net/bridge/br_multicast.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Bridge multicast support.
   4  *
   5  * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au>
   6  */
   7
   8 #include <linux/err.h>
   9 #include <linux/export.h>
  10 #include <linux/if_ether.h>
  11 #include <linux/igmp.h>
  12 #include <linux/in.h>
  13 #include <linux/jhash.h>
  14 #include <linux/kernel.h>
  15 #include <linux/log2.h>
  16 #include <linux/netdevice.h>
  17 #include <linux/netfilter_bridge.h>
  18 #include <linux/random.h>
  19 #include <linux/rculist.h>
  20 #include <linux/skbuff.h>
  21 #include <linux/slab.h>
  22 #include <linux/timer.h>
  23 #include <linux/inetdevice.h>
  24 #include <linux/mroute.h>
  25 #include <net/ip.h>
  26 #include <net/switchdev.h>
  27 #if IS_ENABLED(CONFIG_IPV6)
  28 #include <linux/icmpv6.h>
  29 #include <net/ipv6.h>
  30 #include <net/mld.h>
  31 #include <net/ip6_checksum.h>
  32 #include <net/addrconf.h>
  33 #endif
  34
  35 #include "br_private.h"
  36
  37 static const struct rhashtable_params br_mdb_rht_params = {
  38         .head_offset = offsetof(struct net_bridge_mdb_entry, rhnode),
  39         .key_offset = offsetof(struct net_bridge_mdb_entry, addr),
  40         .key_len = sizeof(struct br_ip),
  41         .automatic_shrinking = true,
  42 };
  43
  44 static const struct rhashtable_params br_sg_port_rht_params = {
  45         .head_offset = offsetof(struct net_bridge_port_group, rhnode),
  46         .key_offset = offsetof(struct net_bridge_port_group, key),
  47         .key_len = sizeof(struct net_bridge_port_group_sg_key),
  48         .automatic_shrinking = true,
  49 };
  50
  51 static void br_multicast_start_querier(struct net_bridge *br,
  52                                        struct bridge_mcast_own_query *query);
  53 static void br_multicast_add_router(struct net_bridge *br,
  54                                     struct net_bridge_port *port);
  55 static void br_ip4_multicast_leave_group(struct net_bridge *br,
  56                                          struct net_bridge_port *port,
  57                                          __be32 group,
  58                                          __u16 vid,
  59                                          const unsigned char *src);
  60 static void br_multicast_port_group_rexmit(struct timer_list *t);
  61
  62 static void __del_port_router(struct net_bridge_port *p);
  63 #if IS_ENABLED(CONFIG_IPV6)
  64 static void br_ip6_multicast_leave_group(struct net_bridge *br,
  65                                          struct net_bridge_port *port,
  66                                          const struct in6_addr *group,
  67                                          __u16 vid, const unsigned char *src);
  68 #endif
  69 static struct net_bridge_port_group *
  70 __br_multicast_add_group(struct net_bridge *br,
  71                          struct net_bridge_port *port,
  72                          struct br_ip *group,
  73                          const unsigned char *src,
  74                          u8 filter_mode,
  75                          bool igmpv2_mldv1,
  76                          bool blocked);
  77 static void br_multicast_find_del_pg(struct net_bridge *br,
  78                                      struct net_bridge_port_group *pg);
  79
  80 static struct net_bridge_port_group *
  81 br_sg_port_find(struct net_bridge *br,
  82                 struct net_bridge_port_group_sg_key *sg_p)
  83 {
  84         lockdep_assert_held_once(&br->multicast_lock);
  85
  86         return rhashtable_lookup_fast(&br->sg_port_tbl, sg_p,
  87                                       br_sg_port_rht_params);
  88 }
  89
  90 static struct net_bridge_mdb_entry *br_mdb_ip_get_rcu(struct net_bridge *br,
  91                                                       struct br_ip *dst)
  92 {
  93         return rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
  94 }
  95
  96 struct net_bridge_mdb_entry *br_mdb_ip_get(struct net_bridge *br,
  97                                            struct br_ip *dst)
  98 {
  99         struct net_bridge_mdb_entry *ent;
 100
 101         lockdep_assert_held_once(&br->multicast_lock);
 102
 103         rcu_read_lock();
 104         ent = rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
 105         rcu_read_unlock();
 106
 107         return ent;
 108 }
 109
 110 static struct net_bridge_mdb_entry *br_mdb_ip4_get(struct net_bridge *br,
 111                                                    __be32 dst, __u16 vid)
 112 {
 113         struct br_ip br_dst;
 114
 115         memset(&br_dst, 0, sizeof(br_dst));
 116         br_dst.dst.ip4 = dst;
 117         br_dst.proto = htons(ETH_P_IP);
 118         br_dst.vid = vid;
 119
 120         return br_mdb_ip_get(br, &br_dst);
 121 }
 122
 123 #if IS_ENABLED(CONFIG_IPV6)
 124 static struct net_bridge_mdb_entry *br_mdb_ip6_get(struct net_bridge *br,
 125                                                    const struct in6_addr *dst,
 126                                                    __u16 vid)
 127 {
 128         struct br_ip br_dst;
 129
 130         memset(&br_dst, 0, sizeof(br_dst));
 131         br_dst.dst.ip6 = *dst;
 132         br_dst.proto = htons(ETH_P_IPV6);
 133         br_dst.vid = vid;
 134
 135         return br_mdb_ip_get(br, &br_dst);
 136 }
 137 #endif
 138
 139 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
 140                                         struct sk_buff *skb, u16 vid)
 141 {
 142         struct br_ip ip;
 143
 144         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
 145                 return NULL;
 146
 147         if (BR_INPUT_SKB_CB(skb)->igmp)
 148                 return NULL;
 149
 150         memset(&ip, 0, sizeof(ip));
 151         ip.proto = skb->protocol;
 152         ip.vid = vid;
 153
 154         switch (skb->protocol) {
 155         case htons(ETH_P_IP):
 156                 ip.dst.ip4 = ip_hdr(skb)->daddr;
 157                 if (br->multicast_igmp_version == 3) {
 158                         struct net_bridge_mdb_entry *mdb;
 159
 160                         ip.src.ip4 = ip_hdr(skb)->saddr;
 161                         mdb = br_mdb_ip_get_rcu(br, &ip);
 162                         if (mdb)
 163                                 return mdb;
 164                         ip.src.ip4 = 0;
 165                 }
 166                 break;
 167 #if IS_ENABLED(CONFIG_IPV6)
 168         case htons(ETH_P_IPV6):
 169                 ip.dst.ip6 = ipv6_hdr(skb)->daddr;
 170                 if (br->multicast_mld_version == 2) {
 171                         struct net_bridge_mdb_entry *mdb;
 172
 173                         ip.src.ip6 = ipv6_hdr(skb)->saddr;
 174                         mdb = br_mdb_ip_get_rcu(br, &ip);
 175                         if (mdb)
 176                                 return mdb;
 177                         memset(&ip.src.ip6, 0, sizeof(ip.src.ip6));
 178                 }
 179                 break;
 180 #endif
 181         default:
 182                 return NULL;
 183         }
 184
 185         return br_mdb_ip_get_rcu(br, &ip);
 186 }
 187
 188 static bool br_port_group_equal(struct net_bridge_port_group *p,
 189                                 struct net_bridge_port *port,
 190                                 const unsigned char *src)
 191 {
 192         if (p->key.port != port)
 193                 return false;
 194
 195         if (!(port->flags & BR_MULTICAST_TO_UNICAST))
 196                 return true;
 197
 198         return ether_addr_equal(src, p->eth_addr);
 199 }
 200
 201 static void __fwd_add_star_excl(struct net_bridge_port_group *pg,
 202                                 struct br_ip *sg_ip)
 203 {
 204         struct net_bridge_port_group_sg_key sg_key;
 205         struct net_bridge *br = pg->key.port->br;
 206         struct net_bridge_port_group *src_pg;
 207
 208         memset(&sg_key, 0, sizeof(sg_key));
 209         sg_key.port = pg->key.port;
 210         sg_key.addr = *sg_ip;
 211         if (br_sg_port_find(br, &sg_key))
 212                 return;
 213
 214         src_pg = __br_multicast_add_group(br, pg->key.port, sg_ip, pg->eth_addr,
 215                                           MCAST_INCLUDE, false, false);
 216         if (IS_ERR_OR_NULL(src_pg) ||
 217             src_pg->rt_protocol != RTPROT_KERNEL)
 218                 return;
 219
 220         src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
 221 }
 222
 223 static void __fwd_del_star_excl(struct net_bridge_port_group *pg,
 224                                 struct br_ip *sg_ip)
 225 {
 226         struct net_bridge_port_group_sg_key sg_key;
 227         struct net_bridge *br = pg->key.port->br;
 228         struct net_bridge_port_group *src_pg;
 229
 230         memset(&sg_key, 0, sizeof(sg_key));
 231         sg_key.port = pg->key.port;
 232         sg_key.addr = *sg_ip;
 233         src_pg = br_sg_port_find(br, &sg_key);
 234         if (!src_pg || !(src_pg->flags & MDB_PG_FLAGS_STAR_EXCL) ||
 235             src_pg->rt_protocol != RTPROT_KERNEL)
 236                 return;
 237
 238         br_multicast_find_del_pg(br, src_pg);
 239 }
 240
 241 /* When a port group transitions to (or is added as) EXCLUDE we need to add it
 242  * to all other ports' S,G entries which are not blocked by the current group
 243  * for proper replication, the assumption is that any S,G blocked entries
 244  * are already added so the S,G,port lookup should skip them.
 245  * When a port group transitions from EXCLUDE -> INCLUDE mode or is being
 246  * deleted we need to remove it from all ports' S,G entries where it was
 247  * automatically installed before (i.e. where it's MDB_PG_FLAGS_STAR_EXCL).
 248  */
 249 void br_multicast_star_g_handle_mode(struct net_bridge_port_group *pg,
 250                                      u8 filter_mode)
 251 {
 252         struct net_bridge *br = pg->key.port->br;
 253         struct net_bridge_port_group *pg_lst;
 254         struct net_bridge_mdb_entry *mp;
 255         struct br_ip sg_ip;
 256
 257         if (WARN_ON(!br_multicast_is_star_g(&pg->key.addr)))
 258                 return;
 259
 260         mp = br_mdb_ip_get(br, &pg->key.addr);
 261         if (!mp)
 262                 return;
 263
 264         memset(&sg_ip, 0, sizeof(sg_ip));
 265         sg_ip = pg->key.addr;
 266         for (pg_lst = mlock_dereference(mp->ports, br);
 267              pg_lst;
 268              pg_lst = mlock_dereference(pg_lst->next, br)) {
 269                 struct net_bridge_group_src *src_ent;
 270
 271                 if (pg_lst == pg)
 272                         continue;
 273                 hlist_for_each_entry(src_ent, &pg_lst->src_list, node) {
 274                         if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
 275                                 continue;
 276                         sg_ip.src = src_ent->addr.src;
 277                         switch (filter_mode) {
 278                         case MCAST_INCLUDE:
 279                                 __fwd_del_star_excl(pg, &sg_ip);
 280                                 break;
 281                         case MCAST_EXCLUDE:
 282                                 __fwd_add_star_excl(pg, &sg_ip);
 283                                 break;
 284                         }
 285                 }
 286         }
 287 }
 288
 289 /* called when adding a new S,G with host_joined == false by default */
 290 static void br_multicast_sg_host_state(struct net_bridge_mdb_entry *star_mp,
 291                                        struct net_bridge_port_group *sg)
 292 {
 293         struct net_bridge_mdb_entry *sg_mp;
 294
 295         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 296                 return;
 297         if (!star_mp->host_joined)
 298                 return;
 299
 300         sg_mp = br_mdb_ip_get(star_mp->br, &sg->key.addr);
 301         if (!sg_mp)
 302                 return;
 303         sg_mp->host_joined = true;
 304 }
 305
 306 /* set the host_joined state of all of *,G's S,G entries */
 307 static void br_multicast_star_g_host_state(struct net_bridge_mdb_entry *star_mp)
 308 {
 309         struct net_bridge *br = star_mp->br;
 310         struct net_bridge_mdb_entry *sg_mp;
 311         struct net_bridge_port_group *pg;
 312         struct br_ip sg_ip;
 313
 314         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 315                 return;
 316
 317         memset(&sg_ip, 0, sizeof(sg_ip));
 318         sg_ip = star_mp->addr;
 319         for (pg = mlock_dereference(star_mp->ports, br);
 320              pg;
 321              pg = mlock_dereference(pg->next, br)) {
 322                 struct net_bridge_group_src *src_ent;
 323
 324                 hlist_for_each_entry(src_ent, &pg->src_list, node) {
 325                         if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
 326                                 continue;
 327                         sg_ip.src = src_ent->addr.src;
 328                         sg_mp = br_mdb_ip_get(br, &sg_ip);
 329                         if (!sg_mp)
 330                                 continue;
 331                         sg_mp->host_joined = star_mp->host_joined;
 332                 }
 333         }
 334 }
 335
 336 static void br_multicast_sg_del_exclude_ports(struct net_bridge_mdb_entry *sgmp)
 337 {
 338         struct net_bridge_port_group __rcu **pp;
 339         struct net_bridge_port_group *p;
 340
 341         /* *,G exclude ports are only added to S,G entries */
 342         if (WARN_ON(br_multicast_is_star_g(&sgmp->addr)))
 343                 return;
 344
 345         /* we need the STAR_EXCLUDE ports if there are non-STAR_EXCLUDE ports
 346          * we should ignore perm entries since they're managed by user-space
 347          */
 348         for (pp = &sgmp->ports;
 349              (p = mlock_dereference(*pp, sgmp->br)) != NULL;
 350              pp = &p->next)
 351                 if (!(p->flags & (MDB_PG_FLAGS_STAR_EXCL |
 352                                   MDB_PG_FLAGS_PERMANENT)))
 353                         return;
 354
 355         /* currently the host can only have joined the *,G which means
 356          * we treat it as EXCLUDE {}, so for an S,G it's considered a
 357          * STAR_EXCLUDE entry and we can safely leave it
 358          */
 359         sgmp->host_joined = false;
 360
 361         for (pp = &sgmp->ports;
 362              (p = mlock_dereference(*pp, sgmp->br)) != NULL;) {
 363                 if (!(p->flags & MDB_PG_FLAGS_PERMANENT))
 364                         br_multicast_del_pg(sgmp, p, pp);
 365                 else
 366                         pp = &p->next;
 367         }
 368 }
 369
 370 void br_multicast_sg_add_exclude_ports(struct net_bridge_mdb_entry *star_mp,
 371                                        struct net_bridge_port_group *sg)
 372 {
 373         struct net_bridge_port_group_sg_key sg_key;
 374         struct net_bridge *br = star_mp->br;
 375         struct net_bridge_port_group *pg;
 376
 377         if (WARN_ON(br_multicast_is_star_g(&sg->key.addr)))
 378                 return;
 379         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 380                 return;
 381
 382         br_multicast_sg_host_state(star_mp, sg);
 383         memset(&sg_key, 0, sizeof(sg_key));
 384         sg_key.addr = sg->key.addr;
 385         /* we need to add all exclude ports to the S,G */
 386         for (pg = mlock_dereference(star_mp->ports, br);
 387              pg;
 388              pg = mlock_dereference(pg->next, br)) {
 389                 struct net_bridge_port_group *src_pg;
 390
 391                 if (pg == sg || pg->filter_mode == MCAST_INCLUDE)
 392                         continue;
 393
 394                 sg_key.port = pg->key.port;
 395                 if (br_sg_port_find(br, &sg_key))
 396                         continue;
 397
 398                 src_pg = __br_multicast_add_group(br, pg->key.port,
 399                                                   &sg->key.addr,
 400                                                   sg->eth_addr,
 401                                                   MCAST_INCLUDE, false, false);
 402                 if (IS_ERR_OR_NULL(src_pg) ||
 403                     src_pg->rt_protocol != RTPROT_KERNEL)
 404                         continue;
 405                 src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
 406         }
 407 }
 408
 409 static void br_multicast_fwd_src_add(struct net_bridge_group_src *src)
 410 {
 411         struct net_bridge_mdb_entry *star_mp;
 412         struct net_bridge_port_group *sg;
 413         struct br_ip sg_ip;
 414
 415         if (src->flags & BR_SGRP_F_INSTALLED)
 416                 return;
 417
 418         memset(&sg_ip, 0, sizeof(sg_ip));
 419         sg_ip = src->pg->key.addr;
 420         sg_ip.src = src->addr.src;
 421         sg = __br_multicast_add_group(src->br, src->pg->key.port, &sg_ip,
 422                                       src->pg->eth_addr, MCAST_INCLUDE, false,
 423                                       !timer_pending(&src->timer));
 424         if (IS_ERR_OR_NULL(sg))
 425                 return;
 426         src->flags |= BR_SGRP_F_INSTALLED;
 427         sg->flags &= ~MDB_PG_FLAGS_STAR_EXCL;
 428
 429         /* if it was added by user-space as perm we can skip next steps */
 430         if (sg->rt_protocol != RTPROT_KERNEL &&
 431             (sg->flags & MDB_PG_FLAGS_PERMANENT))
 432                 return;
 433
 434         /* the kernel is now responsible for removing this S,G */
 435         del_timer(&sg->timer);
 436         star_mp = br_mdb_ip_get(src->br, &src->pg->key.addr);
 437         if (!star_mp)
 438                 return;
 439
 440         br_multicast_sg_add_exclude_ports(star_mp, sg);
 441 }
 442
 443 static void br_multicast_fwd_src_remove(struct net_bridge_group_src *src)
 444 {
 445         struct net_bridge_port_group *p, *pg = src->pg;
 446         struct net_bridge_port_group __rcu **pp;
 447         struct net_bridge_mdb_entry *mp;
 448         struct br_ip sg_ip;
 449
 450         memset(&sg_ip, 0, sizeof(sg_ip));
 451         sg_ip = pg->key.addr;
 452         sg_ip.src = src->addr.src;
 453
 454         mp = br_mdb_ip_get(src->br, &sg_ip);
 455         if (!mp)
 456                 return;
 457
 458         for (pp = &mp->ports;
 459              (p = mlock_dereference(*pp, src->br)) != NULL;
 460              pp = &p->next) {
 461                 if (!br_port_group_equal(p, pg->key.port, pg->eth_addr))
 462                         continue;
 463
 464                 if (p->rt_protocol != RTPROT_KERNEL &&
 465                     (p->flags & MDB_PG_FLAGS_PERMANENT))
 466                         break;
 467
 468                 br_multicast_del_pg(mp, p, pp);
 469                 break;
 470         }
 471         src->flags &= ~BR_SGRP_F_INSTALLED;
 472 }
 473
 474 /* install S,G and based on src's timer enable or disable forwarding */
 475 static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)
 476 {
 477         struct net_bridge_port_group_sg_key sg_key;
 478         struct net_bridge_port_group *sg;
 479         u8 old_flags;
 480
 481         br_multicast_fwd_src_add(src);
 482
 483         memset(&sg_key, 0, sizeof(sg_key));
 484         sg_key.addr = src->pg->key.addr;
 485         sg_key.addr.src = src->addr.src;
 486         sg_key.port = src->pg->key.port;
 487
 488         sg = br_sg_port_find(src->br, &sg_key);
 489         if (!sg || (sg->flags & MDB_PG_FLAGS_PERMANENT))
 490                 return;
 491
 492         old_flags = sg->flags;
 493         if (timer_pending(&src->timer))
 494                 sg->flags &= ~MDB_PG_FLAGS_BLOCKED;
 495         else
 496                 sg->flags |= MDB_PG_FLAGS_BLOCKED;
 497
 498         if (old_flags != sg->flags) {
 499                 struct net_bridge_mdb_entry *sg_mp;
 500
 501                 sg_mp = br_mdb_ip_get(src->br, &sg_key.addr);
 502                 if (!sg_mp)
 503                         return;
 504                 br_mdb_notify(src->br->dev, sg_mp, sg, RTM_NEWMDB);
 505         }
 506 }
 507
 508 static void br_multicast_destroy_mdb_entry(struct net_bridge_mcast_gc *gc)
 509 {
 510         struct net_bridge_mdb_entry *mp;
 511
 512         mp = container_of(gc, struct net_bridge_mdb_entry, mcast_gc);
 513         WARN_ON(!hlist_unhashed(&mp->mdb_node));
 514         WARN_ON(mp->ports);
 515
 516         del_timer_sync(&mp->timer);
 517         kfree_rcu(mp, rcu);
 518 }
 519
 520 static void br_multicast_del_mdb_entry(struct net_bridge_mdb_entry *mp)
 521 {
 522         struct net_bridge *br = mp->br;
 523
 524         rhashtable_remove_fast(&br->mdb_hash_tbl, &mp->rhnode,
 525                                br_mdb_rht_params);
 526         hlist_del_init_rcu(&mp->mdb_node);
 527         hlist_add_head(&mp->mcast_gc.gc_node, &br->mcast_gc_list);
 528         queue_work(system_long_wq, &br->mcast_gc_work);
 529 }
 530
 531 static void br_multicast_group_expired(struct timer_list *t)
 532 {
 533         struct net_bridge_mdb_entry *mp = from_timer(mp, t, timer);
 534         struct net_bridge *br = mp->br;
 535
 536         spin_lock(&br->multicast_lock);
 537         if (hlist_unhashed(&mp->mdb_node) || !netif_running(br->dev) ||
 538             timer_pending(&mp->timer))
 539                 goto out;
 540
 541         br_multicast_host_leave(mp, true);
 542
 543         if (mp->ports)
 544                 goto out;
 545         br_multicast_del_mdb_entry(mp);
 546 out:
 547         spin_unlock(&br->multicast_lock);
 548 }
 549
 550 static void br_multicast_destroy_group_src(struct net_bridge_mcast_gc *gc)
 551 {
 552         struct net_bridge_group_src *src;
 553
 554         src = container_of(gc, struct net_bridge_group_src, mcast_gc);
 555         WARN_ON(!hlist_unhashed(&src->node));
 556
 557         del_timer_sync(&src->timer);
 558         kfree_rcu(src, rcu);
 559 }
 560
 561 static void br_multicast_del_group_src(struct net_bridge_group_src *src)
 562 {
 563         struct net_bridge *br = src->pg->key.port->br;
 564
 565         br_multicast_fwd_src_remove(src);
 566         hlist_del_init_rcu(&src->node);
 567         src->pg->src_ents--;
 568         hlist_add_head(&src->mcast_gc.gc_node, &br->mcast_gc_list);
 569         queue_work(system_long_wq, &br->mcast_gc_work);
 570 }
 571
 572 static void br_multicast_destroy_port_group(struct net_bridge_mcast_gc *gc)
 573 {
 574         struct net_bridge_port_group *pg;
 575
 576         pg = container_of(gc, struct net_bridge_port_group, mcast_gc);
 577         WARN_ON(!hlist_unhashed(&pg->mglist));
 578         WARN_ON(!hlist_empty(&pg->src_list));
 579
 580         del_timer_sync(&pg->rexmit_timer);
 581         del_timer_sync(&pg->timer);
 582         kfree_rcu(pg, rcu);
 583 }
 584
 585 void br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
 586                          struct net_bridge_port_group *pg,
 587                          struct net_bridge_port_group __rcu **pp)
 588 {
 589         struct net_bridge *br = pg->key.port->br;
 590         struct net_bridge_group_src *ent;
 591         struct hlist_node *tmp;
 592
 593         rcu_assign_pointer(*pp, pg->next);
 594         hlist_del_init(&pg->mglist);
 595         hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
 596                 br_multicast_del_group_src(ent);
 597         br_mdb_notify(br->dev, mp, pg, RTM_DELMDB);
 598         if (!br_multicast_is_star_g(&mp->addr)) {
 599                 rhashtable_remove_fast(&br->sg_port_tbl, &pg->rhnode,
 600                                        br_sg_port_rht_params);
 601                 br_multicast_sg_del_exclude_ports(mp);
 602         } else {
 603                 br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
 604         }
 605         hlist_add_head(&pg->mcast_gc.gc_node, &br->mcast_gc_list);
 606         queue_work(system_long_wq, &br->mcast_gc_work);
 607
 608         if (!mp->ports && !mp->host_joined && netif_running(br->dev))
 609                 mod_timer(&mp->timer, jiffies);
 610 }
 611
 612 static void br_multicast_find_del_pg(struct net_bridge *br,
 613                                      struct net_bridge_port_group *pg)
 614 {
 615         struct net_bridge_port_group __rcu **pp;
 616         struct net_bridge_mdb_entry *mp;
 617         struct net_bridge_port_group *p;
 618
 619         mp = br_mdb_ip_get(br, &pg->key.addr);
 620         if (WARN_ON(!mp))
 621                 return;
 622
 623         for (pp = &mp->ports;
 624              (p = mlock_dereference(*pp, br)) != NULL;
 625              pp = &p->next) {
 626                 if (p != pg)
 627                         continue;
 628
 629                 br_multicast_del_pg(mp, pg, pp);
 630                 return;
 631         }
 632
 633         WARN_ON(1);
 634 }
 635
 636 static void br_multicast_port_group_expired(struct timer_list *t)
 637 {
 638         struct net_bridge_port_group *pg = from_timer(pg, t, timer);
 639         struct net_bridge_group_src *src_ent;
 640         struct net_bridge *br = pg->key.port->br;
 641         struct hlist_node *tmp;
 642         bool changed;
 643
 644         spin_lock(&br->multicast_lock);
 645         if (!netif_running(br->dev) || timer_pending(&pg->timer) ||
 646             hlist_unhashed(&pg->mglist) || pg->flags & MDB_PG_FLAGS_PERMANENT)
 647                 goto out;
 648
 649         changed = !!(pg->filter_mode == MCAST_EXCLUDE);
 650         pg->filter_mode = MCAST_INCLUDE;
 651         hlist_for_each_entry_safe(src_ent, tmp, &pg->src_list, node) {
 652                 if (!timer_pending(&src_ent->timer)) {
 653                         br_multicast_del_group_src(src_ent);
 654                         changed = true;
 655                 }
 656         }
 657
 658         if (hlist_empty(&pg->src_list)) {
 659                 br_multicast_find_del_pg(br, pg);
 660         } else if (changed) {
 661                 struct net_bridge_mdb_entry *mp = br_mdb_ip_get(br, &pg->key.addr);
 662
 663                 if (changed && br_multicast_is_star_g(&pg->key.addr))
 664                         br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
 665
 666                 if (WARN_ON(!mp))
 667                         goto out;
 668                 br_mdb_notify(br->dev, mp, pg, RTM_NEWMDB);
 669         }
 670 out:
 671         spin_unlock(&br->multicast_lock);
 672 }
 673
 674 static void br_multicast_gc(struct hlist_head *head)
 675 {
 676         struct net_bridge_mcast_gc *gcent;
 677         struct hlist_node *tmp;
 678
 679         hlist_for_each_entry_safe(gcent, tmp, head, gc_node) {
 680                 hlist_del_init(&gcent->gc_node);
 681                 gcent->destroy(gcent);
 682         }
 683 }
 684
 685 static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
 686                                                     struct net_bridge_port_group *pg,
 687                                                     __be32 ip_dst, __be32 group,
 688                                                     bool with_srcs, bool over_lmqt,
 689                                                     u8 sflag, u8 *igmp_type,
 690                                                     bool *need_rexmit)
 691 {
 692         struct net_bridge_port *p = pg ? pg->key.port : NULL;
 693         struct net_bridge_group_src *ent;
 694         size_t pkt_size, igmp_hdr_size;
 695         unsigned long now = jiffies;
 696         struct igmpv3_query *ihv3;
 697         void *csum_start = NULL;
 698         __sum16 *csum = NULL;
 699         struct sk_buff *skb;
 700         struct igmphdr *ih;
 701         struct ethhdr *eth;
 702         unsigned long lmqt;
 703         struct iphdr *iph;
 704         u16 lmqt_srcs = 0;
 705
 706         igmp_hdr_size = sizeof(*ih);
 707         if (br->multicast_igmp_version == 3) {
 708                 igmp_hdr_size = sizeof(*ihv3);
 709                 if (pg && with_srcs) {
 710                         lmqt = now + (br->multicast_last_member_interval *
 711                                       br->multicast_last_member_count);
 712                         hlist_for_each_entry(ent, &pg->src_list, node) {
 713                                 if (over_lmqt == time_after(ent->timer.expires,
 714                                                             lmqt) &&
 715                                     ent->src_query_rexmit_cnt > 0)
 716                                         lmqt_srcs++;
 717                         }
 718
 719                         if (!lmqt_srcs)
 720                                 return NULL;
 721                         igmp_hdr_size += lmqt_srcs * sizeof(__be32);
 722                 }
 723         }
 724
 725         pkt_size = sizeof(*eth) + sizeof(*iph) + 4 + igmp_hdr_size;
 726         if ((p && pkt_size > p->dev->mtu) ||
 727             pkt_size > br->dev->mtu)
 728                 return NULL;
 729
 730         skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
 731         if (!skb)
 732                 goto out;
 733
 734         skb->protocol = htons(ETH_P_IP);
 735
 736         skb_reset_mac_header(skb);
 737         eth = eth_hdr(skb);
 738
 739         ether_addr_copy(eth->h_source, br->dev->dev_addr);
 740         ip_eth_mc_map(ip_dst, eth->h_dest);
 741         eth->h_proto = htons(ETH_P_IP);
 742         skb_put(skb, sizeof(*eth));
 743
 744         skb_set_network_header(skb, skb->len);
 745         iph = ip_hdr(skb);
 746         iph->tot_len = htons(pkt_size - sizeof(*eth));
 747
 748         iph->version = 4;
 749         iph->ihl = 6;
 750         iph->tos = 0xc0;
 751         iph->id = 0;
 752         iph->frag_off = htons(IP_DF);
 753         iph->ttl = 1;
 754         iph->protocol = IPPROTO_IGMP;
 755         iph->saddr = br_opt_get(br, BROPT_MULTICAST_QUERY_USE_IFADDR) ?
 756                      inet_select_addr(br->dev, 0, RT_SCOPE_LINK) : 0;
 757         iph->daddr = ip_dst;
 758         ((u8 *)&iph[1])[0] = IPOPT_RA;
 759         ((u8 *)&iph[1])[1] = 4;
 760         ((u8 *)&iph[1])[2] = 0;
 761         ((u8 *)&iph[1])[3] = 0;
 762         ip_send_check(iph);
 763         skb_put(skb, 24);
 764
 765         skb_set_transport_header(skb, skb->len);
 766         *igmp_type = IGMP_HOST_MEMBERSHIP_QUERY;
 767
 768         switch (br->multicast_igmp_version) {
 769         case 2:
 770                 ih = igmp_hdr(skb);
 771                 ih->type = IGMP_HOST_MEMBERSHIP_QUERY;
 772                 ih->code = (group ? br->multicast_last_member_interval :
 773                                     br->multicast_query_response_interval) /
 774                            (HZ / IGMP_TIMER_SCALE);
 775                 ih->group = group;
 776                 ih->csum = 0;
 777                 csum = &ih->csum;
 778                 csum_start = (void *)ih;
 779                 break;
 780         case 3:
 781                 ihv3 = igmpv3_query_hdr(skb);
 782                 ihv3->type = IGMP_HOST_MEMBERSHIP_QUERY;
 783                 ihv3->code = (group ? br->multicast_last_member_interval :
 784                                       br->multicast_query_response_interval) /
 785                              (HZ / IGMP_TIMER_SCALE);
 786                 ihv3->group = group;
 787                 ihv3->qqic = br->multicast_query_interval / HZ;
 788                 ihv3->nsrcs = htons(lmqt_srcs);
 789                 ihv3->resv = 0;
 790                 ihv3->suppress = sflag;
 791                 ihv3->qrv = 2;
 792                 ihv3->csum = 0;
 793                 csum = &ihv3->csum;
 794                 csum_start = (void *)ihv3;
 795                 if (!pg || !with_srcs)
 796                         break;
 797
 798                 lmqt_srcs = 0;
 799                 hlist_for_each_entry(ent, &pg->src_list, node) {
 800                         if (over_lmqt == time_after(ent->timer.expires,
 801                                                     lmqt) &&
 802                             ent->src_query_rexmit_cnt > 0) {
 803                                 ihv3->srcs[lmqt_srcs++] = ent->addr.src.ip4;
 804                                 ent->src_query_rexmit_cnt--;
 805                                 if (need_rexmit && ent->src_query_rexmit_cnt)
 806                                         *need_rexmit = true;
 807                         }
 808                 }
 809                 if (WARN_ON(lmqt_srcs != ntohs(ihv3->nsrcs))) {
 810                         kfree_skb(skb);
 811                         return NULL;
 812                 }
 813                 break;
 814         }
 815
 816         if (WARN_ON(!csum || !csum_start)) {
 817                 kfree_skb(skb);
 818                 return NULL;
 819         }
 820
 821         *csum = ip_compute_csum(csum_start, igmp_hdr_size);
 822         skb_put(skb, igmp_hdr_size);
 823         __skb_pull(skb, sizeof(*eth));
 824
 825 out:
 826         return skb;
 827 }
 828
 829 #if IS_ENABLED(CONFIG_IPV6)
 830 static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
 831                                                     struct net_bridge_port_group *pg,
 832                                                     const struct in6_addr *ip6_dst,
 833                                                     const struct in6_addr *group,
 834                                                     bool with_srcs, bool over_llqt,
 835                                                     u8 sflag, u8 *igmp_type,
 836                                                     bool *need_rexmit)
 837 {
 838         struct net_bridge_port *p = pg ? pg->key.port : NULL;
 839         struct net_bridge_group_src *ent;
 840         size_t pkt_size, mld_hdr_size;
 841         unsigned long now = jiffies;
 842         struct mld2_query *mld2q;
 843         void *csum_start = NULL;
 844         unsigned long interval;
 845         __sum16 *csum = NULL;
 846         struct ipv6hdr *ip6h;
 847         struct mld_msg *mldq;
 848         struct sk_buff *skb;
 849         unsigned long llqt;
 850         struct ethhdr *eth;
 851         u16 llqt_srcs = 0;
 852         u8 *hopopt;
 853
 854         mld_hdr_size = sizeof(*mldq);
 855         if (br->multicast_mld_version == 2) {
 856                 mld_hdr_size = sizeof(*mld2q);
 857                 if (pg && with_srcs) {
 858                         llqt = now + (br->multicast_last_member_interval *
 859                                       br->multicast_last_member_count);
 860                         hlist_for_each_entry(ent, &pg->src_list, node) {
 861                                 if (over_llqt == time_after(ent->timer.expires,
 862                                                             llqt) &&
 863                                     ent->src_query_rexmit_cnt > 0)
 864                                         llqt_srcs++;
 865                         }
 866
 867                         if (!llqt_srcs)
 868                                 return NULL;
 869                         mld_hdr_size += llqt_srcs * sizeof(struct in6_addr);
 870                 }
 871         }
 872
 873         pkt_size = sizeof(*eth) + sizeof(*ip6h) + 8 + mld_hdr_size;
 874         if ((p && pkt_size > p->dev->mtu) ||
 875             pkt_size > br->dev->mtu)
 876                 return NULL;
 877
 878         skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
 879         if (!skb)
 880                 goto out;
 881
 882         skb->protocol = htons(ETH_P_IPV6);
 883
 884         /* Ethernet header */
 885         skb_reset_mac_header(skb);
 886         eth = eth_hdr(skb);
 887
 888         ether_addr_copy(eth->h_source, br->dev->dev_addr);
 889         eth->h_proto = htons(ETH_P_IPV6);
 890         skb_put(skb, sizeof(*eth));
 891
 892         /* IPv6 header + HbH option */
 893         skb_set_network_header(skb, skb->len);
 894         ip6h = ipv6_hdr(skb);
 895
 896         *(__force __be32 *)ip6h = htonl(0x60000000);
 897         ip6h->payload_len = htons(8 + mld_hdr_size);
 898         ip6h->nexthdr = IPPROTO_HOPOPTS;
 899         ip6h->hop_limit = 1;
 900         ip6h->daddr = *ip6_dst;
 901         if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
 902                                &ip6h->saddr)) {
 903                 kfree_skb(skb);
 904                 br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, false);
 905                 return NULL;
 906         }
 907
 908         br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
 909         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 910
 911         hopopt = (u8 *)(ip6h + 1);
 912         hopopt[0] = IPPROTO_ICMPV6;             /* next hdr */
 913         hopopt[1] = 0;                          /* length of HbH */
 914         hopopt[2] = IPV6_TLV_ROUTERALERT;       /* Router Alert */
 915         hopopt[3] = 2;                          /* Length of RA Option */
 916         hopopt[4] = 0;                          /* Type = 0x0000 (MLD) */
 917         hopopt[5] = 0;
 918         hopopt[6] = IPV6_TLV_PAD1;              /* Pad1 */
 919         hopopt[7] = IPV6_TLV_PAD1;              /* Pad1 */
 920
 921         skb_put(skb, sizeof(*ip6h) + 8);
 922
 923         /* ICMPv6 */
 924         skb_set_transport_header(skb, skb->len);
 925         interval = ipv6_addr_any(group) ?
 926                         br->multicast_query_response_interval :
 927                         br->multicast_last_member_interval;
 928         *igmp_type = ICMPV6_MGM_QUERY;
 929         switch (br->multicast_mld_version) {
 930         case 1:
 931                 mldq = (struct mld_msg *)icmp6_hdr(skb);
 932                 mldq->mld_type = ICMPV6_MGM_QUERY;
 933                 mldq->mld_code = 0;
 934                 mldq->mld_cksum = 0;
 935                 mldq->mld_maxdelay = htons((u16)jiffies_to_msecs(interval));
 936                 mldq->mld_reserved = 0;
 937                 mldq->mld_mca = *group;
 938                 csum = &mldq->mld_cksum;
 939                 csum_start = (void *)mldq;
 940                 break;
 941         case 2:
 942                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
 943                 mld2q->mld2q_mrc = htons((u16)jiffies_to_msecs(interval));
 944                 mld2q->mld2q_type = ICMPV6_MGM_QUERY;
 945                 mld2q->mld2q_code = 0;
 946                 mld2q->mld2q_cksum = 0;
 947                 mld2q->mld2q_resv1 = 0;
 948                 mld2q->mld2q_resv2 = 0;
 949                 mld2q->mld2q_suppress = sflag;
 950                 mld2q->mld2q_qrv = 2;
 951                 mld2q->mld2q_nsrcs = htons(llqt_srcs);
 952                 mld2q->mld2q_qqic = br->multicast_query_interval / HZ;
 953                 mld2q->mld2q_mca = *group;
 954                 csum = &mld2q->mld2q_cksum;
 955                 csum_start = (void *)mld2q;
 956                 if (!pg || !with_srcs)
 957                         break;
 958
 959                 llqt_srcs = 0;
 960                 hlist_for_each_entry(ent, &pg->src_list, node) {
 961                         if (over_llqt == time_after(ent->timer.expires,
 962                                                     llqt) &&
 963                             ent->src_query_rexmit_cnt > 0) {
 964                                 mld2q->mld2q_srcs[llqt_srcs++] = ent->addr.src.ip6;
 965                                 ent->src_query_rexmit_cnt--;
 966                                 if (need_rexmit && ent->src_query_rexmit_cnt)
 967                                         *need_rexmit = true;
 968                         }
 969                 }
 970                 if (WARN_ON(llqt_srcs != ntohs(mld2q->mld2q_nsrcs))) {
 971                         kfree_skb(skb);
 972                         return NULL;
 973                 }
 974                 break;
 975         }
 976
 977         if (WARN_ON(!csum || !csum_start)) {
 978                 kfree_skb(skb);
 979                 return NULL;
 980         }
 981
 982         *csum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, mld_hdr_size,
 983                                 IPPROTO_ICMPV6,
 984                                 csum_partial(csum_start, mld_hdr_size, 0));
 985         skb_put(skb, mld_hdr_size);
 986         __skb_pull(skb, sizeof(*eth));
 987
 988 out:
 989         return skb;
 990 }
 991 #endif
 992
 993 static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
 994                                                 struct net_bridge_port_group *pg,
 995                                                 struct br_ip *ip_dst,
 996                                                 struct br_ip *group,
 997                                                 bool with_srcs, bool over_lmqt,
 998                                                 u8 sflag, u8 *igmp_type,
 999                                                 bool *need_rexmit)
1000 {
1001         __be32 ip4_dst;
1002
1003         switch (group->proto) {
1004         case htons(ETH_P_IP):
1005                 ip4_dst = ip_dst ? ip_dst->dst.ip4 : htonl(INADDR_ALLHOSTS_GROUP);
1006                 return br_ip4_multicast_alloc_query(br, pg,
1007                                                     ip4_dst, group->dst.ip4,
1008                                                     with_srcs, over_lmqt,
1009                                                     sflag, igmp_type,
1010                                                     need_rexmit);
1011 #if IS_ENABLED(CONFIG_IPV6)
1012         case htons(ETH_P_IPV6): {
1013                 struct in6_addr ip6_dst;
1014
1015                 if (ip_dst)
1016                         ip6_dst = ip_dst->dst.ip6;
1017                 else
1018                         ipv6_addr_set(&ip6_dst, htonl(0xff020000), 0, 0,
1019                                       htonl(1));
1020
1021                 return br_ip6_multicast_alloc_query(br, pg,
1022                                                     &ip6_dst, &group->dst.ip6,
1023                                                     with_srcs, over_lmqt,
1024                                                     sflag, igmp_type,
1025                                                     need_rexmit);
1026         }
1027 #endif
1028         }
1029         return NULL;
1030 }
1031
1032 struct net_bridge_mdb_entry *br_multicast_new_group(struct net_bridge *br,
1033                                                     struct br_ip *group)
1034 {
1035         struct net_bridge_mdb_entry *mp;
1036         int err;
1037
1038         mp = br_mdb_ip_get(br, group);
1039         if (mp)
1040                 return mp;
1041
1042         if (atomic_read(&br->mdb_hash_tbl.nelems) >= br->hash_max) {
1043                 br_opt_toggle(br, BROPT_MULTICAST_ENABLED, false);
1044                 return ERR_PTR(-E2BIG);
1045         }
1046
1047         mp = kzalloc(sizeof(*mp), GFP_ATOMIC);
1048         if (unlikely(!mp))
1049                 return ERR_PTR(-ENOMEM);
1050
1051         mp->br = br;
1052         mp->addr = *group;
1053         mp->mcast_gc.destroy = br_multicast_destroy_mdb_entry;
1054         timer_setup(&mp->timer, br_multicast_group_expired, 0);
1055         err = rhashtable_lookup_insert_fast(&br->mdb_hash_tbl, &mp->rhnode,
1056                                             br_mdb_rht_params);
1057         if (err) {
1058                 kfree(mp);
1059                 mp = ERR_PTR(err);
1060         } else {
1061                 hlist_add_head_rcu(&mp->mdb_node, &br->mdb_list);
1062         }
1063
1064         return mp;
1065 }
1066
1067 static void br_multicast_group_src_expired(struct timer_list *t)
1068 {
1069         struct net_bridge_group_src *src = from_timer(src, t, timer);
1070         struct net_bridge_port_group *pg;
1071         struct net_bridge *br = src->br;
1072
1073         spin_lock(&br->multicast_lock);
1074         if (hlist_unhashed(&src->node) || !netif_running(br->dev) ||
1075             timer_pending(&src->timer))
1076                 goto out;
1077
1078         pg = src->pg;
1079         if (pg->filter_mode == MCAST_INCLUDE) {
1080                 br_multicast_del_group_src(src);
1081                 if (!hlist_empty(&pg->src_list))
1082                         goto out;
1083                 br_multicast_find_del_pg(br, pg);
1084         } else {
1085                 br_multicast_fwd_src_handle(src);
1086         }
1087
1088 out:
1089         spin_unlock(&br->multicast_lock);
1090 }
1091
1092 static struct net_bridge_group_src *
1093 br_multicast_find_group_src(struct net_bridge_port_group *pg, struct br_ip *ip)
1094 {
1095         struct net_bridge_group_src *ent;
1096
1097         switch (ip->proto) {
1098         case htons(ETH_P_IP):
1099                 hlist_for_each_entry(ent, &pg->src_list, node)
1100                         if (ip->src.ip4 == ent->addr.src.ip4)
1101                                 return ent;
1102                 break;
1103 #if IS_ENABLED(CONFIG_IPV6)
1104         case htons(ETH_P_IPV6):
1105                 hlist_for_each_entry(ent, &pg->src_list, node)
1106                         if (!ipv6_addr_cmp(&ent->addr.src.ip6, &ip->src.ip6))
1107                                 return ent;
1108                 break;
1109 #endif
1110         }
1111
1112         return NULL;
1113 }
1114
1115 static struct net_bridge_group_src *
1116 br_multicast_new_group_src(struct net_bridge_port_group *pg, struct br_ip *src_ip)
1117 {
1118         struct net_bridge_group_src *grp_src;
1119
1120         if (unlikely(pg->src_ents >= PG_SRC_ENT_LIMIT))
1121                 return NULL;
1122
1123         switch (src_ip->proto) {
1124         case htons(ETH_P_IP):
1125                 if (ipv4_is_zeronet(src_ip->src.ip4) ||
1126                     ipv4_is_multicast(src_ip->src.ip4))
1127                         return NULL;
1128                 break;
1129 #if IS_ENABLED(CONFIG_IPV6)
1130         case htons(ETH_P_IPV6):
1131                 if (ipv6_addr_any(&src_ip->src.ip6) ||
1132                     ipv6_addr_is_multicast(&src_ip->src.ip6))
1133                         return NULL;
1134                 break;
1135 #endif
1136         }
1137
1138         grp_src = kzalloc(sizeof(*grp_src), GFP_ATOMIC);
1139         if (unlikely(!grp_src))
1140                 return NULL;
1141
1142         grp_src->pg = pg;
1143         grp_src->br = pg->key.port->br;
1144         grp_src->addr = *src_ip;
1145         grp_src->mcast_gc.destroy = br_multicast_destroy_group_src;
1146         timer_setup(&grp_src->timer, br_multicast_group_src_expired, 0);
1147
1148         hlist_add_head_rcu(&grp_src->node, &pg->src_list);
1149         pg->src_ents++;
1150
1151         return grp_src;
1152 }
1153
1154 struct net_bridge_port_group *br_multicast_new_port_group(
1155                         struct net_bridge_port *port,
1156                         struct br_ip *group,
1157                         struct net_bridge_port_group __rcu *next,
1158                         unsigned char flags,
1159                         const unsigned char *src,
1160                         u8 filter_mode,
1161                         u8 rt_protocol)
1162 {
1163         struct net_bridge_port_group *p;
1164
1165         p = kzalloc(sizeof(*p), GFP_ATOMIC);
1166         if (unlikely(!p))
1167                 return NULL;
1168
1169         p->key.addr = *group;
1170         p->key.port = port;
1171         p->flags = flags;
1172         p->filter_mode = filter_mode;
1173         p->rt_protocol = rt_protocol;
1174         p->mcast_gc.destroy = br_multicast_destroy_port_group;
1175         INIT_HLIST_HEAD(&p->src_list);
1176
1177         if (!br_multicast_is_star_g(group) &&
1178             rhashtable_lookup_insert_fast(&port->br->sg_port_tbl, &p->rhnode,
1179                                           br_sg_port_rht_params)) {
1180                 kfree(p);
1181                 return NULL;
1182         }
1183
1184         rcu_assign_pointer(p->next, next);
1185         timer_setup(&p->timer, br_multicast_port_group_expired, 0);
1186         timer_setup(&p->rexmit_timer, br_multicast_port_group_rexmit, 0);
1187         hlist_add_head(&p->mglist, &port->mglist);
1188
1189         if (src)
1190                 memcpy(p->eth_addr, src, ETH_ALEN);
1191         else
1192                 eth_broadcast_addr(p->eth_addr);
1193
1194         return p;
1195 }
1196
1197 void br_multicast_host_join(struct net_bridge_mdb_entry *mp, bool notify)
1198 {
1199         if (!mp->host_joined) {
1200                 mp->host_joined = true;
1201                 if (br_multicast_is_star_g(&mp->addr))
1202                         br_multicast_star_g_host_state(mp);
1203                 if (notify)
1204                         br_mdb_notify(mp->br->dev, mp, NULL, RTM_NEWMDB);
1205         }
1206         mod_timer(&mp->timer, jiffies + mp->br->multicast_membership_interval);
1207 }
1208
1209 void br_multicast_host_leave(struct net_bridge_mdb_entry *mp, bool notify)
1210 {
1211         if (!mp->host_joined)
1212                 return;
1213
1214         mp->host_joined = false;
1215         if (br_multicast_is_star_g(&mp->addr))
1216                 br_multicast_star_g_host_state(mp);
1217         if (notify)
1218                 br_mdb_notify(mp->br->dev, mp, NULL, RTM_DELMDB);
1219 }
1220
1221 static struct net_bridge_port_group *
1222 __br_multicast_add_group(struct net_bridge *br,
1223                          struct net_bridge_port *port,
1224                          struct br_ip *group,
1225                          const unsigned char *src,
1226                          u8 filter_mode,
1227                          bool igmpv2_mldv1,
1228                          bool blocked)
1229 {
1230         struct net_bridge_port_group __rcu **pp;
1231         struct net_bridge_port_group *p = NULL;
1232         struct net_bridge_mdb_entry *mp;
1233         unsigned long now = jiffies;
1234
1235         if (!netif_running(br->dev) ||
1236             (port && port->state == BR_STATE_DISABLED))
1237                 goto out;
1238
1239         mp = br_multicast_new_group(br, group);
1240         if (IS_ERR(mp))
1241                 return ERR_PTR(PTR_ERR(mp));
1242
1243         if (!port) {
1244                 br_multicast_host_join(mp, true);
1245                 goto out;
1246         }
1247
1248         for (pp = &mp->ports;
1249              (p = mlock_dereference(*pp, br)) != NULL;
1250              pp = &p->next) {
1251                 if (br_port_group_equal(p, port, src))
1252                         goto found;
1253                 if ((unsigned long)p->key.port < (unsigned long)port)
1254                         break;
1255         }
1256
1257         p = br_multicast_new_port_group(port, group, *pp, 0, src, filter_mode,
1258                                         RTPROT_KERNEL);
1259         if (unlikely(!p)) {
1260                 p = ERR_PTR(-ENOMEM);
1261                 goto out;
1262         }
1263         rcu_assign_pointer(*pp, p);
1264         if (blocked)
1265                 p->flags |= MDB_PG_FLAGS_BLOCKED;
1266         br_mdb_notify(br->dev, mp, p, RTM_NEWMDB);
1267
1268 found:
1269         if (igmpv2_mldv1)
1270                 mod_timer(&p->timer, now + br->multicast_membership_interval);
1271
1272 out:
1273         return p;
1274 }
1275
1276 static int br_multicast_add_group(struct net_bridge *br,
1277                                   struct net_bridge_port *port,
1278                                   struct br_ip *group,
1279                                   const unsigned char *src,
1280                                   u8 filter_mode,
1281                                   bool igmpv2_mldv1)
1282 {
1283         struct net_bridge_port_group *pg;
1284         int err;
1285
1286         spin_lock(&br->multicast_lock);
1287         pg = __br_multicast_add_group(br, port, group, src, filter_mode,
1288                                       igmpv2_mldv1, false);
1289         /* NULL is considered valid for host joined groups */
1290         err = IS_ERR(pg) ? PTR_ERR(pg) : 0;
1291         spin_unlock(&br->multicast_lock);
1292
1293         return err;
1294 }
1295
1296 static int br_ip4_multicast_add_group(struct net_bridge *br,
1297                                       struct net_bridge_port *port,
1298                                       __be32 group,
1299                                       __u16 vid,
1300                                       const unsigned char *src,
1301                                       bool igmpv2)
1302 {
1303         struct br_ip br_group;
1304         u8 filter_mode;
1305
1306         if (ipv4_is_local_multicast(group))
1307                 return 0;
1308
1309         memset(&br_group, 0, sizeof(br_group));
1310         br_group.dst.ip4 = group;
1311         br_group.proto = htons(ETH_P_IP);
1312         br_group.vid = vid;
1313         filter_mode = igmpv2 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1314
1315         return br_multicast_add_group(br, port, &br_group, src, filter_mode,
1316                                       igmpv2);
1317 }
1318
1319 #if IS_ENABLED(CONFIG_IPV6)
1320 static int br_ip6_multicast_add_group(struct net_bridge *br,
1321                                       struct net_bridge_port *port,
1322                                       const struct in6_addr *group,
1323                                       __u16 vid,
1324                                       const unsigned char *src,
1325                                       bool mldv1)
1326 {
1327         struct br_ip br_group;
1328         u8 filter_mode;
1329
1330         if (ipv6_addr_is_ll_all_nodes(group))
1331                 return 0;
1332
1333         memset(&br_group, 0, sizeof(br_group));
1334         br_group.dst.ip6 = *group;
1335         br_group.proto = htons(ETH_P_IPV6);
1336         br_group.vid = vid;
1337         filter_mode = mldv1 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1338
1339         return br_multicast_add_group(br, port, &br_group, src, filter_mode,
1340                                       mldv1);
1341 }
1342 #endif
1343
1344 static void br_multicast_router_expired(struct timer_list *t)
1345 {
1346         struct net_bridge_port *port =
1347                         from_timer(port, t, multicast_router_timer);
1348         struct net_bridge *br = port->br;
1349
1350         spin_lock(&br->multicast_lock);
1351         if (port->multicast_router == MDB_RTR_TYPE_DISABLED ||
1352             port->multicast_router == MDB_RTR_TYPE_PERM ||
1353             timer_pending(&port->multicast_router_timer))
1354                 goto out;
1355
1356         __del_port_router(port);
1357 out:
1358         spin_unlock(&br->multicast_lock);
1359 }
1360
1361 static void br_mc_router_state_change(struct net_bridge *p,
1362                                       bool is_mc_router)
1363 {
1364         struct switchdev_attr attr = {
1365                 .orig_dev = p->dev,
1366                 .id = SWITCHDEV_ATTR_ID_BRIDGE_MROUTER,
1367                 .flags = SWITCHDEV_F_DEFER,
1368                 .u.mrouter = is_mc_router,
1369         };
1370
1371         switchdev_port_attr_set(p->dev, &attr);
1372 }
1373
1374 static void br_multicast_local_router_expired(struct timer_list *t)
1375 {
1376         struct net_bridge *br = from_timer(br, t, multicast_router_timer);
1377
1378         spin_lock(&br->multicast_lock);
1379         if (br->multicast_router == MDB_RTR_TYPE_DISABLED ||
1380             br->multicast_router == MDB_RTR_TYPE_PERM ||
1381             timer_pending(&br->multicast_router_timer))
1382                 goto out;
1383
1384         br_mc_router_state_change(br, false);
1385 out:
1386         spin_unlock(&br->multicast_lock);
1387 }
1388
1389 static void br_multicast_querier_expired(struct net_bridge *br,
1390                                          struct bridge_mcast_own_query *query)
1391 {
1392         spin_lock(&br->multicast_lock);
1393         if (!netif_running(br->dev) || !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1394                 goto out;
1395
1396         br_multicast_start_querier(br, query);
1397
1398 out:
1399         spin_unlock(&br->multicast_lock);
1400 }
1401
1402 static void br_ip4_multicast_querier_expired(struct timer_list *t)
1403 {
1404         struct net_bridge *br = from_timer(br, t, ip4_other_query.timer);
1405
1406         br_multicast_querier_expired(br, &br->ip4_own_query);
1407 }
1408
1409 #if IS_ENABLED(CONFIG_IPV6)
1410 static void br_ip6_multicast_querier_expired(struct timer_list *t)
1411 {
1412         struct net_bridge *br = from_timer(br, t, ip6_other_query.timer);
1413
1414         br_multicast_querier_expired(br, &br->ip6_own_query);
1415 }
1416 #endif
1417
1418 static void br_multicast_select_own_querier(struct net_bridge *br,
1419                                             struct br_ip *ip,
1420                                             struct sk_buff *skb)
1421 {
1422         if (ip->proto == htons(ETH_P_IP))
1423                 br->ip4_querier.addr.src.ip4 = ip_hdr(skb)->saddr;
1424 #if IS_ENABLED(CONFIG_IPV6)
1425         else
1426                 br->ip6_querier.addr.src.ip6 = ipv6_hdr(skb)->saddr;
1427 #endif
1428 }
1429
1430 static void __br_multicast_send_query(struct net_bridge *br,
1431                                       struct net_bridge_port *port,
1432                                       struct net_bridge_port_group *pg,
1433                                       struct br_ip *ip_dst,
1434                                       struct br_ip *group,
1435                                       bool with_srcs,
1436                                       u8 sflag,
1437                                       bool *need_rexmit)
1438 {
1439         bool over_lmqt = !!sflag;
1440         struct sk_buff *skb;
1441         u8 igmp_type;
1442
1443 again_under_lmqt:
1444         skb = br_multicast_alloc_query(br, pg, ip_dst, group, with_srcs,
1445                                        over_lmqt, sflag, &igmp_type,
1446                                        need_rexmit);
1447         if (!skb)
1448                 return;
1449
1450         if (port) {
1451                 skb->dev = port->dev;
1452                 br_multicast_count(br, port, skb, igmp_type,
1453                                    BR_MCAST_DIR_TX);
1454                 NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
1455                         dev_net(port->dev), NULL, skb, NULL, skb->dev,
1456                         br_dev_queue_push_xmit);
1457
1458                 if (over_lmqt && with_srcs && sflag) {
1459                         over_lmqt = false;
1460                         goto again_under_lmqt;
1461                 }
1462         } else {
1463                 br_multicast_select_own_querier(br, group, skb);
1464                 br_multicast_count(br, port, skb, igmp_type,
1465                                    BR_MCAST_DIR_RX);
1466                 netif_rx(skb);
1467         }
1468 }
1469
1470 static void br_multicast_send_query(struct net_bridge *br,
1471                                     struct net_bridge_port *port,
1472                                     struct bridge_mcast_own_query *own_query)
1473 {
1474         struct bridge_mcast_other_query *other_query = NULL;
1475         struct br_ip br_group;
1476         unsigned long time;
1477
1478         if (!netif_running(br->dev) ||
1479             !br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
1480             !br_opt_get(br, BROPT_MULTICAST_QUERIER))
1481                 return;
1482
1483         memset(&br_group.dst, 0, sizeof(br_group.dst));
1484
1485         if (port ? (own_query == &port->ip4_own_query) :
1486                    (own_query == &br->ip4_own_query)) {
1487                 other_query = &br->ip4_other_query;
1488                 br_group.proto = htons(ETH_P_IP);
1489 #if IS_ENABLED(CONFIG_IPV6)
1490         } else {
1491                 other_query = &br->ip6_other_query;
1492                 br_group.proto = htons(ETH_P_IPV6);
1493 #endif
1494         }
1495
1496         if (!other_query || timer_pending(&other_query->timer))
1497                 return;
1498
1499         __br_multicast_send_query(br, port, NULL, NULL, &br_group, false, 0,
1500                                   NULL);
1501
1502         time = jiffies;
1503         time += own_query->startup_sent < br->multicast_startup_query_count ?
1504                 br->multicast_startup_query_interval :
1505                 br->multicast_query_interval;
1506         mod_timer(&own_query->timer, time);
1507 }
1508
1509 static void
1510 br_multicast_port_query_expired(struct net_bridge_port *port,
1511                                 struct bridge_mcast_own_query *query)
1512 {
1513         struct net_bridge *br = port->br;
1514
1515         spin_lock(&br->multicast_lock);
1516         if (port->state == BR_STATE_DISABLED ||
1517             port->state == BR_STATE_BLOCKING)
1518                 goto out;
1519
1520         if (query->startup_sent < br->multicast_startup_query_count)
1521                 query->startup_sent++;
1522
1523         br_multicast_send_query(port->br, port, query);
1524
1525 out:
1526         spin_unlock(&br->multicast_lock);
1527 }
1528
1529 static void br_ip4_multicast_port_query_expired(struct timer_list *t)
1530 {
1531         struct net_bridge_port *port = from_timer(port, t, ip4_own_query.timer);
1532
1533         br_multicast_port_query_expired(port, &port->ip4_own_query);
1534 }
1535
1536 #if IS_ENABLED(CONFIG_IPV6)
1537 static void br_ip6_multicast_port_query_expired(struct timer_list *t)
1538 {
1539         struct net_bridge_port *port = from_timer(port, t, ip6_own_query.timer);
1540
1541         br_multicast_port_query_expired(port, &port->ip6_own_query);
1542 }
1543 #endif
1544
1545 static void br_multicast_port_group_rexmit(struct timer_list *t)
1546 {
1547         struct net_bridge_port_group *pg = from_timer(pg, t, rexmit_timer);
1548         struct bridge_mcast_other_query *other_query = NULL;
1549         struct net_bridge *br = pg->key.port->br;
1550         bool need_rexmit = false;
1551
1552         spin_lock(&br->multicast_lock);
1553         if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
1554             !br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
1555             !br_opt_get(br, BROPT_MULTICAST_QUERIER))
1556                 goto out;
1557
1558         if (pg->key.addr.proto == htons(ETH_P_IP))
1559                 other_query = &br->ip4_other_query;
1560 #if IS_ENABLED(CONFIG_IPV6)
1561         else
1562                 other_query = &br->ip6_other_query;
1563 #endif
1564
1565         if (!other_query || timer_pending(&other_query->timer))
1566                 goto out;
1567
1568         if (pg->grp_query_rexmit_cnt) {
1569                 pg->grp_query_rexmit_cnt--;
1570                 __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1571                                           &pg->key.addr, false, 1, NULL);
1572         }
1573         __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1574                                   &pg->key.addr, true, 0, &need_rexmit);
1575
1576         if (pg->grp_query_rexmit_cnt || need_rexmit)
1577                 mod_timer(&pg->rexmit_timer, jiffies +
1578                                              br->multicast_last_member_interval);
1579 out:
1580         spin_unlock(&br->multicast_lock);
1581 }
1582
1583 static void br_mc_disabled_update(struct net_device *dev, bool value)
1584 {
1585         struct switchdev_attr attr = {
1586                 .orig_dev = dev,
1587                 .id = SWITCHDEV_ATTR_ID_BRIDGE_MC_DISABLED,
1588                 .flags = SWITCHDEV_F_DEFER,
1589                 .u.mc_disabled = !value,
1590         };
1591
1592         switchdev_port_attr_set(dev, &attr);
1593 }
1594
1595 int br_multicast_add_port(struct net_bridge_port *port)
1596 {
1597         port->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
1598
1599         timer_setup(&port->multicast_router_timer,
1600                     br_multicast_router_expired, 0);
1601         timer_setup(&port->ip4_own_query.timer,
1602                     br_ip4_multicast_port_query_expired, 0);
1603 #if IS_ENABLED(CONFIG_IPV6)
1604         timer_setup(&port->ip6_own_query.timer,
1605                     br_ip6_multicast_port_query_expired, 0);
1606 #endif
1607         br_mc_disabled_update(port->dev,
1608                               br_opt_get(port->br, BROPT_MULTICAST_ENABLED));
1609
1610         port->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
1611         if (!port->mcast_stats)
1612                 return -ENOMEM;
1613
1614         return 0;
1615 }
1616
1617 void br_multicast_del_port(struct net_bridge_port *port)
1618 {
1619         struct net_bridge *br = port->br;
1620         struct net_bridge_port_group *pg;
1621         HLIST_HEAD(deleted_head);
1622         struct hlist_node *n;
1623
1624         /* Take care of the remaining groups, only perm ones should be left */
1625         spin_lock_bh(&br->multicast_lock);
1626         hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
1627                 br_multicast_find_del_pg(br, pg);
1628         hlist_move_list(&br->mcast_gc_list, &deleted_head);
1629         spin_unlock_bh(&br->multicast_lock);
1630         br_multicast_gc(&deleted_head);
1631         del_timer_sync(&port->multicast_router_timer);
1632         free_percpu(port->mcast_stats);
1633 }
1634
1635 static void br_multicast_enable(struct bridge_mcast_own_query *query)
1636 {
1637         query->startup_sent = 0;
1638
1639         if (try_to_del_timer_sync(&query->timer) >= 0 ||
1640             del_timer(&query->timer))
1641                 mod_timer(&query->timer, jiffies);
1642 }
1643
1644 static void __br_multicast_enable_port(struct net_bridge_port *port)
1645 {
1646         struct net_bridge *br = port->br;
1647
1648         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED) || !netif_running(br->dev))
1649                 return;
1650
1651         br_multicast_enable(&port->ip4_own_query);
1652 #if IS_ENABLED(CONFIG_IPV6)
1653         br_multicast_enable(&port->ip6_own_query);
1654 #endif
1655         if (port->multicast_router == MDB_RTR_TYPE_PERM &&
1656             hlist_unhashed(&port->rlist))
1657                 br_multicast_add_router(br, port);
1658 }
1659
1660 void br_multicast_enable_port(struct net_bridge_port *port)
1661 {
1662         struct net_bridge *br = port->br;
1663
1664         spin_lock(&br->multicast_lock);
1665         __br_multicast_enable_port(port);
1666         spin_unlock(&br->multicast_lock);
1667 }
1668
1669 void br_multicast_disable_port(struct net_bridge_port *port)
1670 {
1671         struct net_bridge *br = port->br;
1672         struct net_bridge_port_group *pg;
1673         struct hlist_node *n;
1674
1675         spin_lock(&br->multicast_lock);
1676         hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
1677                 if (!(pg->flags & MDB_PG_FLAGS_PERMANENT))
1678                         br_multicast_find_del_pg(br, pg);
1679
1680         __del_port_router(port);
1681
1682         del_timer(&port->multicast_router_timer);
1683         del_timer(&port->ip4_own_query.timer);
1684 #if IS_ENABLED(CONFIG_IPV6)
1685         del_timer(&port->ip6_own_query.timer);
1686 #endif
1687         spin_unlock(&br->multicast_lock);
1688 }
1689
1690 static int __grp_src_delete_marked(struct net_bridge_port_group *pg)
1691 {
1692         struct net_bridge_group_src *ent;
1693         struct hlist_node *tmp;
1694         int deleted = 0;
1695
1696         hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
1697                 if (ent->flags & BR_SGRP_F_DELETE) {
1698                         br_multicast_del_group_src(ent);
1699                         deleted++;
1700                 }
1701
1702         return deleted;
1703 }
1704
1705 static void __grp_src_mod_timer(struct net_bridge_group_src *src,
1706                                 unsigned long expires)
1707 {
1708         mod_timer(&src->timer, expires);
1709         br_multicast_fwd_src_handle(src);
1710 }
1711
1712 static void __grp_src_query_marked_and_rexmit(struct net_bridge_port_group *pg)
1713 {
1714         struct bridge_mcast_other_query *other_query = NULL;
1715         struct net_bridge *br = pg->key.port->br;
1716         u32 lmqc = br->multicast_last_member_count;
1717         unsigned long lmqt, lmi, now = jiffies;
1718         struct net_bridge_group_src *ent;
1719
1720         if (!netif_running(br->dev) ||
1721             !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1722                 return;
1723
1724         if (pg->key.addr.proto == htons(ETH_P_IP))
1725                 other_query = &br->ip4_other_query;
1726 #if IS_ENABLED(CONFIG_IPV6)
1727         else
1728                 other_query = &br->ip6_other_query;
1729 #endif
1730
1731         lmqt = now + br_multicast_lmqt(br);
1732         hlist_for_each_entry(ent, &pg->src_list, node) {
1733                 if (ent->flags & BR_SGRP_F_SEND) {
1734                         ent->flags &= ~BR_SGRP_F_SEND;
1735                         if (ent->timer.expires > lmqt) {
1736                                 if (br_opt_get(br, BROPT_MULTICAST_QUERIER) &&
1737                                     other_query &&
1738                                     !timer_pending(&other_query->timer))
1739                                         ent->src_query_rexmit_cnt = lmqc;
1740                                 __grp_src_mod_timer(ent, lmqt);
1741                         }
1742                 }
1743         }
1744
1745         if (!br_opt_get(br, BROPT_MULTICAST_QUERIER) ||
1746             !other_query || timer_pending(&other_query->timer))
1747                 return;
1748
1749         __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1750                                   &pg->key.addr, true, 1, NULL);
1751
1752         lmi = now + br->multicast_last_member_interval;
1753         if (!timer_pending(&pg->rexmit_timer) ||
1754             time_after(pg->rexmit_timer.expires, lmi))
1755                 mod_timer(&pg->rexmit_timer, lmi);
1756 }
1757
1758 static void __grp_send_query_and_rexmit(struct net_bridge_port_group *pg)
1759 {
1760         struct bridge_mcast_other_query *other_query = NULL;
1761         struct net_bridge *br = pg->key.port->br;
1762         unsigned long now = jiffies, lmi;
1763
1764         if (!netif_running(br->dev) ||
1765             !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1766                 return;
1767
1768         if (pg->key.addr.proto == htons(ETH_P_IP))
1769                 other_query = &br->ip4_other_query;
1770 #if IS_ENABLED(CONFIG_IPV6)
1771         else
1772                 other_query = &br->ip6_other_query;
1773 #endif
1774
1775         if (br_opt_get(br, BROPT_MULTICAST_QUERIER) &&
1776             other_query && !timer_pending(&other_query->timer)) {
1777                 lmi = now + br->multicast_last_member_interval;
1778                 pg->grp_query_rexmit_cnt = br->multicast_last_member_count - 1;
1779                 __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1780                                           &pg->key.addr, false, 0, NULL);
1781                 if (!timer_pending(&pg->rexmit_timer) ||
1782                     time_after(pg->rexmit_timer.expires, lmi))
1783                         mod_timer(&pg->rexmit_timer, lmi);
1784         }
1785
1786         if (pg->filter_mode == MCAST_EXCLUDE &&
1787             (!timer_pending(&pg->timer) ||
1788              time_after(pg->timer.expires, now + br_multicast_lmqt(br))))
1789                 mod_timer(&pg->timer, now + br_multicast_lmqt(br));
1790 }
1791
1792 /* State          Msg type      New state                Actions
1793  * INCLUDE (A)    IS_IN (B)     INCLUDE (A+B)            (B)=GMI
1794  * INCLUDE (A)    ALLOW (B)     INCLUDE (A+B)            (B)=GMI
1795  * EXCLUDE (X,Y)  ALLOW (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
1796  */
1797 static bool br_multicast_isinc_allow(struct net_bridge_port_group *pg,
1798                                      void *srcs, u32 nsrcs, size_t src_size)
1799 {
1800         struct net_bridge *br = pg->key.port->br;
1801         struct net_bridge_group_src *ent;
1802         unsigned long now = jiffies;
1803         bool changed = false;
1804         struct br_ip src_ip;
1805         u32 src_idx;
1806
1807         memset(&src_ip, 0, sizeof(src_ip));
1808         src_ip.proto = pg->key.addr.proto;
1809         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1810                 memcpy(&src_ip.src, srcs, src_size);
1811                 ent = br_multicast_find_group_src(pg, &src_ip);
1812                 if (!ent) {
1813                         ent = br_multicast_new_group_src(pg, &src_ip);
1814                         if (ent)
1815                                 changed = true;
1816                 }
1817
1818                 if (ent)
1819                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
1820                 srcs += src_size;
1821         }
1822
1823         return changed;
1824 }
1825
1826 /* State          Msg type      New state                Actions
1827  * INCLUDE (A)    IS_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
1828  *                                                       Delete (A-B)
1829  *                                                       Group Timer=GMI
1830  */
1831 static void __grp_src_isexc_incl(struct net_bridge_port_group *pg,
1832                                  void *srcs, u32 nsrcs, size_t src_size)
1833 {
1834         struct net_bridge_group_src *ent;
1835         struct br_ip src_ip;
1836         u32 src_idx;
1837
1838         hlist_for_each_entry(ent, &pg->src_list, node)
1839                 ent->flags |= BR_SGRP_F_DELETE;
1840
1841         memset(&src_ip, 0, sizeof(src_ip));
1842         src_ip.proto = pg->key.addr.proto;
1843         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1844                 memcpy(&src_ip.src, srcs, src_size);
1845                 ent = br_multicast_find_group_src(pg, &src_ip);
1846                 if (ent)
1847                         ent->flags &= ~BR_SGRP_F_DELETE;
1848                 else
1849                         ent = br_multicast_new_group_src(pg, &src_ip);
1850                 if (ent)
1851                         br_multicast_fwd_src_handle(ent);
1852                 srcs += src_size;
1853         }
1854
1855         __grp_src_delete_marked(pg);
1856 }
1857
1858 /* State          Msg type      New state                Actions
1859  * EXCLUDE (X,Y)  IS_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=GMI
1860  *                                                       Delete (X-A)
1861  *                                                       Delete (Y-A)
1862  *                                                       Group Timer=GMI
1863  */
1864 static bool __grp_src_isexc_excl(struct net_bridge_port_group *pg,
1865                                  void *srcs, u32 nsrcs, size_t src_size)
1866 {
1867         struct net_bridge *br = pg->key.port->br;
1868         struct net_bridge_group_src *ent;
1869         unsigned long now = jiffies;
1870         bool changed = false;
1871         struct br_ip src_ip;
1872         u32 src_idx;
1873
1874         hlist_for_each_entry(ent, &pg->src_list, node)
1875                 ent->flags |= BR_SGRP_F_DELETE;
1876
1877         memset(&src_ip, 0, sizeof(src_ip));
1878         src_ip.proto = pg->key.addr.proto;
1879         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1880                 memcpy(&src_ip.src, srcs, src_size);
1881                 ent = br_multicast_find_group_src(pg, &src_ip);
1882                 if (ent) {
1883                         ent->flags &= ~BR_SGRP_F_DELETE;
1884                 } else {
1885                         ent = br_multicast_new_group_src(pg, &src_ip);
1886                         if (ent) {
1887                                 __grp_src_mod_timer(ent,
1888                                                     now + br_multicast_gmi(br));
1889                                 changed = true;
1890                         }
1891                 }
1892                 srcs += src_size;
1893         }
1894
1895         if (__grp_src_delete_marked(pg))
1896                 changed = true;
1897
1898         return changed;
1899 }
1900
1901 static bool br_multicast_isexc(struct net_bridge_port_group *pg,
1902                                void *srcs, u32 nsrcs, size_t src_size)
1903 {
1904         struct net_bridge *br = pg->key.port->br;
1905         bool changed = false;
1906
1907         switch (pg->filter_mode) {
1908         case MCAST_INCLUDE:
1909                 __grp_src_isexc_incl(pg, srcs, nsrcs, src_size);
1910                 br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
1911                 changed = true;
1912                 break;
1913         case MCAST_EXCLUDE:
1914                 changed = __grp_src_isexc_excl(pg, srcs, nsrcs, src_size);
1915                 break;
1916         }
1917
1918         pg->filter_mode = MCAST_EXCLUDE;
1919         mod_timer(&pg->timer, jiffies + br_multicast_gmi(br));
1920
1921         return changed;
1922 }
1923
1924 /* State          Msg type      New state                Actions
1925  * INCLUDE (A)    TO_IN (B)     INCLUDE (A+B)            (B)=GMI
1926  *                                                       Send Q(G,A-B)
1927  */
1928 static bool __grp_src_toin_incl(struct net_bridge_port_group *pg,
1929                                 void *srcs, u32 nsrcs, size_t src_size)
1930 {
1931         struct net_bridge *br = pg->key.port->br;
1932         u32 src_idx, to_send = pg->src_ents;
1933         struct net_bridge_group_src *ent;
1934         unsigned long now = jiffies;
1935         bool changed = false;
1936         struct br_ip src_ip;
1937
1938         hlist_for_each_entry(ent, &pg->src_list, node)
1939                 ent->flags |= BR_SGRP_F_SEND;
1940
1941         memset(&src_ip, 0, sizeof(src_ip));
1942         src_ip.proto = pg->key.addr.proto;
1943         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1944                 memcpy(&src_ip.src, srcs, src_size);
1945                 ent = br_multicast_find_group_src(pg, &src_ip);
1946                 if (ent) {
1947                         ent->flags &= ~BR_SGRP_F_SEND;
1948                         to_send--;
1949                 } else {
1950                         ent = br_multicast_new_group_src(pg, &src_ip);
1951                         if (ent)
1952                                 changed = true;
1953                 }
1954                 if (ent)
1955                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
1956                 srcs += src_size;
1957         }
1958
1959         if (to_send)
1960                 __grp_src_query_marked_and_rexmit(pg);
1961
1962         return changed;
1963 }
1964
1965 /* State          Msg type      New state                Actions
1966  * EXCLUDE (X,Y)  TO_IN (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
1967  *                                                       Send Q(G,X-A)
1968  *                                                       Send Q(G)
1969  */
1970 static bool __grp_src_toin_excl(struct net_bridge_port_group *pg,
1971                                 void *srcs, u32 nsrcs, size_t src_size)
1972 {
1973         struct net_bridge *br = pg->key.port->br;
1974         u32 src_idx, to_send = pg->src_ents;
1975         struct net_bridge_group_src *ent;
1976         unsigned long now = jiffies;
1977         bool changed = false;
1978         struct br_ip src_ip;
1979
1980         hlist_for_each_entry(ent, &pg->src_list, node)
1981                 if (timer_pending(&ent->timer))
1982                         ent->flags |= BR_SGRP_F_SEND;
1983
1984         memset(&src_ip, 0, sizeof(src_ip));
1985         src_ip.proto = pg->key.addr.proto;
1986         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1987                 memcpy(&src_ip.src, srcs, src_size);
1988                 ent = br_multicast_find_group_src(pg, &src_ip);
1989                 if (ent) {
1990                         if (timer_pending(&ent->timer)) {
1991                                 ent->flags &= ~BR_SGRP_F_SEND;
1992                                 to_send--;
1993                         }
1994                 } else {
1995                         ent = br_multicast_new_group_src(pg, &src_ip);
1996                         if (ent)
1997                                 changed = true;
1998                 }
1999                 if (ent)
2000                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
2001                 srcs += src_size;
2002         }
2003
2004         if (to_send)
2005                 __grp_src_query_marked_and_rexmit(pg);
2006
2007         __grp_send_query_and_rexmit(pg);
2008
2009         return changed;
2010 }
2011
2012 static bool br_multicast_toin(struct net_bridge_port_group *pg,
2013                               void *srcs, u32 nsrcs, size_t src_size)
2014 {
2015         bool changed = false;
2016
2017         switch (pg->filter_mode) {
2018         case MCAST_INCLUDE:
2019                 changed = __grp_src_toin_incl(pg, srcs, nsrcs, src_size);
2020                 break;
2021         case MCAST_EXCLUDE:
2022                 changed = __grp_src_toin_excl(pg, srcs, nsrcs, src_size);
2023                 break;
2024         }
2025
2026         return changed;
2027 }
2028
2029 /* State          Msg type      New state                Actions
2030  * INCLUDE (A)    TO_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
2031  *                                                       Delete (A-B)
2032  *                                                       Send Q(G,A*B)
2033  *                                                       Group Timer=GMI
2034  */
2035 static void __grp_src_toex_incl(struct net_bridge_port_group *pg,
2036                                 void *srcs, u32 nsrcs, size_t src_size)
2037 {
2038         struct net_bridge_group_src *ent;
2039         u32 src_idx, to_send = 0;
2040         struct br_ip src_ip;
2041
2042         hlist_for_each_entry(ent, &pg->src_list, node)
2043                 ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2044
2045         memset(&src_ip, 0, sizeof(src_ip));
2046         src_ip.proto = pg->key.addr.proto;
2047         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2048                 memcpy(&src_ip.src, srcs, src_size);
2049                 ent = br_multicast_find_group_src(pg, &src_ip);
2050                 if (ent) {
2051                         ent->flags = (ent->flags & ~BR_SGRP_F_DELETE) |
2052                                      BR_SGRP_F_SEND;
2053                         to_send++;
2054                 } else {
2055                         ent = br_multicast_new_group_src(pg, &src_ip);
2056                 }
2057                 if (ent)
2058                         br_multicast_fwd_src_handle(ent);
2059                 srcs += src_size;
2060         }
2061
2062         __grp_src_delete_marked(pg);
2063         if (to_send)
2064                 __grp_src_query_marked_and_rexmit(pg);
2065 }
2066
2067 /* State          Msg type      New state                Actions
2068  * EXCLUDE (X,Y)  TO_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=Group Timer
2069  *                                                       Delete (X-A)
2070  *                                                       Delete (Y-A)
2071  *                                                       Send Q(G,A-Y)
2072  *                                                       Group Timer=GMI
2073  */
2074 static bool __grp_src_toex_excl(struct net_bridge_port_group *pg,
2075                                 void *srcs, u32 nsrcs, size_t src_size)
2076 {
2077         struct net_bridge_group_src *ent;
2078         u32 src_idx, to_send = 0;
2079         bool changed = false;
2080         struct br_ip src_ip;
2081
2082         hlist_for_each_entry(ent, &pg->src_list, node)
2083                 ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2084
2085         memset(&src_ip, 0, sizeof(src_ip));
2086         src_ip.proto = pg->key.addr.proto;
2087         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2088                 memcpy(&src_ip.src, srcs, src_size);
2089                 ent = br_multicast_find_group_src(pg, &src_ip);
2090                 if (ent) {
2091                         ent->flags &= ~BR_SGRP_F_DELETE;
2092                 } else {
2093                         ent = br_multicast_new_group_src(pg, &src_ip);
2094                         if (ent) {
2095                                 __grp_src_mod_timer(ent, pg->timer.expires);
2096                                 changed = true;
2097                         }
2098                 }
2099                 if (ent && timer_pending(&ent->timer)) {
2100                         ent->flags |= BR_SGRP_F_SEND;
2101                         to_send++;
2102                 }
2103                 srcs += src_size;
2104         }
2105
2106         if (__grp_src_delete_marked(pg))
2107                 changed = true;
2108         if (to_send)
2109                 __grp_src_query_marked_and_rexmit(pg);
2110
2111         return changed;
2112 }
2113
2114 static bool br_multicast_toex(struct net_bridge_port_group *pg,
2115                               void *srcs, u32 nsrcs, size_t src_size)
2116 {
2117         struct net_bridge *br = pg->key.port->br;
2118         bool changed = false;
2119
2120         switch (pg->filter_mode) {
2121         case MCAST_INCLUDE:
2122                 __grp_src_toex_incl(pg, srcs, nsrcs, src_size);
2123                 br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
2124                 changed = true;
2125                 break;
2126         case MCAST_EXCLUDE:
2127                 changed = __grp_src_toex_excl(pg, srcs, nsrcs, src_size);
2128                 break;
2129         }
2130
2131         pg->filter_mode = MCAST_EXCLUDE;
2132         mod_timer(&pg->timer, jiffies + br_multicast_gmi(br));
2133
2134         return changed;
2135 }
2136
2137 /* State          Msg type      New state                Actions
2138  * INCLUDE (A)    BLOCK (B)     INCLUDE (A)              Send Q(G,A*B)
2139  */
2140 static void __grp_src_block_incl(struct net_bridge_port_group *pg,
2141                                  void *srcs, u32 nsrcs, size_t src_size)
2142 {
2143         struct net_bridge_group_src *ent;
2144         u32 src_idx, to_send = 0;
2145         struct br_ip src_ip;
2146
2147         hlist_for_each_entry(ent, &pg->src_list, node)
2148                 ent->flags &= ~BR_SGRP_F_SEND;
2149
2150         memset(&src_ip, 0, sizeof(src_ip));
2151         src_ip.proto = pg->key.addr.proto;
2152         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2153                 memcpy(&src_ip.src, srcs, src_size);
2154                 ent = br_multicast_find_group_src(pg, &src_ip);
2155                 if (ent) {
2156                         ent->flags |= BR_SGRP_F_SEND;
2157                         to_send++;
2158                 }
2159                 srcs += src_size;
2160         }
2161
2162         if (to_send)
2163                 __grp_src_query_marked_and_rexmit(pg);
2164
2165         if (pg->filter_mode == MCAST_INCLUDE && hlist_empty(&pg->src_list))
2166                 br_multicast_find_del_pg(pg->key.port->br, pg);
2167 }
2168
2169 /* State          Msg type      New state                Actions
2170  * EXCLUDE (X,Y)  BLOCK (A)     EXCLUDE (X+(A-Y),Y)      (A-X-Y)=Group Timer
2171  *                                                       Send Q(G,A-Y)
2172  */
2173 static bool __grp_src_block_excl(struct net_bridge_port_group *pg,
2174                                  void *srcs, u32 nsrcs, size_t src_size)
2175 {
2176         struct net_bridge_group_src *ent;
2177         u32 src_idx, to_send = 0;
2178         bool changed = false;
2179         struct br_ip src_ip;
2180
2181         hlist_for_each_entry(ent, &pg->src_list, node)
2182                 ent->flags &= ~BR_SGRP_F_SEND;
2183
2184         memset(&src_ip, 0, sizeof(src_ip));
2185         src_ip.proto = pg->key.addr.proto;
2186         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2187                 memcpy(&src_ip.src, srcs, src_size);
2188                 ent = br_multicast_find_group_src(pg, &src_ip);
2189                 if (!ent) {
2190                         ent = br_multicast_new_group_src(pg, &src_ip);
2191                         if (ent) {
2192                                 __grp_src_mod_timer(ent, pg->timer.expires);
2193                                 changed = true;
2194                         }
2195                 }
2196                 if (ent && timer_pending(&ent->timer)) {
2197                         ent->flags |= BR_SGRP_F_SEND;
2198                         to_send++;
2199                 }
2200                 srcs += src_size;
2201         }
2202
2203         if (to_send)
2204                 __grp_src_query_marked_and_rexmit(pg);
2205
2206         return changed;
2207 }
2208
2209 static bool br_multicast_block(struct net_bridge_port_group *pg,
2210                                void *srcs, u32 nsrcs, size_t src_size)
2211 {
2212         bool changed = false;
2213
2214         switch (pg->filter_mode) {
2215         case MCAST_INCLUDE:
2216                 __grp_src_block_incl(pg, srcs, nsrcs, src_size);
2217                 break;
2218         case MCAST_EXCLUDE:
2219                 changed = __grp_src_block_excl(pg, srcs, nsrcs, src_size);
2220                 break;
2221         }
2222
2223         return changed;
2224 }
2225
2226 static struct net_bridge_port_group *
2227 br_multicast_find_port(struct net_bridge_mdb_entry *mp,
2228                        struct net_bridge_port *p,
2229                        const unsigned char *src)
2230 {
2231         struct net_bridge *br __maybe_unused = mp->br;
2232         struct net_bridge_port_group *pg;
2233
2234         for (pg = mlock_dereference(mp->ports, br);
2235              pg;
2236              pg = mlock_dereference(pg->next, br))
2237                 if (br_port_group_equal(pg, p, src))
2238                         return pg;
2239
2240         return NULL;
2241 }
2242
2243 static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
2244                                          struct net_bridge_port *port,
2245                                          struct sk_buff *skb,
2246                                          u16 vid)
2247 {
2248         bool igmpv2 = br->multicast_igmp_version == 2;
2249         struct net_bridge_mdb_entry *mdst;
2250         struct net_bridge_port_group *pg;
2251         const unsigned char *src;
2252         struct igmpv3_report *ih;
2253         struct igmpv3_grec *grec;
2254         int i, len, num, type;
2255         bool changed = false;
2256         __be32 group;
2257         int err = 0;
2258         u16 nsrcs;
2259
2260         ih = igmpv3_report_hdr(skb);
2261         num = ntohs(ih->ngrec);
2262         len = skb_transport_offset(skb) + sizeof(*ih);
2263
2264         for (i = 0; i < num; i++) {
2265                 len += sizeof(*grec);
2266                 if (!ip_mc_may_pull(skb, len))
2267                         return -EINVAL;
2268
2269                 grec = (void *)(skb->data + len - sizeof(*grec));
2270                 group = grec->grec_mca;
2271                 type = grec->grec_type;
2272                 nsrcs = ntohs(grec->grec_nsrcs);
2273
2274                 len += nsrcs * 4;
2275                 if (!ip_mc_may_pull(skb, len))
2276                         return -EINVAL;
2277
2278                 switch (type) {
2279                 case IGMPV3_MODE_IS_INCLUDE:
2280                 case IGMPV3_MODE_IS_EXCLUDE:
2281                 case IGMPV3_CHANGE_TO_INCLUDE:
2282                 case IGMPV3_CHANGE_TO_EXCLUDE:
2283                 case IGMPV3_ALLOW_NEW_SOURCES:
2284                 case IGMPV3_BLOCK_OLD_SOURCES:
2285                         break;
2286
2287                 default:
2288                         continue;
2289                 }
2290
2291                 src = eth_hdr(skb)->h_source;
2292                 if (nsrcs == 0 &&
2293                     (type == IGMPV3_CHANGE_TO_INCLUDE ||
2294                      type == IGMPV3_MODE_IS_INCLUDE)) {
2295                         if (!port || igmpv2) {
2296                                 br_ip4_multicast_leave_group(br, port, group, vid, src);
2297                                 continue;
2298                         }
2299                 } else {
2300                         err = br_ip4_multicast_add_group(br, port, group, vid,
2301                                                          src, igmpv2);
2302                         if (err)
2303                                 break;
2304                 }
2305
2306                 if (!port || igmpv2)
2307                         continue;
2308
2309                 spin_lock_bh(&br->multicast_lock);
2310                 mdst = br_mdb_ip4_get(br, group, vid);
2311                 if (!mdst)
2312                         goto unlock_continue;
2313                 pg = br_multicast_find_port(mdst, port, src);
2314                 if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2315                         goto unlock_continue;
2316                 /* reload grec */
2317                 grec = (void *)(skb->data + len - sizeof(*grec) - (nsrcs * 4));
2318                 switch (type) {
2319                 case IGMPV3_ALLOW_NEW_SOURCES:
2320                         changed = br_multicast_isinc_allow(pg, grec->grec_src,
2321                                                            nsrcs, sizeof(__be32));
2322                         break;
2323                 case IGMPV3_MODE_IS_INCLUDE:
2324                         changed = br_multicast_isinc_allow(pg, grec->grec_src, nsrcs,
2325                                                            sizeof(__be32));
2326                         break;
2327                 case IGMPV3_MODE_IS_EXCLUDE:
2328                         changed = br_multicast_isexc(pg, grec->grec_src, nsrcs,
2329                                                      sizeof(__be32));
2330                         break;
2331                 case IGMPV3_CHANGE_TO_INCLUDE:
2332                         changed = br_multicast_toin(pg, grec->grec_src, nsrcs,
2333                                                     sizeof(__be32));
2334                         break;
2335                 case IGMPV3_CHANGE_TO_EXCLUDE:
2336                         changed = br_multicast_toex(pg, grec->grec_src, nsrcs,
2337                                                     sizeof(__be32));
2338                         break;
2339                 case IGMPV3_BLOCK_OLD_SOURCES:
2340                         changed = br_multicast_block(pg, grec->grec_src, nsrcs,
2341                                                      sizeof(__be32));
2342                         break;
2343                 }
2344                 if (changed)
2345                         br_mdb_notify(br->dev, mdst, pg, RTM_NEWMDB);
2346 unlock_continue:
2347                 spin_unlock_bh(&br->multicast_lock);
2348         }
2349
2350         return err;
2351 }
2352
2353 #if IS_ENABLED(CONFIG_IPV6)
2354 static int br_ip6_multicast_mld2_report(struct net_bridge *br,
2355                                         struct net_bridge_port *port,
2356                                         struct sk_buff *skb,
2357                                         u16 vid)
2358 {
2359         bool mldv1 = br->multicast_mld_version == 1;
2360         struct net_bridge_mdb_entry *mdst;
2361         struct net_bridge_port_group *pg;
2362         unsigned int nsrcs_offset;
2363         const unsigned char *src;
2364         struct icmp6hdr *icmp6h;
2365         struct mld2_grec *grec;
2366         unsigned int grec_len;
2367         bool changed = false;
2368         int i, len, num;
2369         int err = 0;
2370
2371         if (!ipv6_mc_may_pull(skb, sizeof(*icmp6h)))
2372                 return -EINVAL;
2373
2374         icmp6h = icmp6_hdr(skb);
2375         num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
2376         len = skb_transport_offset(skb) + sizeof(*icmp6h);
2377
2378         for (i = 0; i < num; i++) {
2379                 __be16 *_nsrcs, __nsrcs;
2380                 u16 nsrcs;
2381
2382                 nsrcs_offset = len + offsetof(struct mld2_grec, grec_nsrcs);
2383
2384                 if (skb_transport_offset(skb) + ipv6_transport_len(skb) <
2385                     nsrcs_offset + sizeof(__nsrcs))
2386                         return -EINVAL;
2387
2388                 _nsrcs = skb_header_pointer(skb, nsrcs_offset,
2389                                             sizeof(__nsrcs), &__nsrcs);
2390                 if (!_nsrcs)
2391                         return -EINVAL;
2392
2393                 nsrcs = ntohs(*_nsrcs);
2394                 grec_len = struct_size(grec, grec_src, nsrcs);
2395
2396                 if (!ipv6_mc_may_pull(skb, len + grec_len))
2397                         return -EINVAL;
2398
2399                 grec = (struct mld2_grec *)(skb->data + len);
2400                 len += grec_len;
2401
2402                 switch (grec->grec_type) {
2403                 case MLD2_MODE_IS_INCLUDE:
2404                 case MLD2_MODE_IS_EXCLUDE:
2405                 case MLD2_CHANGE_TO_INCLUDE:
2406                 case MLD2_CHANGE_TO_EXCLUDE:
2407                 case MLD2_ALLOW_NEW_SOURCES:
2408                 case MLD2_BLOCK_OLD_SOURCES:
2409                         break;
2410
2411                 default:
2412                         continue;
2413                 }
2414
2415                 src = eth_hdr(skb)->h_source;
2416                 if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
2417                      grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
2418                     nsrcs == 0) {
2419                         if (!port || mldv1) {
2420                                 br_ip6_multicast_leave_group(br, port,
2421                                                              &grec->grec_mca,
2422                                                              vid, src);
2423                                 continue;
2424                         }
2425                 } else {
2426                         err = br_ip6_multicast_add_group(br, port,
2427                                                          &grec->grec_mca, vid,
2428                                                          src, mldv1);
2429                         if (err)
2430                                 break;
2431                 }
2432
2433                 if (!port || mldv1)
2434                         continue;
2435
2436                 spin_lock_bh(&br->multicast_lock);
2437                 mdst = br_mdb_ip6_get(br, &grec->grec_mca, vid);
2438                 if (!mdst)
2439                         goto unlock_continue;
2440                 pg = br_multicast_find_port(mdst, port, src);
2441                 if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2442                         goto unlock_continue;
2443                 switch (grec->grec_type) {
2444                 case MLD2_ALLOW_NEW_SOURCES:
2445                         changed = br_multicast_isinc_allow(pg, grec->grec_src,
2446                                                            nsrcs,
2447                                                            sizeof(struct in6_addr));
2448                         break;
2449                 case MLD2_MODE_IS_INCLUDE:
2450                         changed = br_multicast_isinc_allow(pg, grec->grec_src, nsrcs,
2451                                                            sizeof(struct in6_addr));
2452                         break;
2453                 case MLD2_MODE_IS_EXCLUDE:
2454                         changed = br_multicast_isexc(pg, grec->grec_src, nsrcs,
2455                                                      sizeof(struct in6_addr));
2456                         break;
2457                 case MLD2_CHANGE_TO_INCLUDE:
2458                         changed = br_multicast_toin(pg, grec->grec_src, nsrcs,
2459                                                     sizeof(struct in6_addr));
2460                         break;
2461                 case MLD2_CHANGE_TO_EXCLUDE:
2462                         changed = br_multicast_toex(pg, grec->grec_src, nsrcs,
2463                                                     sizeof(struct in6_addr));
2464                         break;
2465                 case MLD2_BLOCK_OLD_SOURCES:
2466                         changed = br_multicast_block(pg, grec->grec_src, nsrcs,
2467                                                      sizeof(struct in6_addr));
2468                         break;
2469                 }
2470                 if (changed)
2471                         br_mdb_notify(br->dev, mdst, pg, RTM_NEWMDB);
2472 unlock_continue:
2473                 spin_unlock_bh(&br->multicast_lock);
2474         }
2475
2476         return err;
2477 }
2478 #endif
2479
2480 static bool br_ip4_multicast_select_querier(struct net_bridge *br,
2481                                             struct net_bridge_port *port,
2482                                             __be32 saddr)
2483 {
2484         if (!timer_pending(&br->ip4_own_query.timer) &&
2485             !timer_pending(&br->ip4_other_query.timer))
2486                 goto update;
2487
2488         if (!br->ip4_querier.addr.src.ip4)
2489                 goto update;
2490
2491         if (ntohl(saddr) <= ntohl(br->ip4_querier.addr.src.ip4))
2492                 goto update;
2493
2494         return false;
2495
2496 update:
2497         br->ip4_querier.addr.src.ip4 = saddr;
2498
2499         /* update protected by general multicast_lock by caller */
2500         rcu_assign_pointer(br->ip4_querier.port, port);
2501
2502         return true;
2503 }
2504
2505 #if IS_ENABLED(CONFIG_IPV6)
2506 static bool br_ip6_multicast_select_querier(struct net_bridge *br,
2507                                             struct net_bridge_port *port,
2508                                             struct in6_addr *saddr)
2509 {
2510         if (!timer_pending(&br->ip6_own_query.timer) &&
2511             !timer_pending(&br->ip6_other_query.timer))
2512                 goto update;
2513
2514         if (ipv6_addr_cmp(saddr, &br->ip6_querier.addr.src.ip6) <= 0)
2515                 goto update;
2516
2517         return false;
2518
2519 update:
2520         br->ip6_querier.addr.src.ip6 = *saddr;
2521
2522         /* update protected by general multicast_lock by caller */
2523         rcu_assign_pointer(br->ip6_querier.port, port);
2524
2525         return true;
2526 }
2527 #endif
2528
2529 static bool br_multicast_select_querier(struct net_bridge *br,
2530                                         struct net_bridge_port *port,
2531                                         struct br_ip *saddr)
2532 {
2533         switch (saddr->proto) {
2534         case htons(ETH_P_IP):
2535                 return br_ip4_multicast_select_querier(br, port, saddr->src.ip4);
2536 #if IS_ENABLED(CONFIG_IPV6)
2537         case htons(ETH_P_IPV6):
2538                 return br_ip6_multicast_select_querier(br, port, &saddr->src.ip6);
2539 #endif
2540         }
2541
2542         return false;
2543 }
2544
2545 static void
2546 br_multicast_update_query_timer(struct net_bridge *br,
2547                                 struct bridge_mcast_other_query *query,
2548                                 unsigned long max_delay)
2549 {
2550         if (!timer_pending(&query->timer))
2551                 query->delay_time = jiffies + max_delay;
2552
2553         mod_timer(&query->timer, jiffies + br->multicast_querier_interval);
2554 }
2555
2556 static void br_port_mc_router_state_change(struct net_bridge_port *p,
2557                                            bool is_mc_router)
2558 {
2559         struct switchdev_attr attr = {
2560                 .orig_dev = p->dev,
2561                 .id = SWITCHDEV_ATTR_ID_PORT_MROUTER,
2562                 .flags = SWITCHDEV_F_DEFER,
2563                 .u.mrouter = is_mc_router,
2564         };
2565
2566         switchdev_port_attr_set(p->dev, &attr);
2567 }
2568
2569 /*
2570  * Add port to router_list
2571  *  list is maintained ordered by pointer value
2572  *  and locked by br->multicast_lock and RCU
2573  */
2574 static void br_multicast_add_router(struct net_bridge *br,
2575                                     struct net_bridge_port *port)
2576 {
2577         struct net_bridge_port *p;
2578         struct hlist_node *slot = NULL;
2579
2580         if (!hlist_unhashed(&port->rlist))
2581                 return;
2582
2583         hlist_for_each_entry(p, &br->router_list, rlist) {
2584                 if ((unsigned long) port >= (unsigned long) p)
2585                         break;
2586                 slot = &p->rlist;
2587         }
2588
2589         if (slot)
2590                 hlist_add_behind_rcu(&port->rlist, slot);
2591         else
2592                 hlist_add_head_rcu(&port->rlist, &br->router_list);
2593         br_rtr_notify(br->dev, port, RTM_NEWMDB);
2594         br_port_mc_router_state_change(port, true);
2595 }
2596
2597 static void br_multicast_mark_router(struct net_bridge *br,
2598                                      struct net_bridge_port *port)
2599 {
2600         unsigned long now = jiffies;
2601
2602         if (!port) {
2603                 if (br->multicast_router == MDB_RTR_TYPE_TEMP_QUERY) {
2604                         if (!timer_pending(&br->multicast_router_timer))
2605                                 br_mc_router_state_change(br, true);
2606                         mod_timer(&br->multicast_router_timer,
2607                                   now + br->multicast_querier_interval);
2608                 }
2609                 return;
2610         }
2611
2612         if (port->multicast_router == MDB_RTR_TYPE_DISABLED ||
2613             port->multicast_router == MDB_RTR_TYPE_PERM)
2614                 return;
2615
2616         br_multicast_add_router(br, port);
2617
2618         mod_timer(&port->multicast_router_timer,
2619                   now + br->multicast_querier_interval);
2620 }
2621
2622 static void br_multicast_query_received(struct net_bridge *br,
2623                                         struct net_bridge_port *port,
2624                                         struct bridge_mcast_other_query *query,
2625                                         struct br_ip *saddr,
2626                                         unsigned long max_delay)
2627 {
2628         if (!br_multicast_select_querier(br, port, saddr))
2629                 return;
2630
2631         br_multicast_update_query_timer(br, query, max_delay);
2632         br_multicast_mark_router(br, port);
2633 }
2634
2635 static void br_ip4_multicast_query(struct net_bridge *br,
2636                                    struct net_bridge_port *port,
2637                                    struct sk_buff *skb,
2638                                    u16 vid)
2639 {
2640         unsigned int transport_len = ip_transport_len(skb);
2641         const struct iphdr *iph = ip_hdr(skb);
2642         struct igmphdr *ih = igmp_hdr(skb);
2643         struct net_bridge_mdb_entry *mp;
2644         struct igmpv3_query *ih3;
2645         struct net_bridge_port_group *p;
2646         struct net_bridge_port_group __rcu **pp;
2647         struct br_ip saddr;
2648         unsigned long max_delay;
2649         unsigned long now = jiffies;
2650         __be32 group;
2651
2652         spin_lock(&br->multicast_lock);
2653         if (!netif_running(br->dev) ||
2654             (port && port->state == BR_STATE_DISABLED))
2655                 goto out;
2656
2657         group = ih->group;
2658
2659         if (transport_len == sizeof(*ih)) {
2660                 max_delay = ih->code * (HZ / IGMP_TIMER_SCALE);
2661
2662                 if (!max_delay) {
2663                         max_delay = 10 * HZ;
2664                         group = 0;
2665                 }
2666         } else if (transport_len >= sizeof(*ih3)) {
2667                 ih3 = igmpv3_query_hdr(skb);
2668                 if (ih3->nsrcs ||
2669                     (br->multicast_igmp_version == 3 && group && ih3->suppress))
2670                         goto out;
2671
2672                 max_delay = ih3->code ?
2673                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
2674         } else {
2675                 goto out;
2676         }
2677
2678         if (!group) {
2679                 saddr.proto = htons(ETH_P_IP);
2680                 saddr.src.ip4 = iph->saddr;
2681
2682                 br_multicast_query_received(br, port, &br->ip4_other_query,
2683                                             &saddr, max_delay);
2684                 goto out;
2685         }
2686
2687         mp = br_mdb_ip4_get(br, group, vid);
2688         if (!mp)
2689                 goto out;
2690
2691         max_delay *= br->multicast_last_member_count;
2692
2693         if (mp->host_joined &&
2694             (timer_pending(&mp->timer) ?
2695              time_after(mp->timer.expires, now + max_delay) :
2696              try_to_del_timer_sync(&mp->timer) >= 0))
2697                 mod_timer(&mp->timer, now + max_delay);
2698
2699         for (pp = &mp->ports;
2700              (p = mlock_dereference(*pp, br)) != NULL;
2701              pp = &p->next) {
2702                 if (timer_pending(&p->timer) ?
2703                     time_after(p->timer.expires, now + max_delay) :
2704                     try_to_del_timer_sync(&p->timer) >= 0 &&
2705                     (br->multicast_igmp_version == 2 ||
2706                      p->filter_mode == MCAST_EXCLUDE))
2707                         mod_timer(&p->timer, now + max_delay);
2708         }
2709
2710 out:
2711         spin_unlock(&br->multicast_lock);
2712 }
2713
2714 #if IS_ENABLED(CONFIG_IPV6)
2715 static int br_ip6_multicast_query(struct net_bridge *br,
2716                                   struct net_bridge_port *port,
2717                                   struct sk_buff *skb,
2718                                   u16 vid)
2719 {
2720         unsigned int transport_len = ipv6_transport_len(skb);
2721         struct mld_msg *mld;
2722         struct net_bridge_mdb_entry *mp;
2723         struct mld2_query *mld2q;
2724         struct net_bridge_port_group *p;
2725         struct net_bridge_port_group __rcu **pp;
2726         struct br_ip saddr;
2727         unsigned long max_delay;
2728         unsigned long now = jiffies;
2729         unsigned int offset = skb_transport_offset(skb);
2730         const struct in6_addr *group = NULL;
2731         bool is_general_query;
2732         int err = 0;
2733
2734         spin_lock(&br->multicast_lock);
2735         if (!netif_running(br->dev) ||
2736             (port && port->state == BR_STATE_DISABLED))
2737                 goto out;
2738
2739         if (transport_len == sizeof(*mld)) {
2740                 if (!pskb_may_pull(skb, offset + sizeof(*mld))) {
2741                         err = -EINVAL;
2742                         goto out;
2743                 }
2744                 mld = (struct mld_msg *) icmp6_hdr(skb);
2745                 max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
2746                 if (max_delay)
2747                         group = &mld->mld_mca;
2748         } else {
2749                 if (!pskb_may_pull(skb, offset + sizeof(*mld2q))) {
2750                         err = -EINVAL;
2751                         goto out;
2752                 }
2753                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
2754                 if (!mld2q->mld2q_nsrcs)
2755                         group = &mld2q->mld2q_mca;
2756                 if (br->multicast_mld_version == 2 &&
2757                     !ipv6_addr_any(&mld2q->mld2q_mca) &&
2758                     mld2q->mld2q_suppress)
2759                         goto out;
2760
2761                 max_delay = max(msecs_to_jiffies(mldv2_mrc(mld2q)), 1UL);
2762         }
2763
2764         is_general_query = group && ipv6_addr_any(group);
2765
2766         if (is_general_query) {
2767                 saddr.proto = htons(ETH_P_IPV6);
2768                 saddr.src.ip6 = ipv6_hdr(skb)->saddr;
2769
2770                 br_multicast_query_received(br, port, &br->ip6_other_query,
2771                                             &saddr, max_delay);
2772                 goto out;
2773         } else if (!group) {
2774                 goto out;
2775         }
2776
2777         mp = br_mdb_ip6_get(br, group, vid);
2778         if (!mp)
2779                 goto out;
2780
2781         max_delay *= br->multicast_last_member_count;
2782         if (mp->host_joined &&
2783             (timer_pending(&mp->timer) ?
2784              time_after(mp->timer.expires, now + max_delay) :
2785              try_to_del_timer_sync(&mp->timer) >= 0))
2786                 mod_timer(&mp->timer, now + max_delay);
2787
2788         for (pp = &mp->ports;
2789              (p = mlock_dereference(*pp, br)) != NULL;
2790              pp = &p->next) {
2791                 if (timer_pending(&p->timer) ?
2792                     time_after(p->timer.expires, now + max_delay) :
2793                     try_to_del_timer_sync(&p->timer) >= 0 &&
2794                     (br->multicast_mld_version == 1 ||
2795                      p->filter_mode == MCAST_EXCLUDE))
2796                         mod_timer(&p->timer, now + max_delay);
2797         }
2798
2799 out:
2800         spin_unlock(&br->multicast_lock);
2801         return err;
2802 }
2803 #endif
2804
2805 static void
2806 br_multicast_leave_group(struct net_bridge *br,
2807                          struct net_bridge_port *port,
2808                          struct br_ip *group,
2809                          struct bridge_mcast_other_query *other_query,
2810                          struct bridge_mcast_own_query *own_query,
2811                          const unsigned char *src)
2812 {
2813         struct net_bridge_mdb_entry *mp;
2814         struct net_bridge_port_group *p;
2815         unsigned long now;
2816         unsigned long time;
2817
2818         spin_lock(&br->multicast_lock);
2819         if (!netif_running(br->dev) ||
2820             (port && port->state == BR_STATE_DISABLED))
2821                 goto out;
2822
2823         mp = br_mdb_ip_get(br, group);
2824         if (!mp)
2825                 goto out;
2826
2827         if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
2828                 struct net_bridge_port_group __rcu **pp;
2829
2830                 for (pp = &mp->ports;
2831                      (p = mlock_dereference(*pp, br)) != NULL;
2832                      pp = &p->next) {
2833                         if (!br_port_group_equal(p, port, src))
2834                                 continue;
2835
2836                         if (p->flags & MDB_PG_FLAGS_PERMANENT)
2837                                 break;
2838
2839                         p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2840                         br_multicast_del_pg(mp, p, pp);
2841                 }
2842                 goto out;
2843         }
2844
2845         if (timer_pending(&other_query->timer))
2846                 goto out;
2847
2848         if (br_opt_get(br, BROPT_MULTICAST_QUERIER)) {
2849                 __br_multicast_send_query(br, port, NULL, NULL, &mp->addr,
2850                                           false, 0, NULL);
2851
2852                 time = jiffies + br->multicast_last_member_count *
2853                                  br->multicast_last_member_interval;
2854
2855                 mod_timer(&own_query->timer, time);
2856
2857                 for (p = mlock_dereference(mp->ports, br);
2858                      p != NULL;
2859                      p = mlock_dereference(p->next, br)) {
2860                         if (!br_port_group_equal(p, port, src))
2861                                 continue;
2862
2863                         if (!hlist_unhashed(&p->mglist) &&
2864                             (timer_pending(&p->timer) ?
2865                              time_after(p->timer.expires, time) :
2866                              try_to_del_timer_sync(&p->timer) >= 0)) {
2867                                 mod_timer(&p->timer, time);
2868                         }
2869
2870                         break;
2871                 }
2872         }
2873
2874         now = jiffies;
2875         time = now + br->multicast_last_member_count *
2876                      br->multicast_last_member_interval;
2877
2878         if (!port) {
2879                 if (mp->host_joined &&
2880                     (timer_pending(&mp->timer) ?
2881                      time_after(mp->timer.expires, time) :
2882                      try_to_del_timer_sync(&mp->timer) >= 0)) {
2883                         mod_timer(&mp->timer, time);
2884                 }
2885
2886                 goto out;
2887         }
2888
2889         for (p = mlock_dereference(mp->ports, br);
2890              p != NULL;
2891              p = mlock_dereference(p->next, br)) {
2892                 if (p->key.port != port)
2893                         continue;
2894
2895                 if (!hlist_unhashed(&p->mglist) &&
2896                     (timer_pending(&p->timer) ?
2897                      time_after(p->timer.expires, time) :
2898                      try_to_del_timer_sync(&p->timer) >= 0)) {
2899                         mod_timer(&p->timer, time);
2900                 }
2901
2902                 break;
2903         }
2904 out:
2905         spin_unlock(&br->multicast_lock);
2906 }
2907
2908 static void br_ip4_multicast_leave_group(struct net_bridge *br,
2909                                          struct net_bridge_port *port,
2910                                          __be32 group,
2911                                          __u16 vid,
2912                                          const unsigned char *src)
2913 {
2914         struct br_ip br_group;
2915         struct bridge_mcast_own_query *own_query;
2916
2917         if (ipv4_is_local_multicast(group))
2918                 return;
2919
2920         own_query = port ? &port->ip4_own_query : &br->ip4_own_query;
2921
2922         memset(&br_group, 0, sizeof(br_group));
2923         br_group.dst.ip4 = group;
2924         br_group.proto = htons(ETH_P_IP);
2925         br_group.vid = vid;
2926
2927         br_multicast_leave_group(br, port, &br_group, &br->ip4_other_query,
2928                                  own_query, src);
2929 }
2930
2931 #if IS_ENABLED(CONFIG_IPV6)
2932 static void br_ip6_multicast_leave_group(struct net_bridge *br,
2933                                          struct net_bridge_port *port,
2934                                          const struct in6_addr *group,
2935                                          __u16 vid,
2936                                          const unsigned char *src)
2937 {
2938         struct br_ip br_group;
2939         struct bridge_mcast_own_query *own_query;
2940
2941         if (ipv6_addr_is_ll_all_nodes(group))
2942                 return;
2943
2944         own_query = port ? &port->ip6_own_query : &br->ip6_own_query;
2945
2946         memset(&br_group, 0, sizeof(br_group));
2947         br_group.dst.ip6 = *group;
2948         br_group.proto = htons(ETH_P_IPV6);
2949         br_group.vid = vid;
2950
2951         br_multicast_leave_group(br, port, &br_group, &br->ip6_other_query,
2952                                  own_query, src);
2953 }
2954 #endif
2955
2956 static void br_multicast_err_count(const struct net_bridge *br,
2957                                    const struct net_bridge_port *p,
2958                                    __be16 proto)
2959 {
2960         struct bridge_mcast_stats __percpu *stats;
2961         struct bridge_mcast_stats *pstats;
2962
2963         if (!br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
2964                 return;
2965
2966         if (p)
2967                 stats = p->mcast_stats;
2968         else
2969                 stats = br->mcast_stats;
2970         if (WARN_ON(!stats))
2971                 return;
2972
2973         pstats = this_cpu_ptr(stats);
2974
2975         u64_stats_update_begin(&pstats->syncp);
2976         switch (proto) {
2977         case htons(ETH_P_IP):
2978                 pstats->mstats.igmp_parse_errors++;
2979                 break;
2980 #if IS_ENABLED(CONFIG_IPV6)
2981         case htons(ETH_P_IPV6):
2982                 pstats->mstats.mld_parse_errors++;
2983                 break;
2984 #endif
2985         }
2986         u64_stats_update_end(&pstats->syncp);
2987 }
2988
2989 static void br_multicast_pim(struct net_bridge *br,
2990                              struct net_bridge_port *port,
2991                              const struct sk_buff *skb)
2992 {
2993         unsigned int offset = skb_transport_offset(skb);
2994         struct pimhdr *pimhdr, _pimhdr;
2995
2996         pimhdr = skb_header_pointer(skb, offset, sizeof(_pimhdr), &_pimhdr);
2997         if (!pimhdr || pim_hdr_version(pimhdr) != PIM_VERSION ||
2998             pim_hdr_type(pimhdr) != PIM_TYPE_HELLO)
2999                 return;
3000
3001         br_multicast_mark_router(br, port);
3002 }
3003
3004 static int br_ip4_multicast_mrd_rcv(struct net_bridge *br,
3005                                     struct net_bridge_port *port,
3006                                     struct sk_buff *skb)
3007 {
3008         if (ip_hdr(skb)->protocol != IPPROTO_IGMP ||
3009             igmp_hdr(skb)->type != IGMP_MRDISC_ADV)
3010                 return -ENOMSG;
3011
3012         br_multicast_mark_router(br, port);
3013
3014         return 0;
3015 }
3016
3017 static int br_multicast_ipv4_rcv(struct net_bridge *br,
3018                                  struct net_bridge_port *port,
3019                                  struct sk_buff *skb,
3020                                  u16 vid)
3021 {
3022         const unsigned char *src;
3023         struct igmphdr *ih;
3024         int err;
3025
3026         err = ip_mc_check_igmp(skb);
3027
3028         if (err == -ENOMSG) {
3029                 if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
3030                         BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3031                 } else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
3032                         if (ip_hdr(skb)->protocol == IPPROTO_PIM)
3033                                 br_multicast_pim(br, port, skb);
3034                 } else if (ipv4_is_all_snoopers(ip_hdr(skb)->daddr)) {
3035                         br_ip4_multicast_mrd_rcv(br, port, skb);
3036                 }
3037
3038                 return 0;
3039         } else if (err < 0) {
3040                 br_multicast_err_count(br, port, skb->protocol);
3041                 return err;
3042         }
3043
3044         ih = igmp_hdr(skb);
3045         src = eth_hdr(skb)->h_source;
3046         BR_INPUT_SKB_CB(skb)->igmp = ih->type;
3047
3048         switch (ih->type) {
3049         case IGMP_HOST_MEMBERSHIP_REPORT:
3050         case IGMPV2_HOST_MEMBERSHIP_REPORT:
3051                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3052                 err = br_ip4_multicast_add_group(br, port, ih->group, vid, src,
3053                                                  true);
3054                 break;
3055         case IGMPV3_HOST_MEMBERSHIP_REPORT:
3056                 err = br_ip4_multicast_igmp3_report(br, port, skb, vid);
3057                 break;
3058         case IGMP_HOST_MEMBERSHIP_QUERY:
3059                 br_ip4_multicast_query(br, port, skb, vid);
3060                 break;
3061         case IGMP_HOST_LEAVE_MESSAGE:
3062                 br_ip4_multicast_leave_group(br, port, ih->group, vid, src);
3063                 break;
3064         }
3065
3066         br_multicast_count(br, port, skb, BR_INPUT_SKB_CB(skb)->igmp,
3067                            BR_MCAST_DIR_RX);
3068
3069         return err;
3070 }
3071
3072 #if IS_ENABLED(CONFIG_IPV6)
3073 static int br_ip6_multicast_mrd_rcv(struct net_bridge *br,
3074                                     struct net_bridge_port *port,
3075                                     struct sk_buff *skb)
3076 {
3077         int ret;
3078
3079         if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6)
3080                 return -ENOMSG;
3081
3082         ret = ipv6_mc_check_icmpv6(skb);
3083         if (ret < 0)
3084                 return ret;
3085
3086         if (icmp6_hdr(skb)->icmp6_type != ICMPV6_MRDISC_ADV)
3087                 return -ENOMSG;
3088
3089         br_multicast_mark_router(br, port);
3090
3091         return 0;
3092 }
3093
3094 static int br_multicast_ipv6_rcv(struct net_bridge *br,
3095                                  struct net_bridge_port *port,
3096                                  struct sk_buff *skb,
3097                                  u16 vid)
3098 {
3099         const unsigned char *src;
3100         struct mld_msg *mld;
3101         int err;
3102
3103         err = ipv6_mc_check_mld(skb);
3104
3105         if (err == -ENOMSG) {
3106                 if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
3107                         BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3108
3109                 if (ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr)) {
3110                         err = br_ip6_multicast_mrd_rcv(br, port, skb);
3111
3112                         if (err < 0 && err != -ENOMSG) {
3113                                 br_multicast_err_count(br, port, skb->protocol);
3114                                 return err;
3115                         }
3116                 }
3117
3118                 return 0;
3119         } else if (err < 0) {
3120                 br_multicast_err_count(br, port, skb->protocol);
3121                 return err;
3122         }
3123
3124         mld = (struct mld_msg *)skb_transport_header(skb);
3125         BR_INPUT_SKB_CB(skb)->igmp = mld->mld_type;
3126
3127         switch (mld->mld_type) {
3128         case ICMPV6_MGM_REPORT:
3129                 src = eth_hdr(skb)->h_source;
3130                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3131                 err = br_ip6_multicast_add_group(br, port, &mld->mld_mca, vid,
3132                                                  src, true);
3133                 break;
3134         case ICMPV6_MLD2_REPORT:
3135                 err = br_ip6_multicast_mld2_report(br, port, skb, vid);
3136                 break;
3137         case ICMPV6_MGM_QUERY:
3138                 err = br_ip6_multicast_query(br, port, skb, vid);
3139                 break;
3140         case ICMPV6_MGM_REDUCTION:
3141                 src = eth_hdr(skb)->h_source;
3142                 br_ip6_multicast_leave_group(br, port, &mld->mld_mca, vid, src);
3143                 break;
3144         }
3145
3146         br_multicast_count(br, port, skb, BR_INPUT_SKB_CB(skb)->igmp,
3147                            BR_MCAST_DIR_RX);
3148
3149         return err;
3150 }
3151 #endif
3152
3153 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
3154                      struct sk_buff *skb, u16 vid)
3155 {
3156         int ret = 0;
3157
3158         BR_INPUT_SKB_CB(skb)->igmp = 0;
3159         BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
3160
3161         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
3162                 return 0;
3163
3164         switch (skb->protocol) {
3165         case htons(ETH_P_IP):
3166                 ret = br_multicast_ipv4_rcv(br, port, skb, vid);
3167                 break;
3168 #if IS_ENABLED(CONFIG_IPV6)
3169         case htons(ETH_P_IPV6):
3170                 ret = br_multicast_ipv6_rcv(br, port, skb, vid);
3171                 break;
3172 #endif
3173         }
3174
3175         return ret;
3176 }
3177
3178 static void br_multicast_query_expired(struct net_bridge *br,
3179                                        struct bridge_mcast_own_query *query,
3180                                        struct bridge_mcast_querier *querier)
3181 {
3182         spin_lock(&br->multicast_lock);
3183         if (query->startup_sent < br->multicast_startup_query_count)
3184                 query->startup_sent++;
3185
3186         RCU_INIT_POINTER(querier->port, NULL);
3187         br_multicast_send_query(br, NULL, query);
3188         spin_unlock(&br->multicast_lock);
3189 }
3190
3191 static void br_ip4_multicast_query_expired(struct timer_list *t)
3192 {
3193         struct net_bridge *br = from_timer(br, t, ip4_own_query.timer);
3194
3195         br_multicast_query_expired(br, &br->ip4_own_query, &br->ip4_querier);
3196 }
3197
3198 #if IS_ENABLED(CONFIG_IPV6)
3199 static void br_ip6_multicast_query_expired(struct timer_list *t)
3200 {
3201         struct net_bridge *br = from_timer(br, t, ip6_own_query.timer);
3202
3203         br_multicast_query_expired(br, &br->ip6_own_query, &br->ip6_querier);
3204 }
3205 #endif
3206
3207 static void br_multicast_gc_work(struct work_struct *work)
3208 {
3209         struct net_bridge *br = container_of(work, struct net_bridge,
3210                                              mcast_gc_work);
3211         HLIST_HEAD(deleted_head);
3212
3213         spin_lock_bh(&br->multicast_lock);
3214         hlist_move_list(&br->mcast_gc_list, &deleted_head);
3215         spin_unlock_bh(&br->multicast_lock);
3216
3217         br_multicast_gc(&deleted_head);
3218 }
3219
3220 void br_multicast_init(struct net_bridge *br)
3221 {
3222         br->hash_max = BR_MULTICAST_DEFAULT_HASH_MAX;
3223
3224         br->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3225         br->multicast_last_member_count = 2;
3226         br->multicast_startup_query_count = 2;
3227
3228         br->multicast_last_member_interval = HZ;
3229         br->multicast_query_response_interval = 10 * HZ;
3230         br->multicast_startup_query_interval = 125 * HZ / 4;
3231         br->multicast_query_interval = 125 * HZ;
3232         br->multicast_querier_interval = 255 * HZ;
3233         br->multicast_membership_interval = 260 * HZ;
3234
3235         br->ip4_other_query.delay_time = 0;
3236         br->ip4_querier.port = NULL;
3237         br->multicast_igmp_version = 2;
3238 #if IS_ENABLED(CONFIG_IPV6)
3239         br->multicast_mld_version = 1;
3240         br->ip6_other_query.delay_time = 0;
3241         br->ip6_querier.port = NULL;
3242 #endif
3243         br_opt_toggle(br, BROPT_MULTICAST_ENABLED, true);
3244         br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
3245
3246         spin_lock_init(&br->multicast_lock);
3247         timer_setup(&br->multicast_router_timer,
3248                     br_multicast_local_router_expired, 0);
3249         timer_setup(&br->ip4_other_query.timer,
3250                     br_ip4_multicast_querier_expired, 0);
3251         timer_setup(&br->ip4_own_query.timer,
3252                     br_ip4_multicast_query_expired, 0);
3253 #if IS_ENABLED(CONFIG_IPV6)
3254         timer_setup(&br->ip6_other_query.timer,
3255                     br_ip6_multicast_querier_expired, 0);
3256         timer_setup(&br->ip6_own_query.timer,
3257                     br_ip6_multicast_query_expired, 0);
3258 #endif
3259         INIT_HLIST_HEAD(&br->mdb_list);
3260         INIT_HLIST_HEAD(&br->mcast_gc_list);
3261         INIT_WORK(&br->mcast_gc_work, br_multicast_gc_work);
3262 }
3263
3264 static void br_ip4_multicast_join_snoopers(struct net_bridge *br)
3265 {
3266         struct in_device *in_dev = in_dev_get(br->dev);
3267
3268         if (!in_dev)
3269                 return;
3270
3271         __ip_mc_inc_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
3272         in_dev_put(in_dev);
3273 }
3274
3275 #if IS_ENABLED(CONFIG_IPV6)
3276 static void br_ip6_multicast_join_snoopers(struct net_bridge *br)
3277 {
3278         struct in6_addr addr;
3279
3280         ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
3281         ipv6_dev_mc_inc(br->dev, &addr);
3282 }
3283 #else
3284 static inline void br_ip6_multicast_join_snoopers(struct net_bridge *br)
3285 {
3286 }
3287 #endif
3288
3289 void br_multicast_join_snoopers(struct net_bridge *br)
3290 {
3291         br_ip4_multicast_join_snoopers(br);
3292         br_ip6_multicast_join_snoopers(br);
3293 }
3294
3295 static void br_ip4_multicast_leave_snoopers(struct net_bridge *br)
3296 {
3297         struct in_device *in_dev = in_dev_get(br->dev);
3298
3299         if (WARN_ON(!in_dev))
3300                 return;
3301
3302         __ip_mc_dec_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
3303         in_dev_put(in_dev);
3304 }
3305
3306 #if IS_ENABLED(CONFIG_IPV6)
3307 static void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
3308 {
3309         struct in6_addr addr;
3310
3311         ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
3312         ipv6_dev_mc_dec(br->dev, &addr);
3313 }
3314 #else
3315 static inline void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
3316 {
3317 }
3318 #endif
3319
3320 void br_multicast_leave_snoopers(struct net_bridge *br)
3321 {
3322         br_ip4_multicast_leave_snoopers(br);
3323         br_ip6_multicast_leave_snoopers(br);
3324 }
3325
3326 static void __br_multicast_open(struct net_bridge *br,
3327                                 struct bridge_mcast_own_query *query)
3328 {
3329         query->startup_sent = 0;
3330
3331         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
3332                 return;
3333
3334         mod_timer(&query->timer, jiffies);
3335 }
3336
3337 void br_multicast_open(struct net_bridge *br)
3338 {
3339         __br_multicast_open(br, &br->ip4_own_query);
3340 #if IS_ENABLED(CONFIG_IPV6)
3341         __br_multicast_open(br, &br->ip6_own_query);
3342 #endif
3343 }
3344
3345 void br_multicast_stop(struct net_bridge *br)
3346 {
3347         del_timer_sync(&br->multicast_router_timer);
3348         del_timer_sync(&br->ip4_other_query.timer);
3349         del_timer_sync(&br->ip4_own_query.timer);
3350 #if IS_ENABLED(CONFIG_IPV6)
3351         del_timer_sync(&br->ip6_other_query.timer);
3352         del_timer_sync(&br->ip6_own_query.timer);
3353 #endif
3354 }
3355
3356 void br_multicast_dev_del(struct net_bridge *br)
3357 {
3358         struct net_bridge_mdb_entry *mp;
3359         HLIST_HEAD(deleted_head);
3360         struct hlist_node *tmp;
3361
3362         spin_lock_bh(&br->multicast_lock);
3363         hlist_for_each_entry_safe(mp, tmp, &br->mdb_list, mdb_node)
3364                 br_multicast_del_mdb_entry(mp);
3365         hlist_move_list(&br->mcast_gc_list, &deleted_head);
3366         spin_unlock_bh(&br->multicast_lock);
3367
3368         br_multicast_gc(&deleted_head);
3369         cancel_work_sync(&br->mcast_gc_work);
3370
3371         rcu_barrier();
3372 }
3373
3374 int br_multicast_set_router(struct net_bridge *br, unsigned long val)
3375 {
3376         int err = -EINVAL;
3377
3378         spin_lock_bh(&br->multicast_lock);
3379
3380         switch (val) {
3381         case MDB_RTR_TYPE_DISABLED:
3382         case MDB_RTR_TYPE_PERM:
3383                 br_mc_router_state_change(br, val == MDB_RTR_TYPE_PERM);
3384                 del_timer(&br->multicast_router_timer);
3385                 br->multicast_router = val;
3386                 err = 0;
3387                 break;
3388         case MDB_RTR_TYPE_TEMP_QUERY:
3389                 if (br->multicast_router != MDB_RTR_TYPE_TEMP_QUERY)
3390                         br_mc_router_state_change(br, false);
3391                 br->multicast_router = val;
3392                 err = 0;
3393                 break;
3394         }
3395
3396         spin_unlock_bh(&br->multicast_lock);
3397
3398         return err;
3399 }
3400
3401 static void __del_port_router(struct net_bridge_port *p)
3402 {
3403         if (hlist_unhashed(&p->rlist))
3404                 return;
3405         hlist_del_init_rcu(&p->rlist);
3406         br_rtr_notify(p->br->dev, p, RTM_DELMDB);
3407         br_port_mc_router_state_change(p, false);
3408
3409         /* don't allow timer refresh */
3410         if (p->multicast_router == MDB_RTR_TYPE_TEMP)
3411                 p->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3412 }
3413
3414 int br_multicast_set_port_router(struct net_bridge_port *p, unsigned long val)
3415 {
3416         struct net_bridge *br = p->br;
3417         unsigned long now = jiffies;
3418         int err = -EINVAL;
3419
3420         spin_lock(&br->multicast_lock);
3421         if (p->multicast_router == val) {
3422                 /* Refresh the temp router port timer */
3423                 if (p->multicast_router == MDB_RTR_TYPE_TEMP)
3424                         mod_timer(&p->multicast_router_timer,
3425                                   now + br->multicast_querier_interval);
3426                 err = 0;
3427                 goto unlock;
3428         }
3429         switch (val) {
3430         case MDB_RTR_TYPE_DISABLED:
3431                 p->multicast_router = MDB_RTR_TYPE_DISABLED;
3432                 __del_port_router(p);
3433                 del_timer(&p->multicast_router_timer);
3434                 break;
3435         case MDB_RTR_TYPE_TEMP_QUERY:
3436                 p->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3437                 __del_port_router(p);
3438                 break;
3439         case MDB_RTR_TYPE_PERM:
3440                 p->multicast_router = MDB_RTR_TYPE_PERM;
3441                 del_timer(&p->multicast_router_timer);
3442                 br_multicast_add_router(br, p);
3443                 break;
3444         case MDB_RTR_TYPE_TEMP:
3445                 p->multicast_router = MDB_RTR_TYPE_TEMP;
3446                 br_multicast_mark_router(br, p);
3447                 break;
3448         default:
3449                 goto unlock;
3450         }
3451         err = 0;
3452 unlock:
3453         spin_unlock(&br->multicast_lock);
3454
3455         return err;
3456 }
3457
3458 static void br_multicast_start_querier(struct net_bridge *br,
3459                                        struct bridge_mcast_own_query *query)
3460 {
3461         struct net_bridge_port *port;
3462
3463         __br_multicast_open(br, query);
3464
3465         rcu_read_lock();
3466         list_for_each_entry_rcu(port, &br->port_list, list) {
3467                 if (port->state == BR_STATE_DISABLED ||
3468                     port->state == BR_STATE_BLOCKING)
3469                         continue;
3470
3471                 if (query == &br->ip4_own_query)
3472                         br_multicast_enable(&port->ip4_own_query);
3473 #if IS_ENABLED(CONFIG_IPV6)
3474                 else
3475                         br_multicast_enable(&port->ip6_own_query);
3476 #endif
3477         }
3478         rcu_read_unlock();
3479 }
3480
3481 int br_multicast_toggle(struct net_bridge *br, unsigned long val)
3482 {
3483         struct net_bridge_port *port;
3484         bool change_snoopers = false;
3485
3486         spin_lock_bh(&br->multicast_lock);
3487         if (!!br_opt_get(br, BROPT_MULTICAST_ENABLED) == !!val)
3488                 goto unlock;
3489
3490         br_mc_disabled_update(br->dev, val);
3491         br_opt_toggle(br, BROPT_MULTICAST_ENABLED, !!val);
3492         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED)) {
3493                 change_snoopers = true;
3494                 goto unlock;
3495         }
3496
3497         if (!netif_running(br->dev))
3498                 goto unlock;
3499
3500         br_multicast_open(br);
3501         list_for_each_entry(port, &br->port_list, list)
3502                 __br_multicast_enable_port(port);
3503
3504         change_snoopers = true;
3505
3506 unlock:
3507         spin_unlock_bh(&br->multicast_lock);
3508
3509         /* br_multicast_join_snoopers has the potential to cause
3510          * an MLD Report/Leave to be delivered to br_multicast_rcv,
3511          * which would in turn call br_multicast_add_group, which would
3512          * attempt to acquire multicast_lock. This function should be
3513          * called after the lock has been released to avoid deadlocks on
3514          * multicast_lock.
3515          *
3516          * br_multicast_leave_snoopers does not have the problem since
3517          * br_multicast_rcv first checks BROPT_MULTICAST_ENABLED, and
3518          * returns without calling br_multicast_ipv4/6_rcv if it's not
3519          * enabled. Moved both functions out just for symmetry.
3520          */
3521         if (change_snoopers) {
3522                 if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
3523                         br_multicast_join_snoopers(br);
3524                 else
3525                         br_multicast_leave_snoopers(br);
3526         }
3527
3528         return 0;
3529 }
3530
3531 bool br_multicast_enabled(const struct net_device *dev)
3532 {
3533         struct net_bridge *br = netdev_priv(dev);
3534
3535         return !!br_opt_get(br, BROPT_MULTICAST_ENABLED);
3536 }
3537 EXPORT_SYMBOL_GPL(br_multicast_enabled);
3538
3539 bool br_multicast_router(const struct net_device *dev)
3540 {
3541         struct net_bridge *br = netdev_priv(dev);
3542         bool is_router;
3543
3544         spin_lock_bh(&br->multicast_lock);
3545         is_router = br_multicast_is_router(br);
3546         spin_unlock_bh(&br->multicast_lock);
3547         return is_router;
3548 }
3549 EXPORT_SYMBOL_GPL(br_multicast_router);
3550
3551 int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
3552 {
3553         unsigned long max_delay;
3554
3555         val = !!val;
3556
3557         spin_lock_bh(&br->multicast_lock);
3558         if (br_opt_get(br, BROPT_MULTICAST_QUERIER) == val)
3559                 goto unlock;
3560
3561         br_opt_toggle(br, BROPT_MULTICAST_QUERIER, !!val);
3562         if (!val)
3563                 goto unlock;
3564
3565         max_delay = br->multicast_query_response_interval;
3566
3567         if (!timer_pending(&br->ip4_other_query.timer))
3568                 br->ip4_other_query.delay_time = jiffies + max_delay;
3569
3570         br_multicast_start_querier(br, &br->ip4_own_query);
3571
3572 #if IS_ENABLED(CONFIG_IPV6)
3573         if (!timer_pending(&br->ip6_other_query.timer))
3574                 br->ip6_other_query.delay_time = jiffies + max_delay;
3575
3576         br_multicast_start_querier(br, &br->ip6_own_query);
3577 #endif
3578
3579 unlock:
3580         spin_unlock_bh(&br->multicast_lock);
3581
3582         return 0;
3583 }
3584
3585 int br_multicast_set_igmp_version(struct net_bridge *br, unsigned long val)
3586 {
3587         /* Currently we support only version 2 and 3 */
3588         switch (val) {
3589         case 2:
3590         case 3:
3591                 break;
3592         default:
3593                 return -EINVAL;
3594         }
3595
3596         spin_lock_bh(&br->multicast_lock);
3597         br->multicast_igmp_version = val;
3598         spin_unlock_bh(&br->multicast_lock);
3599
3600         return 0;
3601 }
3602
3603 #if IS_ENABLED(CONFIG_IPV6)
3604 int br_multicast_set_mld_version(struct net_bridge *br, unsigned long val)
3605 {
3606         /* Currently we support version 1 and 2 */
3607         switch (val) {
3608         case 1:
3609         case 2:
3610                 break;
3611         default:
3612                 return -EINVAL;
3613         }
3614
3615         spin_lock_bh(&br->multicast_lock);
3616         br->multicast_mld_version = val;
3617         spin_unlock_bh(&br->multicast_lock);
3618
3619         return 0;
3620 }
3621 #endif
3622
3623 /**
3624  * br_multicast_list_adjacent - Returns snooped multicast addresses
3625  * @dev:        The bridge port adjacent to which to retrieve addresses
3626  * @br_ip_list: The list to store found, snooped multicast IP addresses in
3627  *
3628  * Creates a list of IP addresses (struct br_ip_list) sensed by the multicast
3629  * snooping feature on all bridge ports of dev's bridge device, excluding
3630  * the addresses from dev itself.
3631  *
3632  * Returns the number of items added to br_ip_list.
3633  *
3634  * Notes:
3635  * - br_ip_list needs to be initialized by caller
3636  * - br_ip_list might contain duplicates in the end
3637  *   (needs to be taken care of by caller)
3638  * - br_ip_list needs to be freed by caller
3639  */
3640 int br_multicast_list_adjacent(struct net_device *dev,
3641                                struct list_head *br_ip_list)
3642 {
3643         struct net_bridge *br;
3644         struct net_bridge_port *port;
3645         struct net_bridge_port_group *group;
3646         struct br_ip_list *entry;
3647         int count = 0;
3648
3649         rcu_read_lock();
3650         if (!br_ip_list || !netif_is_bridge_port(dev))
3651                 goto unlock;
3652
3653         port = br_port_get_rcu(dev);
3654         if (!port || !port->br)
3655                 goto unlock;
3656
3657         br = port->br;
3658
3659         list_for_each_entry_rcu(port, &br->port_list, list) {
3660                 if (!port->dev || port->dev == dev)
3661                         continue;
3662
3663                 hlist_for_each_entry_rcu(group, &port->mglist, mglist) {
3664                         entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
3665                         if (!entry)
3666                                 goto unlock;
3667
3668                         entry->addr = group->key.addr;
3669                         list_add(&entry->list, br_ip_list);
3670                         count++;
3671                 }
3672         }
3673
3674 unlock:
3675         rcu_read_unlock();
3676         return count;
3677 }
3678 EXPORT_SYMBOL_GPL(br_multicast_list_adjacent);
3679
3680 /**
3681  * br_multicast_has_querier_anywhere - Checks for a querier on a bridge
3682  * @dev: The bridge port providing the bridge on which to check for a querier
3683  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
3684  *
3685  * Checks whether the given interface has a bridge on top and if so returns
3686  * true if a valid querier exists anywhere on the bridged link layer.
3687  * Otherwise returns false.
3688  */
3689 bool br_multicast_has_querier_anywhere(struct net_device *dev, int proto)
3690 {
3691         struct net_bridge *br;
3692         struct net_bridge_port *port;
3693         struct ethhdr eth;
3694         bool ret = false;
3695
3696         rcu_read_lock();
3697         if (!netif_is_bridge_port(dev))
3698                 goto unlock;
3699
3700         port = br_port_get_rcu(dev);
3701         if (!port || !port->br)
3702                 goto unlock;
3703
3704         br = port->br;
3705
3706         memset(&eth, 0, sizeof(eth));
3707         eth.h_proto = htons(proto);
3708
3709         ret = br_multicast_querier_exists(br, &eth);
3710
3711 unlock:
3712         rcu_read_unlock();
3713         return ret;
3714 }
3715 EXPORT_SYMBOL_GPL(br_multicast_has_querier_anywhere);
3716
3717 /**
3718  * br_multicast_has_querier_adjacent - Checks for a querier behind a bridge port
3719  * @dev: The bridge port adjacent to which to check for a querier
3720  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
3721  *
3722  * Checks whether the given interface has a bridge on top and if so returns
3723  * true if a selected querier is behind one of the other ports of this
3724  * bridge. Otherwise returns false.
3725  */
3726 bool br_multicast_has_querier_adjacent(struct net_device *dev, int proto)
3727 {
3728         struct net_bridge *br;
3729         struct net_bridge_port *port;
3730         bool ret = false;
3731
3732         rcu_read_lock();
3733         if (!netif_is_bridge_port(dev))
3734                 goto unlock;
3735
3736         port = br_port_get_rcu(dev);
3737         if (!port || !port->br)
3738                 goto unlock;
3739
3740         br = port->br;
3741
3742         switch (proto) {
3743         case ETH_P_IP:
3744                 if (!timer_pending(&br->ip4_other_query.timer) ||
3745                     rcu_dereference(br->ip4_querier.port) == port)
3746                         goto unlock;
3747                 break;
3748 #if IS_ENABLED(CONFIG_IPV6)
3749         case ETH_P_IPV6:
3750                 if (!timer_pending(&br->ip6_other_query.timer) ||
3751                     rcu_dereference(br->ip6_querier.port) == port)
3752                         goto unlock;
3753                 break;
3754 #endif
3755         default:
3756                 goto unlock;
3757         }
3758
3759         ret = true;
3760 unlock:
3761         rcu_read_unlock();
3762         return ret;
3763 }
3764 EXPORT_SYMBOL_GPL(br_multicast_has_querier_adjacent);
3765
3766 static void br_mcast_stats_add(struct bridge_mcast_stats __percpu *stats,
3767                                const struct sk_buff *skb, u8 type, u8 dir)
3768 {
3769         struct bridge_mcast_stats *pstats = this_cpu_ptr(stats);
3770         __be16 proto = skb->protocol;
3771         unsigned int t_len;
3772
3773         u64_stats_update_begin(&pstats->syncp);
3774         switch (proto) {
3775         case htons(ETH_P_IP):
3776                 t_len = ntohs(ip_hdr(skb)->tot_len) - ip_hdrlen(skb);
3777                 switch (type) {
3778                 case IGMP_HOST_MEMBERSHIP_REPORT:
3779                         pstats->mstats.igmp_v1reports[dir]++;
3780                         break;
3781                 case IGMPV2_HOST_MEMBERSHIP_REPORT:
3782                         pstats->mstats.igmp_v2reports[dir]++;
3783                         break;
3784                 case IGMPV3_HOST_MEMBERSHIP_REPORT:
3785                         pstats->mstats.igmp_v3reports[dir]++;
3786                         break;
3787                 case IGMP_HOST_MEMBERSHIP_QUERY:
3788                         if (t_len != sizeof(struct igmphdr)) {
3789                                 pstats->mstats.igmp_v3queries[dir]++;
3790                         } else {
3791                                 unsigned int offset = skb_transport_offset(skb);
3792                                 struct igmphdr *ih, _ihdr;
3793
3794                                 ih = skb_header_pointer(skb, offset,
3795                                                         sizeof(_ihdr), &_ihdr);
3796                                 if (!ih)
3797                                         break;
3798                                 if (!ih->code)
3799                                         pstats->mstats.igmp_v1queries[dir]++;
3800                                 else
3801                                         pstats->mstats.igmp_v2queries[dir]++;
3802                         }
3803                         break;
3804                 case IGMP_HOST_LEAVE_MESSAGE:
3805                         pstats->mstats.igmp_leaves[dir]++;
3806                         break;
3807                 }
3808                 break;
3809 #if IS_ENABLED(CONFIG_IPV6)
3810         case htons(ETH_P_IPV6):
3811                 t_len = ntohs(ipv6_hdr(skb)->payload_len) +
3812                         sizeof(struct ipv6hdr);
3813                 t_len -= skb_network_header_len(skb);
3814                 switch (type) {
3815                 case ICMPV6_MGM_REPORT:
3816                         pstats->mstats.mld_v1reports[dir]++;
3817                         break;
3818                 case ICMPV6_MLD2_REPORT:
3819                         pstats->mstats.mld_v2reports[dir]++;
3820                         break;
3821                 case ICMPV6_MGM_QUERY:
3822                         if (t_len != sizeof(struct mld_msg))
3823                                 pstats->mstats.mld_v2queries[dir]++;
3824                         else
3825                                 pstats->mstats.mld_v1queries[dir]++;
3826                         break;
3827                 case ICMPV6_MGM_REDUCTION:
3828                         pstats->mstats.mld_leaves[dir]++;
3829                         break;
3830                 }
3831                 break;
3832 #endif /* CONFIG_IPV6 */
3833         }
3834         u64_stats_update_end(&pstats->syncp);
3835 }
3836
3837 void br_multicast_count(struct net_bridge *br, const struct net_bridge_port *p,
3838                         const struct sk_buff *skb, u8 type, u8 dir)
3839 {
3840         struct bridge_mcast_stats __percpu *stats;
3841
3842         /* if multicast_disabled is true then igmp type can't be set */
3843         if (!type || !br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
3844                 return;
3845
3846         if (p)
3847                 stats = p->mcast_stats;
3848         else
3849                 stats = br->mcast_stats;
3850         if (WARN_ON(!stats))
3851                 return;
3852
3853         br_mcast_stats_add(stats, skb, type, dir);
3854 }
3855
3856 int br_multicast_init_stats(struct net_bridge *br)
3857 {
3858         br->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
3859         if (!br->mcast_stats)
3860                 return -ENOMEM;
3861
3862         return 0;
3863 }
3864
3865 void br_multicast_uninit_stats(struct net_bridge *br)
3866 {
3867         free_percpu(br->mcast_stats);
3868 }
3869
3870 /* noinline for https://bugs.llvm.org/show_bug.cgi?id=45802#c9 */
3871 static noinline_for_stack void mcast_stats_add_dir(u64 *dst, u64 *src)
3872 {
3873         dst[BR_MCAST_DIR_RX] += src[BR_MCAST_DIR_RX];
3874         dst[BR_MCAST_DIR_TX] += src[BR_MCAST_DIR_TX];
3875 }
3876
3877 void br_multicast_get_stats(const struct net_bridge *br,
3878                             const struct net_bridge_port *p,
3879                             struct br_mcast_stats *dest)
3880 {
3881         struct bridge_mcast_stats __percpu *stats;
3882         struct br_mcast_stats tdst;
3883         int i;
3884
3885         memset(dest, 0, sizeof(*dest));
3886         if (p)
3887                 stats = p->mcast_stats;
3888         else
3889                 stats = br->mcast_stats;
3890         if (WARN_ON(!stats))
3891                 return;
3892
3893         memset(&tdst, 0, sizeof(tdst));
3894         for_each_possible_cpu(i) {
3895                 struct bridge_mcast_stats *cpu_stats = per_cpu_ptr(stats, i);
3896                 struct br_mcast_stats temp;
3897                 unsigned int start;
3898
3899                 do {
3900                         start = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
3901                         memcpy(&temp, &cpu_stats->mstats, sizeof(temp));
3902                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, start));
3903
3904                 mcast_stats_add_dir(tdst.igmp_v1queries, temp.igmp_v1queries);
3905                 mcast_stats_add_dir(tdst.igmp_v2queries, temp.igmp_v2queries);
3906                 mcast_stats_add_dir(tdst.igmp_v3queries, temp.igmp_v3queries);
3907                 mcast_stats_add_dir(tdst.igmp_leaves, temp.igmp_leaves);
3908                 mcast_stats_add_dir(tdst.igmp_v1reports, temp.igmp_v1reports);
3909                 mcast_stats_add_dir(tdst.igmp_v2reports, temp.igmp_v2reports);
3910                 mcast_stats_add_dir(tdst.igmp_v3reports, temp.igmp_v3reports);
3911                 tdst.igmp_parse_errors += temp.igmp_parse_errors;
3912
3913                 mcast_stats_add_dir(tdst.mld_v1queries, temp.mld_v1queries);
3914                 mcast_stats_add_dir(tdst.mld_v2queries, temp.mld_v2queries);
3915                 mcast_stats_add_dir(tdst.mld_leaves, temp.mld_leaves);
3916                 mcast_stats_add_dir(tdst.mld_v1reports, temp.mld_v1reports);
3917                 mcast_stats_add_dir(tdst.mld_v2reports, temp.mld_v2reports);
3918                 tdst.mld_parse_errors += temp.mld_parse_errors;
3919         }
3920         memcpy(dest, &tdst, sizeof(*dest));
3921 }
3922
3923 int br_mdb_hash_init(struct net_bridge *br)
3924 {
3925         int err;
3926
3927         err = rhashtable_init(&br->sg_port_tbl, &br_sg_port_rht_params);
3928         if (err)
3929                 return err;
3930
3931         err = rhashtable_init(&br->mdb_hash_tbl, &br_mdb_rht_params);
3932         if (err) {
3933                 rhashtable_destroy(&br->sg_port_tbl);
3934                 return err;
3935         }
3936
3937         return 0;
3938 }
3939
3940 void br_mdb_hash_fini(struct net_bridge *br)
3941 {
3942         rhashtable_destroy(&br->sg_port_tbl);
3943         rhashtable_destroy(&br->mdb_hash_tbl);
3944 }