xref: /openbmc/linux/net/ipv6/addrconf.c (revision 7bcae826)
1 /*
2  *	IPv6 Address [auto]configuration
3  *	Linux INET6 implementation
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
8  *
9  *	This program is free software; you can redistribute it and/or
10  *      modify it under the terms of the GNU General Public License
11  *      as published by the Free Software Foundation; either version
12  *      2 of the License, or (at your option) any later version.
13  */
14 
15 /*
16  *	Changes:
17  *
18  *	Janos Farkas			:	delete timer on ifdown
19  *	<chexum@bankinf.banki.hu>
20  *	Andi Kleen			:	kill double kfree on module
21  *						unload.
22  *	Maciej W. Rozycki		:	FDDI support
23  *	sekiya@USAGI			:	Don't send too many RS
24  *						packets.
25  *	yoshfuji@USAGI			:       Fixed interval between DAD
26  *						packets.
27  *	YOSHIFUJI Hideaki @USAGI	:	improved accuracy of
28  *						address validation timer.
29  *	YOSHIFUJI Hideaki @USAGI	:	Privacy Extensions (RFC3041)
30  *						support.
31  *	Yuji SEKIYA @USAGI		:	Don't assign a same IPv6
32  *						address on a same interface.
33  *	YOSHIFUJI Hideaki @USAGI	:	ARCnet support
34  *	YOSHIFUJI Hideaki @USAGI	:	convert /proc/net/if_inet6 to
35  *						seq_file.
36  *	YOSHIFUJI Hideaki @USAGI	:	improved source address
37  *						selection; consider scope,
38  *						status etc.
39  */
40 
41 #define pr_fmt(fmt) "IPv6: " fmt
42 
43 #include <linux/errno.h>
44 #include <linux/types.h>
45 #include <linux/kernel.h>
46 #include <linux/socket.h>
47 #include <linux/sockios.h>
48 #include <linux/net.h>
49 #include <linux/inet.h>
50 #include <linux/in6.h>
51 #include <linux/netdevice.h>
52 #include <linux/if_addr.h>
53 #include <linux/if_arp.h>
54 #include <linux/if_arcnet.h>
55 #include <linux/if_infiniband.h>
56 #include <linux/route.h>
57 #include <linux/inetdevice.h>
58 #include <linux/init.h>
59 #include <linux/slab.h>
60 #ifdef CONFIG_SYSCTL
61 #include <linux/sysctl.h>
62 #endif
63 #include <linux/capability.h>
64 #include <linux/delay.h>
65 #include <linux/notifier.h>
66 #include <linux/string.h>
67 #include <linux/hash.h>
68 
69 #include <net/net_namespace.h>
70 #include <net/sock.h>
71 #include <net/snmp.h>
72 
73 #include <net/6lowpan.h>
74 #include <net/firewire.h>
75 #include <net/ipv6.h>
76 #include <net/protocol.h>
77 #include <net/ndisc.h>
78 #include <net/ip6_route.h>
79 #include <net/addrconf.h>
80 #include <net/tcp.h>
81 #include <net/ip.h>
82 #include <net/netlink.h>
83 #include <net/pkt_sched.h>
84 #include <net/l3mdev.h>
85 #include <linux/if_tunnel.h>
86 #include <linux/rtnetlink.h>
87 #include <linux/netconf.h>
88 #include <linux/random.h>
89 #include <linux/uaccess.h>
90 #include <asm/unaligned.h>
91 
92 #include <linux/proc_fs.h>
93 #include <linux/seq_file.h>
94 #include <linux/export.h>
95 
96 /* Set to 3 to get tracing... */
97 #define ACONF_DEBUG 2
98 
99 #if ACONF_DEBUG >= 3
100 #define ADBG(fmt, ...) printk(fmt, ##__VA_ARGS__)
101 #else
102 #define ADBG(fmt, ...) do { if (0) printk(fmt, ##__VA_ARGS__); } while (0)
103 #endif
104 
105 #define	INFINITY_LIFE_TIME	0xFFFFFFFF
106 
107 #define IPV6_MAX_STRLEN \
108 	sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")
109 
110 static inline u32 cstamp_delta(unsigned long cstamp)
111 {
112 	return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
113 }
114 
115 static inline s32 rfc3315_s14_backoff_init(s32 irt)
116 {
117 	/* multiply 'initial retransmission time' by 0.9 .. 1.1 */
118 	u64 tmp = (900000 + prandom_u32() % 200001) * (u64)irt;
119 	do_div(tmp, 1000000);
120 	return (s32)tmp;
121 }
122 
123 static inline s32 rfc3315_s14_backoff_update(s32 rt, s32 mrt)
124 {
125 	/* multiply 'retransmission timeout' by 1.9 .. 2.1 */
126 	u64 tmp = (1900000 + prandom_u32() % 200001) * (u64)rt;
127 	do_div(tmp, 1000000);
128 	if ((s32)tmp > mrt) {
129 		/* multiply 'maximum retransmission time' by 0.9 .. 1.1 */
130 		tmp = (900000 + prandom_u32() % 200001) * (u64)mrt;
131 		do_div(tmp, 1000000);
132 	}
133 	return (s32)tmp;
134 }
135 
136 #ifdef CONFIG_SYSCTL
137 static int addrconf_sysctl_register(struct inet6_dev *idev);
138 static void addrconf_sysctl_unregister(struct inet6_dev *idev);
139 #else
140 static inline int addrconf_sysctl_register(struct inet6_dev *idev)
141 {
142 	return 0;
143 }
144 
145 static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
146 {
147 }
148 #endif
149 
150 static void ipv6_regen_rndid(struct inet6_dev *idev);
151 static void ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
152 
153 static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);
154 static int ipv6_count_addresses(struct inet6_dev *idev);
155 static int ipv6_generate_stable_address(struct in6_addr *addr,
156 					u8 dad_count,
157 					const struct inet6_dev *idev);
158 
159 /*
160  *	Configured unicast address hash table
161  */
162 static struct hlist_head inet6_addr_lst[IN6_ADDR_HSIZE];
163 static DEFINE_SPINLOCK(addrconf_hash_lock);
164 
165 static void addrconf_verify(void);
166 static void addrconf_verify_rtnl(void);
167 static void addrconf_verify_work(struct work_struct *);
168 
169 static struct workqueue_struct *addrconf_wq;
170 static DECLARE_DELAYED_WORK(addr_chk_work, addrconf_verify_work);
171 
172 static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
173 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);
174 
175 static void addrconf_type_change(struct net_device *dev,
176 				 unsigned long event);
177 static int addrconf_ifdown(struct net_device *dev, int how);
178 
179 static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
180 						  int plen,
181 						  const struct net_device *dev,
182 						  u32 flags, u32 noflags);
183 
184 static void addrconf_dad_start(struct inet6_ifaddr *ifp);
185 static void addrconf_dad_work(struct work_struct *w);
186 static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id);
187 static void addrconf_dad_run(struct inet6_dev *idev);
188 static void addrconf_rs_timer(unsigned long data);
189 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
190 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
191 
192 static void inet6_prefix_notify(int event, struct inet6_dev *idev,
193 				struct prefix_info *pinfo);
194 static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
195 			       struct net_device *dev);
196 
197 static struct ipv6_devconf ipv6_devconf __read_mostly = {
198 	.forwarding		= 0,
199 	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
200 	.mtu6			= IPV6_MIN_MTU,
201 	.accept_ra		= 1,
202 	.accept_redirects	= 1,
203 	.autoconf		= 1,
204 	.force_mld_version	= 0,
205 	.mldv1_unsolicited_report_interval = 10 * HZ,
206 	.mldv2_unsolicited_report_interval = HZ,
207 	.dad_transmits		= 1,
208 	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
209 	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
210 	.rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
211 	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
212 	.use_tempaddr		= 0,
213 	.temp_valid_lft		= TEMP_VALID_LIFETIME,
214 	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
215 	.regen_max_retry	= REGEN_MAX_RETRY,
216 	.max_desync_factor	= MAX_DESYNC_FACTOR,
217 	.max_addresses		= IPV6_MAX_ADDRESSES,
218 	.accept_ra_defrtr	= 1,
219 	.accept_ra_from_local	= 0,
220 	.accept_ra_min_hop_limit= 1,
221 	.accept_ra_pinfo	= 1,
222 #ifdef CONFIG_IPV6_ROUTER_PREF
223 	.accept_ra_rtr_pref	= 1,
224 	.rtr_probe_interval	= 60 * HZ,
225 #ifdef CONFIG_IPV6_ROUTE_INFO
226 	.accept_ra_rt_info_max_plen = 0,
227 #endif
228 #endif
229 	.proxy_ndp		= 0,
230 	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
231 	.disable_ipv6		= 0,
232 	.accept_dad		= 1,
233 	.suppress_frag_ndisc	= 1,
234 	.accept_ra_mtu		= 1,
235 	.stable_secret		= {
236 		.initialized = false,
237 	},
238 	.use_oif_addrs_only	= 0,
239 	.ignore_routes_with_linkdown = 0,
240 	.keep_addr_on_down	= 0,
241 	.seg6_enabled		= 0,
242 #ifdef CONFIG_IPV6_SEG6_HMAC
243 	.seg6_require_hmac	= 0,
244 #endif
245 	.enhanced_dad           = 1,
246 	.addr_gen_mode		= IN6_ADDR_GEN_MODE_EUI64,
247 };
248 
249 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
250 	.forwarding		= 0,
251 	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
252 	.mtu6			= IPV6_MIN_MTU,
253 	.accept_ra		= 1,
254 	.accept_redirects	= 1,
255 	.autoconf		= 1,
256 	.force_mld_version	= 0,
257 	.mldv1_unsolicited_report_interval = 10 * HZ,
258 	.mldv2_unsolicited_report_interval = HZ,
259 	.dad_transmits		= 1,
260 	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
261 	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
262 	.rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
263 	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
264 	.use_tempaddr		= 0,
265 	.temp_valid_lft		= TEMP_VALID_LIFETIME,
266 	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
267 	.regen_max_retry	= REGEN_MAX_RETRY,
268 	.max_desync_factor	= MAX_DESYNC_FACTOR,
269 	.max_addresses		= IPV6_MAX_ADDRESSES,
270 	.accept_ra_defrtr	= 1,
271 	.accept_ra_from_local	= 0,
272 	.accept_ra_min_hop_limit= 1,
273 	.accept_ra_pinfo	= 1,
274 #ifdef CONFIG_IPV6_ROUTER_PREF
275 	.accept_ra_rtr_pref	= 1,
276 	.rtr_probe_interval	= 60 * HZ,
277 #ifdef CONFIG_IPV6_ROUTE_INFO
278 	.accept_ra_rt_info_max_plen = 0,
279 #endif
280 #endif
281 	.proxy_ndp		= 0,
282 	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
283 	.disable_ipv6		= 0,
284 	.accept_dad		= 1,
285 	.suppress_frag_ndisc	= 1,
286 	.accept_ra_mtu		= 1,
287 	.stable_secret		= {
288 		.initialized = false,
289 	},
290 	.use_oif_addrs_only	= 0,
291 	.ignore_routes_with_linkdown = 0,
292 	.keep_addr_on_down	= 0,
293 	.seg6_enabled		= 0,
294 #ifdef CONFIG_IPV6_SEG6_HMAC
295 	.seg6_require_hmac	= 0,
296 #endif
297 	.enhanced_dad           = 1,
298 	.addr_gen_mode		= IN6_ADDR_GEN_MODE_EUI64,
299 };
300 
301 /* Check if a valid qdisc is available */
302 static inline bool addrconf_qdisc_ok(const struct net_device *dev)
303 {
304 	return !qdisc_tx_is_noop(dev);
305 }
306 
307 static void addrconf_del_rs_timer(struct inet6_dev *idev)
308 {
309 	if (del_timer(&idev->rs_timer))
310 		__in6_dev_put(idev);
311 }
312 
313 static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
314 {
315 	if (cancel_delayed_work(&ifp->dad_work))
316 		__in6_ifa_put(ifp);
317 }
318 
319 static void addrconf_mod_rs_timer(struct inet6_dev *idev,
320 				  unsigned long when)
321 {
322 	if (!timer_pending(&idev->rs_timer))
323 		in6_dev_hold(idev);
324 	mod_timer(&idev->rs_timer, jiffies + when);
325 }
326 
327 static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
328 				   unsigned long delay)
329 {
330 	if (!delayed_work_pending(&ifp->dad_work))
331 		in6_ifa_hold(ifp);
332 	mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
333 }
334 
335 static int snmp6_alloc_dev(struct inet6_dev *idev)
336 {
337 	int i;
338 
339 	idev->stats.ipv6 = alloc_percpu(struct ipstats_mib);
340 	if (!idev->stats.ipv6)
341 		goto err_ip;
342 
343 	for_each_possible_cpu(i) {
344 		struct ipstats_mib *addrconf_stats;
345 		addrconf_stats = per_cpu_ptr(idev->stats.ipv6, i);
346 		u64_stats_init(&addrconf_stats->syncp);
347 	}
348 
349 
350 	idev->stats.icmpv6dev = kzalloc(sizeof(struct icmpv6_mib_device),
351 					GFP_KERNEL);
352 	if (!idev->stats.icmpv6dev)
353 		goto err_icmp;
354 	idev->stats.icmpv6msgdev = kzalloc(sizeof(struct icmpv6msg_mib_device),
355 					   GFP_KERNEL);
356 	if (!idev->stats.icmpv6msgdev)
357 		goto err_icmpmsg;
358 
359 	return 0;
360 
361 err_icmpmsg:
362 	kfree(idev->stats.icmpv6dev);
363 err_icmp:
364 	free_percpu(idev->stats.ipv6);
365 err_ip:
366 	return -ENOMEM;
367 }
368 
369 static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
370 {
371 	struct inet6_dev *ndev;
372 	int err = -ENOMEM;
373 
374 	ASSERT_RTNL();
375 
376 	if (dev->mtu < IPV6_MIN_MTU)
377 		return ERR_PTR(-EINVAL);
378 
379 	ndev = kzalloc(sizeof(struct inet6_dev), GFP_KERNEL);
380 	if (!ndev)
381 		return ERR_PTR(err);
382 
383 	rwlock_init(&ndev->lock);
384 	ndev->dev = dev;
385 	INIT_LIST_HEAD(&ndev->addr_list);
386 	setup_timer(&ndev->rs_timer, addrconf_rs_timer,
387 		    (unsigned long)ndev);
388 	memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
389 
390 	if (ndev->cnf.stable_secret.initialized)
391 		ndev->cnf.addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
392 	else
393 		ndev->cnf.addr_gen_mode = ipv6_devconf_dflt.addr_gen_mode;
394 
395 	ndev->cnf.mtu6 = dev->mtu;
396 	ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
397 	if (!ndev->nd_parms) {
398 		kfree(ndev);
399 		return ERR_PTR(err);
400 	}
401 	if (ndev->cnf.forwarding)
402 		dev_disable_lro(dev);
403 	/* We refer to the device */
404 	dev_hold(dev);
405 
406 	if (snmp6_alloc_dev(ndev) < 0) {
407 		ADBG(KERN_WARNING
408 			"%s: cannot allocate memory for statistics; dev=%s.\n",
409 			__func__, dev->name);
410 		neigh_parms_release(&nd_tbl, ndev->nd_parms);
411 		dev_put(dev);
412 		kfree(ndev);
413 		return ERR_PTR(err);
414 	}
415 
416 	if (snmp6_register_dev(ndev) < 0) {
417 		ADBG(KERN_WARNING
418 			"%s: cannot create /proc/net/dev_snmp6/%s\n",
419 			__func__, dev->name);
420 		goto err_release;
421 	}
422 
423 	/* One reference from device. */
424 	in6_dev_hold(ndev);
425 
426 	if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
427 		ndev->cnf.accept_dad = -1;
428 
429 #if IS_ENABLED(CONFIG_IPV6_SIT)
430 	if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
431 		pr_info("%s: Disabled Multicast RS\n", dev->name);
432 		ndev->cnf.rtr_solicits = 0;
433 	}
434 #endif
435 
436 	INIT_LIST_HEAD(&ndev->tempaddr_list);
437 	ndev->desync_factor = U32_MAX;
438 	if ((dev->flags&IFF_LOOPBACK) ||
439 	    dev->type == ARPHRD_TUNNEL ||
440 	    dev->type == ARPHRD_TUNNEL6 ||
441 	    dev->type == ARPHRD_SIT ||
442 	    dev->type == ARPHRD_NONE) {
443 		ndev->cnf.use_tempaddr = -1;
444 	} else
445 		ipv6_regen_rndid(ndev);
446 
447 	ndev->token = in6addr_any;
448 
449 	if (netif_running(dev) && addrconf_qdisc_ok(dev))
450 		ndev->if_flags |= IF_READY;
451 
452 	ipv6_mc_init_dev(ndev);
453 	ndev->tstamp = jiffies;
454 	err = addrconf_sysctl_register(ndev);
455 	if (err) {
456 		ipv6_mc_destroy_dev(ndev);
457 		snmp6_unregister_dev(ndev);
458 		goto err_release;
459 	}
460 	/* protected by rtnl_lock */
461 	rcu_assign_pointer(dev->ip6_ptr, ndev);
462 
463 	/* Join interface-local all-node multicast group */
464 	ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allnodes);
465 
466 	/* Join all-node multicast group */
467 	ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
468 
469 	/* Join all-router multicast group if forwarding is set */
470 	if (ndev->cnf.forwarding && (dev->flags & IFF_MULTICAST))
471 		ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
472 
473 	return ndev;
474 
475 err_release:
476 	neigh_parms_release(&nd_tbl, ndev->nd_parms);
477 	ndev->dead = 1;
478 	in6_dev_finish_destroy(ndev);
479 	return ERR_PTR(err);
480 }
481 
482 static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
483 {
484 	struct inet6_dev *idev;
485 
486 	ASSERT_RTNL();
487 
488 	idev = __in6_dev_get(dev);
489 	if (!idev) {
490 		idev = ipv6_add_dev(dev);
491 		if (IS_ERR(idev))
492 			return NULL;
493 	}
494 
495 	if (dev->flags&IFF_UP)
496 		ipv6_mc_up(idev);
497 	return idev;
498 }
499 
500 static int inet6_netconf_msgsize_devconf(int type)
501 {
502 	int size =  NLMSG_ALIGN(sizeof(struct netconfmsg))
503 		    + nla_total_size(4);	/* NETCONFA_IFINDEX */
504 	bool all = false;
505 
506 	if (type == NETCONFA_ALL)
507 		all = true;
508 
509 	if (all || type == NETCONFA_FORWARDING)
510 		size += nla_total_size(4);
511 #ifdef CONFIG_IPV6_MROUTE
512 	if (all || type == NETCONFA_MC_FORWARDING)
513 		size += nla_total_size(4);
514 #endif
515 	if (all || type == NETCONFA_PROXY_NEIGH)
516 		size += nla_total_size(4);
517 
518 	if (all || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN)
519 		size += nla_total_size(4);
520 
521 	return size;
522 }
523 
524 static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
525 				      struct ipv6_devconf *devconf, u32 portid,
526 				      u32 seq, int event, unsigned int flags,
527 				      int type)
528 {
529 	struct nlmsghdr  *nlh;
530 	struct netconfmsg *ncm;
531 	bool all = false;
532 
533 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct netconfmsg),
534 			flags);
535 	if (!nlh)
536 		return -EMSGSIZE;
537 
538 	if (type == NETCONFA_ALL)
539 		all = true;
540 
541 	ncm = nlmsg_data(nlh);
542 	ncm->ncm_family = AF_INET6;
543 
544 	if (nla_put_s32(skb, NETCONFA_IFINDEX, ifindex) < 0)
545 		goto nla_put_failure;
546 
547 	if ((all || type == NETCONFA_FORWARDING) &&
548 	    nla_put_s32(skb, NETCONFA_FORWARDING, devconf->forwarding) < 0)
549 		goto nla_put_failure;
550 #ifdef CONFIG_IPV6_MROUTE
551 	if ((all || type == NETCONFA_MC_FORWARDING) &&
552 	    nla_put_s32(skb, NETCONFA_MC_FORWARDING,
553 			devconf->mc_forwarding) < 0)
554 		goto nla_put_failure;
555 #endif
556 	if ((all || type == NETCONFA_PROXY_NEIGH) &&
557 	    nla_put_s32(skb, NETCONFA_PROXY_NEIGH, devconf->proxy_ndp) < 0)
558 		goto nla_put_failure;
559 
560 	if ((all || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN) &&
561 	    nla_put_s32(skb, NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
562 			devconf->ignore_routes_with_linkdown) < 0)
563 		goto nla_put_failure;
564 
565 	nlmsg_end(skb, nlh);
566 	return 0;
567 
568 nla_put_failure:
569 	nlmsg_cancel(skb, nlh);
570 	return -EMSGSIZE;
571 }
572 
573 void inet6_netconf_notify_devconf(struct net *net, int type, int ifindex,
574 				  struct ipv6_devconf *devconf)
575 {
576 	struct sk_buff *skb;
577 	int err = -ENOBUFS;
578 
579 	skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_KERNEL);
580 	if (!skb)
581 		goto errout;
582 
583 	err = inet6_netconf_fill_devconf(skb, ifindex, devconf, 0, 0,
584 					 RTM_NEWNETCONF, 0, type);
585 	if (err < 0) {
586 		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
587 		WARN_ON(err == -EMSGSIZE);
588 		kfree_skb(skb);
589 		goto errout;
590 	}
591 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_KERNEL);
592 	return;
593 errout:
594 	rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err);
595 }
596 
597 static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
598 	[NETCONFA_IFINDEX]	= { .len = sizeof(int) },
599 	[NETCONFA_FORWARDING]	= { .len = sizeof(int) },
600 	[NETCONFA_PROXY_NEIGH]	= { .len = sizeof(int) },
601 	[NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN]	= { .len = sizeof(int) },
602 };
603 
604 static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
605 				     struct nlmsghdr *nlh)
606 {
607 	struct net *net = sock_net(in_skb->sk);
608 	struct nlattr *tb[NETCONFA_MAX+1];
609 	struct netconfmsg *ncm;
610 	struct sk_buff *skb;
611 	struct ipv6_devconf *devconf;
612 	struct inet6_dev *in6_dev;
613 	struct net_device *dev;
614 	int ifindex;
615 	int err;
616 
617 	err = nlmsg_parse(nlh, sizeof(*ncm), tb, NETCONFA_MAX,
618 			  devconf_ipv6_policy);
619 	if (err < 0)
620 		goto errout;
621 
622 	err = -EINVAL;
623 	if (!tb[NETCONFA_IFINDEX])
624 		goto errout;
625 
626 	ifindex = nla_get_s32(tb[NETCONFA_IFINDEX]);
627 	switch (ifindex) {
628 	case NETCONFA_IFINDEX_ALL:
629 		devconf = net->ipv6.devconf_all;
630 		break;
631 	case NETCONFA_IFINDEX_DEFAULT:
632 		devconf = net->ipv6.devconf_dflt;
633 		break;
634 	default:
635 		dev = __dev_get_by_index(net, ifindex);
636 		if (!dev)
637 			goto errout;
638 		in6_dev = __in6_dev_get(dev);
639 		if (!in6_dev)
640 			goto errout;
641 		devconf = &in6_dev->cnf;
642 		break;
643 	}
644 
645 	err = -ENOBUFS;
646 	skb = nlmsg_new(inet6_netconf_msgsize_devconf(NETCONFA_ALL), GFP_ATOMIC);
647 	if (!skb)
648 		goto errout;
649 
650 	err = inet6_netconf_fill_devconf(skb, ifindex, devconf,
651 					 NETLINK_CB(in_skb).portid,
652 					 nlh->nlmsg_seq, RTM_NEWNETCONF, 0,
653 					 NETCONFA_ALL);
654 	if (err < 0) {
655 		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
656 		WARN_ON(err == -EMSGSIZE);
657 		kfree_skb(skb);
658 		goto errout;
659 	}
660 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
661 errout:
662 	return err;
663 }
664 
665 static int inet6_netconf_dump_devconf(struct sk_buff *skb,
666 				      struct netlink_callback *cb)
667 {
668 	struct net *net = sock_net(skb->sk);
669 	int h, s_h;
670 	int idx, s_idx;
671 	struct net_device *dev;
672 	struct inet6_dev *idev;
673 	struct hlist_head *head;
674 
675 	s_h = cb->args[0];
676 	s_idx = idx = cb->args[1];
677 
678 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
679 		idx = 0;
680 		head = &net->dev_index_head[h];
681 		rcu_read_lock();
682 		cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^
683 			  net->dev_base_seq;
684 		hlist_for_each_entry_rcu(dev, head, index_hlist) {
685 			if (idx < s_idx)
686 				goto cont;
687 			idev = __in6_dev_get(dev);
688 			if (!idev)
689 				goto cont;
690 
691 			if (inet6_netconf_fill_devconf(skb, dev->ifindex,
692 						       &idev->cnf,
693 						       NETLINK_CB(cb->skb).portid,
694 						       cb->nlh->nlmsg_seq,
695 						       RTM_NEWNETCONF,
696 						       NLM_F_MULTI,
697 						       NETCONFA_ALL) < 0) {
698 				rcu_read_unlock();
699 				goto done;
700 			}
701 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
702 cont:
703 			idx++;
704 		}
705 		rcu_read_unlock();
706 	}
707 	if (h == NETDEV_HASHENTRIES) {
708 		if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_ALL,
709 					       net->ipv6.devconf_all,
710 					       NETLINK_CB(cb->skb).portid,
711 					       cb->nlh->nlmsg_seq,
712 					       RTM_NEWNETCONF, NLM_F_MULTI,
713 					       NETCONFA_ALL) < 0)
714 			goto done;
715 		else
716 			h++;
717 	}
718 	if (h == NETDEV_HASHENTRIES + 1) {
719 		if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_DEFAULT,
720 					       net->ipv6.devconf_dflt,
721 					       NETLINK_CB(cb->skb).portid,
722 					       cb->nlh->nlmsg_seq,
723 					       RTM_NEWNETCONF, NLM_F_MULTI,
724 					       NETCONFA_ALL) < 0)
725 			goto done;
726 		else
727 			h++;
728 	}
729 done:
730 	cb->args[0] = h;
731 	cb->args[1] = idx;
732 
733 	return skb->len;
734 }
735 
736 #ifdef CONFIG_SYSCTL
737 static void dev_forward_change(struct inet6_dev *idev)
738 {
739 	struct net_device *dev;
740 	struct inet6_ifaddr *ifa;
741 
742 	if (!idev)
743 		return;
744 	dev = idev->dev;
745 	if (idev->cnf.forwarding)
746 		dev_disable_lro(dev);
747 	if (dev->flags & IFF_MULTICAST) {
748 		if (idev->cnf.forwarding) {
749 			ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
750 			ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allrouters);
751 			ipv6_dev_mc_inc(dev, &in6addr_sitelocal_allrouters);
752 		} else {
753 			ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);
754 			ipv6_dev_mc_dec(dev, &in6addr_interfacelocal_allrouters);
755 			ipv6_dev_mc_dec(dev, &in6addr_sitelocal_allrouters);
756 		}
757 	}
758 
759 	list_for_each_entry(ifa, &idev->addr_list, if_list) {
760 		if (ifa->flags&IFA_F_TENTATIVE)
761 			continue;
762 		if (idev->cnf.forwarding)
763 			addrconf_join_anycast(ifa);
764 		else
765 			addrconf_leave_anycast(ifa);
766 	}
767 	inet6_netconf_notify_devconf(dev_net(dev), NETCONFA_FORWARDING,
768 				     dev->ifindex, &idev->cnf);
769 }
770 
771 
772 static void addrconf_forward_change(struct net *net, __s32 newf)
773 {
774 	struct net_device *dev;
775 	struct inet6_dev *idev;
776 
777 	for_each_netdev(net, dev) {
778 		idev = __in6_dev_get(dev);
779 		if (idev) {
780 			int changed = (!idev->cnf.forwarding) ^ (!newf);
781 			idev->cnf.forwarding = newf;
782 			if (changed)
783 				dev_forward_change(idev);
784 		}
785 	}
786 }
787 
788 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
789 {
790 	struct net *net;
791 	int old;
792 
793 	if (!rtnl_trylock())
794 		return restart_syscall();
795 
796 	net = (struct net *)table->extra2;
797 	old = *p;
798 	*p = newf;
799 
800 	if (p == &net->ipv6.devconf_dflt->forwarding) {
801 		if ((!newf) ^ (!old))
802 			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
803 						     NETCONFA_IFINDEX_DEFAULT,
804 						     net->ipv6.devconf_dflt);
805 		rtnl_unlock();
806 		return 0;
807 	}
808 
809 	if (p == &net->ipv6.devconf_all->forwarding) {
810 		int old_dflt = net->ipv6.devconf_dflt->forwarding;
811 
812 		net->ipv6.devconf_dflt->forwarding = newf;
813 		if ((!newf) ^ (!old_dflt))
814 			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
815 						     NETCONFA_IFINDEX_DEFAULT,
816 						     net->ipv6.devconf_dflt);
817 
818 		addrconf_forward_change(net, newf);
819 		if ((!newf) ^ (!old))
820 			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
821 						     NETCONFA_IFINDEX_ALL,
822 						     net->ipv6.devconf_all);
823 	} else if ((!newf) ^ (!old))
824 		dev_forward_change((struct inet6_dev *)table->extra1);
825 	rtnl_unlock();
826 
827 	if (newf)
828 		rt6_purge_dflt_routers(net);
829 	return 1;
830 }
831 
832 static void addrconf_linkdown_change(struct net *net, __s32 newf)
833 {
834 	struct net_device *dev;
835 	struct inet6_dev *idev;
836 
837 	for_each_netdev(net, dev) {
838 		idev = __in6_dev_get(dev);
839 		if (idev) {
840 			int changed = (!idev->cnf.ignore_routes_with_linkdown) ^ (!newf);
841 
842 			idev->cnf.ignore_routes_with_linkdown = newf;
843 			if (changed)
844 				inet6_netconf_notify_devconf(dev_net(dev),
845 							     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
846 							     dev->ifindex,
847 							     &idev->cnf);
848 		}
849 	}
850 }
851 
852 static int addrconf_fixup_linkdown(struct ctl_table *table, int *p, int newf)
853 {
854 	struct net *net;
855 	int old;
856 
857 	if (!rtnl_trylock())
858 		return restart_syscall();
859 
860 	net = (struct net *)table->extra2;
861 	old = *p;
862 	*p = newf;
863 
864 	if (p == &net->ipv6.devconf_dflt->ignore_routes_with_linkdown) {
865 		if ((!newf) ^ (!old))
866 			inet6_netconf_notify_devconf(net,
867 						     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
868 						     NETCONFA_IFINDEX_DEFAULT,
869 						     net->ipv6.devconf_dflt);
870 		rtnl_unlock();
871 		return 0;
872 	}
873 
874 	if (p == &net->ipv6.devconf_all->ignore_routes_with_linkdown) {
875 		net->ipv6.devconf_dflt->ignore_routes_with_linkdown = newf;
876 		addrconf_linkdown_change(net, newf);
877 		if ((!newf) ^ (!old))
878 			inet6_netconf_notify_devconf(net,
879 						     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
880 						     NETCONFA_IFINDEX_ALL,
881 						     net->ipv6.devconf_all);
882 	}
883 	rtnl_unlock();
884 
885 	return 1;
886 }
887 
888 #endif
889 
890 /* Nobody refers to this ifaddr, destroy it */
891 void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
892 {
893 	WARN_ON(!hlist_unhashed(&ifp->addr_lst));
894 
895 #ifdef NET_REFCNT_DEBUG
896 	pr_debug("%s\n", __func__);
897 #endif
898 
899 	in6_dev_put(ifp->idev);
900 
901 	if (cancel_delayed_work(&ifp->dad_work))
902 		pr_notice("delayed DAD work was pending while freeing ifa=%p\n",
903 			  ifp);
904 
905 	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
906 		pr_warn("Freeing alive inet6 address %p\n", ifp);
907 		return;
908 	}
909 	ip6_rt_put(ifp->rt);
910 
911 	kfree_rcu(ifp, rcu);
912 }
913 
914 static void
915 ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
916 {
917 	struct list_head *p;
918 	int ifp_scope = ipv6_addr_src_scope(&ifp->addr);
919 
920 	/*
921 	 * Each device address list is sorted in order of scope -
922 	 * global before linklocal.
923 	 */
924 	list_for_each(p, &idev->addr_list) {
925 		struct inet6_ifaddr *ifa
926 			= list_entry(p, struct inet6_ifaddr, if_list);
927 		if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))
928 			break;
929 	}
930 
931 	list_add_tail(&ifp->if_list, p);
932 }
933 
934 static u32 inet6_addr_hash(const struct in6_addr *addr)
935 {
936 	return hash_32(ipv6_addr_hash(addr), IN6_ADDR_HSIZE_SHIFT);
937 }
938 
939 /* On success it returns ifp with increased reference count */
940 
941 static struct inet6_ifaddr *
942 ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
943 	      const struct in6_addr *peer_addr, int pfxlen,
944 	      int scope, u32 flags, u32 valid_lft, u32 prefered_lft)
945 {
946 	struct inet6_ifaddr *ifa = NULL;
947 	struct rt6_info *rt;
948 	unsigned int hash;
949 	int err = 0;
950 	int addr_type = ipv6_addr_type(addr);
951 
952 	if (addr_type == IPV6_ADDR_ANY ||
953 	    addr_type & IPV6_ADDR_MULTICAST ||
954 	    (!(idev->dev->flags & IFF_LOOPBACK) &&
955 	     addr_type & IPV6_ADDR_LOOPBACK))
956 		return ERR_PTR(-EADDRNOTAVAIL);
957 
958 	rcu_read_lock_bh();
959 	if (idev->dead) {
960 		err = -ENODEV;			/*XXX*/
961 		goto out2;
962 	}
963 
964 	if (idev->cnf.disable_ipv6) {
965 		err = -EACCES;
966 		goto out2;
967 	}
968 
969 	spin_lock(&addrconf_hash_lock);
970 
971 	/* Ignore adding duplicate addresses on an interface */
972 	if (ipv6_chk_same_addr(dev_net(idev->dev), addr, idev->dev)) {
973 		ADBG("ipv6_add_addr: already assigned\n");
974 		err = -EEXIST;
975 		goto out;
976 	}
977 
978 	ifa = kzalloc(sizeof(struct inet6_ifaddr), GFP_ATOMIC);
979 
980 	if (!ifa) {
981 		ADBG("ipv6_add_addr: malloc failed\n");
982 		err = -ENOBUFS;
983 		goto out;
984 	}
985 
986 	rt = addrconf_dst_alloc(idev, addr, false);
987 	if (IS_ERR(rt)) {
988 		err = PTR_ERR(rt);
989 		goto out;
990 	}
991 
992 	neigh_parms_data_state_setall(idev->nd_parms);
993 
994 	ifa->addr = *addr;
995 	if (peer_addr)
996 		ifa->peer_addr = *peer_addr;
997 
998 	spin_lock_init(&ifa->lock);
999 	INIT_DELAYED_WORK(&ifa->dad_work, addrconf_dad_work);
1000 	INIT_HLIST_NODE(&ifa->addr_lst);
1001 	ifa->scope = scope;
1002 	ifa->prefix_len = pfxlen;
1003 	ifa->flags = flags | IFA_F_TENTATIVE;
1004 	ifa->valid_lft = valid_lft;
1005 	ifa->prefered_lft = prefered_lft;
1006 	ifa->cstamp = ifa->tstamp = jiffies;
1007 	ifa->tokenized = false;
1008 
1009 	ifa->rt = rt;
1010 
1011 	ifa->idev = idev;
1012 	in6_dev_hold(idev);
1013 	/* For caller */
1014 	in6_ifa_hold(ifa);
1015 
1016 	/* Add to big hash table */
1017 	hash = inet6_addr_hash(addr);
1018 
1019 	hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);
1020 	spin_unlock(&addrconf_hash_lock);
1021 
1022 	write_lock(&idev->lock);
1023 	/* Add to inet6_dev unicast addr list. */
1024 	ipv6_link_dev_addr(idev, ifa);
1025 
1026 	if (ifa->flags&IFA_F_TEMPORARY) {
1027 		list_add(&ifa->tmp_list, &idev->tempaddr_list);
1028 		in6_ifa_hold(ifa);
1029 	}
1030 
1031 	in6_ifa_hold(ifa);
1032 	write_unlock(&idev->lock);
1033 out2:
1034 	rcu_read_unlock_bh();
1035 
1036 	if (likely(err == 0))
1037 		inet6addr_notifier_call_chain(NETDEV_UP, ifa);
1038 	else {
1039 		kfree(ifa);
1040 		ifa = ERR_PTR(err);
1041 	}
1042 
1043 	return ifa;
1044 out:
1045 	spin_unlock(&addrconf_hash_lock);
1046 	goto out2;
1047 }
1048 
1049 enum cleanup_prefix_rt_t {
1050 	CLEANUP_PREFIX_RT_NOP,    /* no cleanup action for prefix route */
1051 	CLEANUP_PREFIX_RT_DEL,    /* delete the prefix route */
1052 	CLEANUP_PREFIX_RT_EXPIRE, /* update the lifetime of the prefix route */
1053 };
1054 
1055 /*
1056  * Check, whether the prefix for ifp would still need a prefix route
1057  * after deleting ifp. The function returns one of the CLEANUP_PREFIX_RT_*
1058  * constants.
1059  *
1060  * 1) we don't purge prefix if address was not permanent.
1061  *    prefix is managed by its own lifetime.
1062  * 2) we also don't purge, if the address was IFA_F_NOPREFIXROUTE.
1063  * 3) if there are no addresses, delete prefix.
1064  * 4) if there are still other permanent address(es),
1065  *    corresponding prefix is still permanent.
1066  * 5) if there are still other addresses with IFA_F_NOPREFIXROUTE,
1067  *    don't purge the prefix, assume user space is managing it.
1068  * 6) otherwise, update prefix lifetime to the
1069  *    longest valid lifetime among the corresponding
1070  *    addresses on the device.
1071  *    Note: subsequent RA will update lifetime.
1072  **/
1073 static enum cleanup_prefix_rt_t
1074 check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
1075 {
1076 	struct inet6_ifaddr *ifa;
1077 	struct inet6_dev *idev = ifp->idev;
1078 	unsigned long lifetime;
1079 	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_DEL;
1080 
1081 	*expires = jiffies;
1082 
1083 	list_for_each_entry(ifa, &idev->addr_list, if_list) {
1084 		if (ifa == ifp)
1085 			continue;
1086 		if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
1087 				       ifp->prefix_len))
1088 			continue;
1089 		if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
1090 			return CLEANUP_PREFIX_RT_NOP;
1091 
1092 		action = CLEANUP_PREFIX_RT_EXPIRE;
1093 
1094 		spin_lock(&ifa->lock);
1095 
1096 		lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
1097 		/*
1098 		 * Note: Because this address is
1099 		 * not permanent, lifetime <
1100 		 * LONG_MAX / HZ here.
1101 		 */
1102 		if (time_before(*expires, ifa->tstamp + lifetime * HZ))
1103 			*expires = ifa->tstamp + lifetime * HZ;
1104 		spin_unlock(&ifa->lock);
1105 	}
1106 
1107 	return action;
1108 }
1109 
1110 static void
1111 cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires, bool del_rt)
1112 {
1113 	struct rt6_info *rt;
1114 
1115 	rt = addrconf_get_prefix_route(&ifp->addr,
1116 				       ifp->prefix_len,
1117 				       ifp->idev->dev,
1118 				       0, RTF_GATEWAY | RTF_DEFAULT);
1119 	if (rt) {
1120 		if (del_rt)
1121 			ip6_del_rt(rt);
1122 		else {
1123 			if (!(rt->rt6i_flags & RTF_EXPIRES))
1124 				rt6_set_expires(rt, expires);
1125 			ip6_rt_put(rt);
1126 		}
1127 	}
1128 }
1129 
1130 
1131 /* This function wants to get referenced ifp and releases it before return */
1132 
1133 static void ipv6_del_addr(struct inet6_ifaddr *ifp)
1134 {
1135 	int state;
1136 	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_NOP;
1137 	unsigned long expires;
1138 
1139 	ASSERT_RTNL();
1140 
1141 	spin_lock_bh(&ifp->lock);
1142 	state = ifp->state;
1143 	ifp->state = INET6_IFADDR_STATE_DEAD;
1144 	spin_unlock_bh(&ifp->lock);
1145 
1146 	if (state == INET6_IFADDR_STATE_DEAD)
1147 		goto out;
1148 
1149 	spin_lock_bh(&addrconf_hash_lock);
1150 	hlist_del_init_rcu(&ifp->addr_lst);
1151 	spin_unlock_bh(&addrconf_hash_lock);
1152 
1153 	write_lock_bh(&ifp->idev->lock);
1154 
1155 	if (ifp->flags&IFA_F_TEMPORARY) {
1156 		list_del(&ifp->tmp_list);
1157 		if (ifp->ifpub) {
1158 			in6_ifa_put(ifp->ifpub);
1159 			ifp->ifpub = NULL;
1160 		}
1161 		__in6_ifa_put(ifp);
1162 	}
1163 
1164 	if (ifp->flags & IFA_F_PERMANENT && !(ifp->flags & IFA_F_NOPREFIXROUTE))
1165 		action = check_cleanup_prefix_route(ifp, &expires);
1166 
1167 	list_del_init(&ifp->if_list);
1168 	__in6_ifa_put(ifp);
1169 
1170 	write_unlock_bh(&ifp->idev->lock);
1171 
1172 	addrconf_del_dad_work(ifp);
1173 
1174 	ipv6_ifa_notify(RTM_DELADDR, ifp);
1175 
1176 	inet6addr_notifier_call_chain(NETDEV_DOWN, ifp);
1177 
1178 	if (action != CLEANUP_PREFIX_RT_NOP) {
1179 		cleanup_prefix_route(ifp, expires,
1180 			action == CLEANUP_PREFIX_RT_DEL);
1181 	}
1182 
1183 	/* clean up prefsrc entries */
1184 	rt6_remove_prefsrc(ifp);
1185 out:
1186 	in6_ifa_put(ifp);
1187 }
1188 
1189 static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *ift)
1190 {
1191 	struct inet6_dev *idev = ifp->idev;
1192 	struct in6_addr addr, *tmpaddr;
1193 	unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_tstamp, age;
1194 	unsigned long regen_advance;
1195 	int tmp_plen;
1196 	int ret = 0;
1197 	u32 addr_flags;
1198 	unsigned long now = jiffies;
1199 	long max_desync_factor;
1200 	s32 cnf_temp_preferred_lft;
1201 
1202 	write_lock_bh(&idev->lock);
1203 	if (ift) {
1204 		spin_lock_bh(&ift->lock);
1205 		memcpy(&addr.s6_addr[8], &ift->addr.s6_addr[8], 8);
1206 		spin_unlock_bh(&ift->lock);
1207 		tmpaddr = &addr;
1208 	} else {
1209 		tmpaddr = NULL;
1210 	}
1211 retry:
1212 	in6_dev_hold(idev);
1213 	if (idev->cnf.use_tempaddr <= 0) {
1214 		write_unlock_bh(&idev->lock);
1215 		pr_info("%s: use_tempaddr is disabled\n", __func__);
1216 		in6_dev_put(idev);
1217 		ret = -1;
1218 		goto out;
1219 	}
1220 	spin_lock_bh(&ifp->lock);
1221 	if (ifp->regen_count++ >= idev->cnf.regen_max_retry) {
1222 		idev->cnf.use_tempaddr = -1;	/*XXX*/
1223 		spin_unlock_bh(&ifp->lock);
1224 		write_unlock_bh(&idev->lock);
1225 		pr_warn("%s: regeneration time exceeded - disabled temporary address support\n",
1226 			__func__);
1227 		in6_dev_put(idev);
1228 		ret = -1;
1229 		goto out;
1230 	}
1231 	in6_ifa_hold(ifp);
1232 	memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);
1233 	ipv6_try_regen_rndid(idev, tmpaddr);
1234 	memcpy(&addr.s6_addr[8], idev->rndid, 8);
1235 	age = (now - ifp->tstamp) / HZ;
1236 
1237 	regen_advance = idev->cnf.regen_max_retry *
1238 			idev->cnf.dad_transmits *
1239 			NEIGH_VAR(idev->nd_parms, RETRANS_TIME) / HZ;
1240 
1241 	/* recalculate max_desync_factor each time and update
1242 	 * idev->desync_factor if it's larger
1243 	 */
1244 	cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft);
1245 	max_desync_factor = min_t(__u32,
1246 				  idev->cnf.max_desync_factor,
1247 				  cnf_temp_preferred_lft - regen_advance);
1248 
1249 	if (unlikely(idev->desync_factor > max_desync_factor)) {
1250 		if (max_desync_factor > 0) {
1251 			get_random_bytes(&idev->desync_factor,
1252 					 sizeof(idev->desync_factor));
1253 			idev->desync_factor %= max_desync_factor;
1254 		} else {
1255 			idev->desync_factor = 0;
1256 		}
1257 	}
1258 
1259 	tmp_valid_lft = min_t(__u32,
1260 			      ifp->valid_lft,
1261 			      idev->cnf.temp_valid_lft + age);
1262 	tmp_prefered_lft = cnf_temp_preferred_lft + age -
1263 			    idev->desync_factor;
1264 	tmp_prefered_lft = min_t(__u32, ifp->prefered_lft, tmp_prefered_lft);
1265 	tmp_plen = ifp->prefix_len;
1266 	tmp_tstamp = ifp->tstamp;
1267 	spin_unlock_bh(&ifp->lock);
1268 
1269 	write_unlock_bh(&idev->lock);
1270 
1271 	/* A temporary address is created only if this calculated Preferred
1272 	 * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
1273 	 * an implementation must not create a temporary address with a zero
1274 	 * Preferred Lifetime.
1275 	 * Use age calculation as in addrconf_verify to avoid unnecessary
1276 	 * temporary addresses being generated.
1277 	 */
1278 	age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
1279 	if (tmp_prefered_lft <= regen_advance + age) {
1280 		in6_ifa_put(ifp);
1281 		in6_dev_put(idev);
1282 		ret = -1;
1283 		goto out;
1284 	}
1285 
1286 	addr_flags = IFA_F_TEMPORARY;
1287 	/* set in addrconf_prefix_rcv() */
1288 	if (ifp->flags & IFA_F_OPTIMISTIC)
1289 		addr_flags |= IFA_F_OPTIMISTIC;
1290 
1291 	ift = ipv6_add_addr(idev, &addr, NULL, tmp_plen,
1292 			    ipv6_addr_scope(&addr), addr_flags,
1293 			    tmp_valid_lft, tmp_prefered_lft);
1294 	if (IS_ERR(ift)) {
1295 		in6_ifa_put(ifp);
1296 		in6_dev_put(idev);
1297 		pr_info("%s: retry temporary address regeneration\n", __func__);
1298 		tmpaddr = &addr;
1299 		write_lock_bh(&idev->lock);
1300 		goto retry;
1301 	}
1302 
1303 	spin_lock_bh(&ift->lock);
1304 	ift->ifpub = ifp;
1305 	ift->cstamp = now;
1306 	ift->tstamp = tmp_tstamp;
1307 	spin_unlock_bh(&ift->lock);
1308 
1309 	addrconf_dad_start(ift);
1310 	in6_ifa_put(ift);
1311 	in6_dev_put(idev);
1312 out:
1313 	return ret;
1314 }
1315 
1316 /*
1317  *	Choose an appropriate source address (RFC3484)
1318  */
1319 enum {
1320 	IPV6_SADDR_RULE_INIT = 0,
1321 	IPV6_SADDR_RULE_LOCAL,
1322 	IPV6_SADDR_RULE_SCOPE,
1323 	IPV6_SADDR_RULE_PREFERRED,
1324 #ifdef CONFIG_IPV6_MIP6
1325 	IPV6_SADDR_RULE_HOA,
1326 #endif
1327 	IPV6_SADDR_RULE_OIF,
1328 	IPV6_SADDR_RULE_LABEL,
1329 	IPV6_SADDR_RULE_PRIVACY,
1330 	IPV6_SADDR_RULE_ORCHID,
1331 	IPV6_SADDR_RULE_PREFIX,
1332 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1333 	IPV6_SADDR_RULE_NOT_OPTIMISTIC,
1334 #endif
1335 	IPV6_SADDR_RULE_MAX
1336 };
1337 
1338 struct ipv6_saddr_score {
1339 	int			rule;
1340 	int			addr_type;
1341 	struct inet6_ifaddr	*ifa;
1342 	DECLARE_BITMAP(scorebits, IPV6_SADDR_RULE_MAX);
1343 	int			scopedist;
1344 	int			matchlen;
1345 };
1346 
1347 struct ipv6_saddr_dst {
1348 	const struct in6_addr *addr;
1349 	int ifindex;
1350 	int scope;
1351 	int label;
1352 	unsigned int prefs;
1353 };
1354 
1355 static inline int ipv6_saddr_preferred(int type)
1356 {
1357 	if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))
1358 		return 1;
1359 	return 0;
1360 }
1361 
1362 static inline bool ipv6_use_optimistic_addr(struct inet6_dev *idev)
1363 {
1364 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1365 	return idev && idev->cnf.optimistic_dad && idev->cnf.use_optimistic;
1366 #else
1367 	return false;
1368 #endif
1369 }
1370 
1371 static int ipv6_get_saddr_eval(struct net *net,
1372 			       struct ipv6_saddr_score *score,
1373 			       struct ipv6_saddr_dst *dst,
1374 			       int i)
1375 {
1376 	int ret;
1377 
1378 	if (i <= score->rule) {
1379 		switch (i) {
1380 		case IPV6_SADDR_RULE_SCOPE:
1381 			ret = score->scopedist;
1382 			break;
1383 		case IPV6_SADDR_RULE_PREFIX:
1384 			ret = score->matchlen;
1385 			break;
1386 		default:
1387 			ret = !!test_bit(i, score->scorebits);
1388 		}
1389 		goto out;
1390 	}
1391 
1392 	switch (i) {
1393 	case IPV6_SADDR_RULE_INIT:
1394 		/* Rule 0: remember if hiscore is not ready yet */
1395 		ret = !!score->ifa;
1396 		break;
1397 	case IPV6_SADDR_RULE_LOCAL:
1398 		/* Rule 1: Prefer same address */
1399 		ret = ipv6_addr_equal(&score->ifa->addr, dst->addr);
1400 		break;
1401 	case IPV6_SADDR_RULE_SCOPE:
1402 		/* Rule 2: Prefer appropriate scope
1403 		 *
1404 		 *      ret
1405 		 *       ^
1406 		 *    -1 |  d 15
1407 		 *    ---+--+-+---> scope
1408 		 *       |
1409 		 *       |             d is scope of the destination.
1410 		 *  B-d  |  \
1411 		 *       |   \      <- smaller scope is better if
1412 		 *  B-15 |    \        if scope is enough for destination.
1413 		 *       |             ret = B - scope (-1 <= scope >= d <= 15).
1414 		 * d-C-1 | /
1415 		 *       |/         <- greater is better
1416 		 *   -C  /             if scope is not enough for destination.
1417 		 *      /|             ret = scope - C (-1 <= d < scope <= 15).
1418 		 *
1419 		 * d - C - 1 < B -15 (for all -1 <= d <= 15).
1420 		 * C > d + 14 - B >= 15 + 14 - B = 29 - B.
1421 		 * Assume B = 0 and we get C > 29.
1422 		 */
1423 		ret = __ipv6_addr_src_scope(score->addr_type);
1424 		if (ret >= dst->scope)
1425 			ret = -ret;
1426 		else
1427 			ret -= 128;	/* 30 is enough */
1428 		score->scopedist = ret;
1429 		break;
1430 	case IPV6_SADDR_RULE_PREFERRED:
1431 	    {
1432 		/* Rule 3: Avoid deprecated and optimistic addresses */
1433 		u8 avoid = IFA_F_DEPRECATED;
1434 
1435 		if (!ipv6_use_optimistic_addr(score->ifa->idev))
1436 			avoid |= IFA_F_OPTIMISTIC;
1437 		ret = ipv6_saddr_preferred(score->addr_type) ||
1438 		      !(score->ifa->flags & avoid);
1439 		break;
1440 	    }
1441 #ifdef CONFIG_IPV6_MIP6
1442 	case IPV6_SADDR_RULE_HOA:
1443 	    {
1444 		/* Rule 4: Prefer home address */
1445 		int prefhome = !(dst->prefs & IPV6_PREFER_SRC_COA);
1446 		ret = !(score->ifa->flags & IFA_F_HOMEADDRESS) ^ prefhome;
1447 		break;
1448 	    }
1449 #endif
1450 	case IPV6_SADDR_RULE_OIF:
1451 		/* Rule 5: Prefer outgoing interface */
1452 		ret = (!dst->ifindex ||
1453 		       dst->ifindex == score->ifa->idev->dev->ifindex);
1454 		break;
1455 	case IPV6_SADDR_RULE_LABEL:
1456 		/* Rule 6: Prefer matching label */
1457 		ret = ipv6_addr_label(net,
1458 				      &score->ifa->addr, score->addr_type,
1459 				      score->ifa->idev->dev->ifindex) == dst->label;
1460 		break;
1461 	case IPV6_SADDR_RULE_PRIVACY:
1462 	    {
1463 		/* Rule 7: Prefer public address
1464 		 * Note: prefer temporary address if use_tempaddr >= 2
1465 		 */
1466 		int preftmp = dst->prefs & (IPV6_PREFER_SRC_PUBLIC|IPV6_PREFER_SRC_TMP) ?
1467 				!!(dst->prefs & IPV6_PREFER_SRC_TMP) :
1468 				score->ifa->idev->cnf.use_tempaddr >= 2;
1469 		ret = (!(score->ifa->flags & IFA_F_TEMPORARY)) ^ preftmp;
1470 		break;
1471 	    }
1472 	case IPV6_SADDR_RULE_ORCHID:
1473 		/* Rule 8-: Prefer ORCHID vs ORCHID or
1474 		 *	    non-ORCHID vs non-ORCHID
1475 		 */
1476 		ret = !(ipv6_addr_orchid(&score->ifa->addr) ^
1477 			ipv6_addr_orchid(dst->addr));
1478 		break;
1479 	case IPV6_SADDR_RULE_PREFIX:
1480 		/* Rule 8: Use longest matching prefix */
1481 		ret = ipv6_addr_diff(&score->ifa->addr, dst->addr);
1482 		if (ret > score->ifa->prefix_len)
1483 			ret = score->ifa->prefix_len;
1484 		score->matchlen = ret;
1485 		break;
1486 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1487 	case IPV6_SADDR_RULE_NOT_OPTIMISTIC:
1488 		/* Optimistic addresses still have lower precedence than other
1489 		 * preferred addresses.
1490 		 */
1491 		ret = !(score->ifa->flags & IFA_F_OPTIMISTIC);
1492 		break;
1493 #endif
1494 	default:
1495 		ret = 0;
1496 	}
1497 
1498 	if (ret)
1499 		__set_bit(i, score->scorebits);
1500 	score->rule = i;
1501 out:
1502 	return ret;
1503 }
1504 
1505 static int __ipv6_dev_get_saddr(struct net *net,
1506 				struct ipv6_saddr_dst *dst,
1507 				struct inet6_dev *idev,
1508 				struct ipv6_saddr_score *scores,
1509 				int hiscore_idx)
1510 {
1511 	struct ipv6_saddr_score *score = &scores[1 - hiscore_idx], *hiscore = &scores[hiscore_idx];
1512 
1513 	read_lock_bh(&idev->lock);
1514 	list_for_each_entry(score->ifa, &idev->addr_list, if_list) {
1515 		int i;
1516 
1517 		/*
1518 		 * - Tentative Address (RFC2462 section 5.4)
1519 		 *  - A tentative address is not considered
1520 		 *    "assigned to an interface" in the traditional
1521 		 *    sense, unless it is also flagged as optimistic.
1522 		 * - Candidate Source Address (section 4)
1523 		 *  - In any case, anycast addresses, multicast
1524 		 *    addresses, and the unspecified address MUST
1525 		 *    NOT be included in a candidate set.
1526 		 */
1527 		if ((score->ifa->flags & IFA_F_TENTATIVE) &&
1528 		    (!(score->ifa->flags & IFA_F_OPTIMISTIC)))
1529 			continue;
1530 
1531 		score->addr_type = __ipv6_addr_type(&score->ifa->addr);
1532 
1533 		if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
1534 			     score->addr_type & IPV6_ADDR_MULTICAST)) {
1535 			net_dbg_ratelimited("ADDRCONF: unspecified / multicast address assigned as unicast address on %s",
1536 					    idev->dev->name);
1537 			continue;
1538 		}
1539 
1540 		score->rule = -1;
1541 		bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
1542 
1543 		for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
1544 			int minihiscore, miniscore;
1545 
1546 			minihiscore = ipv6_get_saddr_eval(net, hiscore, dst, i);
1547 			miniscore = ipv6_get_saddr_eval(net, score, dst, i);
1548 
1549 			if (minihiscore > miniscore) {
1550 				if (i == IPV6_SADDR_RULE_SCOPE &&
1551 				    score->scopedist > 0) {
1552 					/*
1553 					 * special case:
1554 					 * each remaining entry
1555 					 * has too small (not enough)
1556 					 * scope, because ifa entries
1557 					 * are sorted by their scope
1558 					 * values.
1559 					 */
1560 					goto out;
1561 				}
1562 				break;
1563 			} else if (minihiscore < miniscore) {
1564 				if (hiscore->ifa)
1565 					in6_ifa_put(hiscore->ifa);
1566 
1567 				in6_ifa_hold(score->ifa);
1568 
1569 				swap(hiscore, score);
1570 				hiscore_idx = 1 - hiscore_idx;
1571 
1572 				/* restore our iterator */
1573 				score->ifa = hiscore->ifa;
1574 
1575 				break;
1576 			}
1577 		}
1578 	}
1579 out:
1580 	read_unlock_bh(&idev->lock);
1581 	return hiscore_idx;
1582 }
1583 
1584 static int ipv6_get_saddr_master(struct net *net,
1585 				 const struct net_device *dst_dev,
1586 				 const struct net_device *master,
1587 				 struct ipv6_saddr_dst *dst,
1588 				 struct ipv6_saddr_score *scores,
1589 				 int hiscore_idx)
1590 {
1591 	struct inet6_dev *idev;
1592 
1593 	idev = __in6_dev_get(dst_dev);
1594 	if (idev)
1595 		hiscore_idx = __ipv6_dev_get_saddr(net, dst, idev,
1596 						   scores, hiscore_idx);
1597 
1598 	idev = __in6_dev_get(master);
1599 	if (idev)
1600 		hiscore_idx = __ipv6_dev_get_saddr(net, dst, idev,
1601 						   scores, hiscore_idx);
1602 
1603 	return hiscore_idx;
1604 }
1605 
1606 int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
1607 		       const struct in6_addr *daddr, unsigned int prefs,
1608 		       struct in6_addr *saddr)
1609 {
1610 	struct ipv6_saddr_score scores[2], *hiscore;
1611 	struct ipv6_saddr_dst dst;
1612 	struct inet6_dev *idev;
1613 	struct net_device *dev;
1614 	int dst_type;
1615 	bool use_oif_addr = false;
1616 	int hiscore_idx = 0;
1617 
1618 	dst_type = __ipv6_addr_type(daddr);
1619 	dst.addr = daddr;
1620 	dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
1621 	dst.scope = __ipv6_addr_src_scope(dst_type);
1622 	dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);
1623 	dst.prefs = prefs;
1624 
1625 	scores[hiscore_idx].rule = -1;
1626 	scores[hiscore_idx].ifa = NULL;
1627 
1628 	rcu_read_lock();
1629 
1630 	/* Candidate Source Address (section 4)
1631 	 *  - multicast and link-local destination address,
1632 	 *    the set of candidate source address MUST only
1633 	 *    include addresses assigned to interfaces
1634 	 *    belonging to the same link as the outgoing
1635 	 *    interface.
1636 	 * (- For site-local destination addresses, the
1637 	 *    set of candidate source addresses MUST only
1638 	 *    include addresses assigned to interfaces
1639 	 *    belonging to the same site as the outgoing
1640 	 *    interface.)
1641 	 *  - "It is RECOMMENDED that the candidate source addresses
1642 	 *    be the set of unicast addresses assigned to the
1643 	 *    interface that will be used to send to the destination
1644 	 *    (the 'outgoing' interface)." (RFC 6724)
1645 	 */
1646 	if (dst_dev) {
1647 		idev = __in6_dev_get(dst_dev);
1648 		if ((dst_type & IPV6_ADDR_MULTICAST) ||
1649 		    dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL ||
1650 		    (idev && idev->cnf.use_oif_addrs_only)) {
1651 			use_oif_addr = true;
1652 		}
1653 	}
1654 
1655 	if (use_oif_addr) {
1656 		if (idev)
1657 			hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
1658 	} else {
1659 		const struct net_device *master;
1660 		int master_idx = 0;
1661 
1662 		/* if dst_dev exists and is enslaved to an L3 device, then
1663 		 * prefer addresses from dst_dev and then the master over
1664 		 * any other enslaved devices in the L3 domain.
1665 		 */
1666 		master = l3mdev_master_dev_rcu(dst_dev);
1667 		if (master) {
1668 			master_idx = master->ifindex;
1669 
1670 			hiscore_idx = ipv6_get_saddr_master(net, dst_dev,
1671 							    master, &dst,
1672 							    scores, hiscore_idx);
1673 
1674 			if (scores[hiscore_idx].ifa)
1675 				goto out;
1676 		}
1677 
1678 		for_each_netdev_rcu(net, dev) {
1679 			/* only consider addresses on devices in the
1680 			 * same L3 domain
1681 			 */
1682 			if (l3mdev_master_ifindex_rcu(dev) != master_idx)
1683 				continue;
1684 			idev = __in6_dev_get(dev);
1685 			if (!idev)
1686 				continue;
1687 			hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
1688 		}
1689 	}
1690 
1691 out:
1692 	rcu_read_unlock();
1693 
1694 	hiscore = &scores[hiscore_idx];
1695 	if (!hiscore->ifa)
1696 		return -EADDRNOTAVAIL;
1697 
1698 	*saddr = hiscore->ifa->addr;
1699 	in6_ifa_put(hiscore->ifa);
1700 	return 0;
1701 }
1702 EXPORT_SYMBOL(ipv6_dev_get_saddr);
1703 
1704 int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
1705 		      u32 banned_flags)
1706 {
1707 	struct inet6_ifaddr *ifp;
1708 	int err = -EADDRNOTAVAIL;
1709 
1710 	list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
1711 		if (ifp->scope > IFA_LINK)
1712 			break;
1713 		if (ifp->scope == IFA_LINK &&
1714 		    !(ifp->flags & banned_flags)) {
1715 			*addr = ifp->addr;
1716 			err = 0;
1717 			break;
1718 		}
1719 	}
1720 	return err;
1721 }
1722 
1723 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
1724 		    u32 banned_flags)
1725 {
1726 	struct inet6_dev *idev;
1727 	int err = -EADDRNOTAVAIL;
1728 
1729 	rcu_read_lock();
1730 	idev = __in6_dev_get(dev);
1731 	if (idev) {
1732 		read_lock_bh(&idev->lock);
1733 		err = __ipv6_get_lladdr(idev, addr, banned_flags);
1734 		read_unlock_bh(&idev->lock);
1735 	}
1736 	rcu_read_unlock();
1737 	return err;
1738 }
1739 
1740 static int ipv6_count_addresses(struct inet6_dev *idev)
1741 {
1742 	int cnt = 0;
1743 	struct inet6_ifaddr *ifp;
1744 
1745 	read_lock_bh(&idev->lock);
1746 	list_for_each_entry(ifp, &idev->addr_list, if_list)
1747 		cnt++;
1748 	read_unlock_bh(&idev->lock);
1749 	return cnt;
1750 }
1751 
1752 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
1753 		  const struct net_device *dev, int strict)
1754 {
1755 	return ipv6_chk_addr_and_flags(net, addr, dev, strict, IFA_F_TENTATIVE);
1756 }
1757 EXPORT_SYMBOL(ipv6_chk_addr);
1758 
1759 int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
1760 			    const struct net_device *dev, int strict,
1761 			    u32 banned_flags)
1762 {
1763 	struct inet6_ifaddr *ifp;
1764 	unsigned int hash = inet6_addr_hash(addr);
1765 	u32 ifp_flags;
1766 
1767 	rcu_read_lock_bh();
1768 	hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
1769 		if (!net_eq(dev_net(ifp->idev->dev), net))
1770 			continue;
1771 		/* Decouple optimistic from tentative for evaluation here.
1772 		 * Ban optimistic addresses explicitly, when required.
1773 		 */
1774 		ifp_flags = (ifp->flags&IFA_F_OPTIMISTIC)
1775 			    ? (ifp->flags&~IFA_F_TENTATIVE)
1776 			    : ifp->flags;
1777 		if (ipv6_addr_equal(&ifp->addr, addr) &&
1778 		    !(ifp_flags&banned_flags) &&
1779 		    (!dev || ifp->idev->dev == dev ||
1780 		     !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
1781 			rcu_read_unlock_bh();
1782 			return 1;
1783 		}
1784 	}
1785 
1786 	rcu_read_unlock_bh();
1787 	return 0;
1788 }
1789 EXPORT_SYMBOL(ipv6_chk_addr_and_flags);
1790 
1791 static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
1792 			       struct net_device *dev)
1793 {
1794 	unsigned int hash = inet6_addr_hash(addr);
1795 	struct inet6_ifaddr *ifp;
1796 
1797 	hlist_for_each_entry(ifp, &inet6_addr_lst[hash], addr_lst) {
1798 		if (!net_eq(dev_net(ifp->idev->dev), net))
1799 			continue;
1800 		if (ipv6_addr_equal(&ifp->addr, addr)) {
1801 			if (!dev || ifp->idev->dev == dev)
1802 				return true;
1803 		}
1804 	}
1805 	return false;
1806 }
1807 
1808 /* Compares an address/prefix_len with addresses on device @dev.
1809  * If one is found it returns true.
1810  */
1811 bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
1812 	const unsigned int prefix_len, struct net_device *dev)
1813 {
1814 	struct inet6_dev *idev;
1815 	struct inet6_ifaddr *ifa;
1816 	bool ret = false;
1817 
1818 	rcu_read_lock();
1819 	idev = __in6_dev_get(dev);
1820 	if (idev) {
1821 		read_lock_bh(&idev->lock);
1822 		list_for_each_entry(ifa, &idev->addr_list, if_list) {
1823 			ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
1824 			if (ret)
1825 				break;
1826 		}
1827 		read_unlock_bh(&idev->lock);
1828 	}
1829 	rcu_read_unlock();
1830 
1831 	return ret;
1832 }
1833 EXPORT_SYMBOL(ipv6_chk_custom_prefix);
1834 
1835 int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
1836 {
1837 	struct inet6_dev *idev;
1838 	struct inet6_ifaddr *ifa;
1839 	int	onlink;
1840 
1841 	onlink = 0;
1842 	rcu_read_lock();
1843 	idev = __in6_dev_get(dev);
1844 	if (idev) {
1845 		read_lock_bh(&idev->lock);
1846 		list_for_each_entry(ifa, &idev->addr_list, if_list) {
1847 			onlink = ipv6_prefix_equal(addr, &ifa->addr,
1848 						   ifa->prefix_len);
1849 			if (onlink)
1850 				break;
1851 		}
1852 		read_unlock_bh(&idev->lock);
1853 	}
1854 	rcu_read_unlock();
1855 	return onlink;
1856 }
1857 EXPORT_SYMBOL(ipv6_chk_prefix);
1858 
1859 struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,
1860 				     struct net_device *dev, int strict)
1861 {
1862 	struct inet6_ifaddr *ifp, *result = NULL;
1863 	unsigned int hash = inet6_addr_hash(addr);
1864 
1865 	rcu_read_lock_bh();
1866 	hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
1867 		if (!net_eq(dev_net(ifp->idev->dev), net))
1868 			continue;
1869 		if (ipv6_addr_equal(&ifp->addr, addr)) {
1870 			if (!dev || ifp->idev->dev == dev ||
1871 			    !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {
1872 				result = ifp;
1873 				in6_ifa_hold(ifp);
1874 				break;
1875 			}
1876 		}
1877 	}
1878 	rcu_read_unlock_bh();
1879 
1880 	return result;
1881 }
1882 
1883 /* Gets referenced address, destroys ifaddr */
1884 
1885 static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
1886 {
1887 	if (dad_failed)
1888 		ifp->flags |= IFA_F_DADFAILED;
1889 
1890 	if (ifp->flags&IFA_F_PERMANENT) {
1891 		spin_lock_bh(&ifp->lock);
1892 		addrconf_del_dad_work(ifp);
1893 		ifp->flags |= IFA_F_TENTATIVE;
1894 		spin_unlock_bh(&ifp->lock);
1895 		if (dad_failed)
1896 			ipv6_ifa_notify(0, ifp);
1897 		in6_ifa_put(ifp);
1898 	} else if (ifp->flags&IFA_F_TEMPORARY) {
1899 		struct inet6_ifaddr *ifpub;
1900 		spin_lock_bh(&ifp->lock);
1901 		ifpub = ifp->ifpub;
1902 		if (ifpub) {
1903 			in6_ifa_hold(ifpub);
1904 			spin_unlock_bh(&ifp->lock);
1905 			ipv6_create_tempaddr(ifpub, ifp);
1906 			in6_ifa_put(ifpub);
1907 		} else {
1908 			spin_unlock_bh(&ifp->lock);
1909 		}
1910 		ipv6_del_addr(ifp);
1911 	} else {
1912 		ipv6_del_addr(ifp);
1913 	}
1914 }
1915 
1916 static int addrconf_dad_end(struct inet6_ifaddr *ifp)
1917 {
1918 	int err = -ENOENT;
1919 
1920 	spin_lock_bh(&ifp->lock);
1921 	if (ifp->state == INET6_IFADDR_STATE_DAD) {
1922 		ifp->state = INET6_IFADDR_STATE_POSTDAD;
1923 		err = 0;
1924 	}
1925 	spin_unlock_bh(&ifp->lock);
1926 
1927 	return err;
1928 }
1929 
1930 void addrconf_dad_failure(struct inet6_ifaddr *ifp)
1931 {
1932 	struct inet6_dev *idev = ifp->idev;
1933 	struct net *net = dev_net(ifp->idev->dev);
1934 
1935 	if (addrconf_dad_end(ifp)) {
1936 		in6_ifa_put(ifp);
1937 		return;
1938 	}
1939 
1940 	net_info_ratelimited("%s: IPv6 duplicate address %pI6c detected!\n",
1941 			     ifp->idev->dev->name, &ifp->addr);
1942 
1943 	spin_lock_bh(&ifp->lock);
1944 
1945 	if (ifp->flags & IFA_F_STABLE_PRIVACY) {
1946 		int scope = ifp->scope;
1947 		u32 flags = ifp->flags;
1948 		struct in6_addr new_addr;
1949 		struct inet6_ifaddr *ifp2;
1950 		u32 valid_lft, preferred_lft;
1951 		int pfxlen = ifp->prefix_len;
1952 		int retries = ifp->stable_privacy_retry + 1;
1953 
1954 		if (retries > net->ipv6.sysctl.idgen_retries) {
1955 			net_info_ratelimited("%s: privacy stable address generation failed because of DAD conflicts!\n",
1956 					     ifp->idev->dev->name);
1957 			goto errdad;
1958 		}
1959 
1960 		new_addr = ifp->addr;
1961 		if (ipv6_generate_stable_address(&new_addr, retries,
1962 						 idev))
1963 			goto errdad;
1964 
1965 		valid_lft = ifp->valid_lft;
1966 		preferred_lft = ifp->prefered_lft;
1967 
1968 		spin_unlock_bh(&ifp->lock);
1969 
1970 		if (idev->cnf.max_addresses &&
1971 		    ipv6_count_addresses(idev) >=
1972 		    idev->cnf.max_addresses)
1973 			goto lock_errdad;
1974 
1975 		net_info_ratelimited("%s: generating new stable privacy address because of DAD conflict\n",
1976 				     ifp->idev->dev->name);
1977 
1978 		ifp2 = ipv6_add_addr(idev, &new_addr, NULL, pfxlen,
1979 				     scope, flags, valid_lft,
1980 				     preferred_lft);
1981 		if (IS_ERR(ifp2))
1982 			goto lock_errdad;
1983 
1984 		spin_lock_bh(&ifp2->lock);
1985 		ifp2->stable_privacy_retry = retries;
1986 		ifp2->state = INET6_IFADDR_STATE_PREDAD;
1987 		spin_unlock_bh(&ifp2->lock);
1988 
1989 		addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
1990 		in6_ifa_put(ifp2);
1991 lock_errdad:
1992 		spin_lock_bh(&ifp->lock);
1993 	}
1994 
1995 errdad:
1996 	/* transition from _POSTDAD to _ERRDAD */
1997 	ifp->state = INET6_IFADDR_STATE_ERRDAD;
1998 	spin_unlock_bh(&ifp->lock);
1999 
2000 	addrconf_mod_dad_work(ifp, 0);
2001 	in6_ifa_put(ifp);
2002 }
2003 
2004 /* Join to solicited addr multicast group.
2005  * caller must hold RTNL */
2006 void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
2007 {
2008 	struct in6_addr maddr;
2009 
2010 	if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
2011 		return;
2012 
2013 	addrconf_addr_solict_mult(addr, &maddr);
2014 	ipv6_dev_mc_inc(dev, &maddr);
2015 }
2016 
2017 /* caller must hold RTNL */
2018 void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
2019 {
2020 	struct in6_addr maddr;
2021 
2022 	if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
2023 		return;
2024 
2025 	addrconf_addr_solict_mult(addr, &maddr);
2026 	__ipv6_dev_mc_dec(idev, &maddr);
2027 }
2028 
2029 /* caller must hold RTNL */
2030 static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
2031 {
2032 	struct in6_addr addr;
2033 
2034 	if (ifp->prefix_len >= 127) /* RFC 6164 */
2035 		return;
2036 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
2037 	if (ipv6_addr_any(&addr))
2038 		return;
2039 	__ipv6_dev_ac_inc(ifp->idev, &addr);
2040 }
2041 
2042 /* caller must hold RTNL */
2043 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
2044 {
2045 	struct in6_addr addr;
2046 
2047 	if (ifp->prefix_len >= 127) /* RFC 6164 */
2048 		return;
2049 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
2050 	if (ipv6_addr_any(&addr))
2051 		return;
2052 	__ipv6_dev_ac_dec(ifp->idev, &addr);
2053 }
2054 
2055 static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
2056 {
2057 	if (dev->addr_len != EUI64_ADDR_LEN)
2058 		return -1;
2059 	memcpy(eui, dev->dev_addr, EUI64_ADDR_LEN);
2060 	eui[0] ^= 2;
2061 	return 0;
2062 }
2063 
2064 static int addrconf_ifid_ieee1394(u8 *eui, struct net_device *dev)
2065 {
2066 	union fwnet_hwaddr *ha;
2067 
2068 	if (dev->addr_len != FWNET_ALEN)
2069 		return -1;
2070 
2071 	ha = (union fwnet_hwaddr *)dev->dev_addr;
2072 
2073 	memcpy(eui, &ha->uc.uniq_id, sizeof(ha->uc.uniq_id));
2074 	eui[0] ^= 2;
2075 	return 0;
2076 }
2077 
2078 static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
2079 {
2080 	/* XXX: inherit EUI-64 from other interface -- yoshfuji */
2081 	if (dev->addr_len != ARCNET_ALEN)
2082 		return -1;
2083 	memset(eui, 0, 7);
2084 	eui[7] = *(u8 *)dev->dev_addr;
2085 	return 0;
2086 }
2087 
2088 static int addrconf_ifid_infiniband(u8 *eui, struct net_device *dev)
2089 {
2090 	if (dev->addr_len != INFINIBAND_ALEN)
2091 		return -1;
2092 	memcpy(eui, dev->dev_addr + 12, 8);
2093 	eui[0] |= 2;
2094 	return 0;
2095 }
2096 
2097 static int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
2098 {
2099 	if (addr == 0)
2100 		return -1;
2101 	eui[0] = (ipv4_is_zeronet(addr) || ipv4_is_private_10(addr) ||
2102 		  ipv4_is_loopback(addr) || ipv4_is_linklocal_169(addr) ||
2103 		  ipv4_is_private_172(addr) || ipv4_is_test_192(addr) ||
2104 		  ipv4_is_anycast_6to4(addr) || ipv4_is_private_192(addr) ||
2105 		  ipv4_is_test_198(addr) || ipv4_is_multicast(addr) ||
2106 		  ipv4_is_lbcast(addr)) ? 0x00 : 0x02;
2107 	eui[1] = 0;
2108 	eui[2] = 0x5E;
2109 	eui[3] = 0xFE;
2110 	memcpy(eui + 4, &addr, 4);
2111 	return 0;
2112 }
2113 
2114 static int addrconf_ifid_sit(u8 *eui, struct net_device *dev)
2115 {
2116 	if (dev->priv_flags & IFF_ISATAP)
2117 		return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
2118 	return -1;
2119 }
2120 
2121 static int addrconf_ifid_gre(u8 *eui, struct net_device *dev)
2122 {
2123 	return __ipv6_isatap_ifid(eui, *(__be32 *)dev->dev_addr);
2124 }
2125 
2126 static int addrconf_ifid_ip6tnl(u8 *eui, struct net_device *dev)
2127 {
2128 	memcpy(eui, dev->perm_addr, 3);
2129 	memcpy(eui + 5, dev->perm_addr + 3, 3);
2130 	eui[3] = 0xFF;
2131 	eui[4] = 0xFE;
2132 	eui[0] ^= 2;
2133 	return 0;
2134 }
2135 
2136 static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
2137 {
2138 	switch (dev->type) {
2139 	case ARPHRD_ETHER:
2140 	case ARPHRD_FDDI:
2141 		return addrconf_ifid_eui48(eui, dev);
2142 	case ARPHRD_ARCNET:
2143 		return addrconf_ifid_arcnet(eui, dev);
2144 	case ARPHRD_INFINIBAND:
2145 		return addrconf_ifid_infiniband(eui, dev);
2146 	case ARPHRD_SIT:
2147 		return addrconf_ifid_sit(eui, dev);
2148 	case ARPHRD_IPGRE:
2149 	case ARPHRD_TUNNEL:
2150 		return addrconf_ifid_gre(eui, dev);
2151 	case ARPHRD_6LOWPAN:
2152 		return addrconf_ifid_eui64(eui, dev);
2153 	case ARPHRD_IEEE1394:
2154 		return addrconf_ifid_ieee1394(eui, dev);
2155 	case ARPHRD_TUNNEL6:
2156 	case ARPHRD_IP6GRE:
2157 		return addrconf_ifid_ip6tnl(eui, dev);
2158 	}
2159 	return -1;
2160 }
2161 
2162 static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
2163 {
2164 	int err = -1;
2165 	struct inet6_ifaddr *ifp;
2166 
2167 	read_lock_bh(&idev->lock);
2168 	list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
2169 		if (ifp->scope > IFA_LINK)
2170 			break;
2171 		if (ifp->scope == IFA_LINK && !(ifp->flags&IFA_F_TENTATIVE)) {
2172 			memcpy(eui, ifp->addr.s6_addr+8, 8);
2173 			err = 0;
2174 			break;
2175 		}
2176 	}
2177 	read_unlock_bh(&idev->lock);
2178 	return err;
2179 }
2180 
2181 /* (re)generation of randomized interface identifier (RFC 3041 3.2, 3.5) */
2182 static void ipv6_regen_rndid(struct inet6_dev *idev)
2183 {
2184 regen:
2185 	get_random_bytes(idev->rndid, sizeof(idev->rndid));
2186 	idev->rndid[0] &= ~0x02;
2187 
2188 	/*
2189 	 * <draft-ietf-ipngwg-temp-addresses-v2-00.txt>:
2190 	 * check if generated address is not inappropriate
2191 	 *
2192 	 *  - Reserved subnet anycast (RFC 2526)
2193 	 *	11111101 11....11 1xxxxxxx
2194 	 *  - ISATAP (RFC4214) 6.1
2195 	 *	00-00-5E-FE-xx-xx-xx-xx
2196 	 *  - value 0
2197 	 *  - XXX: already assigned to an address on the device
2198 	 */
2199 	if (idev->rndid[0] == 0xfd &&
2200 	    (idev->rndid[1]&idev->rndid[2]&idev->rndid[3]&idev->rndid[4]&idev->rndid[5]&idev->rndid[6]) == 0xff &&
2201 	    (idev->rndid[7]&0x80))
2202 		goto regen;
2203 	if ((idev->rndid[0]|idev->rndid[1]) == 0) {
2204 		if (idev->rndid[2] == 0x5e && idev->rndid[3] == 0xfe)
2205 			goto regen;
2206 		if ((idev->rndid[2]|idev->rndid[3]|idev->rndid[4]|idev->rndid[5]|idev->rndid[6]|idev->rndid[7]) == 0x00)
2207 			goto regen;
2208 	}
2209 }
2210 
2211 static void  ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr)
2212 {
2213 	if (tmpaddr && memcmp(idev->rndid, &tmpaddr->s6_addr[8], 8) == 0)
2214 		ipv6_regen_rndid(idev);
2215 }
2216 
2217 /*
2218  *	Add prefix route.
2219  */
2220 
2221 static void
2222 addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
2223 		      unsigned long expires, u32 flags)
2224 {
2225 	struct fib6_config cfg = {
2226 		.fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_PREFIX,
2227 		.fc_metric = IP6_RT_PRIO_ADDRCONF,
2228 		.fc_ifindex = dev->ifindex,
2229 		.fc_expires = expires,
2230 		.fc_dst_len = plen,
2231 		.fc_flags = RTF_UP | flags,
2232 		.fc_nlinfo.nl_net = dev_net(dev),
2233 		.fc_protocol = RTPROT_KERNEL,
2234 	};
2235 
2236 	cfg.fc_dst = *pfx;
2237 
2238 	/* Prevent useless cloning on PtP SIT.
2239 	   This thing is done here expecting that the whole
2240 	   class of non-broadcast devices need not cloning.
2241 	 */
2242 #if IS_ENABLED(CONFIG_IPV6_SIT)
2243 	if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
2244 		cfg.fc_flags |= RTF_NONEXTHOP;
2245 #endif
2246 
2247 	ip6_route_add(&cfg);
2248 }
2249 
2250 
2251 static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
2252 						  int plen,
2253 						  const struct net_device *dev,
2254 						  u32 flags, u32 noflags)
2255 {
2256 	struct fib6_node *fn;
2257 	struct rt6_info *rt = NULL;
2258 	struct fib6_table *table;
2259 	u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_PREFIX;
2260 
2261 	table = fib6_get_table(dev_net(dev), tb_id);
2262 	if (!table)
2263 		return NULL;
2264 
2265 	read_lock_bh(&table->tb6_lock);
2266 	fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0);
2267 	if (!fn)
2268 		goto out;
2269 
2270 	noflags |= RTF_CACHE;
2271 	for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
2272 		if (rt->dst.dev->ifindex != dev->ifindex)
2273 			continue;
2274 		if ((rt->rt6i_flags & flags) != flags)
2275 			continue;
2276 		if ((rt->rt6i_flags & noflags) != 0)
2277 			continue;
2278 		dst_hold(&rt->dst);
2279 		break;
2280 	}
2281 out:
2282 	read_unlock_bh(&table->tb6_lock);
2283 	return rt;
2284 }
2285 
2286 
2287 /* Create "default" multicast route to the interface */
2288 
2289 static void addrconf_add_mroute(struct net_device *dev)
2290 {
2291 	struct fib6_config cfg = {
2292 		.fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_LOCAL,
2293 		.fc_metric = IP6_RT_PRIO_ADDRCONF,
2294 		.fc_ifindex = dev->ifindex,
2295 		.fc_dst_len = 8,
2296 		.fc_flags = RTF_UP,
2297 		.fc_nlinfo.nl_net = dev_net(dev),
2298 	};
2299 
2300 	ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
2301 
2302 	ip6_route_add(&cfg);
2303 }
2304 
2305 static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
2306 {
2307 	struct inet6_dev *idev;
2308 
2309 	ASSERT_RTNL();
2310 
2311 	idev = ipv6_find_idev(dev);
2312 	if (!idev)
2313 		return ERR_PTR(-ENOBUFS);
2314 
2315 	if (idev->cnf.disable_ipv6)
2316 		return ERR_PTR(-EACCES);
2317 
2318 	/* Add default multicast route */
2319 	if (!(dev->flags & IFF_LOOPBACK) && !netif_is_l3_master(dev))
2320 		addrconf_add_mroute(dev);
2321 
2322 	return idev;
2323 }
2324 
2325 static void manage_tempaddrs(struct inet6_dev *idev,
2326 			     struct inet6_ifaddr *ifp,
2327 			     __u32 valid_lft, __u32 prefered_lft,
2328 			     bool create, unsigned long now)
2329 {
2330 	u32 flags;
2331 	struct inet6_ifaddr *ift;
2332 
2333 	read_lock_bh(&idev->lock);
2334 	/* update all temporary addresses in the list */
2335 	list_for_each_entry(ift, &idev->tempaddr_list, tmp_list) {
2336 		int age, max_valid, max_prefered;
2337 
2338 		if (ifp != ift->ifpub)
2339 			continue;
2340 
2341 		/* RFC 4941 section 3.3:
2342 		 * If a received option will extend the lifetime of a public
2343 		 * address, the lifetimes of temporary addresses should
2344 		 * be extended, subject to the overall constraint that no
2345 		 * temporary addresses should ever remain "valid" or "preferred"
2346 		 * for a time longer than (TEMP_VALID_LIFETIME) or
2347 		 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR), respectively.
2348 		 */
2349 		age = (now - ift->cstamp) / HZ;
2350 		max_valid = idev->cnf.temp_valid_lft - age;
2351 		if (max_valid < 0)
2352 			max_valid = 0;
2353 
2354 		max_prefered = idev->cnf.temp_prefered_lft -
2355 			       idev->desync_factor - age;
2356 		if (max_prefered < 0)
2357 			max_prefered = 0;
2358 
2359 		if (valid_lft > max_valid)
2360 			valid_lft = max_valid;
2361 
2362 		if (prefered_lft > max_prefered)
2363 			prefered_lft = max_prefered;
2364 
2365 		spin_lock(&ift->lock);
2366 		flags = ift->flags;
2367 		ift->valid_lft = valid_lft;
2368 		ift->prefered_lft = prefered_lft;
2369 		ift->tstamp = now;
2370 		if (prefered_lft > 0)
2371 			ift->flags &= ~IFA_F_DEPRECATED;
2372 
2373 		spin_unlock(&ift->lock);
2374 		if (!(flags&IFA_F_TENTATIVE))
2375 			ipv6_ifa_notify(0, ift);
2376 	}
2377 
2378 	if ((create || list_empty(&idev->tempaddr_list)) &&
2379 	    idev->cnf.use_tempaddr > 0) {
2380 		/* When a new public address is created as described
2381 		 * in [ADDRCONF], also create a new temporary address.
2382 		 * Also create a temporary address if it's enabled but
2383 		 * no temporary address currently exists.
2384 		 */
2385 		read_unlock_bh(&idev->lock);
2386 		ipv6_create_tempaddr(ifp, NULL);
2387 	} else {
2388 		read_unlock_bh(&idev->lock);
2389 	}
2390 }
2391 
2392 static bool is_addr_mode_generate_stable(struct inet6_dev *idev)
2393 {
2394 	return idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_STABLE_PRIVACY ||
2395 	       idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_RANDOM;
2396 }
2397 
2398 int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,
2399 				 const struct prefix_info *pinfo,
2400 				 struct inet6_dev *in6_dev,
2401 				 const struct in6_addr *addr, int addr_type,
2402 				 u32 addr_flags, bool sllao, bool tokenized,
2403 				 __u32 valid_lft, u32 prefered_lft)
2404 {
2405 	struct inet6_ifaddr *ifp = ipv6_get_ifaddr(net, addr, dev, 1);
2406 	int create = 0, update_lft = 0;
2407 
2408 	if (!ifp && valid_lft) {
2409 		int max_addresses = in6_dev->cnf.max_addresses;
2410 
2411 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
2412 		if (in6_dev->cnf.optimistic_dad &&
2413 		    !net->ipv6.devconf_all->forwarding && sllao)
2414 			addr_flags |= IFA_F_OPTIMISTIC;
2415 #endif
2416 
2417 		/* Do not allow to create too much of autoconfigured
2418 		 * addresses; this would be too easy way to crash kernel.
2419 		 */
2420 		if (!max_addresses ||
2421 		    ipv6_count_addresses(in6_dev) < max_addresses)
2422 			ifp = ipv6_add_addr(in6_dev, addr, NULL,
2423 					    pinfo->prefix_len,
2424 					    addr_type&IPV6_ADDR_SCOPE_MASK,
2425 					    addr_flags, valid_lft,
2426 					    prefered_lft);
2427 
2428 		if (IS_ERR_OR_NULL(ifp))
2429 			return -1;
2430 
2431 		update_lft = 0;
2432 		create = 1;
2433 		spin_lock_bh(&ifp->lock);
2434 		ifp->flags |= IFA_F_MANAGETEMPADDR;
2435 		ifp->cstamp = jiffies;
2436 		ifp->tokenized = tokenized;
2437 		spin_unlock_bh(&ifp->lock);
2438 		addrconf_dad_start(ifp);
2439 	}
2440 
2441 	if (ifp) {
2442 		u32 flags;
2443 		unsigned long now;
2444 		u32 stored_lft;
2445 
2446 		/* update lifetime (RFC2462 5.5.3 e) */
2447 		spin_lock_bh(&ifp->lock);
2448 		now = jiffies;
2449 		if (ifp->valid_lft > (now - ifp->tstamp) / HZ)
2450 			stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
2451 		else
2452 			stored_lft = 0;
2453 		if (!update_lft && !create && stored_lft) {
2454 			const u32 minimum_lft = min_t(u32,
2455 				stored_lft, MIN_VALID_LIFETIME);
2456 			valid_lft = max(valid_lft, minimum_lft);
2457 
2458 			/* RFC4862 Section 5.5.3e:
2459 			 * "Note that the preferred lifetime of the
2460 			 *  corresponding address is always reset to
2461 			 *  the Preferred Lifetime in the received
2462 			 *  Prefix Information option, regardless of
2463 			 *  whether the valid lifetime is also reset or
2464 			 *  ignored."
2465 			 *
2466 			 * So we should always update prefered_lft here.
2467 			 */
2468 			update_lft = 1;
2469 		}
2470 
2471 		if (update_lft) {
2472 			ifp->valid_lft = valid_lft;
2473 			ifp->prefered_lft = prefered_lft;
2474 			ifp->tstamp = now;
2475 			flags = ifp->flags;
2476 			ifp->flags &= ~IFA_F_DEPRECATED;
2477 			spin_unlock_bh(&ifp->lock);
2478 
2479 			if (!(flags&IFA_F_TENTATIVE))
2480 				ipv6_ifa_notify(0, ifp);
2481 		} else
2482 			spin_unlock_bh(&ifp->lock);
2483 
2484 		manage_tempaddrs(in6_dev, ifp, valid_lft, prefered_lft,
2485 				 create, now);
2486 
2487 		in6_ifa_put(ifp);
2488 		addrconf_verify();
2489 	}
2490 
2491 	return 0;
2492 }
2493 EXPORT_SYMBOL_GPL(addrconf_prefix_rcv_add_addr);
2494 
2495 void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
2496 {
2497 	struct prefix_info *pinfo;
2498 	__u32 valid_lft;
2499 	__u32 prefered_lft;
2500 	int addr_type, err;
2501 	u32 addr_flags = 0;
2502 	struct inet6_dev *in6_dev;
2503 	struct net *net = dev_net(dev);
2504 
2505 	pinfo = (struct prefix_info *) opt;
2506 
2507 	if (len < sizeof(struct prefix_info)) {
2508 		ADBG("addrconf: prefix option too short\n");
2509 		return;
2510 	}
2511 
2512 	/*
2513 	 *	Validation checks ([ADDRCONF], page 19)
2514 	 */
2515 
2516 	addr_type = ipv6_addr_type(&pinfo->prefix);
2517 
2518 	if (addr_type & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL))
2519 		return;
2520 
2521 	valid_lft = ntohl(pinfo->valid);
2522 	prefered_lft = ntohl(pinfo->prefered);
2523 
2524 	if (prefered_lft > valid_lft) {
2525 		net_warn_ratelimited("addrconf: prefix option has invalid lifetime\n");
2526 		return;
2527 	}
2528 
2529 	in6_dev = in6_dev_get(dev);
2530 
2531 	if (!in6_dev) {
2532 		net_dbg_ratelimited("addrconf: device %s not configured\n",
2533 				    dev->name);
2534 		return;
2535 	}
2536 
2537 	/*
2538 	 *	Two things going on here:
2539 	 *	1) Add routes for on-link prefixes
2540 	 *	2) Configure prefixes with the auto flag set
2541 	 */
2542 
2543 	if (pinfo->onlink) {
2544 		struct rt6_info *rt;
2545 		unsigned long rt_expires;
2546 
2547 		/* Avoid arithmetic overflow. Really, we could
2548 		 * save rt_expires in seconds, likely valid_lft,
2549 		 * but it would require division in fib gc, that it
2550 		 * not good.
2551 		 */
2552 		if (HZ > USER_HZ)
2553 			rt_expires = addrconf_timeout_fixup(valid_lft, HZ);
2554 		else
2555 			rt_expires = addrconf_timeout_fixup(valid_lft, USER_HZ);
2556 
2557 		if (addrconf_finite_timeout(rt_expires))
2558 			rt_expires *= HZ;
2559 
2560 		rt = addrconf_get_prefix_route(&pinfo->prefix,
2561 					       pinfo->prefix_len,
2562 					       dev,
2563 					       RTF_ADDRCONF | RTF_PREFIX_RT,
2564 					       RTF_GATEWAY | RTF_DEFAULT);
2565 
2566 		if (rt) {
2567 			/* Autoconf prefix route */
2568 			if (valid_lft == 0) {
2569 				ip6_del_rt(rt);
2570 				rt = NULL;
2571 			} else if (addrconf_finite_timeout(rt_expires)) {
2572 				/* not infinity */
2573 				rt6_set_expires(rt, jiffies + rt_expires);
2574 			} else {
2575 				rt6_clean_expires(rt);
2576 			}
2577 		} else if (valid_lft) {
2578 			clock_t expires = 0;
2579 			int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
2580 			if (addrconf_finite_timeout(rt_expires)) {
2581 				/* not infinity */
2582 				flags |= RTF_EXPIRES;
2583 				expires = jiffies_to_clock_t(rt_expires);
2584 			}
2585 			addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
2586 					      dev, expires, flags);
2587 		}
2588 		ip6_rt_put(rt);
2589 	}
2590 
2591 	/* Try to figure out our local address for this prefix */
2592 
2593 	if (pinfo->autoconf && in6_dev->cnf.autoconf) {
2594 		struct in6_addr addr;
2595 		bool tokenized = false, dev_addr_generated = false;
2596 
2597 		if (pinfo->prefix_len == 64) {
2598 			memcpy(&addr, &pinfo->prefix, 8);
2599 
2600 			if (!ipv6_addr_any(&in6_dev->token)) {
2601 				read_lock_bh(&in6_dev->lock);
2602 				memcpy(addr.s6_addr + 8,
2603 				       in6_dev->token.s6_addr + 8, 8);
2604 				read_unlock_bh(&in6_dev->lock);
2605 				tokenized = true;
2606 			} else if (is_addr_mode_generate_stable(in6_dev) &&
2607 				   !ipv6_generate_stable_address(&addr, 0,
2608 								 in6_dev)) {
2609 				addr_flags |= IFA_F_STABLE_PRIVACY;
2610 				goto ok;
2611 			} else if (ipv6_generate_eui64(addr.s6_addr + 8, dev) &&
2612 				   ipv6_inherit_eui64(addr.s6_addr + 8, in6_dev)) {
2613 				goto put;
2614 			} else {
2615 				dev_addr_generated = true;
2616 			}
2617 			goto ok;
2618 		}
2619 		net_dbg_ratelimited("IPv6 addrconf: prefix with wrong length %d\n",
2620 				    pinfo->prefix_len);
2621 		goto put;
2622 
2623 ok:
2624 		err = addrconf_prefix_rcv_add_addr(net, dev, pinfo, in6_dev,
2625 						   &addr, addr_type,
2626 						   addr_flags, sllao,
2627 						   tokenized, valid_lft,
2628 						   prefered_lft);
2629 		if (err)
2630 			goto put;
2631 
2632 		/* Ignore error case here because previous prefix add addr was
2633 		 * successful which will be notified.
2634 		 */
2635 		ndisc_ops_prefix_rcv_add_addr(net, dev, pinfo, in6_dev, &addr,
2636 					      addr_type, addr_flags, sllao,
2637 					      tokenized, valid_lft,
2638 					      prefered_lft,
2639 					      dev_addr_generated);
2640 	}
2641 	inet6_prefix_notify(RTM_NEWPREFIX, in6_dev, pinfo);
2642 put:
2643 	in6_dev_put(in6_dev);
2644 }
2645 
2646 /*
2647  *	Set destination address.
2648  *	Special case for SIT interfaces where we create a new "virtual"
2649  *	device.
2650  */
2651 int addrconf_set_dstaddr(struct net *net, void __user *arg)
2652 {
2653 	struct in6_ifreq ireq;
2654 	struct net_device *dev;
2655 	int err = -EINVAL;
2656 
2657 	rtnl_lock();
2658 
2659 	err = -EFAULT;
2660 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2661 		goto err_exit;
2662 
2663 	dev = __dev_get_by_index(net, ireq.ifr6_ifindex);
2664 
2665 	err = -ENODEV;
2666 	if (!dev)
2667 		goto err_exit;
2668 
2669 #if IS_ENABLED(CONFIG_IPV6_SIT)
2670 	if (dev->type == ARPHRD_SIT) {
2671 		const struct net_device_ops *ops = dev->netdev_ops;
2672 		struct ifreq ifr;
2673 		struct ip_tunnel_parm p;
2674 
2675 		err = -EADDRNOTAVAIL;
2676 		if (!(ipv6_addr_type(&ireq.ifr6_addr) & IPV6_ADDR_COMPATv4))
2677 			goto err_exit;
2678 
2679 		memset(&p, 0, sizeof(p));
2680 		p.iph.daddr = ireq.ifr6_addr.s6_addr32[3];
2681 		p.iph.saddr = 0;
2682 		p.iph.version = 4;
2683 		p.iph.ihl = 5;
2684 		p.iph.protocol = IPPROTO_IPV6;
2685 		p.iph.ttl = 64;
2686 		ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
2687 
2688 		if (ops->ndo_do_ioctl) {
2689 			mm_segment_t oldfs = get_fs();
2690 
2691 			set_fs(KERNEL_DS);
2692 			err = ops->ndo_do_ioctl(dev, &ifr, SIOCADDTUNNEL);
2693 			set_fs(oldfs);
2694 		} else
2695 			err = -EOPNOTSUPP;
2696 
2697 		if (err == 0) {
2698 			err = -ENOBUFS;
2699 			dev = __dev_get_by_name(net, p.name);
2700 			if (!dev)
2701 				goto err_exit;
2702 			err = dev_open(dev);
2703 		}
2704 	}
2705 #endif
2706 
2707 err_exit:
2708 	rtnl_unlock();
2709 	return err;
2710 }
2711 
2712 static int ipv6_mc_config(struct sock *sk, bool join,
2713 			  const struct in6_addr *addr, int ifindex)
2714 {
2715 	int ret;
2716 
2717 	ASSERT_RTNL();
2718 
2719 	lock_sock(sk);
2720 	if (join)
2721 		ret = ipv6_sock_mc_join(sk, ifindex, addr);
2722 	else
2723 		ret = ipv6_sock_mc_drop(sk, ifindex, addr);
2724 	release_sock(sk);
2725 
2726 	return ret;
2727 }
2728 
2729 /*
2730  *	Manual configuration of address on an interface
2731  */
2732 static int inet6_addr_add(struct net *net, int ifindex,
2733 			  const struct in6_addr *pfx,
2734 			  const struct in6_addr *peer_pfx,
2735 			  unsigned int plen, __u32 ifa_flags,
2736 			  __u32 prefered_lft, __u32 valid_lft)
2737 {
2738 	struct inet6_ifaddr *ifp;
2739 	struct inet6_dev *idev;
2740 	struct net_device *dev;
2741 	unsigned long timeout;
2742 	clock_t expires;
2743 	int scope;
2744 	u32 flags;
2745 
2746 	ASSERT_RTNL();
2747 
2748 	if (plen > 128)
2749 		return -EINVAL;
2750 
2751 	/* check the lifetime */
2752 	if (!valid_lft || prefered_lft > valid_lft)
2753 		return -EINVAL;
2754 
2755 	if (ifa_flags & IFA_F_MANAGETEMPADDR && plen != 64)
2756 		return -EINVAL;
2757 
2758 	dev = __dev_get_by_index(net, ifindex);
2759 	if (!dev)
2760 		return -ENODEV;
2761 
2762 	idev = addrconf_add_dev(dev);
2763 	if (IS_ERR(idev))
2764 		return PTR_ERR(idev);
2765 
2766 	if (ifa_flags & IFA_F_MCAUTOJOIN) {
2767 		int ret = ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2768 					 true, pfx, ifindex);
2769 
2770 		if (ret < 0)
2771 			return ret;
2772 	}
2773 
2774 	scope = ipv6_addr_scope(pfx);
2775 
2776 	timeout = addrconf_timeout_fixup(valid_lft, HZ);
2777 	if (addrconf_finite_timeout(timeout)) {
2778 		expires = jiffies_to_clock_t(timeout * HZ);
2779 		valid_lft = timeout;
2780 		flags = RTF_EXPIRES;
2781 	} else {
2782 		expires = 0;
2783 		flags = 0;
2784 		ifa_flags |= IFA_F_PERMANENT;
2785 	}
2786 
2787 	timeout = addrconf_timeout_fixup(prefered_lft, HZ);
2788 	if (addrconf_finite_timeout(timeout)) {
2789 		if (timeout == 0)
2790 			ifa_flags |= IFA_F_DEPRECATED;
2791 		prefered_lft = timeout;
2792 	}
2793 
2794 	ifp = ipv6_add_addr(idev, pfx, peer_pfx, plen, scope, ifa_flags,
2795 			    valid_lft, prefered_lft);
2796 
2797 	if (!IS_ERR(ifp)) {
2798 		if (!(ifa_flags & IFA_F_NOPREFIXROUTE)) {
2799 			addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
2800 					      expires, flags);
2801 		}
2802 
2803 		/*
2804 		 * Note that section 3.1 of RFC 4429 indicates
2805 		 * that the Optimistic flag should not be set for
2806 		 * manually configured addresses
2807 		 */
2808 		addrconf_dad_start(ifp);
2809 		if (ifa_flags & IFA_F_MANAGETEMPADDR)
2810 			manage_tempaddrs(idev, ifp, valid_lft, prefered_lft,
2811 					 true, jiffies);
2812 		in6_ifa_put(ifp);
2813 		addrconf_verify_rtnl();
2814 		return 0;
2815 	} else if (ifa_flags & IFA_F_MCAUTOJOIN) {
2816 		ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2817 			       false, pfx, ifindex);
2818 	}
2819 
2820 	return PTR_ERR(ifp);
2821 }
2822 
2823 static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,
2824 			  const struct in6_addr *pfx, unsigned int plen)
2825 {
2826 	struct inet6_ifaddr *ifp;
2827 	struct inet6_dev *idev;
2828 	struct net_device *dev;
2829 
2830 	if (plen > 128)
2831 		return -EINVAL;
2832 
2833 	dev = __dev_get_by_index(net, ifindex);
2834 	if (!dev)
2835 		return -ENODEV;
2836 
2837 	idev = __in6_dev_get(dev);
2838 	if (!idev)
2839 		return -ENXIO;
2840 
2841 	read_lock_bh(&idev->lock);
2842 	list_for_each_entry(ifp, &idev->addr_list, if_list) {
2843 		if (ifp->prefix_len == plen &&
2844 		    ipv6_addr_equal(pfx, &ifp->addr)) {
2845 			in6_ifa_hold(ifp);
2846 			read_unlock_bh(&idev->lock);
2847 
2848 			if (!(ifp->flags & IFA_F_TEMPORARY) &&
2849 			    (ifa_flags & IFA_F_MANAGETEMPADDR))
2850 				manage_tempaddrs(idev, ifp, 0, 0, false,
2851 						 jiffies);
2852 			ipv6_del_addr(ifp);
2853 			addrconf_verify_rtnl();
2854 			if (ipv6_addr_is_multicast(pfx)) {
2855 				ipv6_mc_config(net->ipv6.mc_autojoin_sk,
2856 					       false, pfx, dev->ifindex);
2857 			}
2858 			return 0;
2859 		}
2860 	}
2861 	read_unlock_bh(&idev->lock);
2862 	return -EADDRNOTAVAIL;
2863 }
2864 
2865 
2866 int addrconf_add_ifaddr(struct net *net, void __user *arg)
2867 {
2868 	struct in6_ifreq ireq;
2869 	int err;
2870 
2871 	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2872 		return -EPERM;
2873 
2874 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2875 		return -EFAULT;
2876 
2877 	rtnl_lock();
2878 	err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr, NULL,
2879 			     ireq.ifr6_prefixlen, IFA_F_PERMANENT,
2880 			     INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
2881 	rtnl_unlock();
2882 	return err;
2883 }
2884 
2885 int addrconf_del_ifaddr(struct net *net, void __user *arg)
2886 {
2887 	struct in6_ifreq ireq;
2888 	int err;
2889 
2890 	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2891 		return -EPERM;
2892 
2893 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
2894 		return -EFAULT;
2895 
2896 	rtnl_lock();
2897 	err = inet6_addr_del(net, ireq.ifr6_ifindex, 0, &ireq.ifr6_addr,
2898 			     ireq.ifr6_prefixlen);
2899 	rtnl_unlock();
2900 	return err;
2901 }
2902 
2903 static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
2904 		     int plen, int scope)
2905 {
2906 	struct inet6_ifaddr *ifp;
2907 
2908 	ifp = ipv6_add_addr(idev, addr, NULL, plen,
2909 			    scope, IFA_F_PERMANENT,
2910 			    INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
2911 	if (!IS_ERR(ifp)) {
2912 		spin_lock_bh(&ifp->lock);
2913 		ifp->flags &= ~IFA_F_TENTATIVE;
2914 		spin_unlock_bh(&ifp->lock);
2915 		rt_genid_bump_ipv6(dev_net(idev->dev));
2916 		ipv6_ifa_notify(RTM_NEWADDR, ifp);
2917 		in6_ifa_put(ifp);
2918 	}
2919 }
2920 
2921 #if IS_ENABLED(CONFIG_IPV6_SIT)
2922 static void sit_add_v4_addrs(struct inet6_dev *idev)
2923 {
2924 	struct in6_addr addr;
2925 	struct net_device *dev;
2926 	struct net *net = dev_net(idev->dev);
2927 	int scope, plen;
2928 	u32 pflags = 0;
2929 
2930 	ASSERT_RTNL();
2931 
2932 	memset(&addr, 0, sizeof(struct in6_addr));
2933 	memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4);
2934 
2935 	if (idev->dev->flags&IFF_POINTOPOINT) {
2936 		addr.s6_addr32[0] = htonl(0xfe800000);
2937 		scope = IFA_LINK;
2938 		plen = 64;
2939 	} else {
2940 		scope = IPV6_ADDR_COMPATv4;
2941 		plen = 96;
2942 		pflags |= RTF_NONEXTHOP;
2943 	}
2944 
2945 	if (addr.s6_addr32[3]) {
2946 		add_addr(idev, &addr, plen, scope);
2947 		addrconf_prefix_route(&addr, plen, idev->dev, 0, pflags);
2948 		return;
2949 	}
2950 
2951 	for_each_netdev(net, dev) {
2952 		struct in_device *in_dev = __in_dev_get_rtnl(dev);
2953 		if (in_dev && (dev->flags & IFF_UP)) {
2954 			struct in_ifaddr *ifa;
2955 
2956 			int flag = scope;
2957 
2958 			for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
2959 
2960 				addr.s6_addr32[3] = ifa->ifa_local;
2961 
2962 				if (ifa->ifa_scope == RT_SCOPE_LINK)
2963 					continue;
2964 				if (ifa->ifa_scope >= RT_SCOPE_HOST) {
2965 					if (idev->dev->flags&IFF_POINTOPOINT)
2966 						continue;
2967 					flag |= IFA_HOST;
2968 				}
2969 
2970 				add_addr(idev, &addr, plen, flag);
2971 				addrconf_prefix_route(&addr, plen, idev->dev, 0,
2972 						      pflags);
2973 			}
2974 		}
2975 	}
2976 }
2977 #endif
2978 
2979 static void init_loopback(struct net_device *dev)
2980 {
2981 	struct inet6_dev  *idev;
2982 	struct net_device *sp_dev;
2983 	struct inet6_ifaddr *sp_ifa;
2984 	struct rt6_info *sp_rt;
2985 
2986 	/* ::1 */
2987 
2988 	ASSERT_RTNL();
2989 
2990 	idev = ipv6_find_idev(dev);
2991 	if (!idev) {
2992 		pr_debug("%s: add_dev failed\n", __func__);
2993 		return;
2994 	}
2995 
2996 	add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
2997 
2998 	/* Add routes to other interface's IPv6 addresses */
2999 	for_each_netdev(dev_net(dev), sp_dev) {
3000 		if (!strcmp(sp_dev->name, dev->name))
3001 			continue;
3002 
3003 		idev = __in6_dev_get(sp_dev);
3004 		if (!idev)
3005 			continue;
3006 
3007 		read_lock_bh(&idev->lock);
3008 		list_for_each_entry(sp_ifa, &idev->addr_list, if_list) {
3009 
3010 			if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
3011 				continue;
3012 
3013 			if (sp_ifa->rt) {
3014 				/* This dst has been added to garbage list when
3015 				 * lo device down, release this obsolete dst and
3016 				 * reallocate a new router for ifa.
3017 				 */
3018 				if (!atomic_read(&sp_ifa->rt->rt6i_ref)) {
3019 					ip6_rt_put(sp_ifa->rt);
3020 					sp_ifa->rt = NULL;
3021 				} else {
3022 					continue;
3023 				}
3024 			}
3025 
3026 			sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, false);
3027 
3028 			/* Failure cases are ignored */
3029 			if (!IS_ERR(sp_rt)) {
3030 				sp_ifa->rt = sp_rt;
3031 				ip6_ins_rt(sp_rt);
3032 			}
3033 		}
3034 		read_unlock_bh(&idev->lock);
3035 	}
3036 }
3037 
3038 void addrconf_add_linklocal(struct inet6_dev *idev,
3039 			    const struct in6_addr *addr, u32 flags)
3040 {
3041 	struct inet6_ifaddr *ifp;
3042 	u32 addr_flags = flags | IFA_F_PERMANENT;
3043 
3044 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
3045 	if (idev->cnf.optimistic_dad &&
3046 	    !dev_net(idev->dev)->ipv6.devconf_all->forwarding)
3047 		addr_flags |= IFA_F_OPTIMISTIC;
3048 #endif
3049 
3050 	ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags,
3051 			    INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
3052 	if (!IS_ERR(ifp)) {
3053 		addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
3054 		addrconf_dad_start(ifp);
3055 		in6_ifa_put(ifp);
3056 	}
3057 }
3058 EXPORT_SYMBOL_GPL(addrconf_add_linklocal);
3059 
3060 static bool ipv6_reserved_interfaceid(struct in6_addr address)
3061 {
3062 	if ((address.s6_addr32[2] | address.s6_addr32[3]) == 0)
3063 		return true;
3064 
3065 	if (address.s6_addr32[2] == htonl(0x02005eff) &&
3066 	    ((address.s6_addr32[3] & htonl(0xfe000000)) == htonl(0xfe000000)))
3067 		return true;
3068 
3069 	if (address.s6_addr32[2] == htonl(0xfdffffff) &&
3070 	    ((address.s6_addr32[3] & htonl(0xffffff80)) == htonl(0xffffff80)))
3071 		return true;
3072 
3073 	return false;
3074 }
3075 
3076 static int ipv6_generate_stable_address(struct in6_addr *address,
3077 					u8 dad_count,
3078 					const struct inet6_dev *idev)
3079 {
3080 	static DEFINE_SPINLOCK(lock);
3081 	static __u32 digest[SHA_DIGEST_WORDS];
3082 	static __u32 workspace[SHA_WORKSPACE_WORDS];
3083 
3084 	static union {
3085 		char __data[SHA_MESSAGE_BYTES];
3086 		struct {
3087 			struct in6_addr secret;
3088 			__be32 prefix[2];
3089 			unsigned char hwaddr[MAX_ADDR_LEN];
3090 			u8 dad_count;
3091 		} __packed;
3092 	} data;
3093 
3094 	struct in6_addr secret;
3095 	struct in6_addr temp;
3096 	struct net *net = dev_net(idev->dev);
3097 
3098 	BUILD_BUG_ON(sizeof(data.__data) != sizeof(data));
3099 
3100 	if (idev->cnf.stable_secret.initialized)
3101 		secret = idev->cnf.stable_secret.secret;
3102 	else if (net->ipv6.devconf_dflt->stable_secret.initialized)
3103 		secret = net->ipv6.devconf_dflt->stable_secret.secret;
3104 	else
3105 		return -1;
3106 
3107 retry:
3108 	spin_lock_bh(&lock);
3109 
3110 	sha_init(digest);
3111 	memset(&data, 0, sizeof(data));
3112 	memset(workspace, 0, sizeof(workspace));
3113 	memcpy(data.hwaddr, idev->dev->perm_addr, idev->dev->addr_len);
3114 	data.prefix[0] = address->s6_addr32[0];
3115 	data.prefix[1] = address->s6_addr32[1];
3116 	data.secret = secret;
3117 	data.dad_count = dad_count;
3118 
3119 	sha_transform(digest, data.__data, workspace);
3120 
3121 	temp = *address;
3122 	temp.s6_addr32[2] = (__force __be32)digest[0];
3123 	temp.s6_addr32[3] = (__force __be32)digest[1];
3124 
3125 	spin_unlock_bh(&lock);
3126 
3127 	if (ipv6_reserved_interfaceid(temp)) {
3128 		dad_count++;
3129 		if (dad_count > dev_net(idev->dev)->ipv6.sysctl.idgen_retries)
3130 			return -1;
3131 		goto retry;
3132 	}
3133 
3134 	*address = temp;
3135 	return 0;
3136 }
3137 
3138 static void ipv6_gen_mode_random_init(struct inet6_dev *idev)
3139 {
3140 	struct ipv6_stable_secret *s = &idev->cnf.stable_secret;
3141 
3142 	if (s->initialized)
3143 		return;
3144 	s = &idev->cnf.stable_secret;
3145 	get_random_bytes(&s->secret, sizeof(s->secret));
3146 	s->initialized = true;
3147 }
3148 
3149 static void addrconf_addr_gen(struct inet6_dev *idev, bool prefix_route)
3150 {
3151 	struct in6_addr addr;
3152 
3153 	/* no link local addresses on L3 master devices */
3154 	if (netif_is_l3_master(idev->dev))
3155 		return;
3156 
3157 	ipv6_addr_set(&addr, htonl(0xFE800000), 0, 0, 0);
3158 
3159 	switch (idev->cnf.addr_gen_mode) {
3160 	case IN6_ADDR_GEN_MODE_RANDOM:
3161 		ipv6_gen_mode_random_init(idev);
3162 		/* fallthrough */
3163 	case IN6_ADDR_GEN_MODE_STABLE_PRIVACY:
3164 		if (!ipv6_generate_stable_address(&addr, 0, idev))
3165 			addrconf_add_linklocal(idev, &addr,
3166 					       IFA_F_STABLE_PRIVACY);
3167 		else if (prefix_route)
3168 			addrconf_prefix_route(&addr, 64, idev->dev, 0, 0);
3169 		break;
3170 	case IN6_ADDR_GEN_MODE_EUI64:
3171 		/* addrconf_add_linklocal also adds a prefix_route and we
3172 		 * only need to care about prefix routes if ipv6_generate_eui64
3173 		 * couldn't generate one.
3174 		 */
3175 		if (ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) == 0)
3176 			addrconf_add_linklocal(idev, &addr, 0);
3177 		else if (prefix_route)
3178 			addrconf_prefix_route(&addr, 64, idev->dev, 0, 0);
3179 		break;
3180 	case IN6_ADDR_GEN_MODE_NONE:
3181 	default:
3182 		/* will not add any link local address */
3183 		break;
3184 	}
3185 }
3186 
3187 static void addrconf_dev_config(struct net_device *dev)
3188 {
3189 	struct inet6_dev *idev;
3190 
3191 	ASSERT_RTNL();
3192 
3193 	if ((dev->type != ARPHRD_ETHER) &&
3194 	    (dev->type != ARPHRD_FDDI) &&
3195 	    (dev->type != ARPHRD_ARCNET) &&
3196 	    (dev->type != ARPHRD_INFINIBAND) &&
3197 	    (dev->type != ARPHRD_IEEE1394) &&
3198 	    (dev->type != ARPHRD_TUNNEL6) &&
3199 	    (dev->type != ARPHRD_6LOWPAN) &&
3200 	    (dev->type != ARPHRD_IP6GRE) &&
3201 	    (dev->type != ARPHRD_IPGRE) &&
3202 	    (dev->type != ARPHRD_TUNNEL) &&
3203 	    (dev->type != ARPHRD_NONE)) {
3204 		/* Alas, we support only Ethernet autoconfiguration. */
3205 		return;
3206 	}
3207 
3208 	idev = addrconf_add_dev(dev);
3209 	if (IS_ERR(idev))
3210 		return;
3211 
3212 	/* this device type has no EUI support */
3213 	if (dev->type == ARPHRD_NONE &&
3214 	    idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)
3215 		idev->cnf.addr_gen_mode = IN6_ADDR_GEN_MODE_RANDOM;
3216 
3217 	addrconf_addr_gen(idev, false);
3218 }
3219 
3220 #if IS_ENABLED(CONFIG_IPV6_SIT)
3221 static void addrconf_sit_config(struct net_device *dev)
3222 {
3223 	struct inet6_dev *idev;
3224 
3225 	ASSERT_RTNL();
3226 
3227 	/*
3228 	 * Configure the tunnel with one of our IPv4
3229 	 * addresses... we should configure all of
3230 	 * our v4 addrs in the tunnel
3231 	 */
3232 
3233 	idev = ipv6_find_idev(dev);
3234 	if (!idev) {
3235 		pr_debug("%s: add_dev failed\n", __func__);
3236 		return;
3237 	}
3238 
3239 	if (dev->priv_flags & IFF_ISATAP) {
3240 		addrconf_addr_gen(idev, false);
3241 		return;
3242 	}
3243 
3244 	sit_add_v4_addrs(idev);
3245 
3246 	if (dev->flags&IFF_POINTOPOINT)
3247 		addrconf_add_mroute(dev);
3248 }
3249 #endif
3250 
3251 #if IS_ENABLED(CONFIG_NET_IPGRE)
3252 static void addrconf_gre_config(struct net_device *dev)
3253 {
3254 	struct inet6_dev *idev;
3255 
3256 	ASSERT_RTNL();
3257 
3258 	idev = ipv6_find_idev(dev);
3259 	if (!idev) {
3260 		pr_debug("%s: add_dev failed\n", __func__);
3261 		return;
3262 	}
3263 
3264 	addrconf_addr_gen(idev, true);
3265 	if (dev->flags & IFF_POINTOPOINT)
3266 		addrconf_add_mroute(dev);
3267 }
3268 #endif
3269 
3270 static int fixup_permanent_addr(struct inet6_dev *idev,
3271 				struct inet6_ifaddr *ifp)
3272 {
3273 	if (!ifp->rt) {
3274 		struct rt6_info *rt;
3275 
3276 		rt = addrconf_dst_alloc(idev, &ifp->addr, false);
3277 		if (unlikely(IS_ERR(rt)))
3278 			return PTR_ERR(rt);
3279 
3280 		ifp->rt = rt;
3281 	}
3282 
3283 	if (!(ifp->flags & IFA_F_NOPREFIXROUTE)) {
3284 		addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
3285 				      idev->dev, 0, 0);
3286 	}
3287 
3288 	addrconf_dad_start(ifp);
3289 
3290 	return 0;
3291 }
3292 
3293 static void addrconf_permanent_addr(struct net_device *dev)
3294 {
3295 	struct inet6_ifaddr *ifp, *tmp;
3296 	struct inet6_dev *idev;
3297 
3298 	idev = __in6_dev_get(dev);
3299 	if (!idev)
3300 		return;
3301 
3302 	write_lock_bh(&idev->lock);
3303 
3304 	list_for_each_entry_safe(ifp, tmp, &idev->addr_list, if_list) {
3305 		if ((ifp->flags & IFA_F_PERMANENT) &&
3306 		    fixup_permanent_addr(idev, ifp) < 0) {
3307 			write_unlock_bh(&idev->lock);
3308 			ipv6_del_addr(ifp);
3309 			write_lock_bh(&idev->lock);
3310 
3311 			net_info_ratelimited("%s: Failed to add prefix route for address %pI6c; dropping\n",
3312 					     idev->dev->name, &ifp->addr);
3313 		}
3314 	}
3315 
3316 	write_unlock_bh(&idev->lock);
3317 }
3318 
3319 static int addrconf_notify(struct notifier_block *this, unsigned long event,
3320 			   void *ptr)
3321 {
3322 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
3323 	struct netdev_notifier_changeupper_info *info;
3324 	struct inet6_dev *idev = __in6_dev_get(dev);
3325 	int run_pending = 0;
3326 	int err;
3327 
3328 	switch (event) {
3329 	case NETDEV_REGISTER:
3330 		if (!idev && dev->mtu >= IPV6_MIN_MTU) {
3331 			idev = ipv6_add_dev(dev);
3332 			if (IS_ERR(idev))
3333 				return notifier_from_errno(PTR_ERR(idev));
3334 		}
3335 		break;
3336 
3337 	case NETDEV_CHANGEMTU:
3338 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
3339 		if (dev->mtu < IPV6_MIN_MTU) {
3340 			addrconf_ifdown(dev, 1);
3341 			break;
3342 		}
3343 
3344 		if (idev) {
3345 			rt6_mtu_change(dev, dev->mtu);
3346 			idev->cnf.mtu6 = dev->mtu;
3347 			break;
3348 		}
3349 
3350 		/* allocate new idev */
3351 		idev = ipv6_add_dev(dev);
3352 		if (IS_ERR(idev))
3353 			break;
3354 
3355 		/* device is still not ready */
3356 		if (!(idev->if_flags & IF_READY))
3357 			break;
3358 
3359 		run_pending = 1;
3360 
3361 		/* fall through */
3362 
3363 	case NETDEV_UP:
3364 	case NETDEV_CHANGE:
3365 		if (dev->flags & IFF_SLAVE)
3366 			break;
3367 
3368 		if (idev && idev->cnf.disable_ipv6)
3369 			break;
3370 
3371 		if (event == NETDEV_UP) {
3372 			/* restore routes for permanent addresses */
3373 			addrconf_permanent_addr(dev);
3374 
3375 			if (!addrconf_qdisc_ok(dev)) {
3376 				/* device is not ready yet. */
3377 				pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
3378 					dev->name);
3379 				break;
3380 			}
3381 
3382 			if (!idev && dev->mtu >= IPV6_MIN_MTU)
3383 				idev = ipv6_add_dev(dev);
3384 
3385 			if (!IS_ERR_OR_NULL(idev)) {
3386 				idev->if_flags |= IF_READY;
3387 				run_pending = 1;
3388 			}
3389 		} else if (event == NETDEV_CHANGE) {
3390 			if (!addrconf_qdisc_ok(dev)) {
3391 				/* device is still not ready. */
3392 				break;
3393 			}
3394 
3395 			if (idev) {
3396 				if (idev->if_flags & IF_READY) {
3397 					/* device is already configured -
3398 					 * but resend MLD reports, we might
3399 					 * have roamed and need to update
3400 					 * multicast snooping switches
3401 					 */
3402 					ipv6_mc_up(idev);
3403 					break;
3404 				}
3405 				idev->if_flags |= IF_READY;
3406 			}
3407 
3408 			pr_info("ADDRCONF(NETDEV_CHANGE): %s: link becomes ready\n",
3409 				dev->name);
3410 
3411 			run_pending = 1;
3412 		}
3413 
3414 		switch (dev->type) {
3415 #if IS_ENABLED(CONFIG_IPV6_SIT)
3416 		case ARPHRD_SIT:
3417 			addrconf_sit_config(dev);
3418 			break;
3419 #endif
3420 #if IS_ENABLED(CONFIG_NET_IPGRE)
3421 		case ARPHRD_IPGRE:
3422 			addrconf_gre_config(dev);
3423 			break;
3424 #endif
3425 		case ARPHRD_LOOPBACK:
3426 			init_loopback(dev);
3427 			break;
3428 
3429 		default:
3430 			addrconf_dev_config(dev);
3431 			break;
3432 		}
3433 
3434 		if (!IS_ERR_OR_NULL(idev)) {
3435 			if (run_pending)
3436 				addrconf_dad_run(idev);
3437 
3438 			/*
3439 			 * If the MTU changed during the interface down,
3440 			 * when the interface up, the changed MTU must be
3441 			 * reflected in the idev as well as routers.
3442 			 */
3443 			if (idev->cnf.mtu6 != dev->mtu &&
3444 			    dev->mtu >= IPV6_MIN_MTU) {
3445 				rt6_mtu_change(dev, dev->mtu);
3446 				idev->cnf.mtu6 = dev->mtu;
3447 			}
3448 			idev->tstamp = jiffies;
3449 			inet6_ifinfo_notify(RTM_NEWLINK, idev);
3450 
3451 			/*
3452 			 * If the changed mtu during down is lower than
3453 			 * IPV6_MIN_MTU stop IPv6 on this interface.
3454 			 */
3455 			if (dev->mtu < IPV6_MIN_MTU)
3456 				addrconf_ifdown(dev, 1);
3457 		}
3458 		break;
3459 
3460 	case NETDEV_DOWN:
3461 	case NETDEV_UNREGISTER:
3462 		/*
3463 		 *	Remove all addresses from this interface.
3464 		 */
3465 		addrconf_ifdown(dev, event != NETDEV_DOWN);
3466 		break;
3467 
3468 	case NETDEV_CHANGENAME:
3469 		if (idev) {
3470 			snmp6_unregister_dev(idev);
3471 			addrconf_sysctl_unregister(idev);
3472 			err = addrconf_sysctl_register(idev);
3473 			if (err)
3474 				return notifier_from_errno(err);
3475 			err = snmp6_register_dev(idev);
3476 			if (err) {
3477 				addrconf_sysctl_unregister(idev);
3478 				return notifier_from_errno(err);
3479 			}
3480 		}
3481 		break;
3482 
3483 	case NETDEV_PRE_TYPE_CHANGE:
3484 	case NETDEV_POST_TYPE_CHANGE:
3485 		if (idev)
3486 			addrconf_type_change(dev, event);
3487 		break;
3488 
3489 	case NETDEV_CHANGEUPPER:
3490 		info = ptr;
3491 
3492 		/* flush all routes if dev is linked to or unlinked from
3493 		 * an L3 master device (e.g., VRF)
3494 		 */
3495 		if (info->upper_dev && netif_is_l3_master(info->upper_dev))
3496 			addrconf_ifdown(dev, 0);
3497 	}
3498 
3499 	return NOTIFY_OK;
3500 }
3501 
3502 /*
3503  *	addrconf module should be notified of a device going up
3504  */
3505 static struct notifier_block ipv6_dev_notf = {
3506 	.notifier_call = addrconf_notify,
3507 };
3508 
3509 static void addrconf_type_change(struct net_device *dev, unsigned long event)
3510 {
3511 	struct inet6_dev *idev;
3512 	ASSERT_RTNL();
3513 
3514 	idev = __in6_dev_get(dev);
3515 
3516 	if (event == NETDEV_POST_TYPE_CHANGE)
3517 		ipv6_mc_remap(idev);
3518 	else if (event == NETDEV_PRE_TYPE_CHANGE)
3519 		ipv6_mc_unmap(idev);
3520 }
3521 
3522 static bool addr_is_local(const struct in6_addr *addr)
3523 {
3524 	return ipv6_addr_type(addr) &
3525 		(IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
3526 }
3527 
3528 static int addrconf_ifdown(struct net_device *dev, int how)
3529 {
3530 	struct net *net = dev_net(dev);
3531 	struct inet6_dev *idev;
3532 	struct inet6_ifaddr *ifa, *tmp;
3533 	struct list_head del_list;
3534 	int _keep_addr;
3535 	bool keep_addr;
3536 	int state, i;
3537 
3538 	ASSERT_RTNL();
3539 
3540 	rt6_ifdown(net, dev);
3541 	neigh_ifdown(&nd_tbl, dev);
3542 
3543 	idev = __in6_dev_get(dev);
3544 	if (!idev)
3545 		return -ENODEV;
3546 
3547 	/*
3548 	 * Step 1: remove reference to ipv6 device from parent device.
3549 	 *	   Do not dev_put!
3550 	 */
3551 	if (how) {
3552 		idev->dead = 1;
3553 
3554 		/* protected by rtnl_lock */
3555 		RCU_INIT_POINTER(dev->ip6_ptr, NULL);
3556 
3557 		/* Step 1.5: remove snmp6 entry */
3558 		snmp6_unregister_dev(idev);
3559 
3560 	}
3561 
3562 	/* aggregate the system setting and interface setting */
3563 	_keep_addr = net->ipv6.devconf_all->keep_addr_on_down;
3564 	if (!_keep_addr)
3565 		_keep_addr = idev->cnf.keep_addr_on_down;
3566 
3567 	/* combine the user config with event to determine if permanent
3568 	 * addresses are to be removed from address hash table
3569 	 */
3570 	keep_addr = !(how || _keep_addr <= 0 || idev->cnf.disable_ipv6);
3571 
3572 	/* Step 2: clear hash table */
3573 	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
3574 		struct hlist_head *h = &inet6_addr_lst[i];
3575 
3576 		spin_lock_bh(&addrconf_hash_lock);
3577 restart:
3578 		hlist_for_each_entry_rcu(ifa, h, addr_lst) {
3579 			if (ifa->idev == idev) {
3580 				addrconf_del_dad_work(ifa);
3581 				/* combined flag + permanent flag decide if
3582 				 * address is retained on a down event
3583 				 */
3584 				if (!keep_addr ||
3585 				    !(ifa->flags & IFA_F_PERMANENT) ||
3586 				    addr_is_local(&ifa->addr)) {
3587 					hlist_del_init_rcu(&ifa->addr_lst);
3588 					goto restart;
3589 				}
3590 			}
3591 		}
3592 		spin_unlock_bh(&addrconf_hash_lock);
3593 	}
3594 
3595 	write_lock_bh(&idev->lock);
3596 
3597 	addrconf_del_rs_timer(idev);
3598 
3599 	/* Step 2: clear flags for stateless addrconf */
3600 	if (!how)
3601 		idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
3602 
3603 	/* Step 3: clear tempaddr list */
3604 	while (!list_empty(&idev->tempaddr_list)) {
3605 		ifa = list_first_entry(&idev->tempaddr_list,
3606 				       struct inet6_ifaddr, tmp_list);
3607 		list_del(&ifa->tmp_list);
3608 		write_unlock_bh(&idev->lock);
3609 		spin_lock_bh(&ifa->lock);
3610 
3611 		if (ifa->ifpub) {
3612 			in6_ifa_put(ifa->ifpub);
3613 			ifa->ifpub = NULL;
3614 		}
3615 		spin_unlock_bh(&ifa->lock);
3616 		in6_ifa_put(ifa);
3617 		write_lock_bh(&idev->lock);
3618 	}
3619 
3620 	/* re-combine the user config with event to determine if permanent
3621 	 * addresses are to be removed from the interface list
3622 	 */
3623 	keep_addr = (!how && _keep_addr > 0 && !idev->cnf.disable_ipv6);
3624 
3625 	INIT_LIST_HEAD(&del_list);
3626 	list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
3627 		struct rt6_info *rt = NULL;
3628 
3629 		addrconf_del_dad_work(ifa);
3630 
3631 		write_unlock_bh(&idev->lock);
3632 		spin_lock_bh(&ifa->lock);
3633 
3634 		if (keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
3635 		    !addr_is_local(&ifa->addr)) {
3636 			/* set state to skip the notifier below */
3637 			state = INET6_IFADDR_STATE_DEAD;
3638 			ifa->state = 0;
3639 			if (!(ifa->flags & IFA_F_NODAD))
3640 				ifa->flags |= IFA_F_TENTATIVE;
3641 
3642 			rt = ifa->rt;
3643 			ifa->rt = NULL;
3644 		} else {
3645 			state = ifa->state;
3646 			ifa->state = INET6_IFADDR_STATE_DEAD;
3647 
3648 			list_move(&ifa->if_list, &del_list);
3649 		}
3650 
3651 		spin_unlock_bh(&ifa->lock);
3652 
3653 		if (rt)
3654 			ip6_del_rt(rt);
3655 
3656 		if (state != INET6_IFADDR_STATE_DEAD) {
3657 			__ipv6_ifa_notify(RTM_DELADDR, ifa);
3658 			inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
3659 		} else {
3660 			if (idev->cnf.forwarding)
3661 				addrconf_leave_anycast(ifa);
3662 			addrconf_leave_solict(ifa->idev, &ifa->addr);
3663 		}
3664 
3665 		write_lock_bh(&idev->lock);
3666 	}
3667 
3668 	write_unlock_bh(&idev->lock);
3669 
3670 	/* now clean up addresses to be removed */
3671 	while (!list_empty(&del_list)) {
3672 		ifa = list_first_entry(&del_list,
3673 				       struct inet6_ifaddr, if_list);
3674 		list_del(&ifa->if_list);
3675 
3676 		in6_ifa_put(ifa);
3677 	}
3678 
3679 	/* Step 5: Discard anycast and multicast list */
3680 	if (how) {
3681 		ipv6_ac_destroy_dev(idev);
3682 		ipv6_mc_destroy_dev(idev);
3683 	} else {
3684 		ipv6_mc_down(idev);
3685 	}
3686 
3687 	idev->tstamp = jiffies;
3688 
3689 	/* Last: Shot the device (if unregistered) */
3690 	if (how) {
3691 		addrconf_sysctl_unregister(idev);
3692 		neigh_parms_release(&nd_tbl, idev->nd_parms);
3693 		neigh_ifdown(&nd_tbl, dev);
3694 		in6_dev_put(idev);
3695 	}
3696 	return 0;
3697 }
3698 
3699 static void addrconf_rs_timer(unsigned long data)
3700 {
3701 	struct inet6_dev *idev = (struct inet6_dev *)data;
3702 	struct net_device *dev = idev->dev;
3703 	struct in6_addr lladdr;
3704 
3705 	write_lock(&idev->lock);
3706 	if (idev->dead || !(idev->if_flags & IF_READY))
3707 		goto out;
3708 
3709 	if (!ipv6_accept_ra(idev))
3710 		goto out;
3711 
3712 	/* Announcement received after solicitation was sent */
3713 	if (idev->if_flags & IF_RA_RCVD)
3714 		goto out;
3715 
3716 	if (idev->rs_probes++ < idev->cnf.rtr_solicits || idev->cnf.rtr_solicits < 0) {
3717 		write_unlock(&idev->lock);
3718 		if (!ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
3719 			ndisc_send_rs(dev, &lladdr,
3720 				      &in6addr_linklocal_allrouters);
3721 		else
3722 			goto put;
3723 
3724 		write_lock(&idev->lock);
3725 		idev->rs_interval = rfc3315_s14_backoff_update(
3726 			idev->rs_interval, idev->cnf.rtr_solicit_max_interval);
3727 		/* The wait after the last probe can be shorter */
3728 		addrconf_mod_rs_timer(idev, (idev->rs_probes ==
3729 					     idev->cnf.rtr_solicits) ?
3730 				      idev->cnf.rtr_solicit_delay :
3731 				      idev->rs_interval);
3732 	} else {
3733 		/*
3734 		 * Note: we do not support deprecated "all on-link"
3735 		 * assumption any longer.
3736 		 */
3737 		pr_debug("%s: no IPv6 routers present\n", idev->dev->name);
3738 	}
3739 
3740 out:
3741 	write_unlock(&idev->lock);
3742 put:
3743 	in6_dev_put(idev);
3744 }
3745 
3746 /*
3747  *	Duplicate Address Detection
3748  */
3749 static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
3750 {
3751 	unsigned long rand_num;
3752 	struct inet6_dev *idev = ifp->idev;
3753 	u64 nonce;
3754 
3755 	if (ifp->flags & IFA_F_OPTIMISTIC)
3756 		rand_num = 0;
3757 	else
3758 		rand_num = prandom_u32() % (idev->cnf.rtr_solicit_delay ? : 1);
3759 
3760 	nonce = 0;
3761 	if (idev->cnf.enhanced_dad ||
3762 	    dev_net(idev->dev)->ipv6.devconf_all->enhanced_dad) {
3763 		do
3764 			get_random_bytes(&nonce, 6);
3765 		while (nonce == 0);
3766 	}
3767 	ifp->dad_nonce = nonce;
3768 	ifp->dad_probes = idev->cnf.dad_transmits;
3769 	addrconf_mod_dad_work(ifp, rand_num);
3770 }
3771 
3772 static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
3773 {
3774 	struct inet6_dev *idev = ifp->idev;
3775 	struct net_device *dev = idev->dev;
3776 	bool bump_id, notify = false;
3777 
3778 	addrconf_join_solict(dev, &ifp->addr);
3779 
3780 	prandom_seed((__force u32) ifp->addr.s6_addr32[3]);
3781 
3782 	read_lock_bh(&idev->lock);
3783 	spin_lock(&ifp->lock);
3784 	if (ifp->state == INET6_IFADDR_STATE_DEAD)
3785 		goto out;
3786 
3787 	if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
3788 	    idev->cnf.accept_dad < 1 ||
3789 	    !(ifp->flags&IFA_F_TENTATIVE) ||
3790 	    ifp->flags & IFA_F_NODAD) {
3791 		bump_id = ifp->flags & IFA_F_TENTATIVE;
3792 		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
3793 		spin_unlock(&ifp->lock);
3794 		read_unlock_bh(&idev->lock);
3795 
3796 		addrconf_dad_completed(ifp, bump_id);
3797 		return;
3798 	}
3799 
3800 	if (!(idev->if_flags & IF_READY)) {
3801 		spin_unlock(&ifp->lock);
3802 		read_unlock_bh(&idev->lock);
3803 		/*
3804 		 * If the device is not ready:
3805 		 * - keep it tentative if it is a permanent address.
3806 		 * - otherwise, kill it.
3807 		 */
3808 		in6_ifa_hold(ifp);
3809 		addrconf_dad_stop(ifp, 0);
3810 		return;
3811 	}
3812 
3813 	/*
3814 	 * Optimistic nodes can start receiving
3815 	 * Frames right away
3816 	 */
3817 	if (ifp->flags & IFA_F_OPTIMISTIC) {
3818 		ip6_ins_rt(ifp->rt);
3819 		if (ipv6_use_optimistic_addr(idev)) {
3820 			/* Because optimistic nodes can use this address,
3821 			 * notify listeners. If DAD fails, RTM_DELADDR is sent.
3822 			 */
3823 			notify = true;
3824 		}
3825 	}
3826 
3827 	addrconf_dad_kick(ifp);
3828 out:
3829 	spin_unlock(&ifp->lock);
3830 	read_unlock_bh(&idev->lock);
3831 	if (notify)
3832 		ipv6_ifa_notify(RTM_NEWADDR, ifp);
3833 }
3834 
3835 static void addrconf_dad_start(struct inet6_ifaddr *ifp)
3836 {
3837 	bool begin_dad = false;
3838 
3839 	spin_lock_bh(&ifp->lock);
3840 	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
3841 		ifp->state = INET6_IFADDR_STATE_PREDAD;
3842 		begin_dad = true;
3843 	}
3844 	spin_unlock_bh(&ifp->lock);
3845 
3846 	if (begin_dad)
3847 		addrconf_mod_dad_work(ifp, 0);
3848 }
3849 
3850 static void addrconf_dad_work(struct work_struct *w)
3851 {
3852 	struct inet6_ifaddr *ifp = container_of(to_delayed_work(w),
3853 						struct inet6_ifaddr,
3854 						dad_work);
3855 	struct inet6_dev *idev = ifp->idev;
3856 	bool bump_id, disable_ipv6 = false;
3857 	struct in6_addr mcaddr;
3858 
3859 	enum {
3860 		DAD_PROCESS,
3861 		DAD_BEGIN,
3862 		DAD_ABORT,
3863 	} action = DAD_PROCESS;
3864 
3865 	rtnl_lock();
3866 
3867 	spin_lock_bh(&ifp->lock);
3868 	if (ifp->state == INET6_IFADDR_STATE_PREDAD) {
3869 		action = DAD_BEGIN;
3870 		ifp->state = INET6_IFADDR_STATE_DAD;
3871 	} else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
3872 		action = DAD_ABORT;
3873 		ifp->state = INET6_IFADDR_STATE_POSTDAD;
3874 
3875 		if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6 &&
3876 		    !(ifp->flags & IFA_F_STABLE_PRIVACY)) {
3877 			struct in6_addr addr;
3878 
3879 			addr.s6_addr32[0] = htonl(0xfe800000);
3880 			addr.s6_addr32[1] = 0;
3881 
3882 			if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
3883 			    ipv6_addr_equal(&ifp->addr, &addr)) {
3884 				/* DAD failed for link-local based on MAC */
3885 				idev->cnf.disable_ipv6 = 1;
3886 
3887 				pr_info("%s: IPv6 being disabled!\n",
3888 					ifp->idev->dev->name);
3889 				disable_ipv6 = true;
3890 			}
3891 		}
3892 	}
3893 	spin_unlock_bh(&ifp->lock);
3894 
3895 	if (action == DAD_BEGIN) {
3896 		addrconf_dad_begin(ifp);
3897 		goto out;
3898 	} else if (action == DAD_ABORT) {
3899 		in6_ifa_hold(ifp);
3900 		addrconf_dad_stop(ifp, 1);
3901 		if (disable_ipv6)
3902 			addrconf_ifdown(idev->dev, 0);
3903 		goto out;
3904 	}
3905 
3906 	if (!ifp->dad_probes && addrconf_dad_end(ifp))
3907 		goto out;
3908 
3909 	write_lock_bh(&idev->lock);
3910 	if (idev->dead || !(idev->if_flags & IF_READY)) {
3911 		write_unlock_bh(&idev->lock);
3912 		goto out;
3913 	}
3914 
3915 	spin_lock(&ifp->lock);
3916 	if (ifp->state == INET6_IFADDR_STATE_DEAD) {
3917 		spin_unlock(&ifp->lock);
3918 		write_unlock_bh(&idev->lock);
3919 		goto out;
3920 	}
3921 
3922 	if (ifp->dad_probes == 0) {
3923 		/*
3924 		 * DAD was successful
3925 		 */
3926 
3927 		bump_id = ifp->flags & IFA_F_TENTATIVE;
3928 		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
3929 		spin_unlock(&ifp->lock);
3930 		write_unlock_bh(&idev->lock);
3931 
3932 		addrconf_dad_completed(ifp, bump_id);
3933 
3934 		goto out;
3935 	}
3936 
3937 	ifp->dad_probes--;
3938 	addrconf_mod_dad_work(ifp,
3939 			      NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME));
3940 	spin_unlock(&ifp->lock);
3941 	write_unlock_bh(&idev->lock);
3942 
3943 	/* send a neighbour solicitation for our addr */
3944 	addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
3945 	ndisc_send_ns(ifp->idev->dev, &ifp->addr, &mcaddr, &in6addr_any,
3946 		      ifp->dad_nonce);
3947 out:
3948 	in6_ifa_put(ifp);
3949 	rtnl_unlock();
3950 }
3951 
3952 /* ifp->idev must be at least read locked */
3953 static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
3954 {
3955 	struct inet6_ifaddr *ifpiter;
3956 	struct inet6_dev *idev = ifp->idev;
3957 
3958 	list_for_each_entry_reverse(ifpiter, &idev->addr_list, if_list) {
3959 		if (ifpiter->scope > IFA_LINK)
3960 			break;
3961 		if (ifp != ifpiter && ifpiter->scope == IFA_LINK &&
3962 		    (ifpiter->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|
3963 				       IFA_F_OPTIMISTIC|IFA_F_DADFAILED)) ==
3964 		    IFA_F_PERMANENT)
3965 			return false;
3966 	}
3967 	return true;
3968 }
3969 
3970 static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id)
3971 {
3972 	struct net_device *dev = ifp->idev->dev;
3973 	struct in6_addr lladdr;
3974 	bool send_rs, send_mld;
3975 
3976 	addrconf_del_dad_work(ifp);
3977 
3978 	/*
3979 	 *	Configure the address for reception. Now it is valid.
3980 	 */
3981 
3982 	ipv6_ifa_notify(RTM_NEWADDR, ifp);
3983 
3984 	/* If added prefix is link local and we are prepared to process
3985 	   router advertisements, start sending router solicitations.
3986 	 */
3987 
3988 	read_lock_bh(&ifp->idev->lock);
3989 	send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
3990 	send_rs = send_mld &&
3991 		  ipv6_accept_ra(ifp->idev) &&
3992 		  ifp->idev->cnf.rtr_solicits != 0 &&
3993 		  (dev->flags&IFF_LOOPBACK) == 0;
3994 	read_unlock_bh(&ifp->idev->lock);
3995 
3996 	/* While dad is in progress mld report's source address is in6_addrany.
3997 	 * Resend with proper ll now.
3998 	 */
3999 	if (send_mld)
4000 		ipv6_mc_dad_complete(ifp->idev);
4001 
4002 	if (send_rs) {
4003 		/*
4004 		 *	If a host as already performed a random delay
4005 		 *	[...] as part of DAD [...] there is no need
4006 		 *	to delay again before sending the first RS
4007 		 */
4008 		if (ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
4009 			return;
4010 		ndisc_send_rs(dev, &lladdr, &in6addr_linklocal_allrouters);
4011 
4012 		write_lock_bh(&ifp->idev->lock);
4013 		spin_lock(&ifp->lock);
4014 		ifp->idev->rs_interval = rfc3315_s14_backoff_init(
4015 			ifp->idev->cnf.rtr_solicit_interval);
4016 		ifp->idev->rs_probes = 1;
4017 		ifp->idev->if_flags |= IF_RS_SENT;
4018 		addrconf_mod_rs_timer(ifp->idev, ifp->idev->rs_interval);
4019 		spin_unlock(&ifp->lock);
4020 		write_unlock_bh(&ifp->idev->lock);
4021 	}
4022 
4023 	if (bump_id)
4024 		rt_genid_bump_ipv6(dev_net(dev));
4025 
4026 	/* Make sure that a new temporary address will be created
4027 	 * before this temporary address becomes deprecated.
4028 	 */
4029 	if (ifp->flags & IFA_F_TEMPORARY)
4030 		addrconf_verify_rtnl();
4031 }
4032 
4033 static void addrconf_dad_run(struct inet6_dev *idev)
4034 {
4035 	struct inet6_ifaddr *ifp;
4036 
4037 	read_lock_bh(&idev->lock);
4038 	list_for_each_entry(ifp, &idev->addr_list, if_list) {
4039 		spin_lock(&ifp->lock);
4040 		if (ifp->flags & IFA_F_TENTATIVE &&
4041 		    ifp->state == INET6_IFADDR_STATE_DAD)
4042 			addrconf_dad_kick(ifp);
4043 		spin_unlock(&ifp->lock);
4044 	}
4045 	read_unlock_bh(&idev->lock);
4046 }
4047 
4048 #ifdef CONFIG_PROC_FS
4049 struct if6_iter_state {
4050 	struct seq_net_private p;
4051 	int bucket;
4052 	int offset;
4053 };
4054 
4055 static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
4056 {
4057 	struct inet6_ifaddr *ifa = NULL;
4058 	struct if6_iter_state *state = seq->private;
4059 	struct net *net = seq_file_net(seq);
4060 	int p = 0;
4061 
4062 	/* initial bucket if pos is 0 */
4063 	if (pos == 0) {
4064 		state->bucket = 0;
4065 		state->offset = 0;
4066 	}
4067 
4068 	for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
4069 		hlist_for_each_entry_rcu_bh(ifa, &inet6_addr_lst[state->bucket],
4070 					 addr_lst) {
4071 			if (!net_eq(dev_net(ifa->idev->dev), net))
4072 				continue;
4073 			/* sync with offset */
4074 			if (p < state->offset) {
4075 				p++;
4076 				continue;
4077 			}
4078 			state->offset++;
4079 			return ifa;
4080 		}
4081 
4082 		/* prepare for next bucket */
4083 		state->offset = 0;
4084 		p = 0;
4085 	}
4086 	return NULL;
4087 }
4088 
4089 static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
4090 					 struct inet6_ifaddr *ifa)
4091 {
4092 	struct if6_iter_state *state = seq->private;
4093 	struct net *net = seq_file_net(seq);
4094 
4095 	hlist_for_each_entry_continue_rcu_bh(ifa, addr_lst) {
4096 		if (!net_eq(dev_net(ifa->idev->dev), net))
4097 			continue;
4098 		state->offset++;
4099 		return ifa;
4100 	}
4101 
4102 	while (++state->bucket < IN6_ADDR_HSIZE) {
4103 		state->offset = 0;
4104 		hlist_for_each_entry_rcu_bh(ifa,
4105 				     &inet6_addr_lst[state->bucket], addr_lst) {
4106 			if (!net_eq(dev_net(ifa->idev->dev), net))
4107 				continue;
4108 			state->offset++;
4109 			return ifa;
4110 		}
4111 	}
4112 
4113 	return NULL;
4114 }
4115 
4116 static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
4117 	__acquires(rcu_bh)
4118 {
4119 	rcu_read_lock_bh();
4120 	return if6_get_first(seq, *pos);
4121 }
4122 
4123 static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
4124 {
4125 	struct inet6_ifaddr *ifa;
4126 
4127 	ifa = if6_get_next(seq, v);
4128 	++*pos;
4129 	return ifa;
4130 }
4131 
4132 static void if6_seq_stop(struct seq_file *seq, void *v)
4133 	__releases(rcu_bh)
4134 {
4135 	rcu_read_unlock_bh();
4136 }
4137 
4138 static int if6_seq_show(struct seq_file *seq, void *v)
4139 {
4140 	struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
4141 	seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
4142 		   &ifp->addr,
4143 		   ifp->idev->dev->ifindex,
4144 		   ifp->prefix_len,
4145 		   ifp->scope,
4146 		   (u8) ifp->flags,
4147 		   ifp->idev->dev->name);
4148 	return 0;
4149 }
4150 
4151 static const struct seq_operations if6_seq_ops = {
4152 	.start	= if6_seq_start,
4153 	.next	= if6_seq_next,
4154 	.show	= if6_seq_show,
4155 	.stop	= if6_seq_stop,
4156 };
4157 
4158 static int if6_seq_open(struct inode *inode, struct file *file)
4159 {
4160 	return seq_open_net(inode, file, &if6_seq_ops,
4161 			    sizeof(struct if6_iter_state));
4162 }
4163 
4164 static const struct file_operations if6_fops = {
4165 	.owner		= THIS_MODULE,
4166 	.open		= if6_seq_open,
4167 	.read		= seq_read,
4168 	.llseek		= seq_lseek,
4169 	.release	= seq_release_net,
4170 };
4171 
4172 static int __net_init if6_proc_net_init(struct net *net)
4173 {
4174 	if (!proc_create("if_inet6", S_IRUGO, net->proc_net, &if6_fops))
4175 		return -ENOMEM;
4176 	return 0;
4177 }
4178 
4179 static void __net_exit if6_proc_net_exit(struct net *net)
4180 {
4181 	remove_proc_entry("if_inet6", net->proc_net);
4182 }
4183 
4184 static struct pernet_operations if6_proc_net_ops = {
4185 	.init = if6_proc_net_init,
4186 	.exit = if6_proc_net_exit,
4187 };
4188 
4189 int __init if6_proc_init(void)
4190 {
4191 	return register_pernet_subsys(&if6_proc_net_ops);
4192 }
4193 
4194 void if6_proc_exit(void)
4195 {
4196 	unregister_pernet_subsys(&if6_proc_net_ops);
4197 }
4198 #endif	/* CONFIG_PROC_FS */
4199 
4200 #if IS_ENABLED(CONFIG_IPV6_MIP6)
4201 /* Check if address is a home address configured on any interface. */
4202 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
4203 {
4204 	int ret = 0;
4205 	struct inet6_ifaddr *ifp = NULL;
4206 	unsigned int hash = inet6_addr_hash(addr);
4207 
4208 	rcu_read_lock_bh();
4209 	hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
4210 		if (!net_eq(dev_net(ifp->idev->dev), net))
4211 			continue;
4212 		if (ipv6_addr_equal(&ifp->addr, addr) &&
4213 		    (ifp->flags & IFA_F_HOMEADDRESS)) {
4214 			ret = 1;
4215 			break;
4216 		}
4217 	}
4218 	rcu_read_unlock_bh();
4219 	return ret;
4220 }
4221 #endif
4222 
4223 /*
4224  *	Periodic address status verification
4225  */
4226 
4227 static void addrconf_verify_rtnl(void)
4228 {
4229 	unsigned long now, next, next_sec, next_sched;
4230 	struct inet6_ifaddr *ifp;
4231 	int i;
4232 
4233 	ASSERT_RTNL();
4234 
4235 	rcu_read_lock_bh();
4236 	now = jiffies;
4237 	next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
4238 
4239 	cancel_delayed_work(&addr_chk_work);
4240 
4241 	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
4242 restart:
4243 		hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[i], addr_lst) {
4244 			unsigned long age;
4245 
4246 			/* When setting preferred_lft to a value not zero or
4247 			 * infinity, while valid_lft is infinity
4248 			 * IFA_F_PERMANENT has a non-infinity life time.
4249 			 */
4250 			if ((ifp->flags & IFA_F_PERMANENT) &&
4251 			    (ifp->prefered_lft == INFINITY_LIFE_TIME))
4252 				continue;
4253 
4254 			spin_lock(&ifp->lock);
4255 			/* We try to batch several events at once. */
4256 			age = (now - ifp->tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
4257 
4258 			if (ifp->valid_lft != INFINITY_LIFE_TIME &&
4259 			    age >= ifp->valid_lft) {
4260 				spin_unlock(&ifp->lock);
4261 				in6_ifa_hold(ifp);
4262 				ipv6_del_addr(ifp);
4263 				goto restart;
4264 			} else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
4265 				spin_unlock(&ifp->lock);
4266 				continue;
4267 			} else if (age >= ifp->prefered_lft) {
4268 				/* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
4269 				int deprecate = 0;
4270 
4271 				if (!(ifp->flags&IFA_F_DEPRECATED)) {
4272 					deprecate = 1;
4273 					ifp->flags |= IFA_F_DEPRECATED;
4274 				}
4275 
4276 				if ((ifp->valid_lft != INFINITY_LIFE_TIME) &&
4277 				    (time_before(ifp->tstamp + ifp->valid_lft * HZ, next)))
4278 					next = ifp->tstamp + ifp->valid_lft * HZ;
4279 
4280 				spin_unlock(&ifp->lock);
4281 
4282 				if (deprecate) {
4283 					in6_ifa_hold(ifp);
4284 
4285 					ipv6_ifa_notify(0, ifp);
4286 					in6_ifa_put(ifp);
4287 					goto restart;
4288 				}
4289 			} else if ((ifp->flags&IFA_F_TEMPORARY) &&
4290 				   !(ifp->flags&IFA_F_TENTATIVE)) {
4291 				unsigned long regen_advance = ifp->idev->cnf.regen_max_retry *
4292 					ifp->idev->cnf.dad_transmits *
4293 					NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME) / HZ;
4294 
4295 				if (age >= ifp->prefered_lft - regen_advance) {
4296 					struct inet6_ifaddr *ifpub = ifp->ifpub;
4297 					if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
4298 						next = ifp->tstamp + ifp->prefered_lft * HZ;
4299 					if (!ifp->regen_count && ifpub) {
4300 						ifp->regen_count++;
4301 						in6_ifa_hold(ifp);
4302 						in6_ifa_hold(ifpub);
4303 						spin_unlock(&ifp->lock);
4304 
4305 						spin_lock(&ifpub->lock);
4306 						ifpub->regen_count = 0;
4307 						spin_unlock(&ifpub->lock);
4308 						ipv6_create_tempaddr(ifpub, ifp);
4309 						in6_ifa_put(ifpub);
4310 						in6_ifa_put(ifp);
4311 						goto restart;
4312 					}
4313 				} else if (time_before(ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ, next))
4314 					next = ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ;
4315 				spin_unlock(&ifp->lock);
4316 			} else {
4317 				/* ifp->prefered_lft <= ifp->valid_lft */
4318 				if (time_before(ifp->tstamp + ifp->prefered_lft * HZ, next))
4319 					next = ifp->tstamp + ifp->prefered_lft * HZ;
4320 				spin_unlock(&ifp->lock);
4321 			}
4322 		}
4323 	}
4324 
4325 	next_sec = round_jiffies_up(next);
4326 	next_sched = next;
4327 
4328 	/* If rounded timeout is accurate enough, accept it. */
4329 	if (time_before(next_sec, next + ADDRCONF_TIMER_FUZZ))
4330 		next_sched = next_sec;
4331 
4332 	/* And minimum interval is ADDRCONF_TIMER_FUZZ_MAX. */
4333 	if (time_before(next_sched, jiffies + ADDRCONF_TIMER_FUZZ_MAX))
4334 		next_sched = jiffies + ADDRCONF_TIMER_FUZZ_MAX;
4335 
4336 	ADBG(KERN_DEBUG "now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
4337 	      now, next, next_sec, next_sched);
4338 	mod_delayed_work(addrconf_wq, &addr_chk_work, next_sched - now);
4339 	rcu_read_unlock_bh();
4340 }
4341 
4342 static void addrconf_verify_work(struct work_struct *w)
4343 {
4344 	rtnl_lock();
4345 	addrconf_verify_rtnl();
4346 	rtnl_unlock();
4347 }
4348 
4349 static void addrconf_verify(void)
4350 {
4351 	mod_delayed_work(addrconf_wq, &addr_chk_work, 0);
4352 }
4353 
4354 static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local,
4355 				     struct in6_addr **peer_pfx)
4356 {
4357 	struct in6_addr *pfx = NULL;
4358 
4359 	*peer_pfx = NULL;
4360 
4361 	if (addr)
4362 		pfx = nla_data(addr);
4363 
4364 	if (local) {
4365 		if (pfx && nla_memcmp(local, pfx, sizeof(*pfx)))
4366 			*peer_pfx = pfx;
4367 		pfx = nla_data(local);
4368 	}
4369 
4370 	return pfx;
4371 }
4372 
4373 static const struct nla_policy ifa_ipv6_policy[IFA_MAX+1] = {
4374 	[IFA_ADDRESS]		= { .len = sizeof(struct in6_addr) },
4375 	[IFA_LOCAL]		= { .len = sizeof(struct in6_addr) },
4376 	[IFA_CACHEINFO]		= { .len = sizeof(struct ifa_cacheinfo) },
4377 	[IFA_FLAGS]		= { .len = sizeof(u32) },
4378 };
4379 
4380 static int
4381 inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
4382 {
4383 	struct net *net = sock_net(skb->sk);
4384 	struct ifaddrmsg *ifm;
4385 	struct nlattr *tb[IFA_MAX+1];
4386 	struct in6_addr *pfx, *peer_pfx;
4387 	u32 ifa_flags;
4388 	int err;
4389 
4390 	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
4391 	if (err < 0)
4392 		return err;
4393 
4394 	ifm = nlmsg_data(nlh);
4395 	pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
4396 	if (!pfx)
4397 		return -EINVAL;
4398 
4399 	ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) : ifm->ifa_flags;
4400 
4401 	/* We ignore other flags so far. */
4402 	ifa_flags &= IFA_F_MANAGETEMPADDR;
4403 
4404 	return inet6_addr_del(net, ifm->ifa_index, ifa_flags, pfx,
4405 			      ifm->ifa_prefixlen);
4406 }
4407 
4408 static int inet6_addr_modify(struct inet6_ifaddr *ifp, u32 ifa_flags,
4409 			     u32 prefered_lft, u32 valid_lft)
4410 {
4411 	u32 flags;
4412 	clock_t expires;
4413 	unsigned long timeout;
4414 	bool was_managetempaddr;
4415 	bool had_prefixroute;
4416 
4417 	ASSERT_RTNL();
4418 
4419 	if (!valid_lft || (prefered_lft > valid_lft))
4420 		return -EINVAL;
4421 
4422 	if (ifa_flags & IFA_F_MANAGETEMPADDR &&
4423 	    (ifp->flags & IFA_F_TEMPORARY || ifp->prefix_len != 64))
4424 		return -EINVAL;
4425 
4426 	timeout = addrconf_timeout_fixup(valid_lft, HZ);
4427 	if (addrconf_finite_timeout(timeout)) {
4428 		expires = jiffies_to_clock_t(timeout * HZ);
4429 		valid_lft = timeout;
4430 		flags = RTF_EXPIRES;
4431 	} else {
4432 		expires = 0;
4433 		flags = 0;
4434 		ifa_flags |= IFA_F_PERMANENT;
4435 	}
4436 
4437 	timeout = addrconf_timeout_fixup(prefered_lft, HZ);
4438 	if (addrconf_finite_timeout(timeout)) {
4439 		if (timeout == 0)
4440 			ifa_flags |= IFA_F_DEPRECATED;
4441 		prefered_lft = timeout;
4442 	}
4443 
4444 	spin_lock_bh(&ifp->lock);
4445 	was_managetempaddr = ifp->flags & IFA_F_MANAGETEMPADDR;
4446 	had_prefixroute = ifp->flags & IFA_F_PERMANENT &&
4447 			  !(ifp->flags & IFA_F_NOPREFIXROUTE);
4448 	ifp->flags &= ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD |
4449 			IFA_F_HOMEADDRESS | IFA_F_MANAGETEMPADDR |
4450 			IFA_F_NOPREFIXROUTE);
4451 	ifp->flags |= ifa_flags;
4452 	ifp->tstamp = jiffies;
4453 	ifp->valid_lft = valid_lft;
4454 	ifp->prefered_lft = prefered_lft;
4455 
4456 	spin_unlock_bh(&ifp->lock);
4457 	if (!(ifp->flags&IFA_F_TENTATIVE))
4458 		ipv6_ifa_notify(0, ifp);
4459 
4460 	if (!(ifa_flags & IFA_F_NOPREFIXROUTE)) {
4461 		addrconf_prefix_route(&ifp->addr, ifp->prefix_len, ifp->idev->dev,
4462 				      expires, flags);
4463 	} else if (had_prefixroute) {
4464 		enum cleanup_prefix_rt_t action;
4465 		unsigned long rt_expires;
4466 
4467 		write_lock_bh(&ifp->idev->lock);
4468 		action = check_cleanup_prefix_route(ifp, &rt_expires);
4469 		write_unlock_bh(&ifp->idev->lock);
4470 
4471 		if (action != CLEANUP_PREFIX_RT_NOP) {
4472 			cleanup_prefix_route(ifp, rt_expires,
4473 				action == CLEANUP_PREFIX_RT_DEL);
4474 		}
4475 	}
4476 
4477 	if (was_managetempaddr || ifp->flags & IFA_F_MANAGETEMPADDR) {
4478 		if (was_managetempaddr && !(ifp->flags & IFA_F_MANAGETEMPADDR))
4479 			valid_lft = prefered_lft = 0;
4480 		manage_tempaddrs(ifp->idev, ifp, valid_lft, prefered_lft,
4481 				 !was_managetempaddr, jiffies);
4482 	}
4483 
4484 	addrconf_verify_rtnl();
4485 
4486 	return 0;
4487 }
4488 
4489 static int
4490 inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
4491 {
4492 	struct net *net = sock_net(skb->sk);
4493 	struct ifaddrmsg *ifm;
4494 	struct nlattr *tb[IFA_MAX+1];
4495 	struct in6_addr *pfx, *peer_pfx;
4496 	struct inet6_ifaddr *ifa;
4497 	struct net_device *dev;
4498 	u32 valid_lft = INFINITY_LIFE_TIME, preferred_lft = INFINITY_LIFE_TIME;
4499 	u32 ifa_flags;
4500 	int err;
4501 
4502 	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
4503 	if (err < 0)
4504 		return err;
4505 
4506 	ifm = nlmsg_data(nlh);
4507 	pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
4508 	if (!pfx)
4509 		return -EINVAL;
4510 
4511 	if (tb[IFA_CACHEINFO]) {
4512 		struct ifa_cacheinfo *ci;
4513 
4514 		ci = nla_data(tb[IFA_CACHEINFO]);
4515 		valid_lft = ci->ifa_valid;
4516 		preferred_lft = ci->ifa_prefered;
4517 	} else {
4518 		preferred_lft = INFINITY_LIFE_TIME;
4519 		valid_lft = INFINITY_LIFE_TIME;
4520 	}
4521 
4522 	dev =  __dev_get_by_index(net, ifm->ifa_index);
4523 	if (!dev)
4524 		return -ENODEV;
4525 
4526 	ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) : ifm->ifa_flags;
4527 
4528 	/* We ignore other flags so far. */
4529 	ifa_flags &= IFA_F_NODAD | IFA_F_HOMEADDRESS | IFA_F_MANAGETEMPADDR |
4530 		     IFA_F_NOPREFIXROUTE | IFA_F_MCAUTOJOIN;
4531 
4532 	ifa = ipv6_get_ifaddr(net, pfx, dev, 1);
4533 	if (!ifa) {
4534 		/*
4535 		 * It would be best to check for !NLM_F_CREATE here but
4536 		 * userspace already relies on not having to provide this.
4537 		 */
4538 		return inet6_addr_add(net, ifm->ifa_index, pfx, peer_pfx,
4539 				      ifm->ifa_prefixlen, ifa_flags,
4540 				      preferred_lft, valid_lft);
4541 	}
4542 
4543 	if (nlh->nlmsg_flags & NLM_F_EXCL ||
4544 	    !(nlh->nlmsg_flags & NLM_F_REPLACE))
4545 		err = -EEXIST;
4546 	else
4547 		err = inet6_addr_modify(ifa, ifa_flags, preferred_lft, valid_lft);
4548 
4549 	in6_ifa_put(ifa);
4550 
4551 	return err;
4552 }
4553 
4554 static void put_ifaddrmsg(struct nlmsghdr *nlh, u8 prefixlen, u32 flags,
4555 			  u8 scope, int ifindex)
4556 {
4557 	struct ifaddrmsg *ifm;
4558 
4559 	ifm = nlmsg_data(nlh);
4560 	ifm->ifa_family = AF_INET6;
4561 	ifm->ifa_prefixlen = prefixlen;
4562 	ifm->ifa_flags = flags;
4563 	ifm->ifa_scope = scope;
4564 	ifm->ifa_index = ifindex;
4565 }
4566 
4567 static int put_cacheinfo(struct sk_buff *skb, unsigned long cstamp,
4568 			 unsigned long tstamp, u32 preferred, u32 valid)
4569 {
4570 	struct ifa_cacheinfo ci;
4571 
4572 	ci.cstamp = cstamp_delta(cstamp);
4573 	ci.tstamp = cstamp_delta(tstamp);
4574 	ci.ifa_prefered = preferred;
4575 	ci.ifa_valid = valid;
4576 
4577 	return nla_put(skb, IFA_CACHEINFO, sizeof(ci), &ci);
4578 }
4579 
4580 static inline int rt_scope(int ifa_scope)
4581 {
4582 	if (ifa_scope & IFA_HOST)
4583 		return RT_SCOPE_HOST;
4584 	else if (ifa_scope & IFA_LINK)
4585 		return RT_SCOPE_LINK;
4586 	else if (ifa_scope & IFA_SITE)
4587 		return RT_SCOPE_SITE;
4588 	else
4589 		return RT_SCOPE_UNIVERSE;
4590 }
4591 
4592 static inline int inet6_ifaddr_msgsize(void)
4593 {
4594 	return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
4595 	       + nla_total_size(16) /* IFA_LOCAL */
4596 	       + nla_total_size(16) /* IFA_ADDRESS */
4597 	       + nla_total_size(sizeof(struct ifa_cacheinfo))
4598 	       + nla_total_size(4)  /* IFA_FLAGS */;
4599 }
4600 
4601 static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
4602 			     u32 portid, u32 seq, int event, unsigned int flags)
4603 {
4604 	struct nlmsghdr  *nlh;
4605 	u32 preferred, valid;
4606 
4607 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
4608 	if (!nlh)
4609 		return -EMSGSIZE;
4610 
4611 	put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
4612 		      ifa->idev->dev->ifindex);
4613 
4614 	if (!((ifa->flags&IFA_F_PERMANENT) &&
4615 	      (ifa->prefered_lft == INFINITY_LIFE_TIME))) {
4616 		preferred = ifa->prefered_lft;
4617 		valid = ifa->valid_lft;
4618 		if (preferred != INFINITY_LIFE_TIME) {
4619 			long tval = (jiffies - ifa->tstamp)/HZ;
4620 			if (preferred > tval)
4621 				preferred -= tval;
4622 			else
4623 				preferred = 0;
4624 			if (valid != INFINITY_LIFE_TIME) {
4625 				if (valid > tval)
4626 					valid -= tval;
4627 				else
4628 					valid = 0;
4629 			}
4630 		}
4631 	} else {
4632 		preferred = INFINITY_LIFE_TIME;
4633 		valid = INFINITY_LIFE_TIME;
4634 	}
4635 
4636 	if (!ipv6_addr_any(&ifa->peer_addr)) {
4637 		if (nla_put_in6_addr(skb, IFA_LOCAL, &ifa->addr) < 0 ||
4638 		    nla_put_in6_addr(skb, IFA_ADDRESS, &ifa->peer_addr) < 0)
4639 			goto error;
4640 	} else
4641 		if (nla_put_in6_addr(skb, IFA_ADDRESS, &ifa->addr) < 0)
4642 			goto error;
4643 
4644 	if (put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0)
4645 		goto error;
4646 
4647 	if (nla_put_u32(skb, IFA_FLAGS, ifa->flags) < 0)
4648 		goto error;
4649 
4650 	nlmsg_end(skb, nlh);
4651 	return 0;
4652 
4653 error:
4654 	nlmsg_cancel(skb, nlh);
4655 	return -EMSGSIZE;
4656 }
4657 
4658 static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
4659 				u32 portid, u32 seq, int event, u16 flags)
4660 {
4661 	struct nlmsghdr  *nlh;
4662 	u8 scope = RT_SCOPE_UNIVERSE;
4663 	int ifindex = ifmca->idev->dev->ifindex;
4664 
4665 	if (ipv6_addr_scope(&ifmca->mca_addr) & IFA_SITE)
4666 		scope = RT_SCOPE_SITE;
4667 
4668 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
4669 	if (!nlh)
4670 		return -EMSGSIZE;
4671 
4672 	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
4673 	if (nla_put_in6_addr(skb, IFA_MULTICAST, &ifmca->mca_addr) < 0 ||
4674 	    put_cacheinfo(skb, ifmca->mca_cstamp, ifmca->mca_tstamp,
4675 			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
4676 		nlmsg_cancel(skb, nlh);
4677 		return -EMSGSIZE;
4678 	}
4679 
4680 	nlmsg_end(skb, nlh);
4681 	return 0;
4682 }
4683 
4684 static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
4685 				u32 portid, u32 seq, int event, unsigned int flags)
4686 {
4687 	struct nlmsghdr  *nlh;
4688 	u8 scope = RT_SCOPE_UNIVERSE;
4689 	int ifindex = ifaca->aca_idev->dev->ifindex;
4690 
4691 	if (ipv6_addr_scope(&ifaca->aca_addr) & IFA_SITE)
4692 		scope = RT_SCOPE_SITE;
4693 
4694 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
4695 	if (!nlh)
4696 		return -EMSGSIZE;
4697 
4698 	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
4699 	if (nla_put_in6_addr(skb, IFA_ANYCAST, &ifaca->aca_addr) < 0 ||
4700 	    put_cacheinfo(skb, ifaca->aca_cstamp, ifaca->aca_tstamp,
4701 			  INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
4702 		nlmsg_cancel(skb, nlh);
4703 		return -EMSGSIZE;
4704 	}
4705 
4706 	nlmsg_end(skb, nlh);
4707 	return 0;
4708 }
4709 
4710 enum addr_type_t {
4711 	UNICAST_ADDR,
4712 	MULTICAST_ADDR,
4713 	ANYCAST_ADDR,
4714 };
4715 
4716 /* called with rcu_read_lock() */
4717 static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
4718 			  struct netlink_callback *cb, enum addr_type_t type,
4719 			  int s_ip_idx, int *p_ip_idx)
4720 {
4721 	struct ifmcaddr6 *ifmca;
4722 	struct ifacaddr6 *ifaca;
4723 	int err = 1;
4724 	int ip_idx = *p_ip_idx;
4725 
4726 	read_lock_bh(&idev->lock);
4727 	switch (type) {
4728 	case UNICAST_ADDR: {
4729 		struct inet6_ifaddr *ifa;
4730 
4731 		/* unicast address incl. temp addr */
4732 		list_for_each_entry(ifa, &idev->addr_list, if_list) {
4733 			if (++ip_idx < s_ip_idx)
4734 				continue;
4735 			err = inet6_fill_ifaddr(skb, ifa,
4736 						NETLINK_CB(cb->skb).portid,
4737 						cb->nlh->nlmsg_seq,
4738 						RTM_NEWADDR,
4739 						NLM_F_MULTI);
4740 			if (err < 0)
4741 				break;
4742 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4743 		}
4744 		break;
4745 	}
4746 	case MULTICAST_ADDR:
4747 		/* multicast address */
4748 		for (ifmca = idev->mc_list; ifmca;
4749 		     ifmca = ifmca->next, ip_idx++) {
4750 			if (ip_idx < s_ip_idx)
4751 				continue;
4752 			err = inet6_fill_ifmcaddr(skb, ifmca,
4753 						  NETLINK_CB(cb->skb).portid,
4754 						  cb->nlh->nlmsg_seq,
4755 						  RTM_GETMULTICAST,
4756 						  NLM_F_MULTI);
4757 			if (err < 0)
4758 				break;
4759 		}
4760 		break;
4761 	case ANYCAST_ADDR:
4762 		/* anycast address */
4763 		for (ifaca = idev->ac_list; ifaca;
4764 		     ifaca = ifaca->aca_next, ip_idx++) {
4765 			if (ip_idx < s_ip_idx)
4766 				continue;
4767 			err = inet6_fill_ifacaddr(skb, ifaca,
4768 						  NETLINK_CB(cb->skb).portid,
4769 						  cb->nlh->nlmsg_seq,
4770 						  RTM_GETANYCAST,
4771 						  NLM_F_MULTI);
4772 			if (err < 0)
4773 				break;
4774 		}
4775 		break;
4776 	default:
4777 		break;
4778 	}
4779 	read_unlock_bh(&idev->lock);
4780 	*p_ip_idx = ip_idx;
4781 	return err;
4782 }
4783 
4784 static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
4785 			   enum addr_type_t type)
4786 {
4787 	struct net *net = sock_net(skb->sk);
4788 	int h, s_h;
4789 	int idx, ip_idx;
4790 	int s_idx, s_ip_idx;
4791 	struct net_device *dev;
4792 	struct inet6_dev *idev;
4793 	struct hlist_head *head;
4794 
4795 	s_h = cb->args[0];
4796 	s_idx = idx = cb->args[1];
4797 	s_ip_idx = ip_idx = cb->args[2];
4798 
4799 	rcu_read_lock();
4800 	cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^ net->dev_base_seq;
4801 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
4802 		idx = 0;
4803 		head = &net->dev_index_head[h];
4804 		hlist_for_each_entry_rcu(dev, head, index_hlist) {
4805 			if (idx < s_idx)
4806 				goto cont;
4807 			if (h > s_h || idx > s_idx)
4808 				s_ip_idx = 0;
4809 			ip_idx = 0;
4810 			idev = __in6_dev_get(dev);
4811 			if (!idev)
4812 				goto cont;
4813 
4814 			if (in6_dump_addrs(idev, skb, cb, type,
4815 					   s_ip_idx, &ip_idx) < 0)
4816 				goto done;
4817 cont:
4818 			idx++;
4819 		}
4820 	}
4821 done:
4822 	rcu_read_unlock();
4823 	cb->args[0] = h;
4824 	cb->args[1] = idx;
4825 	cb->args[2] = ip_idx;
4826 
4827 	return skb->len;
4828 }
4829 
4830 static int inet6_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
4831 {
4832 	enum addr_type_t type = UNICAST_ADDR;
4833 
4834 	return inet6_dump_addr(skb, cb, type);
4835 }
4836 
4837 static int inet6_dump_ifmcaddr(struct sk_buff *skb, struct netlink_callback *cb)
4838 {
4839 	enum addr_type_t type = MULTICAST_ADDR;
4840 
4841 	return inet6_dump_addr(skb, cb, type);
4842 }
4843 
4844 
4845 static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
4846 {
4847 	enum addr_type_t type = ANYCAST_ADDR;
4848 
4849 	return inet6_dump_addr(skb, cb, type);
4850 }
4851 
4852 static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh)
4853 {
4854 	struct net *net = sock_net(in_skb->sk);
4855 	struct ifaddrmsg *ifm;
4856 	struct nlattr *tb[IFA_MAX+1];
4857 	struct in6_addr *addr = NULL, *peer;
4858 	struct net_device *dev = NULL;
4859 	struct inet6_ifaddr *ifa;
4860 	struct sk_buff *skb;
4861 	int err;
4862 
4863 	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
4864 	if (err < 0)
4865 		goto errout;
4866 
4867 	addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer);
4868 	if (!addr) {
4869 		err = -EINVAL;
4870 		goto errout;
4871 	}
4872 
4873 	ifm = nlmsg_data(nlh);
4874 	if (ifm->ifa_index)
4875 		dev = __dev_get_by_index(net, ifm->ifa_index);
4876 
4877 	ifa = ipv6_get_ifaddr(net, addr, dev, 1);
4878 	if (!ifa) {
4879 		err = -EADDRNOTAVAIL;
4880 		goto errout;
4881 	}
4882 
4883 	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_KERNEL);
4884 	if (!skb) {
4885 		err = -ENOBUFS;
4886 		goto errout_ifa;
4887 	}
4888 
4889 	err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).portid,
4890 				nlh->nlmsg_seq, RTM_NEWADDR, 0);
4891 	if (err < 0) {
4892 		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
4893 		WARN_ON(err == -EMSGSIZE);
4894 		kfree_skb(skb);
4895 		goto errout_ifa;
4896 	}
4897 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
4898 errout_ifa:
4899 	in6_ifa_put(ifa);
4900 errout:
4901 	return err;
4902 }
4903 
4904 static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
4905 {
4906 	struct sk_buff *skb;
4907 	struct net *net = dev_net(ifa->idev->dev);
4908 	int err = -ENOBUFS;
4909 
4910 	/* Don't send DELADDR notification for TENTATIVE address,
4911 	 * since NEWADDR notification is sent only after removing
4912 	 * TENTATIVE flag.
4913 	 */
4914 	if (ifa->flags & IFA_F_TENTATIVE && event == RTM_DELADDR)
4915 		return;
4916 
4917 	skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_ATOMIC);
4918 	if (!skb)
4919 		goto errout;
4920 
4921 	err = inet6_fill_ifaddr(skb, ifa, 0, 0, event, 0);
4922 	if (err < 0) {
4923 		/* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
4924 		WARN_ON(err == -EMSGSIZE);
4925 		kfree_skb(skb);
4926 		goto errout;
4927 	}
4928 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
4929 	return;
4930 errout:
4931 	if (err < 0)
4932 		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err);
4933 }
4934 
4935 static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
4936 				__s32 *array, int bytes)
4937 {
4938 	BUG_ON(bytes < (DEVCONF_MAX * 4));
4939 
4940 	memset(array, 0, bytes);
4941 	array[DEVCONF_FORWARDING] = cnf->forwarding;
4942 	array[DEVCONF_HOPLIMIT] = cnf->hop_limit;
4943 	array[DEVCONF_MTU6] = cnf->mtu6;
4944 	array[DEVCONF_ACCEPT_RA] = cnf->accept_ra;
4945 	array[DEVCONF_ACCEPT_REDIRECTS] = cnf->accept_redirects;
4946 	array[DEVCONF_AUTOCONF] = cnf->autoconf;
4947 	array[DEVCONF_DAD_TRANSMITS] = cnf->dad_transmits;
4948 	array[DEVCONF_RTR_SOLICITS] = cnf->rtr_solicits;
4949 	array[DEVCONF_RTR_SOLICIT_INTERVAL] =
4950 		jiffies_to_msecs(cnf->rtr_solicit_interval);
4951 	array[DEVCONF_RTR_SOLICIT_MAX_INTERVAL] =
4952 		jiffies_to_msecs(cnf->rtr_solicit_max_interval);
4953 	array[DEVCONF_RTR_SOLICIT_DELAY] =
4954 		jiffies_to_msecs(cnf->rtr_solicit_delay);
4955 	array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version;
4956 	array[DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL] =
4957 		jiffies_to_msecs(cnf->mldv1_unsolicited_report_interval);
4958 	array[DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL] =
4959 		jiffies_to_msecs(cnf->mldv2_unsolicited_report_interval);
4960 	array[DEVCONF_USE_TEMPADDR] = cnf->use_tempaddr;
4961 	array[DEVCONF_TEMP_VALID_LFT] = cnf->temp_valid_lft;
4962 	array[DEVCONF_TEMP_PREFERED_LFT] = cnf->temp_prefered_lft;
4963 	array[DEVCONF_REGEN_MAX_RETRY] = cnf->regen_max_retry;
4964 	array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor;
4965 	array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
4966 	array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
4967 	array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] = cnf->accept_ra_min_hop_limit;
4968 	array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
4969 #ifdef CONFIG_IPV6_ROUTER_PREF
4970 	array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
4971 	array[DEVCONF_RTR_PROBE_INTERVAL] =
4972 		jiffies_to_msecs(cnf->rtr_probe_interval);
4973 #ifdef CONFIG_IPV6_ROUTE_INFO
4974 	array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
4975 #endif
4976 #endif
4977 	array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;
4978 	array[DEVCONF_ACCEPT_SOURCE_ROUTE] = cnf->accept_source_route;
4979 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
4980 	array[DEVCONF_OPTIMISTIC_DAD] = cnf->optimistic_dad;
4981 	array[DEVCONF_USE_OPTIMISTIC] = cnf->use_optimistic;
4982 #endif
4983 #ifdef CONFIG_IPV6_MROUTE
4984 	array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding;
4985 #endif
4986 	array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
4987 	array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
4988 	array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
4989 	array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
4990 	array[DEVCONF_SUPPRESS_FRAG_NDISC] = cnf->suppress_frag_ndisc;
4991 	array[DEVCONF_ACCEPT_RA_FROM_LOCAL] = cnf->accept_ra_from_local;
4992 	array[DEVCONF_ACCEPT_RA_MTU] = cnf->accept_ra_mtu;
4993 	array[DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN] = cnf->ignore_routes_with_linkdown;
4994 	/* we omit DEVCONF_STABLE_SECRET for now */
4995 	array[DEVCONF_USE_OIF_ADDRS_ONLY] = cnf->use_oif_addrs_only;
4996 	array[DEVCONF_DROP_UNICAST_IN_L2_MULTICAST] = cnf->drop_unicast_in_l2_multicast;
4997 	array[DEVCONF_DROP_UNSOLICITED_NA] = cnf->drop_unsolicited_na;
4998 	array[DEVCONF_KEEP_ADDR_ON_DOWN] = cnf->keep_addr_on_down;
4999 	array[DEVCONF_SEG6_ENABLED] = cnf->seg6_enabled;
5000 #ifdef CONFIG_IPV6_SEG6_HMAC
5001 	array[DEVCONF_SEG6_REQUIRE_HMAC] = cnf->seg6_require_hmac;
5002 #endif
5003 	array[DEVCONF_ENHANCED_DAD] = cnf->enhanced_dad;
5004 	array[DEVCONF_ADDR_GEN_MODE] = cnf->addr_gen_mode;
5005 }
5006 
5007 static inline size_t inet6_ifla6_size(void)
5008 {
5009 	return nla_total_size(4) /* IFLA_INET6_FLAGS */
5010 	     + nla_total_size(sizeof(struct ifla_cacheinfo))
5011 	     + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
5012 	     + nla_total_size(IPSTATS_MIB_MAX * 8) /* IFLA_INET6_STATS */
5013 	     + nla_total_size(ICMP6_MIB_MAX * 8) /* IFLA_INET6_ICMP6STATS */
5014 	     + nla_total_size(sizeof(struct in6_addr)); /* IFLA_INET6_TOKEN */
5015 }
5016 
5017 static inline size_t inet6_if_nlmsg_size(void)
5018 {
5019 	return NLMSG_ALIGN(sizeof(struct ifinfomsg))
5020 	       + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
5021 	       + nla_total_size(MAX_ADDR_LEN) /* IFLA_ADDRESS */
5022 	       + nla_total_size(4) /* IFLA_MTU */
5023 	       + nla_total_size(4) /* IFLA_LINK */
5024 	       + nla_total_size(1) /* IFLA_OPERSTATE */
5025 	       + nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */
5026 }
5027 
5028 static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
5029 					int bytes)
5030 {
5031 	int i;
5032 	int pad = bytes - sizeof(u64) * ICMP6_MIB_MAX;
5033 	BUG_ON(pad < 0);
5034 
5035 	/* Use put_unaligned() because stats may not be aligned for u64. */
5036 	put_unaligned(ICMP6_MIB_MAX, &stats[0]);
5037 	for (i = 1; i < ICMP6_MIB_MAX; i++)
5038 		put_unaligned(atomic_long_read(&mib[i]), &stats[i]);
5039 
5040 	memset(&stats[ICMP6_MIB_MAX], 0, pad);
5041 }
5042 
5043 static inline void __snmp6_fill_stats64(u64 *stats, void __percpu *mib,
5044 					int bytes, size_t syncpoff)
5045 {
5046 	int i, c;
5047 	u64 buff[IPSTATS_MIB_MAX];
5048 	int pad = bytes - sizeof(u64) * IPSTATS_MIB_MAX;
5049 
5050 	BUG_ON(pad < 0);
5051 
5052 	memset(buff, 0, sizeof(buff));
5053 	buff[0] = IPSTATS_MIB_MAX;
5054 
5055 	for_each_possible_cpu(c) {
5056 		for (i = 1; i < IPSTATS_MIB_MAX; i++)
5057 			buff[i] += snmp_get_cpu_field64(mib, c, i, syncpoff);
5058 	}
5059 
5060 	memcpy(stats, buff, IPSTATS_MIB_MAX * sizeof(u64));
5061 	memset(&stats[IPSTATS_MIB_MAX], 0, pad);
5062 }
5063 
5064 static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
5065 			     int bytes)
5066 {
5067 	switch (attrtype) {
5068 	case IFLA_INET6_STATS:
5069 		__snmp6_fill_stats64(stats, idev->stats.ipv6, bytes,
5070 				     offsetof(struct ipstats_mib, syncp));
5071 		break;
5072 	case IFLA_INET6_ICMP6STATS:
5073 		__snmp6_fill_statsdev(stats, idev->stats.icmpv6dev->mibs, bytes);
5074 		break;
5075 	}
5076 }
5077 
5078 static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev,
5079 				  u32 ext_filter_mask)
5080 {
5081 	struct nlattr *nla;
5082 	struct ifla_cacheinfo ci;
5083 
5084 	if (nla_put_u32(skb, IFLA_INET6_FLAGS, idev->if_flags))
5085 		goto nla_put_failure;
5086 	ci.max_reasm_len = IPV6_MAXPLEN;
5087 	ci.tstamp = cstamp_delta(idev->tstamp);
5088 	ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
5089 	ci.retrans_time = jiffies_to_msecs(NEIGH_VAR(idev->nd_parms, RETRANS_TIME));
5090 	if (nla_put(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci))
5091 		goto nla_put_failure;
5092 	nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
5093 	if (!nla)
5094 		goto nla_put_failure;
5095 	ipv6_store_devconf(&idev->cnf, nla_data(nla), nla_len(nla));
5096 
5097 	/* XXX - MC not implemented */
5098 
5099 	if (ext_filter_mask & RTEXT_FILTER_SKIP_STATS)
5100 		return 0;
5101 
5102 	nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
5103 	if (!nla)
5104 		goto nla_put_failure;
5105 	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
5106 
5107 	nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
5108 	if (!nla)
5109 		goto nla_put_failure;
5110 	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
5111 
5112 	nla = nla_reserve(skb, IFLA_INET6_TOKEN, sizeof(struct in6_addr));
5113 	if (!nla)
5114 		goto nla_put_failure;
5115 
5116 	if (nla_put_u8(skb, IFLA_INET6_ADDR_GEN_MODE, idev->cnf.addr_gen_mode))
5117 		goto nla_put_failure;
5118 
5119 	read_lock_bh(&idev->lock);
5120 	memcpy(nla_data(nla), idev->token.s6_addr, nla_len(nla));
5121 	read_unlock_bh(&idev->lock);
5122 
5123 	return 0;
5124 
5125 nla_put_failure:
5126 	return -EMSGSIZE;
5127 }
5128 
5129 static size_t inet6_get_link_af_size(const struct net_device *dev,
5130 				     u32 ext_filter_mask)
5131 {
5132 	if (!__in6_dev_get(dev))
5133 		return 0;
5134 
5135 	return inet6_ifla6_size();
5136 }
5137 
5138 static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev,
5139 			      u32 ext_filter_mask)
5140 {
5141 	struct inet6_dev *idev = __in6_dev_get(dev);
5142 
5143 	if (!idev)
5144 		return -ENODATA;
5145 
5146 	if (inet6_fill_ifla6_attrs(skb, idev, ext_filter_mask) < 0)
5147 		return -EMSGSIZE;
5148 
5149 	return 0;
5150 }
5151 
5152 static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
5153 {
5154 	struct inet6_ifaddr *ifp;
5155 	struct net_device *dev = idev->dev;
5156 	bool clear_token, update_rs = false;
5157 	struct in6_addr ll_addr;
5158 
5159 	ASSERT_RTNL();
5160 
5161 	if (!token)
5162 		return -EINVAL;
5163 	if (dev->flags & (IFF_LOOPBACK | IFF_NOARP))
5164 		return -EINVAL;
5165 	if (!ipv6_accept_ra(idev))
5166 		return -EINVAL;
5167 	if (idev->cnf.rtr_solicits == 0)
5168 		return -EINVAL;
5169 
5170 	write_lock_bh(&idev->lock);
5171 
5172 	BUILD_BUG_ON(sizeof(token->s6_addr) != 16);
5173 	memcpy(idev->token.s6_addr + 8, token->s6_addr + 8, 8);
5174 
5175 	write_unlock_bh(&idev->lock);
5176 
5177 	clear_token = ipv6_addr_any(token);
5178 	if (clear_token)
5179 		goto update_lft;
5180 
5181 	if (!idev->dead && (idev->if_flags & IF_READY) &&
5182 	    !ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE |
5183 			     IFA_F_OPTIMISTIC)) {
5184 		/* If we're not ready, then normal ifup will take care
5185 		 * of this. Otherwise, we need to request our rs here.
5186 		 */
5187 		ndisc_send_rs(dev, &ll_addr, &in6addr_linklocal_allrouters);
5188 		update_rs = true;
5189 	}
5190 
5191 update_lft:
5192 	write_lock_bh(&idev->lock);
5193 
5194 	if (update_rs) {
5195 		idev->if_flags |= IF_RS_SENT;
5196 		idev->rs_interval = rfc3315_s14_backoff_init(
5197 			idev->cnf.rtr_solicit_interval);
5198 		idev->rs_probes = 1;
5199 		addrconf_mod_rs_timer(idev, idev->rs_interval);
5200 	}
5201 
5202 	/* Well, that's kinda nasty ... */
5203 	list_for_each_entry(ifp, &idev->addr_list, if_list) {
5204 		spin_lock(&ifp->lock);
5205 		if (ifp->tokenized) {
5206 			ifp->valid_lft = 0;
5207 			ifp->prefered_lft = 0;
5208 		}
5209 		spin_unlock(&ifp->lock);
5210 	}
5211 
5212 	write_unlock_bh(&idev->lock);
5213 	inet6_ifinfo_notify(RTM_NEWLINK, idev);
5214 	addrconf_verify_rtnl();
5215 	return 0;
5216 }
5217 
5218 static const struct nla_policy inet6_af_policy[IFLA_INET6_MAX + 1] = {
5219 	[IFLA_INET6_ADDR_GEN_MODE]	= { .type = NLA_U8 },
5220 	[IFLA_INET6_TOKEN]		= { .len = sizeof(struct in6_addr) },
5221 };
5222 
5223 static int inet6_validate_link_af(const struct net_device *dev,
5224 				  const struct nlattr *nla)
5225 {
5226 	struct nlattr *tb[IFLA_INET6_MAX + 1];
5227 
5228 	if (dev && !__in6_dev_get(dev))
5229 		return -EAFNOSUPPORT;
5230 
5231 	return nla_parse_nested(tb, IFLA_INET6_MAX, nla, inet6_af_policy);
5232 }
5233 
5234 static int check_addr_gen_mode(int mode)
5235 {
5236 	if (mode != IN6_ADDR_GEN_MODE_EUI64 &&
5237 	    mode != IN6_ADDR_GEN_MODE_NONE &&
5238 	    mode != IN6_ADDR_GEN_MODE_STABLE_PRIVACY &&
5239 	    mode != IN6_ADDR_GEN_MODE_RANDOM)
5240 		return -EINVAL;
5241 	return 1;
5242 }
5243 
5244 static int check_stable_privacy(struct inet6_dev *idev, struct net *net,
5245 				int mode)
5246 {
5247 	if (mode == IN6_ADDR_GEN_MODE_STABLE_PRIVACY &&
5248 	    !idev->cnf.stable_secret.initialized &&
5249 	    !net->ipv6.devconf_dflt->stable_secret.initialized)
5250 		return -EINVAL;
5251 	return 1;
5252 }
5253 
5254 static int inet6_set_link_af(struct net_device *dev, const struct nlattr *nla)
5255 {
5256 	int err = -EINVAL;
5257 	struct inet6_dev *idev = __in6_dev_get(dev);
5258 	struct nlattr *tb[IFLA_INET6_MAX + 1];
5259 
5260 	if (!idev)
5261 		return -EAFNOSUPPORT;
5262 
5263 	if (nla_parse_nested(tb, IFLA_INET6_MAX, nla, NULL) < 0)
5264 		BUG();
5265 
5266 	if (tb[IFLA_INET6_TOKEN]) {
5267 		err = inet6_set_iftoken(idev, nla_data(tb[IFLA_INET6_TOKEN]));
5268 		if (err)
5269 			return err;
5270 	}
5271 
5272 	if (tb[IFLA_INET6_ADDR_GEN_MODE]) {
5273 		u8 mode = nla_get_u8(tb[IFLA_INET6_ADDR_GEN_MODE]);
5274 
5275 		if (check_addr_gen_mode(mode) < 0 ||
5276 		    check_stable_privacy(idev, dev_net(dev), mode) < 0)
5277 			return -EINVAL;
5278 
5279 		idev->cnf.addr_gen_mode = mode;
5280 		err = 0;
5281 	}
5282 
5283 	return err;
5284 }
5285 
5286 static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
5287 			     u32 portid, u32 seq, int event, unsigned int flags)
5288 {
5289 	struct net_device *dev = idev->dev;
5290 	struct ifinfomsg *hdr;
5291 	struct nlmsghdr *nlh;
5292 	void *protoinfo;
5293 
5294 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*hdr), flags);
5295 	if (!nlh)
5296 		return -EMSGSIZE;
5297 
5298 	hdr = nlmsg_data(nlh);
5299 	hdr->ifi_family = AF_INET6;
5300 	hdr->__ifi_pad = 0;
5301 	hdr->ifi_type = dev->type;
5302 	hdr->ifi_index = dev->ifindex;
5303 	hdr->ifi_flags = dev_get_flags(dev);
5304 	hdr->ifi_change = 0;
5305 
5306 	if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
5307 	    (dev->addr_len &&
5308 	     nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr)) ||
5309 	    nla_put_u32(skb, IFLA_MTU, dev->mtu) ||
5310 	    (dev->ifindex != dev_get_iflink(dev) &&
5311 	     nla_put_u32(skb, IFLA_LINK, dev_get_iflink(dev))) ||
5312 	    nla_put_u8(skb, IFLA_OPERSTATE,
5313 		       netif_running(dev) ? dev->operstate : IF_OPER_DOWN))
5314 		goto nla_put_failure;
5315 	protoinfo = nla_nest_start(skb, IFLA_PROTINFO);
5316 	if (!protoinfo)
5317 		goto nla_put_failure;
5318 
5319 	if (inet6_fill_ifla6_attrs(skb, idev, 0) < 0)
5320 		goto nla_put_failure;
5321 
5322 	nla_nest_end(skb, protoinfo);
5323 	nlmsg_end(skb, nlh);
5324 	return 0;
5325 
5326 nla_put_failure:
5327 	nlmsg_cancel(skb, nlh);
5328 	return -EMSGSIZE;
5329 }
5330 
5331 static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
5332 {
5333 	struct net *net = sock_net(skb->sk);
5334 	int h, s_h;
5335 	int idx = 0, s_idx;
5336 	struct net_device *dev;
5337 	struct inet6_dev *idev;
5338 	struct hlist_head *head;
5339 
5340 	s_h = cb->args[0];
5341 	s_idx = cb->args[1];
5342 
5343 	rcu_read_lock();
5344 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
5345 		idx = 0;
5346 		head = &net->dev_index_head[h];
5347 		hlist_for_each_entry_rcu(dev, head, index_hlist) {
5348 			if (idx < s_idx)
5349 				goto cont;
5350 			idev = __in6_dev_get(dev);
5351 			if (!idev)
5352 				goto cont;
5353 			if (inet6_fill_ifinfo(skb, idev,
5354 					      NETLINK_CB(cb->skb).portid,
5355 					      cb->nlh->nlmsg_seq,
5356 					      RTM_NEWLINK, NLM_F_MULTI) < 0)
5357 				goto out;
5358 cont:
5359 			idx++;
5360 		}
5361 	}
5362 out:
5363 	rcu_read_unlock();
5364 	cb->args[1] = idx;
5365 	cb->args[0] = h;
5366 
5367 	return skb->len;
5368 }
5369 
5370 void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
5371 {
5372 	struct sk_buff *skb;
5373 	struct net *net = dev_net(idev->dev);
5374 	int err = -ENOBUFS;
5375 
5376 	skb = nlmsg_new(inet6_if_nlmsg_size(), GFP_ATOMIC);
5377 	if (!skb)
5378 		goto errout;
5379 
5380 	err = inet6_fill_ifinfo(skb, idev, 0, 0, event, 0);
5381 	if (err < 0) {
5382 		/* -EMSGSIZE implies BUG in inet6_if_nlmsg_size() */
5383 		WARN_ON(err == -EMSGSIZE);
5384 		kfree_skb(skb);
5385 		goto errout;
5386 	}
5387 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFINFO, NULL, GFP_ATOMIC);
5388 	return;
5389 errout:
5390 	if (err < 0)
5391 		rtnl_set_sk_err(net, RTNLGRP_IPV6_IFINFO, err);
5392 }
5393 
5394 static inline size_t inet6_prefix_nlmsg_size(void)
5395 {
5396 	return NLMSG_ALIGN(sizeof(struct prefixmsg))
5397 	       + nla_total_size(sizeof(struct in6_addr))
5398 	       + nla_total_size(sizeof(struct prefix_cacheinfo));
5399 }
5400 
5401 static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
5402 			     struct prefix_info *pinfo, u32 portid, u32 seq,
5403 			     int event, unsigned int flags)
5404 {
5405 	struct prefixmsg *pmsg;
5406 	struct nlmsghdr *nlh;
5407 	struct prefix_cacheinfo	ci;
5408 
5409 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*pmsg), flags);
5410 	if (!nlh)
5411 		return -EMSGSIZE;
5412 
5413 	pmsg = nlmsg_data(nlh);
5414 	pmsg->prefix_family = AF_INET6;
5415 	pmsg->prefix_pad1 = 0;
5416 	pmsg->prefix_pad2 = 0;
5417 	pmsg->prefix_ifindex = idev->dev->ifindex;
5418 	pmsg->prefix_len = pinfo->prefix_len;
5419 	pmsg->prefix_type = pinfo->type;
5420 	pmsg->prefix_pad3 = 0;
5421 	pmsg->prefix_flags = 0;
5422 	if (pinfo->onlink)
5423 		pmsg->prefix_flags |= IF_PREFIX_ONLINK;
5424 	if (pinfo->autoconf)
5425 		pmsg->prefix_flags |= IF_PREFIX_AUTOCONF;
5426 
5427 	if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix))
5428 		goto nla_put_failure;
5429 	ci.preferred_time = ntohl(pinfo->prefered);
5430 	ci.valid_time = ntohl(pinfo->valid);
5431 	if (nla_put(skb, PREFIX_CACHEINFO, sizeof(ci), &ci))
5432 		goto nla_put_failure;
5433 	nlmsg_end(skb, nlh);
5434 	return 0;
5435 
5436 nla_put_failure:
5437 	nlmsg_cancel(skb, nlh);
5438 	return -EMSGSIZE;
5439 }
5440 
5441 static void inet6_prefix_notify(int event, struct inet6_dev *idev,
5442 			 struct prefix_info *pinfo)
5443 {
5444 	struct sk_buff *skb;
5445 	struct net *net = dev_net(idev->dev);
5446 	int err = -ENOBUFS;
5447 
5448 	skb = nlmsg_new(inet6_prefix_nlmsg_size(), GFP_ATOMIC);
5449 	if (!skb)
5450 		goto errout;
5451 
5452 	err = inet6_fill_prefix(skb, idev, pinfo, 0, 0, event, 0);
5453 	if (err < 0) {
5454 		/* -EMSGSIZE implies BUG in inet6_prefix_nlmsg_size() */
5455 		WARN_ON(err == -EMSGSIZE);
5456 		kfree_skb(skb);
5457 		goto errout;
5458 	}
5459 	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
5460 	return;
5461 errout:
5462 	if (err < 0)
5463 		rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
5464 }
5465 
5466 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
5467 {
5468 	struct net *net = dev_net(ifp->idev->dev);
5469 
5470 	if (event)
5471 		ASSERT_RTNL();
5472 
5473 	inet6_ifa_notify(event ? : RTM_NEWADDR, ifp);
5474 
5475 	switch (event) {
5476 	case RTM_NEWADDR:
5477 		/*
5478 		 * If the address was optimistic
5479 		 * we inserted the route at the start of
5480 		 * our DAD process, so we don't need
5481 		 * to do it again
5482 		 */
5483 		if (!(ifp->rt->rt6i_node))
5484 			ip6_ins_rt(ifp->rt);
5485 		if (ifp->idev->cnf.forwarding)
5486 			addrconf_join_anycast(ifp);
5487 		if (!ipv6_addr_any(&ifp->peer_addr))
5488 			addrconf_prefix_route(&ifp->peer_addr, 128,
5489 					      ifp->idev->dev, 0, 0);
5490 		break;
5491 	case RTM_DELADDR:
5492 		if (ifp->idev->cnf.forwarding)
5493 			addrconf_leave_anycast(ifp);
5494 		addrconf_leave_solict(ifp->idev, &ifp->addr);
5495 		if (!ipv6_addr_any(&ifp->peer_addr)) {
5496 			struct rt6_info *rt;
5497 
5498 			rt = addrconf_get_prefix_route(&ifp->peer_addr, 128,
5499 						       ifp->idev->dev, 0, 0);
5500 			if (rt)
5501 				ip6_del_rt(rt);
5502 		}
5503 		if (ifp->rt) {
5504 			dst_hold(&ifp->rt->dst);
5505 			ip6_del_rt(ifp->rt);
5506 		}
5507 		rt_genid_bump_ipv6(net);
5508 		break;
5509 	}
5510 	atomic_inc(&net->ipv6.dev_addr_genid);
5511 }
5512 
5513 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
5514 {
5515 	rcu_read_lock_bh();
5516 	if (likely(ifp->idev->dead == 0))
5517 		__ipv6_ifa_notify(event, ifp);
5518 	rcu_read_unlock_bh();
5519 }
5520 
5521 #ifdef CONFIG_SYSCTL
5522 
5523 static
5524 int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
5525 			   void __user *buffer, size_t *lenp, loff_t *ppos)
5526 {
5527 	int *valp = ctl->data;
5528 	int val = *valp;
5529 	loff_t pos = *ppos;
5530 	struct ctl_table lctl;
5531 	int ret;
5532 
5533 	/*
5534 	 * ctl->data points to idev->cnf.forwarding, we should
5535 	 * not modify it until we get the rtnl lock.
5536 	 */
5537 	lctl = *ctl;
5538 	lctl.data = &val;
5539 
5540 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
5541 
5542 	if (write)
5543 		ret = addrconf_fixup_forwarding(ctl, valp, val);
5544 	if (ret)
5545 		*ppos = pos;
5546 	return ret;
5547 }
5548 
5549 static
5550 int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
5551 			void __user *buffer, size_t *lenp, loff_t *ppos)
5552 {
5553 	struct inet6_dev *idev = ctl->extra1;
5554 	int min_mtu = IPV6_MIN_MTU;
5555 	struct ctl_table lctl;
5556 
5557 	lctl = *ctl;
5558 	lctl.extra1 = &min_mtu;
5559 	lctl.extra2 = idev ? &idev->dev->mtu : NULL;
5560 
5561 	return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
5562 }
5563 
5564 static void dev_disable_change(struct inet6_dev *idev)
5565 {
5566 	struct netdev_notifier_info info;
5567 
5568 	if (!idev || !idev->dev)
5569 		return;
5570 
5571 	netdev_notifier_info_init(&info, idev->dev);
5572 	if (idev->cnf.disable_ipv6)
5573 		addrconf_notify(NULL, NETDEV_DOWN, &info);
5574 	else
5575 		addrconf_notify(NULL, NETDEV_UP, &info);
5576 }
5577 
5578 static void addrconf_disable_change(struct net *net, __s32 newf)
5579 {
5580 	struct net_device *dev;
5581 	struct inet6_dev *idev;
5582 
5583 	for_each_netdev(net, dev) {
5584 		idev = __in6_dev_get(dev);
5585 		if (idev) {
5586 			int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
5587 			idev->cnf.disable_ipv6 = newf;
5588 			if (changed)
5589 				dev_disable_change(idev);
5590 		}
5591 	}
5592 }
5593 
5594 static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
5595 {
5596 	struct net *net;
5597 	int old;
5598 
5599 	if (!rtnl_trylock())
5600 		return restart_syscall();
5601 
5602 	net = (struct net *)table->extra2;
5603 	old = *p;
5604 	*p = newf;
5605 
5606 	if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
5607 		rtnl_unlock();
5608 		return 0;
5609 	}
5610 
5611 	if (p == &net->ipv6.devconf_all->disable_ipv6) {
5612 		net->ipv6.devconf_dflt->disable_ipv6 = newf;
5613 		addrconf_disable_change(net, newf);
5614 	} else if ((!newf) ^ (!old))
5615 		dev_disable_change((struct inet6_dev *)table->extra1);
5616 
5617 	rtnl_unlock();
5618 	return 0;
5619 }
5620 
5621 static
5622 int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
5623 			    void __user *buffer, size_t *lenp, loff_t *ppos)
5624 {
5625 	int *valp = ctl->data;
5626 	int val = *valp;
5627 	loff_t pos = *ppos;
5628 	struct ctl_table lctl;
5629 	int ret;
5630 
5631 	/*
5632 	 * ctl->data points to idev->cnf.disable_ipv6, we should
5633 	 * not modify it until we get the rtnl lock.
5634 	 */
5635 	lctl = *ctl;
5636 	lctl.data = &val;
5637 
5638 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
5639 
5640 	if (write)
5641 		ret = addrconf_disable_ipv6(ctl, valp, val);
5642 	if (ret)
5643 		*ppos = pos;
5644 	return ret;
5645 }
5646 
5647 static
5648 int addrconf_sysctl_proxy_ndp(struct ctl_table *ctl, int write,
5649 			      void __user *buffer, size_t *lenp, loff_t *ppos)
5650 {
5651 	int *valp = ctl->data;
5652 	int ret;
5653 	int old, new;
5654 
5655 	old = *valp;
5656 	ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
5657 	new = *valp;
5658 
5659 	if (write && old != new) {
5660 		struct net *net = ctl->extra2;
5661 
5662 		if (!rtnl_trylock())
5663 			return restart_syscall();
5664 
5665 		if (valp == &net->ipv6.devconf_dflt->proxy_ndp)
5666 			inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
5667 						     NETCONFA_IFINDEX_DEFAULT,
5668 						     net->ipv6.devconf_dflt);
5669 		else if (valp == &net->ipv6.devconf_all->proxy_ndp)
5670 			inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
5671 						     NETCONFA_IFINDEX_ALL,
5672 						     net->ipv6.devconf_all);
5673 		else {
5674 			struct inet6_dev *idev = ctl->extra1;
5675 
5676 			inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
5677 						     idev->dev->ifindex,
5678 						     &idev->cnf);
5679 		}
5680 		rtnl_unlock();
5681 	}
5682 
5683 	return ret;
5684 }
5685 
5686 static int addrconf_sysctl_addr_gen_mode(struct ctl_table *ctl, int write,
5687 					 void __user *buffer, size_t *lenp,
5688 					 loff_t *ppos)
5689 {
5690 	int ret = 0;
5691 	int new_val;
5692 	struct inet6_dev *idev = (struct inet6_dev *)ctl->extra1;
5693 	struct net *net = (struct net *)ctl->extra2;
5694 
5695 	ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
5696 
5697 	if (write) {
5698 		new_val = *((int *)ctl->data);
5699 
5700 		if (check_addr_gen_mode(new_val) < 0)
5701 			return -EINVAL;
5702 
5703 		/* request for default */
5704 		if (&net->ipv6.devconf_dflt->addr_gen_mode == ctl->data) {
5705 			ipv6_devconf_dflt.addr_gen_mode = new_val;
5706 
5707 		/* request for individual net device */
5708 		} else {
5709 			if (!idev)
5710 				return ret;
5711 
5712 			if (check_stable_privacy(idev, net, new_val) < 0)
5713 				return -EINVAL;
5714 
5715 			if (idev->cnf.addr_gen_mode != new_val) {
5716 				idev->cnf.addr_gen_mode = new_val;
5717 				rtnl_lock();
5718 				addrconf_dev_config(idev->dev);
5719 				rtnl_unlock();
5720 			}
5721 		}
5722 	}
5723 
5724 	return ret;
5725 }
5726 
5727 static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
5728 					 void __user *buffer, size_t *lenp,
5729 					 loff_t *ppos)
5730 {
5731 	int err;
5732 	struct in6_addr addr;
5733 	char str[IPV6_MAX_STRLEN];
5734 	struct ctl_table lctl = *ctl;
5735 	struct net *net = ctl->extra2;
5736 	struct ipv6_stable_secret *secret = ctl->data;
5737 
5738 	if (&net->ipv6.devconf_all->stable_secret == ctl->data)
5739 		return -EIO;
5740 
5741 	lctl.maxlen = IPV6_MAX_STRLEN;
5742 	lctl.data = str;
5743 
5744 	if (!rtnl_trylock())
5745 		return restart_syscall();
5746 
5747 	if (!write && !secret->initialized) {
5748 		err = -EIO;
5749 		goto out;
5750 	}
5751 
5752 	err = snprintf(str, sizeof(str), "%pI6", &secret->secret);
5753 	if (err >= sizeof(str)) {
5754 		err = -EIO;
5755 		goto out;
5756 	}
5757 
5758 	err = proc_dostring(&lctl, write, buffer, lenp, ppos);
5759 	if (err || !write)
5760 		goto out;
5761 
5762 	if (in6_pton(str, -1, addr.in6_u.u6_addr8, -1, NULL) != 1) {
5763 		err = -EIO;
5764 		goto out;
5765 	}
5766 
5767 	secret->initialized = true;
5768 	secret->secret = addr;
5769 
5770 	if (&net->ipv6.devconf_dflt->stable_secret == ctl->data) {
5771 		struct net_device *dev;
5772 
5773 		for_each_netdev(net, dev) {
5774 			struct inet6_dev *idev = __in6_dev_get(dev);
5775 
5776 			if (idev) {
5777 				idev->cnf.addr_gen_mode =
5778 					IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
5779 			}
5780 		}
5781 	} else {
5782 		struct inet6_dev *idev = ctl->extra1;
5783 
5784 		idev->cnf.addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
5785 	}
5786 
5787 out:
5788 	rtnl_unlock();
5789 
5790 	return err;
5791 }
5792 
5793 static
5794 int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
5795 						int write,
5796 						void __user *buffer,
5797 						size_t *lenp,
5798 						loff_t *ppos)
5799 {
5800 	int *valp = ctl->data;
5801 	int val = *valp;
5802 	loff_t pos = *ppos;
5803 	struct ctl_table lctl;
5804 	int ret;
5805 
5806 	/* ctl->data points to idev->cnf.ignore_routes_when_linkdown
5807 	 * we should not modify it until we get the rtnl lock.
5808 	 */
5809 	lctl = *ctl;
5810 	lctl.data = &val;
5811 
5812 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
5813 
5814 	if (write)
5815 		ret = addrconf_fixup_linkdown(ctl, valp, val);
5816 	if (ret)
5817 		*ppos = pos;
5818 	return ret;
5819 }
5820 
5821 static int minus_one = -1;
5822 static const int one = 1;
5823 static const int two_five_five = 255;
5824 
5825 static const struct ctl_table addrconf_sysctl[] = {
5826 	{
5827 		.procname	= "forwarding",
5828 		.data		= &ipv6_devconf.forwarding,
5829 		.maxlen		= sizeof(int),
5830 		.mode		= 0644,
5831 		.proc_handler	= addrconf_sysctl_forward,
5832 	},
5833 	{
5834 		.procname	= "hop_limit",
5835 		.data		= &ipv6_devconf.hop_limit,
5836 		.maxlen		= sizeof(int),
5837 		.mode		= 0644,
5838 		.proc_handler	= proc_dointvec_minmax,
5839 		.extra1		= (void *)&one,
5840 		.extra2		= (void *)&two_five_five,
5841 	},
5842 	{
5843 		.procname	= "mtu",
5844 		.data		= &ipv6_devconf.mtu6,
5845 		.maxlen		= sizeof(int),
5846 		.mode		= 0644,
5847 		.proc_handler	= addrconf_sysctl_mtu,
5848 	},
5849 	{
5850 		.procname	= "accept_ra",
5851 		.data		= &ipv6_devconf.accept_ra,
5852 		.maxlen		= sizeof(int),
5853 		.mode		= 0644,
5854 		.proc_handler	= proc_dointvec,
5855 	},
5856 	{
5857 		.procname	= "accept_redirects",
5858 		.data		= &ipv6_devconf.accept_redirects,
5859 		.maxlen		= sizeof(int),
5860 		.mode		= 0644,
5861 		.proc_handler	= proc_dointvec,
5862 	},
5863 	{
5864 		.procname	= "autoconf",
5865 		.data		= &ipv6_devconf.autoconf,
5866 		.maxlen		= sizeof(int),
5867 		.mode		= 0644,
5868 		.proc_handler	= proc_dointvec,
5869 	},
5870 	{
5871 		.procname	= "dad_transmits",
5872 		.data		= &ipv6_devconf.dad_transmits,
5873 		.maxlen		= sizeof(int),
5874 		.mode		= 0644,
5875 		.proc_handler	= proc_dointvec,
5876 	},
5877 	{
5878 		.procname	= "router_solicitations",
5879 		.data		= &ipv6_devconf.rtr_solicits,
5880 		.maxlen		= sizeof(int),
5881 		.mode		= 0644,
5882 		.proc_handler	= proc_dointvec_minmax,
5883 		.extra1		= &minus_one,
5884 	},
5885 	{
5886 		.procname	= "router_solicitation_interval",
5887 		.data		= &ipv6_devconf.rtr_solicit_interval,
5888 		.maxlen		= sizeof(int),
5889 		.mode		= 0644,
5890 		.proc_handler	= proc_dointvec_jiffies,
5891 	},
5892 	{
5893 		.procname	= "router_solicitation_max_interval",
5894 		.data		= &ipv6_devconf.rtr_solicit_max_interval,
5895 		.maxlen		= sizeof(int),
5896 		.mode		= 0644,
5897 		.proc_handler	= proc_dointvec_jiffies,
5898 	},
5899 	{
5900 		.procname	= "router_solicitation_delay",
5901 		.data		= &ipv6_devconf.rtr_solicit_delay,
5902 		.maxlen		= sizeof(int),
5903 		.mode		= 0644,
5904 		.proc_handler	= proc_dointvec_jiffies,
5905 	},
5906 	{
5907 		.procname	= "force_mld_version",
5908 		.data		= &ipv6_devconf.force_mld_version,
5909 		.maxlen		= sizeof(int),
5910 		.mode		= 0644,
5911 		.proc_handler	= proc_dointvec,
5912 	},
5913 	{
5914 		.procname	= "mldv1_unsolicited_report_interval",
5915 		.data		=
5916 			&ipv6_devconf.mldv1_unsolicited_report_interval,
5917 		.maxlen		= sizeof(int),
5918 		.mode		= 0644,
5919 		.proc_handler	= proc_dointvec_ms_jiffies,
5920 	},
5921 	{
5922 		.procname	= "mldv2_unsolicited_report_interval",
5923 		.data		=
5924 			&ipv6_devconf.mldv2_unsolicited_report_interval,
5925 		.maxlen		= sizeof(int),
5926 		.mode		= 0644,
5927 		.proc_handler	= proc_dointvec_ms_jiffies,
5928 	},
5929 	{
5930 		.procname	= "use_tempaddr",
5931 		.data		= &ipv6_devconf.use_tempaddr,
5932 		.maxlen		= sizeof(int),
5933 		.mode		= 0644,
5934 		.proc_handler	= proc_dointvec,
5935 	},
5936 	{
5937 		.procname	= "temp_valid_lft",
5938 		.data		= &ipv6_devconf.temp_valid_lft,
5939 		.maxlen		= sizeof(int),
5940 		.mode		= 0644,
5941 		.proc_handler	= proc_dointvec,
5942 	},
5943 	{
5944 		.procname	= "temp_prefered_lft",
5945 		.data		= &ipv6_devconf.temp_prefered_lft,
5946 		.maxlen		= sizeof(int),
5947 		.mode		= 0644,
5948 		.proc_handler	= proc_dointvec,
5949 	},
5950 	{
5951 		.procname	= "regen_max_retry",
5952 		.data		= &ipv6_devconf.regen_max_retry,
5953 		.maxlen		= sizeof(int),
5954 		.mode		= 0644,
5955 		.proc_handler	= proc_dointvec,
5956 	},
5957 	{
5958 		.procname	= "max_desync_factor",
5959 		.data		= &ipv6_devconf.max_desync_factor,
5960 		.maxlen		= sizeof(int),
5961 		.mode		= 0644,
5962 		.proc_handler	= proc_dointvec,
5963 	},
5964 	{
5965 		.procname	= "max_addresses",
5966 		.data		= &ipv6_devconf.max_addresses,
5967 		.maxlen		= sizeof(int),
5968 		.mode		= 0644,
5969 		.proc_handler	= proc_dointvec,
5970 	},
5971 	{
5972 		.procname	= "accept_ra_defrtr",
5973 		.data		= &ipv6_devconf.accept_ra_defrtr,
5974 		.maxlen		= sizeof(int),
5975 		.mode		= 0644,
5976 		.proc_handler	= proc_dointvec,
5977 	},
5978 	{
5979 		.procname	= "accept_ra_min_hop_limit",
5980 		.data		= &ipv6_devconf.accept_ra_min_hop_limit,
5981 		.maxlen		= sizeof(int),
5982 		.mode		= 0644,
5983 		.proc_handler	= proc_dointvec,
5984 	},
5985 	{
5986 		.procname	= "accept_ra_pinfo",
5987 		.data		= &ipv6_devconf.accept_ra_pinfo,
5988 		.maxlen		= sizeof(int),
5989 		.mode		= 0644,
5990 		.proc_handler	= proc_dointvec,
5991 	},
5992 #ifdef CONFIG_IPV6_ROUTER_PREF
5993 	{
5994 		.procname	= "accept_ra_rtr_pref",
5995 		.data		= &ipv6_devconf.accept_ra_rtr_pref,
5996 		.maxlen		= sizeof(int),
5997 		.mode		= 0644,
5998 		.proc_handler	= proc_dointvec,
5999 	},
6000 	{
6001 		.procname	= "router_probe_interval",
6002 		.data		= &ipv6_devconf.rtr_probe_interval,
6003 		.maxlen		= sizeof(int),
6004 		.mode		= 0644,
6005 		.proc_handler	= proc_dointvec_jiffies,
6006 	},
6007 #ifdef CONFIG_IPV6_ROUTE_INFO
6008 	{
6009 		.procname	= "accept_ra_rt_info_max_plen",
6010 		.data		= &ipv6_devconf.accept_ra_rt_info_max_plen,
6011 		.maxlen		= sizeof(int),
6012 		.mode		= 0644,
6013 		.proc_handler	= proc_dointvec,
6014 	},
6015 #endif
6016 #endif
6017 	{
6018 		.procname	= "proxy_ndp",
6019 		.data		= &ipv6_devconf.proxy_ndp,
6020 		.maxlen		= sizeof(int),
6021 		.mode		= 0644,
6022 		.proc_handler	= addrconf_sysctl_proxy_ndp,
6023 	},
6024 	{
6025 		.procname	= "accept_source_route",
6026 		.data		= &ipv6_devconf.accept_source_route,
6027 		.maxlen		= sizeof(int),
6028 		.mode		= 0644,
6029 		.proc_handler	= proc_dointvec,
6030 	},
6031 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
6032 	{
6033 		.procname	= "optimistic_dad",
6034 		.data		= &ipv6_devconf.optimistic_dad,
6035 		.maxlen		= sizeof(int),
6036 		.mode		= 0644,
6037 		.proc_handler   = proc_dointvec,
6038 	},
6039 	{
6040 		.procname	= "use_optimistic",
6041 		.data		= &ipv6_devconf.use_optimistic,
6042 		.maxlen		= sizeof(int),
6043 		.mode		= 0644,
6044 		.proc_handler	= proc_dointvec,
6045 	},
6046 #endif
6047 #ifdef CONFIG_IPV6_MROUTE
6048 	{
6049 		.procname	= "mc_forwarding",
6050 		.data		= &ipv6_devconf.mc_forwarding,
6051 		.maxlen		= sizeof(int),
6052 		.mode		= 0444,
6053 		.proc_handler	= proc_dointvec,
6054 	},
6055 #endif
6056 	{
6057 		.procname	= "disable_ipv6",
6058 		.data		= &ipv6_devconf.disable_ipv6,
6059 		.maxlen		= sizeof(int),
6060 		.mode		= 0644,
6061 		.proc_handler	= addrconf_sysctl_disable,
6062 	},
6063 	{
6064 		.procname	= "accept_dad",
6065 		.data		= &ipv6_devconf.accept_dad,
6066 		.maxlen		= sizeof(int),
6067 		.mode		= 0644,
6068 		.proc_handler	= proc_dointvec,
6069 	},
6070 	{
6071 		.procname	= "force_tllao",
6072 		.data		= &ipv6_devconf.force_tllao,
6073 		.maxlen		= sizeof(int),
6074 		.mode		= 0644,
6075 		.proc_handler	= proc_dointvec
6076 	},
6077 	{
6078 		.procname	= "ndisc_notify",
6079 		.data		= &ipv6_devconf.ndisc_notify,
6080 		.maxlen		= sizeof(int),
6081 		.mode		= 0644,
6082 		.proc_handler	= proc_dointvec
6083 	},
6084 	{
6085 		.procname	= "suppress_frag_ndisc",
6086 		.data		= &ipv6_devconf.suppress_frag_ndisc,
6087 		.maxlen		= sizeof(int),
6088 		.mode		= 0644,
6089 		.proc_handler	= proc_dointvec
6090 	},
6091 	{
6092 		.procname	= "accept_ra_from_local",
6093 		.data		= &ipv6_devconf.accept_ra_from_local,
6094 		.maxlen		= sizeof(int),
6095 		.mode		= 0644,
6096 		.proc_handler	= proc_dointvec,
6097 	},
6098 	{
6099 		.procname	= "accept_ra_mtu",
6100 		.data		= &ipv6_devconf.accept_ra_mtu,
6101 		.maxlen		= sizeof(int),
6102 		.mode		= 0644,
6103 		.proc_handler	= proc_dointvec,
6104 	},
6105 	{
6106 		.procname	= "stable_secret",
6107 		.data		= &ipv6_devconf.stable_secret,
6108 		.maxlen		= IPV6_MAX_STRLEN,
6109 		.mode		= 0600,
6110 		.proc_handler	= addrconf_sysctl_stable_secret,
6111 	},
6112 	{
6113 		.procname	= "use_oif_addrs_only",
6114 		.data		= &ipv6_devconf.use_oif_addrs_only,
6115 		.maxlen		= sizeof(int),
6116 		.mode		= 0644,
6117 		.proc_handler	= proc_dointvec,
6118 	},
6119 	{
6120 		.procname	= "ignore_routes_with_linkdown",
6121 		.data		= &ipv6_devconf.ignore_routes_with_linkdown,
6122 		.maxlen		= sizeof(int),
6123 		.mode		= 0644,
6124 		.proc_handler	= addrconf_sysctl_ignore_routes_with_linkdown,
6125 	},
6126 	{
6127 		.procname	= "drop_unicast_in_l2_multicast",
6128 		.data		= &ipv6_devconf.drop_unicast_in_l2_multicast,
6129 		.maxlen		= sizeof(int),
6130 		.mode		= 0644,
6131 		.proc_handler	= proc_dointvec,
6132 	},
6133 	{
6134 		.procname	= "drop_unsolicited_na",
6135 		.data		= &ipv6_devconf.drop_unsolicited_na,
6136 		.maxlen		= sizeof(int),
6137 		.mode		= 0644,
6138 		.proc_handler	= proc_dointvec,
6139 	},
6140 	{
6141 		.procname	= "keep_addr_on_down",
6142 		.data		= &ipv6_devconf.keep_addr_on_down,
6143 		.maxlen		= sizeof(int),
6144 		.mode		= 0644,
6145 		.proc_handler	= proc_dointvec,
6146 
6147 	},
6148 	{
6149 		.procname	= "seg6_enabled",
6150 		.data		= &ipv6_devconf.seg6_enabled,
6151 		.maxlen		= sizeof(int),
6152 		.mode		= 0644,
6153 		.proc_handler	= proc_dointvec,
6154 	},
6155 #ifdef CONFIG_IPV6_SEG6_HMAC
6156 	{
6157 		.procname	= "seg6_require_hmac",
6158 		.data		= &ipv6_devconf.seg6_require_hmac,
6159 		.maxlen		= sizeof(int),
6160 		.mode		= 0644,
6161 		.proc_handler	= proc_dointvec,
6162 	},
6163 #endif
6164 	{
6165 		.procname       = "enhanced_dad",
6166 		.data           = &ipv6_devconf.enhanced_dad,
6167 		.maxlen         = sizeof(int),
6168 		.mode           = 0644,
6169 		.proc_handler   = proc_dointvec,
6170 	},
6171 	{
6172 		.procname		= "addr_gen_mode",
6173 		.data			= &ipv6_devconf.addr_gen_mode,
6174 		.maxlen			= sizeof(int),
6175 		.mode			= 0644,
6176 		.proc_handler	= addrconf_sysctl_addr_gen_mode,
6177 	},
6178 	{
6179 		/* sentinel */
6180 	}
6181 };
6182 
6183 static int __addrconf_sysctl_register(struct net *net, char *dev_name,
6184 		struct inet6_dev *idev, struct ipv6_devconf *p)
6185 {
6186 	int i, ifindex;
6187 	struct ctl_table *table;
6188 	char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
6189 
6190 	table = kmemdup(addrconf_sysctl, sizeof(addrconf_sysctl), GFP_KERNEL);
6191 	if (!table)
6192 		goto out;
6193 
6194 	for (i = 0; table[i].data; i++) {
6195 		table[i].data += (char *)p - (char *)&ipv6_devconf;
6196 		/* If one of these is already set, then it is not safe to
6197 		 * overwrite either of them: this makes proc_dointvec_minmax
6198 		 * usable.
6199 		 */
6200 		if (!table[i].extra1 && !table[i].extra2) {
6201 			table[i].extra1 = idev; /* embedded; no ref */
6202 			table[i].extra2 = net;
6203 		}
6204 	}
6205 
6206 	snprintf(path, sizeof(path), "net/ipv6/conf/%s", dev_name);
6207 
6208 	p->sysctl_header = register_net_sysctl(net, path, table);
6209 	if (!p->sysctl_header)
6210 		goto free;
6211 
6212 	if (!strcmp(dev_name, "all"))
6213 		ifindex = NETCONFA_IFINDEX_ALL;
6214 	else if (!strcmp(dev_name, "default"))
6215 		ifindex = NETCONFA_IFINDEX_DEFAULT;
6216 	else
6217 		ifindex = idev->dev->ifindex;
6218 	inet6_netconf_notify_devconf(net, NETCONFA_ALL, ifindex, p);
6219 	return 0;
6220 
6221 free:
6222 	kfree(table);
6223 out:
6224 	return -ENOBUFS;
6225 }
6226 
6227 static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
6228 {
6229 	struct ctl_table *table;
6230 
6231 	if (!p->sysctl_header)
6232 		return;
6233 
6234 	table = p->sysctl_header->ctl_table_arg;
6235 	unregister_net_sysctl_table(p->sysctl_header);
6236 	p->sysctl_header = NULL;
6237 	kfree(table);
6238 }
6239 
6240 static int addrconf_sysctl_register(struct inet6_dev *idev)
6241 {
6242 	int err;
6243 
6244 	if (!sysctl_dev_name_is_allowed(idev->dev->name))
6245 		return -EINVAL;
6246 
6247 	err = neigh_sysctl_register(idev->dev, idev->nd_parms,
6248 				    &ndisc_ifinfo_sysctl_change);
6249 	if (err)
6250 		return err;
6251 	err = __addrconf_sysctl_register(dev_net(idev->dev), idev->dev->name,
6252 					 idev, &idev->cnf);
6253 	if (err)
6254 		neigh_sysctl_unregister(idev->nd_parms);
6255 
6256 	return err;
6257 }
6258 
6259 static void addrconf_sysctl_unregister(struct inet6_dev *idev)
6260 {
6261 	__addrconf_sysctl_unregister(&idev->cnf);
6262 	neigh_sysctl_unregister(idev->nd_parms);
6263 }
6264 
6265 
6266 #endif
6267 
6268 static int __net_init addrconf_init_net(struct net *net)
6269 {
6270 	int err = -ENOMEM;
6271 	struct ipv6_devconf *all, *dflt;
6272 
6273 	all = kmemdup(&ipv6_devconf, sizeof(ipv6_devconf), GFP_KERNEL);
6274 	if (!all)
6275 		goto err_alloc_all;
6276 
6277 	dflt = kmemdup(&ipv6_devconf_dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
6278 	if (!dflt)
6279 		goto err_alloc_dflt;
6280 
6281 	/* these will be inherited by all namespaces */
6282 	dflt->autoconf = ipv6_defaults.autoconf;
6283 	dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
6284 
6285 	dflt->stable_secret.initialized = false;
6286 	all->stable_secret.initialized = false;
6287 
6288 	net->ipv6.devconf_all = all;
6289 	net->ipv6.devconf_dflt = dflt;
6290 
6291 #ifdef CONFIG_SYSCTL
6292 	err = __addrconf_sysctl_register(net, "all", NULL, all);
6293 	if (err < 0)
6294 		goto err_reg_all;
6295 
6296 	err = __addrconf_sysctl_register(net, "default", NULL, dflt);
6297 	if (err < 0)
6298 		goto err_reg_dflt;
6299 #endif
6300 	return 0;
6301 
6302 #ifdef CONFIG_SYSCTL
6303 err_reg_dflt:
6304 	__addrconf_sysctl_unregister(all);
6305 err_reg_all:
6306 	kfree(dflt);
6307 #endif
6308 err_alloc_dflt:
6309 	kfree(all);
6310 err_alloc_all:
6311 	return err;
6312 }
6313 
6314 static void __net_exit addrconf_exit_net(struct net *net)
6315 {
6316 #ifdef CONFIG_SYSCTL
6317 	__addrconf_sysctl_unregister(net->ipv6.devconf_dflt);
6318 	__addrconf_sysctl_unregister(net->ipv6.devconf_all);
6319 #endif
6320 	kfree(net->ipv6.devconf_dflt);
6321 	kfree(net->ipv6.devconf_all);
6322 }
6323 
6324 static struct pernet_operations addrconf_ops = {
6325 	.init = addrconf_init_net,
6326 	.exit = addrconf_exit_net,
6327 };
6328 
6329 static struct rtnl_af_ops inet6_ops __read_mostly = {
6330 	.family		  = AF_INET6,
6331 	.fill_link_af	  = inet6_fill_link_af,
6332 	.get_link_af_size = inet6_get_link_af_size,
6333 	.validate_link_af = inet6_validate_link_af,
6334 	.set_link_af	  = inet6_set_link_af,
6335 };
6336 
6337 /*
6338  *	Init / cleanup code
6339  */
6340 
6341 int __init addrconf_init(void)
6342 {
6343 	struct inet6_dev *idev;
6344 	int i, err;
6345 
6346 	err = ipv6_addr_label_init();
6347 	if (err < 0) {
6348 		pr_crit("%s: cannot initialize default policy table: %d\n",
6349 			__func__, err);
6350 		goto out;
6351 	}
6352 
6353 	err = register_pernet_subsys(&addrconf_ops);
6354 	if (err < 0)
6355 		goto out_addrlabel;
6356 
6357 	addrconf_wq = create_workqueue("ipv6_addrconf");
6358 	if (!addrconf_wq) {
6359 		err = -ENOMEM;
6360 		goto out_nowq;
6361 	}
6362 
6363 	/* The addrconf netdev notifier requires that loopback_dev
6364 	 * has it's ipv6 private information allocated and setup
6365 	 * before it can bring up and give link-local addresses
6366 	 * to other devices which are up.
6367 	 *
6368 	 * Unfortunately, loopback_dev is not necessarily the first
6369 	 * entry in the global dev_base list of net devices.  In fact,
6370 	 * it is likely to be the very last entry on that list.
6371 	 * So this causes the notifier registry below to try and
6372 	 * give link-local addresses to all devices besides loopback_dev
6373 	 * first, then loopback_dev, which cases all the non-loopback_dev
6374 	 * devices to fail to get a link-local address.
6375 	 *
6376 	 * So, as a temporary fix, allocate the ipv6 structure for
6377 	 * loopback_dev first by hand.
6378 	 * Longer term, all of the dependencies ipv6 has upon the loopback
6379 	 * device and it being up should be removed.
6380 	 */
6381 	rtnl_lock();
6382 	idev = ipv6_add_dev(init_net.loopback_dev);
6383 	rtnl_unlock();
6384 	if (IS_ERR(idev)) {
6385 		err = PTR_ERR(idev);
6386 		goto errlo;
6387 	}
6388 
6389 	for (i = 0; i < IN6_ADDR_HSIZE; i++)
6390 		INIT_HLIST_HEAD(&inet6_addr_lst[i]);
6391 
6392 	register_netdevice_notifier(&ipv6_dev_notf);
6393 
6394 	addrconf_verify();
6395 
6396 	rtnl_af_register(&inet6_ops);
6397 
6398 	err = __rtnl_register(PF_INET6, RTM_GETLINK, NULL, inet6_dump_ifinfo,
6399 			      NULL);
6400 	if (err < 0)
6401 		goto errout;
6402 
6403 	/* Only the first call to __rtnl_register can fail */
6404 	__rtnl_register(PF_INET6, RTM_NEWADDR, inet6_rtm_newaddr, NULL, NULL);
6405 	__rtnl_register(PF_INET6, RTM_DELADDR, inet6_rtm_deladdr, NULL, NULL);
6406 	__rtnl_register(PF_INET6, RTM_GETADDR, inet6_rtm_getaddr,
6407 			inet6_dump_ifaddr, NULL);
6408 	__rtnl_register(PF_INET6, RTM_GETMULTICAST, NULL,
6409 			inet6_dump_ifmcaddr, NULL);
6410 	__rtnl_register(PF_INET6, RTM_GETANYCAST, NULL,
6411 			inet6_dump_ifacaddr, NULL);
6412 	__rtnl_register(PF_INET6, RTM_GETNETCONF, inet6_netconf_get_devconf,
6413 			inet6_netconf_dump_devconf, NULL);
6414 
6415 	ipv6_addr_label_rtnl_register();
6416 
6417 	return 0;
6418 errout:
6419 	rtnl_af_unregister(&inet6_ops);
6420 	unregister_netdevice_notifier(&ipv6_dev_notf);
6421 errlo:
6422 	destroy_workqueue(addrconf_wq);
6423 out_nowq:
6424 	unregister_pernet_subsys(&addrconf_ops);
6425 out_addrlabel:
6426 	ipv6_addr_label_cleanup();
6427 out:
6428 	return err;
6429 }
6430 
6431 void addrconf_cleanup(void)
6432 {
6433 	struct net_device *dev;
6434 	int i;
6435 
6436 	unregister_netdevice_notifier(&ipv6_dev_notf);
6437 	unregister_pernet_subsys(&addrconf_ops);
6438 	ipv6_addr_label_cleanup();
6439 
6440 	rtnl_lock();
6441 
6442 	__rtnl_af_unregister(&inet6_ops);
6443 
6444 	/* clean dev list */
6445 	for_each_netdev(&init_net, dev) {
6446 		if (__in6_dev_get(dev) == NULL)
6447 			continue;
6448 		addrconf_ifdown(dev, 1);
6449 	}
6450 	addrconf_ifdown(init_net.loopback_dev, 2);
6451 
6452 	/*
6453 	 *	Check hash table.
6454 	 */
6455 	spin_lock_bh(&addrconf_hash_lock);
6456 	for (i = 0; i < IN6_ADDR_HSIZE; i++)
6457 		WARN_ON(!hlist_empty(&inet6_addr_lst[i]));
6458 	spin_unlock_bh(&addrconf_hash_lock);
6459 	cancel_delayed_work(&addr_chk_work);
6460 	rtnl_unlock();
6461 
6462 	destroy_workqueue(addrconf_wq);
6463 }
6464