9 files changed, 38 insertions, 32 deletions

diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index fe3c758791ca..9e14767500ea 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -1128,6 +1128,8 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
                         err = -ENOMEM;
                         goto err_unlock;
                 }
+                if (swdev_notify)
+                        fdb->added_by_user = 1;
                 fdb->added_by_external_learn = 1;
                 fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
         } else {
@@ -1147,6 +1149,9 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
                         modified = true;
                 }
 
+                if (swdev_notify)
+                        fdb->added_by_user = 1;
+
                 if (modified)
                         fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
         }
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 5372e2042adf..48ddc60b4fbd 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -36,10 +36,10 @@ static inline int should_deliver(const struct net_bridge_port *p,
 
 int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        skb_push(skb, ETH_HLEN);
         if (!is_skb_forwardable(skb->dev, skb))
                 goto drop;
 
-        skb_push(skb, ETH_HLEN);
         br_drop_fake_rtable(skb);
 
         if (skb->ip_summed == CHECKSUM_PARTIAL &&
@@ -65,6 +65,7 @@ EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit);
 
 int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        skb->tstamp = 0;
         return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING,
                        net, sk, skb, NULL, skb->dev,
                        br_dev_queue_push_xmit);
@@ -97,12 +98,11 @@ static void __br_forward(const struct net_bridge_port *to,
                 net = dev_net(indev);
         } else {
                 if (unlikely(netpoll_tx_running(to->br->dev))) {
-                        if (!is_skb_forwardable(skb->dev, skb)) {
+                        skb_push(skb, ETH_HLEN);
+                        if (!is_skb_forwardable(skb->dev, skb))
                                 kfree_skb(skb);
-                        } else {
-                                skb_push(skb, ETH_HLEN);
+                        else
                                 br_netpoll_send_skb(to, skb);
-                        }
                         return;
                 }
                 br_hook = NF_BR_LOCAL_OUT;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 3aeff0895669..ac92b2eb32b1 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1204,14 +1204,7 @@ static void br_multicast_query_received(struct net_bridge *br,
                 return;
 
         br_multicast_update_query_timer(br, query, max_delay);
-
-        /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules,
-         * the arrival port for IGMP Queries where the source address
-         * is 0.0.0.0 should not be added to router port list.
-         */
-        if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) ||
-            saddr->proto == htons(ETH_P_IPV6))
-                br_multicast_mark_router(br, port);
+        br_multicast_mark_router(br, port);
 }
 
 static void br_ip4_multicast_query(struct net_bridge *br,
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index d21a23698410..c93c35bb73dd 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -265,7 +265,7 @@ int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_
                 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
                 int ret;
 
-                if (neigh->hh.hh_len) {
+                if ((neigh->nud_state & NUD_CONNECTED) && neigh->hh.hh_len) {
                         neigh_hh_bridge(&neigh->hh, skb);
                         skb->dev = nf_bridge->physindev;
                         ret = br_handle_frame_finish(net, sk, skb);
diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
index 94039f588f1d..564710f88f93 100644
--- a/net/bridge/br_netfilter_ipv6.c
+++ b/net/bridge/br_netfilter_ipv6.c
@@ -131,6 +131,7 @@ int br_validate_ipv6(struct net *net, struct sk_buff *skb)
                                         IPSTATS_MIB_INDISCARDS);
                         goto drop;
                 }
+                hdr = ipv6_hdr(skb);
         }
         if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
                 goto drop;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index d240b3e7919f..eabf8bf28a3f 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -107,6 +107,7 @@ struct br_tunnel_info {
 /* private vlan flags */
 enum {
         BR_VLFLAG_PER_PORT_STATS = BIT(0),
+        BR_VLFLAG_ADDED_BY_SWITCHDEV = BIT(1),
 };
 
 /**
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 4a2f31157ef5..96abf8feb9dc 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -80,16 +80,18 @@ static bool __vlan_add_flags(struct net_bridge_vlan *v, u16 flags)
 }
 
 static int __vlan_vid_add(struct net_device *dev, struct net_bridge *br,
-                          u16 vid, u16 flags, struct netlink_ext_ack *extack)
+                          struct net_bridge_vlan *v, u16 flags,
+                          struct netlink_ext_ack *extack)
 {
         int err;
 
         /* Try switchdev op first. In case it is not supported, fallback to
          * 8021q add.
          */
-        err = br_switchdev_port_vlan_add(dev, vid, flags, extack);
+        err = br_switchdev_port_vlan_add(dev, v->vid, flags, extack);
         if (err == -EOPNOTSUPP)
-                return vlan_vid_add(dev, br->vlan_proto, vid);
+                return vlan_vid_add(dev, br->vlan_proto, v->vid);
+        v->priv_flags |= BR_VLFLAG_ADDED_BY_SWITCHDEV;
         return err;
 }
 
@@ -121,19 +123,17 @@ static void __vlan_del_list(struct net_bridge_vlan *v)
 }
 
 static int __vlan_vid_del(struct net_device *dev, struct net_bridge *br,
-                          u16 vid)
+                          const struct net_bridge_vlan *v)
 {
         int err;
 
         /* Try switchdev op first. In case it is not supported, fallback to
          * 8021q del.
          */
-        err = br_switchdev_port_vlan_del(dev, vid);
-        if (err == -EOPNOTSUPP) {
-                vlan_vid_del(dev, br->vlan_proto, vid);
-                return 0;
-        }
-        return err;
+        err = br_switchdev_port_vlan_del(dev, v->vid);
+        if (!(v->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV))
+                vlan_vid_del(dev, br->vlan_proto, v->vid);
+        return err == -EOPNOTSUPP ? 0 : err;
 }
 
 /* Returns a master vlan, if it didn't exist it gets created. In all cases a
@@ -242,7 +242,7 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags,
                  * This ensures tagged traffic enters the bridge when
                  * promiscuous mode is disabled by br_manage_promisc().
                  */
-                err = __vlan_vid_add(dev, br, v->vid, flags, extack);
+                err = __vlan_vid_add(dev, br, v, flags, extack);
                 if (err)
                         goto out;
 
@@ -305,7 +305,7 @@ out_fdb_insert:
 
 out_filt:
         if (p) {
-                __vlan_vid_del(dev, br, v->vid);
+                __vlan_vid_del(dev, br, v);
                 if (masterv) {
                         if (v->stats && masterv->stats != v->stats)
                                 free_percpu(v->stats);
@@ -338,7 +338,7 @@ static int __vlan_del(struct net_bridge_vlan *v)
 
         __vlan_delete_pvid(vg, v->vid);
         if (p) {
-                err = __vlan_vid_del(p->dev, p->br, v->vid);
+                err = __vlan_vid_del(p->dev, p->br, v);
                 if (err)
                         goto out;
         } else {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 491828713e0b..6693e209efe8 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1137,14 +1137,16 @@ static int do_replace(struct net *net, const void __user *user,
         tmp.name[sizeof(tmp.name) - 1] = 0;
 
         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
-        newinfo = vmalloc(sizeof(*newinfo) + countersize);
+        newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT,
+                            PAGE_KERNEL);
         if (!newinfo)
                 return -ENOMEM;
 
         if (countersize)
                 memset(newinfo->counters, 0, countersize);
 
-        newinfo->entries = vmalloc(tmp.entries_size);
+        newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT,
+                                     PAGE_KERNEL);
         if (!newinfo->entries) {
                 ret = -ENOMEM;
                 goto free_newinfo;
@@ -2291,9 +2293,12 @@ static int compat_do_replace(struct net *net, void __user *user,
 
         xt_compat_lock(NFPROTO_BRIDGE);
 
-        ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
-        if (ret < 0)
-                goto out_unlock;
+        if (tmp.nentries) {
+                ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
+                if (ret < 0)
+                        goto out_unlock;
+        }
+
         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
         if (ret < 0)
                 goto out_unlock;
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index 08cbed7d940e..419e8edf23ba 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -229,6 +229,7 @@ static bool reject6_br_csum_ok(struct sk_buff *skb, int hook)
             pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h)))
                 return false;
 
+        ip6h = ipv6_hdr(skb);
         thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo);
         if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0)
                 return false;