xref: /openbmc/linux/net/ipv4/igmp.c (revision e6c81cce)
1 /*
2  *	Linux NET3:	Internet Group Management Protocol  [IGMP]
3  *
4  *	This code implements the IGMP protocol as defined in RFC1112. There has
5  *	been a further revision of this protocol since which is now supported.
6  *
7  *	If you have trouble with this module be careful what gcc you have used,
8  *	the older version didn't come out right using gcc 2.5.8, the newer one
9  *	seems to fall out with gcc 2.6.2.
10  *
11  *	Authors:
12  *		Alan Cox <alan@lxorguk.ukuu.org.uk>
13  *
14  *	This program is free software; you can redistribute it and/or
15  *	modify it under the terms of the GNU General Public License
16  *	as published by the Free Software Foundation; either version
17  *	2 of the License, or (at your option) any later version.
18  *
19  *	Fixes:
20  *
21  *		Alan Cox	:	Added lots of __inline__ to optimise
22  *					the memory usage of all the tiny little
23  *					functions.
24  *		Alan Cox	:	Dumped the header building experiment.
25  *		Alan Cox	:	Minor tweaks ready for multicast routing
26  *					and extended IGMP protocol.
27  *		Alan Cox	:	Removed a load of inline directives. Gcc 2.5.8
28  *					writes utterly bogus code otherwise (sigh)
29  *					fixed IGMP loopback to behave in the manner
30  *					desired by mrouted, fixed the fact it has been
31  *					broken since 1.3.6 and cleaned up a few minor
32  *					points.
33  *
34  *		Chih-Jen Chang	:	Tried to revise IGMP to Version 2
35  *		Tsu-Sheng Tsao		E-mail: chihjenc@scf.usc.edu and tsusheng@scf.usc.edu
36  *					The enhancements are mainly based on Steve Deering's
37  * 					ipmulti-3.5 source code.
38  *		Chih-Jen Chang	:	Added the igmp_get_mrouter_info and
39  *		Tsu-Sheng Tsao		igmp_set_mrouter_info to keep track of
40  *					the mrouted version on that device.
41  *		Chih-Jen Chang	:	Added the max_resp_time parameter to
42  *		Tsu-Sheng Tsao		igmp_heard_query(). Using this parameter
43  *					to identify the multicast router version
44  *					and do what the IGMP version 2 specified.
45  *		Chih-Jen Chang	:	Added a timer to revert to IGMP V2 router
46  *		Tsu-Sheng Tsao		if the specified time expired.
47  *		Alan Cox	:	Stop IGMP from 0.0.0.0 being accepted.
48  *		Alan Cox	:	Use GFP_ATOMIC in the right places.
49  *		Christian Daudt :	igmp timer wasn't set for local group
50  *					memberships but was being deleted,
51  *					which caused a "del_timer() called
52  *					from %p with timer not initialized\n"
53  *					message (960131).
54  *		Christian Daudt :	removed del_timer from
55  *					igmp_timer_expire function (960205).
56  *             Christian Daudt :       igmp_heard_report now only calls
57  *                                     igmp_timer_expire if tm->running is
58  *                                     true (960216).
59  *		Malcolm Beattie :	ttl comparison wrong in igmp_rcv made
60  *					igmp_heard_query never trigger. Expiry
61  *					miscalculation fixed in igmp_heard_query
62  *					and random() made to return unsigned to
63  *					prevent negative expiry times.
64  *		Alexey Kuznetsov:	Wrong group leaving behaviour, backport
65  *					fix from pending 2.1.x patches.
66  *		Alan Cox:		Forget to enable FDDI support earlier.
67  *		Alexey Kuznetsov:	Fixed leaving groups on device down.
68  *		Alexey Kuznetsov:	Accordance to igmp-v2-06 draft.
69  *		David L Stevens:	IGMPv3 support, with help from
70  *					Vinay Kulkarni
71  */
72 
73 #include <linux/module.h>
74 #include <linux/slab.h>
75 #include <asm/uaccess.h>
76 #include <linux/types.h>
77 #include <linux/kernel.h>
78 #include <linux/jiffies.h>
79 #include <linux/string.h>
80 #include <linux/socket.h>
81 #include <linux/sockios.h>
82 #include <linux/in.h>
83 #include <linux/inet.h>
84 #include <linux/netdevice.h>
85 #include <linux/skbuff.h>
86 #include <linux/inetdevice.h>
87 #include <linux/igmp.h>
88 #include <linux/if_arp.h>
89 #include <linux/rtnetlink.h>
90 #include <linux/times.h>
91 #include <linux/pkt_sched.h>
92 
93 #include <net/net_namespace.h>
94 #include <net/arp.h>
95 #include <net/ip.h>
96 #include <net/protocol.h>
97 #include <net/route.h>
98 #include <net/sock.h>
99 #include <net/checksum.h>
100 #include <net/inet_common.h>
101 #include <linux/netfilter_ipv4.h>
102 #ifdef CONFIG_IP_MROUTE
103 #include <linux/mroute.h>
104 #endif
105 #ifdef CONFIG_PROC_FS
106 #include <linux/proc_fs.h>
107 #include <linux/seq_file.h>
108 #endif
109 
110 #define IP_MAX_MEMBERSHIPS	20
111 #define IP_MAX_MSF		10
112 
113 #ifdef CONFIG_IP_MULTICAST
114 /* Parameter names and values are taken from igmp-v2-06 draft */
115 
116 #define IGMP_V1_ROUTER_PRESENT_TIMEOUT		(400*HZ)
117 #define IGMP_V2_ROUTER_PRESENT_TIMEOUT		(400*HZ)
118 #define IGMP_V2_UNSOLICITED_REPORT_INTERVAL	(10*HZ)
119 #define IGMP_V3_UNSOLICITED_REPORT_INTERVAL	(1*HZ)
120 #define IGMP_QUERY_RESPONSE_INTERVAL		(10*HZ)
121 #define IGMP_QUERY_ROBUSTNESS_VARIABLE		2
122 
123 
124 #define IGMP_INITIAL_REPORT_DELAY		(1)
125 
126 /* IGMP_INITIAL_REPORT_DELAY is not from IGMP specs!
127  * IGMP specs require to report membership immediately after
128  * joining a group, but we delay the first report by a
129  * small interval. It seems more natural and still does not
130  * contradict to specs provided this delay is small enough.
131  */
132 
133 #define IGMP_V1_SEEN(in_dev) \
134 	(IPV4_DEVCONF_ALL(dev_net(in_dev->dev), FORCE_IGMP_VERSION) == 1 || \
135 	 IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 1 || \
136 	 ((in_dev)->mr_v1_seen && \
137 	  time_before(jiffies, (in_dev)->mr_v1_seen)))
138 #define IGMP_V2_SEEN(in_dev) \
139 	(IPV4_DEVCONF_ALL(dev_net(in_dev->dev), FORCE_IGMP_VERSION) == 2 || \
140 	 IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 2 || \
141 	 ((in_dev)->mr_v2_seen && \
142 	  time_before(jiffies, (in_dev)->mr_v2_seen)))
143 
144 static int unsolicited_report_interval(struct in_device *in_dev)
145 {
146 	int interval_ms, interval_jiffies;
147 
148 	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
149 		interval_ms = IN_DEV_CONF_GET(
150 			in_dev,
151 			IGMPV2_UNSOLICITED_REPORT_INTERVAL);
152 	else /* v3 */
153 		interval_ms = IN_DEV_CONF_GET(
154 			in_dev,
155 			IGMPV3_UNSOLICITED_REPORT_INTERVAL);
156 
157 	interval_jiffies = msecs_to_jiffies(interval_ms);
158 
159 	/* _timer functions can't handle a delay of 0 jiffies so ensure
160 	 *  we always return a positive value.
161 	 */
162 	if (interval_jiffies <= 0)
163 		interval_jiffies = 1;
164 	return interval_jiffies;
165 }
166 
167 static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im);
168 static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr);
169 static void igmpv3_clear_delrec(struct in_device *in_dev);
170 static int sf_setstate(struct ip_mc_list *pmc);
171 static void sf_markstate(struct ip_mc_list *pmc);
172 #endif
173 static void ip_mc_clear_src(struct ip_mc_list *pmc);
174 static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
175 			 int sfcount, __be32 *psfsrc, int delta);
176 
177 static void ip_ma_put(struct ip_mc_list *im)
178 {
179 	if (atomic_dec_and_test(&im->refcnt)) {
180 		in_dev_put(im->interface);
181 		kfree_rcu(im, rcu);
182 	}
183 }
184 
185 #define for_each_pmc_rcu(in_dev, pmc)				\
186 	for (pmc = rcu_dereference(in_dev->mc_list);		\
187 	     pmc != NULL;					\
188 	     pmc = rcu_dereference(pmc->next_rcu))
189 
190 #define for_each_pmc_rtnl(in_dev, pmc)				\
191 	for (pmc = rtnl_dereference(in_dev->mc_list);		\
192 	     pmc != NULL;					\
193 	     pmc = rtnl_dereference(pmc->next_rcu))
194 
195 #ifdef CONFIG_IP_MULTICAST
196 
197 /*
198  *	Timer management
199  */
200 
201 static void igmp_stop_timer(struct ip_mc_list *im)
202 {
203 	spin_lock_bh(&im->lock);
204 	if (del_timer(&im->timer))
205 		atomic_dec(&im->refcnt);
206 	im->tm_running = 0;
207 	im->reporter = 0;
208 	im->unsolicit_count = 0;
209 	spin_unlock_bh(&im->lock);
210 }
211 
212 /* It must be called with locked im->lock */
213 static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
214 {
215 	int tv = prandom_u32() % max_delay;
216 
217 	im->tm_running = 1;
218 	if (!mod_timer(&im->timer, jiffies+tv+2))
219 		atomic_inc(&im->refcnt);
220 }
221 
222 static void igmp_gq_start_timer(struct in_device *in_dev)
223 {
224 	int tv = prandom_u32() % in_dev->mr_maxdelay;
225 
226 	in_dev->mr_gq_running = 1;
227 	if (!mod_timer(&in_dev->mr_gq_timer, jiffies+tv+2))
228 		in_dev_hold(in_dev);
229 }
230 
231 static void igmp_ifc_start_timer(struct in_device *in_dev, int delay)
232 {
233 	int tv = prandom_u32() % delay;
234 
235 	if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2))
236 		in_dev_hold(in_dev);
237 }
238 
239 static void igmp_mod_timer(struct ip_mc_list *im, int max_delay)
240 {
241 	spin_lock_bh(&im->lock);
242 	im->unsolicit_count = 0;
243 	if (del_timer(&im->timer)) {
244 		if ((long)(im->timer.expires-jiffies) < max_delay) {
245 			add_timer(&im->timer);
246 			im->tm_running = 1;
247 			spin_unlock_bh(&im->lock);
248 			return;
249 		}
250 		atomic_dec(&im->refcnt);
251 	}
252 	igmp_start_timer(im, max_delay);
253 	spin_unlock_bh(&im->lock);
254 }
255 
256 
257 /*
258  *	Send an IGMP report.
259  */
260 
261 #define IGMP_SIZE (sizeof(struct igmphdr)+sizeof(struct iphdr)+4)
262 
263 
264 static int is_in(struct ip_mc_list *pmc, struct ip_sf_list *psf, int type,
265 	int gdeleted, int sdeleted)
266 {
267 	switch (type) {
268 	case IGMPV3_MODE_IS_INCLUDE:
269 	case IGMPV3_MODE_IS_EXCLUDE:
270 		if (gdeleted || sdeleted)
271 			return 0;
272 		if (!(pmc->gsquery && !psf->sf_gsresp)) {
273 			if (pmc->sfmode == MCAST_INCLUDE)
274 				return 1;
275 			/* don't include if this source is excluded
276 			 * in all filters
277 			 */
278 			if (psf->sf_count[MCAST_INCLUDE])
279 				return type == IGMPV3_MODE_IS_INCLUDE;
280 			return pmc->sfcount[MCAST_EXCLUDE] ==
281 				psf->sf_count[MCAST_EXCLUDE];
282 		}
283 		return 0;
284 	case IGMPV3_CHANGE_TO_INCLUDE:
285 		if (gdeleted || sdeleted)
286 			return 0;
287 		return psf->sf_count[MCAST_INCLUDE] != 0;
288 	case IGMPV3_CHANGE_TO_EXCLUDE:
289 		if (gdeleted || sdeleted)
290 			return 0;
291 		if (pmc->sfcount[MCAST_EXCLUDE] == 0 ||
292 		    psf->sf_count[MCAST_INCLUDE])
293 			return 0;
294 		return pmc->sfcount[MCAST_EXCLUDE] ==
295 			psf->sf_count[MCAST_EXCLUDE];
296 	case IGMPV3_ALLOW_NEW_SOURCES:
297 		if (gdeleted || !psf->sf_crcount)
298 			return 0;
299 		return (pmc->sfmode == MCAST_INCLUDE) ^ sdeleted;
300 	case IGMPV3_BLOCK_OLD_SOURCES:
301 		if (pmc->sfmode == MCAST_INCLUDE)
302 			return gdeleted || (psf->sf_crcount && sdeleted);
303 		return psf->sf_crcount && !gdeleted && !sdeleted;
304 	}
305 	return 0;
306 }
307 
308 static int
309 igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
310 {
311 	struct ip_sf_list *psf;
312 	int scount = 0;
313 
314 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
315 		if (!is_in(pmc, psf, type, gdeleted, sdeleted))
316 			continue;
317 		scount++;
318 	}
319 	return scount;
320 }
321 
322 static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
323 {
324 	struct sk_buff *skb;
325 	struct rtable *rt;
326 	struct iphdr *pip;
327 	struct igmpv3_report *pig;
328 	struct net *net = dev_net(dev);
329 	struct flowi4 fl4;
330 	int hlen = LL_RESERVED_SPACE(dev);
331 	int tlen = dev->needed_tailroom;
332 	unsigned int size = mtu;
333 
334 	while (1) {
335 		skb = alloc_skb(size + hlen + tlen,
336 				GFP_ATOMIC | __GFP_NOWARN);
337 		if (skb)
338 			break;
339 		size >>= 1;
340 		if (size < 256)
341 			return NULL;
342 	}
343 	skb->priority = TC_PRIO_CONTROL;
344 
345 	rt = ip_route_output_ports(net, &fl4, NULL, IGMPV3_ALL_MCR, 0,
346 				   0, 0,
347 				   IPPROTO_IGMP, 0, dev->ifindex);
348 	if (IS_ERR(rt)) {
349 		kfree_skb(skb);
350 		return NULL;
351 	}
352 
353 	skb_dst_set(skb, &rt->dst);
354 	skb->dev = dev;
355 
356 	skb->reserved_tailroom = skb_end_offset(skb) -
357 				 min(mtu, skb_end_offset(skb));
358 	skb_reserve(skb, hlen);
359 
360 	skb_reset_network_header(skb);
361 	pip = ip_hdr(skb);
362 	skb_put(skb, sizeof(struct iphdr) + 4);
363 
364 	pip->version  = 4;
365 	pip->ihl      = (sizeof(struct iphdr)+4)>>2;
366 	pip->tos      = 0xc0;
367 	pip->frag_off = htons(IP_DF);
368 	pip->ttl      = 1;
369 	pip->daddr    = fl4.daddr;
370 	pip->saddr    = fl4.saddr;
371 	pip->protocol = IPPROTO_IGMP;
372 	pip->tot_len  = 0;	/* filled in later */
373 	ip_select_ident(net, skb, NULL);
374 	((u8 *)&pip[1])[0] = IPOPT_RA;
375 	((u8 *)&pip[1])[1] = 4;
376 	((u8 *)&pip[1])[2] = 0;
377 	((u8 *)&pip[1])[3] = 0;
378 
379 	skb->transport_header = skb->network_header + sizeof(struct iphdr) + 4;
380 	skb_put(skb, sizeof(*pig));
381 	pig = igmpv3_report_hdr(skb);
382 	pig->type = IGMPV3_HOST_MEMBERSHIP_REPORT;
383 	pig->resv1 = 0;
384 	pig->csum = 0;
385 	pig->resv2 = 0;
386 	pig->ngrec = 0;
387 	return skb;
388 }
389 
390 static int igmpv3_sendpack(struct sk_buff *skb)
391 {
392 	struct igmphdr *pig = igmp_hdr(skb);
393 	const int igmplen = skb_tail_pointer(skb) - skb_transport_header(skb);
394 
395 	pig->csum = ip_compute_csum(igmp_hdr(skb), igmplen);
396 
397 	return ip_local_out(skb);
398 }
399 
400 static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel)
401 {
402 	return sizeof(struct igmpv3_grec) + 4*igmp_scount(pmc, type, gdel, sdel);
403 }
404 
405 static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
406 	int type, struct igmpv3_grec **ppgr)
407 {
408 	struct net_device *dev = pmc->interface->dev;
409 	struct igmpv3_report *pih;
410 	struct igmpv3_grec *pgr;
411 
412 	if (!skb)
413 		skb = igmpv3_newpack(dev, dev->mtu);
414 	if (!skb)
415 		return NULL;
416 	pgr = (struct igmpv3_grec *)skb_put(skb, sizeof(struct igmpv3_grec));
417 	pgr->grec_type = type;
418 	pgr->grec_auxwords = 0;
419 	pgr->grec_nsrcs = 0;
420 	pgr->grec_mca = pmc->multiaddr;
421 	pih = igmpv3_report_hdr(skb);
422 	pih->ngrec = htons(ntohs(pih->ngrec)+1);
423 	*ppgr = pgr;
424 	return skb;
425 }
426 
427 #define AVAILABLE(skb)	((skb) ? skb_availroom(skb) : 0)
428 
429 static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
430 	int type, int gdeleted, int sdeleted)
431 {
432 	struct net_device *dev = pmc->interface->dev;
433 	struct igmpv3_report *pih;
434 	struct igmpv3_grec *pgr = NULL;
435 	struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list;
436 	int scount, stotal, first, isquery, truncate;
437 
438 	if (pmc->multiaddr == IGMP_ALL_HOSTS)
439 		return skb;
440 
441 	isquery = type == IGMPV3_MODE_IS_INCLUDE ||
442 		  type == IGMPV3_MODE_IS_EXCLUDE;
443 	truncate = type == IGMPV3_MODE_IS_EXCLUDE ||
444 		    type == IGMPV3_CHANGE_TO_EXCLUDE;
445 
446 	stotal = scount = 0;
447 
448 	psf_list = sdeleted ? &pmc->tomb : &pmc->sources;
449 
450 	if (!*psf_list)
451 		goto empty_source;
452 
453 	pih = skb ? igmpv3_report_hdr(skb) : NULL;
454 
455 	/* EX and TO_EX get a fresh packet, if needed */
456 	if (truncate) {
457 		if (pih && pih->ngrec &&
458 		    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
459 			if (skb)
460 				igmpv3_sendpack(skb);
461 			skb = igmpv3_newpack(dev, dev->mtu);
462 		}
463 	}
464 	first = 1;
465 	psf_prev = NULL;
466 	for (psf = *psf_list; psf; psf = psf_next) {
467 		__be32 *psrc;
468 
469 		psf_next = psf->sf_next;
470 
471 		if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
472 			psf_prev = psf;
473 			continue;
474 		}
475 
476 		/* clear marks on query responses */
477 		if (isquery)
478 			psf->sf_gsresp = 0;
479 
480 		if (AVAILABLE(skb) < sizeof(__be32) +
481 		    first*sizeof(struct igmpv3_grec)) {
482 			if (truncate && !first)
483 				break;	 /* truncate these */
484 			if (pgr)
485 				pgr->grec_nsrcs = htons(scount);
486 			if (skb)
487 				igmpv3_sendpack(skb);
488 			skb = igmpv3_newpack(dev, dev->mtu);
489 			first = 1;
490 			scount = 0;
491 		}
492 		if (first) {
493 			skb = add_grhead(skb, pmc, type, &pgr);
494 			first = 0;
495 		}
496 		if (!skb)
497 			return NULL;
498 		psrc = (__be32 *)skb_put(skb, sizeof(__be32));
499 		*psrc = psf->sf_inaddr;
500 		scount++; stotal++;
501 		if ((type == IGMPV3_ALLOW_NEW_SOURCES ||
502 		     type == IGMPV3_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
503 			psf->sf_crcount--;
504 			if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
505 				if (psf_prev)
506 					psf_prev->sf_next = psf->sf_next;
507 				else
508 					*psf_list = psf->sf_next;
509 				kfree(psf);
510 				continue;
511 			}
512 		}
513 		psf_prev = psf;
514 	}
515 
516 empty_source:
517 	if (!stotal) {
518 		if (type == IGMPV3_ALLOW_NEW_SOURCES ||
519 		    type == IGMPV3_BLOCK_OLD_SOURCES)
520 			return skb;
521 		if (pmc->crcount || isquery) {
522 			/* make sure we have room for group header */
523 			if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)) {
524 				igmpv3_sendpack(skb);
525 				skb = NULL; /* add_grhead will get a new one */
526 			}
527 			skb = add_grhead(skb, pmc, type, &pgr);
528 		}
529 	}
530 	if (pgr)
531 		pgr->grec_nsrcs = htons(scount);
532 
533 	if (isquery)
534 		pmc->gsquery = 0;	/* clear query state on report */
535 	return skb;
536 }
537 
538 static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
539 {
540 	struct sk_buff *skb = NULL;
541 	int type;
542 
543 	if (!pmc) {
544 		rcu_read_lock();
545 		for_each_pmc_rcu(in_dev, pmc) {
546 			if (pmc->multiaddr == IGMP_ALL_HOSTS)
547 				continue;
548 			spin_lock_bh(&pmc->lock);
549 			if (pmc->sfcount[MCAST_EXCLUDE])
550 				type = IGMPV3_MODE_IS_EXCLUDE;
551 			else
552 				type = IGMPV3_MODE_IS_INCLUDE;
553 			skb = add_grec(skb, pmc, type, 0, 0);
554 			spin_unlock_bh(&pmc->lock);
555 		}
556 		rcu_read_unlock();
557 	} else {
558 		spin_lock_bh(&pmc->lock);
559 		if (pmc->sfcount[MCAST_EXCLUDE])
560 			type = IGMPV3_MODE_IS_EXCLUDE;
561 		else
562 			type = IGMPV3_MODE_IS_INCLUDE;
563 		skb = add_grec(skb, pmc, type, 0, 0);
564 		spin_unlock_bh(&pmc->lock);
565 	}
566 	if (!skb)
567 		return 0;
568 	return igmpv3_sendpack(skb);
569 }
570 
571 /*
572  * remove zero-count source records from a source filter list
573  */
574 static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
575 {
576 	struct ip_sf_list *psf_prev, *psf_next, *psf;
577 
578 	psf_prev = NULL;
579 	for (psf = *ppsf; psf; psf = psf_next) {
580 		psf_next = psf->sf_next;
581 		if (psf->sf_crcount == 0) {
582 			if (psf_prev)
583 				psf_prev->sf_next = psf->sf_next;
584 			else
585 				*ppsf = psf->sf_next;
586 			kfree(psf);
587 		} else
588 			psf_prev = psf;
589 	}
590 }
591 
592 static void igmpv3_send_cr(struct in_device *in_dev)
593 {
594 	struct ip_mc_list *pmc, *pmc_prev, *pmc_next;
595 	struct sk_buff *skb = NULL;
596 	int type, dtype;
597 
598 	rcu_read_lock();
599 	spin_lock_bh(&in_dev->mc_tomb_lock);
600 
601 	/* deleted MCA's */
602 	pmc_prev = NULL;
603 	for (pmc = in_dev->mc_tomb; pmc; pmc = pmc_next) {
604 		pmc_next = pmc->next;
605 		if (pmc->sfmode == MCAST_INCLUDE) {
606 			type = IGMPV3_BLOCK_OLD_SOURCES;
607 			dtype = IGMPV3_BLOCK_OLD_SOURCES;
608 			skb = add_grec(skb, pmc, type, 1, 0);
609 			skb = add_grec(skb, pmc, dtype, 1, 1);
610 		}
611 		if (pmc->crcount) {
612 			if (pmc->sfmode == MCAST_EXCLUDE) {
613 				type = IGMPV3_CHANGE_TO_INCLUDE;
614 				skb = add_grec(skb, pmc, type, 1, 0);
615 			}
616 			pmc->crcount--;
617 			if (pmc->crcount == 0) {
618 				igmpv3_clear_zeros(&pmc->tomb);
619 				igmpv3_clear_zeros(&pmc->sources);
620 			}
621 		}
622 		if (pmc->crcount == 0 && !pmc->tomb && !pmc->sources) {
623 			if (pmc_prev)
624 				pmc_prev->next = pmc_next;
625 			else
626 				in_dev->mc_tomb = pmc_next;
627 			in_dev_put(pmc->interface);
628 			kfree(pmc);
629 		} else
630 			pmc_prev = pmc;
631 	}
632 	spin_unlock_bh(&in_dev->mc_tomb_lock);
633 
634 	/* change recs */
635 	for_each_pmc_rcu(in_dev, pmc) {
636 		spin_lock_bh(&pmc->lock);
637 		if (pmc->sfcount[MCAST_EXCLUDE]) {
638 			type = IGMPV3_BLOCK_OLD_SOURCES;
639 			dtype = IGMPV3_ALLOW_NEW_SOURCES;
640 		} else {
641 			type = IGMPV3_ALLOW_NEW_SOURCES;
642 			dtype = IGMPV3_BLOCK_OLD_SOURCES;
643 		}
644 		skb = add_grec(skb, pmc, type, 0, 0);
645 		skb = add_grec(skb, pmc, dtype, 0, 1);	/* deleted sources */
646 
647 		/* filter mode changes */
648 		if (pmc->crcount) {
649 			if (pmc->sfmode == MCAST_EXCLUDE)
650 				type = IGMPV3_CHANGE_TO_EXCLUDE;
651 			else
652 				type = IGMPV3_CHANGE_TO_INCLUDE;
653 			skb = add_grec(skb, pmc, type, 0, 0);
654 			pmc->crcount--;
655 		}
656 		spin_unlock_bh(&pmc->lock);
657 	}
658 	rcu_read_unlock();
659 
660 	if (!skb)
661 		return;
662 	(void) igmpv3_sendpack(skb);
663 }
664 
665 static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
666 	int type)
667 {
668 	struct sk_buff *skb;
669 	struct iphdr *iph;
670 	struct igmphdr *ih;
671 	struct rtable *rt;
672 	struct net_device *dev = in_dev->dev;
673 	struct net *net = dev_net(dev);
674 	__be32	group = pmc ? pmc->multiaddr : 0;
675 	struct flowi4 fl4;
676 	__be32	dst;
677 	int hlen, tlen;
678 
679 	if (type == IGMPV3_HOST_MEMBERSHIP_REPORT)
680 		return igmpv3_send_report(in_dev, pmc);
681 	else if (type == IGMP_HOST_LEAVE_MESSAGE)
682 		dst = IGMP_ALL_ROUTER;
683 	else
684 		dst = group;
685 
686 	rt = ip_route_output_ports(net, &fl4, NULL, dst, 0,
687 				   0, 0,
688 				   IPPROTO_IGMP, 0, dev->ifindex);
689 	if (IS_ERR(rt))
690 		return -1;
691 
692 	hlen = LL_RESERVED_SPACE(dev);
693 	tlen = dev->needed_tailroom;
694 	skb = alloc_skb(IGMP_SIZE + hlen + tlen, GFP_ATOMIC);
695 	if (!skb) {
696 		ip_rt_put(rt);
697 		return -1;
698 	}
699 	skb->priority = TC_PRIO_CONTROL;
700 
701 	skb_dst_set(skb, &rt->dst);
702 
703 	skb_reserve(skb, hlen);
704 
705 	skb_reset_network_header(skb);
706 	iph = ip_hdr(skb);
707 	skb_put(skb, sizeof(struct iphdr) + 4);
708 
709 	iph->version  = 4;
710 	iph->ihl      = (sizeof(struct iphdr)+4)>>2;
711 	iph->tos      = 0xc0;
712 	iph->frag_off = htons(IP_DF);
713 	iph->ttl      = 1;
714 	iph->daddr    = dst;
715 	iph->saddr    = fl4.saddr;
716 	iph->protocol = IPPROTO_IGMP;
717 	ip_select_ident(net, skb, NULL);
718 	((u8 *)&iph[1])[0] = IPOPT_RA;
719 	((u8 *)&iph[1])[1] = 4;
720 	((u8 *)&iph[1])[2] = 0;
721 	((u8 *)&iph[1])[3] = 0;
722 
723 	ih = (struct igmphdr *)skb_put(skb, sizeof(struct igmphdr));
724 	ih->type = type;
725 	ih->code = 0;
726 	ih->csum = 0;
727 	ih->group = group;
728 	ih->csum = ip_compute_csum((void *)ih, sizeof(struct igmphdr));
729 
730 	return ip_local_out(skb);
731 }
732 
733 static void igmp_gq_timer_expire(unsigned long data)
734 {
735 	struct in_device *in_dev = (struct in_device *)data;
736 
737 	in_dev->mr_gq_running = 0;
738 	igmpv3_send_report(in_dev, NULL);
739 	in_dev_put(in_dev);
740 }
741 
742 static void igmp_ifc_timer_expire(unsigned long data)
743 {
744 	struct in_device *in_dev = (struct in_device *)data;
745 
746 	igmpv3_send_cr(in_dev);
747 	if (in_dev->mr_ifc_count) {
748 		in_dev->mr_ifc_count--;
749 		igmp_ifc_start_timer(in_dev,
750 				     unsolicited_report_interval(in_dev));
751 	}
752 	in_dev_put(in_dev);
753 }
754 
755 static void igmp_ifc_event(struct in_device *in_dev)
756 {
757 	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
758 		return;
759 	in_dev->mr_ifc_count = in_dev->mr_qrv ?: sysctl_igmp_qrv;
760 	igmp_ifc_start_timer(in_dev, 1);
761 }
762 
763 
764 static void igmp_timer_expire(unsigned long data)
765 {
766 	struct ip_mc_list *im = (struct ip_mc_list *)data;
767 	struct in_device *in_dev = im->interface;
768 
769 	spin_lock(&im->lock);
770 	im->tm_running = 0;
771 
772 	if (im->unsolicit_count) {
773 		im->unsolicit_count--;
774 		igmp_start_timer(im, unsolicited_report_interval(in_dev));
775 	}
776 	im->reporter = 1;
777 	spin_unlock(&im->lock);
778 
779 	if (IGMP_V1_SEEN(in_dev))
780 		igmp_send_report(in_dev, im, IGMP_HOST_MEMBERSHIP_REPORT);
781 	else if (IGMP_V2_SEEN(in_dev))
782 		igmp_send_report(in_dev, im, IGMPV2_HOST_MEMBERSHIP_REPORT);
783 	else
784 		igmp_send_report(in_dev, im, IGMPV3_HOST_MEMBERSHIP_REPORT);
785 
786 	ip_ma_put(im);
787 }
788 
789 /* mark EXCLUDE-mode sources */
790 static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
791 {
792 	struct ip_sf_list *psf;
793 	int i, scount;
794 
795 	scount = 0;
796 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
797 		if (scount == nsrcs)
798 			break;
799 		for (i = 0; i < nsrcs; i++) {
800 			/* skip inactive filters */
801 			if (psf->sf_count[MCAST_INCLUDE] ||
802 			    pmc->sfcount[MCAST_EXCLUDE] !=
803 			    psf->sf_count[MCAST_EXCLUDE])
804 				break;
805 			if (srcs[i] == psf->sf_inaddr) {
806 				scount++;
807 				break;
808 			}
809 		}
810 	}
811 	pmc->gsquery = 0;
812 	if (scount == nsrcs)	/* all sources excluded */
813 		return 0;
814 	return 1;
815 }
816 
817 static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
818 {
819 	struct ip_sf_list *psf;
820 	int i, scount;
821 
822 	if (pmc->sfmode == MCAST_EXCLUDE)
823 		return igmp_xmarksources(pmc, nsrcs, srcs);
824 
825 	/* mark INCLUDE-mode sources */
826 	scount = 0;
827 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
828 		if (scount == nsrcs)
829 			break;
830 		for (i = 0; i < nsrcs; i++)
831 			if (srcs[i] == psf->sf_inaddr) {
832 				psf->sf_gsresp = 1;
833 				scount++;
834 				break;
835 			}
836 	}
837 	if (!scount) {
838 		pmc->gsquery = 0;
839 		return 0;
840 	}
841 	pmc->gsquery = 1;
842 	return 1;
843 }
844 
845 /* return true if packet was dropped */
846 static bool igmp_heard_report(struct in_device *in_dev, __be32 group)
847 {
848 	struct ip_mc_list *im;
849 
850 	/* Timers are only set for non-local groups */
851 
852 	if (group == IGMP_ALL_HOSTS)
853 		return false;
854 
855 	rcu_read_lock();
856 	for_each_pmc_rcu(in_dev, im) {
857 		if (im->multiaddr == group) {
858 			igmp_stop_timer(im);
859 			break;
860 		}
861 	}
862 	rcu_read_unlock();
863 	return false;
864 }
865 
866 /* return true if packet was dropped */
867 static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
868 	int len)
869 {
870 	struct igmphdr 		*ih = igmp_hdr(skb);
871 	struct igmpv3_query *ih3 = igmpv3_query_hdr(skb);
872 	struct ip_mc_list	*im;
873 	__be32			group = ih->group;
874 	int			max_delay;
875 	int			mark = 0;
876 
877 
878 	if (len == 8) {
879 		if (ih->code == 0) {
880 			/* Alas, old v1 router presents here. */
881 
882 			max_delay = IGMP_QUERY_RESPONSE_INTERVAL;
883 			in_dev->mr_v1_seen = jiffies +
884 				IGMP_V1_ROUTER_PRESENT_TIMEOUT;
885 			group = 0;
886 		} else {
887 			/* v2 router present */
888 			max_delay = ih->code*(HZ/IGMP_TIMER_SCALE);
889 			in_dev->mr_v2_seen = jiffies +
890 				IGMP_V2_ROUTER_PRESENT_TIMEOUT;
891 		}
892 		/* cancel the interface change timer */
893 		in_dev->mr_ifc_count = 0;
894 		if (del_timer(&in_dev->mr_ifc_timer))
895 			__in_dev_put(in_dev);
896 		/* clear deleted report items */
897 		igmpv3_clear_delrec(in_dev);
898 	} else if (len < 12) {
899 		return true;	/* ignore bogus packet; freed by caller */
900 	} else if (IGMP_V1_SEEN(in_dev)) {
901 		/* This is a v3 query with v1 queriers present */
902 		max_delay = IGMP_QUERY_RESPONSE_INTERVAL;
903 		group = 0;
904 	} else if (IGMP_V2_SEEN(in_dev)) {
905 		/* this is a v3 query with v2 queriers present;
906 		 * Interpretation of the max_delay code is problematic here.
907 		 * A real v2 host would use ih_code directly, while v3 has a
908 		 * different encoding. We use the v3 encoding as more likely
909 		 * to be intended in a v3 query.
910 		 */
911 		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
912 		if (!max_delay)
913 			max_delay = 1;	/* can't mod w/ 0 */
914 	} else { /* v3 */
915 		if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
916 			return true;
917 
918 		ih3 = igmpv3_query_hdr(skb);
919 		if (ih3->nsrcs) {
920 			if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)
921 					   + ntohs(ih3->nsrcs)*sizeof(__be32)))
922 				return true;
923 			ih3 = igmpv3_query_hdr(skb);
924 		}
925 
926 		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
927 		if (!max_delay)
928 			max_delay = 1;	/* can't mod w/ 0 */
929 		in_dev->mr_maxdelay = max_delay;
930 		if (ih3->qrv)
931 			in_dev->mr_qrv = ih3->qrv;
932 		if (!group) { /* general query */
933 			if (ih3->nsrcs)
934 				return true;	/* no sources allowed */
935 			igmp_gq_start_timer(in_dev);
936 			return false;
937 		}
938 		/* mark sources to include, if group & source-specific */
939 		mark = ih3->nsrcs != 0;
940 	}
941 
942 	/*
943 	 * - Start the timers in all of our membership records
944 	 *   that the query applies to for the interface on
945 	 *   which the query arrived excl. those that belong
946 	 *   to a "local" group (224.0.0.X)
947 	 * - For timers already running check if they need to
948 	 *   be reset.
949 	 * - Use the igmp->igmp_code field as the maximum
950 	 *   delay possible
951 	 */
952 	rcu_read_lock();
953 	for_each_pmc_rcu(in_dev, im) {
954 		int changed;
955 
956 		if (group && group != im->multiaddr)
957 			continue;
958 		if (im->multiaddr == IGMP_ALL_HOSTS)
959 			continue;
960 		spin_lock_bh(&im->lock);
961 		if (im->tm_running)
962 			im->gsquery = im->gsquery && mark;
963 		else
964 			im->gsquery = mark;
965 		changed = !im->gsquery ||
966 			igmp_marksources(im, ntohs(ih3->nsrcs), ih3->srcs);
967 		spin_unlock_bh(&im->lock);
968 		if (changed)
969 			igmp_mod_timer(im, max_delay);
970 	}
971 	rcu_read_unlock();
972 	return false;
973 }
974 
975 /* called in rcu_read_lock() section */
976 int igmp_rcv(struct sk_buff *skb)
977 {
978 	/* This basically follows the spec line by line -- see RFC1112 */
979 	struct igmphdr *ih;
980 	struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
981 	int len = skb->len;
982 	bool dropped = true;
983 
984 	if (!in_dev)
985 		goto drop;
986 
987 	if (!pskb_may_pull(skb, sizeof(struct igmphdr)))
988 		goto drop;
989 
990 	if (skb_checksum_simple_validate(skb))
991 		goto drop;
992 
993 	ih = igmp_hdr(skb);
994 	switch (ih->type) {
995 	case IGMP_HOST_MEMBERSHIP_QUERY:
996 		dropped = igmp_heard_query(in_dev, skb, len);
997 		break;
998 	case IGMP_HOST_MEMBERSHIP_REPORT:
999 	case IGMPV2_HOST_MEMBERSHIP_REPORT:
1000 		/* Is it our report looped back? */
1001 		if (rt_is_output_route(skb_rtable(skb)))
1002 			break;
1003 		/* don't rely on MC router hearing unicast reports */
1004 		if (skb->pkt_type == PACKET_MULTICAST ||
1005 		    skb->pkt_type == PACKET_BROADCAST)
1006 			dropped = igmp_heard_report(in_dev, ih->group);
1007 		break;
1008 	case IGMP_PIM:
1009 #ifdef CONFIG_IP_PIMSM_V1
1010 		return pim_rcv_v1(skb);
1011 #endif
1012 	case IGMPV3_HOST_MEMBERSHIP_REPORT:
1013 	case IGMP_DVMRP:
1014 	case IGMP_TRACE:
1015 	case IGMP_HOST_LEAVE_MESSAGE:
1016 	case IGMP_MTRACE:
1017 	case IGMP_MTRACE_RESP:
1018 		break;
1019 	default:
1020 		break;
1021 	}
1022 
1023 drop:
1024 	if (dropped)
1025 		kfree_skb(skb);
1026 	else
1027 		consume_skb(skb);
1028 	return 0;
1029 }
1030 
1031 #endif
1032 
1033 
1034 /*
1035  *	Add a filter to a device
1036  */
1037 
1038 static void ip_mc_filter_add(struct in_device *in_dev, __be32 addr)
1039 {
1040 	char buf[MAX_ADDR_LEN];
1041 	struct net_device *dev = in_dev->dev;
1042 
1043 	/* Checking for IFF_MULTICAST here is WRONG-WRONG-WRONG.
1044 	   We will get multicast token leakage, when IFF_MULTICAST
1045 	   is changed. This check should be done in ndo_set_rx_mode
1046 	   routine. Something sort of:
1047 	   if (dev->mc_list && dev->flags&IFF_MULTICAST) { do it; }
1048 	   --ANK
1049 	   */
1050 	if (arp_mc_map(addr, buf, dev, 0) == 0)
1051 		dev_mc_add(dev, buf);
1052 }
1053 
1054 /*
1055  *	Remove a filter from a device
1056  */
1057 
1058 static void ip_mc_filter_del(struct in_device *in_dev, __be32 addr)
1059 {
1060 	char buf[MAX_ADDR_LEN];
1061 	struct net_device *dev = in_dev->dev;
1062 
1063 	if (arp_mc_map(addr, buf, dev, 0) == 0)
1064 		dev_mc_del(dev, buf);
1065 }
1066 
1067 #ifdef CONFIG_IP_MULTICAST
1068 /*
1069  * deleted ip_mc_list manipulation
1070  */
1071 static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
1072 {
1073 	struct ip_mc_list *pmc;
1074 
1075 	/* this is an "ip_mc_list" for convenience; only the fields below
1076 	 * are actually used. In particular, the refcnt and users are not
1077 	 * used for management of the delete list. Using the same structure
1078 	 * for deleted items allows change reports to use common code with
1079 	 * non-deleted or query-response MCA's.
1080 	 */
1081 	pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
1082 	if (!pmc)
1083 		return;
1084 	spin_lock_bh(&im->lock);
1085 	pmc->interface = im->interface;
1086 	in_dev_hold(in_dev);
1087 	pmc->multiaddr = im->multiaddr;
1088 	pmc->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1089 	pmc->sfmode = im->sfmode;
1090 	if (pmc->sfmode == MCAST_INCLUDE) {
1091 		struct ip_sf_list *psf;
1092 
1093 		pmc->tomb = im->tomb;
1094 		pmc->sources = im->sources;
1095 		im->tomb = im->sources = NULL;
1096 		for (psf = pmc->sources; psf; psf = psf->sf_next)
1097 			psf->sf_crcount = pmc->crcount;
1098 	}
1099 	spin_unlock_bh(&im->lock);
1100 
1101 	spin_lock_bh(&in_dev->mc_tomb_lock);
1102 	pmc->next = in_dev->mc_tomb;
1103 	in_dev->mc_tomb = pmc;
1104 	spin_unlock_bh(&in_dev->mc_tomb_lock);
1105 }
1106 
1107 static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
1108 {
1109 	struct ip_mc_list *pmc, *pmc_prev;
1110 	struct ip_sf_list *psf, *psf_next;
1111 
1112 	spin_lock_bh(&in_dev->mc_tomb_lock);
1113 	pmc_prev = NULL;
1114 	for (pmc = in_dev->mc_tomb; pmc; pmc = pmc->next) {
1115 		if (pmc->multiaddr == multiaddr)
1116 			break;
1117 		pmc_prev = pmc;
1118 	}
1119 	if (pmc) {
1120 		if (pmc_prev)
1121 			pmc_prev->next = pmc->next;
1122 		else
1123 			in_dev->mc_tomb = pmc->next;
1124 	}
1125 	spin_unlock_bh(&in_dev->mc_tomb_lock);
1126 	if (pmc) {
1127 		for (psf = pmc->tomb; psf; psf = psf_next) {
1128 			psf_next = psf->sf_next;
1129 			kfree(psf);
1130 		}
1131 		in_dev_put(pmc->interface);
1132 		kfree(pmc);
1133 	}
1134 }
1135 
1136 static void igmpv3_clear_delrec(struct in_device *in_dev)
1137 {
1138 	struct ip_mc_list *pmc, *nextpmc;
1139 
1140 	spin_lock_bh(&in_dev->mc_tomb_lock);
1141 	pmc = in_dev->mc_tomb;
1142 	in_dev->mc_tomb = NULL;
1143 	spin_unlock_bh(&in_dev->mc_tomb_lock);
1144 
1145 	for (; pmc; pmc = nextpmc) {
1146 		nextpmc = pmc->next;
1147 		ip_mc_clear_src(pmc);
1148 		in_dev_put(pmc->interface);
1149 		kfree(pmc);
1150 	}
1151 	/* clear dead sources, too */
1152 	rcu_read_lock();
1153 	for_each_pmc_rcu(in_dev, pmc) {
1154 		struct ip_sf_list *psf, *psf_next;
1155 
1156 		spin_lock_bh(&pmc->lock);
1157 		psf = pmc->tomb;
1158 		pmc->tomb = NULL;
1159 		spin_unlock_bh(&pmc->lock);
1160 		for (; psf; psf = psf_next) {
1161 			psf_next = psf->sf_next;
1162 			kfree(psf);
1163 		}
1164 	}
1165 	rcu_read_unlock();
1166 }
1167 #endif
1168 
1169 static void igmp_group_dropped(struct ip_mc_list *im)
1170 {
1171 	struct in_device *in_dev = im->interface;
1172 #ifdef CONFIG_IP_MULTICAST
1173 	int reporter;
1174 #endif
1175 
1176 	if (im->loaded) {
1177 		im->loaded = 0;
1178 		ip_mc_filter_del(in_dev, im->multiaddr);
1179 	}
1180 
1181 #ifdef CONFIG_IP_MULTICAST
1182 	if (im->multiaddr == IGMP_ALL_HOSTS)
1183 		return;
1184 
1185 	reporter = im->reporter;
1186 	igmp_stop_timer(im);
1187 
1188 	if (!in_dev->dead) {
1189 		if (IGMP_V1_SEEN(in_dev))
1190 			return;
1191 		if (IGMP_V2_SEEN(in_dev)) {
1192 			if (reporter)
1193 				igmp_send_report(in_dev, im, IGMP_HOST_LEAVE_MESSAGE);
1194 			return;
1195 		}
1196 		/* IGMPv3 */
1197 		igmpv3_add_delrec(in_dev, im);
1198 
1199 		igmp_ifc_event(in_dev);
1200 	}
1201 #endif
1202 }
1203 
1204 static void igmp_group_added(struct ip_mc_list *im)
1205 {
1206 	struct in_device *in_dev = im->interface;
1207 
1208 	if (im->loaded == 0) {
1209 		im->loaded = 1;
1210 		ip_mc_filter_add(in_dev, im->multiaddr);
1211 	}
1212 
1213 #ifdef CONFIG_IP_MULTICAST
1214 	if (im->multiaddr == IGMP_ALL_HOSTS)
1215 		return;
1216 
1217 	if (in_dev->dead)
1218 		return;
1219 	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev)) {
1220 		spin_lock_bh(&im->lock);
1221 		igmp_start_timer(im, IGMP_INITIAL_REPORT_DELAY);
1222 		spin_unlock_bh(&im->lock);
1223 		return;
1224 	}
1225 	/* else, v3 */
1226 
1227 	im->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1228 	igmp_ifc_event(in_dev);
1229 #endif
1230 }
1231 
1232 
1233 /*
1234  *	Multicast list managers
1235  */
1236 
1237 static u32 ip_mc_hash(const struct ip_mc_list *im)
1238 {
1239 	return hash_32((__force u32)im->multiaddr, MC_HASH_SZ_LOG);
1240 }
1241 
1242 static void ip_mc_hash_add(struct in_device *in_dev,
1243 			   struct ip_mc_list *im)
1244 {
1245 	struct ip_mc_list __rcu **mc_hash;
1246 	u32 hash;
1247 
1248 	mc_hash = rtnl_dereference(in_dev->mc_hash);
1249 	if (mc_hash) {
1250 		hash = ip_mc_hash(im);
1251 		im->next_hash = mc_hash[hash];
1252 		rcu_assign_pointer(mc_hash[hash], im);
1253 		return;
1254 	}
1255 
1256 	/* do not use a hash table for small number of items */
1257 	if (in_dev->mc_count < 4)
1258 		return;
1259 
1260 	mc_hash = kzalloc(sizeof(struct ip_mc_list *) << MC_HASH_SZ_LOG,
1261 			  GFP_KERNEL);
1262 	if (!mc_hash)
1263 		return;
1264 
1265 	for_each_pmc_rtnl(in_dev, im) {
1266 		hash = ip_mc_hash(im);
1267 		im->next_hash = mc_hash[hash];
1268 		RCU_INIT_POINTER(mc_hash[hash], im);
1269 	}
1270 
1271 	rcu_assign_pointer(in_dev->mc_hash, mc_hash);
1272 }
1273 
1274 static void ip_mc_hash_remove(struct in_device *in_dev,
1275 			      struct ip_mc_list *im)
1276 {
1277 	struct ip_mc_list __rcu **mc_hash = rtnl_dereference(in_dev->mc_hash);
1278 	struct ip_mc_list *aux;
1279 
1280 	if (!mc_hash)
1281 		return;
1282 	mc_hash += ip_mc_hash(im);
1283 	while ((aux = rtnl_dereference(*mc_hash)) != im)
1284 		mc_hash = &aux->next_hash;
1285 	*mc_hash = im->next_hash;
1286 }
1287 
1288 
1289 /*
1290  *	A socket has joined a multicast group on device dev.
1291  */
1292 
1293 void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
1294 {
1295 	struct ip_mc_list *im;
1296 
1297 	ASSERT_RTNL();
1298 
1299 	for_each_pmc_rtnl(in_dev, im) {
1300 		if (im->multiaddr == addr) {
1301 			im->users++;
1302 			ip_mc_add_src(in_dev, &addr, MCAST_EXCLUDE, 0, NULL, 0);
1303 			goto out;
1304 		}
1305 	}
1306 
1307 	im = kzalloc(sizeof(*im), GFP_KERNEL);
1308 	if (!im)
1309 		goto out;
1310 
1311 	im->users = 1;
1312 	im->interface = in_dev;
1313 	in_dev_hold(in_dev);
1314 	im->multiaddr = addr;
1315 	/* initial mode is (EX, empty) */
1316 	im->sfmode = MCAST_EXCLUDE;
1317 	im->sfcount[MCAST_EXCLUDE] = 1;
1318 	atomic_set(&im->refcnt, 1);
1319 	spin_lock_init(&im->lock);
1320 #ifdef CONFIG_IP_MULTICAST
1321 	setup_timer(&im->timer, igmp_timer_expire, (unsigned long)im);
1322 	im->unsolicit_count = sysctl_igmp_qrv;
1323 #endif
1324 
1325 	im->next_rcu = in_dev->mc_list;
1326 	in_dev->mc_count++;
1327 	rcu_assign_pointer(in_dev->mc_list, im);
1328 
1329 	ip_mc_hash_add(in_dev, im);
1330 
1331 #ifdef CONFIG_IP_MULTICAST
1332 	igmpv3_del_delrec(in_dev, im->multiaddr);
1333 #endif
1334 	igmp_group_added(im);
1335 	if (!in_dev->dead)
1336 		ip_rt_multicast_event(in_dev);
1337 out:
1338 	return;
1339 }
1340 EXPORT_SYMBOL(ip_mc_inc_group);
1341 
1342 /*
1343  *	Resend IGMP JOIN report; used by netdev notifier.
1344  */
1345 static void ip_mc_rejoin_groups(struct in_device *in_dev)
1346 {
1347 #ifdef CONFIG_IP_MULTICAST
1348 	struct ip_mc_list *im;
1349 	int type;
1350 
1351 	ASSERT_RTNL();
1352 
1353 	for_each_pmc_rtnl(in_dev, im) {
1354 		if (im->multiaddr == IGMP_ALL_HOSTS)
1355 			continue;
1356 
1357 		/* a failover is happening and switches
1358 		 * must be notified immediately
1359 		 */
1360 		if (IGMP_V1_SEEN(in_dev))
1361 			type = IGMP_HOST_MEMBERSHIP_REPORT;
1362 		else if (IGMP_V2_SEEN(in_dev))
1363 			type = IGMPV2_HOST_MEMBERSHIP_REPORT;
1364 		else
1365 			type = IGMPV3_HOST_MEMBERSHIP_REPORT;
1366 		igmp_send_report(in_dev, im, type);
1367 	}
1368 #endif
1369 }
1370 
1371 /*
1372  *	A socket has left a multicast group on device dev
1373  */
1374 
1375 void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
1376 {
1377 	struct ip_mc_list *i;
1378 	struct ip_mc_list __rcu **ip;
1379 
1380 	ASSERT_RTNL();
1381 
1382 	for (ip = &in_dev->mc_list;
1383 	     (i = rtnl_dereference(*ip)) != NULL;
1384 	     ip = &i->next_rcu) {
1385 		if (i->multiaddr == addr) {
1386 			if (--i->users == 0) {
1387 				ip_mc_hash_remove(in_dev, i);
1388 				*ip = i->next_rcu;
1389 				in_dev->mc_count--;
1390 				igmp_group_dropped(i);
1391 				ip_mc_clear_src(i);
1392 
1393 				if (!in_dev->dead)
1394 					ip_rt_multicast_event(in_dev);
1395 
1396 				ip_ma_put(i);
1397 				return;
1398 			}
1399 			break;
1400 		}
1401 	}
1402 }
1403 EXPORT_SYMBOL(ip_mc_dec_group);
1404 
1405 /* Device changing type */
1406 
1407 void ip_mc_unmap(struct in_device *in_dev)
1408 {
1409 	struct ip_mc_list *pmc;
1410 
1411 	ASSERT_RTNL();
1412 
1413 	for_each_pmc_rtnl(in_dev, pmc)
1414 		igmp_group_dropped(pmc);
1415 }
1416 
1417 void ip_mc_remap(struct in_device *in_dev)
1418 {
1419 	struct ip_mc_list *pmc;
1420 
1421 	ASSERT_RTNL();
1422 
1423 	for_each_pmc_rtnl(in_dev, pmc)
1424 		igmp_group_added(pmc);
1425 }
1426 
1427 /* Device going down */
1428 
1429 void ip_mc_down(struct in_device *in_dev)
1430 {
1431 	struct ip_mc_list *pmc;
1432 
1433 	ASSERT_RTNL();
1434 
1435 	for_each_pmc_rtnl(in_dev, pmc)
1436 		igmp_group_dropped(pmc);
1437 
1438 #ifdef CONFIG_IP_MULTICAST
1439 	in_dev->mr_ifc_count = 0;
1440 	if (del_timer(&in_dev->mr_ifc_timer))
1441 		__in_dev_put(in_dev);
1442 	in_dev->mr_gq_running = 0;
1443 	if (del_timer(&in_dev->mr_gq_timer))
1444 		__in_dev_put(in_dev);
1445 	igmpv3_clear_delrec(in_dev);
1446 #endif
1447 
1448 	ip_mc_dec_group(in_dev, IGMP_ALL_HOSTS);
1449 }
1450 
1451 void ip_mc_init_dev(struct in_device *in_dev)
1452 {
1453 	ASSERT_RTNL();
1454 
1455 #ifdef CONFIG_IP_MULTICAST
1456 	setup_timer(&in_dev->mr_gq_timer, igmp_gq_timer_expire,
1457 			(unsigned long)in_dev);
1458 	setup_timer(&in_dev->mr_ifc_timer, igmp_ifc_timer_expire,
1459 			(unsigned long)in_dev);
1460 	in_dev->mr_qrv = sysctl_igmp_qrv;
1461 #endif
1462 
1463 	spin_lock_init(&in_dev->mc_tomb_lock);
1464 }
1465 
1466 /* Device going up */
1467 
1468 void ip_mc_up(struct in_device *in_dev)
1469 {
1470 	struct ip_mc_list *pmc;
1471 
1472 	ASSERT_RTNL();
1473 
1474 #ifdef CONFIG_IP_MULTICAST
1475 	in_dev->mr_qrv = sysctl_igmp_qrv;
1476 #endif
1477 	ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
1478 
1479 	for_each_pmc_rtnl(in_dev, pmc)
1480 		igmp_group_added(pmc);
1481 }
1482 
1483 /*
1484  *	Device is about to be destroyed: clean up.
1485  */
1486 
1487 void ip_mc_destroy_dev(struct in_device *in_dev)
1488 {
1489 	struct ip_mc_list *i;
1490 
1491 	ASSERT_RTNL();
1492 
1493 	/* Deactivate timers */
1494 	ip_mc_down(in_dev);
1495 
1496 	while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) {
1497 		in_dev->mc_list = i->next_rcu;
1498 		in_dev->mc_count--;
1499 
1500 		/* We've dropped the groups in ip_mc_down already */
1501 		ip_mc_clear_src(i);
1502 		ip_ma_put(i);
1503 	}
1504 }
1505 
1506 /* RTNL is locked */
1507 static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
1508 {
1509 	struct net_device *dev = NULL;
1510 	struct in_device *idev = NULL;
1511 
1512 	if (imr->imr_ifindex) {
1513 		idev = inetdev_by_index(net, imr->imr_ifindex);
1514 		return idev;
1515 	}
1516 	if (imr->imr_address.s_addr) {
1517 		dev = __ip_dev_find(net, imr->imr_address.s_addr, false);
1518 		if (!dev)
1519 			return NULL;
1520 	}
1521 
1522 	if (!dev) {
1523 		struct rtable *rt = ip_route_output(net,
1524 						    imr->imr_multiaddr.s_addr,
1525 						    0, 0, 0);
1526 		if (!IS_ERR(rt)) {
1527 			dev = rt->dst.dev;
1528 			ip_rt_put(rt);
1529 		}
1530 	}
1531 	if (dev) {
1532 		imr->imr_ifindex = dev->ifindex;
1533 		idev = __in_dev_get_rtnl(dev);
1534 	}
1535 	return idev;
1536 }
1537 
1538 /*
1539  *	Join a socket to a group
1540  */
1541 int sysctl_igmp_max_memberships __read_mostly = IP_MAX_MEMBERSHIPS;
1542 int sysctl_igmp_max_msf __read_mostly = IP_MAX_MSF;
1543 #ifdef CONFIG_IP_MULTICAST
1544 int sysctl_igmp_qrv __read_mostly = IGMP_QUERY_ROBUSTNESS_VARIABLE;
1545 #endif
1546 
1547 static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
1548 	__be32 *psfsrc)
1549 {
1550 	struct ip_sf_list *psf, *psf_prev;
1551 	int rv = 0;
1552 
1553 	psf_prev = NULL;
1554 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
1555 		if (psf->sf_inaddr == *psfsrc)
1556 			break;
1557 		psf_prev = psf;
1558 	}
1559 	if (!psf || psf->sf_count[sfmode] == 0) {
1560 		/* source filter not found, or count wrong =>  bug */
1561 		return -ESRCH;
1562 	}
1563 	psf->sf_count[sfmode]--;
1564 	if (psf->sf_count[sfmode] == 0) {
1565 		ip_rt_multicast_event(pmc->interface);
1566 	}
1567 	if (!psf->sf_count[MCAST_INCLUDE] && !psf->sf_count[MCAST_EXCLUDE]) {
1568 #ifdef CONFIG_IP_MULTICAST
1569 		struct in_device *in_dev = pmc->interface;
1570 #endif
1571 
1572 		/* no more filters for this source */
1573 		if (psf_prev)
1574 			psf_prev->sf_next = psf->sf_next;
1575 		else
1576 			pmc->sources = psf->sf_next;
1577 #ifdef CONFIG_IP_MULTICAST
1578 		if (psf->sf_oldin &&
1579 		    !IGMP_V1_SEEN(in_dev) && !IGMP_V2_SEEN(in_dev)) {
1580 			psf->sf_crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1581 			psf->sf_next = pmc->tomb;
1582 			pmc->tomb = psf;
1583 			rv = 1;
1584 		} else
1585 #endif
1586 			kfree(psf);
1587 	}
1588 	return rv;
1589 }
1590 
1591 #ifndef CONFIG_IP_MULTICAST
1592 #define igmp_ifc_event(x)	do { } while (0)
1593 #endif
1594 
1595 static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
1596 			 int sfcount, __be32 *psfsrc, int delta)
1597 {
1598 	struct ip_mc_list *pmc;
1599 	int	changerec = 0;
1600 	int	i, err;
1601 
1602 	if (!in_dev)
1603 		return -ENODEV;
1604 	rcu_read_lock();
1605 	for_each_pmc_rcu(in_dev, pmc) {
1606 		if (*pmca == pmc->multiaddr)
1607 			break;
1608 	}
1609 	if (!pmc) {
1610 		/* MCA not found?? bug */
1611 		rcu_read_unlock();
1612 		return -ESRCH;
1613 	}
1614 	spin_lock_bh(&pmc->lock);
1615 	rcu_read_unlock();
1616 #ifdef CONFIG_IP_MULTICAST
1617 	sf_markstate(pmc);
1618 #endif
1619 	if (!delta) {
1620 		err = -EINVAL;
1621 		if (!pmc->sfcount[sfmode])
1622 			goto out_unlock;
1623 		pmc->sfcount[sfmode]--;
1624 	}
1625 	err = 0;
1626 	for (i = 0; i < sfcount; i++) {
1627 		int rv = ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
1628 
1629 		changerec |= rv > 0;
1630 		if (!err && rv < 0)
1631 			err = rv;
1632 	}
1633 	if (pmc->sfmode == MCAST_EXCLUDE &&
1634 	    pmc->sfcount[MCAST_EXCLUDE] == 0 &&
1635 	    pmc->sfcount[MCAST_INCLUDE]) {
1636 #ifdef CONFIG_IP_MULTICAST
1637 		struct ip_sf_list *psf;
1638 #endif
1639 
1640 		/* filter mode change */
1641 		pmc->sfmode = MCAST_INCLUDE;
1642 #ifdef CONFIG_IP_MULTICAST
1643 		pmc->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1644 		in_dev->mr_ifc_count = pmc->crcount;
1645 		for (psf = pmc->sources; psf; psf = psf->sf_next)
1646 			psf->sf_crcount = 0;
1647 		igmp_ifc_event(pmc->interface);
1648 	} else if (sf_setstate(pmc) || changerec) {
1649 		igmp_ifc_event(pmc->interface);
1650 #endif
1651 	}
1652 out_unlock:
1653 	spin_unlock_bh(&pmc->lock);
1654 	return err;
1655 }
1656 
1657 /*
1658  * Add multicast single-source filter to the interface list
1659  */
1660 static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
1661 	__be32 *psfsrc)
1662 {
1663 	struct ip_sf_list *psf, *psf_prev;
1664 
1665 	psf_prev = NULL;
1666 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
1667 		if (psf->sf_inaddr == *psfsrc)
1668 			break;
1669 		psf_prev = psf;
1670 	}
1671 	if (!psf) {
1672 		psf = kzalloc(sizeof(*psf), GFP_ATOMIC);
1673 		if (!psf)
1674 			return -ENOBUFS;
1675 		psf->sf_inaddr = *psfsrc;
1676 		if (psf_prev) {
1677 			psf_prev->sf_next = psf;
1678 		} else
1679 			pmc->sources = psf;
1680 	}
1681 	psf->sf_count[sfmode]++;
1682 	if (psf->sf_count[sfmode] == 1) {
1683 		ip_rt_multicast_event(pmc->interface);
1684 	}
1685 	return 0;
1686 }
1687 
1688 #ifdef CONFIG_IP_MULTICAST
1689 static void sf_markstate(struct ip_mc_list *pmc)
1690 {
1691 	struct ip_sf_list *psf;
1692 	int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
1693 
1694 	for (psf = pmc->sources; psf; psf = psf->sf_next)
1695 		if (pmc->sfcount[MCAST_EXCLUDE]) {
1696 			psf->sf_oldin = mca_xcount ==
1697 				psf->sf_count[MCAST_EXCLUDE] &&
1698 				!psf->sf_count[MCAST_INCLUDE];
1699 		} else
1700 			psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
1701 }
1702 
1703 static int sf_setstate(struct ip_mc_list *pmc)
1704 {
1705 	struct ip_sf_list *psf, *dpsf;
1706 	int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
1707 	int qrv = pmc->interface->mr_qrv;
1708 	int new_in, rv;
1709 
1710 	rv = 0;
1711 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
1712 		if (pmc->sfcount[MCAST_EXCLUDE]) {
1713 			new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
1714 				!psf->sf_count[MCAST_INCLUDE];
1715 		} else
1716 			new_in = psf->sf_count[MCAST_INCLUDE] != 0;
1717 		if (new_in) {
1718 			if (!psf->sf_oldin) {
1719 				struct ip_sf_list *prev = NULL;
1720 
1721 				for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next) {
1722 					if (dpsf->sf_inaddr == psf->sf_inaddr)
1723 						break;
1724 					prev = dpsf;
1725 				}
1726 				if (dpsf) {
1727 					if (prev)
1728 						prev->sf_next = dpsf->sf_next;
1729 					else
1730 						pmc->tomb = dpsf->sf_next;
1731 					kfree(dpsf);
1732 				}
1733 				psf->sf_crcount = qrv;
1734 				rv++;
1735 			}
1736 		} else if (psf->sf_oldin) {
1737 
1738 			psf->sf_crcount = 0;
1739 			/*
1740 			 * add or update "delete" records if an active filter
1741 			 * is now inactive
1742 			 */
1743 			for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next)
1744 				if (dpsf->sf_inaddr == psf->sf_inaddr)
1745 					break;
1746 			if (!dpsf) {
1747 				dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
1748 				if (!dpsf)
1749 					continue;
1750 				*dpsf = *psf;
1751 				/* pmc->lock held by callers */
1752 				dpsf->sf_next = pmc->tomb;
1753 				pmc->tomb = dpsf;
1754 			}
1755 			dpsf->sf_crcount = qrv;
1756 			rv++;
1757 		}
1758 	}
1759 	return rv;
1760 }
1761 #endif
1762 
1763 /*
1764  * Add multicast source filter list to the interface list
1765  */
1766 static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
1767 			 int sfcount, __be32 *psfsrc, int delta)
1768 {
1769 	struct ip_mc_list *pmc;
1770 	int	isexclude;
1771 	int	i, err;
1772 
1773 	if (!in_dev)
1774 		return -ENODEV;
1775 	rcu_read_lock();
1776 	for_each_pmc_rcu(in_dev, pmc) {
1777 		if (*pmca == pmc->multiaddr)
1778 			break;
1779 	}
1780 	if (!pmc) {
1781 		/* MCA not found?? bug */
1782 		rcu_read_unlock();
1783 		return -ESRCH;
1784 	}
1785 	spin_lock_bh(&pmc->lock);
1786 	rcu_read_unlock();
1787 
1788 #ifdef CONFIG_IP_MULTICAST
1789 	sf_markstate(pmc);
1790 #endif
1791 	isexclude = pmc->sfmode == MCAST_EXCLUDE;
1792 	if (!delta)
1793 		pmc->sfcount[sfmode]++;
1794 	err = 0;
1795 	for (i = 0; i < sfcount; i++) {
1796 		err = ip_mc_add1_src(pmc, sfmode, &psfsrc[i]);
1797 		if (err)
1798 			break;
1799 	}
1800 	if (err) {
1801 		int j;
1802 
1803 		if (!delta)
1804 			pmc->sfcount[sfmode]--;
1805 		for (j = 0; j < i; j++)
1806 			(void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
1807 	} else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
1808 #ifdef CONFIG_IP_MULTICAST
1809 		struct ip_sf_list *psf;
1810 		in_dev = pmc->interface;
1811 #endif
1812 
1813 		/* filter mode change */
1814 		if (pmc->sfcount[MCAST_EXCLUDE])
1815 			pmc->sfmode = MCAST_EXCLUDE;
1816 		else if (pmc->sfcount[MCAST_INCLUDE])
1817 			pmc->sfmode = MCAST_INCLUDE;
1818 #ifdef CONFIG_IP_MULTICAST
1819 		/* else no filters; keep old mode for reports */
1820 
1821 		pmc->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
1822 		in_dev->mr_ifc_count = pmc->crcount;
1823 		for (psf = pmc->sources; psf; psf = psf->sf_next)
1824 			psf->sf_crcount = 0;
1825 		igmp_ifc_event(in_dev);
1826 	} else if (sf_setstate(pmc)) {
1827 		igmp_ifc_event(in_dev);
1828 #endif
1829 	}
1830 	spin_unlock_bh(&pmc->lock);
1831 	return err;
1832 }
1833 
1834 static void ip_mc_clear_src(struct ip_mc_list *pmc)
1835 {
1836 	struct ip_sf_list *psf, *nextpsf;
1837 
1838 	for (psf = pmc->tomb; psf; psf = nextpsf) {
1839 		nextpsf = psf->sf_next;
1840 		kfree(psf);
1841 	}
1842 	pmc->tomb = NULL;
1843 	for (psf = pmc->sources; psf; psf = nextpsf) {
1844 		nextpsf = psf->sf_next;
1845 		kfree(psf);
1846 	}
1847 	pmc->sources = NULL;
1848 	pmc->sfmode = MCAST_EXCLUDE;
1849 	pmc->sfcount[MCAST_INCLUDE] = 0;
1850 	pmc->sfcount[MCAST_EXCLUDE] = 1;
1851 }
1852 
1853 /* Join a multicast group
1854  */
1855 
1856 int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
1857 {
1858 	__be32 addr = imr->imr_multiaddr.s_addr;
1859 	struct ip_mc_socklist *iml, *i;
1860 	struct in_device *in_dev;
1861 	struct inet_sock *inet = inet_sk(sk);
1862 	struct net *net = sock_net(sk);
1863 	int ifindex;
1864 	int count = 0;
1865 	int err;
1866 
1867 	ASSERT_RTNL();
1868 
1869 	if (!ipv4_is_multicast(addr))
1870 		return -EINVAL;
1871 
1872 	in_dev = ip_mc_find_dev(net, imr);
1873 
1874 	if (!in_dev) {
1875 		err = -ENODEV;
1876 		goto done;
1877 	}
1878 
1879 	err = -EADDRINUSE;
1880 	ifindex = imr->imr_ifindex;
1881 	for_each_pmc_rtnl(inet, i) {
1882 		if (i->multi.imr_multiaddr.s_addr == addr &&
1883 		    i->multi.imr_ifindex == ifindex)
1884 			goto done;
1885 		count++;
1886 	}
1887 	err = -ENOBUFS;
1888 	if (count >= sysctl_igmp_max_memberships)
1889 		goto done;
1890 	iml = sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
1891 	if (!iml)
1892 		goto done;
1893 
1894 	memcpy(&iml->multi, imr, sizeof(*imr));
1895 	iml->next_rcu = inet->mc_list;
1896 	iml->sflist = NULL;
1897 	iml->sfmode = MCAST_EXCLUDE;
1898 	rcu_assign_pointer(inet->mc_list, iml);
1899 	ip_mc_inc_group(in_dev, addr);
1900 	err = 0;
1901 done:
1902 	return err;
1903 }
1904 EXPORT_SYMBOL(ip_mc_join_group);
1905 
1906 static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
1907 			   struct in_device *in_dev)
1908 {
1909 	struct ip_sf_socklist *psf = rtnl_dereference(iml->sflist);
1910 	int err;
1911 
1912 	if (!psf) {
1913 		/* any-source empty exclude case */
1914 		return ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
1915 			iml->sfmode, 0, NULL, 0);
1916 	}
1917 	err = ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
1918 			iml->sfmode, psf->sl_count, psf->sl_addr, 0);
1919 	RCU_INIT_POINTER(iml->sflist, NULL);
1920 	/* decrease mem now to avoid the memleak warning */
1921 	atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);
1922 	kfree_rcu(psf, rcu);
1923 	return err;
1924 }
1925 
1926 int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
1927 {
1928 	struct inet_sock *inet = inet_sk(sk);
1929 	struct ip_mc_socklist *iml;
1930 	struct ip_mc_socklist __rcu **imlp;
1931 	struct in_device *in_dev;
1932 	struct net *net = sock_net(sk);
1933 	__be32 group = imr->imr_multiaddr.s_addr;
1934 	u32 ifindex;
1935 	int ret = -EADDRNOTAVAIL;
1936 
1937 	ASSERT_RTNL();
1938 
1939 	in_dev = ip_mc_find_dev(net, imr);
1940 	if (!in_dev) {
1941 		ret = -ENODEV;
1942 		goto out;
1943 	}
1944 	ifindex = imr->imr_ifindex;
1945 	for (imlp = &inet->mc_list;
1946 	     (iml = rtnl_dereference(*imlp)) != NULL;
1947 	     imlp = &iml->next_rcu) {
1948 		if (iml->multi.imr_multiaddr.s_addr != group)
1949 			continue;
1950 		if (ifindex) {
1951 			if (iml->multi.imr_ifindex != ifindex)
1952 				continue;
1953 		} else if (imr->imr_address.s_addr && imr->imr_address.s_addr !=
1954 				iml->multi.imr_address.s_addr)
1955 			continue;
1956 
1957 		(void) ip_mc_leave_src(sk, iml, in_dev);
1958 
1959 		*imlp = iml->next_rcu;
1960 
1961 		ip_mc_dec_group(in_dev, group);
1962 
1963 		/* decrease mem now to avoid the memleak warning */
1964 		atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
1965 		kfree_rcu(iml, rcu);
1966 		return 0;
1967 	}
1968 out:
1969 	return ret;
1970 }
1971 EXPORT_SYMBOL(ip_mc_leave_group);
1972 
1973 int ip_mc_source(int add, int omode, struct sock *sk, struct
1974 	ip_mreq_source *mreqs, int ifindex)
1975 {
1976 	int err;
1977 	struct ip_mreqn imr;
1978 	__be32 addr = mreqs->imr_multiaddr;
1979 	struct ip_mc_socklist *pmc;
1980 	struct in_device *in_dev = NULL;
1981 	struct inet_sock *inet = inet_sk(sk);
1982 	struct ip_sf_socklist *psl;
1983 	struct net *net = sock_net(sk);
1984 	int leavegroup = 0;
1985 	int i, j, rv;
1986 
1987 	if (!ipv4_is_multicast(addr))
1988 		return -EINVAL;
1989 
1990 	ASSERT_RTNL();
1991 
1992 	imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
1993 	imr.imr_address.s_addr = mreqs->imr_interface;
1994 	imr.imr_ifindex = ifindex;
1995 	in_dev = ip_mc_find_dev(net, &imr);
1996 
1997 	if (!in_dev) {
1998 		err = -ENODEV;
1999 		goto done;
2000 	}
2001 	err = -EADDRNOTAVAIL;
2002 
2003 	for_each_pmc_rtnl(inet, pmc) {
2004 		if ((pmc->multi.imr_multiaddr.s_addr ==
2005 		     imr.imr_multiaddr.s_addr) &&
2006 		    (pmc->multi.imr_ifindex == imr.imr_ifindex))
2007 			break;
2008 	}
2009 	if (!pmc) {		/* must have a prior join */
2010 		err = -EINVAL;
2011 		goto done;
2012 	}
2013 	/* if a source filter was set, must be the same mode as before */
2014 	if (pmc->sflist) {
2015 		if (pmc->sfmode != omode) {
2016 			err = -EINVAL;
2017 			goto done;
2018 		}
2019 	} else if (pmc->sfmode != omode) {
2020 		/* allow mode switches for empty-set filters */
2021 		ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 0, NULL, 0);
2022 		ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, pmc->sfmode, 0,
2023 			NULL, 0);
2024 		pmc->sfmode = omode;
2025 	}
2026 
2027 	psl = rtnl_dereference(pmc->sflist);
2028 	if (!add) {
2029 		if (!psl)
2030 			goto done;	/* err = -EADDRNOTAVAIL */
2031 		rv = !0;
2032 		for (i = 0; i < psl->sl_count; i++) {
2033 			rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
2034 				sizeof(__be32));
2035 			if (rv == 0)
2036 				break;
2037 		}
2038 		if (rv)		/* source not found */
2039 			goto done;	/* err = -EADDRNOTAVAIL */
2040 
2041 		/* special case - (INCLUDE, empty) == LEAVE_GROUP */
2042 		if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
2043 			leavegroup = 1;
2044 			goto done;
2045 		}
2046 
2047 		/* update the interface filter */
2048 		ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
2049 			&mreqs->imr_sourceaddr, 1);
2050 
2051 		for (j = i+1; j < psl->sl_count; j++)
2052 			psl->sl_addr[j-1] = psl->sl_addr[j];
2053 		psl->sl_count--;
2054 		err = 0;
2055 		goto done;
2056 	}
2057 	/* else, add a new source to the filter */
2058 
2059 	if (psl && psl->sl_count >= sysctl_igmp_max_msf) {
2060 		err = -ENOBUFS;
2061 		goto done;
2062 	}
2063 	if (!psl || psl->sl_count == psl->sl_max) {
2064 		struct ip_sf_socklist *newpsl;
2065 		int count = IP_SFBLOCK;
2066 
2067 		if (psl)
2068 			count += psl->sl_max;
2069 		newpsl = sock_kmalloc(sk, IP_SFLSIZE(count), GFP_KERNEL);
2070 		if (!newpsl) {
2071 			err = -ENOBUFS;
2072 			goto done;
2073 		}
2074 		newpsl->sl_max = count;
2075 		newpsl->sl_count = count - IP_SFBLOCK;
2076 		if (psl) {
2077 			for (i = 0; i < psl->sl_count; i++)
2078 				newpsl->sl_addr[i] = psl->sl_addr[i];
2079 			/* decrease mem now to avoid the memleak warning */
2080 			atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
2081 			kfree_rcu(psl, rcu);
2082 		}
2083 		rcu_assign_pointer(pmc->sflist, newpsl);
2084 		psl = newpsl;
2085 	}
2086 	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
2087 	for (i = 0; i < psl->sl_count; i++) {
2088 		rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
2089 			sizeof(__be32));
2090 		if (rv == 0)
2091 			break;
2092 	}
2093 	if (rv == 0)		/* address already there is an error */
2094 		goto done;
2095 	for (j = psl->sl_count-1; j >= i; j--)
2096 		psl->sl_addr[j+1] = psl->sl_addr[j];
2097 	psl->sl_addr[i] = mreqs->imr_sourceaddr;
2098 	psl->sl_count++;
2099 	err = 0;
2100 	/* update the interface list */
2101 	ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
2102 		&mreqs->imr_sourceaddr, 1);
2103 done:
2104 	if (leavegroup)
2105 		err = ip_mc_leave_group(sk, &imr);
2106 	return err;
2107 }
2108 
2109 int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
2110 {
2111 	int err = 0;
2112 	struct ip_mreqn	imr;
2113 	__be32 addr = msf->imsf_multiaddr;
2114 	struct ip_mc_socklist *pmc;
2115 	struct in_device *in_dev;
2116 	struct inet_sock *inet = inet_sk(sk);
2117 	struct ip_sf_socklist *newpsl, *psl;
2118 	struct net *net = sock_net(sk);
2119 	int leavegroup = 0;
2120 
2121 	if (!ipv4_is_multicast(addr))
2122 		return -EINVAL;
2123 	if (msf->imsf_fmode != MCAST_INCLUDE &&
2124 	    msf->imsf_fmode != MCAST_EXCLUDE)
2125 		return -EINVAL;
2126 
2127 	ASSERT_RTNL();
2128 
2129 	imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
2130 	imr.imr_address.s_addr = msf->imsf_interface;
2131 	imr.imr_ifindex = ifindex;
2132 	in_dev = ip_mc_find_dev(net, &imr);
2133 
2134 	if (!in_dev) {
2135 		err = -ENODEV;
2136 		goto done;
2137 	}
2138 
2139 	/* special case - (INCLUDE, empty) == LEAVE_GROUP */
2140 	if (msf->imsf_fmode == MCAST_INCLUDE && msf->imsf_numsrc == 0) {
2141 		leavegroup = 1;
2142 		goto done;
2143 	}
2144 
2145 	for_each_pmc_rtnl(inet, pmc) {
2146 		if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
2147 		    pmc->multi.imr_ifindex == imr.imr_ifindex)
2148 			break;
2149 	}
2150 	if (!pmc) {		/* must have a prior join */
2151 		err = -EINVAL;
2152 		goto done;
2153 	}
2154 	if (msf->imsf_numsrc) {
2155 		newpsl = sock_kmalloc(sk, IP_SFLSIZE(msf->imsf_numsrc),
2156 							   GFP_KERNEL);
2157 		if (!newpsl) {
2158 			err = -ENOBUFS;
2159 			goto done;
2160 		}
2161 		newpsl->sl_max = newpsl->sl_count = msf->imsf_numsrc;
2162 		memcpy(newpsl->sl_addr, msf->imsf_slist,
2163 			msf->imsf_numsrc * sizeof(msf->imsf_slist[0]));
2164 		err = ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
2165 			msf->imsf_fmode, newpsl->sl_count, newpsl->sl_addr, 0);
2166 		if (err) {
2167 			sock_kfree_s(sk, newpsl, IP_SFLSIZE(newpsl->sl_max));
2168 			goto done;
2169 		}
2170 	} else {
2171 		newpsl = NULL;
2172 		(void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
2173 				     msf->imsf_fmode, 0, NULL, 0);
2174 	}
2175 	psl = rtnl_dereference(pmc->sflist);
2176 	if (psl) {
2177 		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
2178 			psl->sl_count, psl->sl_addr, 0);
2179 		/* decrease mem now to avoid the memleak warning */
2180 		atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
2181 		kfree_rcu(psl, rcu);
2182 	} else
2183 		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
2184 			0, NULL, 0);
2185 	rcu_assign_pointer(pmc->sflist, newpsl);
2186 	pmc->sfmode = msf->imsf_fmode;
2187 	err = 0;
2188 done:
2189 	if (leavegroup)
2190 		err = ip_mc_leave_group(sk, &imr);
2191 	return err;
2192 }
2193 
2194 int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
2195 	struct ip_msfilter __user *optval, int __user *optlen)
2196 {
2197 	int err, len, count, copycount;
2198 	struct ip_mreqn	imr;
2199 	__be32 addr = msf->imsf_multiaddr;
2200 	struct ip_mc_socklist *pmc;
2201 	struct in_device *in_dev;
2202 	struct inet_sock *inet = inet_sk(sk);
2203 	struct ip_sf_socklist *psl;
2204 	struct net *net = sock_net(sk);
2205 
2206 	if (!ipv4_is_multicast(addr))
2207 		return -EINVAL;
2208 
2209 	rtnl_lock();
2210 
2211 	imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
2212 	imr.imr_address.s_addr = msf->imsf_interface;
2213 	imr.imr_ifindex = 0;
2214 	in_dev = ip_mc_find_dev(net, &imr);
2215 
2216 	if (!in_dev) {
2217 		err = -ENODEV;
2218 		goto done;
2219 	}
2220 	err = -EADDRNOTAVAIL;
2221 
2222 	for_each_pmc_rtnl(inet, pmc) {
2223 		if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
2224 		    pmc->multi.imr_ifindex == imr.imr_ifindex)
2225 			break;
2226 	}
2227 	if (!pmc)		/* must have a prior join */
2228 		goto done;
2229 	msf->imsf_fmode = pmc->sfmode;
2230 	psl = rtnl_dereference(pmc->sflist);
2231 	rtnl_unlock();
2232 	if (!psl) {
2233 		len = 0;
2234 		count = 0;
2235 	} else {
2236 		count = psl->sl_count;
2237 	}
2238 	copycount = count < msf->imsf_numsrc ? count : msf->imsf_numsrc;
2239 	len = copycount * sizeof(psl->sl_addr[0]);
2240 	msf->imsf_numsrc = count;
2241 	if (put_user(IP_MSFILTER_SIZE(copycount), optlen) ||
2242 	    copy_to_user(optval, msf, IP_MSFILTER_SIZE(0))) {
2243 		return -EFAULT;
2244 	}
2245 	if (len &&
2246 	    copy_to_user(&optval->imsf_slist[0], psl->sl_addr, len))
2247 		return -EFAULT;
2248 	return 0;
2249 done:
2250 	rtnl_unlock();
2251 	return err;
2252 }
2253 
2254 int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
2255 	struct group_filter __user *optval, int __user *optlen)
2256 {
2257 	int err, i, count, copycount;
2258 	struct sockaddr_in *psin;
2259 	__be32 addr;
2260 	struct ip_mc_socklist *pmc;
2261 	struct inet_sock *inet = inet_sk(sk);
2262 	struct ip_sf_socklist *psl;
2263 
2264 	psin = (struct sockaddr_in *)&gsf->gf_group;
2265 	if (psin->sin_family != AF_INET)
2266 		return -EINVAL;
2267 	addr = psin->sin_addr.s_addr;
2268 	if (!ipv4_is_multicast(addr))
2269 		return -EINVAL;
2270 
2271 	rtnl_lock();
2272 
2273 	err = -EADDRNOTAVAIL;
2274 
2275 	for_each_pmc_rtnl(inet, pmc) {
2276 		if (pmc->multi.imr_multiaddr.s_addr == addr &&
2277 		    pmc->multi.imr_ifindex == gsf->gf_interface)
2278 			break;
2279 	}
2280 	if (!pmc)		/* must have a prior join */
2281 		goto done;
2282 	gsf->gf_fmode = pmc->sfmode;
2283 	psl = rtnl_dereference(pmc->sflist);
2284 	rtnl_unlock();
2285 	count = psl ? psl->sl_count : 0;
2286 	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
2287 	gsf->gf_numsrc = count;
2288 	if (put_user(GROUP_FILTER_SIZE(copycount), optlen) ||
2289 	    copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
2290 		return -EFAULT;
2291 	}
2292 	for (i = 0; i < copycount; i++) {
2293 		struct sockaddr_storage ss;
2294 
2295 		psin = (struct sockaddr_in *)&ss;
2296 		memset(&ss, 0, sizeof(ss));
2297 		psin->sin_family = AF_INET;
2298 		psin->sin_addr.s_addr = psl->sl_addr[i];
2299 		if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss)))
2300 			return -EFAULT;
2301 	}
2302 	return 0;
2303 done:
2304 	rtnl_unlock();
2305 	return err;
2306 }
2307 
2308 /*
2309  * check if a multicast source filter allows delivery for a given <src,dst,intf>
2310  */
2311 int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
2312 {
2313 	struct inet_sock *inet = inet_sk(sk);
2314 	struct ip_mc_socklist *pmc;
2315 	struct ip_sf_socklist *psl;
2316 	int i;
2317 	int ret;
2318 
2319 	ret = 1;
2320 	if (!ipv4_is_multicast(loc_addr))
2321 		goto out;
2322 
2323 	rcu_read_lock();
2324 	for_each_pmc_rcu(inet, pmc) {
2325 		if (pmc->multi.imr_multiaddr.s_addr == loc_addr &&
2326 		    pmc->multi.imr_ifindex == dif)
2327 			break;
2328 	}
2329 	ret = inet->mc_all;
2330 	if (!pmc)
2331 		goto unlock;
2332 	psl = rcu_dereference(pmc->sflist);
2333 	ret = (pmc->sfmode == MCAST_EXCLUDE);
2334 	if (!psl)
2335 		goto unlock;
2336 
2337 	for (i = 0; i < psl->sl_count; i++) {
2338 		if (psl->sl_addr[i] == rmt_addr)
2339 			break;
2340 	}
2341 	ret = 0;
2342 	if (pmc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
2343 		goto unlock;
2344 	if (pmc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
2345 		goto unlock;
2346 	ret = 1;
2347 unlock:
2348 	rcu_read_unlock();
2349 out:
2350 	return ret;
2351 }
2352 
2353 /*
2354  *	A socket is closing.
2355  */
2356 
2357 void ip_mc_drop_socket(struct sock *sk)
2358 {
2359 	struct inet_sock *inet = inet_sk(sk);
2360 	struct ip_mc_socklist *iml;
2361 	struct net *net = sock_net(sk);
2362 
2363 	if (!inet->mc_list)
2364 		return;
2365 
2366 	rtnl_lock();
2367 	while ((iml = rtnl_dereference(inet->mc_list)) != NULL) {
2368 		struct in_device *in_dev;
2369 
2370 		inet->mc_list = iml->next_rcu;
2371 		in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
2372 		(void) ip_mc_leave_src(sk, iml, in_dev);
2373 		if (in_dev)
2374 			ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
2375 		/* decrease mem now to avoid the memleak warning */
2376 		atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
2377 		kfree_rcu(iml, rcu);
2378 	}
2379 	rtnl_unlock();
2380 }
2381 
2382 /* called with rcu_read_lock() */
2383 int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u16 proto)
2384 {
2385 	struct ip_mc_list *im;
2386 	struct ip_mc_list __rcu **mc_hash;
2387 	struct ip_sf_list *psf;
2388 	int rv = 0;
2389 
2390 	mc_hash = rcu_dereference(in_dev->mc_hash);
2391 	if (mc_hash) {
2392 		u32 hash = hash_32((__force u32)mc_addr, MC_HASH_SZ_LOG);
2393 
2394 		for (im = rcu_dereference(mc_hash[hash]);
2395 		     im != NULL;
2396 		     im = rcu_dereference(im->next_hash)) {
2397 			if (im->multiaddr == mc_addr)
2398 				break;
2399 		}
2400 	} else {
2401 		for_each_pmc_rcu(in_dev, im) {
2402 			if (im->multiaddr == mc_addr)
2403 				break;
2404 		}
2405 	}
2406 	if (im && proto == IPPROTO_IGMP) {
2407 		rv = 1;
2408 	} else if (im) {
2409 		if (src_addr) {
2410 			for (psf = im->sources; psf; psf = psf->sf_next) {
2411 				if (psf->sf_inaddr == src_addr)
2412 					break;
2413 			}
2414 			if (psf)
2415 				rv = psf->sf_count[MCAST_INCLUDE] ||
2416 					psf->sf_count[MCAST_EXCLUDE] !=
2417 					im->sfcount[MCAST_EXCLUDE];
2418 			else
2419 				rv = im->sfcount[MCAST_EXCLUDE] != 0;
2420 		} else
2421 			rv = 1; /* unspecified source; tentatively allow */
2422 	}
2423 	return rv;
2424 }
2425 
2426 #if defined(CONFIG_PROC_FS)
2427 struct igmp_mc_iter_state {
2428 	struct seq_net_private p;
2429 	struct net_device *dev;
2430 	struct in_device *in_dev;
2431 };
2432 
2433 #define	igmp_mc_seq_private(seq)	((struct igmp_mc_iter_state *)(seq)->private)
2434 
2435 static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
2436 {
2437 	struct net *net = seq_file_net(seq);
2438 	struct ip_mc_list *im = NULL;
2439 	struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2440 
2441 	state->in_dev = NULL;
2442 	for_each_netdev_rcu(net, state->dev) {
2443 		struct in_device *in_dev;
2444 
2445 		in_dev = __in_dev_get_rcu(state->dev);
2446 		if (!in_dev)
2447 			continue;
2448 		im = rcu_dereference(in_dev->mc_list);
2449 		if (im) {
2450 			state->in_dev = in_dev;
2451 			break;
2452 		}
2453 	}
2454 	return im;
2455 }
2456 
2457 static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_list *im)
2458 {
2459 	struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2460 
2461 	im = rcu_dereference(im->next_rcu);
2462 	while (!im) {
2463 		state->dev = next_net_device_rcu(state->dev);
2464 		if (!state->dev) {
2465 			state->in_dev = NULL;
2466 			break;
2467 		}
2468 		state->in_dev = __in_dev_get_rcu(state->dev);
2469 		if (!state->in_dev)
2470 			continue;
2471 		im = rcu_dereference(state->in_dev->mc_list);
2472 	}
2473 	return im;
2474 }
2475 
2476 static struct ip_mc_list *igmp_mc_get_idx(struct seq_file *seq, loff_t pos)
2477 {
2478 	struct ip_mc_list *im = igmp_mc_get_first(seq);
2479 	if (im)
2480 		while (pos && (im = igmp_mc_get_next(seq, im)) != NULL)
2481 			--pos;
2482 	return pos ? NULL : im;
2483 }
2484 
2485 static void *igmp_mc_seq_start(struct seq_file *seq, loff_t *pos)
2486 	__acquires(rcu)
2487 {
2488 	rcu_read_lock();
2489 	return *pos ? igmp_mc_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2490 }
2491 
2492 static void *igmp_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2493 {
2494 	struct ip_mc_list *im;
2495 	if (v == SEQ_START_TOKEN)
2496 		im = igmp_mc_get_first(seq);
2497 	else
2498 		im = igmp_mc_get_next(seq, v);
2499 	++*pos;
2500 	return im;
2501 }
2502 
2503 static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
2504 	__releases(rcu)
2505 {
2506 	struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2507 
2508 	state->in_dev = NULL;
2509 	state->dev = NULL;
2510 	rcu_read_unlock();
2511 }
2512 
2513 static int igmp_mc_seq_show(struct seq_file *seq, void *v)
2514 {
2515 	if (v == SEQ_START_TOKEN)
2516 		seq_puts(seq,
2517 			 "Idx\tDevice    : Count Querier\tGroup    Users Timer\tReporter\n");
2518 	else {
2519 		struct ip_mc_list *im = (struct ip_mc_list *)v;
2520 		struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2521 		char   *querier;
2522 		long delta;
2523 
2524 #ifdef CONFIG_IP_MULTICAST
2525 		querier = IGMP_V1_SEEN(state->in_dev) ? "V1" :
2526 			  IGMP_V2_SEEN(state->in_dev) ? "V2" :
2527 			  "V3";
2528 #else
2529 		querier = "NONE";
2530 #endif
2531 
2532 		if (rcu_access_pointer(state->in_dev->mc_list) == im) {
2533 			seq_printf(seq, "%d\t%-10s: %5d %7s\n",
2534 				   state->dev->ifindex, state->dev->name, state->in_dev->mc_count, querier);
2535 		}
2536 
2537 		delta = im->timer.expires - jiffies;
2538 		seq_printf(seq,
2539 			   "\t\t\t\t%08X %5d %d:%08lX\t\t%d\n",
2540 			   im->multiaddr, im->users,
2541 			   im->tm_running,
2542 			   im->tm_running ? jiffies_delta_to_clock_t(delta) : 0,
2543 			   im->reporter);
2544 	}
2545 	return 0;
2546 }
2547 
2548 static const struct seq_operations igmp_mc_seq_ops = {
2549 	.start	=	igmp_mc_seq_start,
2550 	.next	=	igmp_mc_seq_next,
2551 	.stop	=	igmp_mc_seq_stop,
2552 	.show	=	igmp_mc_seq_show,
2553 };
2554 
2555 static int igmp_mc_seq_open(struct inode *inode, struct file *file)
2556 {
2557 	return seq_open_net(inode, file, &igmp_mc_seq_ops,
2558 			sizeof(struct igmp_mc_iter_state));
2559 }
2560 
2561 static const struct file_operations igmp_mc_seq_fops = {
2562 	.owner		=	THIS_MODULE,
2563 	.open		=	igmp_mc_seq_open,
2564 	.read		=	seq_read,
2565 	.llseek		=	seq_lseek,
2566 	.release	=	seq_release_net,
2567 };
2568 
2569 struct igmp_mcf_iter_state {
2570 	struct seq_net_private p;
2571 	struct net_device *dev;
2572 	struct in_device *idev;
2573 	struct ip_mc_list *im;
2574 };
2575 
2576 #define igmp_mcf_seq_private(seq)	((struct igmp_mcf_iter_state *)(seq)->private)
2577 
2578 static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
2579 {
2580 	struct net *net = seq_file_net(seq);
2581 	struct ip_sf_list *psf = NULL;
2582 	struct ip_mc_list *im = NULL;
2583 	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2584 
2585 	state->idev = NULL;
2586 	state->im = NULL;
2587 	for_each_netdev_rcu(net, state->dev) {
2588 		struct in_device *idev;
2589 		idev = __in_dev_get_rcu(state->dev);
2590 		if (unlikely(!idev))
2591 			continue;
2592 		im = rcu_dereference(idev->mc_list);
2593 		if (likely(im)) {
2594 			spin_lock_bh(&im->lock);
2595 			psf = im->sources;
2596 			if (likely(psf)) {
2597 				state->im = im;
2598 				state->idev = idev;
2599 				break;
2600 			}
2601 			spin_unlock_bh(&im->lock);
2602 		}
2603 	}
2604 	return psf;
2605 }
2606 
2607 static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_list *psf)
2608 {
2609 	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2610 
2611 	psf = psf->sf_next;
2612 	while (!psf) {
2613 		spin_unlock_bh(&state->im->lock);
2614 		state->im = state->im->next;
2615 		while (!state->im) {
2616 			state->dev = next_net_device_rcu(state->dev);
2617 			if (!state->dev) {
2618 				state->idev = NULL;
2619 				goto out;
2620 			}
2621 			state->idev = __in_dev_get_rcu(state->dev);
2622 			if (!state->idev)
2623 				continue;
2624 			state->im = rcu_dereference(state->idev->mc_list);
2625 		}
2626 		if (!state->im)
2627 			break;
2628 		spin_lock_bh(&state->im->lock);
2629 		psf = state->im->sources;
2630 	}
2631 out:
2632 	return psf;
2633 }
2634 
2635 static struct ip_sf_list *igmp_mcf_get_idx(struct seq_file *seq, loff_t pos)
2636 {
2637 	struct ip_sf_list *psf = igmp_mcf_get_first(seq);
2638 	if (psf)
2639 		while (pos && (psf = igmp_mcf_get_next(seq, psf)) != NULL)
2640 			--pos;
2641 	return pos ? NULL : psf;
2642 }
2643 
2644 static void *igmp_mcf_seq_start(struct seq_file *seq, loff_t *pos)
2645 	__acquires(rcu)
2646 {
2647 	rcu_read_lock();
2648 	return *pos ? igmp_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2649 }
2650 
2651 static void *igmp_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2652 {
2653 	struct ip_sf_list *psf;
2654 	if (v == SEQ_START_TOKEN)
2655 		psf = igmp_mcf_get_first(seq);
2656 	else
2657 		psf = igmp_mcf_get_next(seq, v);
2658 	++*pos;
2659 	return psf;
2660 }
2661 
2662 static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
2663 	__releases(rcu)
2664 {
2665 	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2666 	if (likely(state->im)) {
2667 		spin_unlock_bh(&state->im->lock);
2668 		state->im = NULL;
2669 	}
2670 	state->idev = NULL;
2671 	state->dev = NULL;
2672 	rcu_read_unlock();
2673 }
2674 
2675 static int igmp_mcf_seq_show(struct seq_file *seq, void *v)
2676 {
2677 	struct ip_sf_list *psf = (struct ip_sf_list *)v;
2678 	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2679 
2680 	if (v == SEQ_START_TOKEN) {
2681 		seq_puts(seq, "Idx Device        MCA        SRC    INC    EXC\n");
2682 	} else {
2683 		seq_printf(seq,
2684 			   "%3d %6.6s 0x%08x "
2685 			   "0x%08x %6lu %6lu\n",
2686 			   state->dev->ifindex, state->dev->name,
2687 			   ntohl(state->im->multiaddr),
2688 			   ntohl(psf->sf_inaddr),
2689 			   psf->sf_count[MCAST_INCLUDE],
2690 			   psf->sf_count[MCAST_EXCLUDE]);
2691 	}
2692 	return 0;
2693 }
2694 
2695 static const struct seq_operations igmp_mcf_seq_ops = {
2696 	.start	=	igmp_mcf_seq_start,
2697 	.next	=	igmp_mcf_seq_next,
2698 	.stop	=	igmp_mcf_seq_stop,
2699 	.show	=	igmp_mcf_seq_show,
2700 };
2701 
2702 static int igmp_mcf_seq_open(struct inode *inode, struct file *file)
2703 {
2704 	return seq_open_net(inode, file, &igmp_mcf_seq_ops,
2705 			sizeof(struct igmp_mcf_iter_state));
2706 }
2707 
2708 static const struct file_operations igmp_mcf_seq_fops = {
2709 	.owner		=	THIS_MODULE,
2710 	.open		=	igmp_mcf_seq_open,
2711 	.read		=	seq_read,
2712 	.llseek		=	seq_lseek,
2713 	.release	=	seq_release_net,
2714 };
2715 
2716 static int __net_init igmp_net_init(struct net *net)
2717 {
2718 	struct proc_dir_entry *pde;
2719 	int err;
2720 
2721 	pde = proc_create("igmp", S_IRUGO, net->proc_net, &igmp_mc_seq_fops);
2722 	if (!pde)
2723 		goto out_igmp;
2724 	pde = proc_create("mcfilter", S_IRUGO, net->proc_net,
2725 			  &igmp_mcf_seq_fops);
2726 	if (!pde)
2727 		goto out_mcfilter;
2728 	err = inet_ctl_sock_create(&net->ipv4.mc_autojoin_sk, AF_INET,
2729 				   SOCK_DGRAM, 0, net);
2730 	if (err < 0) {
2731 		pr_err("Failed to initialize the IGMP autojoin socket (err %d)\n",
2732 		       err);
2733 		goto out_sock;
2734 	}
2735 
2736 	return 0;
2737 
2738 out_sock:
2739 	remove_proc_entry("mcfilter", net->proc_net);
2740 out_mcfilter:
2741 	remove_proc_entry("igmp", net->proc_net);
2742 out_igmp:
2743 	return -ENOMEM;
2744 }
2745 
2746 static void __net_exit igmp_net_exit(struct net *net)
2747 {
2748 	remove_proc_entry("mcfilter", net->proc_net);
2749 	remove_proc_entry("igmp", net->proc_net);
2750 	inet_ctl_sock_destroy(net->ipv4.mc_autojoin_sk);
2751 }
2752 
2753 static struct pernet_operations igmp_net_ops = {
2754 	.init = igmp_net_init,
2755 	.exit = igmp_net_exit,
2756 };
2757 #endif
2758 
2759 static int igmp_netdev_event(struct notifier_block *this,
2760 			     unsigned long event, void *ptr)
2761 {
2762 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
2763 	struct in_device *in_dev;
2764 
2765 	switch (event) {
2766 	case NETDEV_RESEND_IGMP:
2767 		in_dev = __in_dev_get_rtnl(dev);
2768 		if (in_dev)
2769 			ip_mc_rejoin_groups(in_dev);
2770 		break;
2771 	default:
2772 		break;
2773 	}
2774 	return NOTIFY_DONE;
2775 }
2776 
2777 static struct notifier_block igmp_notifier = {
2778 	.notifier_call = igmp_netdev_event,
2779 };
2780 
2781 int __init igmp_mc_init(void)
2782 {
2783 #if defined(CONFIG_PROC_FS)
2784 	int err;
2785 
2786 	err = register_pernet_subsys(&igmp_net_ops);
2787 	if (err)
2788 		return err;
2789 	err = register_netdevice_notifier(&igmp_notifier);
2790 	if (err)
2791 		goto reg_notif_fail;
2792 	return 0;
2793 
2794 reg_notif_fail:
2795 	unregister_pernet_subsys(&igmp_net_ops);
2796 	return err;
2797 #else
2798 	return register_netdevice_notifier(&igmp_notifier);
2799 #endif
2800 }
2801