt_nflen;
1188366e41d9SVlad Yasevich 
1189366e41d9SVlad Yasevich 		v6_cork->opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1190366e41d9SVlad Yasevich 						    sk->sk_allocation);
1191366e41d9SVlad Yasevich 		if (opt->dst0opt && !v6_cork->opt->dst0opt)
1192366e41d9SVlad Yasevich 			return -ENOBUFS;
1193366e41d9SVlad Yasevich 
1194366e41d9SVlad Yasevich 		v6_cork->opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1195366e41d9SVlad Yasevich 						    sk->sk_allocation);
1196366e41d9SVlad Yasevich 		if (opt->dst1opt && !v6_cork->opt->dst1opt)
1197366e41d9SVlad Yasevich 			return -ENOBUFS;
1198366e41d9SVlad Yasevich 
1199366e41d9SVlad Yasevich 		v6_cork->opt->hopopt = ip6_opt_dup(opt->hopopt,
1200366e41d9SVlad Yasevich 						   sk->sk_allocation);
1201366e41d9SVlad Yasevich 		if (opt->hopopt && !v6_cork->opt->hopopt)
1202366e41d9SVlad Yasevich 			return -ENOBUFS;
1203366e41d9SVlad Yasevich 
1204366e41d9SVlad Yasevich 		v6_cork->opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1205366e41d9SVlad Yasevich 						    sk->sk_allocation);
1206366e41d9SVlad Yasevich 		if (opt->srcrt && !v6_cork->opt->srcrt)
1207366e41d9SVlad Yasevich 			return -ENOBUFS;
1208366e41d9SVlad Yasevich 
1209366e41d9SVlad Yasevich 		/* need source address above miyazawa*/
1210366e41d9SVlad Yasevich 	}
1211366e41d9SVlad Yasevich 	dst_hold(&rt->dst);
1212366e41d9SVlad Yasevich 	cork->base.dst = &rt->dst;
1213366e41d9SVlad Yasevich 	cork->fl.u.ip6 = *fl6;
121426879da5SWei Wang 	v6_cork->hop_limit = ipc6->hlimit;
121526879da5SWei Wang 	v6_cork->tclass = ipc6->tclass;
1216366e41d9SVlad Yasevich 	if (rt->dst.flags & DST_XFRM_TUNNEL)
1217366e41d9SVlad Yasevich 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1218749439bfSMike Maloney 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
1219366e41d9SVlad Yasevich 	else
1220366e41d9SVlad Yasevich 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1221c02b3741SDavid S. Miller 			READ_ONCE(rt->dst.dev->mtu) : dst_mtu(xfrm_dst_path(&rt->dst));
1222366e41d9SVlad Yasevich 	if (np->frag_size < mtu) {
1223366e41d9SVlad Yasevich 		if (np->frag_size)
1224366e41d9SVlad Yasevich 			mtu = np->frag_size;
1225366e41d9SVlad Yasevich 	}
1226749439bfSMike Maloney 	if (mtu < IPV6_MIN_MTU)
1227749439bfSMike Maloney 		return -EINVAL;
1228366e41d9SVlad Yasevich 	cork->base.fragsize = mtu;
12290f6c480fSDavid Miller 	if (dst_allfrag(xfrm_dst_path(&rt->dst)))
1230366e41d9SVlad Yasevich 		cork->base.flags |= IPCORK_ALLFRAG;
1231366e41d9SVlad Yasevich 	cork->base.length = 0;
1232366e41d9SVlad Yasevich 
1233366e41d9SVlad Yasevich 	return 0;
1234366e41d9SVlad Yasevich }
1235366e41d9SVlad Yasevich 
12360bbe84a6SVlad Yasevich static int __ip6_append_data(struct sock *sk,
12370bbe84a6SVlad Yasevich 			     struct flowi6 *fl6,
12380bbe84a6SVlad Yasevich 			     struct sk_buff_head *queue,
12390bbe84a6SVlad Yasevich 			     struct inet_cork *cork,
12400bbe84a6SVlad Yasevich 			     struct inet6_cork *v6_cork,
12410bbe84a6SVlad Yasevich 			     struct page_frag *pfrag,
12420bbe84a6SVlad Yasevich 			     int getfrag(void *from, char *to, int offset,
12430bbe84a6SVlad Yasevich 					 int len, int odd, struct sk_buff *skb),
12441da177e4SLinus Torvalds 			     void *from, int length, int transhdrlen,
124526879da5SWei Wang 			     unsigned int flags, struct ipcm6_cookie *ipc6,
1246c14ac945SSoheil Hassas Yeganeh 			     const struct sockcm_cookie *sockc)
12471da177e4SLinus Torvalds {
12480c183379SGao feng 	struct sk_buff *skb, *skb_prev = NULL;
1249e367c2d0Slucien 	unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
12500bbe84a6SVlad Yasevich 	int exthdrlen = 0;
12510bbe84a6SVlad Yasevich 	int dst_exthdrlen = 0;
12521da177e4SLinus Torvalds 	int hh_len;
12531da177e4SLinus Torvalds 	int copy;
12541da177e4SLinus Torvalds 	int err;
12551da177e4SLinus Torvalds 	int offset = 0;
1256a693e698SAnders Berggren 	__u8 tx_flags = 0;
125709c2d251SWillem de Bruijn 	u32 tskey = 0;
12580bbe84a6SVlad Yasevich 	struct rt6_info *rt = (struct rt6_info *)cork->dst;
12590bbe84a6SVlad Yasevich 	struct ipv6_txoptions *opt = v6_cork->opt;
126032dce968SVlad Yasevich 	int csummode = CHECKSUM_NONE;
1261682b1a9dSHannes Frederic Sowa 	unsigned int maxnonfragsize, headersize;
12621da177e4SLinus Torvalds 
12630bbe84a6SVlad Yasevich 	skb = skb_peek_tail(queue);
12640bbe84a6SVlad Yasevich 	if (!skb) {
12650bbe84a6SVlad Yasevich 		exthdrlen = opt ? opt->opt_flen : 0;
12667efdba5bSRomain KUNTZ 		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
12671da177e4SLinus Torvalds 	}
12680bbe84a6SVlad Yasevich 
1269366e41d9SVlad Yasevich 	mtu = cork->fragsize;
1270e367c2d0Slucien 	orig_mtu = mtu;
12711da177e4SLinus Torvalds 
1272d8d1f30bSChangli Gao 	hh_len = LL_RESERVED_SPACE(rt->dst.dev);
12731da177e4SLinus Torvalds 
1274a1b05140SMasahide NAKAMURA 	fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1275b4ce9277SHerbert Xu 			(opt ? opt->opt_nflen : 0);
12764df98e76SHannes Frederic Sowa 	maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
12774df98e76SHannes Frederic Sowa 		     sizeof(struct frag_hdr);
12781da177e4SLinus Torvalds 
12794df98e76SHannes Frederic Sowa 	headersize = sizeof(struct ipv6hdr) +
12803a1cebe7SHannes Frederic Sowa 		     (opt ? opt->opt_flen + opt->opt_nflen : 0) +
12814df98e76SHannes Frederic Sowa 		     (dst_allfrag(&rt->dst) ?
12824df98e76SHannes Frederic Sowa 		      sizeof(struct frag_hdr) : 0) +
12834df98e76SHannes Frederic Sowa 		     rt->rt6i_nfheader_len;
12844df98e76SHannes Frederic Sowa 
128526879da5SWei Wang 	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
12864df98e76SHannes Frederic Sowa 	    (sk->sk_protocol == IPPROTO_UDP ||
12874df98e76SHannes Frederic Sowa 	     sk->sk_protocol == IPPROTO_RAW)) {
12884df98e76SHannes Frederic Sowa 		ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
12894df98e76SHannes Frederic Sowa 				sizeof(struct ipv6hdr));
12904df98e76SHannes Frederic Sowa 		goto emsgsize;
12914df98e76SHannes Frederic Sowa 	}
12924df98e76SHannes Frederic Sowa 
1293682b1a9dSHannes Frederic Sowa 	if (ip6_sk_ignore_df(sk))
1294682b1a9dSHannes Frederic Sowa 		maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
1295682b1a9dSHannes Frederic Sowa 	else
1296682b1a9dSHannes Frederic Sowa 		maxnonfragsize = mtu;
1297682b1a9dSHannes Frederic Sowa 
12984df98e76SHannes Frederic Sowa 	if (cork->length + length > maxnonfragsize - headersize) {
12994df98e76SHannes Frederic Sowa emsgsize:
13004df98e76SHannes Frederic Sowa 		ipv6_local_error(sk, EMSGSIZE, fl6,
13014df98e76SHannes Frederic Sowa 				 mtu - headersize +
13024df98e76SHannes Frederic Sowa 				 sizeof(struct ipv6hdr));
13031da177e4SLinus Torvalds 		return -EMSGSIZE;
13041da177e4SLinus Torvalds 	}
1305682b1a9dSHannes Frederic Sowa 
1306682b1a9dSHannes Frederic Sowa 	/* CHECKSUM_PARTIAL only with no extension headers and when
1307682b1a9dSHannes Frederic Sowa 	 * we are not going to fragment
1308682b1a9dSHannes Frederic Sowa 	 */
1309682b1a9dSHannes Frederic Sowa 	if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
1310682b1a9dSHannes Frederic Sowa 	    headersize == sizeof(struct ipv6hdr) &&
13112b89ed65SVlad Yasevich 	    length <= mtu - headersize &&
1312682b1a9dSHannes Frederic Sowa 	    !(flags & MSG_MORE) &&
1313c8cd0989STom Herbert 	    rt->dst.dev->features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM))
1314682b1a9dSHannes Frederic Sowa 		csummode = CHECKSUM_PARTIAL;
13151da177e4SLinus Torvalds 
131609c2d251SWillem de Bruijn 	if (sk->sk_type == SOCK_DGRAM || sk->sk_type == SOCK_RAW) {
1317c14ac945SSoheil Hassas Yeganeh 		sock_tx_timestamp(sk, sockc->tsflags, &tx_flags);
131809c2d251SWillem de Bruijn 		if (tx_flags & SKBTX_ANY_SW_TSTAMP &&
131909c2d251SWillem de Bruijn 		    sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)
132009c2d251SWillem de Bruijn 			tskey = sk->sk_tskey++;
132109c2d251SWillem de Bruijn 	}
1322a693e698SAnders Berggren 
13231da177e4SLinus Torvalds 	/*
13241da177e4SLinus Torvalds 	 * Let's try using as much space as possible.
13251da177e4SLinus Torvalds 	 * Use MTU if total length of the message fits into the MTU.
13261da177e4SLinus Torvalds 	 * Otherwise, we need to reserve fragment header and
13271da177e4SLinus Torvalds 	 * fragment alignment (= 8-15 octects, in total).
13281da177e4SLinus Torvalds 	 *
13291da177e4SLinus Torvalds 	 * Note that we may need to "move" the data from the tail of
13301da177e4SLinus Torvalds 	 * of the buffer to the new fragment when we split
13311da177e4SLinus Torvalds 	 * the message.
13321da177e4SLinus Torvalds 	 *
13331da177e4SLinus Torvalds 	 * FIXME: It may be fragmented into multiple chunks
13341da177e4SLinus Torvalds 	 *        at once if non-fragmentable extension headers
13351da177e4SLinus Torvalds 	 *        are too large.
13361da177e4SLinus Torvalds 	 * --yoshfuji
13371da177e4SLinus Torvalds 	 */
13381da177e4SLinus Torvalds 
13392811ebacSHannes Frederic Sowa 	cork->length += length;
13402811ebacSHannes Frederic Sowa 	if (!skb)
13411da177e4SLinus Torvalds 		goto alloc_new_skb;
13421da177e4SLinus Torvalds 
13431da177e4SLinus Torvalds 	while (length > 0) {
13441da177e4SLinus Torvalds 		/* Check if the remaining data fits into current packet. */
1345bdc712b4SDavid S. Miller 		copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
13461da177e4SLinus Torvalds 		if (copy < length)
13471da177e4SLinus Torvalds 			copy = maxfraglen - skb->len;
13481da177e4SLinus Torvalds 
13491da177e4SLinus Torvalds 		if (copy <= 0) {
13501da177e4SLinus Torvalds 			char *data;
13511da177e4SLinus Torvalds 			unsigned int datalen;
13521da177e4SLinus Torvalds 			unsigned int fraglen;
13531da177e4SLinus Torvalds 			unsigned int fraggap;
13541da177e4SLinus Torvalds 			unsigned int alloclen;
13551da177e4SLinus Torvalds alloc_new_skb:
13561da177e4SLinus Torvalds 			/* There's no room in the current skb */
13570c183379SGao feng 			if (skb)
13580c183379SGao feng 				fraggap = skb->len - maxfraglen;
13591da177e4SLinus Torvalds 			else
13601da177e4SLinus Torvalds 				fraggap = 0;
13610c183379SGao feng 			/* update mtu and maxfraglen if necessary */
136263159f29SIan Morris 			if (!skb || !skb_prev)
13630c183379SGao feng 				ip6_append_data_mtu(&mtu, &maxfraglen,
136475a493e6SHannes Frederic Sowa 						    fragheaderlen, skb, rt,
1365e367c2d0Slucien 						    orig_mtu);
13660c183379SGao feng 
13670c183379SGao feng 			skb_prev = skb;
13681da177e4SLinus Torvalds 
13691da177e4SLinus Torvalds 			/*
13701da177e4SLinus Torvalds 			 * If remaining data exceeds the mtu,
13711da177e4SLinus Torvalds 			 * we know we need more fragment(s).
13721da177e4SLinus Torvalds 			 */
13731da177e4SLinus Torvalds 			datalen = length + fraggap;
13741da177e4SLinus Torvalds 
13750c183379SGao feng 			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
13760c183379SGao feng 				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
13771da177e4SLinus Torvalds 			if ((flags & MSG_MORE) &&
1378d8d1f30bSChangli Gao 			    !(rt->dst.dev->features&NETIF_F_SG))
13791da177e4SLinus Torvalds 				alloclen = mtu;
13801da177e4SLinus Torvalds 			else
13811da177e4SLinus Torvalds 				alloclen = datalen + fragheaderlen;
13821da177e4SLinus Torvalds 
1383299b0767SSteffen Klassert 			alloclen += dst_exthdrlen;
1384299b0767SSteffen Klassert 
13850c183379SGao feng 			if (datalen != length + fraggap) {
13861da177e4SLinus Torvalds 				/*
13870c183379SGao feng 				 * this is not the last fragment, the trailer
13880c183379SGao feng 				 * space is regarded as data space.
13891da177e4SLinus Torvalds 				 */
13900c183379SGao feng 				datalen += rt->dst.trailer_len;
13910c183379SGao feng 			}
13920c183379SGao feng 
1393d8d1f30bSChangli Gao 			alloclen += rt->dst.trailer_len;
13940c183379SGao feng 			fraglen = datalen + fragheaderlen;
13951da177e4SLinus Torvalds 
13961da177e4SLinus Torvalds 			/*
13971da177e4SLinus Torvalds 			 * We just reserve space for fragment header.
13981da177e4SLinus Torvalds 			 * Note: this may be overallocation if the message
13991da177e4SLinus Torvalds 			 * (without MSG_MORE) fits into the MTU.
14001da177e4SLinus Torvalds 			 */
14011da177e4SLinus Torvalds 			alloclen += sizeof(struct frag_hdr);
14021da177e4SLinus Torvalds 
1403232cd35dSEric Dumazet 			copy = datalen - transhdrlen - fraggap;
1404232cd35dSEric Dumazet 			if (copy < 0) {
1405232cd35dSEric Dumazet 				err = -EINVAL;
1406232cd35dSEric Dumazet 				goto error;
1407232cd35dSEric Dumazet 			}
14081da177e4SLinus Torvalds 			if (transhdrlen) {
14091da177e4SLinus Torvalds 				skb = sock_alloc_send_skb(sk,
14101da177e4SLinus Torvalds 						alloclen + hh_len,
14111da177e4SLinus Torvalds 						(flags & MSG_DONTWAIT), &err);
14121da177e4SLinus Torvalds 			} else {
14131da177e4SLinus Torvalds 				skb = NULL;
141414afee4bSReshetova, Elena 				if (refcount_read(&sk->sk_wmem_alloc) <=
14151da177e4SLinus Torvalds 				    2 * sk->sk_sndbuf)
14161da177e4SLinus Torvalds 					skb = sock_wmalloc(sk,
14171da177e4SLinus Torvalds 							   alloclen + hh_len, 1,
14181da177e4SLinus Torvalds 							   sk->sk_allocation);
141963159f29SIan Morris 				if (unlikely(!skb))
14201da177e4SLinus Torvalds 					err = -ENOBUFS;
14211da177e4SLinus Torvalds 			}
142263159f29SIan Morris 			if (!skb)
14231da177e4SLinus Torvalds 				goto error;
14241da177e4SLinus Torvalds 			/*
14251da177e4SLinus Torvalds 			 *	Fill in the control structures
14261da177e4SLinus Torvalds 			 */
14279c9c9ad5SHannes Frederic Sowa 			skb->protocol = htons(ETH_P_IPV6);
142832dce968SVlad Yasevich 			skb->ip_summed = csummode;
14291da177e4SLinus Torvalds 			skb->csum = 0;
14301f85851eSGao feng 			/* reserve for fragmentation and ipsec header */
14311f85851eSGao feng 			skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
14321f85851eSGao feng 				    dst_exthdrlen);
14331da177e4SLinus Torvalds 
143411878b40SWillem de Bruijn 			/* Only the initial fragment is time stamped */
1435a693e698SAnders Berggren 			skb_shinfo(skb)->tx_flags = tx_flags;
143611878b40SWillem de Bruijn 			tx_flags = 0;
143709c2d251SWillem de Bruijn 			skb_shinfo(skb)->tskey = tskey;
143809c2d251SWillem de Bruijn 			tskey = 0;
1439a693e698SAnders Berggren 
14401da177e4SLinus Torvalds 			/*
14411da177e4SLinus Torvalds 			 *	Find where to start putting bytes
14421da177e4SLinus Torvalds 			 */
14431f85851eSGao feng 			data = skb_put(skb, fraglen);
14441f85851eSGao feng 			skb_set_network_header(skb, exthdrlen);
14451f85851eSGao feng 			data += fragheaderlen;
1446b0e380b1SArnaldo Carvalho de Melo 			skb->transport_header = (skb->network_header +
1447b0e380b1SArnaldo Carvalho de Melo 						 fragheaderlen);
14481da177e4SLinus Torvalds 			if (fraggap) {
14491da177e4SLinus Torvalds 				skb->csum = skb_copy_and_csum_bits(
14501da177e4SLinus Torvalds 					skb_prev, maxfraglen,
14511da177e4SLinus Torvalds 					data + transhdrlen, fraggap, 0);
14521da177e4SLinus Torvalds 				skb_prev->csum = csum_sub(skb_prev->csum,
14531da177e4SLinus Torvalds 							  skb->csum);
14541da177e4SLinus Torvalds 				data += fraggap;
1455e9fa4f7bSHerbert Xu 				pskb_trim_unique(skb_prev, maxfraglen);
14561da177e4SLinus Torvalds 			}
1457232cd35dSEric Dumazet 			if (copy > 0 &&
1458232cd35dSEric Dumazet 			    getfrag(from, data + transhdrlen, offset,
1459232cd35dSEric Dumazet 				    copy, fraggap, skb) < 0) {
14601da177e4SLinus Torvalds 				err = -EFAULT;
14611da177e4SLinus Torvalds 				kfree_skb(skb);
14621da177e4SLinus Torvalds 				goto error;
14631da177e4SLinus Torvalds 			}
14641da177e4SLinus Torvalds 
14651da177e4SLinus Torvalds 			offset += copy;
14661da177e4SLinus Torvalds 			length -= datalen - fraggap;
14671da177e4SLinus Torvalds 			transhdrlen = 0;
14681da177e4SLinus Torvalds 			exthdrlen = 0;
1469299b0767SSteffen Klassert 			dst_exthdrlen = 0;
14701da177e4SLinus Torvalds 
14710dec879fSJulian Anastasov 			if ((flags & MSG_CONFIRM) && !skb_prev)
14720dec879fSJulian Anastasov 				skb_set_dst_pending_confirm(skb, 1);
14730dec879fSJulian Anastasov 
14741da177e4SLinus Torvalds 			/*
14751da177e4SLinus Torvalds 			 * Put the packet on the pending queue
14761da177e4SLinus Torvalds 			 */
14770bbe84a6SVlad Yasevich 			__skb_queue_tail(queue, skb);
14781da177e4SLinus Torvalds 			continue;
14791da177e4SLinus Torvalds 		}
14801da177e4SLinus Torvalds 
14811da177e4SLinus Torvalds 		if (copy > length)
14821da177e4SLinus Torvalds 			copy = length;
14831da177e4SLinus Torvalds 
1484d8d1f30bSChangli Gao 		if (!(rt->dst.dev->features&NETIF_F_SG)) {
14851da177e4SLinus Torvalds 			unsigned int off;
14861da177e4SLinus Torvalds 
14871da177e4SLinus Torvalds 			off = skb->len;
14881da177e4SLinus Torvalds 			if (getfrag(from, skb_put(skb, copy),
14891da177e4SLinus Torvalds 						offset, copy, off, skb) < 0) {
14901da177e4SLinus Torvalds 				__skb_trim(skb, off);
14911da177e4SLinus Torvalds 				err = -EFAULT;
14921da177e4SLinus Torvalds 				goto error;
14931da177e4SLinus Torvalds 			}
14941da177e4SLinus Torvalds 		} else {
14951da177e4SLinus Torvalds 			int i = skb_shinfo(skb)->nr_frags;
14961da177e4SLinus Torvalds 
14971da177e4SLinus Torvalds 			err = -ENOMEM;
14985640f768SEric Dumazet 			if (!sk_page_frag_refill(sk, pfrag))
14991da177e4SLinus Torvalds 				goto error;
15001da177e4SLinus Torvalds 
15015640f768SEric Dumazet 			if (!skb_can_coalesce(skb, i, pfrag->page,
15025640f768SEric Dumazet 					      pfrag->offset)) {
15031da177e4SLinus Torvalds 				err = -EMSGSIZE;
15045640f768SEric Dumazet 				if (i == MAX_SKB_FRAGS)
15051da177e4SLinus Torvalds 					goto error;
15065640f768SEric Dumazet 
15075640f768SEric Dumazet 				__skb_fill_page_desc(skb, i, pfrag->page,
15085640f768SEric Dumazet 						     pfrag->offset, 0);
15095640f768SEric Dumazet 				skb_shinfo(skb)->nr_frags = ++i;
15105640f768SEric Dumazet 				get_page(pfrag->page);
15111da177e4SLinus Torvalds 			}
15125640f768SEric Dumazet 			copy = min_t(int, copy, pfrag->size - pfrag->offset);
15139e903e08SEric Dumazet 			if (getfrag(from,
15145640f768SEric Dumazet 				    page_address(pfrag->page) + pfrag->offset,
15155640f768SEric Dumazet 				    offset, copy, skb->len, skb) < 0)
15165640f768SEric Dumazet 				goto error_efault;
15175640f768SEric Dumazet 
15185640f768SEric Dumazet 			pfrag->offset += copy;
15195640f768SEric Dumazet 			skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
15201da177e4SLinus Torvalds 			skb->len += copy;
15211da177e4SLinus Torvalds 			skb->data_len += copy;
1522f945fa7aSHerbert Xu 			skb->truesize += copy;
152314afee4bSReshetova, Elena 			refcount_add(copy, &sk->sk_wmem_alloc);
15241da177e4SLinus Torvalds 		}
15251da177e4SLinus Torvalds 		offset += copy;
15261da177e4SLinus Torvalds 		length -= copy;
15271da177e4SLinus Torvalds 	}
15285640f768SEric Dumazet 
15291da177e4SLinus Torvalds 	return 0;
15305640f768SEric Dumazet 
15315640f768SEric Dumazet error_efault:
15325640f768SEric Dumazet 	err = -EFAULT;
15331da177e4SLinus Torvalds error:
1534bdc712b4SDavid S. Miller 	cork->length -= length;
15353bd653c8SDenis V. Lunev 	IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
15361da177e4SLinus Torvalds 	return err;
15371da177e4SLinus Torvalds }
15380bbe84a6SVlad Yasevich 
15390bbe84a6SVlad Yasevich int ip6_append_data(struct sock *sk,
15400bbe84a6SVlad Yasevich 		    int getfrag(void *from, char *to, int offset, int len,
15410bbe84a6SVlad Yasevich 				int odd, struct sk_buff *skb),
154226879da5SWei Wang 		    void *from, int length, int transhdrlen,
154326879da5SWei Wang 		    struct ipcm6_cookie *ipc6, struct flowi6 *fl6,
154426879da5SWei Wang 		    struct rt6_info *rt, unsigned int flags,
1545c14ac945SSoheil Hassas Yeganeh 		    const struct sockcm_cookie *sockc)
15460bbe84a6SVlad Yasevich {
15470bbe84a6SVlad Yasevich 	struct inet_sock *inet = inet_sk(sk);
15480bbe84a6SVlad Yasevich 	struct ipv6_pinfo *np = inet6_sk(sk);
15490bbe84a6SVlad Yasevich 	int exthdrlen;
15500bbe84a6SVlad Yasevich 	int err;
15510bbe84a6SVlad Yasevich 
15520bbe84a6SVlad Yasevich 	if (flags&MSG_PROBE)
15530bbe84a6SVlad Yasevich 		return 0;
15540bbe84a6SVlad Yasevich 	if (skb_queue_empty(&sk->sk_write_queue)) {
15550bbe84a6SVlad Yasevich 		/*
15560bbe84a6SVlad Yasevich 		 * setup for corking
15570bbe84a6SVlad Yasevich 		 */
155826879da5SWei Wang 		err = ip6_setup_cork(sk, &inet->cork, &np->cork,
155926879da5SWei Wang 				     ipc6, rt, fl6);
15600bbe84a6SVlad Yasevich 		if (err)
15610bbe84a6SVlad Yasevich 			return err;
15620bbe84a6SVlad Yasevich 
156326879da5SWei Wang 		exthdrlen = (ipc6->opt ? ipc6->opt->opt_flen : 0);
15640bbe84a6SVlad Yasevich 		length += exthdrlen;
15650bbe84a6SVlad Yasevich 		transhdrlen += exthdrlen;
15660bbe84a6SVlad Yasevich 	} else {
15670bbe84a6SVlad Yasevich 		fl6 = &inet->cork.fl.u.ip6;
15680bbe84a6SVlad Yasevich 		transhdrlen = 0;
15690bbe84a6SVlad Yasevich 	}
15700bbe84a6SVlad Yasevich 
15710bbe84a6SVlad Yasevich 	return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
15720bbe84a6SVlad Yasevich 				 &np->cork, sk_page_frag(sk), getfrag,
157326879da5SWei Wang 				 from, length, transhdrlen, flags, ipc6, sockc);
15740bbe84a6SVlad Yasevich }
1575a495f836SChris Elston EXPORT_SYMBOL_GPL(ip6_append_data);
15761da177e4SLinus Torvalds 
1577366e41d9SVlad Yasevich static void ip6_cork_release(struct inet_cork_full *cork,
1578366e41d9SVlad Yasevich 			     struct inet6_cork *v6_cork)
1579bf138862SPavel Emelyanov {
1580366e41d9SVlad Yasevich 	if (v6_cork->opt) {
1581366e41d9SVlad Yasevich 		kfree(v6_cork->opt->dst0opt);
1582366e41d9SVlad Yasevich 		kfree(v6_cork->opt->dst1opt);
1583366e41d9SVlad Yasevich 		kfree(v6_cork->opt->hopopt);
1584366e41d9SVlad Yasevich 		kfree(v6_cork->opt->srcrt);
1585366e41d9SVlad Yasevich 		kfree(v6_cork->opt);
1586366e41d9SVlad Yasevich 		v6_cork->opt = NULL;
15870178b695SHerbert Xu 	}
15880178b695SHerbert Xu 
1589366e41d9SVlad Yasevich 	if (cork->base.dst) {
1590366e41d9SVlad Yasevich 		dst_release(cork->base.dst);
1591366e41d9SVlad Yasevich 		cork->base.dst = NULL;
1592366e41d9SVlad Yasevich 		cork->base.flags &= ~IPCORK_ALLFRAG;
1593bf138862SPavel Emelyanov 	}
1594366e41d9SVlad Yasevich 	memset(&cork->fl, 0, sizeof(cork->fl));
1595bf138862SPavel Emelyanov }
1596bf138862SPavel Emelyanov 
15976422398cSVlad Yasevich struct sk_buff *__ip6_make_skb(struct sock *sk,
15986422398cSVlad Yasevich 			       struct sk_buff_head *queue,
15996422398cSVlad Yasevich 			       struct inet_cork_full *cork,
16006422398cSVlad Yasevich 			       struct inet6_cork *v6_cork)
16011da177e4SLinus Torvalds {
16021da177e4SLinus Torvalds 	struct sk_buff *skb, *tmp_skb;
16031da177e4SLinus Torvalds 	struct sk_buff **tail_skb;
16041da177e4SLinus Torvalds 	struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
16051da177e4SLinus Torvalds 	struct ipv6_pinfo *np = inet6_sk(sk);
16063bd653c8SDenis V. Lunev 	struct net *net = sock_net(sk);
16071da177e4SLinus Torvalds 	struct ipv6hdr *hdr;
16086422398cSVlad Yasevich 	struct ipv6_txoptions *opt = v6_cork->opt;
16096422398cSVlad Yasevich 	struct rt6_info *rt = (struct rt6_info *)cork->base.dst;
16106422398cSVlad Yasevich 	struct flowi6 *fl6 = &cork->fl.u.ip6;
16114c9483b2SDavid S. Miller 	unsigned char proto = fl6->flowi6_proto;
16121da177e4SLinus Torvalds 
16136422398cSVlad Yasevich 	skb = __skb_dequeue(queue);
161463159f29SIan Morris 	if (!skb)
16151da177e4SLinus Torvalds 		goto out;
16161da177e4SLinus Torvalds 	tail_skb = &(skb_shinfo(skb)->frag_list);
16171da177e4SLinus Torvalds 
16181da177e4SLinus Torvalds 	/* move skb->data to ip header from ext header */
1619d56f90a7SArnaldo Carvalho de Melo 	if (skb->data < skb_network_header(skb))
1620bbe735e4SArnaldo Carvalho de Melo 		__skb_pull(skb, skb_network_offset(skb));
16216422398cSVlad Yasevich 	while ((tmp_skb = __skb_dequeue(queue)) != NULL) {
1622cfe1fc77SArnaldo Carvalho de Melo 		__skb_pull(tmp_skb, skb_network_header_len(skb));
16231da177e4SLinus Torvalds 		*tail_skb = tmp_skb;
16241da177e4SLinus Torvalds 		tail_skb = &(tmp_skb->next);
16251da177e4SLinus Torvalds 		skb->len += tmp_skb->len;
16261da177e4SLinus Torvalds 		skb->data_len += tmp_skb->len;
16271da177e4SLinus Torvalds 		skb->truesize += tmp_skb->truesize;
16281da177e4SLinus Torvalds 		tmp_skb->destructor = NULL;
16291da177e4SLinus Torvalds 		tmp_skb->sk = NULL;
16301da177e4SLinus Torvalds 	}
16311da177e4SLinus Torvalds 
163228a89453SHerbert Xu 	/* Allow local fragmentation. */
163360ff7467SWANG Cong 	skb->ignore_df = ip6_sk_ignore_df(sk);
163428a89453SHerbert Xu 
16354e3fd7a0SAlexey Dobriyan 	*final_dst = fl6->daddr;
1636cfe1fc77SArnaldo Carvalho de Melo 	__skb_pull(skb, skb_network_header_len(skb));
16371da177e4SLinus Torvalds 	if (opt && opt->opt_flen)
16381da177e4SLinus Torvalds 		ipv6_push_frag_opts(skb, opt, &proto);
16391da177e4SLinus Torvalds 	if (opt && opt->opt_nflen)
1640613fa3caSDavid Lebrun 		ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst, &fl6->saddr);
16411da177e4SLinus Torvalds 
1642e2d1bca7SArnaldo Carvalho de Melo 	skb_push(skb, sizeof(struct ipv6hdr));
1643e2d1bca7SArnaldo Carvalho de Melo 	skb_reset_network_header(skb);
16440660e03fSArnaldo Carvalho de Melo 	hdr = ipv6_hdr(skb);
16451da177e4SLinus Torvalds 
16466422398cSVlad Yasevich 	ip6_flow_hdr(hdr, v6_cork->tclass,
1647cb1ce2efSTom Herbert 		     ip6_make_flowlabel(net, skb, fl6->flowlabel,
1648513674b5SShaohua Li 					ip6_autoflowlabel(net, np), fl6));
16496422398cSVlad Yasevich 	hdr->hop_limit = v6_cork->hop_limit;
16501da177e4SLinus Torvalds 	hdr->nexthdr = proto;
16514e3fd7a0SAlexey Dobriyan 	hdr->saddr = fl6->saddr;
16524e3fd7a0SAlexey Dobriyan 	hdr->daddr = *final_dst;
16531da177e4SLinus Torvalds 
1654a2c2064fSPatrick McHardy 	skb->priority = sk->sk_priority;
16554a19ec58SLaszlo Attila Toth 	skb->mark = sk->sk_mark;
1656a2c2064fSPatrick McHardy 
1657d8d1f30bSChangli Gao 	skb_dst_set(skb, dst_clone(&rt->dst));
1658edf391ffSNeil Horman 	IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
165914878f75SDavid L Stevens 	if (proto == IPPROTO_ICMPV6) {
1660adf30907SEric Dumazet 		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
166114878f75SDavid L Stevens 
166243a43b60SHannes Frederic Sowa 		ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
166343a43b60SHannes Frederic Sowa 		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
166414878f75SDavid L Stevens 	}
166514878f75SDavid L Stevens 
16666422398cSVlad Yasevich 	ip6_cork_release(cork, v6_cork);
16676422398cSVlad Yasevich out:
16686422398cSVlad Yasevich 	return skb;
16696422398cSVlad Yasevich }
16706422398cSVlad Yasevich 
16716422398cSVlad Yasevich int ip6_send_skb(struct sk_buff *skb)
16726422398cSVlad Yasevich {
16736422398cSVlad Yasevich 	struct net *net = sock_net(skb->sk);
16746422398cSVlad Yasevich 	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
16756422398cSVlad Yasevich 	int err;
16766422398cSVlad Yasevich 
167733224b16SEric W. Biederman 	err = ip6_local_out(net, skb->sk, skb);
16781da177e4SLinus Torvalds 	if (err) {
16791da177e4SLinus Torvalds 		if (err > 0)
16806ce9e7b5SEric Dumazet 			err = net_xmit_errno(err);
16811da177e4SLinus Torvalds 		if (err)
16826422398cSVlad Yasevich 			IP6_INC_STATS(net, rt->rt6i_idev,
16836422398cSVlad Yasevich 				      IPSTATS_MIB_OUTDISCARDS);
16841da177e4SLinus Torvalds 	}
16851da177e4SLinus Torvalds 
16861da177e4SLinus Torvalds 	return err;
16876422398cSVlad Yasevich }
16886422398cSVlad Yasevich 
16896422398cSVlad Yasevich int ip6_push_pending_frames(struct sock *sk)
16906422398cSVlad Yasevich {
16916422398cSVlad Yasevich 	struct sk_buff *skb;
16926422398cSVlad Yasevich 
16936422398cSVlad Yasevich 	skb = ip6_finish_skb(sk);
16946422398cSVlad Yasevich 	if (!skb)
16956422398cSVlad Yasevich 		return 0;
16966422398cSVlad Yasevich 
16976422398cSVlad Yasevich 	return ip6_send_skb(skb);
16981da177e4SLinus Torvalds }
1699a495f836SChris Elston EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
17001da177e4SLinus Torvalds 
17010bbe84a6SVlad Yasevich static void __ip6_flush_pending_frames(struct sock *sk,
17026422398cSVlad Yasevich 				       struct sk_buff_head *queue,
17036422398cSVlad Yasevich 				       struct inet_cork_full *cork,
17046422398cSVlad Yasevich 				       struct inet6_cork *v6_cork)
17051da177e4SLinus Torvalds {
17061da177e4SLinus Torvalds 	struct sk_buff *skb;
17071da177e4SLinus Torvalds 
17080bbe84a6SVlad Yasevich 	while ((skb = __skb_dequeue_tail(queue)) != NULL) {
1709adf30907SEric Dumazet 		if (skb_dst(skb))
1710adf30907SEric Dumazet 			IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1711a11d206dSYOSHIFUJI Hideaki 				      IPSTATS_MIB_OUTDISCARDS);
17121da177e4SLinus Torvalds 		kfree_skb(skb);
17131da177e4SLinus Torvalds 	}
17141da177e4SLinus Torvalds 
17156422398cSVlad Yasevich 	ip6_cork_release(cork, v6_cork);
17161da177e4SLinus Torvalds }
17170bbe84a6SVlad Yasevich 
17180bbe84a6SVlad Yasevich void ip6_flush_pending_frames(struct sock *sk)
17190bbe84a6SVlad Yasevich {
17206422398cSVlad Yasevich 	__ip6_flush_pending_frames(sk, &sk->sk_write_queue,
17216422398cSVlad Yasevich 				   &inet_sk(sk)->cork, &inet6_sk(sk)->cork);
17220bbe84a6SVlad Yasevich }
1723a495f836SChris Elston EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
17246422398cSVlad Yasevich 
17256422398cSVlad Yasevich struct sk_buff *ip6_make_skb(struct sock *sk,
17266422398cSVlad Yasevich 			     int getfrag(void *from, char *to, int offset,
17276422398cSVlad Yasevich 					 int len, int odd, struct sk_buff *skb),
17286422398cSVlad Yasevich 			     void *from, int length, int transhdrlen,
172926879da5SWei Wang 			     struct ipcm6_cookie *ipc6, struct flowi6 *fl6,
17306422398cSVlad Yasevich 			     struct rt6_info *rt, unsigned int flags,
173126879da5SWei Wang 			     const struct sockcm_cookie *sockc)
17326422398cSVlad Yasevich {
17336422398cSVlad Yasevich 	struct inet_cork_full cork;
17346422398cSVlad Yasevich 	struct inet6_cork v6_cork;
17356422398cSVlad Yasevich 	struct sk_buff_head queue;
173626879da5SWei Wang 	int exthdrlen = (ipc6->opt ? ipc6->opt->opt_flen : 0);
17376422398cSVlad Yasevich 	int err;
17386422398cSVlad Yasevich 
17396422398cSVlad Yasevich 	if (flags & MSG_PROBE)
17406422398cSVlad Yasevich 		return NULL;
17416422398cSVlad Yasevich 
17426422398cSVlad Yasevich 	__skb_queue_head_init(&queue);
17436422398cSVlad Yasevich 
17446422398cSVlad Yasevich 	cork.base.flags = 0;
17456422398cSVlad Yasevich 	cork.base.addr = 0;
17466422398cSVlad Yasevich 	cork.base.opt = NULL;
174795ef498dSEric Dumazet 	cork.base.dst = NULL;
17486422398cSVlad Yasevich 	v6_cork.opt = NULL;
174926879da5SWei Wang 	err = ip6_setup_cork(sk, &cork, &v6_cork, ipc6, rt, fl6);
1750862c03eeSEric Dumazet 	if (err) {
1751862c03eeSEric Dumazet 		ip6_cork_release(&cork, &v6_cork);
17526422398cSVlad Yasevich 		return ERR_PTR(err);
1753862c03eeSEric Dumazet 	}
175426879da5SWei Wang 	if (ipc6->dontfrag < 0)
175526879da5SWei Wang 		ipc6->dontfrag = inet6_sk(sk)->dontfrag;
17566422398cSVlad Yasevich 
17576422398cSVlad Yasevich 	err = __ip6_append_data(sk, fl6, &queue, &cork.base, &v6_cork,
17586422398cSVlad Yasevich 				&current->task_frag, getfrag, from,
17596422398cSVlad Yasevich 				length + exthdrlen, transhdrlen + exthdrlen,
176026879da5SWei Wang 				flags, ipc6, sockc);
17616422398cSVlad Yasevich 	if (err) {
17626422398cSVlad Yasevich 		__ip6_flush_pending_frames(sk, &queue, &cork, &v6_cork);
17636422398cSVlad Yasevich 		return ERR_PTR(err);
17646422398cSVlad Yasevich 	}
17656422398cSVlad Yasevich 
17666422398cSVlad Yasevich 	return __ip6_make_skb(sk, &queue, &cork, &v6_cork);
17676422398cSVlad Yasevich }
1768