1 files changed, 35 insertions, 15 deletions
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 99508d66a642..ec19a890c9a0 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -47,6 +47,7 @@
 #include <linux/mroute.h>
 #include <linux/init.h>
 #include <linux/if_ether.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -275,7 +276,8 @@ failure:
 *      @notify: Set to 1, if the caller is a notifier_call
 */
-static int vif_delete(struct net *net, int vifi, int notify)
+static int vif_delete(struct net *net, int vifi, int notify,
+                      struct list_head *head)
 {
        struct vif_device *v;
        struct net_device *dev;
@@ -319,7 +321,7 @@ static int vif_delete(struct net *net, int vifi, int notify)
        }
        if (v->flags&(VIFF_TUNNEL|VIFF_REGISTER) && !notify)
-                unregister_netdevice(dev);
+                unregister_netdevice_queue(dev, head);
        dev_put(dev);
        return 0;
@@ -469,8 +471,18 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                        return err;
                }
                break;
+        case VIFF_USE_IFINDEX:
        case 0:
-                dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+                if (vifc->vifc_flags == VIFF_USE_IFINDEX) {
+                        dev = dev_get_by_index(net, vifc->vifc_lcl_ifindex);
+                        if (dev && dev->ip_ptr == NULL) {
+                                dev_put(dev);
+                                return -EADDRNOTAVAIL;
+                        }
+                } else
+                        dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
                if (!dev)
                        return -EADDRNOTAVAIL;
                err = dev_set_allmulti(dev, 1);
@@ -742,7 +754,8 @@ ipmr_cache_unresolved(struct net *net, vifi_t vifi, struct sk_buff *skb)
                c->next = mfc_unres_queue;
                mfc_unres_queue = c;
-                mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
+                if (atomic_read(&net->ipv4.cache_resolve_queue_len) == 1)
+                        mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
        }
        /*
@@ -791,6 +804,9 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
        int line;
        struct mfc_cache *uc, *c, **cp;
+        if (mfc->mfcc_parent >= MAXVIFS)
+                return -ENFILE;
        line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
        for (cp = &net->ipv4.mfc_cache_array[line];
@@ -862,14 +878,16 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
 static void mroute_clean_tables(struct net *net)
 {
        int i;
+        LIST_HEAD(list);
        /*
         *      Shut down all active vif entries
         */
        for (i = 0; i < net->ipv4.maxvif; i++) {
                if (!(net->ipv4.vif_table[i].flags&VIFF_STATIC))
-                        vif_delete(net, i, 0);
+                        vif_delete(net, i, 0, &list);
        }
+        unregister_netdevice_many(&list);
        /*
         *      Wipe the cache
@@ -948,7 +966,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
        switch (optname) {
        case MRT_INIT:
                if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_IGMP)
+                    inet_sk(sk)->inet_num != IPPROTO_IGMP)
                        return -EOPNOTSUPP;
                if (optlen != sizeof(int))
                        return -ENOPROTOOPT;
@@ -985,7 +1003,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
                if (optname == MRT_ADD_VIF) {
                        ret = vif_add(net, &vif, sk == net->ipv4.mroute_sk);
                } else {
-                        ret = vif_delete(net, vif.vifc_vifi, 0);
+                        ret = vif_delete(net, vif.vifc_vifi, 0, NULL);
                }
                rtnl_unlock();
                return ret;
@@ -1148,17 +1166,16 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
        struct net *net = dev_net(dev);
        struct vif_device *v;
        int ct;
+        LIST_HEAD(list);
-        if (!net_eq(dev_net(dev), net))
-                return NOTIFY_DONE;
        if (event != NETDEV_UNREGISTER)
                return NOTIFY_DONE;
        v = &net->ipv4.vif_table[0];
        for (ct = 0; ct < net->ipv4.maxvif; ct++, v++) {
                if (v->dev == dev)
-                        vif_delete(net, ct, 1);
+                        vif_delete(net, ct, 1, &list);
        }
+        unregister_netdevice_many(&list);
        return NOTIFY_DONE;
 }
@@ -1601,17 +1618,20 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
        int ct;
        struct rtnexthop *nhp;
        struct net *net = mfc_net(c);
-        struct net_device *dev = net->ipv4.vif_table[c->mfc_parent].dev;
        u8 *b = skb_tail_pointer(skb);
        struct rtattr *mp_head;
-        if (dev)
+        /* If cache is unresolved, don't try to parse IIF and OIF */
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        if (c->mfc_parent > MAXVIFS)
+                return -ENOENT;
+        if (VIF_EXISTS(net, c->mfc_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &net->ipv4.vif_table[c->mfc_parent].dev->ifindex);
        mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
        for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (VIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
                        if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                goto rtattr_failure;
                        nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index 99508d66a642..ec19a890c9a0 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c
@@ -47,6 +47,7 @@
47	#include <linux/mroute.h>	47	#include <linux/mroute.h>
48	#include <linux/init.h>	48	#include <linux/init.h>
49	#include <linux/if_ether.h>	49	#include <linux/if_ether.h>
		50	#include <linux/slab.h>
50	#include <net/net_namespace.h>	51	#include <net/net_namespace.h>
51	#include <net/ip.h>	52	#include <net/ip.h>
52	#include <net/protocol.h>	53	#include <net/protocol.h>
@@ -275,7 +276,8 @@ failure:
275	* @notify: Set to 1, if the caller is a notifier_call	276	* @notify: Set to 1, if the caller is a notifier_call
276	*/	277	*/
277		278
278	static int vif_delete(struct net *net, int vifi, int notify)	279	static int vif_delete(struct net *net, int vifi, int notify,
		280	struct list_head *head)
279	{	281	{
280	struct vif_device *v;	282	struct vif_device *v;
281	struct net_device *dev;	283	struct net_device *dev;
@@ -319,7 +321,7 @@ static int vif_delete(struct net *net, int vifi, int notify)
319	}	321	}
320		322
321	if (v->flags&(VIFF_TUNNEL\|VIFF_REGISTER) && !notify)	323	if (v->flags&(VIFF_TUNNEL\|VIFF_REGISTER) && !notify)
322	unregister_netdevice(dev);	324	unregister_netdevice_queue(dev, head);
323		325
324	dev_put(dev);	326	dev_put(dev);
325	return 0;	327	return 0;
@@ -469,8 +471,18 @@ static int vif_add(struct net net, struct vifctl vifc, int mrtsock)
469	return err;	471	return err;
470	}	472	}
471	break;	473	break;
		474
		475	case VIFF_USE_IFINDEX:
472	case 0:	476	case 0:
473	dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);	477	if (vifc->vifc_flags == VIFF_USE_IFINDEX) {
		478	dev = dev_get_by_index(net, vifc->vifc_lcl_ifindex);
		479	if (dev && dev->ip_ptr == NULL) {
		480	dev_put(dev);
		481	return -EADDRNOTAVAIL;
		482	}
		483	} else
		484	dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
		485
474	if (!dev)	486	if (!dev)
475	return -EADDRNOTAVAIL;	487	return -EADDRNOTAVAIL;
476	err = dev_set_allmulti(dev, 1);	488	err = dev_set_allmulti(dev, 1);
@@ -742,7 +754,8 @@ ipmr_cache_unresolved(struct net net, vifi_t vifi, struct sk_buff skb)
742	c->next = mfc_unres_queue;	754	c->next = mfc_unres_queue;
743	mfc_unres_queue = c;	755	mfc_unres_queue = c;
744		756
745	mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);	757	if (atomic_read(&net->ipv4.cache_resolve_queue_len) == 1)
		758	mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
746	}	759	}
747		760
748	/*	761	/*
@@ -791,6 +804,9 @@ static int ipmr_mfc_add(struct net net, struct mfcctl mfc, int mrtsock)
791	int line;	804	int line;
792	struct mfc_cache uc, c, **cp;	805	struct mfc_cache uc, c, **cp;
793		806
		807	if (mfc->mfcc_parent >= MAXVIFS)
		808	return -ENFILE;
		809
794	line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);	810	line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
795		811
796	for (cp = &net->ipv4.mfc_cache_array[line];	812	for (cp = &net->ipv4.mfc_cache_array[line];
@@ -862,14 +878,16 @@ static int ipmr_mfc_add(struct net net, struct mfcctl mfc, int mrtsock)
862	static void mroute_clean_tables(struct net *net)	878	static void mroute_clean_tables(struct net *net)
863	{	879	{
864	int i;	880	int i;
		881	LIST_HEAD(list);
865		882
866	/*	883	/*
867	* Shut down all active vif entries	884	* Shut down all active vif entries
868	*/	885	*/
869	for (i = 0; i < net->ipv4.maxvif; i++) {	886	for (i = 0; i < net->ipv4.maxvif; i++) {
870	if (!(net->ipv4.vif_table[i].flags&VIFF_STATIC))	887	if (!(net->ipv4.vif_table[i].flags&VIFF_STATIC))
871	vif_delete(net, i, 0);	888	vif_delete(net, i, 0, &list);
872	}	889	}
		890	unregister_netdevice_many(&list);
873		891
874	/*	892	/*
875	* Wipe the cache	893	* Wipe the cache
@@ -948,7 +966,7 @@ int ip_mroute_setsockopt(struct sock sk, int optname, char __user optval, unsi
948	switch (optname) {	966	switch (optname) {
949	case MRT_INIT:	967	case MRT_INIT:
950	if (sk->sk_type != SOCK_RAW \|\|	968	if (sk->sk_type != SOCK_RAW \|\|
951	inet_sk(sk)->num != IPPROTO_IGMP)	969	inet_sk(sk)->inet_num != IPPROTO_IGMP)
952	return -EOPNOTSUPP;	970	return -EOPNOTSUPP;
953	if (optlen != sizeof(int))	971	if (optlen != sizeof(int))
954	return -ENOPROTOOPT;	972	return -ENOPROTOOPT;
@@ -985,7 +1003,7 @@ int ip_mroute_setsockopt(struct sock sk, int optname, char __user optval, unsi
985	if (optname == MRT_ADD_VIF) {	1003	if (optname == MRT_ADD_VIF) {
986	ret = vif_add(net, &vif, sk == net->ipv4.mroute_sk);	1004	ret = vif_add(net, &vif, sk == net->ipv4.mroute_sk);
987	} else {	1005	} else {
988	ret = vif_delete(net, vif.vifc_vifi, 0);	1006	ret = vif_delete(net, vif.vifc_vifi, 0, NULL);
989	}	1007	}
990	rtnl_unlock();	1008	rtnl_unlock();
991	return ret;	1009	return ret;
@@ -1148,17 +1166,16 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
1148	struct net *net = dev_net(dev);	1166	struct net *net = dev_net(dev);
1149	struct vif_device *v;	1167	struct vif_device *v;
1150	int ct;	1168	int ct;
1151		1169	LIST_HEAD(list);
1152	if (!net_eq(dev_net(dev), net))
1153	return NOTIFY_DONE;
1154		1170
1155	if (event != NETDEV_UNREGISTER)	1171	if (event != NETDEV_UNREGISTER)
1156	return NOTIFY_DONE;	1172	return NOTIFY_DONE;
1157	v = &net->ipv4.vif_table[0];	1173	v = &net->ipv4.vif_table[0];
1158	for (ct = 0; ct < net->ipv4.maxvif; ct++, v++) {	1174	for (ct = 0; ct < net->ipv4.maxvif; ct++, v++) {
1159	if (v->dev == dev)	1175	if (v->dev == dev)
1160	vif_delete(net, ct, 1);	1176	vif_delete(net, ct, 1, &list);
1161	}	1177	}
		1178	unregister_netdevice_many(&list);
1162	return NOTIFY_DONE;	1179	return NOTIFY_DONE;
1163	}	1180	}
1164		1181
@@ -1601,17 +1618,20 @@ ipmr_fill_mroute(struct sk_buff skb, struct mfc_cache c, struct rtmsg *rtm)
1601	int ct;	1618	int ct;
1602	struct rtnexthop *nhp;	1619	struct rtnexthop *nhp;
1603	struct net *net = mfc_net(c);	1620	struct net *net = mfc_net(c);
1604	struct net_device *dev = net->ipv4.vif_table[c->mfc_parent].dev;
1605	u8 *b = skb_tail_pointer(skb);	1621	u8 *b = skb_tail_pointer(skb);
1606	struct rtattr *mp_head;	1622	struct rtattr *mp_head;
1607		1623
1608	if (dev)	1624	/* If cache is unresolved, don't try to parse IIF and OIF */
1609	RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);	1625	if (c->mfc_parent > MAXVIFS)
		1626	return -ENOENT;
		1627
		1628	if (VIF_EXISTS(net, c->mfc_parent))
		1629	RTA_PUT(skb, RTA_IIF, 4, &net->ipv4.vif_table[c->mfc_parent].dev->ifindex);
1610		1630
1611	mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));	1631	mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
1612		1632
1613	for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {	1633	for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
1614	if (c->mfc_un.res.ttls[ct] < 255) {	1634	if (VIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
1615	if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))	1635	if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
1616	goto rtattr_failure;	1636	goto rtattr_failure;
1617	nhp = (struct rtnexthop )skb_put(skb, RTA_ALIGN(sizeof(nhp)));	1637	nhp = (struct rtnexthop )skb_put(skb, RTA_ALIGN(sizeof(nhp)));