net/bridge/br_multicast.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Bridge multicast support.
   4  *
   5  * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au>
   6  */
   7
   8 #include <linux/err.h>
   9 #include <linux/export.h>
  10 #include <linux/if_ether.h>
  11 #include <linux/igmp.h>
  12 #include <linux/in.h>
  13 #include <linux/jhash.h>
  14 #include <linux/kernel.h>
  15 #include <linux/log2.h>
  16 #include <linux/netdevice.h>
  17 #include <linux/netfilter_bridge.h>
  18 #include <linux/random.h>
  19 #include <linux/rculist.h>
  20 #include <linux/skbuff.h>
  21 #include <linux/slab.h>
  22 #include <linux/timer.h>
  23 #include <linux/inetdevice.h>
  24 #include <linux/mroute.h>
  25 #include <net/ip.h>
  26 #include <net/switchdev.h>
  27 #if IS_ENABLED(CONFIG_IPV6)
  28 #include <linux/icmpv6.h>
  29 #include <net/ipv6.h>
  30 #include <net/mld.h>
  31 #include <net/ip6_checksum.h>
  32 #include <net/addrconf.h>
  33 #endif
  34
  35 #include "br_private.h"
  36 #include "br_private_mcast_eht.h"
  37
  38 static const struct rhashtable_params br_mdb_rht_params = {
  39         .head_offset = offsetof(struct net_bridge_mdb_entry, rhnode),
  40         .key_offset = offsetof(struct net_bridge_mdb_entry, addr),
  41         .key_len = sizeof(struct br_ip),
  42         .automatic_shrinking = true,
  43 };
  44
  45 static const struct rhashtable_params br_sg_port_rht_params = {
  46         .head_offset = offsetof(struct net_bridge_port_group, rhnode),
  47         .key_offset = offsetof(struct net_bridge_port_group, key),
  48         .key_len = sizeof(struct net_bridge_port_group_sg_key),
  49         .automatic_shrinking = true,
  50 };
  51
  52 static void br_multicast_start_querier(struct net_bridge *br,
  53                                        struct bridge_mcast_own_query *query);
  54 static void br_multicast_add_router(struct net_bridge *br,
  55                                     struct net_bridge_port *port);
  56 static void br_ip4_multicast_leave_group(struct net_bridge *br,
  57                                          struct net_bridge_port *port,
  58                                          __be32 group,
  59                                          __u16 vid,
  60                                          const unsigned char *src);
  61 static void br_multicast_port_group_rexmit(struct timer_list *t);
  62
  63 static void __del_port_router(struct net_bridge_port *p);
  64 #if IS_ENABLED(CONFIG_IPV6)
  65 static void br_ip6_multicast_leave_group(struct net_bridge *br,
  66                                          struct net_bridge_port *port,
  67                                          const struct in6_addr *group,
  68                                          __u16 vid, const unsigned char *src);
  69 #endif
  70 static struct net_bridge_port_group *
  71 __br_multicast_add_group(struct net_bridge *br,
  72                          struct net_bridge_port *port,
  73                          struct br_ip *group,
  74                          const unsigned char *src,
  75                          u8 filter_mode,
  76                          bool igmpv2_mldv1,
  77                          bool blocked);
  78 static void br_multicast_find_del_pg(struct net_bridge *br,
  79                                      struct net_bridge_port_group *pg);
  80
  81 static struct net_bridge_port_group *
  82 br_sg_port_find(struct net_bridge *br,
  83                 struct net_bridge_port_group_sg_key *sg_p)
  84 {
  85         lockdep_assert_held_once(&br->multicast_lock);
  86
  87         return rhashtable_lookup_fast(&br->sg_port_tbl, sg_p,
  88                                       br_sg_port_rht_params);
  89 }
  90
  91 static struct net_bridge_mdb_entry *br_mdb_ip_get_rcu(struct net_bridge *br,
  92                                                       struct br_ip *dst)
  93 {
  94         return rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
  95 }
  96
  97 struct net_bridge_mdb_entry *br_mdb_ip_get(struct net_bridge *br,
  98                                            struct br_ip *dst)
  99 {
 100         struct net_bridge_mdb_entry *ent;
 101
 102         lockdep_assert_held_once(&br->multicast_lock);
 103
 104         rcu_read_lock();
 105         ent = rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
 106         rcu_read_unlock();
 107
 108         return ent;
 109 }
 110
 111 static struct net_bridge_mdb_entry *br_mdb_ip4_get(struct net_bridge *br,
 112                                                    __be32 dst, __u16 vid)
 113 {
 114         struct br_ip br_dst;
 115
 116         memset(&br_dst, 0, sizeof(br_dst));
 117         br_dst.dst.ip4 = dst;
 118         br_dst.proto = htons(ETH_P_IP);
 119         br_dst.vid = vid;
 120
 121         return br_mdb_ip_get(br, &br_dst);
 122 }
 123
 124 #if IS_ENABLED(CONFIG_IPV6)
 125 static struct net_bridge_mdb_entry *br_mdb_ip6_get(struct net_bridge *br,
 126                                                    const struct in6_addr *dst,
 127                                                    __u16 vid)
 128 {
 129         struct br_ip br_dst;
 130
 131         memset(&br_dst, 0, sizeof(br_dst));
 132         br_dst.dst.ip6 = *dst;
 133         br_dst.proto = htons(ETH_P_IPV6);
 134         br_dst.vid = vid;
 135
 136         return br_mdb_ip_get(br, &br_dst);
 137 }
 138 #endif
 139
 140 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
 141                                         struct sk_buff *skb, u16 vid)
 142 {
 143         struct br_ip ip;
 144
 145         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
 146                 return NULL;
 147
 148         if (BR_INPUT_SKB_CB(skb)->igmp)
 149                 return NULL;
 150
 151         memset(&ip, 0, sizeof(ip));
 152         ip.proto = skb->protocol;
 153         ip.vid = vid;
 154
 155         switch (skb->protocol) {
 156         case htons(ETH_P_IP):
 157                 ip.dst.ip4 = ip_hdr(skb)->daddr;
 158                 if (br->multicast_igmp_version == 3) {
 159                         struct net_bridge_mdb_entry *mdb;
 160
 161                         ip.src.ip4 = ip_hdr(skb)->saddr;
 162                         mdb = br_mdb_ip_get_rcu(br, &ip);
 163                         if (mdb)
 164                                 return mdb;
 165                         ip.src.ip4 = 0;
 166                 }
 167                 break;
 168 #if IS_ENABLED(CONFIG_IPV6)
 169         case htons(ETH_P_IPV6):
 170                 ip.dst.ip6 = ipv6_hdr(skb)->daddr;
 171                 if (br->multicast_mld_version == 2) {
 172                         struct net_bridge_mdb_entry *mdb;
 173
 174                         ip.src.ip6 = ipv6_hdr(skb)->saddr;
 175                         mdb = br_mdb_ip_get_rcu(br, &ip);
 176                         if (mdb)
 177                                 return mdb;
 178                         memset(&ip.src.ip6, 0, sizeof(ip.src.ip6));
 179                 }
 180                 break;
 181 #endif
 182         default:
 183                 ip.proto = 0;
 184                 ether_addr_copy(ip.dst.mac_addr, eth_hdr(skb)->h_dest);
 185         }
 186
 187         return br_mdb_ip_get_rcu(br, &ip);
 188 }
 189
 190 static bool br_port_group_equal(struct net_bridge_port_group *p,
 191                                 struct net_bridge_port *port,
 192                                 const unsigned char *src)
 193 {
 194         if (p->key.port != port)
 195                 return false;
 196
 197         if (!(port->flags & BR_MULTICAST_TO_UNICAST))
 198                 return true;
 199
 200         return ether_addr_equal(src, p->eth_addr);
 201 }
 202
 203 static void __fwd_add_star_excl(struct net_bridge_port_group *pg,
 204                                 struct br_ip *sg_ip)
 205 {
 206         struct net_bridge_port_group_sg_key sg_key;
 207         struct net_bridge *br = pg->key.port->br;
 208         struct net_bridge_port_group *src_pg;
 209
 210         memset(&sg_key, 0, sizeof(sg_key));
 211         sg_key.port = pg->key.port;
 212         sg_key.addr = *sg_ip;
 213         if (br_sg_port_find(br, &sg_key))
 214                 return;
 215
 216         src_pg = __br_multicast_add_group(br, pg->key.port, sg_ip, pg->eth_addr,
 217                                           MCAST_INCLUDE, false, false);
 218         if (IS_ERR_OR_NULL(src_pg) ||
 219             src_pg->rt_protocol != RTPROT_KERNEL)
 220                 return;
 221
 222         src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
 223 }
 224
 225 static void __fwd_del_star_excl(struct net_bridge_port_group *pg,
 226                                 struct br_ip *sg_ip)
 227 {
 228         struct net_bridge_port_group_sg_key sg_key;
 229         struct net_bridge *br = pg->key.port->br;
 230         struct net_bridge_port_group *src_pg;
 231
 232         memset(&sg_key, 0, sizeof(sg_key));
 233         sg_key.port = pg->key.port;
 234         sg_key.addr = *sg_ip;
 235         src_pg = br_sg_port_find(br, &sg_key);
 236         if (!src_pg || !(src_pg->flags & MDB_PG_FLAGS_STAR_EXCL) ||
 237             src_pg->rt_protocol != RTPROT_KERNEL)
 238                 return;
 239
 240         br_multicast_find_del_pg(br, src_pg);
 241 }
 242
 243 /* When a port group transitions to (or is added as) EXCLUDE we need to add it
 244  * to all other ports' S,G entries which are not blocked by the current group
 245  * for proper replication, the assumption is that any S,G blocked entries
 246  * are already added so the S,G,port lookup should skip them.
 247  * When a port group transitions from EXCLUDE -> INCLUDE mode or is being
 248  * deleted we need to remove it from all ports' S,G entries where it was
 249  * automatically installed before (i.e. where it's MDB_PG_FLAGS_STAR_EXCL).
 250  */
 251 void br_multicast_star_g_handle_mode(struct net_bridge_port_group *pg,
 252                                      u8 filter_mode)
 253 {
 254         struct net_bridge *br = pg->key.port->br;
 255         struct net_bridge_port_group *pg_lst;
 256         struct net_bridge_mdb_entry *mp;
 257         struct br_ip sg_ip;
 258
 259         if (WARN_ON(!br_multicast_is_star_g(&pg->key.addr)))
 260                 return;
 261
 262         mp = br_mdb_ip_get(br, &pg->key.addr);
 263         if (!mp)
 264                 return;
 265
 266         memset(&sg_ip, 0, sizeof(sg_ip));
 267         sg_ip = pg->key.addr;
 268         for (pg_lst = mlock_dereference(mp->ports, br);
 269              pg_lst;
 270              pg_lst = mlock_dereference(pg_lst->next, br)) {
 271                 struct net_bridge_group_src *src_ent;
 272
 273                 if (pg_lst == pg)
 274                         continue;
 275                 hlist_for_each_entry(src_ent, &pg_lst->src_list, node) {
 276                         if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
 277                                 continue;
 278                         sg_ip.src = src_ent->addr.src;
 279                         switch (filter_mode) {
 280                         case MCAST_INCLUDE:
 281                                 __fwd_del_star_excl(pg, &sg_ip);
 282                                 break;
 283                         case MCAST_EXCLUDE:
 284                                 __fwd_add_star_excl(pg, &sg_ip);
 285                                 break;
 286                         }
 287                 }
 288         }
 289 }
 290
 291 /* called when adding a new S,G with host_joined == false by default */
 292 static void br_multicast_sg_host_state(struct net_bridge_mdb_entry *star_mp,
 293                                        struct net_bridge_port_group *sg)
 294 {
 295         struct net_bridge_mdb_entry *sg_mp;
 296
 297         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 298                 return;
 299         if (!star_mp->host_joined)
 300                 return;
 301
 302         sg_mp = br_mdb_ip_get(star_mp->br, &sg->key.addr);
 303         if (!sg_mp)
 304                 return;
 305         sg_mp->host_joined = true;
 306 }
 307
 308 /* set the host_joined state of all of *,G's S,G entries */
 309 static void br_multicast_star_g_host_state(struct net_bridge_mdb_entry *star_mp)
 310 {
 311         struct net_bridge *br = star_mp->br;
 312         struct net_bridge_mdb_entry *sg_mp;
 313         struct net_bridge_port_group *pg;
 314         struct br_ip sg_ip;
 315
 316         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 317                 return;
 318
 319         memset(&sg_ip, 0, sizeof(sg_ip));
 320         sg_ip = star_mp->addr;
 321         for (pg = mlock_dereference(star_mp->ports, br);
 322              pg;
 323              pg = mlock_dereference(pg->next, br)) {
 324                 struct net_bridge_group_src *src_ent;
 325
 326                 hlist_for_each_entry(src_ent, &pg->src_list, node) {
 327                         if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
 328                                 continue;
 329                         sg_ip.src = src_ent->addr.src;
 330                         sg_mp = br_mdb_ip_get(br, &sg_ip);
 331                         if (!sg_mp)
 332                                 continue;
 333                         sg_mp->host_joined = star_mp->host_joined;
 334                 }
 335         }
 336 }
 337
 338 static void br_multicast_sg_del_exclude_ports(struct net_bridge_mdb_entry *sgmp)
 339 {
 340         struct net_bridge_port_group __rcu **pp;
 341         struct net_bridge_port_group *p;
 342
 343         /* *,G exclude ports are only added to S,G entries */
 344         if (WARN_ON(br_multicast_is_star_g(&sgmp->addr)))
 345                 return;
 346
 347         /* we need the STAR_EXCLUDE ports if there are non-STAR_EXCLUDE ports
 348          * we should ignore perm entries since they're managed by user-space
 349          */
 350         for (pp = &sgmp->ports;
 351              (p = mlock_dereference(*pp, sgmp->br)) != NULL;
 352              pp = &p->next)
 353                 if (!(p->flags & (MDB_PG_FLAGS_STAR_EXCL |
 354                                   MDB_PG_FLAGS_PERMANENT)))
 355                         return;
 356
 357         /* currently the host can only have joined the *,G which means
 358          * we treat it as EXCLUDE {}, so for an S,G it's considered a
 359          * STAR_EXCLUDE entry and we can safely leave it
 360          */
 361         sgmp->host_joined = false;
 362
 363         for (pp = &sgmp->ports;
 364              (p = mlock_dereference(*pp, sgmp->br)) != NULL;) {
 365                 if (!(p->flags & MDB_PG_FLAGS_PERMANENT))
 366                         br_multicast_del_pg(sgmp, p, pp);
 367                 else
 368                         pp = &p->next;
 369         }
 370 }
 371
 372 void br_multicast_sg_add_exclude_ports(struct net_bridge_mdb_entry *star_mp,
 373                                        struct net_bridge_port_group *sg)
 374 {
 375         struct net_bridge_port_group_sg_key sg_key;
 376         struct net_bridge *br = star_mp->br;
 377         struct net_bridge_port_group *pg;
 378
 379         if (WARN_ON(br_multicast_is_star_g(&sg->key.addr)))
 380                 return;
 381         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 382                 return;
 383
 384         br_multicast_sg_host_state(star_mp, sg);
 385         memset(&sg_key, 0, sizeof(sg_key));
 386         sg_key.addr = sg->key.addr;
 387         /* we need to add all exclude ports to the S,G */
 388         for (pg = mlock_dereference(star_mp->ports, br);
 389              pg;
 390              pg = mlock_dereference(pg->next, br)) {
 391                 struct net_bridge_port_group *src_pg;
 392
 393                 if (pg == sg || pg->filter_mode == MCAST_INCLUDE)
 394                         continue;
 395
 396                 sg_key.port = pg->key.port;
 397                 if (br_sg_port_find(br, &sg_key))
 398                         continue;
 399
 400                 src_pg = __br_multicast_add_group(br, pg->key.port,
 401                                                   &sg->key.addr,
 402                                                   sg->eth_addr,
 403                                                   MCAST_INCLUDE, false, false);
 404                 if (IS_ERR_OR_NULL(src_pg) ||
 405                     src_pg->rt_protocol != RTPROT_KERNEL)
 406                         continue;
 407                 src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
 408         }
 409 }
 410
 411 static void br_multicast_fwd_src_add(struct net_bridge_group_src *src)
 412 {
 413         struct net_bridge_mdb_entry *star_mp;
 414         struct net_bridge_port_group *sg;
 415         struct br_ip sg_ip;
 416
 417         if (src->flags & BR_SGRP_F_INSTALLED)
 418                 return;
 419
 420         memset(&sg_ip, 0, sizeof(sg_ip));
 421         sg_ip = src->pg->key.addr;
 422         sg_ip.src = src->addr.src;
 423         sg = __br_multicast_add_group(src->br, src->pg->key.port, &sg_ip,
 424                                       src->pg->eth_addr, MCAST_INCLUDE, false,
 425                                       !timer_pending(&src->timer));
 426         if (IS_ERR_OR_NULL(sg))
 427                 return;
 428         src->flags |= BR_SGRP_F_INSTALLED;
 429         sg->flags &= ~MDB_PG_FLAGS_STAR_EXCL;
 430
 431         /* if it was added by user-space as perm we can skip next steps */
 432         if (sg->rt_protocol != RTPROT_KERNEL &&
 433             (sg->flags & MDB_PG_FLAGS_PERMANENT))
 434                 return;
 435
 436         /* the kernel is now responsible for removing this S,G */
 437         del_timer(&sg->timer);
 438         star_mp = br_mdb_ip_get(src->br, &src->pg->key.addr);
 439         if (!star_mp)
 440                 return;
 441
 442         br_multicast_sg_add_exclude_ports(star_mp, sg);
 443 }
 444
 445 static void br_multicast_fwd_src_remove(struct net_bridge_group_src *src,
 446                                         bool fastleave)
 447 {
 448         struct net_bridge_port_group *p, *pg = src->pg;
 449         struct net_bridge_port_group __rcu **pp;
 450         struct net_bridge_mdb_entry *mp;
 451         struct br_ip sg_ip;
 452
 453         memset(&sg_ip, 0, sizeof(sg_ip));
 454         sg_ip = pg->key.addr;
 455         sg_ip.src = src->addr.src;
 456
 457         mp = br_mdb_ip_get(src->br, &sg_ip);
 458         if (!mp)
 459                 return;
 460
 461         for (pp = &mp->ports;
 462              (p = mlock_dereference(*pp, src->br)) != NULL;
 463              pp = &p->next) {
 464                 if (!br_port_group_equal(p, pg->key.port, pg->eth_addr))
 465                         continue;
 466
 467                 if (p->rt_protocol != RTPROT_KERNEL &&
 468                     (p->flags & MDB_PG_FLAGS_PERMANENT))
 469                         break;
 470
 471                 if (fastleave)
 472                         p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
 473                 br_multicast_del_pg(mp, p, pp);
 474                 break;
 475         }
 476         src->flags &= ~BR_SGRP_F_INSTALLED;
 477 }
 478
 479 /* install S,G and based on src's timer enable or disable forwarding */
 480 static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)
 481 {
 482         struct net_bridge_port_group_sg_key sg_key;
 483         struct net_bridge_port_group *sg;
 484         u8 old_flags;
 485
 486         br_multicast_fwd_src_add(src);
 487
 488         memset(&sg_key, 0, sizeof(sg_key));
 489         sg_key.addr = src->pg->key.addr;
 490         sg_key.addr.src = src->addr.src;
 491         sg_key.port = src->pg->key.port;
 492
 493         sg = br_sg_port_find(src->br, &sg_key);
 494         if (!sg || (sg->flags & MDB_PG_FLAGS_PERMANENT))
 495                 return;
 496
 497         old_flags = sg->flags;
 498         if (timer_pending(&src->timer))
 499                 sg->flags &= ~MDB_PG_FLAGS_BLOCKED;
 500         else
 501                 sg->flags |= MDB_PG_FLAGS_BLOCKED;
 502
 503         if (old_flags != sg->flags) {
 504                 struct net_bridge_mdb_entry *sg_mp;
 505
 506                 sg_mp = br_mdb_ip_get(src->br, &sg_key.addr);
 507                 if (!sg_mp)
 508                         return;
 509                 br_mdb_notify(src->br->dev, sg_mp, sg, RTM_NEWMDB);
 510         }
 511 }
 512
 513 static void br_multicast_destroy_mdb_entry(struct net_bridge_mcast_gc *gc)
 514 {
 515         struct net_bridge_mdb_entry *mp;
 516
 517         mp = container_of(gc, struct net_bridge_mdb_entry, mcast_gc);
 518         WARN_ON(!hlist_unhashed(&mp->mdb_node));
 519         WARN_ON(mp->ports);
 520
 521         del_timer_sync(&mp->timer);
 522         kfree_rcu(mp, rcu);
 523 }
 524
 525 static void br_multicast_del_mdb_entry(struct net_bridge_mdb_entry *mp)
 526 {
 527         struct net_bridge *br = mp->br;
 528
 529         rhashtable_remove_fast(&br->mdb_hash_tbl, &mp->rhnode,
 530                                br_mdb_rht_params);
 531         hlist_del_init_rcu(&mp->mdb_node);
 532         hlist_add_head(&mp->mcast_gc.gc_node, &br->mcast_gc_list);
 533         queue_work(system_long_wq, &br->mcast_gc_work);
 534 }
 535
 536 static void br_multicast_group_expired(struct timer_list *t)
 537 {
 538         struct net_bridge_mdb_entry *mp = from_timer(mp, t, timer);
 539         struct net_bridge *br = mp->br;
 540
 541         spin_lock(&br->multicast_lock);
 542         if (hlist_unhashed(&mp->mdb_node) || !netif_running(br->dev) ||
 543             timer_pending(&mp->timer))
 544                 goto out;
 545
 546         br_multicast_host_leave(mp, true);
 547
 548         if (mp->ports)
 549                 goto out;
 550         br_multicast_del_mdb_entry(mp);
 551 out:
 552         spin_unlock(&br->multicast_lock);
 553 }
 554
 555 static void br_multicast_destroy_group_src(struct net_bridge_mcast_gc *gc)
 556 {
 557         struct net_bridge_group_src *src;
 558
 559         src = container_of(gc, struct net_bridge_group_src, mcast_gc);
 560         WARN_ON(!hlist_unhashed(&src->node));
 561
 562         del_timer_sync(&src->timer);
 563         kfree_rcu(src, rcu);
 564 }
 565
 566 void br_multicast_del_group_src(struct net_bridge_group_src *src,
 567                                 bool fastleave)
 568 {
 569         struct net_bridge *br = src->pg->key.port->br;
 570
 571         br_multicast_fwd_src_remove(src, fastleave);
 572         hlist_del_init_rcu(&src->node);
 573         src->pg->src_ents--;
 574         hlist_add_head(&src->mcast_gc.gc_node, &br->mcast_gc_list);
 575         queue_work(system_long_wq, &br->mcast_gc_work);
 576 }
 577
 578 static void br_multicast_destroy_port_group(struct net_bridge_mcast_gc *gc)
 579 {
 580         struct net_bridge_port_group *pg;
 581
 582         pg = container_of(gc, struct net_bridge_port_group, mcast_gc);
 583         WARN_ON(!hlist_unhashed(&pg->mglist));
 584         WARN_ON(!hlist_empty(&pg->src_list));
 585
 586         del_timer_sync(&pg->rexmit_timer);
 587         del_timer_sync(&pg->timer);
 588         kfree_rcu(pg, rcu);
 589 }
 590
 591 void br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
 592                          struct net_bridge_port_group *pg,
 593                          struct net_bridge_port_group __rcu **pp)
 594 {
 595         struct net_bridge *br = pg->key.port->br;
 596         struct net_bridge_group_src *ent;
 597         struct hlist_node *tmp;
 598
 599         rcu_assign_pointer(*pp, pg->next);
 600         hlist_del_init(&pg->mglist);
 601         br_multicast_eht_clean_sets(pg);
 602         hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
 603                 br_multicast_del_group_src(ent, false);
 604         br_mdb_notify(br->dev, mp, pg, RTM_DELMDB);
 605         if (!br_multicast_is_star_g(&mp->addr)) {
 606                 rhashtable_remove_fast(&br->sg_port_tbl, &pg->rhnode,
 607                                        br_sg_port_rht_params);
 608                 br_multicast_sg_del_exclude_ports(mp);
 609         } else {
 610                 br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
 611         }
 612         hlist_add_head(&pg->mcast_gc.gc_node, &br->mcast_gc_list);
 613         queue_work(system_long_wq, &br->mcast_gc_work);
 614
 615         if (!mp->ports && !mp->host_joined && netif_running(br->dev))
 616                 mod_timer(&mp->timer, jiffies);
 617 }
 618
 619 static void br_multicast_find_del_pg(struct net_bridge *br,
 620                                      struct net_bridge_port_group *pg)
 621 {
 622         struct net_bridge_port_group __rcu **pp;
 623         struct net_bridge_mdb_entry *mp;
 624         struct net_bridge_port_group *p;
 625
 626         mp = br_mdb_ip_get(br, &pg->key.addr);
 627         if (WARN_ON(!mp))
 628                 return;
 629
 630         for (pp = &mp->ports;
 631              (p = mlock_dereference(*pp, br)) != NULL;
 632              pp = &p->next) {
 633                 if (p != pg)
 634                         continue;
 635
 636                 br_multicast_del_pg(mp, pg, pp);
 637                 return;
 638         }
 639
 640         WARN_ON(1);
 641 }
 642
 643 static void br_multicast_port_group_expired(struct timer_list *t)
 644 {
 645         struct net_bridge_port_group *pg = from_timer(pg, t, timer);
 646         struct net_bridge_group_src *src_ent;
 647         struct net_bridge *br = pg->key.port->br;
 648         struct hlist_node *tmp;
 649         bool changed;
 650
 651         spin_lock(&br->multicast_lock);
 652         if (!netif_running(br->dev) || timer_pending(&pg->timer) ||
 653             hlist_unhashed(&pg->mglist) || pg->flags & MDB_PG_FLAGS_PERMANENT)
 654                 goto out;
 655
 656         changed = !!(pg->filter_mode == MCAST_EXCLUDE);
 657         pg->filter_mode = MCAST_INCLUDE;
 658         hlist_for_each_entry_safe(src_ent, tmp, &pg->src_list, node) {
 659                 if (!timer_pending(&src_ent->timer)) {
 660                         br_multicast_del_group_src(src_ent, false);
 661                         changed = true;
 662                 }
 663         }
 664
 665         if (hlist_empty(&pg->src_list)) {
 666                 br_multicast_find_del_pg(br, pg);
 667         } else if (changed) {
 668                 struct net_bridge_mdb_entry *mp = br_mdb_ip_get(br, &pg->key.addr);
 669
 670                 if (changed && br_multicast_is_star_g(&pg->key.addr))
 671                         br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
 672
 673                 if (WARN_ON(!mp))
 674                         goto out;
 675                 br_mdb_notify(br->dev, mp, pg, RTM_NEWMDB);
 676         }
 677 out:
 678         spin_unlock(&br->multicast_lock);
 679 }
 680
 681 static void br_multicast_gc(struct hlist_head *head)
 682 {
 683         struct net_bridge_mcast_gc *gcent;
 684         struct hlist_node *tmp;
 685
 686         hlist_for_each_entry_safe(gcent, tmp, head, gc_node) {
 687                 hlist_del_init(&gcent->gc_node);
 688                 gcent->destroy(gcent);
 689         }
 690 }
 691
 692 static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
 693                                                     struct net_bridge_port_group *pg,
 694                                                     __be32 ip_dst, __be32 group,
 695                                                     bool with_srcs, bool over_lmqt,
 696                                                     u8 sflag, u8 *igmp_type,
 697                                                     bool *need_rexmit)
 698 {
 699         struct net_bridge_port *p = pg ? pg->key.port : NULL;
 700         struct net_bridge_group_src *ent;
 701         size_t pkt_size, igmp_hdr_size;
 702         unsigned long now = jiffies;
 703         struct igmpv3_query *ihv3;
 704         void *csum_start = NULL;
 705         __sum16 *csum = NULL;
 706         struct sk_buff *skb;
 707         struct igmphdr *ih;
 708         struct ethhdr *eth;
 709         unsigned long lmqt;
 710         struct iphdr *iph;
 711         u16 lmqt_srcs = 0;
 712
 713         igmp_hdr_size = sizeof(*ih);
 714         if (br->multicast_igmp_version == 3) {
 715                 igmp_hdr_size = sizeof(*ihv3);
 716                 if (pg && with_srcs) {
 717                         lmqt = now + (br->multicast_last_member_interval *
 718                                       br->multicast_last_member_count);
 719                         hlist_for_each_entry(ent, &pg->src_list, node) {
 720                                 if (over_lmqt == time_after(ent->timer.expires,
 721                                                             lmqt) &&
 722                                     ent->src_query_rexmit_cnt > 0)
 723                                         lmqt_srcs++;
 724                         }
 725
 726                         if (!lmqt_srcs)
 727                                 return NULL;
 728                         igmp_hdr_size += lmqt_srcs * sizeof(__be32);
 729                 }
 730         }
 731
 732         pkt_size = sizeof(*eth) + sizeof(*iph) + 4 + igmp_hdr_size;
 733         if ((p && pkt_size > p->dev->mtu) ||
 734             pkt_size > br->dev->mtu)
 735                 return NULL;
 736
 737         skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
 738         if (!skb)
 739                 goto out;
 740
 741         skb->protocol = htons(ETH_P_IP);
 742
 743         skb_reset_mac_header(skb);
 744         eth = eth_hdr(skb);
 745
 746         ether_addr_copy(eth->h_source, br->dev->dev_addr);
 747         ip_eth_mc_map(ip_dst, eth->h_dest);
 748         eth->h_proto = htons(ETH_P_IP);
 749         skb_put(skb, sizeof(*eth));
 750
 751         skb_set_network_header(skb, skb->len);
 752         iph = ip_hdr(skb);
 753         iph->tot_len = htons(pkt_size - sizeof(*eth));
 754
 755         iph->version = 4;
 756         iph->ihl = 6;
 757         iph->tos = 0xc0;
 758         iph->id = 0;
 759         iph->frag_off = htons(IP_DF);
 760         iph->ttl = 1;
 761         iph->protocol = IPPROTO_IGMP;
 762         iph->saddr = br_opt_get(br, BROPT_MULTICAST_QUERY_USE_IFADDR) ?
 763                      inet_select_addr(br->dev, 0, RT_SCOPE_LINK) : 0;
 764         iph->daddr = ip_dst;
 765         ((u8 *)&iph[1])[0] = IPOPT_RA;
 766         ((u8 *)&iph[1])[1] = 4;
 767         ((u8 *)&iph[1])[2] = 0;
 768         ((u8 *)&iph[1])[3] = 0;
 769         ip_send_check(iph);
 770         skb_put(skb, 24);
 771
 772         skb_set_transport_header(skb, skb->len);
 773         *igmp_type = IGMP_HOST_MEMBERSHIP_QUERY;
 774
 775         switch (br->multicast_igmp_version) {
 776         case 2:
 777                 ih = igmp_hdr(skb);
 778                 ih->type = IGMP_HOST_MEMBERSHIP_QUERY;
 779                 ih->code = (group ? br->multicast_last_member_interval :
 780                                     br->multicast_query_response_interval) /
 781                            (HZ / IGMP_TIMER_SCALE);
 782                 ih->group = group;
 783                 ih->csum = 0;
 784                 csum = &ih->csum;
 785                 csum_start = (void *)ih;
 786                 break;
 787         case 3:
 788                 ihv3 = igmpv3_query_hdr(skb);
 789                 ihv3->type = IGMP_HOST_MEMBERSHIP_QUERY;
 790                 ihv3->code = (group ? br->multicast_last_member_interval :
 791                                       br->multicast_query_response_interval) /
 792                              (HZ / IGMP_TIMER_SCALE);
 793                 ihv3->group = group;
 794                 ihv3->qqic = br->multicast_query_interval / HZ;
 795                 ihv3->nsrcs = htons(lmqt_srcs);
 796                 ihv3->resv = 0;
 797                 ihv3->suppress = sflag;
 798                 ihv3->qrv = 2;
 799                 ihv3->csum = 0;
 800                 csum = &ihv3->csum;
 801                 csum_start = (void *)ihv3;
 802                 if (!pg || !with_srcs)
 803                         break;
 804
 805                 lmqt_srcs = 0;
 806                 hlist_for_each_entry(ent, &pg->src_list, node) {
 807                         if (over_lmqt == time_after(ent->timer.expires,
 808                                                     lmqt) &&
 809                             ent->src_query_rexmit_cnt > 0) {
 810                                 ihv3->srcs[lmqt_srcs++] = ent->addr.src.ip4;
 811                                 ent->src_query_rexmit_cnt--;
 812                                 if (need_rexmit && ent->src_query_rexmit_cnt)
 813                                         *need_rexmit = true;
 814                         }
 815                 }
 816                 if (WARN_ON(lmqt_srcs != ntohs(ihv3->nsrcs))) {
 817                         kfree_skb(skb);
 818                         return NULL;
 819                 }
 820                 break;
 821         }
 822
 823         if (WARN_ON(!csum || !csum_start)) {
 824                 kfree_skb(skb);
 825                 return NULL;
 826         }
 827
 828         *csum = ip_compute_csum(csum_start, igmp_hdr_size);
 829         skb_put(skb, igmp_hdr_size);
 830         __skb_pull(skb, sizeof(*eth));
 831
 832 out:
 833         return skb;
 834 }
 835
 836 #if IS_ENABLED(CONFIG_IPV6)
 837 static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
 838                                                     struct net_bridge_port_group *pg,
 839                                                     const struct in6_addr *ip6_dst,
 840                                                     const struct in6_addr *group,
 841                                                     bool with_srcs, bool over_llqt,
 842                                                     u8 sflag, u8 *igmp_type,
 843                                                     bool *need_rexmit)
 844 {
 845         struct net_bridge_port *p = pg ? pg->key.port : NULL;
 846         struct net_bridge_group_src *ent;
 847         size_t pkt_size, mld_hdr_size;
 848         unsigned long now = jiffies;
 849         struct mld2_query *mld2q;
 850         void *csum_start = NULL;
 851         unsigned long interval;
 852         __sum16 *csum = NULL;
 853         struct ipv6hdr *ip6h;
 854         struct mld_msg *mldq;
 855         struct sk_buff *skb;
 856         unsigned long llqt;
 857         struct ethhdr *eth;
 858         u16 llqt_srcs = 0;
 859         u8 *hopopt;
 860
 861         mld_hdr_size = sizeof(*mldq);
 862         if (br->multicast_mld_version == 2) {
 863                 mld_hdr_size = sizeof(*mld2q);
 864                 if (pg && with_srcs) {
 865                         llqt = now + (br->multicast_last_member_interval *
 866                                       br->multicast_last_member_count);
 867                         hlist_for_each_entry(ent, &pg->src_list, node) {
 868                                 if (over_llqt == time_after(ent->timer.expires,
 869                                                             llqt) &&
 870                                     ent->src_query_rexmit_cnt > 0)
 871                                         llqt_srcs++;
 872                         }
 873
 874                         if (!llqt_srcs)
 875                                 return NULL;
 876                         mld_hdr_size += llqt_srcs * sizeof(struct in6_addr);
 877                 }
 878         }
 879
 880         pkt_size = sizeof(*eth) + sizeof(*ip6h) + 8 + mld_hdr_size;
 881         if ((p && pkt_size > p->dev->mtu) ||
 882             pkt_size > br->dev->mtu)
 883                 return NULL;
 884
 885         skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
 886         if (!skb)
 887                 goto out;
 888
 889         skb->protocol = htons(ETH_P_IPV6);
 890
 891         /* Ethernet header */
 892         skb_reset_mac_header(skb);
 893         eth = eth_hdr(skb);
 894
 895         ether_addr_copy(eth->h_source, br->dev->dev_addr);
 896         eth->h_proto = htons(ETH_P_IPV6);
 897         skb_put(skb, sizeof(*eth));
 898
 899         /* IPv6 header + HbH option */
 900         skb_set_network_header(skb, skb->len);
 901         ip6h = ipv6_hdr(skb);
 902
 903         *(__force __be32 *)ip6h = htonl(0x60000000);
 904         ip6h->payload_len = htons(8 + mld_hdr_size);
 905         ip6h->nexthdr = IPPROTO_HOPOPTS;
 906         ip6h->hop_limit = 1;
 907         ip6h->daddr = *ip6_dst;
 908         if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
 909                                &ip6h->saddr)) {
 910                 kfree_skb(skb);
 911                 br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, false);
 912                 return NULL;
 913         }
 914
 915         br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
 916         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 917
 918         hopopt = (u8 *)(ip6h + 1);
 919         hopopt[0] = IPPROTO_ICMPV6;             /* next hdr */
 920         hopopt[1] = 0;                          /* length of HbH */
 921         hopopt[2] = IPV6_TLV_ROUTERALERT;       /* Router Alert */
 922         hopopt[3] = 2;                          /* Length of RA Option */
 923         hopopt[4] = 0;                          /* Type = 0x0000 (MLD) */
 924         hopopt[5] = 0;
 925         hopopt[6] = IPV6_TLV_PAD1;              /* Pad1 */
 926         hopopt[7] = IPV6_TLV_PAD1;              /* Pad1 */
 927
 928         skb_put(skb, sizeof(*ip6h) + 8);
 929
 930         /* ICMPv6 */
 931         skb_set_transport_header(skb, skb->len);
 932         interval = ipv6_addr_any(group) ?
 933                         br->multicast_query_response_interval :
 934                         br->multicast_last_member_interval;
 935         *igmp_type = ICMPV6_MGM_QUERY;
 936         switch (br->multicast_mld_version) {
 937         case 1:
 938                 mldq = (struct mld_msg *)icmp6_hdr(skb);
 939                 mldq->mld_type = ICMPV6_MGM_QUERY;
 940                 mldq->mld_code = 0;
 941                 mldq->mld_cksum = 0;
 942                 mldq->mld_maxdelay = htons((u16)jiffies_to_msecs(interval));
 943                 mldq->mld_reserved = 0;
 944                 mldq->mld_mca = *group;
 945                 csum = &mldq->mld_cksum;
 946                 csum_start = (void *)mldq;
 947                 break;
 948         case 2:
 949                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
 950                 mld2q->mld2q_mrc = htons((u16)jiffies_to_msecs(interval));
 951                 mld2q->mld2q_type = ICMPV6_MGM_QUERY;
 952                 mld2q->mld2q_code = 0;
 953                 mld2q->mld2q_cksum = 0;
 954                 mld2q->mld2q_resv1 = 0;
 955                 mld2q->mld2q_resv2 = 0;
 956                 mld2q->mld2q_suppress = sflag;
 957                 mld2q->mld2q_qrv = 2;
 958                 mld2q->mld2q_nsrcs = htons(llqt_srcs);
 959                 mld2q->mld2q_qqic = br->multicast_query_interval / HZ;
 960                 mld2q->mld2q_mca = *group;
 961                 csum = &mld2q->mld2q_cksum;
 962                 csum_start = (void *)mld2q;
 963                 if (!pg || !with_srcs)
 964                         break;
 965
 966                 llqt_srcs = 0;
 967                 hlist_for_each_entry(ent, &pg->src_list, node) {
 968                         if (over_llqt == time_after(ent->timer.expires,
 969                                                     llqt) &&
 970                             ent->src_query_rexmit_cnt > 0) {
 971                                 mld2q->mld2q_srcs[llqt_srcs++] = ent->addr.src.ip6;
 972                                 ent->src_query_rexmit_cnt--;
 973                                 if (need_rexmit && ent->src_query_rexmit_cnt)
 974                                         *need_rexmit = true;
 975                         }
 976                 }
 977                 if (WARN_ON(llqt_srcs != ntohs(mld2q->mld2q_nsrcs))) {
 978                         kfree_skb(skb);
 979                         return NULL;
 980                 }
 981                 break;
 982         }
 983
 984         if (WARN_ON(!csum || !csum_start)) {
 985                 kfree_skb(skb);
 986                 return NULL;
 987         }
 988
 989         *csum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, mld_hdr_size,
 990                                 IPPROTO_ICMPV6,
 991                                 csum_partial(csum_start, mld_hdr_size, 0));
 992         skb_put(skb, mld_hdr_size);
 993         __skb_pull(skb, sizeof(*eth));
 994
 995 out:
 996         return skb;
 997 }
 998 #endif
 999
1000 static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
1001                                                 struct net_bridge_port_group *pg,
1002                                                 struct br_ip *ip_dst,
1003                                                 struct br_ip *group,
1004                                                 bool with_srcs, bool over_lmqt,
1005                                                 u8 sflag, u8 *igmp_type,
1006                                                 bool *need_rexmit)
1007 {
1008         __be32 ip4_dst;
1009
1010         switch (group->proto) {
1011         case htons(ETH_P_IP):
1012                 ip4_dst = ip_dst ? ip_dst->dst.ip4 : htonl(INADDR_ALLHOSTS_GROUP);
1013                 return br_ip4_multicast_alloc_query(br, pg,
1014                                                     ip4_dst, group->dst.ip4,
1015                                                     with_srcs, over_lmqt,
1016                                                     sflag, igmp_type,
1017                                                     need_rexmit);
1018 #if IS_ENABLED(CONFIG_IPV6)
1019         case htons(ETH_P_IPV6): {
1020                 struct in6_addr ip6_dst;
1021
1022                 if (ip_dst)
1023                         ip6_dst = ip_dst->dst.ip6;
1024                 else
1025                         ipv6_addr_set(&ip6_dst, htonl(0xff020000), 0, 0,
1026                                       htonl(1));
1027
1028                 return br_ip6_multicast_alloc_query(br, pg,
1029                                                     &ip6_dst, &group->dst.ip6,
1030                                                     with_srcs, over_lmqt,
1031                                                     sflag, igmp_type,
1032                                                     need_rexmit);
1033         }
1034 #endif
1035         }
1036         return NULL;
1037 }
1038
1039 struct net_bridge_mdb_entry *br_multicast_new_group(struct net_bridge *br,
1040                                                     struct br_ip *group)
1041 {
1042         struct net_bridge_mdb_entry *mp;
1043         int err;
1044
1045         mp = br_mdb_ip_get(br, group);
1046         if (mp)
1047                 return mp;
1048
1049         if (atomic_read(&br->mdb_hash_tbl.nelems) >= br->hash_max) {
1050                 br_opt_toggle(br, BROPT_MULTICAST_ENABLED, false);
1051                 return ERR_PTR(-E2BIG);
1052         }
1053
1054         mp = kzalloc(sizeof(*mp), GFP_ATOMIC);
1055         if (unlikely(!mp))
1056                 return ERR_PTR(-ENOMEM);
1057
1058         mp->br = br;
1059         mp->addr = *group;
1060         mp->mcast_gc.destroy = br_multicast_destroy_mdb_entry;
1061         timer_setup(&mp->timer, br_multicast_group_expired, 0);
1062         err = rhashtable_lookup_insert_fast(&br->mdb_hash_tbl, &mp->rhnode,
1063                                             br_mdb_rht_params);
1064         if (err) {
1065                 kfree(mp);
1066                 mp = ERR_PTR(err);
1067         } else {
1068                 hlist_add_head_rcu(&mp->mdb_node, &br->mdb_list);
1069         }
1070
1071         return mp;
1072 }
1073
1074 static void br_multicast_group_src_expired(struct timer_list *t)
1075 {
1076         struct net_bridge_group_src *src = from_timer(src, t, timer);
1077         struct net_bridge_port_group *pg;
1078         struct net_bridge *br = src->br;
1079
1080         spin_lock(&br->multicast_lock);
1081         if (hlist_unhashed(&src->node) || !netif_running(br->dev) ||
1082             timer_pending(&src->timer))
1083                 goto out;
1084
1085         pg = src->pg;
1086         if (pg->filter_mode == MCAST_INCLUDE) {
1087                 br_multicast_del_group_src(src, false);
1088                 if (!hlist_empty(&pg->src_list))
1089                         goto out;
1090                 br_multicast_find_del_pg(br, pg);
1091         } else {
1092                 br_multicast_fwd_src_handle(src);
1093         }
1094
1095 out:
1096         spin_unlock(&br->multicast_lock);
1097 }
1098
1099 struct net_bridge_group_src *
1100 br_multicast_find_group_src(struct net_bridge_port_group *pg, struct br_ip *ip)
1101 {
1102         struct net_bridge_group_src *ent;
1103
1104         switch (ip->proto) {
1105         case htons(ETH_P_IP):
1106                 hlist_for_each_entry(ent, &pg->src_list, node)
1107                         if (ip->src.ip4 == ent->addr.src.ip4)
1108                                 return ent;
1109                 break;
1110 #if IS_ENABLED(CONFIG_IPV6)
1111         case htons(ETH_P_IPV6):
1112                 hlist_for_each_entry(ent, &pg->src_list, node)
1113                         if (!ipv6_addr_cmp(&ent->addr.src.ip6, &ip->src.ip6))
1114                                 return ent;
1115                 break;
1116 #endif
1117         }
1118
1119         return NULL;
1120 }
1121
1122 static struct net_bridge_group_src *
1123 br_multicast_new_group_src(struct net_bridge_port_group *pg, struct br_ip *src_ip)
1124 {
1125         struct net_bridge_group_src *grp_src;
1126
1127         if (unlikely(pg->src_ents >= PG_SRC_ENT_LIMIT))
1128                 return NULL;
1129
1130         switch (src_ip->proto) {
1131         case htons(ETH_P_IP):
1132                 if (ipv4_is_zeronet(src_ip->src.ip4) ||
1133                     ipv4_is_multicast(src_ip->src.ip4))
1134                         return NULL;
1135                 break;
1136 #if IS_ENABLED(CONFIG_IPV6)
1137         case htons(ETH_P_IPV6):
1138                 if (ipv6_addr_any(&src_ip->src.ip6) ||
1139                     ipv6_addr_is_multicast(&src_ip->src.ip6))
1140                         return NULL;
1141                 break;
1142 #endif
1143         }
1144
1145         grp_src = kzalloc(sizeof(*grp_src), GFP_ATOMIC);
1146         if (unlikely(!grp_src))
1147                 return NULL;
1148
1149         grp_src->pg = pg;
1150         grp_src->br = pg->key.port->br;
1151         grp_src->addr = *src_ip;
1152         grp_src->mcast_gc.destroy = br_multicast_destroy_group_src;
1153         timer_setup(&grp_src->timer, br_multicast_group_src_expired, 0);
1154
1155         hlist_add_head_rcu(&grp_src->node, &pg->src_list);
1156         pg->src_ents++;
1157
1158         return grp_src;
1159 }
1160
1161 struct net_bridge_port_group *br_multicast_new_port_group(
1162                         struct net_bridge_port *port,
1163                         struct br_ip *group,
1164                         struct net_bridge_port_group __rcu *next,
1165                         unsigned char flags,
1166                         const unsigned char *src,
1167                         u8 filter_mode,
1168                         u8 rt_protocol)
1169 {
1170         struct net_bridge_port_group *p;
1171
1172         p = kzalloc(sizeof(*p), GFP_ATOMIC);
1173         if (unlikely(!p))
1174                 return NULL;
1175
1176         p->key.addr = *group;
1177         p->key.port = port;
1178         p->flags = flags;
1179         p->filter_mode = filter_mode;
1180         p->rt_protocol = rt_protocol;
1181         p->eht_host_tree = RB_ROOT;
1182         p->eht_set_tree = RB_ROOT;
1183         p->mcast_gc.destroy = br_multicast_destroy_port_group;
1184         INIT_HLIST_HEAD(&p->src_list);
1185
1186         if (!br_multicast_is_star_g(group) &&
1187             rhashtable_lookup_insert_fast(&port->br->sg_port_tbl, &p->rhnode,
1188                                           br_sg_port_rht_params)) {
1189                 kfree(p);
1190                 return NULL;
1191         }
1192
1193         rcu_assign_pointer(p->next, next);
1194         timer_setup(&p->timer, br_multicast_port_group_expired, 0);
1195         timer_setup(&p->rexmit_timer, br_multicast_port_group_rexmit, 0);
1196         hlist_add_head(&p->mglist, &port->mglist);
1197
1198         if (src)
1199                 memcpy(p->eth_addr, src, ETH_ALEN);
1200         else
1201                 eth_broadcast_addr(p->eth_addr);
1202
1203         return p;
1204 }
1205
1206 void br_multicast_host_join(struct net_bridge_mdb_entry *mp, bool notify)
1207 {
1208         if (!mp->host_joined) {
1209                 mp->host_joined = true;
1210                 if (br_multicast_is_star_g(&mp->addr))
1211                         br_multicast_star_g_host_state(mp);
1212                 if (notify)
1213                         br_mdb_notify(mp->br->dev, mp, NULL, RTM_NEWMDB);
1214         }
1215
1216         if (br_group_is_l2(&mp->addr))
1217                 return;
1218
1219         mod_timer(&mp->timer, jiffies + mp->br->multicast_membership_interval);
1220 }
1221
1222 void br_multicast_host_leave(struct net_bridge_mdb_entry *mp, bool notify)
1223 {
1224         if (!mp->host_joined)
1225                 return;
1226
1227         mp->host_joined = false;
1228         if (br_multicast_is_star_g(&mp->addr))
1229                 br_multicast_star_g_host_state(mp);
1230         if (notify)
1231                 br_mdb_notify(mp->br->dev, mp, NULL, RTM_DELMDB);
1232 }
1233
1234 static struct net_bridge_port_group *
1235 __br_multicast_add_group(struct net_bridge *br,
1236                          struct net_bridge_port *port,
1237                          struct br_ip *group,
1238                          const unsigned char *src,
1239                          u8 filter_mode,
1240                          bool igmpv2_mldv1,
1241                          bool blocked)
1242 {
1243         struct net_bridge_port_group __rcu **pp;
1244         struct net_bridge_port_group *p = NULL;
1245         struct net_bridge_mdb_entry *mp;
1246         unsigned long now = jiffies;
1247
1248         if (!netif_running(br->dev) ||
1249             (port && port->state == BR_STATE_DISABLED))
1250                 goto out;
1251
1252         mp = br_multicast_new_group(br, group);
1253         if (IS_ERR(mp))
1254                 return ERR_CAST(mp);
1255
1256         if (!port) {
1257                 br_multicast_host_join(mp, true);
1258                 goto out;
1259         }
1260
1261         for (pp = &mp->ports;
1262              (p = mlock_dereference(*pp, br)) != NULL;
1263              pp = &p->next) {
1264                 if (br_port_group_equal(p, port, src))
1265                         goto found;
1266                 if ((unsigned long)p->key.port < (unsigned long)port)
1267                         break;
1268         }
1269
1270         p = br_multicast_new_port_group(port, group, *pp, 0, src,
1271                                         filter_mode, RTPROT_KERNEL);
1272         if (unlikely(!p)) {
1273                 p = ERR_PTR(-ENOMEM);
1274                 goto out;
1275         }
1276         rcu_assign_pointer(*pp, p);
1277         if (blocked)
1278                 p->flags |= MDB_PG_FLAGS_BLOCKED;
1279         br_mdb_notify(br->dev, mp, p, RTM_NEWMDB);
1280
1281 found:
1282         if (igmpv2_mldv1)
1283                 mod_timer(&p->timer, now + br->multicast_membership_interval);
1284
1285 out:
1286         return p;
1287 }
1288
1289 static int br_multicast_add_group(struct net_bridge *br,
1290                                   struct net_bridge_port *port,
1291                                   struct br_ip *group,
1292                                   const unsigned char *src,
1293                                   u8 filter_mode,
1294                                   bool igmpv2_mldv1)
1295 {
1296         struct net_bridge_port_group *pg;
1297         int err;
1298
1299         spin_lock(&br->multicast_lock);
1300         pg = __br_multicast_add_group(br, port, group, src, filter_mode,
1301                                       igmpv2_mldv1, false);
1302         /* NULL is considered valid for host joined groups */
1303         err = PTR_ERR_OR_ZERO(pg);
1304         spin_unlock(&br->multicast_lock);
1305
1306         return err;
1307 }
1308
1309 static int br_ip4_multicast_add_group(struct net_bridge *br,
1310                                       struct net_bridge_port *port,
1311                                       __be32 group,
1312                                       __u16 vid,
1313                                       const unsigned char *src,
1314                                       bool igmpv2)
1315 {
1316         struct br_ip br_group;
1317         u8 filter_mode;
1318
1319         if (ipv4_is_local_multicast(group))
1320                 return 0;
1321
1322         memset(&br_group, 0, sizeof(br_group));
1323         br_group.dst.ip4 = group;
1324         br_group.proto = htons(ETH_P_IP);
1325         br_group.vid = vid;
1326         filter_mode = igmpv2 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1327
1328         return br_multicast_add_group(br, port, &br_group, src, filter_mode,
1329                                       igmpv2);
1330 }
1331
1332 #if IS_ENABLED(CONFIG_IPV6)
1333 static int br_ip6_multicast_add_group(struct net_bridge *br,
1334                                       struct net_bridge_port *port,
1335                                       const struct in6_addr *group,
1336                                       __u16 vid,
1337                                       const unsigned char *src,
1338                                       bool mldv1)
1339 {
1340         struct br_ip br_group;
1341         u8 filter_mode;
1342
1343         if (ipv6_addr_is_ll_all_nodes(group))
1344                 return 0;
1345
1346         memset(&br_group, 0, sizeof(br_group));
1347         br_group.dst.ip6 = *group;
1348         br_group.proto = htons(ETH_P_IPV6);
1349         br_group.vid = vid;
1350         filter_mode = mldv1 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1351
1352         return br_multicast_add_group(br, port, &br_group, src, filter_mode,
1353                                       mldv1);
1354 }
1355 #endif
1356
1357 static void br_multicast_router_expired(struct timer_list *t)
1358 {
1359         struct net_bridge_port *port =
1360                         from_timer(port, t, multicast_router_timer);
1361         struct net_bridge *br = port->br;
1362
1363         spin_lock(&br->multicast_lock);
1364         if (port->multicast_router == MDB_RTR_TYPE_DISABLED ||
1365             port->multicast_router == MDB_RTR_TYPE_PERM ||
1366             timer_pending(&port->multicast_router_timer))
1367                 goto out;
1368
1369         __del_port_router(port);
1370 out:
1371         spin_unlock(&br->multicast_lock);
1372 }
1373
1374 static void br_mc_router_state_change(struct net_bridge *p,
1375                                       bool is_mc_router)
1376 {
1377         struct switchdev_attr attr = {
1378                 .orig_dev = p->dev,
1379                 .id = SWITCHDEV_ATTR_ID_BRIDGE_MROUTER,
1380                 .flags = SWITCHDEV_F_DEFER,
1381                 .u.mrouter = is_mc_router,
1382         };
1383
1384         switchdev_port_attr_set(p->dev, &attr, NULL);
1385 }
1386
1387 static void br_multicast_local_router_expired(struct timer_list *t)
1388 {
1389         struct net_bridge *br = from_timer(br, t, multicast_router_timer);
1390
1391         spin_lock(&br->multicast_lock);
1392         if (br->multicast_router == MDB_RTR_TYPE_DISABLED ||
1393             br->multicast_router == MDB_RTR_TYPE_PERM ||
1394             timer_pending(&br->multicast_router_timer))
1395                 goto out;
1396
1397         br_mc_router_state_change(br, false);
1398 out:
1399         spin_unlock(&br->multicast_lock);
1400 }
1401
1402 static void br_multicast_querier_expired(struct net_bridge *br,
1403                                          struct bridge_mcast_own_query *query)
1404 {
1405         spin_lock(&br->multicast_lock);
1406         if (!netif_running(br->dev) || !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1407                 goto out;
1408
1409         br_multicast_start_querier(br, query);
1410
1411 out:
1412         spin_unlock(&br->multicast_lock);
1413 }
1414
1415 static void br_ip4_multicast_querier_expired(struct timer_list *t)
1416 {
1417         struct net_bridge *br = from_timer(br, t, ip4_other_query.timer);
1418
1419         br_multicast_querier_expired(br, &br->ip4_own_query);
1420 }
1421
1422 #if IS_ENABLED(CONFIG_IPV6)
1423 static void br_ip6_multicast_querier_expired(struct timer_list *t)
1424 {
1425         struct net_bridge *br = from_timer(br, t, ip6_other_query.timer);
1426
1427         br_multicast_querier_expired(br, &br->ip6_own_query);
1428 }
1429 #endif
1430
1431 static void br_multicast_select_own_querier(struct net_bridge *br,
1432                                             struct br_ip *ip,
1433                                             struct sk_buff *skb)
1434 {
1435         if (ip->proto == htons(ETH_P_IP))
1436                 br->ip4_querier.addr.src.ip4 = ip_hdr(skb)->saddr;
1437 #if IS_ENABLED(CONFIG_IPV6)
1438         else
1439                 br->ip6_querier.addr.src.ip6 = ipv6_hdr(skb)->saddr;
1440 #endif
1441 }
1442
1443 static void __br_multicast_send_query(struct net_bridge *br,
1444                                       struct net_bridge_port *port,
1445                                       struct net_bridge_port_group *pg,
1446                                       struct br_ip *ip_dst,
1447                                       struct br_ip *group,
1448                                       bool with_srcs,
1449                                       u8 sflag,
1450                                       bool *need_rexmit)
1451 {
1452         bool over_lmqt = !!sflag;
1453         struct sk_buff *skb;
1454         u8 igmp_type;
1455
1456 again_under_lmqt:
1457         skb = br_multicast_alloc_query(br, pg, ip_dst, group, with_srcs,
1458                                        over_lmqt, sflag, &igmp_type,
1459                                        need_rexmit);
1460         if (!skb)
1461                 return;
1462
1463         if (port) {
1464                 skb->dev = port->dev;
1465                 br_multicast_count(br, port, skb, igmp_type,
1466                                    BR_MCAST_DIR_TX);
1467                 NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
1468                         dev_net(port->dev), NULL, skb, NULL, skb->dev,
1469                         br_dev_queue_push_xmit);
1470
1471                 if (over_lmqt && with_srcs && sflag) {
1472                         over_lmqt = false;
1473                         goto again_under_lmqt;
1474                 }
1475         } else {
1476                 br_multicast_select_own_querier(br, group, skb);
1477                 br_multicast_count(br, port, skb, igmp_type,
1478                                    BR_MCAST_DIR_RX);
1479                 netif_rx(skb);
1480         }
1481 }
1482
1483 static void br_multicast_send_query(struct net_bridge *br,
1484                                     struct net_bridge_port *port,
1485                                     struct bridge_mcast_own_query *own_query)
1486 {
1487         struct bridge_mcast_other_query *other_query = NULL;
1488         struct br_ip br_group;
1489         unsigned long time;
1490
1491         if (!netif_running(br->dev) ||
1492             !br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
1493             !br_opt_get(br, BROPT_MULTICAST_QUERIER))
1494                 return;
1495
1496         memset(&br_group.dst, 0, sizeof(br_group.dst));
1497
1498         if (port ? (own_query == &port->ip4_own_query) :
1499                    (own_query == &br->ip4_own_query)) {
1500                 other_query = &br->ip4_other_query;
1501                 br_group.proto = htons(ETH_P_IP);
1502 #if IS_ENABLED(CONFIG_IPV6)
1503         } else {
1504                 other_query = &br->ip6_other_query;
1505                 br_group.proto = htons(ETH_P_IPV6);
1506 #endif
1507         }
1508
1509         if (!other_query || timer_pending(&other_query->timer))
1510                 return;
1511
1512         __br_multicast_send_query(br, port, NULL, NULL, &br_group, false, 0,
1513                                   NULL);
1514
1515         time = jiffies;
1516         time += own_query->startup_sent < br->multicast_startup_query_count ?
1517                 br->multicast_startup_query_interval :
1518                 br->multicast_query_interval;
1519         mod_timer(&own_query->timer, time);
1520 }
1521
1522 static void
1523 br_multicast_port_query_expired(struct net_bridge_port *port,
1524                                 struct bridge_mcast_own_query *query)
1525 {
1526         struct net_bridge *br = port->br;
1527
1528         spin_lock(&br->multicast_lock);
1529         if (port->state == BR_STATE_DISABLED ||
1530             port->state == BR_STATE_BLOCKING)
1531                 goto out;
1532
1533         if (query->startup_sent < br->multicast_startup_query_count)
1534                 query->startup_sent++;
1535
1536         br_multicast_send_query(port->br, port, query);
1537
1538 out:
1539         spin_unlock(&br->multicast_lock);
1540 }
1541
1542 static void br_ip4_multicast_port_query_expired(struct timer_list *t)
1543 {
1544         struct net_bridge_port *port = from_timer(port, t, ip4_own_query.timer);
1545
1546         br_multicast_port_query_expired(port, &port->ip4_own_query);
1547 }
1548
1549 #if IS_ENABLED(CONFIG_IPV6)
1550 static void br_ip6_multicast_port_query_expired(struct timer_list *t)
1551 {
1552         struct net_bridge_port *port = from_timer(port, t, ip6_own_query.timer);
1553
1554         br_multicast_port_query_expired(port, &port->ip6_own_query);
1555 }
1556 #endif
1557
1558 static void br_multicast_port_group_rexmit(struct timer_list *t)
1559 {
1560         struct net_bridge_port_group *pg = from_timer(pg, t, rexmit_timer);
1561         struct bridge_mcast_other_query *other_query = NULL;
1562         struct net_bridge *br = pg->key.port->br;
1563         bool need_rexmit = false;
1564
1565         spin_lock(&br->multicast_lock);
1566         if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
1567             !br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
1568             !br_opt_get(br, BROPT_MULTICAST_QUERIER))
1569                 goto out;
1570
1571         if (pg->key.addr.proto == htons(ETH_P_IP))
1572                 other_query = &br->ip4_other_query;
1573 #if IS_ENABLED(CONFIG_IPV6)
1574         else
1575                 other_query = &br->ip6_other_query;
1576 #endif
1577
1578         if (!other_query || timer_pending(&other_query->timer))
1579                 goto out;
1580
1581         if (pg->grp_query_rexmit_cnt) {
1582                 pg->grp_query_rexmit_cnt--;
1583                 __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1584                                           &pg->key.addr, false, 1, NULL);
1585         }
1586         __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1587                                   &pg->key.addr, true, 0, &need_rexmit);
1588
1589         if (pg->grp_query_rexmit_cnt || need_rexmit)
1590                 mod_timer(&pg->rexmit_timer, jiffies +
1591                                              br->multicast_last_member_interval);
1592 out:
1593         spin_unlock(&br->multicast_lock);
1594 }
1595
1596 static int br_mc_disabled_update(struct net_device *dev, bool value,
1597                                  struct netlink_ext_ack *extack)
1598 {
1599         struct switchdev_attr attr = {
1600                 .orig_dev = dev,
1601                 .id = SWITCHDEV_ATTR_ID_BRIDGE_MC_DISABLED,
1602                 .flags = SWITCHDEV_F_DEFER,
1603                 .u.mc_disabled = !value,
1604         };
1605
1606         return switchdev_port_attr_set(dev, &attr, extack);
1607 }
1608
1609 int br_multicast_add_port(struct net_bridge_port *port)
1610 {
1611         int err;
1612
1613         port->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
1614         port->multicast_eht_hosts_limit = BR_MCAST_DEFAULT_EHT_HOSTS_LIMIT;
1615
1616         timer_setup(&port->multicast_router_timer,
1617                     br_multicast_router_expired, 0);
1618         timer_setup(&port->ip4_own_query.timer,
1619                     br_ip4_multicast_port_query_expired, 0);
1620 #if IS_ENABLED(CONFIG_IPV6)
1621         timer_setup(&port->ip6_own_query.timer,
1622                     br_ip6_multicast_port_query_expired, 0);
1623 #endif
1624         err = br_mc_disabled_update(port->dev,
1625                                     br_opt_get(port->br,
1626                                                BROPT_MULTICAST_ENABLED),
1627                                     NULL);
1628         if (err && err != -EOPNOTSUPP)
1629                 return err;
1630
1631         port->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
1632         if (!port->mcast_stats)
1633                 return -ENOMEM;
1634
1635         return 0;
1636 }
1637
1638 void br_multicast_del_port(struct net_bridge_port *port)
1639 {
1640         struct net_bridge *br = port->br;
1641         struct net_bridge_port_group *pg;
1642         HLIST_HEAD(deleted_head);
1643         struct hlist_node *n;
1644
1645         /* Take care of the remaining groups, only perm ones should be left */
1646         spin_lock_bh(&br->multicast_lock);
1647         hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
1648                 br_multicast_find_del_pg(br, pg);
1649         hlist_move_list(&br->mcast_gc_list, &deleted_head);
1650         spin_unlock_bh(&br->multicast_lock);
1651         br_multicast_gc(&deleted_head);
1652         del_timer_sync(&port->multicast_router_timer);
1653         free_percpu(port->mcast_stats);
1654 }
1655
1656 static void br_multicast_enable(struct bridge_mcast_own_query *query)
1657 {
1658         query->startup_sent = 0;
1659
1660         if (try_to_del_timer_sync(&query->timer) >= 0 ||
1661             del_timer(&query->timer))
1662                 mod_timer(&query->timer, jiffies);
1663 }
1664
1665 static void __br_multicast_enable_port(struct net_bridge_port *port)
1666 {
1667         struct net_bridge *br = port->br;
1668
1669         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED) || !netif_running(br->dev))
1670                 return;
1671
1672         br_multicast_enable(&port->ip4_own_query);
1673 #if IS_ENABLED(CONFIG_IPV6)
1674         br_multicast_enable(&port->ip6_own_query);
1675 #endif
1676         if (port->multicast_router == MDB_RTR_TYPE_PERM &&
1677             hlist_unhashed(&port->rlist))
1678                 br_multicast_add_router(br, port);
1679 }
1680
1681 void br_multicast_enable_port(struct net_bridge_port *port)
1682 {
1683         struct net_bridge *br = port->br;
1684
1685         spin_lock(&br->multicast_lock);
1686         __br_multicast_enable_port(port);
1687         spin_unlock(&br->multicast_lock);
1688 }
1689
1690 void br_multicast_disable_port(struct net_bridge_port *port)
1691 {
1692         struct net_bridge *br = port->br;
1693         struct net_bridge_port_group *pg;
1694         struct hlist_node *n;
1695
1696         spin_lock(&br->multicast_lock);
1697         hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
1698                 if (!(pg->flags & MDB_PG_FLAGS_PERMANENT))
1699                         br_multicast_find_del_pg(br, pg);
1700
1701         __del_port_router(port);
1702
1703         del_timer(&port->multicast_router_timer);
1704         del_timer(&port->ip4_own_query.timer);
1705 #if IS_ENABLED(CONFIG_IPV6)
1706         del_timer(&port->ip6_own_query.timer);
1707 #endif
1708         spin_unlock(&br->multicast_lock);
1709 }
1710
1711 static int __grp_src_delete_marked(struct net_bridge_port_group *pg)
1712 {
1713         struct net_bridge_group_src *ent;
1714         struct hlist_node *tmp;
1715         int deleted = 0;
1716
1717         hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
1718                 if (ent->flags & BR_SGRP_F_DELETE) {
1719                         br_multicast_del_group_src(ent, false);
1720                         deleted++;
1721                 }
1722
1723         return deleted;
1724 }
1725
1726 static void __grp_src_mod_timer(struct net_bridge_group_src *src,
1727                                 unsigned long expires)
1728 {
1729         mod_timer(&src->timer, expires);
1730         br_multicast_fwd_src_handle(src);
1731 }
1732
1733 static void __grp_src_query_marked_and_rexmit(struct net_bridge_port_group *pg)
1734 {
1735         struct bridge_mcast_other_query *other_query = NULL;
1736         struct net_bridge *br = pg->key.port->br;
1737         u32 lmqc = br->multicast_last_member_count;
1738         unsigned long lmqt, lmi, now = jiffies;
1739         struct net_bridge_group_src *ent;
1740
1741         if (!netif_running(br->dev) ||
1742             !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1743                 return;
1744
1745         if (pg->key.addr.proto == htons(ETH_P_IP))
1746                 other_query = &br->ip4_other_query;
1747 #if IS_ENABLED(CONFIG_IPV6)
1748         else
1749                 other_query = &br->ip6_other_query;
1750 #endif
1751
1752         lmqt = now + br_multicast_lmqt(br);
1753         hlist_for_each_entry(ent, &pg->src_list, node) {
1754                 if (ent->flags & BR_SGRP_F_SEND) {
1755                         ent->flags &= ~BR_SGRP_F_SEND;
1756                         if (ent->timer.expires > lmqt) {
1757                                 if (br_opt_get(br, BROPT_MULTICAST_QUERIER) &&
1758                                     other_query &&
1759                                     !timer_pending(&other_query->timer))
1760                                         ent->src_query_rexmit_cnt = lmqc;
1761                                 __grp_src_mod_timer(ent, lmqt);
1762                         }
1763                 }
1764         }
1765
1766         if (!br_opt_get(br, BROPT_MULTICAST_QUERIER) ||
1767             !other_query || timer_pending(&other_query->timer))
1768                 return;
1769
1770         __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1771                                   &pg->key.addr, true, 1, NULL);
1772
1773         lmi = now + br->multicast_last_member_interval;
1774         if (!timer_pending(&pg->rexmit_timer) ||
1775             time_after(pg->rexmit_timer.expires, lmi))
1776                 mod_timer(&pg->rexmit_timer, lmi);
1777 }
1778
1779 static void __grp_send_query_and_rexmit(struct net_bridge_port_group *pg)
1780 {
1781         struct bridge_mcast_other_query *other_query = NULL;
1782         struct net_bridge *br = pg->key.port->br;
1783         unsigned long now = jiffies, lmi;
1784
1785         if (!netif_running(br->dev) ||
1786             !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1787                 return;
1788
1789         if (pg->key.addr.proto == htons(ETH_P_IP))
1790                 other_query = &br->ip4_other_query;
1791 #if IS_ENABLED(CONFIG_IPV6)
1792         else
1793                 other_query = &br->ip6_other_query;
1794 #endif
1795
1796         if (br_opt_get(br, BROPT_MULTICAST_QUERIER) &&
1797             other_query && !timer_pending(&other_query->timer)) {
1798                 lmi = now + br->multicast_last_member_interval;
1799                 pg->grp_query_rexmit_cnt = br->multicast_last_member_count - 1;
1800                 __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1801                                           &pg->key.addr, false, 0, NULL);
1802                 if (!timer_pending(&pg->rexmit_timer) ||
1803                     time_after(pg->rexmit_timer.expires, lmi))
1804                         mod_timer(&pg->rexmit_timer, lmi);
1805         }
1806
1807         if (pg->filter_mode == MCAST_EXCLUDE &&
1808             (!timer_pending(&pg->timer) ||
1809              time_after(pg->timer.expires, now + br_multicast_lmqt(br))))
1810                 mod_timer(&pg->timer, now + br_multicast_lmqt(br));
1811 }
1812
1813 /* State          Msg type      New state                Actions
1814  * INCLUDE (A)    IS_IN (B)     INCLUDE (A+B)            (B)=GMI
1815  * INCLUDE (A)    ALLOW (B)     INCLUDE (A+B)            (B)=GMI
1816  * EXCLUDE (X,Y)  ALLOW (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
1817  */
1818 static bool br_multicast_isinc_allow(struct net_bridge_port_group *pg, void *h_addr,
1819                                      void *srcs, u32 nsrcs, size_t addr_size,
1820                                      int grec_type)
1821 {
1822         struct net_bridge *br = pg->key.port->br;
1823         struct net_bridge_group_src *ent;
1824         unsigned long now = jiffies;
1825         bool changed = false;
1826         struct br_ip src_ip;
1827         u32 src_idx;
1828
1829         memset(&src_ip, 0, sizeof(src_ip));
1830         src_ip.proto = pg->key.addr.proto;
1831         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1832                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1833                 ent = br_multicast_find_group_src(pg, &src_ip);
1834                 if (!ent) {
1835                         ent = br_multicast_new_group_src(pg, &src_ip);
1836                         if (ent)
1837                                 changed = true;
1838                 }
1839
1840                 if (ent)
1841                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
1842         }
1843
1844         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
1845                 changed = true;
1846
1847         return changed;
1848 }
1849
1850 /* State          Msg type      New state                Actions
1851  * INCLUDE (A)    IS_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
1852  *                                                       Delete (A-B)
1853  *                                                       Group Timer=GMI
1854  */
1855 static void __grp_src_isexc_incl(struct net_bridge_port_group *pg, void *h_addr,
1856                                  void *srcs, u32 nsrcs, size_t addr_size,
1857                                  int grec_type)
1858 {
1859         struct net_bridge_group_src *ent;
1860         struct br_ip src_ip;
1861         u32 src_idx;
1862
1863         hlist_for_each_entry(ent, &pg->src_list, node)
1864                 ent->flags |= BR_SGRP_F_DELETE;
1865
1866         memset(&src_ip, 0, sizeof(src_ip));
1867         src_ip.proto = pg->key.addr.proto;
1868         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1869                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1870                 ent = br_multicast_find_group_src(pg, &src_ip);
1871                 if (ent)
1872                         ent->flags &= ~BR_SGRP_F_DELETE;
1873                 else
1874                         ent = br_multicast_new_group_src(pg, &src_ip);
1875                 if (ent)
1876                         br_multicast_fwd_src_handle(ent);
1877         }
1878
1879         br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type);
1880
1881         __grp_src_delete_marked(pg);
1882 }
1883
1884 /* State          Msg type      New state                Actions
1885  * EXCLUDE (X,Y)  IS_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=GMI
1886  *                                                       Delete (X-A)
1887  *                                                       Delete (Y-A)
1888  *                                                       Group Timer=GMI
1889  */
1890 static bool __grp_src_isexc_excl(struct net_bridge_port_group *pg, void *h_addr,
1891                                  void *srcs, u32 nsrcs, size_t addr_size,
1892                                  int grec_type)
1893 {
1894         struct net_bridge *br = pg->key.port->br;
1895         struct net_bridge_group_src *ent;
1896         unsigned long now = jiffies;
1897         bool changed = false;
1898         struct br_ip src_ip;
1899         u32 src_idx;
1900
1901         hlist_for_each_entry(ent, &pg->src_list, node)
1902                 ent->flags |= BR_SGRP_F_DELETE;
1903
1904         memset(&src_ip, 0, sizeof(src_ip));
1905         src_ip.proto = pg->key.addr.proto;
1906         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1907                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1908                 ent = br_multicast_find_group_src(pg, &src_ip);
1909                 if (ent) {
1910                         ent->flags &= ~BR_SGRP_F_DELETE;
1911                 } else {
1912                         ent = br_multicast_new_group_src(pg, &src_ip);
1913                         if (ent) {
1914                                 __grp_src_mod_timer(ent,
1915                                                     now + br_multicast_gmi(br));
1916                                 changed = true;
1917                         }
1918                 }
1919         }
1920
1921         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
1922                 changed = true;
1923
1924         if (__grp_src_delete_marked(pg))
1925                 changed = true;
1926
1927         return changed;
1928 }
1929
1930 static bool br_multicast_isexc(struct net_bridge_port_group *pg, void *h_addr,
1931                                void *srcs, u32 nsrcs, size_t addr_size,
1932                                int grec_type)
1933 {
1934         struct net_bridge *br = pg->key.port->br;
1935         bool changed = false;
1936
1937         switch (pg->filter_mode) {
1938         case MCAST_INCLUDE:
1939                 __grp_src_isexc_incl(pg, h_addr, srcs, nsrcs, addr_size,
1940                                      grec_type);
1941                 br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
1942                 changed = true;
1943                 break;
1944         case MCAST_EXCLUDE:
1945                 changed = __grp_src_isexc_excl(pg, h_addr, srcs, nsrcs, addr_size,
1946                                                grec_type);
1947                 break;
1948         }
1949
1950         pg->filter_mode = MCAST_EXCLUDE;
1951         mod_timer(&pg->timer, jiffies + br_multicast_gmi(br));
1952
1953         return changed;
1954 }
1955
1956 /* State          Msg type      New state                Actions
1957  * INCLUDE (A)    TO_IN (B)     INCLUDE (A+B)            (B)=GMI
1958  *                                                       Send Q(G,A-B)
1959  */
1960 static bool __grp_src_toin_incl(struct net_bridge_port_group *pg, void *h_addr,
1961                                 void *srcs, u32 nsrcs, size_t addr_size,
1962                                 int grec_type)
1963 {
1964         struct net_bridge *br = pg->key.port->br;
1965         u32 src_idx, to_send = pg->src_ents;
1966         struct net_bridge_group_src *ent;
1967         unsigned long now = jiffies;
1968         bool changed = false;
1969         struct br_ip src_ip;
1970
1971         hlist_for_each_entry(ent, &pg->src_list, node)
1972                 ent->flags |= BR_SGRP_F_SEND;
1973
1974         memset(&src_ip, 0, sizeof(src_ip));
1975         src_ip.proto = pg->key.addr.proto;
1976         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1977                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1978                 ent = br_multicast_find_group_src(pg, &src_ip);
1979                 if (ent) {
1980                         ent->flags &= ~BR_SGRP_F_SEND;
1981                         to_send--;
1982                 } else {
1983                         ent = br_multicast_new_group_src(pg, &src_ip);
1984                         if (ent)
1985                                 changed = true;
1986                 }
1987                 if (ent)
1988                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
1989         }
1990
1991         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
1992                 changed = true;
1993
1994         if (to_send)
1995                 __grp_src_query_marked_and_rexmit(pg);
1996
1997         return changed;
1998 }
1999
2000 /* State          Msg type      New state                Actions
2001  * EXCLUDE (X,Y)  TO_IN (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
2002  *                                                       Send Q(G,X-A)
2003  *                                                       Send Q(G)
2004  */
2005 static bool __grp_src_toin_excl(struct net_bridge_port_group *pg, void *h_addr,
2006                                 void *srcs, u32 nsrcs, size_t addr_size,
2007                                 int grec_type)
2008 {
2009         struct net_bridge *br = pg->key.port->br;
2010         u32 src_idx, to_send = pg->src_ents;
2011         struct net_bridge_group_src *ent;
2012         unsigned long now = jiffies;
2013         bool changed = false;
2014         struct br_ip src_ip;
2015
2016         hlist_for_each_entry(ent, &pg->src_list, node)
2017                 if (timer_pending(&ent->timer))
2018                         ent->flags |= BR_SGRP_F_SEND;
2019
2020         memset(&src_ip, 0, sizeof(src_ip));
2021         src_ip.proto = pg->key.addr.proto;
2022         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2023                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2024                 ent = br_multicast_find_group_src(pg, &src_ip);
2025                 if (ent) {
2026                         if (timer_pending(&ent->timer)) {
2027                                 ent->flags &= ~BR_SGRP_F_SEND;
2028                                 to_send--;
2029                         }
2030                 } else {
2031                         ent = br_multicast_new_group_src(pg, &src_ip);
2032                         if (ent)
2033                                 changed = true;
2034                 }
2035                 if (ent)
2036                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
2037         }
2038
2039         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2040                 changed = true;
2041
2042         if (to_send)
2043                 __grp_src_query_marked_and_rexmit(pg);
2044
2045         __grp_send_query_and_rexmit(pg);
2046
2047         return changed;
2048 }
2049
2050 static bool br_multicast_toin(struct net_bridge_port_group *pg, void *h_addr,
2051                               void *srcs, u32 nsrcs, size_t addr_size,
2052                               int grec_type)
2053 {
2054         bool changed = false;
2055
2056         switch (pg->filter_mode) {
2057         case MCAST_INCLUDE:
2058                 changed = __grp_src_toin_incl(pg, h_addr, srcs, nsrcs, addr_size,
2059                                               grec_type);
2060                 break;
2061         case MCAST_EXCLUDE:
2062                 changed = __grp_src_toin_excl(pg, h_addr, srcs, nsrcs, addr_size,
2063                                               grec_type);
2064                 break;
2065         }
2066
2067         if (br_multicast_eht_should_del_pg(pg)) {
2068                 pg->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2069                 br_multicast_find_del_pg(pg->key.port->br, pg);
2070                 /* a notification has already been sent and we shouldn't
2071                  * access pg after the delete so we have to return false
2072                  */
2073                 changed = false;
2074         }
2075
2076         return changed;
2077 }
2078
2079 /* State          Msg type      New state                Actions
2080  * INCLUDE (A)    TO_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
2081  *                                                       Delete (A-B)
2082  *                                                       Send Q(G,A*B)
2083  *                                                       Group Timer=GMI
2084  */
2085 static void __grp_src_toex_incl(struct net_bridge_port_group *pg, void *h_addr,
2086                                 void *srcs, u32 nsrcs, size_t addr_size,
2087                                 int grec_type)
2088 {
2089         struct net_bridge_group_src *ent;
2090         u32 src_idx, to_send = 0;
2091         struct br_ip src_ip;
2092
2093         hlist_for_each_entry(ent, &pg->src_list, node)
2094                 ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2095
2096         memset(&src_ip, 0, sizeof(src_ip));
2097         src_ip.proto = pg->key.addr.proto;
2098         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2099                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2100                 ent = br_multicast_find_group_src(pg, &src_ip);
2101                 if (ent) {
2102                         ent->flags = (ent->flags & ~BR_SGRP_F_DELETE) |
2103                                      BR_SGRP_F_SEND;
2104                         to_send++;
2105                 } else {
2106                         ent = br_multicast_new_group_src(pg, &src_ip);
2107                 }
2108                 if (ent)
2109                         br_multicast_fwd_src_handle(ent);
2110         }
2111
2112         br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type);
2113
2114         __grp_src_delete_marked(pg);
2115         if (to_send)
2116                 __grp_src_query_marked_and_rexmit(pg);
2117 }
2118
2119 /* State          Msg type      New state                Actions
2120  * EXCLUDE (X,Y)  TO_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=Group Timer
2121  *                                                       Delete (X-A)
2122  *                                                       Delete (Y-A)
2123  *                                                       Send Q(G,A-Y)
2124  *                                                       Group Timer=GMI
2125  */
2126 static bool __grp_src_toex_excl(struct net_bridge_port_group *pg, void *h_addr,
2127                                 void *srcs, u32 nsrcs, size_t addr_size,
2128                                 int grec_type)
2129 {
2130         struct net_bridge_group_src *ent;
2131         u32 src_idx, to_send = 0;
2132         bool changed = false;
2133         struct br_ip src_ip;
2134
2135         hlist_for_each_entry(ent, &pg->src_list, node)
2136                 ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2137
2138         memset(&src_ip, 0, sizeof(src_ip));
2139         src_ip.proto = pg->key.addr.proto;
2140         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2141                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2142                 ent = br_multicast_find_group_src(pg, &src_ip);
2143                 if (ent) {
2144                         ent->flags &= ~BR_SGRP_F_DELETE;
2145                 } else {
2146                         ent = br_multicast_new_group_src(pg, &src_ip);
2147                         if (ent) {
2148                                 __grp_src_mod_timer(ent, pg->timer.expires);
2149                                 changed = true;
2150                         }
2151                 }
2152                 if (ent && timer_pending(&ent->timer)) {
2153                         ent->flags |= BR_SGRP_F_SEND;
2154                         to_send++;
2155                 }
2156         }
2157
2158         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2159                 changed = true;
2160
2161         if (__grp_src_delete_marked(pg))
2162                 changed = true;
2163         if (to_send)
2164                 __grp_src_query_marked_and_rexmit(pg);
2165
2166         return changed;
2167 }
2168
2169 static bool br_multicast_toex(struct net_bridge_port_group *pg, void *h_addr,
2170                               void *srcs, u32 nsrcs, size_t addr_size,
2171                               int grec_type)
2172 {
2173         struct net_bridge *br = pg->key.port->br;
2174         bool changed = false;
2175
2176         switch (pg->filter_mode) {
2177         case MCAST_INCLUDE:
2178                 __grp_src_toex_incl(pg, h_addr, srcs, nsrcs, addr_size,
2179                                     grec_type);
2180                 br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
2181                 changed = true;
2182                 break;
2183         case MCAST_EXCLUDE:
2184                 changed = __grp_src_toex_excl(pg, h_addr, srcs, nsrcs, addr_size,
2185                                               grec_type);
2186                 break;
2187         }
2188
2189         pg->filter_mode = MCAST_EXCLUDE;
2190         mod_timer(&pg->timer, jiffies + br_multicast_gmi(br));
2191
2192         return changed;
2193 }
2194
2195 /* State          Msg type      New state                Actions
2196  * INCLUDE (A)    BLOCK (B)     INCLUDE (A)              Send Q(G,A*B)
2197  */
2198 static bool __grp_src_block_incl(struct net_bridge_port_group *pg, void *h_addr,
2199                                  void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2200 {
2201         struct net_bridge_group_src *ent;
2202         u32 src_idx, to_send = 0;
2203         bool changed = false;
2204         struct br_ip src_ip;
2205
2206         hlist_for_each_entry(ent, &pg->src_list, node)
2207                 ent->flags &= ~BR_SGRP_F_SEND;
2208
2209         memset(&src_ip, 0, sizeof(src_ip));
2210         src_ip.proto = pg->key.addr.proto;
2211         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2212                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2213                 ent = br_multicast_find_group_src(pg, &src_ip);
2214                 if (ent) {
2215                         ent->flags |= BR_SGRP_F_SEND;
2216                         to_send++;
2217                 }
2218         }
2219
2220         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2221                 changed = true;
2222
2223         if (to_send)
2224                 __grp_src_query_marked_and_rexmit(pg);
2225
2226         return changed;
2227 }
2228
2229 /* State          Msg type      New state                Actions
2230  * EXCLUDE (X,Y)  BLOCK (A)     EXCLUDE (X+(A-Y),Y)      (A-X-Y)=Group Timer
2231  *                                                       Send Q(G,A-Y)
2232  */
2233 static bool __grp_src_block_excl(struct net_bridge_port_group *pg, void *h_addr,
2234                                  void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2235 {
2236         struct net_bridge_group_src *ent;
2237         u32 src_idx, to_send = 0;
2238         bool changed = false;
2239         struct br_ip src_ip;
2240
2241         hlist_for_each_entry(ent, &pg->src_list, node)
2242                 ent->flags &= ~BR_SGRP_F_SEND;
2243
2244         memset(&src_ip, 0, sizeof(src_ip));
2245         src_ip.proto = pg->key.addr.proto;
2246         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2247                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2248                 ent = br_multicast_find_group_src(pg, &src_ip);
2249                 if (!ent) {
2250                         ent = br_multicast_new_group_src(pg, &src_ip);
2251                         if (ent) {
2252                                 __grp_src_mod_timer(ent, pg->timer.expires);
2253                                 changed = true;
2254                         }
2255                 }
2256                 if (ent && timer_pending(&ent->timer)) {
2257                         ent->flags |= BR_SGRP_F_SEND;
2258                         to_send++;
2259                 }
2260         }
2261
2262         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2263                 changed = true;
2264
2265         if (to_send)
2266                 __grp_src_query_marked_and_rexmit(pg);
2267
2268         return changed;
2269 }
2270
2271 static bool br_multicast_block(struct net_bridge_port_group *pg, void *h_addr,
2272                                void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2273 {
2274         bool changed = false;
2275
2276         switch (pg->filter_mode) {
2277         case MCAST_INCLUDE:
2278                 changed = __grp_src_block_incl(pg, h_addr, srcs, nsrcs, addr_size,
2279                                                grec_type);
2280                 break;
2281         case MCAST_EXCLUDE:
2282                 changed = __grp_src_block_excl(pg, h_addr, srcs, nsrcs, addr_size,
2283                                                grec_type);
2284                 break;
2285         }
2286
2287         if ((pg->filter_mode == MCAST_INCLUDE && hlist_empty(&pg->src_list)) ||
2288             br_multicast_eht_should_del_pg(pg)) {
2289                 if (br_multicast_eht_should_del_pg(pg))
2290                         pg->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2291                 br_multicast_find_del_pg(pg->key.port->br, pg);
2292                 /* a notification has already been sent and we shouldn't
2293                  * access pg after the delete so we have to return false
2294                  */
2295                 changed = false;
2296         }
2297
2298         return changed;
2299 }
2300
2301 static struct net_bridge_port_group *
2302 br_multicast_find_port(struct net_bridge_mdb_entry *mp,
2303                        struct net_bridge_port *p,
2304                        const unsigned char *src)
2305 {
2306         struct net_bridge *br __maybe_unused = mp->br;
2307         struct net_bridge_port_group *pg;
2308
2309         for (pg = mlock_dereference(mp->ports, br);
2310              pg;
2311              pg = mlock_dereference(pg->next, br))
2312                 if (br_port_group_equal(pg, p, src))
2313                         return pg;
2314
2315         return NULL;
2316 }
2317
2318 static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
2319                                          struct net_bridge_port *port,
2320                                          struct sk_buff *skb,
2321                                          u16 vid)
2322 {
2323         bool igmpv2 = br->multicast_igmp_version == 2;
2324         struct net_bridge_mdb_entry *mdst;
2325         struct net_bridge_port_group *pg;
2326         const unsigned char *src;
2327         struct igmpv3_report *ih;
2328         struct igmpv3_grec *grec;
2329         int i, len, num, type;
2330         __be32 group, *h_addr;
2331         bool changed = false;
2332         int err = 0;
2333         u16 nsrcs;
2334
2335         ih = igmpv3_report_hdr(skb);
2336         num = ntohs(ih->ngrec);
2337         len = skb_transport_offset(skb) + sizeof(*ih);
2338
2339         for (i = 0; i < num; i++) {
2340                 len += sizeof(*grec);
2341                 if (!ip_mc_may_pull(skb, len))
2342                         return -EINVAL;
2343
2344                 grec = (void *)(skb->data + len - sizeof(*grec));
2345                 group = grec->grec_mca;
2346                 type = grec->grec_type;
2347                 nsrcs = ntohs(grec->grec_nsrcs);
2348
2349                 len += nsrcs * 4;
2350                 if (!ip_mc_may_pull(skb, len))
2351                         return -EINVAL;
2352
2353                 switch (type) {
2354                 case IGMPV3_MODE_IS_INCLUDE:
2355                 case IGMPV3_MODE_IS_EXCLUDE:
2356                 case IGMPV3_CHANGE_TO_INCLUDE:
2357                 case IGMPV3_CHANGE_TO_EXCLUDE:
2358                 case IGMPV3_ALLOW_NEW_SOURCES:
2359                 case IGMPV3_BLOCK_OLD_SOURCES:
2360                         break;
2361
2362                 default:
2363                         continue;
2364                 }
2365
2366                 src = eth_hdr(skb)->h_source;
2367                 if (nsrcs == 0 &&
2368                     (type == IGMPV3_CHANGE_TO_INCLUDE ||
2369                      type == IGMPV3_MODE_IS_INCLUDE)) {
2370                         if (!port || igmpv2) {
2371                                 br_ip4_multicast_leave_group(br, port, group, vid, src);
2372                                 continue;
2373                         }
2374                 } else {
2375                         err = br_ip4_multicast_add_group(br, port, group, vid,
2376                                                          src, igmpv2);
2377                         if (err)
2378                                 break;
2379                 }
2380
2381                 if (!port || igmpv2)
2382                         continue;
2383
2384                 spin_lock_bh(&br->multicast_lock);
2385                 mdst = br_mdb_ip4_get(br, group, vid);
2386                 if (!mdst)
2387                         goto unlock_continue;
2388                 pg = br_multicast_find_port(mdst, port, src);
2389                 if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2390                         goto unlock_continue;
2391                 /* reload grec and host addr */
2392                 grec = (void *)(skb->data + len - sizeof(*grec) - (nsrcs * 4));
2393                 h_addr = &ip_hdr(skb)->saddr;
2394                 switch (type) {
2395                 case IGMPV3_ALLOW_NEW_SOURCES:
2396                         changed = br_multicast_isinc_allow(pg, h_addr, grec->grec_src,
2397                                                            nsrcs, sizeof(__be32), type);
2398                         break;
2399                 case IGMPV3_MODE_IS_INCLUDE:
2400                         changed = br_multicast_isinc_allow(pg, h_addr, grec->grec_src,
2401                                                            nsrcs, sizeof(__be32), type);
2402                         break;
2403                 case IGMPV3_MODE_IS_EXCLUDE:
2404                         changed = br_multicast_isexc(pg, h_addr, grec->grec_src,
2405                                                      nsrcs, sizeof(__be32), type);
2406                         break;
2407                 case IGMPV3_CHANGE_TO_INCLUDE:
2408                         changed = br_multicast_toin(pg, h_addr, grec->grec_src,
2409                                                     nsrcs, sizeof(__be32), type);
2410                         break;
2411                 case IGMPV3_CHANGE_TO_EXCLUDE:
2412                         changed = br_multicast_toex(pg, h_addr, grec->grec_src,
2413                                                     nsrcs, sizeof(__be32), type);
2414                         break;
2415                 case IGMPV3_BLOCK_OLD_SOURCES:
2416                         changed = br_multicast_block(pg, h_addr, grec->grec_src,
2417                                                      nsrcs, sizeof(__be32), type);
2418                         break;
2419                 }
2420                 if (changed)
2421                         br_mdb_notify(br->dev, mdst, pg, RTM_NEWMDB);
2422 unlock_continue:
2423                 spin_unlock_bh(&br->multicast_lock);
2424         }
2425
2426         return err;
2427 }
2428
2429 #if IS_ENABLED(CONFIG_IPV6)
2430 static int br_ip6_multicast_mld2_report(struct net_bridge *br,
2431                                         struct net_bridge_port *port,
2432                                         struct sk_buff *skb,
2433                                         u16 vid)
2434 {
2435         bool mldv1 = br->multicast_mld_version == 1;
2436         struct net_bridge_mdb_entry *mdst;
2437         struct net_bridge_port_group *pg;
2438         unsigned int nsrcs_offset;
2439         const unsigned char *src;
2440         struct icmp6hdr *icmp6h;
2441         struct in6_addr *h_addr;
2442         struct mld2_grec *grec;
2443         unsigned int grec_len;
2444         bool changed = false;
2445         int i, len, num;
2446         int err = 0;
2447
2448         if (!ipv6_mc_may_pull(skb, sizeof(*icmp6h)))
2449                 return -EINVAL;
2450
2451         icmp6h = icmp6_hdr(skb);
2452         num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
2453         len = skb_transport_offset(skb) + sizeof(*icmp6h);
2454
2455         for (i = 0; i < num; i++) {
2456                 __be16 *_nsrcs, __nsrcs;
2457                 u16 nsrcs;
2458
2459                 nsrcs_offset = len + offsetof(struct mld2_grec, grec_nsrcs);
2460
2461                 if (skb_transport_offset(skb) + ipv6_transport_len(skb) <
2462                     nsrcs_offset + sizeof(__nsrcs))
2463                         return -EINVAL;
2464
2465                 _nsrcs = skb_header_pointer(skb, nsrcs_offset,
2466                                             sizeof(__nsrcs), &__nsrcs);
2467                 if (!_nsrcs)
2468                         return -EINVAL;
2469
2470                 nsrcs = ntohs(*_nsrcs);
2471                 grec_len = struct_size(grec, grec_src, nsrcs);
2472
2473                 if (!ipv6_mc_may_pull(skb, len + grec_len))
2474                         return -EINVAL;
2475
2476                 grec = (struct mld2_grec *)(skb->data + len);
2477                 len += grec_len;
2478
2479                 switch (grec->grec_type) {
2480                 case MLD2_MODE_IS_INCLUDE:
2481                 case MLD2_MODE_IS_EXCLUDE:
2482                 case MLD2_CHANGE_TO_INCLUDE:
2483                 case MLD2_CHANGE_TO_EXCLUDE:
2484                 case MLD2_ALLOW_NEW_SOURCES:
2485                 case MLD2_BLOCK_OLD_SOURCES:
2486                         break;
2487
2488                 default:
2489                         continue;
2490                 }
2491
2492                 src = eth_hdr(skb)->h_source;
2493                 if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
2494                      grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
2495                     nsrcs == 0) {
2496                         if (!port || mldv1) {
2497                                 br_ip6_multicast_leave_group(br, port,
2498                                                              &grec->grec_mca,
2499                                                              vid, src);
2500                                 continue;
2501                         }
2502                 } else {
2503                         err = br_ip6_multicast_add_group(br, port,
2504                                                          &grec->grec_mca, vid,
2505                                                          src, mldv1);
2506                         if (err)
2507                                 break;
2508                 }
2509
2510                 if (!port || mldv1)
2511                         continue;
2512
2513                 spin_lock_bh(&br->multicast_lock);
2514                 mdst = br_mdb_ip6_get(br, &grec->grec_mca, vid);
2515                 if (!mdst)
2516                         goto unlock_continue;
2517                 pg = br_multicast_find_port(mdst, port, src);
2518                 if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2519                         goto unlock_continue;
2520                 h_addr = &ipv6_hdr(skb)->saddr;
2521                 switch (grec->grec_type) {
2522                 case MLD2_ALLOW_NEW_SOURCES:
2523                         changed = br_multicast_isinc_allow(pg, h_addr,
2524                                                            grec->grec_src, nsrcs,
2525                                                            sizeof(struct in6_addr),
2526                                                            grec->grec_type);
2527                         break;
2528                 case MLD2_MODE_IS_INCLUDE:
2529                         changed = br_multicast_isinc_allow(pg, h_addr,
2530                                                            grec->grec_src, nsrcs,
2531                                                            sizeof(struct in6_addr),
2532                                                            grec->grec_type);
2533                         break;
2534                 case MLD2_MODE_IS_EXCLUDE:
2535                         changed = br_multicast_isexc(pg, h_addr,
2536                                                      grec->grec_src, nsrcs,
2537                                                      sizeof(struct in6_addr),
2538                                                      grec->grec_type);
2539                         break;
2540                 case MLD2_CHANGE_TO_INCLUDE:
2541                         changed = br_multicast_toin(pg, h_addr,
2542                                                     grec->grec_src, nsrcs,
2543                                                     sizeof(struct in6_addr),
2544                                                     grec->grec_type);
2545                         break;
2546                 case MLD2_CHANGE_TO_EXCLUDE:
2547                         changed = br_multicast_toex(pg, h_addr,
2548                                                     grec->grec_src, nsrcs,
2549                                                     sizeof(struct in6_addr),
2550                                                     grec->grec_type);
2551                         break;
2552                 case MLD2_BLOCK_OLD_SOURCES:
2553                         changed = br_multicast_block(pg, h_addr,
2554                                                      grec->grec_src, nsrcs,
2555                                                      sizeof(struct in6_addr),
2556                                                      grec->grec_type);
2557                         break;
2558                 }
2559                 if (changed)
2560                         br_mdb_notify(br->dev, mdst, pg, RTM_NEWMDB);
2561 unlock_continue:
2562                 spin_unlock_bh(&br->multicast_lock);
2563         }
2564
2565         return err;
2566 }
2567 #endif
2568
2569 static bool br_ip4_multicast_select_querier(struct net_bridge *br,
2570                                             struct net_bridge_port *port,
2571                                             __be32 saddr)
2572 {
2573         if (!timer_pending(&br->ip4_own_query.timer) &&
2574             !timer_pending(&br->ip4_other_query.timer))
2575                 goto update;
2576
2577         if (!br->ip4_querier.addr.src.ip4)
2578                 goto update;
2579
2580         if (ntohl(saddr) <= ntohl(br->ip4_querier.addr.src.ip4))
2581                 goto update;
2582
2583         return false;
2584
2585 update:
2586         br->ip4_querier.addr.src.ip4 = saddr;
2587
2588         /* update protected by general multicast_lock by caller */
2589         rcu_assign_pointer(br->ip4_querier.port, port);
2590
2591         return true;
2592 }
2593
2594 #if IS_ENABLED(CONFIG_IPV6)
2595 static bool br_ip6_multicast_select_querier(struct net_bridge *br,
2596                                             struct net_bridge_port *port,
2597                                             struct in6_addr *saddr)
2598 {
2599         if (!timer_pending(&br->ip6_own_query.timer) &&
2600             !timer_pending(&br->ip6_other_query.timer))
2601                 goto update;
2602
2603         if (ipv6_addr_cmp(saddr, &br->ip6_querier.addr.src.ip6) <= 0)
2604                 goto update;
2605
2606         return false;
2607
2608 update:
2609         br->ip6_querier.addr.src.ip6 = *saddr;
2610
2611         /* update protected by general multicast_lock by caller */
2612         rcu_assign_pointer(br->ip6_querier.port, port);
2613
2614         return true;
2615 }
2616 #endif
2617
2618 static bool br_multicast_select_querier(struct net_bridge *br,
2619                                         struct net_bridge_port *port,
2620                                         struct br_ip *saddr)
2621 {
2622         switch (saddr->proto) {
2623         case htons(ETH_P_IP):
2624                 return br_ip4_multicast_select_querier(br, port, saddr->src.ip4);
2625 #if IS_ENABLED(CONFIG_IPV6)
2626         case htons(ETH_P_IPV6):
2627                 return br_ip6_multicast_select_querier(br, port, &saddr->src.ip6);
2628 #endif
2629         }
2630
2631         return false;
2632 }
2633
2634 static void
2635 br_multicast_update_query_timer(struct net_bridge *br,
2636                                 struct bridge_mcast_other_query *query,
2637                                 unsigned long max_delay)
2638 {
2639         if (!timer_pending(&query->timer))
2640                 query->delay_time = jiffies + max_delay;
2641
2642         mod_timer(&query->timer, jiffies + br->multicast_querier_interval);
2643 }
2644
2645 static void br_port_mc_router_state_change(struct net_bridge_port *p,
2646                                            bool is_mc_router)
2647 {
2648         struct switchdev_attr attr = {
2649                 .orig_dev = p->dev,
2650                 .id = SWITCHDEV_ATTR_ID_PORT_MROUTER,
2651                 .flags = SWITCHDEV_F_DEFER,
2652                 .u.mrouter = is_mc_router,
2653         };
2654
2655         switchdev_port_attr_set(p->dev, &attr, NULL);
2656 }
2657
2658 /*
2659  * Add port to router_list
2660  *  list is maintained ordered by pointer value
2661  *  and locked by br->multicast_lock and RCU
2662  */
2663 static void br_multicast_add_router(struct net_bridge *br,
2664                                     struct net_bridge_port *port)
2665 {
2666         struct net_bridge_port *p;
2667         struct hlist_node *slot = NULL;
2668
2669         if (!hlist_unhashed(&port->rlist))
2670                 return;
2671
2672         hlist_for_each_entry(p, &br->router_list, rlist) {
2673                 if ((unsigned long) port >= (unsigned long) p)
2674                         break;
2675                 slot = &p->rlist;
2676         }
2677
2678         if (slot)
2679                 hlist_add_behind_rcu(&port->rlist, slot);
2680         else
2681                 hlist_add_head_rcu(&port->rlist, &br->router_list);
2682         br_rtr_notify(br->dev, port, RTM_NEWMDB);
2683         br_port_mc_router_state_change(port, true);
2684 }
2685
2686 static void br_multicast_mark_router(struct net_bridge *br,
2687                                      struct net_bridge_port *port)
2688 {
2689         unsigned long now = jiffies;
2690
2691         if (!port) {
2692                 if (br->multicast_router == MDB_RTR_TYPE_TEMP_QUERY) {
2693                         if (!timer_pending(&br->multicast_router_timer))
2694                                 br_mc_router_state_change(br, true);
2695                         mod_timer(&br->multicast_router_timer,
2696                                   now + br->multicast_querier_interval);
2697                 }
2698                 return;
2699         }
2700
2701         if (port->multicast_router == MDB_RTR_TYPE_DISABLED ||
2702             port->multicast_router == MDB_RTR_TYPE_PERM)
2703                 return;
2704
2705         br_multicast_add_router(br, port);
2706
2707         mod_timer(&port->multicast_router_timer,
2708                   now + br->multicast_querier_interval);
2709 }
2710
2711 static void br_multicast_query_received(struct net_bridge *br,
2712                                         struct net_bridge_port *port,
2713                                         struct bridge_mcast_other_query *query,
2714                                         struct br_ip *saddr,
2715                                         unsigned long max_delay)
2716 {
2717         if (!br_multicast_select_querier(br, port, saddr))
2718                 return;
2719
2720         br_multicast_update_query_timer(br, query, max_delay);
2721         br_multicast_mark_router(br, port);
2722 }
2723
2724 static void br_ip4_multicast_query(struct net_bridge *br,
2725                                    struct net_bridge_port *port,
2726                                    struct sk_buff *skb,
2727                                    u16 vid)
2728 {
2729         unsigned int transport_len = ip_transport_len(skb);
2730         const struct iphdr *iph = ip_hdr(skb);
2731         struct igmphdr *ih = igmp_hdr(skb);
2732         struct net_bridge_mdb_entry *mp;
2733         struct igmpv3_query *ih3;
2734         struct net_bridge_port_group *p;
2735         struct net_bridge_port_group __rcu **pp;
2736         struct br_ip saddr;
2737         unsigned long max_delay;
2738         unsigned long now = jiffies;
2739         __be32 group;
2740
2741         spin_lock(&br->multicast_lock);
2742         if (!netif_running(br->dev) ||
2743             (port && port->state == BR_STATE_DISABLED))
2744                 goto out;
2745
2746         group = ih->group;
2747
2748         if (transport_len == sizeof(*ih)) {
2749                 max_delay = ih->code * (HZ / IGMP_TIMER_SCALE);
2750
2751                 if (!max_delay) {
2752                         max_delay = 10 * HZ;
2753                         group = 0;
2754                 }
2755         } else if (transport_len >= sizeof(*ih3)) {
2756                 ih3 = igmpv3_query_hdr(skb);
2757                 if (ih3->nsrcs ||
2758                     (br->multicast_igmp_version == 3 && group && ih3->suppress))
2759                         goto out;
2760
2761                 max_delay = ih3->code ?
2762                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
2763         } else {
2764                 goto out;
2765         }
2766
2767         if (!group) {
2768                 saddr.proto = htons(ETH_P_IP);
2769                 saddr.src.ip4 = iph->saddr;
2770
2771                 br_multicast_query_received(br, port, &br->ip4_other_query,
2772                                             &saddr, max_delay);
2773                 goto out;
2774         }
2775
2776         mp = br_mdb_ip4_get(br, group, vid);
2777         if (!mp)
2778                 goto out;
2779
2780         max_delay *= br->multicast_last_member_count;
2781
2782         if (mp->host_joined &&
2783             (timer_pending(&mp->timer) ?
2784              time_after(mp->timer.expires, now + max_delay) :
2785              try_to_del_timer_sync(&mp->timer) >= 0))
2786                 mod_timer(&mp->timer, now + max_delay);
2787
2788         for (pp = &mp->ports;
2789              (p = mlock_dereference(*pp, br)) != NULL;
2790              pp = &p->next) {
2791                 if (timer_pending(&p->timer) ?
2792                     time_after(p->timer.expires, now + max_delay) :
2793                     try_to_del_timer_sync(&p->timer) >= 0 &&
2794                     (br->multicast_igmp_version == 2 ||
2795                      p->filter_mode == MCAST_EXCLUDE))
2796                         mod_timer(&p->timer, now + max_delay);
2797         }
2798
2799 out:
2800         spin_unlock(&br->multicast_lock);
2801 }
2802
2803 #if IS_ENABLED(CONFIG_IPV6)
2804 static int br_ip6_multicast_query(struct net_bridge *br,
2805                                   struct net_bridge_port *port,
2806                                   struct sk_buff *skb,
2807                                   u16 vid)
2808 {
2809         unsigned int transport_len = ipv6_transport_len(skb);
2810         struct mld_msg *mld;
2811         struct net_bridge_mdb_entry *mp;
2812         struct mld2_query *mld2q;
2813         struct net_bridge_port_group *p;
2814         struct net_bridge_port_group __rcu **pp;
2815         struct br_ip saddr;
2816         unsigned long max_delay;
2817         unsigned long now = jiffies;
2818         unsigned int offset = skb_transport_offset(skb);
2819         const struct in6_addr *group = NULL;
2820         bool is_general_query;
2821         int err = 0;
2822
2823         spin_lock(&br->multicast_lock);
2824         if (!netif_running(br->dev) ||
2825             (port && port->state == BR_STATE_DISABLED))
2826                 goto out;
2827
2828         if (transport_len == sizeof(*mld)) {
2829                 if (!pskb_may_pull(skb, offset + sizeof(*mld))) {
2830                         err = -EINVAL;
2831                         goto out;
2832                 }
2833                 mld = (struct mld_msg *) icmp6_hdr(skb);
2834                 max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
2835                 if (max_delay)
2836                         group = &mld->mld_mca;
2837         } else {
2838                 if (!pskb_may_pull(skb, offset + sizeof(*mld2q))) {
2839                         err = -EINVAL;
2840                         goto out;
2841                 }
2842                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
2843                 if (!mld2q->mld2q_nsrcs)
2844                         group = &mld2q->mld2q_mca;
2845                 if (br->multicast_mld_version == 2 &&
2846                     !ipv6_addr_any(&mld2q->mld2q_mca) &&
2847                     mld2q->mld2q_suppress)
2848                         goto out;
2849
2850                 max_delay = max(msecs_to_jiffies(mldv2_mrc(mld2q)), 1UL);
2851         }
2852
2853         is_general_query = group && ipv6_addr_any(group);
2854
2855         if (is_general_query) {
2856                 saddr.proto = htons(ETH_P_IPV6);
2857                 saddr.src.ip6 = ipv6_hdr(skb)->saddr;
2858
2859                 br_multicast_query_received(br, port, &br->ip6_other_query,
2860                                             &saddr, max_delay);
2861                 goto out;
2862         } else if (!group) {
2863                 goto out;
2864         }
2865
2866         mp = br_mdb_ip6_get(br, group, vid);
2867         if (!mp)
2868                 goto out;
2869
2870         max_delay *= br->multicast_last_member_count;
2871         if (mp->host_joined &&
2872             (timer_pending(&mp->timer) ?
2873              time_after(mp->timer.expires, now + max_delay) :
2874              try_to_del_timer_sync(&mp->timer) >= 0))
2875                 mod_timer(&mp->timer, now + max_delay);
2876
2877         for (pp = &mp->ports;
2878              (p = mlock_dereference(*pp, br)) != NULL;
2879              pp = &p->next) {
2880                 if (timer_pending(&p->timer) ?
2881                     time_after(p->timer.expires, now + max_delay) :
2882                     try_to_del_timer_sync(&p->timer) >= 0 &&
2883                     (br->multicast_mld_version == 1 ||
2884                      p->filter_mode == MCAST_EXCLUDE))
2885                         mod_timer(&p->timer, now + max_delay);
2886         }
2887
2888 out:
2889         spin_unlock(&br->multicast_lock);
2890         return err;
2891 }
2892 #endif
2893
2894 static void
2895 br_multicast_leave_group(struct net_bridge *br,
2896                          struct net_bridge_port *port,
2897                          struct br_ip *group,
2898                          struct bridge_mcast_other_query *other_query,
2899                          struct bridge_mcast_own_query *own_query,
2900                          const unsigned char *src)
2901 {
2902         struct net_bridge_mdb_entry *mp;
2903         struct net_bridge_port_group *p;
2904         unsigned long now;
2905         unsigned long time;
2906
2907         spin_lock(&br->multicast_lock);
2908         if (!netif_running(br->dev) ||
2909             (port && port->state == BR_STATE_DISABLED))
2910                 goto out;
2911
2912         mp = br_mdb_ip_get(br, group);
2913         if (!mp)
2914                 goto out;
2915
2916         if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
2917                 struct net_bridge_port_group __rcu **pp;
2918
2919                 for (pp = &mp->ports;
2920                      (p = mlock_dereference(*pp, br)) != NULL;
2921                      pp = &p->next) {
2922                         if (!br_port_group_equal(p, port, src))
2923                                 continue;
2924
2925                         if (p->flags & MDB_PG_FLAGS_PERMANENT)
2926                                 break;
2927
2928                         p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2929                         br_multicast_del_pg(mp, p, pp);
2930                 }
2931                 goto out;
2932         }
2933
2934         if (timer_pending(&other_query->timer))
2935                 goto out;
2936
2937         if (br_opt_get(br, BROPT_MULTICAST_QUERIER)) {
2938                 __br_multicast_send_query(br, port, NULL, NULL, &mp->addr,
2939                                           false, 0, NULL);
2940
2941                 time = jiffies + br->multicast_last_member_count *
2942                                  br->multicast_last_member_interval;
2943
2944                 mod_timer(&own_query->timer, time);
2945
2946                 for (p = mlock_dereference(mp->ports, br);
2947                      p != NULL;
2948                      p = mlock_dereference(p->next, br)) {
2949                         if (!br_port_group_equal(p, port, src))
2950                                 continue;
2951
2952                         if (!hlist_unhashed(&p->mglist) &&
2953                             (timer_pending(&p->timer) ?
2954                              time_after(p->timer.expires, time) :
2955                              try_to_del_timer_sync(&p->timer) >= 0)) {
2956                                 mod_timer(&p->timer, time);
2957                         }
2958
2959                         break;
2960                 }
2961         }
2962
2963         now = jiffies;
2964         time = now + br->multicast_last_member_count *
2965                      br->multicast_last_member_interval;
2966
2967         if (!port) {
2968                 if (mp->host_joined &&
2969                     (timer_pending(&mp->timer) ?
2970                      time_after(mp->timer.expires, time) :
2971                      try_to_del_timer_sync(&mp->timer) >= 0)) {
2972                         mod_timer(&mp->timer, time);
2973                 }
2974
2975                 goto out;
2976         }
2977
2978         for (p = mlock_dereference(mp->ports, br);
2979              p != NULL;
2980              p = mlock_dereference(p->next, br)) {
2981                 if (p->key.port != port)
2982                         continue;
2983
2984                 if (!hlist_unhashed(&p->mglist) &&
2985                     (timer_pending(&p->timer) ?
2986                      time_after(p->timer.expires, time) :
2987                      try_to_del_timer_sync(&p->timer) >= 0)) {
2988                         mod_timer(&p->timer, time);
2989                 }
2990
2991                 break;
2992         }
2993 out:
2994         spin_unlock(&br->multicast_lock);
2995 }
2996
2997 static void br_ip4_multicast_leave_group(struct net_bridge *br,
2998                                          struct net_bridge_port *port,
2999                                          __be32 group,
3000                                          __u16 vid,
3001                                          const unsigned char *src)
3002 {
3003         struct br_ip br_group;
3004         struct bridge_mcast_own_query *own_query;
3005
3006         if (ipv4_is_local_multicast(group))
3007                 return;
3008
3009         own_query = port ? &port->ip4_own_query : &br->ip4_own_query;
3010
3011         memset(&br_group, 0, sizeof(br_group));
3012         br_group.dst.ip4 = group;
3013         br_group.proto = htons(ETH_P_IP);
3014         br_group.vid = vid;
3015
3016         br_multicast_leave_group(br, port, &br_group, &br->ip4_other_query,
3017                                  own_query, src);
3018 }
3019
3020 #if IS_ENABLED(CONFIG_IPV6)
3021 static void br_ip6_multicast_leave_group(struct net_bridge *br,
3022                                          struct net_bridge_port *port,
3023                                          const struct in6_addr *group,
3024                                          __u16 vid,
3025                                          const unsigned char *src)
3026 {
3027         struct br_ip br_group;
3028         struct bridge_mcast_own_query *own_query;
3029
3030         if (ipv6_addr_is_ll_all_nodes(group))
3031                 return;
3032
3033         own_query = port ? &port->ip6_own_query : &br->ip6_own_query;
3034
3035         memset(&br_group, 0, sizeof(br_group));
3036         br_group.dst.ip6 = *group;
3037         br_group.proto = htons(ETH_P_IPV6);
3038         br_group.vid = vid;
3039
3040         br_multicast_leave_group(br, port, &br_group, &br->ip6_other_query,
3041                                  own_query, src);
3042 }
3043 #endif
3044
3045 static void br_multicast_err_count(const struct net_bridge *br,
3046                                    const struct net_bridge_port *p,
3047                                    __be16 proto)
3048 {
3049         struct bridge_mcast_stats __percpu *stats;
3050         struct bridge_mcast_stats *pstats;
3051
3052         if (!br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
3053                 return;
3054
3055         if (p)
3056                 stats = p->mcast_stats;
3057         else
3058                 stats = br->mcast_stats;
3059         if (WARN_ON(!stats))
3060                 return;
3061
3062         pstats = this_cpu_ptr(stats);
3063
3064         u64_stats_update_begin(&pstats->syncp);
3065         switch (proto) {
3066         case htons(ETH_P_IP):
3067                 pstats->mstats.igmp_parse_errors++;
3068                 break;
3069 #if IS_ENABLED(CONFIG_IPV6)
3070         case htons(ETH_P_IPV6):
3071                 pstats->mstats.mld_parse_errors++;
3072                 break;
3073 #endif
3074         }
3075         u64_stats_update_end(&pstats->syncp);
3076 }
3077
3078 static void br_multicast_pim(struct net_bridge *br,
3079                              struct net_bridge_port *port,
3080                              const struct sk_buff *skb)
3081 {
3082         unsigned int offset = skb_transport_offset(skb);
3083         struct pimhdr *pimhdr, _pimhdr;
3084
3085         pimhdr = skb_header_pointer(skb, offset, sizeof(_pimhdr), &_pimhdr);
3086         if (!pimhdr || pim_hdr_version(pimhdr) != PIM_VERSION ||
3087             pim_hdr_type(pimhdr) != PIM_TYPE_HELLO)
3088                 return;
3089
3090         br_multicast_mark_router(br, port);
3091 }
3092
3093 static int br_ip4_multicast_mrd_rcv(struct net_bridge *br,
3094                                     struct net_bridge_port *port,
3095                                     struct sk_buff *skb)
3096 {
3097         if (ip_hdr(skb)->protocol != IPPROTO_IGMP ||
3098             igmp_hdr(skb)->type != IGMP_MRDISC_ADV)
3099                 return -ENOMSG;
3100
3101         br_multicast_mark_router(br, port);
3102
3103         return 0;
3104 }
3105
3106 static int br_multicast_ipv4_rcv(struct net_bridge *br,
3107                                  struct net_bridge_port *port,
3108                                  struct sk_buff *skb,
3109                                  u16 vid)
3110 {
3111         const unsigned char *src;
3112         struct igmphdr *ih;
3113         int err;
3114
3115         err = ip_mc_check_igmp(skb);
3116
3117         if (err == -ENOMSG) {
3118                 if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
3119                         BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3120                 } else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
3121                         if (ip_hdr(skb)->protocol == IPPROTO_PIM)
3122                                 br_multicast_pim(br, port, skb);
3123                 } else if (ipv4_is_all_snoopers(ip_hdr(skb)->daddr)) {
3124                         br_ip4_multicast_mrd_rcv(br, port, skb);
3125                 }
3126
3127                 return 0;
3128         } else if (err < 0) {
3129                 br_multicast_err_count(br, port, skb->protocol);
3130                 return err;
3131         }
3132
3133         ih = igmp_hdr(skb);
3134         src = eth_hdr(skb)->h_source;
3135         BR_INPUT_SKB_CB(skb)->igmp = ih->type;
3136
3137         switch (ih->type) {
3138         case IGMP_HOST_MEMBERSHIP_REPORT:
3139         case IGMPV2_HOST_MEMBERSHIP_REPORT:
3140                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3141                 err = br_ip4_multicast_add_group(br, port, ih->group, vid, src,
3142                                                  true);
3143                 break;
3144         case IGMPV3_HOST_MEMBERSHIP_REPORT:
3145                 err = br_ip4_multicast_igmp3_report(br, port, skb, vid);
3146                 break;
3147         case IGMP_HOST_MEMBERSHIP_QUERY:
3148                 br_ip4_multicast_query(br, port, skb, vid);
3149                 break;
3150         case IGMP_HOST_LEAVE_MESSAGE:
3151                 br_ip4_multicast_leave_group(br, port, ih->group, vid, src);
3152                 break;
3153         }
3154
3155         br_multicast_count(br, port, skb, BR_INPUT_SKB_CB(skb)->igmp,
3156                            BR_MCAST_DIR_RX);
3157
3158         return err;
3159 }
3160
3161 #if IS_ENABLED(CONFIG_IPV6)
3162 static void br_ip6_multicast_mrd_rcv(struct net_bridge *br,
3163                                      struct net_bridge_port *port,
3164                                      struct sk_buff *skb)
3165 {
3166         if (icmp6_hdr(skb)->icmp6_type != ICMPV6_MRDISC_ADV)
3167                 return;
3168
3169         br_multicast_mark_router(br, port);
3170 }
3171
3172 static int br_multicast_ipv6_rcv(struct net_bridge *br,
3173                                  struct net_bridge_port *port,
3174                                  struct sk_buff *skb,
3175                                  u16 vid)
3176 {
3177         const unsigned char *src;
3178         struct mld_msg *mld;
3179         int err;
3180
3181         err = ipv6_mc_check_mld(skb);
3182
3183         if (err == -ENOMSG || err == -ENODATA) {
3184                 if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
3185                         BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3186                 if (err == -ENODATA &&
3187                     ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
3188                         br_ip6_multicast_mrd_rcv(br, port, skb);
3189
3190                 return 0;
3191         } else if (err < 0) {
3192                 br_multicast_err_count(br, port, skb->protocol);
3193                 return err;
3194         }
3195
3196         mld = (struct mld_msg *)skb_transport_header(skb);
3197         BR_INPUT_SKB_CB(skb)->igmp = mld->mld_type;
3198
3199         switch (mld->mld_type) {
3200         case ICMPV6_MGM_REPORT:
3201                 src = eth_hdr(skb)->h_source;
3202                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3203                 err = br_ip6_multicast_add_group(br, port, &mld->mld_mca, vid,
3204                                                  src, true);
3205                 break;
3206         case ICMPV6_MLD2_REPORT:
3207                 err = br_ip6_multicast_mld2_report(br, port, skb, vid);
3208                 break;
3209         case ICMPV6_MGM_QUERY:
3210                 err = br_ip6_multicast_query(br, port, skb, vid);
3211                 break;
3212         case ICMPV6_MGM_REDUCTION:
3213                 src = eth_hdr(skb)->h_source;
3214                 br_ip6_multicast_leave_group(br, port, &mld->mld_mca, vid, src);
3215                 break;
3216         }
3217
3218         br_multicast_count(br, port, skb, BR_INPUT_SKB_CB(skb)->igmp,
3219                            BR_MCAST_DIR_RX);
3220
3221         return err;
3222 }
3223 #endif
3224
3225 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
3226                      struct sk_buff *skb, u16 vid)
3227 {
3228         int ret = 0;
3229
3230         BR_INPUT_SKB_CB(skb)->igmp = 0;
3231         BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
3232
3233         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
3234                 return 0;
3235
3236         switch (skb->protocol) {
3237         case htons(ETH_P_IP):
3238                 ret = br_multicast_ipv4_rcv(br, port, skb, vid);
3239                 break;
3240 #if IS_ENABLED(CONFIG_IPV6)
3241         case htons(ETH_P_IPV6):
3242                 ret = br_multicast_ipv6_rcv(br, port, skb, vid);
3243                 break;
3244 #endif
3245         }
3246
3247         return ret;
3248 }
3249
3250 static void br_multicast_query_expired(struct net_bridge *br,
3251                                        struct bridge_mcast_own_query *query,
3252                                        struct bridge_mcast_querier *querier)
3253 {
3254         spin_lock(&br->multicast_lock);
3255         if (query->startup_sent < br->multicast_startup_query_count)
3256                 query->startup_sent++;
3257
3258         RCU_INIT_POINTER(querier->port, NULL);
3259         br_multicast_send_query(br, NULL, query);
3260         spin_unlock(&br->multicast_lock);
3261 }
3262
3263 static void br_ip4_multicast_query_expired(struct timer_list *t)
3264 {
3265         struct net_bridge *br = from_timer(br, t, ip4_own_query.timer);
3266
3267         br_multicast_query_expired(br, &br->ip4_own_query, &br->ip4_querier);
3268 }
3269
3270 #if IS_ENABLED(CONFIG_IPV6)
3271 static void br_ip6_multicast_query_expired(struct timer_list *t)
3272 {
3273         struct net_bridge *br = from_timer(br, t, ip6_own_query.timer);
3274
3275         br_multicast_query_expired(br, &br->ip6_own_query, &br->ip6_querier);
3276 }
3277 #endif
3278
3279 static void br_multicast_gc_work(struct work_struct *work)
3280 {
3281         struct net_bridge *br = container_of(work, struct net_bridge,
3282                                              mcast_gc_work);
3283         HLIST_HEAD(deleted_head);
3284
3285         spin_lock_bh(&br->multicast_lock);
3286         hlist_move_list(&br->mcast_gc_list, &deleted_head);
3287         spin_unlock_bh(&br->multicast_lock);
3288
3289         br_multicast_gc(&deleted_head);
3290 }
3291
3292 void br_multicast_init(struct net_bridge *br)
3293 {
3294         br->hash_max = BR_MULTICAST_DEFAULT_HASH_MAX;
3295
3296         br->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3297         br->multicast_last_member_count = 2;
3298         br->multicast_startup_query_count = 2;
3299
3300         br->multicast_last_member_interval = HZ;
3301         br->multicast_query_response_interval = 10 * HZ;
3302         br->multicast_startup_query_interval = 125 * HZ / 4;
3303         br->multicast_query_interval = 125 * HZ;
3304         br->multicast_querier_interval = 255 * HZ;
3305         br->multicast_membership_interval = 260 * HZ;
3306
3307         br->ip4_other_query.delay_time = 0;
3308         br->ip4_querier.port = NULL;
3309         br->multicast_igmp_version = 2;
3310 #if IS_ENABLED(CONFIG_IPV6)
3311         br->multicast_mld_version = 1;
3312         br->ip6_other_query.delay_time = 0;
3313         br->ip6_querier.port = NULL;
3314 #endif
3315         br_opt_toggle(br, BROPT_MULTICAST_ENABLED, true);
3316         br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
3317
3318         spin_lock_init(&br->multicast_lock);
3319         timer_setup(&br->multicast_router_timer,
3320                     br_multicast_local_router_expired, 0);
3321         timer_setup(&br->ip4_other_query.timer,
3322                     br_ip4_multicast_querier_expired, 0);
3323         timer_setup(&br->ip4_own_query.timer,
3324                     br_ip4_multicast_query_expired, 0);
3325 #if IS_ENABLED(CONFIG_IPV6)
3326         timer_setup(&br->ip6_other_query.timer,
3327                     br_ip6_multicast_querier_expired, 0);
3328         timer_setup(&br->ip6_own_query.timer,
3329                     br_ip6_multicast_query_expired, 0);
3330 #endif
3331         INIT_HLIST_HEAD(&br->mdb_list);
3332         INIT_HLIST_HEAD(&br->mcast_gc_list);
3333         INIT_WORK(&br->mcast_gc_work, br_multicast_gc_work);
3334 }
3335
3336 static void br_ip4_multicast_join_snoopers(struct net_bridge *br)
3337 {
3338         struct in_device *in_dev = in_dev_get(br->dev);
3339
3340         if (!in_dev)
3341                 return;
3342
3343         __ip_mc_inc_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
3344         in_dev_put(in_dev);
3345 }
3346
3347 #if IS_ENABLED(CONFIG_IPV6)
3348 static void br_ip6_multicast_join_snoopers(struct net_bridge *br)
3349 {
3350         struct in6_addr addr;
3351
3352         ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
3353         ipv6_dev_mc_inc(br->dev, &addr);
3354 }
3355 #else
3356 static inline void br_ip6_multicast_join_snoopers(struct net_bridge *br)
3357 {
3358 }
3359 #endif
3360
3361 void br_multicast_join_snoopers(struct net_bridge *br)
3362 {
3363         br_ip4_multicast_join_snoopers(br);
3364         br_ip6_multicast_join_snoopers(br);
3365 }
3366
3367 static void br_ip4_multicast_leave_snoopers(struct net_bridge *br)
3368 {
3369         struct in_device *in_dev = in_dev_get(br->dev);
3370
3371         if (WARN_ON(!in_dev))
3372                 return;
3373
3374         __ip_mc_dec_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
3375         in_dev_put(in_dev);
3376 }
3377
3378 #if IS_ENABLED(CONFIG_IPV6)
3379 static void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
3380 {
3381         struct in6_addr addr;
3382
3383         ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
3384         ipv6_dev_mc_dec(br->dev, &addr);
3385 }
3386 #else
3387 static inline void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
3388 {
3389 }
3390 #endif
3391
3392 void br_multicast_leave_snoopers(struct net_bridge *br)
3393 {
3394         br_ip4_multicast_leave_snoopers(br);
3395         br_ip6_multicast_leave_snoopers(br);
3396 }
3397
3398 static void __br_multicast_open(struct net_bridge *br,
3399                                 struct bridge_mcast_own_query *query)
3400 {
3401         query->startup_sent = 0;
3402
3403         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
3404                 return;
3405
3406         mod_timer(&query->timer, jiffies);
3407 }
3408
3409 void br_multicast_open(struct net_bridge *br)
3410 {
3411         __br_multicast_open(br, &br->ip4_own_query);
3412 #if IS_ENABLED(CONFIG_IPV6)
3413         __br_multicast_open(br, &br->ip6_own_query);
3414 #endif
3415 }
3416
3417 void br_multicast_stop(struct net_bridge *br)
3418 {
3419         del_timer_sync(&br->multicast_router_timer);
3420         del_timer_sync(&br->ip4_other_query.timer);
3421         del_timer_sync(&br->ip4_own_query.timer);
3422 #if IS_ENABLED(CONFIG_IPV6)
3423         del_timer_sync(&br->ip6_other_query.timer);
3424         del_timer_sync(&br->ip6_own_query.timer);
3425 #endif
3426 }
3427
3428 void br_multicast_dev_del(struct net_bridge *br)
3429 {
3430         struct net_bridge_mdb_entry *mp;
3431         HLIST_HEAD(deleted_head);
3432         struct hlist_node *tmp;
3433
3434         spin_lock_bh(&br->multicast_lock);
3435         hlist_for_each_entry_safe(mp, tmp, &br->mdb_list, mdb_node)
3436                 br_multicast_del_mdb_entry(mp);
3437         hlist_move_list(&br->mcast_gc_list, &deleted_head);
3438         spin_unlock_bh(&br->multicast_lock);
3439
3440         br_multicast_gc(&deleted_head);
3441         cancel_work_sync(&br->mcast_gc_work);
3442
3443         rcu_barrier();
3444 }
3445
3446 int br_multicast_set_router(struct net_bridge *br, unsigned long val)
3447 {
3448         int err = -EINVAL;
3449
3450         spin_lock_bh(&br->multicast_lock);
3451
3452         switch (val) {
3453         case MDB_RTR_TYPE_DISABLED:
3454         case MDB_RTR_TYPE_PERM:
3455                 br_mc_router_state_change(br, val == MDB_RTR_TYPE_PERM);
3456                 del_timer(&br->multicast_router_timer);
3457                 br->multicast_router = val;
3458                 err = 0;
3459                 break;
3460         case MDB_RTR_TYPE_TEMP_QUERY:
3461                 if (br->multicast_router != MDB_RTR_TYPE_TEMP_QUERY)
3462                         br_mc_router_state_change(br, false);
3463                 br->multicast_router = val;
3464                 err = 0;
3465                 break;
3466         }
3467
3468         spin_unlock_bh(&br->multicast_lock);
3469
3470         return err;
3471 }
3472
3473 static void __del_port_router(struct net_bridge_port *p)
3474 {
3475         if (hlist_unhashed(&p->rlist))
3476                 return;
3477         hlist_del_init_rcu(&p->rlist);
3478         br_rtr_notify(p->br->dev, p, RTM_DELMDB);
3479         br_port_mc_router_state_change(p, false);
3480
3481         /* don't allow timer refresh */
3482         if (p->multicast_router == MDB_RTR_TYPE_TEMP)
3483                 p->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3484 }
3485
3486 int br_multicast_set_port_router(struct net_bridge_port *p, unsigned long val)
3487 {
3488         struct net_bridge *br = p->br;
3489         unsigned long now = jiffies;
3490         int err = -EINVAL;
3491
3492         spin_lock(&br->multicast_lock);
3493         if (p->multicast_router == val) {
3494                 /* Refresh the temp router port timer */
3495                 if (p->multicast_router == MDB_RTR_TYPE_TEMP)
3496                         mod_timer(&p->multicast_router_timer,
3497                                   now + br->multicast_querier_interval);
3498                 err = 0;
3499                 goto unlock;
3500         }
3501         switch (val) {
3502         case MDB_RTR_TYPE_DISABLED:
3503                 p->multicast_router = MDB_RTR_TYPE_DISABLED;
3504                 __del_port_router(p);
3505                 del_timer(&p->multicast_router_timer);
3506                 break;
3507         case MDB_RTR_TYPE_TEMP_QUERY:
3508                 p->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3509                 __del_port_router(p);
3510                 break;
3511         case MDB_RTR_TYPE_PERM:
3512                 p->multicast_router = MDB_RTR_TYPE_PERM;
3513                 del_timer(&p->multicast_router_timer);
3514                 br_multicast_add_router(br, p);
3515                 break;
3516         case MDB_RTR_TYPE_TEMP:
3517                 p->multicast_router = MDB_RTR_TYPE_TEMP;
3518                 br_multicast_mark_router(br, p);
3519                 break;
3520         default:
3521                 goto unlock;
3522         }
3523         err = 0;
3524 unlock:
3525         spin_unlock(&br->multicast_lock);
3526
3527         return err;
3528 }
3529
3530 static void br_multicast_start_querier(struct net_bridge *br,
3531                                        struct bridge_mcast_own_query *query)
3532 {
3533         struct net_bridge_port *port;
3534
3535         __br_multicast_open(br, query);
3536
3537         rcu_read_lock();
3538         list_for_each_entry_rcu(port, &br->port_list, list) {
3539                 if (port->state == BR_STATE_DISABLED ||
3540                     port->state == BR_STATE_BLOCKING)
3541                         continue;
3542
3543                 if (query == &br->ip4_own_query)
3544                         br_multicast_enable(&port->ip4_own_query);
3545 #if IS_ENABLED(CONFIG_IPV6)
3546                 else
3547                         br_multicast_enable(&port->ip6_own_query);
3548 #endif
3549         }
3550         rcu_read_unlock();
3551 }
3552
3553 int br_multicast_toggle(struct net_bridge *br, unsigned long val,
3554                         struct netlink_ext_ack *extack)
3555 {
3556         struct net_bridge_port *port;
3557         bool change_snoopers = false;
3558         int err = 0;
3559
3560         spin_lock_bh(&br->multicast_lock);
3561         if (!!br_opt_get(br, BROPT_MULTICAST_ENABLED) == !!val)
3562                 goto unlock;
3563
3564         err = br_mc_disabled_update(br->dev, val, extack);
3565         if (err == -EOPNOTSUPP)
3566                 err = 0;
3567         if (err)
3568                 goto unlock;
3569
3570         br_opt_toggle(br, BROPT_MULTICAST_ENABLED, !!val);
3571         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED)) {
3572                 change_snoopers = true;
3573                 goto unlock;
3574         }
3575
3576         if (!netif_running(br->dev))
3577                 goto unlock;
3578
3579         br_multicast_open(br);
3580         list_for_each_entry(port, &br->port_list, list)
3581                 __br_multicast_enable_port(port);
3582
3583         change_snoopers = true;
3584
3585 unlock:
3586         spin_unlock_bh(&br->multicast_lock);
3587
3588         /* br_multicast_join_snoopers has the potential to cause
3589          * an MLD Report/Leave to be delivered to br_multicast_rcv,
3590          * which would in turn call br_multicast_add_group, which would
3591          * attempt to acquire multicast_lock. This function should be
3592          * called after the lock has been released to avoid deadlocks on
3593          * multicast_lock.
3594          *
3595          * br_multicast_leave_snoopers does not have the problem since
3596          * br_multicast_rcv first checks BROPT_MULTICAST_ENABLED, and
3597          * returns without calling br_multicast_ipv4/6_rcv if it's not
3598          * enabled. Moved both functions out just for symmetry.
3599          */
3600         if (change_snoopers) {
3601                 if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
3602                         br_multicast_join_snoopers(br);
3603                 else
3604                         br_multicast_leave_snoopers(br);
3605         }
3606
3607         return err;
3608 }
3609
3610 bool br_multicast_enabled(const struct net_device *dev)
3611 {
3612         struct net_bridge *br = netdev_priv(dev);
3613
3614         return !!br_opt_get(br, BROPT_MULTICAST_ENABLED);
3615 }
3616 EXPORT_SYMBOL_GPL(br_multicast_enabled);
3617
3618 bool br_multicast_router(const struct net_device *dev)
3619 {
3620         struct net_bridge *br = netdev_priv(dev);
3621         bool is_router;
3622
3623         spin_lock_bh(&br->multicast_lock);
3624         is_router = br_multicast_is_router(br);
3625         spin_unlock_bh(&br->multicast_lock);
3626         return is_router;
3627 }
3628 EXPORT_SYMBOL_GPL(br_multicast_router);
3629
3630 int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
3631 {
3632         unsigned long max_delay;
3633
3634         val = !!val;
3635
3636         spin_lock_bh(&br->multicast_lock);
3637         if (br_opt_get(br, BROPT_MULTICAST_QUERIER) == val)
3638                 goto unlock;
3639
3640         br_opt_toggle(br, BROPT_MULTICAST_QUERIER, !!val);
3641         if (!val)
3642                 goto unlock;
3643
3644         max_delay = br->multicast_query_response_interval;
3645
3646         if (!timer_pending(&br->ip4_other_query.timer))
3647                 br->ip4_other_query.delay_time = jiffies + max_delay;
3648
3649         br_multicast_start_querier(br, &br->ip4_own_query);
3650
3651 #if IS_ENABLED(CONFIG_IPV6)
3652         if (!timer_pending(&br->ip6_other_query.timer))
3653                 br->ip6_other_query.delay_time = jiffies + max_delay;
3654
3655         br_multicast_start_querier(br, &br->ip6_own_query);
3656 #endif
3657
3658 unlock:
3659         spin_unlock_bh(&br->multicast_lock);
3660
3661         return 0;
3662 }
3663
3664 int br_multicast_set_igmp_version(struct net_bridge *br, unsigned long val)
3665 {
3666         /* Currently we support only version 2 and 3 */
3667         switch (val) {
3668         case 2:
3669         case 3:
3670                 break;
3671         default:
3672                 return -EINVAL;
3673         }
3674
3675         spin_lock_bh(&br->multicast_lock);
3676         br->multicast_igmp_version = val;
3677         spin_unlock_bh(&br->multicast_lock);
3678
3679         return 0;
3680 }
3681
3682 #if IS_ENABLED(CONFIG_IPV6)
3683 int br_multicast_set_mld_version(struct net_bridge *br, unsigned long val)
3684 {
3685         /* Currently we support version 1 and 2 */
3686         switch (val) {
3687         case 1:
3688         case 2:
3689                 break;
3690         default:
3691                 return -EINVAL;
3692         }
3693
3694         spin_lock_bh(&br->multicast_lock);
3695         br->multicast_mld_version = val;
3696         spin_unlock_bh(&br->multicast_lock);
3697
3698         return 0;
3699 }
3700 #endif
3701
3702 /**
3703  * br_multicast_list_adjacent - Returns snooped multicast addresses
3704  * @dev:        The bridge port adjacent to which to retrieve addresses
3705  * @br_ip_list: The list to store found, snooped multicast IP addresses in
3706  *
3707  * Creates a list of IP addresses (struct br_ip_list) sensed by the multicast
3708  * snooping feature on all bridge ports of dev's bridge device, excluding
3709  * the addresses from dev itself.
3710  *
3711  * Returns the number of items added to br_ip_list.
3712  *
3713  * Notes:
3714  * - br_ip_list needs to be initialized by caller
3715  * - br_ip_list might contain duplicates in the end
3716  *   (needs to be taken care of by caller)
3717  * - br_ip_list needs to be freed by caller
3718  */
3719 int br_multicast_list_adjacent(struct net_device *dev,
3720                                struct list_head *br_ip_list)
3721 {
3722         struct net_bridge *br;
3723         struct net_bridge_port *port;
3724         struct net_bridge_port_group *group;
3725         struct br_ip_list *entry;
3726         int count = 0;
3727
3728         rcu_read_lock();
3729         if (!br_ip_list || !netif_is_bridge_port(dev))
3730                 goto unlock;
3731
3732         port = br_port_get_rcu(dev);
3733         if (!port || !port->br)
3734                 goto unlock;
3735
3736         br = port->br;
3737
3738         list_for_each_entry_rcu(port, &br->port_list, list) {
3739                 if (!port->dev || port->dev == dev)
3740                         continue;
3741
3742                 hlist_for_each_entry_rcu(group, &port->mglist, mglist) {
3743                         entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
3744                         if (!entry)
3745                                 goto unlock;
3746
3747                         entry->addr = group->key.addr;
3748                         list_add(&entry->list, br_ip_list);
3749                         count++;
3750                 }
3751         }
3752
3753 unlock:
3754         rcu_read_unlock();
3755         return count;
3756 }
3757 EXPORT_SYMBOL_GPL(br_multicast_list_adjacent);
3758
3759 /**
3760  * br_multicast_has_querier_anywhere - Checks for a querier on a bridge
3761  * @dev: The bridge port providing the bridge on which to check for a querier
3762  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
3763  *
3764  * Checks whether the given interface has a bridge on top and if so returns
3765  * true if a valid querier exists anywhere on the bridged link layer.
3766  * Otherwise returns false.
3767  */
3768 bool br_multicast_has_querier_anywhere(struct net_device *dev, int proto)
3769 {
3770         struct net_bridge *br;
3771         struct net_bridge_port *port;
3772         struct ethhdr eth;
3773         bool ret = false;
3774
3775         rcu_read_lock();
3776         if (!netif_is_bridge_port(dev))
3777                 goto unlock;
3778
3779         port = br_port_get_rcu(dev);
3780         if (!port || !port->br)
3781                 goto unlock;
3782
3783         br = port->br;
3784
3785         memset(&eth, 0, sizeof(eth));
3786         eth.h_proto = htons(proto);
3787
3788         ret = br_multicast_querier_exists(br, &eth, NULL);
3789
3790 unlock:
3791         rcu_read_unlock();
3792         return ret;
3793 }
3794 EXPORT_SYMBOL_GPL(br_multicast_has_querier_anywhere);
3795
3796 /**
3797  * br_multicast_has_querier_adjacent - Checks for a querier behind a bridge port
3798  * @dev: The bridge port adjacent to which to check for a querier
3799  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
3800  *
3801  * Checks whether the given interface has a bridge on top and if so returns
3802  * true if a selected querier is behind one of the other ports of this
3803  * bridge. Otherwise returns false.
3804  */
3805 bool br_multicast_has_querier_adjacent(struct net_device *dev, int proto)
3806 {
3807         struct net_bridge *br;
3808         struct net_bridge_port *port;
3809         bool ret = false;
3810
3811         rcu_read_lock();
3812         if (!netif_is_bridge_port(dev))
3813                 goto unlock;
3814
3815         port = br_port_get_rcu(dev);
3816         if (!port || !port->br)
3817                 goto unlock;
3818
3819         br = port->br;
3820
3821         switch (proto) {
3822         case ETH_P_IP:
3823                 if (!timer_pending(&br->ip4_other_query.timer) ||
3824                     rcu_dereference(br->ip4_querier.port) == port)
3825                         goto unlock;
3826                 break;
3827 #if IS_ENABLED(CONFIG_IPV6)
3828         case ETH_P_IPV6:
3829                 if (!timer_pending(&br->ip6_other_query.timer) ||
3830                     rcu_dereference(br->ip6_querier.port) == port)
3831                         goto unlock;
3832                 break;
3833 #endif
3834         default:
3835                 goto unlock;
3836         }
3837
3838         ret = true;
3839 unlock:
3840         rcu_read_unlock();
3841         return ret;
3842 }
3843 EXPORT_SYMBOL_GPL(br_multicast_has_querier_adjacent);
3844
3845 static void br_mcast_stats_add(struct bridge_mcast_stats __percpu *stats,
3846                                const struct sk_buff *skb, u8 type, u8 dir)
3847 {
3848         struct bridge_mcast_stats *pstats = this_cpu_ptr(stats);
3849         __be16 proto = skb->protocol;
3850         unsigned int t_len;
3851
3852         u64_stats_update_begin(&pstats->syncp);
3853         switch (proto) {
3854         case htons(ETH_P_IP):
3855                 t_len = ntohs(ip_hdr(skb)->tot_len) - ip_hdrlen(skb);
3856                 switch (type) {
3857                 case IGMP_HOST_MEMBERSHIP_REPORT:
3858                         pstats->mstats.igmp_v1reports[dir]++;
3859                         break;
3860                 case IGMPV2_HOST_MEMBERSHIP_REPORT:
3861                         pstats->mstats.igmp_v2reports[dir]++;
3862                         break;
3863                 case IGMPV3_HOST_MEMBERSHIP_REPORT:
3864                         pstats->mstats.igmp_v3reports[dir]++;
3865                         break;
3866                 case IGMP_HOST_MEMBERSHIP_QUERY:
3867                         if (t_len != sizeof(struct igmphdr)) {
3868                                 pstats->mstats.igmp_v3queries[dir]++;
3869                         } else {
3870                                 unsigned int offset = skb_transport_offset(skb);
3871                                 struct igmphdr *ih, _ihdr;
3872
3873                                 ih = skb_header_pointer(skb, offset,
3874                                                         sizeof(_ihdr), &_ihdr);
3875                                 if (!ih)
3876                                         break;
3877                                 if (!ih->code)
3878                                         pstats->mstats.igmp_v1queries[dir]++;
3879                                 else
3880                                         pstats->mstats.igmp_v2queries[dir]++;
3881                         }
3882                         break;
3883                 case IGMP_HOST_LEAVE_MESSAGE:
3884                         pstats->mstats.igmp_leaves[dir]++;
3885                         break;
3886                 }
3887                 break;
3888 #if IS_ENABLED(CONFIG_IPV6)
3889         case htons(ETH_P_IPV6):
3890                 t_len = ntohs(ipv6_hdr(skb)->payload_len) +
3891                         sizeof(struct ipv6hdr);
3892                 t_len -= skb_network_header_len(skb);
3893                 switch (type) {
3894                 case ICMPV6_MGM_REPORT:
3895                         pstats->mstats.mld_v1reports[dir]++;
3896                         break;
3897                 case ICMPV6_MLD2_REPORT:
3898                         pstats->mstats.mld_v2reports[dir]++;
3899                         break;
3900                 case ICMPV6_MGM_QUERY:
3901                         if (t_len != sizeof(struct mld_msg))
3902                                 pstats->mstats.mld_v2queries[dir]++;
3903                         else
3904                                 pstats->mstats.mld_v1queries[dir]++;
3905                         break;
3906                 case ICMPV6_MGM_REDUCTION:
3907                         pstats->mstats.mld_leaves[dir]++;
3908                         break;
3909                 }
3910                 break;
3911 #endif /* CONFIG_IPV6 */
3912         }
3913         u64_stats_update_end(&pstats->syncp);
3914 }
3915
3916 void br_multicast_count(struct net_bridge *br, const struct net_bridge_port *p,
3917                         const struct sk_buff *skb, u8 type, u8 dir)
3918 {
3919         struct bridge_mcast_stats __percpu *stats;
3920
3921         /* if multicast_disabled is true then igmp type can't be set */
3922         if (!type || !br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
3923                 return;
3924
3925         if (p)
3926                 stats = p->mcast_stats;
3927         else
3928                 stats = br->mcast_stats;
3929         if (WARN_ON(!stats))
3930                 return;
3931
3932         br_mcast_stats_add(stats, skb, type, dir);
3933 }
3934
3935 int br_multicast_init_stats(struct net_bridge *br)
3936 {
3937         br->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
3938         if (!br->mcast_stats)
3939                 return -ENOMEM;
3940
3941         return 0;
3942 }
3943
3944 void br_multicast_uninit_stats(struct net_bridge *br)
3945 {
3946         free_percpu(br->mcast_stats);
3947 }
3948
3949 /* noinline for https://bugs.llvm.org/show_bug.cgi?id=45802#c9 */
3950 static noinline_for_stack void mcast_stats_add_dir(u64 *dst, u64 *src)
3951 {
3952         dst[BR_MCAST_DIR_RX] += src[BR_MCAST_DIR_RX];
3953         dst[BR_MCAST_DIR_TX] += src[BR_MCAST_DIR_TX];
3954 }
3955
3956 void br_multicast_get_stats(const struct net_bridge *br,
3957                             const struct net_bridge_port *p,
3958                             struct br_mcast_stats *dest)
3959 {
3960         struct bridge_mcast_stats __percpu *stats;
3961         struct br_mcast_stats tdst;
3962         int i;
3963
3964         memset(dest, 0, sizeof(*dest));
3965         if (p)
3966                 stats = p->mcast_stats;
3967         else
3968                 stats = br->mcast_stats;
3969         if (WARN_ON(!stats))
3970                 return;
3971
3972         memset(&tdst, 0, sizeof(tdst));
3973         for_each_possible_cpu(i) {
3974                 struct bridge_mcast_stats *cpu_stats = per_cpu_ptr(stats, i);
3975                 struct br_mcast_stats temp;
3976                 unsigned int start;
3977
3978                 do {
3979                         start = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
3980                         memcpy(&temp, &cpu_stats->mstats, sizeof(temp));
3981                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, start));
3982
3983                 mcast_stats_add_dir(tdst.igmp_v1queries, temp.igmp_v1queries);
3984                 mcast_stats_add_dir(tdst.igmp_v2queries, temp.igmp_v2queries);
3985                 mcast_stats_add_dir(tdst.igmp_v3queries, temp.igmp_v3queries);
3986                 mcast_stats_add_dir(tdst.igmp_leaves, temp.igmp_leaves);
3987                 mcast_stats_add_dir(tdst.igmp_v1reports, temp.igmp_v1reports);
3988                 mcast_stats_add_dir(tdst.igmp_v2reports, temp.igmp_v2reports);
3989                 mcast_stats_add_dir(tdst.igmp_v3reports, temp.igmp_v3reports);
3990                 tdst.igmp_parse_errors += temp.igmp_parse_errors;
3991
3992                 mcast_stats_add_dir(tdst.mld_v1queries, temp.mld_v1queries);
3993                 mcast_stats_add_dir(tdst.mld_v2queries, temp.mld_v2queries);
3994                 mcast_stats_add_dir(tdst.mld_leaves, temp.mld_leaves);
3995                 mcast_stats_add_dir(tdst.mld_v1reports, temp.mld_v1reports);
3996                 mcast_stats_add_dir(tdst.mld_v2reports, temp.mld_v2reports);
3997                 tdst.mld_parse_errors += temp.mld_parse_errors;
3998         }
3999         memcpy(dest, &tdst, sizeof(*dest));
4000 }
4001
4002 int br_mdb_hash_init(struct net_bridge *br)
4003 {
4004         int err;
4005
4006         err = rhashtable_init(&br->sg_port_tbl, &br_sg_port_rht_params);
4007         if (err)
4008                 return err;
4009
4010         err = rhashtable_init(&br->mdb_hash_tbl, &br_mdb_rht_params);
4011         if (err) {
4012                 rhashtable_destroy(&br->sg_port_tbl);
4013                 return err;
4014         }
4015
4016         return 0;
4017 }
4018
4019 void br_mdb_hash_fini(struct net_bridge *br)
4020 {
4021         rhashtable_destroy(&br->sg_port_tbl);
4022         rhashtable_destroy(&br->mdb_hash_tbl);
4023 }