xref: /OK3568_Linux_fs/kernel/net/ipv4/igmp.c (revision 4882a59341e53eb6f0b4789bf948001014eff981)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *	Linux NET3:	Internet Group Management Protocol  [IGMP]
4  *
5  *	This code implements the IGMP protocol as defined in RFC1112. There has
6  *	been a further revision of this protocol since which is now supported.
7  *
8  *	If you have trouble with this module be careful what gcc you have used,
9  *	the older version didn't come out right using gcc 2.5.8, the newer one
10  *	seems to fall out with gcc 2.6.2.
11  *
12  *	Authors:
13  *		Alan Cox <alan@lxorguk.ukuu.org.uk>
14  *
15  *	Fixes:
16  *
17  *		Alan Cox	:	Added lots of __inline__ to optimise
18  *					the memory usage of all the tiny little
19  *					functions.
20  *		Alan Cox	:	Dumped the header building experiment.
21  *		Alan Cox	:	Minor tweaks ready for multicast routing
22  *					and extended IGMP protocol.
23  *		Alan Cox	:	Removed a load of inline directives. Gcc 2.5.8
24  *					writes utterly bogus code otherwise (sigh)
25  *					fixed IGMP loopback to behave in the manner
26  *					desired by mrouted, fixed the fact it has been
27  *					broken since 1.3.6 and cleaned up a few minor
28  *					points.
29  *
30  *		Chih-Jen Chang	:	Tried to revise IGMP to Version 2
31  *		Tsu-Sheng Tsao		E-mail: chihjenc@scf.usc.edu and tsusheng@scf.usc.edu
32  *					The enhancements are mainly based on Steve Deering's
33  * 					ipmulti-3.5 source code.
34  *		Chih-Jen Chang	:	Added the igmp_get_mrouter_info and
35  *		Tsu-Sheng Tsao		igmp_set_mrouter_info to keep track of
36  *					the mrouted version on that device.
37  *		Chih-Jen Chang	:	Added the max_resp_time parameter to
38  *		Tsu-Sheng Tsao		igmp_heard_query(). Using this parameter
39  *					to identify the multicast router version
40  *					and do what the IGMP version 2 specified.
41  *		Chih-Jen Chang	:	Added a timer to revert to IGMP V2 router
42  *		Tsu-Sheng Tsao		if the specified time expired.
43  *		Alan Cox	:	Stop IGMP from 0.0.0.0 being accepted.
44  *		Alan Cox	:	Use GFP_ATOMIC in the right places.
45  *		Christian Daudt :	igmp timer wasn't set for local group
46  *					memberships but was being deleted,
47  *					which caused a "del_timer() called
48  *					from %p with timer not initialized\n"
49  *					message (960131).
50  *		Christian Daudt :	removed del_timer from
51  *					igmp_timer_expire function (960205).
52  *             Christian Daudt :       igmp_heard_report now only calls
53  *                                     igmp_timer_expire if tm->running is
54  *                                     true (960216).
55  *		Malcolm Beattie :	ttl comparison wrong in igmp_rcv made
56  *					igmp_heard_query never trigger. Expiry
57  *					miscalculation fixed in igmp_heard_query
58  *					and random() made to return unsigned to
59  *					prevent negative expiry times.
60  *		Alexey Kuznetsov:	Wrong group leaving behaviour, backport
61  *					fix from pending 2.1.x patches.
62  *		Alan Cox:		Forget to enable FDDI support earlier.
63  *		Alexey Kuznetsov:	Fixed leaving groups on device down.
64  *		Alexey Kuznetsov:	Accordance to igmp-v2-06 draft.
65  *		David L Stevens:	IGMPv3 support, with help from
66  *					Vinay Kulkarni
67  */
68 
69 #include <linux/module.h>
70 #include <linux/slab.h>
71 #include <linux/uaccess.h>
72 #include <linux/types.h>
73 #include <linux/kernel.h>
74 #include <linux/jiffies.h>
75 #include <linux/string.h>
76 #include <linux/socket.h>
77 #include <linux/sockios.h>
78 #include <linux/in.h>
79 #include <linux/inet.h>
80 #include <linux/netdevice.h>
81 #include <linux/skbuff.h>
82 #include <linux/inetdevice.h>
83 #include <linux/igmp.h>
84 #include <linux/if_arp.h>
85 #include <linux/rtnetlink.h>
86 #include <linux/times.h>
87 #include <linux/pkt_sched.h>
88 #include <linux/byteorder/generic.h>
89 
90 #include <net/net_namespace.h>
91 #include <net/arp.h>
92 #include <net/ip.h>
93 #include <net/protocol.h>
94 #include <net/route.h>
95 #include <net/sock.h>
96 #include <net/checksum.h>
97 #include <net/inet_common.h>
98 #include <linux/netfilter_ipv4.h>
99 #ifdef CONFIG_IP_MROUTE
100 #include <linux/mroute.h>
101 #endif
102 #ifdef CONFIG_PROC_FS
103 #include <linux/proc_fs.h>
104 #include <linux/seq_file.h>
105 #endif
106 
107 #ifdef CONFIG_IP_MULTICAST
108 /* Parameter names and values are taken from igmp-v2-06 draft */
109 
110 #define IGMP_QUERY_INTERVAL			(125*HZ)
111 #define IGMP_QUERY_RESPONSE_INTERVAL		(10*HZ)
112 
113 #define IGMP_INITIAL_REPORT_DELAY		(1)
114 
115 /* IGMP_INITIAL_REPORT_DELAY is not from IGMP specs!
116  * IGMP specs require to report membership immediately after
117  * joining a group, but we delay the first report by a
118  * small interval. It seems more natural and still does not
119  * contradict to specs provided this delay is small enough.
120  */
121 
122 #define IGMP_V1_SEEN(in_dev) \
123 	(IPV4_DEVCONF_ALL(dev_net(in_dev->dev), FORCE_IGMP_VERSION) == 1 || \
124 	 IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 1 || \
125 	 ((in_dev)->mr_v1_seen && \
126 	  time_before(jiffies, (in_dev)->mr_v1_seen)))
127 #define IGMP_V2_SEEN(in_dev) \
128 	(IPV4_DEVCONF_ALL(dev_net(in_dev->dev), FORCE_IGMP_VERSION) == 2 || \
129 	 IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 2 || \
130 	 ((in_dev)->mr_v2_seen && \
131 	  time_before(jiffies, (in_dev)->mr_v2_seen)))
132 
unsolicited_report_interval(struct in_device * in_dev)133 static int unsolicited_report_interval(struct in_device *in_dev)
134 {
135 	int interval_ms, interval_jiffies;
136 
137 	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
138 		interval_ms = IN_DEV_CONF_GET(
139 			in_dev,
140 			IGMPV2_UNSOLICITED_REPORT_INTERVAL);
141 	else /* v3 */
142 		interval_ms = IN_DEV_CONF_GET(
143 			in_dev,
144 			IGMPV3_UNSOLICITED_REPORT_INTERVAL);
145 
146 	interval_jiffies = msecs_to_jiffies(interval_ms);
147 
148 	/* _timer functions can't handle a delay of 0 jiffies so ensure
149 	 *  we always return a positive value.
150 	 */
151 	if (interval_jiffies <= 0)
152 		interval_jiffies = 1;
153 	return interval_jiffies;
154 }
155 
156 static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im,
157 			      gfp_t gfp);
158 static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im);
159 static void igmpv3_clear_delrec(struct in_device *in_dev);
160 static int sf_setstate(struct ip_mc_list *pmc);
161 static void sf_markstate(struct ip_mc_list *pmc);
162 #endif
163 static void ip_mc_clear_src(struct ip_mc_list *pmc);
164 static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
165 			 int sfcount, __be32 *psfsrc, int delta);
166 
ip_ma_put(struct ip_mc_list * im)167 static void ip_ma_put(struct ip_mc_list *im)
168 {
169 	if (refcount_dec_and_test(&im->refcnt)) {
170 		in_dev_put(im->interface);
171 		kfree_rcu(im, rcu);
172 	}
173 }
174 
175 #define for_each_pmc_rcu(in_dev, pmc)				\
176 	for (pmc = rcu_dereference(in_dev->mc_list);		\
177 	     pmc != NULL;					\
178 	     pmc = rcu_dereference(pmc->next_rcu))
179 
180 #define for_each_pmc_rtnl(in_dev, pmc)				\
181 	for (pmc = rtnl_dereference(in_dev->mc_list);		\
182 	     pmc != NULL;					\
183 	     pmc = rtnl_dereference(pmc->next_rcu))
184 
ip_sf_list_clear_all(struct ip_sf_list * psf)185 static void ip_sf_list_clear_all(struct ip_sf_list *psf)
186 {
187 	struct ip_sf_list *next;
188 
189 	while (psf) {
190 		next = psf->sf_next;
191 		kfree(psf);
192 		psf = next;
193 	}
194 }
195 
196 #ifdef CONFIG_IP_MULTICAST
197 
198 /*
199  *	Timer management
200  */
201 
igmp_stop_timer(struct ip_mc_list * im)202 static void igmp_stop_timer(struct ip_mc_list *im)
203 {
204 	spin_lock_bh(&im->lock);
205 	if (del_timer(&im->timer))
206 		refcount_dec(&im->refcnt);
207 	im->tm_running = 0;
208 	im->reporter = 0;
209 	im->unsolicit_count = 0;
210 	spin_unlock_bh(&im->lock);
211 }
212 
213 /* It must be called with locked im->lock */
igmp_start_timer(struct ip_mc_list * im,int max_delay)214 static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
215 {
216 	int tv = prandom_u32() % max_delay;
217 
218 	im->tm_running = 1;
219 	if (!mod_timer(&im->timer, jiffies+tv+2))
220 		refcount_inc(&im->refcnt);
221 }
222 
igmp_gq_start_timer(struct in_device * in_dev)223 static void igmp_gq_start_timer(struct in_device *in_dev)
224 {
225 	int tv = prandom_u32() % in_dev->mr_maxdelay;
226 	unsigned long exp = jiffies + tv + 2;
227 
228 	if (in_dev->mr_gq_running &&
229 	    time_after_eq(exp, (in_dev->mr_gq_timer).expires))
230 		return;
231 
232 	in_dev->mr_gq_running = 1;
233 	if (!mod_timer(&in_dev->mr_gq_timer, exp))
234 		in_dev_hold(in_dev);
235 }
236 
igmp_ifc_start_timer(struct in_device * in_dev,int delay)237 static void igmp_ifc_start_timer(struct in_device *in_dev, int delay)
238 {
239 	int tv = prandom_u32() % delay;
240 
241 	if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2))
242 		in_dev_hold(in_dev);
243 }
244 
igmp_mod_timer(struct ip_mc_list * im,int max_delay)245 static void igmp_mod_timer(struct ip_mc_list *im, int max_delay)
246 {
247 	spin_lock_bh(&im->lock);
248 	im->unsolicit_count = 0;
249 	if (del_timer(&im->timer)) {
250 		if ((long)(im->timer.expires-jiffies) < max_delay) {
251 			add_timer(&im->timer);
252 			im->tm_running = 1;
253 			spin_unlock_bh(&im->lock);
254 			return;
255 		}
256 		refcount_dec(&im->refcnt);
257 	}
258 	igmp_start_timer(im, max_delay);
259 	spin_unlock_bh(&im->lock);
260 }
261 
262 
263 /*
264  *	Send an IGMP report.
265  */
266 
267 #define IGMP_SIZE (sizeof(struct igmphdr)+sizeof(struct iphdr)+4)
268 
269 
is_in(struct ip_mc_list * pmc,struct ip_sf_list * psf,int type,int gdeleted,int sdeleted)270 static int is_in(struct ip_mc_list *pmc, struct ip_sf_list *psf, int type,
271 	int gdeleted, int sdeleted)
272 {
273 	switch (type) {
274 	case IGMPV3_MODE_IS_INCLUDE:
275 	case IGMPV3_MODE_IS_EXCLUDE:
276 		if (gdeleted || sdeleted)
277 			return 0;
278 		if (!(pmc->gsquery && !psf->sf_gsresp)) {
279 			if (pmc->sfmode == MCAST_INCLUDE)
280 				return 1;
281 			/* don't include if this source is excluded
282 			 * in all filters
283 			 */
284 			if (psf->sf_count[MCAST_INCLUDE])
285 				return type == IGMPV3_MODE_IS_INCLUDE;
286 			return pmc->sfcount[MCAST_EXCLUDE] ==
287 				psf->sf_count[MCAST_EXCLUDE];
288 		}
289 		return 0;
290 	case IGMPV3_CHANGE_TO_INCLUDE:
291 		if (gdeleted || sdeleted)
292 			return 0;
293 		return psf->sf_count[MCAST_INCLUDE] != 0;
294 	case IGMPV3_CHANGE_TO_EXCLUDE:
295 		if (gdeleted || sdeleted)
296 			return 0;
297 		if (pmc->sfcount[MCAST_EXCLUDE] == 0 ||
298 		    psf->sf_count[MCAST_INCLUDE])
299 			return 0;
300 		return pmc->sfcount[MCAST_EXCLUDE] ==
301 			psf->sf_count[MCAST_EXCLUDE];
302 	case IGMPV3_ALLOW_NEW_SOURCES:
303 		if (gdeleted || !psf->sf_crcount)
304 			return 0;
305 		return (pmc->sfmode == MCAST_INCLUDE) ^ sdeleted;
306 	case IGMPV3_BLOCK_OLD_SOURCES:
307 		if (pmc->sfmode == MCAST_INCLUDE)
308 			return gdeleted || (psf->sf_crcount && sdeleted);
309 		return psf->sf_crcount && !gdeleted && !sdeleted;
310 	}
311 	return 0;
312 }
313 
314 static int
igmp_scount(struct ip_mc_list * pmc,int type,int gdeleted,int sdeleted)315 igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
316 {
317 	struct ip_sf_list *psf;
318 	int scount = 0;
319 
320 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
321 		if (!is_in(pmc, psf, type, gdeleted, sdeleted))
322 			continue;
323 		scount++;
324 	}
325 	return scount;
326 }
327 
328 /* source address selection per RFC 3376 section 4.2.13 */
igmpv3_get_srcaddr(struct net_device * dev,const struct flowi4 * fl4)329 static __be32 igmpv3_get_srcaddr(struct net_device *dev,
330 				 const struct flowi4 *fl4)
331 {
332 	struct in_device *in_dev = __in_dev_get_rcu(dev);
333 	const struct in_ifaddr *ifa;
334 
335 	if (!in_dev)
336 		return htonl(INADDR_ANY);
337 
338 	in_dev_for_each_ifa_rcu(ifa, in_dev) {
339 		if (fl4->saddr == ifa->ifa_local)
340 			return fl4->saddr;
341 	}
342 
343 	return htonl(INADDR_ANY);
344 }
345 
igmpv3_newpack(struct net_device * dev,unsigned int mtu)346 static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
347 {
348 	struct sk_buff *skb;
349 	struct rtable *rt;
350 	struct iphdr *pip;
351 	struct igmpv3_report *pig;
352 	struct net *net = dev_net(dev);
353 	struct flowi4 fl4;
354 	int hlen = LL_RESERVED_SPACE(dev);
355 	int tlen = dev->needed_tailroom;
356 	unsigned int size = mtu;
357 
358 	while (1) {
359 		skb = alloc_skb(size + hlen + tlen,
360 				GFP_ATOMIC | __GFP_NOWARN);
361 		if (skb)
362 			break;
363 		size >>= 1;
364 		if (size < 256)
365 			return NULL;
366 	}
367 	skb->priority = TC_PRIO_CONTROL;
368 
369 	rt = ip_route_output_ports(net, &fl4, NULL, IGMPV3_ALL_MCR, 0,
370 				   0, 0,
371 				   IPPROTO_IGMP, 0, dev->ifindex);
372 	if (IS_ERR(rt)) {
373 		kfree_skb(skb);
374 		return NULL;
375 	}
376 
377 	skb_dst_set(skb, &rt->dst);
378 	skb->dev = dev;
379 
380 	skb_reserve(skb, hlen);
381 	skb_tailroom_reserve(skb, mtu, tlen);
382 
383 	skb_reset_network_header(skb);
384 	pip = ip_hdr(skb);
385 	skb_put(skb, sizeof(struct iphdr) + 4);
386 
387 	pip->version  = 4;
388 	pip->ihl      = (sizeof(struct iphdr)+4)>>2;
389 	pip->tos      = 0xc0;
390 	pip->frag_off = htons(IP_DF);
391 	pip->ttl      = 1;
392 	pip->daddr    = fl4.daddr;
393 
394 	rcu_read_lock();
395 	pip->saddr    = igmpv3_get_srcaddr(dev, &fl4);
396 	rcu_read_unlock();
397 
398 	pip->protocol = IPPROTO_IGMP;
399 	pip->tot_len  = 0;	/* filled in later */
400 	ip_select_ident(net, skb, NULL);
401 	((u8 *)&pip[1])[0] = IPOPT_RA;
402 	((u8 *)&pip[1])[1] = 4;
403 	((u8 *)&pip[1])[2] = 0;
404 	((u8 *)&pip[1])[3] = 0;
405 
406 	skb->transport_header = skb->network_header + sizeof(struct iphdr) + 4;
407 	skb_put(skb, sizeof(*pig));
408 	pig = igmpv3_report_hdr(skb);
409 	pig->type = IGMPV3_HOST_MEMBERSHIP_REPORT;
410 	pig->resv1 = 0;
411 	pig->csum = 0;
412 	pig->resv2 = 0;
413 	pig->ngrec = 0;
414 	return skb;
415 }
416 
igmpv3_sendpack(struct sk_buff * skb)417 static int igmpv3_sendpack(struct sk_buff *skb)
418 {
419 	struct igmphdr *pig = igmp_hdr(skb);
420 	const int igmplen = skb_tail_pointer(skb) - skb_transport_header(skb);
421 
422 	pig->csum = ip_compute_csum(igmp_hdr(skb), igmplen);
423 
424 	return ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
425 }
426 
grec_size(struct ip_mc_list * pmc,int type,int gdel,int sdel)427 static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel)
428 {
429 	return sizeof(struct igmpv3_grec) + 4*igmp_scount(pmc, type, gdel, sdel);
430 }
431 
add_grhead(struct sk_buff * skb,struct ip_mc_list * pmc,int type,struct igmpv3_grec ** ppgr,unsigned int mtu)432 static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
433 	int type, struct igmpv3_grec **ppgr, unsigned int mtu)
434 {
435 	struct net_device *dev = pmc->interface->dev;
436 	struct igmpv3_report *pih;
437 	struct igmpv3_grec *pgr;
438 
439 	if (!skb) {
440 		skb = igmpv3_newpack(dev, mtu);
441 		if (!skb)
442 			return NULL;
443 	}
444 	pgr = skb_put(skb, sizeof(struct igmpv3_grec));
445 	pgr->grec_type = type;
446 	pgr->grec_auxwords = 0;
447 	pgr->grec_nsrcs = 0;
448 	pgr->grec_mca = pmc->multiaddr;
449 	pih = igmpv3_report_hdr(skb);
450 	pih->ngrec = htons(ntohs(pih->ngrec)+1);
451 	*ppgr = pgr;
452 	return skb;
453 }
454 
455 #define AVAILABLE(skb)	((skb) ? skb_availroom(skb) : 0)
456 
add_grec(struct sk_buff * skb,struct ip_mc_list * pmc,int type,int gdeleted,int sdeleted)457 static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
458 	int type, int gdeleted, int sdeleted)
459 {
460 	struct net_device *dev = pmc->interface->dev;
461 	struct net *net = dev_net(dev);
462 	struct igmpv3_report *pih;
463 	struct igmpv3_grec *pgr = NULL;
464 	struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list;
465 	int scount, stotal, first, isquery, truncate;
466 	unsigned int mtu;
467 
468 	if (pmc->multiaddr == IGMP_ALL_HOSTS)
469 		return skb;
470 	if (ipv4_is_local_multicast(pmc->multiaddr) &&
471 	    !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
472 		return skb;
473 
474 	mtu = READ_ONCE(dev->mtu);
475 	if (mtu < IPV4_MIN_MTU)
476 		return skb;
477 
478 	isquery = type == IGMPV3_MODE_IS_INCLUDE ||
479 		  type == IGMPV3_MODE_IS_EXCLUDE;
480 	truncate = type == IGMPV3_MODE_IS_EXCLUDE ||
481 		    type == IGMPV3_CHANGE_TO_EXCLUDE;
482 
483 	stotal = scount = 0;
484 
485 	psf_list = sdeleted ? &pmc->tomb : &pmc->sources;
486 
487 	if (!*psf_list)
488 		goto empty_source;
489 
490 	pih = skb ? igmpv3_report_hdr(skb) : NULL;
491 
492 	/* EX and TO_EX get a fresh packet, if needed */
493 	if (truncate) {
494 		if (pih && pih->ngrec &&
495 		    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
496 			if (skb)
497 				igmpv3_sendpack(skb);
498 			skb = igmpv3_newpack(dev, mtu);
499 		}
500 	}
501 	first = 1;
502 	psf_prev = NULL;
503 	for (psf = *psf_list; psf; psf = psf_next) {
504 		__be32 *psrc;
505 
506 		psf_next = psf->sf_next;
507 
508 		if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
509 			psf_prev = psf;
510 			continue;
511 		}
512 
513 		/* Based on RFC3376 5.1. Should not send source-list change
514 		 * records when there is a filter mode change.
515 		 */
516 		if (((gdeleted && pmc->sfmode == MCAST_EXCLUDE) ||
517 		     (!gdeleted && pmc->crcount)) &&
518 		    (type == IGMPV3_ALLOW_NEW_SOURCES ||
519 		     type == IGMPV3_BLOCK_OLD_SOURCES) && psf->sf_crcount)
520 			goto decrease_sf_crcount;
521 
522 		/* clear marks on query responses */
523 		if (isquery)
524 			psf->sf_gsresp = 0;
525 
526 		if (AVAILABLE(skb) < sizeof(__be32) +
527 		    first*sizeof(struct igmpv3_grec)) {
528 			if (truncate && !first)
529 				break;	 /* truncate these */
530 			if (pgr)
531 				pgr->grec_nsrcs = htons(scount);
532 			if (skb)
533 				igmpv3_sendpack(skb);
534 			skb = igmpv3_newpack(dev, mtu);
535 			first = 1;
536 			scount = 0;
537 		}
538 		if (first) {
539 			skb = add_grhead(skb, pmc, type, &pgr, mtu);
540 			first = 0;
541 		}
542 		if (!skb)
543 			return NULL;
544 		psrc = skb_put(skb, sizeof(__be32));
545 		*psrc = psf->sf_inaddr;
546 		scount++; stotal++;
547 		if ((type == IGMPV3_ALLOW_NEW_SOURCES ||
548 		     type == IGMPV3_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
549 decrease_sf_crcount:
550 			psf->sf_crcount--;
551 			if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
552 				if (psf_prev)
553 					psf_prev->sf_next = psf->sf_next;
554 				else
555 					*psf_list = psf->sf_next;
556 				kfree(psf);
557 				continue;
558 			}
559 		}
560 		psf_prev = psf;
561 	}
562 
563 empty_source:
564 	if (!stotal) {
565 		if (type == IGMPV3_ALLOW_NEW_SOURCES ||
566 		    type == IGMPV3_BLOCK_OLD_SOURCES)
567 			return skb;
568 		if (pmc->crcount || isquery) {
569 			/* make sure we have room for group header */
570 			if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)) {
571 				igmpv3_sendpack(skb);
572 				skb = NULL; /* add_grhead will get a new one */
573 			}
574 			skb = add_grhead(skb, pmc, type, &pgr, mtu);
575 		}
576 	}
577 	if (pgr)
578 		pgr->grec_nsrcs = htons(scount);
579 
580 	if (isquery)
581 		pmc->gsquery = 0;	/* clear query state on report */
582 	return skb;
583 }
584 
igmpv3_send_report(struct in_device * in_dev,struct ip_mc_list * pmc)585 static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
586 {
587 	struct sk_buff *skb = NULL;
588 	struct net *net = dev_net(in_dev->dev);
589 	int type;
590 
591 	if (!pmc) {
592 		rcu_read_lock();
593 		for_each_pmc_rcu(in_dev, pmc) {
594 			if (pmc->multiaddr == IGMP_ALL_HOSTS)
595 				continue;
596 			if (ipv4_is_local_multicast(pmc->multiaddr) &&
597 			    !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
598 				continue;
599 			spin_lock_bh(&pmc->lock);
600 			if (pmc->sfcount[MCAST_EXCLUDE])
601 				type = IGMPV3_MODE_IS_EXCLUDE;
602 			else
603 				type = IGMPV3_MODE_IS_INCLUDE;
604 			skb = add_grec(skb, pmc, type, 0, 0);
605 			spin_unlock_bh(&pmc->lock);
606 		}
607 		rcu_read_unlock();
608 	} else {
609 		spin_lock_bh(&pmc->lock);
610 		if (pmc->sfcount[MCAST_EXCLUDE])
611 			type = IGMPV3_MODE_IS_EXCLUDE;
612 		else
613 			type = IGMPV3_MODE_IS_INCLUDE;
614 		skb = add_grec(skb, pmc, type, 0, 0);
615 		spin_unlock_bh(&pmc->lock);
616 	}
617 	if (!skb)
618 		return 0;
619 	return igmpv3_sendpack(skb);
620 }
621 
622 /*
623  * remove zero-count source records from a source filter list
624  */
igmpv3_clear_zeros(struct ip_sf_list ** ppsf)625 static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
626 {
627 	struct ip_sf_list *psf_prev, *psf_next, *psf;
628 
629 	psf_prev = NULL;
630 	for (psf = *ppsf; psf; psf = psf_next) {
631 		psf_next = psf->sf_next;
632 		if (psf->sf_crcount == 0) {
633 			if (psf_prev)
634 				psf_prev->sf_next = psf->sf_next;
635 			else
636 				*ppsf = psf->sf_next;
637 			kfree(psf);
638 		} else
639 			psf_prev = psf;
640 	}
641 }
642 
kfree_pmc(struct ip_mc_list * pmc)643 static void kfree_pmc(struct ip_mc_list *pmc)
644 {
645 	ip_sf_list_clear_all(pmc->sources);
646 	ip_sf_list_clear_all(pmc->tomb);
647 	kfree(pmc);
648 }
649 
igmpv3_send_cr(struct in_device * in_dev)650 static void igmpv3_send_cr(struct in_device *in_dev)
651 {
652 	struct ip_mc_list *pmc, *pmc_prev, *pmc_next;
653 	struct sk_buff *skb = NULL;
654 	int type, dtype;
655 
656 	rcu_read_lock();
657 	spin_lock_bh(&in_dev->mc_tomb_lock);
658 
659 	/* deleted MCA's */
660 	pmc_prev = NULL;
661 	for (pmc = in_dev->mc_tomb; pmc; pmc = pmc_next) {
662 		pmc_next = pmc->next;
663 		if (pmc->sfmode == MCAST_INCLUDE) {
664 			type = IGMPV3_BLOCK_OLD_SOURCES;
665 			dtype = IGMPV3_BLOCK_OLD_SOURCES;
666 			skb = add_grec(skb, pmc, type, 1, 0);
667 			skb = add_grec(skb, pmc, dtype, 1, 1);
668 		}
669 		if (pmc->crcount) {
670 			if (pmc->sfmode == MCAST_EXCLUDE) {
671 				type = IGMPV3_CHANGE_TO_INCLUDE;
672 				skb = add_grec(skb, pmc, type, 1, 0);
673 			}
674 			pmc->crcount--;
675 			if (pmc->crcount == 0) {
676 				igmpv3_clear_zeros(&pmc->tomb);
677 				igmpv3_clear_zeros(&pmc->sources);
678 			}
679 		}
680 		if (pmc->crcount == 0 && !pmc->tomb && !pmc->sources) {
681 			if (pmc_prev)
682 				pmc_prev->next = pmc_next;
683 			else
684 				in_dev->mc_tomb = pmc_next;
685 			in_dev_put(pmc->interface);
686 			kfree_pmc(pmc);
687 		} else
688 			pmc_prev = pmc;
689 	}
690 	spin_unlock_bh(&in_dev->mc_tomb_lock);
691 
692 	/* change recs */
693 	for_each_pmc_rcu(in_dev, pmc) {
694 		spin_lock_bh(&pmc->lock);
695 		if (pmc->sfcount[MCAST_EXCLUDE]) {
696 			type = IGMPV3_BLOCK_OLD_SOURCES;
697 			dtype = IGMPV3_ALLOW_NEW_SOURCES;
698 		} else {
699 			type = IGMPV3_ALLOW_NEW_SOURCES;
700 			dtype = IGMPV3_BLOCK_OLD_SOURCES;
701 		}
702 		skb = add_grec(skb, pmc, type, 0, 0);
703 		skb = add_grec(skb, pmc, dtype, 0, 1);	/* deleted sources */
704 
705 		/* filter mode changes */
706 		if (pmc->crcount) {
707 			if (pmc->sfmode == MCAST_EXCLUDE)
708 				type = IGMPV3_CHANGE_TO_EXCLUDE;
709 			else
710 				type = IGMPV3_CHANGE_TO_INCLUDE;
711 			skb = add_grec(skb, pmc, type, 0, 0);
712 			pmc->crcount--;
713 		}
714 		spin_unlock_bh(&pmc->lock);
715 	}
716 	rcu_read_unlock();
717 
718 	if (!skb)
719 		return;
720 	(void) igmpv3_sendpack(skb);
721 }
722 
igmp_send_report(struct in_device * in_dev,struct ip_mc_list * pmc,int type)723 static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
724 	int type)
725 {
726 	struct sk_buff *skb;
727 	struct iphdr *iph;
728 	struct igmphdr *ih;
729 	struct rtable *rt;
730 	struct net_device *dev = in_dev->dev;
731 	struct net *net = dev_net(dev);
732 	__be32	group = pmc ? pmc->multiaddr : 0;
733 	struct flowi4 fl4;
734 	__be32	dst;
735 	int hlen, tlen;
736 
737 	if (type == IGMPV3_HOST_MEMBERSHIP_REPORT)
738 		return igmpv3_send_report(in_dev, pmc);
739 
740 	if (ipv4_is_local_multicast(group) &&
741 	    !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
742 		return 0;
743 
744 	if (type == IGMP_HOST_LEAVE_MESSAGE)
745 		dst = IGMP_ALL_ROUTER;
746 	else
747 		dst = group;
748 
749 	rt = ip_route_output_ports(net, &fl4, NULL, dst, 0,
750 				   0, 0,
751 				   IPPROTO_IGMP, 0, dev->ifindex);
752 	if (IS_ERR(rt))
753 		return -1;
754 
755 	hlen = LL_RESERVED_SPACE(dev);
756 	tlen = dev->needed_tailroom;
757 	skb = alloc_skb(IGMP_SIZE + hlen + tlen, GFP_ATOMIC);
758 	if (!skb) {
759 		ip_rt_put(rt);
760 		return -1;
761 	}
762 	skb->priority = TC_PRIO_CONTROL;
763 
764 	skb_dst_set(skb, &rt->dst);
765 
766 	skb_reserve(skb, hlen);
767 
768 	skb_reset_network_header(skb);
769 	iph = ip_hdr(skb);
770 	skb_put(skb, sizeof(struct iphdr) + 4);
771 
772 	iph->version  = 4;
773 	iph->ihl      = (sizeof(struct iphdr)+4)>>2;
774 	iph->tos      = 0xc0;
775 	iph->frag_off = htons(IP_DF);
776 	iph->ttl      = 1;
777 	iph->daddr    = dst;
778 	iph->saddr    = fl4.saddr;
779 	iph->protocol = IPPROTO_IGMP;
780 	ip_select_ident(net, skb, NULL);
781 	((u8 *)&iph[1])[0] = IPOPT_RA;
782 	((u8 *)&iph[1])[1] = 4;
783 	((u8 *)&iph[1])[2] = 0;
784 	((u8 *)&iph[1])[3] = 0;
785 
786 	ih = skb_put(skb, sizeof(struct igmphdr));
787 	ih->type = type;
788 	ih->code = 0;
789 	ih->csum = 0;
790 	ih->group = group;
791 	ih->csum = ip_compute_csum((void *)ih, sizeof(struct igmphdr));
792 
793 	return ip_local_out(net, skb->sk, skb);
794 }
795 
igmp_gq_timer_expire(struct timer_list * t)796 static void igmp_gq_timer_expire(struct timer_list *t)
797 {
798 	struct in_device *in_dev = from_timer(in_dev, t, mr_gq_timer);
799 
800 	in_dev->mr_gq_running = 0;
801 	igmpv3_send_report(in_dev, NULL);
802 	in_dev_put(in_dev);
803 }
804 
igmp_ifc_timer_expire(struct timer_list * t)805 static void igmp_ifc_timer_expire(struct timer_list *t)
806 {
807 	struct in_device *in_dev = from_timer(in_dev, t, mr_ifc_timer);
808 
809 	igmpv3_send_cr(in_dev);
810 	if (in_dev->mr_ifc_count) {
811 		in_dev->mr_ifc_count--;
812 		igmp_ifc_start_timer(in_dev,
813 				     unsolicited_report_interval(in_dev));
814 	}
815 	in_dev_put(in_dev);
816 }
817 
igmp_ifc_event(struct in_device * in_dev)818 static void igmp_ifc_event(struct in_device *in_dev)
819 {
820 	struct net *net = dev_net(in_dev->dev);
821 	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
822 		return;
823 	in_dev->mr_ifc_count = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
824 	igmp_ifc_start_timer(in_dev, 1);
825 }
826 
827 
igmp_timer_expire(struct timer_list * t)828 static void igmp_timer_expire(struct timer_list *t)
829 {
830 	struct ip_mc_list *im = from_timer(im, t, timer);
831 	struct in_device *in_dev = im->interface;
832 
833 	spin_lock(&im->lock);
834 	im->tm_running = 0;
835 
836 	if (im->unsolicit_count && --im->unsolicit_count)
837 		igmp_start_timer(im, unsolicited_report_interval(in_dev));
838 
839 	im->reporter = 1;
840 	spin_unlock(&im->lock);
841 
842 	if (IGMP_V1_SEEN(in_dev))
843 		igmp_send_report(in_dev, im, IGMP_HOST_MEMBERSHIP_REPORT);
844 	else if (IGMP_V2_SEEN(in_dev))
845 		igmp_send_report(in_dev, im, IGMPV2_HOST_MEMBERSHIP_REPORT);
846 	else
847 		igmp_send_report(in_dev, im, IGMPV3_HOST_MEMBERSHIP_REPORT);
848 
849 	ip_ma_put(im);
850 }
851 
852 /* mark EXCLUDE-mode sources */
igmp_xmarksources(struct ip_mc_list * pmc,int nsrcs,__be32 * srcs)853 static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
854 {
855 	struct ip_sf_list *psf;
856 	int i, scount;
857 
858 	scount = 0;
859 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
860 		if (scount == nsrcs)
861 			break;
862 		for (i = 0; i < nsrcs; i++) {
863 			/* skip inactive filters */
864 			if (psf->sf_count[MCAST_INCLUDE] ||
865 			    pmc->sfcount[MCAST_EXCLUDE] !=
866 			    psf->sf_count[MCAST_EXCLUDE])
867 				break;
868 			if (srcs[i] == psf->sf_inaddr) {
869 				scount++;
870 				break;
871 			}
872 		}
873 	}
874 	pmc->gsquery = 0;
875 	if (scount == nsrcs)	/* all sources excluded */
876 		return 0;
877 	return 1;
878 }
879 
igmp_marksources(struct ip_mc_list * pmc,int nsrcs,__be32 * srcs)880 static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
881 {
882 	struct ip_sf_list *psf;
883 	int i, scount;
884 
885 	if (pmc->sfmode == MCAST_EXCLUDE)
886 		return igmp_xmarksources(pmc, nsrcs, srcs);
887 
888 	/* mark INCLUDE-mode sources */
889 	scount = 0;
890 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
891 		if (scount == nsrcs)
892 			break;
893 		for (i = 0; i < nsrcs; i++)
894 			if (srcs[i] == psf->sf_inaddr) {
895 				psf->sf_gsresp = 1;
896 				scount++;
897 				break;
898 			}
899 	}
900 	if (!scount) {
901 		pmc->gsquery = 0;
902 		return 0;
903 	}
904 	pmc->gsquery = 1;
905 	return 1;
906 }
907 
908 /* return true if packet was dropped */
igmp_heard_report(struct in_device * in_dev,__be32 group)909 static bool igmp_heard_report(struct in_device *in_dev, __be32 group)
910 {
911 	struct ip_mc_list *im;
912 	struct net *net = dev_net(in_dev->dev);
913 
914 	/* Timers are only set for non-local groups */
915 
916 	if (group == IGMP_ALL_HOSTS)
917 		return false;
918 	if (ipv4_is_local_multicast(group) &&
919 	    !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
920 		return false;
921 
922 	rcu_read_lock();
923 	for_each_pmc_rcu(in_dev, im) {
924 		if (im->multiaddr == group) {
925 			igmp_stop_timer(im);
926 			break;
927 		}
928 	}
929 	rcu_read_unlock();
930 	return false;
931 }
932 
933 /* return true if packet was dropped */
igmp_heard_query(struct in_device * in_dev,struct sk_buff * skb,int len)934 static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
935 	int len)
936 {
937 	struct igmphdr 		*ih = igmp_hdr(skb);
938 	struct igmpv3_query *ih3 = igmpv3_query_hdr(skb);
939 	struct ip_mc_list	*im;
940 	__be32			group = ih->group;
941 	int			max_delay;
942 	int			mark = 0;
943 	struct net		*net = dev_net(in_dev->dev);
944 
945 
946 	if (len == 8) {
947 		if (ih->code == 0) {
948 			/* Alas, old v1 router presents here. */
949 
950 			max_delay = IGMP_QUERY_RESPONSE_INTERVAL;
951 			in_dev->mr_v1_seen = jiffies +
952 				(in_dev->mr_qrv * in_dev->mr_qi) +
953 				in_dev->mr_qri;
954 			group = 0;
955 		} else {
956 			/* v2 router present */
957 			max_delay = ih->code*(HZ/IGMP_TIMER_SCALE);
958 			in_dev->mr_v2_seen = jiffies +
959 				(in_dev->mr_qrv * in_dev->mr_qi) +
960 				in_dev->mr_qri;
961 		}
962 		/* cancel the interface change timer */
963 		in_dev->mr_ifc_count = 0;
964 		if (del_timer(&in_dev->mr_ifc_timer))
965 			__in_dev_put(in_dev);
966 		/* clear deleted report items */
967 		igmpv3_clear_delrec(in_dev);
968 	} else if (len < 12) {
969 		return true;	/* ignore bogus packet; freed by caller */
970 	} else if (IGMP_V1_SEEN(in_dev)) {
971 		/* This is a v3 query with v1 queriers present */
972 		max_delay = IGMP_QUERY_RESPONSE_INTERVAL;
973 		group = 0;
974 	} else if (IGMP_V2_SEEN(in_dev)) {
975 		/* this is a v3 query with v2 queriers present;
976 		 * Interpretation of the max_delay code is problematic here.
977 		 * A real v2 host would use ih_code directly, while v3 has a
978 		 * different encoding. We use the v3 encoding as more likely
979 		 * to be intended in a v3 query.
980 		 */
981 		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
982 		if (!max_delay)
983 			max_delay = 1;	/* can't mod w/ 0 */
984 	} else { /* v3 */
985 		if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
986 			return true;
987 
988 		ih3 = igmpv3_query_hdr(skb);
989 		if (ih3->nsrcs) {
990 			if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)
991 					   + ntohs(ih3->nsrcs)*sizeof(__be32)))
992 				return true;
993 			ih3 = igmpv3_query_hdr(skb);
994 		}
995 
996 		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
997 		if (!max_delay)
998 			max_delay = 1;	/* can't mod w/ 0 */
999 		in_dev->mr_maxdelay = max_delay;
1000 
1001 		/* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently
1002 		 * received value was zero, use the default or statically
1003 		 * configured value.
1004 		 */
1005 		in_dev->mr_qrv = ih3->qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
1006 		in_dev->mr_qi = IGMPV3_QQIC(ih3->qqic)*HZ ?: IGMP_QUERY_INTERVAL;
1007 
1008 		/* RFC3376, 8.3. Query Response Interval:
1009 		 * The number of seconds represented by the [Query Response
1010 		 * Interval] must be less than the [Query Interval].
1011 		 */
1012 		if (in_dev->mr_qri >= in_dev->mr_qi)
1013 			in_dev->mr_qri = (in_dev->mr_qi/HZ - 1)*HZ;
1014 
1015 		if (!group) { /* general query */
1016 			if (ih3->nsrcs)
1017 				return true;	/* no sources allowed */
1018 			igmp_gq_start_timer(in_dev);
1019 			return false;
1020 		}
1021 		/* mark sources to include, if group & source-specific */
1022 		mark = ih3->nsrcs != 0;
1023 	}
1024 
1025 	/*
1026 	 * - Start the timers in all of our membership records
1027 	 *   that the query applies to for the interface on
1028 	 *   which the query arrived excl. those that belong
1029 	 *   to a "local" group (224.0.0.X)
1030 	 * - For timers already running check if they need to
1031 	 *   be reset.
1032 	 * - Use the igmp->igmp_code field as the maximum
1033 	 *   delay possible
1034 	 */
1035 	rcu_read_lock();
1036 	for_each_pmc_rcu(in_dev, im) {
1037 		int changed;
1038 
1039 		if (group && group != im->multiaddr)
1040 			continue;
1041 		if (im->multiaddr == IGMP_ALL_HOSTS)
1042 			continue;
1043 		if (ipv4_is_local_multicast(im->multiaddr) &&
1044 		    !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
1045 			continue;
1046 		spin_lock_bh(&im->lock);
1047 		if (im->tm_running)
1048 			im->gsquery = im->gsquery && mark;
1049 		else
1050 			im->gsquery = mark;
1051 		changed = !im->gsquery ||
1052 			igmp_marksources(im, ntohs(ih3->nsrcs), ih3->srcs);
1053 		spin_unlock_bh(&im->lock);
1054 		if (changed)
1055 			igmp_mod_timer(im, max_delay);
1056 	}
1057 	rcu_read_unlock();
1058 	return false;
1059 }
1060 
1061 /* called in rcu_read_lock() section */
igmp_rcv(struct sk_buff * skb)1062 int igmp_rcv(struct sk_buff *skb)
1063 {
1064 	/* This basically follows the spec line by line -- see RFC1112 */
1065 	struct igmphdr *ih;
1066 	struct net_device *dev = skb->dev;
1067 	struct in_device *in_dev;
1068 	int len = skb->len;
1069 	bool dropped = true;
1070 
1071 	if (netif_is_l3_master(dev)) {
1072 		dev = dev_get_by_index_rcu(dev_net(dev), IPCB(skb)->iif);
1073 		if (!dev)
1074 			goto drop;
1075 	}
1076 
1077 	in_dev = __in_dev_get_rcu(dev);
1078 	if (!in_dev)
1079 		goto drop;
1080 
1081 	if (!pskb_may_pull(skb, sizeof(struct igmphdr)))
1082 		goto drop;
1083 
1084 	if (skb_checksum_simple_validate(skb))
1085 		goto drop;
1086 
1087 	ih = igmp_hdr(skb);
1088 	switch (ih->type) {
1089 	case IGMP_HOST_MEMBERSHIP_QUERY:
1090 		dropped = igmp_heard_query(in_dev, skb, len);
1091 		break;
1092 	case IGMP_HOST_MEMBERSHIP_REPORT:
1093 	case IGMPV2_HOST_MEMBERSHIP_REPORT:
1094 		/* Is it our report looped back? */
1095 		if (rt_is_output_route(skb_rtable(skb)))
1096 			break;
1097 		/* don't rely on MC router hearing unicast reports */
1098 		if (skb->pkt_type == PACKET_MULTICAST ||
1099 		    skb->pkt_type == PACKET_BROADCAST)
1100 			dropped = igmp_heard_report(in_dev, ih->group);
1101 		break;
1102 	case IGMP_PIM:
1103 #ifdef CONFIG_IP_PIMSM_V1
1104 		return pim_rcv_v1(skb);
1105 #endif
1106 	case IGMPV3_HOST_MEMBERSHIP_REPORT:
1107 	case IGMP_DVMRP:
1108 	case IGMP_TRACE:
1109 	case IGMP_HOST_LEAVE_MESSAGE:
1110 	case IGMP_MTRACE:
1111 	case IGMP_MTRACE_RESP:
1112 		break;
1113 	default:
1114 		break;
1115 	}
1116 
1117 drop:
1118 	if (dropped)
1119 		kfree_skb(skb);
1120 	else
1121 		consume_skb(skb);
1122 	return 0;
1123 }
1124 
1125 #endif
1126 
1127 
1128 /*
1129  *	Add a filter to a device
1130  */
1131 
ip_mc_filter_add(struct in_device * in_dev,__be32 addr)1132 static void ip_mc_filter_add(struct in_device *in_dev, __be32 addr)
1133 {
1134 	char buf[MAX_ADDR_LEN];
1135 	struct net_device *dev = in_dev->dev;
1136 
1137 	/* Checking for IFF_MULTICAST here is WRONG-WRONG-WRONG.
1138 	   We will get multicast token leakage, when IFF_MULTICAST
1139 	   is changed. This check should be done in ndo_set_rx_mode
1140 	   routine. Something sort of:
1141 	   if (dev->mc_list && dev->flags&IFF_MULTICAST) { do it; }
1142 	   --ANK
1143 	   */
1144 	if (arp_mc_map(addr, buf, dev, 0) == 0)
1145 		dev_mc_add(dev, buf);
1146 }
1147 
1148 /*
1149  *	Remove a filter from a device
1150  */
1151 
ip_mc_filter_del(struct in_device * in_dev,__be32 addr)1152 static void ip_mc_filter_del(struct in_device *in_dev, __be32 addr)
1153 {
1154 	char buf[MAX_ADDR_LEN];
1155 	struct net_device *dev = in_dev->dev;
1156 
1157 	if (arp_mc_map(addr, buf, dev, 0) == 0)
1158 		dev_mc_del(dev, buf);
1159 }
1160 
1161 #ifdef CONFIG_IP_MULTICAST
1162 /*
1163  * deleted ip_mc_list manipulation
1164  */
igmpv3_add_delrec(struct in_device * in_dev,struct ip_mc_list * im,gfp_t gfp)1165 static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im,
1166 			      gfp_t gfp)
1167 {
1168 	struct ip_mc_list *pmc;
1169 	struct net *net = dev_net(in_dev->dev);
1170 
1171 	/* this is an "ip_mc_list" for convenience; only the fields below
1172 	 * are actually used. In particular, the refcnt and users are not
1173 	 * used for management of the delete list. Using the same structure
1174 	 * for deleted items allows change reports to use common code with
1175 	 * non-deleted or query-response MCA's.
1176 	 */
1177 	pmc = kzalloc(sizeof(*pmc), gfp);
1178 	if (!pmc)
1179 		return;
1180 	spin_lock_init(&pmc->lock);
1181 	spin_lock_bh(&im->lock);
1182 	pmc->interface = im->interface;
1183 	in_dev_hold(in_dev);
1184 	pmc->multiaddr = im->multiaddr;
1185 	pmc->crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
1186 	pmc->sfmode = im->sfmode;
1187 	if (pmc->sfmode == MCAST_INCLUDE) {
1188 		struct ip_sf_list *psf;
1189 
1190 		pmc->tomb = im->tomb;
1191 		pmc->sources = im->sources;
1192 		im->tomb = im->sources = NULL;
1193 		for (psf = pmc->sources; psf; psf = psf->sf_next)
1194 			psf->sf_crcount = pmc->crcount;
1195 	}
1196 	spin_unlock_bh(&im->lock);
1197 
1198 	spin_lock_bh(&in_dev->mc_tomb_lock);
1199 	pmc->next = in_dev->mc_tomb;
1200 	in_dev->mc_tomb = pmc;
1201 	spin_unlock_bh(&in_dev->mc_tomb_lock);
1202 }
1203 
1204 /*
1205  * restore ip_mc_list deleted records
1206  */
igmpv3_del_delrec(struct in_device * in_dev,struct ip_mc_list * im)1207 static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
1208 {
1209 	struct ip_mc_list *pmc, *pmc_prev;
1210 	struct ip_sf_list *psf;
1211 	struct net *net = dev_net(in_dev->dev);
1212 	__be32 multiaddr = im->multiaddr;
1213 
1214 	spin_lock_bh(&in_dev->mc_tomb_lock);
1215 	pmc_prev = NULL;
1216 	for (pmc = in_dev->mc_tomb; pmc; pmc = pmc->next) {
1217 		if (pmc->multiaddr == multiaddr)
1218 			break;
1219 		pmc_prev = pmc;
1220 	}
1221 	if (pmc) {
1222 		if (pmc_prev)
1223 			pmc_prev->next = pmc->next;
1224 		else
1225 			in_dev->mc_tomb = pmc->next;
1226 	}
1227 	spin_unlock_bh(&in_dev->mc_tomb_lock);
1228 
1229 	spin_lock_bh(&im->lock);
1230 	if (pmc) {
1231 		im->interface = pmc->interface;
1232 		if (im->sfmode == MCAST_INCLUDE) {
1233 			swap(im->tomb, pmc->tomb);
1234 			swap(im->sources, pmc->sources);
1235 			for (psf = im->sources; psf; psf = psf->sf_next)
1236 				psf->sf_crcount = in_dev->mr_qrv ?:
1237 					READ_ONCE(net->ipv4.sysctl_igmp_qrv);
1238 		} else {
1239 			im->crcount = in_dev->mr_qrv ?:
1240 				READ_ONCE(net->ipv4.sysctl_igmp_qrv);
1241 		}
1242 		in_dev_put(pmc->interface);
1243 		kfree_pmc(pmc);
1244 	}
1245 	spin_unlock_bh(&im->lock);
1246 }
1247 
1248 /*
1249  * flush ip_mc_list deleted records
1250  */
igmpv3_clear_delrec(struct in_device * in_dev)1251 static void igmpv3_clear_delrec(struct in_device *in_dev)
1252 {
1253 	struct ip_mc_list *pmc, *nextpmc;
1254 
1255 	spin_lock_bh(&in_dev->mc_tomb_lock);
1256 	pmc = in_dev->mc_tomb;
1257 	in_dev->mc_tomb = NULL;
1258 	spin_unlock_bh(&in_dev->mc_tomb_lock);
1259 
1260 	for (; pmc; pmc = nextpmc) {
1261 		nextpmc = pmc->next;
1262 		ip_mc_clear_src(pmc);
1263 		in_dev_put(pmc->interface);
1264 		kfree_pmc(pmc);
1265 	}
1266 	/* clear dead sources, too */
1267 	rcu_read_lock();
1268 	for_each_pmc_rcu(in_dev, pmc) {
1269 		struct ip_sf_list *psf;
1270 
1271 		spin_lock_bh(&pmc->lock);
1272 		psf = pmc->tomb;
1273 		pmc->tomb = NULL;
1274 		spin_unlock_bh(&pmc->lock);
1275 		ip_sf_list_clear_all(psf);
1276 	}
1277 	rcu_read_unlock();
1278 }
1279 #endif
1280 
__igmp_group_dropped(struct ip_mc_list * im,gfp_t gfp)1281 static void __igmp_group_dropped(struct ip_mc_list *im, gfp_t gfp)
1282 {
1283 	struct in_device *in_dev = im->interface;
1284 #ifdef CONFIG_IP_MULTICAST
1285 	struct net *net = dev_net(in_dev->dev);
1286 	int reporter;
1287 #endif
1288 
1289 	if (im->loaded) {
1290 		im->loaded = 0;
1291 		ip_mc_filter_del(in_dev, im->multiaddr);
1292 	}
1293 
1294 #ifdef CONFIG_IP_MULTICAST
1295 	if (im->multiaddr == IGMP_ALL_HOSTS)
1296 		return;
1297 	if (ipv4_is_local_multicast(im->multiaddr) &&
1298 	    !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
1299 		return;
1300 
1301 	reporter = im->reporter;
1302 	igmp_stop_timer(im);
1303 
1304 	if (!in_dev->dead) {
1305 		if (IGMP_V1_SEEN(in_dev))
1306 			return;
1307 		if (IGMP_V2_SEEN(in_dev)) {
1308 			if (reporter)
1309 				igmp_send_report(in_dev, im, IGMP_HOST_LEAVE_MESSAGE);
1310 			return;
1311 		}
1312 		/* IGMPv3 */
1313 		igmpv3_add_delrec(in_dev, im, gfp);
1314 
1315 		igmp_ifc_event(in_dev);
1316 	}
1317 #endif
1318 }
1319 
igmp_group_dropped(struct ip_mc_list * im)1320 static void igmp_group_dropped(struct ip_mc_list *im)
1321 {
1322 	__igmp_group_dropped(im, GFP_KERNEL);
1323 }
1324 
igmp_group_added(struct ip_mc_list * im)1325 static void igmp_group_added(struct ip_mc_list *im)
1326 {
1327 	struct in_device *in_dev = im->interface;
1328 #ifdef CONFIG_IP_MULTICAST
1329 	struct net *net = dev_net(in_dev->dev);
1330 #endif
1331 
1332 	if (im->loaded == 0) {
1333 		im->loaded = 1;
1334 		ip_mc_filter_add(in_dev, im->multiaddr);
1335 	}
1336 
1337 #ifdef CONFIG_IP_MULTICAST
1338 	if (im->multiaddr == IGMP_ALL_HOSTS)
1339 		return;
1340 	if (ipv4_is_local_multicast(im->multiaddr) &&
1341 	    !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
1342 		return;
1343 
1344 	if (in_dev->dead)
1345 		return;
1346 
1347 	im->unsolicit_count = READ_ONCE(net->ipv4.sysctl_igmp_qrv);
1348 	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev)) {
1349 		spin_lock_bh(&im->lock);
1350 		igmp_start_timer(im, IGMP_INITIAL_REPORT_DELAY);
1351 		spin_unlock_bh(&im->lock);
1352 		return;
1353 	}
1354 	/* else, v3 */
1355 
1356 	/* Based on RFC3376 5.1, for newly added INCLUDE SSM, we should
1357 	 * not send filter-mode change record as the mode should be from
1358 	 * IN() to IN(A).
1359 	 */
1360 	if (im->sfmode == MCAST_EXCLUDE)
1361 		im->crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
1362 
1363 	igmp_ifc_event(in_dev);
1364 #endif
1365 }
1366 
1367 
1368 /*
1369  *	Multicast list managers
1370  */
1371 
ip_mc_hash(const struct ip_mc_list * im)1372 static u32 ip_mc_hash(const struct ip_mc_list *im)
1373 {
1374 	return hash_32((__force u32)im->multiaddr, MC_HASH_SZ_LOG);
1375 }
1376 
ip_mc_hash_add(struct in_device * in_dev,struct ip_mc_list * im)1377 static void ip_mc_hash_add(struct in_device *in_dev,
1378 			   struct ip_mc_list *im)
1379 {
1380 	struct ip_mc_list __rcu **mc_hash;
1381 	u32 hash;
1382 
1383 	mc_hash = rtnl_dereference(in_dev->mc_hash);
1384 	if (mc_hash) {
1385 		hash = ip_mc_hash(im);
1386 		im->next_hash = mc_hash[hash];
1387 		rcu_assign_pointer(mc_hash[hash], im);
1388 		return;
1389 	}
1390 
1391 	/* do not use a hash table for small number of items */
1392 	if (in_dev->mc_count < 4)
1393 		return;
1394 
1395 	mc_hash = kzalloc(sizeof(struct ip_mc_list *) << MC_HASH_SZ_LOG,
1396 			  GFP_KERNEL);
1397 	if (!mc_hash)
1398 		return;
1399 
1400 	for_each_pmc_rtnl(in_dev, im) {
1401 		hash = ip_mc_hash(im);
1402 		im->next_hash = mc_hash[hash];
1403 		RCU_INIT_POINTER(mc_hash[hash], im);
1404 	}
1405 
1406 	rcu_assign_pointer(in_dev->mc_hash, mc_hash);
1407 }
1408 
ip_mc_hash_remove(struct in_device * in_dev,struct ip_mc_list * im)1409 static void ip_mc_hash_remove(struct in_device *in_dev,
1410 			      struct ip_mc_list *im)
1411 {
1412 	struct ip_mc_list __rcu **mc_hash = rtnl_dereference(in_dev->mc_hash);
1413 	struct ip_mc_list *aux;
1414 
1415 	if (!mc_hash)
1416 		return;
1417 	mc_hash += ip_mc_hash(im);
1418 	while ((aux = rtnl_dereference(*mc_hash)) != im)
1419 		mc_hash = &aux->next_hash;
1420 	*mc_hash = im->next_hash;
1421 }
1422 
1423 
1424 /*
1425  *	A socket has joined a multicast group on device dev.
1426  */
____ip_mc_inc_group(struct in_device * in_dev,__be32 addr,unsigned int mode,gfp_t gfp)1427 static void ____ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
1428 				unsigned int mode, gfp_t gfp)
1429 {
1430 	struct ip_mc_list *im;
1431 
1432 	ASSERT_RTNL();
1433 
1434 	for_each_pmc_rtnl(in_dev, im) {
1435 		if (im->multiaddr == addr) {
1436 			im->users++;
1437 			ip_mc_add_src(in_dev, &addr, mode, 0, NULL, 0);
1438 			goto out;
1439 		}
1440 	}
1441 
1442 	im = kzalloc(sizeof(*im), gfp);
1443 	if (!im)
1444 		goto out;
1445 
1446 	im->users = 1;
1447 	im->interface = in_dev;
1448 	in_dev_hold(in_dev);
1449 	im->multiaddr = addr;
1450 	/* initial mode is (EX, empty) */
1451 	im->sfmode = mode;
1452 	im->sfcount[mode] = 1;
1453 	refcount_set(&im->refcnt, 1);
1454 	spin_lock_init(&im->lock);
1455 #ifdef CONFIG_IP_MULTICAST
1456 	timer_setup(&im->timer, igmp_timer_expire, 0);
1457 #endif
1458 
1459 	im->next_rcu = in_dev->mc_list;
1460 	in_dev->mc_count++;
1461 	rcu_assign_pointer(in_dev->mc_list, im);
1462 
1463 	ip_mc_hash_add(in_dev, im);
1464 
1465 #ifdef CONFIG_IP_MULTICAST
1466 	igmpv3_del_delrec(in_dev, im);
1467 #endif
1468 	igmp_group_added(im);
1469 	if (!in_dev->dead)
1470 		ip_rt_multicast_event(in_dev);
1471 out:
1472 	return;
1473 }
1474 
__ip_mc_inc_group(struct in_device * in_dev,__be32 addr,gfp_t gfp)1475 void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr, gfp_t gfp)
1476 {
1477 	____ip_mc_inc_group(in_dev, addr, MCAST_EXCLUDE, gfp);
1478 }
1479 EXPORT_SYMBOL(__ip_mc_inc_group);
1480 
ip_mc_inc_group(struct in_device * in_dev,__be32 addr)1481 void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
1482 {
1483 	__ip_mc_inc_group(in_dev, addr, GFP_KERNEL);
1484 }
1485 EXPORT_SYMBOL(ip_mc_inc_group);
1486 
ip_mc_check_iphdr(struct sk_buff * skb)1487 static int ip_mc_check_iphdr(struct sk_buff *skb)
1488 {
1489 	const struct iphdr *iph;
1490 	unsigned int len;
1491 	unsigned int offset = skb_network_offset(skb) + sizeof(*iph);
1492 
1493 	if (!pskb_may_pull(skb, offset))
1494 		return -EINVAL;
1495 
1496 	iph = ip_hdr(skb);
1497 
1498 	if (iph->version != 4 || ip_hdrlen(skb) < sizeof(*iph))
1499 		return -EINVAL;
1500 
1501 	offset += ip_hdrlen(skb) - sizeof(*iph);
1502 
1503 	if (!pskb_may_pull(skb, offset))
1504 		return -EINVAL;
1505 
1506 	iph = ip_hdr(skb);
1507 
1508 	if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
1509 		return -EINVAL;
1510 
1511 	len = skb_network_offset(skb) + ntohs(iph->tot_len);
1512 	if (skb->len < len || len < offset)
1513 		return -EINVAL;
1514 
1515 	skb_set_transport_header(skb, offset);
1516 
1517 	return 0;
1518 }
1519 
ip_mc_check_igmp_reportv3(struct sk_buff * skb)1520 static int ip_mc_check_igmp_reportv3(struct sk_buff *skb)
1521 {
1522 	unsigned int len = skb_transport_offset(skb);
1523 
1524 	len += sizeof(struct igmpv3_report);
1525 
1526 	return ip_mc_may_pull(skb, len) ? 0 : -EINVAL;
1527 }
1528 
ip_mc_check_igmp_query(struct sk_buff * skb)1529 static int ip_mc_check_igmp_query(struct sk_buff *skb)
1530 {
1531 	unsigned int transport_len = ip_transport_len(skb);
1532 	unsigned int len;
1533 
1534 	/* IGMPv{1,2}? */
1535 	if (transport_len != sizeof(struct igmphdr)) {
1536 		/* or IGMPv3? */
1537 		if (transport_len < sizeof(struct igmpv3_query))
1538 			return -EINVAL;
1539 
1540 		len = skb_transport_offset(skb) + sizeof(struct igmpv3_query);
1541 		if (!ip_mc_may_pull(skb, len))
1542 			return -EINVAL;
1543 	}
1544 
1545 	/* RFC2236+RFC3376 (IGMPv2+IGMPv3) require the multicast link layer
1546 	 * all-systems destination addresses (224.0.0.1) for general queries
1547 	 */
1548 	if (!igmp_hdr(skb)->group &&
1549 	    ip_hdr(skb)->daddr != htonl(INADDR_ALLHOSTS_GROUP))
1550 		return -EINVAL;
1551 
1552 	return 0;
1553 }
1554 
ip_mc_check_igmp_msg(struct sk_buff * skb)1555 static int ip_mc_check_igmp_msg(struct sk_buff *skb)
1556 {
1557 	switch (igmp_hdr(skb)->type) {
1558 	case IGMP_HOST_LEAVE_MESSAGE:
1559 	case IGMP_HOST_MEMBERSHIP_REPORT:
1560 	case IGMPV2_HOST_MEMBERSHIP_REPORT:
1561 		return 0;
1562 	case IGMPV3_HOST_MEMBERSHIP_REPORT:
1563 		return ip_mc_check_igmp_reportv3(skb);
1564 	case IGMP_HOST_MEMBERSHIP_QUERY:
1565 		return ip_mc_check_igmp_query(skb);
1566 	default:
1567 		return -ENOMSG;
1568 	}
1569 }
1570 
ip_mc_validate_checksum(struct sk_buff * skb)1571 static __sum16 ip_mc_validate_checksum(struct sk_buff *skb)
1572 {
1573 	return skb_checksum_simple_validate(skb);
1574 }
1575 
ip_mc_check_igmp_csum(struct sk_buff * skb)1576 static int ip_mc_check_igmp_csum(struct sk_buff *skb)
1577 {
1578 	unsigned int len = skb_transport_offset(skb) + sizeof(struct igmphdr);
1579 	unsigned int transport_len = ip_transport_len(skb);
1580 	struct sk_buff *skb_chk;
1581 
1582 	if (!ip_mc_may_pull(skb, len))
1583 		return -EINVAL;
1584 
1585 	skb_chk = skb_checksum_trimmed(skb, transport_len,
1586 				       ip_mc_validate_checksum);
1587 	if (!skb_chk)
1588 		return -EINVAL;
1589 
1590 	if (skb_chk != skb)
1591 		kfree_skb(skb_chk);
1592 
1593 	return 0;
1594 }
1595 
1596 /**
1597  * ip_mc_check_igmp - checks whether this is a sane IGMP packet
1598  * @skb: the skb to validate
1599  *
1600  * Checks whether an IPv4 packet is a valid IGMP packet. If so sets
1601  * skb transport header accordingly and returns zero.
1602  *
1603  * -EINVAL: A broken packet was detected, i.e. it violates some internet
1604  *  standard
1605  * -ENOMSG: IP header validation succeeded but it is not an IGMP packet.
1606  * -ENOMEM: A memory allocation failure happened.
1607  *
1608  * Caller needs to set the skb network header and free any returned skb if it
1609  * differs from the provided skb.
1610  */
ip_mc_check_igmp(struct sk_buff * skb)1611 int ip_mc_check_igmp(struct sk_buff *skb)
1612 {
1613 	int ret = ip_mc_check_iphdr(skb);
1614 
1615 	if (ret < 0)
1616 		return ret;
1617 
1618 	if (ip_hdr(skb)->protocol != IPPROTO_IGMP)
1619 		return -ENOMSG;
1620 
1621 	ret = ip_mc_check_igmp_csum(skb);
1622 	if (ret < 0)
1623 		return ret;
1624 
1625 	return ip_mc_check_igmp_msg(skb);
1626 }
1627 EXPORT_SYMBOL(ip_mc_check_igmp);
1628 
1629 /*
1630  *	Resend IGMP JOIN report; used by netdev notifier.
1631  */
ip_mc_rejoin_groups(struct in_device * in_dev)1632 static void ip_mc_rejoin_groups(struct in_device *in_dev)
1633 {
1634 #ifdef CONFIG_IP_MULTICAST
1635 	struct ip_mc_list *im;
1636 	int type;
1637 	struct net *net = dev_net(in_dev->dev);
1638 
1639 	ASSERT_RTNL();
1640 
1641 	for_each_pmc_rtnl(in_dev, im) {
1642 		if (im->multiaddr == IGMP_ALL_HOSTS)
1643 			continue;
1644 		if (ipv4_is_local_multicast(im->multiaddr) &&
1645 		    !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
1646 			continue;
1647 
1648 		/* a failover is happening and switches
1649 		 * must be notified immediately
1650 		 */
1651 		if (IGMP_V1_SEEN(in_dev))
1652 			type = IGMP_HOST_MEMBERSHIP_REPORT;
1653 		else if (IGMP_V2_SEEN(in_dev))
1654 			type = IGMPV2_HOST_MEMBERSHIP_REPORT;
1655 		else
1656 			type = IGMPV3_HOST_MEMBERSHIP_REPORT;
1657 		igmp_send_report(in_dev, im, type);
1658 	}
1659 #endif
1660 }
1661 
1662 /*
1663  *	A socket has left a multicast group on device dev
1664  */
1665 
__ip_mc_dec_group(struct in_device * in_dev,__be32 addr,gfp_t gfp)1666 void __ip_mc_dec_group(struct in_device *in_dev, __be32 addr, gfp_t gfp)
1667 {
1668 	struct ip_mc_list *i;
1669 	struct ip_mc_list __rcu **ip;
1670 
1671 	ASSERT_RTNL();
1672 
1673 	for (ip = &in_dev->mc_list;
1674 	     (i = rtnl_dereference(*ip)) != NULL;
1675 	     ip = &i->next_rcu) {
1676 		if (i->multiaddr == addr) {
1677 			if (--i->users == 0) {
1678 				ip_mc_hash_remove(in_dev, i);
1679 				*ip = i->next_rcu;
1680 				in_dev->mc_count--;
1681 				__igmp_group_dropped(i, gfp);
1682 				ip_mc_clear_src(i);
1683 
1684 				if (!in_dev->dead)
1685 					ip_rt_multicast_event(in_dev);
1686 
1687 				ip_ma_put(i);
1688 				return;
1689 			}
1690 			break;
1691 		}
1692 	}
1693 }
1694 EXPORT_SYMBOL(__ip_mc_dec_group);
1695 
1696 /* Device changing type */
1697 
ip_mc_unmap(struct in_device * in_dev)1698 void ip_mc_unmap(struct in_device *in_dev)
1699 {
1700 	struct ip_mc_list *pmc;
1701 
1702 	ASSERT_RTNL();
1703 
1704 	for_each_pmc_rtnl(in_dev, pmc)
1705 		igmp_group_dropped(pmc);
1706 }
1707 
ip_mc_remap(struct in_device * in_dev)1708 void ip_mc_remap(struct in_device *in_dev)
1709 {
1710 	struct ip_mc_list *pmc;
1711 
1712 	ASSERT_RTNL();
1713 
1714 	for_each_pmc_rtnl(in_dev, pmc) {
1715 #ifdef CONFIG_IP_MULTICAST
1716 		igmpv3_del_delrec(in_dev, pmc);
1717 #endif
1718 		igmp_group_added(pmc);
1719 	}
1720 }
1721 
1722 /* Device going down */
1723 
ip_mc_down(struct in_device * in_dev)1724 void ip_mc_down(struct in_device *in_dev)
1725 {
1726 	struct ip_mc_list *pmc;
1727 
1728 	ASSERT_RTNL();
1729 
1730 	for_each_pmc_rtnl(in_dev, pmc)
1731 		igmp_group_dropped(pmc);
1732 
1733 #ifdef CONFIG_IP_MULTICAST
1734 	in_dev->mr_ifc_count = 0;
1735 	if (del_timer(&in_dev->mr_ifc_timer))
1736 		__in_dev_put(in_dev);
1737 	in_dev->mr_gq_running = 0;
1738 	if (del_timer(&in_dev->mr_gq_timer))
1739 		__in_dev_put(in_dev);
1740 #endif
1741 
1742 	ip_mc_dec_group(in_dev, IGMP_ALL_HOSTS);
1743 }
1744 
1745 #ifdef CONFIG_IP_MULTICAST
ip_mc_reset(struct in_device * in_dev)1746 static void ip_mc_reset(struct in_device *in_dev)
1747 {
1748 	struct net *net = dev_net(in_dev->dev);
1749 
1750 	in_dev->mr_qi = IGMP_QUERY_INTERVAL;
1751 	in_dev->mr_qri = IGMP_QUERY_RESPONSE_INTERVAL;
1752 	in_dev->mr_qrv = READ_ONCE(net->ipv4.sysctl_igmp_qrv);
1753 }
1754 #else
ip_mc_reset(struct in_device * in_dev)1755 static void ip_mc_reset(struct in_device *in_dev)
1756 {
1757 }
1758 #endif
1759 
ip_mc_init_dev(struct in_device * in_dev)1760 void ip_mc_init_dev(struct in_device *in_dev)
1761 {
1762 	ASSERT_RTNL();
1763 
1764 #ifdef CONFIG_IP_MULTICAST
1765 	timer_setup(&in_dev->mr_gq_timer, igmp_gq_timer_expire, 0);
1766 	timer_setup(&in_dev->mr_ifc_timer, igmp_ifc_timer_expire, 0);
1767 #endif
1768 	ip_mc_reset(in_dev);
1769 
1770 	spin_lock_init(&in_dev->mc_tomb_lock);
1771 }
1772 
1773 /* Device going up */
1774 
ip_mc_up(struct in_device * in_dev)1775 void ip_mc_up(struct in_device *in_dev)
1776 {
1777 	struct ip_mc_list *pmc;
1778 
1779 	ASSERT_RTNL();
1780 
1781 	ip_mc_reset(in_dev);
1782 	ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
1783 
1784 	for_each_pmc_rtnl(in_dev, pmc) {
1785 #ifdef CONFIG_IP_MULTICAST
1786 		igmpv3_del_delrec(in_dev, pmc);
1787 #endif
1788 		igmp_group_added(pmc);
1789 	}
1790 }
1791 
1792 /*
1793  *	Device is about to be destroyed: clean up.
1794  */
1795 
ip_mc_destroy_dev(struct in_device * in_dev)1796 void ip_mc_destroy_dev(struct in_device *in_dev)
1797 {
1798 	struct ip_mc_list *i;
1799 
1800 	ASSERT_RTNL();
1801 
1802 	/* Deactivate timers */
1803 	ip_mc_down(in_dev);
1804 #ifdef CONFIG_IP_MULTICAST
1805 	igmpv3_clear_delrec(in_dev);
1806 #endif
1807 
1808 	while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) {
1809 		in_dev->mc_list = i->next_rcu;
1810 		in_dev->mc_count--;
1811 		ip_mc_clear_src(i);
1812 		ip_ma_put(i);
1813 	}
1814 }
1815 
1816 /* RTNL is locked */
ip_mc_find_dev(struct net * net,struct ip_mreqn * imr)1817 static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
1818 {
1819 	struct net_device *dev = NULL;
1820 	struct in_device *idev = NULL;
1821 
1822 	if (imr->imr_ifindex) {
1823 		idev = inetdev_by_index(net, imr->imr_ifindex);
1824 		return idev;
1825 	}
1826 	if (imr->imr_address.s_addr) {
1827 		dev = __ip_dev_find(net, imr->imr_address.s_addr, false);
1828 		if (!dev)
1829 			return NULL;
1830 	}
1831 
1832 	if (!dev) {
1833 		struct rtable *rt = ip_route_output(net,
1834 						    imr->imr_multiaddr.s_addr,
1835 						    0, 0, 0);
1836 		if (!IS_ERR(rt)) {
1837 			dev = rt->dst.dev;
1838 			ip_rt_put(rt);
1839 		}
1840 	}
1841 	if (dev) {
1842 		imr->imr_ifindex = dev->ifindex;
1843 		idev = __in_dev_get_rtnl(dev);
1844 	}
1845 	return idev;
1846 }
1847 
1848 /*
1849  *	Join a socket to a group
1850  */
1851 
ip_mc_del1_src(struct ip_mc_list * pmc,int sfmode,__be32 * psfsrc)1852 static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
1853 	__be32 *psfsrc)
1854 {
1855 	struct ip_sf_list *psf, *psf_prev;
1856 	int rv = 0;
1857 
1858 	psf_prev = NULL;
1859 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
1860 		if (psf->sf_inaddr == *psfsrc)
1861 			break;
1862 		psf_prev = psf;
1863 	}
1864 	if (!psf || psf->sf_count[sfmode] == 0) {
1865 		/* source filter not found, or count wrong =>  bug */
1866 		return -ESRCH;
1867 	}
1868 	psf->sf_count[sfmode]--;
1869 	if (psf->sf_count[sfmode] == 0) {
1870 		ip_rt_multicast_event(pmc->interface);
1871 	}
1872 	if (!psf->sf_count[MCAST_INCLUDE] && !psf->sf_count[MCAST_EXCLUDE]) {
1873 #ifdef CONFIG_IP_MULTICAST
1874 		struct in_device *in_dev = pmc->interface;
1875 		struct net *net = dev_net(in_dev->dev);
1876 #endif
1877 
1878 		/* no more filters for this source */
1879 		if (psf_prev)
1880 			psf_prev->sf_next = psf->sf_next;
1881 		else
1882 			pmc->sources = psf->sf_next;
1883 #ifdef CONFIG_IP_MULTICAST
1884 		if (psf->sf_oldin &&
1885 		    !IGMP_V1_SEEN(in_dev) && !IGMP_V2_SEEN(in_dev)) {
1886 			psf->sf_crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
1887 			psf->sf_next = pmc->tomb;
1888 			pmc->tomb = psf;
1889 			rv = 1;
1890 		} else
1891 #endif
1892 			kfree(psf);
1893 	}
1894 	return rv;
1895 }
1896 
1897 #ifndef CONFIG_IP_MULTICAST
1898 #define igmp_ifc_event(x)	do { } while (0)
1899 #endif
1900 
ip_mc_del_src(struct in_device * in_dev,__be32 * pmca,int sfmode,int sfcount,__be32 * psfsrc,int delta)1901 static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
1902 			 int sfcount, __be32 *psfsrc, int delta)
1903 {
1904 	struct ip_mc_list *pmc;
1905 	int	changerec = 0;
1906 	int	i, err;
1907 
1908 	if (!in_dev)
1909 		return -ENODEV;
1910 	rcu_read_lock();
1911 	for_each_pmc_rcu(in_dev, pmc) {
1912 		if (*pmca == pmc->multiaddr)
1913 			break;
1914 	}
1915 	if (!pmc) {
1916 		/* MCA not found?? bug */
1917 		rcu_read_unlock();
1918 		return -ESRCH;
1919 	}
1920 	spin_lock_bh(&pmc->lock);
1921 	rcu_read_unlock();
1922 #ifdef CONFIG_IP_MULTICAST
1923 	sf_markstate(pmc);
1924 #endif
1925 	if (!delta) {
1926 		err = -EINVAL;
1927 		if (!pmc->sfcount[sfmode])
1928 			goto out_unlock;
1929 		pmc->sfcount[sfmode]--;
1930 	}
1931 	err = 0;
1932 	for (i = 0; i < sfcount; i++) {
1933 		int rv = ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
1934 
1935 		changerec |= rv > 0;
1936 		if (!err && rv < 0)
1937 			err = rv;
1938 	}
1939 	if (pmc->sfmode == MCAST_EXCLUDE &&
1940 	    pmc->sfcount[MCAST_EXCLUDE] == 0 &&
1941 	    pmc->sfcount[MCAST_INCLUDE]) {
1942 #ifdef CONFIG_IP_MULTICAST
1943 		struct ip_sf_list *psf;
1944 		struct net *net = dev_net(in_dev->dev);
1945 #endif
1946 
1947 		/* filter mode change */
1948 		pmc->sfmode = MCAST_INCLUDE;
1949 #ifdef CONFIG_IP_MULTICAST
1950 		pmc->crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
1951 		in_dev->mr_ifc_count = pmc->crcount;
1952 		for (psf = pmc->sources; psf; psf = psf->sf_next)
1953 			psf->sf_crcount = 0;
1954 		igmp_ifc_event(pmc->interface);
1955 	} else if (sf_setstate(pmc) || changerec) {
1956 		igmp_ifc_event(pmc->interface);
1957 #endif
1958 	}
1959 out_unlock:
1960 	spin_unlock_bh(&pmc->lock);
1961 	return err;
1962 }
1963 
1964 /*
1965  * Add multicast single-source filter to the interface list
1966  */
ip_mc_add1_src(struct ip_mc_list * pmc,int sfmode,__be32 * psfsrc)1967 static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
1968 	__be32 *psfsrc)
1969 {
1970 	struct ip_sf_list *psf, *psf_prev;
1971 
1972 	psf_prev = NULL;
1973 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
1974 		if (psf->sf_inaddr == *psfsrc)
1975 			break;
1976 		psf_prev = psf;
1977 	}
1978 	if (!psf) {
1979 		psf = kzalloc(sizeof(*psf), GFP_ATOMIC);
1980 		if (!psf)
1981 			return -ENOBUFS;
1982 		psf->sf_inaddr = *psfsrc;
1983 		if (psf_prev) {
1984 			psf_prev->sf_next = psf;
1985 		} else
1986 			pmc->sources = psf;
1987 	}
1988 	psf->sf_count[sfmode]++;
1989 	if (psf->sf_count[sfmode] == 1) {
1990 		ip_rt_multicast_event(pmc->interface);
1991 	}
1992 	return 0;
1993 }
1994 
1995 #ifdef CONFIG_IP_MULTICAST
sf_markstate(struct ip_mc_list * pmc)1996 static void sf_markstate(struct ip_mc_list *pmc)
1997 {
1998 	struct ip_sf_list *psf;
1999 	int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
2000 
2001 	for (psf = pmc->sources; psf; psf = psf->sf_next)
2002 		if (pmc->sfcount[MCAST_EXCLUDE]) {
2003 			psf->sf_oldin = mca_xcount ==
2004 				psf->sf_count[MCAST_EXCLUDE] &&
2005 				!psf->sf_count[MCAST_INCLUDE];
2006 		} else
2007 			psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
2008 }
2009 
sf_setstate(struct ip_mc_list * pmc)2010 static int sf_setstate(struct ip_mc_list *pmc)
2011 {
2012 	struct ip_sf_list *psf, *dpsf;
2013 	int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
2014 	int qrv = pmc->interface->mr_qrv;
2015 	int new_in, rv;
2016 
2017 	rv = 0;
2018 	for (psf = pmc->sources; psf; psf = psf->sf_next) {
2019 		if (pmc->sfcount[MCAST_EXCLUDE]) {
2020 			new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
2021 				!psf->sf_count[MCAST_INCLUDE];
2022 		} else
2023 			new_in = psf->sf_count[MCAST_INCLUDE] != 0;
2024 		if (new_in) {
2025 			if (!psf->sf_oldin) {
2026 				struct ip_sf_list *prev = NULL;
2027 
2028 				for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next) {
2029 					if (dpsf->sf_inaddr == psf->sf_inaddr)
2030 						break;
2031 					prev = dpsf;
2032 				}
2033 				if (dpsf) {
2034 					if (prev)
2035 						prev->sf_next = dpsf->sf_next;
2036 					else
2037 						pmc->tomb = dpsf->sf_next;
2038 					kfree(dpsf);
2039 				}
2040 				psf->sf_crcount = qrv;
2041 				rv++;
2042 			}
2043 		} else if (psf->sf_oldin) {
2044 
2045 			psf->sf_crcount = 0;
2046 			/*
2047 			 * add or update "delete" records if an active filter
2048 			 * is now inactive
2049 			 */
2050 			for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next)
2051 				if (dpsf->sf_inaddr == psf->sf_inaddr)
2052 					break;
2053 			if (!dpsf) {
2054 				dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
2055 				if (!dpsf)
2056 					continue;
2057 				*dpsf = *psf;
2058 				/* pmc->lock held by callers */
2059 				dpsf->sf_next = pmc->tomb;
2060 				pmc->tomb = dpsf;
2061 			}
2062 			dpsf->sf_crcount = qrv;
2063 			rv++;
2064 		}
2065 	}
2066 	return rv;
2067 }
2068 #endif
2069 
2070 /*
2071  * Add multicast source filter list to the interface list
2072  */
ip_mc_add_src(struct in_device * in_dev,__be32 * pmca,int sfmode,int sfcount,__be32 * psfsrc,int delta)2073 static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
2074 			 int sfcount, __be32 *psfsrc, int delta)
2075 {
2076 	struct ip_mc_list *pmc;
2077 	int	isexclude;
2078 	int	i, err;
2079 
2080 	if (!in_dev)
2081 		return -ENODEV;
2082 	rcu_read_lock();
2083 	for_each_pmc_rcu(in_dev, pmc) {
2084 		if (*pmca == pmc->multiaddr)
2085 			break;
2086 	}
2087 	if (!pmc) {
2088 		/* MCA not found?? bug */
2089 		rcu_read_unlock();
2090 		return -ESRCH;
2091 	}
2092 	spin_lock_bh(&pmc->lock);
2093 	rcu_read_unlock();
2094 
2095 #ifdef CONFIG_IP_MULTICAST
2096 	sf_markstate(pmc);
2097 #endif
2098 	isexclude = pmc->sfmode == MCAST_EXCLUDE;
2099 	if (!delta)
2100 		pmc->sfcount[sfmode]++;
2101 	err = 0;
2102 	for (i = 0; i < sfcount; i++) {
2103 		err = ip_mc_add1_src(pmc, sfmode, &psfsrc[i]);
2104 		if (err)
2105 			break;
2106 	}
2107 	if (err) {
2108 		int j;
2109 
2110 		if (!delta)
2111 			pmc->sfcount[sfmode]--;
2112 		for (j = 0; j < i; j++)
2113 			(void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
2114 	} else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
2115 #ifdef CONFIG_IP_MULTICAST
2116 		struct ip_sf_list *psf;
2117 		struct net *net = dev_net(pmc->interface->dev);
2118 		in_dev = pmc->interface;
2119 #endif
2120 
2121 		/* filter mode change */
2122 		if (pmc->sfcount[MCAST_EXCLUDE])
2123 			pmc->sfmode = MCAST_EXCLUDE;
2124 		else if (pmc->sfcount[MCAST_INCLUDE])
2125 			pmc->sfmode = MCAST_INCLUDE;
2126 #ifdef CONFIG_IP_MULTICAST
2127 		/* else no filters; keep old mode for reports */
2128 
2129 		pmc->crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
2130 		in_dev->mr_ifc_count = pmc->crcount;
2131 		for (psf = pmc->sources; psf; psf = psf->sf_next)
2132 			psf->sf_crcount = 0;
2133 		igmp_ifc_event(in_dev);
2134 	} else if (sf_setstate(pmc)) {
2135 		igmp_ifc_event(in_dev);
2136 #endif
2137 	}
2138 	spin_unlock_bh(&pmc->lock);
2139 	return err;
2140 }
2141 
ip_mc_clear_src(struct ip_mc_list * pmc)2142 static void ip_mc_clear_src(struct ip_mc_list *pmc)
2143 {
2144 	struct ip_sf_list *tomb, *sources;
2145 
2146 	spin_lock_bh(&pmc->lock);
2147 	tomb = pmc->tomb;
2148 	pmc->tomb = NULL;
2149 	sources = pmc->sources;
2150 	pmc->sources = NULL;
2151 	pmc->sfmode = MCAST_EXCLUDE;
2152 	pmc->sfcount[MCAST_INCLUDE] = 0;
2153 	pmc->sfcount[MCAST_EXCLUDE] = 1;
2154 	spin_unlock_bh(&pmc->lock);
2155 
2156 	ip_sf_list_clear_all(tomb);
2157 	ip_sf_list_clear_all(sources);
2158 }
2159 
2160 /* Join a multicast group
2161  */
__ip_mc_join_group(struct sock * sk,struct ip_mreqn * imr,unsigned int mode)2162 static int __ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr,
2163 			      unsigned int mode)
2164 {
2165 	__be32 addr = imr->imr_multiaddr.s_addr;
2166 	struct ip_mc_socklist *iml, *i;
2167 	struct in_device *in_dev;
2168 	struct inet_sock *inet = inet_sk(sk);
2169 	struct net *net = sock_net(sk);
2170 	int ifindex;
2171 	int count = 0;
2172 	int err;
2173 
2174 	ASSERT_RTNL();
2175 
2176 	if (!ipv4_is_multicast(addr))
2177 		return -EINVAL;
2178 
2179 	in_dev = ip_mc_find_dev(net, imr);
2180 
2181 	if (!in_dev) {
2182 		err = -ENODEV;
2183 		goto done;
2184 	}
2185 
2186 	err = -EADDRINUSE;
2187 	ifindex = imr->imr_ifindex;
2188 	for_each_pmc_rtnl(inet, i) {
2189 		if (i->multi.imr_multiaddr.s_addr == addr &&
2190 		    i->multi.imr_ifindex == ifindex)
2191 			goto done;
2192 		count++;
2193 	}
2194 	err = -ENOBUFS;
2195 	if (count >= READ_ONCE(net->ipv4.sysctl_igmp_max_memberships))
2196 		goto done;
2197 	iml = sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
2198 	if (!iml)
2199 		goto done;
2200 
2201 	memcpy(&iml->multi, imr, sizeof(*imr));
2202 	iml->next_rcu = inet->mc_list;
2203 	iml->sflist = NULL;
2204 	iml->sfmode = mode;
2205 	rcu_assign_pointer(inet->mc_list, iml);
2206 	____ip_mc_inc_group(in_dev, addr, mode, GFP_KERNEL);
2207 	err = 0;
2208 done:
2209 	return err;
2210 }
2211 
2212 /* Join ASM (Any-Source Multicast) group
2213  */
ip_mc_join_group(struct sock * sk,struct ip_mreqn * imr)2214 int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
2215 {
2216 	return __ip_mc_join_group(sk, imr, MCAST_EXCLUDE);
2217 }
2218 EXPORT_SYMBOL(ip_mc_join_group);
2219 
2220 /* Join SSM (Source-Specific Multicast) group
2221  */
ip_mc_join_group_ssm(struct sock * sk,struct ip_mreqn * imr,unsigned int mode)2222 int ip_mc_join_group_ssm(struct sock *sk, struct ip_mreqn *imr,
2223 			 unsigned int mode)
2224 {
2225 	return __ip_mc_join_group(sk, imr, mode);
2226 }
2227 
ip_mc_leave_src(struct sock * sk,struct ip_mc_socklist * iml,struct in_device * in_dev)2228 static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
2229 			   struct in_device *in_dev)
2230 {
2231 	struct ip_sf_socklist *psf = rtnl_dereference(iml->sflist);
2232 	int err;
2233 
2234 	if (!psf) {
2235 		/* any-source empty exclude case */
2236 		return ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
2237 			iml->sfmode, 0, NULL, 0);
2238 	}
2239 	err = ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
2240 			iml->sfmode, psf->sl_count, psf->sl_addr, 0);
2241 	RCU_INIT_POINTER(iml->sflist, NULL);
2242 	/* decrease mem now to avoid the memleak warning */
2243 	atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);
2244 	kfree_rcu(psf, rcu);
2245 	return err;
2246 }
2247 
ip_mc_leave_group(struct sock * sk,struct ip_mreqn * imr)2248 int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
2249 {
2250 	struct inet_sock *inet = inet_sk(sk);
2251 	struct ip_mc_socklist *iml;
2252 	struct ip_mc_socklist __rcu **imlp;
2253 	struct in_device *in_dev;
2254 	struct net *net = sock_net(sk);
2255 	__be32 group = imr->imr_multiaddr.s_addr;
2256 	u32 ifindex;
2257 	int ret = -EADDRNOTAVAIL;
2258 
2259 	ASSERT_RTNL();
2260 
2261 	in_dev = ip_mc_find_dev(net, imr);
2262 	if (!imr->imr_ifindex && !imr->imr_address.s_addr && !in_dev) {
2263 		ret = -ENODEV;
2264 		goto out;
2265 	}
2266 	ifindex = imr->imr_ifindex;
2267 	for (imlp = &inet->mc_list;
2268 	     (iml = rtnl_dereference(*imlp)) != NULL;
2269 	     imlp = &iml->next_rcu) {
2270 		if (iml->multi.imr_multiaddr.s_addr != group)
2271 			continue;
2272 		if (ifindex) {
2273 			if (iml->multi.imr_ifindex != ifindex)
2274 				continue;
2275 		} else if (imr->imr_address.s_addr && imr->imr_address.s_addr !=
2276 				iml->multi.imr_address.s_addr)
2277 			continue;
2278 
2279 		(void) ip_mc_leave_src(sk, iml, in_dev);
2280 
2281 		*imlp = iml->next_rcu;
2282 
2283 		if (in_dev)
2284 			ip_mc_dec_group(in_dev, group);
2285 
2286 		/* decrease mem now to avoid the memleak warning */
2287 		atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
2288 		kfree_rcu(iml, rcu);
2289 		return 0;
2290 	}
2291 out:
2292 	return ret;
2293 }
2294 EXPORT_SYMBOL(ip_mc_leave_group);
2295 
ip_mc_source(int add,int omode,struct sock * sk,struct ip_mreq_source * mreqs,int ifindex)2296 int ip_mc_source(int add, int omode, struct sock *sk, struct
2297 	ip_mreq_source *mreqs, int ifindex)
2298 {
2299 	int err;
2300 	struct ip_mreqn imr;
2301 	__be32 addr = mreqs->imr_multiaddr;
2302 	struct ip_mc_socklist *pmc;
2303 	struct in_device *in_dev = NULL;
2304 	struct inet_sock *inet = inet_sk(sk);
2305 	struct ip_sf_socklist *psl;
2306 	struct net *net = sock_net(sk);
2307 	int leavegroup = 0;
2308 	int i, j, rv;
2309 
2310 	if (!ipv4_is_multicast(addr))
2311 		return -EINVAL;
2312 
2313 	ASSERT_RTNL();
2314 
2315 	imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
2316 	imr.imr_address.s_addr = mreqs->imr_interface;
2317 	imr.imr_ifindex = ifindex;
2318 	in_dev = ip_mc_find_dev(net, &imr);
2319 
2320 	if (!in_dev) {
2321 		err = -ENODEV;
2322 		goto done;
2323 	}
2324 	err = -EADDRNOTAVAIL;
2325 
2326 	for_each_pmc_rtnl(inet, pmc) {
2327 		if ((pmc->multi.imr_multiaddr.s_addr ==
2328 		     imr.imr_multiaddr.s_addr) &&
2329 		    (pmc->multi.imr_ifindex == imr.imr_ifindex))
2330 			break;
2331 	}
2332 	if (!pmc) {		/* must have a prior join */
2333 		err = -EINVAL;
2334 		goto done;
2335 	}
2336 	/* if a source filter was set, must be the same mode as before */
2337 	if (pmc->sflist) {
2338 		if (pmc->sfmode != omode) {
2339 			err = -EINVAL;
2340 			goto done;
2341 		}
2342 	} else if (pmc->sfmode != omode) {
2343 		/* allow mode switches for empty-set filters */
2344 		ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 0, NULL, 0);
2345 		ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, pmc->sfmode, 0,
2346 			NULL, 0);
2347 		pmc->sfmode = omode;
2348 	}
2349 
2350 	psl = rtnl_dereference(pmc->sflist);
2351 	if (!add) {
2352 		if (!psl)
2353 			goto done;	/* err = -EADDRNOTAVAIL */
2354 		rv = !0;
2355 		for (i = 0; i < psl->sl_count; i++) {
2356 			rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
2357 				sizeof(__be32));
2358 			if (rv == 0)
2359 				break;
2360 		}
2361 		if (rv)		/* source not found */
2362 			goto done;	/* err = -EADDRNOTAVAIL */
2363 
2364 		/* special case - (INCLUDE, empty) == LEAVE_GROUP */
2365 		if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
2366 			leavegroup = 1;
2367 			goto done;
2368 		}
2369 
2370 		/* update the interface filter */
2371 		ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
2372 			&mreqs->imr_sourceaddr, 1);
2373 
2374 		for (j = i+1; j < psl->sl_count; j++)
2375 			psl->sl_addr[j-1] = psl->sl_addr[j];
2376 		psl->sl_count--;
2377 		err = 0;
2378 		goto done;
2379 	}
2380 	/* else, add a new source to the filter */
2381 
2382 	if (psl && psl->sl_count >= READ_ONCE(net->ipv4.sysctl_igmp_max_msf)) {
2383 		err = -ENOBUFS;
2384 		goto done;
2385 	}
2386 	if (!psl || psl->sl_count == psl->sl_max) {
2387 		struct ip_sf_socklist *newpsl;
2388 		int count = IP_SFBLOCK;
2389 
2390 		if (psl)
2391 			count += psl->sl_max;
2392 		newpsl = sock_kmalloc(sk, IP_SFLSIZE(count), GFP_KERNEL);
2393 		if (!newpsl) {
2394 			err = -ENOBUFS;
2395 			goto done;
2396 		}
2397 		newpsl->sl_max = count;
2398 		newpsl->sl_count = count - IP_SFBLOCK;
2399 		if (psl) {
2400 			for (i = 0; i < psl->sl_count; i++)
2401 				newpsl->sl_addr[i] = psl->sl_addr[i];
2402 			/* decrease mem now to avoid the memleak warning */
2403 			atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
2404 		}
2405 		rcu_assign_pointer(pmc->sflist, newpsl);
2406 		if (psl)
2407 			kfree_rcu(psl, rcu);
2408 		psl = newpsl;
2409 	}
2410 	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
2411 	for (i = 0; i < psl->sl_count; i++) {
2412 		rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
2413 			sizeof(__be32));
2414 		if (rv == 0)
2415 			break;
2416 	}
2417 	if (rv == 0)		/* address already there is an error */
2418 		goto done;
2419 	for (j = psl->sl_count-1; j >= i; j--)
2420 		psl->sl_addr[j+1] = psl->sl_addr[j];
2421 	psl->sl_addr[i] = mreqs->imr_sourceaddr;
2422 	psl->sl_count++;
2423 	err = 0;
2424 	/* update the interface list */
2425 	ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
2426 		&mreqs->imr_sourceaddr, 1);
2427 done:
2428 	if (leavegroup)
2429 		err = ip_mc_leave_group(sk, &imr);
2430 	return err;
2431 }
2432 
ip_mc_msfilter(struct sock * sk,struct ip_msfilter * msf,int ifindex)2433 int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
2434 {
2435 	int err = 0;
2436 	struct ip_mreqn	imr;
2437 	__be32 addr = msf->imsf_multiaddr;
2438 	struct ip_mc_socklist *pmc;
2439 	struct in_device *in_dev;
2440 	struct inet_sock *inet = inet_sk(sk);
2441 	struct ip_sf_socklist *newpsl, *psl;
2442 	struct net *net = sock_net(sk);
2443 	int leavegroup = 0;
2444 
2445 	if (!ipv4_is_multicast(addr))
2446 		return -EINVAL;
2447 	if (msf->imsf_fmode != MCAST_INCLUDE &&
2448 	    msf->imsf_fmode != MCAST_EXCLUDE)
2449 		return -EINVAL;
2450 
2451 	ASSERT_RTNL();
2452 
2453 	imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
2454 	imr.imr_address.s_addr = msf->imsf_interface;
2455 	imr.imr_ifindex = ifindex;
2456 	in_dev = ip_mc_find_dev(net, &imr);
2457 
2458 	if (!in_dev) {
2459 		err = -ENODEV;
2460 		goto done;
2461 	}
2462 
2463 	/* special case - (INCLUDE, empty) == LEAVE_GROUP */
2464 	if (msf->imsf_fmode == MCAST_INCLUDE && msf->imsf_numsrc == 0) {
2465 		leavegroup = 1;
2466 		goto done;
2467 	}
2468 
2469 	for_each_pmc_rtnl(inet, pmc) {
2470 		if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
2471 		    pmc->multi.imr_ifindex == imr.imr_ifindex)
2472 			break;
2473 	}
2474 	if (!pmc) {		/* must have a prior join */
2475 		err = -EINVAL;
2476 		goto done;
2477 	}
2478 	if (msf->imsf_numsrc) {
2479 		newpsl = sock_kmalloc(sk, IP_SFLSIZE(msf->imsf_numsrc),
2480 							   GFP_KERNEL);
2481 		if (!newpsl) {
2482 			err = -ENOBUFS;
2483 			goto done;
2484 		}
2485 		newpsl->sl_max = newpsl->sl_count = msf->imsf_numsrc;
2486 		memcpy(newpsl->sl_addr, msf->imsf_slist,
2487 			msf->imsf_numsrc * sizeof(msf->imsf_slist[0]));
2488 		err = ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
2489 			msf->imsf_fmode, newpsl->sl_count, newpsl->sl_addr, 0);
2490 		if (err) {
2491 			sock_kfree_s(sk, newpsl, IP_SFLSIZE(newpsl->sl_max));
2492 			goto done;
2493 		}
2494 	} else {
2495 		newpsl = NULL;
2496 		(void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
2497 				     msf->imsf_fmode, 0, NULL, 0);
2498 	}
2499 	psl = rtnl_dereference(pmc->sflist);
2500 	if (psl) {
2501 		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
2502 			psl->sl_count, psl->sl_addr, 0);
2503 		/* decrease mem now to avoid the memleak warning */
2504 		atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
2505 	} else {
2506 		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
2507 			0, NULL, 0);
2508 	}
2509 	rcu_assign_pointer(pmc->sflist, newpsl);
2510 	if (psl)
2511 		kfree_rcu(psl, rcu);
2512 	pmc->sfmode = msf->imsf_fmode;
2513 	err = 0;
2514 done:
2515 	if (leavegroup)
2516 		err = ip_mc_leave_group(sk, &imr);
2517 	return err;
2518 }
2519 
ip_mc_msfget(struct sock * sk,struct ip_msfilter * msf,struct ip_msfilter __user * optval,int __user * optlen)2520 int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
2521 	struct ip_msfilter __user *optval, int __user *optlen)
2522 {
2523 	int err, len, count, copycount;
2524 	struct ip_mreqn	imr;
2525 	__be32 addr = msf->imsf_multiaddr;
2526 	struct ip_mc_socklist *pmc;
2527 	struct in_device *in_dev;
2528 	struct inet_sock *inet = inet_sk(sk);
2529 	struct ip_sf_socklist *psl;
2530 	struct net *net = sock_net(sk);
2531 
2532 	ASSERT_RTNL();
2533 
2534 	if (!ipv4_is_multicast(addr))
2535 		return -EINVAL;
2536 
2537 	imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
2538 	imr.imr_address.s_addr = msf->imsf_interface;
2539 	imr.imr_ifindex = 0;
2540 	in_dev = ip_mc_find_dev(net, &imr);
2541 
2542 	if (!in_dev) {
2543 		err = -ENODEV;
2544 		goto done;
2545 	}
2546 	err = -EADDRNOTAVAIL;
2547 
2548 	for_each_pmc_rtnl(inet, pmc) {
2549 		if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
2550 		    pmc->multi.imr_ifindex == imr.imr_ifindex)
2551 			break;
2552 	}
2553 	if (!pmc)		/* must have a prior join */
2554 		goto done;
2555 	msf->imsf_fmode = pmc->sfmode;
2556 	psl = rtnl_dereference(pmc->sflist);
2557 	if (!psl) {
2558 		len = 0;
2559 		count = 0;
2560 	} else {
2561 		count = psl->sl_count;
2562 	}
2563 	copycount = count < msf->imsf_numsrc ? count : msf->imsf_numsrc;
2564 	len = copycount * sizeof(psl->sl_addr[0]);
2565 	msf->imsf_numsrc = count;
2566 	if (put_user(IP_MSFILTER_SIZE(copycount), optlen) ||
2567 	    copy_to_user(optval, msf, IP_MSFILTER_SIZE(0))) {
2568 		return -EFAULT;
2569 	}
2570 	if (len &&
2571 	    copy_to_user(&optval->imsf_slist[0], psl->sl_addr, len))
2572 		return -EFAULT;
2573 	return 0;
2574 done:
2575 	return err;
2576 }
2577 
ip_mc_gsfget(struct sock * sk,struct group_filter * gsf,struct sockaddr_storage __user * p)2578 int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
2579 	struct sockaddr_storage __user *p)
2580 {
2581 	int i, count, copycount;
2582 	struct sockaddr_in *psin;
2583 	__be32 addr;
2584 	struct ip_mc_socklist *pmc;
2585 	struct inet_sock *inet = inet_sk(sk);
2586 	struct ip_sf_socklist *psl;
2587 
2588 	ASSERT_RTNL();
2589 
2590 	psin = (struct sockaddr_in *)&gsf->gf_group;
2591 	if (psin->sin_family != AF_INET)
2592 		return -EINVAL;
2593 	addr = psin->sin_addr.s_addr;
2594 	if (!ipv4_is_multicast(addr))
2595 		return -EINVAL;
2596 
2597 	for_each_pmc_rtnl(inet, pmc) {
2598 		if (pmc->multi.imr_multiaddr.s_addr == addr &&
2599 		    pmc->multi.imr_ifindex == gsf->gf_interface)
2600 			break;
2601 	}
2602 	if (!pmc)		/* must have a prior join */
2603 		return -EADDRNOTAVAIL;
2604 	gsf->gf_fmode = pmc->sfmode;
2605 	psl = rtnl_dereference(pmc->sflist);
2606 	count = psl ? psl->sl_count : 0;
2607 	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
2608 	gsf->gf_numsrc = count;
2609 	for (i = 0; i < copycount; i++, p++) {
2610 		struct sockaddr_storage ss;
2611 
2612 		psin = (struct sockaddr_in *)&ss;
2613 		memset(&ss, 0, sizeof(ss));
2614 		psin->sin_family = AF_INET;
2615 		psin->sin_addr.s_addr = psl->sl_addr[i];
2616 		if (copy_to_user(p, &ss, sizeof(ss)))
2617 			return -EFAULT;
2618 	}
2619 	return 0;
2620 }
2621 
2622 /*
2623  * check if a multicast source filter allows delivery for a given <src,dst,intf>
2624  */
ip_mc_sf_allow(struct sock * sk,__be32 loc_addr,__be32 rmt_addr,int dif,int sdif)2625 int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr,
2626 		   int dif, int sdif)
2627 {
2628 	struct inet_sock *inet = inet_sk(sk);
2629 	struct ip_mc_socklist *pmc;
2630 	struct ip_sf_socklist *psl;
2631 	int i;
2632 	int ret;
2633 
2634 	ret = 1;
2635 	if (!ipv4_is_multicast(loc_addr))
2636 		goto out;
2637 
2638 	rcu_read_lock();
2639 	for_each_pmc_rcu(inet, pmc) {
2640 		if (pmc->multi.imr_multiaddr.s_addr == loc_addr &&
2641 		    (pmc->multi.imr_ifindex == dif ||
2642 		     (sdif && pmc->multi.imr_ifindex == sdif)))
2643 			break;
2644 	}
2645 	ret = inet->mc_all;
2646 	if (!pmc)
2647 		goto unlock;
2648 	psl = rcu_dereference(pmc->sflist);
2649 	ret = (pmc->sfmode == MCAST_EXCLUDE);
2650 	if (!psl)
2651 		goto unlock;
2652 
2653 	for (i = 0; i < psl->sl_count; i++) {
2654 		if (psl->sl_addr[i] == rmt_addr)
2655 			break;
2656 	}
2657 	ret = 0;
2658 	if (pmc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
2659 		goto unlock;
2660 	if (pmc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
2661 		goto unlock;
2662 	ret = 1;
2663 unlock:
2664 	rcu_read_unlock();
2665 out:
2666 	return ret;
2667 }
2668 
2669 /*
2670  *	A socket is closing.
2671  */
2672 
ip_mc_drop_socket(struct sock * sk)2673 void ip_mc_drop_socket(struct sock *sk)
2674 {
2675 	struct inet_sock *inet = inet_sk(sk);
2676 	struct ip_mc_socklist *iml;
2677 	struct net *net = sock_net(sk);
2678 
2679 	if (!inet->mc_list)
2680 		return;
2681 
2682 	rtnl_lock();
2683 	while ((iml = rtnl_dereference(inet->mc_list)) != NULL) {
2684 		struct in_device *in_dev;
2685 
2686 		inet->mc_list = iml->next_rcu;
2687 		in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
2688 		(void) ip_mc_leave_src(sk, iml, in_dev);
2689 		if (in_dev)
2690 			ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
2691 		/* decrease mem now to avoid the memleak warning */
2692 		atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
2693 		kfree_rcu(iml, rcu);
2694 	}
2695 	rtnl_unlock();
2696 }
2697 
2698 /* called with rcu_read_lock() */
ip_check_mc_rcu(struct in_device * in_dev,__be32 mc_addr,__be32 src_addr,u8 proto)2699 int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u8 proto)
2700 {
2701 	struct ip_mc_list *im;
2702 	struct ip_mc_list __rcu **mc_hash;
2703 	struct ip_sf_list *psf;
2704 	int rv = 0;
2705 
2706 	mc_hash = rcu_dereference(in_dev->mc_hash);
2707 	if (mc_hash) {
2708 		u32 hash = hash_32((__force u32)mc_addr, MC_HASH_SZ_LOG);
2709 
2710 		for (im = rcu_dereference(mc_hash[hash]);
2711 		     im != NULL;
2712 		     im = rcu_dereference(im->next_hash)) {
2713 			if (im->multiaddr == mc_addr)
2714 				break;
2715 		}
2716 	} else {
2717 		for_each_pmc_rcu(in_dev, im) {
2718 			if (im->multiaddr == mc_addr)
2719 				break;
2720 		}
2721 	}
2722 	if (im && proto == IPPROTO_IGMP) {
2723 		rv = 1;
2724 	} else if (im) {
2725 		if (src_addr) {
2726 			spin_lock_bh(&im->lock);
2727 			for (psf = im->sources; psf; psf = psf->sf_next) {
2728 				if (psf->sf_inaddr == src_addr)
2729 					break;
2730 			}
2731 			if (psf)
2732 				rv = psf->sf_count[MCAST_INCLUDE] ||
2733 					psf->sf_count[MCAST_EXCLUDE] !=
2734 					im->sfcount[MCAST_EXCLUDE];
2735 			else
2736 				rv = im->sfcount[MCAST_EXCLUDE] != 0;
2737 			spin_unlock_bh(&im->lock);
2738 		} else
2739 			rv = 1; /* unspecified source; tentatively allow */
2740 	}
2741 	return rv;
2742 }
2743 
2744 #if defined(CONFIG_PROC_FS)
2745 struct igmp_mc_iter_state {
2746 	struct seq_net_private p;
2747 	struct net_device *dev;
2748 	struct in_device *in_dev;
2749 };
2750 
2751 #define	igmp_mc_seq_private(seq)	((struct igmp_mc_iter_state *)(seq)->private)
2752 
igmp_mc_get_first(struct seq_file * seq)2753 static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
2754 {
2755 	struct net *net = seq_file_net(seq);
2756 	struct ip_mc_list *im = NULL;
2757 	struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2758 
2759 	state->in_dev = NULL;
2760 	for_each_netdev_rcu(net, state->dev) {
2761 		struct in_device *in_dev;
2762 
2763 		in_dev = __in_dev_get_rcu(state->dev);
2764 		if (!in_dev)
2765 			continue;
2766 		im = rcu_dereference(in_dev->mc_list);
2767 		if (im) {
2768 			state->in_dev = in_dev;
2769 			break;
2770 		}
2771 	}
2772 	return im;
2773 }
2774 
igmp_mc_get_next(struct seq_file * seq,struct ip_mc_list * im)2775 static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_list *im)
2776 {
2777 	struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2778 
2779 	im = rcu_dereference(im->next_rcu);
2780 	while (!im) {
2781 		state->dev = next_net_device_rcu(state->dev);
2782 		if (!state->dev) {
2783 			state->in_dev = NULL;
2784 			break;
2785 		}
2786 		state->in_dev = __in_dev_get_rcu(state->dev);
2787 		if (!state->in_dev)
2788 			continue;
2789 		im = rcu_dereference(state->in_dev->mc_list);
2790 	}
2791 	return im;
2792 }
2793 
igmp_mc_get_idx(struct seq_file * seq,loff_t pos)2794 static struct ip_mc_list *igmp_mc_get_idx(struct seq_file *seq, loff_t pos)
2795 {
2796 	struct ip_mc_list *im = igmp_mc_get_first(seq);
2797 	if (im)
2798 		while (pos && (im = igmp_mc_get_next(seq, im)) != NULL)
2799 			--pos;
2800 	return pos ? NULL : im;
2801 }
2802 
igmp_mc_seq_start(struct seq_file * seq,loff_t * pos)2803 static void *igmp_mc_seq_start(struct seq_file *seq, loff_t *pos)
2804 	__acquires(rcu)
2805 {
2806 	rcu_read_lock();
2807 	return *pos ? igmp_mc_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2808 }
2809 
igmp_mc_seq_next(struct seq_file * seq,void * v,loff_t * pos)2810 static void *igmp_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2811 {
2812 	struct ip_mc_list *im;
2813 	if (v == SEQ_START_TOKEN)
2814 		im = igmp_mc_get_first(seq);
2815 	else
2816 		im = igmp_mc_get_next(seq, v);
2817 	++*pos;
2818 	return im;
2819 }
2820 
igmp_mc_seq_stop(struct seq_file * seq,void * v)2821 static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
2822 	__releases(rcu)
2823 {
2824 	struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2825 
2826 	state->in_dev = NULL;
2827 	state->dev = NULL;
2828 	rcu_read_unlock();
2829 }
2830 
igmp_mc_seq_show(struct seq_file * seq,void * v)2831 static int igmp_mc_seq_show(struct seq_file *seq, void *v)
2832 {
2833 	if (v == SEQ_START_TOKEN)
2834 		seq_puts(seq,
2835 			 "Idx\tDevice    : Count Querier\tGroup    Users Timer\tReporter\n");
2836 	else {
2837 		struct ip_mc_list *im = (struct ip_mc_list *)v;
2838 		struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
2839 		char   *querier;
2840 		long delta;
2841 
2842 #ifdef CONFIG_IP_MULTICAST
2843 		querier = IGMP_V1_SEEN(state->in_dev) ? "V1" :
2844 			  IGMP_V2_SEEN(state->in_dev) ? "V2" :
2845 			  "V3";
2846 #else
2847 		querier = "NONE";
2848 #endif
2849 
2850 		if (rcu_access_pointer(state->in_dev->mc_list) == im) {
2851 			seq_printf(seq, "%d\t%-10s: %5d %7s\n",
2852 				   state->dev->ifindex, state->dev->name, state->in_dev->mc_count, querier);
2853 		}
2854 
2855 		delta = im->timer.expires - jiffies;
2856 		seq_printf(seq,
2857 			   "\t\t\t\t%08X %5d %d:%08lX\t\t%d\n",
2858 			   im->multiaddr, im->users,
2859 			   im->tm_running,
2860 			   im->tm_running ? jiffies_delta_to_clock_t(delta) : 0,
2861 			   im->reporter);
2862 	}
2863 	return 0;
2864 }
2865 
2866 static const struct seq_operations igmp_mc_seq_ops = {
2867 	.start	=	igmp_mc_seq_start,
2868 	.next	=	igmp_mc_seq_next,
2869 	.stop	=	igmp_mc_seq_stop,
2870 	.show	=	igmp_mc_seq_show,
2871 };
2872 
2873 struct igmp_mcf_iter_state {
2874 	struct seq_net_private p;
2875 	struct net_device *dev;
2876 	struct in_device *idev;
2877 	struct ip_mc_list *im;
2878 };
2879 
2880 #define igmp_mcf_seq_private(seq)	((struct igmp_mcf_iter_state *)(seq)->private)
2881 
igmp_mcf_get_first(struct seq_file * seq)2882 static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
2883 {
2884 	struct net *net = seq_file_net(seq);
2885 	struct ip_sf_list *psf = NULL;
2886 	struct ip_mc_list *im = NULL;
2887 	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2888 
2889 	state->idev = NULL;
2890 	state->im = NULL;
2891 	for_each_netdev_rcu(net, state->dev) {
2892 		struct in_device *idev;
2893 		idev = __in_dev_get_rcu(state->dev);
2894 		if (unlikely(!idev))
2895 			continue;
2896 		im = rcu_dereference(idev->mc_list);
2897 		if (likely(im)) {
2898 			spin_lock_bh(&im->lock);
2899 			psf = im->sources;
2900 			if (likely(psf)) {
2901 				state->im = im;
2902 				state->idev = idev;
2903 				break;
2904 			}
2905 			spin_unlock_bh(&im->lock);
2906 		}
2907 	}
2908 	return psf;
2909 }
2910 
igmp_mcf_get_next(struct seq_file * seq,struct ip_sf_list * psf)2911 static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_list *psf)
2912 {
2913 	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2914 
2915 	psf = psf->sf_next;
2916 	while (!psf) {
2917 		spin_unlock_bh(&state->im->lock);
2918 		state->im = state->im->next;
2919 		while (!state->im) {
2920 			state->dev = next_net_device_rcu(state->dev);
2921 			if (!state->dev) {
2922 				state->idev = NULL;
2923 				goto out;
2924 			}
2925 			state->idev = __in_dev_get_rcu(state->dev);
2926 			if (!state->idev)
2927 				continue;
2928 			state->im = rcu_dereference(state->idev->mc_list);
2929 		}
2930 		if (!state->im)
2931 			break;
2932 		spin_lock_bh(&state->im->lock);
2933 		psf = state->im->sources;
2934 	}
2935 out:
2936 	return psf;
2937 }
2938 
igmp_mcf_get_idx(struct seq_file * seq,loff_t pos)2939 static struct ip_sf_list *igmp_mcf_get_idx(struct seq_file *seq, loff_t pos)
2940 {
2941 	struct ip_sf_list *psf = igmp_mcf_get_first(seq);
2942 	if (psf)
2943 		while (pos && (psf = igmp_mcf_get_next(seq, psf)) != NULL)
2944 			--pos;
2945 	return pos ? NULL : psf;
2946 }
2947 
igmp_mcf_seq_start(struct seq_file * seq,loff_t * pos)2948 static void *igmp_mcf_seq_start(struct seq_file *seq, loff_t *pos)
2949 	__acquires(rcu)
2950 {
2951 	rcu_read_lock();
2952 	return *pos ? igmp_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2953 }
2954 
igmp_mcf_seq_next(struct seq_file * seq,void * v,loff_t * pos)2955 static void *igmp_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2956 {
2957 	struct ip_sf_list *psf;
2958 	if (v == SEQ_START_TOKEN)
2959 		psf = igmp_mcf_get_first(seq);
2960 	else
2961 		psf = igmp_mcf_get_next(seq, v);
2962 	++*pos;
2963 	return psf;
2964 }
2965 
igmp_mcf_seq_stop(struct seq_file * seq,void * v)2966 static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
2967 	__releases(rcu)
2968 {
2969 	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2970 	if (likely(state->im)) {
2971 		spin_unlock_bh(&state->im->lock);
2972 		state->im = NULL;
2973 	}
2974 	state->idev = NULL;
2975 	state->dev = NULL;
2976 	rcu_read_unlock();
2977 }
2978 
igmp_mcf_seq_show(struct seq_file * seq,void * v)2979 static int igmp_mcf_seq_show(struct seq_file *seq, void *v)
2980 {
2981 	struct ip_sf_list *psf = (struct ip_sf_list *)v;
2982 	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
2983 
2984 	if (v == SEQ_START_TOKEN) {
2985 		seq_puts(seq, "Idx Device        MCA        SRC    INC    EXC\n");
2986 	} else {
2987 		seq_printf(seq,
2988 			   "%3d %6.6s 0x%08x "
2989 			   "0x%08x %6lu %6lu\n",
2990 			   state->dev->ifindex, state->dev->name,
2991 			   ntohl(state->im->multiaddr),
2992 			   ntohl(psf->sf_inaddr),
2993 			   psf->sf_count[MCAST_INCLUDE],
2994 			   psf->sf_count[MCAST_EXCLUDE]);
2995 	}
2996 	return 0;
2997 }
2998 
2999 static const struct seq_operations igmp_mcf_seq_ops = {
3000 	.start	=	igmp_mcf_seq_start,
3001 	.next	=	igmp_mcf_seq_next,
3002 	.stop	=	igmp_mcf_seq_stop,
3003 	.show	=	igmp_mcf_seq_show,
3004 };
3005 
igmp_net_init(struct net * net)3006 static int __net_init igmp_net_init(struct net *net)
3007 {
3008 	struct proc_dir_entry *pde;
3009 	int err;
3010 
3011 	pde = proc_create_net("igmp", 0444, net->proc_net, &igmp_mc_seq_ops,
3012 			sizeof(struct igmp_mc_iter_state));
3013 	if (!pde)
3014 		goto out_igmp;
3015 	pde = proc_create_net("mcfilter", 0444, net->proc_net,
3016 			&igmp_mcf_seq_ops, sizeof(struct igmp_mcf_iter_state));
3017 	if (!pde)
3018 		goto out_mcfilter;
3019 	err = inet_ctl_sock_create(&net->ipv4.mc_autojoin_sk, AF_INET,
3020 				   SOCK_DGRAM, 0, net);
3021 	if (err < 0) {
3022 		pr_err("Failed to initialize the IGMP autojoin socket (err %d)\n",
3023 		       err);
3024 		goto out_sock;
3025 	}
3026 
3027 	return 0;
3028 
3029 out_sock:
3030 	remove_proc_entry("mcfilter", net->proc_net);
3031 out_mcfilter:
3032 	remove_proc_entry("igmp", net->proc_net);
3033 out_igmp:
3034 	return -ENOMEM;
3035 }
3036 
igmp_net_exit(struct net * net)3037 static void __net_exit igmp_net_exit(struct net *net)
3038 {
3039 	remove_proc_entry("mcfilter", net->proc_net);
3040 	remove_proc_entry("igmp", net->proc_net);
3041 	inet_ctl_sock_destroy(net->ipv4.mc_autojoin_sk);
3042 }
3043 
3044 static struct pernet_operations igmp_net_ops = {
3045 	.init = igmp_net_init,
3046 	.exit = igmp_net_exit,
3047 };
3048 #endif
3049 
igmp_netdev_event(struct notifier_block * this,unsigned long event,void * ptr)3050 static int igmp_netdev_event(struct notifier_block *this,
3051 			     unsigned long event, void *ptr)
3052 {
3053 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
3054 	struct in_device *in_dev;
3055 
3056 	switch (event) {
3057 	case NETDEV_RESEND_IGMP:
3058 		in_dev = __in_dev_get_rtnl(dev);
3059 		if (in_dev)
3060 			ip_mc_rejoin_groups(in_dev);
3061 		break;
3062 	default:
3063 		break;
3064 	}
3065 	return NOTIFY_DONE;
3066 }
3067 
3068 static struct notifier_block igmp_notifier = {
3069 	.notifier_call = igmp_netdev_event,
3070 };
3071 
igmp_mc_init(void)3072 int __init igmp_mc_init(void)
3073 {
3074 #if defined(CONFIG_PROC_FS)
3075 	int err;
3076 
3077 	err = register_pernet_subsys(&igmp_net_ops);
3078 	if (err)
3079 		return err;
3080 	err = register_netdevice_notifier(&igmp_notifier);
3081 	if (err)
3082 		goto reg_notif_fail;
3083 	return 0;
3084 
3085 reg_notif_fail:
3086 	unregister_pernet_subsys(&igmp_net_ops);
3087 	return err;
3088 #else
3089 	return register_netdevice_notifier(&igmp_notifier);
3090 #endif
3091 }
3092