1 files changed, 74 insertions, 52 deletions

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8e80fd279100..7c7e963260e1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -222,11 +222,11 @@ static const u32 ip6_template_metrics[RTAX_MAX] = {
         [RTAX_HOPLIMIT - 1] = 255,
 };
 
-static struct rt6_info ip6_null_entry_template = {
+static const struct rt6_info ip6_null_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
                 .__use          = 1,
-                .obsolete       = -1,
+                .obsolete       = DST_OBSOLETE_FORCE_CHK,
                 .error          = -ENETUNREACH,
                 .input          = ip6_pkt_discard,
                 .output         = ip6_pkt_discard_out,
@@ -242,11 +242,11 @@ static struct rt6_info ip6_null_entry_template = {
 static int ip6_pkt_prohibit(struct sk_buff *skb);
 static int ip6_pkt_prohibit_out(struct sk_buff *skb);
 
-static struct rt6_info ip6_prohibit_entry_template = {
+static const struct rt6_info ip6_prohibit_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
                 .__use          = 1,
-                .obsolete       = -1,
+                .obsolete       = DST_OBSOLETE_FORCE_CHK,
                 .error          = -EACCES,
                 .input          = ip6_pkt_prohibit,
                 .output         = ip6_pkt_prohibit_out,
@@ -257,11 +257,11 @@ static struct rt6_info ip6_prohibit_entry_template = {
         .rt6i_ref       = ATOMIC_INIT(1),
 };
 
-static struct rt6_info ip6_blk_hole_entry_template = {
+static const struct rt6_info ip6_blk_hole_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
                 .__use          = 1,
-                .obsolete       = -1,
+                .obsolete       = DST_OBSOLETE_FORCE_CHK,
                 .error          = -EINVAL,
                 .input          = dst_discard,
                 .output         = dst_discard,
@@ -281,13 +281,14 @@ static inline struct rt6_info *ip6_dst_alloc(struct net *net,
                                              struct fib6_table *table)
 {
         struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
-                                        0, DST_OBSOLETE_NONE, flags);
+                                        0, DST_OBSOLETE_FORCE_CHK, flags);
 
         if (rt) {
                 struct dst_entry *dst = &rt->dst;
 
                 memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
                 rt6_init_peer(rt, table ? &table->tb6_peers : net->ipv6.peers);
+                rt->rt6i_genid = rt_genid(net);
         }
         return rt;
 }
@@ -369,15 +370,11 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 
 static bool rt6_check_expired(const struct rt6_info *rt)
 {
-        struct rt6_info *ort = NULL;
-
         if (rt->rt6i_flags & RTF_EXPIRES) {
                 if (time_after(jiffies, rt->dst.expires))
                         return true;
         } else if (rt->dst.from) {
-                ort = (struct rt6_info *) rt->dst.from;
-                return (ort->rt6i_flags & RTF_EXPIRES) &&
-                        time_after(jiffies, ort->dst.expires);
+                return rt6_check_expired((struct rt6_info *) rt->dst.from);
         }
         return false;
 }
@@ -451,10 +448,9 @@ static void rt6_probe(struct rt6_info *rt)
          * Router Reachability Probe MUST be rate-limited
          * to no more than one per minute.
          */
-        rcu_read_lock();
         neigh = rt ? rt->n : NULL;
         if (!neigh || (neigh->nud_state & NUD_VALID))
-                goto out;
+                return;
         read_lock_bh(&neigh->lock);
         if (!(neigh->nud_state & NUD_VALID) &&
             time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
@@ -470,8 +466,6 @@ static void rt6_probe(struct rt6_info *rt)
         } else {
                 read_unlock_bh(&neigh->lock);
         }
-out:
-        rcu_read_unlock();
 }
 #else
 static inline void rt6_probe(struct rt6_info *rt)
@@ -498,7 +492,6 @@ static inline int rt6_check_neigh(struct rt6_info *rt)
         struct neighbour *neigh;
         int m;
 
-        rcu_read_lock();
         neigh = rt->n;
         if (rt->rt6i_flags & RTF_NONEXTHOP ||
             !(rt->rt6i_flags & RTF_GATEWAY))
@@ -516,7 +509,6 @@ static inline int rt6_check_neigh(struct rt6_info *rt)
                 read_unlock_bh(&neigh->lock);
         } else
                 m = 0;
-        rcu_read_unlock();
         return m;
 }
 
@@ -965,7 +957,7 @@ struct dst_entry * ip6_route_output(struct net *net, const struct sock *sk,
 {
         int flags = 0;
 
-        fl6->flowi6_iif = net->loopback_dev->ifindex;
+        fl6->flowi6_iif = LOOPBACK_IFINDEX;
 
         if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr))
                 flags |= RT6_LOOKUP_F_IFACE;
@@ -1031,6 +1023,13 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt = (struct rt6_info *) dst;
 
+        /* All IPV6 dsts are created with ->obsolete set to the value
+         * DST_OBSOLETE_FORCE_CHK which forces validation calls down
+         * into this function always.
+         */
+        if (rt->rt6i_genid != rt_genid(dev_net(rt->dst.dev)))
+                return NULL;
+
         if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie)) {
                 if (rt->rt6i_peer_genid != rt6_peer_genid()) {
                         if (!rt6_has_peer(rt))
@@ -1397,8 +1396,6 @@ int ip6_route_add(struct fib6_config *cfg)
                 goto out;
         }
 
-        rt->dst.obsolete = -1;
-
         if (cfg->fc_flags & RTF_EXPIRES)
                 rt6_set_expires(rt, jiffies +
                                 clock_t_to_jiffies(cfg->fc_expires));
@@ -1463,8 +1460,21 @@ int ip6_route_add(struct fib6_config *cfg)
                 }
                 rt->dst.output = ip6_pkt_discard_out;
                 rt->dst.input = ip6_pkt_discard;
-                rt->dst.error = -ENETUNREACH;
                 rt->rt6i_flags = RTF_REJECT|RTF_NONEXTHOP;
+                switch (cfg->fc_type) {
+                case RTN_BLACKHOLE:
+                        rt->dst.error = -EINVAL;
+                        break;
+                case RTN_PROHIBIT:
+                        rt->dst.error = -EACCES;
+                        break;
+                case RTN_THROW:
+                        rt->dst.error = -EAGAIN;
+                        break;
+                default:
+                        rt->dst.error = -ENETUNREACH;
+                        break;
+                }
                 goto install_route;
         }
 
@@ -1583,17 +1593,18 @@ static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
         struct fib6_table *table;
         struct net *net = dev_net(rt->dst.dev);
 
-        if (rt == net->ipv6.ip6_null_entry)
-                return -ENOENT;
+        if (rt == net->ipv6.ip6_null_entry) {
+                err = -ENOENT;
+                goto out;
+        }
 
         table = rt->rt6i_table;
         write_lock_bh(&table->tb6_lock);
-
         err = fib6_del(rt, info);
-        dst_release(&rt->dst);
-
         write_unlock_bh(&table->tb6_lock);
 
+out:
+        dst_release(&rt->dst);
         return err;
 }
 
@@ -1829,7 +1840,7 @@ static struct rt6_info *rt6_get_route_info(struct net *net,
         if (!table)
                 return NULL;
 
-        write_lock_bh(&table->tb6_lock);
+        read_lock_bh(&table->tb6_lock);
         fn = fib6_locate(&table->tb6_root, prefix ,prefixlen, NULL, 0);
         if (!fn)
                 goto out;
@@ -1845,7 +1856,7 @@ static struct rt6_info *rt6_get_route_info(struct net *net,
                 break;
         }
 out:
-        write_unlock_bh(&table->tb6_lock);
+        read_unlock_bh(&table->tb6_lock);
         return rt;
 }
 
@@ -1861,7 +1872,7 @@ static struct rt6_info *rt6_add_route_info(struct net *net,
                 .fc_dst_len     = prefixlen,
                 .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO |
                                   RTF_UP | RTF_PREF(pref),
-                .fc_nlinfo.pid = 0,
+                .fc_nlinfo.portid = 0,
                 .fc_nlinfo.nlh = NULL,
                 .fc_nlinfo.nl_net = net,
         };
@@ -1888,7 +1899,7 @@ struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_dev
         if (!table)
                 return NULL;
 
-        write_lock_bh(&table->tb6_lock);
+        read_lock_bh(&table->tb6_lock);
         for (rt = table->tb6_root.leaf; rt; rt=rt->dst.rt6_next) {
                 if (dev == rt->dst.dev &&
                     ((rt->rt6i_flags & (RTF_ADDRCONF | RTF_DEFAULT)) == (RTF_ADDRCONF | RTF_DEFAULT)) &&
@@ -1897,7 +1908,7 @@ struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_dev
         }
         if (rt)
                 dst_hold(&rt->dst);
-        write_unlock_bh(&table->tb6_lock);
+        read_unlock_bh(&table->tb6_lock);
         return rt;
 }
 
@@ -1911,7 +1922,7 @@ struct rt6_info *rt6_add_dflt_router(const struct in6_addr *gwaddr,
                 .fc_ifindex     = dev->ifindex,
                 .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT |
                                   RTF_UP | RTF_EXPIRES | RTF_PREF(pref),
-                .fc_nlinfo.pid = 0,
+                .fc_nlinfo.portid = 0,
                 .fc_nlinfo.nlh = NULL,
                 .fc_nlinfo.nl_net = dev_net(dev),
         };
@@ -2080,7 +2091,6 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         rt->dst.input = ip6_input;
         rt->dst.output = ip6_output;
         rt->rt6i_idev = idev;
-        rt->dst.obsolete = -1;
 
         rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
         if (anycast)
@@ -2261,14 +2271,18 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         cfg->fc_src_len = rtm->rtm_src_len;
         cfg->fc_flags = RTF_UP;
         cfg->fc_protocol = rtm->rtm_protocol;
+        cfg->fc_type = rtm->rtm_type;
 
-        if (rtm->rtm_type == RTN_UNREACHABLE)
+        if (rtm->rtm_type == RTN_UNREACHABLE ||
+            rtm->rtm_type == RTN_BLACKHOLE ||
+            rtm->rtm_type == RTN_PROHIBIT ||
+            rtm->rtm_type == RTN_THROW)
                 cfg->fc_flags |= RTF_REJECT;
 
         if (rtm->rtm_type == RTN_LOCAL)
                 cfg->fc_flags |= RTF_LOCAL;
 
-        cfg->fc_nlinfo.pid = NETLINK_CB(skb).pid;
+        cfg->fc_nlinfo.portid = NETLINK_CB(skb).portid;
         cfg->fc_nlinfo.nlh = nlh;
         cfg->fc_nlinfo.nl_net = sock_net(skb->sk);
 
@@ -2359,7 +2373,7 @@ static inline size_t rt6_nlmsg_size(void)
 static int rt6_fill_node(struct net *net,
                          struct sk_buff *skb, struct rt6_info *rt,
                          struct in6_addr *dst, struct in6_addr *src,
-                         int iif, int type, u32 pid, u32 seq,
+                         int iif, int type, u32 portid, u32 seq,
                          int prefix, int nowait, unsigned int flags)
 {
         struct rtmsg *rtm;
@@ -2375,7 +2389,7 @@ static int rt6_fill_node(struct net *net,
                 }
         }
 
-        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*rtm), flags);
+        nlh = nlmsg_put(skb, portid, seq, type, sizeof(*rtm), flags);
         if (!nlh)
                 return -EMSGSIZE;
 
@@ -2391,8 +2405,22 @@ static int rt6_fill_node(struct net *net,
         rtm->rtm_table = table;
         if (nla_put_u32(skb, RTA_TABLE, table))
                 goto nla_put_failure;
-        if (rt->rt6i_flags & RTF_REJECT)
-                rtm->rtm_type = RTN_UNREACHABLE;
+        if (rt->rt6i_flags & RTF_REJECT) {
+                switch (rt->dst.error) {
+                case -EINVAL:
+                        rtm->rtm_type = RTN_BLACKHOLE;
+                        break;
+                case -EACCES:
+                        rtm->rtm_type = RTN_PROHIBIT;
+                        break;
+                case -EAGAIN:
+                        rtm->rtm_type = RTN_THROW;
+                        break;
+                default:
+                        rtm->rtm_type = RTN_UNREACHABLE;
+                        break;
+                }
+        }
         else if (rt->rt6i_flags & RTF_LOCAL)
                 rtm->rtm_type = RTN_LOCAL;
         else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
@@ -2465,15 +2493,11 @@ static int rt6_fill_node(struct net *net,
         if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto nla_put_failure;
 
-        rcu_read_lock();
         n = rt->n;
         if (n) {
-                if (nla_put(skb, RTA_GATEWAY, 16, &n->primary_key) < 0) {
-                        rcu_read_unlock();
+                if (nla_put(skb, RTA_GATEWAY, 16, &n->primary_key) < 0)
                         goto nla_put_failure;
-                }
         }
-        rcu_read_unlock();
 
         if (rt->dst.dev &&
             nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
@@ -2506,7 +2530,7 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
 
         return rt6_fill_node(arg->net,
                      arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
-                     NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
+                     NETLINK_CB(arg->cb->skb).portid, arg->cb->nlh->nlmsg_seq,
                      prefix, 0, NLM_F_MULTI);
 }
 
@@ -2586,14 +2610,14 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         skb_dst_set(skb, &rt->dst);
 
         err = rt6_fill_node(net, skb, rt, &fl6.daddr, &fl6.saddr, iif,
-                            RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
+                            RTM_NEWROUTE, NETLINK_CB(in_skb).portid,
                             nlh->nlmsg_seq, 0, 0, 0);
         if (err < 0) {
                 kfree_skb(skb);
                 goto errout;
         }
 
-        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid);
+        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
 errout:
         return err;
 }
@@ -2613,14 +2637,14 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
                 goto errout;
 
         err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
-                                event, info->pid, seq, 0, 0, 0);
+                                event, info->portid, seq, 0, 0, 0);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
                 kfree_skb(skb);
                 goto errout;
         }
-        rtnl_notify(skb, net, info->pid, RTNLGRP_IPV6_ROUTE,
+        rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE,
                     info->nlh, gfp_any());
         return;
 errout:
@@ -2675,14 +2699,12 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 #else
         seq_puts(m, "00000000000000000000000000000000 00 ");
 #endif
-        rcu_read_lock();
         n = rt->n;
         if (n) {
                 seq_printf(m, "%pi6", n->primary_key);
         } else {
                 seq_puts(m, "00000000000000000000000000000000");
         }
-        rcu_read_unlock();
         seq_printf(m, " %08x %08x %08x %08x %8s\n",
                    rt->rt6i_metric, atomic_read(&rt->dst.__refcnt),
                    rt->dst.__use, rt->rt6i_flags,