net/bridge/br_multicast.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Bridge multicast support.
   4  *
   5  * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au>
   6  */
   7
   8 #include <linux/err.h>
   9 #include <linux/export.h>
  10 #include <linux/if_ether.h>
  11 #include <linux/igmp.h>
  12 #include <linux/in.h>
  13 #include <linux/jhash.h>
  14 #include <linux/kernel.h>
  15 #include <linux/log2.h>
  16 #include <linux/netdevice.h>
  17 #include <linux/netfilter_bridge.h>
  18 #include <linux/random.h>
  19 #include <linux/rculist.h>
  20 #include <linux/skbuff.h>
  21 #include <linux/slab.h>
  22 #include <linux/timer.h>
  23 #include <linux/inetdevice.h>
  24 #include <linux/mroute.h>
  25 #include <net/ip.h>
  26 #include <net/switchdev.h>
  27 #if IS_ENABLED(CONFIG_IPV6)
  28 #include <linux/icmpv6.h>
  29 #include <net/ipv6.h>
  30 #include <net/mld.h>
  31 #include <net/ip6_checksum.h>
  32 #include <net/addrconf.h>
  33 #endif
  34
  35 #include "br_private.h"
  36 #include "br_private_mcast_eht.h"
  37
  38 static const struct rhashtable_params br_mdb_rht_params = {
  39         .head_offset = offsetof(struct net_bridge_mdb_entry, rhnode),
  40         .key_offset = offsetof(struct net_bridge_mdb_entry, addr),
  41         .key_len = sizeof(struct br_ip),
  42         .automatic_shrinking = true,
  43 };
  44
  45 static const struct rhashtable_params br_sg_port_rht_params = {
  46         .head_offset = offsetof(struct net_bridge_port_group, rhnode),
  47         .key_offset = offsetof(struct net_bridge_port_group, key),
  48         .key_len = sizeof(struct net_bridge_port_group_sg_key),
  49         .automatic_shrinking = true,
  50 };
  51
  52 static void br_multicast_start_querier(struct net_bridge *br,
  53                                        struct bridge_mcast_own_query *query);
  54 static void br_multicast_add_router(struct net_bridge *br,
  55                                     struct net_bridge_port *port);
  56 static void br_ip4_multicast_leave_group(struct net_bridge *br,
  57                                          struct net_bridge_port *port,
  58                                          __be32 group,
  59                                          __u16 vid,
  60                                          const unsigned char *src);
  61 static void br_multicast_port_group_rexmit(struct timer_list *t);
  62
  63 static void __del_port_router(struct net_bridge_port *p);
  64 #if IS_ENABLED(CONFIG_IPV6)
  65 static void br_ip6_multicast_leave_group(struct net_bridge *br,
  66                                          struct net_bridge_port *port,
  67                                          const struct in6_addr *group,
  68                                          __u16 vid, const unsigned char *src);
  69 #endif
  70 static struct net_bridge_port_group *
  71 __br_multicast_add_group(struct net_bridge *br,
  72                          struct net_bridge_port *port,
  73                          struct br_ip *group,
  74                          const unsigned char *src,
  75                          u8 filter_mode,
  76                          bool igmpv2_mldv1,
  77                          bool blocked);
  78 static void br_multicast_find_del_pg(struct net_bridge *br,
  79                                      struct net_bridge_port_group *pg);
  80
  81 static struct net_bridge_port_group *
  82 br_sg_port_find(struct net_bridge *br,
  83                 struct net_bridge_port_group_sg_key *sg_p)
  84 {
  85         lockdep_assert_held_once(&br->multicast_lock);
  86
  87         return rhashtable_lookup_fast(&br->sg_port_tbl, sg_p,
  88                                       br_sg_port_rht_params);
  89 }
  90
  91 static struct net_bridge_mdb_entry *br_mdb_ip_get_rcu(struct net_bridge *br,
  92                                                       struct br_ip *dst)
  93 {
  94         return rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
  95 }
  96
  97 struct net_bridge_mdb_entry *br_mdb_ip_get(struct net_bridge *br,
  98                                            struct br_ip *dst)
  99 {
 100         struct net_bridge_mdb_entry *ent;
 101
 102         lockdep_assert_held_once(&br->multicast_lock);
 103
 104         rcu_read_lock();
 105         ent = rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
 106         rcu_read_unlock();
 107
 108         return ent;
 109 }
 110
 111 static struct net_bridge_mdb_entry *br_mdb_ip4_get(struct net_bridge *br,
 112                                                    __be32 dst, __u16 vid)
 113 {
 114         struct br_ip br_dst;
 115
 116         memset(&br_dst, 0, sizeof(br_dst));
 117         br_dst.dst.ip4 = dst;
 118         br_dst.proto = htons(ETH_P_IP);
 119         br_dst.vid = vid;
 120
 121         return br_mdb_ip_get(br, &br_dst);
 122 }
 123
 124 #if IS_ENABLED(CONFIG_IPV6)
 125 static struct net_bridge_mdb_entry *br_mdb_ip6_get(struct net_bridge *br,
 126                                                    const struct in6_addr *dst,
 127                                                    __u16 vid)
 128 {
 129         struct br_ip br_dst;
 130
 131         memset(&br_dst, 0, sizeof(br_dst));
 132         br_dst.dst.ip6 = *dst;
 133         br_dst.proto = htons(ETH_P_IPV6);
 134         br_dst.vid = vid;
 135
 136         return br_mdb_ip_get(br, &br_dst);
 137 }
 138 #endif
 139
 140 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
 141                                         struct sk_buff *skb, u16 vid)
 142 {
 143         struct br_ip ip;
 144
 145         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
 146                 return NULL;
 147
 148         if (BR_INPUT_SKB_CB(skb)->igmp)
 149                 return NULL;
 150
 151         memset(&ip, 0, sizeof(ip));
 152         ip.proto = skb->protocol;
 153         ip.vid = vid;
 154
 155         switch (skb->protocol) {
 156         case htons(ETH_P_IP):
 157                 ip.dst.ip4 = ip_hdr(skb)->daddr;
 158                 if (br->multicast_igmp_version == 3) {
 159                         struct net_bridge_mdb_entry *mdb;
 160
 161                         ip.src.ip4 = ip_hdr(skb)->saddr;
 162                         mdb = br_mdb_ip_get_rcu(br, &ip);
 163                         if (mdb)
 164                                 return mdb;
 165                         ip.src.ip4 = 0;
 166                 }
 167                 break;
 168 #if IS_ENABLED(CONFIG_IPV6)
 169         case htons(ETH_P_IPV6):
 170                 ip.dst.ip6 = ipv6_hdr(skb)->daddr;
 171                 if (br->multicast_mld_version == 2) {
 172                         struct net_bridge_mdb_entry *mdb;
 173
 174                         ip.src.ip6 = ipv6_hdr(skb)->saddr;
 175                         mdb = br_mdb_ip_get_rcu(br, &ip);
 176                         if (mdb)
 177                                 return mdb;
 178                         memset(&ip.src.ip6, 0, sizeof(ip.src.ip6));
 179                 }
 180                 break;
 181 #endif
 182         default:
 183                 ip.proto = 0;
 184                 ether_addr_copy(ip.dst.mac_addr, eth_hdr(skb)->h_dest);
 185         }
 186
 187         return br_mdb_ip_get_rcu(br, &ip);
 188 }
 189
 190 static bool br_port_group_equal(struct net_bridge_port_group *p,
 191                                 struct net_bridge_port *port,
 192                                 const unsigned char *src)
 193 {
 194         if (p->key.port != port)
 195                 return false;
 196
 197         if (!(port->flags & BR_MULTICAST_TO_UNICAST))
 198                 return true;
 199
 200         return ether_addr_equal(src, p->eth_addr);
 201 }
 202
 203 static void __fwd_add_star_excl(struct net_bridge_port_group *pg,
 204                                 struct br_ip *sg_ip)
 205 {
 206         struct net_bridge_port_group_sg_key sg_key;
 207         struct net_bridge *br = pg->key.port->br;
 208         struct net_bridge_port_group *src_pg;
 209
 210         memset(&sg_key, 0, sizeof(sg_key));
 211         sg_key.port = pg->key.port;
 212         sg_key.addr = *sg_ip;
 213         if (br_sg_port_find(br, &sg_key))
 214                 return;
 215
 216         src_pg = __br_multicast_add_group(br, pg->key.port, sg_ip, pg->eth_addr,
 217                                           MCAST_INCLUDE, false, false);
 218         if (IS_ERR_OR_NULL(src_pg) ||
 219             src_pg->rt_protocol != RTPROT_KERNEL)
 220                 return;
 221
 222         src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
 223 }
 224
 225 static void __fwd_del_star_excl(struct net_bridge_port_group *pg,
 226                                 struct br_ip *sg_ip)
 227 {
 228         struct net_bridge_port_group_sg_key sg_key;
 229         struct net_bridge *br = pg->key.port->br;
 230         struct net_bridge_port_group *src_pg;
 231
 232         memset(&sg_key, 0, sizeof(sg_key));
 233         sg_key.port = pg->key.port;
 234         sg_key.addr = *sg_ip;
 235         src_pg = br_sg_port_find(br, &sg_key);
 236         if (!src_pg || !(src_pg->flags & MDB_PG_FLAGS_STAR_EXCL) ||
 237             src_pg->rt_protocol != RTPROT_KERNEL)
 238                 return;
 239
 240         br_multicast_find_del_pg(br, src_pg);
 241 }
 242
 243 /* When a port group transitions to (or is added as) EXCLUDE we need to add it
 244  * to all other ports' S,G entries which are not blocked by the current group
 245  * for proper replication, the assumption is that any S,G blocked entries
 246  * are already added so the S,G,port lookup should skip them.
 247  * When a port group transitions from EXCLUDE -> INCLUDE mode or is being
 248  * deleted we need to remove it from all ports' S,G entries where it was
 249  * automatically installed before (i.e. where it's MDB_PG_FLAGS_STAR_EXCL).
 250  */
 251 void br_multicast_star_g_handle_mode(struct net_bridge_port_group *pg,
 252                                      u8 filter_mode)
 253 {
 254         struct net_bridge *br = pg->key.port->br;
 255         struct net_bridge_port_group *pg_lst;
 256         struct net_bridge_mdb_entry *mp;
 257         struct br_ip sg_ip;
 258
 259         if (WARN_ON(!br_multicast_is_star_g(&pg->key.addr)))
 260                 return;
 261
 262         mp = br_mdb_ip_get(br, &pg->key.addr);
 263         if (!mp)
 264                 return;
 265
 266         memset(&sg_ip, 0, sizeof(sg_ip));
 267         sg_ip = pg->key.addr;
 268         for (pg_lst = mlock_dereference(mp->ports, br);
 269              pg_lst;
 270              pg_lst = mlock_dereference(pg_lst->next, br)) {
 271                 struct net_bridge_group_src *src_ent;
 272
 273                 if (pg_lst == pg)
 274                         continue;
 275                 hlist_for_each_entry(src_ent, &pg_lst->src_list, node) {
 276                         if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
 277                                 continue;
 278                         sg_ip.src = src_ent->addr.src;
 279                         switch (filter_mode) {
 280                         case MCAST_INCLUDE:
 281                                 __fwd_del_star_excl(pg, &sg_ip);
 282                                 break;
 283                         case MCAST_EXCLUDE:
 284                                 __fwd_add_star_excl(pg, &sg_ip);
 285                                 break;
 286                         }
 287                 }
 288         }
 289 }
 290
 291 /* called when adding a new S,G with host_joined == false by default */
 292 static void br_multicast_sg_host_state(struct net_bridge_mdb_entry *star_mp,
 293                                        struct net_bridge_port_group *sg)
 294 {
 295         struct net_bridge_mdb_entry *sg_mp;
 296
 297         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 298                 return;
 299         if (!star_mp->host_joined)
 300                 return;
 301
 302         sg_mp = br_mdb_ip_get(star_mp->br, &sg->key.addr);
 303         if (!sg_mp)
 304                 return;
 305         sg_mp->host_joined = true;
 306 }
 307
 308 /* set the host_joined state of all of *,G's S,G entries */
 309 static void br_multicast_star_g_host_state(struct net_bridge_mdb_entry *star_mp)
 310 {
 311         struct net_bridge *br = star_mp->br;
 312         struct net_bridge_mdb_entry *sg_mp;
 313         struct net_bridge_port_group *pg;
 314         struct br_ip sg_ip;
 315
 316         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 317                 return;
 318
 319         memset(&sg_ip, 0, sizeof(sg_ip));
 320         sg_ip = star_mp->addr;
 321         for (pg = mlock_dereference(star_mp->ports, br);
 322              pg;
 323              pg = mlock_dereference(pg->next, br)) {
 324                 struct net_bridge_group_src *src_ent;
 325
 326                 hlist_for_each_entry(src_ent, &pg->src_list, node) {
 327                         if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
 328                                 continue;
 329                         sg_ip.src = src_ent->addr.src;
 330                         sg_mp = br_mdb_ip_get(br, &sg_ip);
 331                         if (!sg_mp)
 332                                 continue;
 333                         sg_mp->host_joined = star_mp->host_joined;
 334                 }
 335         }
 336 }
 337
 338 static void br_multicast_sg_del_exclude_ports(struct net_bridge_mdb_entry *sgmp)
 339 {
 340         struct net_bridge_port_group __rcu **pp;
 341         struct net_bridge_port_group *p;
 342
 343         /* *,G exclude ports are only added to S,G entries */
 344         if (WARN_ON(br_multicast_is_star_g(&sgmp->addr)))
 345                 return;
 346
 347         /* we need the STAR_EXCLUDE ports if there are non-STAR_EXCLUDE ports
 348          * we should ignore perm entries since they're managed by user-space
 349          */
 350         for (pp = &sgmp->ports;
 351              (p = mlock_dereference(*pp, sgmp->br)) != NULL;
 352              pp = &p->next)
 353                 if (!(p->flags & (MDB_PG_FLAGS_STAR_EXCL |
 354                                   MDB_PG_FLAGS_PERMANENT)))
 355                         return;
 356
 357         /* currently the host can only have joined the *,G which means
 358          * we treat it as EXCLUDE {}, so for an S,G it's considered a
 359          * STAR_EXCLUDE entry and we can safely leave it
 360          */
 361         sgmp->host_joined = false;
 362
 363         for (pp = &sgmp->ports;
 364              (p = mlock_dereference(*pp, sgmp->br)) != NULL;) {
 365                 if (!(p->flags & MDB_PG_FLAGS_PERMANENT))
 366                         br_multicast_del_pg(sgmp, p, pp);
 367                 else
 368                         pp = &p->next;
 369         }
 370 }
 371
 372 void br_multicast_sg_add_exclude_ports(struct net_bridge_mdb_entry *star_mp,
 373                                        struct net_bridge_port_group *sg)
 374 {
 375         struct net_bridge_port_group_sg_key sg_key;
 376         struct net_bridge *br = star_mp->br;
 377         struct net_bridge_port_group *pg;
 378
 379         if (WARN_ON(br_multicast_is_star_g(&sg->key.addr)))
 380                 return;
 381         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 382                 return;
 383
 384         br_multicast_sg_host_state(star_mp, sg);
 385         memset(&sg_key, 0, sizeof(sg_key));
 386         sg_key.addr = sg->key.addr;
 387         /* we need to add all exclude ports to the S,G */
 388         for (pg = mlock_dereference(star_mp->ports, br);
 389              pg;
 390              pg = mlock_dereference(pg->next, br)) {
 391                 struct net_bridge_port_group *src_pg;
 392
 393                 if (pg == sg || pg->filter_mode == MCAST_INCLUDE)
 394                         continue;
 395
 396                 sg_key.port = pg->key.port;
 397                 if (br_sg_port_find(br, &sg_key))
 398                         continue;
 399
 400                 src_pg = __br_multicast_add_group(br, pg->key.port,
 401                                                   &sg->key.addr,
 402                                                   sg->eth_addr,
 403                                                   MCAST_INCLUDE, false, false);
 404                 if (IS_ERR_OR_NULL(src_pg) ||
 405                     src_pg->rt_protocol != RTPROT_KERNEL)
 406                         continue;
 407                 src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
 408         }
 409 }
 410
 411 static void br_multicast_fwd_src_add(struct net_bridge_group_src *src)
 412 {
 413         struct net_bridge_mdb_entry *star_mp;
 414         struct net_bridge_port_group *sg;
 415         struct br_ip sg_ip;
 416
 417         if (src->flags & BR_SGRP_F_INSTALLED)
 418                 return;
 419
 420         memset(&sg_ip, 0, sizeof(sg_ip));
 421         sg_ip = src->pg->key.addr;
 422         sg_ip.src = src->addr.src;
 423         sg = __br_multicast_add_group(src->br, src->pg->key.port, &sg_ip,
 424                                       src->pg->eth_addr, MCAST_INCLUDE, false,
 425                                       !timer_pending(&src->timer));
 426         if (IS_ERR_OR_NULL(sg))
 427                 return;
 428         src->flags |= BR_SGRP_F_INSTALLED;
 429         sg->flags &= ~MDB_PG_FLAGS_STAR_EXCL;
 430
 431         /* if it was added by user-space as perm we can skip next steps */
 432         if (sg->rt_protocol != RTPROT_KERNEL &&
 433             (sg->flags & MDB_PG_FLAGS_PERMANENT))
 434                 return;
 435
 436         /* the kernel is now responsible for removing this S,G */
 437         del_timer(&sg->timer);
 438         star_mp = br_mdb_ip_get(src->br, &src->pg->key.addr);
 439         if (!star_mp)
 440                 return;
 441
 442         br_multicast_sg_add_exclude_ports(star_mp, sg);
 443 }
 444
 445 static void br_multicast_fwd_src_remove(struct net_bridge_group_src *src,
 446                                         bool fastleave)
 447 {
 448         struct net_bridge_port_group *p, *pg = src->pg;
 449         struct net_bridge_port_group __rcu **pp;
 450         struct net_bridge_mdb_entry *mp;
 451         struct br_ip sg_ip;
 452
 453         memset(&sg_ip, 0, sizeof(sg_ip));
 454         sg_ip = pg->key.addr;
 455         sg_ip.src = src->addr.src;
 456
 457         mp = br_mdb_ip_get(src->br, &sg_ip);
 458         if (!mp)
 459                 return;
 460
 461         for (pp = &mp->ports;
 462              (p = mlock_dereference(*pp, src->br)) != NULL;
 463              pp = &p->next) {
 464                 if (!br_port_group_equal(p, pg->key.port, pg->eth_addr))
 465                         continue;
 466
 467                 if (p->rt_protocol != RTPROT_KERNEL &&
 468                     (p->flags & MDB_PG_FLAGS_PERMANENT))
 469                         break;
 470
 471                 if (fastleave)
 472                         p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
 473                 br_multicast_del_pg(mp, p, pp);
 474                 break;
 475         }
 476         src->flags &= ~BR_SGRP_F_INSTALLED;
 477 }
 478
 479 /* install S,G and based on src's timer enable or disable forwarding */
 480 static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)
 481 {
 482         struct net_bridge_port_group_sg_key sg_key;
 483         struct net_bridge_port_group *sg;
 484         u8 old_flags;
 485
 486         br_multicast_fwd_src_add(src);
 487
 488         memset(&sg_key, 0, sizeof(sg_key));
 489         sg_key.addr = src->pg->key.addr;
 490         sg_key.addr.src = src->addr.src;
 491         sg_key.port = src->pg->key.port;
 492
 493         sg = br_sg_port_find(src->br, &sg_key);
 494         if (!sg || (sg->flags & MDB_PG_FLAGS_PERMANENT))
 495                 return;
 496
 497         old_flags = sg->flags;
 498         if (timer_pending(&src->timer))
 499                 sg->flags &= ~MDB_PG_FLAGS_BLOCKED;
 500         else
 501                 sg->flags |= MDB_PG_FLAGS_BLOCKED;
 502
 503         if (old_flags != sg->flags) {
 504                 struct net_bridge_mdb_entry *sg_mp;
 505
 506                 sg_mp = br_mdb_ip_get(src->br, &sg_key.addr);
 507                 if (!sg_mp)
 508                         return;
 509                 br_mdb_notify(src->br->dev, sg_mp, sg, RTM_NEWMDB);
 510         }
 511 }
 512
 513 static void br_multicast_destroy_mdb_entry(struct net_bridge_mcast_gc *gc)
 514 {
 515         struct net_bridge_mdb_entry *mp;
 516
 517         mp = container_of(gc, struct net_bridge_mdb_entry, mcast_gc);
 518         WARN_ON(!hlist_unhashed(&mp->mdb_node));
 519         WARN_ON(mp->ports);
 520
 521         del_timer_sync(&mp->timer);
 522         kfree_rcu(mp, rcu);
 523 }
 524
 525 static void br_multicast_del_mdb_entry(struct net_bridge_mdb_entry *mp)
 526 {
 527         struct net_bridge *br = mp->br;
 528
 529         rhashtable_remove_fast(&br->mdb_hash_tbl, &mp->rhnode,
 530                                br_mdb_rht_params);
 531         hlist_del_init_rcu(&mp->mdb_node);
 532         hlist_add_head(&mp->mcast_gc.gc_node, &br->mcast_gc_list);
 533         queue_work(system_long_wq, &br->mcast_gc_work);
 534 }
 535
 536 static void br_multicast_group_expired(struct timer_list *t)
 537 {
 538         struct net_bridge_mdb_entry *mp = from_timer(mp, t, timer);
 539         struct net_bridge *br = mp->br;
 540
 541         spin_lock(&br->multicast_lock);
 542         if (hlist_unhashed(&mp->mdb_node) || !netif_running(br->dev) ||
 543             timer_pending(&mp->timer))
 544                 goto out;
 545
 546         br_multicast_host_leave(mp, true);
 547
 548         if (mp->ports)
 549                 goto out;
 550         br_multicast_del_mdb_entry(mp);
 551 out:
 552         spin_unlock(&br->multicast_lock);
 553 }
 554
 555 static void br_multicast_destroy_group_src(struct net_bridge_mcast_gc *gc)
 556 {
 557         struct net_bridge_group_src *src;
 558
 559         src = container_of(gc, struct net_bridge_group_src, mcast_gc);
 560         WARN_ON(!hlist_unhashed(&src->node));
 561
 562         del_timer_sync(&src->timer);
 563         kfree_rcu(src, rcu);
 564 }
 565
 566 void br_multicast_del_group_src(struct net_bridge_group_src *src,
 567                                 bool fastleave)
 568 {
 569         struct net_bridge *br = src->pg->key.port->br;
 570
 571         br_multicast_fwd_src_remove(src, fastleave);
 572         hlist_del_init_rcu(&src->node);
 573         src->pg->src_ents--;
 574         hlist_add_head(&src->mcast_gc.gc_node, &br->mcast_gc_list);
 575         queue_work(system_long_wq, &br->mcast_gc_work);
 576 }
 577
 578 static void br_multicast_destroy_port_group(struct net_bridge_mcast_gc *gc)
 579 {
 580         struct net_bridge_port_group *pg;
 581
 582         pg = container_of(gc, struct net_bridge_port_group, mcast_gc);
 583         WARN_ON(!hlist_unhashed(&pg->mglist));
 584         WARN_ON(!hlist_empty(&pg->src_list));
 585
 586         del_timer_sync(&pg->rexmit_timer);
 587         del_timer_sync(&pg->timer);
 588         kfree_rcu(pg, rcu);
 589 }
 590
 591 void br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
 592                          struct net_bridge_port_group *pg,
 593                          struct net_bridge_port_group __rcu **pp)
 594 {
 595         struct net_bridge *br = pg->key.port->br;
 596         struct net_bridge_group_src *ent;
 597         struct hlist_node *tmp;
 598
 599         rcu_assign_pointer(*pp, pg->next);
 600         hlist_del_init(&pg->mglist);
 601         br_multicast_eht_clean_sets(pg);
 602         hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
 603                 br_multicast_del_group_src(ent, false);
 604         br_mdb_notify(br->dev, mp, pg, RTM_DELMDB);
 605         if (!br_multicast_is_star_g(&mp->addr)) {
 606                 rhashtable_remove_fast(&br->sg_port_tbl, &pg->rhnode,
 607                                        br_sg_port_rht_params);
 608                 br_multicast_sg_del_exclude_ports(mp);
 609         } else {
 610                 br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
 611         }
 612         hlist_add_head(&pg->mcast_gc.gc_node, &br->mcast_gc_list);
 613         queue_work(system_long_wq, &br->mcast_gc_work);
 614
 615         if (!mp->ports && !mp->host_joined && netif_running(br->dev))
 616                 mod_timer(&mp->timer, jiffies);
 617 }
 618
 619 static void br_multicast_find_del_pg(struct net_bridge *br,
 620                                      struct net_bridge_port_group *pg)
 621 {
 622         struct net_bridge_port_group __rcu **pp;
 623         struct net_bridge_mdb_entry *mp;
 624         struct net_bridge_port_group *p;
 625
 626         mp = br_mdb_ip_get(br, &pg->key.addr);
 627         if (WARN_ON(!mp))
 628                 return;
 629
 630         for (pp = &mp->ports;
 631              (p = mlock_dereference(*pp, br)) != NULL;
 632              pp = &p->next) {
 633                 if (p != pg)
 634                         continue;
 635
 636                 br_multicast_del_pg(mp, pg, pp);
 637                 return;
 638         }
 639
 640         WARN_ON(1);
 641 }
 642
 643 static void br_multicast_port_group_expired(struct timer_list *t)
 644 {
 645         struct net_bridge_port_group *pg = from_timer(pg, t, timer);
 646         struct net_bridge_group_src *src_ent;
 647         struct net_bridge *br = pg->key.port->br;
 648         struct hlist_node *tmp;
 649         bool changed;
 650
 651         spin_lock(&br->multicast_lock);
 652         if (!netif_running(br->dev) || timer_pending(&pg->timer) ||
 653             hlist_unhashed(&pg->mglist) || pg->flags & MDB_PG_FLAGS_PERMANENT)
 654                 goto out;
 655
 656         changed = !!(pg->filter_mode == MCAST_EXCLUDE);
 657         pg->filter_mode = MCAST_INCLUDE;
 658         hlist_for_each_entry_safe(src_ent, tmp, &pg->src_list, node) {
 659                 if (!timer_pending(&src_ent->timer)) {
 660                         br_multicast_del_group_src(src_ent, false);
 661                         changed = true;
 662                 }
 663         }
 664
 665         if (hlist_empty(&pg->src_list)) {
 666                 br_multicast_find_del_pg(br, pg);
 667         } else if (changed) {
 668                 struct net_bridge_mdb_entry *mp = br_mdb_ip_get(br, &pg->key.addr);
 669
 670                 if (changed && br_multicast_is_star_g(&pg->key.addr))
 671                         br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
 672
 673                 if (WARN_ON(!mp))
 674                         goto out;
 675                 br_mdb_notify(br->dev, mp, pg, RTM_NEWMDB);
 676         }
 677 out:
 678         spin_unlock(&br->multicast_lock);
 679 }
 680
 681 static void br_multicast_gc(struct hlist_head *head)
 682 {
 683         struct net_bridge_mcast_gc *gcent;
 684         struct hlist_node *tmp;
 685
 686         hlist_for_each_entry_safe(gcent, tmp, head, gc_node) {
 687                 hlist_del_init(&gcent->gc_node);
 688                 gcent->destroy(gcent);
 689         }
 690 }
 691
 692 static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
 693                                                     struct net_bridge_port_group *pg,
 694                                                     __be32 ip_dst, __be32 group,
 695                                                     bool with_srcs, bool over_lmqt,
 696                                                     u8 sflag, u8 *igmp_type,
 697                                                     bool *need_rexmit)
 698 {
 699         struct net_bridge_port *p = pg ? pg->key.port : NULL;
 700         struct net_bridge_group_src *ent;
 701         size_t pkt_size, igmp_hdr_size;
 702         unsigned long now = jiffies;
 703         struct igmpv3_query *ihv3;
 704         void *csum_start = NULL;
 705         __sum16 *csum = NULL;
 706         struct sk_buff *skb;
 707         struct igmphdr *ih;
 708         struct ethhdr *eth;
 709         unsigned long lmqt;
 710         struct iphdr *iph;
 711         u16 lmqt_srcs = 0;
 712
 713         igmp_hdr_size = sizeof(*ih);
 714         if (br->multicast_igmp_version == 3) {
 715                 igmp_hdr_size = sizeof(*ihv3);
 716                 if (pg && with_srcs) {
 717                         lmqt = now + (br->multicast_last_member_interval *
 718                                       br->multicast_last_member_count);
 719                         hlist_for_each_entry(ent, &pg->src_list, node) {
 720                                 if (over_lmqt == time_after(ent->timer.expires,
 721                                                             lmqt) &&
 722                                     ent->src_query_rexmit_cnt > 0)
 723                                         lmqt_srcs++;
 724                         }
 725
 726                         if (!lmqt_srcs)
 727                                 return NULL;
 728                         igmp_hdr_size += lmqt_srcs * sizeof(__be32);
 729                 }
 730         }
 731
 732         pkt_size = sizeof(*eth) + sizeof(*iph) + 4 + igmp_hdr_size;
 733         if ((p && pkt_size > p->dev->mtu) ||
 734             pkt_size > br->dev->mtu)
 735                 return NULL;
 736
 737         skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
 738         if (!skb)
 739                 goto out;
 740
 741         skb->protocol = htons(ETH_P_IP);
 742
 743         skb_reset_mac_header(skb);
 744         eth = eth_hdr(skb);
 745
 746         ether_addr_copy(eth->h_source, br->dev->dev_addr);
 747         ip_eth_mc_map(ip_dst, eth->h_dest);
 748         eth->h_proto = htons(ETH_P_IP);
 749         skb_put(skb, sizeof(*eth));
 750
 751         skb_set_network_header(skb, skb->len);
 752         iph = ip_hdr(skb);
 753         iph->tot_len = htons(pkt_size - sizeof(*eth));
 754
 755         iph->version = 4;
 756         iph->ihl = 6;
 757         iph->tos = 0xc0;
 758         iph->id = 0;
 759         iph->frag_off = htons(IP_DF);
 760         iph->ttl = 1;
 761         iph->protocol = IPPROTO_IGMP;
 762         iph->saddr = br_opt_get(br, BROPT_MULTICAST_QUERY_USE_IFADDR) ?
 763                      inet_select_addr(br->dev, 0, RT_SCOPE_LINK) : 0;
 764         iph->daddr = ip_dst;
 765         ((u8 *)&iph[1])[0] = IPOPT_RA;
 766         ((u8 *)&iph[1])[1] = 4;
 767         ((u8 *)&iph[1])[2] = 0;
 768         ((u8 *)&iph[1])[3] = 0;
 769         ip_send_check(iph);
 770         skb_put(skb, 24);
 771
 772         skb_set_transport_header(skb, skb->len);
 773         *igmp_type = IGMP_HOST_MEMBERSHIP_QUERY;
 774
 775         switch (br->multicast_igmp_version) {
 776         case 2:
 777                 ih = igmp_hdr(skb);
 778                 ih->type = IGMP_HOST_MEMBERSHIP_QUERY;
 779                 ih->code = (group ? br->multicast_last_member_interval :
 780                                     br->multicast_query_response_interval) /
 781                            (HZ / IGMP_TIMER_SCALE);
 782                 ih->group = group;
 783                 ih->csum = 0;
 784                 csum = &ih->csum;
 785                 csum_start = (void *)ih;
 786                 break;
 787         case 3:
 788                 ihv3 = igmpv3_query_hdr(skb);
 789                 ihv3->type = IGMP_HOST_MEMBERSHIP_QUERY;
 790                 ihv3->code = (group ? br->multicast_last_member_interval :
 791                                       br->multicast_query_response_interval) /
 792                              (HZ / IGMP_TIMER_SCALE);
 793                 ihv3->group = group;
 794                 ihv3->qqic = br->multicast_query_interval / HZ;
 795                 ihv3->nsrcs = htons(lmqt_srcs);
 796                 ihv3->resv = 0;
 797                 ihv3->suppress = sflag;
 798                 ihv3->qrv = 2;
 799                 ihv3->csum = 0;
 800                 csum = &ihv3->csum;
 801                 csum_start = (void *)ihv3;
 802                 if (!pg || !with_srcs)
 803                         break;
 804
 805                 lmqt_srcs = 0;
 806                 hlist_for_each_entry(ent, &pg->src_list, node) {
 807                         if (over_lmqt == time_after(ent->timer.expires,
 808                                                     lmqt) &&
 809                             ent->src_query_rexmit_cnt > 0) {
 810                                 ihv3->srcs[lmqt_srcs++] = ent->addr.src.ip4;
 811                                 ent->src_query_rexmit_cnt--;
 812                                 if (need_rexmit && ent->src_query_rexmit_cnt)
 813                                         *need_rexmit = true;
 814                         }
 815                 }
 816                 if (WARN_ON(lmqt_srcs != ntohs(ihv3->nsrcs))) {
 817                         kfree_skb(skb);
 818                         return NULL;
 819                 }
 820                 break;
 821         }
 822
 823         if (WARN_ON(!csum || !csum_start)) {
 824                 kfree_skb(skb);
 825                 return NULL;
 826         }
 827
 828         *csum = ip_compute_csum(csum_start, igmp_hdr_size);
 829         skb_put(skb, igmp_hdr_size);
 830         __skb_pull(skb, sizeof(*eth));
 831
 832 out:
 833         return skb;
 834 }
 835
 836 #if IS_ENABLED(CONFIG_IPV6)
 837 static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
 838                                                     struct net_bridge_port_group *pg,
 839                                                     const struct in6_addr *ip6_dst,
 840                                                     const struct in6_addr *group,
 841                                                     bool with_srcs, bool over_llqt,
 842                                                     u8 sflag, u8 *igmp_type,
 843                                                     bool *need_rexmit)
 844 {
 845         struct net_bridge_port *p = pg ? pg->key.port : NULL;
 846         struct net_bridge_group_src *ent;
 847         size_t pkt_size, mld_hdr_size;
 848         unsigned long now = jiffies;
 849         struct mld2_query *mld2q;
 850         void *csum_start = NULL;
 851         unsigned long interval;
 852         __sum16 *csum = NULL;
 853         struct ipv6hdr *ip6h;
 854         struct mld_msg *mldq;
 855         struct sk_buff *skb;
 856         unsigned long llqt;
 857         struct ethhdr *eth;
 858         u16 llqt_srcs = 0;
 859         u8 *hopopt;
 860
 861         mld_hdr_size = sizeof(*mldq);
 862         if (br->multicast_mld_version == 2) {
 863                 mld_hdr_size = sizeof(*mld2q);
 864                 if (pg && with_srcs) {
 865                         llqt = now + (br->multicast_last_member_interval *
 866                                       br->multicast_last_member_count);
 867                         hlist_for_each_entry(ent, &pg->src_list, node) {
 868                                 if (over_llqt == time_after(ent->timer.expires,
 869                                                             llqt) &&
 870                                     ent->src_query_rexmit_cnt > 0)
 871                                         llqt_srcs++;
 872                         }
 873
 874                         if (!llqt_srcs)
 875                                 return NULL;
 876                         mld_hdr_size += llqt_srcs * sizeof(struct in6_addr);
 877                 }
 878         }
 879
 880         pkt_size = sizeof(*eth) + sizeof(*ip6h) + 8 + mld_hdr_size;
 881         if ((p && pkt_size > p->dev->mtu) ||
 882             pkt_size > br->dev->mtu)
 883                 return NULL;
 884
 885         skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
 886         if (!skb)
 887                 goto out;
 888
 889         skb->protocol = htons(ETH_P_IPV6);
 890
 891         /* Ethernet header */
 892         skb_reset_mac_header(skb);
 893         eth = eth_hdr(skb);
 894
 895         ether_addr_copy(eth->h_source, br->dev->dev_addr);
 896         eth->h_proto = htons(ETH_P_IPV6);
 897         skb_put(skb, sizeof(*eth));
 898
 899         /* IPv6 header + HbH option */
 900         skb_set_network_header(skb, skb->len);
 901         ip6h = ipv6_hdr(skb);
 902
 903         *(__force __be32 *)ip6h = htonl(0x60000000);
 904         ip6h->payload_len = htons(8 + mld_hdr_size);
 905         ip6h->nexthdr = IPPROTO_HOPOPTS;
 906         ip6h->hop_limit = 1;
 907         ip6h->daddr = *ip6_dst;
 908         if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
 909                                &ip6h->saddr)) {
 910                 kfree_skb(skb);
 911                 br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, false);
 912                 return NULL;
 913         }
 914
 915         br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
 916         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 917
 918         hopopt = (u8 *)(ip6h + 1);
 919         hopopt[0] = IPPROTO_ICMPV6;             /* next hdr */
 920         hopopt[1] = 0;                          /* length of HbH */
 921         hopopt[2] = IPV6_TLV_ROUTERALERT;       /* Router Alert */
 922         hopopt[3] = 2;                          /* Length of RA Option */
 923         hopopt[4] = 0;                          /* Type = 0x0000 (MLD) */
 924         hopopt[5] = 0;
 925         hopopt[6] = IPV6_TLV_PAD1;              /* Pad1 */
 926         hopopt[7] = IPV6_TLV_PAD1;              /* Pad1 */
 927
 928         skb_put(skb, sizeof(*ip6h) + 8);
 929
 930         /* ICMPv6 */
 931         skb_set_transport_header(skb, skb->len);
 932         interval = ipv6_addr_any(group) ?
 933                         br->multicast_query_response_interval :
 934                         br->multicast_last_member_interval;
 935         *igmp_type = ICMPV6_MGM_QUERY;
 936         switch (br->multicast_mld_version) {
 937         case 1:
 938                 mldq = (struct mld_msg *)icmp6_hdr(skb);
 939                 mldq->mld_type = ICMPV6_MGM_QUERY;
 940                 mldq->mld_code = 0;
 941                 mldq->mld_cksum = 0;
 942                 mldq->mld_maxdelay = htons((u16)jiffies_to_msecs(interval));
 943                 mldq->mld_reserved = 0;
 944                 mldq->mld_mca = *group;
 945                 csum = &mldq->mld_cksum;
 946                 csum_start = (void *)mldq;
 947                 break;
 948         case 2:
 949                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
 950                 mld2q->mld2q_mrc = htons((u16)jiffies_to_msecs(interval));
 951                 mld2q->mld2q_type = ICMPV6_MGM_QUERY;
 952                 mld2q->mld2q_code = 0;
 953                 mld2q->mld2q_cksum = 0;
 954                 mld2q->mld2q_resv1 = 0;
 955                 mld2q->mld2q_resv2 = 0;
 956                 mld2q->mld2q_suppress = sflag;
 957                 mld2q->mld2q_qrv = 2;
 958                 mld2q->mld2q_nsrcs = htons(llqt_srcs);
 959                 mld2q->mld2q_qqic = br->multicast_query_interval / HZ;
 960                 mld2q->mld2q_mca = *group;
 961                 csum = &mld2q->mld2q_cksum;
 962                 csum_start = (void *)mld2q;
 963                 if (!pg || !with_srcs)
 964                         break;
 965
 966                 llqt_srcs = 0;
 967                 hlist_for_each_entry(ent, &pg->src_list, node) {
 968                         if (over_llqt == time_after(ent->timer.expires,
 969                                                     llqt) &&
 970                             ent->src_query_rexmit_cnt > 0) {
 971                                 mld2q->mld2q_srcs[llqt_srcs++] = ent->addr.src.ip6;
 972                                 ent->src_query_rexmit_cnt--;
 973                                 if (need_rexmit && ent->src_query_rexmit_cnt)
 974                                         *need_rexmit = true;
 975                         }
 976                 }
 977                 if (WARN_ON(llqt_srcs != ntohs(mld2q->mld2q_nsrcs))) {
 978                         kfree_skb(skb);
 979                         return NULL;
 980                 }
 981                 break;
 982         }
 983
 984         if (WARN_ON(!csum || !csum_start)) {
 985                 kfree_skb(skb);
 986                 return NULL;
 987         }
 988
 989         *csum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, mld_hdr_size,
 990                                 IPPROTO_ICMPV6,
 991                                 csum_partial(csum_start, mld_hdr_size, 0));
 992         skb_put(skb, mld_hdr_size);
 993         __skb_pull(skb, sizeof(*eth));
 994
 995 out:
 996         return skb;
 997 }
 998 #endif
 999
1000 static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
1001                                                 struct net_bridge_port_group *pg,
1002                                                 struct br_ip *ip_dst,
1003                                                 struct br_ip *group,
1004                                                 bool with_srcs, bool over_lmqt,
1005                                                 u8 sflag, u8 *igmp_type,
1006                                                 bool *need_rexmit)
1007 {
1008         __be32 ip4_dst;
1009
1010         switch (group->proto) {
1011         case htons(ETH_P_IP):
1012                 ip4_dst = ip_dst ? ip_dst->dst.ip4 : htonl(INADDR_ALLHOSTS_GROUP);
1013                 return br_ip4_multicast_alloc_query(br, pg,
1014                                                     ip4_dst, group->dst.ip4,
1015                                                     with_srcs, over_lmqt,
1016                                                     sflag, igmp_type,
1017                                                     need_rexmit);
1018 #if IS_ENABLED(CONFIG_IPV6)
1019         case htons(ETH_P_IPV6): {
1020                 struct in6_addr ip6_dst;
1021
1022                 if (ip_dst)
1023                         ip6_dst = ip_dst->dst.ip6;
1024                 else
1025                         ipv6_addr_set(&ip6_dst, htonl(0xff020000), 0, 0,
1026                                       htonl(1));
1027
1028                 return br_ip6_multicast_alloc_query(br, pg,
1029                                                     &ip6_dst, &group->dst.ip6,
1030                                                     with_srcs, over_lmqt,
1031                                                     sflag, igmp_type,
1032                                                     need_rexmit);
1033         }
1034 #endif
1035         }
1036         return NULL;
1037 }
1038
1039 struct net_bridge_mdb_entry *br_multicast_new_group(struct net_bridge *br,
1040                                                     struct br_ip *group)
1041 {
1042         struct net_bridge_mdb_entry *mp;
1043         int err;
1044
1045         mp = br_mdb_ip_get(br, group);
1046         if (mp)
1047                 return mp;
1048
1049         if (atomic_read(&br->mdb_hash_tbl.nelems) >= br->hash_max) {
1050                 br_opt_toggle(br, BROPT_MULTICAST_ENABLED, false);
1051                 return ERR_PTR(-E2BIG);
1052         }
1053
1054         mp = kzalloc(sizeof(*mp), GFP_ATOMIC);
1055         if (unlikely(!mp))
1056                 return ERR_PTR(-ENOMEM);
1057
1058         mp->br = br;
1059         mp->addr = *group;
1060         mp->mcast_gc.destroy = br_multicast_destroy_mdb_entry;
1061         timer_setup(&mp->timer, br_multicast_group_expired, 0);
1062         err = rhashtable_lookup_insert_fast(&br->mdb_hash_tbl, &mp->rhnode,
1063                                             br_mdb_rht_params);
1064         if (err) {
1065                 kfree(mp);
1066                 mp = ERR_PTR(err);
1067         } else {
1068                 hlist_add_head_rcu(&mp->mdb_node, &br->mdb_list);
1069         }
1070
1071         return mp;
1072 }
1073
1074 static void br_multicast_group_src_expired(struct timer_list *t)
1075 {
1076         struct net_bridge_group_src *src = from_timer(src, t, timer);
1077         struct net_bridge_port_group *pg;
1078         struct net_bridge *br = src->br;
1079
1080         spin_lock(&br->multicast_lock);
1081         if (hlist_unhashed(&src->node) || !netif_running(br->dev) ||
1082             timer_pending(&src->timer))
1083                 goto out;
1084
1085         pg = src->pg;
1086         if (pg->filter_mode == MCAST_INCLUDE) {
1087                 br_multicast_del_group_src(src, false);
1088                 if (!hlist_empty(&pg->src_list))
1089                         goto out;
1090                 br_multicast_find_del_pg(br, pg);
1091         } else {
1092                 br_multicast_fwd_src_handle(src);
1093         }
1094
1095 out:
1096         spin_unlock(&br->multicast_lock);
1097 }
1098
1099 struct net_bridge_group_src *
1100 br_multicast_find_group_src(struct net_bridge_port_group *pg, struct br_ip *ip)
1101 {
1102         struct net_bridge_group_src *ent;
1103
1104         switch (ip->proto) {
1105         case htons(ETH_P_IP):
1106                 hlist_for_each_entry(ent, &pg->src_list, node)
1107                         if (ip->src.ip4 == ent->addr.src.ip4)
1108                                 return ent;
1109                 break;
1110 #if IS_ENABLED(CONFIG_IPV6)
1111         case htons(ETH_P_IPV6):
1112                 hlist_for_each_entry(ent, &pg->src_list, node)
1113                         if (!ipv6_addr_cmp(&ent->addr.src.ip6, &ip->src.ip6))
1114                                 return ent;
1115                 break;
1116 #endif
1117         }
1118
1119         return NULL;
1120 }
1121
1122 static struct net_bridge_group_src *
1123 br_multicast_new_group_src(struct net_bridge_port_group *pg, struct br_ip *src_ip)
1124 {
1125         struct net_bridge_group_src *grp_src;
1126
1127         if (unlikely(pg->src_ents >= PG_SRC_ENT_LIMIT))
1128                 return NULL;
1129
1130         switch (src_ip->proto) {
1131         case htons(ETH_P_IP):
1132                 if (ipv4_is_zeronet(src_ip->src.ip4) ||
1133                     ipv4_is_multicast(src_ip->src.ip4))
1134                         return NULL;
1135                 break;
1136 #if IS_ENABLED(CONFIG_IPV6)
1137         case htons(ETH_P_IPV6):
1138                 if (ipv6_addr_any(&src_ip->src.ip6) ||
1139                     ipv6_addr_is_multicast(&src_ip->src.ip6))
1140                         return NULL;
1141                 break;
1142 #endif
1143         }
1144
1145         grp_src = kzalloc(sizeof(*grp_src), GFP_ATOMIC);
1146         if (unlikely(!grp_src))
1147                 return NULL;
1148
1149         grp_src->pg = pg;
1150         grp_src->br = pg->key.port->br;
1151         grp_src->addr = *src_ip;
1152         grp_src->mcast_gc.destroy = br_multicast_destroy_group_src;
1153         timer_setup(&grp_src->timer, br_multicast_group_src_expired, 0);
1154
1155         hlist_add_head_rcu(&grp_src->node, &pg->src_list);
1156         pg->src_ents++;
1157
1158         return grp_src;
1159 }
1160
1161 struct net_bridge_port_group *br_multicast_new_port_group(
1162                         struct net_bridge_port *port,
1163                         struct br_ip *group,
1164                         struct net_bridge_port_group __rcu *next,
1165                         unsigned char flags,
1166                         const unsigned char *src,
1167                         u8 filter_mode,
1168                         u8 rt_protocol)
1169 {
1170         struct net_bridge_port_group *p;
1171
1172         p = kzalloc(sizeof(*p), GFP_ATOMIC);
1173         if (unlikely(!p))
1174                 return NULL;
1175
1176         p->key.addr = *group;
1177         p->key.port = port;
1178         p->flags = flags;
1179         p->filter_mode = filter_mode;
1180         p->rt_protocol = rt_protocol;
1181         p->eht_host_tree = RB_ROOT;
1182         p->eht_set_tree = RB_ROOT;
1183         p->mcast_gc.destroy = br_multicast_destroy_port_group;
1184         INIT_HLIST_HEAD(&p->src_list);
1185
1186         if (!br_multicast_is_star_g(group) &&
1187             rhashtable_lookup_insert_fast(&port->br->sg_port_tbl, &p->rhnode,
1188                                           br_sg_port_rht_params)) {
1189                 kfree(p);
1190                 return NULL;
1191         }
1192
1193         rcu_assign_pointer(p->next, next);
1194         timer_setup(&p->timer, br_multicast_port_group_expired, 0);
1195         timer_setup(&p->rexmit_timer, br_multicast_port_group_rexmit, 0);
1196         hlist_add_head(&p->mglist, &port->mglist);
1197
1198         if (src)
1199                 memcpy(p->eth_addr, src, ETH_ALEN);
1200         else
1201                 eth_broadcast_addr(p->eth_addr);
1202
1203         return p;
1204 }
1205
1206 void br_multicast_host_join(struct net_bridge_mdb_entry *mp, bool notify)
1207 {
1208         if (!mp->host_joined) {
1209                 mp->host_joined = true;
1210                 if (br_multicast_is_star_g(&mp->addr))
1211                         br_multicast_star_g_host_state(mp);
1212                 if (notify)
1213                         br_mdb_notify(mp->br->dev, mp, NULL, RTM_NEWMDB);
1214         }
1215
1216         if (br_group_is_l2(&mp->addr))
1217                 return;
1218
1219         mod_timer(&mp->timer, jiffies + mp->br->multicast_membership_interval);
1220 }
1221
1222 void br_multicast_host_leave(struct net_bridge_mdb_entry *mp, bool notify)
1223 {
1224         if (!mp->host_joined)
1225                 return;
1226
1227         mp->host_joined = false;
1228         if (br_multicast_is_star_g(&mp->addr))
1229                 br_multicast_star_g_host_state(mp);
1230         if (notify)
1231                 br_mdb_notify(mp->br->dev, mp, NULL, RTM_DELMDB);
1232 }
1233
1234 static struct net_bridge_port_group *
1235 __br_multicast_add_group(struct net_bridge *br,
1236                          struct net_bridge_port *port,
1237                          struct br_ip *group,
1238                          const unsigned char *src,
1239                          u8 filter_mode,
1240                          bool igmpv2_mldv1,
1241                          bool blocked)
1242 {
1243         struct net_bridge_port_group __rcu **pp;
1244         struct net_bridge_port_group *p = NULL;
1245         struct net_bridge_mdb_entry *mp;
1246         unsigned long now = jiffies;
1247
1248         if (!netif_running(br->dev) ||
1249             (port && port->state == BR_STATE_DISABLED))
1250                 goto out;
1251
1252         mp = br_multicast_new_group(br, group);
1253         if (IS_ERR(mp))
1254                 return ERR_CAST(mp);
1255
1256         if (!port) {
1257                 br_multicast_host_join(mp, true);
1258                 goto out;
1259         }
1260
1261         for (pp = &mp->ports;
1262              (p = mlock_dereference(*pp, br)) != NULL;
1263              pp = &p->next) {
1264                 if (br_port_group_equal(p, port, src))
1265                         goto found;
1266                 if ((unsigned long)p->key.port < (unsigned long)port)
1267                         break;
1268         }
1269
1270         p = br_multicast_new_port_group(port, group, *pp, 0, src,
1271                                         filter_mode, RTPROT_KERNEL);
1272         if (unlikely(!p)) {
1273                 p = ERR_PTR(-ENOMEM);
1274                 goto out;
1275         }
1276         rcu_assign_pointer(*pp, p);
1277         if (blocked)
1278                 p->flags |= MDB_PG_FLAGS_BLOCKED;
1279         br_mdb_notify(br->dev, mp, p, RTM_NEWMDB);
1280
1281 found:
1282         if (igmpv2_mldv1)
1283                 mod_timer(&p->timer, now + br->multicast_membership_interval);
1284
1285 out:
1286         return p;
1287 }
1288
1289 static int br_multicast_add_group(struct net_bridge *br,
1290                                   struct net_bridge_port *port,
1291                                   struct br_ip *group,
1292                                   const unsigned char *src,
1293                                   u8 filter_mode,
1294                                   bool igmpv2_mldv1)
1295 {
1296         struct net_bridge_port_group *pg;
1297         int err;
1298
1299         spin_lock(&br->multicast_lock);
1300         pg = __br_multicast_add_group(br, port, group, src, filter_mode,
1301                                       igmpv2_mldv1, false);
1302         /* NULL is considered valid for host joined groups */
1303         err = PTR_ERR_OR_ZERO(pg);
1304         spin_unlock(&br->multicast_lock);
1305
1306         return err;
1307 }
1308
1309 static int br_ip4_multicast_add_group(struct net_bridge *br,
1310                                       struct net_bridge_port *port,
1311                                       __be32 group,
1312                                       __u16 vid,
1313                                       const unsigned char *src,
1314                                       bool igmpv2)
1315 {
1316         struct br_ip br_group;
1317         u8 filter_mode;
1318
1319         if (ipv4_is_local_multicast(group))
1320                 return 0;
1321
1322         memset(&br_group, 0, sizeof(br_group));
1323         br_group.dst.ip4 = group;
1324         br_group.proto = htons(ETH_P_IP);
1325         br_group.vid = vid;
1326         filter_mode = igmpv2 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1327
1328         return br_multicast_add_group(br, port, &br_group, src, filter_mode,
1329                                       igmpv2);
1330 }
1331
1332 #if IS_ENABLED(CONFIG_IPV6)
1333 static int br_ip6_multicast_add_group(struct net_bridge *br,
1334                                       struct net_bridge_port *port,
1335                                       const struct in6_addr *group,
1336                                       __u16 vid,
1337                                       const unsigned char *src,
1338                                       bool mldv1)
1339 {
1340         struct br_ip br_group;
1341         u8 filter_mode;
1342
1343         if (ipv6_addr_is_ll_all_nodes(group))
1344                 return 0;
1345
1346         memset(&br_group, 0, sizeof(br_group));
1347         br_group.dst.ip6 = *group;
1348         br_group.proto = htons(ETH_P_IPV6);
1349         br_group.vid = vid;
1350         filter_mode = mldv1 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1351
1352         return br_multicast_add_group(br, port, &br_group, src, filter_mode,
1353                                       mldv1);
1354 }
1355 #endif
1356
1357 static void br_multicast_router_expired(struct timer_list *t)
1358 {
1359         struct net_bridge_port *port =
1360                         from_timer(port, t, multicast_router_timer);
1361         struct net_bridge *br = port->br;
1362
1363         spin_lock(&br->multicast_lock);
1364         if (port->multicast_router == MDB_RTR_TYPE_DISABLED ||
1365             port->multicast_router == MDB_RTR_TYPE_PERM ||
1366             timer_pending(&port->multicast_router_timer))
1367                 goto out;
1368
1369         __del_port_router(port);
1370 out:
1371         spin_unlock(&br->multicast_lock);
1372 }
1373
1374 static void br_mc_router_state_change(struct net_bridge *p,
1375                                       bool is_mc_router)
1376 {
1377         struct switchdev_attr attr = {
1378                 .orig_dev = p->dev,
1379                 .id = SWITCHDEV_ATTR_ID_BRIDGE_MROUTER,
1380                 .flags = SWITCHDEV_F_DEFER,
1381                 .u.mrouter = is_mc_router,
1382         };
1383
1384         switchdev_port_attr_set(p->dev, &attr, NULL);
1385 }
1386
1387 static void br_multicast_local_router_expired(struct timer_list *t)
1388 {
1389         struct net_bridge *br = from_timer(br, t, multicast_router_timer);
1390
1391         spin_lock(&br->multicast_lock);
1392         if (br->multicast_router == MDB_RTR_TYPE_DISABLED ||
1393             br->multicast_router == MDB_RTR_TYPE_PERM ||
1394             timer_pending(&br->multicast_router_timer))
1395                 goto out;
1396
1397         br_mc_router_state_change(br, false);
1398 out:
1399         spin_unlock(&br->multicast_lock);
1400 }
1401
1402 static void br_multicast_querier_expired(struct net_bridge *br,
1403                                          struct bridge_mcast_own_query *query)
1404 {
1405         spin_lock(&br->multicast_lock);
1406         if (!netif_running(br->dev) || !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1407                 goto out;
1408
1409         br_multicast_start_querier(br, query);
1410
1411 out:
1412         spin_unlock(&br->multicast_lock);
1413 }
1414
1415 static void br_ip4_multicast_querier_expired(struct timer_list *t)
1416 {
1417         struct net_bridge *br = from_timer(br, t, ip4_other_query.timer);
1418
1419         br_multicast_querier_expired(br, &br->ip4_own_query);
1420 }
1421
1422 #if IS_ENABLED(CONFIG_IPV6)
1423 static void br_ip6_multicast_querier_expired(struct timer_list *t)
1424 {
1425         struct net_bridge *br = from_timer(br, t, ip6_other_query.timer);
1426
1427         br_multicast_querier_expired(br, &br->ip6_own_query);
1428 }
1429 #endif
1430
1431 static void br_multicast_select_own_querier(struct net_bridge *br,
1432                                             struct br_ip *ip,
1433                                             struct sk_buff *skb)
1434 {
1435         if (ip->proto == htons(ETH_P_IP))
1436                 br->ip4_querier.addr.src.ip4 = ip_hdr(skb)->saddr;
1437 #if IS_ENABLED(CONFIG_IPV6)
1438         else
1439                 br->ip6_querier.addr.src.ip6 = ipv6_hdr(skb)->saddr;
1440 #endif
1441 }
1442
1443 static void __br_multicast_send_query(struct net_bridge *br,
1444                                       struct net_bridge_port *port,
1445                                       struct net_bridge_port_group *pg,
1446                                       struct br_ip *ip_dst,
1447                                       struct br_ip *group,
1448                                       bool with_srcs,
1449                                       u8 sflag,
1450                                       bool *need_rexmit)
1451 {
1452         bool over_lmqt = !!sflag;
1453         struct sk_buff *skb;
1454         u8 igmp_type;
1455
1456 again_under_lmqt:
1457         skb = br_multicast_alloc_query(br, pg, ip_dst, group, with_srcs,
1458                                        over_lmqt, sflag, &igmp_type,
1459                                        need_rexmit);
1460         if (!skb)
1461                 return;
1462
1463         if (port) {
1464                 skb->dev = port->dev;
1465                 br_multicast_count(br, port, skb, igmp_type,
1466                                    BR_MCAST_DIR_TX);
1467                 NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
1468                         dev_net(port->dev), NULL, skb, NULL, skb->dev,
1469                         br_dev_queue_push_xmit);
1470
1471                 if (over_lmqt && with_srcs && sflag) {
1472                         over_lmqt = false;
1473                         goto again_under_lmqt;
1474                 }
1475         } else {
1476                 br_multicast_select_own_querier(br, group, skb);
1477                 br_multicast_count(br, port, skb, igmp_type,
1478                                    BR_MCAST_DIR_RX);
1479                 netif_rx(skb);
1480         }
1481 }
1482
1483 static void br_multicast_send_query(struct net_bridge *br,
1484                                     struct net_bridge_port *port,
1485                                     struct bridge_mcast_own_query *own_query)
1486 {
1487         struct bridge_mcast_other_query *other_query = NULL;
1488         struct br_ip br_group;
1489         unsigned long time;
1490
1491         if (!netif_running(br->dev) ||
1492             !br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
1493             !br_opt_get(br, BROPT_MULTICAST_QUERIER))
1494                 return;
1495
1496         memset(&br_group.dst, 0, sizeof(br_group.dst));
1497
1498         if (port ? (own_query == &port->ip4_own_query) :
1499                    (own_query == &br->ip4_own_query)) {
1500                 other_query = &br->ip4_other_query;
1501                 br_group.proto = htons(ETH_P_IP);
1502 #if IS_ENABLED(CONFIG_IPV6)
1503         } else {
1504                 other_query = &br->ip6_other_query;
1505                 br_group.proto = htons(ETH_P_IPV6);
1506 #endif
1507         }
1508
1509         if (!other_query || timer_pending(&other_query->timer))
1510                 return;
1511
1512         __br_multicast_send_query(br, port, NULL, NULL, &br_group, false, 0,
1513                                   NULL);
1514
1515         time = jiffies;
1516         time += own_query->startup_sent < br->multicast_startup_query_count ?
1517                 br->multicast_startup_query_interval :
1518                 br->multicast_query_interval;
1519         mod_timer(&own_query->timer, time);
1520 }
1521
1522 static void
1523 br_multicast_port_query_expired(struct net_bridge_port *port,
1524                                 struct bridge_mcast_own_query *query)
1525 {
1526         struct net_bridge *br = port->br;
1527
1528         spin_lock(&br->multicast_lock);
1529         if (port->state == BR_STATE_DISABLED ||
1530             port->state == BR_STATE_BLOCKING)
1531                 goto out;
1532
1533         if (query->startup_sent < br->multicast_startup_query_count)
1534                 query->startup_sent++;
1535
1536         br_multicast_send_query(port->br, port, query);
1537
1538 out:
1539         spin_unlock(&br->multicast_lock);
1540 }
1541
1542 static void br_ip4_multicast_port_query_expired(struct timer_list *t)
1543 {
1544         struct net_bridge_port *port = from_timer(port, t, ip4_own_query.timer);
1545
1546         br_multicast_port_query_expired(port, &port->ip4_own_query);
1547 }
1548
1549 #if IS_ENABLED(CONFIG_IPV6)
1550 static void br_ip6_multicast_port_query_expired(struct timer_list *t)
1551 {
1552         struct net_bridge_port *port = from_timer(port, t, ip6_own_query.timer);
1553
1554         br_multicast_port_query_expired(port, &port->ip6_own_query);
1555 }
1556 #endif
1557
1558 static void br_multicast_port_group_rexmit(struct timer_list *t)
1559 {
1560         struct net_bridge_port_group *pg = from_timer(pg, t, rexmit_timer);
1561         struct bridge_mcast_other_query *other_query = NULL;
1562         struct net_bridge *br = pg->key.port->br;
1563         bool need_rexmit = false;
1564
1565         spin_lock(&br->multicast_lock);
1566         if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
1567             !br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
1568             !br_opt_get(br, BROPT_MULTICAST_QUERIER))
1569                 goto out;
1570
1571         if (pg->key.addr.proto == htons(ETH_P_IP))
1572                 other_query = &br->ip4_other_query;
1573 #if IS_ENABLED(CONFIG_IPV6)
1574         else
1575                 other_query = &br->ip6_other_query;
1576 #endif
1577
1578         if (!other_query || timer_pending(&other_query->timer))
1579                 goto out;
1580
1581         if (pg->grp_query_rexmit_cnt) {
1582                 pg->grp_query_rexmit_cnt--;
1583                 __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1584                                           &pg->key.addr, false, 1, NULL);
1585         }
1586         __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1587                                   &pg->key.addr, true, 0, &need_rexmit);
1588
1589         if (pg->grp_query_rexmit_cnt || need_rexmit)
1590                 mod_timer(&pg->rexmit_timer, jiffies +
1591                                              br->multicast_last_member_interval);
1592 out:
1593         spin_unlock(&br->multicast_lock);
1594 }
1595
1596 static void br_mc_disabled_update(struct net_device *dev, bool value)
1597 {
1598         struct switchdev_attr attr = {
1599                 .orig_dev = dev,
1600                 .id = SWITCHDEV_ATTR_ID_BRIDGE_MC_DISABLED,
1601                 .flags = SWITCHDEV_F_DEFER,
1602                 .u.mc_disabled = !value,
1603         };
1604
1605         switchdev_port_attr_set(dev, &attr, NULL);
1606 }
1607
1608 int br_multicast_add_port(struct net_bridge_port *port)
1609 {
1610         port->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
1611         port->multicast_eht_hosts_limit = BR_MCAST_DEFAULT_EHT_HOSTS_LIMIT;
1612
1613         timer_setup(&port->multicast_router_timer,
1614                     br_multicast_router_expired, 0);
1615         timer_setup(&port->ip4_own_query.timer,
1616                     br_ip4_multicast_port_query_expired, 0);
1617 #if IS_ENABLED(CONFIG_IPV6)
1618         timer_setup(&port->ip6_own_query.timer,
1619                     br_ip6_multicast_port_query_expired, 0);
1620 #endif
1621         br_mc_disabled_update(port->dev,
1622                               br_opt_get(port->br, BROPT_MULTICAST_ENABLED));
1623
1624         port->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
1625         if (!port->mcast_stats)
1626                 return -ENOMEM;
1627
1628         return 0;
1629 }
1630
1631 void br_multicast_del_port(struct net_bridge_port *port)
1632 {
1633         struct net_bridge *br = port->br;
1634         struct net_bridge_port_group *pg;
1635         HLIST_HEAD(deleted_head);
1636         struct hlist_node *n;
1637
1638         /* Take care of the remaining groups, only perm ones should be left */
1639         spin_lock_bh(&br->multicast_lock);
1640         hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
1641                 br_multicast_find_del_pg(br, pg);
1642         hlist_move_list(&br->mcast_gc_list, &deleted_head);
1643         spin_unlock_bh(&br->multicast_lock);
1644         br_multicast_gc(&deleted_head);
1645         del_timer_sync(&port->multicast_router_timer);
1646         free_percpu(port->mcast_stats);
1647 }
1648
1649 static void br_multicast_enable(struct bridge_mcast_own_query *query)
1650 {
1651         query->startup_sent = 0;
1652
1653         if (try_to_del_timer_sync(&query->timer) >= 0 ||
1654             del_timer(&query->timer))
1655                 mod_timer(&query->timer, jiffies);
1656 }
1657
1658 static void __br_multicast_enable_port(struct net_bridge_port *port)
1659 {
1660         struct net_bridge *br = port->br;
1661
1662         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED) || !netif_running(br->dev))
1663                 return;
1664
1665         br_multicast_enable(&port->ip4_own_query);
1666 #if IS_ENABLED(CONFIG_IPV6)
1667         br_multicast_enable(&port->ip6_own_query);
1668 #endif
1669         if (port->multicast_router == MDB_RTR_TYPE_PERM &&
1670             hlist_unhashed(&port->rlist))
1671                 br_multicast_add_router(br, port);
1672 }
1673
1674 void br_multicast_enable_port(struct net_bridge_port *port)
1675 {
1676         struct net_bridge *br = port->br;
1677
1678         spin_lock(&br->multicast_lock);
1679         __br_multicast_enable_port(port);
1680         spin_unlock(&br->multicast_lock);
1681 }
1682
1683 void br_multicast_disable_port(struct net_bridge_port *port)
1684 {
1685         struct net_bridge *br = port->br;
1686         struct net_bridge_port_group *pg;
1687         struct hlist_node *n;
1688
1689         spin_lock(&br->multicast_lock);
1690         hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
1691                 if (!(pg->flags & MDB_PG_FLAGS_PERMANENT))
1692                         br_multicast_find_del_pg(br, pg);
1693
1694         __del_port_router(port);
1695
1696         del_timer(&port->multicast_router_timer);
1697         del_timer(&port->ip4_own_query.timer);
1698 #if IS_ENABLED(CONFIG_IPV6)
1699         del_timer(&port->ip6_own_query.timer);
1700 #endif
1701         spin_unlock(&br->multicast_lock);
1702 }
1703
1704 static int __grp_src_delete_marked(struct net_bridge_port_group *pg)
1705 {
1706         struct net_bridge_group_src *ent;
1707         struct hlist_node *tmp;
1708         int deleted = 0;
1709
1710         hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
1711                 if (ent->flags & BR_SGRP_F_DELETE) {
1712                         br_multicast_del_group_src(ent, false);
1713                         deleted++;
1714                 }
1715
1716         return deleted;
1717 }
1718
1719 static void __grp_src_mod_timer(struct net_bridge_group_src *src,
1720                                 unsigned long expires)
1721 {
1722         mod_timer(&src->timer, expires);
1723         br_multicast_fwd_src_handle(src);
1724 }
1725
1726 static void __grp_src_query_marked_and_rexmit(struct net_bridge_port_group *pg)
1727 {
1728         struct bridge_mcast_other_query *other_query = NULL;
1729         struct net_bridge *br = pg->key.port->br;
1730         u32 lmqc = br->multicast_last_member_count;
1731         unsigned long lmqt, lmi, now = jiffies;
1732         struct net_bridge_group_src *ent;
1733
1734         if (!netif_running(br->dev) ||
1735             !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1736                 return;
1737
1738         if (pg->key.addr.proto == htons(ETH_P_IP))
1739                 other_query = &br->ip4_other_query;
1740 #if IS_ENABLED(CONFIG_IPV6)
1741         else
1742                 other_query = &br->ip6_other_query;
1743 #endif
1744
1745         lmqt = now + br_multicast_lmqt(br);
1746         hlist_for_each_entry(ent, &pg->src_list, node) {
1747                 if (ent->flags & BR_SGRP_F_SEND) {
1748                         ent->flags &= ~BR_SGRP_F_SEND;
1749                         if (ent->timer.expires > lmqt) {
1750                                 if (br_opt_get(br, BROPT_MULTICAST_QUERIER) &&
1751                                     other_query &&
1752                                     !timer_pending(&other_query->timer))
1753                                         ent->src_query_rexmit_cnt = lmqc;
1754                                 __grp_src_mod_timer(ent, lmqt);
1755                         }
1756                 }
1757         }
1758
1759         if (!br_opt_get(br, BROPT_MULTICAST_QUERIER) ||
1760             !other_query || timer_pending(&other_query->timer))
1761                 return;
1762
1763         __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1764                                   &pg->key.addr, true, 1, NULL);
1765
1766         lmi = now + br->multicast_last_member_interval;
1767         if (!timer_pending(&pg->rexmit_timer) ||
1768             time_after(pg->rexmit_timer.expires, lmi))
1769                 mod_timer(&pg->rexmit_timer, lmi);
1770 }
1771
1772 static void __grp_send_query_and_rexmit(struct net_bridge_port_group *pg)
1773 {
1774         struct bridge_mcast_other_query *other_query = NULL;
1775         struct net_bridge *br = pg->key.port->br;
1776         unsigned long now = jiffies, lmi;
1777
1778         if (!netif_running(br->dev) ||
1779             !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1780                 return;
1781
1782         if (pg->key.addr.proto == htons(ETH_P_IP))
1783                 other_query = &br->ip4_other_query;
1784 #if IS_ENABLED(CONFIG_IPV6)
1785         else
1786                 other_query = &br->ip6_other_query;
1787 #endif
1788
1789         if (br_opt_get(br, BROPT_MULTICAST_QUERIER) &&
1790             other_query && !timer_pending(&other_query->timer)) {
1791                 lmi = now + br->multicast_last_member_interval;
1792                 pg->grp_query_rexmit_cnt = br->multicast_last_member_count - 1;
1793                 __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1794                                           &pg->key.addr, false, 0, NULL);
1795                 if (!timer_pending(&pg->rexmit_timer) ||
1796                     time_after(pg->rexmit_timer.expires, lmi))
1797                         mod_timer(&pg->rexmit_timer, lmi);
1798         }
1799
1800         if (pg->filter_mode == MCAST_EXCLUDE &&
1801             (!timer_pending(&pg->timer) ||
1802              time_after(pg->timer.expires, now + br_multicast_lmqt(br))))
1803                 mod_timer(&pg->timer, now + br_multicast_lmqt(br));
1804 }
1805
1806 /* State          Msg type      New state                Actions
1807  * INCLUDE (A)    IS_IN (B)     INCLUDE (A+B)            (B)=GMI
1808  * INCLUDE (A)    ALLOW (B)     INCLUDE (A+B)            (B)=GMI
1809  * EXCLUDE (X,Y)  ALLOW (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
1810  */
1811 static bool br_multicast_isinc_allow(struct net_bridge_port_group *pg, void *h_addr,
1812                                      void *srcs, u32 nsrcs, size_t addr_size,
1813                                      int grec_type)
1814 {
1815         struct net_bridge *br = pg->key.port->br;
1816         struct net_bridge_group_src *ent;
1817         unsigned long now = jiffies;
1818         bool changed = false;
1819         struct br_ip src_ip;
1820         u32 src_idx;
1821
1822         memset(&src_ip, 0, sizeof(src_ip));
1823         src_ip.proto = pg->key.addr.proto;
1824         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1825                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1826                 ent = br_multicast_find_group_src(pg, &src_ip);
1827                 if (!ent) {
1828                         ent = br_multicast_new_group_src(pg, &src_ip);
1829                         if (ent)
1830                                 changed = true;
1831                 }
1832
1833                 if (ent)
1834                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
1835         }
1836
1837         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
1838                 changed = true;
1839
1840         return changed;
1841 }
1842
1843 /* State          Msg type      New state                Actions
1844  * INCLUDE (A)    IS_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
1845  *                                                       Delete (A-B)
1846  *                                                       Group Timer=GMI
1847  */
1848 static void __grp_src_isexc_incl(struct net_bridge_port_group *pg, void *h_addr,
1849                                  void *srcs, u32 nsrcs, size_t addr_size,
1850                                  int grec_type)
1851 {
1852         struct net_bridge_group_src *ent;
1853         struct br_ip src_ip;
1854         u32 src_idx;
1855
1856         hlist_for_each_entry(ent, &pg->src_list, node)
1857                 ent->flags |= BR_SGRP_F_DELETE;
1858
1859         memset(&src_ip, 0, sizeof(src_ip));
1860         src_ip.proto = pg->key.addr.proto;
1861         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1862                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1863                 ent = br_multicast_find_group_src(pg, &src_ip);
1864                 if (ent)
1865                         ent->flags &= ~BR_SGRP_F_DELETE;
1866                 else
1867                         ent = br_multicast_new_group_src(pg, &src_ip);
1868                 if (ent)
1869                         br_multicast_fwd_src_handle(ent);
1870         }
1871
1872         br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type);
1873
1874         __grp_src_delete_marked(pg);
1875 }
1876
1877 /* State          Msg type      New state                Actions
1878  * EXCLUDE (X,Y)  IS_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=GMI
1879  *                                                       Delete (X-A)
1880  *                                                       Delete (Y-A)
1881  *                                                       Group Timer=GMI
1882  */
1883 static bool __grp_src_isexc_excl(struct net_bridge_port_group *pg, void *h_addr,
1884                                  void *srcs, u32 nsrcs, size_t addr_size,
1885                                  int grec_type)
1886 {
1887         struct net_bridge *br = pg->key.port->br;
1888         struct net_bridge_group_src *ent;
1889         unsigned long now = jiffies;
1890         bool changed = false;
1891         struct br_ip src_ip;
1892         u32 src_idx;
1893
1894         hlist_for_each_entry(ent, &pg->src_list, node)
1895                 ent->flags |= BR_SGRP_F_DELETE;
1896
1897         memset(&src_ip, 0, sizeof(src_ip));
1898         src_ip.proto = pg->key.addr.proto;
1899         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1900                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1901                 ent = br_multicast_find_group_src(pg, &src_ip);
1902                 if (ent) {
1903                         ent->flags &= ~BR_SGRP_F_DELETE;
1904                 } else {
1905                         ent = br_multicast_new_group_src(pg, &src_ip);
1906                         if (ent) {
1907                                 __grp_src_mod_timer(ent,
1908                                                     now + br_multicast_gmi(br));
1909                                 changed = true;
1910                         }
1911                 }
1912         }
1913
1914         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
1915                 changed = true;
1916
1917         if (__grp_src_delete_marked(pg))
1918                 changed = true;
1919
1920         return changed;
1921 }
1922
1923 static bool br_multicast_isexc(struct net_bridge_port_group *pg, void *h_addr,
1924                                void *srcs, u32 nsrcs, size_t addr_size,
1925                                int grec_type)
1926 {
1927         struct net_bridge *br = pg->key.port->br;
1928         bool changed = false;
1929
1930         switch (pg->filter_mode) {
1931         case MCAST_INCLUDE:
1932                 __grp_src_isexc_incl(pg, h_addr, srcs, nsrcs, addr_size,
1933                                      grec_type);
1934                 br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
1935                 changed = true;
1936                 break;
1937         case MCAST_EXCLUDE:
1938                 changed = __grp_src_isexc_excl(pg, h_addr, srcs, nsrcs, addr_size,
1939                                                grec_type);
1940                 break;
1941         }
1942
1943         pg->filter_mode = MCAST_EXCLUDE;
1944         mod_timer(&pg->timer, jiffies + br_multicast_gmi(br));
1945
1946         return changed;
1947 }
1948
1949 /* State          Msg type      New state                Actions
1950  * INCLUDE (A)    TO_IN (B)     INCLUDE (A+B)            (B)=GMI
1951  *                                                       Send Q(G,A-B)
1952  */
1953 static bool __grp_src_toin_incl(struct net_bridge_port_group *pg, void *h_addr,
1954                                 void *srcs, u32 nsrcs, size_t addr_size,
1955                                 int grec_type)
1956 {
1957         struct net_bridge *br = pg->key.port->br;
1958         u32 src_idx, to_send = pg->src_ents;
1959         struct net_bridge_group_src *ent;
1960         unsigned long now = jiffies;
1961         bool changed = false;
1962         struct br_ip src_ip;
1963
1964         hlist_for_each_entry(ent, &pg->src_list, node)
1965                 ent->flags |= BR_SGRP_F_SEND;
1966
1967         memset(&src_ip, 0, sizeof(src_ip));
1968         src_ip.proto = pg->key.addr.proto;
1969         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1970                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1971                 ent = br_multicast_find_group_src(pg, &src_ip);
1972                 if (ent) {
1973                         ent->flags &= ~BR_SGRP_F_SEND;
1974                         to_send--;
1975                 } else {
1976                         ent = br_multicast_new_group_src(pg, &src_ip);
1977                         if (ent)
1978                                 changed = true;
1979                 }
1980                 if (ent)
1981                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
1982         }
1983
1984         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
1985                 changed = true;
1986
1987         if (to_send)
1988                 __grp_src_query_marked_and_rexmit(pg);
1989
1990         return changed;
1991 }
1992
1993 /* State          Msg type      New state                Actions
1994  * EXCLUDE (X,Y)  TO_IN (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
1995  *                                                       Send Q(G,X-A)
1996  *                                                       Send Q(G)
1997  */
1998 static bool __grp_src_toin_excl(struct net_bridge_port_group *pg, void *h_addr,
1999                                 void *srcs, u32 nsrcs, size_t addr_size,
2000                                 int grec_type)
2001 {
2002         struct net_bridge *br = pg->key.port->br;
2003         u32 src_idx, to_send = pg->src_ents;
2004         struct net_bridge_group_src *ent;
2005         unsigned long now = jiffies;
2006         bool changed = false;
2007         struct br_ip src_ip;
2008
2009         hlist_for_each_entry(ent, &pg->src_list, node)
2010                 if (timer_pending(&ent->timer))
2011                         ent->flags |= BR_SGRP_F_SEND;
2012
2013         memset(&src_ip, 0, sizeof(src_ip));
2014         src_ip.proto = pg->key.addr.proto;
2015         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2016                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2017                 ent = br_multicast_find_group_src(pg, &src_ip);
2018                 if (ent) {
2019                         if (timer_pending(&ent->timer)) {
2020                                 ent->flags &= ~BR_SGRP_F_SEND;
2021                                 to_send--;
2022                         }
2023                 } else {
2024                         ent = br_multicast_new_group_src(pg, &src_ip);
2025                         if (ent)
2026                                 changed = true;
2027                 }
2028                 if (ent)
2029                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
2030         }
2031
2032         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2033                 changed = true;
2034
2035         if (to_send)
2036                 __grp_src_query_marked_and_rexmit(pg);
2037
2038         __grp_send_query_and_rexmit(pg);
2039
2040         return changed;
2041 }
2042
2043 static bool br_multicast_toin(struct net_bridge_port_group *pg, void *h_addr,
2044                               void *srcs, u32 nsrcs, size_t addr_size,
2045                               int grec_type)
2046 {
2047         bool changed = false;
2048
2049         switch (pg->filter_mode) {
2050         case MCAST_INCLUDE:
2051                 changed = __grp_src_toin_incl(pg, h_addr, srcs, nsrcs, addr_size,
2052                                               grec_type);
2053                 break;
2054         case MCAST_EXCLUDE:
2055                 changed = __grp_src_toin_excl(pg, h_addr, srcs, nsrcs, addr_size,
2056                                               grec_type);
2057                 break;
2058         }
2059
2060         if (br_multicast_eht_should_del_pg(pg)) {
2061                 pg->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2062                 br_multicast_find_del_pg(pg->key.port->br, pg);
2063                 /* a notification has already been sent and we shouldn't
2064                  * access pg after the delete so we have to return false
2065                  */
2066                 changed = false;
2067         }
2068
2069         return changed;
2070 }
2071
2072 /* State          Msg type      New state                Actions
2073  * INCLUDE (A)    TO_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
2074  *                                                       Delete (A-B)
2075  *                                                       Send Q(G,A*B)
2076  *                                                       Group Timer=GMI
2077  */
2078 static void __grp_src_toex_incl(struct net_bridge_port_group *pg, void *h_addr,
2079                                 void *srcs, u32 nsrcs, size_t addr_size,
2080                                 int grec_type)
2081 {
2082         struct net_bridge_group_src *ent;
2083         u32 src_idx, to_send = 0;
2084         struct br_ip src_ip;
2085
2086         hlist_for_each_entry(ent, &pg->src_list, node)
2087                 ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2088
2089         memset(&src_ip, 0, sizeof(src_ip));
2090         src_ip.proto = pg->key.addr.proto;
2091         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2092                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2093                 ent = br_multicast_find_group_src(pg, &src_ip);
2094                 if (ent) {
2095                         ent->flags = (ent->flags & ~BR_SGRP_F_DELETE) |
2096                                      BR_SGRP_F_SEND;
2097                         to_send++;
2098                 } else {
2099                         ent = br_multicast_new_group_src(pg, &src_ip);
2100                 }
2101                 if (ent)
2102                         br_multicast_fwd_src_handle(ent);
2103         }
2104
2105         br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type);
2106
2107         __grp_src_delete_marked(pg);
2108         if (to_send)
2109                 __grp_src_query_marked_and_rexmit(pg);
2110 }
2111
2112 /* State          Msg type      New state                Actions
2113  * EXCLUDE (X,Y)  TO_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=Group Timer
2114  *                                                       Delete (X-A)
2115  *                                                       Delete (Y-A)
2116  *                                                       Send Q(G,A-Y)
2117  *                                                       Group Timer=GMI
2118  */
2119 static bool __grp_src_toex_excl(struct net_bridge_port_group *pg, void *h_addr,
2120                                 void *srcs, u32 nsrcs, size_t addr_size,
2121                                 int grec_type)
2122 {
2123         struct net_bridge_group_src *ent;
2124         u32 src_idx, to_send = 0;
2125         bool changed = false;
2126         struct br_ip src_ip;
2127
2128         hlist_for_each_entry(ent, &pg->src_list, node)
2129                 ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2130
2131         memset(&src_ip, 0, sizeof(src_ip));
2132         src_ip.proto = pg->key.addr.proto;
2133         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2134                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2135                 ent = br_multicast_find_group_src(pg, &src_ip);
2136                 if (ent) {
2137                         ent->flags &= ~BR_SGRP_F_DELETE;
2138                 } else {
2139                         ent = br_multicast_new_group_src(pg, &src_ip);
2140                         if (ent) {
2141                                 __grp_src_mod_timer(ent, pg->timer.expires);
2142                                 changed = true;
2143                         }
2144                 }
2145                 if (ent && timer_pending(&ent->timer)) {
2146                         ent->flags |= BR_SGRP_F_SEND;
2147                         to_send++;
2148                 }
2149         }
2150
2151         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2152                 changed = true;
2153
2154         if (__grp_src_delete_marked(pg))
2155                 changed = true;
2156         if (to_send)
2157                 __grp_src_query_marked_and_rexmit(pg);
2158
2159         return changed;
2160 }
2161
2162 static bool br_multicast_toex(struct net_bridge_port_group *pg, void *h_addr,
2163                               void *srcs, u32 nsrcs, size_t addr_size,
2164                               int grec_type)
2165 {
2166         struct net_bridge *br = pg->key.port->br;
2167         bool changed = false;
2168
2169         switch (pg->filter_mode) {
2170         case MCAST_INCLUDE:
2171                 __grp_src_toex_incl(pg, h_addr, srcs, nsrcs, addr_size,
2172                                     grec_type);
2173                 br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
2174                 changed = true;
2175                 break;
2176         case MCAST_EXCLUDE:
2177                 changed = __grp_src_toex_excl(pg, h_addr, srcs, nsrcs, addr_size,
2178                                               grec_type);
2179                 break;
2180         }
2181
2182         pg->filter_mode = MCAST_EXCLUDE;
2183         mod_timer(&pg->timer, jiffies + br_multicast_gmi(br));
2184
2185         return changed;
2186 }
2187
2188 /* State          Msg type      New state                Actions
2189  * INCLUDE (A)    BLOCK (B)     INCLUDE (A)              Send Q(G,A*B)
2190  */
2191 static bool __grp_src_block_incl(struct net_bridge_port_group *pg, void *h_addr,
2192                                  void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2193 {
2194         struct net_bridge_group_src *ent;
2195         u32 src_idx, to_send = 0;
2196         bool changed = false;
2197         struct br_ip src_ip;
2198
2199         hlist_for_each_entry(ent, &pg->src_list, node)
2200                 ent->flags &= ~BR_SGRP_F_SEND;
2201
2202         memset(&src_ip, 0, sizeof(src_ip));
2203         src_ip.proto = pg->key.addr.proto;
2204         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2205                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2206                 ent = br_multicast_find_group_src(pg, &src_ip);
2207                 if (ent) {
2208                         ent->flags |= BR_SGRP_F_SEND;
2209                         to_send++;
2210                 }
2211         }
2212
2213         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2214                 changed = true;
2215
2216         if (to_send)
2217                 __grp_src_query_marked_and_rexmit(pg);
2218
2219         return changed;
2220 }
2221
2222 /* State          Msg type      New state                Actions
2223  * EXCLUDE (X,Y)  BLOCK (A)     EXCLUDE (X+(A-Y),Y)      (A-X-Y)=Group Timer
2224  *                                                       Send Q(G,A-Y)
2225  */
2226 static bool __grp_src_block_excl(struct net_bridge_port_group *pg, void *h_addr,
2227                                  void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2228 {
2229         struct net_bridge_group_src *ent;
2230         u32 src_idx, to_send = 0;
2231         bool changed = false;
2232         struct br_ip src_ip;
2233
2234         hlist_for_each_entry(ent, &pg->src_list, node)
2235                 ent->flags &= ~BR_SGRP_F_SEND;
2236
2237         memset(&src_ip, 0, sizeof(src_ip));
2238         src_ip.proto = pg->key.addr.proto;
2239         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2240                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2241                 ent = br_multicast_find_group_src(pg, &src_ip);
2242                 if (!ent) {
2243                         ent = br_multicast_new_group_src(pg, &src_ip);
2244                         if (ent) {
2245                                 __grp_src_mod_timer(ent, pg->timer.expires);
2246                                 changed = true;
2247                         }
2248                 }
2249                 if (ent && timer_pending(&ent->timer)) {
2250                         ent->flags |= BR_SGRP_F_SEND;
2251                         to_send++;
2252                 }
2253         }
2254
2255         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2256                 changed = true;
2257
2258         if (to_send)
2259                 __grp_src_query_marked_and_rexmit(pg);
2260
2261         return changed;
2262 }
2263
2264 static bool br_multicast_block(struct net_bridge_port_group *pg, void *h_addr,
2265                                void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2266 {
2267         bool changed = false;
2268
2269         switch (pg->filter_mode) {
2270         case MCAST_INCLUDE:
2271                 changed = __grp_src_block_incl(pg, h_addr, srcs, nsrcs, addr_size,
2272                                                grec_type);
2273                 break;
2274         case MCAST_EXCLUDE:
2275                 changed = __grp_src_block_excl(pg, h_addr, srcs, nsrcs, addr_size,
2276                                                grec_type);
2277                 break;
2278         }
2279
2280         if ((pg->filter_mode == MCAST_INCLUDE && hlist_empty(&pg->src_list)) ||
2281             br_multicast_eht_should_del_pg(pg)) {
2282                 if (br_multicast_eht_should_del_pg(pg))
2283                         pg->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2284                 br_multicast_find_del_pg(pg->key.port->br, pg);
2285                 /* a notification has already been sent and we shouldn't
2286                  * access pg after the delete so we have to return false
2287                  */
2288                 changed = false;
2289         }
2290
2291         return changed;
2292 }
2293
2294 static struct net_bridge_port_group *
2295 br_multicast_find_port(struct net_bridge_mdb_entry *mp,
2296                        struct net_bridge_port *p,
2297                        const unsigned char *src)
2298 {
2299         struct net_bridge *br __maybe_unused = mp->br;
2300         struct net_bridge_port_group *pg;
2301
2302         for (pg = mlock_dereference(mp->ports, br);
2303              pg;
2304              pg = mlock_dereference(pg->next, br))
2305                 if (br_port_group_equal(pg, p, src))
2306                         return pg;
2307
2308         return NULL;
2309 }
2310
2311 static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
2312                                          struct net_bridge_port *port,
2313                                          struct sk_buff *skb,
2314                                          u16 vid)
2315 {
2316         bool igmpv2 = br->multicast_igmp_version == 2;
2317         struct net_bridge_mdb_entry *mdst;
2318         struct net_bridge_port_group *pg;
2319         const unsigned char *src;
2320         struct igmpv3_report *ih;
2321         struct igmpv3_grec *grec;
2322         int i, len, num, type;
2323         __be32 group, *h_addr;
2324         bool changed = false;
2325         int err = 0;
2326         u16 nsrcs;
2327
2328         ih = igmpv3_report_hdr(skb);
2329         num = ntohs(ih->ngrec);
2330         len = skb_transport_offset(skb) + sizeof(*ih);
2331
2332         for (i = 0; i < num; i++) {
2333                 len += sizeof(*grec);
2334                 if (!ip_mc_may_pull(skb, len))
2335                         return -EINVAL;
2336
2337                 grec = (void *)(skb->data + len - sizeof(*grec));
2338                 group = grec->grec_mca;
2339                 type = grec->grec_type;
2340                 nsrcs = ntohs(grec->grec_nsrcs);
2341
2342                 len += nsrcs * 4;
2343                 if (!ip_mc_may_pull(skb, len))
2344                         return -EINVAL;
2345
2346                 switch (type) {
2347                 case IGMPV3_MODE_IS_INCLUDE:
2348                 case IGMPV3_MODE_IS_EXCLUDE:
2349                 case IGMPV3_CHANGE_TO_INCLUDE:
2350                 case IGMPV3_CHANGE_TO_EXCLUDE:
2351                 case IGMPV3_ALLOW_NEW_SOURCES:
2352                 case IGMPV3_BLOCK_OLD_SOURCES:
2353                         break;
2354
2355                 default:
2356                         continue;
2357                 }
2358
2359                 src = eth_hdr(skb)->h_source;
2360                 if (nsrcs == 0 &&
2361                     (type == IGMPV3_CHANGE_TO_INCLUDE ||
2362                      type == IGMPV3_MODE_IS_INCLUDE)) {
2363                         if (!port || igmpv2) {
2364                                 br_ip4_multicast_leave_group(br, port, group, vid, src);
2365                                 continue;
2366                         }
2367                 } else {
2368                         err = br_ip4_multicast_add_group(br, port, group, vid,
2369                                                          src, igmpv2);
2370                         if (err)
2371                                 break;
2372                 }
2373
2374                 if (!port || igmpv2)
2375                         continue;
2376
2377                 spin_lock_bh(&br->multicast_lock);
2378                 mdst = br_mdb_ip4_get(br, group, vid);
2379                 if (!mdst)
2380                         goto unlock_continue;
2381                 pg = br_multicast_find_port(mdst, port, src);
2382                 if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2383                         goto unlock_continue;
2384                 /* reload grec and host addr */
2385                 grec = (void *)(skb->data + len - sizeof(*grec) - (nsrcs * 4));
2386                 h_addr = &ip_hdr(skb)->saddr;
2387                 switch (type) {
2388                 case IGMPV3_ALLOW_NEW_SOURCES:
2389                         changed = br_multicast_isinc_allow(pg, h_addr, grec->grec_src,
2390                                                            nsrcs, sizeof(__be32), type);
2391                         break;
2392                 case IGMPV3_MODE_IS_INCLUDE:
2393                         changed = br_multicast_isinc_allow(pg, h_addr, grec->grec_src,
2394                                                            nsrcs, sizeof(__be32), type);
2395                         break;
2396                 case IGMPV3_MODE_IS_EXCLUDE:
2397                         changed = br_multicast_isexc(pg, h_addr, grec->grec_src,
2398                                                      nsrcs, sizeof(__be32), type);
2399                         break;
2400                 case IGMPV3_CHANGE_TO_INCLUDE:
2401                         changed = br_multicast_toin(pg, h_addr, grec->grec_src,
2402                                                     nsrcs, sizeof(__be32), type);
2403                         break;
2404                 case IGMPV3_CHANGE_TO_EXCLUDE:
2405                         changed = br_multicast_toex(pg, h_addr, grec->grec_src,
2406                                                     nsrcs, sizeof(__be32), type);
2407                         break;
2408                 case IGMPV3_BLOCK_OLD_SOURCES:
2409                         changed = br_multicast_block(pg, h_addr, grec->grec_src,
2410                                                      nsrcs, sizeof(__be32), type);
2411                         break;
2412                 }
2413                 if (changed)
2414                         br_mdb_notify(br->dev, mdst, pg, RTM_NEWMDB);
2415 unlock_continue:
2416                 spin_unlock_bh(&br->multicast_lock);
2417         }
2418
2419         return err;
2420 }
2421
2422 #if IS_ENABLED(CONFIG_IPV6)
2423 static int br_ip6_multicast_mld2_report(struct net_bridge *br,
2424                                         struct net_bridge_port *port,
2425                                         struct sk_buff *skb,
2426                                         u16 vid)
2427 {
2428         bool mldv1 = br->multicast_mld_version == 1;
2429         struct net_bridge_mdb_entry *mdst;
2430         struct net_bridge_port_group *pg;
2431         unsigned int nsrcs_offset;
2432         const unsigned char *src;
2433         struct icmp6hdr *icmp6h;
2434         struct in6_addr *h_addr;
2435         struct mld2_grec *grec;
2436         unsigned int grec_len;
2437         bool changed = false;
2438         int i, len, num;
2439         int err = 0;
2440
2441         if (!ipv6_mc_may_pull(skb, sizeof(*icmp6h)))
2442                 return -EINVAL;
2443
2444         icmp6h = icmp6_hdr(skb);
2445         num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
2446         len = skb_transport_offset(skb) + sizeof(*icmp6h);
2447
2448         for (i = 0; i < num; i++) {
2449                 __be16 *_nsrcs, __nsrcs;
2450                 u16 nsrcs;
2451
2452                 nsrcs_offset = len + offsetof(struct mld2_grec, grec_nsrcs);
2453
2454                 if (skb_transport_offset(skb) + ipv6_transport_len(skb) <
2455                     nsrcs_offset + sizeof(__nsrcs))
2456                         return -EINVAL;
2457
2458                 _nsrcs = skb_header_pointer(skb, nsrcs_offset,
2459                                             sizeof(__nsrcs), &__nsrcs);
2460                 if (!_nsrcs)
2461                         return -EINVAL;
2462
2463                 nsrcs = ntohs(*_nsrcs);
2464                 grec_len = struct_size(grec, grec_src, nsrcs);
2465
2466                 if (!ipv6_mc_may_pull(skb, len + grec_len))
2467                         return -EINVAL;
2468
2469                 grec = (struct mld2_grec *)(skb->data + len);
2470                 len += grec_len;
2471
2472                 switch (grec->grec_type) {
2473                 case MLD2_MODE_IS_INCLUDE:
2474                 case MLD2_MODE_IS_EXCLUDE:
2475                 case MLD2_CHANGE_TO_INCLUDE:
2476                 case MLD2_CHANGE_TO_EXCLUDE:
2477                 case MLD2_ALLOW_NEW_SOURCES:
2478                 case MLD2_BLOCK_OLD_SOURCES:
2479                         break;
2480
2481                 default:
2482                         continue;
2483                 }
2484
2485                 src = eth_hdr(skb)->h_source;
2486                 if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
2487                      grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
2488                     nsrcs == 0) {
2489                         if (!port || mldv1) {
2490                                 br_ip6_multicast_leave_group(br, port,
2491                                                              &grec->grec_mca,
2492                                                              vid, src);
2493                                 continue;
2494                         }
2495                 } else {
2496                         err = br_ip6_multicast_add_group(br, port,
2497                                                          &grec->grec_mca, vid,
2498                                                          src, mldv1);
2499                         if (err)
2500                                 break;
2501                 }
2502
2503                 if (!port || mldv1)
2504                         continue;
2505
2506                 spin_lock_bh(&br->multicast_lock);
2507                 mdst = br_mdb_ip6_get(br, &grec->grec_mca, vid);
2508                 if (!mdst)
2509                         goto unlock_continue;
2510                 pg = br_multicast_find_port(mdst, port, src);
2511                 if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2512                         goto unlock_continue;
2513                 h_addr = &ipv6_hdr(skb)->saddr;
2514                 switch (grec->grec_type) {
2515                 case MLD2_ALLOW_NEW_SOURCES:
2516                         changed = br_multicast_isinc_allow(pg, h_addr,
2517                                                            grec->grec_src, nsrcs,
2518                                                            sizeof(struct in6_addr),
2519                                                            grec->grec_type);
2520                         break;
2521                 case MLD2_MODE_IS_INCLUDE:
2522                         changed = br_multicast_isinc_allow(pg, h_addr,
2523                                                            grec->grec_src, nsrcs,
2524                                                            sizeof(struct in6_addr),
2525                                                            grec->grec_type);
2526                         break;
2527                 case MLD2_MODE_IS_EXCLUDE:
2528                         changed = br_multicast_isexc(pg, h_addr,
2529                                                      grec->grec_src, nsrcs,
2530                                                      sizeof(struct in6_addr),
2531                                                      grec->grec_type);
2532                         break;
2533                 case MLD2_CHANGE_TO_INCLUDE:
2534                         changed = br_multicast_toin(pg, h_addr,
2535                                                     grec->grec_src, nsrcs,
2536                                                     sizeof(struct in6_addr),
2537                                                     grec->grec_type);
2538                         break;
2539                 case MLD2_CHANGE_TO_EXCLUDE:
2540                         changed = br_multicast_toex(pg, h_addr,
2541                                                     grec->grec_src, nsrcs,
2542                                                     sizeof(struct in6_addr),
2543                                                     grec->grec_type);
2544                         break;
2545                 case MLD2_BLOCK_OLD_SOURCES:
2546                         changed = br_multicast_block(pg, h_addr,
2547                                                      grec->grec_src, nsrcs,
2548                                                      sizeof(struct in6_addr),
2549                                                      grec->grec_type);
2550                         break;
2551                 }
2552                 if (changed)
2553                         br_mdb_notify(br->dev, mdst, pg, RTM_NEWMDB);
2554 unlock_continue:
2555                 spin_unlock_bh(&br->multicast_lock);
2556         }
2557
2558         return err;
2559 }
2560 #endif
2561
2562 static bool br_ip4_multicast_select_querier(struct net_bridge *br,
2563                                             struct net_bridge_port *port,
2564                                             __be32 saddr)
2565 {
2566         if (!timer_pending(&br->ip4_own_query.timer) &&
2567             !timer_pending(&br->ip4_other_query.timer))
2568                 goto update;
2569
2570         if (!br->ip4_querier.addr.src.ip4)
2571                 goto update;
2572
2573         if (ntohl(saddr) <= ntohl(br->ip4_querier.addr.src.ip4))
2574                 goto update;
2575
2576         return false;
2577
2578 update:
2579         br->ip4_querier.addr.src.ip4 = saddr;
2580
2581         /* update protected by general multicast_lock by caller */
2582         rcu_assign_pointer(br->ip4_querier.port, port);
2583
2584         return true;
2585 }
2586
2587 #if IS_ENABLED(CONFIG_IPV6)
2588 static bool br_ip6_multicast_select_querier(struct net_bridge *br,
2589                                             struct net_bridge_port *port,
2590                                             struct in6_addr *saddr)
2591 {
2592         if (!timer_pending(&br->ip6_own_query.timer) &&
2593             !timer_pending(&br->ip6_other_query.timer))
2594                 goto update;
2595
2596         if (ipv6_addr_cmp(saddr, &br->ip6_querier.addr.src.ip6) <= 0)
2597                 goto update;
2598
2599         return false;
2600
2601 update:
2602         br->ip6_querier.addr.src.ip6 = *saddr;
2603
2604         /* update protected by general multicast_lock by caller */
2605         rcu_assign_pointer(br->ip6_querier.port, port);
2606
2607         return true;
2608 }
2609 #endif
2610
2611 static bool br_multicast_select_querier(struct net_bridge *br,
2612                                         struct net_bridge_port *port,
2613                                         struct br_ip *saddr)
2614 {
2615         switch (saddr->proto) {
2616         case htons(ETH_P_IP):
2617                 return br_ip4_multicast_select_querier(br, port, saddr->src.ip4);
2618 #if IS_ENABLED(CONFIG_IPV6)
2619         case htons(ETH_P_IPV6):
2620                 return br_ip6_multicast_select_querier(br, port, &saddr->src.ip6);
2621 #endif
2622         }
2623
2624         return false;
2625 }
2626
2627 static void
2628 br_multicast_update_query_timer(struct net_bridge *br,
2629                                 struct bridge_mcast_other_query *query,
2630                                 unsigned long max_delay)
2631 {
2632         if (!timer_pending(&query->timer))
2633                 query->delay_time = jiffies + max_delay;
2634
2635         mod_timer(&query->timer, jiffies + br->multicast_querier_interval);
2636 }
2637
2638 static void br_port_mc_router_state_change(struct net_bridge_port *p,
2639                                            bool is_mc_router)
2640 {
2641         struct switchdev_attr attr = {
2642                 .orig_dev = p->dev,
2643                 .id = SWITCHDEV_ATTR_ID_PORT_MROUTER,
2644                 .flags = SWITCHDEV_F_DEFER,
2645                 .u.mrouter = is_mc_router,
2646         };
2647
2648         switchdev_port_attr_set(p->dev, &attr, NULL);
2649 }
2650
2651 /*
2652  * Add port to router_list
2653  *  list is maintained ordered by pointer value
2654  *  and locked by br->multicast_lock and RCU
2655  */
2656 static void br_multicast_add_router(struct net_bridge *br,
2657                                     struct net_bridge_port *port)
2658 {
2659         struct net_bridge_port *p;
2660         struct hlist_node *slot = NULL;
2661
2662         if (!hlist_unhashed(&port->rlist))
2663                 return;
2664
2665         hlist_for_each_entry(p, &br->router_list, rlist) {
2666                 if ((unsigned long) port >= (unsigned long) p)
2667                         break;
2668                 slot = &p->rlist;
2669         }
2670
2671         if (slot)
2672                 hlist_add_behind_rcu(&port->rlist, slot);
2673         else
2674                 hlist_add_head_rcu(&port->rlist, &br->router_list);
2675         br_rtr_notify(br->dev, port, RTM_NEWMDB);
2676         br_port_mc_router_state_change(port, true);
2677 }
2678
2679 static void br_multicast_mark_router(struct net_bridge *br,
2680                                      struct net_bridge_port *port)
2681 {
2682         unsigned long now = jiffies;
2683
2684         if (!port) {
2685                 if (br->multicast_router == MDB_RTR_TYPE_TEMP_QUERY) {
2686                         if (!timer_pending(&br->multicast_router_timer))
2687                                 br_mc_router_state_change(br, true);
2688                         mod_timer(&br->multicast_router_timer,
2689                                   now + br->multicast_querier_interval);
2690                 }
2691                 return;
2692         }
2693
2694         if (port->multicast_router == MDB_RTR_TYPE_DISABLED ||
2695             port->multicast_router == MDB_RTR_TYPE_PERM)
2696                 return;
2697
2698         br_multicast_add_router(br, port);
2699
2700         mod_timer(&port->multicast_router_timer,
2701                   now + br->multicast_querier_interval);
2702 }
2703
2704 static void br_multicast_query_received(struct net_bridge *br,
2705                                         struct net_bridge_port *port,
2706                                         struct bridge_mcast_other_query *query,
2707                                         struct br_ip *saddr,
2708                                         unsigned long max_delay)
2709 {
2710         if (!br_multicast_select_querier(br, port, saddr))
2711                 return;
2712
2713         br_multicast_update_query_timer(br, query, max_delay);
2714         br_multicast_mark_router(br, port);
2715 }
2716
2717 static void br_ip4_multicast_query(struct net_bridge *br,
2718                                    struct net_bridge_port *port,
2719                                    struct sk_buff *skb,
2720                                    u16 vid)
2721 {
2722         unsigned int transport_len = ip_transport_len(skb);
2723         const struct iphdr *iph = ip_hdr(skb);
2724         struct igmphdr *ih = igmp_hdr(skb);
2725         struct net_bridge_mdb_entry *mp;
2726         struct igmpv3_query *ih3;
2727         struct net_bridge_port_group *p;
2728         struct net_bridge_port_group __rcu **pp;
2729         struct br_ip saddr;
2730         unsigned long max_delay;
2731         unsigned long now = jiffies;
2732         __be32 group;
2733
2734         spin_lock(&br->multicast_lock);
2735         if (!netif_running(br->dev) ||
2736             (port && port->state == BR_STATE_DISABLED))
2737                 goto out;
2738
2739         group = ih->group;
2740
2741         if (transport_len == sizeof(*ih)) {
2742                 max_delay = ih->code * (HZ / IGMP_TIMER_SCALE);
2743
2744                 if (!max_delay) {
2745                         max_delay = 10 * HZ;
2746                         group = 0;
2747                 }
2748         } else if (transport_len >= sizeof(*ih3)) {
2749                 ih3 = igmpv3_query_hdr(skb);
2750                 if (ih3->nsrcs ||
2751                     (br->multicast_igmp_version == 3 && group && ih3->suppress))
2752                         goto out;
2753
2754                 max_delay = ih3->code ?
2755                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
2756         } else {
2757                 goto out;
2758         }
2759
2760         if (!group) {
2761                 saddr.proto = htons(ETH_P_IP);
2762                 saddr.src.ip4 = iph->saddr;
2763
2764                 br_multicast_query_received(br, port, &br->ip4_other_query,
2765                                             &saddr, max_delay);
2766                 goto out;
2767         }
2768
2769         mp = br_mdb_ip4_get(br, group, vid);
2770         if (!mp)
2771                 goto out;
2772
2773         max_delay *= br->multicast_last_member_count;
2774
2775         if (mp->host_joined &&
2776             (timer_pending(&mp->timer) ?
2777              time_after(mp->timer.expires, now + max_delay) :
2778              try_to_del_timer_sync(&mp->timer) >= 0))
2779                 mod_timer(&mp->timer, now + max_delay);
2780
2781         for (pp = &mp->ports;
2782              (p = mlock_dereference(*pp, br)) != NULL;
2783              pp = &p->next) {
2784                 if (timer_pending(&p->timer) ?
2785                     time_after(p->timer.expires, now + max_delay) :
2786                     try_to_del_timer_sync(&p->timer) >= 0 &&
2787                     (br->multicast_igmp_version == 2 ||
2788                      p->filter_mode == MCAST_EXCLUDE))
2789                         mod_timer(&p->timer, now + max_delay);
2790         }
2791
2792 out:
2793         spin_unlock(&br->multicast_lock);
2794 }
2795
2796 #if IS_ENABLED(CONFIG_IPV6)
2797 static int br_ip6_multicast_query(struct net_bridge *br,
2798                                   struct net_bridge_port *port,
2799                                   struct sk_buff *skb,
2800                                   u16 vid)
2801 {
2802         unsigned int transport_len = ipv6_transport_len(skb);
2803         struct mld_msg *mld;
2804         struct net_bridge_mdb_entry *mp;
2805         struct mld2_query *mld2q;
2806         struct net_bridge_port_group *p;
2807         struct net_bridge_port_group __rcu **pp;
2808         struct br_ip saddr;
2809         unsigned long max_delay;
2810         unsigned long now = jiffies;
2811         unsigned int offset = skb_transport_offset(skb);
2812         const struct in6_addr *group = NULL;
2813         bool is_general_query;
2814         int err = 0;
2815
2816         spin_lock(&br->multicast_lock);
2817         if (!netif_running(br->dev) ||
2818             (port && port->state == BR_STATE_DISABLED))
2819                 goto out;
2820
2821         if (transport_len == sizeof(*mld)) {
2822                 if (!pskb_may_pull(skb, offset + sizeof(*mld))) {
2823                         err = -EINVAL;
2824                         goto out;
2825                 }
2826                 mld = (struct mld_msg *) icmp6_hdr(skb);
2827                 max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
2828                 if (max_delay)
2829                         group = &mld->mld_mca;
2830         } else {
2831                 if (!pskb_may_pull(skb, offset + sizeof(*mld2q))) {
2832                         err = -EINVAL;
2833                         goto out;
2834                 }
2835                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
2836                 if (!mld2q->mld2q_nsrcs)
2837                         group = &mld2q->mld2q_mca;
2838                 if (br->multicast_mld_version == 2 &&
2839                     !ipv6_addr_any(&mld2q->mld2q_mca) &&
2840                     mld2q->mld2q_suppress)
2841                         goto out;
2842
2843                 max_delay = max(msecs_to_jiffies(mldv2_mrc(mld2q)), 1UL);
2844         }
2845
2846         is_general_query = group && ipv6_addr_any(group);
2847
2848         if (is_general_query) {
2849                 saddr.proto = htons(ETH_P_IPV6);
2850                 saddr.src.ip6 = ipv6_hdr(skb)->saddr;
2851
2852                 br_multicast_query_received(br, port, &br->ip6_other_query,
2853                                             &saddr, max_delay);
2854                 goto out;
2855         } else if (!group) {
2856                 goto out;
2857         }
2858
2859         mp = br_mdb_ip6_get(br, group, vid);
2860         if (!mp)
2861                 goto out;
2862
2863         max_delay *= br->multicast_last_member_count;
2864         if (mp->host_joined &&
2865             (timer_pending(&mp->timer) ?
2866              time_after(mp->timer.expires, now + max_delay) :
2867              try_to_del_timer_sync(&mp->timer) >= 0))
2868                 mod_timer(&mp->timer, now + max_delay);
2869
2870         for (pp = &mp->ports;
2871              (p = mlock_dereference(*pp, br)) != NULL;
2872              pp = &p->next) {
2873                 if (timer_pending(&p->timer) ?
2874                     time_after(p->timer.expires, now + max_delay) :
2875                     try_to_del_timer_sync(&p->timer) >= 0 &&
2876                     (br->multicast_mld_version == 1 ||
2877                      p->filter_mode == MCAST_EXCLUDE))
2878                         mod_timer(&p->timer, now + max_delay);
2879         }
2880
2881 out:
2882         spin_unlock(&br->multicast_lock);
2883         return err;
2884 }
2885 #endif
2886
2887 static void
2888 br_multicast_leave_group(struct net_bridge *br,
2889                          struct net_bridge_port *port,
2890                          struct br_ip *group,
2891                          struct bridge_mcast_other_query *other_query,
2892                          struct bridge_mcast_own_query *own_query,
2893                          const unsigned char *src)
2894 {
2895         struct net_bridge_mdb_entry *mp;
2896         struct net_bridge_port_group *p;
2897         unsigned long now;
2898         unsigned long time;
2899
2900         spin_lock(&br->multicast_lock);
2901         if (!netif_running(br->dev) ||
2902             (port && port->state == BR_STATE_DISABLED))
2903                 goto out;
2904
2905         mp = br_mdb_ip_get(br, group);
2906         if (!mp)
2907                 goto out;
2908
2909         if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
2910                 struct net_bridge_port_group __rcu **pp;
2911
2912                 for (pp = &mp->ports;
2913                      (p = mlock_dereference(*pp, br)) != NULL;
2914                      pp = &p->next) {
2915                         if (!br_port_group_equal(p, port, src))
2916                                 continue;
2917
2918                         if (p->flags & MDB_PG_FLAGS_PERMANENT)
2919                                 break;
2920
2921                         p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2922                         br_multicast_del_pg(mp, p, pp);
2923                 }
2924                 goto out;
2925         }
2926
2927         if (timer_pending(&other_query->timer))
2928                 goto out;
2929
2930         if (br_opt_get(br, BROPT_MULTICAST_QUERIER)) {
2931                 __br_multicast_send_query(br, port, NULL, NULL, &mp->addr,
2932                                           false, 0, NULL);
2933
2934                 time = jiffies + br->multicast_last_member_count *
2935                                  br->multicast_last_member_interval;
2936
2937                 mod_timer(&own_query->timer, time);
2938
2939                 for (p = mlock_dereference(mp->ports, br);
2940                      p != NULL;
2941                      p = mlock_dereference(p->next, br)) {
2942                         if (!br_port_group_equal(p, port, src))
2943                                 continue;
2944
2945                         if (!hlist_unhashed(&p->mglist) &&
2946                             (timer_pending(&p->timer) ?
2947                              time_after(p->timer.expires, time) :
2948                              try_to_del_timer_sync(&p->timer) >= 0)) {
2949                                 mod_timer(&p->timer, time);
2950                         }
2951
2952                         break;
2953                 }
2954         }
2955
2956         now = jiffies;
2957         time = now + br->multicast_last_member_count *
2958                      br->multicast_last_member_interval;
2959
2960         if (!port) {
2961                 if (mp->host_joined &&
2962                     (timer_pending(&mp->timer) ?
2963                      time_after(mp->timer.expires, time) :
2964                      try_to_del_timer_sync(&mp->timer) >= 0)) {
2965                         mod_timer(&mp->timer, time);
2966                 }
2967
2968                 goto out;
2969         }
2970
2971         for (p = mlock_dereference(mp->ports, br);
2972              p != NULL;
2973              p = mlock_dereference(p->next, br)) {
2974                 if (p->key.port != port)
2975                         continue;
2976
2977                 if (!hlist_unhashed(&p->mglist) &&
2978                     (timer_pending(&p->timer) ?
2979                      time_after(p->timer.expires, time) :
2980                      try_to_del_timer_sync(&p->timer) >= 0)) {
2981                         mod_timer(&p->timer, time);
2982                 }
2983
2984                 break;
2985         }
2986 out:
2987         spin_unlock(&br->multicast_lock);
2988 }
2989
2990 static void br_ip4_multicast_leave_group(struct net_bridge *br,
2991                                          struct net_bridge_port *port,
2992                                          __be32 group,
2993                                          __u16 vid,
2994                                          const unsigned char *src)
2995 {
2996         struct br_ip br_group;
2997         struct bridge_mcast_own_query *own_query;
2998
2999         if (ipv4_is_local_multicast(group))
3000                 return;
3001
3002         own_query = port ? &port->ip4_own_query : &br->ip4_own_query;
3003
3004         memset(&br_group, 0, sizeof(br_group));
3005         br_group.dst.ip4 = group;
3006         br_group.proto = htons(ETH_P_IP);
3007         br_group.vid = vid;
3008
3009         br_multicast_leave_group(br, port, &br_group, &br->ip4_other_query,
3010                                  own_query, src);
3011 }
3012
3013 #if IS_ENABLED(CONFIG_IPV6)
3014 static void br_ip6_multicast_leave_group(struct net_bridge *br,
3015                                          struct net_bridge_port *port,
3016                                          const struct in6_addr *group,
3017                                          __u16 vid,
3018                                          const unsigned char *src)
3019 {
3020         struct br_ip br_group;
3021         struct bridge_mcast_own_query *own_query;
3022
3023         if (ipv6_addr_is_ll_all_nodes(group))
3024                 return;
3025
3026         own_query = port ? &port->ip6_own_query : &br->ip6_own_query;
3027
3028         memset(&br_group, 0, sizeof(br_group));
3029         br_group.dst.ip6 = *group;
3030         br_group.proto = htons(ETH_P_IPV6);
3031         br_group.vid = vid;
3032
3033         br_multicast_leave_group(br, port, &br_group, &br->ip6_other_query,
3034                                  own_query, src);
3035 }
3036 #endif
3037
3038 static void br_multicast_err_count(const struct net_bridge *br,
3039                                    const struct net_bridge_port *p,
3040                                    __be16 proto)
3041 {
3042         struct bridge_mcast_stats __percpu *stats;
3043         struct bridge_mcast_stats *pstats;
3044
3045         if (!br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
3046                 return;
3047
3048         if (p)
3049                 stats = p->mcast_stats;
3050         else
3051                 stats = br->mcast_stats;
3052         if (WARN_ON(!stats))
3053                 return;
3054
3055         pstats = this_cpu_ptr(stats);
3056
3057         u64_stats_update_begin(&pstats->syncp);
3058         switch (proto) {
3059         case htons(ETH_P_IP):
3060                 pstats->mstats.igmp_parse_errors++;
3061                 break;
3062 #if IS_ENABLED(CONFIG_IPV6)
3063         case htons(ETH_P_IPV6):
3064                 pstats->mstats.mld_parse_errors++;
3065                 break;
3066 #endif
3067         }
3068         u64_stats_update_end(&pstats->syncp);
3069 }
3070
3071 static void br_multicast_pim(struct net_bridge *br,
3072                              struct net_bridge_port *port,
3073                              const struct sk_buff *skb)
3074 {
3075         unsigned int offset = skb_transport_offset(skb);
3076         struct pimhdr *pimhdr, _pimhdr;
3077
3078         pimhdr = skb_header_pointer(skb, offset, sizeof(_pimhdr), &_pimhdr);
3079         if (!pimhdr || pim_hdr_version(pimhdr) != PIM_VERSION ||
3080             pim_hdr_type(pimhdr) != PIM_TYPE_HELLO)
3081                 return;
3082
3083         br_multicast_mark_router(br, port);
3084 }
3085
3086 static int br_ip4_multicast_mrd_rcv(struct net_bridge *br,
3087                                     struct net_bridge_port *port,
3088                                     struct sk_buff *skb)
3089 {
3090         if (ip_hdr(skb)->protocol != IPPROTO_IGMP ||
3091             igmp_hdr(skb)->type != IGMP_MRDISC_ADV)
3092                 return -ENOMSG;
3093
3094         br_multicast_mark_router(br, port);
3095
3096         return 0;
3097 }
3098
3099 static int br_multicast_ipv4_rcv(struct net_bridge *br,
3100                                  struct net_bridge_port *port,
3101                                  struct sk_buff *skb,
3102                                  u16 vid)
3103 {
3104         const unsigned char *src;
3105         struct igmphdr *ih;
3106         int err;
3107
3108         err = ip_mc_check_igmp(skb);
3109
3110         if (err == -ENOMSG) {
3111                 if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
3112                         BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3113                 } else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
3114                         if (ip_hdr(skb)->protocol == IPPROTO_PIM)
3115                                 br_multicast_pim(br, port, skb);
3116                 } else if (ipv4_is_all_snoopers(ip_hdr(skb)->daddr)) {
3117                         br_ip4_multicast_mrd_rcv(br, port, skb);
3118                 }
3119
3120                 return 0;
3121         } else if (err < 0) {
3122                 br_multicast_err_count(br, port, skb->protocol);
3123                 return err;
3124         }
3125
3126         ih = igmp_hdr(skb);
3127         src = eth_hdr(skb)->h_source;
3128         BR_INPUT_SKB_CB(skb)->igmp = ih->type;
3129
3130         switch (ih->type) {
3131         case IGMP_HOST_MEMBERSHIP_REPORT:
3132         case IGMPV2_HOST_MEMBERSHIP_REPORT:
3133                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3134                 err = br_ip4_multicast_add_group(br, port, ih->group, vid, src,
3135                                                  true);
3136                 break;
3137         case IGMPV3_HOST_MEMBERSHIP_REPORT:
3138                 err = br_ip4_multicast_igmp3_report(br, port, skb, vid);
3139                 break;
3140         case IGMP_HOST_MEMBERSHIP_QUERY:
3141                 br_ip4_multicast_query(br, port, skb, vid);
3142                 break;
3143         case IGMP_HOST_LEAVE_MESSAGE:
3144                 br_ip4_multicast_leave_group(br, port, ih->group, vid, src);
3145                 break;
3146         }
3147
3148         br_multicast_count(br, port, skb, BR_INPUT_SKB_CB(skb)->igmp,
3149                            BR_MCAST_DIR_RX);
3150
3151         return err;
3152 }
3153
3154 #if IS_ENABLED(CONFIG_IPV6)
3155 static int br_ip6_multicast_mrd_rcv(struct net_bridge *br,
3156                                     struct net_bridge_port *port,
3157                                     struct sk_buff *skb)
3158 {
3159         int ret;
3160
3161         if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6)
3162                 return -ENOMSG;
3163
3164         ret = ipv6_mc_check_icmpv6(skb);
3165         if (ret < 0)
3166                 return ret;
3167
3168         if (icmp6_hdr(skb)->icmp6_type != ICMPV6_MRDISC_ADV)
3169                 return -ENOMSG;
3170
3171         br_multicast_mark_router(br, port);
3172
3173         return 0;
3174 }
3175
3176 static int br_multicast_ipv6_rcv(struct net_bridge *br,
3177                                  struct net_bridge_port *port,
3178                                  struct sk_buff *skb,
3179                                  u16 vid)
3180 {
3181         const unsigned char *src;
3182         struct mld_msg *mld;
3183         int err;
3184
3185         err = ipv6_mc_check_mld(skb);
3186
3187         if (err == -ENOMSG) {
3188                 if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
3189                         BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3190
3191                 if (ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr)) {
3192                         err = br_ip6_multicast_mrd_rcv(br, port, skb);
3193
3194                         if (err < 0 && err != -ENOMSG) {
3195                                 br_multicast_err_count(br, port, skb->protocol);
3196                                 return err;
3197                         }
3198                 }
3199
3200                 return 0;
3201         } else if (err < 0) {
3202                 br_multicast_err_count(br, port, skb->protocol);
3203                 return err;
3204         }
3205
3206         mld = (struct mld_msg *)skb_transport_header(skb);
3207         BR_INPUT_SKB_CB(skb)->igmp = mld->mld_type;
3208
3209         switch (mld->mld_type) {
3210         case ICMPV6_MGM_REPORT:
3211                 src = eth_hdr(skb)->h_source;
3212                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3213                 err = br_ip6_multicast_add_group(br, port, &mld->mld_mca, vid,
3214                                                  src, true);
3215                 break;
3216         case ICMPV6_MLD2_REPORT:
3217                 err = br_ip6_multicast_mld2_report(br, port, skb, vid);
3218                 break;
3219         case ICMPV6_MGM_QUERY:
3220                 err = br_ip6_multicast_query(br, port, skb, vid);
3221                 break;
3222         case ICMPV6_MGM_REDUCTION:
3223                 src = eth_hdr(skb)->h_source;
3224                 br_ip6_multicast_leave_group(br, port, &mld->mld_mca, vid, src);
3225                 break;
3226         }
3227
3228         br_multicast_count(br, port, skb, BR_INPUT_SKB_CB(skb)->igmp,
3229                            BR_MCAST_DIR_RX);
3230
3231         return err;
3232 }
3233 #endif
3234
3235 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
3236                      struct sk_buff *skb, u16 vid)
3237 {
3238         int ret = 0;
3239
3240         BR_INPUT_SKB_CB(skb)->igmp = 0;
3241         BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
3242
3243         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
3244                 return 0;
3245
3246         switch (skb->protocol) {
3247         case htons(ETH_P_IP):
3248                 ret = br_multicast_ipv4_rcv(br, port, skb, vid);
3249                 break;
3250 #if IS_ENABLED(CONFIG_IPV6)
3251         case htons(ETH_P_IPV6):
3252                 ret = br_multicast_ipv6_rcv(br, port, skb, vid);
3253                 break;
3254 #endif
3255         }
3256
3257         return ret;
3258 }
3259
3260 static void br_multicast_query_expired(struct net_bridge *br,
3261                                        struct bridge_mcast_own_query *query,
3262                                        struct bridge_mcast_querier *querier)
3263 {
3264         spin_lock(&br->multicast_lock);
3265         if (query->startup_sent < br->multicast_startup_query_count)
3266                 query->startup_sent++;
3267
3268         RCU_INIT_POINTER(querier->port, NULL);
3269         br_multicast_send_query(br, NULL, query);
3270         spin_unlock(&br->multicast_lock);
3271 }
3272
3273 static void br_ip4_multicast_query_expired(struct timer_list *t)
3274 {
3275         struct net_bridge *br = from_timer(br, t, ip4_own_query.timer);
3276
3277         br_multicast_query_expired(br, &br->ip4_own_query, &br->ip4_querier);
3278 }
3279
3280 #if IS_ENABLED(CONFIG_IPV6)
3281 static void br_ip6_multicast_query_expired(struct timer_list *t)
3282 {
3283         struct net_bridge *br = from_timer(br, t, ip6_own_query.timer);
3284
3285         br_multicast_query_expired(br, &br->ip6_own_query, &br->ip6_querier);
3286 }
3287 #endif
3288
3289 static void br_multicast_gc_work(struct work_struct *work)
3290 {
3291         struct net_bridge *br = container_of(work, struct net_bridge,
3292                                              mcast_gc_work);
3293         HLIST_HEAD(deleted_head);
3294
3295         spin_lock_bh(&br->multicast_lock);
3296         hlist_move_list(&br->mcast_gc_list, &deleted_head);
3297         spin_unlock_bh(&br->multicast_lock);
3298
3299         br_multicast_gc(&deleted_head);
3300 }
3301
3302 void br_multicast_init(struct net_bridge *br)
3303 {
3304         br->hash_max = BR_MULTICAST_DEFAULT_HASH_MAX;
3305
3306         br->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3307         br->multicast_last_member_count = 2;
3308         br->multicast_startup_query_count = 2;
3309
3310         br->multicast_last_member_interval = HZ;
3311         br->multicast_query_response_interval = 10 * HZ;
3312         br->multicast_startup_query_interval = 125 * HZ / 4;
3313         br->multicast_query_interval = 125 * HZ;
3314         br->multicast_querier_interval = 255 * HZ;
3315         br->multicast_membership_interval = 260 * HZ;
3316
3317         br->ip4_other_query.delay_time = 0;
3318         br->ip4_querier.port = NULL;
3319         br->multicast_igmp_version = 2;
3320 #if IS_ENABLED(CONFIG_IPV6)
3321         br->multicast_mld_version = 1;
3322         br->ip6_other_query.delay_time = 0;
3323         br->ip6_querier.port = NULL;
3324 #endif
3325         br_opt_toggle(br, BROPT_MULTICAST_ENABLED, true);
3326         br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
3327
3328         spin_lock_init(&br->multicast_lock);
3329         timer_setup(&br->multicast_router_timer,
3330                     br_multicast_local_router_expired, 0);
3331         timer_setup(&br->ip4_other_query.timer,
3332                     br_ip4_multicast_querier_expired, 0);
3333         timer_setup(&br->ip4_own_query.timer,
3334                     br_ip4_multicast_query_expired, 0);
3335 #if IS_ENABLED(CONFIG_IPV6)
3336         timer_setup(&br->ip6_other_query.timer,
3337                     br_ip6_multicast_querier_expired, 0);
3338         timer_setup(&br->ip6_own_query.timer,
3339                     br_ip6_multicast_query_expired, 0);
3340 #endif
3341         INIT_HLIST_HEAD(&br->mdb_list);
3342         INIT_HLIST_HEAD(&br->mcast_gc_list);
3343         INIT_WORK(&br->mcast_gc_work, br_multicast_gc_work);
3344 }
3345
3346 static void br_ip4_multicast_join_snoopers(struct net_bridge *br)
3347 {
3348         struct in_device *in_dev = in_dev_get(br->dev);
3349
3350         if (!in_dev)
3351                 return;
3352
3353         __ip_mc_inc_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
3354         in_dev_put(in_dev);
3355 }
3356
3357 #if IS_ENABLED(CONFIG_IPV6)
3358 static void br_ip6_multicast_join_snoopers(struct net_bridge *br)
3359 {
3360         struct in6_addr addr;
3361
3362         ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
3363         ipv6_dev_mc_inc(br->dev, &addr);
3364 }
3365 #else
3366 static inline void br_ip6_multicast_join_snoopers(struct net_bridge *br)
3367 {
3368 }
3369 #endif
3370
3371 void br_multicast_join_snoopers(struct net_bridge *br)
3372 {
3373         br_ip4_multicast_join_snoopers(br);
3374         br_ip6_multicast_join_snoopers(br);
3375 }
3376
3377 static void br_ip4_multicast_leave_snoopers(struct net_bridge *br)
3378 {
3379         struct in_device *in_dev = in_dev_get(br->dev);
3380
3381         if (WARN_ON(!in_dev))
3382                 return;
3383
3384         __ip_mc_dec_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
3385         in_dev_put(in_dev);
3386 }
3387
3388 #if IS_ENABLED(CONFIG_IPV6)
3389 static void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
3390 {
3391         struct in6_addr addr;
3392
3393         ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
3394         ipv6_dev_mc_dec(br->dev, &addr);
3395 }
3396 #else
3397 static inline void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
3398 {
3399 }
3400 #endif
3401
3402 void br_multicast_leave_snoopers(struct net_bridge *br)
3403 {
3404         br_ip4_multicast_leave_snoopers(br);
3405         br_ip6_multicast_leave_snoopers(br);
3406 }
3407
3408 static void __br_multicast_open(struct net_bridge *br,
3409                                 struct bridge_mcast_own_query *query)
3410 {
3411         query->startup_sent = 0;
3412
3413         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
3414                 return;
3415
3416         mod_timer(&query->timer, jiffies);
3417 }
3418
3419 void br_multicast_open(struct net_bridge *br)
3420 {
3421         __br_multicast_open(br, &br->ip4_own_query);
3422 #if IS_ENABLED(CONFIG_IPV6)
3423         __br_multicast_open(br, &br->ip6_own_query);
3424 #endif
3425 }
3426
3427 void br_multicast_stop(struct net_bridge *br)
3428 {
3429         del_timer_sync(&br->multicast_router_timer);
3430         del_timer_sync(&br->ip4_other_query.timer);
3431         del_timer_sync(&br->ip4_own_query.timer);
3432 #if IS_ENABLED(CONFIG_IPV6)
3433         del_timer_sync(&br->ip6_other_query.timer);
3434         del_timer_sync(&br->ip6_own_query.timer);
3435 #endif
3436 }
3437
3438 void br_multicast_dev_del(struct net_bridge *br)
3439 {
3440         struct net_bridge_mdb_entry *mp;
3441         HLIST_HEAD(deleted_head);
3442         struct hlist_node *tmp;
3443
3444         spin_lock_bh(&br->multicast_lock);
3445         hlist_for_each_entry_safe(mp, tmp, &br->mdb_list, mdb_node)
3446                 br_multicast_del_mdb_entry(mp);
3447         hlist_move_list(&br->mcast_gc_list, &deleted_head);
3448         spin_unlock_bh(&br->multicast_lock);
3449
3450         br_multicast_gc(&deleted_head);
3451         cancel_work_sync(&br->mcast_gc_work);
3452
3453         rcu_barrier();
3454 }
3455
3456 int br_multicast_set_router(struct net_bridge *br, unsigned long val)
3457 {
3458         int err = -EINVAL;
3459
3460         spin_lock_bh(&br->multicast_lock);
3461
3462         switch (val) {
3463         case MDB_RTR_TYPE_DISABLED:
3464         case MDB_RTR_TYPE_PERM:
3465                 br_mc_router_state_change(br, val == MDB_RTR_TYPE_PERM);
3466                 del_timer(&br->multicast_router_timer);
3467                 br->multicast_router = val;
3468                 err = 0;
3469                 break;
3470         case MDB_RTR_TYPE_TEMP_QUERY:
3471                 if (br->multicast_router != MDB_RTR_TYPE_TEMP_QUERY)
3472                         br_mc_router_state_change(br, false);
3473                 br->multicast_router = val;
3474                 err = 0;
3475                 break;
3476         }
3477
3478         spin_unlock_bh(&br->multicast_lock);
3479
3480         return err;
3481 }
3482
3483 static void __del_port_router(struct net_bridge_port *p)
3484 {
3485         if (hlist_unhashed(&p->rlist))
3486                 return;
3487         hlist_del_init_rcu(&p->rlist);
3488         br_rtr_notify(p->br->dev, p, RTM_DELMDB);
3489         br_port_mc_router_state_change(p, false);
3490
3491         /* don't allow timer refresh */
3492         if (p->multicast_router == MDB_RTR_TYPE_TEMP)
3493                 p->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3494 }
3495
3496 int br_multicast_set_port_router(struct net_bridge_port *p, unsigned long val)
3497 {
3498         struct net_bridge *br = p->br;
3499         unsigned long now = jiffies;
3500         int err = -EINVAL;
3501
3502         spin_lock(&br->multicast_lock);
3503         if (p->multicast_router == val) {
3504                 /* Refresh the temp router port timer */
3505                 if (p->multicast_router == MDB_RTR_TYPE_TEMP)
3506                         mod_timer(&p->multicast_router_timer,
3507                                   now + br->multicast_querier_interval);
3508                 err = 0;
3509                 goto unlock;
3510         }
3511         switch (val) {
3512         case MDB_RTR_TYPE_DISABLED:
3513                 p->multicast_router = MDB_RTR_TYPE_DISABLED;
3514                 __del_port_router(p);
3515                 del_timer(&p->multicast_router_timer);
3516                 break;
3517         case MDB_RTR_TYPE_TEMP_QUERY:
3518                 p->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3519                 __del_port_router(p);
3520                 break;
3521         case MDB_RTR_TYPE_PERM:
3522                 p->multicast_router = MDB_RTR_TYPE_PERM;
3523                 del_timer(&p->multicast_router_timer);
3524                 br_multicast_add_router(br, p);
3525                 break;
3526         case MDB_RTR_TYPE_TEMP:
3527                 p->multicast_router = MDB_RTR_TYPE_TEMP;
3528                 br_multicast_mark_router(br, p);
3529                 break;
3530         default:
3531                 goto unlock;
3532         }
3533         err = 0;
3534 unlock:
3535         spin_unlock(&br->multicast_lock);
3536
3537         return err;
3538 }
3539
3540 static void br_multicast_start_querier(struct net_bridge *br,
3541                                        struct bridge_mcast_own_query *query)
3542 {
3543         struct net_bridge_port *port;
3544
3545         __br_multicast_open(br, query);
3546
3547         rcu_read_lock();
3548         list_for_each_entry_rcu(port, &br->port_list, list) {
3549                 if (port->state == BR_STATE_DISABLED ||
3550                     port->state == BR_STATE_BLOCKING)
3551                         continue;
3552
3553                 if (query == &br->ip4_own_query)
3554                         br_multicast_enable(&port->ip4_own_query);
3555 #if IS_ENABLED(CONFIG_IPV6)
3556                 else
3557                         br_multicast_enable(&port->ip6_own_query);
3558 #endif
3559         }
3560         rcu_read_unlock();
3561 }
3562
3563 int br_multicast_toggle(struct net_bridge *br, unsigned long val)
3564 {
3565         struct net_bridge_port *port;
3566         bool change_snoopers = false;
3567
3568         spin_lock_bh(&br->multicast_lock);
3569         if (!!br_opt_get(br, BROPT_MULTICAST_ENABLED) == !!val)
3570                 goto unlock;
3571
3572         br_mc_disabled_update(br->dev, val);
3573         br_opt_toggle(br, BROPT_MULTICAST_ENABLED, !!val);
3574         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED)) {
3575                 change_snoopers = true;
3576                 goto unlock;
3577         }
3578
3579         if (!netif_running(br->dev))
3580                 goto unlock;
3581
3582         br_multicast_open(br);
3583         list_for_each_entry(port, &br->port_list, list)
3584                 __br_multicast_enable_port(port);
3585
3586         change_snoopers = true;
3587
3588 unlock:
3589         spin_unlock_bh(&br->multicast_lock);
3590
3591         /* br_multicast_join_snoopers has the potential to cause
3592          * an MLD Report/Leave to be delivered to br_multicast_rcv,
3593          * which would in turn call br_multicast_add_group, which would
3594          * attempt to acquire multicast_lock. This function should be
3595          * called after the lock has been released to avoid deadlocks on
3596          * multicast_lock.
3597          *
3598          * br_multicast_leave_snoopers does not have the problem since
3599          * br_multicast_rcv first checks BROPT_MULTICAST_ENABLED, and
3600          * returns without calling br_multicast_ipv4/6_rcv if it's not
3601          * enabled. Moved both functions out just for symmetry.
3602          */
3603         if (change_snoopers) {
3604                 if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
3605                         br_multicast_join_snoopers(br);
3606                 else
3607                         br_multicast_leave_snoopers(br);
3608         }
3609
3610         return 0;
3611 }
3612
3613 bool br_multicast_enabled(const struct net_device *dev)
3614 {
3615         struct net_bridge *br = netdev_priv(dev);
3616
3617         return !!br_opt_get(br, BROPT_MULTICAST_ENABLED);
3618 }
3619 EXPORT_SYMBOL_GPL(br_multicast_enabled);
3620
3621 bool br_multicast_router(const struct net_device *dev)
3622 {
3623         struct net_bridge *br = netdev_priv(dev);
3624         bool is_router;
3625
3626         spin_lock_bh(&br->multicast_lock);
3627         is_router = br_multicast_is_router(br);
3628         spin_unlock_bh(&br->multicast_lock);
3629         return is_router;
3630 }
3631 EXPORT_SYMBOL_GPL(br_multicast_router);
3632
3633 int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
3634 {
3635         unsigned long max_delay;
3636
3637         val = !!val;
3638
3639         spin_lock_bh(&br->multicast_lock);
3640         if (br_opt_get(br, BROPT_MULTICAST_QUERIER) == val)
3641                 goto unlock;
3642
3643         br_opt_toggle(br, BROPT_MULTICAST_QUERIER, !!val);
3644         if (!val)
3645                 goto unlock;
3646
3647         max_delay = br->multicast_query_response_interval;
3648
3649         if (!timer_pending(&br->ip4_other_query.timer))
3650                 br->ip4_other_query.delay_time = jiffies + max_delay;
3651
3652         br_multicast_start_querier(br, &br->ip4_own_query);
3653
3654 #if IS_ENABLED(CONFIG_IPV6)
3655         if (!timer_pending(&br->ip6_other_query.timer))
3656                 br->ip6_other_query.delay_time = jiffies + max_delay;
3657
3658         br_multicast_start_querier(br, &br->ip6_own_query);
3659 #endif
3660
3661 unlock:
3662         spin_unlock_bh(&br->multicast_lock);
3663
3664         return 0;
3665 }
3666
3667 int br_multicast_set_igmp_version(struct net_bridge *br, unsigned long val)
3668 {
3669         /* Currently we support only version 2 and 3 */
3670         switch (val) {
3671         case 2:
3672         case 3:
3673                 break;
3674         default:
3675                 return -EINVAL;
3676         }
3677
3678         spin_lock_bh(&br->multicast_lock);
3679         br->multicast_igmp_version = val;
3680         spin_unlock_bh(&br->multicast_lock);
3681
3682         return 0;
3683 }
3684
3685 #if IS_ENABLED(CONFIG_IPV6)
3686 int br_multicast_set_mld_version(struct net_bridge *br, unsigned long val)
3687 {
3688         /* Currently we support version 1 and 2 */
3689         switch (val) {
3690         case 1:
3691         case 2:
3692                 break;
3693         default:
3694                 return -EINVAL;
3695         }
3696
3697         spin_lock_bh(&br->multicast_lock);
3698         br->multicast_mld_version = val;
3699         spin_unlock_bh(&br->multicast_lock);
3700
3701         return 0;
3702 }
3703 #endif
3704
3705 /**
3706  * br_multicast_list_adjacent - Returns snooped multicast addresses
3707  * @dev:        The bridge port adjacent to which to retrieve addresses
3708  * @br_ip_list: The list to store found, snooped multicast IP addresses in
3709  *
3710  * Creates a list of IP addresses (struct br_ip_list) sensed by the multicast
3711  * snooping feature on all bridge ports of dev's bridge device, excluding
3712  * the addresses from dev itself.
3713  *
3714  * Returns the number of items added to br_ip_list.
3715  *
3716  * Notes:
3717  * - br_ip_list needs to be initialized by caller
3718  * - br_ip_list might contain duplicates in the end
3719  *   (needs to be taken care of by caller)
3720  * - br_ip_list needs to be freed by caller
3721  */
3722 int br_multicast_list_adjacent(struct net_device *dev,
3723                                struct list_head *br_ip_list)
3724 {
3725         struct net_bridge *br;
3726         struct net_bridge_port *port;
3727         struct net_bridge_port_group *group;
3728         struct br_ip_list *entry;
3729         int count = 0;
3730
3731         rcu_read_lock();
3732         if (!br_ip_list || !netif_is_bridge_port(dev))
3733                 goto unlock;
3734
3735         port = br_port_get_rcu(dev);
3736         if (!port || !port->br)
3737                 goto unlock;
3738
3739         br = port->br;
3740
3741         list_for_each_entry_rcu(port, &br->port_list, list) {
3742                 if (!port->dev || port->dev == dev)
3743                         continue;
3744
3745                 hlist_for_each_entry_rcu(group, &port->mglist, mglist) {
3746                         entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
3747                         if (!entry)
3748                                 goto unlock;
3749
3750                         entry->addr = group->key.addr;
3751                         list_add(&entry->list, br_ip_list);
3752                         count++;
3753                 }
3754         }
3755
3756 unlock:
3757         rcu_read_unlock();
3758         return count;
3759 }
3760 EXPORT_SYMBOL_GPL(br_multicast_list_adjacent);
3761
3762 /**
3763  * br_multicast_has_querier_anywhere - Checks for a querier on a bridge
3764  * @dev: The bridge port providing the bridge on which to check for a querier
3765  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
3766  *
3767  * Checks whether the given interface has a bridge on top and if so returns
3768  * true if a valid querier exists anywhere on the bridged link layer.
3769  * Otherwise returns false.
3770  */
3771 bool br_multicast_has_querier_anywhere(struct net_device *dev, int proto)
3772 {
3773         struct net_bridge *br;
3774         struct net_bridge_port *port;
3775         struct ethhdr eth;
3776         bool ret = false;
3777
3778         rcu_read_lock();
3779         if (!netif_is_bridge_port(dev))
3780                 goto unlock;
3781
3782         port = br_port_get_rcu(dev);
3783         if (!port || !port->br)
3784                 goto unlock;
3785
3786         br = port->br;
3787
3788         memset(&eth, 0, sizeof(eth));
3789         eth.h_proto = htons(proto);
3790
3791         ret = br_multicast_querier_exists(br, &eth, NULL);
3792
3793 unlock:
3794         rcu_read_unlock();
3795         return ret;
3796 }
3797 EXPORT_SYMBOL_GPL(br_multicast_has_querier_anywhere);
3798
3799 /**
3800  * br_multicast_has_querier_adjacent - Checks for a querier behind a bridge port
3801  * @dev: The bridge port adjacent to which to check for a querier
3802  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
3803  *
3804  * Checks whether the given interface has a bridge on top and if so returns
3805  * true if a selected querier is behind one of the other ports of this
3806  * bridge. Otherwise returns false.
3807  */
3808 bool br_multicast_has_querier_adjacent(struct net_device *dev, int proto)
3809 {
3810         struct net_bridge *br;
3811         struct net_bridge_port *port;
3812         bool ret = false;
3813
3814         rcu_read_lock();
3815         if (!netif_is_bridge_port(dev))
3816                 goto unlock;
3817
3818         port = br_port_get_rcu(dev);
3819         if (!port || !port->br)
3820                 goto unlock;
3821
3822         br = port->br;
3823
3824         switch (proto) {
3825         case ETH_P_IP:
3826                 if (!timer_pending(&br->ip4_other_query.timer) ||
3827                     rcu_dereference(br->ip4_querier.port) == port)
3828                         goto unlock;
3829                 break;
3830 #if IS_ENABLED(CONFIG_IPV6)
3831         case ETH_P_IPV6:
3832                 if (!timer_pending(&br->ip6_other_query.timer) ||
3833                     rcu_dereference(br->ip6_querier.port) == port)
3834                         goto unlock;
3835                 break;
3836 #endif
3837         default:
3838                 goto unlock;
3839         }
3840
3841         ret = true;
3842 unlock:
3843         rcu_read_unlock();
3844         return ret;
3845 }
3846 EXPORT_SYMBOL_GPL(br_multicast_has_querier_adjacent);
3847
3848 static void br_mcast_stats_add(struct bridge_mcast_stats __percpu *stats,
3849                                const struct sk_buff *skb, u8 type, u8 dir)
3850 {
3851         struct bridge_mcast_stats *pstats = this_cpu_ptr(stats);
3852         __be16 proto = skb->protocol;
3853         unsigned int t_len;
3854
3855         u64_stats_update_begin(&pstats->syncp);
3856         switch (proto) {
3857         case htons(ETH_P_IP):
3858                 t_len = ntohs(ip_hdr(skb)->tot_len) - ip_hdrlen(skb);
3859                 switch (type) {
3860                 case IGMP_HOST_MEMBERSHIP_REPORT:
3861                         pstats->mstats.igmp_v1reports[dir]++;
3862                         break;
3863                 case IGMPV2_HOST_MEMBERSHIP_REPORT:
3864                         pstats->mstats.igmp_v2reports[dir]++;
3865                         break;
3866                 case IGMPV3_HOST_MEMBERSHIP_REPORT:
3867                         pstats->mstats.igmp_v3reports[dir]++;
3868                         break;
3869                 case IGMP_HOST_MEMBERSHIP_QUERY:
3870                         if (t_len != sizeof(struct igmphdr)) {
3871                                 pstats->mstats.igmp_v3queries[dir]++;
3872                         } else {
3873                                 unsigned int offset = skb_transport_offset(skb);
3874                                 struct igmphdr *ih, _ihdr;
3875
3876                                 ih = skb_header_pointer(skb, offset,
3877                                                         sizeof(_ihdr), &_ihdr);
3878                                 if (!ih)
3879                                         break;
3880                                 if (!ih->code)
3881                                         pstats->mstats.igmp_v1queries[dir]++;
3882                                 else
3883                                         pstats->mstats.igmp_v2queries[dir]++;
3884                         }
3885                         break;
3886                 case IGMP_HOST_LEAVE_MESSAGE:
3887                         pstats->mstats.igmp_leaves[dir]++;
3888                         break;
3889                 }
3890                 break;
3891 #if IS_ENABLED(CONFIG_IPV6)
3892         case htons(ETH_P_IPV6):
3893                 t_len = ntohs(ipv6_hdr(skb)->payload_len) +
3894                         sizeof(struct ipv6hdr);
3895                 t_len -= skb_network_header_len(skb);
3896                 switch (type) {
3897                 case ICMPV6_MGM_REPORT:
3898                         pstats->mstats.mld_v1reports[dir]++;
3899                         break;
3900                 case ICMPV6_MLD2_REPORT:
3901                         pstats->mstats.mld_v2reports[dir]++;
3902                         break;
3903                 case ICMPV6_MGM_QUERY:
3904                         if (t_len != sizeof(struct mld_msg))
3905                                 pstats->mstats.mld_v2queries[dir]++;
3906                         else
3907                                 pstats->mstats.mld_v1queries[dir]++;
3908                         break;
3909                 case ICMPV6_MGM_REDUCTION:
3910                         pstats->mstats.mld_leaves[dir]++;
3911                         break;
3912                 }
3913                 break;
3914 #endif /* CONFIG_IPV6 */
3915         }
3916         u64_stats_update_end(&pstats->syncp);
3917 }
3918
3919 void br_multicast_count(struct net_bridge *br, const struct net_bridge_port *p,
3920                         const struct sk_buff *skb, u8 type, u8 dir)
3921 {
3922         struct bridge_mcast_stats __percpu *stats;
3923
3924         /* if multicast_disabled is true then igmp type can't be set */
3925         if (!type || !br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
3926                 return;
3927
3928         if (p)
3929                 stats = p->mcast_stats;
3930         else
3931                 stats = br->mcast_stats;
3932         if (WARN_ON(!stats))
3933                 return;
3934
3935         br_mcast_stats_add(stats, skb, type, dir);
3936 }
3937
3938 int br_multicast_init_stats(struct net_bridge *br)
3939 {
3940         br->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
3941         if (!br->mcast_stats)
3942                 return -ENOMEM;
3943
3944         return 0;
3945 }
3946
3947 void br_multicast_uninit_stats(struct net_bridge *br)
3948 {
3949         free_percpu(br->mcast_stats);
3950 }
3951
3952 /* noinline for https://bugs.llvm.org/show_bug.cgi?id=45802#c9 */
3953 static noinline_for_stack void mcast_stats_add_dir(u64 *dst, u64 *src)
3954 {
3955         dst[BR_MCAST_DIR_RX] += src[BR_MCAST_DIR_RX];
3956         dst[BR_MCAST_DIR_TX] += src[BR_MCAST_DIR_TX];
3957 }
3958
3959 void br_multicast_get_stats(const struct net_bridge *br,
3960                             const struct net_bridge_port *p,
3961                             struct br_mcast_stats *dest)
3962 {
3963         struct bridge_mcast_stats __percpu *stats;
3964         struct br_mcast_stats tdst;
3965         int i;
3966
3967         memset(dest, 0, sizeof(*dest));
3968         if (p)
3969                 stats = p->mcast_stats;
3970         else
3971                 stats = br->mcast_stats;
3972         if (WARN_ON(!stats))
3973                 return;
3974
3975         memset(&tdst, 0, sizeof(tdst));
3976         for_each_possible_cpu(i) {
3977                 struct bridge_mcast_stats *cpu_stats = per_cpu_ptr(stats, i);
3978                 struct br_mcast_stats temp;
3979                 unsigned int start;
3980
3981                 do {
3982                         start = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
3983                         memcpy(&temp, &cpu_stats->mstats, sizeof(temp));
3984                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, start));
3985
3986                 mcast_stats_add_dir(tdst.igmp_v1queries, temp.igmp_v1queries);
3987                 mcast_stats_add_dir(tdst.igmp_v2queries, temp.igmp_v2queries);
3988                 mcast_stats_add_dir(tdst.igmp_v3queries, temp.igmp_v3queries);
3989                 mcast_stats_add_dir(tdst.igmp_leaves, temp.igmp_leaves);
3990                 mcast_stats_add_dir(tdst.igmp_v1reports, temp.igmp_v1reports);
3991                 mcast_stats_add_dir(tdst.igmp_v2reports, temp.igmp_v2reports);
3992                 mcast_stats_add_dir(tdst.igmp_v3reports, temp.igmp_v3reports);
3993                 tdst.igmp_parse_errors += temp.igmp_parse_errors;
3994
3995                 mcast_stats_add_dir(tdst.mld_v1queries, temp.mld_v1queries);
3996                 mcast_stats_add_dir(tdst.mld_v2queries, temp.mld_v2queries);
3997                 mcast_stats_add_dir(tdst.mld_leaves, temp.mld_leaves);
3998                 mcast_stats_add_dir(tdst.mld_v1reports, temp.mld_v1reports);
3999                 mcast_stats_add_dir(tdst.mld_v2reports, temp.mld_v2reports);
4000                 tdst.mld_parse_errors += temp.mld_parse_errors;
4001         }
4002         memcpy(dest, &tdst, sizeof(*dest));
4003 }
4004
4005 int br_mdb_hash_init(struct net_bridge *br)
4006 {
4007         int err;
4008
4009         err = rhashtable_init(&br->sg_port_tbl, &br_sg_port_rht_params);
4010         if (err)
4011                 return err;
4012
4013         err = rhashtable_init(&br->mdb_hash_tbl, &br_mdb_rht_params);
4014         if (err) {
4015                 rhashtable_destroy(&br->sg_port_tbl);
4016                 return err;
4017         }
4018
4019         return 0;
4020 }
4021
4022 void br_mdb_hash_fini(struct net_bridge *br)
4023 {
4024         rhashtable_destroy(&br->sg_port_tbl);
4025         rhashtable_destroy(&br->mdb_hash_tbl);
4026 }