LCOV - code coverage report
Current view: top level - net/ipv4 - igmp.c (source / functions) Hit Total Coverage
Test: landlock.info Lines: 73 893 8.2 %
Date: 2021-04-22 12:43:58 Functions: 8 60 13.3 %

          Line data    Source code
       1             : // SPDX-License-Identifier: GPL-2.0-or-later
       2             : /*
       3             :  *      Linux NET3:     Internet Group Management Protocol  [IGMP]
       4             :  *
       5             :  *      This code implements the IGMP protocol as defined in RFC1112. There has
       6             :  *      been a further revision of this protocol since which is now supported.
       7             :  *
       8             :  *      If you have trouble with this module be careful what gcc you have used,
       9             :  *      the older version didn't come out right using gcc 2.5.8, the newer one
      10             :  *      seems to fall out with gcc 2.6.2.
      11             :  *
      12             :  *      Authors:
      13             :  *              Alan Cox <alan@lxorguk.ukuu.org.uk>
      14             :  *
      15             :  *      Fixes:
      16             :  *
      17             :  *              Alan Cox        :       Added lots of __inline__ to optimise
      18             :  *                                      the memory usage of all the tiny little
      19             :  *                                      functions.
      20             :  *              Alan Cox        :       Dumped the header building experiment.
      21             :  *              Alan Cox        :       Minor tweaks ready for multicast routing
      22             :  *                                      and extended IGMP protocol.
      23             :  *              Alan Cox        :       Removed a load of inline directives. Gcc 2.5.8
      24             :  *                                      writes utterly bogus code otherwise (sigh)
      25             :  *                                      fixed IGMP loopback to behave in the manner
      26             :  *                                      desired by mrouted, fixed the fact it has been
      27             :  *                                      broken since 1.3.6 and cleaned up a few minor
      28             :  *                                      points.
      29             :  *
      30             :  *              Chih-Jen Chang  :       Tried to revise IGMP to Version 2
      31             :  *              Tsu-Sheng Tsao          E-mail: chihjenc@scf.usc.edu and tsusheng@scf.usc.edu
      32             :  *                                      The enhancements are mainly based on Steve Deering's
      33             :  *                                      ipmulti-3.5 source code.
      34             :  *              Chih-Jen Chang  :       Added the igmp_get_mrouter_info and
      35             :  *              Tsu-Sheng Tsao          igmp_set_mrouter_info to keep track of
      36             :  *                                      the mrouted version on that device.
      37             :  *              Chih-Jen Chang  :       Added the max_resp_time parameter to
      38             :  *              Tsu-Sheng Tsao          igmp_heard_query(). Using this parameter
      39             :  *                                      to identify the multicast router version
      40             :  *                                      and do what the IGMP version 2 specified.
      41             :  *              Chih-Jen Chang  :       Added a timer to revert to IGMP V2 router
      42             :  *              Tsu-Sheng Tsao          if the specified time expired.
      43             :  *              Alan Cox        :       Stop IGMP from 0.0.0.0 being accepted.
      44             :  *              Alan Cox        :       Use GFP_ATOMIC in the right places.
      45             :  *              Christian Daudt :       igmp timer wasn't set for local group
      46             :  *                                      memberships but was being deleted,
      47             :  *                                      which caused a "del_timer() called
      48             :  *                                      from %p with timer not initialized\n"
      49             :  *                                      message (960131).
      50             :  *              Christian Daudt :       removed del_timer from
      51             :  *                                      igmp_timer_expire function (960205).
      52             :  *             Christian Daudt :       igmp_heard_report now only calls
      53             :  *                                     igmp_timer_expire if tm->running is
      54             :  *                                     true (960216).
      55             :  *              Malcolm Beattie :       ttl comparison wrong in igmp_rcv made
      56             :  *                                      igmp_heard_query never trigger. Expiry
      57             :  *                                      miscalculation fixed in igmp_heard_query
      58             :  *                                      and random() made to return unsigned to
      59             :  *                                      prevent negative expiry times.
      60             :  *              Alexey Kuznetsov:       Wrong group leaving behaviour, backport
      61             :  *                                      fix from pending 2.1.x patches.
      62             :  *              Alan Cox:               Forget to enable FDDI support earlier.
      63             :  *              Alexey Kuznetsov:       Fixed leaving groups on device down.
      64             :  *              Alexey Kuznetsov:       Accordance to igmp-v2-06 draft.
      65             :  *              David L Stevens:        IGMPv3 support, with help from
      66             :  *                                      Vinay Kulkarni
      67             :  */
      68             : 
      69             : #include <linux/module.h>
      70             : #include <linux/slab.h>
      71             : #include <linux/uaccess.h>
      72             : #include <linux/types.h>
      73             : #include <linux/kernel.h>
      74             : #include <linux/jiffies.h>
      75             : #include <linux/string.h>
      76             : #include <linux/socket.h>
      77             : #include <linux/sockios.h>
      78             : #include <linux/in.h>
      79             : #include <linux/inet.h>
      80             : #include <linux/netdevice.h>
      81             : #include <linux/skbuff.h>
      82             : #include <linux/inetdevice.h>
      83             : #include <linux/igmp.h>
      84             : #include <linux/if_arp.h>
      85             : #include <linux/rtnetlink.h>
      86             : #include <linux/times.h>
      87             : #include <linux/pkt_sched.h>
      88             : #include <linux/byteorder/generic.h>
      89             : 
      90             : #include <net/net_namespace.h>
      91             : #include <net/arp.h>
      92             : #include <net/ip.h>
      93             : #include <net/protocol.h>
      94             : #include <net/route.h>
      95             : #include <net/sock.h>
      96             : #include <net/checksum.h>
      97             : #include <net/inet_common.h>
      98             : #include <linux/netfilter_ipv4.h>
      99             : #ifdef CONFIG_IP_MROUTE
     100             : #include <linux/mroute.h>
     101             : #endif
     102             : #ifdef CONFIG_PROC_FS
     103             : #include <linux/proc_fs.h>
     104             : #include <linux/seq_file.h>
     105             : #endif
     106             : 
     107             : #ifdef CONFIG_IP_MULTICAST
     108             : /* Parameter names and values are taken from igmp-v2-06 draft */
     109             : 
     110             : #define IGMP_QUERY_INTERVAL                     (125*HZ)
     111             : #define IGMP_QUERY_RESPONSE_INTERVAL            (10*HZ)
     112             : 
     113             : #define IGMP_INITIAL_REPORT_DELAY               (1)
     114             : 
     115             : /* IGMP_INITIAL_REPORT_DELAY is not from IGMP specs!
     116             :  * IGMP specs require to report membership immediately after
     117             :  * joining a group, but we delay the first report by a
     118             :  * small interval. It seems more natural and still does not
     119             :  * contradict to specs provided this delay is small enough.
     120             :  */
     121             : 
     122             : #define IGMP_V1_SEEN(in_dev) \
     123             :         (IPV4_DEVCONF_ALL(dev_net(in_dev->dev), FORCE_IGMP_VERSION) == 1 || \
     124             :          IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 1 || \
     125             :          ((in_dev)->mr_v1_seen && \
     126             :           time_before(jiffies, (in_dev)->mr_v1_seen)))
     127             : #define IGMP_V2_SEEN(in_dev) \
     128             :         (IPV4_DEVCONF_ALL(dev_net(in_dev->dev), FORCE_IGMP_VERSION) == 2 || \
     129             :          IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 2 || \
     130             :          ((in_dev)->mr_v2_seen && \
     131             :           time_before(jiffies, (in_dev)->mr_v2_seen)))
     132             : 
     133             : static int unsolicited_report_interval(struct in_device *in_dev)
     134             : {
     135             :         int interval_ms, interval_jiffies;
     136             : 
     137             :         if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
     138             :                 interval_ms = IN_DEV_CONF_GET(
     139             :                         in_dev,
     140             :                         IGMPV2_UNSOLICITED_REPORT_INTERVAL);
     141             :         else /* v3 */
     142             :                 interval_ms = IN_DEV_CONF_GET(
     143             :                         in_dev,
     144             :                         IGMPV3_UNSOLICITED_REPORT_INTERVAL);
     145             : 
     146             :         interval_jiffies = msecs_to_jiffies(interval_ms);
     147             : 
     148             :         /* _timer functions can't handle a delay of 0 jiffies so ensure
     149             :          *  we always return a positive value.
     150             :          */
     151             :         if (interval_jiffies <= 0)
     152             :                 interval_jiffies = 1;
     153             :         return interval_jiffies;
     154             : }
     155             : 
     156             : static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im,
     157             :                               gfp_t gfp);
     158             : static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im);
     159             : static void igmpv3_clear_delrec(struct in_device *in_dev);
     160             : static int sf_setstate(struct ip_mc_list *pmc);
     161             : static void sf_markstate(struct ip_mc_list *pmc);
     162             : #endif
     163             : static void ip_mc_clear_src(struct ip_mc_list *pmc);
     164             : static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
     165             :                          int sfcount, __be32 *psfsrc, int delta);
     166             : 
     167           0 : static void ip_ma_put(struct ip_mc_list *im)
     168             : {
     169           0 :         if (refcount_dec_and_test(&im->refcnt)) {
     170           0 :                 in_dev_put(im->interface);
     171           0 :                 kfree_rcu(im, rcu);
     172             :         }
     173           0 : }
     174             : 
     175             : #define for_each_pmc_rcu(in_dev, pmc)                           \
     176             :         for (pmc = rcu_dereference(in_dev->mc_list);         \
     177             :              pmc != NULL;                                       \
     178             :              pmc = rcu_dereference(pmc->next_rcu))
     179             : 
     180             : #define for_each_pmc_rtnl(in_dev, pmc)                          \
     181             :         for (pmc = rtnl_dereference(in_dev->mc_list);                \
     182             :              pmc != NULL;                                       \
     183             :              pmc = rtnl_dereference(pmc->next_rcu))
     184             : 
     185             : static void ip_sf_list_clear_all(struct ip_sf_list *psf)
     186             : {
     187             :         struct ip_sf_list *next;
     188             : 
     189           0 :         while (psf) {
     190           0 :                 next = psf->sf_next;
     191           0 :                 kfree(psf);
     192           0 :                 psf = next;
     193             :         }
     194             : }
     195             : 
     196             : #ifdef CONFIG_IP_MULTICAST
     197             : 
     198             : /*
     199             :  *      Timer management
     200             :  */
     201             : 
     202             : static void igmp_stop_timer(struct ip_mc_list *im)
     203             : {
     204             :         spin_lock_bh(&im->lock);
     205             :         if (del_timer(&im->timer))
     206             :                 refcount_dec(&im->refcnt);
     207             :         im->tm_running = 0;
     208             :         im->reporter = 0;
     209             :         im->unsolicit_count = 0;
     210             :         spin_unlock_bh(&im->lock);
     211             : }
     212             : 
     213             : /* It must be called with locked im->lock */
     214             : static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
     215             : {
     216             :         int tv = prandom_u32() % max_delay;
     217             : 
     218             :         im->tm_running = 1;
     219             :         if (!mod_timer(&im->timer, jiffies+tv+2))
     220             :                 refcount_inc(&im->refcnt);
     221             : }
     222             : 
     223             : static void igmp_gq_start_timer(struct in_device *in_dev)
     224             : {
     225             :         int tv = prandom_u32() % in_dev->mr_maxdelay;
     226             :         unsigned long exp = jiffies + tv + 2;
     227             : 
     228             :         if (in_dev->mr_gq_running &&
     229             :             time_after_eq(exp, (in_dev->mr_gq_timer).expires))
     230             :                 return;
     231             : 
     232             :         in_dev->mr_gq_running = 1;
     233             :         if (!mod_timer(&in_dev->mr_gq_timer, exp))
     234             :                 in_dev_hold(in_dev);
     235             : }
     236             : 
     237             : static void igmp_ifc_start_timer(struct in_device *in_dev, int delay)
     238             : {
     239             :         int tv = prandom_u32() % delay;
     240             : 
     241             :         if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2))
     242             :                 in_dev_hold(in_dev);
     243             : }
     244             : 
     245             : static void igmp_mod_timer(struct ip_mc_list *im, int max_delay)
     246             : {
     247             :         spin_lock_bh(&im->lock);
     248             :         im->unsolicit_count = 0;
     249             :         if (del_timer(&im->timer)) {
     250             :                 if ((long)(im->timer.expires-jiffies) < max_delay) {
     251             :                         add_timer(&im->timer);
     252             :                         im->tm_running = 1;
     253             :                         spin_unlock_bh(&im->lock);
     254             :                         return;
     255             :                 }
     256             :                 refcount_dec(&im->refcnt);
     257             :         }
     258             :         igmp_start_timer(im, max_delay);
     259             :         spin_unlock_bh(&im->lock);
     260             : }
     261             : 
     262             : 
     263             : /*
     264             :  *      Send an IGMP report.
     265             :  */
     266             : 
     267             : #define IGMP_SIZE (sizeof(struct igmphdr)+sizeof(struct iphdr)+4)
     268             : 
     269             : 
     270             : static int is_in(struct ip_mc_list *pmc, struct ip_sf_list *psf, int type,
     271             :         int gdeleted, int sdeleted)
     272             : {
     273             :         switch (type) {
     274             :         case IGMPV3_MODE_IS_INCLUDE:
     275             :         case IGMPV3_MODE_IS_EXCLUDE:
     276             :                 if (gdeleted || sdeleted)
     277             :                         return 0;
     278             :                 if (!(pmc->gsquery && !psf->sf_gsresp)) {
     279             :                         if (pmc->sfmode == MCAST_INCLUDE)
     280             :                                 return 1;
     281             :                         /* don't include if this source is excluded
     282             :                          * in all filters
     283             :                          */
     284             :                         if (psf->sf_count[MCAST_INCLUDE])
     285             :                                 return type == IGMPV3_MODE_IS_INCLUDE;
     286             :                         return pmc->sfcount[MCAST_EXCLUDE] ==
     287             :                                 psf->sf_count[MCAST_EXCLUDE];
     288             :                 }
     289             :                 return 0;
     290             :         case IGMPV3_CHANGE_TO_INCLUDE:
     291             :                 if (gdeleted || sdeleted)
     292             :                         return 0;
     293             :                 return psf->sf_count[MCAST_INCLUDE] != 0;
     294             :         case IGMPV3_CHANGE_TO_EXCLUDE:
     295             :                 if (gdeleted || sdeleted)
     296             :                         return 0;
     297             :                 if (pmc->sfcount[MCAST_EXCLUDE] == 0 ||
     298             :                     psf->sf_count[MCAST_INCLUDE])
     299             :                         return 0;
     300             :                 return pmc->sfcount[MCAST_EXCLUDE] ==
     301             :                         psf->sf_count[MCAST_EXCLUDE];
     302             :         case IGMPV3_ALLOW_NEW_SOURCES:
     303             :                 if (gdeleted || !psf->sf_crcount)
     304             :                         return 0;
     305             :                 return (pmc->sfmode == MCAST_INCLUDE) ^ sdeleted;
     306             :         case IGMPV3_BLOCK_OLD_SOURCES:
     307             :                 if (pmc->sfmode == MCAST_INCLUDE)
     308             :                         return gdeleted || (psf->sf_crcount && sdeleted);
     309             :                 return psf->sf_crcount && !gdeleted && !sdeleted;
     310             :         }
     311             :         return 0;
     312             : }
     313             : 
     314             : static int
     315             : igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
     316             : {
     317             :         struct ip_sf_list *psf;
     318             :         int scount = 0;
     319             : 
     320             :         for (psf = pmc->sources; psf; psf = psf->sf_next) {
     321             :                 if (!is_in(pmc, psf, type, gdeleted, sdeleted))
     322             :                         continue;
     323             :                 scount++;
     324             :         }
     325             :         return scount;
     326             : }
     327             : 
     328             : /* source address selection per RFC 3376 section 4.2.13 */
     329             : static __be32 igmpv3_get_srcaddr(struct net_device *dev,
     330             :                                  const struct flowi4 *fl4)
     331             : {
     332             :         struct in_device *in_dev = __in_dev_get_rcu(dev);
     333             :         const struct in_ifaddr *ifa;
     334             : 
     335             :         if (!in_dev)
     336             :                 return htonl(INADDR_ANY);
     337             : 
     338             :         in_dev_for_each_ifa_rcu(ifa, in_dev) {
     339             :                 if (fl4->saddr == ifa->ifa_local)
     340             :                         return fl4->saddr;
     341             :         }
     342             : 
     343             :         return htonl(INADDR_ANY);
     344             : }
     345             : 
     346             : static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
     347             : {
     348             :         struct sk_buff *skb;
     349             :         struct rtable *rt;
     350             :         struct iphdr *pip;
     351             :         struct igmpv3_report *pig;
     352             :         struct net *net = dev_net(dev);
     353             :         struct flowi4 fl4;
     354             :         int hlen = LL_RESERVED_SPACE(dev);
     355             :         int tlen = dev->needed_tailroom;
     356             :         unsigned int size = mtu;
     357             : 
     358             :         while (1) {
     359             :                 skb = alloc_skb(size + hlen + tlen,
     360             :                                 GFP_ATOMIC | __GFP_NOWARN);
     361             :                 if (skb)
     362             :                         break;
     363             :                 size >>= 1;
     364             :                 if (size < 256)
     365             :                         return NULL;
     366             :         }
     367             :         skb->priority = TC_PRIO_CONTROL;
     368             : 
     369             :         rt = ip_route_output_ports(net, &fl4, NULL, IGMPV3_ALL_MCR, 0,
     370             :                                    0, 0,
     371             :                                    IPPROTO_IGMP, 0, dev->ifindex);
     372             :         if (IS_ERR(rt)) {
     373             :                 kfree_skb(skb);
     374             :                 return NULL;
     375             :         }
     376             : 
     377             :         skb_dst_set(skb, &rt->dst);
     378             :         skb->dev = dev;
     379             : 
     380             :         skb_reserve(skb, hlen);
     381             :         skb_tailroom_reserve(skb, mtu, tlen);
     382             : 
     383             :         skb_reset_network_header(skb);
     384             :         pip = ip_hdr(skb);
     385             :         skb_put(skb, sizeof(struct iphdr) + 4);
     386             : 
     387             :         pip->version  = 4;
     388             :         pip->ihl      = (sizeof(struct iphdr)+4)>>2;
     389             :         pip->tos      = 0xc0;
     390             :         pip->frag_off = htons(IP_DF);
     391             :         pip->ttl      = 1;
     392             :         pip->daddr    = fl4.daddr;
     393             : 
     394             :         rcu_read_lock();
     395             :         pip->saddr    = igmpv3_get_srcaddr(dev, &fl4);
     396             :         rcu_read_unlock();
     397             : 
     398             :         pip->protocol = IPPROTO_IGMP;
     399             :         pip->tot_len  = 0;   /* filled in later */
     400             :         ip_select_ident(net, skb, NULL);
     401             :         ((u8 *)&pip[1])[0] = IPOPT_RA;
     402             :         ((u8 *)&pip[1])[1] = 4;
     403             :         ((u8 *)&pip[1])[2] = 0;
     404             :         ((u8 *)&pip[1])[3] = 0;
     405             : 
     406             :         skb->transport_header = skb->network_header + sizeof(struct iphdr) + 4;
     407             :         skb_put(skb, sizeof(*pig));
     408             :         pig = igmpv3_report_hdr(skb);
     409             :         pig->type = IGMPV3_HOST_MEMBERSHIP_REPORT;
     410             :         pig->resv1 = 0;
     411             :         pig->csum = 0;
     412             :         pig->resv2 = 0;
     413             :         pig->ngrec = 0;
     414             :         return skb;
     415             : }
     416             : 
     417             : static int igmpv3_sendpack(struct sk_buff *skb)
     418             : {
     419             :         struct igmphdr *pig = igmp_hdr(skb);
     420             :         const int igmplen = skb_tail_pointer(skb) - skb_transport_header(skb);
     421             : 
     422             :         pig->csum = ip_compute_csum(igmp_hdr(skb), igmplen);
     423             : 
     424             :         return ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
     425             : }
     426             : 
     427             : static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel)
     428             : {
     429             :         return sizeof(struct igmpv3_grec) + 4*igmp_scount(pmc, type, gdel, sdel);
     430             : }
     431             : 
     432             : static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
     433             :         int type, struct igmpv3_grec **ppgr, unsigned int mtu)
     434             : {
     435             :         struct net_device *dev = pmc->interface->dev;
     436             :         struct igmpv3_report *pih;
     437             :         struct igmpv3_grec *pgr;
     438             : 
     439             :         if (!skb) {
     440             :                 skb = igmpv3_newpack(dev, mtu);
     441             :                 if (!skb)
     442             :                         return NULL;
     443             :         }
     444             :         pgr = skb_put(skb, sizeof(struct igmpv3_grec));
     445             :         pgr->grec_type = type;
     446             :         pgr->grec_auxwords = 0;
     447             :         pgr->grec_nsrcs = 0;
     448             :         pgr->grec_mca = pmc->multiaddr;
     449             :         pih = igmpv3_report_hdr(skb);
     450             :         pih->ngrec = htons(ntohs(pih->ngrec)+1);
     451             :         *ppgr = pgr;
     452             :         return skb;
     453             : }
     454             : 
     455             : #define AVAILABLE(skb)  ((skb) ? skb_availroom(skb) : 0)
     456             : 
     457             : static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
     458             :         int type, int gdeleted, int sdeleted)
     459             : {
     460             :         struct net_device *dev = pmc->interface->dev;
     461             :         struct net *net = dev_net(dev);
     462             :         struct igmpv3_report *pih;
     463             :         struct igmpv3_grec *pgr = NULL;
     464             :         struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list;
     465             :         int scount, stotal, first, isquery, truncate;
     466             :         unsigned int mtu;
     467             : 
     468             :         if (pmc->multiaddr == IGMP_ALL_HOSTS)
     469             :                 return skb;
     470             :         if (ipv4_is_local_multicast(pmc->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports)
     471             :                 return skb;
     472             : 
     473             :         mtu = READ_ONCE(dev->mtu);
     474             :         if (mtu < IPV4_MIN_MTU)
     475             :                 return skb;
     476             : 
     477             :         isquery = type == IGMPV3_MODE_IS_INCLUDE ||
     478             :                   type == IGMPV3_MODE_IS_EXCLUDE;
     479             :         truncate = type == IGMPV3_MODE_IS_EXCLUDE ||
     480             :                     type == IGMPV3_CHANGE_TO_EXCLUDE;
     481             : 
     482             :         stotal = scount = 0;
     483             : 
     484             :         psf_list = sdeleted ? &pmc->tomb : &pmc->sources;
     485             : 
     486             :         if (!*psf_list)
     487             :                 goto empty_source;
     488             : 
     489             :         pih = skb ? igmpv3_report_hdr(skb) : NULL;
     490             : 
     491             :         /* EX and TO_EX get a fresh packet, if needed */
     492             :         if (truncate) {
     493             :                 if (pih && pih->ngrec &&
     494             :                     AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
     495             :                         if (skb)
     496             :                                 igmpv3_sendpack(skb);
     497             :                         skb = igmpv3_newpack(dev, mtu);
     498             :                 }
     499             :         }
     500             :         first = 1;
     501             :         psf_prev = NULL;
     502             :         for (psf = *psf_list; psf; psf = psf_next) {
     503             :                 __be32 *psrc;
     504             : 
     505             :                 psf_next = psf->sf_next;
     506             : 
     507             :                 if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
     508             :                         psf_prev = psf;
     509             :                         continue;
     510             :                 }
     511             : 
     512             :                 /* Based on RFC3376 5.1. Should not send source-list change
     513             :                  * records when there is a filter mode change.
     514             :                  */
     515             :                 if (((gdeleted && pmc->sfmode == MCAST_EXCLUDE) ||
     516             :                      (!gdeleted && pmc->crcount)) &&
     517             :                     (type == IGMPV3_ALLOW_NEW_SOURCES ||
     518             :                      type == IGMPV3_BLOCK_OLD_SOURCES) && psf->sf_crcount)
     519             :                         goto decrease_sf_crcount;
     520             : 
     521             :                 /* clear marks on query responses */
     522             :                 if (isquery)
     523             :                         psf->sf_gsresp = 0;
     524             : 
     525             :                 if (AVAILABLE(skb) < sizeof(__be32) +
     526             :                     first*sizeof(struct igmpv3_grec)) {
     527             :                         if (truncate && !first)
     528             :                                 break;   /* truncate these */
     529             :                         if (pgr)
     530             :                                 pgr->grec_nsrcs = htons(scount);
     531             :                         if (skb)
     532             :                                 igmpv3_sendpack(skb);
     533             :                         skb = igmpv3_newpack(dev, mtu);
     534             :                         first = 1;
     535             :                         scount = 0;
     536             :                 }
     537             :                 if (first) {
     538             :                         skb = add_grhead(skb, pmc, type, &pgr, mtu);
     539             :                         first = 0;
     540             :                 }
     541             :                 if (!skb)
     542             :                         return NULL;
     543             :                 psrc = skb_put(skb, sizeof(__be32));
     544             :                 *psrc = psf->sf_inaddr;
     545             :                 scount++; stotal++;
     546             :                 if ((type == IGMPV3_ALLOW_NEW_SOURCES ||
     547             :                      type == IGMPV3_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
     548             : decrease_sf_crcount:
     549             :                         psf->sf_crcount--;
     550             :                         if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
     551             :                                 if (psf_prev)
     552             :                                         psf_prev->sf_next = psf->sf_next;
     553             :                                 else
     554             :                                         *psf_list = psf->sf_next;
     555             :                                 kfree(psf);
     556             :                                 continue;
     557             :                         }
     558             :                 }
     559             :                 psf_prev = psf;
     560             :         }
     561             : 
     562             : empty_source:
     563             :         if (!stotal) {
     564             :                 if (type == IGMPV3_ALLOW_NEW_SOURCES ||
     565             :                     type == IGMPV3_BLOCK_OLD_SOURCES)
     566             :                         return skb;
     567             :                 if (pmc->crcount || isquery) {
     568             :                         /* make sure we have room for group header */
     569             :                         if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)) {
     570             :                                 igmpv3_sendpack(skb);
     571             :                                 skb = NULL; /* add_grhead will get a new one */
     572             :                         }
     573             :                         skb = add_grhead(skb, pmc, type, &pgr, mtu);
     574             :                 }
     575             :         }
     576             :         if (pgr)
     577             :                 pgr->grec_nsrcs = htons(scount);
     578             : 
     579             :         if (isquery)
     580             :                 pmc->gsquery = 0;    /* clear query state on report */
     581             :         return skb;
     582             : }
     583             : 
     584             : static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
     585             : {
     586             :         struct sk_buff *skb = NULL;
     587             :         struct net *net = dev_net(in_dev->dev);
     588             :         int type;
     589             : 
     590             :         if (!pmc) {
     591             :                 rcu_read_lock();
     592             :                 for_each_pmc_rcu(in_dev, pmc) {
     593             :                         if (pmc->multiaddr == IGMP_ALL_HOSTS)
     594             :                                 continue;
     595             :                         if (ipv4_is_local_multicast(pmc->multiaddr) &&
     596             :                              !net->ipv4.sysctl_igmp_llm_reports)
     597             :                                 continue;
     598             :                         spin_lock_bh(&pmc->lock);
     599             :                         if (pmc->sfcount[MCAST_EXCLUDE])
     600             :                                 type = IGMPV3_MODE_IS_EXCLUDE;
     601             :                         else
     602             :                                 type = IGMPV3_MODE_IS_INCLUDE;
     603             :                         skb = add_grec(skb, pmc, type, 0, 0);
     604             :                         spin_unlock_bh(&pmc->lock);
     605             :                 }
     606             :                 rcu_read_unlock();
     607             :         } else {
     608             :                 spin_lock_bh(&pmc->lock);
     609             :                 if (pmc->sfcount[MCAST_EXCLUDE])
     610             :                         type = IGMPV3_MODE_IS_EXCLUDE;
     611             :                 else
     612             :                         type = IGMPV3_MODE_IS_INCLUDE;
     613             :                 skb = add_grec(skb, pmc, type, 0, 0);
     614             :                 spin_unlock_bh(&pmc->lock);
     615             :         }
     616             :         if (!skb)
     617             :                 return 0;
     618             :         return igmpv3_sendpack(skb);
     619             : }
     620             : 
     621             : /*
     622             :  * remove zero-count source records from a source filter list
     623             :  */
     624             : static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
     625             : {
     626             :         struct ip_sf_list *psf_prev, *psf_next, *psf;
     627             : 
     628             :         psf_prev = NULL;
     629             :         for (psf = *ppsf; psf; psf = psf_next) {
     630             :                 psf_next = psf->sf_next;
     631             :                 if (psf->sf_crcount == 0) {
     632             :                         if (psf_prev)
     633             :                                 psf_prev->sf_next = psf->sf_next;
     634             :                         else
     635             :                                 *ppsf = psf->sf_next;
     636             :                         kfree(psf);
     637             :                 } else
     638             :                         psf_prev = psf;
     639             :         }
     640             : }
     641             : 
     642             : static void kfree_pmc(struct ip_mc_list *pmc)
     643             : {
     644             :         ip_sf_list_clear_all(pmc->sources);
     645             :         ip_sf_list_clear_all(pmc->tomb);
     646             :         kfree(pmc);
     647             : }
     648             : 
     649             : static void igmpv3_send_cr(struct in_device *in_dev)
     650             : {
     651             :         struct ip_mc_list *pmc, *pmc_prev, *pmc_next;
     652             :         struct sk_buff *skb = NULL;
     653             :         int type, dtype;
     654             : 
     655             :         rcu_read_lock();
     656             :         spin_lock_bh(&in_dev->mc_tomb_lock);
     657             : 
     658             :         /* deleted MCA's */
     659             :         pmc_prev = NULL;
     660             :         for (pmc = in_dev->mc_tomb; pmc; pmc = pmc_next) {
     661             :                 pmc_next = pmc->next;
     662             :                 if (pmc->sfmode == MCAST_INCLUDE) {
     663             :                         type = IGMPV3_BLOCK_OLD_SOURCES;
     664             :                         dtype = IGMPV3_BLOCK_OLD_SOURCES;
     665             :                         skb = add_grec(skb, pmc, type, 1, 0);
     666             :                         skb = add_grec(skb, pmc, dtype, 1, 1);
     667             :                 }
     668             :                 if (pmc->crcount) {
     669             :                         if (pmc->sfmode == MCAST_EXCLUDE) {
     670             :                                 type = IGMPV3_CHANGE_TO_INCLUDE;
     671             :                                 skb = add_grec(skb, pmc, type, 1, 0);
     672             :                         }
     673             :                         pmc->crcount--;
     674             :                         if (pmc->crcount == 0) {
     675             :                                 igmpv3_clear_zeros(&pmc->tomb);
     676             :                                 igmpv3_clear_zeros(&pmc->sources);
     677             :                         }
     678             :                 }
     679             :                 if (pmc->crcount == 0 && !pmc->tomb && !pmc->sources) {
     680             :                         if (pmc_prev)
     681             :                                 pmc_prev->next = pmc_next;
     682             :                         else
     683             :                                 in_dev->mc_tomb = pmc_next;
     684             :                         in_dev_put(pmc->interface);
     685             :                         kfree_pmc(pmc);
     686             :                 } else
     687             :                         pmc_prev = pmc;
     688             :         }
     689             :         spin_unlock_bh(&in_dev->mc_tomb_lock);
     690             : 
     691             :         /* change recs */
     692             :         for_each_pmc_rcu(in_dev, pmc) {
     693             :                 spin_lock_bh(&pmc->lock);
     694             :                 if (pmc->sfcount[MCAST_EXCLUDE]) {
     695             :                         type = IGMPV3_BLOCK_OLD_SOURCES;
     696             :                         dtype = IGMPV3_ALLOW_NEW_SOURCES;
     697             :                 } else {
     698             :                         type = IGMPV3_ALLOW_NEW_SOURCES;
     699             :                         dtype = IGMPV3_BLOCK_OLD_SOURCES;
     700             :                 }
     701             :                 skb = add_grec(skb, pmc, type, 0, 0);
     702             :                 skb = add_grec(skb, pmc, dtype, 0, 1);  /* deleted sources */
     703             : 
     704             :                 /* filter mode changes */
     705             :                 if (pmc->crcount) {
     706             :                         if (pmc->sfmode == MCAST_EXCLUDE)
     707             :                                 type = IGMPV3_CHANGE_TO_EXCLUDE;
     708             :                         else
     709             :                                 type = IGMPV3_CHANGE_TO_INCLUDE;
     710             :                         skb = add_grec(skb, pmc, type, 0, 0);
     711             :                         pmc->crcount--;
     712             :                 }
     713             :                 spin_unlock_bh(&pmc->lock);
     714             :         }
     715             :         rcu_read_unlock();
     716             : 
     717             :         if (!skb)
     718             :                 return;
     719             :         (void) igmpv3_sendpack(skb);
     720             : }
     721             : 
     722             : static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
     723             :         int type)
     724             : {
     725             :         struct sk_buff *skb;
     726             :         struct iphdr *iph;
     727             :         struct igmphdr *ih;
     728             :         struct rtable *rt;
     729             :         struct net_device *dev = in_dev->dev;
     730             :         struct net *net = dev_net(dev);
     731             :         __be32  group = pmc ? pmc->multiaddr : 0;
     732             :         struct flowi4 fl4;
     733             :         __be32  dst;
     734             :         int hlen, tlen;
     735             : 
     736             :         if (type == IGMPV3_HOST_MEMBERSHIP_REPORT)
     737             :                 return igmpv3_send_report(in_dev, pmc);
     738             : 
     739             :         if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports)
     740             :                 return 0;
     741             : 
     742             :         if (type == IGMP_HOST_LEAVE_MESSAGE)
     743             :                 dst = IGMP_ALL_ROUTER;
     744             :         else
     745             :                 dst = group;
     746             : 
     747             :         rt = ip_route_output_ports(net, &fl4, NULL, dst, 0,
     748             :                                    0, 0,
     749             :                                    IPPROTO_IGMP, 0, dev->ifindex);
     750             :         if (IS_ERR(rt))
     751             :                 return -1;
     752             : 
     753             :         hlen = LL_RESERVED_SPACE(dev);
     754             :         tlen = dev->needed_tailroom;
     755             :         skb = alloc_skb(IGMP_SIZE + hlen + tlen, GFP_ATOMIC);
     756             :         if (!skb) {
     757             :                 ip_rt_put(rt);
     758             :                 return -1;
     759             :         }
     760             :         skb->priority = TC_PRIO_CONTROL;
     761             : 
     762             :         skb_dst_set(skb, &rt->dst);
     763             : 
     764             :         skb_reserve(skb, hlen);
     765             : 
     766             :         skb_reset_network_header(skb);
     767             :         iph = ip_hdr(skb);
     768             :         skb_put(skb, sizeof(struct iphdr) + 4);
     769             : 
     770             :         iph->version  = 4;
     771             :         iph->ihl      = (sizeof(struct iphdr)+4)>>2;
     772             :         iph->tos      = 0xc0;
     773             :         iph->frag_off = htons(IP_DF);
     774             :         iph->ttl      = 1;
     775             :         iph->daddr    = dst;
     776             :         iph->saddr    = fl4.saddr;
     777             :         iph->protocol = IPPROTO_IGMP;
     778             :         ip_select_ident(net, skb, NULL);
     779             :         ((u8 *)&iph[1])[0] = IPOPT_RA;
     780             :         ((u8 *)&iph[1])[1] = 4;
     781             :         ((u8 *)&iph[1])[2] = 0;
     782             :         ((u8 *)&iph[1])[3] = 0;
     783             : 
     784             :         ih = skb_put(skb, sizeof(struct igmphdr));
     785             :         ih->type = type;
     786             :         ih->code = 0;
     787             :         ih->csum = 0;
     788             :         ih->group = group;
     789             :         ih->csum = ip_compute_csum((void *)ih, sizeof(struct igmphdr));
     790             : 
     791             :         return ip_local_out(net, skb->sk, skb);
     792             : }
     793             : 
     794             : static void igmp_gq_timer_expire(struct timer_list *t)
     795             : {
     796             :         struct in_device *in_dev = from_timer(in_dev, t, mr_gq_timer);
     797             : 
     798             :         in_dev->mr_gq_running = 0;
     799             :         igmpv3_send_report(in_dev, NULL);
     800             :         in_dev_put(in_dev);
     801             : }
     802             : 
     803             : static void igmp_ifc_timer_expire(struct timer_list *t)
     804             : {
     805             :         struct in_device *in_dev = from_timer(in_dev, t, mr_ifc_timer);
     806             : 
     807             :         igmpv3_send_cr(in_dev);
     808             :         if (in_dev->mr_ifc_count) {
     809             :                 in_dev->mr_ifc_count--;
     810             :                 igmp_ifc_start_timer(in_dev,
     811             :                                      unsolicited_report_interval(in_dev));
     812             :         }
     813             :         in_dev_put(in_dev);
     814             : }
     815             : 
     816             : static void igmp_ifc_event(struct in_device *in_dev)
     817             : {
     818             :         struct net *net = dev_net(in_dev->dev);
     819             :         if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
     820             :                 return;
     821             :         in_dev->mr_ifc_count = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
     822             :         igmp_ifc_start_timer(in_dev, 1);
     823             : }
     824             : 
     825             : 
     826             : static void igmp_timer_expire(struct timer_list *t)
     827             : {
     828             :         struct ip_mc_list *im = from_timer(im, t, timer);
     829             :         struct in_device *in_dev = im->interface;
     830             : 
     831             :         spin_lock(&im->lock);
     832             :         im->tm_running = 0;
     833             : 
     834             :         if (im->unsolicit_count && --im->unsolicit_count)
     835             :                 igmp_start_timer(im, unsolicited_report_interval(in_dev));
     836             : 
     837             :         im->reporter = 1;
     838             :         spin_unlock(&im->lock);
     839             : 
     840             :         if (IGMP_V1_SEEN(in_dev))
     841             :                 igmp_send_report(in_dev, im, IGMP_HOST_MEMBERSHIP_REPORT);
     842             :         else if (IGMP_V2_SEEN(in_dev))
     843             :                 igmp_send_report(in_dev, im, IGMPV2_HOST_MEMBERSHIP_REPORT);
     844             :         else
     845             :                 igmp_send_report(in_dev, im, IGMPV3_HOST_MEMBERSHIP_REPORT);
     846             : 
     847             :         ip_ma_put(im);
     848             : }
     849             : 
     850             : /* mark EXCLUDE-mode sources */
     851             : static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
     852             : {
     853             :         struct ip_sf_list *psf;
     854             :         int i, scount;
     855             : 
     856             :         scount = 0;
     857             :         for (psf = pmc->sources; psf; psf = psf->sf_next) {
     858             :                 if (scount == nsrcs)
     859             :                         break;
     860             :                 for (i = 0; i < nsrcs; i++) {
     861             :                         /* skip inactive filters */
     862             :                         if (psf->sf_count[MCAST_INCLUDE] ||
     863             :                             pmc->sfcount[MCAST_EXCLUDE] !=
     864             :                             psf->sf_count[MCAST_EXCLUDE])
     865             :                                 break;
     866             :                         if (srcs[i] == psf->sf_inaddr) {
     867             :                                 scount++;
     868             :                                 break;
     869             :                         }
     870             :                 }
     871             :         }
     872             :         pmc->gsquery = 0;
     873             :         if (scount == nsrcs)    /* all sources excluded */
     874             :                 return 0;
     875             :         return 1;
     876             : }
     877             : 
     878             : static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
     879             : {
     880             :         struct ip_sf_list *psf;
     881             :         int i, scount;
     882             : 
     883             :         if (pmc->sfmode == MCAST_EXCLUDE)
     884             :                 return igmp_xmarksources(pmc, nsrcs, srcs);
     885             : 
     886             :         /* mark INCLUDE-mode sources */
     887             :         scount = 0;
     888             :         for (psf = pmc->sources; psf; psf = psf->sf_next) {
     889             :                 if (scount == nsrcs)
     890             :                         break;
     891             :                 for (i = 0; i < nsrcs; i++)
     892             :                         if (srcs[i] == psf->sf_inaddr) {
     893             :                                 psf->sf_gsresp = 1;
     894             :                                 scount++;
     895             :                                 break;
     896             :                         }
     897             :         }
     898             :         if (!scount) {
     899             :                 pmc->gsquery = 0;
     900             :                 return 0;
     901             :         }
     902             :         pmc->gsquery = 1;
     903             :         return 1;
     904             : }
     905             : 
     906             : /* return true if packet was dropped */
     907             : static bool igmp_heard_report(struct in_device *in_dev, __be32 group)
     908             : {
     909             :         struct ip_mc_list *im;
     910             :         struct net *net = dev_net(in_dev->dev);
     911             : 
     912             :         /* Timers are only set for non-local groups */
     913             : 
     914             :         if (group == IGMP_ALL_HOSTS)
     915             :                 return false;
     916             :         if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports)
     917             :                 return false;
     918             : 
     919             :         rcu_read_lock();
     920             :         for_each_pmc_rcu(in_dev, im) {
     921             :                 if (im->multiaddr == group) {
     922             :                         igmp_stop_timer(im);
     923             :                         break;
     924             :                 }
     925             :         }
     926             :         rcu_read_unlock();
     927             :         return false;
     928             : }
     929             : 
     930             : /* return true if packet was dropped */
     931             : static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
     932             :         int len)
     933             : {
     934             :         struct igmphdr          *ih = igmp_hdr(skb);
     935             :         struct igmpv3_query *ih3 = igmpv3_query_hdr(skb);
     936             :         struct ip_mc_list       *im;
     937             :         __be32                  group = ih->group;
     938             :         int                     max_delay;
     939             :         int                     mark = 0;
     940             :         struct net              *net = dev_net(in_dev->dev);
     941             : 
     942             : 
     943             :         if (len == 8) {
     944             :                 if (ih->code == 0) {
     945             :                         /* Alas, old v1 router presents here. */
     946             : 
     947             :                         max_delay = IGMP_QUERY_RESPONSE_INTERVAL;
     948             :                         in_dev->mr_v1_seen = jiffies +
     949             :                                 (in_dev->mr_qrv * in_dev->mr_qi) +
     950             :                                 in_dev->mr_qri;
     951             :                         group = 0;
     952             :                 } else {
     953             :                         /* v2 router present */
     954             :                         max_delay = ih->code*(HZ/IGMP_TIMER_SCALE);
     955             :                         in_dev->mr_v2_seen = jiffies +
     956             :                                 (in_dev->mr_qrv * in_dev->mr_qi) +
     957             :                                 in_dev->mr_qri;
     958             :                 }
     959             :                 /* cancel the interface change timer */
     960             :                 in_dev->mr_ifc_count = 0;
     961             :                 if (del_timer(&in_dev->mr_ifc_timer))
     962             :                         __in_dev_put(in_dev);
     963             :                 /* clear deleted report items */
     964             :                 igmpv3_clear_delrec(in_dev);
     965             :         } else if (len < 12) {
     966             :                 return true;    /* ignore bogus packet; freed by caller */
     967             :         } else if (IGMP_V1_SEEN(in_dev)) {
     968             :                 /* This is a v3 query with v1 queriers present */
     969             :                 max_delay = IGMP_QUERY_RESPONSE_INTERVAL;
     970             :                 group = 0;
     971             :         } else if (IGMP_V2_SEEN(in_dev)) {
     972             :                 /* this is a v3 query with v2 queriers present;
     973             :                  * Interpretation of the max_delay code is problematic here.
     974             :                  * A real v2 host would use ih_code directly, while v3 has a
     975             :                  * different encoding. We use the v3 encoding as more likely
     976             :                  * to be intended in a v3 query.
     977             :                  */
     978             :                 max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
     979             :                 if (!max_delay)
     980             :                         max_delay = 1;  /* can't mod w/ 0 */
     981             :         } else { /* v3 */
     982             :                 if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
     983             :                         return true;
     984             : 
     985             :                 ih3 = igmpv3_query_hdr(skb);
     986             :                 if (ih3->nsrcs) {
     987             :                         if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)
     988             :                                            + ntohs(ih3->nsrcs)*sizeof(__be32)))
     989             :                                 return true;
     990             :                         ih3 = igmpv3_query_hdr(skb);
     991             :                 }
     992             : 
     993             :                 max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
     994             :                 if (!max_delay)
     995             :                         max_delay = 1;  /* can't mod w/ 0 */
     996             :                 in_dev->mr_maxdelay = max_delay;
     997             : 
     998             :                 /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently
     999             :                  * received value was zero, use the default or statically
    1000             :                  * configured value.
    1001             :                  */
    1002             :                 in_dev->mr_qrv = ih3->qrv ?: net->ipv4.sysctl_igmp_qrv;
    1003             :                 in_dev->mr_qi = IGMPV3_QQIC(ih3->qqic)*HZ ?: IGMP_QUERY_INTERVAL;
    1004             : 
    1005             :                 /* RFC3376, 8.3. Query Response Interval:
    1006             :                  * The number of seconds represented by the [Query Response
    1007             :                  * Interval] must be less than the [Query Interval].
    1008             :                  */
    1009             :                 if (in_dev->mr_qri >= in_dev->mr_qi)
    1010             :                         in_dev->mr_qri = (in_dev->mr_qi/HZ - 1)*HZ;
    1011             : 
    1012             :                 if (!group) { /* general query */
    1013             :                         if (ih3->nsrcs)
    1014             :                                 return true;    /* no sources allowed */
    1015             :                         igmp_gq_start_timer(in_dev);
    1016             :                         return false;
    1017             :                 }
    1018             :                 /* mark sources to include, if group & source-specific */
    1019             :                 mark = ih3->nsrcs != 0;
    1020             :         }
    1021             : 
    1022             :         /*
    1023             :          * - Start the timers in all of our membership records
    1024             :          *   that the query applies to for the interface on
    1025             :          *   which the query arrived excl. those that belong
    1026             :          *   to a "local" group (224.0.0.X)
    1027             :          * - For timers already running check if they need to
    1028             :          *   be reset.
    1029             :          * - Use the igmp->igmp_code field as the maximum
    1030             :          *   delay possible
    1031             :          */
    1032             :         rcu_read_lock();
    1033             :         for_each_pmc_rcu(in_dev, im) {
    1034             :                 int changed;
    1035             : 
    1036             :                 if (group && group != im->multiaddr)
    1037             :                         continue;
    1038             :                 if (im->multiaddr == IGMP_ALL_HOSTS)
    1039             :                         continue;
    1040             :                 if (ipv4_is_local_multicast(im->multiaddr) &&
    1041             :                     !net->ipv4.sysctl_igmp_llm_reports)
    1042             :                         continue;
    1043             :                 spin_lock_bh(&im->lock);
    1044             :                 if (im->tm_running)
    1045             :                         im->gsquery = im->gsquery && mark;
    1046             :                 else
    1047             :                         im->gsquery = mark;
    1048             :                 changed = !im->gsquery ||
    1049             :                         igmp_marksources(im, ntohs(ih3->nsrcs), ih3->srcs);
    1050             :                 spin_unlock_bh(&im->lock);
    1051             :                 if (changed)
    1052             :                         igmp_mod_timer(im, max_delay);
    1053             :         }
    1054             :         rcu_read_unlock();
    1055             :         return false;
    1056             : }
    1057             : 
    1058             : /* called in rcu_read_lock() section */
    1059             : int igmp_rcv(struct sk_buff *skb)
    1060             : {
    1061             :         /* This basically follows the spec line by line -- see RFC1112 */
    1062             :         struct igmphdr *ih;
    1063             :         struct net_device *dev = skb->dev;
    1064             :         struct in_device *in_dev;
    1065             :         int len = skb->len;
    1066             :         bool dropped = true;
    1067             : 
    1068             :         if (netif_is_l3_master(dev)) {
    1069             :                 dev = dev_get_by_index_rcu(dev_net(dev), IPCB(skb)->iif);
    1070             :                 if (!dev)
    1071             :                         goto drop;
    1072             :         }
    1073             : 
    1074             :         in_dev = __in_dev_get_rcu(dev);
    1075             :         if (!in_dev)
    1076             :                 goto drop;
    1077             : 
    1078             :         if (!pskb_may_pull(skb, sizeof(struct igmphdr)))
    1079             :                 goto drop;
    1080             : 
    1081             :         if (skb_checksum_simple_validate(skb))
    1082             :                 goto drop;
    1083             : 
    1084             :         ih = igmp_hdr(skb);
    1085             :         switch (ih->type) {
    1086             :         case IGMP_HOST_MEMBERSHIP_QUERY:
    1087             :                 dropped = igmp_heard_query(in_dev, skb, len);
    1088             :                 break;
    1089             :         case IGMP_HOST_MEMBERSHIP_REPORT:
    1090             :         case IGMPV2_HOST_MEMBERSHIP_REPORT:
    1091             :                 /* Is it our report looped back? */
    1092             :                 if (rt_is_output_route(skb_rtable(skb)))
    1093             :                         break;
    1094             :                 /* don't rely on MC router hearing unicast reports */
    1095             :                 if (skb->pkt_type == PACKET_MULTICAST ||
    1096             :                     skb->pkt_type == PACKET_BROADCAST)
    1097             :                         dropped = igmp_heard_report(in_dev, ih->group);
    1098             :                 break;
    1099             :         case IGMP_PIM:
    1100             : #ifdef CONFIG_IP_PIMSM_V1
    1101             :                 return pim_rcv_v1(skb);
    1102             : #endif
    1103             :         case IGMPV3_HOST_MEMBERSHIP_REPORT:
    1104             :         case IGMP_DVMRP:
    1105             :         case IGMP_TRACE:
    1106             :         case IGMP_HOST_LEAVE_MESSAGE:
    1107             :         case IGMP_MTRACE:
    1108             :         case IGMP_MTRACE_RESP:
    1109             :                 break;
    1110             :         default:
    1111             :                 break;
    1112             :         }
    1113             : 
    1114             : drop:
    1115             :         if (dropped)
    1116             :                 kfree_skb(skb);
    1117             :         else
    1118             :                 consume_skb(skb);
    1119             :         return 0;
    1120             : }
    1121             : 
    1122             : #endif
    1123             : 
    1124             : 
    1125             : /*
    1126             :  *      Add a filter to a device
    1127             :  */
    1128             : 
    1129           2 : static void ip_mc_filter_add(struct in_device *in_dev, __be32 addr)
    1130             : {
    1131           2 :         char buf[MAX_ADDR_LEN];
    1132           2 :         struct net_device *dev = in_dev->dev;
    1133             : 
    1134             :         /* Checking for IFF_MULTICAST here is WRONG-WRONG-WRONG.
    1135             :            We will get multicast token leakage, when IFF_MULTICAST
    1136             :            is changed. This check should be done in ndo_set_rx_mode
    1137             :            routine. Something sort of:
    1138             :            if (dev->mc_list && dev->flags&IFF_MULTICAST) { do it; }
    1139             :            --ANK
    1140             :            */
    1141           2 :         if (arp_mc_map(addr, buf, dev, 0) == 0)
    1142           1 :                 dev_mc_add(dev, buf);
    1143           2 : }
    1144             : 
    1145             : /*
    1146             :  *      Remove a filter from a device
    1147             :  */
    1148             : 
    1149           0 : static void ip_mc_filter_del(struct in_device *in_dev, __be32 addr)
    1150             : {
    1151           0 :         char buf[MAX_ADDR_LEN];
    1152           0 :         struct net_device *dev = in_dev->dev;
    1153             : 
    1154           0 :         if (arp_mc_map(addr, buf, dev, 0) == 0)
    1155           0 :                 dev_mc_del(dev, buf);
    1156           0 : }
    1157             : 
    1158             : #ifdef CONFIG_IP_MULTICAST
    1159             : /*
    1160             :  * deleted ip_mc_list manipulation
    1161             :  */
    1162             : static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im,
    1163             :                               gfp_t gfp)
    1164             : {
    1165             :         struct ip_mc_list *pmc;
    1166             :         struct net *net = dev_net(in_dev->dev);
    1167             : 
    1168             :         /* this is an "ip_mc_list" for convenience; only the fields below
    1169             :          * are actually used. In particular, the refcnt and users are not
    1170             :          * used for management of the delete list. Using the same structure
    1171             :          * for deleted items allows change reports to use common code with
    1172             :          * non-deleted or query-response MCA's.
    1173             :          */
    1174             :         pmc = kzalloc(sizeof(*pmc), gfp);
    1175             :         if (!pmc)
    1176             :                 return;
    1177             :         spin_lock_init(&pmc->lock);
    1178             :         spin_lock_bh(&im->lock);
    1179             :         pmc->interface = im->interface;
    1180             :         in_dev_hold(in_dev);
    1181             :         pmc->multiaddr = im->multiaddr;
    1182             :         pmc->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
    1183             :         pmc->sfmode = im->sfmode;
    1184             :         if (pmc->sfmode == MCAST_INCLUDE) {
    1185             :                 struct ip_sf_list *psf;
    1186             : 
    1187             :                 pmc->tomb = im->tomb;
    1188             :                 pmc->sources = im->sources;
    1189             :                 im->tomb = im->sources = NULL;
    1190             :                 for (psf = pmc->sources; psf; psf = psf->sf_next)
    1191             :                         psf->sf_crcount = pmc->crcount;
    1192             :         }
    1193             :         spin_unlock_bh(&im->lock);
    1194             : 
    1195             :         spin_lock_bh(&in_dev->mc_tomb_lock);
    1196             :         pmc->next = in_dev->mc_tomb;
    1197             :         in_dev->mc_tomb = pmc;
    1198             :         spin_unlock_bh(&in_dev->mc_tomb_lock);
    1199             : }
    1200             : 
    1201             : /*
    1202             :  * restore ip_mc_list deleted records
    1203             :  */
    1204             : static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
    1205             : {
    1206             :         struct ip_mc_list *pmc, *pmc_prev;
    1207             :         struct ip_sf_list *psf;
    1208             :         struct net *net = dev_net(in_dev->dev);
    1209             :         __be32 multiaddr = im->multiaddr;
    1210             : 
    1211             :         spin_lock_bh(&in_dev->mc_tomb_lock);
    1212             :         pmc_prev = NULL;
    1213             :         for (pmc = in_dev->mc_tomb; pmc; pmc = pmc->next) {
    1214             :                 if (pmc->multiaddr == multiaddr)
    1215             :                         break;
    1216             :                 pmc_prev = pmc;
    1217             :         }
    1218             :         if (pmc) {
    1219             :                 if (pmc_prev)
    1220             :                         pmc_prev->next = pmc->next;
    1221             :                 else
    1222             :                         in_dev->mc_tomb = pmc->next;
    1223             :         }
    1224             :         spin_unlock_bh(&in_dev->mc_tomb_lock);
    1225             : 
    1226             :         spin_lock_bh(&im->lock);
    1227             :         if (pmc) {
    1228             :                 im->interface = pmc->interface;
    1229             :                 if (im->sfmode == MCAST_INCLUDE) {
    1230             :                         swap(im->tomb, pmc->tomb);
    1231             :                         swap(im->sources, pmc->sources);
    1232             :                         for (psf = im->sources; psf; psf = psf->sf_next)
    1233             :                                 psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
    1234             :                 } else {
    1235             :                         im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
    1236             :                 }
    1237             :                 in_dev_put(pmc->interface);
    1238             :                 kfree_pmc(pmc);
    1239             :         }
    1240             :         spin_unlock_bh(&im->lock);
    1241             : }
    1242             : 
    1243             : /*
    1244             :  * flush ip_mc_list deleted records
    1245             :  */
    1246             : static void igmpv3_clear_delrec(struct in_device *in_dev)
    1247             : {
    1248             :         struct ip_mc_list *pmc, *nextpmc;
    1249             : 
    1250             :         spin_lock_bh(&in_dev->mc_tomb_lock);
    1251             :         pmc = in_dev->mc_tomb;
    1252             :         in_dev->mc_tomb = NULL;
    1253             :         spin_unlock_bh(&in_dev->mc_tomb_lock);
    1254             : 
    1255             :         for (; pmc; pmc = nextpmc) {
    1256             :                 nextpmc = pmc->next;
    1257             :                 ip_mc_clear_src(pmc);
    1258             :                 in_dev_put(pmc->interface);
    1259             :                 kfree_pmc(pmc);
    1260             :         }
    1261             :         /* clear dead sources, too */
    1262             :         rcu_read_lock();
    1263             :         for_each_pmc_rcu(in_dev, pmc) {
    1264             :                 struct ip_sf_list *psf;
    1265             : 
    1266             :                 spin_lock_bh(&pmc->lock);
    1267             :                 psf = pmc->tomb;
    1268             :                 pmc->tomb = NULL;
    1269             :                 spin_unlock_bh(&pmc->lock);
    1270             :                 ip_sf_list_clear_all(psf);
    1271             :         }
    1272             :         rcu_read_unlock();
    1273             : }
    1274             : #endif
    1275             : 
    1276           0 : static void __igmp_group_dropped(struct ip_mc_list *im, gfp_t gfp)
    1277             : {
    1278           0 :         struct in_device *in_dev = im->interface;
    1279             : #ifdef CONFIG_IP_MULTICAST
    1280             :         struct net *net = dev_net(in_dev->dev);
    1281             :         int reporter;
    1282             : #endif
    1283             : 
    1284           0 :         if (im->loaded) {
    1285           0 :                 im->loaded = 0;
    1286           0 :                 ip_mc_filter_del(in_dev, im->multiaddr);
    1287             :         }
    1288             : 
    1289             : #ifdef CONFIG_IP_MULTICAST
    1290             :         if (im->multiaddr == IGMP_ALL_HOSTS)
    1291             :                 return;
    1292             :         if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports)
    1293             :                 return;
    1294             : 
    1295             :         reporter = im->reporter;
    1296             :         igmp_stop_timer(im);
    1297             : 
    1298             :         if (!in_dev->dead) {
    1299             :                 if (IGMP_V1_SEEN(in_dev))
    1300             :                         return;
    1301             :                 if (IGMP_V2_SEEN(in_dev)) {
    1302             :                         if (reporter)
    1303             :                                 igmp_send_report(in_dev, im, IGMP_HOST_LEAVE_MESSAGE);
    1304             :                         return;
    1305             :                 }
    1306             :                 /* IGMPv3 */
    1307             :                 igmpv3_add_delrec(in_dev, im, gfp);
    1308             : 
    1309             :                 igmp_ifc_event(in_dev);
    1310             :         }
    1311             : #endif
    1312           0 : }
    1313             : 
    1314           0 : static void igmp_group_dropped(struct ip_mc_list *im)
    1315             : {
    1316           0 :         __igmp_group_dropped(im, GFP_KERNEL);
    1317             : }
    1318             : 
    1319           4 : static void igmp_group_added(struct ip_mc_list *im)
    1320             : {
    1321           4 :         struct in_device *in_dev = im->interface;
    1322             : #ifdef CONFIG_IP_MULTICAST
    1323             :         struct net *net = dev_net(in_dev->dev);
    1324             : #endif
    1325             : 
    1326           4 :         if (im->loaded == 0) {
    1327           2 :                 im->loaded = 1;
    1328           2 :                 ip_mc_filter_add(in_dev, im->multiaddr);
    1329             :         }
    1330             : 
    1331             : #ifdef CONFIG_IP_MULTICAST
    1332             :         if (im->multiaddr == IGMP_ALL_HOSTS)
    1333             :                 return;
    1334             :         if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports)
    1335             :                 return;
    1336             : 
    1337             :         if (in_dev->dead)
    1338             :                 return;
    1339             : 
    1340             :         im->unsolicit_count = net->ipv4.sysctl_igmp_qrv;
    1341             :         if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev)) {
    1342             :                 spin_lock_bh(&im->lock);
    1343             :                 igmp_start_timer(im, IGMP_INITIAL_REPORT_DELAY);
    1344             :                 spin_unlock_bh(&im->lock);
    1345             :                 return;
    1346             :         }
    1347             :         /* else, v3 */
    1348             : 
    1349             :         /* Based on RFC3376 5.1, for newly added INCLUDE SSM, we should
    1350             :          * not send filter-mode change record as the mode should be from
    1351             :          * IN() to IN(A).
    1352             :          */
    1353             :         if (im->sfmode == MCAST_EXCLUDE)
    1354             :                 im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
    1355             : 
    1356             :         igmp_ifc_event(in_dev);
    1357             : #endif
    1358           4 : }
    1359             : 
    1360             : 
    1361             : /*
    1362             :  *      Multicast list managers
    1363             :  */
    1364             : 
    1365           0 : static u32 ip_mc_hash(const struct ip_mc_list *im)
    1366             : {
    1367           0 :         return hash_32((__force u32)im->multiaddr, MC_HASH_SZ_LOG);
    1368             : }
    1369             : 
    1370           2 : static void ip_mc_hash_add(struct in_device *in_dev,
    1371             :                            struct ip_mc_list *im)
    1372             : {
    1373           2 :         struct ip_mc_list __rcu **mc_hash;
    1374           2 :         u32 hash;
    1375             : 
    1376           2 :         mc_hash = rtnl_dereference(in_dev->mc_hash);
    1377           2 :         if (mc_hash) {
    1378           0 :                 hash = ip_mc_hash(im);
    1379           0 :                 im->next_hash = mc_hash[hash];
    1380           0 :                 rcu_assign_pointer(mc_hash[hash], im);
    1381           0 :                 return;
    1382             :         }
    1383             : 
    1384             :         /* do not use a hash table for small number of items */
    1385           2 :         if (in_dev->mc_count < 4)
    1386             :                 return;
    1387             : 
    1388           0 :         mc_hash = kzalloc(sizeof(struct ip_mc_list *) << MC_HASH_SZ_LOG,
    1389             :                           GFP_KERNEL);
    1390           0 :         if (!mc_hash)
    1391             :                 return;
    1392             : 
    1393           0 :         for_each_pmc_rtnl(in_dev, im) {
    1394           0 :                 hash = ip_mc_hash(im);
    1395           0 :                 im->next_hash = mc_hash[hash];
    1396           0 :                 RCU_INIT_POINTER(mc_hash[hash], im);
    1397             :         }
    1398             : 
    1399           0 :         rcu_assign_pointer(in_dev->mc_hash, mc_hash);
    1400             : }
    1401             : 
    1402           0 : static void ip_mc_hash_remove(struct in_device *in_dev,
    1403             :                               struct ip_mc_list *im)
    1404             : {
    1405           0 :         struct ip_mc_list __rcu **mc_hash = rtnl_dereference(in_dev->mc_hash);
    1406           0 :         struct ip_mc_list *aux;
    1407             : 
    1408           0 :         if (!mc_hash)
    1409             :                 return;
    1410           0 :         mc_hash += ip_mc_hash(im);
    1411           0 :         while ((aux = rtnl_dereference(*mc_hash)) != im)
    1412           0 :                 mc_hash = &aux->next_hash;
    1413           0 :         *mc_hash = im->next_hash;
    1414             : }
    1415             : 
    1416             : 
    1417             : /*
    1418             :  *      A socket has joined a multicast group on device dev.
    1419             :  */
    1420           2 : static void ____ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
    1421             :                                 unsigned int mode, gfp_t gfp)
    1422             : {
    1423           2 :         struct ip_mc_list *im;
    1424             : 
    1425           2 :         ASSERT_RTNL();
    1426             : 
    1427           2 :         for_each_pmc_rtnl(in_dev, im) {
    1428           0 :                 if (im->multiaddr == addr) {
    1429           0 :                         im->users++;
    1430           0 :                         ip_mc_add_src(in_dev, &addr, mode, 0, NULL, 0);
    1431           0 :                         goto out;
    1432             :                 }
    1433             :         }
    1434             : 
    1435           2 :         im = kzalloc(sizeof(*im), gfp);
    1436           2 :         if (!im)
    1437           0 :                 goto out;
    1438             : 
    1439           2 :         im->users = 1;
    1440           2 :         im->interface = in_dev;
    1441           2 :         in_dev_hold(in_dev);
    1442           2 :         im->multiaddr = addr;
    1443             :         /* initial mode is (EX, empty) */
    1444           2 :         im->sfmode = mode;
    1445           2 :         im->sfcount[mode] = 1;
    1446           2 :         refcount_set(&im->refcnt, 1);
    1447           2 :         spin_lock_init(&im->lock);
    1448             : #ifdef CONFIG_IP_MULTICAST
    1449             :         timer_setup(&im->timer, igmp_timer_expire, 0);
    1450             : #endif
    1451             : 
    1452           2 :         im->next_rcu = in_dev->mc_list;
    1453           2 :         in_dev->mc_count++;
    1454           2 :         rcu_assign_pointer(in_dev->mc_list, im);
    1455             : 
    1456           2 :         ip_mc_hash_add(in_dev, im);
    1457             : 
    1458             : #ifdef CONFIG_IP_MULTICAST
    1459             :         igmpv3_del_delrec(in_dev, im);
    1460             : #endif
    1461           2 :         igmp_group_added(im);
    1462           2 :         if (!in_dev->dead)
    1463           2 :                 ip_rt_multicast_event(in_dev);
    1464           0 : out:
    1465           2 :         return;
    1466             : }
    1467             : 
    1468           2 : void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr, gfp_t gfp)
    1469             : {
    1470           0 :         ____ip_mc_inc_group(in_dev, addr, MCAST_EXCLUDE, gfp);
    1471           0 : }
    1472             : EXPORT_SYMBOL(__ip_mc_inc_group);
    1473             : 
    1474           2 : void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
    1475             : {
    1476           0 :         __ip_mc_inc_group(in_dev, addr, GFP_KERNEL);
    1477           0 : }
    1478             : EXPORT_SYMBOL(ip_mc_inc_group);
    1479             : 
    1480           0 : static int ip_mc_check_iphdr(struct sk_buff *skb)
    1481             : {
    1482           0 :         const struct iphdr *iph;
    1483           0 :         unsigned int len;
    1484           0 :         unsigned int offset = skb_network_offset(skb) + sizeof(*iph);
    1485             : 
    1486           0 :         if (!pskb_may_pull(skb, offset))
    1487             :                 return -EINVAL;
    1488             : 
    1489           0 :         iph = ip_hdr(skb);
    1490             : 
    1491           0 :         if (iph->version != 4 || ip_hdrlen(skb) < sizeof(*iph))
    1492             :                 return -EINVAL;
    1493             : 
    1494           0 :         offset += ip_hdrlen(skb) - sizeof(*iph);
    1495             : 
    1496           0 :         if (!pskb_may_pull(skb, offset))
    1497             :                 return -EINVAL;
    1498             : 
    1499           0 :         iph = ip_hdr(skb);
    1500             : 
    1501           0 :         if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
    1502             :                 return -EINVAL;
    1503             : 
    1504           0 :         len = skb_network_offset(skb) + ntohs(iph->tot_len);
    1505           0 :         if (skb->len < len || len < offset)
    1506             :                 return -EINVAL;
    1507             : 
    1508           0 :         skb_set_transport_header(skb, offset);
    1509             : 
    1510           0 :         return 0;
    1511             : }
    1512             : 
    1513           0 : static int ip_mc_check_igmp_reportv3(struct sk_buff *skb)
    1514             : {
    1515           0 :         unsigned int len = skb_transport_offset(skb);
    1516             : 
    1517           0 :         len += sizeof(struct igmpv3_report);
    1518             : 
    1519           0 :         return ip_mc_may_pull(skb, len) ? 0 : -EINVAL;
    1520             : }
    1521             : 
    1522           0 : static int ip_mc_check_igmp_query(struct sk_buff *skb)
    1523             : {
    1524           0 :         unsigned int transport_len = ip_transport_len(skb);
    1525           0 :         unsigned int len;
    1526             : 
    1527             :         /* IGMPv{1,2}? */
    1528           0 :         if (transport_len != sizeof(struct igmphdr)) {
    1529             :                 /* or IGMPv3? */
    1530           0 :                 if (transport_len < sizeof(struct igmpv3_query))
    1531             :                         return -EINVAL;
    1532             : 
    1533           0 :                 len = skb_transport_offset(skb) + sizeof(struct igmpv3_query);
    1534           0 :                 if (!ip_mc_may_pull(skb, len))
    1535             :                         return -EINVAL;
    1536             :         }
    1537             : 
    1538             :         /* RFC2236+RFC3376 (IGMPv2+IGMPv3) require the multicast link layer
    1539             :          * all-systems destination addresses (224.0.0.1) for general queries
    1540             :          */
    1541           0 :         if (!igmp_hdr(skb)->group &&
    1542           0 :             ip_hdr(skb)->daddr != htonl(INADDR_ALLHOSTS_GROUP))
    1543           0 :                 return -EINVAL;
    1544             : 
    1545             :         return 0;
    1546             : }
    1547             : 
    1548           0 : static int ip_mc_check_igmp_msg(struct sk_buff *skb)
    1549             : {
    1550           0 :         switch (igmp_hdr(skb)->type) {
    1551             :         case IGMP_HOST_LEAVE_MESSAGE:
    1552             :         case IGMP_HOST_MEMBERSHIP_REPORT:
    1553             :         case IGMPV2_HOST_MEMBERSHIP_REPORT:
    1554             :                 return 0;
    1555           0 :         case IGMPV3_HOST_MEMBERSHIP_REPORT:
    1556           0 :                 return ip_mc_check_igmp_reportv3(skb);
    1557           0 :         case IGMP_HOST_MEMBERSHIP_QUERY:
    1558           0 :                 return ip_mc_check_igmp_query(skb);
    1559           0 :         default:
    1560           0 :                 return -ENOMSG;
    1561             :         }
    1562             : }
    1563             : 
    1564           0 : static __sum16 ip_mc_validate_checksum(struct sk_buff *skb)
    1565             : {
    1566           0 :         return skb_checksum_simple_validate(skb);
    1567             : }
    1568             : 
    1569           0 : static int ip_mc_check_igmp_csum(struct sk_buff *skb)
    1570             : {
    1571           0 :         unsigned int len = skb_transport_offset(skb) + sizeof(struct igmphdr);
    1572           0 :         unsigned int transport_len = ip_transport_len(skb);
    1573           0 :         struct sk_buff *skb_chk;
    1574             : 
    1575           0 :         if (!ip_mc_may_pull(skb, len))
    1576             :                 return -EINVAL;
    1577             : 
    1578           0 :         skb_chk = skb_checksum_trimmed(skb, transport_len,
    1579             :                                        ip_mc_validate_checksum);
    1580           0 :         if (!skb_chk)
    1581             :                 return -EINVAL;
    1582             : 
    1583           0 :         if (skb_chk != skb)
    1584           0 :                 kfree_skb(skb_chk);
    1585             : 
    1586             :         return 0;
    1587             : }
    1588             : 
    1589             : /**
    1590             :  * ip_mc_check_igmp - checks whether this is a sane IGMP packet
    1591             :  * @skb: the skb to validate
    1592             :  *
    1593             :  * Checks whether an IPv4 packet is a valid IGMP packet. If so sets
    1594             :  * skb transport header accordingly and returns zero.
    1595             :  *
    1596             :  * -EINVAL: A broken packet was detected, i.e. it violates some internet
    1597             :  *  standard
    1598             :  * -ENOMSG: IP header validation succeeded but it is not an IGMP packet.
    1599             :  * -ENOMEM: A memory allocation failure happened.
    1600             :  *
    1601             :  * Caller needs to set the skb network header and free any returned skb if it
    1602             :  * differs from the provided skb.
    1603             :  */
    1604           0 : int ip_mc_check_igmp(struct sk_buff *skb)
    1605             : {
    1606           0 :         int ret = ip_mc_check_iphdr(skb);
    1607             : 
    1608           0 :         if (ret < 0)
    1609             :                 return ret;
    1610             : 
    1611           0 :         if (ip_hdr(skb)->protocol != IPPROTO_IGMP)
    1612             :                 return -ENOMSG;
    1613             : 
    1614           0 :         ret = ip_mc_check_igmp_csum(skb);
    1615           0 :         if (ret < 0)
    1616             :                 return ret;
    1617             : 
    1618           0 :         return ip_mc_check_igmp_msg(skb);
    1619             : }
    1620             : EXPORT_SYMBOL(ip_mc_check_igmp);
    1621             : 
    1622             : /*
    1623             :  *      Resend IGMP JOIN report; used by netdev notifier.
    1624             :  */
    1625             : static void ip_mc_rejoin_groups(struct in_device *in_dev)
    1626             : {
    1627             : #ifdef CONFIG_IP_MULTICAST
    1628             :         struct ip_mc_list *im;
    1629             :         int type;
    1630             :         struct net *net = dev_net(in_dev->dev);
    1631             : 
    1632             :         ASSERT_RTNL();
    1633             : 
    1634             :         for_each_pmc_rtnl(in_dev, im) {
    1635             :                 if (im->multiaddr == IGMP_ALL_HOSTS)
    1636             :                         continue;
    1637             :                 if (ipv4_is_local_multicast(im->multiaddr) &&
    1638             :                     !net->ipv4.sysctl_igmp_llm_reports)
    1639             :                         continue;
    1640             : 
    1641             :                 /* a failover is happening and switches
    1642             :                  * must be notified immediately
    1643             :                  */
    1644             :                 if (IGMP_V1_SEEN(in_dev))
    1645             :                         type = IGMP_HOST_MEMBERSHIP_REPORT;
    1646             :                 else if (IGMP_V2_SEEN(in_dev))
    1647             :                         type = IGMPV2_HOST_MEMBERSHIP_REPORT;
    1648             :                 else
    1649             :                         type = IGMPV3_HOST_MEMBERSHIP_REPORT;
    1650             :                 igmp_send_report(in_dev, im, type);
    1651             :         }
    1652             : #endif
    1653             : }
    1654             : 
    1655             : /*
    1656             :  *      A socket has left a multicast group on device dev
    1657             :  */
    1658             : 
    1659           0 : void __ip_mc_dec_group(struct in_device *in_dev, __be32 addr, gfp_t gfp)
    1660             : {
    1661           0 :         struct ip_mc_list *i;
    1662           0 :         struct ip_mc_list __rcu **ip;
    1663             : 
    1664           0 :         ASSERT_RTNL();
    1665             : 
    1666           0 :         for (ip = &in_dev->mc_list;
    1667           0 :              (i = rtnl_dereference(*ip)) != NULL;
    1668           0 :              ip = &i->next_rcu) {
    1669           0 :                 if (i->multiaddr == addr) {
    1670           0 :                         if (--i->users == 0) {
    1671           0 :                                 ip_mc_hash_remove(in_dev, i);
    1672           0 :                                 *ip = i->next_rcu;
    1673           0 :                                 in_dev->mc_count--;
    1674           0 :                                 __igmp_group_dropped(i, gfp);
    1675           0 :                                 ip_mc_clear_src(i);
    1676             : 
    1677           0 :                                 if (!in_dev->dead)
    1678           0 :                                         ip_rt_multicast_event(in_dev);
    1679             : 
    1680           0 :                                 ip_ma_put(i);
    1681           0 :                                 return;
    1682             :                         }
    1683             :                         break;
    1684             :                 }
    1685             :         }
    1686             : }
    1687             : EXPORT_SYMBOL(__ip_mc_dec_group);
    1688             : 
    1689             : /* Device changing type */
    1690             : 
    1691           0 : void ip_mc_unmap(struct in_device *in_dev)
    1692             : {
    1693           0 :         struct ip_mc_list *pmc;
    1694             : 
    1695           0 :         ASSERT_RTNL();
    1696             : 
    1697           0 :         for_each_pmc_rtnl(in_dev, pmc)
    1698           0 :                 igmp_group_dropped(pmc);
    1699           0 : }
    1700             : 
    1701           0 : void ip_mc_remap(struct in_device *in_dev)
    1702             : {
    1703           0 :         struct ip_mc_list *pmc;
    1704             : 
    1705           0 :         ASSERT_RTNL();
    1706             : 
    1707           0 :         for_each_pmc_rtnl(in_dev, pmc) {
    1708             : #ifdef CONFIG_IP_MULTICAST
    1709             :                 igmpv3_del_delrec(in_dev, pmc);
    1710             : #endif
    1711           0 :                 igmp_group_added(pmc);
    1712             :         }
    1713           0 : }
    1714             : 
    1715             : /* Device going down */
    1716             : 
    1717           0 : void ip_mc_down(struct in_device *in_dev)
    1718             : {
    1719           0 :         struct ip_mc_list *pmc;
    1720             : 
    1721           0 :         ASSERT_RTNL();
    1722             : 
    1723           0 :         for_each_pmc_rtnl(in_dev, pmc)
    1724           0 :                 igmp_group_dropped(pmc);
    1725             : 
    1726             : #ifdef CONFIG_IP_MULTICAST
    1727             :         in_dev->mr_ifc_count = 0;
    1728             :         if (del_timer(&in_dev->mr_ifc_timer))
    1729             :                 __in_dev_put(in_dev);
    1730             :         in_dev->mr_gq_running = 0;
    1731             :         if (del_timer(&in_dev->mr_gq_timer))
    1732             :                 __in_dev_put(in_dev);
    1733             : #endif
    1734             : 
    1735           0 :         ip_mc_dec_group(in_dev, IGMP_ALL_HOSTS);
    1736           0 : }
    1737             : 
    1738             : #ifdef CONFIG_IP_MULTICAST
    1739             : static void ip_mc_reset(struct in_device *in_dev)
    1740             : {
    1741             :         struct net *net = dev_net(in_dev->dev);
    1742             : 
    1743             :         in_dev->mr_qi = IGMP_QUERY_INTERVAL;
    1744             :         in_dev->mr_qri = IGMP_QUERY_RESPONSE_INTERVAL;
    1745             :         in_dev->mr_qrv = net->ipv4.sysctl_igmp_qrv;
    1746             : }
    1747             : #else
    1748           4 : static void ip_mc_reset(struct in_device *in_dev)
    1749             : {
    1750           4 : }
    1751             : #endif
    1752             : 
    1753           2 : void ip_mc_init_dev(struct in_device *in_dev)
    1754             : {
    1755           2 :         ASSERT_RTNL();
    1756             : 
    1757             : #ifdef CONFIG_IP_MULTICAST
    1758             :         timer_setup(&in_dev->mr_gq_timer, igmp_gq_timer_expire, 0);
    1759             :         timer_setup(&in_dev->mr_ifc_timer, igmp_ifc_timer_expire, 0);
    1760             : #endif
    1761           2 :         ip_mc_reset(in_dev);
    1762             : 
    1763           2 :         spin_lock_init(&in_dev->mc_tomb_lock);
    1764           2 : }
    1765             : 
    1766             : /* Device going up */
    1767             : 
    1768           2 : void ip_mc_up(struct in_device *in_dev)
    1769             : {
    1770           2 :         struct ip_mc_list *pmc;
    1771             : 
    1772           2 :         ASSERT_RTNL();
    1773             : 
    1774           2 :         ip_mc_reset(in_dev);
    1775           2 :         ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
    1776             : 
    1777           4 :         for_each_pmc_rtnl(in_dev, pmc) {
    1778             : #ifdef CONFIG_IP_MULTICAST
    1779             :                 igmpv3_del_delrec(in_dev, pmc);
    1780             : #endif
    1781           2 :                 igmp_group_added(pmc);
    1782             :         }
    1783           2 : }
    1784             : 
    1785             : /*
    1786             :  *      Device is about to be destroyed: clean up.
    1787             :  */
    1788             : 
    1789           0 : void ip_mc_destroy_dev(struct in_device *in_dev)
    1790             : {
    1791           0 :         struct ip_mc_list *i;
    1792             : 
    1793           0 :         ASSERT_RTNL();
    1794             : 
    1795             :         /* Deactivate timers */
    1796           0 :         ip_mc_down(in_dev);
    1797             : #ifdef CONFIG_IP_MULTICAST
    1798             :         igmpv3_clear_delrec(in_dev);
    1799             : #endif
    1800             : 
    1801           0 :         while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) {
    1802           0 :                 in_dev->mc_list = i->next_rcu;
    1803           0 :                 in_dev->mc_count--;
    1804           0 :                 ip_ma_put(i);
    1805             :         }
    1806           0 : }
    1807             : 
    1808             : /* RTNL is locked */
    1809           0 : static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
    1810             : {
    1811           0 :         struct net_device *dev = NULL;
    1812           0 :         struct in_device *idev = NULL;
    1813             : 
    1814           0 :         if (imr->imr_ifindex) {
    1815           0 :                 idev = inetdev_by_index(net, imr->imr_ifindex);
    1816           0 :                 return idev;
    1817             :         }
    1818           0 :         if (imr->imr_address.s_addr) {
    1819           0 :                 dev = __ip_dev_find(net, imr->imr_address.s_addr, false);
    1820           0 :                 if (!dev)
    1821             :                         return NULL;
    1822             :         }
    1823             : 
    1824           0 :         if (!dev) {
    1825           0 :                 struct rtable *rt = ip_route_output(net,
    1826             :                                                     imr->imr_multiaddr.s_addr,
    1827             :                                                     0, 0, 0);
    1828           0 :                 if (!IS_ERR(rt)) {
    1829           0 :                         dev = rt->dst.dev;
    1830           0 :                         ip_rt_put(rt);
    1831             :                 }
    1832             :         }
    1833           0 :         if (dev) {
    1834           0 :                 imr->imr_ifindex = dev->ifindex;
    1835           0 :                 idev = __in_dev_get_rtnl(dev);
    1836             :         }
    1837             :         return idev;
    1838             : }
    1839             : 
    1840             : /*
    1841             :  *      Join a socket to a group
    1842             :  */
    1843             : 
    1844           0 : static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
    1845             :         __be32 *psfsrc)
    1846             : {
    1847           0 :         struct ip_sf_list *psf, *psf_prev;
    1848           0 :         int rv = 0;
    1849             : 
    1850           0 :         psf_prev = NULL;
    1851           0 :         for (psf = pmc->sources; psf; psf = psf->sf_next) {
    1852           0 :                 if (psf->sf_inaddr == *psfsrc)
    1853             :                         break;
    1854           0 :                 psf_prev = psf;
    1855             :         }
    1856           0 :         if (!psf || psf->sf_count[sfmode] == 0) {
    1857             :                 /* source filter not found, or count wrong =>  bug */
    1858             :                 return -ESRCH;
    1859             :         }
    1860           0 :         psf->sf_count[sfmode]--;
    1861           0 :         if (psf->sf_count[sfmode] == 0) {
    1862           0 :                 ip_rt_multicast_event(pmc->interface);
    1863             :         }
    1864           0 :         if (!psf->sf_count[MCAST_INCLUDE] && !psf->sf_count[MCAST_EXCLUDE]) {
    1865             : #ifdef CONFIG_IP_MULTICAST
    1866             :                 struct in_device *in_dev = pmc->interface;
    1867             :                 struct net *net = dev_net(in_dev->dev);
    1868             : #endif
    1869             : 
    1870             :                 /* no more filters for this source */
    1871           0 :                 if (psf_prev)
    1872           0 :                         psf_prev->sf_next = psf->sf_next;
    1873             :                 else
    1874           0 :                         pmc->sources = psf->sf_next;
    1875             : #ifdef CONFIG_IP_MULTICAST
    1876             :                 if (psf->sf_oldin &&
    1877             :                     !IGMP_V1_SEEN(in_dev) && !IGMP_V2_SEEN(in_dev)) {
    1878             :                         psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
    1879             :                         psf->sf_next = pmc->tomb;
    1880             :                         pmc->tomb = psf;
    1881             :                         rv = 1;
    1882             :                 } else
    1883             : #endif
    1884           0 :                         kfree(psf);
    1885             :         }
    1886             :         return rv;
    1887             : }
    1888             : 
    1889             : #ifndef CONFIG_IP_MULTICAST
    1890             : #define igmp_ifc_event(x)       do { } while (0)
    1891             : #endif
    1892             : 
    1893           0 : static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
    1894             :                          int sfcount, __be32 *psfsrc, int delta)
    1895             : {
    1896           0 :         struct ip_mc_list *pmc;
    1897           0 :         int     changerec = 0;
    1898           0 :         int     i, err;
    1899             : 
    1900           0 :         if (!in_dev)
    1901             :                 return -ENODEV;
    1902           0 :         rcu_read_lock();
    1903           0 :         for_each_pmc_rcu(in_dev, pmc) {
    1904           0 :                 if (*pmca == pmc->multiaddr)
    1905             :                         break;
    1906             :         }
    1907           0 :         if (!pmc) {
    1908             :                 /* MCA not found?? bug */
    1909           0 :                 rcu_read_unlock();
    1910           0 :                 return -ESRCH;
    1911             :         }
    1912           0 :         spin_lock_bh(&pmc->lock);
    1913           0 :         rcu_read_unlock();
    1914             : #ifdef CONFIG_IP_MULTICAST
    1915             :         sf_markstate(pmc);
    1916             : #endif
    1917           0 :         if (!delta) {
    1918           0 :                 err = -EINVAL;
    1919           0 :                 if (!pmc->sfcount[sfmode])
    1920           0 :                         goto out_unlock;
    1921           0 :                 pmc->sfcount[sfmode]--;
    1922             :         }
    1923             :         err = 0;
    1924           0 :         for (i = 0; i < sfcount; i++) {
    1925           0 :                 int rv = ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
    1926             : 
    1927           0 :                 changerec |= rv > 0;
    1928           0 :                 if (!err && rv < 0)
    1929           0 :                         err = rv;
    1930             :         }
    1931           0 :         if (pmc->sfmode == MCAST_EXCLUDE &&
    1932           0 :             pmc->sfcount[MCAST_EXCLUDE] == 0 &&
    1933           0 :             pmc->sfcount[MCAST_INCLUDE]) {
    1934             : #ifdef CONFIG_IP_MULTICAST
    1935             :                 struct ip_sf_list *psf;
    1936             :                 struct net *net = dev_net(in_dev->dev);
    1937             : #endif
    1938             : 
    1939             :                 /* filter mode change */
    1940           0 :                 pmc->sfmode = MCAST_INCLUDE;
    1941             : #ifdef CONFIG_IP_MULTICAST
    1942             :                 pmc->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
    1943             :                 in_dev->mr_ifc_count = pmc->crcount;
    1944             :                 for (psf = pmc->sources; psf; psf = psf->sf_next)
    1945             :                         psf->sf_crcount = 0;
    1946             :                 igmp_ifc_event(pmc->interface);
    1947             :         } else if (sf_setstate(pmc) || changerec) {
    1948             :                 igmp_ifc_event(pmc->interface);
    1949             : #endif
    1950             :         }
    1951           0 : out_unlock:
    1952           0 :         spin_unlock_bh(&pmc->lock);
    1953           0 :         return err;
    1954             : }
    1955             : 
    1956             : /*
    1957             :  * Add multicast single-source filter to the interface list
    1958             :  */
    1959           0 : static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
    1960             :         __be32 *psfsrc)
    1961             : {
    1962           0 :         struct ip_sf_list *psf, *psf_prev;
    1963             : 
    1964           0 :         psf_prev = NULL;
    1965           0 :         for (psf = pmc->sources; psf; psf = psf->sf_next) {
    1966           0 :                 if (psf->sf_inaddr == *psfsrc)
    1967             :                         break;
    1968           0 :                 psf_prev = psf;
    1969             :         }
    1970           0 :         if (!psf) {
    1971           0 :                 psf = kzalloc(sizeof(*psf), GFP_ATOMIC);
    1972           0 :                 if (!psf)
    1973             :                         return -ENOBUFS;
    1974           0 :                 psf->sf_inaddr = *psfsrc;
    1975           0 :                 if (psf_prev) {
    1976           0 :                         psf_prev->sf_next = psf;
    1977             :                 } else
    1978           0 :                         pmc->sources = psf;
    1979             :         }
    1980           0 :         psf->sf_count[sfmode]++;
    1981           0 :         if (psf->sf_count[sfmode] == 1) {
    1982           0 :                 ip_rt_multicast_event(pmc->interface);
    1983             :         }
    1984             :         return 0;
    1985             : }
    1986             : 
    1987             : #ifdef CONFIG_IP_MULTICAST
    1988             : static void sf_markstate(struct ip_mc_list *pmc)
    1989             : {
    1990             :         struct ip_sf_list *psf;
    1991             :         int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
    1992             : 
    1993             :         for (psf = pmc->sources; psf; psf = psf->sf_next)
    1994             :                 if (pmc->sfcount[MCAST_EXCLUDE]) {
    1995             :                         psf->sf_oldin = mca_xcount ==
    1996             :                                 psf->sf_count[MCAST_EXCLUDE] &&
    1997             :                                 !psf->sf_count[MCAST_INCLUDE];
    1998             :                 } else
    1999             :                         psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
    2000             : }
    2001             : 
    2002             : static int sf_setstate(struct ip_mc_list *pmc)
    2003             : {
    2004             :         struct ip_sf_list *psf, *dpsf;
    2005             :         int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
    2006             :         int qrv = pmc->interface->mr_qrv;
    2007             :         int new_in, rv;
    2008             : 
    2009             :         rv = 0;
    2010             :         for (psf = pmc->sources; psf; psf = psf->sf_next) {
    2011             :                 if (pmc->sfcount[MCAST_EXCLUDE]) {
    2012             :                         new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
    2013             :                                 !psf->sf_count[MCAST_INCLUDE];
    2014             :                 } else
    2015             :                         new_in = psf->sf_count[MCAST_INCLUDE] != 0;
    2016             :                 if (new_in) {
    2017             :                         if (!psf->sf_oldin) {
    2018             :                                 struct ip_sf_list *prev = NULL;
    2019             : 
    2020             :                                 for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next) {
    2021             :                                         if (dpsf->sf_inaddr == psf->sf_inaddr)
    2022             :                                                 break;
    2023             :                                         prev = dpsf;
    2024             :                                 }
    2025             :                                 if (dpsf) {
    2026             :                                         if (prev)
    2027             :                                                 prev->sf_next = dpsf->sf_next;
    2028             :                                         else
    2029             :                                                 pmc->tomb = dpsf->sf_next;
    2030             :                                         kfree(dpsf);
    2031             :                                 }
    2032             :                                 psf->sf_crcount = qrv;
    2033             :                                 rv++;
    2034             :                         }
    2035             :                 } else if (psf->sf_oldin) {
    2036             : 
    2037             :                         psf->sf_crcount = 0;
    2038             :                         /*
    2039             :                          * add or update "delete" records if an active filter
    2040             :                          * is now inactive
    2041             :                          */
    2042             :                         for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next)
    2043             :                                 if (dpsf->sf_inaddr == psf->sf_inaddr)
    2044             :                                         break;
    2045             :                         if (!dpsf) {
    2046             :                                 dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
    2047             :                                 if (!dpsf)
    2048             :                                         continue;
    2049             :                                 *dpsf = *psf;
    2050             :                                 /* pmc->lock held by callers */
    2051             :                                 dpsf->sf_next = pmc->tomb;
    2052             :                                 pmc->tomb = dpsf;
    2053             :                         }
    2054             :                         dpsf->sf_crcount = qrv;
    2055             :                         rv++;
    2056             :                 }
    2057             :         }
    2058             :         return rv;
    2059             : }
    2060             : #endif
    2061             : 
    2062             : /*
    2063             :  * Add multicast source filter list to the interface list
    2064             :  */
    2065           0 : static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
    2066             :                          int sfcount, __be32 *psfsrc, int delta)
    2067             : {
    2068           0 :         struct ip_mc_list *pmc;
    2069           0 :         int     isexclude;
    2070           0 :         int     i, err;
    2071             : 
    2072           0 :         if (!in_dev)
    2073             :                 return -ENODEV;
    2074           0 :         rcu_read_lock();
    2075           0 :         for_each_pmc_rcu(in_dev, pmc) {
    2076           0 :                 if (*pmca == pmc->multiaddr)
    2077             :                         break;
    2078             :         }
    2079           0 :         if (!pmc) {
    2080             :                 /* MCA not found?? bug */
    2081           0 :                 rcu_read_unlock();
    2082           0 :                 return -ESRCH;
    2083             :         }
    2084           0 :         spin_lock_bh(&pmc->lock);
    2085           0 :         rcu_read_unlock();
    2086             : 
    2087             : #ifdef CONFIG_IP_MULTICAST
    2088             :         sf_markstate(pmc);
    2089             : #endif
    2090           0 :         isexclude = pmc->sfmode == MCAST_EXCLUDE;
    2091           0 :         if (!delta)
    2092           0 :                 pmc->sfcount[sfmode]++;
    2093             :         err = 0;
    2094           0 :         for (i = 0; i < sfcount; i++) {
    2095           0 :                 err = ip_mc_add1_src(pmc, sfmode, &psfsrc[i]);
    2096           0 :                 if (err)
    2097             :                         break;
    2098             :         }
    2099           0 :         if (err) {
    2100           0 :                 int j;
    2101             : 
    2102           0 :                 if (!delta)
    2103           0 :                         pmc->sfcount[sfmode]--;
    2104           0 :                 for (j = 0; j < i; j++)
    2105           0 :                         (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
    2106           0 :         } else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
    2107             : #ifdef CONFIG_IP_MULTICAST
    2108             :                 struct ip_sf_list *psf;
    2109             :                 struct net *net = dev_net(pmc->interface->dev);
    2110             :                 in_dev = pmc->interface;
    2111             : #endif
    2112             : 
    2113             :                 /* filter mode change */
    2114           0 :                 if (pmc->sfcount[MCAST_EXCLUDE])
    2115           0 :                         pmc->sfmode = MCAST_EXCLUDE;
    2116           0 :                 else if (pmc->sfcount[MCAST_INCLUDE])
    2117           0 :                         pmc->sfmode = MCAST_INCLUDE;
    2118             : #ifdef CONFIG_IP_MULTICAST
    2119             :                 /* else no filters; keep old mode for reports */
    2120             : 
    2121             :                 pmc->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
    2122             :                 in_dev->mr_ifc_count = pmc->crcount;
    2123             :                 for (psf = pmc->sources; psf; psf = psf->sf_next)
    2124             :                         psf->sf_crcount = 0;
    2125             :                 igmp_ifc_event(in_dev);
    2126             :         } else if (sf_setstate(pmc)) {
    2127             :                 igmp_ifc_event(in_dev);
    2128             : #endif
    2129             :         }
    2130           0 :         spin_unlock_bh(&pmc->lock);
    2131           0 :         return err;
    2132             : }
    2133             : 
    2134           0 : static void ip_mc_clear_src(struct ip_mc_list *pmc)
    2135             : {
    2136           0 :         struct ip_sf_list *tomb, *sources;
    2137             : 
    2138           0 :         spin_lock_bh(&pmc->lock);
    2139           0 :         tomb = pmc->tomb;
    2140           0 :         pmc->tomb = NULL;
    2141           0 :         sources = pmc->sources;
    2142           0 :         pmc->sources = NULL;
    2143           0 :         pmc->sfmode = MCAST_EXCLUDE;
    2144           0 :         pmc->sfcount[MCAST_INCLUDE] = 0;
    2145           0 :         pmc->sfcount[MCAST_EXCLUDE] = 1;
    2146           0 :         spin_unlock_bh(&pmc->lock);
    2147             : 
    2148           0 :         ip_sf_list_clear_all(tomb);
    2149           0 :         ip_sf_list_clear_all(sources);
    2150           0 : }
    2151             : 
    2152             : /* Join a multicast group
    2153             :  */
    2154           0 : static int __ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr,
    2155             :                               unsigned int mode)
    2156             : {
    2157           0 :         __be32 addr = imr->imr_multiaddr.s_addr;
    2158           0 :         struct ip_mc_socklist *iml, *i;
    2159           0 :         struct in_device *in_dev;
    2160           0 :         struct inet_sock *inet = inet_sk(sk);
    2161           0 :         struct net *net = sock_net(sk);
    2162           0 :         int ifindex;
    2163           0 :         int count = 0;
    2164           0 :         int err;
    2165             : 
    2166           0 :         ASSERT_RTNL();
    2167             : 
    2168           0 :         if (!ipv4_is_multicast(addr))
    2169             :                 return -EINVAL;
    2170             : 
    2171           0 :         in_dev = ip_mc_find_dev(net, imr);
    2172             : 
    2173           0 :         if (!in_dev) {
    2174           0 :                 err = -ENODEV;
    2175           0 :                 goto done;
    2176             :         }
    2177             : 
    2178           0 :         err = -EADDRINUSE;
    2179           0 :         ifindex = imr->imr_ifindex;
    2180           0 :         for_each_pmc_rtnl(inet, i) {
    2181           0 :                 if (i->multi.imr_multiaddr.s_addr == addr &&
    2182           0 :                     i->multi.imr_ifindex == ifindex)
    2183           0 :                         goto done;
    2184           0 :                 count++;
    2185             :         }
    2186           0 :         err = -ENOBUFS;
    2187           0 :         if (count >= net->ipv4.sysctl_igmp_max_memberships)
    2188           0 :                 goto done;
    2189           0 :         iml = sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
    2190           0 :         if (!iml)
    2191           0 :                 goto done;
    2192             : 
    2193           0 :         memcpy(&iml->multi, imr, sizeof(*imr));
    2194           0 :         iml->next_rcu = inet->mc_list;
    2195           0 :         iml->sflist = NULL;
    2196           0 :         iml->sfmode = mode;
    2197           0 :         rcu_assign_pointer(inet->mc_list, iml);
    2198           0 :         ____ip_mc_inc_group(in_dev, addr, mode, GFP_KERNEL);
    2199           0 :         err = 0;
    2200             : done:
    2201             :         return err;
    2202             : }
    2203             : 
    2204             : /* Join ASM (Any-Source Multicast) group
    2205             :  */
    2206           0 : int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
    2207             : {
    2208           0 :         return __ip_mc_join_group(sk, imr, MCAST_EXCLUDE);
    2209             : }
    2210             : EXPORT_SYMBOL(ip_mc_join_group);
    2211             : 
    2212             : /* Join SSM (Source-Specific Multicast) group
    2213             :  */
    2214           0 : int ip_mc_join_group_ssm(struct sock *sk, struct ip_mreqn *imr,
    2215             :                          unsigned int mode)
    2216             : {
    2217           0 :         return __ip_mc_join_group(sk, imr, mode);
    2218             : }
    2219             : 
    2220           0 : static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
    2221             :                            struct in_device *in_dev)
    2222             : {
    2223           0 :         struct ip_sf_socklist *psf = rtnl_dereference(iml->sflist);
    2224           0 :         int err;
    2225             : 
    2226           0 :         if (!psf) {
    2227             :                 /* any-source empty exclude case */
    2228           0 :                 return ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
    2229           0 :                         iml->sfmode, 0, NULL, 0);
    2230             :         }
    2231           0 :         err = ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
    2232           0 :                         iml->sfmode, psf->sl_count, psf->sl_addr, 0);
    2233           0 :         RCU_INIT_POINTER(iml->sflist, NULL);
    2234             :         /* decrease mem now to avoid the memleak warning */
    2235           0 :         atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);
    2236           0 :         kfree_rcu(psf, rcu);
    2237           0 :         return err;
    2238             : }
    2239             : 
    2240           0 : int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
    2241             : {
    2242           0 :         struct inet_sock *inet = inet_sk(sk);
    2243           0 :         struct ip_mc_socklist *iml;
    2244           0 :         struct ip_mc_socklist __rcu **imlp;
    2245           0 :         struct in_device *in_dev;
    2246           0 :         struct net *net = sock_net(sk);
    2247           0 :         __be32 group = imr->imr_multiaddr.s_addr;
    2248           0 :         u32 ifindex;
    2249           0 :         int ret = -EADDRNOTAVAIL;
    2250             : 
    2251           0 :         ASSERT_RTNL();
    2252             : 
    2253           0 :         in_dev = ip_mc_find_dev(net, imr);
    2254           0 :         if (!imr->imr_ifindex && !imr->imr_address.s_addr && !in_dev) {
    2255           0 :                 ret = -ENODEV;
    2256           0 :                 goto out;
    2257             :         }
    2258           0 :         ifindex = imr->imr_ifindex;
    2259           0 :         for (imlp = &inet->mc_list;
    2260           0 :              (iml = rtnl_dereference(*imlp)) != NULL;
    2261           0 :              imlp = &iml->next_rcu) {
    2262           0 :                 if (iml->multi.imr_multiaddr.s_addr != group)
    2263           0 :                         continue;
    2264           0 :                 if (ifindex) {
    2265           0 :                         if (iml->multi.imr_ifindex != ifindex)
    2266           0 :                                 continue;
    2267           0 :                 } else if (imr->imr_address.s_addr && imr->imr_address.s_addr !=
    2268           0 :                                 iml->multi.imr_address.s_addr)
    2269           0 :                         continue;
    2270             : 
    2271           0 :                 (void) ip_mc_leave_src(sk, iml, in_dev);
    2272             : 
    2273           0 :                 *imlp = iml->next_rcu;
    2274             : 
    2275           0 :                 if (in_dev)
    2276           0 :                         ip_mc_dec_group(in_dev, group);
    2277             : 
    2278             :                 /* decrease mem now to avoid the memleak warning */
    2279           0 :                 atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
    2280           0 :                 kfree_rcu(iml, rcu);
    2281           0 :                 return 0;
    2282             :         }
    2283           0 : out:
    2284             :         return ret;
    2285             : }
    2286             : EXPORT_SYMBOL(ip_mc_leave_group);
    2287             : 
    2288           0 : int ip_mc_source(int add, int omode, struct sock *sk, struct
    2289             :         ip_mreq_source *mreqs, int ifindex)
    2290             : {
    2291           0 :         int err;
    2292           0 :         struct ip_mreqn imr;
    2293           0 :         __be32 addr = mreqs->imr_multiaddr;
    2294           0 :         struct ip_mc_socklist *pmc;
    2295           0 :         struct in_device *in_dev = NULL;
    2296           0 :         struct inet_sock *inet = inet_sk(sk);
    2297           0 :         struct ip_sf_socklist *psl;
    2298           0 :         struct net *net = sock_net(sk);
    2299           0 :         int leavegroup = 0;
    2300           0 :         int i, j, rv;
    2301             : 
    2302           0 :         if (!ipv4_is_multicast(addr))
    2303             :                 return -EINVAL;
    2304             : 
    2305           0 :         ASSERT_RTNL();
    2306             : 
    2307           0 :         imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
    2308           0 :         imr.imr_address.s_addr = mreqs->imr_interface;
    2309           0 :         imr.imr_ifindex = ifindex;
    2310           0 :         in_dev = ip_mc_find_dev(net, &imr);
    2311             : 
    2312           0 :         if (!in_dev) {
    2313           0 :                 err = -ENODEV;
    2314           0 :                 goto done;
    2315             :         }
    2316           0 :         err = -EADDRNOTAVAIL;
    2317             : 
    2318           0 :         for_each_pmc_rtnl(inet, pmc) {
    2319           0 :                 if ((pmc->multi.imr_multiaddr.s_addr ==
    2320           0 :                      imr.imr_multiaddr.s_addr) &&
    2321           0 :                     (pmc->multi.imr_ifindex == imr.imr_ifindex))
    2322             :                         break;
    2323             :         }
    2324           0 :         if (!pmc) {             /* must have a prior join */
    2325           0 :                 err = -EINVAL;
    2326           0 :                 goto done;
    2327             :         }
    2328             :         /* if a source filter was set, must be the same mode as before */
    2329           0 :         if (pmc->sflist) {
    2330           0 :                 if (pmc->sfmode != omode) {
    2331           0 :                         err = -EINVAL;
    2332           0 :                         goto done;
    2333             :                 }
    2334           0 :         } else if (pmc->sfmode != omode) {
    2335             :                 /* allow mode switches for empty-set filters */
    2336           0 :                 ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 0, NULL, 0);
    2337           0 :                 ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, pmc->sfmode, 0,
    2338             :                         NULL, 0);
    2339           0 :                 pmc->sfmode = omode;
    2340             :         }
    2341             : 
    2342           0 :         psl = rtnl_dereference(pmc->sflist);
    2343           0 :         if (!add) {
    2344           0 :                 if (!psl)
    2345           0 :                         goto done;      /* err = -EADDRNOTAVAIL */
    2346             :                 rv = !0;
    2347           0 :                 for (i = 0; i < psl->sl_count; i++) {
    2348           0 :                         rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
    2349             :                                 sizeof(__be32));
    2350           0 :                         if (rv == 0)
    2351             :                                 break;
    2352             :                 }
    2353           0 :                 if (rv)         /* source not found */
    2354           0 :                         goto done;      /* err = -EADDRNOTAVAIL */
    2355             : 
    2356             :                 /* special case - (INCLUDE, empty) == LEAVE_GROUP */
    2357           0 :                 if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
    2358           0 :                         leavegroup = 1;
    2359           0 :                         goto done;
    2360             :                 }
    2361             : 
    2362             :                 /* update the interface filter */
    2363           0 :                 ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
    2364             :                         &mreqs->imr_sourceaddr, 1);
    2365             : 
    2366           0 :                 for (j = i+1; j < psl->sl_count; j++)
    2367           0 :                         psl->sl_addr[j-1] = psl->sl_addr[j];
    2368           0 :                 psl->sl_count--;
    2369           0 :                 err = 0;
    2370           0 :                 goto done;
    2371             :         }
    2372             :         /* else, add a new source to the filter */
    2373             : 
    2374           0 :         if (psl && psl->sl_count >= net->ipv4.sysctl_igmp_max_msf) {
    2375           0 :                 err = -ENOBUFS;
    2376           0 :                 goto done;
    2377             :         }
    2378           0 :         if (!psl || psl->sl_count == psl->sl_max) {
    2379           0 :                 struct ip_sf_socklist *newpsl;
    2380           0 :                 int count = IP_SFBLOCK;
    2381             : 
    2382           0 :                 if (psl)
    2383           0 :                         count += psl->sl_max;
    2384           0 :                 newpsl = sock_kmalloc(sk, IP_SFLSIZE(count), GFP_KERNEL);
    2385           0 :                 if (!newpsl) {
    2386           0 :                         err = -ENOBUFS;
    2387           0 :                         goto done;
    2388             :                 }
    2389           0 :                 newpsl->sl_max = count;
    2390           0 :                 newpsl->sl_count = count - IP_SFBLOCK;
    2391           0 :                 if (psl) {
    2392           0 :                         for (i = 0; i < psl->sl_count; i++)
    2393           0 :                                 newpsl->sl_addr[i] = psl->sl_addr[i];
    2394             :                         /* decrease mem now to avoid the memleak warning */
    2395           0 :                         atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
    2396           0 :                         kfree_rcu(psl, rcu);
    2397             :                 }
    2398           0 :                 rcu_assign_pointer(pmc->sflist, newpsl);
    2399           0 :                 psl = newpsl;
    2400             :         }
    2401           0 :         rv = 1; /* > 0 for insert logic below if sl_count is 0 */
    2402           0 :         for (i = 0; i < psl->sl_count; i++) {
    2403           0 :                 rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
    2404             :                         sizeof(__be32));
    2405           0 :                 if (rv == 0)
    2406             :                         break;
    2407             :         }
    2408           0 :         if (rv == 0)            /* address already there is an error */
    2409           0 :                 goto done;
    2410           0 :         for (j = psl->sl_count-1; j >= i; j--)
    2411           0 :                 psl->sl_addr[j+1] = psl->sl_addr[j];
    2412           0 :         psl->sl_addr[i] = mreqs->imr_sourceaddr;
    2413           0 :         psl->sl_count++;
    2414           0 :         err = 0;
    2415             :         /* update the interface list */
    2416           0 :         ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
    2417             :                 &mreqs->imr_sourceaddr, 1);
    2418             : done:
    2419           0 :         if (leavegroup)
    2420           0 :                 err = ip_mc_leave_group(sk, &imr);
    2421             :         return err;
    2422             : }
    2423             : 
    2424           0 : int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
    2425             : {
    2426           0 :         int err = 0;
    2427           0 :         struct ip_mreqn imr;
    2428           0 :         __be32 addr = msf->imsf_multiaddr;
    2429           0 :         struct ip_mc_socklist *pmc;
    2430           0 :         struct in_device *in_dev;
    2431           0 :         struct inet_sock *inet = inet_sk(sk);
    2432           0 :         struct ip_sf_socklist *newpsl, *psl;
    2433           0 :         struct net *net = sock_net(sk);
    2434           0 :         int leavegroup = 0;
    2435             : 
    2436           0 :         if (!ipv4_is_multicast(addr))
    2437             :                 return -EINVAL;
    2438           0 :         if (msf->imsf_fmode != MCAST_INCLUDE &&
    2439             :             msf->imsf_fmode != MCAST_EXCLUDE)
    2440             :                 return -EINVAL;
    2441             : 
    2442           0 :         ASSERT_RTNL();
    2443             : 
    2444           0 :         imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
    2445           0 :         imr.imr_address.s_addr = msf->imsf_interface;
    2446           0 :         imr.imr_ifindex = ifindex;
    2447           0 :         in_dev = ip_mc_find_dev(net, &imr);
    2448             : 
    2449           0 :         if (!in_dev) {
    2450           0 :                 err = -ENODEV;
    2451           0 :                 goto done;
    2452             :         }
    2453             : 
    2454             :         /* special case - (INCLUDE, empty) == LEAVE_GROUP */
    2455           0 :         if (msf->imsf_fmode == MCAST_INCLUDE && msf->imsf_numsrc == 0) {
    2456           0 :                 leavegroup = 1;
    2457           0 :                 goto done;
    2458             :         }
    2459             : 
    2460           0 :         for_each_pmc_rtnl(inet, pmc) {
    2461           0 :                 if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
    2462           0 :                     pmc->multi.imr_ifindex == imr.imr_ifindex)
    2463             :                         break;
    2464             :         }
    2465           0 :         if (!pmc) {             /* must have a prior join */
    2466           0 :                 err = -EINVAL;
    2467           0 :                 goto done;
    2468             :         }
    2469           0 :         if (msf->imsf_numsrc) {
    2470           0 :                 newpsl = sock_kmalloc(sk, IP_SFLSIZE(msf->imsf_numsrc),
    2471             :                                                            GFP_KERNEL);
    2472           0 :                 if (!newpsl) {
    2473           0 :                         err = -ENOBUFS;
    2474           0 :                         goto done;
    2475             :                 }
    2476           0 :                 newpsl->sl_max = newpsl->sl_count = msf->imsf_numsrc;
    2477           0 :                 memcpy(newpsl->sl_addr, msf->imsf_slist,
    2478           0 :                         msf->imsf_numsrc * sizeof(msf->imsf_slist[0]));
    2479           0 :                 err = ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
    2480           0 :                         msf->imsf_fmode, newpsl->sl_count, newpsl->sl_addr, 0);
    2481           0 :                 if (err) {
    2482           0 :                         sock_kfree_s(sk, newpsl, IP_SFLSIZE(newpsl->sl_max));
    2483           0 :                         goto done;
    2484             :                 }
    2485             :         } else {
    2486           0 :                 newpsl = NULL;
    2487           0 :                 (void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
    2488           0 :                                      msf->imsf_fmode, 0, NULL, 0);
    2489             :         }
    2490           0 :         psl = rtnl_dereference(pmc->sflist);
    2491           0 :         if (psl) {
    2492           0 :                 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
    2493           0 :                         psl->sl_count, psl->sl_addr, 0);
    2494             :                 /* decrease mem now to avoid the memleak warning */
    2495           0 :                 atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
    2496           0 :                 kfree_rcu(psl, rcu);
    2497             :         } else
    2498           0 :                 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
    2499             :                         0, NULL, 0);
    2500           0 :         rcu_assign_pointer(pmc->sflist, newpsl);
    2501           0 :         pmc->sfmode = msf->imsf_fmode;
    2502           0 :         err = 0;
    2503             : done:
    2504           0 :         if (leavegroup)
    2505           0 :                 err = ip_mc_leave_group(sk, &imr);
    2506             :         return err;
    2507             : }
    2508             : 
    2509           0 : int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
    2510             :         struct ip_msfilter __user *optval, int __user *optlen)
    2511             : {
    2512           0 :         int err, len, count, copycount;
    2513           0 :         struct ip_mreqn imr;
    2514           0 :         __be32 addr = msf->imsf_multiaddr;
    2515           0 :         struct ip_mc_socklist *pmc;
    2516           0 :         struct in_device *in_dev;
    2517           0 :         struct inet_sock *inet = inet_sk(sk);
    2518           0 :         struct ip_sf_socklist *psl;
    2519           0 :         struct net *net = sock_net(sk);
    2520             : 
    2521           0 :         ASSERT_RTNL();
    2522             : 
    2523           0 :         if (!ipv4_is_multicast(addr))
    2524             :                 return -EINVAL;
    2525             : 
    2526           0 :         imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
    2527           0 :         imr.imr_address.s_addr = msf->imsf_interface;
    2528           0 :         imr.imr_ifindex = 0;
    2529           0 :         in_dev = ip_mc_find_dev(net, &imr);
    2530             : 
    2531           0 :         if (!in_dev) {
    2532           0 :                 err = -ENODEV;
    2533           0 :                 goto done;
    2534             :         }
    2535           0 :         err = -EADDRNOTAVAIL;
    2536             : 
    2537           0 :         for_each_pmc_rtnl(inet, pmc) {
    2538           0 :                 if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
    2539           0 :                     pmc->multi.imr_ifindex == imr.imr_ifindex)
    2540             :                         break;
    2541             :         }
    2542           0 :         if (!pmc)               /* must have a prior join */
    2543           0 :                 goto done;
    2544           0 :         msf->imsf_fmode = pmc->sfmode;
    2545           0 :         psl = rtnl_dereference(pmc->sflist);
    2546           0 :         if (!psl) {
    2547           0 :                 len = 0;
    2548             :                 count = 0;
    2549             :         } else {
    2550           0 :                 count = psl->sl_count;
    2551             :         }
    2552           0 :         copycount = count < msf->imsf_numsrc ? count : msf->imsf_numsrc;
    2553           0 :         len = copycount * sizeof(psl->sl_addr[0]);
    2554           0 :         msf->imsf_numsrc = count;
    2555           0 :         if (put_user(IP_MSFILTER_SIZE(copycount), optlen) ||
    2556           0 :             copy_to_user(optval, msf, IP_MSFILTER_SIZE(0))) {
    2557           0 :                 return -EFAULT;
    2558             :         }
    2559           0 :         if (len &&
    2560           0 :             copy_to_user(&optval->imsf_slist[0], psl->sl_addr, len))
    2561           0 :                 return -EFAULT;
    2562             :         return 0;
    2563             : done:
    2564             :         return err;
    2565             : }
    2566             : 
    2567           0 : int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
    2568             :         struct sockaddr_storage __user *p)
    2569             : {
    2570           0 :         int i, count, copycount;
    2571           0 :         struct sockaddr_in *psin;
    2572           0 :         __be32 addr;
    2573           0 :         struct ip_mc_socklist *pmc;
    2574           0 :         struct inet_sock *inet = inet_sk(sk);
    2575           0 :         struct ip_sf_socklist *psl;
    2576             : 
    2577           0 :         ASSERT_RTNL();
    2578             : 
    2579           0 :         psin = (struct sockaddr_in *)&gsf->gf_group;
    2580           0 :         if (psin->sin_family != AF_INET)
    2581             :                 return -EINVAL;
    2582           0 :         addr = psin->sin_addr.s_addr;
    2583           0 :         if (!ipv4_is_multicast(addr))
    2584             :                 return -EINVAL;
    2585             : 
    2586           0 :         for_each_pmc_rtnl(inet, pmc) {
    2587           0 :                 if (pmc->multi.imr_multiaddr.s_addr == addr &&
    2588           0 :                     pmc->multi.imr_ifindex == gsf->gf_interface)
    2589             :                         break;
    2590             :         }
    2591           0 :         if (!pmc)               /* must have a prior join */
    2592             :                 return -EADDRNOTAVAIL;
    2593           0 :         gsf->gf_fmode = pmc->sfmode;
    2594           0 :         psl = rtnl_dereference(pmc->sflist);
    2595           0 :         count = psl ? psl->sl_count : 0;
    2596           0 :         copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
    2597           0 :         gsf->gf_numsrc = count;
    2598           0 :         for (i = 0; i < copycount; i++, p++) {
    2599           0 :                 struct sockaddr_storage ss;
    2600             : 
    2601           0 :                 psin = (struct sockaddr_in *)&ss;
    2602           0 :                 memset(&ss, 0, sizeof(ss));
    2603           0 :                 psin->sin_family = AF_INET;
    2604           0 :                 psin->sin_addr.s_addr = psl->sl_addr[i];
    2605           0 :                 if (copy_to_user(p, &ss, sizeof(ss)))
    2606           0 :                         return -EFAULT;
    2607             :         }
    2608             :         return 0;
    2609             : }
    2610             : 
    2611             : /*
    2612             :  * check if a multicast source filter allows delivery for a given <src,dst,intf>
    2613             :  */
    2614           2 : int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr,
    2615             :                    int dif, int sdif)
    2616             : {
    2617           2 :         struct inet_sock *inet = inet_sk(sk);
    2618           2 :         struct ip_mc_socklist *pmc;
    2619           2 :         struct ip_sf_socklist *psl;
    2620           2 :         int i;
    2621           2 :         int ret;
    2622             : 
    2623           2 :         ret = 1;
    2624           2 :         if (!ipv4_is_multicast(loc_addr))
    2625           2 :                 goto out;
    2626             : 
    2627           0 :         rcu_read_lock();
    2628           0 :         for_each_pmc_rcu(inet, pmc) {
    2629           0 :                 if (pmc->multi.imr_multiaddr.s_addr == loc_addr &&
    2630           0 :                     (pmc->multi.imr_ifindex == dif ||
    2631           0 :                      (sdif && pmc->multi.imr_ifindex == sdif)))
    2632             :                         break;
    2633             :         }
    2634           0 :         ret = inet->mc_all;
    2635           0 :         if (!pmc)
    2636           0 :                 goto unlock;
    2637           0 :         psl = rcu_dereference(pmc->sflist);
    2638           0 :         ret = (pmc->sfmode == MCAST_EXCLUDE);
    2639           0 :         if (!psl)
    2640           0 :                 goto unlock;
    2641             : 
    2642           0 :         for (i = 0; i < psl->sl_count; i++) {
    2643           0 :                 if (psl->sl_addr[i] == rmt_addr)
    2644             :                         break;
    2645             :         }
    2646           0 :         ret = 0;
    2647           0 :         if (pmc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
    2648           0 :                 goto unlock;
    2649           0 :         if (pmc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
    2650           0 :                 goto unlock;
    2651             :         ret = 1;
    2652           0 : unlock:
    2653           0 :         rcu_read_unlock();
    2654           2 : out:
    2655           2 :         return ret;
    2656             : }
    2657             : 
    2658             : /*
    2659             :  *      A socket is closing.
    2660             :  */
    2661             : 
    2662          43 : void ip_mc_drop_socket(struct sock *sk)
    2663             : {
    2664          43 :         struct inet_sock *inet = inet_sk(sk);
    2665          43 :         struct ip_mc_socklist *iml;
    2666          43 :         struct net *net = sock_net(sk);
    2667             : 
    2668          43 :         if (!inet->mc_list)
    2669             :                 return;
    2670             : 
    2671           0 :         rtnl_lock();
    2672           0 :         while ((iml = rtnl_dereference(inet->mc_list)) != NULL) {
    2673           0 :                 struct in_device *in_dev;
    2674             : 
    2675           0 :                 inet->mc_list = iml->next_rcu;
    2676           0 :                 in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
    2677           0 :                 (void) ip_mc_leave_src(sk, iml, in_dev);
    2678           0 :                 if (in_dev)
    2679           0 :                         ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
    2680             :                 /* decrease mem now to avoid the memleak warning */
    2681           0 :                 atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
    2682           0 :                 kfree_rcu(iml, rcu);
    2683             :         }
    2684           0 :         rtnl_unlock();
    2685             : }
    2686             : 
    2687             : /* called with rcu_read_lock() */
    2688           0 : int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u8 proto)
    2689             : {
    2690           0 :         struct ip_mc_list *im;
    2691           0 :         struct ip_mc_list __rcu **mc_hash;
    2692           0 :         struct ip_sf_list *psf;
    2693           0 :         int rv = 0;
    2694             : 
    2695           0 :         mc_hash = rcu_dereference(in_dev->mc_hash);
    2696           0 :         if (mc_hash) {
    2697           0 :                 u32 hash = hash_32((__force u32)mc_addr, MC_HASH_SZ_LOG);
    2698             : 
    2699           0 :                 for (im = rcu_dereference(mc_hash[hash]);
    2700           0 :                      im != NULL;
    2701           0 :                      im = rcu_dereference(im->next_hash)) {
    2702           0 :                         if (im->multiaddr == mc_addr)
    2703             :                                 break;
    2704             :                 }
    2705             :         } else {
    2706           0 :                 for_each_pmc_rcu(in_dev, im) {
    2707           0 :                         if (im->multiaddr == mc_addr)
    2708             :                                 break;
    2709             :                 }
    2710             :         }
    2711           0 :         if (im && proto == IPPROTO_IGMP) {
    2712             :                 rv = 1;
    2713           0 :         } else if (im) {
    2714           0 :                 if (src_addr) {
    2715           0 :                         for (psf = im->sources; psf; psf = psf->sf_next) {
    2716           0 :                                 if (psf->sf_inaddr == src_addr)
    2717             :                                         break;
    2718             :                         }
    2719           0 :                         if (psf)
    2720           0 :                                 rv = psf->sf_count[MCAST_INCLUDE] ||
    2721           0 :                                         psf->sf_count[MCAST_EXCLUDE] !=
    2722           0 :                                         im->sfcount[MCAST_EXCLUDE];
    2723             :                         else
    2724           0 :                                 rv = im->sfcount[MCAST_EXCLUDE] != 0;
    2725             :                 } else
    2726             :                         rv = 1; /* unspecified source; tentatively allow */
    2727             :         }
    2728           0 :         return rv;
    2729             : }
    2730             : 
    2731             : #if defined(CONFIG_PROC_FS)
    2732             : struct igmp_mc_iter_state {
    2733             :         struct seq_net_private p;
    2734             :         struct net_device *dev;
    2735             :         struct in_device *in_dev;
    2736             : };
    2737             : 
    2738             : #define igmp_mc_seq_private(seq)        ((struct igmp_mc_iter_state *)(seq)->private)
    2739             : 
    2740           0 : static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
    2741             : {
    2742           0 :         struct net *net = seq_file_net(seq);
    2743           0 :         struct ip_mc_list *im = NULL;
    2744           0 :         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
    2745             : 
    2746           0 :         state->in_dev = NULL;
    2747           0 :         for_each_netdev_rcu(net, state->dev) {
    2748           0 :                 struct in_device *in_dev;
    2749             : 
    2750           0 :                 in_dev = __in_dev_get_rcu(state->dev);
    2751           0 :                 if (!in_dev)
    2752           0 :                         continue;
    2753           0 :                 im = rcu_dereference(in_dev->mc_list);
    2754           0 :                 if (im) {
    2755           0 :                         state->in_dev = in_dev;
    2756           0 :                         break;
    2757             :                 }
    2758             :         }
    2759           0 :         return im;
    2760             : }
    2761             : 
    2762           0 : static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_list *im)
    2763             : {
    2764           0 :         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
    2765             : 
    2766           0 :         im = rcu_dereference(im->next_rcu);
    2767           0 :         while (!im) {
    2768           0 :                 state->dev = next_net_device_rcu(state->dev);
    2769           0 :                 if (!state->dev) {
    2770           0 :                         state->in_dev = NULL;
    2771           0 :                         break;
    2772             :                 }
    2773           0 :                 state->in_dev = __in_dev_get_rcu(state->dev);
    2774           0 :                 if (!state->in_dev)
    2775           0 :                         continue;
    2776           0 :                 im = rcu_dereference(state->in_dev->mc_list);
    2777             :         }
    2778           0 :         return im;
    2779             : }
    2780             : 
    2781           0 : static struct ip_mc_list *igmp_mc_get_idx(struct seq_file *seq, loff_t pos)
    2782             : {
    2783           0 :         struct ip_mc_list *im = igmp_mc_get_first(seq);
    2784           0 :         if (im)
    2785           0 :                 while (pos && (im = igmp_mc_get_next(seq, im)) != NULL)
    2786           0 :                         --pos;
    2787           0 :         return pos ? NULL : im;
    2788             : }
    2789             : 
    2790           0 : static void *igmp_mc_seq_start(struct seq_file *seq, loff_t *pos)
    2791             :         __acquires(rcu)
    2792             : {
    2793           0 :         rcu_read_lock();
    2794           0 :         return *pos ? igmp_mc_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
    2795             : }
    2796             : 
    2797           0 : static void *igmp_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
    2798             : {
    2799           0 :         struct ip_mc_list *im;
    2800           0 :         if (v == SEQ_START_TOKEN)
    2801           0 :                 im = igmp_mc_get_first(seq);
    2802             :         else
    2803           0 :                 im = igmp_mc_get_next(seq, v);
    2804           0 :         ++*pos;
    2805           0 :         return im;
    2806             : }
    2807             : 
    2808           0 : static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
    2809             :         __releases(rcu)
    2810             : {
    2811           0 :         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
    2812             : 
    2813           0 :         state->in_dev = NULL;
    2814           0 :         state->dev = NULL;
    2815           0 :         rcu_read_unlock();
    2816           0 : }
    2817             : 
    2818           0 : static int igmp_mc_seq_show(struct seq_file *seq, void *v)
    2819             : {
    2820           0 :         if (v == SEQ_START_TOKEN)
    2821           0 :                 seq_puts(seq,
    2822             :                          "Idx\tDevice    : Count Querier\tGroup    Users Timer\tReporter\n");
    2823             :         else {
    2824           0 :                 struct ip_mc_list *im = (struct ip_mc_list *)v;
    2825           0 :                 struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
    2826           0 :                 char   *querier;
    2827           0 :                 long delta;
    2828             : 
    2829             : #ifdef CONFIG_IP_MULTICAST
    2830             :                 querier = IGMP_V1_SEEN(state->in_dev) ? "V1" :
    2831             :                           IGMP_V2_SEEN(state->in_dev) ? "V2" :
    2832             :                           "V3";
    2833             : #else
    2834           0 :                 querier = "NONE";
    2835             : #endif
    2836             : 
    2837           0 :                 if (rcu_access_pointer(state->in_dev->mc_list) == im) {
    2838           0 :                         seq_printf(seq, "%d\t%-10s: %5d %7s\n",
    2839           0 :                                    state->dev->ifindex, state->dev->name, state->in_dev->mc_count, querier);
    2840             :                 }
    2841             : 
    2842           0 :                 delta = im->timer.expires - jiffies;
    2843           0 :                 seq_printf(seq,
    2844             :                            "\t\t\t\t%08X %5d %d:%08lX\t\t%d\n",
    2845             :                            im->multiaddr, im->users,
    2846           0 :                            im->tm_running,
    2847           0 :                            im->tm_running ? jiffies_delta_to_clock_t(delta) : 0,
    2848           0 :                            im->reporter);
    2849             :         }
    2850           0 :         return 0;
    2851             : }
    2852             : 
    2853             : static const struct seq_operations igmp_mc_seq_ops = {
    2854             :         .start  =       igmp_mc_seq_start,
    2855             :         .next   =       igmp_mc_seq_next,
    2856             :         .stop   =       igmp_mc_seq_stop,
    2857             :         .show   =       igmp_mc_seq_show,
    2858             : };
    2859             : 
    2860             : struct igmp_mcf_iter_state {
    2861             :         struct seq_net_private p;
    2862             :         struct net_device *dev;
    2863             :         struct in_device *idev;
    2864             :         struct ip_mc_list *im;
    2865             : };
    2866             : 
    2867             : #define igmp_mcf_seq_private(seq)       ((struct igmp_mcf_iter_state *)(seq)->private)
    2868             : 
    2869           0 : static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
    2870             : {
    2871           0 :         struct net *net = seq_file_net(seq);
    2872           0 :         struct ip_sf_list *psf = NULL;
    2873           0 :         struct ip_mc_list *im = NULL;
    2874           0 :         struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
    2875             : 
    2876           0 :         state->idev = NULL;
    2877           0 :         state->im = NULL;
    2878           0 :         for_each_netdev_rcu(net, state->dev) {
    2879           0 :                 struct in_device *idev;
    2880           0 :                 idev = __in_dev_get_rcu(state->dev);
    2881           0 :                 if (unlikely(!idev))
    2882           0 :                         continue;
    2883           0 :                 im = rcu_dereference(idev->mc_list);
    2884           0 :                 if (likely(im)) {
    2885           0 :                         spin_lock_bh(&im->lock);
    2886           0 :                         psf = im->sources;
    2887           0 :                         if (likely(psf)) {
    2888           0 :                                 state->im = im;
    2889           0 :                                 state->idev = idev;
    2890           0 :                                 break;
    2891             :                         }
    2892           0 :                         spin_unlock_bh(&im->lock);
    2893             :                 }
    2894             :         }
    2895           0 :         return psf;
    2896             : }
    2897             : 
    2898           0 : static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_list *psf)
    2899             : {
    2900           0 :         struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
    2901             : 
    2902           0 :         psf = psf->sf_next;
    2903           0 :         while (!psf) {
    2904           0 :                 spin_unlock_bh(&state->im->lock);
    2905           0 :                 state->im = state->im->next;
    2906           0 :                 while (!state->im) {
    2907           0 :                         state->dev = next_net_device_rcu(state->dev);
    2908           0 :                         if (!state->dev) {
    2909           0 :                                 state->idev = NULL;
    2910           0 :                                 goto out;
    2911             :                         }
    2912           0 :                         state->idev = __in_dev_get_rcu(state->dev);
    2913           0 :                         if (!state->idev)
    2914           0 :                                 continue;
    2915           0 :                         state->im = rcu_dereference(state->idev->mc_list);
    2916             :                 }
    2917           0 :                 if (!state->im)
    2918             :                         break;
    2919           0 :                 spin_lock_bh(&state->im->lock);
    2920           0 :                 psf = state->im->sources;
    2921             :         }
    2922           0 : out:
    2923           0 :         return psf;
    2924             : }
    2925             : 
    2926           0 : static struct ip_sf_list *igmp_mcf_get_idx(struct seq_file *seq, loff_t pos)
    2927             : {
    2928           0 :         struct ip_sf_list *psf = igmp_mcf_get_first(seq);
    2929           0 :         if (psf)
    2930           0 :                 while (pos && (psf = igmp_mcf_get_next(seq, psf)) != NULL)
    2931           0 :                         --pos;
    2932           0 :         return pos ? NULL : psf;
    2933             : }
    2934             : 
    2935           0 : static void *igmp_mcf_seq_start(struct seq_file *seq, loff_t *pos)
    2936             :         __acquires(rcu)
    2937             : {
    2938           0 :         rcu_read_lock();
    2939           0 :         return *pos ? igmp_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
    2940             : }
    2941             : 
    2942           0 : static void *igmp_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
    2943             : {
    2944           0 :         struct ip_sf_list *psf;
    2945           0 :         if (v == SEQ_START_TOKEN)
    2946           0 :                 psf = igmp_mcf_get_first(seq);
    2947             :         else
    2948           0 :                 psf = igmp_mcf_get_next(seq, v);
    2949           0 :         ++*pos;
    2950           0 :         return psf;
    2951             : }
    2952             : 
    2953           0 : static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
    2954             :         __releases(rcu)
    2955             : {
    2956           0 :         struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
    2957           0 :         if (likely(state->im)) {
    2958           0 :                 spin_unlock_bh(&state->im->lock);
    2959           0 :                 state->im = NULL;
    2960             :         }
    2961           0 :         state->idev = NULL;
    2962           0 :         state->dev = NULL;
    2963           0 :         rcu_read_unlock();
    2964           0 : }
    2965             : 
    2966           0 : static int igmp_mcf_seq_show(struct seq_file *seq, void *v)
    2967             : {
    2968           0 :         struct ip_sf_list *psf = (struct ip_sf_list *)v;
    2969           0 :         struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
    2970             : 
    2971           0 :         if (v == SEQ_START_TOKEN) {
    2972           0 :                 seq_puts(seq, "Idx Device        MCA        SRC    INC    EXC\n");
    2973             :         } else {
    2974           0 :                 seq_printf(seq,
    2975             :                            "%3d %6.6s 0x%08x "
    2976             :                            "0x%08x %6lu %6lu\n",
    2977           0 :                            state->dev->ifindex, state->dev->name,
    2978           0 :                            ntohl(state->im->multiaddr),
    2979           0 :                            ntohl(psf->sf_inaddr),
    2980             :                            psf->sf_count[MCAST_INCLUDE],
    2981             :                            psf->sf_count[MCAST_EXCLUDE]);
    2982             :         }
    2983           0 :         return 0;
    2984             : }
    2985             : 
    2986             : static const struct seq_operations igmp_mcf_seq_ops = {
    2987             :         .start  =       igmp_mcf_seq_start,
    2988             :         .next   =       igmp_mcf_seq_next,
    2989             :         .stop   =       igmp_mcf_seq_stop,
    2990             :         .show   =       igmp_mcf_seq_show,
    2991             : };
    2992             : 
    2993           0 : static int __net_init igmp_net_init(struct net *net)
    2994             : {
    2995           0 :         struct proc_dir_entry *pde;
    2996           0 :         int err;
    2997             : 
    2998           0 :         pde = proc_create_net("igmp", 0444, net->proc_net, &igmp_mc_seq_ops,
    2999             :                         sizeof(struct igmp_mc_iter_state));
    3000           0 :         if (!pde)
    3001           0 :                 goto out_igmp;
    3002           0 :         pde = proc_create_net("mcfilter", 0444, net->proc_net,
    3003             :                         &igmp_mcf_seq_ops, sizeof(struct igmp_mcf_iter_state));
    3004           0 :         if (!pde)
    3005           0 :                 goto out_mcfilter;
    3006           0 :         err = inet_ctl_sock_create(&net->ipv4.mc_autojoin_sk, AF_INET,
    3007             :                                    SOCK_DGRAM, 0, net);
    3008           0 :         if (err < 0) {
    3009           0 :                 pr_err("Failed to initialize the IGMP autojoin socket (err %d)\n",
    3010             :                        err);
    3011           0 :                 goto out_sock;
    3012             :         }
    3013             : 
    3014             :         return 0;
    3015             : 
    3016           0 : out_sock:
    3017           0 :         remove_proc_entry("mcfilter", net->proc_net);
    3018           0 : out_mcfilter:
    3019           0 :         remove_proc_entry("igmp", net->proc_net);
    3020             : out_igmp:
    3021             :         return -ENOMEM;
    3022             : }
    3023             : 
    3024           0 : static void __net_exit igmp_net_exit(struct net *net)
    3025             : {
    3026           0 :         remove_proc_entry("mcfilter", net->proc_net);
    3027           0 :         remove_proc_entry("igmp", net->proc_net);
    3028           0 :         inet_ctl_sock_destroy(net->ipv4.mc_autojoin_sk);
    3029           0 : }
    3030             : 
    3031             : static struct pernet_operations igmp_net_ops = {
    3032             :         .init = igmp_net_init,
    3033             :         .exit = igmp_net_exit,
    3034             : };
    3035             : #endif
    3036             : 
    3037           0 : static int igmp_netdev_event(struct notifier_block *this,
    3038             :                              unsigned long event, void *ptr)
    3039             : {
    3040           0 :         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
    3041           0 :         struct in_device *in_dev;
    3042             : 
    3043           0 :         switch (event) {
    3044           0 :         case NETDEV_RESEND_IGMP:
    3045           0 :                 in_dev = __in_dev_get_rtnl(dev);
    3046           0 :                 if (in_dev)
    3047           0 :                         ip_mc_rejoin_groups(in_dev);
    3048             :                 break;
    3049             :         default:
    3050             :                 break;
    3051             :         }
    3052           0 :         return NOTIFY_DONE;
    3053             : }
    3054             : 
    3055             : static struct notifier_block igmp_notifier = {
    3056             :         .notifier_call = igmp_netdev_event,
    3057             : };
    3058             : 
    3059           0 : int __init igmp_mc_init(void)
    3060             : {
    3061             : #if defined(CONFIG_PROC_FS)
    3062           0 :         int err;
    3063             : 
    3064           0 :         err = register_pernet_subsys(&igmp_net_ops);
    3065           0 :         if (err)
    3066             :                 return err;
    3067           0 :         err = register_netdevice_notifier(&igmp_notifier);
    3068           0 :         if (err)
    3069           0 :                 goto reg_notif_fail;
    3070             :         return 0;
    3071             : 
    3072           0 : reg_notif_fail:
    3073           0 :         unregister_pernet_subsys(&igmp_net_ops);
    3074           0 :         return err;
    3075             : #else
    3076             :         return register_netdevice_notifier(&igmp_notifier);
    3077             : #endif
    3078             : }

Generated by: LCOV version 1.14