net/bridge/br_multicast.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Bridge multicast support.
   4  *
   5  * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au>
   6  */
   7
   8 #include <linux/err.h>
   9 #include <linux/export.h>
  10 #include <linux/if_ether.h>
  11 #include <linux/igmp.h>
  12 #include <linux/in.h>
  13 #include <linux/jhash.h>
  14 #include <linux/kernel.h>
  15 #include <linux/log2.h>
  16 #include <linux/netdevice.h>
  17 #include <linux/netfilter_bridge.h>
  18 #include <linux/random.h>
  19 #include <linux/rculist.h>
  20 #include <linux/skbuff.h>
  21 #include <linux/slab.h>
  22 #include <linux/timer.h>
  23 #include <linux/inetdevice.h>
  24 #include <linux/mroute.h>
  25 #include <net/ip.h>
  26 #include <net/switchdev.h>
  27 #if IS_ENABLED(CONFIG_IPV6)
  28 #include <linux/icmpv6.h>
  29 #include <net/ipv6.h>
  30 #include <net/mld.h>
  31 #include <net/ip6_checksum.h>
  32 #include <net/addrconf.h>
  33 #endif
  34
  35 #include "br_private.h"
  36 #include "br_private_mcast_eht.h"
  37
  38 static const struct rhashtable_params br_mdb_rht_params = {
  39         .head_offset = offsetof(struct net_bridge_mdb_entry, rhnode),
  40         .key_offset = offsetof(struct net_bridge_mdb_entry, addr),
  41         .key_len = sizeof(struct br_ip),
  42         .automatic_shrinking = true,
  43 };
  44
  45 static const struct rhashtable_params br_sg_port_rht_params = {
  46         .head_offset = offsetof(struct net_bridge_port_group, rhnode),
  47         .key_offset = offsetof(struct net_bridge_port_group, key),
  48         .key_len = sizeof(struct net_bridge_port_group_sg_key),
  49         .automatic_shrinking = true,
  50 };
  51
  52 static void br_multicast_start_querier(struct net_bridge *br,
  53                                        struct bridge_mcast_own_query *query);
  54 static void br_multicast_add_router(struct net_bridge *br,
  55                                     struct net_bridge_port *port);
  56 static void br_ip4_multicast_leave_group(struct net_bridge *br,
  57                                          struct net_bridge_port *port,
  58                                          __be32 group,
  59                                          __u16 vid,
  60                                          const unsigned char *src);
  61 static void br_multicast_port_group_rexmit(struct timer_list *t);
  62
  63 static void __del_port_router(struct net_bridge_port *p);
  64 #if IS_ENABLED(CONFIG_IPV6)
  65 static void br_ip6_multicast_leave_group(struct net_bridge *br,
  66                                          struct net_bridge_port *port,
  67                                          const struct in6_addr *group,
  68                                          __u16 vid, const unsigned char *src);
  69 #endif
  70 static struct net_bridge_port_group *
  71 __br_multicast_add_group(struct net_bridge *br,
  72                          struct net_bridge_port *port,
  73                          struct br_ip *group,
  74                          const unsigned char *src,
  75                          u8 filter_mode,
  76                          bool igmpv2_mldv1,
  77                          bool blocked);
  78 static void br_multicast_find_del_pg(struct net_bridge *br,
  79                                      struct net_bridge_port_group *pg);
  80
  81 static struct net_bridge_port_group *
  82 br_sg_port_find(struct net_bridge *br,
  83                 struct net_bridge_port_group_sg_key *sg_p)
  84 {
  85         lockdep_assert_held_once(&br->multicast_lock);
  86
  87         return rhashtable_lookup_fast(&br->sg_port_tbl, sg_p,
  88                                       br_sg_port_rht_params);
  89 }
  90
  91 static struct net_bridge_mdb_entry *br_mdb_ip_get_rcu(struct net_bridge *br,
  92                                                       struct br_ip *dst)
  93 {
  94         return rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
  95 }
  96
  97 struct net_bridge_mdb_entry *br_mdb_ip_get(struct net_bridge *br,
  98                                            struct br_ip *dst)
  99 {
 100         struct net_bridge_mdb_entry *ent;
 101
 102         lockdep_assert_held_once(&br->multicast_lock);
 103
 104         rcu_read_lock();
 105         ent = rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
 106         rcu_read_unlock();
 107
 108         return ent;
 109 }
 110
 111 static struct net_bridge_mdb_entry *br_mdb_ip4_get(struct net_bridge *br,
 112                                                    __be32 dst, __u16 vid)
 113 {
 114         struct br_ip br_dst;
 115
 116         memset(&br_dst, 0, sizeof(br_dst));
 117         br_dst.dst.ip4 = dst;
 118         br_dst.proto = htons(ETH_P_IP);
 119         br_dst.vid = vid;
 120
 121         return br_mdb_ip_get(br, &br_dst);
 122 }
 123
 124 #if IS_ENABLED(CONFIG_IPV6)
 125 static struct net_bridge_mdb_entry *br_mdb_ip6_get(struct net_bridge *br,
 126                                                    const struct in6_addr *dst,
 127                                                    __u16 vid)
 128 {
 129         struct br_ip br_dst;
 130
 131         memset(&br_dst, 0, sizeof(br_dst));
 132         br_dst.dst.ip6 = *dst;
 133         br_dst.proto = htons(ETH_P_IPV6);
 134         br_dst.vid = vid;
 135
 136         return br_mdb_ip_get(br, &br_dst);
 137 }
 138 #endif
 139
 140 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
 141                                         struct sk_buff *skb, u16 vid)
 142 {
 143         struct br_ip ip;
 144
 145         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
 146                 return NULL;
 147
 148         if (BR_INPUT_SKB_CB(skb)->igmp)
 149                 return NULL;
 150
 151         memset(&ip, 0, sizeof(ip));
 152         ip.proto = skb->protocol;
 153         ip.vid = vid;
 154
 155         switch (skb->protocol) {
 156         case htons(ETH_P_IP):
 157                 ip.dst.ip4 = ip_hdr(skb)->daddr;
 158                 if (br->multicast_igmp_version == 3) {
 159                         struct net_bridge_mdb_entry *mdb;
 160
 161                         ip.src.ip4 = ip_hdr(skb)->saddr;
 162                         mdb = br_mdb_ip_get_rcu(br, &ip);
 163                         if (mdb)
 164                                 return mdb;
 165                         ip.src.ip4 = 0;
 166                 }
 167                 break;
 168 #if IS_ENABLED(CONFIG_IPV6)
 169         case htons(ETH_P_IPV6):
 170                 ip.dst.ip6 = ipv6_hdr(skb)->daddr;
 171                 if (br->multicast_mld_version == 2) {
 172                         struct net_bridge_mdb_entry *mdb;
 173
 174                         ip.src.ip6 = ipv6_hdr(skb)->saddr;
 175                         mdb = br_mdb_ip_get_rcu(br, &ip);
 176                         if (mdb)
 177                                 return mdb;
 178                         memset(&ip.src.ip6, 0, sizeof(ip.src.ip6));
 179                 }
 180                 break;
 181 #endif
 182         default:
 183                 ip.proto = 0;
 184                 ether_addr_copy(ip.dst.mac_addr, eth_hdr(skb)->h_dest);
 185         }
 186
 187         return br_mdb_ip_get_rcu(br, &ip);
 188 }
 189
 190 static bool br_port_group_equal(struct net_bridge_port_group *p,
 191                                 struct net_bridge_port *port,
 192                                 const unsigned char *src)
 193 {
 194         if (p->key.port != port)
 195                 return false;
 196
 197         if (!(port->flags & BR_MULTICAST_TO_UNICAST))
 198                 return true;
 199
 200         return ether_addr_equal(src, p->eth_addr);
 201 }
 202
 203 static void __fwd_add_star_excl(struct net_bridge_port_group *pg,
 204                                 struct br_ip *sg_ip)
 205 {
 206         struct net_bridge_port_group_sg_key sg_key;
 207         struct net_bridge *br = pg->key.port->br;
 208         struct net_bridge_port_group *src_pg;
 209
 210         memset(&sg_key, 0, sizeof(sg_key));
 211         sg_key.port = pg->key.port;
 212         sg_key.addr = *sg_ip;
 213         if (br_sg_port_find(br, &sg_key))
 214                 return;
 215
 216         src_pg = __br_multicast_add_group(br, pg->key.port, sg_ip, pg->eth_addr,
 217                                           MCAST_INCLUDE, false, false);
 218         if (IS_ERR_OR_NULL(src_pg) ||
 219             src_pg->rt_protocol != RTPROT_KERNEL)
 220                 return;
 221
 222         src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
 223 }
 224
 225 static void __fwd_del_star_excl(struct net_bridge_port_group *pg,
 226                                 struct br_ip *sg_ip)
 227 {
 228         struct net_bridge_port_group_sg_key sg_key;
 229         struct net_bridge *br = pg->key.port->br;
 230         struct net_bridge_port_group *src_pg;
 231
 232         memset(&sg_key, 0, sizeof(sg_key));
 233         sg_key.port = pg->key.port;
 234         sg_key.addr = *sg_ip;
 235         src_pg = br_sg_port_find(br, &sg_key);
 236         if (!src_pg || !(src_pg->flags & MDB_PG_FLAGS_STAR_EXCL) ||
 237             src_pg->rt_protocol != RTPROT_KERNEL)
 238                 return;
 239
 240         br_multicast_find_del_pg(br, src_pg);
 241 }
 242
 243 /* When a port group transitions to (or is added as) EXCLUDE we need to add it
 244  * to all other ports' S,G entries which are not blocked by the current group
 245  * for proper replication, the assumption is that any S,G blocked entries
 246  * are already added so the S,G,port lookup should skip them.
 247  * When a port group transitions from EXCLUDE -> INCLUDE mode or is being
 248  * deleted we need to remove it from all ports' S,G entries where it was
 249  * automatically installed before (i.e. where it's MDB_PG_FLAGS_STAR_EXCL).
 250  */
 251 void br_multicast_star_g_handle_mode(struct net_bridge_port_group *pg,
 252                                      u8 filter_mode)
 253 {
 254         struct net_bridge *br = pg->key.port->br;
 255         struct net_bridge_port_group *pg_lst;
 256         struct net_bridge_mdb_entry *mp;
 257         struct br_ip sg_ip;
 258
 259         if (WARN_ON(!br_multicast_is_star_g(&pg->key.addr)))
 260                 return;
 261
 262         mp = br_mdb_ip_get(br, &pg->key.addr);
 263         if (!mp)
 264                 return;
 265
 266         memset(&sg_ip, 0, sizeof(sg_ip));
 267         sg_ip = pg->key.addr;
 268         for (pg_lst = mlock_dereference(mp->ports, br);
 269              pg_lst;
 270              pg_lst = mlock_dereference(pg_lst->next, br)) {
 271                 struct net_bridge_group_src *src_ent;
 272
 273                 if (pg_lst == pg)
 274                         continue;
 275                 hlist_for_each_entry(src_ent, &pg_lst->src_list, node) {
 276                         if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
 277                                 continue;
 278                         sg_ip.src = src_ent->addr.src;
 279                         switch (filter_mode) {
 280                         case MCAST_INCLUDE:
 281                                 __fwd_del_star_excl(pg, &sg_ip);
 282                                 break;
 283                         case MCAST_EXCLUDE:
 284                                 __fwd_add_star_excl(pg, &sg_ip);
 285                                 break;
 286                         }
 287                 }
 288         }
 289 }
 290
 291 /* called when adding a new S,G with host_joined == false by default */
 292 static void br_multicast_sg_host_state(struct net_bridge_mdb_entry *star_mp,
 293                                        struct net_bridge_port_group *sg)
 294 {
 295         struct net_bridge_mdb_entry *sg_mp;
 296
 297         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 298                 return;
 299         if (!star_mp->host_joined)
 300                 return;
 301
 302         sg_mp = br_mdb_ip_get(star_mp->br, &sg->key.addr);
 303         if (!sg_mp)
 304                 return;
 305         sg_mp->host_joined = true;
 306 }
 307
 308 /* set the host_joined state of all of *,G's S,G entries */
 309 static void br_multicast_star_g_host_state(struct net_bridge_mdb_entry *star_mp)
 310 {
 311         struct net_bridge *br = star_mp->br;
 312         struct net_bridge_mdb_entry *sg_mp;
 313         struct net_bridge_port_group *pg;
 314         struct br_ip sg_ip;
 315
 316         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 317                 return;
 318
 319         memset(&sg_ip, 0, sizeof(sg_ip));
 320         sg_ip = star_mp->addr;
 321         for (pg = mlock_dereference(star_mp->ports, br);
 322              pg;
 323              pg = mlock_dereference(pg->next, br)) {
 324                 struct net_bridge_group_src *src_ent;
 325
 326                 hlist_for_each_entry(src_ent, &pg->src_list, node) {
 327                         if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
 328                                 continue;
 329                         sg_ip.src = src_ent->addr.src;
 330                         sg_mp = br_mdb_ip_get(br, &sg_ip);
 331                         if (!sg_mp)
 332                                 continue;
 333                         sg_mp->host_joined = star_mp->host_joined;
 334                 }
 335         }
 336 }
 337
 338 static void br_multicast_sg_del_exclude_ports(struct net_bridge_mdb_entry *sgmp)
 339 {
 340         struct net_bridge_port_group __rcu **pp;
 341         struct net_bridge_port_group *p;
 342
 343         /* *,G exclude ports are only added to S,G entries */
 344         if (WARN_ON(br_multicast_is_star_g(&sgmp->addr)))
 345                 return;
 346
 347         /* we need the STAR_EXCLUDE ports if there are non-STAR_EXCLUDE ports
 348          * we should ignore perm entries since they're managed by user-space
 349          */
 350         for (pp = &sgmp->ports;
 351              (p = mlock_dereference(*pp, sgmp->br)) != NULL;
 352              pp = &p->next)
 353                 if (!(p->flags & (MDB_PG_FLAGS_STAR_EXCL |
 354                                   MDB_PG_FLAGS_PERMANENT)))
 355                         return;
 356
 357         /* currently the host can only have joined the *,G which means
 358          * we treat it as EXCLUDE {}, so for an S,G it's considered a
 359          * STAR_EXCLUDE entry and we can safely leave it
 360          */
 361         sgmp->host_joined = false;
 362
 363         for (pp = &sgmp->ports;
 364              (p = mlock_dereference(*pp, sgmp->br)) != NULL;) {
 365                 if (!(p->flags & MDB_PG_FLAGS_PERMANENT))
 366                         br_multicast_del_pg(sgmp, p, pp);
 367                 else
 368                         pp = &p->next;
 369         }
 370 }
 371
 372 void br_multicast_sg_add_exclude_ports(struct net_bridge_mdb_entry *star_mp,
 373                                        struct net_bridge_port_group *sg)
 374 {
 375         struct net_bridge_port_group_sg_key sg_key;
 376         struct net_bridge *br = star_mp->br;
 377         struct net_bridge_port_group *pg;
 378
 379         if (WARN_ON(br_multicast_is_star_g(&sg->key.addr)))
 380                 return;
 381         if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
 382                 return;
 383
 384         br_multicast_sg_host_state(star_mp, sg);
 385         memset(&sg_key, 0, sizeof(sg_key));
 386         sg_key.addr = sg->key.addr;
 387         /* we need to add all exclude ports to the S,G */
 388         for (pg = mlock_dereference(star_mp->ports, br);
 389              pg;
 390              pg = mlock_dereference(pg->next, br)) {
 391                 struct net_bridge_port_group *src_pg;
 392
 393                 if (pg == sg || pg->filter_mode == MCAST_INCLUDE)
 394                         continue;
 395
 396                 sg_key.port = pg->key.port;
 397                 if (br_sg_port_find(br, &sg_key))
 398                         continue;
 399
 400                 src_pg = __br_multicast_add_group(br, pg->key.port,
 401                                                   &sg->key.addr,
 402                                                   sg->eth_addr,
 403                                                   MCAST_INCLUDE, false, false);
 404                 if (IS_ERR_OR_NULL(src_pg) ||
 405                     src_pg->rt_protocol != RTPROT_KERNEL)
 406                         continue;
 407                 src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
 408         }
 409 }
 410
 411 static void br_multicast_fwd_src_add(struct net_bridge_group_src *src)
 412 {
 413         struct net_bridge_mdb_entry *star_mp;
 414         struct net_bridge_port_group *sg;
 415         struct br_ip sg_ip;
 416
 417         if (src->flags & BR_SGRP_F_INSTALLED)
 418                 return;
 419
 420         memset(&sg_ip, 0, sizeof(sg_ip));
 421         sg_ip = src->pg->key.addr;
 422         sg_ip.src = src->addr.src;
 423         sg = __br_multicast_add_group(src->br, src->pg->key.port, &sg_ip,
 424                                       src->pg->eth_addr, MCAST_INCLUDE, false,
 425                                       !timer_pending(&src->timer));
 426         if (IS_ERR_OR_NULL(sg))
 427                 return;
 428         src->flags |= BR_SGRP_F_INSTALLED;
 429         sg->flags &= ~MDB_PG_FLAGS_STAR_EXCL;
 430
 431         /* if it was added by user-space as perm we can skip next steps */
 432         if (sg->rt_protocol != RTPROT_KERNEL &&
 433             (sg->flags & MDB_PG_FLAGS_PERMANENT))
 434                 return;
 435
 436         /* the kernel is now responsible for removing this S,G */
 437         del_timer(&sg->timer);
 438         star_mp = br_mdb_ip_get(src->br, &src->pg->key.addr);
 439         if (!star_mp)
 440                 return;
 441
 442         br_multicast_sg_add_exclude_ports(star_mp, sg);
 443 }
 444
 445 static void br_multicast_fwd_src_remove(struct net_bridge_group_src *src,
 446                                         bool fastleave)
 447 {
 448         struct net_bridge_port_group *p, *pg = src->pg;
 449         struct net_bridge_port_group __rcu **pp;
 450         struct net_bridge_mdb_entry *mp;
 451         struct br_ip sg_ip;
 452
 453         memset(&sg_ip, 0, sizeof(sg_ip));
 454         sg_ip = pg->key.addr;
 455         sg_ip.src = src->addr.src;
 456
 457         mp = br_mdb_ip_get(src->br, &sg_ip);
 458         if (!mp)
 459                 return;
 460
 461         for (pp = &mp->ports;
 462              (p = mlock_dereference(*pp, src->br)) != NULL;
 463              pp = &p->next) {
 464                 if (!br_port_group_equal(p, pg->key.port, pg->eth_addr))
 465                         continue;
 466
 467                 if (p->rt_protocol != RTPROT_KERNEL &&
 468                     (p->flags & MDB_PG_FLAGS_PERMANENT))
 469                         break;
 470
 471                 if (fastleave)
 472                         p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
 473                 br_multicast_del_pg(mp, p, pp);
 474                 break;
 475         }
 476         src->flags &= ~BR_SGRP_F_INSTALLED;
 477 }
 478
 479 /* install S,G and based on src's timer enable or disable forwarding */
 480 static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)
 481 {
 482         struct net_bridge_port_group_sg_key sg_key;
 483         struct net_bridge_port_group *sg;
 484         u8 old_flags;
 485
 486         br_multicast_fwd_src_add(src);
 487
 488         memset(&sg_key, 0, sizeof(sg_key));
 489         sg_key.addr = src->pg->key.addr;
 490         sg_key.addr.src = src->addr.src;
 491         sg_key.port = src->pg->key.port;
 492
 493         sg = br_sg_port_find(src->br, &sg_key);
 494         if (!sg || (sg->flags & MDB_PG_FLAGS_PERMANENT))
 495                 return;
 496
 497         old_flags = sg->flags;
 498         if (timer_pending(&src->timer))
 499                 sg->flags &= ~MDB_PG_FLAGS_BLOCKED;
 500         else
 501                 sg->flags |= MDB_PG_FLAGS_BLOCKED;
 502
 503         if (old_flags != sg->flags) {
 504                 struct net_bridge_mdb_entry *sg_mp;
 505
 506                 sg_mp = br_mdb_ip_get(src->br, &sg_key.addr);
 507                 if (!sg_mp)
 508                         return;
 509                 br_mdb_notify(src->br->dev, sg_mp, sg, RTM_NEWMDB);
 510         }
 511 }
 512
 513 static void br_multicast_destroy_mdb_entry(struct net_bridge_mcast_gc *gc)
 514 {
 515         struct net_bridge_mdb_entry *mp;
 516
 517         mp = container_of(gc, struct net_bridge_mdb_entry, mcast_gc);
 518         WARN_ON(!hlist_unhashed(&mp->mdb_node));
 519         WARN_ON(mp->ports);
 520
 521         del_timer_sync(&mp->timer);
 522         kfree_rcu(mp, rcu);
 523 }
 524
 525 static void br_multicast_del_mdb_entry(struct net_bridge_mdb_entry *mp)
 526 {
 527         struct net_bridge *br = mp->br;
 528
 529         rhashtable_remove_fast(&br->mdb_hash_tbl, &mp->rhnode,
 530                                br_mdb_rht_params);
 531         hlist_del_init_rcu(&mp->mdb_node);
 532         hlist_add_head(&mp->mcast_gc.gc_node, &br->mcast_gc_list);
 533         queue_work(system_long_wq, &br->mcast_gc_work);
 534 }
 535
 536 static void br_multicast_group_expired(struct timer_list *t)
 537 {
 538         struct net_bridge_mdb_entry *mp = from_timer(mp, t, timer);
 539         struct net_bridge *br = mp->br;
 540
 541         spin_lock(&br->multicast_lock);
 542         if (hlist_unhashed(&mp->mdb_node) || !netif_running(br->dev) ||
 543             timer_pending(&mp->timer))
 544                 goto out;
 545
 546         br_multicast_host_leave(mp, true);
 547
 548         if (mp->ports)
 549                 goto out;
 550         br_multicast_del_mdb_entry(mp);
 551 out:
 552         spin_unlock(&br->multicast_lock);
 553 }
 554
 555 static void br_multicast_destroy_group_src(struct net_bridge_mcast_gc *gc)
 556 {
 557         struct net_bridge_group_src *src;
 558
 559         src = container_of(gc, struct net_bridge_group_src, mcast_gc);
 560         WARN_ON(!hlist_unhashed(&src->node));
 561
 562         del_timer_sync(&src->timer);
 563         kfree_rcu(src, rcu);
 564 }
 565
 566 void br_multicast_del_group_src(struct net_bridge_group_src *src,
 567                                 bool fastleave)
 568 {
 569         struct net_bridge *br = src->pg->key.port->br;
 570
 571         br_multicast_fwd_src_remove(src, fastleave);
 572         hlist_del_init_rcu(&src->node);
 573         src->pg->src_ents--;
 574         hlist_add_head(&src->mcast_gc.gc_node, &br->mcast_gc_list);
 575         queue_work(system_long_wq, &br->mcast_gc_work);
 576 }
 577
 578 static void br_multicast_destroy_port_group(struct net_bridge_mcast_gc *gc)
 579 {
 580         struct net_bridge_port_group *pg;
 581
 582         pg = container_of(gc, struct net_bridge_port_group, mcast_gc);
 583         WARN_ON(!hlist_unhashed(&pg->mglist));
 584         WARN_ON(!hlist_empty(&pg->src_list));
 585
 586         del_timer_sync(&pg->rexmit_timer);
 587         del_timer_sync(&pg->timer);
 588         kfree_rcu(pg, rcu);
 589 }
 590
 591 void br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
 592                          struct net_bridge_port_group *pg,
 593                          struct net_bridge_port_group __rcu **pp)
 594 {
 595         struct net_bridge *br = pg->key.port->br;
 596         struct net_bridge_group_src *ent;
 597         struct hlist_node *tmp;
 598
 599         rcu_assign_pointer(*pp, pg->next);
 600         hlist_del_init(&pg->mglist);
 601         br_multicast_eht_clean_sets(pg);
 602         hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
 603                 br_multicast_del_group_src(ent, false);
 604         br_mdb_notify(br->dev, mp, pg, RTM_DELMDB);
 605         if (!br_multicast_is_star_g(&mp->addr)) {
 606                 rhashtable_remove_fast(&br->sg_port_tbl, &pg->rhnode,
 607                                        br_sg_port_rht_params);
 608                 br_multicast_sg_del_exclude_ports(mp);
 609         } else {
 610                 br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
 611         }
 612         hlist_add_head(&pg->mcast_gc.gc_node, &br->mcast_gc_list);
 613         queue_work(system_long_wq, &br->mcast_gc_work);
 614
 615         if (!mp->ports && !mp->host_joined && netif_running(br->dev))
 616                 mod_timer(&mp->timer, jiffies);
 617 }
 618
 619 static void br_multicast_find_del_pg(struct net_bridge *br,
 620                                      struct net_bridge_port_group *pg)
 621 {
 622         struct net_bridge_port_group __rcu **pp;
 623         struct net_bridge_mdb_entry *mp;
 624         struct net_bridge_port_group *p;
 625
 626         mp = br_mdb_ip_get(br, &pg->key.addr);
 627         if (WARN_ON(!mp))
 628                 return;
 629
 630         for (pp = &mp->ports;
 631              (p = mlock_dereference(*pp, br)) != NULL;
 632              pp = &p->next) {
 633                 if (p != pg)
 634                         continue;
 635
 636                 br_multicast_del_pg(mp, pg, pp);
 637                 return;
 638         }
 639
 640         WARN_ON(1);
 641 }
 642
 643 static void br_multicast_port_group_expired(struct timer_list *t)
 644 {
 645         struct net_bridge_port_group *pg = from_timer(pg, t, timer);
 646         struct net_bridge_group_src *src_ent;
 647         struct net_bridge *br = pg->key.port->br;
 648         struct hlist_node *tmp;
 649         bool changed;
 650
 651         spin_lock(&br->multicast_lock);
 652         if (!netif_running(br->dev) || timer_pending(&pg->timer) ||
 653             hlist_unhashed(&pg->mglist) || pg->flags & MDB_PG_FLAGS_PERMANENT)
 654                 goto out;
 655
 656         changed = !!(pg->filter_mode == MCAST_EXCLUDE);
 657         pg->filter_mode = MCAST_INCLUDE;
 658         hlist_for_each_entry_safe(src_ent, tmp, &pg->src_list, node) {
 659                 if (!timer_pending(&src_ent->timer)) {
 660                         br_multicast_del_group_src(src_ent, false);
 661                         changed = true;
 662                 }
 663         }
 664
 665         if (hlist_empty(&pg->src_list)) {
 666                 br_multicast_find_del_pg(br, pg);
 667         } else if (changed) {
 668                 struct net_bridge_mdb_entry *mp = br_mdb_ip_get(br, &pg->key.addr);
 669
 670                 if (changed && br_multicast_is_star_g(&pg->key.addr))
 671                         br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
 672
 673                 if (WARN_ON(!mp))
 674                         goto out;
 675                 br_mdb_notify(br->dev, mp, pg, RTM_NEWMDB);
 676         }
 677 out:
 678         spin_unlock(&br->multicast_lock);
 679 }
 680
 681 static void br_multicast_gc(struct hlist_head *head)
 682 {
 683         struct net_bridge_mcast_gc *gcent;
 684         struct hlist_node *tmp;
 685
 686         hlist_for_each_entry_safe(gcent, tmp, head, gc_node) {
 687                 hlist_del_init(&gcent->gc_node);
 688                 gcent->destroy(gcent);
 689         }
 690 }
 691
 692 static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
 693                                                     struct net_bridge_port_group *pg,
 694                                                     __be32 ip_dst, __be32 group,
 695                                                     bool with_srcs, bool over_lmqt,
 696                                                     u8 sflag, u8 *igmp_type,
 697                                                     bool *need_rexmit)
 698 {
 699         struct net_bridge_port *p = pg ? pg->key.port : NULL;
 700         struct net_bridge_group_src *ent;
 701         size_t pkt_size, igmp_hdr_size;
 702         unsigned long now = jiffies;
 703         struct igmpv3_query *ihv3;
 704         void *csum_start = NULL;
 705         __sum16 *csum = NULL;
 706         struct sk_buff *skb;
 707         struct igmphdr *ih;
 708         struct ethhdr *eth;
 709         unsigned long lmqt;
 710         struct iphdr *iph;
 711         u16 lmqt_srcs = 0;
 712
 713         igmp_hdr_size = sizeof(*ih);
 714         if (br->multicast_igmp_version == 3) {
 715                 igmp_hdr_size = sizeof(*ihv3);
 716                 if (pg && with_srcs) {
 717                         lmqt = now + (br->multicast_last_member_interval *
 718                                       br->multicast_last_member_count);
 719                         hlist_for_each_entry(ent, &pg->src_list, node) {
 720                                 if (over_lmqt == time_after(ent->timer.expires,
 721                                                             lmqt) &&
 722                                     ent->src_query_rexmit_cnt > 0)
 723                                         lmqt_srcs++;
 724                         }
 725
 726                         if (!lmqt_srcs)
 727                                 return NULL;
 728                         igmp_hdr_size += lmqt_srcs * sizeof(__be32);
 729                 }
 730         }
 731
 732         pkt_size = sizeof(*eth) + sizeof(*iph) + 4 + igmp_hdr_size;
 733         if ((p && pkt_size > p->dev->mtu) ||
 734             pkt_size > br->dev->mtu)
 735                 return NULL;
 736
 737         skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
 738         if (!skb)
 739                 goto out;
 740
 741         skb->protocol = htons(ETH_P_IP);
 742
 743         skb_reset_mac_header(skb);
 744         eth = eth_hdr(skb);
 745
 746         ether_addr_copy(eth->h_source, br->dev->dev_addr);
 747         ip_eth_mc_map(ip_dst, eth->h_dest);
 748         eth->h_proto = htons(ETH_P_IP);
 749         skb_put(skb, sizeof(*eth));
 750
 751         skb_set_network_header(skb, skb->len);
 752         iph = ip_hdr(skb);
 753         iph->tot_len = htons(pkt_size - sizeof(*eth));
 754
 755         iph->version = 4;
 756         iph->ihl = 6;
 757         iph->tos = 0xc0;
 758         iph->id = 0;
 759         iph->frag_off = htons(IP_DF);
 760         iph->ttl = 1;
 761         iph->protocol = IPPROTO_IGMP;
 762         iph->saddr = br_opt_get(br, BROPT_MULTICAST_QUERY_USE_IFADDR) ?
 763                      inet_select_addr(br->dev, 0, RT_SCOPE_LINK) : 0;
 764         iph->daddr = ip_dst;
 765         ((u8 *)&iph[1])[0] = IPOPT_RA;
 766         ((u8 *)&iph[1])[1] = 4;
 767         ((u8 *)&iph[1])[2] = 0;
 768         ((u8 *)&iph[1])[3] = 0;
 769         ip_send_check(iph);
 770         skb_put(skb, 24);
 771
 772         skb_set_transport_header(skb, skb->len);
 773         *igmp_type = IGMP_HOST_MEMBERSHIP_QUERY;
 774
 775         switch (br->multicast_igmp_version) {
 776         case 2:
 777                 ih = igmp_hdr(skb);
 778                 ih->type = IGMP_HOST_MEMBERSHIP_QUERY;
 779                 ih->code = (group ? br->multicast_last_member_interval :
 780                                     br->multicast_query_response_interval) /
 781                            (HZ / IGMP_TIMER_SCALE);
 782                 ih->group = group;
 783                 ih->csum = 0;
 784                 csum = &ih->csum;
 785                 csum_start = (void *)ih;
 786                 break;
 787         case 3:
 788                 ihv3 = igmpv3_query_hdr(skb);
 789                 ihv3->type = IGMP_HOST_MEMBERSHIP_QUERY;
 790                 ihv3->code = (group ? br->multicast_last_member_interval :
 791                                       br->multicast_query_response_interval) /
 792                              (HZ / IGMP_TIMER_SCALE);
 793                 ihv3->group = group;
 794                 ihv3->qqic = br->multicast_query_interval / HZ;
 795                 ihv3->nsrcs = htons(lmqt_srcs);
 796                 ihv3->resv = 0;
 797                 ihv3->suppress = sflag;
 798                 ihv3->qrv = 2;
 799                 ihv3->csum = 0;
 800                 csum = &ihv3->csum;
 801                 csum_start = (void *)ihv3;
 802                 if (!pg || !with_srcs)
 803                         break;
 804
 805                 lmqt_srcs = 0;
 806                 hlist_for_each_entry(ent, &pg->src_list, node) {
 807                         if (over_lmqt == time_after(ent->timer.expires,
 808                                                     lmqt) &&
 809                             ent->src_query_rexmit_cnt > 0) {
 810                                 ihv3->srcs[lmqt_srcs++] = ent->addr.src.ip4;
 811                                 ent->src_query_rexmit_cnt--;
 812                                 if (need_rexmit && ent->src_query_rexmit_cnt)
 813                                         *need_rexmit = true;
 814                         }
 815                 }
 816                 if (WARN_ON(lmqt_srcs != ntohs(ihv3->nsrcs))) {
 817                         kfree_skb(skb);
 818                         return NULL;
 819                 }
 820                 break;
 821         }
 822
 823         if (WARN_ON(!csum || !csum_start)) {
 824                 kfree_skb(skb);
 825                 return NULL;
 826         }
 827
 828         *csum = ip_compute_csum(csum_start, igmp_hdr_size);
 829         skb_put(skb, igmp_hdr_size);
 830         __skb_pull(skb, sizeof(*eth));
 831
 832 out:
 833         return skb;
 834 }
 835
 836 #if IS_ENABLED(CONFIG_IPV6)
 837 static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
 838                                                     struct net_bridge_port_group *pg,
 839                                                     const struct in6_addr *ip6_dst,
 840                                                     const struct in6_addr *group,
 841                                                     bool with_srcs, bool over_llqt,
 842                                                     u8 sflag, u8 *igmp_type,
 843                                                     bool *need_rexmit)
 844 {
 845         struct net_bridge_port *p = pg ? pg->key.port : NULL;
 846         struct net_bridge_group_src *ent;
 847         size_t pkt_size, mld_hdr_size;
 848         unsigned long now = jiffies;
 849         struct mld2_query *mld2q;
 850         void *csum_start = NULL;
 851         unsigned long interval;
 852         __sum16 *csum = NULL;
 853         struct ipv6hdr *ip6h;
 854         struct mld_msg *mldq;
 855         struct sk_buff *skb;
 856         unsigned long llqt;
 857         struct ethhdr *eth;
 858         u16 llqt_srcs = 0;
 859         u8 *hopopt;
 860
 861         mld_hdr_size = sizeof(*mldq);
 862         if (br->multicast_mld_version == 2) {
 863                 mld_hdr_size = sizeof(*mld2q);
 864                 if (pg && with_srcs) {
 865                         llqt = now + (br->multicast_last_member_interval *
 866                                       br->multicast_last_member_count);
 867                         hlist_for_each_entry(ent, &pg->src_list, node) {
 868                                 if (over_llqt == time_after(ent->timer.expires,
 869                                                             llqt) &&
 870                                     ent->src_query_rexmit_cnt > 0)
 871                                         llqt_srcs++;
 872                         }
 873
 874                         if (!llqt_srcs)
 875                                 return NULL;
 876                         mld_hdr_size += llqt_srcs * sizeof(struct in6_addr);
 877                 }
 878         }
 879
 880         pkt_size = sizeof(*eth) + sizeof(*ip6h) + 8 + mld_hdr_size;
 881         if ((p && pkt_size > p->dev->mtu) ||
 882             pkt_size > br->dev->mtu)
 883                 return NULL;
 884
 885         skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
 886         if (!skb)
 887                 goto out;
 888
 889         skb->protocol = htons(ETH_P_IPV6);
 890
 891         /* Ethernet header */
 892         skb_reset_mac_header(skb);
 893         eth = eth_hdr(skb);
 894
 895         ether_addr_copy(eth->h_source, br->dev->dev_addr);
 896         eth->h_proto = htons(ETH_P_IPV6);
 897         skb_put(skb, sizeof(*eth));
 898
 899         /* IPv6 header + HbH option */
 900         skb_set_network_header(skb, skb->len);
 901         ip6h = ipv6_hdr(skb);
 902
 903         *(__force __be32 *)ip6h = htonl(0x60000000);
 904         ip6h->payload_len = htons(8 + mld_hdr_size);
 905         ip6h->nexthdr = IPPROTO_HOPOPTS;
 906         ip6h->hop_limit = 1;
 907         ip6h->daddr = *ip6_dst;
 908         if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
 909                                &ip6h->saddr)) {
 910                 kfree_skb(skb);
 911                 br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, false);
 912                 return NULL;
 913         }
 914
 915         br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
 916         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 917
 918         hopopt = (u8 *)(ip6h + 1);
 919         hopopt[0] = IPPROTO_ICMPV6;             /* next hdr */
 920         hopopt[1] = 0;                          /* length of HbH */
 921         hopopt[2] = IPV6_TLV_ROUTERALERT;       /* Router Alert */
 922         hopopt[3] = 2;                          /* Length of RA Option */
 923         hopopt[4] = 0;                          /* Type = 0x0000 (MLD) */
 924         hopopt[5] = 0;
 925         hopopt[6] = IPV6_TLV_PAD1;              /* Pad1 */
 926         hopopt[7] = IPV6_TLV_PAD1;              /* Pad1 */
 927
 928         skb_put(skb, sizeof(*ip6h) + 8);
 929
 930         /* ICMPv6 */
 931         skb_set_transport_header(skb, skb->len);
 932         interval = ipv6_addr_any(group) ?
 933                         br->multicast_query_response_interval :
 934                         br->multicast_last_member_interval;
 935         *igmp_type = ICMPV6_MGM_QUERY;
 936         switch (br->multicast_mld_version) {
 937         case 1:
 938                 mldq = (struct mld_msg *)icmp6_hdr(skb);
 939                 mldq->mld_type = ICMPV6_MGM_QUERY;
 940                 mldq->mld_code = 0;
 941                 mldq->mld_cksum = 0;
 942                 mldq->mld_maxdelay = htons((u16)jiffies_to_msecs(interval));
 943                 mldq->mld_reserved = 0;
 944                 mldq->mld_mca = *group;
 945                 csum = &mldq->mld_cksum;
 946                 csum_start = (void *)mldq;
 947                 break;
 948         case 2:
 949                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
 950                 mld2q->mld2q_mrc = htons((u16)jiffies_to_msecs(interval));
 951                 mld2q->mld2q_type = ICMPV6_MGM_QUERY;
 952                 mld2q->mld2q_code = 0;
 953                 mld2q->mld2q_cksum = 0;
 954                 mld2q->mld2q_resv1 = 0;
 955                 mld2q->mld2q_resv2 = 0;
 956                 mld2q->mld2q_suppress = sflag;
 957                 mld2q->mld2q_qrv = 2;
 958                 mld2q->mld2q_nsrcs = htons(llqt_srcs);
 959                 mld2q->mld2q_qqic = br->multicast_query_interval / HZ;
 960                 mld2q->mld2q_mca = *group;
 961                 csum = &mld2q->mld2q_cksum;
 962                 csum_start = (void *)mld2q;
 963                 if (!pg || !with_srcs)
 964                         break;
 965
 966                 llqt_srcs = 0;
 967                 hlist_for_each_entry(ent, &pg->src_list, node) {
 968                         if (over_llqt == time_after(ent->timer.expires,
 969                                                     llqt) &&
 970                             ent->src_query_rexmit_cnt > 0) {
 971                                 mld2q->mld2q_srcs[llqt_srcs++] = ent->addr.src.ip6;
 972                                 ent->src_query_rexmit_cnt--;
 973                                 if (need_rexmit && ent->src_query_rexmit_cnt)
 974                                         *need_rexmit = true;
 975                         }
 976                 }
 977                 if (WARN_ON(llqt_srcs != ntohs(mld2q->mld2q_nsrcs))) {
 978                         kfree_skb(skb);
 979                         return NULL;
 980                 }
 981                 break;
 982         }
 983
 984         if (WARN_ON(!csum || !csum_start)) {
 985                 kfree_skb(skb);
 986                 return NULL;
 987         }
 988
 989         *csum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, mld_hdr_size,
 990                                 IPPROTO_ICMPV6,
 991                                 csum_partial(csum_start, mld_hdr_size, 0));
 992         skb_put(skb, mld_hdr_size);
 993         __skb_pull(skb, sizeof(*eth));
 994
 995 out:
 996         return skb;
 997 }
 998 #endif
 999
1000 static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
1001                                                 struct net_bridge_port_group *pg,
1002                                                 struct br_ip *ip_dst,
1003                                                 struct br_ip *group,
1004                                                 bool with_srcs, bool over_lmqt,
1005                                                 u8 sflag, u8 *igmp_type,
1006                                                 bool *need_rexmit)
1007 {
1008         __be32 ip4_dst;
1009
1010         switch (group->proto) {
1011         case htons(ETH_P_IP):
1012                 ip4_dst = ip_dst ? ip_dst->dst.ip4 : htonl(INADDR_ALLHOSTS_GROUP);
1013                 return br_ip4_multicast_alloc_query(br, pg,
1014                                                     ip4_dst, group->dst.ip4,
1015                                                     with_srcs, over_lmqt,
1016                                                     sflag, igmp_type,
1017                                                     need_rexmit);
1018 #if IS_ENABLED(CONFIG_IPV6)
1019         case htons(ETH_P_IPV6): {
1020                 struct in6_addr ip6_dst;
1021
1022                 if (ip_dst)
1023                         ip6_dst = ip_dst->dst.ip6;
1024                 else
1025                         ipv6_addr_set(&ip6_dst, htonl(0xff020000), 0, 0,
1026                                       htonl(1));
1027
1028                 return br_ip6_multicast_alloc_query(br, pg,
1029                                                     &ip6_dst, &group->dst.ip6,
1030                                                     with_srcs, over_lmqt,
1031                                                     sflag, igmp_type,
1032                                                     need_rexmit);
1033         }
1034 #endif
1035         }
1036         return NULL;
1037 }
1038
1039 struct net_bridge_mdb_entry *br_multicast_new_group(struct net_bridge *br,
1040                                                     struct br_ip *group)
1041 {
1042         struct net_bridge_mdb_entry *mp;
1043         int err;
1044
1045         mp = br_mdb_ip_get(br, group);
1046         if (mp)
1047                 return mp;
1048
1049         if (atomic_read(&br->mdb_hash_tbl.nelems) >= br->hash_max) {
1050                 br_opt_toggle(br, BROPT_MULTICAST_ENABLED, false);
1051                 return ERR_PTR(-E2BIG);
1052         }
1053
1054         mp = kzalloc(sizeof(*mp), GFP_ATOMIC);
1055         if (unlikely(!mp))
1056                 return ERR_PTR(-ENOMEM);
1057
1058         mp->br = br;
1059         mp->addr = *group;
1060         mp->mcast_gc.destroy = br_multicast_destroy_mdb_entry;
1061         timer_setup(&mp->timer, br_multicast_group_expired, 0);
1062         err = rhashtable_lookup_insert_fast(&br->mdb_hash_tbl, &mp->rhnode,
1063                                             br_mdb_rht_params);
1064         if (err) {
1065                 kfree(mp);
1066                 mp = ERR_PTR(err);
1067         } else {
1068                 hlist_add_head_rcu(&mp->mdb_node, &br->mdb_list);
1069         }
1070
1071         return mp;
1072 }
1073
1074 static void br_multicast_group_src_expired(struct timer_list *t)
1075 {
1076         struct net_bridge_group_src *src = from_timer(src, t, timer);
1077         struct net_bridge_port_group *pg;
1078         struct net_bridge *br = src->br;
1079
1080         spin_lock(&br->multicast_lock);
1081         if (hlist_unhashed(&src->node) || !netif_running(br->dev) ||
1082             timer_pending(&src->timer))
1083                 goto out;
1084
1085         pg = src->pg;
1086         if (pg->filter_mode == MCAST_INCLUDE) {
1087                 br_multicast_del_group_src(src, false);
1088                 if (!hlist_empty(&pg->src_list))
1089                         goto out;
1090                 br_multicast_find_del_pg(br, pg);
1091         } else {
1092                 br_multicast_fwd_src_handle(src);
1093         }
1094
1095 out:
1096         spin_unlock(&br->multicast_lock);
1097 }
1098
1099 struct net_bridge_group_src *
1100 br_multicast_find_group_src(struct net_bridge_port_group *pg, struct br_ip *ip)
1101 {
1102         struct net_bridge_group_src *ent;
1103
1104         switch (ip->proto) {
1105         case htons(ETH_P_IP):
1106                 hlist_for_each_entry(ent, &pg->src_list, node)
1107                         if (ip->src.ip4 == ent->addr.src.ip4)
1108                                 return ent;
1109                 break;
1110 #if IS_ENABLED(CONFIG_IPV6)
1111         case htons(ETH_P_IPV6):
1112                 hlist_for_each_entry(ent, &pg->src_list, node)
1113                         if (!ipv6_addr_cmp(&ent->addr.src.ip6, &ip->src.ip6))
1114                                 return ent;
1115                 break;
1116 #endif
1117         }
1118
1119         return NULL;
1120 }
1121
1122 static struct net_bridge_group_src *
1123 br_multicast_new_group_src(struct net_bridge_port_group *pg, struct br_ip *src_ip)
1124 {
1125         struct net_bridge_group_src *grp_src;
1126
1127         if (unlikely(pg->src_ents >= PG_SRC_ENT_LIMIT))
1128                 return NULL;
1129
1130         switch (src_ip->proto) {
1131         case htons(ETH_P_IP):
1132                 if (ipv4_is_zeronet(src_ip->src.ip4) ||
1133                     ipv4_is_multicast(src_ip->src.ip4))
1134                         return NULL;
1135                 break;
1136 #if IS_ENABLED(CONFIG_IPV6)
1137         case htons(ETH_P_IPV6):
1138                 if (ipv6_addr_any(&src_ip->src.ip6) ||
1139                     ipv6_addr_is_multicast(&src_ip->src.ip6))
1140                         return NULL;
1141                 break;
1142 #endif
1143         }
1144
1145         grp_src = kzalloc(sizeof(*grp_src), GFP_ATOMIC);
1146         if (unlikely(!grp_src))
1147                 return NULL;
1148
1149         grp_src->pg = pg;
1150         grp_src->br = pg->key.port->br;
1151         grp_src->addr = *src_ip;
1152         grp_src->mcast_gc.destroy = br_multicast_destroy_group_src;
1153         timer_setup(&grp_src->timer, br_multicast_group_src_expired, 0);
1154
1155         hlist_add_head_rcu(&grp_src->node, &pg->src_list);
1156         pg->src_ents++;
1157
1158         return grp_src;
1159 }
1160
1161 struct net_bridge_port_group *br_multicast_new_port_group(
1162                         struct net_bridge_port *port,
1163                         struct br_ip *group,
1164                         struct net_bridge_port_group __rcu *next,
1165                         unsigned char flags,
1166                         const unsigned char *src,
1167                         u8 filter_mode,
1168                         u8 rt_protocol)
1169 {
1170         struct net_bridge_port_group *p;
1171
1172         p = kzalloc(sizeof(*p), GFP_ATOMIC);
1173         if (unlikely(!p))
1174                 return NULL;
1175
1176         p->key.addr = *group;
1177         p->key.port = port;
1178         p->flags = flags;
1179         p->filter_mode = filter_mode;
1180         p->rt_protocol = rt_protocol;
1181         p->eht_host_tree = RB_ROOT;
1182         p->eht_set_tree = RB_ROOT;
1183         p->mcast_gc.destroy = br_multicast_destroy_port_group;
1184         INIT_HLIST_HEAD(&p->src_list);
1185
1186         if (!br_multicast_is_star_g(group) &&
1187             rhashtable_lookup_insert_fast(&port->br->sg_port_tbl, &p->rhnode,
1188                                           br_sg_port_rht_params)) {
1189                 kfree(p);
1190                 return NULL;
1191         }
1192
1193         rcu_assign_pointer(p->next, next);
1194         timer_setup(&p->timer, br_multicast_port_group_expired, 0);
1195         timer_setup(&p->rexmit_timer, br_multicast_port_group_rexmit, 0);
1196         hlist_add_head(&p->mglist, &port->mglist);
1197
1198         if (src)
1199                 memcpy(p->eth_addr, src, ETH_ALEN);
1200         else
1201                 eth_broadcast_addr(p->eth_addr);
1202
1203         return p;
1204 }
1205
1206 void br_multicast_host_join(struct net_bridge_mdb_entry *mp, bool notify)
1207 {
1208         if (!mp->host_joined) {
1209                 mp->host_joined = true;
1210                 if (br_multicast_is_star_g(&mp->addr))
1211                         br_multicast_star_g_host_state(mp);
1212                 if (notify)
1213                         br_mdb_notify(mp->br->dev, mp, NULL, RTM_NEWMDB);
1214         }
1215
1216         if (br_group_is_l2(&mp->addr))
1217                 return;
1218
1219         mod_timer(&mp->timer, jiffies + mp->br->multicast_membership_interval);
1220 }
1221
1222 void br_multicast_host_leave(struct net_bridge_mdb_entry *mp, bool notify)
1223 {
1224         if (!mp->host_joined)
1225                 return;
1226
1227         mp->host_joined = false;
1228         if (br_multicast_is_star_g(&mp->addr))
1229                 br_multicast_star_g_host_state(mp);
1230         if (notify)
1231                 br_mdb_notify(mp->br->dev, mp, NULL, RTM_DELMDB);
1232 }
1233
1234 static struct net_bridge_port_group *
1235 __br_multicast_add_group(struct net_bridge *br,
1236                          struct net_bridge_port *port,
1237                          struct br_ip *group,
1238                          const unsigned char *src,
1239                          u8 filter_mode,
1240                          bool igmpv2_mldv1,
1241                          bool blocked)
1242 {
1243         struct net_bridge_port_group __rcu **pp;
1244         struct net_bridge_port_group *p = NULL;
1245         struct net_bridge_mdb_entry *mp;
1246         unsigned long now = jiffies;
1247
1248         if (!netif_running(br->dev) ||
1249             (port && port->state == BR_STATE_DISABLED))
1250                 goto out;
1251
1252         mp = br_multicast_new_group(br, group);
1253         if (IS_ERR(mp))
1254                 return ERR_CAST(mp);
1255
1256         if (!port) {
1257                 br_multicast_host_join(mp, true);
1258                 goto out;
1259         }
1260
1261         for (pp = &mp->ports;
1262              (p = mlock_dereference(*pp, br)) != NULL;
1263              pp = &p->next) {
1264                 if (br_port_group_equal(p, port, src))
1265                         goto found;
1266                 if ((unsigned long)p->key.port < (unsigned long)port)
1267                         break;
1268         }
1269
1270         p = br_multicast_new_port_group(port, group, *pp, 0, src,
1271                                         filter_mode, RTPROT_KERNEL);
1272         if (unlikely(!p)) {
1273                 p = ERR_PTR(-ENOMEM);
1274                 goto out;
1275         }
1276         rcu_assign_pointer(*pp, p);
1277         if (blocked)
1278                 p->flags |= MDB_PG_FLAGS_BLOCKED;
1279         br_mdb_notify(br->dev, mp, p, RTM_NEWMDB);
1280
1281 found:
1282         if (igmpv2_mldv1)
1283                 mod_timer(&p->timer, now + br->multicast_membership_interval);
1284
1285 out:
1286         return p;
1287 }
1288
1289 static int br_multicast_add_group(struct net_bridge *br,
1290                                   struct net_bridge_port *port,
1291                                   struct br_ip *group,
1292                                   const unsigned char *src,
1293                                   u8 filter_mode,
1294                                   bool igmpv2_mldv1)
1295 {
1296         struct net_bridge_port_group *pg;
1297         int err;
1298
1299         spin_lock(&br->multicast_lock);
1300         pg = __br_multicast_add_group(br, port, group, src, filter_mode,
1301                                       igmpv2_mldv1, false);
1302         /* NULL is considered valid for host joined groups */
1303         err = PTR_ERR_OR_ZERO(pg);
1304         spin_unlock(&br->multicast_lock);
1305
1306         return err;
1307 }
1308
1309 static int br_ip4_multicast_add_group(struct net_bridge *br,
1310                                       struct net_bridge_port *port,
1311                                       __be32 group,
1312                                       __u16 vid,
1313                                       const unsigned char *src,
1314                                       bool igmpv2)
1315 {
1316         struct br_ip br_group;
1317         u8 filter_mode;
1318
1319         if (ipv4_is_local_multicast(group))
1320                 return 0;
1321
1322         memset(&br_group, 0, sizeof(br_group));
1323         br_group.dst.ip4 = group;
1324         br_group.proto = htons(ETH_P_IP);
1325         br_group.vid = vid;
1326         filter_mode = igmpv2 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1327
1328         return br_multicast_add_group(br, port, &br_group, src, filter_mode,
1329                                       igmpv2);
1330 }
1331
1332 #if IS_ENABLED(CONFIG_IPV6)
1333 static int br_ip6_multicast_add_group(struct net_bridge *br,
1334                                       struct net_bridge_port *port,
1335                                       const struct in6_addr *group,
1336                                       __u16 vid,
1337                                       const unsigned char *src,
1338                                       bool mldv1)
1339 {
1340         struct br_ip br_group;
1341         u8 filter_mode;
1342
1343         if (ipv6_addr_is_ll_all_nodes(group))
1344                 return 0;
1345
1346         memset(&br_group, 0, sizeof(br_group));
1347         br_group.dst.ip6 = *group;
1348         br_group.proto = htons(ETH_P_IPV6);
1349         br_group.vid = vid;
1350         filter_mode = mldv1 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1351
1352         return br_multicast_add_group(br, port, &br_group, src, filter_mode,
1353                                       mldv1);
1354 }
1355 #endif
1356
1357 static void br_multicast_router_expired(struct timer_list *t)
1358 {
1359         struct net_bridge_port *port =
1360                         from_timer(port, t, ip4_mc_router_timer);
1361         struct net_bridge *br = port->br;
1362
1363         spin_lock(&br->multicast_lock);
1364         if (port->multicast_router == MDB_RTR_TYPE_DISABLED ||
1365             port->multicast_router == MDB_RTR_TYPE_PERM ||
1366             timer_pending(&port->ip4_mc_router_timer))
1367                 goto out;
1368
1369         __del_port_router(port);
1370 out:
1371         spin_unlock(&br->multicast_lock);
1372 }
1373
1374 static void br_mc_router_state_change(struct net_bridge *p,
1375                                       bool is_mc_router)
1376 {
1377         struct switchdev_attr attr = {
1378                 .orig_dev = p->dev,
1379                 .id = SWITCHDEV_ATTR_ID_BRIDGE_MROUTER,
1380                 .flags = SWITCHDEV_F_DEFER,
1381                 .u.mrouter = is_mc_router,
1382         };
1383
1384         switchdev_port_attr_set(p->dev, &attr, NULL);
1385 }
1386
1387 static void br_multicast_local_router_expired(struct timer_list *t)
1388 {
1389         struct net_bridge *br = from_timer(br, t, ip4_mc_router_timer);
1390
1391         spin_lock(&br->multicast_lock);
1392         if (br->multicast_router == MDB_RTR_TYPE_DISABLED ||
1393             br->multicast_router == MDB_RTR_TYPE_PERM ||
1394             timer_pending(&br->ip4_mc_router_timer))
1395                 goto out;
1396
1397         br_mc_router_state_change(br, false);
1398 out:
1399         spin_unlock(&br->multicast_lock);
1400 }
1401
1402 static void br_multicast_querier_expired(struct net_bridge *br,
1403                                          struct bridge_mcast_own_query *query)
1404 {
1405         spin_lock(&br->multicast_lock);
1406         if (!netif_running(br->dev) || !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1407                 goto out;
1408
1409         br_multicast_start_querier(br, query);
1410
1411 out:
1412         spin_unlock(&br->multicast_lock);
1413 }
1414
1415 static void br_ip4_multicast_querier_expired(struct timer_list *t)
1416 {
1417         struct net_bridge *br = from_timer(br, t, ip4_other_query.timer);
1418
1419         br_multicast_querier_expired(br, &br->ip4_own_query);
1420 }
1421
1422 #if IS_ENABLED(CONFIG_IPV6)
1423 static void br_ip6_multicast_querier_expired(struct timer_list *t)
1424 {
1425         struct net_bridge *br = from_timer(br, t, ip6_other_query.timer);
1426
1427         br_multicast_querier_expired(br, &br->ip6_own_query);
1428 }
1429 #endif
1430
1431 static void br_multicast_select_own_querier(struct net_bridge *br,
1432                                             struct br_ip *ip,
1433                                             struct sk_buff *skb)
1434 {
1435         if (ip->proto == htons(ETH_P_IP))
1436                 br->ip4_querier.addr.src.ip4 = ip_hdr(skb)->saddr;
1437 #if IS_ENABLED(CONFIG_IPV6)
1438         else
1439                 br->ip6_querier.addr.src.ip6 = ipv6_hdr(skb)->saddr;
1440 #endif
1441 }
1442
1443 static void __br_multicast_send_query(struct net_bridge *br,
1444                                       struct net_bridge_port *port,
1445                                       struct net_bridge_port_group *pg,
1446                                       struct br_ip *ip_dst,
1447                                       struct br_ip *group,
1448                                       bool with_srcs,
1449                                       u8 sflag,
1450                                       bool *need_rexmit)
1451 {
1452         bool over_lmqt = !!sflag;
1453         struct sk_buff *skb;
1454         u8 igmp_type;
1455
1456 again_under_lmqt:
1457         skb = br_multicast_alloc_query(br, pg, ip_dst, group, with_srcs,
1458                                        over_lmqt, sflag, &igmp_type,
1459                                        need_rexmit);
1460         if (!skb)
1461                 return;
1462
1463         if (port) {
1464                 skb->dev = port->dev;
1465                 br_multicast_count(br, port, skb, igmp_type,
1466                                    BR_MCAST_DIR_TX);
1467                 NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
1468                         dev_net(port->dev), NULL, skb, NULL, skb->dev,
1469                         br_dev_queue_push_xmit);
1470
1471                 if (over_lmqt && with_srcs && sflag) {
1472                         over_lmqt = false;
1473                         goto again_under_lmqt;
1474                 }
1475         } else {
1476                 br_multicast_select_own_querier(br, group, skb);
1477                 br_multicast_count(br, port, skb, igmp_type,
1478                                    BR_MCAST_DIR_RX);
1479                 netif_rx(skb);
1480         }
1481 }
1482
1483 static void br_multicast_send_query(struct net_bridge *br,
1484                                     struct net_bridge_port *port,
1485                                     struct bridge_mcast_own_query *own_query)
1486 {
1487         struct bridge_mcast_other_query *other_query = NULL;
1488         struct br_ip br_group;
1489         unsigned long time;
1490
1491         if (!netif_running(br->dev) ||
1492             !br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
1493             !br_opt_get(br, BROPT_MULTICAST_QUERIER))
1494                 return;
1495
1496         memset(&br_group.dst, 0, sizeof(br_group.dst));
1497
1498         if (port ? (own_query == &port->ip4_own_query) :
1499                    (own_query == &br->ip4_own_query)) {
1500                 other_query = &br->ip4_other_query;
1501                 br_group.proto = htons(ETH_P_IP);
1502 #if IS_ENABLED(CONFIG_IPV6)
1503         } else {
1504                 other_query = &br->ip6_other_query;
1505                 br_group.proto = htons(ETH_P_IPV6);
1506 #endif
1507         }
1508
1509         if (!other_query || timer_pending(&other_query->timer))
1510                 return;
1511
1512         __br_multicast_send_query(br, port, NULL, NULL, &br_group, false, 0,
1513                                   NULL);
1514
1515         time = jiffies;
1516         time += own_query->startup_sent < br->multicast_startup_query_count ?
1517                 br->multicast_startup_query_interval :
1518                 br->multicast_query_interval;
1519         mod_timer(&own_query->timer, time);
1520 }
1521
1522 static void
1523 br_multicast_port_query_expired(struct net_bridge_port *port,
1524                                 struct bridge_mcast_own_query *query)
1525 {
1526         struct net_bridge *br = port->br;
1527
1528         spin_lock(&br->multicast_lock);
1529         if (port->state == BR_STATE_DISABLED ||
1530             port->state == BR_STATE_BLOCKING)
1531                 goto out;
1532
1533         if (query->startup_sent < br->multicast_startup_query_count)
1534                 query->startup_sent++;
1535
1536         br_multicast_send_query(port->br, port, query);
1537
1538 out:
1539         spin_unlock(&br->multicast_lock);
1540 }
1541
1542 static void br_ip4_multicast_port_query_expired(struct timer_list *t)
1543 {
1544         struct net_bridge_port *port = from_timer(port, t, ip4_own_query.timer);
1545
1546         br_multicast_port_query_expired(port, &port->ip4_own_query);
1547 }
1548
1549 #if IS_ENABLED(CONFIG_IPV6)
1550 static void br_ip6_multicast_port_query_expired(struct timer_list *t)
1551 {
1552         struct net_bridge_port *port = from_timer(port, t, ip6_own_query.timer);
1553
1554         br_multicast_port_query_expired(port, &port->ip6_own_query);
1555 }
1556 #endif
1557
1558 static void br_multicast_port_group_rexmit(struct timer_list *t)
1559 {
1560         struct net_bridge_port_group *pg = from_timer(pg, t, rexmit_timer);
1561         struct bridge_mcast_other_query *other_query = NULL;
1562         struct net_bridge *br = pg->key.port->br;
1563         bool need_rexmit = false;
1564
1565         spin_lock(&br->multicast_lock);
1566         if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
1567             !br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
1568             !br_opt_get(br, BROPT_MULTICAST_QUERIER))
1569                 goto out;
1570
1571         if (pg->key.addr.proto == htons(ETH_P_IP))
1572                 other_query = &br->ip4_other_query;
1573 #if IS_ENABLED(CONFIG_IPV6)
1574         else
1575                 other_query = &br->ip6_other_query;
1576 #endif
1577
1578         if (!other_query || timer_pending(&other_query->timer))
1579                 goto out;
1580
1581         if (pg->grp_query_rexmit_cnt) {
1582                 pg->grp_query_rexmit_cnt--;
1583                 __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1584                                           &pg->key.addr, false, 1, NULL);
1585         }
1586         __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1587                                   &pg->key.addr, true, 0, &need_rexmit);
1588
1589         if (pg->grp_query_rexmit_cnt || need_rexmit)
1590                 mod_timer(&pg->rexmit_timer, jiffies +
1591                                              br->multicast_last_member_interval);
1592 out:
1593         spin_unlock(&br->multicast_lock);
1594 }
1595
1596 static int br_mc_disabled_update(struct net_device *dev, bool value,
1597                                  struct netlink_ext_ack *extack)
1598 {
1599         struct switchdev_attr attr = {
1600                 .orig_dev = dev,
1601                 .id = SWITCHDEV_ATTR_ID_BRIDGE_MC_DISABLED,
1602                 .flags = SWITCHDEV_F_DEFER,
1603                 .u.mc_disabled = !value,
1604         };
1605
1606         return switchdev_port_attr_set(dev, &attr, extack);
1607 }
1608
1609 int br_multicast_add_port(struct net_bridge_port *port)
1610 {
1611         int err;
1612
1613         port->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
1614         port->multicast_eht_hosts_limit = BR_MCAST_DEFAULT_EHT_HOSTS_LIMIT;
1615
1616         timer_setup(&port->ip4_mc_router_timer,
1617                     br_multicast_router_expired, 0);
1618         timer_setup(&port->ip4_own_query.timer,
1619                     br_ip4_multicast_port_query_expired, 0);
1620 #if IS_ENABLED(CONFIG_IPV6)
1621         timer_setup(&port->ip6_own_query.timer,
1622                     br_ip6_multicast_port_query_expired, 0);
1623 #endif
1624         err = br_mc_disabled_update(port->dev,
1625                                     br_opt_get(port->br,
1626                                                BROPT_MULTICAST_ENABLED),
1627                                     NULL);
1628         if (err && err != -EOPNOTSUPP)
1629                 return err;
1630
1631         port->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
1632         if (!port->mcast_stats)
1633                 return -ENOMEM;
1634
1635         return 0;
1636 }
1637
1638 void br_multicast_del_port(struct net_bridge_port *port)
1639 {
1640         struct net_bridge *br = port->br;
1641         struct net_bridge_port_group *pg;
1642         HLIST_HEAD(deleted_head);
1643         struct hlist_node *n;
1644
1645         /* Take care of the remaining groups, only perm ones should be left */
1646         spin_lock_bh(&br->multicast_lock);
1647         hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
1648                 br_multicast_find_del_pg(br, pg);
1649         hlist_move_list(&br->mcast_gc_list, &deleted_head);
1650         spin_unlock_bh(&br->multicast_lock);
1651         br_multicast_gc(&deleted_head);
1652         del_timer_sync(&port->ip4_mc_router_timer);
1653         free_percpu(port->mcast_stats);
1654 }
1655
1656 static void br_multicast_enable(struct bridge_mcast_own_query *query)
1657 {
1658         query->startup_sent = 0;
1659
1660         if (try_to_del_timer_sync(&query->timer) >= 0 ||
1661             del_timer(&query->timer))
1662                 mod_timer(&query->timer, jiffies);
1663 }
1664
1665 static void __br_multicast_enable_port(struct net_bridge_port *port)
1666 {
1667         struct net_bridge *br = port->br;
1668
1669         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED) || !netif_running(br->dev))
1670                 return;
1671
1672         br_multicast_enable(&port->ip4_own_query);
1673 #if IS_ENABLED(CONFIG_IPV6)
1674         br_multicast_enable(&port->ip6_own_query);
1675 #endif
1676         if (port->multicast_router == MDB_RTR_TYPE_PERM &&
1677             hlist_unhashed(&port->ip4_rlist))
1678                 br_multicast_add_router(br, port);
1679 }
1680
1681 void br_multicast_enable_port(struct net_bridge_port *port)
1682 {
1683         struct net_bridge *br = port->br;
1684
1685         spin_lock(&br->multicast_lock);
1686         __br_multicast_enable_port(port);
1687         spin_unlock(&br->multicast_lock);
1688 }
1689
1690 void br_multicast_disable_port(struct net_bridge_port *port)
1691 {
1692         struct net_bridge *br = port->br;
1693         struct net_bridge_port_group *pg;
1694         struct hlist_node *n;
1695
1696         spin_lock(&br->multicast_lock);
1697         hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
1698                 if (!(pg->flags & MDB_PG_FLAGS_PERMANENT))
1699                         br_multicast_find_del_pg(br, pg);
1700
1701         __del_port_router(port);
1702
1703         del_timer(&port->ip4_mc_router_timer);
1704         del_timer(&port->ip4_own_query.timer);
1705 #if IS_ENABLED(CONFIG_IPV6)
1706         del_timer(&port->ip6_own_query.timer);
1707 #endif
1708         spin_unlock(&br->multicast_lock);
1709 }
1710
1711 static int __grp_src_delete_marked(struct net_bridge_port_group *pg)
1712 {
1713         struct net_bridge_group_src *ent;
1714         struct hlist_node *tmp;
1715         int deleted = 0;
1716
1717         hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
1718                 if (ent->flags & BR_SGRP_F_DELETE) {
1719                         br_multicast_del_group_src(ent, false);
1720                         deleted++;
1721                 }
1722
1723         return deleted;
1724 }
1725
1726 static void __grp_src_mod_timer(struct net_bridge_group_src *src,
1727                                 unsigned long expires)
1728 {
1729         mod_timer(&src->timer, expires);
1730         br_multicast_fwd_src_handle(src);
1731 }
1732
1733 static void __grp_src_query_marked_and_rexmit(struct net_bridge_port_group *pg)
1734 {
1735         struct bridge_mcast_other_query *other_query = NULL;
1736         struct net_bridge *br = pg->key.port->br;
1737         u32 lmqc = br->multicast_last_member_count;
1738         unsigned long lmqt, lmi, now = jiffies;
1739         struct net_bridge_group_src *ent;
1740
1741         if (!netif_running(br->dev) ||
1742             !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1743                 return;
1744
1745         if (pg->key.addr.proto == htons(ETH_P_IP))
1746                 other_query = &br->ip4_other_query;
1747 #if IS_ENABLED(CONFIG_IPV6)
1748         else
1749                 other_query = &br->ip6_other_query;
1750 #endif
1751
1752         lmqt = now + br_multicast_lmqt(br);
1753         hlist_for_each_entry(ent, &pg->src_list, node) {
1754                 if (ent->flags & BR_SGRP_F_SEND) {
1755                         ent->flags &= ~BR_SGRP_F_SEND;
1756                         if (ent->timer.expires > lmqt) {
1757                                 if (br_opt_get(br, BROPT_MULTICAST_QUERIER) &&
1758                                     other_query &&
1759                                     !timer_pending(&other_query->timer))
1760                                         ent->src_query_rexmit_cnt = lmqc;
1761                                 __grp_src_mod_timer(ent, lmqt);
1762                         }
1763                 }
1764         }
1765
1766         if (!br_opt_get(br, BROPT_MULTICAST_QUERIER) ||
1767             !other_query || timer_pending(&other_query->timer))
1768                 return;
1769
1770         __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1771                                   &pg->key.addr, true, 1, NULL);
1772
1773         lmi = now + br->multicast_last_member_interval;
1774         if (!timer_pending(&pg->rexmit_timer) ||
1775             time_after(pg->rexmit_timer.expires, lmi))
1776                 mod_timer(&pg->rexmit_timer, lmi);
1777 }
1778
1779 static void __grp_send_query_and_rexmit(struct net_bridge_port_group *pg)
1780 {
1781         struct bridge_mcast_other_query *other_query = NULL;
1782         struct net_bridge *br = pg->key.port->br;
1783         unsigned long now = jiffies, lmi;
1784
1785         if (!netif_running(br->dev) ||
1786             !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1787                 return;
1788
1789         if (pg->key.addr.proto == htons(ETH_P_IP))
1790                 other_query = &br->ip4_other_query;
1791 #if IS_ENABLED(CONFIG_IPV6)
1792         else
1793                 other_query = &br->ip6_other_query;
1794 #endif
1795
1796         if (br_opt_get(br, BROPT_MULTICAST_QUERIER) &&
1797             other_query && !timer_pending(&other_query->timer)) {
1798                 lmi = now + br->multicast_last_member_interval;
1799                 pg->grp_query_rexmit_cnt = br->multicast_last_member_count - 1;
1800                 __br_multicast_send_query(br, pg->key.port, pg, &pg->key.addr,
1801                                           &pg->key.addr, false, 0, NULL);
1802                 if (!timer_pending(&pg->rexmit_timer) ||
1803                     time_after(pg->rexmit_timer.expires, lmi))
1804                         mod_timer(&pg->rexmit_timer, lmi);
1805         }
1806
1807         if (pg->filter_mode == MCAST_EXCLUDE &&
1808             (!timer_pending(&pg->timer) ||
1809              time_after(pg->timer.expires, now + br_multicast_lmqt(br))))
1810                 mod_timer(&pg->timer, now + br_multicast_lmqt(br));
1811 }
1812
1813 /* State          Msg type      New state                Actions
1814  * INCLUDE (A)    IS_IN (B)     INCLUDE (A+B)            (B)=GMI
1815  * INCLUDE (A)    ALLOW (B)     INCLUDE (A+B)            (B)=GMI
1816  * EXCLUDE (X,Y)  ALLOW (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
1817  */
1818 static bool br_multicast_isinc_allow(struct net_bridge_port_group *pg, void *h_addr,
1819                                      void *srcs, u32 nsrcs, size_t addr_size,
1820                                      int grec_type)
1821 {
1822         struct net_bridge *br = pg->key.port->br;
1823         struct net_bridge_group_src *ent;
1824         unsigned long now = jiffies;
1825         bool changed = false;
1826         struct br_ip src_ip;
1827         u32 src_idx;
1828
1829         memset(&src_ip, 0, sizeof(src_ip));
1830         src_ip.proto = pg->key.addr.proto;
1831         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1832                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1833                 ent = br_multicast_find_group_src(pg, &src_ip);
1834                 if (!ent) {
1835                         ent = br_multicast_new_group_src(pg, &src_ip);
1836                         if (ent)
1837                                 changed = true;
1838                 }
1839
1840                 if (ent)
1841                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
1842         }
1843
1844         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
1845                 changed = true;
1846
1847         return changed;
1848 }
1849
1850 /* State          Msg type      New state                Actions
1851  * INCLUDE (A)    IS_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
1852  *                                                       Delete (A-B)
1853  *                                                       Group Timer=GMI
1854  */
1855 static void __grp_src_isexc_incl(struct net_bridge_port_group *pg, void *h_addr,
1856                                  void *srcs, u32 nsrcs, size_t addr_size,
1857                                  int grec_type)
1858 {
1859         struct net_bridge_group_src *ent;
1860         struct br_ip src_ip;
1861         u32 src_idx;
1862
1863         hlist_for_each_entry(ent, &pg->src_list, node)
1864                 ent->flags |= BR_SGRP_F_DELETE;
1865
1866         memset(&src_ip, 0, sizeof(src_ip));
1867         src_ip.proto = pg->key.addr.proto;
1868         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1869                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1870                 ent = br_multicast_find_group_src(pg, &src_ip);
1871                 if (ent)
1872                         ent->flags &= ~BR_SGRP_F_DELETE;
1873                 else
1874                         ent = br_multicast_new_group_src(pg, &src_ip);
1875                 if (ent)
1876                         br_multicast_fwd_src_handle(ent);
1877         }
1878
1879         br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type);
1880
1881         __grp_src_delete_marked(pg);
1882 }
1883
1884 /* State          Msg type      New state                Actions
1885  * EXCLUDE (X,Y)  IS_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=GMI
1886  *                                                       Delete (X-A)
1887  *                                                       Delete (Y-A)
1888  *                                                       Group Timer=GMI
1889  */
1890 static bool __grp_src_isexc_excl(struct net_bridge_port_group *pg, void *h_addr,
1891                                  void *srcs, u32 nsrcs, size_t addr_size,
1892                                  int grec_type)
1893 {
1894         struct net_bridge *br = pg->key.port->br;
1895         struct net_bridge_group_src *ent;
1896         unsigned long now = jiffies;
1897         bool changed = false;
1898         struct br_ip src_ip;
1899         u32 src_idx;
1900
1901         hlist_for_each_entry(ent, &pg->src_list, node)
1902                 ent->flags |= BR_SGRP_F_DELETE;
1903
1904         memset(&src_ip, 0, sizeof(src_ip));
1905         src_ip.proto = pg->key.addr.proto;
1906         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1907                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1908                 ent = br_multicast_find_group_src(pg, &src_ip);
1909                 if (ent) {
1910                         ent->flags &= ~BR_SGRP_F_DELETE;
1911                 } else {
1912                         ent = br_multicast_new_group_src(pg, &src_ip);
1913                         if (ent) {
1914                                 __grp_src_mod_timer(ent,
1915                                                     now + br_multicast_gmi(br));
1916                                 changed = true;
1917                         }
1918                 }
1919         }
1920
1921         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
1922                 changed = true;
1923
1924         if (__grp_src_delete_marked(pg))
1925                 changed = true;
1926
1927         return changed;
1928 }
1929
1930 static bool br_multicast_isexc(struct net_bridge_port_group *pg, void *h_addr,
1931                                void *srcs, u32 nsrcs, size_t addr_size,
1932                                int grec_type)
1933 {
1934         struct net_bridge *br = pg->key.port->br;
1935         bool changed = false;
1936
1937         switch (pg->filter_mode) {
1938         case MCAST_INCLUDE:
1939                 __grp_src_isexc_incl(pg, h_addr, srcs, nsrcs, addr_size,
1940                                      grec_type);
1941                 br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
1942                 changed = true;
1943                 break;
1944         case MCAST_EXCLUDE:
1945                 changed = __grp_src_isexc_excl(pg, h_addr, srcs, nsrcs, addr_size,
1946                                                grec_type);
1947                 break;
1948         }
1949
1950         pg->filter_mode = MCAST_EXCLUDE;
1951         mod_timer(&pg->timer, jiffies + br_multicast_gmi(br));
1952
1953         return changed;
1954 }
1955
1956 /* State          Msg type      New state                Actions
1957  * INCLUDE (A)    TO_IN (B)     INCLUDE (A+B)            (B)=GMI
1958  *                                                       Send Q(G,A-B)
1959  */
1960 static bool __grp_src_toin_incl(struct net_bridge_port_group *pg, void *h_addr,
1961                                 void *srcs, u32 nsrcs, size_t addr_size,
1962                                 int grec_type)
1963 {
1964         struct net_bridge *br = pg->key.port->br;
1965         u32 src_idx, to_send = pg->src_ents;
1966         struct net_bridge_group_src *ent;
1967         unsigned long now = jiffies;
1968         bool changed = false;
1969         struct br_ip src_ip;
1970
1971         hlist_for_each_entry(ent, &pg->src_list, node)
1972                 ent->flags |= BR_SGRP_F_SEND;
1973
1974         memset(&src_ip, 0, sizeof(src_ip));
1975         src_ip.proto = pg->key.addr.proto;
1976         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
1977                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
1978                 ent = br_multicast_find_group_src(pg, &src_ip);
1979                 if (ent) {
1980                         ent->flags &= ~BR_SGRP_F_SEND;
1981                         to_send--;
1982                 } else {
1983                         ent = br_multicast_new_group_src(pg, &src_ip);
1984                         if (ent)
1985                                 changed = true;
1986                 }
1987                 if (ent)
1988                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
1989         }
1990
1991         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
1992                 changed = true;
1993
1994         if (to_send)
1995                 __grp_src_query_marked_and_rexmit(pg);
1996
1997         return changed;
1998 }
1999
2000 /* State          Msg type      New state                Actions
2001  * EXCLUDE (X,Y)  TO_IN (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
2002  *                                                       Send Q(G,X-A)
2003  *                                                       Send Q(G)
2004  */
2005 static bool __grp_src_toin_excl(struct net_bridge_port_group *pg, void *h_addr,
2006                                 void *srcs, u32 nsrcs, size_t addr_size,
2007                                 int grec_type)
2008 {
2009         struct net_bridge *br = pg->key.port->br;
2010         u32 src_idx, to_send = pg->src_ents;
2011         struct net_bridge_group_src *ent;
2012         unsigned long now = jiffies;
2013         bool changed = false;
2014         struct br_ip src_ip;
2015
2016         hlist_for_each_entry(ent, &pg->src_list, node)
2017                 if (timer_pending(&ent->timer))
2018                         ent->flags |= BR_SGRP_F_SEND;
2019
2020         memset(&src_ip, 0, sizeof(src_ip));
2021         src_ip.proto = pg->key.addr.proto;
2022         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2023                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2024                 ent = br_multicast_find_group_src(pg, &src_ip);
2025                 if (ent) {
2026                         if (timer_pending(&ent->timer)) {
2027                                 ent->flags &= ~BR_SGRP_F_SEND;
2028                                 to_send--;
2029                         }
2030                 } else {
2031                         ent = br_multicast_new_group_src(pg, &src_ip);
2032                         if (ent)
2033                                 changed = true;
2034                 }
2035                 if (ent)
2036                         __grp_src_mod_timer(ent, now + br_multicast_gmi(br));
2037         }
2038
2039         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2040                 changed = true;
2041
2042         if (to_send)
2043                 __grp_src_query_marked_and_rexmit(pg);
2044
2045         __grp_send_query_and_rexmit(pg);
2046
2047         return changed;
2048 }
2049
2050 static bool br_multicast_toin(struct net_bridge_port_group *pg, void *h_addr,
2051                               void *srcs, u32 nsrcs, size_t addr_size,
2052                               int grec_type)
2053 {
2054         bool changed = false;
2055
2056         switch (pg->filter_mode) {
2057         case MCAST_INCLUDE:
2058                 changed = __grp_src_toin_incl(pg, h_addr, srcs, nsrcs, addr_size,
2059                                               grec_type);
2060                 break;
2061         case MCAST_EXCLUDE:
2062                 changed = __grp_src_toin_excl(pg, h_addr, srcs, nsrcs, addr_size,
2063                                               grec_type);
2064                 break;
2065         }
2066
2067         if (br_multicast_eht_should_del_pg(pg)) {
2068                 pg->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2069                 br_multicast_find_del_pg(pg->key.port->br, pg);
2070                 /* a notification has already been sent and we shouldn't
2071                  * access pg after the delete so we have to return false
2072                  */
2073                 changed = false;
2074         }
2075
2076         return changed;
2077 }
2078
2079 /* State          Msg type      New state                Actions
2080  * INCLUDE (A)    TO_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
2081  *                                                       Delete (A-B)
2082  *                                                       Send Q(G,A*B)
2083  *                                                       Group Timer=GMI
2084  */
2085 static void __grp_src_toex_incl(struct net_bridge_port_group *pg, void *h_addr,
2086                                 void *srcs, u32 nsrcs, size_t addr_size,
2087                                 int grec_type)
2088 {
2089         struct net_bridge_group_src *ent;
2090         u32 src_idx, to_send = 0;
2091         struct br_ip src_ip;
2092
2093         hlist_for_each_entry(ent, &pg->src_list, node)
2094                 ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2095
2096         memset(&src_ip, 0, sizeof(src_ip));
2097         src_ip.proto = pg->key.addr.proto;
2098         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2099                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2100                 ent = br_multicast_find_group_src(pg, &src_ip);
2101                 if (ent) {
2102                         ent->flags = (ent->flags & ~BR_SGRP_F_DELETE) |
2103                                      BR_SGRP_F_SEND;
2104                         to_send++;
2105                 } else {
2106                         ent = br_multicast_new_group_src(pg, &src_ip);
2107                 }
2108                 if (ent)
2109                         br_multicast_fwd_src_handle(ent);
2110         }
2111
2112         br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type);
2113
2114         __grp_src_delete_marked(pg);
2115         if (to_send)
2116                 __grp_src_query_marked_and_rexmit(pg);
2117 }
2118
2119 /* State          Msg type      New state                Actions
2120  * EXCLUDE (X,Y)  TO_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=Group Timer
2121  *                                                       Delete (X-A)
2122  *                                                       Delete (Y-A)
2123  *                                                       Send Q(G,A-Y)
2124  *                                                       Group Timer=GMI
2125  */
2126 static bool __grp_src_toex_excl(struct net_bridge_port_group *pg, void *h_addr,
2127                                 void *srcs, u32 nsrcs, size_t addr_size,
2128                                 int grec_type)
2129 {
2130         struct net_bridge_group_src *ent;
2131         u32 src_idx, to_send = 0;
2132         bool changed = false;
2133         struct br_ip src_ip;
2134
2135         hlist_for_each_entry(ent, &pg->src_list, node)
2136                 ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2137
2138         memset(&src_ip, 0, sizeof(src_ip));
2139         src_ip.proto = pg->key.addr.proto;
2140         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2141                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2142                 ent = br_multicast_find_group_src(pg, &src_ip);
2143                 if (ent) {
2144                         ent->flags &= ~BR_SGRP_F_DELETE;
2145                 } else {
2146                         ent = br_multicast_new_group_src(pg, &src_ip);
2147                         if (ent) {
2148                                 __grp_src_mod_timer(ent, pg->timer.expires);
2149                                 changed = true;
2150                         }
2151                 }
2152                 if (ent && timer_pending(&ent->timer)) {
2153                         ent->flags |= BR_SGRP_F_SEND;
2154                         to_send++;
2155                 }
2156         }
2157
2158         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2159                 changed = true;
2160
2161         if (__grp_src_delete_marked(pg))
2162                 changed = true;
2163         if (to_send)
2164                 __grp_src_query_marked_and_rexmit(pg);
2165
2166         return changed;
2167 }
2168
2169 static bool br_multicast_toex(struct net_bridge_port_group *pg, void *h_addr,
2170                               void *srcs, u32 nsrcs, size_t addr_size,
2171                               int grec_type)
2172 {
2173         struct net_bridge *br = pg->key.port->br;
2174         bool changed = false;
2175
2176         switch (pg->filter_mode) {
2177         case MCAST_INCLUDE:
2178                 __grp_src_toex_incl(pg, h_addr, srcs, nsrcs, addr_size,
2179                                     grec_type);
2180                 br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
2181                 changed = true;
2182                 break;
2183         case MCAST_EXCLUDE:
2184                 changed = __grp_src_toex_excl(pg, h_addr, srcs, nsrcs, addr_size,
2185                                               grec_type);
2186                 break;
2187         }
2188
2189         pg->filter_mode = MCAST_EXCLUDE;
2190         mod_timer(&pg->timer, jiffies + br_multicast_gmi(br));
2191
2192         return changed;
2193 }
2194
2195 /* State          Msg type      New state                Actions
2196  * INCLUDE (A)    BLOCK (B)     INCLUDE (A)              Send Q(G,A*B)
2197  */
2198 static bool __grp_src_block_incl(struct net_bridge_port_group *pg, void *h_addr,
2199                                  void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2200 {
2201         struct net_bridge_group_src *ent;
2202         u32 src_idx, to_send = 0;
2203         bool changed = false;
2204         struct br_ip src_ip;
2205
2206         hlist_for_each_entry(ent, &pg->src_list, node)
2207                 ent->flags &= ~BR_SGRP_F_SEND;
2208
2209         memset(&src_ip, 0, sizeof(src_ip));
2210         src_ip.proto = pg->key.addr.proto;
2211         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2212                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2213                 ent = br_multicast_find_group_src(pg, &src_ip);
2214                 if (ent) {
2215                         ent->flags |= BR_SGRP_F_SEND;
2216                         to_send++;
2217                 }
2218         }
2219
2220         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2221                 changed = true;
2222
2223         if (to_send)
2224                 __grp_src_query_marked_and_rexmit(pg);
2225
2226         return changed;
2227 }
2228
2229 /* State          Msg type      New state                Actions
2230  * EXCLUDE (X,Y)  BLOCK (A)     EXCLUDE (X+(A-Y),Y)      (A-X-Y)=Group Timer
2231  *                                                       Send Q(G,A-Y)
2232  */
2233 static bool __grp_src_block_excl(struct net_bridge_port_group *pg, void *h_addr,
2234                                  void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2235 {
2236         struct net_bridge_group_src *ent;
2237         u32 src_idx, to_send = 0;
2238         bool changed = false;
2239         struct br_ip src_ip;
2240
2241         hlist_for_each_entry(ent, &pg->src_list, node)
2242                 ent->flags &= ~BR_SGRP_F_SEND;
2243
2244         memset(&src_ip, 0, sizeof(src_ip));
2245         src_ip.proto = pg->key.addr.proto;
2246         for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2247                 memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2248                 ent = br_multicast_find_group_src(pg, &src_ip);
2249                 if (!ent) {
2250                         ent = br_multicast_new_group_src(pg, &src_ip);
2251                         if (ent) {
2252                                 __grp_src_mod_timer(ent, pg->timer.expires);
2253                                 changed = true;
2254                         }
2255                 }
2256                 if (ent && timer_pending(&ent->timer)) {
2257                         ent->flags |= BR_SGRP_F_SEND;
2258                         to_send++;
2259                 }
2260         }
2261
2262         if (br_multicast_eht_handle(pg, h_addr, srcs, nsrcs, addr_size, grec_type))
2263                 changed = true;
2264
2265         if (to_send)
2266                 __grp_src_query_marked_and_rexmit(pg);
2267
2268         return changed;
2269 }
2270
2271 static bool br_multicast_block(struct net_bridge_port_group *pg, void *h_addr,
2272                                void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2273 {
2274         bool changed = false;
2275
2276         switch (pg->filter_mode) {
2277         case MCAST_INCLUDE:
2278                 changed = __grp_src_block_incl(pg, h_addr, srcs, nsrcs, addr_size,
2279                                                grec_type);
2280                 break;
2281         case MCAST_EXCLUDE:
2282                 changed = __grp_src_block_excl(pg, h_addr, srcs, nsrcs, addr_size,
2283                                                grec_type);
2284                 break;
2285         }
2286
2287         if ((pg->filter_mode == MCAST_INCLUDE && hlist_empty(&pg->src_list)) ||
2288             br_multicast_eht_should_del_pg(pg)) {
2289                 if (br_multicast_eht_should_del_pg(pg))
2290                         pg->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2291                 br_multicast_find_del_pg(pg->key.port->br, pg);
2292                 /* a notification has already been sent and we shouldn't
2293                  * access pg after the delete so we have to return false
2294                  */
2295                 changed = false;
2296         }
2297
2298         return changed;
2299 }
2300
2301 static struct net_bridge_port_group *
2302 br_multicast_find_port(struct net_bridge_mdb_entry *mp,
2303                        struct net_bridge_port *p,
2304                        const unsigned char *src)
2305 {
2306         struct net_bridge *br __maybe_unused = mp->br;
2307         struct net_bridge_port_group *pg;
2308
2309         for (pg = mlock_dereference(mp->ports, br);
2310              pg;
2311              pg = mlock_dereference(pg->next, br))
2312                 if (br_port_group_equal(pg, p, src))
2313                         return pg;
2314
2315         return NULL;
2316 }
2317
2318 static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
2319                                          struct net_bridge_port *port,
2320                                          struct sk_buff *skb,
2321                                          u16 vid)
2322 {
2323         bool igmpv2 = br->multicast_igmp_version == 2;
2324         struct net_bridge_mdb_entry *mdst;
2325         struct net_bridge_port_group *pg;
2326         const unsigned char *src;
2327         struct igmpv3_report *ih;
2328         struct igmpv3_grec *grec;
2329         int i, len, num, type;
2330         __be32 group, *h_addr;
2331         bool changed = false;
2332         int err = 0;
2333         u16 nsrcs;
2334
2335         ih = igmpv3_report_hdr(skb);
2336         num = ntohs(ih->ngrec);
2337         len = skb_transport_offset(skb) + sizeof(*ih);
2338
2339         for (i = 0; i < num; i++) {
2340                 len += sizeof(*grec);
2341                 if (!ip_mc_may_pull(skb, len))
2342                         return -EINVAL;
2343
2344                 grec = (void *)(skb->data + len - sizeof(*grec));
2345                 group = grec->grec_mca;
2346                 type = grec->grec_type;
2347                 nsrcs = ntohs(grec->grec_nsrcs);
2348
2349                 len += nsrcs * 4;
2350                 if (!ip_mc_may_pull(skb, len))
2351                         return -EINVAL;
2352
2353                 switch (type) {
2354                 case IGMPV3_MODE_IS_INCLUDE:
2355                 case IGMPV3_MODE_IS_EXCLUDE:
2356                 case IGMPV3_CHANGE_TO_INCLUDE:
2357                 case IGMPV3_CHANGE_TO_EXCLUDE:
2358                 case IGMPV3_ALLOW_NEW_SOURCES:
2359                 case IGMPV3_BLOCK_OLD_SOURCES:
2360                         break;
2361
2362                 default:
2363                         continue;
2364                 }
2365
2366                 src = eth_hdr(skb)->h_source;
2367                 if (nsrcs == 0 &&
2368                     (type == IGMPV3_CHANGE_TO_INCLUDE ||
2369                      type == IGMPV3_MODE_IS_INCLUDE)) {
2370                         if (!port || igmpv2) {
2371                                 br_ip4_multicast_leave_group(br, port, group, vid, src);
2372                                 continue;
2373                         }
2374                 } else {
2375                         err = br_ip4_multicast_add_group(br, port, group, vid,
2376                                                          src, igmpv2);
2377                         if (err)
2378                                 break;
2379                 }
2380
2381                 if (!port || igmpv2)
2382                         continue;
2383
2384                 spin_lock_bh(&br->multicast_lock);
2385                 mdst = br_mdb_ip4_get(br, group, vid);
2386                 if (!mdst)
2387                         goto unlock_continue;
2388                 pg = br_multicast_find_port(mdst, port, src);
2389                 if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2390                         goto unlock_continue;
2391                 /* reload grec and host addr */
2392                 grec = (void *)(skb->data + len - sizeof(*grec) - (nsrcs * 4));
2393                 h_addr = &ip_hdr(skb)->saddr;
2394                 switch (type) {
2395                 case IGMPV3_ALLOW_NEW_SOURCES:
2396                         changed = br_multicast_isinc_allow(pg, h_addr, grec->grec_src,
2397                                                            nsrcs, sizeof(__be32), type);
2398                         break;
2399                 case IGMPV3_MODE_IS_INCLUDE:
2400                         changed = br_multicast_isinc_allow(pg, h_addr, grec->grec_src,
2401                                                            nsrcs, sizeof(__be32), type);
2402                         break;
2403                 case IGMPV3_MODE_IS_EXCLUDE:
2404                         changed = br_multicast_isexc(pg, h_addr, grec->grec_src,
2405                                                      nsrcs, sizeof(__be32), type);
2406                         break;
2407                 case IGMPV3_CHANGE_TO_INCLUDE:
2408                         changed = br_multicast_toin(pg, h_addr, grec->grec_src,
2409                                                     nsrcs, sizeof(__be32), type);
2410                         break;
2411                 case IGMPV3_CHANGE_TO_EXCLUDE:
2412                         changed = br_multicast_toex(pg, h_addr, grec->grec_src,
2413                                                     nsrcs, sizeof(__be32), type);
2414                         break;
2415                 case IGMPV3_BLOCK_OLD_SOURCES:
2416                         changed = br_multicast_block(pg, h_addr, grec->grec_src,
2417                                                      nsrcs, sizeof(__be32), type);
2418                         break;
2419                 }
2420                 if (changed)
2421                         br_mdb_notify(br->dev, mdst, pg, RTM_NEWMDB);
2422 unlock_continue:
2423                 spin_unlock_bh(&br->multicast_lock);
2424         }
2425
2426         return err;
2427 }
2428
2429 #if IS_ENABLED(CONFIG_IPV6)
2430 static int br_ip6_multicast_mld2_report(struct net_bridge *br,
2431                                         struct net_bridge_port *port,
2432                                         struct sk_buff *skb,
2433                                         u16 vid)
2434 {
2435         bool mldv1 = br->multicast_mld_version == 1;
2436         struct net_bridge_mdb_entry *mdst;
2437         struct net_bridge_port_group *pg;
2438         unsigned int nsrcs_offset;
2439         const unsigned char *src;
2440         struct icmp6hdr *icmp6h;
2441         struct in6_addr *h_addr;
2442         struct mld2_grec *grec;
2443         unsigned int grec_len;
2444         bool changed = false;
2445         int i, len, num;
2446         int err = 0;
2447
2448         if (!ipv6_mc_may_pull(skb, sizeof(*icmp6h)))
2449                 return -EINVAL;
2450
2451         icmp6h = icmp6_hdr(skb);
2452         num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
2453         len = skb_transport_offset(skb) + sizeof(*icmp6h);
2454
2455         for (i = 0; i < num; i++) {
2456                 __be16 *_nsrcs, __nsrcs;
2457                 u16 nsrcs;
2458
2459                 nsrcs_offset = len + offsetof(struct mld2_grec, grec_nsrcs);
2460
2461                 if (skb_transport_offset(skb) + ipv6_transport_len(skb) <
2462                     nsrcs_offset + sizeof(__nsrcs))
2463                         return -EINVAL;
2464
2465                 _nsrcs = skb_header_pointer(skb, nsrcs_offset,
2466                                             sizeof(__nsrcs), &__nsrcs);
2467                 if (!_nsrcs)
2468                         return -EINVAL;
2469
2470                 nsrcs = ntohs(*_nsrcs);
2471                 grec_len = struct_size(grec, grec_src, nsrcs);
2472
2473                 if (!ipv6_mc_may_pull(skb, len + grec_len))
2474                         return -EINVAL;
2475
2476                 grec = (struct mld2_grec *)(skb->data + len);
2477                 len += grec_len;
2478
2479                 switch (grec->grec_type) {
2480                 case MLD2_MODE_IS_INCLUDE:
2481                 case MLD2_MODE_IS_EXCLUDE:
2482                 case MLD2_CHANGE_TO_INCLUDE:
2483                 case MLD2_CHANGE_TO_EXCLUDE:
2484                 case MLD2_ALLOW_NEW_SOURCES:
2485                 case MLD2_BLOCK_OLD_SOURCES:
2486                         break;
2487
2488                 default:
2489                         continue;
2490                 }
2491
2492                 src = eth_hdr(skb)->h_source;
2493                 if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
2494                      grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
2495                     nsrcs == 0) {
2496                         if (!port || mldv1) {
2497                                 br_ip6_multicast_leave_group(br, port,
2498                                                              &grec->grec_mca,
2499                                                              vid, src);
2500                                 continue;
2501                         }
2502                 } else {
2503                         err = br_ip6_multicast_add_group(br, port,
2504                                                          &grec->grec_mca, vid,
2505                                                          src, mldv1);
2506                         if (err)
2507                                 break;
2508                 }
2509
2510                 if (!port || mldv1)
2511                         continue;
2512
2513                 spin_lock_bh(&br->multicast_lock);
2514                 mdst = br_mdb_ip6_get(br, &grec->grec_mca, vid);
2515                 if (!mdst)
2516                         goto unlock_continue;
2517                 pg = br_multicast_find_port(mdst, port, src);
2518                 if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2519                         goto unlock_continue;
2520                 h_addr = &ipv6_hdr(skb)->saddr;
2521                 switch (grec->grec_type) {
2522                 case MLD2_ALLOW_NEW_SOURCES:
2523                         changed = br_multicast_isinc_allow(pg, h_addr,
2524                                                            grec->grec_src, nsrcs,
2525                                                            sizeof(struct in6_addr),
2526                                                            grec->grec_type);
2527                         break;
2528                 case MLD2_MODE_IS_INCLUDE:
2529                         changed = br_multicast_isinc_allow(pg, h_addr,
2530                                                            grec->grec_src, nsrcs,
2531                                                            sizeof(struct in6_addr),
2532                                                            grec->grec_type);
2533                         break;
2534                 case MLD2_MODE_IS_EXCLUDE:
2535                         changed = br_multicast_isexc(pg, h_addr,
2536                                                      grec->grec_src, nsrcs,
2537                                                      sizeof(struct in6_addr),
2538                                                      grec->grec_type);
2539                         break;
2540                 case MLD2_CHANGE_TO_INCLUDE:
2541                         changed = br_multicast_toin(pg, h_addr,
2542                                                     grec->grec_src, nsrcs,
2543                                                     sizeof(struct in6_addr),
2544                                                     grec->grec_type);
2545                         break;
2546                 case MLD2_CHANGE_TO_EXCLUDE:
2547                         changed = br_multicast_toex(pg, h_addr,
2548                                                     grec->grec_src, nsrcs,
2549                                                     sizeof(struct in6_addr),
2550                                                     grec->grec_type);
2551                         break;
2552                 case MLD2_BLOCK_OLD_SOURCES:
2553                         changed = br_multicast_block(pg, h_addr,
2554                                                      grec->grec_src, nsrcs,
2555                                                      sizeof(struct in6_addr),
2556                                                      grec->grec_type);
2557                         break;
2558                 }
2559                 if (changed)
2560                         br_mdb_notify(br->dev, mdst, pg, RTM_NEWMDB);
2561 unlock_continue:
2562                 spin_unlock_bh(&br->multicast_lock);
2563         }
2564
2565         return err;
2566 }
2567 #endif
2568
2569 static bool br_ip4_multicast_select_querier(struct net_bridge *br,
2570                                             struct net_bridge_port *port,
2571                                             __be32 saddr)
2572 {
2573         if (!timer_pending(&br->ip4_own_query.timer) &&
2574             !timer_pending(&br->ip4_other_query.timer))
2575                 goto update;
2576
2577         if (!br->ip4_querier.addr.src.ip4)
2578                 goto update;
2579
2580         if (ntohl(saddr) <= ntohl(br->ip4_querier.addr.src.ip4))
2581                 goto update;
2582
2583         return false;
2584
2585 update:
2586         br->ip4_querier.addr.src.ip4 = saddr;
2587
2588         /* update protected by general multicast_lock by caller */
2589         rcu_assign_pointer(br->ip4_querier.port, port);
2590
2591         return true;
2592 }
2593
2594 #if IS_ENABLED(CONFIG_IPV6)
2595 static bool br_ip6_multicast_select_querier(struct net_bridge *br,
2596                                             struct net_bridge_port *port,
2597                                             struct in6_addr *saddr)
2598 {
2599         if (!timer_pending(&br->ip6_own_query.timer) &&
2600             !timer_pending(&br->ip6_other_query.timer))
2601                 goto update;
2602
2603         if (ipv6_addr_cmp(saddr, &br->ip6_querier.addr.src.ip6) <= 0)
2604                 goto update;
2605
2606         return false;
2607
2608 update:
2609         br->ip6_querier.addr.src.ip6 = *saddr;
2610
2611         /* update protected by general multicast_lock by caller */
2612         rcu_assign_pointer(br->ip6_querier.port, port);
2613
2614         return true;
2615 }
2616 #endif
2617
2618 static void
2619 br_multicast_update_query_timer(struct net_bridge *br,
2620                                 struct bridge_mcast_other_query *query,
2621                                 unsigned long max_delay)
2622 {
2623         if (!timer_pending(&query->timer))
2624                 query->delay_time = jiffies + max_delay;
2625
2626         mod_timer(&query->timer, jiffies + br->multicast_querier_interval);
2627 }
2628
2629 static void br_port_mc_router_state_change(struct net_bridge_port *p,
2630                                            bool is_mc_router)
2631 {
2632         struct switchdev_attr attr = {
2633                 .orig_dev = p->dev,
2634                 .id = SWITCHDEV_ATTR_ID_PORT_MROUTER,
2635                 .flags = SWITCHDEV_F_DEFER,
2636                 .u.mrouter = is_mc_router,
2637         };
2638
2639         switchdev_port_attr_set(p->dev, &attr, NULL);
2640 }
2641
2642 /*
2643  * Add port to router_list
2644  *  list is maintained ordered by pointer value
2645  *  and locked by br->multicast_lock and RCU
2646  */
2647 static void br_multicast_add_router(struct net_bridge *br,
2648                                     struct net_bridge_port *port)
2649 {
2650         struct net_bridge_port *p;
2651         struct hlist_node *slot = NULL;
2652
2653         if (!hlist_unhashed(&port->ip4_rlist))
2654                 return;
2655
2656         hlist_for_each_entry(p, &br->ip4_mc_router_list, ip4_rlist) {
2657                 if ((unsigned long) port >= (unsigned long) p)
2658                         break;
2659                 slot = &p->ip4_rlist;
2660         }
2661
2662         if (slot)
2663                 hlist_add_behind_rcu(&port->ip4_rlist, slot);
2664         else
2665                 hlist_add_head_rcu(&port->ip4_rlist, &br->ip4_mc_router_list);
2666         br_rtr_notify(br->dev, port, RTM_NEWMDB);
2667         br_port_mc_router_state_change(port, true);
2668 }
2669
2670 static void br_multicast_mark_router(struct net_bridge *br,
2671                                      struct net_bridge_port *port)
2672 {
2673         unsigned long now = jiffies;
2674
2675         if (!port) {
2676                 if (br->multicast_router == MDB_RTR_TYPE_TEMP_QUERY) {
2677                         if (!timer_pending(&br->ip4_mc_router_timer))
2678                                 br_mc_router_state_change(br, true);
2679                         mod_timer(&br->ip4_mc_router_timer,
2680                                   now + br->multicast_querier_interval);
2681                 }
2682                 return;
2683         }
2684
2685         if (port->multicast_router == MDB_RTR_TYPE_DISABLED ||
2686             port->multicast_router == MDB_RTR_TYPE_PERM)
2687                 return;
2688
2689         br_multicast_add_router(br, port);
2690
2691         mod_timer(&port->ip4_mc_router_timer,
2692                   now + br->multicast_querier_interval);
2693 }
2694
2695 static void
2696 br_ip4_multicast_query_received(struct net_bridge *br,
2697                                 struct net_bridge_port *port,
2698                                 struct bridge_mcast_other_query *query,
2699                                 struct br_ip *saddr,
2700                                 unsigned long max_delay)
2701 {
2702         if (!br_ip4_multicast_select_querier(br, port, saddr->src.ip4))
2703                 return;
2704
2705         br_multicast_update_query_timer(br, query, max_delay);
2706         br_multicast_mark_router(br, port);
2707 }
2708
2709 #if IS_ENABLED(CONFIG_IPV6)
2710 static void
2711 br_ip6_multicast_query_received(struct net_bridge *br,
2712                                 struct net_bridge_port *port,
2713                                 struct bridge_mcast_other_query *query,
2714                                 struct br_ip *saddr,
2715                                 unsigned long max_delay)
2716 {
2717         if (!br_ip6_multicast_select_querier(br, port, &saddr->src.ip6))
2718                 return;
2719
2720         br_multicast_update_query_timer(br, query, max_delay);
2721         br_multicast_mark_router(br, port);
2722 }
2723 #endif
2724
2725 static void br_ip4_multicast_query(struct net_bridge *br,
2726                                    struct net_bridge_port *port,
2727                                    struct sk_buff *skb,
2728                                    u16 vid)
2729 {
2730         unsigned int transport_len = ip_transport_len(skb);
2731         const struct iphdr *iph = ip_hdr(skb);
2732         struct igmphdr *ih = igmp_hdr(skb);
2733         struct net_bridge_mdb_entry *mp;
2734         struct igmpv3_query *ih3;
2735         struct net_bridge_port_group *p;
2736         struct net_bridge_port_group __rcu **pp;
2737         struct br_ip saddr;
2738         unsigned long max_delay;
2739         unsigned long now = jiffies;
2740         __be32 group;
2741
2742         spin_lock(&br->multicast_lock);
2743         if (!netif_running(br->dev) ||
2744             (port && port->state == BR_STATE_DISABLED))
2745                 goto out;
2746
2747         group = ih->group;
2748
2749         if (transport_len == sizeof(*ih)) {
2750                 max_delay = ih->code * (HZ / IGMP_TIMER_SCALE);
2751
2752                 if (!max_delay) {
2753                         max_delay = 10 * HZ;
2754                         group = 0;
2755                 }
2756         } else if (transport_len >= sizeof(*ih3)) {
2757                 ih3 = igmpv3_query_hdr(skb);
2758                 if (ih3->nsrcs ||
2759                     (br->multicast_igmp_version == 3 && group && ih3->suppress))
2760                         goto out;
2761
2762                 max_delay = ih3->code ?
2763                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
2764         } else {
2765                 goto out;
2766         }
2767
2768         if (!group) {
2769                 saddr.proto = htons(ETH_P_IP);
2770                 saddr.src.ip4 = iph->saddr;
2771
2772                 br_ip4_multicast_query_received(br, port, &br->ip4_other_query,
2773                                                 &saddr, max_delay);
2774                 goto out;
2775         }
2776
2777         mp = br_mdb_ip4_get(br, group, vid);
2778         if (!mp)
2779                 goto out;
2780
2781         max_delay *= br->multicast_last_member_count;
2782
2783         if (mp->host_joined &&
2784             (timer_pending(&mp->timer) ?
2785              time_after(mp->timer.expires, now + max_delay) :
2786              try_to_del_timer_sync(&mp->timer) >= 0))
2787                 mod_timer(&mp->timer, now + max_delay);
2788
2789         for (pp = &mp->ports;
2790              (p = mlock_dereference(*pp, br)) != NULL;
2791              pp = &p->next) {
2792                 if (timer_pending(&p->timer) ?
2793                     time_after(p->timer.expires, now + max_delay) :
2794                     try_to_del_timer_sync(&p->timer) >= 0 &&
2795                     (br->multicast_igmp_version == 2 ||
2796                      p->filter_mode == MCAST_EXCLUDE))
2797                         mod_timer(&p->timer, now + max_delay);
2798         }
2799
2800 out:
2801         spin_unlock(&br->multicast_lock);
2802 }
2803
2804 #if IS_ENABLED(CONFIG_IPV6)
2805 static int br_ip6_multicast_query(struct net_bridge *br,
2806                                   struct net_bridge_port *port,
2807                                   struct sk_buff *skb,
2808                                   u16 vid)
2809 {
2810         unsigned int transport_len = ipv6_transport_len(skb);
2811         struct mld_msg *mld;
2812         struct net_bridge_mdb_entry *mp;
2813         struct mld2_query *mld2q;
2814         struct net_bridge_port_group *p;
2815         struct net_bridge_port_group __rcu **pp;
2816         struct br_ip saddr;
2817         unsigned long max_delay;
2818         unsigned long now = jiffies;
2819         unsigned int offset = skb_transport_offset(skb);
2820         const struct in6_addr *group = NULL;
2821         bool is_general_query;
2822         int err = 0;
2823
2824         spin_lock(&br->multicast_lock);
2825         if (!netif_running(br->dev) ||
2826             (port && port->state == BR_STATE_DISABLED))
2827                 goto out;
2828
2829         if (transport_len == sizeof(*mld)) {
2830                 if (!pskb_may_pull(skb, offset + sizeof(*mld))) {
2831                         err = -EINVAL;
2832                         goto out;
2833                 }
2834                 mld = (struct mld_msg *) icmp6_hdr(skb);
2835                 max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
2836                 if (max_delay)
2837                         group = &mld->mld_mca;
2838         } else {
2839                 if (!pskb_may_pull(skb, offset + sizeof(*mld2q))) {
2840                         err = -EINVAL;
2841                         goto out;
2842                 }
2843                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
2844                 if (!mld2q->mld2q_nsrcs)
2845                         group = &mld2q->mld2q_mca;
2846                 if (br->multicast_mld_version == 2 &&
2847                     !ipv6_addr_any(&mld2q->mld2q_mca) &&
2848                     mld2q->mld2q_suppress)
2849                         goto out;
2850
2851                 max_delay = max(msecs_to_jiffies(mldv2_mrc(mld2q)), 1UL);
2852         }
2853
2854         is_general_query = group && ipv6_addr_any(group);
2855
2856         if (is_general_query) {
2857                 saddr.proto = htons(ETH_P_IPV6);
2858                 saddr.src.ip6 = ipv6_hdr(skb)->saddr;
2859
2860                 br_ip6_multicast_query_received(br, port, &br->ip6_other_query,
2861                                                 &saddr, max_delay);
2862                 goto out;
2863         } else if (!group) {
2864                 goto out;
2865         }
2866
2867         mp = br_mdb_ip6_get(br, group, vid);
2868         if (!mp)
2869                 goto out;
2870
2871         max_delay *= br->multicast_last_member_count;
2872         if (mp->host_joined &&
2873             (timer_pending(&mp->timer) ?
2874              time_after(mp->timer.expires, now + max_delay) :
2875              try_to_del_timer_sync(&mp->timer) >= 0))
2876                 mod_timer(&mp->timer, now + max_delay);
2877
2878         for (pp = &mp->ports;
2879              (p = mlock_dereference(*pp, br)) != NULL;
2880              pp = &p->next) {
2881                 if (timer_pending(&p->timer) ?
2882                     time_after(p->timer.expires, now + max_delay) :
2883                     try_to_del_timer_sync(&p->timer) >= 0 &&
2884                     (br->multicast_mld_version == 1 ||
2885                      p->filter_mode == MCAST_EXCLUDE))
2886                         mod_timer(&p->timer, now + max_delay);
2887         }
2888
2889 out:
2890         spin_unlock(&br->multicast_lock);
2891         return err;
2892 }
2893 #endif
2894
2895 static void
2896 br_multicast_leave_group(struct net_bridge *br,
2897                          struct net_bridge_port *port,
2898                          struct br_ip *group,
2899                          struct bridge_mcast_other_query *other_query,
2900                          struct bridge_mcast_own_query *own_query,
2901                          const unsigned char *src)
2902 {
2903         struct net_bridge_mdb_entry *mp;
2904         struct net_bridge_port_group *p;
2905         unsigned long now;
2906         unsigned long time;
2907
2908         spin_lock(&br->multicast_lock);
2909         if (!netif_running(br->dev) ||
2910             (port && port->state == BR_STATE_DISABLED))
2911                 goto out;
2912
2913         mp = br_mdb_ip_get(br, group);
2914         if (!mp)
2915                 goto out;
2916
2917         if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
2918                 struct net_bridge_port_group __rcu **pp;
2919
2920                 for (pp = &mp->ports;
2921                      (p = mlock_dereference(*pp, br)) != NULL;
2922                      pp = &p->next) {
2923                         if (!br_port_group_equal(p, port, src))
2924                                 continue;
2925
2926                         if (p->flags & MDB_PG_FLAGS_PERMANENT)
2927                                 break;
2928
2929                         p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2930                         br_multicast_del_pg(mp, p, pp);
2931                 }
2932                 goto out;
2933         }
2934
2935         if (timer_pending(&other_query->timer))
2936                 goto out;
2937
2938         if (br_opt_get(br, BROPT_MULTICAST_QUERIER)) {
2939                 __br_multicast_send_query(br, port, NULL, NULL, &mp->addr,
2940                                           false, 0, NULL);
2941
2942                 time = jiffies + br->multicast_last_member_count *
2943                                  br->multicast_last_member_interval;
2944
2945                 mod_timer(&own_query->timer, time);
2946
2947                 for (p = mlock_dereference(mp->ports, br);
2948                      p != NULL;
2949                      p = mlock_dereference(p->next, br)) {
2950                         if (!br_port_group_equal(p, port, src))
2951                                 continue;
2952
2953                         if (!hlist_unhashed(&p->mglist) &&
2954                             (timer_pending(&p->timer) ?
2955                              time_after(p->timer.expires, time) :
2956                              try_to_del_timer_sync(&p->timer) >= 0)) {
2957                                 mod_timer(&p->timer, time);
2958                         }
2959
2960                         break;
2961                 }
2962         }
2963
2964         now = jiffies;
2965         time = now + br->multicast_last_member_count *
2966                      br->multicast_last_member_interval;
2967
2968         if (!port) {
2969                 if (mp->host_joined &&
2970                     (timer_pending(&mp->timer) ?
2971                      time_after(mp->timer.expires, time) :
2972                      try_to_del_timer_sync(&mp->timer) >= 0)) {
2973                         mod_timer(&mp->timer, time);
2974                 }
2975
2976                 goto out;
2977         }
2978
2979         for (p = mlock_dereference(mp->ports, br);
2980              p != NULL;
2981              p = mlock_dereference(p->next, br)) {
2982                 if (p->key.port != port)
2983                         continue;
2984
2985                 if (!hlist_unhashed(&p->mglist) &&
2986                     (timer_pending(&p->timer) ?
2987                      time_after(p->timer.expires, time) :
2988                      try_to_del_timer_sync(&p->timer) >= 0)) {
2989                         mod_timer(&p->timer, time);
2990                 }
2991
2992                 break;
2993         }
2994 out:
2995         spin_unlock(&br->multicast_lock);
2996 }
2997
2998 static void br_ip4_multicast_leave_group(struct net_bridge *br,
2999                                          struct net_bridge_port *port,
3000                                          __be32 group,
3001                                          __u16 vid,
3002                                          const unsigned char *src)
3003 {
3004         struct br_ip br_group;
3005         struct bridge_mcast_own_query *own_query;
3006
3007         if (ipv4_is_local_multicast(group))
3008                 return;
3009
3010         own_query = port ? &port->ip4_own_query : &br->ip4_own_query;
3011
3012         memset(&br_group, 0, sizeof(br_group));
3013         br_group.dst.ip4 = group;
3014         br_group.proto = htons(ETH_P_IP);
3015         br_group.vid = vid;
3016
3017         br_multicast_leave_group(br, port, &br_group, &br->ip4_other_query,
3018                                  own_query, src);
3019 }
3020
3021 #if IS_ENABLED(CONFIG_IPV6)
3022 static void br_ip6_multicast_leave_group(struct net_bridge *br,
3023                                          struct net_bridge_port *port,
3024                                          const struct in6_addr *group,
3025                                          __u16 vid,
3026                                          const unsigned char *src)
3027 {
3028         struct br_ip br_group;
3029         struct bridge_mcast_own_query *own_query;
3030
3031         if (ipv6_addr_is_ll_all_nodes(group))
3032                 return;
3033
3034         own_query = port ? &port->ip6_own_query : &br->ip6_own_query;
3035
3036         memset(&br_group, 0, sizeof(br_group));
3037         br_group.dst.ip6 = *group;
3038         br_group.proto = htons(ETH_P_IPV6);
3039         br_group.vid = vid;
3040
3041         br_multicast_leave_group(br, port, &br_group, &br->ip6_other_query,
3042                                  own_query, src);
3043 }
3044 #endif
3045
3046 static void br_multicast_err_count(const struct net_bridge *br,
3047                                    const struct net_bridge_port *p,
3048                                    __be16 proto)
3049 {
3050         struct bridge_mcast_stats __percpu *stats;
3051         struct bridge_mcast_stats *pstats;
3052
3053         if (!br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
3054                 return;
3055
3056         if (p)
3057                 stats = p->mcast_stats;
3058         else
3059                 stats = br->mcast_stats;
3060         if (WARN_ON(!stats))
3061                 return;
3062
3063         pstats = this_cpu_ptr(stats);
3064
3065         u64_stats_update_begin(&pstats->syncp);
3066         switch (proto) {
3067         case htons(ETH_P_IP):
3068                 pstats->mstats.igmp_parse_errors++;
3069                 break;
3070 #if IS_ENABLED(CONFIG_IPV6)
3071         case htons(ETH_P_IPV6):
3072                 pstats->mstats.mld_parse_errors++;
3073                 break;
3074 #endif
3075         }
3076         u64_stats_update_end(&pstats->syncp);
3077 }
3078
3079 static void br_multicast_pim(struct net_bridge *br,
3080                              struct net_bridge_port *port,
3081                              const struct sk_buff *skb)
3082 {
3083         unsigned int offset = skb_transport_offset(skb);
3084         struct pimhdr *pimhdr, _pimhdr;
3085
3086         pimhdr = skb_header_pointer(skb, offset, sizeof(_pimhdr), &_pimhdr);
3087         if (!pimhdr || pim_hdr_version(pimhdr) != PIM_VERSION ||
3088             pim_hdr_type(pimhdr) != PIM_TYPE_HELLO)
3089                 return;
3090
3091         br_multicast_mark_router(br, port);
3092 }
3093
3094 static int br_ip4_multicast_mrd_rcv(struct net_bridge *br,
3095                                     struct net_bridge_port *port,
3096                                     struct sk_buff *skb)
3097 {
3098         if (ip_hdr(skb)->protocol != IPPROTO_IGMP ||
3099             igmp_hdr(skb)->type != IGMP_MRDISC_ADV)
3100                 return -ENOMSG;
3101
3102         br_multicast_mark_router(br, port);
3103
3104         return 0;
3105 }
3106
3107 static int br_multicast_ipv4_rcv(struct net_bridge *br,
3108                                  struct net_bridge_port *port,
3109                                  struct sk_buff *skb,
3110                                  u16 vid)
3111 {
3112         const unsigned char *src;
3113         struct igmphdr *ih;
3114         int err;
3115
3116         err = ip_mc_check_igmp(skb);
3117
3118         if (err == -ENOMSG) {
3119                 if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
3120                         BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3121                 } else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
3122                         if (ip_hdr(skb)->protocol == IPPROTO_PIM)
3123                                 br_multicast_pim(br, port, skb);
3124                 } else if (ipv4_is_all_snoopers(ip_hdr(skb)->daddr)) {
3125                         br_ip4_multicast_mrd_rcv(br, port, skb);
3126                 }
3127
3128                 return 0;
3129         } else if (err < 0) {
3130                 br_multicast_err_count(br, port, skb->protocol);
3131                 return err;
3132         }
3133
3134         ih = igmp_hdr(skb);
3135         src = eth_hdr(skb)->h_source;
3136         BR_INPUT_SKB_CB(skb)->igmp = ih->type;
3137
3138         switch (ih->type) {
3139         case IGMP_HOST_MEMBERSHIP_REPORT:
3140         case IGMPV2_HOST_MEMBERSHIP_REPORT:
3141                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3142                 err = br_ip4_multicast_add_group(br, port, ih->group, vid, src,
3143                                                  true);
3144                 break;
3145         case IGMPV3_HOST_MEMBERSHIP_REPORT:
3146                 err = br_ip4_multicast_igmp3_report(br, port, skb, vid);
3147                 break;
3148         case IGMP_HOST_MEMBERSHIP_QUERY:
3149                 br_ip4_multicast_query(br, port, skb, vid);
3150                 break;
3151         case IGMP_HOST_LEAVE_MESSAGE:
3152                 br_ip4_multicast_leave_group(br, port, ih->group, vid, src);
3153                 break;
3154         }
3155
3156         br_multicast_count(br, port, skb, BR_INPUT_SKB_CB(skb)->igmp,
3157                            BR_MCAST_DIR_RX);
3158
3159         return err;
3160 }
3161
3162 #if IS_ENABLED(CONFIG_IPV6)
3163 static void br_ip6_multicast_mrd_rcv(struct net_bridge *br,
3164                                      struct net_bridge_port *port,
3165                                      struct sk_buff *skb)
3166 {
3167         if (icmp6_hdr(skb)->icmp6_type != ICMPV6_MRDISC_ADV)
3168                 return;
3169
3170         br_multicast_mark_router(br, port);
3171 }
3172
3173 static int br_multicast_ipv6_rcv(struct net_bridge *br,
3174                                  struct net_bridge_port *port,
3175                                  struct sk_buff *skb,
3176                                  u16 vid)
3177 {
3178         const unsigned char *src;
3179         struct mld_msg *mld;
3180         int err;
3181
3182         err = ipv6_mc_check_mld(skb);
3183
3184         if (err == -ENOMSG || err == -ENODATA) {
3185                 if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
3186                         BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3187                 if (err == -ENODATA &&
3188                     ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
3189                         br_ip6_multicast_mrd_rcv(br, port, skb);
3190
3191                 return 0;
3192         } else if (err < 0) {
3193                 br_multicast_err_count(br, port, skb->protocol);
3194                 return err;
3195         }
3196
3197         mld = (struct mld_msg *)skb_transport_header(skb);
3198         BR_INPUT_SKB_CB(skb)->igmp = mld->mld_type;
3199
3200         switch (mld->mld_type) {
3201         case ICMPV6_MGM_REPORT:
3202                 src = eth_hdr(skb)->h_source;
3203                 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3204                 err = br_ip6_multicast_add_group(br, port, &mld->mld_mca, vid,
3205                                                  src, true);
3206                 break;
3207         case ICMPV6_MLD2_REPORT:
3208                 err = br_ip6_multicast_mld2_report(br, port, skb, vid);
3209                 break;
3210         case ICMPV6_MGM_QUERY:
3211                 err = br_ip6_multicast_query(br, port, skb, vid);
3212                 break;
3213         case ICMPV6_MGM_REDUCTION:
3214                 src = eth_hdr(skb)->h_source;
3215                 br_ip6_multicast_leave_group(br, port, &mld->mld_mca, vid, src);
3216                 break;
3217         }
3218
3219         br_multicast_count(br, port, skb, BR_INPUT_SKB_CB(skb)->igmp,
3220                            BR_MCAST_DIR_RX);
3221
3222         return err;
3223 }
3224 #endif
3225
3226 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
3227                      struct sk_buff *skb, u16 vid)
3228 {
3229         int ret = 0;
3230
3231         BR_INPUT_SKB_CB(skb)->igmp = 0;
3232         BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
3233
3234         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
3235                 return 0;
3236
3237         switch (skb->protocol) {
3238         case htons(ETH_P_IP):
3239                 ret = br_multicast_ipv4_rcv(br, port, skb, vid);
3240                 break;
3241 #if IS_ENABLED(CONFIG_IPV6)
3242         case htons(ETH_P_IPV6):
3243                 ret = br_multicast_ipv6_rcv(br, port, skb, vid);
3244                 break;
3245 #endif
3246         }
3247
3248         return ret;
3249 }
3250
3251 static void br_multicast_query_expired(struct net_bridge *br,
3252                                        struct bridge_mcast_own_query *query,
3253                                        struct bridge_mcast_querier *querier)
3254 {
3255         spin_lock(&br->multicast_lock);
3256         if (query->startup_sent < br->multicast_startup_query_count)
3257                 query->startup_sent++;
3258
3259         RCU_INIT_POINTER(querier->port, NULL);
3260         br_multicast_send_query(br, NULL, query);
3261         spin_unlock(&br->multicast_lock);
3262 }
3263
3264 static void br_ip4_multicast_query_expired(struct timer_list *t)
3265 {
3266         struct net_bridge *br = from_timer(br, t, ip4_own_query.timer);
3267
3268         br_multicast_query_expired(br, &br->ip4_own_query, &br->ip4_querier);
3269 }
3270
3271 #if IS_ENABLED(CONFIG_IPV6)
3272 static void br_ip6_multicast_query_expired(struct timer_list *t)
3273 {
3274         struct net_bridge *br = from_timer(br, t, ip6_own_query.timer);
3275
3276         br_multicast_query_expired(br, &br->ip6_own_query, &br->ip6_querier);
3277 }
3278 #endif
3279
3280 static void br_multicast_gc_work(struct work_struct *work)
3281 {
3282         struct net_bridge *br = container_of(work, struct net_bridge,
3283                                              mcast_gc_work);
3284         HLIST_HEAD(deleted_head);
3285
3286         spin_lock_bh(&br->multicast_lock);
3287         hlist_move_list(&br->mcast_gc_list, &deleted_head);
3288         spin_unlock_bh(&br->multicast_lock);
3289
3290         br_multicast_gc(&deleted_head);
3291 }
3292
3293 void br_multicast_init(struct net_bridge *br)
3294 {
3295         br->hash_max = BR_MULTICAST_DEFAULT_HASH_MAX;
3296
3297         br->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3298         br->multicast_last_member_count = 2;
3299         br->multicast_startup_query_count = 2;
3300
3301         br->multicast_last_member_interval = HZ;
3302         br->multicast_query_response_interval = 10 * HZ;
3303         br->multicast_startup_query_interval = 125 * HZ / 4;
3304         br->multicast_query_interval = 125 * HZ;
3305         br->multicast_querier_interval = 255 * HZ;
3306         br->multicast_membership_interval = 260 * HZ;
3307
3308         br->ip4_other_query.delay_time = 0;
3309         br->ip4_querier.port = NULL;
3310         br->multicast_igmp_version = 2;
3311 #if IS_ENABLED(CONFIG_IPV6)
3312         br->multicast_mld_version = 1;
3313         br->ip6_other_query.delay_time = 0;
3314         br->ip6_querier.port = NULL;
3315 #endif
3316         br_opt_toggle(br, BROPT_MULTICAST_ENABLED, true);
3317         br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
3318
3319         spin_lock_init(&br->multicast_lock);
3320         timer_setup(&br->ip4_mc_router_timer,
3321                     br_multicast_local_router_expired, 0);
3322         timer_setup(&br->ip4_other_query.timer,
3323                     br_ip4_multicast_querier_expired, 0);
3324         timer_setup(&br->ip4_own_query.timer,
3325                     br_ip4_multicast_query_expired, 0);
3326 #if IS_ENABLED(CONFIG_IPV6)
3327         timer_setup(&br->ip6_other_query.timer,
3328                     br_ip6_multicast_querier_expired, 0);
3329         timer_setup(&br->ip6_own_query.timer,
3330                     br_ip6_multicast_query_expired, 0);
3331 #endif
3332         INIT_HLIST_HEAD(&br->mdb_list);
3333         INIT_HLIST_HEAD(&br->mcast_gc_list);
3334         INIT_WORK(&br->mcast_gc_work, br_multicast_gc_work);
3335 }
3336
3337 static void br_ip4_multicast_join_snoopers(struct net_bridge *br)
3338 {
3339         struct in_device *in_dev = in_dev_get(br->dev);
3340
3341         if (!in_dev)
3342                 return;
3343
3344         __ip_mc_inc_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
3345         in_dev_put(in_dev);
3346 }
3347
3348 #if IS_ENABLED(CONFIG_IPV6)
3349 static void br_ip6_multicast_join_snoopers(struct net_bridge *br)
3350 {
3351         struct in6_addr addr;
3352
3353         ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
3354         ipv6_dev_mc_inc(br->dev, &addr);
3355 }
3356 #else
3357 static inline void br_ip6_multicast_join_snoopers(struct net_bridge *br)
3358 {
3359 }
3360 #endif
3361
3362 void br_multicast_join_snoopers(struct net_bridge *br)
3363 {
3364         br_ip4_multicast_join_snoopers(br);
3365         br_ip6_multicast_join_snoopers(br);
3366 }
3367
3368 static void br_ip4_multicast_leave_snoopers(struct net_bridge *br)
3369 {
3370         struct in_device *in_dev = in_dev_get(br->dev);
3371
3372         if (WARN_ON(!in_dev))
3373                 return;
3374
3375         __ip_mc_dec_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
3376         in_dev_put(in_dev);
3377 }
3378
3379 #if IS_ENABLED(CONFIG_IPV6)
3380 static void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
3381 {
3382         struct in6_addr addr;
3383
3384         ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
3385         ipv6_dev_mc_dec(br->dev, &addr);
3386 }
3387 #else
3388 static inline void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
3389 {
3390 }
3391 #endif
3392
3393 void br_multicast_leave_snoopers(struct net_bridge *br)
3394 {
3395         br_ip4_multicast_leave_snoopers(br);
3396         br_ip6_multicast_leave_snoopers(br);
3397 }
3398
3399 static void __br_multicast_open(struct net_bridge *br,
3400                                 struct bridge_mcast_own_query *query)
3401 {
3402         query->startup_sent = 0;
3403
3404         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
3405                 return;
3406
3407         mod_timer(&query->timer, jiffies);
3408 }
3409
3410 void br_multicast_open(struct net_bridge *br)
3411 {
3412         __br_multicast_open(br, &br->ip4_own_query);
3413 #if IS_ENABLED(CONFIG_IPV6)
3414         __br_multicast_open(br, &br->ip6_own_query);
3415 #endif
3416 }
3417
3418 void br_multicast_stop(struct net_bridge *br)
3419 {
3420         del_timer_sync(&br->ip4_mc_router_timer);
3421         del_timer_sync(&br->ip4_other_query.timer);
3422         del_timer_sync(&br->ip4_own_query.timer);
3423 #if IS_ENABLED(CONFIG_IPV6)
3424         del_timer_sync(&br->ip6_other_query.timer);
3425         del_timer_sync(&br->ip6_own_query.timer);
3426 #endif
3427 }
3428
3429 void br_multicast_dev_del(struct net_bridge *br)
3430 {
3431         struct net_bridge_mdb_entry *mp;
3432         HLIST_HEAD(deleted_head);
3433         struct hlist_node *tmp;
3434
3435         spin_lock_bh(&br->multicast_lock);
3436         hlist_for_each_entry_safe(mp, tmp, &br->mdb_list, mdb_node)
3437                 br_multicast_del_mdb_entry(mp);
3438         hlist_move_list(&br->mcast_gc_list, &deleted_head);
3439         spin_unlock_bh(&br->multicast_lock);
3440
3441         br_multicast_gc(&deleted_head);
3442         cancel_work_sync(&br->mcast_gc_work);
3443
3444         rcu_barrier();
3445 }
3446
3447 int br_multicast_set_router(struct net_bridge *br, unsigned long val)
3448 {
3449         int err = -EINVAL;
3450
3451         spin_lock_bh(&br->multicast_lock);
3452
3453         switch (val) {
3454         case MDB_RTR_TYPE_DISABLED:
3455         case MDB_RTR_TYPE_PERM:
3456                 br_mc_router_state_change(br, val == MDB_RTR_TYPE_PERM);
3457                 del_timer(&br->ip4_mc_router_timer);
3458                 br->multicast_router = val;
3459                 err = 0;
3460                 break;
3461         case MDB_RTR_TYPE_TEMP_QUERY:
3462                 if (br->multicast_router != MDB_RTR_TYPE_TEMP_QUERY)
3463                         br_mc_router_state_change(br, false);
3464                 br->multicast_router = val;
3465                 err = 0;
3466                 break;
3467         }
3468
3469         spin_unlock_bh(&br->multicast_lock);
3470
3471         return err;
3472 }
3473
3474 static void __del_port_router(struct net_bridge_port *p)
3475 {
3476         if (hlist_unhashed(&p->ip4_rlist))
3477                 return;
3478         hlist_del_init_rcu(&p->ip4_rlist);
3479         br_rtr_notify(p->br->dev, p, RTM_DELMDB);
3480         br_port_mc_router_state_change(p, false);
3481
3482         /* don't allow timer refresh */
3483         if (p->multicast_router == MDB_RTR_TYPE_TEMP)
3484                 p->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3485 }
3486
3487 int br_multicast_set_port_router(struct net_bridge_port *p, unsigned long val)
3488 {
3489         struct net_bridge *br = p->br;
3490         unsigned long now = jiffies;
3491         int err = -EINVAL;
3492
3493         spin_lock(&br->multicast_lock);
3494         if (p->multicast_router == val) {
3495                 /* Refresh the temp router port timer */
3496                 if (p->multicast_router == MDB_RTR_TYPE_TEMP)
3497                         mod_timer(&p->ip4_mc_router_timer,
3498                                   now + br->multicast_querier_interval);
3499                 err = 0;
3500                 goto unlock;
3501         }
3502         switch (val) {
3503         case MDB_RTR_TYPE_DISABLED:
3504                 p->multicast_router = MDB_RTR_TYPE_DISABLED;
3505                 __del_port_router(p);
3506                 del_timer(&p->ip4_mc_router_timer);
3507                 break;
3508         case MDB_RTR_TYPE_TEMP_QUERY:
3509                 p->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
3510                 __del_port_router(p);
3511                 break;
3512         case MDB_RTR_TYPE_PERM:
3513                 p->multicast_router = MDB_RTR_TYPE_PERM;
3514                 del_timer(&p->ip4_mc_router_timer);
3515                 br_multicast_add_router(br, p);
3516                 break;
3517         case MDB_RTR_TYPE_TEMP:
3518                 p->multicast_router = MDB_RTR_TYPE_TEMP;
3519                 br_multicast_mark_router(br, p);
3520                 break;
3521         default:
3522                 goto unlock;
3523         }
3524         err = 0;
3525 unlock:
3526         spin_unlock(&br->multicast_lock);
3527
3528         return err;
3529 }
3530
3531 static void br_multicast_start_querier(struct net_bridge *br,
3532                                        struct bridge_mcast_own_query *query)
3533 {
3534         struct net_bridge_port *port;
3535
3536         __br_multicast_open(br, query);
3537
3538         rcu_read_lock();
3539         list_for_each_entry_rcu(port, &br->port_list, list) {
3540                 if (port->state == BR_STATE_DISABLED ||
3541                     port->state == BR_STATE_BLOCKING)
3542                         continue;
3543
3544                 if (query == &br->ip4_own_query)
3545                         br_multicast_enable(&port->ip4_own_query);
3546 #if IS_ENABLED(CONFIG_IPV6)
3547                 else
3548                         br_multicast_enable(&port->ip6_own_query);
3549 #endif
3550         }
3551         rcu_read_unlock();
3552 }
3553
3554 int br_multicast_toggle(struct net_bridge *br, unsigned long val,
3555                         struct netlink_ext_ack *extack)
3556 {
3557         struct net_bridge_port *port;
3558         bool change_snoopers = false;
3559         int err = 0;
3560
3561         spin_lock_bh(&br->multicast_lock);
3562         if (!!br_opt_get(br, BROPT_MULTICAST_ENABLED) == !!val)
3563                 goto unlock;
3564
3565         err = br_mc_disabled_update(br->dev, val, extack);
3566         if (err == -EOPNOTSUPP)
3567                 err = 0;
3568         if (err)
3569                 goto unlock;
3570
3571         br_opt_toggle(br, BROPT_MULTICAST_ENABLED, !!val);
3572         if (!br_opt_get(br, BROPT_MULTICAST_ENABLED)) {
3573                 change_snoopers = true;
3574                 goto unlock;
3575         }
3576
3577         if (!netif_running(br->dev))
3578                 goto unlock;
3579
3580         br_multicast_open(br);
3581         list_for_each_entry(port, &br->port_list, list)
3582                 __br_multicast_enable_port(port);
3583
3584         change_snoopers = true;
3585
3586 unlock:
3587         spin_unlock_bh(&br->multicast_lock);
3588
3589         /* br_multicast_join_snoopers has the potential to cause
3590          * an MLD Report/Leave to be delivered to br_multicast_rcv,
3591          * which would in turn call br_multicast_add_group, which would
3592          * attempt to acquire multicast_lock. This function should be
3593          * called after the lock has been released to avoid deadlocks on
3594          * multicast_lock.
3595          *
3596          * br_multicast_leave_snoopers does not have the problem since
3597          * br_multicast_rcv first checks BROPT_MULTICAST_ENABLED, and
3598          * returns without calling br_multicast_ipv4/6_rcv if it's not
3599          * enabled. Moved both functions out just for symmetry.
3600          */
3601         if (change_snoopers) {
3602                 if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
3603                         br_multicast_join_snoopers(br);
3604                 else
3605                         br_multicast_leave_snoopers(br);
3606         }
3607
3608         return err;
3609 }
3610
3611 bool br_multicast_enabled(const struct net_device *dev)
3612 {
3613         struct net_bridge *br = netdev_priv(dev);
3614
3615         return !!br_opt_get(br, BROPT_MULTICAST_ENABLED);
3616 }
3617 EXPORT_SYMBOL_GPL(br_multicast_enabled);
3618
3619 bool br_multicast_router(const struct net_device *dev)
3620 {
3621         struct net_bridge *br = netdev_priv(dev);
3622         bool is_router;
3623
3624         spin_lock_bh(&br->multicast_lock);
3625         is_router = br_multicast_is_router(br);
3626         spin_unlock_bh(&br->multicast_lock);
3627         return is_router;
3628 }
3629 EXPORT_SYMBOL_GPL(br_multicast_router);
3630
3631 int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
3632 {
3633         unsigned long max_delay;
3634
3635         val = !!val;
3636
3637         spin_lock_bh(&br->multicast_lock);
3638         if (br_opt_get(br, BROPT_MULTICAST_QUERIER) == val)
3639                 goto unlock;
3640
3641         br_opt_toggle(br, BROPT_MULTICAST_QUERIER, !!val);
3642         if (!val)
3643                 goto unlock;
3644
3645         max_delay = br->multicast_query_response_interval;
3646
3647         if (!timer_pending(&br->ip4_other_query.timer))
3648                 br->ip4_other_query.delay_time = jiffies + max_delay;
3649
3650         br_multicast_start_querier(br, &br->ip4_own_query);
3651
3652 #if IS_ENABLED(CONFIG_IPV6)
3653         if (!timer_pending(&br->ip6_other_query.timer))
3654                 br->ip6_other_query.delay_time = jiffies + max_delay;
3655
3656         br_multicast_start_querier(br, &br->ip6_own_query);
3657 #endif
3658
3659 unlock:
3660         spin_unlock_bh(&br->multicast_lock);
3661
3662         return 0;
3663 }
3664
3665 int br_multicast_set_igmp_version(struct net_bridge *br, unsigned long val)
3666 {
3667         /* Currently we support only version 2 and 3 */
3668         switch (val) {
3669         case 2:
3670         case 3:
3671                 break;
3672         default:
3673                 return -EINVAL;
3674         }
3675
3676         spin_lock_bh(&br->multicast_lock);
3677         br->multicast_igmp_version = val;
3678         spin_unlock_bh(&br->multicast_lock);
3679
3680         return 0;
3681 }
3682
3683 #if IS_ENABLED(CONFIG_IPV6)
3684 int br_multicast_set_mld_version(struct net_bridge *br, unsigned long val)
3685 {
3686         /* Currently we support version 1 and 2 */
3687         switch (val) {
3688         case 1:
3689         case 2:
3690                 break;
3691         default:
3692                 return -EINVAL;
3693         }
3694
3695         spin_lock_bh(&br->multicast_lock);
3696         br->multicast_mld_version = val;
3697         spin_unlock_bh(&br->multicast_lock);
3698
3699         return 0;
3700 }
3701 #endif
3702
3703 /**
3704  * br_multicast_list_adjacent - Returns snooped multicast addresses
3705  * @dev:        The bridge port adjacent to which to retrieve addresses
3706  * @br_ip_list: The list to store found, snooped multicast IP addresses in
3707  *
3708  * Creates a list of IP addresses (struct br_ip_list) sensed by the multicast
3709  * snooping feature on all bridge ports of dev's bridge device, excluding
3710  * the addresses from dev itself.
3711  *
3712  * Returns the number of items added to br_ip_list.
3713  *
3714  * Notes:
3715  * - br_ip_list needs to be initialized by caller
3716  * - br_ip_list might contain duplicates in the end
3717  *   (needs to be taken care of by caller)
3718  * - br_ip_list needs to be freed by caller
3719  */
3720 int br_multicast_list_adjacent(struct net_device *dev,
3721                                struct list_head *br_ip_list)
3722 {
3723         struct net_bridge *br;
3724         struct net_bridge_port *port;
3725         struct net_bridge_port_group *group;
3726         struct br_ip_list *entry;
3727         int count = 0;
3728
3729         rcu_read_lock();
3730         if (!br_ip_list || !netif_is_bridge_port(dev))
3731                 goto unlock;
3732
3733         port = br_port_get_rcu(dev);
3734         if (!port || !port->br)
3735                 goto unlock;
3736
3737         br = port->br;
3738
3739         list_for_each_entry_rcu(port, &br->port_list, list) {
3740                 if (!port->dev || port->dev == dev)
3741                         continue;
3742
3743                 hlist_for_each_entry_rcu(group, &port->mglist, mglist) {
3744                         entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
3745                         if (!entry)
3746                                 goto unlock;
3747
3748                         entry->addr = group->key.addr;
3749                         list_add(&entry->list, br_ip_list);
3750                         count++;
3751                 }
3752         }
3753
3754 unlock:
3755         rcu_read_unlock();
3756         return count;
3757 }
3758 EXPORT_SYMBOL_GPL(br_multicast_list_adjacent);
3759
3760 /**
3761  * br_multicast_has_querier_anywhere - Checks for a querier on a bridge
3762  * @dev: The bridge port providing the bridge on which to check for a querier
3763  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
3764  *
3765  * Checks whether the given interface has a bridge on top and if so returns
3766  * true if a valid querier exists anywhere on the bridged link layer.
3767  * Otherwise returns false.
3768  */
3769 bool br_multicast_has_querier_anywhere(struct net_device *dev, int proto)
3770 {
3771         struct net_bridge *br;
3772         struct net_bridge_port *port;
3773         struct ethhdr eth;
3774         bool ret = false;
3775
3776         rcu_read_lock();
3777         if (!netif_is_bridge_port(dev))
3778                 goto unlock;
3779
3780         port = br_port_get_rcu(dev);
3781         if (!port || !port->br)
3782                 goto unlock;
3783
3784         br = port->br;
3785
3786         memset(&eth, 0, sizeof(eth));
3787         eth.h_proto = htons(proto);
3788
3789         ret = br_multicast_querier_exists(br, &eth, NULL);
3790
3791 unlock:
3792         rcu_read_unlock();
3793         return ret;
3794 }
3795 EXPORT_SYMBOL_GPL(br_multicast_has_querier_anywhere);
3796
3797 /**
3798  * br_multicast_has_querier_adjacent - Checks for a querier behind a bridge port
3799  * @dev: The bridge port adjacent to which to check for a querier
3800  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
3801  *
3802  * Checks whether the given interface has a bridge on top and if so returns
3803  * true if a selected querier is behind one of the other ports of this
3804  * bridge. Otherwise returns false.
3805  */
3806 bool br_multicast_has_querier_adjacent(struct net_device *dev, int proto)
3807 {
3808         struct net_bridge *br;
3809         struct net_bridge_port *port;
3810         bool ret = false;
3811
3812         rcu_read_lock();
3813         if (!netif_is_bridge_port(dev))
3814                 goto unlock;
3815
3816         port = br_port_get_rcu(dev);
3817         if (!port || !port->br)
3818                 goto unlock;
3819
3820         br = port->br;
3821
3822         switch (proto) {
3823         case ETH_P_IP:
3824                 if (!timer_pending(&br->ip4_other_query.timer) ||
3825                     rcu_dereference(br->ip4_querier.port) == port)
3826                         goto unlock;
3827                 break;
3828 #if IS_ENABLED(CONFIG_IPV6)
3829         case ETH_P_IPV6:
3830                 if (!timer_pending(&br->ip6_other_query.timer) ||
3831                     rcu_dereference(br->ip6_querier.port) == port)
3832                         goto unlock;
3833                 break;
3834 #endif
3835         default:
3836                 goto unlock;
3837         }
3838
3839         ret = true;
3840 unlock:
3841         rcu_read_unlock();
3842         return ret;
3843 }
3844 EXPORT_SYMBOL_GPL(br_multicast_has_querier_adjacent);
3845
3846 static void br_mcast_stats_add(struct bridge_mcast_stats __percpu *stats,
3847                                const struct sk_buff *skb, u8 type, u8 dir)
3848 {
3849         struct bridge_mcast_stats *pstats = this_cpu_ptr(stats);
3850         __be16 proto = skb->protocol;
3851         unsigned int t_len;
3852
3853         u64_stats_update_begin(&pstats->syncp);
3854         switch (proto) {
3855         case htons(ETH_P_IP):
3856                 t_len = ntohs(ip_hdr(skb)->tot_len) - ip_hdrlen(skb);
3857                 switch (type) {
3858                 case IGMP_HOST_MEMBERSHIP_REPORT:
3859                         pstats->mstats.igmp_v1reports[dir]++;
3860                         break;
3861                 case IGMPV2_HOST_MEMBERSHIP_REPORT:
3862                         pstats->mstats.igmp_v2reports[dir]++;
3863                         break;
3864                 case IGMPV3_HOST_MEMBERSHIP_REPORT:
3865                         pstats->mstats.igmp_v3reports[dir]++;
3866                         break;
3867                 case IGMP_HOST_MEMBERSHIP_QUERY:
3868                         if (t_len != sizeof(struct igmphdr)) {
3869                                 pstats->mstats.igmp_v3queries[dir]++;
3870                         } else {
3871                                 unsigned int offset = skb_transport_offset(skb);
3872                                 struct igmphdr *ih, _ihdr;
3873
3874                                 ih = skb_header_pointer(skb, offset,
3875                                                         sizeof(_ihdr), &_ihdr);
3876                                 if (!ih)
3877                                         break;
3878                                 if (!ih->code)
3879                                         pstats->mstats.igmp_v1queries[dir]++;
3880                                 else
3881                                         pstats->mstats.igmp_v2queries[dir]++;
3882                         }
3883                         break;
3884                 case IGMP_HOST_LEAVE_MESSAGE:
3885                         pstats->mstats.igmp_leaves[dir]++;
3886                         break;
3887                 }
3888                 break;
3889 #if IS_ENABLED(CONFIG_IPV6)
3890         case htons(ETH_P_IPV6):
3891                 t_len = ntohs(ipv6_hdr(skb)->payload_len) +
3892                         sizeof(struct ipv6hdr);
3893                 t_len -= skb_network_header_len(skb);
3894                 switch (type) {
3895                 case ICMPV6_MGM_REPORT:
3896                         pstats->mstats.mld_v1reports[dir]++;
3897                         break;
3898                 case ICMPV6_MLD2_REPORT:
3899                         pstats->mstats.mld_v2reports[dir]++;
3900                         break;
3901                 case ICMPV6_MGM_QUERY:
3902                         if (t_len != sizeof(struct mld_msg))
3903                                 pstats->mstats.mld_v2queries[dir]++;
3904                         else
3905                                 pstats->mstats.mld_v1queries[dir]++;
3906                         break;
3907                 case ICMPV6_MGM_REDUCTION:
3908                         pstats->mstats.mld_leaves[dir]++;
3909                         break;
3910                 }
3911                 break;
3912 #endif /* CONFIG_IPV6 */
3913         }
3914         u64_stats_update_end(&pstats->syncp);
3915 }
3916
3917 void br_multicast_count(struct net_bridge *br, const struct net_bridge_port *p,
3918                         const struct sk_buff *skb, u8 type, u8 dir)
3919 {
3920         struct bridge_mcast_stats __percpu *stats;
3921
3922         /* if multicast_disabled is true then igmp type can't be set */
3923         if (!type || !br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
3924                 return;
3925
3926         if (p)
3927                 stats = p->mcast_stats;
3928         else
3929                 stats = br->mcast_stats;
3930         if (WARN_ON(!stats))
3931                 return;
3932
3933         br_mcast_stats_add(stats, skb, type, dir);
3934 }
3935
3936 int br_multicast_init_stats(struct net_bridge *br)
3937 {
3938         br->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
3939         if (!br->mcast_stats)
3940                 return -ENOMEM;
3941
3942         return 0;
3943 }
3944
3945 void br_multicast_uninit_stats(struct net_bridge *br)
3946 {
3947         free_percpu(br->mcast_stats);
3948 }
3949
3950 /* noinline for https://bugs.llvm.org/show_bug.cgi?id=45802#c9 */
3951 static noinline_for_stack void mcast_stats_add_dir(u64 *dst, u64 *src)
3952 {
3953         dst[BR_MCAST_DIR_RX] += src[BR_MCAST_DIR_RX];
3954         dst[BR_MCAST_DIR_TX] += src[BR_MCAST_DIR_TX];
3955 }
3956
3957 void br_multicast_get_stats(const struct net_bridge *br,
3958                             const struct net_bridge_port *p,
3959                             struct br_mcast_stats *dest)
3960 {
3961         struct bridge_mcast_stats __percpu *stats;
3962         struct br_mcast_stats tdst;
3963         int i;
3964
3965         memset(dest, 0, sizeof(*dest));
3966         if (p)
3967                 stats = p->mcast_stats;
3968         else
3969                 stats = br->mcast_stats;
3970         if (WARN_ON(!stats))
3971                 return;
3972
3973         memset(&tdst, 0, sizeof(tdst));
3974         for_each_possible_cpu(i) {
3975                 struct bridge_mcast_stats *cpu_stats = per_cpu_ptr(stats, i);
3976                 struct br_mcast_stats temp;
3977                 unsigned int start;
3978
3979                 do {
3980                         start = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
3981                         memcpy(&temp, &cpu_stats->mstats, sizeof(temp));
3982                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, start));
3983
3984                 mcast_stats_add_dir(tdst.igmp_v1queries, temp.igmp_v1queries);
3985                 mcast_stats_add_dir(tdst.igmp_v2queries, temp.igmp_v2queries);
3986                 mcast_stats_add_dir(tdst.igmp_v3queries, temp.igmp_v3queries);
3987                 mcast_stats_add_dir(tdst.igmp_leaves, temp.igmp_leaves);
3988                 mcast_stats_add_dir(tdst.igmp_v1reports, temp.igmp_v1reports);
3989                 mcast_stats_add_dir(tdst.igmp_v2reports, temp.igmp_v2reports);
3990                 mcast_stats_add_dir(tdst.igmp_v3reports, temp.igmp_v3reports);
3991                 tdst.igmp_parse_errors += temp.igmp_parse_errors;
3992
3993                 mcast_stats_add_dir(tdst.mld_v1queries, temp.mld_v1queries);
3994                 mcast_stats_add_dir(tdst.mld_v2queries, temp.mld_v2queries);
3995                 mcast_stats_add_dir(tdst.mld_leaves, temp.mld_leaves);
3996                 mcast_stats_add_dir(tdst.mld_v1reports, temp.mld_v1reports);
3997                 mcast_stats_add_dir(tdst.mld_v2reports, temp.mld_v2reports);
3998                 tdst.mld_parse_errors += temp.mld_parse_errors;
3999         }
4000         memcpy(dest, &tdst, sizeof(*dest));
4001 }
4002
4003 int br_mdb_hash_init(struct net_bridge *br)
4004 {
4005         int err;
4006
4007         err = rhashtable_init(&br->sg_port_tbl, &br_sg_port_rht_params);
4008         if (err)
4009                 return err;
4010
4011         err = rhashtable_init(&br->mdb_hash_tbl, &br_mdb_rht_params);
4012         if (err) {
4013                 rhashtable_destroy(&br->sg_port_tbl);
4014                 return err;
4015         }
4016
4017         return 0;
4018 }
4019
4020 void br_mdb_hash_fini(struct net_bridge *br)
4021 {
4022         rhashtable_destroy(&br->sg_port_tbl);
4023         rhashtable_destroy(&br->mdb_hash_tbl);
4024 }