xref: /openbmc/linux/net/ipv6/mcast.c (revision e868d61272caa648214046a096e5a6bfc068dc8c)
1 /*
2  *	Multicast support for IPv6
3  *	Linux INET6 implementation
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *
8  *	$Id: mcast.c,v 1.40 2002/02/08 03:57:19 davem Exp $
9  *
10  *	Based on linux/ipv4/igmp.c and linux/ipv4/ip_sockglue.c
11  *
12  *	This program is free software; you can redistribute it and/or
13  *      modify it under the terms of the GNU General Public License
14  *      as published by the Free Software Foundation; either version
15  *      2 of the License, or (at your option) any later version.
16  */
17 
18 /* Changes:
19  *
20  *	yoshfuji	: fix format of router-alert option
21  *	YOSHIFUJI Hideaki @USAGI:
22  *		Fixed source address for MLD message based on
23  *		<draft-ietf-magma-mld-source-05.txt>.
24  *	YOSHIFUJI Hideaki @USAGI:
25  *		- Ignore Queries for invalid addresses.
26  *		- MLD for link-local addresses.
27  *	David L Stevens <dlstevens@us.ibm.com>:
28  *		- MLDv2 support
29  */
30 
31 #include <linux/module.h>
32 #include <linux/errno.h>
33 #include <linux/types.h>
34 #include <linux/string.h>
35 #include <linux/socket.h>
36 #include <linux/sockios.h>
37 #include <linux/jiffies.h>
38 #include <linux/times.h>
39 #include <linux/net.h>
40 #include <linux/in.h>
41 #include <linux/in6.h>
42 #include <linux/netdevice.h>
43 #include <linux/if_arp.h>
44 #include <linux/route.h>
45 #include <linux/init.h>
46 #include <linux/proc_fs.h>
47 #include <linux/seq_file.h>
48 
49 #include <linux/netfilter.h>
50 #include <linux/netfilter_ipv6.h>
51 
52 #include <net/sock.h>
53 #include <net/snmp.h>
54 
55 #include <net/ipv6.h>
56 #include <net/protocol.h>
57 #include <net/if_inet6.h>
58 #include <net/ndisc.h>
59 #include <net/addrconf.h>
60 #include <net/ip6_route.h>
61 
62 #include <net/ip6_checksum.h>
63 
64 /* Set to 3 to get tracing... */
65 #define MCAST_DEBUG 2
66 
67 #if MCAST_DEBUG >= 3
68 #define MDBG(x) printk x
69 #else
70 #define MDBG(x)
71 #endif
72 
73 /*
74  *  These header formats should be in a separate include file, but icmpv6.h
75  *  doesn't have in6_addr defined in all cases, there is no __u128, and no
76  *  other files reference these.
77  *
78  *  			+-DLS 4/14/03
79  */
80 
81 /* Multicast Listener Discovery version 2 headers */
82 
83 struct mld2_grec {
84 	__u8		grec_type;
85 	__u8		grec_auxwords;
86 	__be16		grec_nsrcs;
87 	struct in6_addr	grec_mca;
88 	struct in6_addr	grec_src[0];
89 };
90 
91 struct mld2_report {
92 	__u8	type;
93 	__u8	resv1;
94 	__sum16	csum;
95 	__be16	resv2;
96 	__be16	ngrec;
97 	struct mld2_grec grec[0];
98 };
99 
100 struct mld2_query {
101 	__u8 type;
102 	__u8 code;
103 	__sum16 csum;
104 	__be16 mrc;
105 	__be16 resv1;
106 	struct in6_addr mca;
107 #if defined(__LITTLE_ENDIAN_BITFIELD)
108 	__u8 qrv:3,
109 	     suppress:1,
110 	     resv2:4;
111 #elif defined(__BIG_ENDIAN_BITFIELD)
112 	__u8 resv2:4,
113 	     suppress:1,
114 	     qrv:3;
115 #else
116 #error "Please fix <asm/byteorder.h>"
117 #endif
118 	__u8 qqic;
119 	__be16 nsrcs;
120 	struct in6_addr srcs[0];
121 };
122 
123 static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
124 
125 /* Big mc list lock for all the sockets */
126 static DEFINE_RWLOCK(ipv6_sk_mc_lock);
127 
128 static struct socket *igmp6_socket;
129 
130 int __ipv6_dev_mc_dec(struct inet6_dev *idev, struct in6_addr *addr);
131 
132 static void igmp6_join_group(struct ifmcaddr6 *ma);
133 static void igmp6_leave_group(struct ifmcaddr6 *ma);
134 static void igmp6_timer_handler(unsigned long data);
135 
136 static void mld_gq_timer_expire(unsigned long data);
137 static void mld_ifc_timer_expire(unsigned long data);
138 static void mld_ifc_event(struct inet6_dev *idev);
139 static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
140 static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *addr);
141 static void mld_clear_delrec(struct inet6_dev *idev);
142 static int sf_setstate(struct ifmcaddr6 *pmc);
143 static void sf_markstate(struct ifmcaddr6 *pmc);
144 static void ip6_mc_clear_src(struct ifmcaddr6 *pmc);
145 static int ip6_mc_del_src(struct inet6_dev *idev, struct in6_addr *pmca,
146 			  int sfmode, int sfcount, struct in6_addr *psfsrc,
147 			  int delta);
148 static int ip6_mc_add_src(struct inet6_dev *idev, struct in6_addr *pmca,
149 			  int sfmode, int sfcount, struct in6_addr *psfsrc,
150 			  int delta);
151 static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
152 			    struct inet6_dev *idev);
153 
154 
155 #define IGMP6_UNSOLICITED_IVAL	(10*HZ)
156 #define MLD_QRV_DEFAULT		2
157 
158 #define MLD_V1_SEEN(idev) (ipv6_devconf.force_mld_version == 1 || \
159 		(idev)->cnf.force_mld_version == 1 || \
160 		((idev)->mc_v1_seen && \
161 		time_before(jiffies, (idev)->mc_v1_seen)))
162 
163 #define MLDV2_MASK(value, nb) ((nb)>=32 ? (value) : ((1<<(nb))-1) & (value))
164 #define MLDV2_EXP(thresh, nbmant, nbexp, value) \
165 	((value) < (thresh) ? (value) : \
166 	((MLDV2_MASK(value, nbmant) | (1<<(nbmant))) << \
167 	(MLDV2_MASK((value) >> (nbmant), nbexp) + (nbexp))))
168 
169 #define MLDV2_QQIC(value) MLDV2_EXP(0x80, 4, 3, value)
170 #define MLDV2_MRC(value) MLDV2_EXP(0x8000, 12, 3, value)
171 
172 #define IPV6_MLD_MAX_MSF	64
173 
174 int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
175 
176 /*
177  *	socket join on multicast group
178  */
179 
180 int ipv6_sock_mc_join(struct sock *sk, int ifindex, struct in6_addr *addr)
181 {
182 	struct net_device *dev = NULL;
183 	struct ipv6_mc_socklist *mc_lst;
184 	struct ipv6_pinfo *np = inet6_sk(sk);
185 	int err;
186 
187 	if (!ipv6_addr_is_multicast(addr))
188 		return -EINVAL;
189 
190 	read_lock_bh(&ipv6_sk_mc_lock);
191 	for (mc_lst=np->ipv6_mc_list; mc_lst; mc_lst=mc_lst->next) {
192 		if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
193 		    ipv6_addr_equal(&mc_lst->addr, addr)) {
194 			read_unlock_bh(&ipv6_sk_mc_lock);
195 			return -EADDRINUSE;
196 		}
197 	}
198 	read_unlock_bh(&ipv6_sk_mc_lock);
199 
200 	mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
201 
202 	if (mc_lst == NULL)
203 		return -ENOMEM;
204 
205 	mc_lst->next = NULL;
206 	ipv6_addr_copy(&mc_lst->addr, addr);
207 
208 	if (ifindex == 0) {
209 		struct rt6_info *rt;
210 		rt = rt6_lookup(addr, NULL, 0, 0);
211 		if (rt) {
212 			dev = rt->rt6i_dev;
213 			dev_hold(dev);
214 			dst_release(&rt->u.dst);
215 		}
216 	} else
217 		dev = dev_get_by_index(ifindex);
218 
219 	if (dev == NULL) {
220 		sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
221 		return -ENODEV;
222 	}
223 
224 	mc_lst->ifindex = dev->ifindex;
225 	mc_lst->sfmode = MCAST_EXCLUDE;
226 	rwlock_init(&mc_lst->sflock);
227 	mc_lst->sflist = NULL;
228 
229 	/*
230 	 *	now add/increase the group membership on the device
231 	 */
232 
233 	err = ipv6_dev_mc_inc(dev, addr);
234 
235 	if (err) {
236 		sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
237 		dev_put(dev);
238 		return err;
239 	}
240 
241 	write_lock_bh(&ipv6_sk_mc_lock);
242 	mc_lst->next = np->ipv6_mc_list;
243 	np->ipv6_mc_list = mc_lst;
244 	write_unlock_bh(&ipv6_sk_mc_lock);
245 
246 	dev_put(dev);
247 
248 	return 0;
249 }
250 
251 /*
252  *	socket leave on multicast group
253  */
254 int ipv6_sock_mc_drop(struct sock *sk, int ifindex, struct in6_addr *addr)
255 {
256 	struct ipv6_pinfo *np = inet6_sk(sk);
257 	struct ipv6_mc_socklist *mc_lst, **lnk;
258 
259 	write_lock_bh(&ipv6_sk_mc_lock);
260 	for (lnk = &np->ipv6_mc_list; (mc_lst = *lnk) !=NULL ; lnk = &mc_lst->next) {
261 		if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
262 		    ipv6_addr_equal(&mc_lst->addr, addr)) {
263 			struct net_device *dev;
264 
265 			*lnk = mc_lst->next;
266 			write_unlock_bh(&ipv6_sk_mc_lock);
267 
268 			if ((dev = dev_get_by_index(mc_lst->ifindex)) != NULL) {
269 				struct inet6_dev *idev = in6_dev_get(dev);
270 
271 				(void) ip6_mc_leave_src(sk, mc_lst, idev);
272 				if (idev) {
273 					__ipv6_dev_mc_dec(idev, &mc_lst->addr);
274 					in6_dev_put(idev);
275 				}
276 				dev_put(dev);
277 			} else
278 				(void) ip6_mc_leave_src(sk, mc_lst, NULL);
279 			sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
280 			return 0;
281 		}
282 	}
283 	write_unlock_bh(&ipv6_sk_mc_lock);
284 
285 	return -EADDRNOTAVAIL;
286 }
287 
288 static struct inet6_dev *ip6_mc_find_dev(struct in6_addr *group, int ifindex)
289 {
290 	struct net_device *dev = NULL;
291 	struct inet6_dev *idev = NULL;
292 
293 	if (ifindex == 0) {
294 		struct rt6_info *rt;
295 
296 		rt = rt6_lookup(group, NULL, 0, 0);
297 		if (rt) {
298 			dev = rt->rt6i_dev;
299 			dev_hold(dev);
300 			dst_release(&rt->u.dst);
301 		}
302 	} else
303 		dev = dev_get_by_index(ifindex);
304 
305 	if (!dev)
306 		return NULL;
307 	idev = in6_dev_get(dev);
308 	if (!idev) {
309 		dev_put(dev);
310 		return NULL;
311 	}
312 	read_lock_bh(&idev->lock);
313 	if (idev->dead) {
314 		read_unlock_bh(&idev->lock);
315 		in6_dev_put(idev);
316 		dev_put(dev);
317 		return NULL;
318 	}
319 	return idev;
320 }
321 
322 void ipv6_sock_mc_close(struct sock *sk)
323 {
324 	struct ipv6_pinfo *np = inet6_sk(sk);
325 	struct ipv6_mc_socklist *mc_lst;
326 
327 	write_lock_bh(&ipv6_sk_mc_lock);
328 	while ((mc_lst = np->ipv6_mc_list) != NULL) {
329 		struct net_device *dev;
330 
331 		np->ipv6_mc_list = mc_lst->next;
332 		write_unlock_bh(&ipv6_sk_mc_lock);
333 
334 		dev = dev_get_by_index(mc_lst->ifindex);
335 		if (dev) {
336 			struct inet6_dev *idev = in6_dev_get(dev);
337 
338 			(void) ip6_mc_leave_src(sk, mc_lst, idev);
339 			if (idev) {
340 				__ipv6_dev_mc_dec(idev, &mc_lst->addr);
341 				in6_dev_put(idev);
342 			}
343 			dev_put(dev);
344 		} else
345 			(void) ip6_mc_leave_src(sk, mc_lst, NULL);
346 
347 		sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
348 
349 		write_lock_bh(&ipv6_sk_mc_lock);
350 	}
351 	write_unlock_bh(&ipv6_sk_mc_lock);
352 }
353 
354 int ip6_mc_source(int add, int omode, struct sock *sk,
355 	struct group_source_req *pgsr)
356 {
357 	struct in6_addr *source, *group;
358 	struct ipv6_mc_socklist *pmc;
359 	struct net_device *dev;
360 	struct inet6_dev *idev;
361 	struct ipv6_pinfo *inet6 = inet6_sk(sk);
362 	struct ip6_sf_socklist *psl;
363 	int i, j, rv;
364 	int leavegroup = 0;
365 	int pmclocked = 0;
366 	int err;
367 
368 	if (pgsr->gsr_group.ss_family != AF_INET6 ||
369 	    pgsr->gsr_source.ss_family != AF_INET6)
370 		return -EINVAL;
371 
372 	source = &((struct sockaddr_in6 *)&pgsr->gsr_source)->sin6_addr;
373 	group = &((struct sockaddr_in6 *)&pgsr->gsr_group)->sin6_addr;
374 
375 	if (!ipv6_addr_is_multicast(group))
376 		return -EINVAL;
377 
378 	idev = ip6_mc_find_dev(group, pgsr->gsr_interface);
379 	if (!idev)
380 		return -ENODEV;
381 	dev = idev->dev;
382 
383 	err = -EADDRNOTAVAIL;
384 
385 	read_lock_bh(&ipv6_sk_mc_lock);
386 	for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
387 		if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
388 			continue;
389 		if (ipv6_addr_equal(&pmc->addr, group))
390 			break;
391 	}
392 	if (!pmc) {		/* must have a prior join */
393 		err = -EINVAL;
394 		goto done;
395 	}
396 	/* if a source filter was set, must be the same mode as before */
397 	if (pmc->sflist) {
398 		if (pmc->sfmode != omode) {
399 			err = -EINVAL;
400 			goto done;
401 		}
402 	} else if (pmc->sfmode != omode) {
403 		/* allow mode switches for empty-set filters */
404 		ip6_mc_add_src(idev, group, omode, 0, NULL, 0);
405 		ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
406 		pmc->sfmode = omode;
407 	}
408 
409 	write_lock_bh(&pmc->sflock);
410 	pmclocked = 1;
411 
412 	psl = pmc->sflist;
413 	if (!add) {
414 		if (!psl)
415 			goto done;	/* err = -EADDRNOTAVAIL */
416 		rv = !0;
417 		for (i=0; i<psl->sl_count; i++) {
418 			rv = memcmp(&psl->sl_addr[i], source,
419 				sizeof(struct in6_addr));
420 			if (rv == 0)
421 				break;
422 		}
423 		if (rv)		/* source not found */
424 			goto done;	/* err = -EADDRNOTAVAIL */
425 
426 		/* special case - (INCLUDE, empty) == LEAVE_GROUP */
427 		if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
428 			leavegroup = 1;
429 			goto done;
430 		}
431 
432 		/* update the interface filter */
433 		ip6_mc_del_src(idev, group, omode, 1, source, 1);
434 
435 		for (j=i+1; j<psl->sl_count; j++)
436 			psl->sl_addr[j-1] = psl->sl_addr[j];
437 		psl->sl_count--;
438 		err = 0;
439 		goto done;
440 	}
441 	/* else, add a new source to the filter */
442 
443 	if (psl && psl->sl_count >= sysctl_mld_max_msf) {
444 		err = -ENOBUFS;
445 		goto done;
446 	}
447 	if (!psl || psl->sl_count == psl->sl_max) {
448 		struct ip6_sf_socklist *newpsl;
449 		int count = IP6_SFBLOCK;
450 
451 		if (psl)
452 			count += psl->sl_max;
453 		newpsl = sock_kmalloc(sk, IP6_SFLSIZE(count), GFP_ATOMIC);
454 		if (!newpsl) {
455 			err = -ENOBUFS;
456 			goto done;
457 		}
458 		newpsl->sl_max = count;
459 		newpsl->sl_count = count - IP6_SFBLOCK;
460 		if (psl) {
461 			for (i=0; i<psl->sl_count; i++)
462 				newpsl->sl_addr[i] = psl->sl_addr[i];
463 			sock_kfree_s(sk, psl, IP6_SFLSIZE(psl->sl_max));
464 		}
465 		pmc->sflist = psl = newpsl;
466 	}
467 	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
468 	for (i=0; i<psl->sl_count; i++) {
469 		rv = memcmp(&psl->sl_addr[i], source, sizeof(struct in6_addr));
470 		if (rv == 0)
471 			break;
472 	}
473 	if (rv == 0)		/* address already there is an error */
474 		goto done;
475 	for (j=psl->sl_count-1; j>=i; j--)
476 		psl->sl_addr[j+1] = psl->sl_addr[j];
477 	psl->sl_addr[i] = *source;
478 	psl->sl_count++;
479 	err = 0;
480 	/* update the interface list */
481 	ip6_mc_add_src(idev, group, omode, 1, source, 1);
482 done:
483 	if (pmclocked)
484 		write_unlock_bh(&pmc->sflock);
485 	read_unlock_bh(&ipv6_sk_mc_lock);
486 	read_unlock_bh(&idev->lock);
487 	in6_dev_put(idev);
488 	dev_put(dev);
489 	if (leavegroup)
490 		return ipv6_sock_mc_drop(sk, pgsr->gsr_interface, group);
491 	return err;
492 }
493 
494 int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
495 {
496 	struct in6_addr *group;
497 	struct ipv6_mc_socklist *pmc;
498 	struct net_device *dev;
499 	struct inet6_dev *idev;
500 	struct ipv6_pinfo *inet6 = inet6_sk(sk);
501 	struct ip6_sf_socklist *newpsl, *psl;
502 	int leavegroup = 0;
503 	int i, err;
504 
505 	group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
506 
507 	if (!ipv6_addr_is_multicast(group))
508 		return -EINVAL;
509 	if (gsf->gf_fmode != MCAST_INCLUDE &&
510 	    gsf->gf_fmode != MCAST_EXCLUDE)
511 		return -EINVAL;
512 
513 	idev = ip6_mc_find_dev(group, gsf->gf_interface);
514 
515 	if (!idev)
516 		return -ENODEV;
517 	dev = idev->dev;
518 
519 	err = 0;
520 	read_lock_bh(&ipv6_sk_mc_lock);
521 
522 	if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) {
523 		leavegroup = 1;
524 		goto done;
525 	}
526 
527 	for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
528 		if (pmc->ifindex != gsf->gf_interface)
529 			continue;
530 		if (ipv6_addr_equal(&pmc->addr, group))
531 			break;
532 	}
533 	if (!pmc) {		/* must have a prior join */
534 		err = -EINVAL;
535 		goto done;
536 	}
537 	if (gsf->gf_numsrc) {
538 		newpsl = sock_kmalloc(sk, IP6_SFLSIZE(gsf->gf_numsrc),
539 							  GFP_ATOMIC);
540 		if (!newpsl) {
541 			err = -ENOBUFS;
542 			goto done;
543 		}
544 		newpsl->sl_max = newpsl->sl_count = gsf->gf_numsrc;
545 		for (i=0; i<newpsl->sl_count; ++i) {
546 			struct sockaddr_in6 *psin6;
547 
548 			psin6 = (struct sockaddr_in6 *)&gsf->gf_slist[i];
549 			newpsl->sl_addr[i] = psin6->sin6_addr;
550 		}
551 		err = ip6_mc_add_src(idev, group, gsf->gf_fmode,
552 			newpsl->sl_count, newpsl->sl_addr, 0);
553 		if (err) {
554 			sock_kfree_s(sk, newpsl, IP6_SFLSIZE(newpsl->sl_max));
555 			goto done;
556 		}
557 	} else {
558 		newpsl = NULL;
559 		(void) ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0);
560 	}
561 
562 	write_lock_bh(&pmc->sflock);
563 	psl = pmc->sflist;
564 	if (psl) {
565 		(void) ip6_mc_del_src(idev, group, pmc->sfmode,
566 			psl->sl_count, psl->sl_addr, 0);
567 		sock_kfree_s(sk, psl, IP6_SFLSIZE(psl->sl_max));
568 	} else
569 		(void) ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
570 	pmc->sflist = newpsl;
571 	pmc->sfmode = gsf->gf_fmode;
572 	write_unlock_bh(&pmc->sflock);
573 	err = 0;
574 done:
575 	read_unlock_bh(&ipv6_sk_mc_lock);
576 	read_unlock_bh(&idev->lock);
577 	in6_dev_put(idev);
578 	dev_put(dev);
579 	if (leavegroup)
580 		err = ipv6_sock_mc_drop(sk, gsf->gf_interface, group);
581 	return err;
582 }
583 
584 int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
585 	struct group_filter __user *optval, int __user *optlen)
586 {
587 	int err, i, count, copycount;
588 	struct in6_addr *group;
589 	struct ipv6_mc_socklist *pmc;
590 	struct inet6_dev *idev;
591 	struct net_device *dev;
592 	struct ipv6_pinfo *inet6 = inet6_sk(sk);
593 	struct ip6_sf_socklist *psl;
594 
595 	group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
596 
597 	if (!ipv6_addr_is_multicast(group))
598 		return -EINVAL;
599 
600 	idev = ip6_mc_find_dev(group, gsf->gf_interface);
601 
602 	if (!idev)
603 		return -ENODEV;
604 
605 	dev = idev->dev;
606 
607 	err = -EADDRNOTAVAIL;
608 	/*
609 	 * changes to the ipv6_mc_list require the socket lock and
610 	 * a read lock on ip6_sk_mc_lock. We have the socket lock,
611 	 * so reading the list is safe.
612 	 */
613 
614 	for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
615 		if (pmc->ifindex != gsf->gf_interface)
616 			continue;
617 		if (ipv6_addr_equal(group, &pmc->addr))
618 			break;
619 	}
620 	if (!pmc)		/* must have a prior join */
621 		goto done;
622 	gsf->gf_fmode = pmc->sfmode;
623 	psl = pmc->sflist;
624 	count = psl ? psl->sl_count : 0;
625 	read_unlock_bh(&idev->lock);
626 	in6_dev_put(idev);
627 	dev_put(dev);
628 
629 	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
630 	gsf->gf_numsrc = count;
631 	if (put_user(GROUP_FILTER_SIZE(copycount), optlen) ||
632 	    copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
633 		return -EFAULT;
634 	}
635 	/* changes to psl require the socket lock, a read lock on
636 	 * on ipv6_sk_mc_lock and a write lock on pmc->sflock. We
637 	 * have the socket lock, so reading here is safe.
638 	 */
639 	for (i=0; i<copycount; i++) {
640 		struct sockaddr_in6 *psin6;
641 		struct sockaddr_storage ss;
642 
643 		psin6 = (struct sockaddr_in6 *)&ss;
644 		memset(&ss, 0, sizeof(ss));
645 		psin6->sin6_family = AF_INET6;
646 		psin6->sin6_addr = psl->sl_addr[i];
647 		if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss)))
648 			return -EFAULT;
649 	}
650 	return 0;
651 done:
652 	read_unlock_bh(&idev->lock);
653 	in6_dev_put(idev);
654 	dev_put(dev);
655 	return err;
656 }
657 
658 int inet6_mc_check(struct sock *sk, struct in6_addr *mc_addr,
659 	struct in6_addr *src_addr)
660 {
661 	struct ipv6_pinfo *np = inet6_sk(sk);
662 	struct ipv6_mc_socklist *mc;
663 	struct ip6_sf_socklist *psl;
664 	int rv = 1;
665 
666 	read_lock(&ipv6_sk_mc_lock);
667 	for (mc = np->ipv6_mc_list; mc; mc = mc->next) {
668 		if (ipv6_addr_equal(&mc->addr, mc_addr))
669 			break;
670 	}
671 	if (!mc) {
672 		read_unlock(&ipv6_sk_mc_lock);
673 		return 1;
674 	}
675 	read_lock(&mc->sflock);
676 	psl = mc->sflist;
677 	if (!psl) {
678 		rv = mc->sfmode == MCAST_EXCLUDE;
679 	} else {
680 		int i;
681 
682 		for (i=0; i<psl->sl_count; i++) {
683 			if (ipv6_addr_equal(&psl->sl_addr[i], src_addr))
684 				break;
685 		}
686 		if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
687 			rv = 0;
688 		if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
689 			rv = 0;
690 	}
691 	read_unlock(&mc->sflock);
692 	read_unlock(&ipv6_sk_mc_lock);
693 
694 	return rv;
695 }
696 
697 static void ma_put(struct ifmcaddr6 *mc)
698 {
699 	if (atomic_dec_and_test(&mc->mca_refcnt)) {
700 		in6_dev_put(mc->idev);
701 		kfree(mc);
702 	}
703 }
704 
705 static void igmp6_group_added(struct ifmcaddr6 *mc)
706 {
707 	struct net_device *dev = mc->idev->dev;
708 	char buf[MAX_ADDR_LEN];
709 
710 	spin_lock_bh(&mc->mca_lock);
711 	if (!(mc->mca_flags&MAF_LOADED)) {
712 		mc->mca_flags |= MAF_LOADED;
713 		if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
714 			dev_mc_add(dev, buf, dev->addr_len, 0);
715 	}
716 	spin_unlock_bh(&mc->mca_lock);
717 
718 	if (!(dev->flags & IFF_UP) || (mc->mca_flags & MAF_NOREPORT))
719 		return;
720 
721 	if (MLD_V1_SEEN(mc->idev)) {
722 		igmp6_join_group(mc);
723 		return;
724 	}
725 	/* else v2 */
726 
727 	mc->mca_crcount = mc->idev->mc_qrv;
728 	mld_ifc_event(mc->idev);
729 }
730 
731 static void igmp6_group_dropped(struct ifmcaddr6 *mc)
732 {
733 	struct net_device *dev = mc->idev->dev;
734 	char buf[MAX_ADDR_LEN];
735 
736 	spin_lock_bh(&mc->mca_lock);
737 	if (mc->mca_flags&MAF_LOADED) {
738 		mc->mca_flags &= ~MAF_LOADED;
739 		if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
740 			dev_mc_delete(dev, buf, dev->addr_len, 0);
741 	}
742 
743 	if (mc->mca_flags & MAF_NOREPORT)
744 		goto done;
745 	spin_unlock_bh(&mc->mca_lock);
746 
747 	if (!mc->idev->dead)
748 		igmp6_leave_group(mc);
749 
750 	spin_lock_bh(&mc->mca_lock);
751 	if (del_timer(&mc->mca_timer))
752 		atomic_dec(&mc->mca_refcnt);
753 done:
754 	ip6_mc_clear_src(mc);
755 	spin_unlock_bh(&mc->mca_lock);
756 }
757 
758 /*
759  * deleted ifmcaddr6 manipulation
760  */
761 static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
762 {
763 	struct ifmcaddr6 *pmc;
764 
765 	/* this is an "ifmcaddr6" for convenience; only the fields below
766 	 * are actually used. In particular, the refcnt and users are not
767 	 * used for management of the delete list. Using the same structure
768 	 * for deleted items allows change reports to use common code with
769 	 * non-deleted or query-response MCA's.
770 	 */
771 	pmc = kzalloc(sizeof(*pmc), GFP_ATOMIC);
772 	if (!pmc)
773 		return;
774 
775 	spin_lock_bh(&im->mca_lock);
776 	spin_lock_init(&pmc->mca_lock);
777 	pmc->idev = im->idev;
778 	in6_dev_hold(idev);
779 	pmc->mca_addr = im->mca_addr;
780 	pmc->mca_crcount = idev->mc_qrv;
781 	pmc->mca_sfmode = im->mca_sfmode;
782 	if (pmc->mca_sfmode == MCAST_INCLUDE) {
783 		struct ip6_sf_list *psf;
784 
785 		pmc->mca_tomb = im->mca_tomb;
786 		pmc->mca_sources = im->mca_sources;
787 		im->mca_tomb = im->mca_sources = NULL;
788 		for (psf=pmc->mca_sources; psf; psf=psf->sf_next)
789 			psf->sf_crcount = pmc->mca_crcount;
790 	}
791 	spin_unlock_bh(&im->mca_lock);
792 
793 	write_lock_bh(&idev->mc_lock);
794 	pmc->next = idev->mc_tomb;
795 	idev->mc_tomb = pmc;
796 	write_unlock_bh(&idev->mc_lock);
797 }
798 
799 static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *pmca)
800 {
801 	struct ifmcaddr6 *pmc, *pmc_prev;
802 	struct ip6_sf_list *psf, *psf_next;
803 
804 	write_lock_bh(&idev->mc_lock);
805 	pmc_prev = NULL;
806 	for (pmc=idev->mc_tomb; pmc; pmc=pmc->next) {
807 		if (ipv6_addr_equal(&pmc->mca_addr, pmca))
808 			break;
809 		pmc_prev = pmc;
810 	}
811 	if (pmc) {
812 		if (pmc_prev)
813 			pmc_prev->next = pmc->next;
814 		else
815 			idev->mc_tomb = pmc->next;
816 	}
817 	write_unlock_bh(&idev->mc_lock);
818 	if (pmc) {
819 		for (psf=pmc->mca_tomb; psf; psf=psf_next) {
820 			psf_next = psf->sf_next;
821 			kfree(psf);
822 		}
823 		in6_dev_put(pmc->idev);
824 		kfree(pmc);
825 	}
826 }
827 
828 static void mld_clear_delrec(struct inet6_dev *idev)
829 {
830 	struct ifmcaddr6 *pmc, *nextpmc;
831 
832 	write_lock_bh(&idev->mc_lock);
833 	pmc = idev->mc_tomb;
834 	idev->mc_tomb = NULL;
835 	write_unlock_bh(&idev->mc_lock);
836 
837 	for (; pmc; pmc = nextpmc) {
838 		nextpmc = pmc->next;
839 		ip6_mc_clear_src(pmc);
840 		in6_dev_put(pmc->idev);
841 		kfree(pmc);
842 	}
843 
844 	/* clear dead sources, too */
845 	read_lock_bh(&idev->lock);
846 	for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
847 		struct ip6_sf_list *psf, *psf_next;
848 
849 		spin_lock_bh(&pmc->mca_lock);
850 		psf = pmc->mca_tomb;
851 		pmc->mca_tomb = NULL;
852 		spin_unlock_bh(&pmc->mca_lock);
853 		for (; psf; psf=psf_next) {
854 			psf_next = psf->sf_next;
855 			kfree(psf);
856 		}
857 	}
858 	read_unlock_bh(&idev->lock);
859 }
860 
861 
862 /*
863  *	device multicast group inc (add if not found)
864  */
865 int ipv6_dev_mc_inc(struct net_device *dev, struct in6_addr *addr)
866 {
867 	struct ifmcaddr6 *mc;
868 	struct inet6_dev *idev;
869 
870 	idev = in6_dev_get(dev);
871 
872 	if (idev == NULL)
873 		return -EINVAL;
874 
875 	write_lock_bh(&idev->lock);
876 	if (idev->dead) {
877 		write_unlock_bh(&idev->lock);
878 		in6_dev_put(idev);
879 		return -ENODEV;
880 	}
881 
882 	for (mc = idev->mc_list; mc; mc = mc->next) {
883 		if (ipv6_addr_equal(&mc->mca_addr, addr)) {
884 			mc->mca_users++;
885 			write_unlock_bh(&idev->lock);
886 			ip6_mc_add_src(idev, &mc->mca_addr, MCAST_EXCLUDE, 0,
887 				NULL, 0);
888 			in6_dev_put(idev);
889 			return 0;
890 		}
891 	}
892 
893 	/*
894 	 *	not found: create a new one.
895 	 */
896 
897 	mc = kzalloc(sizeof(struct ifmcaddr6), GFP_ATOMIC);
898 
899 	if (mc == NULL) {
900 		write_unlock_bh(&idev->lock);
901 		in6_dev_put(idev);
902 		return -ENOMEM;
903 	}
904 
905 	init_timer(&mc->mca_timer);
906 	mc->mca_timer.function = igmp6_timer_handler;
907 	mc->mca_timer.data = (unsigned long) mc;
908 
909 	ipv6_addr_copy(&mc->mca_addr, addr);
910 	mc->idev = idev;
911 	mc->mca_users = 1;
912 	/* mca_stamp should be updated upon changes */
913 	mc->mca_cstamp = mc->mca_tstamp = jiffies;
914 	atomic_set(&mc->mca_refcnt, 2);
915 	spin_lock_init(&mc->mca_lock);
916 
917 	/* initial mode is (EX, empty) */
918 	mc->mca_sfmode = MCAST_EXCLUDE;
919 	mc->mca_sfcount[MCAST_EXCLUDE] = 1;
920 
921 	if (ipv6_addr_is_ll_all_nodes(&mc->mca_addr) ||
922 	    IPV6_ADDR_MC_SCOPE(&mc->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
923 		mc->mca_flags |= MAF_NOREPORT;
924 
925 	mc->next = idev->mc_list;
926 	idev->mc_list = mc;
927 	write_unlock_bh(&idev->lock);
928 
929 	mld_del_delrec(idev, &mc->mca_addr);
930 	igmp6_group_added(mc);
931 	ma_put(mc);
932 	return 0;
933 }
934 
935 /*
936  *	device multicast group del
937  */
938 int __ipv6_dev_mc_dec(struct inet6_dev *idev, struct in6_addr *addr)
939 {
940 	struct ifmcaddr6 *ma, **map;
941 
942 	write_lock_bh(&idev->lock);
943 	for (map = &idev->mc_list; (ma=*map) != NULL; map = &ma->next) {
944 		if (ipv6_addr_equal(&ma->mca_addr, addr)) {
945 			if (--ma->mca_users == 0) {
946 				*map = ma->next;
947 				write_unlock_bh(&idev->lock);
948 
949 				igmp6_group_dropped(ma);
950 
951 				ma_put(ma);
952 				return 0;
953 			}
954 			write_unlock_bh(&idev->lock);
955 			return 0;
956 		}
957 	}
958 	write_unlock_bh(&idev->lock);
959 
960 	return -ENOENT;
961 }
962 
963 int ipv6_dev_mc_dec(struct net_device *dev, struct in6_addr *addr)
964 {
965 	struct inet6_dev *idev = in6_dev_get(dev);
966 	int err;
967 
968 	if (!idev)
969 		return -ENODEV;
970 
971 	err = __ipv6_dev_mc_dec(idev, addr);
972 
973 	in6_dev_put(idev);
974 
975 	return err;
976 }
977 
978 /*
979  * identify MLD packets for MLD filter exceptions
980  */
981 int ipv6_is_mld(struct sk_buff *skb, int nexthdr)
982 {
983 	struct icmp6hdr *pic;
984 
985 	if (nexthdr != IPPROTO_ICMPV6)
986 		return 0;
987 
988 	if (!pskb_may_pull(skb, sizeof(struct icmp6hdr)))
989 		return 0;
990 
991 	pic = icmp6_hdr(skb);
992 
993 	switch (pic->icmp6_type) {
994 	case ICMPV6_MGM_QUERY:
995 	case ICMPV6_MGM_REPORT:
996 	case ICMPV6_MGM_REDUCTION:
997 	case ICMPV6_MLD2_REPORT:
998 		return 1;
999 	default:
1000 		break;
1001 	}
1002 	return 0;
1003 }
1004 
1005 /*
1006  *	check if the interface/address pair is valid
1007  */
1008 int ipv6_chk_mcast_addr(struct net_device *dev, struct in6_addr *group,
1009 	struct in6_addr *src_addr)
1010 {
1011 	struct inet6_dev *idev;
1012 	struct ifmcaddr6 *mc;
1013 	int rv = 0;
1014 
1015 	idev = in6_dev_get(dev);
1016 	if (idev) {
1017 		read_lock_bh(&idev->lock);
1018 		for (mc = idev->mc_list; mc; mc=mc->next) {
1019 			if (ipv6_addr_equal(&mc->mca_addr, group))
1020 				break;
1021 		}
1022 		if (mc) {
1023 			if (src_addr && !ipv6_addr_any(src_addr)) {
1024 				struct ip6_sf_list *psf;
1025 
1026 				spin_lock_bh(&mc->mca_lock);
1027 				for (psf=mc->mca_sources;psf;psf=psf->sf_next) {
1028 					if (ipv6_addr_equal(&psf->sf_addr, src_addr))
1029 						break;
1030 				}
1031 				if (psf)
1032 					rv = psf->sf_count[MCAST_INCLUDE] ||
1033 						psf->sf_count[MCAST_EXCLUDE] !=
1034 						mc->mca_sfcount[MCAST_EXCLUDE];
1035 				else
1036 					rv = mc->mca_sfcount[MCAST_EXCLUDE] !=0;
1037 				spin_unlock_bh(&mc->mca_lock);
1038 			} else
1039 				rv = 1; /* don't filter unspecified source */
1040 		}
1041 		read_unlock_bh(&idev->lock);
1042 		in6_dev_put(idev);
1043 	}
1044 	return rv;
1045 }
1046 
1047 static void mld_gq_start_timer(struct inet6_dev *idev)
1048 {
1049 	int tv = net_random() % idev->mc_maxdelay;
1050 
1051 	idev->mc_gq_running = 1;
1052 	if (!mod_timer(&idev->mc_gq_timer, jiffies+tv+2))
1053 		in6_dev_hold(idev);
1054 }
1055 
1056 static void mld_ifc_start_timer(struct inet6_dev *idev, int delay)
1057 {
1058 	int tv = net_random() % delay;
1059 
1060 	if (!mod_timer(&idev->mc_ifc_timer, jiffies+tv+2))
1061 		in6_dev_hold(idev);
1062 }
1063 
1064 /*
1065  *	IGMP handling (alias multicast ICMPv6 messages)
1066  */
1067 
1068 static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
1069 {
1070 	unsigned long delay = resptime;
1071 
1072 	/* Do not start timer for these addresses */
1073 	if (ipv6_addr_is_ll_all_nodes(&ma->mca_addr) ||
1074 	    IPV6_ADDR_MC_SCOPE(&ma->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
1075 		return;
1076 
1077 	if (del_timer(&ma->mca_timer)) {
1078 		atomic_dec(&ma->mca_refcnt);
1079 		delay = ma->mca_timer.expires - jiffies;
1080 	}
1081 
1082 	if (delay >= resptime) {
1083 		if (resptime)
1084 			delay = net_random() % resptime;
1085 		else
1086 			delay = 1;
1087 	}
1088 	ma->mca_timer.expires = jiffies + delay;
1089 	if (!mod_timer(&ma->mca_timer, jiffies + delay))
1090 		atomic_inc(&ma->mca_refcnt);
1091 	ma->mca_flags |= MAF_TIMER_RUNNING;
1092 }
1093 
1094 /* mark EXCLUDE-mode sources */
1095 static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
1096 	struct in6_addr *srcs)
1097 {
1098 	struct ip6_sf_list *psf;
1099 	int i, scount;
1100 
1101 	scount = 0;
1102 	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
1103 		if (scount == nsrcs)
1104 			break;
1105 		for (i=0; i<nsrcs; i++) {
1106 			/* skip inactive filters */
1107 			if (pmc->mca_sfcount[MCAST_INCLUDE] ||
1108 			    pmc->mca_sfcount[MCAST_EXCLUDE] !=
1109 			    psf->sf_count[MCAST_EXCLUDE])
1110 				continue;
1111 			if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
1112 				scount++;
1113 				break;
1114 			}
1115 		}
1116 	}
1117 	pmc->mca_flags &= ~MAF_GSQUERY;
1118 	if (scount == nsrcs)	/* all sources excluded */
1119 		return 0;
1120 	return 1;
1121 }
1122 
1123 static int mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
1124 	struct in6_addr *srcs)
1125 {
1126 	struct ip6_sf_list *psf;
1127 	int i, scount;
1128 
1129 	if (pmc->mca_sfmode == MCAST_EXCLUDE)
1130 		return mld_xmarksources(pmc, nsrcs, srcs);
1131 
1132 	/* mark INCLUDE-mode sources */
1133 
1134 	scount = 0;
1135 	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
1136 		if (scount == nsrcs)
1137 			break;
1138 		for (i=0; i<nsrcs; i++) {
1139 			if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
1140 				psf->sf_gsresp = 1;
1141 				scount++;
1142 				break;
1143 			}
1144 		}
1145 	}
1146 	if (!scount) {
1147 		pmc->mca_flags &= ~MAF_GSQUERY;
1148 		return 0;
1149 	}
1150 	pmc->mca_flags |= MAF_GSQUERY;
1151 	return 1;
1152 }
1153 
1154 int igmp6_event_query(struct sk_buff *skb)
1155 {
1156 	struct mld2_query *mlh2 = NULL;
1157 	struct ifmcaddr6 *ma;
1158 	struct in6_addr *group;
1159 	unsigned long max_delay;
1160 	struct inet6_dev *idev;
1161 	struct icmp6hdr *hdr;
1162 	int group_type;
1163 	int mark = 0;
1164 	int len;
1165 
1166 	if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
1167 		return -EINVAL;
1168 
1169 	/* compute payload length excluding extension headers */
1170 	len = ntohs(ipv6_hdr(skb)->payload_len) + sizeof(struct ipv6hdr);
1171 	len -= skb_network_header_len(skb);
1172 
1173 	/* Drop queries with not link local source */
1174 	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL))
1175 		return -EINVAL;
1176 
1177 	idev = in6_dev_get(skb->dev);
1178 
1179 	if (idev == NULL)
1180 		return 0;
1181 
1182 	hdr = icmp6_hdr(skb);
1183 	group = (struct in6_addr *) (hdr + 1);
1184 	group_type = ipv6_addr_type(group);
1185 
1186 	if (group_type != IPV6_ADDR_ANY &&
1187 	    !(group_type&IPV6_ADDR_MULTICAST)) {
1188 		in6_dev_put(idev);
1189 		return -EINVAL;
1190 	}
1191 
1192 	if (len == 24) {
1193 		int switchback;
1194 		/* MLDv1 router present */
1195 
1196 		/* Translate milliseconds to jiffies */
1197 		max_delay = (ntohs(hdr->icmp6_maxdelay)*HZ)/1000;
1198 
1199 		switchback = (idev->mc_qrv + 1) * max_delay;
1200 		idev->mc_v1_seen = jiffies + switchback;
1201 
1202 		/* cancel the interface change timer */
1203 		idev->mc_ifc_count = 0;
1204 		if (del_timer(&idev->mc_ifc_timer))
1205 			__in6_dev_put(idev);
1206 		/* clear deleted report items */
1207 		mld_clear_delrec(idev);
1208 	} else if (len >= 28) {
1209 		int srcs_offset = sizeof(struct mld2_query) -
1210 				  sizeof(struct icmp6hdr);
1211 		if (!pskb_may_pull(skb, srcs_offset)) {
1212 			in6_dev_put(idev);
1213 			return -EINVAL;
1214 		}
1215 		mlh2 = (struct mld2_query *)skb_transport_header(skb);
1216 		max_delay = (MLDV2_MRC(ntohs(mlh2->mrc))*HZ)/1000;
1217 		if (!max_delay)
1218 			max_delay = 1;
1219 		idev->mc_maxdelay = max_delay;
1220 		if (mlh2->qrv)
1221 			idev->mc_qrv = mlh2->qrv;
1222 		if (group_type == IPV6_ADDR_ANY) { /* general query */
1223 			if (mlh2->nsrcs) {
1224 				in6_dev_put(idev);
1225 				return -EINVAL; /* no sources allowed */
1226 			}
1227 			mld_gq_start_timer(idev);
1228 			in6_dev_put(idev);
1229 			return 0;
1230 		}
1231 		/* mark sources to include, if group & source-specific */
1232 		if (mlh2->nsrcs != 0) {
1233 			if (!pskb_may_pull(skb, srcs_offset +
1234 			    ntohs(mlh2->nsrcs) * sizeof(struct in6_addr))) {
1235 				in6_dev_put(idev);
1236 				return -EINVAL;
1237 			}
1238 			mlh2 = (struct mld2_query *)skb_transport_header(skb);
1239 			mark = 1;
1240 		}
1241 	} else {
1242 		in6_dev_put(idev);
1243 		return -EINVAL;
1244 	}
1245 
1246 	read_lock_bh(&idev->lock);
1247 	if (group_type == IPV6_ADDR_ANY) {
1248 		for (ma = idev->mc_list; ma; ma=ma->next) {
1249 			spin_lock_bh(&ma->mca_lock);
1250 			igmp6_group_queried(ma, max_delay);
1251 			spin_unlock_bh(&ma->mca_lock);
1252 		}
1253 	} else {
1254 		for (ma = idev->mc_list; ma; ma=ma->next) {
1255 			if (!ipv6_addr_equal(group, &ma->mca_addr))
1256 				continue;
1257 			spin_lock_bh(&ma->mca_lock);
1258 			if (ma->mca_flags & MAF_TIMER_RUNNING) {
1259 				/* gsquery <- gsquery && mark */
1260 				if (!mark)
1261 					ma->mca_flags &= ~MAF_GSQUERY;
1262 			} else {
1263 				/* gsquery <- mark */
1264 				if (mark)
1265 					ma->mca_flags |= MAF_GSQUERY;
1266 				else
1267 					ma->mca_flags &= ~MAF_GSQUERY;
1268 			}
1269 			if (!(ma->mca_flags & MAF_GSQUERY) ||
1270 			    mld_marksources(ma, ntohs(mlh2->nsrcs), mlh2->srcs))
1271 				igmp6_group_queried(ma, max_delay);
1272 			spin_unlock_bh(&ma->mca_lock);
1273 			break;
1274 		}
1275 	}
1276 	read_unlock_bh(&idev->lock);
1277 	in6_dev_put(idev);
1278 
1279 	return 0;
1280 }
1281 
1282 
1283 int igmp6_event_report(struct sk_buff *skb)
1284 {
1285 	struct ifmcaddr6 *ma;
1286 	struct in6_addr *addrp;
1287 	struct inet6_dev *idev;
1288 	struct icmp6hdr *hdr;
1289 	int addr_type;
1290 
1291 	/* Our own report looped back. Ignore it. */
1292 	if (skb->pkt_type == PACKET_LOOPBACK)
1293 		return 0;
1294 
1295 	/* send our report if the MC router may not have heard this report */
1296 	if (skb->pkt_type != PACKET_MULTICAST &&
1297 	    skb->pkt_type != PACKET_BROADCAST)
1298 		return 0;
1299 
1300 	if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
1301 		return -EINVAL;
1302 
1303 	hdr = icmp6_hdr(skb);
1304 
1305 	/* Drop reports with not link local source */
1306 	addr_type = ipv6_addr_type(&ipv6_hdr(skb)->saddr);
1307 	if (addr_type != IPV6_ADDR_ANY &&
1308 	    !(addr_type&IPV6_ADDR_LINKLOCAL))
1309 		return -EINVAL;
1310 
1311 	addrp = (struct in6_addr *) (hdr + 1);
1312 
1313 	idev = in6_dev_get(skb->dev);
1314 	if (idev == NULL)
1315 		return -ENODEV;
1316 
1317 	/*
1318 	 *	Cancel the timer for this group
1319 	 */
1320 
1321 	read_lock_bh(&idev->lock);
1322 	for (ma = idev->mc_list; ma; ma=ma->next) {
1323 		if (ipv6_addr_equal(&ma->mca_addr, addrp)) {
1324 			spin_lock(&ma->mca_lock);
1325 			if (del_timer(&ma->mca_timer))
1326 				atomic_dec(&ma->mca_refcnt);
1327 			ma->mca_flags &= ~(MAF_LAST_REPORTER|MAF_TIMER_RUNNING);
1328 			spin_unlock(&ma->mca_lock);
1329 			break;
1330 		}
1331 	}
1332 	read_unlock_bh(&idev->lock);
1333 	in6_dev_put(idev);
1334 	return 0;
1335 }
1336 
1337 static int is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
1338 	int gdeleted, int sdeleted)
1339 {
1340 	switch (type) {
1341 	case MLD2_MODE_IS_INCLUDE:
1342 	case MLD2_MODE_IS_EXCLUDE:
1343 		if (gdeleted || sdeleted)
1344 			return 0;
1345 		if (!((pmc->mca_flags & MAF_GSQUERY) && !psf->sf_gsresp)) {
1346 			if (pmc->mca_sfmode == MCAST_INCLUDE)
1347 				return 1;
1348 			/* don't include if this source is excluded
1349 			 * in all filters
1350 			 */
1351 			if (psf->sf_count[MCAST_INCLUDE])
1352 				return type == MLD2_MODE_IS_INCLUDE;
1353 			return pmc->mca_sfcount[MCAST_EXCLUDE] ==
1354 				psf->sf_count[MCAST_EXCLUDE];
1355 		}
1356 		return 0;
1357 	case MLD2_CHANGE_TO_INCLUDE:
1358 		if (gdeleted || sdeleted)
1359 			return 0;
1360 		return psf->sf_count[MCAST_INCLUDE] != 0;
1361 	case MLD2_CHANGE_TO_EXCLUDE:
1362 		if (gdeleted || sdeleted)
1363 			return 0;
1364 		if (pmc->mca_sfcount[MCAST_EXCLUDE] == 0 ||
1365 		    psf->sf_count[MCAST_INCLUDE])
1366 			return 0;
1367 		return pmc->mca_sfcount[MCAST_EXCLUDE] ==
1368 			psf->sf_count[MCAST_EXCLUDE];
1369 	case MLD2_ALLOW_NEW_SOURCES:
1370 		if (gdeleted || !psf->sf_crcount)
1371 			return 0;
1372 		return (pmc->mca_sfmode == MCAST_INCLUDE) ^ sdeleted;
1373 	case MLD2_BLOCK_OLD_SOURCES:
1374 		if (pmc->mca_sfmode == MCAST_INCLUDE)
1375 			return gdeleted || (psf->sf_crcount && sdeleted);
1376 		return psf->sf_crcount && !gdeleted && !sdeleted;
1377 	}
1378 	return 0;
1379 }
1380 
1381 static int
1382 mld_scount(struct ifmcaddr6 *pmc, int type, int gdeleted, int sdeleted)
1383 {
1384 	struct ip6_sf_list *psf;
1385 	int scount = 0;
1386 
1387 	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
1388 		if (!is_in(pmc, psf, type, gdeleted, sdeleted))
1389 			continue;
1390 		scount++;
1391 	}
1392 	return scount;
1393 }
1394 
1395 static struct sk_buff *mld_newpack(struct net_device *dev, int size)
1396 {
1397 	struct sock *sk = igmp6_socket->sk;
1398 	struct sk_buff *skb;
1399 	struct mld2_report *pmr;
1400 	struct in6_addr addr_buf;
1401 	int err;
1402 	u8 ra[8] = { IPPROTO_ICMPV6, 0,
1403 		     IPV6_TLV_ROUTERALERT, 2, 0, 0,
1404 		     IPV6_TLV_PADN, 0 };
1405 
1406 	/* we assume size > sizeof(ra) here */
1407 	skb = sock_alloc_send_skb(sk, size + LL_RESERVED_SPACE(dev), 1, &err);
1408 
1409 	if (skb == 0)
1410 		return NULL;
1411 
1412 	skb_reserve(skb, LL_RESERVED_SPACE(dev));
1413 
1414 	if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
1415 		/* <draft-ietf-magma-mld-source-05.txt>:
1416 		 * use unspecified address as the source address
1417 		 * when a valid link-local address is not available.
1418 		 */
1419 		memset(&addr_buf, 0, sizeof(addr_buf));
1420 	}
1421 
1422 	ip6_nd_hdr(sk, skb, dev, &addr_buf, &mld2_all_mcr, NEXTHDR_HOP, 0);
1423 
1424 	memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
1425 
1426 	skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
1427 	skb_put(skb, sizeof(*pmr));
1428 	pmr = (struct mld2_report *)skb_transport_header(skb);
1429 	pmr->type = ICMPV6_MLD2_REPORT;
1430 	pmr->resv1 = 0;
1431 	pmr->csum = 0;
1432 	pmr->resv2 = 0;
1433 	pmr->ngrec = 0;
1434 	return skb;
1435 }
1436 
1437 static inline int mld_dev_queue_xmit2(struct sk_buff *skb)
1438 {
1439 	struct net_device *dev = skb->dev;
1440 
1441 	if (dev->hard_header) {
1442 		unsigned char ha[MAX_ADDR_LEN];
1443 		int err;
1444 
1445 		ndisc_mc_map(&ipv6_hdr(skb)->daddr, ha, dev, 1);
1446 		err = dev->hard_header(skb, dev, ETH_P_IPV6, ha, NULL, skb->len);
1447 		if (err < 0) {
1448 			kfree_skb(skb);
1449 			return err;
1450 		}
1451 	}
1452 	return dev_queue_xmit(skb);
1453 }
1454 
1455 static inline int mld_dev_queue_xmit(struct sk_buff *skb)
1456 {
1457 	return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dev,
1458 		       mld_dev_queue_xmit2);
1459 }
1460 
1461 static void mld_sendpack(struct sk_buff *skb)
1462 {
1463 	struct ipv6hdr *pip6 = ipv6_hdr(skb);
1464 	struct mld2_report *pmr =
1465 			      (struct mld2_report *)skb_transport_header(skb);
1466 	int payload_len, mldlen;
1467 	struct inet6_dev *idev = in6_dev_get(skb->dev);
1468 	int err;
1469 
1470 	IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
1471 	payload_len = (skb->tail - skb->network_header) - sizeof(*pip6);
1472 	mldlen = skb->tail - skb->transport_header;
1473 	pip6->payload_len = htons(payload_len);
1474 
1475 	pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
1476 		IPPROTO_ICMPV6, csum_partial(skb_transport_header(skb),
1477 					     mldlen, 0));
1478 	err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev,
1479 		mld_dev_queue_xmit);
1480 	if (!err) {
1481 		ICMP6_INC_STATS(idev,ICMP6_MIB_OUTMSGS);
1482 		IP6_INC_STATS(idev, IPSTATS_MIB_OUTMCASTPKTS);
1483 	} else
1484 		IP6_INC_STATS(idev, IPSTATS_MIB_OUTDISCARDS);
1485 
1486 	if (likely(idev != NULL))
1487 		in6_dev_put(idev);
1488 }
1489 
1490 static int grec_size(struct ifmcaddr6 *pmc, int type, int gdel, int sdel)
1491 {
1492 	return sizeof(struct mld2_grec) + 16 * mld_scount(pmc,type,gdel,sdel);
1493 }
1494 
1495 static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
1496 	int type, struct mld2_grec **ppgr)
1497 {
1498 	struct net_device *dev = pmc->idev->dev;
1499 	struct mld2_report *pmr;
1500 	struct mld2_grec *pgr;
1501 
1502 	if (!skb)
1503 		skb = mld_newpack(dev, dev->mtu);
1504 	if (!skb)
1505 		return NULL;
1506 	pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec));
1507 	pgr->grec_type = type;
1508 	pgr->grec_auxwords = 0;
1509 	pgr->grec_nsrcs = 0;
1510 	pgr->grec_mca = pmc->mca_addr;	/* structure copy */
1511 	pmr = (struct mld2_report *)skb_transport_header(skb);
1512 	pmr->ngrec = htons(ntohs(pmr->ngrec)+1);
1513 	*ppgr = pgr;
1514 	return skb;
1515 }
1516 
1517 #define AVAILABLE(skb) ((skb) ? ((skb)->dev ? (skb)->dev->mtu - (skb)->len : \
1518 	skb_tailroom(skb)) : 0)
1519 
1520 static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
1521 	int type, int gdeleted, int sdeleted)
1522 {
1523 	struct net_device *dev = pmc->idev->dev;
1524 	struct mld2_report *pmr;
1525 	struct mld2_grec *pgr = NULL;
1526 	struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
1527 	int scount, stotal, first, isquery, truncate;
1528 
1529 	if (pmc->mca_flags & MAF_NOREPORT)
1530 		return skb;
1531 
1532 	isquery = type == MLD2_MODE_IS_INCLUDE ||
1533 		  type == MLD2_MODE_IS_EXCLUDE;
1534 	truncate = type == MLD2_MODE_IS_EXCLUDE ||
1535 		    type == MLD2_CHANGE_TO_EXCLUDE;
1536 
1537 	stotal = scount = 0;
1538 
1539 	psf_list = sdeleted ? &pmc->mca_tomb : &pmc->mca_sources;
1540 
1541 	if (!*psf_list)
1542 		goto empty_source;
1543 
1544 	pmr = skb ? (struct mld2_report *)skb_transport_header(skb) : NULL;
1545 
1546 	/* EX and TO_EX get a fresh packet, if needed */
1547 	if (truncate) {
1548 		if (pmr && pmr->ngrec &&
1549 		    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
1550 			if (skb)
1551 				mld_sendpack(skb);
1552 			skb = mld_newpack(dev, dev->mtu);
1553 		}
1554 	}
1555 	first = 1;
1556 	psf_prev = NULL;
1557 	for (psf=*psf_list; psf; psf=psf_next) {
1558 		struct in6_addr *psrc;
1559 
1560 		psf_next = psf->sf_next;
1561 
1562 		if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
1563 			psf_prev = psf;
1564 			continue;
1565 		}
1566 
1567 		/* clear marks on query responses */
1568 		if (isquery)
1569 			psf->sf_gsresp = 0;
1570 
1571 		if (AVAILABLE(skb) < sizeof(*psrc) +
1572 		    first*sizeof(struct mld2_grec)) {
1573 			if (truncate && !first)
1574 				break;	 /* truncate these */
1575 			if (pgr)
1576 				pgr->grec_nsrcs = htons(scount);
1577 			if (skb)
1578 				mld_sendpack(skb);
1579 			skb = mld_newpack(dev, dev->mtu);
1580 			first = 1;
1581 			scount = 0;
1582 		}
1583 		if (first) {
1584 			skb = add_grhead(skb, pmc, type, &pgr);
1585 			first = 0;
1586 		}
1587 		if (!skb)
1588 			return NULL;
1589 		psrc = (struct in6_addr *)skb_put(skb, sizeof(*psrc));
1590 		*psrc = psf->sf_addr;
1591 		scount++; stotal++;
1592 		if ((type == MLD2_ALLOW_NEW_SOURCES ||
1593 		     type == MLD2_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
1594 			psf->sf_crcount--;
1595 			if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
1596 				if (psf_prev)
1597 					psf_prev->sf_next = psf->sf_next;
1598 				else
1599 					*psf_list = psf->sf_next;
1600 				kfree(psf);
1601 				continue;
1602 			}
1603 		}
1604 		psf_prev = psf;
1605 	}
1606 
1607 empty_source:
1608 	if (!stotal) {
1609 		if (type == MLD2_ALLOW_NEW_SOURCES ||
1610 		    type == MLD2_BLOCK_OLD_SOURCES)
1611 			return skb;
1612 		if (pmc->mca_crcount || isquery) {
1613 			/* make sure we have room for group header */
1614 			if (skb && AVAILABLE(skb) < sizeof(struct mld2_grec)) {
1615 				mld_sendpack(skb);
1616 				skb = NULL; /* add_grhead will get a new one */
1617 			}
1618 			skb = add_grhead(skb, pmc, type, &pgr);
1619 		}
1620 	}
1621 	if (pgr)
1622 		pgr->grec_nsrcs = htons(scount);
1623 
1624 	if (isquery)
1625 		pmc->mca_flags &= ~MAF_GSQUERY;	/* clear query state */
1626 	return skb;
1627 }
1628 
1629 static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
1630 {
1631 	struct sk_buff *skb = NULL;
1632 	int type;
1633 
1634 	if (!pmc) {
1635 		read_lock_bh(&idev->lock);
1636 		for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
1637 			if (pmc->mca_flags & MAF_NOREPORT)
1638 				continue;
1639 			spin_lock_bh(&pmc->mca_lock);
1640 			if (pmc->mca_sfcount[MCAST_EXCLUDE])
1641 				type = MLD2_MODE_IS_EXCLUDE;
1642 			else
1643 				type = MLD2_MODE_IS_INCLUDE;
1644 			skb = add_grec(skb, pmc, type, 0, 0);
1645 			spin_unlock_bh(&pmc->mca_lock);
1646 		}
1647 		read_unlock_bh(&idev->lock);
1648 	} else {
1649 		spin_lock_bh(&pmc->mca_lock);
1650 		if (pmc->mca_sfcount[MCAST_EXCLUDE])
1651 			type = MLD2_MODE_IS_EXCLUDE;
1652 		else
1653 			type = MLD2_MODE_IS_INCLUDE;
1654 		skb = add_grec(skb, pmc, type, 0, 0);
1655 		spin_unlock_bh(&pmc->mca_lock);
1656 	}
1657 	if (skb)
1658 		mld_sendpack(skb);
1659 }
1660 
1661 /*
1662  * remove zero-count source records from a source filter list
1663  */
1664 static void mld_clear_zeros(struct ip6_sf_list **ppsf)
1665 {
1666 	struct ip6_sf_list *psf_prev, *psf_next, *psf;
1667 
1668 	psf_prev = NULL;
1669 	for (psf=*ppsf; psf; psf = psf_next) {
1670 		psf_next = psf->sf_next;
1671 		if (psf->sf_crcount == 0) {
1672 			if (psf_prev)
1673 				psf_prev->sf_next = psf->sf_next;
1674 			else
1675 				*ppsf = psf->sf_next;
1676 			kfree(psf);
1677 		} else
1678 			psf_prev = psf;
1679 	}
1680 }
1681 
1682 static void mld_send_cr(struct inet6_dev *idev)
1683 {
1684 	struct ifmcaddr6 *pmc, *pmc_prev, *pmc_next;
1685 	struct sk_buff *skb = NULL;
1686 	int type, dtype;
1687 
1688 	read_lock_bh(&idev->lock);
1689 	write_lock_bh(&idev->mc_lock);
1690 
1691 	/* deleted MCA's */
1692 	pmc_prev = NULL;
1693 	for (pmc=idev->mc_tomb; pmc; pmc=pmc_next) {
1694 		pmc_next = pmc->next;
1695 		if (pmc->mca_sfmode == MCAST_INCLUDE) {
1696 			type = MLD2_BLOCK_OLD_SOURCES;
1697 			dtype = MLD2_BLOCK_OLD_SOURCES;
1698 			skb = add_grec(skb, pmc, type, 1, 0);
1699 			skb = add_grec(skb, pmc, dtype, 1, 1);
1700 		}
1701 		if (pmc->mca_crcount) {
1702 			if (pmc->mca_sfmode == MCAST_EXCLUDE) {
1703 				type = MLD2_CHANGE_TO_INCLUDE;
1704 				skb = add_grec(skb, pmc, type, 1, 0);
1705 			}
1706 			pmc->mca_crcount--;
1707 			if (pmc->mca_crcount == 0) {
1708 				mld_clear_zeros(&pmc->mca_tomb);
1709 				mld_clear_zeros(&pmc->mca_sources);
1710 			}
1711 		}
1712 		if (pmc->mca_crcount == 0 && !pmc->mca_tomb &&
1713 		    !pmc->mca_sources) {
1714 			if (pmc_prev)
1715 				pmc_prev->next = pmc_next;
1716 			else
1717 				idev->mc_tomb = pmc_next;
1718 			in6_dev_put(pmc->idev);
1719 			kfree(pmc);
1720 		} else
1721 			pmc_prev = pmc;
1722 	}
1723 	write_unlock_bh(&idev->mc_lock);
1724 
1725 	/* change recs */
1726 	for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
1727 		spin_lock_bh(&pmc->mca_lock);
1728 		if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
1729 			type = MLD2_BLOCK_OLD_SOURCES;
1730 			dtype = MLD2_ALLOW_NEW_SOURCES;
1731 		} else {
1732 			type = MLD2_ALLOW_NEW_SOURCES;
1733 			dtype = MLD2_BLOCK_OLD_SOURCES;
1734 		}
1735 		skb = add_grec(skb, pmc, type, 0, 0);
1736 		skb = add_grec(skb, pmc, dtype, 0, 1);	/* deleted sources */
1737 
1738 		/* filter mode changes */
1739 		if (pmc->mca_crcount) {
1740 			if (pmc->mca_sfmode == MCAST_EXCLUDE)
1741 				type = MLD2_CHANGE_TO_EXCLUDE;
1742 			else
1743 				type = MLD2_CHANGE_TO_INCLUDE;
1744 			skb = add_grec(skb, pmc, type, 0, 0);
1745 			pmc->mca_crcount--;
1746 		}
1747 		spin_unlock_bh(&pmc->mca_lock);
1748 	}
1749 	read_unlock_bh(&idev->lock);
1750 	if (!skb)
1751 		return;
1752 	(void) mld_sendpack(skb);
1753 }
1754 
1755 static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
1756 {
1757 	struct sock *sk = igmp6_socket->sk;
1758 	struct inet6_dev *idev;
1759 	struct sk_buff *skb;
1760 	struct icmp6hdr *hdr;
1761 	struct in6_addr *snd_addr;
1762 	struct in6_addr *addrp;
1763 	struct in6_addr addr_buf;
1764 	struct in6_addr all_routers;
1765 	int err, len, payload_len, full_len;
1766 	u8 ra[8] = { IPPROTO_ICMPV6, 0,
1767 		     IPV6_TLV_ROUTERALERT, 2, 0, 0,
1768 		     IPV6_TLV_PADN, 0 };
1769 
1770 	rcu_read_lock();
1771 	IP6_INC_STATS(__in6_dev_get(dev),
1772 		      IPSTATS_MIB_OUTREQUESTS);
1773 	rcu_read_unlock();
1774 	snd_addr = addr;
1775 	if (type == ICMPV6_MGM_REDUCTION) {
1776 		snd_addr = &all_routers;
1777 		ipv6_addr_all_routers(&all_routers);
1778 	}
1779 
1780 	len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
1781 	payload_len = len + sizeof(ra);
1782 	full_len = sizeof(struct ipv6hdr) + payload_len;
1783 
1784 	skb = sock_alloc_send_skb(sk, LL_RESERVED_SPACE(dev) + full_len, 1, &err);
1785 
1786 	if (skb == NULL) {
1787 		rcu_read_lock();
1788 		IP6_INC_STATS(__in6_dev_get(dev),
1789 			      IPSTATS_MIB_OUTDISCARDS);
1790 		rcu_read_unlock();
1791 		return;
1792 	}
1793 
1794 	skb_reserve(skb, LL_RESERVED_SPACE(dev));
1795 
1796 	if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
1797 		/* <draft-ietf-magma-mld-source-05.txt>:
1798 		 * use unspecified address as the source address
1799 		 * when a valid link-local address is not available.
1800 		 */
1801 		memset(&addr_buf, 0, sizeof(addr_buf));
1802 	}
1803 
1804 	ip6_nd_hdr(sk, skb, dev, &addr_buf, snd_addr, NEXTHDR_HOP, payload_len);
1805 
1806 	memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
1807 
1808 	hdr = (struct icmp6hdr *) skb_put(skb, sizeof(struct icmp6hdr));
1809 	memset(hdr, 0, sizeof(struct icmp6hdr));
1810 	hdr->icmp6_type = type;
1811 
1812 	addrp = (struct in6_addr *) skb_put(skb, sizeof(struct in6_addr));
1813 	ipv6_addr_copy(addrp, addr);
1814 
1815 	hdr->icmp6_cksum = csum_ipv6_magic(&addr_buf, snd_addr, len,
1816 					   IPPROTO_ICMPV6,
1817 					   csum_partial((__u8 *) hdr, len, 0));
1818 
1819 	idev = in6_dev_get(skb->dev);
1820 
1821 	err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev,
1822 		mld_dev_queue_xmit);
1823 	if (!err) {
1824 		if (type == ICMPV6_MGM_REDUCTION)
1825 			ICMP6_INC_STATS(idev, ICMP6_MIB_OUTGROUPMEMBREDUCTIONS);
1826 		else
1827 			ICMP6_INC_STATS(idev, ICMP6_MIB_OUTGROUPMEMBRESPONSES);
1828 		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
1829 		IP6_INC_STATS(idev, IPSTATS_MIB_OUTMCASTPKTS);
1830 	} else
1831 		IP6_INC_STATS(idev, IPSTATS_MIB_OUTDISCARDS);
1832 
1833 	if (likely(idev != NULL))
1834 		in6_dev_put(idev);
1835 	return;
1836 }
1837 
1838 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
1839 	struct in6_addr *psfsrc)
1840 {
1841 	struct ip6_sf_list *psf, *psf_prev;
1842 	int rv = 0;
1843 
1844 	psf_prev = NULL;
1845 	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
1846 		if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
1847 			break;
1848 		psf_prev = psf;
1849 	}
1850 	if (!psf || psf->sf_count[sfmode] == 0) {
1851 		/* source filter not found, or count wrong =>  bug */
1852 		return -ESRCH;
1853 	}
1854 	psf->sf_count[sfmode]--;
1855 	if (!psf->sf_count[MCAST_INCLUDE] && !psf->sf_count[MCAST_EXCLUDE]) {
1856 		struct inet6_dev *idev = pmc->idev;
1857 
1858 		/* no more filters for this source */
1859 		if (psf_prev)
1860 			psf_prev->sf_next = psf->sf_next;
1861 		else
1862 			pmc->mca_sources = psf->sf_next;
1863 		if (psf->sf_oldin && !(pmc->mca_flags & MAF_NOREPORT) &&
1864 		    !MLD_V1_SEEN(idev)) {
1865 			psf->sf_crcount = idev->mc_qrv;
1866 			psf->sf_next = pmc->mca_tomb;
1867 			pmc->mca_tomb = psf;
1868 			rv = 1;
1869 		} else
1870 			kfree(psf);
1871 	}
1872 	return rv;
1873 }
1874 
1875 static int ip6_mc_del_src(struct inet6_dev *idev, struct in6_addr *pmca,
1876 			  int sfmode, int sfcount, struct in6_addr *psfsrc,
1877 			  int delta)
1878 {
1879 	struct ifmcaddr6 *pmc;
1880 	int	changerec = 0;
1881 	int	i, err;
1882 
1883 	if (!idev)
1884 		return -ENODEV;
1885 	read_lock_bh(&idev->lock);
1886 	for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
1887 		if (ipv6_addr_equal(pmca, &pmc->mca_addr))
1888 			break;
1889 	}
1890 	if (!pmc) {
1891 		/* MCA not found?? bug */
1892 		read_unlock_bh(&idev->lock);
1893 		return -ESRCH;
1894 	}
1895 	spin_lock_bh(&pmc->mca_lock);
1896 	sf_markstate(pmc);
1897 	if (!delta) {
1898 		if (!pmc->mca_sfcount[sfmode]) {
1899 			spin_unlock_bh(&pmc->mca_lock);
1900 			read_unlock_bh(&idev->lock);
1901 			return -EINVAL;
1902 		}
1903 		pmc->mca_sfcount[sfmode]--;
1904 	}
1905 	err = 0;
1906 	for (i=0; i<sfcount; i++) {
1907 		int rv = ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
1908 
1909 		changerec |= rv > 0;
1910 		if (!err && rv < 0)
1911 			err = rv;
1912 	}
1913 	if (pmc->mca_sfmode == MCAST_EXCLUDE &&
1914 	    pmc->mca_sfcount[MCAST_EXCLUDE] == 0 &&
1915 	    pmc->mca_sfcount[MCAST_INCLUDE]) {
1916 		struct ip6_sf_list *psf;
1917 
1918 		/* filter mode change */
1919 		pmc->mca_sfmode = MCAST_INCLUDE;
1920 		pmc->mca_crcount = idev->mc_qrv;
1921 		idev->mc_ifc_count = pmc->mca_crcount;
1922 		for (psf=pmc->mca_sources; psf; psf = psf->sf_next)
1923 			psf->sf_crcount = 0;
1924 		mld_ifc_event(pmc->idev);
1925 	} else if (sf_setstate(pmc) || changerec)
1926 		mld_ifc_event(pmc->idev);
1927 	spin_unlock_bh(&pmc->mca_lock);
1928 	read_unlock_bh(&idev->lock);
1929 	return err;
1930 }
1931 
1932 /*
1933  * Add multicast single-source filter to the interface list
1934  */
1935 static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
1936 	struct in6_addr *psfsrc, int delta)
1937 {
1938 	struct ip6_sf_list *psf, *psf_prev;
1939 
1940 	psf_prev = NULL;
1941 	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
1942 		if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
1943 			break;
1944 		psf_prev = psf;
1945 	}
1946 	if (!psf) {
1947 		psf = kzalloc(sizeof(*psf), GFP_ATOMIC);
1948 		if (!psf)
1949 			return -ENOBUFS;
1950 
1951 		psf->sf_addr = *psfsrc;
1952 		if (psf_prev) {
1953 			psf_prev->sf_next = psf;
1954 		} else
1955 			pmc->mca_sources = psf;
1956 	}
1957 	psf->sf_count[sfmode]++;
1958 	return 0;
1959 }
1960 
1961 static void sf_markstate(struct ifmcaddr6 *pmc)
1962 {
1963 	struct ip6_sf_list *psf;
1964 	int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
1965 
1966 	for (psf=pmc->mca_sources; psf; psf=psf->sf_next)
1967 		if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
1968 			psf->sf_oldin = mca_xcount ==
1969 				psf->sf_count[MCAST_EXCLUDE] &&
1970 				!psf->sf_count[MCAST_INCLUDE];
1971 		} else
1972 			psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
1973 }
1974 
1975 static int sf_setstate(struct ifmcaddr6 *pmc)
1976 {
1977 	struct ip6_sf_list *psf, *dpsf;
1978 	int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
1979 	int qrv = pmc->idev->mc_qrv;
1980 	int new_in, rv;
1981 
1982 	rv = 0;
1983 	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
1984 		if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
1985 			new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
1986 				!psf->sf_count[MCAST_INCLUDE];
1987 		} else
1988 			new_in = psf->sf_count[MCAST_INCLUDE] != 0;
1989 		if (new_in) {
1990 			if (!psf->sf_oldin) {
1991 				struct ip6_sf_list *prev = NULL;
1992 
1993 				for (dpsf=pmc->mca_tomb; dpsf;
1994 				     dpsf=dpsf->sf_next) {
1995 					if (ipv6_addr_equal(&dpsf->sf_addr,
1996 					    &psf->sf_addr))
1997 						break;
1998 					prev = dpsf;
1999 				}
2000 				if (dpsf) {
2001 					if (prev)
2002 						prev->sf_next = dpsf->sf_next;
2003 					else
2004 						pmc->mca_tomb = dpsf->sf_next;
2005 					kfree(dpsf);
2006 				}
2007 				psf->sf_crcount = qrv;
2008 				rv++;
2009 			}
2010 		} else if (psf->sf_oldin) {
2011 			psf->sf_crcount = 0;
2012 			/*
2013 			 * add or update "delete" records if an active filter
2014 			 * is now inactive
2015 			 */
2016 			for (dpsf=pmc->mca_tomb; dpsf; dpsf=dpsf->sf_next)
2017 				if (ipv6_addr_equal(&dpsf->sf_addr,
2018 				    &psf->sf_addr))
2019 					break;
2020 			if (!dpsf) {
2021 				dpsf = (struct ip6_sf_list *)
2022 					kmalloc(sizeof(*dpsf), GFP_ATOMIC);
2023 				if (!dpsf)
2024 					continue;
2025 				*dpsf = *psf;
2026 				/* pmc->mca_lock held by callers */
2027 				dpsf->sf_next = pmc->mca_tomb;
2028 				pmc->mca_tomb = dpsf;
2029 			}
2030 			dpsf->sf_crcount = qrv;
2031 			rv++;
2032 		}
2033 	}
2034 	return rv;
2035 }
2036 
2037 /*
2038  * Add multicast source filter list to the interface list
2039  */
2040 static int ip6_mc_add_src(struct inet6_dev *idev, struct in6_addr *pmca,
2041 			  int sfmode, int sfcount, struct in6_addr *psfsrc,
2042 			  int delta)
2043 {
2044 	struct ifmcaddr6 *pmc;
2045 	int	isexclude;
2046 	int	i, err;
2047 
2048 	if (!idev)
2049 		return -ENODEV;
2050 	read_lock_bh(&idev->lock);
2051 	for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
2052 		if (ipv6_addr_equal(pmca, &pmc->mca_addr))
2053 			break;
2054 	}
2055 	if (!pmc) {
2056 		/* MCA not found?? bug */
2057 		read_unlock_bh(&idev->lock);
2058 		return -ESRCH;
2059 	}
2060 	spin_lock_bh(&pmc->mca_lock);
2061 
2062 	sf_markstate(pmc);
2063 	isexclude = pmc->mca_sfmode == MCAST_EXCLUDE;
2064 	if (!delta)
2065 		pmc->mca_sfcount[sfmode]++;
2066 	err = 0;
2067 	for (i=0; i<sfcount; i++) {
2068 		err = ip6_mc_add1_src(pmc, sfmode, &psfsrc[i], delta);
2069 		if (err)
2070 			break;
2071 	}
2072 	if (err) {
2073 		int j;
2074 
2075 		if (!delta)
2076 			pmc->mca_sfcount[sfmode]--;
2077 		for (j=0; j<i; j++)
2078 			(void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
2079 	} else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
2080 		struct inet6_dev *idev = pmc->idev;
2081 		struct ip6_sf_list *psf;
2082 
2083 		/* filter mode change */
2084 		if (pmc->mca_sfcount[MCAST_EXCLUDE])
2085 			pmc->mca_sfmode = MCAST_EXCLUDE;
2086 		else if (pmc->mca_sfcount[MCAST_INCLUDE])
2087 			pmc->mca_sfmode = MCAST_INCLUDE;
2088 		/* else no filters; keep old mode for reports */
2089 
2090 		pmc->mca_crcount = idev->mc_qrv;
2091 		idev->mc_ifc_count = pmc->mca_crcount;
2092 		for (psf=pmc->mca_sources; psf; psf = psf->sf_next)
2093 			psf->sf_crcount = 0;
2094 		mld_ifc_event(idev);
2095 	} else if (sf_setstate(pmc))
2096 		mld_ifc_event(idev);
2097 	spin_unlock_bh(&pmc->mca_lock);
2098 	read_unlock_bh(&idev->lock);
2099 	return err;
2100 }
2101 
2102 static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
2103 {
2104 	struct ip6_sf_list *psf, *nextpsf;
2105 
2106 	for (psf=pmc->mca_tomb; psf; psf=nextpsf) {
2107 		nextpsf = psf->sf_next;
2108 		kfree(psf);
2109 	}
2110 	pmc->mca_tomb = NULL;
2111 	for (psf=pmc->mca_sources; psf; psf=nextpsf) {
2112 		nextpsf = psf->sf_next;
2113 		kfree(psf);
2114 	}
2115 	pmc->mca_sources = NULL;
2116 	pmc->mca_sfmode = MCAST_EXCLUDE;
2117 	pmc->mca_sfcount[MCAST_INCLUDE] = 0;
2118 	pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
2119 }
2120 
2121 
2122 static void igmp6_join_group(struct ifmcaddr6 *ma)
2123 {
2124 	unsigned long delay;
2125 
2126 	if (ma->mca_flags & MAF_NOREPORT)
2127 		return;
2128 
2129 	igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
2130 
2131 	delay = net_random() % IGMP6_UNSOLICITED_IVAL;
2132 
2133 	spin_lock_bh(&ma->mca_lock);
2134 	if (del_timer(&ma->mca_timer)) {
2135 		atomic_dec(&ma->mca_refcnt);
2136 		delay = ma->mca_timer.expires - jiffies;
2137 	}
2138 
2139 	if (!mod_timer(&ma->mca_timer, jiffies + delay))
2140 		atomic_inc(&ma->mca_refcnt);
2141 	ma->mca_flags |= MAF_TIMER_RUNNING | MAF_LAST_REPORTER;
2142 	spin_unlock_bh(&ma->mca_lock);
2143 }
2144 
2145 static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
2146 			    struct inet6_dev *idev)
2147 {
2148 	int err;
2149 
2150 	/* callers have the socket lock and a write lock on ipv6_sk_mc_lock,
2151 	 * so no other readers or writers of iml or its sflist
2152 	 */
2153 	if (iml->sflist == 0) {
2154 		/* any-source empty exclude case */
2155 		return ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
2156 	}
2157 	err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
2158 		iml->sflist->sl_count, iml->sflist->sl_addr, 0);
2159 	sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max));
2160 	iml->sflist = NULL;
2161 	return err;
2162 }
2163 
2164 static void igmp6_leave_group(struct ifmcaddr6 *ma)
2165 {
2166 	if (MLD_V1_SEEN(ma->idev)) {
2167 		if (ma->mca_flags & MAF_LAST_REPORTER)
2168 			igmp6_send(&ma->mca_addr, ma->idev->dev,
2169 				ICMPV6_MGM_REDUCTION);
2170 	} else {
2171 		mld_add_delrec(ma->idev, ma);
2172 		mld_ifc_event(ma->idev);
2173 	}
2174 }
2175 
2176 static void mld_gq_timer_expire(unsigned long data)
2177 {
2178 	struct inet6_dev *idev = (struct inet6_dev *)data;
2179 
2180 	idev->mc_gq_running = 0;
2181 	mld_send_report(idev, NULL);
2182 	__in6_dev_put(idev);
2183 }
2184 
2185 static void mld_ifc_timer_expire(unsigned long data)
2186 {
2187 	struct inet6_dev *idev = (struct inet6_dev *)data;
2188 
2189 	mld_send_cr(idev);
2190 	if (idev->mc_ifc_count) {
2191 		idev->mc_ifc_count--;
2192 		if (idev->mc_ifc_count)
2193 			mld_ifc_start_timer(idev, idev->mc_maxdelay);
2194 	}
2195 	__in6_dev_put(idev);
2196 }
2197 
2198 static void mld_ifc_event(struct inet6_dev *idev)
2199 {
2200 	if (MLD_V1_SEEN(idev))
2201 		return;
2202 	idev->mc_ifc_count = idev->mc_qrv;
2203 	mld_ifc_start_timer(idev, 1);
2204 }
2205 
2206 
2207 static void igmp6_timer_handler(unsigned long data)
2208 {
2209 	struct ifmcaddr6 *ma = (struct ifmcaddr6 *) data;
2210 
2211 	if (MLD_V1_SEEN(ma->idev))
2212 		igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
2213 	else
2214 		mld_send_report(ma->idev, ma);
2215 
2216 	spin_lock(&ma->mca_lock);
2217 	ma->mca_flags |=  MAF_LAST_REPORTER;
2218 	ma->mca_flags &= ~MAF_TIMER_RUNNING;
2219 	spin_unlock(&ma->mca_lock);
2220 	ma_put(ma);
2221 }
2222 
2223 /* Device going down */
2224 
2225 void ipv6_mc_down(struct inet6_dev *idev)
2226 {
2227 	struct ifmcaddr6 *i;
2228 
2229 	/* Withdraw multicast list */
2230 
2231 	read_lock_bh(&idev->lock);
2232 	idev->mc_ifc_count = 0;
2233 	if (del_timer(&idev->mc_ifc_timer))
2234 		__in6_dev_put(idev);
2235 	idev->mc_gq_running = 0;
2236 	if (del_timer(&idev->mc_gq_timer))
2237 		__in6_dev_put(idev);
2238 
2239 	for (i = idev->mc_list; i; i=i->next)
2240 		igmp6_group_dropped(i);
2241 	read_unlock_bh(&idev->lock);
2242 
2243 	mld_clear_delrec(idev);
2244 }
2245 
2246 
2247 /* Device going up */
2248 
2249 void ipv6_mc_up(struct inet6_dev *idev)
2250 {
2251 	struct ifmcaddr6 *i;
2252 
2253 	/* Install multicast list, except for all-nodes (already installed) */
2254 
2255 	read_lock_bh(&idev->lock);
2256 	for (i = idev->mc_list; i; i=i->next)
2257 		igmp6_group_added(i);
2258 	read_unlock_bh(&idev->lock);
2259 }
2260 
2261 /* IPv6 device initialization. */
2262 
2263 void ipv6_mc_init_dev(struct inet6_dev *idev)
2264 {
2265 	write_lock_bh(&idev->lock);
2266 	rwlock_init(&idev->mc_lock);
2267 	idev->mc_gq_running = 0;
2268 	init_timer(&idev->mc_gq_timer);
2269 	idev->mc_gq_timer.data = (unsigned long) idev;
2270 	idev->mc_gq_timer.function = &mld_gq_timer_expire;
2271 	idev->mc_tomb = NULL;
2272 	idev->mc_ifc_count = 0;
2273 	init_timer(&idev->mc_ifc_timer);
2274 	idev->mc_ifc_timer.data = (unsigned long) idev;
2275 	idev->mc_ifc_timer.function = &mld_ifc_timer_expire;
2276 	idev->mc_qrv = MLD_QRV_DEFAULT;
2277 	idev->mc_maxdelay = IGMP6_UNSOLICITED_IVAL;
2278 	idev->mc_v1_seen = 0;
2279 	write_unlock_bh(&idev->lock);
2280 }
2281 
2282 /*
2283  *	Device is about to be destroyed: clean up.
2284  */
2285 
2286 void ipv6_mc_destroy_dev(struct inet6_dev *idev)
2287 {
2288 	struct ifmcaddr6 *i;
2289 	struct in6_addr maddr;
2290 
2291 	/* Deactivate timers */
2292 	ipv6_mc_down(idev);
2293 
2294 	/* Delete all-nodes address. */
2295 	ipv6_addr_all_nodes(&maddr);
2296 
2297 	/* We cannot call ipv6_dev_mc_dec() directly, our caller in
2298 	 * addrconf.c has NULL'd out dev->ip6_ptr so in6_dev_get() will
2299 	 * fail.
2300 	 */
2301 	__ipv6_dev_mc_dec(idev, &maddr);
2302 
2303 	if (idev->cnf.forwarding) {
2304 		ipv6_addr_all_routers(&maddr);
2305 		__ipv6_dev_mc_dec(idev, &maddr);
2306 	}
2307 
2308 	write_lock_bh(&idev->lock);
2309 	while ((i = idev->mc_list) != NULL) {
2310 		idev->mc_list = i->next;
2311 		write_unlock_bh(&idev->lock);
2312 
2313 		igmp6_group_dropped(i);
2314 		ma_put(i);
2315 
2316 		write_lock_bh(&idev->lock);
2317 	}
2318 	write_unlock_bh(&idev->lock);
2319 }
2320 
2321 #ifdef CONFIG_PROC_FS
2322 struct igmp6_mc_iter_state {
2323 	struct net_device *dev;
2324 	struct inet6_dev *idev;
2325 };
2326 
2327 #define igmp6_mc_seq_private(seq)	((struct igmp6_mc_iter_state *)(seq)->private)
2328 
2329 static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
2330 {
2331 	struct ifmcaddr6 *im = NULL;
2332 	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2333 
2334 	state->idev = NULL;
2335 	for_each_netdev(state->dev) {
2336 		struct inet6_dev *idev;
2337 		idev = in6_dev_get(state->dev);
2338 		if (!idev)
2339 			continue;
2340 		read_lock_bh(&idev->lock);
2341 		im = idev->mc_list;
2342 		if (im) {
2343 			state->idev = idev;
2344 			break;
2345 		}
2346 		read_unlock_bh(&idev->lock);
2347 		in6_dev_put(idev);
2348 	}
2349 	return im;
2350 }
2351 
2352 static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr6 *im)
2353 {
2354 	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2355 
2356 	im = im->next;
2357 	while (!im) {
2358 		if (likely(state->idev != NULL)) {
2359 			read_unlock_bh(&state->idev->lock);
2360 			in6_dev_put(state->idev);
2361 		}
2362 		state->dev = next_net_device(state->dev);
2363 		if (!state->dev) {
2364 			state->idev = NULL;
2365 			break;
2366 		}
2367 		state->idev = in6_dev_get(state->dev);
2368 		if (!state->idev)
2369 			continue;
2370 		read_lock_bh(&state->idev->lock);
2371 		im = state->idev->mc_list;
2372 	}
2373 	return im;
2374 }
2375 
2376 static struct ifmcaddr6 *igmp6_mc_get_idx(struct seq_file *seq, loff_t pos)
2377 {
2378 	struct ifmcaddr6 *im = igmp6_mc_get_first(seq);
2379 	if (im)
2380 		while (pos && (im = igmp6_mc_get_next(seq, im)) != NULL)
2381 			--pos;
2382 	return pos ? NULL : im;
2383 }
2384 
2385 static void *igmp6_mc_seq_start(struct seq_file *seq, loff_t *pos)
2386 {
2387 	read_lock(&dev_base_lock);
2388 	return igmp6_mc_get_idx(seq, *pos);
2389 }
2390 
2391 static void *igmp6_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2392 {
2393 	struct ifmcaddr6 *im;
2394 	im = igmp6_mc_get_next(seq, v);
2395 	++*pos;
2396 	return im;
2397 }
2398 
2399 static void igmp6_mc_seq_stop(struct seq_file *seq, void *v)
2400 {
2401 	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2402 	if (likely(state->idev != NULL)) {
2403 		read_unlock_bh(&state->idev->lock);
2404 		in6_dev_put(state->idev);
2405 		state->idev = NULL;
2406 	}
2407 	state->dev = NULL;
2408 	read_unlock(&dev_base_lock);
2409 }
2410 
2411 static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
2412 {
2413 	struct ifmcaddr6 *im = (struct ifmcaddr6 *)v;
2414 	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2415 
2416 	seq_printf(seq,
2417 		   "%-4d %-15s " NIP6_SEQFMT " %5d %08X %ld\n",
2418 		   state->dev->ifindex, state->dev->name,
2419 		   NIP6(im->mca_addr),
2420 		   im->mca_users, im->mca_flags,
2421 		   (im->mca_flags&MAF_TIMER_RUNNING) ?
2422 		   jiffies_to_clock_t(im->mca_timer.expires-jiffies) : 0);
2423 	return 0;
2424 }
2425 
2426 static struct seq_operations igmp6_mc_seq_ops = {
2427 	.start	=	igmp6_mc_seq_start,
2428 	.next	=	igmp6_mc_seq_next,
2429 	.stop	=	igmp6_mc_seq_stop,
2430 	.show	=	igmp6_mc_seq_show,
2431 };
2432 
2433 static int igmp6_mc_seq_open(struct inode *inode, struct file *file)
2434 {
2435 	struct seq_file *seq;
2436 	int rc = -ENOMEM;
2437 	struct igmp6_mc_iter_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
2438 
2439 	if (!s)
2440 		goto out;
2441 
2442 	rc = seq_open(file, &igmp6_mc_seq_ops);
2443 	if (rc)
2444 		goto out_kfree;
2445 
2446 	seq = file->private_data;
2447 	seq->private = s;
2448 out:
2449 	return rc;
2450 out_kfree:
2451 	kfree(s);
2452 	goto out;
2453 }
2454 
2455 static const struct file_operations igmp6_mc_seq_fops = {
2456 	.owner		=	THIS_MODULE,
2457 	.open		=	igmp6_mc_seq_open,
2458 	.read		=	seq_read,
2459 	.llseek		=	seq_lseek,
2460 	.release	=	seq_release_private,
2461 };
2462 
2463 struct igmp6_mcf_iter_state {
2464 	struct net_device *dev;
2465 	struct inet6_dev *idev;
2466 	struct ifmcaddr6 *im;
2467 };
2468 
2469 #define igmp6_mcf_seq_private(seq)	((struct igmp6_mcf_iter_state *)(seq)->private)
2470 
2471 static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
2472 {
2473 	struct ip6_sf_list *psf = NULL;
2474 	struct ifmcaddr6 *im = NULL;
2475 	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2476 
2477 	state->idev = NULL;
2478 	state->im = NULL;
2479 	for_each_netdev(state->dev) {
2480 		struct inet6_dev *idev;
2481 		idev = in6_dev_get(state->dev);
2482 		if (unlikely(idev == NULL))
2483 			continue;
2484 		read_lock_bh(&idev->lock);
2485 		im = idev->mc_list;
2486 		if (likely(im != NULL)) {
2487 			spin_lock_bh(&im->mca_lock);
2488 			psf = im->mca_sources;
2489 			if (likely(psf != NULL)) {
2490 				state->im = im;
2491 				state->idev = idev;
2492 				break;
2493 			}
2494 			spin_unlock_bh(&im->mca_lock);
2495 		}
2496 		read_unlock_bh(&idev->lock);
2497 		in6_dev_put(idev);
2498 	}
2499 	return psf;
2500 }
2501 
2502 static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_sf_list *psf)
2503 {
2504 	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2505 
2506 	psf = psf->sf_next;
2507 	while (!psf) {
2508 		spin_unlock_bh(&state->im->mca_lock);
2509 		state->im = state->im->next;
2510 		while (!state->im) {
2511 			if (likely(state->idev != NULL)) {
2512 				read_unlock_bh(&state->idev->lock);
2513 				in6_dev_put(state->idev);
2514 			}
2515 			state->dev = next_net_device(state->dev);
2516 			if (!state->dev) {
2517 				state->idev = NULL;
2518 				goto out;
2519 			}
2520 			state->idev = in6_dev_get(state->dev);
2521 			if (!state->idev)
2522 				continue;
2523 			read_lock_bh(&state->idev->lock);
2524 			state->im = state->idev->mc_list;
2525 		}
2526 		if (!state->im)
2527 			break;
2528 		spin_lock_bh(&state->im->mca_lock);
2529 		psf = state->im->mca_sources;
2530 	}
2531 out:
2532 	return psf;
2533 }
2534 
2535 static struct ip6_sf_list *igmp6_mcf_get_idx(struct seq_file *seq, loff_t pos)
2536 {
2537 	struct ip6_sf_list *psf = igmp6_mcf_get_first(seq);
2538 	if (psf)
2539 		while (pos && (psf = igmp6_mcf_get_next(seq, psf)) != NULL)
2540 			--pos;
2541 	return pos ? NULL : psf;
2542 }
2543 
2544 static void *igmp6_mcf_seq_start(struct seq_file *seq, loff_t *pos)
2545 {
2546 	read_lock(&dev_base_lock);
2547 	return *pos ? igmp6_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2548 }
2549 
2550 static void *igmp6_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2551 {
2552 	struct ip6_sf_list *psf;
2553 	if (v == SEQ_START_TOKEN)
2554 		psf = igmp6_mcf_get_first(seq);
2555 	else
2556 		psf = igmp6_mcf_get_next(seq, v);
2557 	++*pos;
2558 	return psf;
2559 }
2560 
2561 static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
2562 {
2563 	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2564 	if (likely(state->im != NULL)) {
2565 		spin_unlock_bh(&state->im->mca_lock);
2566 		state->im = NULL;
2567 	}
2568 	if (likely(state->idev != NULL)) {
2569 		read_unlock_bh(&state->idev->lock);
2570 		in6_dev_put(state->idev);
2571 		state->idev = NULL;
2572 	}
2573 	state->dev = NULL;
2574 	read_unlock(&dev_base_lock);
2575 }
2576 
2577 static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
2578 {
2579 	struct ip6_sf_list *psf = (struct ip6_sf_list *)v;
2580 	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2581 
2582 	if (v == SEQ_START_TOKEN) {
2583 		seq_printf(seq,
2584 			   "%3s %6s "
2585 			   "%32s %32s %6s %6s\n", "Idx",
2586 			   "Device", "Multicast Address",
2587 			   "Source Address", "INC", "EXC");
2588 	} else {
2589 		seq_printf(seq,
2590 			   "%3d %6.6s " NIP6_SEQFMT " " NIP6_SEQFMT " %6lu %6lu\n",
2591 			   state->dev->ifindex, state->dev->name,
2592 			   NIP6(state->im->mca_addr),
2593 			   NIP6(psf->sf_addr),
2594 			   psf->sf_count[MCAST_INCLUDE],
2595 			   psf->sf_count[MCAST_EXCLUDE]);
2596 	}
2597 	return 0;
2598 }
2599 
2600 static struct seq_operations igmp6_mcf_seq_ops = {
2601 	.start	=	igmp6_mcf_seq_start,
2602 	.next	=	igmp6_mcf_seq_next,
2603 	.stop	=	igmp6_mcf_seq_stop,
2604 	.show	=	igmp6_mcf_seq_show,
2605 };
2606 
2607 static int igmp6_mcf_seq_open(struct inode *inode, struct file *file)
2608 {
2609 	struct seq_file *seq;
2610 	int rc = -ENOMEM;
2611 	struct igmp6_mcf_iter_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
2612 
2613 	if (!s)
2614 		goto out;
2615 
2616 	rc = seq_open(file, &igmp6_mcf_seq_ops);
2617 	if (rc)
2618 		goto out_kfree;
2619 
2620 	seq = file->private_data;
2621 	seq->private = s;
2622 out:
2623 	return rc;
2624 out_kfree:
2625 	kfree(s);
2626 	goto out;
2627 }
2628 
2629 static const struct file_operations igmp6_mcf_seq_fops = {
2630 	.owner		=	THIS_MODULE,
2631 	.open		=	igmp6_mcf_seq_open,
2632 	.read		=	seq_read,
2633 	.llseek		=	seq_lseek,
2634 	.release	=	seq_release_private,
2635 };
2636 #endif
2637 
2638 int __init igmp6_init(struct net_proto_family *ops)
2639 {
2640 	struct ipv6_pinfo *np;
2641 	struct sock *sk;
2642 	int err;
2643 
2644 	err = sock_create_kern(PF_INET6, SOCK_RAW, IPPROTO_ICMPV6, &igmp6_socket);
2645 	if (err < 0) {
2646 		printk(KERN_ERR
2647 		       "Failed to initialize the IGMP6 control socket (err %d).\n",
2648 		       err);
2649 		igmp6_socket = NULL; /* For safety. */
2650 		return err;
2651 	}
2652 
2653 	sk = igmp6_socket->sk;
2654 	sk->sk_allocation = GFP_ATOMIC;
2655 	sk->sk_prot->unhash(sk);
2656 
2657 	np = inet6_sk(sk);
2658 	np->hop_limit = 1;
2659 
2660 #ifdef CONFIG_PROC_FS
2661 	proc_net_fops_create("igmp6", S_IRUGO, &igmp6_mc_seq_fops);
2662 	proc_net_fops_create("mcfilter6", S_IRUGO, &igmp6_mcf_seq_fops);
2663 #endif
2664 
2665 	return 0;
2666 }
2667 
2668 void igmp6_cleanup(void)
2669 {
2670 	sock_release(igmp6_socket);
2671 	igmp6_socket = NULL; /* for safety */
2672 
2673 #ifdef CONFIG_PROC_FS
2674 	proc_net_remove("mcfilter6");
2675 	proc_net_remove("igmp6");
2676 #endif
2677 }
2678