~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv6/ip6_output.c

Version: ~ [ linux-5.15-rc1 ] ~ [ linux-5.14.5 ] ~ [ linux-5.13.18 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.66 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.147 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.206 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.246 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.282 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.283 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  *      IPv6 output functions
  3  *      Linux INET6 implementation
  4  *
  5  *      Authors:
  6  *      Pedro Roque             <roque@di.fc.ul.pt>
  7  *
  8  *      Based on linux/net/ipv4/ip_output.c
  9  *
 10  *      This program is free software; you can redistribute it and/or
 11  *      modify it under the terms of the GNU General Public License
 12  *      as published by the Free Software Foundation; either version
 13  *      2 of the License, or (at your option) any later version.
 14  *
 15  *      Changes:
 16  *      A.N.Kuznetsov   :       airthmetics in fragmentation.
 17  *                              extension headers are implemented.
 18  *                              route changes now work.
 19  *                              ip6_forward does not confuse sniffers.
 20  *                              etc.
 21  *
 22  *      H. von Brand    :       Added missing #include <linux/string.h>
 23  *      Imran Patel     :       frag id should be in NBO
 24  *      Kazunori MIYAZAWA @USAGI
 25  *                      :       add ip6_append_data and related functions
 26  *                              for datagram xmit
 27  */
 28 
 29 #include <linux/errno.h>
 30 #include <linux/kernel.h>
 31 #include <linux/string.h>
 32 #include <linux/socket.h>
 33 #include <linux/net.h>
 34 #include <linux/netdevice.h>
 35 #include <linux/if_arp.h>
 36 #include <linux/in6.h>
 37 #include <linux/tcp.h>
 38 #include <linux/route.h>
 39 #include <linux/module.h>
 40 #include <linux/slab.h>
 41 
 42 #include <linux/bpf-cgroup.h>
 43 #include <linux/netfilter.h>
 44 #include <linux/netfilter_ipv6.h>
 45 
 46 #include <net/sock.h>
 47 #include <net/snmp.h>
 48 
 49 #include <net/ipv6.h>
 50 #include <net/ndisc.h>
 51 #include <net/protocol.h>
 52 #include <net/ip6_route.h>
 53 #include <net/addrconf.h>
 54 #include <net/rawv6.h>
 55 #include <net/icmp.h>
 56 #include <net/xfrm.h>
 57 #include <net/checksum.h>
 58 #include <linux/mroute6.h>
 59 #include <net/l3mdev.h>
 60 #include <net/lwtunnel.h>
 61 
 62 static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
 63 {
 64         struct dst_entry *dst = skb_dst(skb);
 65         struct net_device *dev = dst->dev;
 66         struct neighbour *neigh;
 67         struct in6_addr *nexthop;
 68         int ret;
 69 
 70         skb->protocol = htons(ETH_P_IPV6);
 71         skb->dev = dev;
 72 
 73         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
 74                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 75 
 76                 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(sk) &&
 77                     ((mroute6_socket(net, skb) &&
 78                      !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
 79                      ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
 80                                          &ipv6_hdr(skb)->saddr))) {
 81                         struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
 82 
 83                         /* Do not check for IFF_ALLMULTI; multicast routing
 84                            is not supported in any case.
 85                          */
 86                         if (newskb)
 87                                 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
 88                                         net, sk, newskb, NULL, newskb->dev,
 89                                         dev_loopback_xmit);
 90 
 91                         if (ipv6_hdr(skb)->hop_limit == 0) {
 92                                 IP6_INC_STATS(net, idev,
 93                                               IPSTATS_MIB_OUTDISCARDS);
 94                                 kfree_skb(skb);
 95                                 return 0;
 96                         }
 97                 }
 98 
 99                 IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, skb->len);
100 
101                 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
102                     IPV6_ADDR_SCOPE_NODELOCAL &&
103                     !(dev->flags & IFF_LOOPBACK)) {
104                         kfree_skb(skb);
105                         return 0;
106                 }
107         }
108 
109         if (lwtunnel_xmit_redirect(dst->lwtstate)) {
110                 int res = lwtunnel_xmit(skb);
111 
112                 if (res < 0 || res == LWTUNNEL_XMIT_DONE)
113                         return res;
114         }
115 
116         rcu_read_lock_bh();
117         nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
118         neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
119         if (unlikely(!neigh))
120                 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
121         if (!IS_ERR(neigh)) {
122                 sock_confirm_neigh(skb, neigh);
123                 ret = neigh_output(neigh, skb);
124                 rcu_read_unlock_bh();
125                 return ret;
126         }
127         rcu_read_unlock_bh();
128 
129         IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
130         kfree_skb(skb);
131         return -EINVAL;
132 }
133 
134 static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
135 {
136         int ret;
137 
138         ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
139         if (ret) {
140                 kfree_skb(skb);
141                 return ret;
142         }
143 
144         if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
145             dst_allfrag(skb_dst(skb)) ||
146             (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
147                 return ip6_fragment(net, sk, skb, ip6_finish_output2);
148         else
149                 return ip6_finish_output2(net, sk, skb);
150 }
151 
152 int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
153 {
154         struct net_device *dev = skb_dst(skb)->dev;
155         struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
156 
157         if (unlikely(idev->cnf.disable_ipv6)) {
158                 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
159                 kfree_skb(skb);
160                 return 0;
161         }
162 
163         return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
164                             net, sk, skb, NULL, dev,
165                             ip6_finish_output,
166                             !(IP6CB(skb)->flags & IP6SKB_REROUTED));
167 }
168 
169 /*
170  * xmit an sk_buff (used by TCP, SCTP and DCCP)
171  * Note : socket lock is not held for SYNACK packets, but might be modified
172  * by calls to skb_set_owner_w() and ipv6_local_error(),
173  * which are using proper atomic operations or spinlocks.
174  */
175 int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
176              __u32 mark, struct ipv6_txoptions *opt, int tclass)
177 {
178         struct net *net = sock_net(sk);
179         const struct ipv6_pinfo *np = inet6_sk(sk);
180         struct in6_addr *first_hop = &fl6->daddr;
181         struct dst_entry *dst = skb_dst(skb);
182         struct ipv6hdr *hdr;
183         u8  proto = fl6->flowi6_proto;
184         int seg_len = skb->len;
185         int hlimit = -1;
186         u32 mtu;
187 
188         if (opt) {
189                 unsigned int head_room;
190 
191                 /* First: exthdrs may take lots of space (~8K for now)
192                    MAX_HEADER is not enough.
193                  */
194                 head_room = opt->opt_nflen + opt->opt_flen;
195                 seg_len += head_room;
196                 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
197 
198                 if (skb_headroom(skb) < head_room) {
199                         struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
200                         if (!skb2) {
201                                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
202                                               IPSTATS_MIB_OUTDISCARDS);
203                                 kfree_skb(skb);
204                                 return -ENOBUFS;
205                         }
206                         consume_skb(skb);
207                         skb = skb2;
208                         /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically,
209                          * it is safe to call in our context (socket lock not held)
210                          */
211                         skb_set_owner_w(skb, (struct sock *)sk);
212                 }
213                 if (opt->opt_flen)
214                         ipv6_push_frag_opts(skb, opt, &proto);
215                 if (opt->opt_nflen)
216                         ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop,
217                                              &fl6->saddr);
218         }
219 
220         skb_push(skb, sizeof(struct ipv6hdr));
221         skb_reset_network_header(skb);
222         hdr = ipv6_hdr(skb);
223 
224         /*
225          *      Fill in the IPv6 header
226          */
227         if (np)
228                 hlimit = np->hop_limit;
229         if (hlimit < 0)
230                 hlimit = ip6_dst_hoplimit(dst);
231 
232         ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
233                                                      np->autoflowlabel, fl6));
234 
235         hdr->payload_len = htons(seg_len);
236         hdr->nexthdr = proto;
237         hdr->hop_limit = hlimit;
238 
239         hdr->saddr = fl6->saddr;
240         hdr->daddr = *first_hop;
241 
242         skb->protocol = htons(ETH_P_IPV6);
243         skb->priority = sk->sk_priority;
244         skb->mark = mark;
245 
246         mtu = dst_mtu(dst);
247         if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
248                 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
249                               IPSTATS_MIB_OUT, skb->len);
250 
251                 /* if egress device is enslaved to an L3 master device pass the
252                  * skb to its handler for processing
253                  */
254                 skb = l3mdev_ip6_out((struct sock *)sk, skb);
255                 if (unlikely(!skb))
256                         return 0;
257 
258                 /* hooks should never assume socket lock is held.
259                  * we promote our socket to non const
260                  */
261                 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
262                                net, (struct sock *)sk, skb, NULL, dst->dev,
263                                dst_output);
264         }
265 
266         skb->dev = dst->dev;
267         /* ipv6_local_error() does not require socket lock,
268          * we promote our socket to non const
269          */
270         ipv6_local_error((struct sock *)sk, EMSGSIZE, fl6, mtu);
271 
272         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
273         kfree_skb(skb);
274         return -EMSGSIZE;
275 }
276 EXPORT_SYMBOL(ip6_xmit);
277 
278 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
279 {
280         struct ip6_ra_chain *ra;
281         struct sock *last = NULL;
282 
283         read_lock(&ip6_ra_lock);
284         for (ra = ip6_ra_chain; ra; ra = ra->next) {
285                 struct sock *sk = ra->sk;
286                 if (sk && ra->sel == sel &&
287                     (!sk->sk_bound_dev_if ||
288                      sk->sk_bound_dev_if == skb->dev->ifindex)) {
289                         if (last) {
290                                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
291                                 if (skb2)
292                                         rawv6_rcv(last, skb2);
293                         }
294                         last = sk;
295                 }
296         }
297 
298         if (last) {
299                 rawv6_rcv(last, skb);
300                 read_unlock(&ip6_ra_lock);
301                 return 1;
302         }
303         read_unlock(&ip6_ra_lock);
304         return 0;
305 }
306 
307 static int ip6_forward_proxy_check(struct sk_buff *skb)
308 {
309         struct ipv6hdr *hdr = ipv6_hdr(skb);
310         u8 nexthdr = hdr->nexthdr;
311         __be16 frag_off;
312         int offset;
313 
314         if (ipv6_ext_hdr(nexthdr)) {
315                 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
316                 if (offset < 0)
317                         return 0;
318         } else
319                 offset = sizeof(struct ipv6hdr);
320 
321         if (nexthdr == IPPROTO_ICMPV6) {
322                 struct icmp6hdr *icmp6;
323 
324                 if (!pskb_may_pull(skb, (skb_network_header(skb) +
325                                          offset + 1 - skb->data)))
326                         return 0;
327 
328                 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
329 
330                 switch (icmp6->icmp6_type) {
331                 case NDISC_ROUTER_SOLICITATION:
332                 case NDISC_ROUTER_ADVERTISEMENT:
333                 case NDISC_NEIGHBOUR_SOLICITATION:
334                 case NDISC_NEIGHBOUR_ADVERTISEMENT:
335                 case NDISC_REDIRECT:
336                         /* For reaction involving unicast neighbor discovery
337                          * message destined to the proxied address, pass it to
338                          * input function.
339                          */
340                         return 1;
341                 default:
342                         break;
343                 }
344         }
345 
346         /*
347          * The proxying router can't forward traffic sent to a link-local
348          * address, so signal the sender and discard the packet. This
349          * behavior is clarified by the MIPv6 specification.
350          */
351         if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
352                 dst_link_failure(skb);
353                 return -1;
354         }
355 
356         return 0;
357 }
358 
359 static inline int ip6_forward_finish(struct net *net, struct sock *sk,
360                                      struct sk_buff *skb)
361 {
362         return dst_output(net, sk, skb);
363 }
364 
365 static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
366 {
367         unsigned int mtu;
368         struct inet6_dev *idev;
369 
370         if (dst_metric_locked(dst, RTAX_MTU)) {
371                 mtu = dst_metric_raw(dst, RTAX_MTU);
372                 if (mtu)
373                         return mtu;
374         }
375 
376         mtu = IPV6_MIN_MTU;
377         rcu_read_lock();
378         idev = __in6_dev_get(dst->dev);
379         if (idev)
380                 mtu = idev->cnf.mtu6;
381         rcu_read_unlock();
382 
383         return mtu;
384 }
385 
386 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
387 {
388         if (skb->len <= mtu)
389                 return false;
390 
391         /* ipv6 conntrack defrag sets max_frag_size + ignore_df */
392         if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
393                 return true;
394 
395         if (skb->ignore_df)
396                 return false;
397 
398         if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
399                 return false;
400 
401         return true;
402 }
403 
404 int ip6_forward(struct sk_buff *skb)
405 {
406         struct dst_entry *dst = skb_dst(skb);
407         struct ipv6hdr *hdr = ipv6_hdr(skb);
408         struct inet6_skb_parm *opt = IP6CB(skb);
409         struct net *net = dev_net(dst->dev);
410         u32 mtu;
411 
412         if (net->ipv6.devconf_all->forwarding == 0)
413                 goto error;
414 
415         if (skb->pkt_type != PACKET_HOST)
416                 goto drop;
417 
418         if (unlikely(skb->sk))
419                 goto drop;
420 
421         if (skb_warn_if_lro(skb))
422                 goto drop;
423 
424         if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
425                 __IP6_INC_STATS(net, ip6_dst_idev(dst),
426                                 IPSTATS_MIB_INDISCARDS);
427                 goto drop;
428         }
429 
430         skb_forward_csum(skb);
431 
432         /*
433          *      We DO NOT make any processing on
434          *      RA packets, pushing them to user level AS IS
435          *      without ane WARRANTY that application will be able
436          *      to interpret them. The reason is that we
437          *      cannot make anything clever here.
438          *
439          *      We are not end-node, so that if packet contains
440          *      AH/ESP, we cannot make anything.
441          *      Defragmentation also would be mistake, RA packets
442          *      cannot be fragmented, because there is no warranty
443          *      that different fragments will go along one path. --ANK
444          */
445         if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
446                 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
447                         return 0;
448         }
449 
450         /*
451          *      check and decrement ttl
452          */
453         if (hdr->hop_limit <= 1) {
454                 /* Force OUTPUT device used as source address */
455                 skb->dev = dst->dev;
456                 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
457                 __IP6_INC_STATS(net, ip6_dst_idev(dst),
458                                 IPSTATS_MIB_INHDRERRORS);
459 
460                 kfree_skb(skb);
461                 return -ETIMEDOUT;
462         }
463 
464         /* XXX: idev->cnf.proxy_ndp? */
465         if (net->ipv6.devconf_all->proxy_ndp &&
466             pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
467                 int proxied = ip6_forward_proxy_check(skb);
468                 if (proxied > 0)
469                         return ip6_input(skb);
470                 else if (proxied < 0) {
471                         __IP6_INC_STATS(net, ip6_dst_idev(dst),
472                                         IPSTATS_MIB_INDISCARDS);
473                         goto drop;
474                 }
475         }
476 
477         if (!xfrm6_route_forward(skb)) {
478                 __IP6_INC_STATS(net, ip6_dst_idev(dst),
479                                 IPSTATS_MIB_INDISCARDS);
480                 goto drop;
481         }
482         dst = skb_dst(skb);
483 
484         /* IPv6 specs say nothing about it, but it is clear that we cannot
485            send redirects to source routed frames.
486            We don't send redirects to frames decapsulated from IPsec.
487          */
488         if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
489                 struct in6_addr *target = NULL;
490                 struct inet_peer *peer;
491                 struct rt6_info *rt;
492 
493                 /*
494                  *      incoming and outgoing devices are the same
495                  *      send a redirect.
496                  */
497 
498                 rt = (struct rt6_info *) dst;
499                 if (rt->rt6i_flags & RTF_GATEWAY)
500                         target = &rt->rt6i_gateway;
501                 else
502                         target = &hdr->daddr;
503 
504                 peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1);
505 
506                 /* Limit redirects both by destination (here)
507                    and by source (inside ndisc_send_redirect)
508                  */
509                 if (inet_peer_xrlim_allow(peer, 1*HZ))
510                         ndisc_send_redirect(skb, target);
511                 if (peer)
512                         inet_putpeer(peer);
513         } else {
514                 int addrtype = ipv6_addr_type(&hdr->saddr);
515 
516                 /* This check is security critical. */
517                 if (addrtype == IPV6_ADDR_ANY ||
518                     addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
519                         goto error;
520                 if (addrtype & IPV6_ADDR_LINKLOCAL) {
521                         icmpv6_send(skb, ICMPV6_DEST_UNREACH,
522                                     ICMPV6_NOT_NEIGHBOUR, 0);
523                         goto error;
524                 }
525         }
526 
527         mtu = ip6_dst_mtu_forward(dst);
528         if (mtu < IPV6_MIN_MTU)
529                 mtu = IPV6_MIN_MTU;
530 
531         if (ip6_pkt_too_big(skb, mtu)) {
532                 /* Again, force OUTPUT device used as source address */
533                 skb->dev = dst->dev;
534                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
535                 __IP6_INC_STATS(net, ip6_dst_idev(dst),
536                                 IPSTATS_MIB_INTOOBIGERRORS);
537                 __IP6_INC_STATS(net, ip6_dst_idev(dst),
538                                 IPSTATS_MIB_FRAGFAILS);
539                 kfree_skb(skb);
540                 return -EMSGSIZE;
541         }
542 
543         if (skb_cow(skb, dst->dev->hard_header_len)) {
544                 __IP6_INC_STATS(net, ip6_dst_idev(dst),
545                                 IPSTATS_MIB_OUTDISCARDS);
546                 goto drop;
547         }
548 
549         hdr = ipv6_hdr(skb);
550 
551         /* Mangling hops number delayed to point after skb COW */
552 
553         hdr->hop_limit--;
554 
555         __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
556         __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
557         return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
558                        net, NULL, skb, skb->dev, dst->dev,
559                        ip6_forward_finish);
560 
561 error:
562         __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
563 drop:
564         kfree_skb(skb);
565         return -EINVAL;
566 }
567 
568 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
569 {
570         to->pkt_type = from->pkt_type;
571         to->priority = from->priority;
572         to->protocol = from->protocol;
573         skb_dst_drop(to);
574         skb_dst_set(to, dst_clone(skb_dst(from)));
575         to->dev = from->dev;
576         to->mark = from->mark;
577 
578 #ifdef CONFIG_NET_SCHED
579         to->tc_index = from->tc_index;
580 #endif
581         nf_copy(to, from);
582         skb_copy_secmark(to, from);
583 }
584 
585 int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
586                  int (*output)(struct net *, struct sock *, struct sk_buff *))
587 {
588         struct sk_buff *frag;
589         struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
590         struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
591                                 inet6_sk(skb->sk) : NULL;
592         struct ipv6hdr *tmp_hdr;
593         struct frag_hdr *fh;
594         unsigned int mtu, hlen, left, len;
595         int hroom, troom;
596         __be32 frag_id;
597         int ptr, offset = 0, err = 0;
598         u8 *prevhdr, nexthdr = 0;
599 
600         err = ip6_find_1stfragopt(skb, &prevhdr);
601         if (err < 0)
602                 goto fail;
603         hlen = err;
604         nexthdr = *prevhdr;
605 
606         mtu = ip6_skb_dst_mtu(skb);
607 
608         /* We must not fragment if the socket is set to force MTU discovery
609          * or if the skb it not generated by a local socket.
610          */
611         if (unlikely(!skb->ignore_df && skb->len > mtu))
612                 goto fail_toobig;
613 
614         if (IP6CB(skb)->frag_max_size) {
615                 if (IP6CB(skb)->frag_max_size > mtu)
616                         goto fail_toobig;
617 
618                 /* don't send fragments larger than what we received */
619                 mtu = IP6CB(skb)->frag_max_size;
620                 if (mtu < IPV6_MIN_MTU)
621                         mtu = IPV6_MIN_MTU;
622         }
623 
624         if (np && np->frag_size < mtu) {
625                 if (np->frag_size)
626                         mtu = np->frag_size;
627         }
628         if (mtu < hlen + sizeof(struct frag_hdr) + 8)
629                 goto fail_toobig;
630         mtu -= hlen + sizeof(struct frag_hdr);
631 
632         frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
633                                     &ipv6_hdr(skb)->saddr);
634 
635         if (skb->ip_summed == CHECKSUM_PARTIAL &&
636             (err = skb_checksum_help(skb)))
637                 goto fail;
638 
639         hroom = LL_RESERVED_SPACE(rt->dst.dev);
640         if (skb_has_frag_list(skb)) {
641                 unsigned int first_len = skb_pagelen(skb);
642                 struct sk_buff *frag2;
643 
644                 if (first_len - hlen > mtu ||
645                     ((first_len - hlen) & 7) ||
646                     skb_cloned(skb) ||
647                     skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
648                         goto slow_path;
649 
650                 skb_walk_frags(skb, frag) {
651                         /* Correct geometry. */
652                         if (frag->len > mtu ||
653                             ((frag->len & 7) && frag->next) ||
654                             skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))
655                                 goto slow_path_clean;
656 
657                         /* Partially cloned skb? */
658                         if (skb_shared(frag))
659                                 goto slow_path_clean;
660 
661                         BUG_ON(frag->sk);
662                         if (skb->sk) {
663                                 frag->sk = skb->sk;
664                                 frag->destructor = sock_wfree;
665                         }
666                         skb->truesize -= frag->truesize;
667                 }
668 
669                 err = 0;
670                 offset = 0;
671                 /* BUILD HEADER */
672 
673                 *prevhdr = NEXTHDR_FRAGMENT;
674                 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
675                 if (!tmp_hdr) {
676                         err = -ENOMEM;
677                         goto fail;
678                 }
679                 frag = skb_shinfo(skb)->frag_list;
680                 skb_frag_list_init(skb);
681 
682                 __skb_pull(skb, hlen);
683                 fh = (struct frag_hdr *)__skb_push(skb, sizeof(struct frag_hdr));
684                 __skb_push(skb, hlen);
685                 skb_reset_network_header(skb);
686                 memcpy(skb_network_header(skb), tmp_hdr, hlen);
687 
688                 fh->nexthdr = nexthdr;
689                 fh->reserved = 0;
690                 fh->frag_off = htons(IP6_MF);
691                 fh->identification = frag_id;
692 
693                 first_len = skb_pagelen(skb);
694                 skb->data_len = first_len - skb_headlen(skb);
695                 skb->len = first_len;
696                 ipv6_hdr(skb)->payload_len = htons(first_len -
697                                                    sizeof(struct ipv6hdr));
698 
699                 dst_hold(&rt->dst);
700 
701                 for (;;) {
702                         /* Prepare header of the next frame,
703                          * before previous one went down. */
704                         if (frag) {
705                                 frag->ip_summed = CHECKSUM_NONE;
706                                 skb_reset_transport_header(frag);
707                                 fh = (struct frag_hdr *)__skb_push(frag, sizeof(struct frag_hdr));
708                                 __skb_push(frag, hlen);
709                                 skb_reset_network_header(frag);
710                                 memcpy(skb_network_header(frag), tmp_hdr,
711                                        hlen);
712                                 offset += skb->len - hlen - sizeof(struct frag_hdr);
713                                 fh->nexthdr = nexthdr;
714                                 fh->reserved = 0;
715                                 fh->frag_off = htons(offset);
716                                 if (frag->next)
717                                         fh->frag_off |= htons(IP6_MF);
718                                 fh->identification = frag_id;
719                                 ipv6_hdr(frag)->payload_len =
720                                                 htons(frag->len -
721                                                       sizeof(struct ipv6hdr));
722                                 ip6_copy_metadata(frag, skb);
723                         }
724 
725                         err = output(net, sk, skb);
726                         if (!err)
727                                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
728                                               IPSTATS_MIB_FRAGCREATES);
729 
730                         if (err || !frag)
731                                 break;
732 
733                         skb = frag;
734                         frag = skb->next;
735                         skb->next = NULL;
736                 }
737 
738                 kfree(tmp_hdr);
739 
740                 if (err == 0) {
741                         IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
742                                       IPSTATS_MIB_FRAGOKS);
743                         ip6_rt_put(rt);
744                         return 0;
745                 }
746 
747                 kfree_skb_list(frag);
748 
749                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
750                               IPSTATS_MIB_FRAGFAILS);
751                 ip6_rt_put(rt);
752                 return err;
753 
754 slow_path_clean:
755                 skb_walk_frags(skb, frag2) {
756                         if (frag2 == frag)
757                                 break;
758                         frag2->sk = NULL;
759                         frag2->destructor = NULL;
760                         skb->truesize += frag2->truesize;
761                 }
762         }
763 
764 slow_path:
765         left = skb->len - hlen;         /* Space per frame */
766         ptr = hlen;                     /* Where to start from */
767 
768         /*
769          *      Fragment the datagram.
770          */
771 
772         troom = rt->dst.dev->needed_tailroom;
773 
774         /*
775          *      Keep copying data until we run out.
776          */
777         while (left > 0)        {
778                 u8 *fragnexthdr_offset;
779 
780                 len = left;
781                 /* IF: it doesn't fit, use 'mtu' - the data space left */
782                 if (len > mtu)
783                         len = mtu;
784                 /* IF: we are not sending up to and including the packet end
785                    then align the next start on an eight byte boundary */
786                 if (len < left) {
787                         len &= ~7;
788                 }
789 
790                 /* Allocate buffer */
791                 frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
792                                  hroom + troom, GFP_ATOMIC);
793                 if (!frag) {
794                         err = -ENOMEM;
795                         goto fail;
796                 }
797 
798                 /*
799                  *      Set up data on packet
800                  */
801 
802                 ip6_copy_metadata(frag, skb);
803                 skb_reserve(frag, hroom);
804                 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
805                 skb_reset_network_header(frag);
806                 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
807                 frag->transport_header = (frag->network_header + hlen +
808                                           sizeof(struct frag_hdr));
809 
810                 /*
811                  *      Charge the memory for the fragment to any owner
812                  *      it might possess
813                  */
814                 if (skb->sk)
815                         skb_set_owner_w(frag, skb->sk);
816 
817                 /*
818                  *      Copy the packet header into the new buffer.
819                  */
820                 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
821 
822                 fragnexthdr_offset = skb_network_header(frag);
823                 fragnexthdr_offset += prevhdr - skb_network_header(skb);
824                 *fragnexthdr_offset = NEXTHDR_FRAGMENT;
825 
826                 /*
827                  *      Build fragment header.
828                  */
829                 fh->nexthdr = nexthdr;
830                 fh->reserved = 0;
831                 fh->identification = frag_id;
832 
833                 /*
834                  *      Copy a block of the IP datagram.
835                  */
836                 BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),
837                                      len));
838                 left -= len;
839 
840                 fh->frag_off = htons(offset);
841                 if (left > 0)
842                         fh->frag_off |= htons(IP6_MF);
843                 ipv6_hdr(frag)->payload_len = htons(frag->len -
844                                                     sizeof(struct ipv6hdr));
845 
846                 ptr += len;
847                 offset += len;
848 
849                 /*
850                  *      Put this fragment into the sending queue.
851                  */
852                 err = output(net, sk, frag);
853                 if (err)
854                         goto fail;
855 
856                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
857                               IPSTATS_MIB_FRAGCREATES);
858         }
859         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
860                       IPSTATS_MIB_FRAGOKS);
861         consume_skb(skb);
862         return err;
863 
864 fail_toobig:
865         if (skb->sk && dst_allfrag(skb_dst(skb)))
866                 sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
867 
868         skb->dev = skb_dst(skb)->dev;
869         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
870         err = -EMSGSIZE;
871 
872 fail:
873         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
874                       IPSTATS_MIB_FRAGFAILS);
875         kfree_skb(skb);
876         return err;
877 }
878 
879 static inline int ip6_rt_check(const struct rt6key *rt_key,
880                                const struct in6_addr *fl_addr,
881                                const struct in6_addr *addr_cache)
882 {
883         return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
884                 (!addr_cache || !ipv6_addr_equal(fl_addr, addr_cache));
885 }
886 
887 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
888                                           struct dst_entry *dst,
889                                           const struct flowi6 *fl6)
890 {
891         struct ipv6_pinfo *np = inet6_sk(sk);
892         struct rt6_info *rt;
893 
894         if (!dst)
895                 goto out;
896 
897         if (dst->ops->family != AF_INET6) {
898                 dst_release(dst);
899                 return NULL;
900         }
901 
902         rt = (struct rt6_info *)dst;
903         /* Yes, checking route validity in not connected
904          * case is not very simple. Take into account,
905          * that we do not support routing by source, TOS,
906          * and MSG_DONTROUTE            --ANK (980726)
907          *
908          * 1. ip6_rt_check(): If route was host route,
909          *    check that cached destination is current.
910          *    If it is network route, we still may
911          *    check its validity using saved pointer
912          *    to the last used address: daddr_cache.
913          *    We do not want to save whole address now,
914          *    (because main consumer of this service
915          *    is tcp, which has not this problem),
916          *    so that the last trick works only on connected
917          *    sockets.
918          * 2. oif also should be the same.
919          */
920         if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
921 #ifdef CONFIG_IPV6_SUBTREES
922             ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
923 #endif
924            (!(fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF) &&
925               (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex))) {
926                 dst_release(dst);
927                 dst = NULL;
928         }
929 
930 out:
931         return dst;
932 }
933 
934 static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
935                                struct dst_entry **dst, struct flowi6 *fl6)
936 {
937 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
938         struct neighbour *n;
939         struct rt6_info *rt;
940 #endif
941         int err;
942         int flags = 0;
943 
944         /* The correct way to handle this would be to do
945          * ip6_route_get_saddr, and then ip6_route_output; however,
946          * the route-specific preferred source forces the
947          * ip6_route_output call _before_ ip6_route_get_saddr.
948          *
949          * In source specific routing (no src=any default route),
950          * ip6_route_output will fail given src=any saddr, though, so
951          * that's why we try it again later.
952          */
953         if (ipv6_addr_any(&fl6->saddr) && (!*dst || !(*dst)->error)) {
954                 struct rt6_info *rt;
955                 bool had_dst = *dst != NULL;
956 
957                 if (!had_dst)
958                         *dst = ip6_route_output(net, sk, fl6);
959                 rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
960                 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
961                                           sk ? inet6_sk(sk)->srcprefs : 0,
962                                           &fl6->saddr);
963                 if (err)
964                         goto out_err_release;
965 
966                 /* If we had an erroneous initial result, pretend it
967                  * never existed and let the SA-enabled version take
968                  * over.
969                  */
970                 if (!had_dst && (*dst)->error) {
971                         dst_release(*dst);
972                         *dst = NULL;
973                 }
974 
975                 if (fl6->flowi6_oif)
976                         flags |= RT6_LOOKUP_F_IFACE;
977         }
978 
979         if (!*dst)
980                 *dst = ip6_route_output_flags(net, sk, fl6, flags);
981 
982         err = (*dst)->error;
983         if (err)
984                 goto out_err_release;
985 
986 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
987         /*
988          * Here if the dst entry we've looked up
989          * has a neighbour entry that is in the INCOMPLETE
990          * state and the src address from the flow is
991          * marked as OPTIMISTIC, we release the found
992          * dst entry and replace it instead with the
993          * dst entry of the nexthop router
994          */
995         rt = (struct rt6_info *) *dst;
996         rcu_read_lock_bh();
997         n = __ipv6_neigh_lookup_noref(rt->dst.dev,
998                                       rt6_nexthop(rt, &fl6->daddr));
999         err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
1000         rcu_read_unlock_bh();
1001 
1002         if (err) {
1003                 struct inet6_ifaddr *ifp;
1004                 struct flowi6 fl_gw6;
1005                 int redirect;
1006 
1007                 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
1008                                       (*dst)->dev, 1);
1009 
1010                 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
1011                 if (ifp)
1012                         in6_ifa_put(ifp);
1013 
1014                 if (redirect) {
1015                         /*
1016                          * We need to get the dst entry for the
1017                          * default router instead
1018                          */
1019                         dst_release(*dst);
1020                         memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
1021                         memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
1022                         *dst = ip6_route_output(net, sk, &fl_gw6);
1023                         err = (*dst)->error;
1024                         if (err)
1025                                 goto out_err_release;
1026                 }
1027         }
1028 #endif
1029         if (ipv6_addr_v4mapped(&fl6->saddr) &&
1030             !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) {
1031                 err = -EAFNOSUPPORT;
1032                 goto out_err_release;
1033         }
1034 
1035         return 0;
1036 
1037 out_err_release:
1038         dst_release(*dst);
1039         *dst = NULL;
1040 
1041         if (err == -ENETUNREACH)
1042                 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
1043         return err;
1044 }
1045 
1046 /**
1047  *      ip6_dst_lookup - perform route lookup on flow
1048  *      @sk: socket which provides route info
1049  *      @dst: pointer to dst_entry * for result
1050  *      @fl6: flow to lookup
1051  *
1052  *      This function performs a route lookup on the given flow.
1053  *
1054  *      It returns zero on success, or a standard errno code on error.
1055  */
1056 int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
1057                    struct flowi6 *fl6)
1058 {
1059         *dst = NULL;
1060         return ip6_dst_lookup_tail(net, sk, dst, fl6);
1061 }
1062 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
1063 
1064 /**
1065  *      ip6_dst_lookup_flow - perform route lookup on flow with ipsec
1066  *      @sk: socket which provides route info
1067  *      @fl6: flow to lookup
1068  *      @final_dst: final destination address for ipsec lookup
1069  *
1070  *      This function performs a route lookup on the given flow.
1071  *
1072  *      It returns a valid dst pointer on success, or a pointer encoded
1073  *      error code.
1074  */
1075 struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6,
1076                                       const struct in6_addr *final_dst)
1077 {
1078         struct dst_entry *dst = NULL;
1079         int err;
1080 
1081         err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
1082         if (err)
1083                 return ERR_PTR(err);
1084         if (final_dst)
1085                 fl6->daddr = *final_dst;
1086 
1087         return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1088 }
1089 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1090 
1091 /**
1092  *      ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1093  *      @sk: socket which provides the dst cache and route info
1094  *      @fl6: flow to lookup
1095  *      @final_dst: final destination address for ipsec lookup
1096  *
1097  *      This function performs a route lookup on the given flow with the
1098  *      possibility of using the cached route in the socket if it is valid.
1099  *      It will take the socket dst lock when operating on the dst cache.
1100  *      As a result, this function can only be used in process context.
1101  *
1102  *      It returns a valid dst pointer on success, or a pointer encoded
1103  *      error code.
1104  */
1105 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1106                                          const struct in6_addr *final_dst)
1107 {
1108         struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1109 
1110         dst = ip6_sk_dst_check(sk, dst, fl6);
1111         if (!dst)
1112                 dst = ip6_dst_lookup_flow(sk, fl6, final_dst);
1113 
1114         return dst;
1115 }
1116 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1117 
1118 static inline int ip6_ufo_append_data(struct sock *sk,
1119                         struct sk_buff_head *queue,
1120                         int getfrag(void *from, char *to, int offset, int len,
1121                         int odd, struct sk_buff *skb),
1122                         void *from, int length, int hh_len, int fragheaderlen,
1123                         int exthdrlen, int transhdrlen, int mtu,
1124                         unsigned int flags, const struct flowi6 *fl6)
1125 
1126 {
1127         struct sk_buff *skb;
1128         int err;
1129 
1130         /* There is support for UDP large send offload by network
1131          * device, so create one single skb packet containing complete
1132          * udp datagram
1133          */
1134         skb = skb_peek_tail(queue);
1135         if (!skb) {
1136                 skb = sock_alloc_send_skb(sk,
1137                         hh_len + fragheaderlen + transhdrlen + 20,
1138                         (flags & MSG_DONTWAIT), &err);
1139                 if (!skb)
1140                         return err;
1141 
1142                 /* reserve space for Hardware header */
1143                 skb_reserve(skb, hh_len);
1144 
1145                 /* create space for UDP/IP header */
1146                 skb_put(skb, fragheaderlen + transhdrlen);
1147 
1148                 /* initialize network header pointer */
1149                 skb_set_network_header(skb, exthdrlen);
1150 
1151                 /* initialize protocol header pointer */
1152                 skb->transport_header = skb->network_header + fragheaderlen;
1153 
1154                 skb->protocol = htons(ETH_P_IPV6);
1155                 skb->csum = 0;
1156 
1157                 if (flags & MSG_CONFIRM)
1158                         skb_set_dst_pending_confirm(skb, 1);
1159 
1160                 __skb_queue_tail(queue, skb);
1161         } else if (skb_is_gso(skb)) {
1162                 goto append;
1163         }
1164 
1165         skb->ip_summed = CHECKSUM_PARTIAL;
1166         /* Specify the length of each IPv6 datagram fragment.
1167          * It has to be a multiple of 8.
1168          */
1169         skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1170                                      sizeof(struct frag_hdr)) & ~7;
1171         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1172         skb_shinfo(skb)->ip6_frag_id = ipv6_select_ident(sock_net(sk),
1173                                                          &fl6->daddr,
1174                                                          &fl6->saddr);
1175 
1176 append:
1177         return skb_append_datato_frags(sk, skb, getfrag, from,
1178                                        (length - transhdrlen));
1179 }
1180 
1181 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1182                                                gfp_t gfp)
1183 {
1184         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1185 }
1186 
1187 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1188                                                 gfp_t gfp)
1189 {
1190         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1191 }
1192 
1193 static void ip6_append_data_mtu(unsigned int *mtu,
1194                                 int *maxfraglen,
1195                                 unsigned int fragheaderlen,
1196                                 struct sk_buff *skb,
1197                                 struct rt6_info *rt,
1198                                 unsigned int orig_mtu)
1199 {
1200         if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1201                 if (!skb) {
1202                         /* first fragment, reserve header_len */
1203                         *mtu = orig_mtu - rt->dst.header_len;
1204 
1205                 } else {
1206                         /*
1207                          * this fragment is not first, the headers
1208                          * space is regarded as data space.
1209                          */
1210                         *mtu = orig_mtu;
1211                 }
1212                 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1213                               + fragheaderlen - sizeof(struct frag_hdr);
1214         }
1215 }
1216 
1217 static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
1218                           struct inet6_cork *v6_cork, struct ipcm6_cookie *ipc6,
1219                           struct rt6_info *rt, struct flowi6 *fl6)
1220 {
1221         struct ipv6_pinfo *np = inet6_sk(sk);
1222         unsigned int mtu;
1223         struct ipv6_txoptions *opt = ipc6->opt;
1224 
1225         /*
1226          * setup for corking
1227          */
1228         if (opt) {
1229                 if (WARN_ON(v6_cork->opt))
1230                         return -EINVAL;
1231 
1232                 v6_cork->opt = kzalloc(opt->tot_len, sk->sk_allocation);
1233                 if (unlikely(!v6_cork->opt))
1234                         return -ENOBUFS;
1235 
1236                 v6_cork->opt->tot_len = opt->tot_len;
1237                 v6_cork->opt->opt_flen = opt->opt_flen;
1238                 v6_cork->opt->opt_nflen = opt->opt_nflen;
1239 
1240                 v6_cork->opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1241                                                     sk->sk_allocation);
1242                 if (opt->dst0opt && !v6_cork->opt->dst0opt)
1243                         return -ENOBUFS;
1244 
1245                 v6_cork->opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1246                                                     sk->sk_allocation);
1247                 if (opt->dst1opt && !v6_cork->opt->dst1opt)
1248                         return -ENOBUFS;
1249 
1250                 v6_cork->opt->hopopt = ip6_opt_dup(opt->hopopt,
1251                                                    sk->sk_allocation);
1252                 if (opt->hopopt && !v6_cork->opt->hopopt)
1253                         return -ENOBUFS;
1254 
1255                 v6_cork->opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1256                                                     sk->sk_allocation);
1257                 if (opt->srcrt && !v6_cork->opt->srcrt)
1258                         return -ENOBUFS;
1259 
1260                 /* need source address above miyazawa*/
1261         }
1262         dst_hold(&rt->dst);
1263         cork->base.dst = &rt->dst;
1264         cork->fl.u.ip6 = *fl6;
1265         v6_cork->hop_limit = ipc6->hlimit;
1266         v6_cork->tclass = ipc6->tclass;
1267         if (rt->dst.flags & DST_XFRM_TUNNEL)
1268                 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1269                       rt->dst.dev->mtu : dst_mtu(&rt->dst);
1270         else
1271                 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1272                       rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1273         if (np->frag_size < mtu) {
1274                 if (np->frag_size)
1275                         mtu = np->frag_size;
1276         }
1277         cork->base.fragsize = mtu;
1278         if (dst_allfrag(rt->dst.path))
1279                 cork->base.flags |= IPCORK_ALLFRAG;
1280         cork->base.length = 0;
1281 
1282         return 0;
1283 }
1284 
1285 static int __ip6_append_data(struct sock *sk,
1286                              struct flowi6 *fl6,
1287                              struct sk_buff_head *queue,
1288                              struct inet_cork *cork,
1289                              struct inet6_cork *v6_cork,
1290                              struct page_frag *pfrag,
1291                              int getfrag(void *from, char *to, int offset,
1292                                          int len, int odd, struct sk_buff *skb),
1293                              void *from, int length, int transhdrlen,
1294                              unsigned int flags, struct ipcm6_cookie *ipc6,
1295                              const struct sockcm_cookie *sockc)
1296 {
1297         struct sk_buff *skb, *skb_prev = NULL;
1298         unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1299         int exthdrlen = 0;
1300         int dst_exthdrlen = 0;
1301         int hh_len;
1302         int copy;
1303         int err;
1304         int offset = 0;
1305         __u8 tx_flags = 0;
1306         u32 tskey = 0;
1307         struct rt6_info *rt = (struct rt6_info *)cork->dst;
1308         struct ipv6_txoptions *opt = v6_cork->opt;
1309         int csummode = CHECKSUM_NONE;
1310         unsigned int maxnonfragsize, headersize;
1311 
1312         skb = skb_peek_tail(queue);
1313         if (!skb) {
1314                 exthdrlen = opt ? opt->opt_flen : 0;
1315                 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1316         }
1317 
1318         mtu = cork->fragsize;
1319         orig_mtu = mtu;
1320 
1321         hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1322 
1323         fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1324                         (opt ? opt->opt_nflen : 0);
1325         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
1326                      sizeof(struct frag_hdr);
1327 
1328         headersize = sizeof(struct ipv6hdr) +
1329                      (opt ? opt->opt_flen + opt->opt_nflen : 0) +
1330                      (dst_allfrag(&rt->dst) ?
1331                       sizeof(struct frag_hdr) : 0) +
1332                      rt->rt6i_nfheader_len;
1333 
1334         if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
1335             (sk->sk_protocol == IPPROTO_UDP ||
1336              sk->sk_protocol == IPPROTO_RAW)) {
1337                 ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
1338                                 sizeof(struct ipv6hdr));
1339                 goto emsgsize;
1340         }
1341 
1342         if (ip6_sk_ignore_df(sk))
1343                 maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
1344         else
1345                 maxnonfragsize = mtu;
1346 
1347         if (cork->length + length > maxnonfragsize - headersize) {
1348 emsgsize:
1349                 ipv6_local_error(sk, EMSGSIZE, fl6,
1350                                  mtu - headersize +
1351                                  sizeof(struct ipv6hdr));
1352                 return -EMSGSIZE;
1353         }
1354 
1355         /* CHECKSUM_PARTIAL only with no extension headers and when
1356          * we are not going to fragment
1357          */
1358         if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
1359             headersize == sizeof(struct ipv6hdr) &&
1360             length <= mtu - headersize &&
1361             !(flags & MSG_MORE) &&
1362             rt->dst.dev->features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM))
1363                 csummode = CHECKSUM_PARTIAL;
1364 
1365         if (sk->sk_type == SOCK_DGRAM || sk->sk_type == SOCK_RAW) {
1366                 sock_tx_timestamp(sk, sockc->tsflags, &tx_flags);
1367                 if (tx_flags & SKBTX_ANY_SW_TSTAMP &&
1368                     sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)
1369                         tskey = sk->sk_tskey++;
1370         }
1371 
1372         /*
1373          * Let's try using as much space as possible.
1374          * Use MTU if total length of the message fits into the MTU.
1375          * Otherwise, we need to reserve fragment header and
1376          * fragment alignment (= 8-15 octects, in total).
1377          *
1378          * Note that we may need to "move" the data from the tail of
1379          * of the buffer to the new fragment when we split
1380          * the message.
1381          *
1382          * FIXME: It may be fragmented into multiple chunks
1383          *        at once if non-fragmentable extension headers
1384          *        are too large.
1385          * --yoshfuji
1386          */
1387 
1388         cork->length += length;
1389         if ((skb && skb_is_gso(skb)) ||
1390             (((length + (skb ? skb->len : headersize)) > mtu) &&
1391             (skb_queue_len(queue) <= 1) &&
1392             (sk->sk_protocol == IPPROTO_UDP) &&
1393             (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
1394             (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
1395                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
1396                                           hh_len, fragheaderlen, exthdrlen,
1397                                           transhdrlen, mtu, flags, fl6);
1398                 if (err)
1399                         goto error;
1400                 return 0;
1401         }
1402 
1403         if (!skb)
1404                 goto alloc_new_skb;
1405 
1406         while (length > 0) {
1407                 /* Check if the remaining data fits into current packet. */
1408                 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1409                 if (copy < length)
1410                         copy = maxfraglen - skb->len;
1411 
1412                 if (copy <= 0) {
1413                         char *data;
1414                         unsigned int datalen;
1415                         unsigned int fraglen;
1416                         unsigned int fraggap;
1417                         unsigned int alloclen;
1418 alloc_new_skb:
1419                         /* There's no room in the current skb */
1420                         if (skb)
1421                                 fraggap = skb->len - maxfraglen;
1422                         else
1423                                 fraggap = 0;
1424                         /* update mtu and maxfraglen if necessary */
1425                         if (!skb || !skb_prev)
1426                                 ip6_append_data_mtu(&mtu, &maxfraglen,
1427                                                     fragheaderlen, skb, rt,
1428                                                     orig_mtu);
1429 
1430                         skb_prev = skb;
1431 
1432                         /*
1433                          * If remaining data exceeds the mtu,
1434                          * we know we need more fragment(s).
1435                          */
1436                         datalen = length + fraggap;
1437 
1438                         if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1439                                 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1440                         if ((flags & MSG_MORE) &&
1441                             !(rt->dst.dev->features&NETIF_F_SG))
1442                                 alloclen = mtu;
1443                         else
1444                                 alloclen = datalen + fragheaderlen;
1445 
1446                         alloclen += dst_exthdrlen;
1447 
1448                         if (datalen != length + fraggap) {
1449                                 /*
1450                                  * this is not the last fragment, the trailer
1451                                  * space is regarded as data space.
1452                                  */
1453                                 datalen += rt->dst.trailer_len;
1454                         }
1455 
1456                         alloclen += rt->dst.trailer_len;
1457                         fraglen = datalen + fragheaderlen;
1458 
1459                         /*
1460                          * We just reserve space for fragment header.
1461                          * Note: this may be overallocation if the message
1462                          * (without MSG_MORE) fits into the MTU.
1463                          */
1464                         alloclen += sizeof(struct frag_hdr);
1465 
1466                         copy = datalen - transhdrlen - fraggap;
1467                         if (copy < 0) {
1468                                 err = -EINVAL;
1469                                 goto error;
1470                         }
1471                         if (transhdrlen) {
1472                                 skb = sock_alloc_send_skb(sk,
1473                                                 alloclen + hh_len,
1474                                                 (flags & MSG_DONTWAIT), &err);
1475                         } else {
1476                                 skb = NULL;
1477                                 if (atomic_read(&sk->sk_wmem_alloc) <=
1478                                     2 * sk->sk_sndbuf)
1479                                         skb = sock_wmalloc(sk,
1480                                                            alloclen + hh_len, 1,
1481                                                            sk->sk_allocation);
1482                                 if (unlikely(!skb))
1483                                         err = -ENOBUFS;
1484                         }
1485                         if (!skb)
1486                                 goto error;
1487                         /*
1488                          *      Fill in the control structures
1489                          */
1490                         skb->protocol = htons(ETH_P_IPV6);
1491                         skb->ip_summed = csummode;
1492                         skb->csum = 0;
1493                         /* reserve for fragmentation and ipsec header */
1494                         skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1495                                     dst_exthdrlen);
1496 
1497                         /* Only the initial fragment is time stamped */
1498                         skb_shinfo(skb)->tx_flags = tx_flags;
1499                         tx_flags = 0;
1500                         skb_shinfo(skb)->tskey = tskey;
1501                         tskey = 0;
1502 
1503                         /*
1504                          *      Find where to start putting bytes
1505                          */
1506                         data = skb_put(skb, fraglen);
1507                         skb_set_network_header(skb, exthdrlen);
1508                         data += fragheaderlen;
1509                         skb->transport_header = (skb->network_header +
1510                                                  fragheaderlen);
1511                         if (fraggap) {
1512                                 skb->csum = skb_copy_and_csum_bits(
1513                                         skb_prev, maxfraglen,
1514                                         data + transhdrlen, fraggap, 0);
1515                                 skb_prev->csum = csum_sub(skb_prev->csum,
1516                                                           skb->csum);
1517                                 data += fraggap;
1518                                 pskb_trim_unique(skb_prev, maxfraglen);
1519                         }
1520                         if (copy > 0 &&
1521                             getfrag(from, data + transhdrlen, offset,
1522                                     copy, fraggap, skb) < 0) {
1523                                 err = -EFAULT;
1524                                 kfree_skb(skb);
1525                                 goto error;
1526                         }
1527 
1528                         offset += copy;
1529                         length -= datalen - fraggap;
1530                         transhdrlen = 0;
1531                         exthdrlen = 0;
1532                         dst_exthdrlen = 0;
1533 
1534                         if ((flags & MSG_CONFIRM) && !skb_prev)
1535                                 skb_set_dst_pending_confirm(skb, 1);
1536 
1537                         /*
1538                          * Put the packet on the pending queue
1539                          */
1540                         __skb_queue_tail(queue, skb);
1541                         continue;
1542                 }
1543 
1544                 if (copy > length)
1545                         copy = length;
1546 
1547                 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1548                         unsigned int off;
1549 
1550                         off = skb->len;
1551                         if (getfrag(from, skb_put(skb, copy),
1552                                                 offset, copy, off, skb) < 0) {
1553                                 __skb_trim(skb, off);
1554                                 err = -EFAULT;
1555                                 goto error;
1556                         }
1557                 } else {
1558                         int i = skb_shinfo(skb)->nr_frags;
1559 
1560                         err = -ENOMEM;
1561                         if (!sk_page_frag_refill(sk, pfrag))
1562                                 goto error;
1563 
1564                         if (!skb_can_coalesce(skb, i, pfrag->page,
1565                                               pfrag->offset)) {
1566                                 err = -EMSGSIZE;
1567                                 if (i == MAX_SKB_FRAGS)
1568                                         goto error;
1569 
1570                                 __skb_fill_page_desc(skb, i, pfrag->page,
1571                                                      pfrag->offset, 0);
1572                                 skb_shinfo(skb)->nr_frags = ++i;
1573                                 get_page(pfrag->page);
1574                         }
1575                         copy = min_t(int, copy, pfrag->size - pfrag->offset);
1576                         if (getfrag(from,
1577                                     page_address(pfrag->page) + pfrag->offset,
1578                                     offset, copy, skb->len, skb) < 0)
1579                                 goto error_efault;
1580 
1581                         pfrag->offset += copy;
1582                         skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1583                         skb->len += copy;
1584                         skb->data_len += copy;
1585                         skb->truesize += copy;
1586                         atomic_add(copy, &sk->sk_wmem_alloc);
1587                 }
1588                 offset += copy;
1589                 length -= copy;
1590         }
1591 
1592         return 0;
1593 
1594 error_efault:
1595         err = -EFAULT;
1596 error:
1597         cork->length -= length;
1598         IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1599         return err;
1600 }
1601 
1602 int ip6_append_data(struct sock *sk,
1603                     int getfrag(void *from, char *to, int offset, int len,
1604                                 int odd, struct sk_buff *skb),
1605                     void *from, int length, int transhdrlen,
1606                     struct ipcm6_cookie *ipc6, struct flowi6 *fl6,
1607                     struct rt6_info *rt, unsigned int flags,
1608                     const struct sockcm_cookie *sockc)
1609 {
1610         struct inet_sock *inet = inet_sk(sk);
1611         struct ipv6_pinfo *np = inet6_sk(sk);
1612         int exthdrlen;
1613         int err;
1614 
1615         if (flags&MSG_PROBE)
1616                 return 0;
1617         if (skb_queue_empty(&sk->sk_write_queue)) {
1618                 /*
1619                  * setup for corking
1620                  */
1621                 err = ip6_setup_cork(sk, &inet->cork, &np->cork,
1622                                      ipc6, rt, fl6);
1623                 if (err)
1624                         return err;
1625 
1626                 exthdrlen = (ipc6->opt ? ipc6->opt->opt_flen : 0);
1627                 length += exthdrlen;
1628                 transhdrlen += exthdrlen;
1629         } else {
1630                 fl6 = &inet->cork.fl.u.ip6;
1631                 transhdrlen = 0;
1632         }
1633 
1634         return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
1635                                  &np->cork, sk_page_frag(sk), getfrag,
1636                                  from, length, transhdrlen, flags, ipc6, sockc);
1637 }
1638 EXPORT_SYMBOL_GPL(ip6_append_data);
1639 
1640 static void ip6_cork_release(struct inet_cork_full *cork,
1641                              struct inet6_cork *v6_cork)
1642 {
1643         if (v6_cork->opt) {
1644                 kfree(v6_cork->opt->dst0opt);
1645                 kfree(v6_cork->opt->dst1opt);
1646                 kfree(v6_cork->opt->hopopt);
1647                 kfree(v6_cork->opt->srcrt);
1648                 kfree(v6_cork->opt);
1649                 v6_cork->opt = NULL;
1650         }
1651 
1652         if (cork->base.dst) {
1653                 dst_release(cork->base.dst);
1654                 cork->base.dst = NULL;
1655                 cork->base.flags &= ~IPCORK_ALLFRAG;
1656         }
1657         memset(&cork->fl, 0, sizeof(cork->fl));
1658 }
1659 
1660 struct sk_buff *__ip6_make_skb(struct sock *sk,
1661                                struct sk_buff_head *queue,
1662                                struct inet_cork_full *cork,
1663                                struct inet6_cork *v6_cork)
1664 {
1665         struct sk_buff *skb, *tmp_skb;
1666         struct sk_buff **tail_skb;
1667         struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1668         struct ipv6_pinfo *np = inet6_sk(sk);
1669         struct net *net = sock_net(sk);
1670         struct ipv6hdr *hdr;
1671         struct ipv6_txoptions *opt = v6_cork->opt;
1672         struct rt6_info *rt = (struct rt6_info *)cork->base.dst;
1673         struct flowi6 *fl6 = &cork->fl.u.ip6;
1674         unsigned char proto = fl6->flowi6_proto;
1675 
1676         skb = __skb_dequeue(queue);
1677         if (!skb)
1678                 goto out;
1679         tail_skb = &(skb_shinfo(skb)->frag_list);
1680 
1681         /* move skb->data to ip header from ext header */
1682         if (skb->data < skb_network_header(skb))
1683                 __skb_pull(skb, skb_network_offset(skb));
1684         while ((tmp_skb = __skb_dequeue(queue)) != NULL) {
1685                 __skb_pull(tmp_skb, skb_network_header_len(skb));
1686                 *tail_skb = tmp_skb;
1687                 tail_skb = &(tmp_skb->next);
1688                 skb->len += tmp_skb->len;
1689                 skb->data_len += tmp_skb->len;
1690                 skb->truesize += tmp_skb->truesize;
1691                 tmp_skb->destructor = NULL;
1692                 tmp_skb->sk = NULL;
1693         }
1694 
1695         /* Allow local fragmentation. */
1696         skb->ignore_df = ip6_sk_ignore_df(sk);
1697 
1698         *final_dst = fl6->daddr;
1699         __skb_pull(skb, skb_network_header_len(skb));
1700         if (opt && opt->opt_flen)
1701                 ipv6_push_frag_opts(skb, opt, &proto);
1702         if (opt && opt->opt_nflen)
1703                 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst, &fl6->saddr);
1704 
1705         skb_push(skb, sizeof(struct ipv6hdr));
1706         skb_reset_network_header(skb);
1707         hdr = ipv6_hdr(skb);
1708 
1709         ip6_flow_hdr(hdr, v6_cork->tclass,
1710                      ip6_make_flowlabel(net, skb, fl6->flowlabel,
1711                                         np->autoflowlabel, fl6));
1712         hdr->hop_limit = v6_cork->hop_limit;
1713         hdr->nexthdr = proto;
1714         hdr->saddr = fl6->saddr;
1715         hdr->daddr = *final_dst;
1716 
1717         skb->priority = sk->sk_priority;
1718         skb->mark = sk->sk_mark;
1719 
1720         skb_dst_set(skb, dst_clone(&rt->dst));
1721         IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1722         if (proto == IPPROTO_ICMPV6) {
1723                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1724 
1725                 ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
1726                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1727         }
1728 
1729         ip6_cork_release(cork, v6_cork);
1730 out:
1731         return skb;
1732 }
1733 
1734 int ip6_send_skb(struct sk_buff *skb)
1735 {
1736         struct net *net = sock_net(skb->sk);
1737         struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
1738         int err;
1739 
1740         err = ip6_local_out(net, skb->sk, skb);
1741         if (err) {
1742                 if (err > 0)
1743                         err = net_xmit_errno(err);
1744                 if (err)
1745                         IP6_INC_STATS(net, rt->rt6i_idev,
1746                                       IPSTATS_MIB_OUTDISCARDS);
1747         }
1748 
1749         return err;
1750 }
1751 
1752 int ip6_push_pending_frames(struct sock *sk)
1753 {
1754         struct sk_buff *skb;
1755 
1756         skb = ip6_finish_skb(sk);
1757         if (!skb)
1758                 return 0;
1759 
1760         return ip6_send_skb(skb);
1761 }
1762 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1763 
1764 static void __ip6_flush_pending_frames(struct sock *sk,
1765                                        struct sk_buff_head *queue,
1766                                        struct inet_cork_full *cork,
1767                                        struct inet6_cork *v6_cork)
1768 {
1769         struct sk_buff *skb;
1770 
1771         while ((skb = __skb_dequeue_tail(queue)) != NULL) {
1772                 if (skb_dst(skb))
1773                         IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1774                                       IPSTATS_MIB_OUTDISCARDS);
1775                 kfree_skb(skb);
1776         }
1777 
1778         ip6_cork_release(cork, v6_cork);
1779 }
1780 
1781 void ip6_flush_pending_frames(struct sock *sk)
1782 {
1783         __ip6_flush_pending_frames(sk, &sk->sk_write_queue,
1784                                    &inet_sk(sk)->cork, &inet6_sk(sk)->cork);
1785 }
1786 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
1787 
1788 struct sk_buff *ip6_make_skb(struct sock *sk,
1789                              int getfrag(void *from, char *to, int offset,
1790                                          int len, int odd, struct sk_buff *skb),
1791                              void *from, int length, int transhdrlen,
1792                              struct ipcm6_cookie *ipc6, struct flowi6 *fl6,
1793                              struct rt6_info *rt, unsigned int flags,
1794                              const struct sockcm_cookie *sockc)
1795 {
1796         struct inet_cork_full cork;
1797         struct inet6_cork v6_cork;
1798         struct sk_buff_head queue;
1799         int exthdrlen = (ipc6->opt ? ipc6->opt->opt_flen : 0);
1800         int err;
1801 
1802         if (flags & MSG_PROBE)
1803                 return NULL;
1804 
1805         __skb_queue_head_init(&queue);
1806 
1807         cork.base.flags = 0;
1808         cork.base.addr = 0;
1809         cork.base.opt = NULL;
1810         v6_cork.opt = NULL;
1811         err = ip6_setup_cork(sk, &cork, &v6_cork, ipc6, rt, fl6);
1812         if (err)
1813                 return ERR_PTR(err);
1814 
1815         if (ipc6->dontfrag < 0)
1816                 ipc6->dontfrag = inet6_sk(sk)->dontfrag;
1817 
1818         err = __ip6_append_data(sk, fl6, &queue, &cork.base, &v6_cork,
1819                                 &current->task_frag, getfrag, from,
1820                                 length + exthdrlen, transhdrlen + exthdrlen,
1821                                 flags, ipc6, sockc);
1822         if (err) {
1823                 __ip6_flush_pending_frames(sk, &queue, &cork, &v6_cork);
1824                 return ERR_PTR(err);
1825         }
1826 
1827         return __ip6_make_skb(sk, &queue, &cork, &v6_cork);
1828 }
1829 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp