12 files changed, 140 insertions, 58 deletions

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 32b8f9f7f79e..feb77ea7b58e 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -91,7 +91,6 @@ static int br_dev_open(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        netif_carrier_off(dev);
         netdev_update_features(dev);
         netif_start_queue(dev);
         br_stp_enable_bridge(br);
@@ -108,8 +107,6 @@ static int br_dev_stop(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        netif_carrier_off(dev);
-
         br_stp_disable_bridge(br);
         br_multicast_stop(br);
 
@@ -304,7 +301,7 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_start_xmit          = br_dev_xmit,
         .ndo_get_stats64         = br_get_stats64,
         .ndo_set_mac_address     = br_set_mac_address,
-        .ndo_set_multicast_list  = br_dev_set_multicast_list,
+        .ndo_set_rx_mode         = br_dev_set_multicast_list,
         .ndo_change_mtu          = br_change_mtu,
         .ndo_do_ioctl            = br_dev_ioctl,
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -361,6 +358,8 @@ void br_dev_setup(struct net_device *dev)
         memcpy(br->group_addr, br_group_address, ETH_ALEN);
 
         br->stp_enabled = BR_NO_STP;
+        br->group_fwd_mask = BR_GROUPFWD_DEFAULT;
+
         br->designated_root = br->bridge_id;
         br->bridge_max_age = br->max_age = 20 * HZ;
         br->bridge_hello_time = br->hello_time = 2 * HZ;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 68def3b7fb49..c8e7861b88b0 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -558,19 +558,28 @@ skip:
 
 /* Create new static fdb entry */
 static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
-                         __u16 state)
+                         __u16 state, __u16 flags)
 {
         struct net_bridge *br = source->br;
         struct hlist_head *head = &br->hash[br_mac_hash(addr)];
         struct net_bridge_fdb_entry *fdb;
 
         fdb = fdb_find(head, addr);
-        if (fdb)
-                return -EEXIST;
+        if (fdb == NULL) {
+                if (!(flags & NLM_F_CREATE))
+                        return -ENOENT;
 
-        fdb = fdb_create(head, source, addr);
-        if (!fdb)
-                return -ENOMEM;
+                fdb = fdb_create(head, source, addr);
+                if (!fdb)
+                        return -ENOMEM;
+        } else {
+                if (flags & NLM_F_EXCL)
+                        return -EEXIST;
+
+                if (flags & NLM_F_REPLACE)
+                        fdb->updated = fdb->used = jiffies;
+                fdb->is_local = fdb->is_static = 0;
+        }
 
         if (state & NUD_PERMANENT)
                 fdb->is_local = fdb->is_static = 1;
@@ -626,7 +635,7 @@ int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         }
 
         spin_lock_bh(&p->br->hash_lock);
-        err = fdb_add_entry(p, addr, ndm->ndm_state);
+        err = fdb_add_entry(p, addr, ndm->ndm_state, nlh->nlmsg_flags);
         spin_unlock_bh(&p->br->hash_lock);
 
         return err;
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index e73815456adf..f603e5b0b930 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -13,6 +13,7 @@
 
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/netpoll.h>
 #include <linux/ethtool.h>
 #include <linux/if_arp.h>
@@ -33,20 +34,18 @@
  */
 static int port_cost(struct net_device *dev)
 {
-        if (dev->ethtool_ops && dev->ethtool_ops->get_settings) {
-                struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET, };
-
-                if (!dev_ethtool_get_settings(dev, &ecmd)) {
-                        switch (ethtool_cmd_speed(&ecmd)) {
-                        case SPEED_10000:
-                                return 2;
-                        case SPEED_1000:
-                                return 4;
-                        case SPEED_100:
-                                return 19;
-                        case SPEED_10:
-                                return 100;
-                        }
+        struct ethtool_cmd ecmd;
+
+        if (!__ethtool_get_settings(dev, &ecmd)) {
+                switch (ethtool_cmd_speed(&ecmd)) {
+                case SPEED_10000:
+                        return 2;
+                case SPEED_1000:
+                        return 4;
+                case SPEED_100:
+                        return 19;
+                case SPEED_10:
+                        return 100;
                 }
         }
 
@@ -161,9 +160,10 @@ static void del_nbp(struct net_bridge_port *p)
         call_rcu(&p->rcu, destroy_nbp_rcu);
 }
 
-/* called with RTNL */
-static void del_br(struct net_bridge *br, struct list_head *head)
+/* Delete bridge device */
+void br_dev_delete(struct net_device *dev, struct list_head *head)
 {
+        struct net_bridge *br = netdev_priv(dev);
         struct net_bridge_port *p, *n;
 
         list_for_each_entry_safe(p, n, &br->port_list, list) {
@@ -268,7 +268,7 @@ int br_del_bridge(struct net *net, const char *name)
         }
 
         else
-                del_br(netdev_priv(dev), NULL);
+                br_dev_delete(dev, NULL);
 
         rtnl_unlock();
         return ret;
@@ -324,7 +324,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         /* Don't allow bridging non-ethernet like devices */
         if ((dev->flags & IFF_LOOPBACK) ||
-            dev->type != ARPHRD_ETHER || dev->addr_len != ETH_ALEN)
+            dev->type != ARPHRD_ETHER || dev->addr_len != ETH_ALEN ||
+            !is_valid_ether_addr(dev->dev_addr))
                 return -EINVAL;
 
         /* No bridging of bridges */
@@ -352,10 +353,6 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         err = kobject_init_and_add(&p->kobj, &brport_ktype, &(dev->dev.kobj),
                                    SYSFS_BRIDGE_PORT_ATTR);
         if (err)
-                goto err0;
-
-        err = br_fdb_insert(br, p, dev->dev_addr);
-        if (err)
                 goto err1;
 
         err = br_sysfs_addif(p);
@@ -396,6 +393,9 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         dev_set_mtu(br->dev, br_min_mtu(br));
 
+        if (br_fdb_insert(br, p, dev->dev_addr))
+                netdev_err(dev, "failed insert local address bridge forwarding table\n");
+
         kobject_uevent(&p->kobj, KOBJ_ADD);
 
         return 0;
@@ -405,11 +405,9 @@ err4:
 err3:
         sysfs_remove_link(br->ifobj, p->dev->name);
 err2:
-        br_fdb_delete_by_port(br, p, 1);
-err1:
         kobject_put(&p->kobj);
         p = NULL; /* kobject_put frees */
-err0:
+err1:
         dev_set_promiscuity(dev, -1);
 put_back:
         dev_put(dev);
@@ -449,7 +447,7 @@ void __net_exit br_net_exit(struct net *net)
         rtnl_lock();
         for_each_netdev(net, dev)
                 if (dev->priv_flags & IFF_EBRIDGE)
-                        del_br(netdev_priv(dev), &list);
+                        br_dev_delete(dev, &list);
 
         unregister_netdevice_many(&list);
         rtnl_unlock();
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index f06ee39c73fd..5a31731be4d0 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -16,6 +16,7 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/netfilter_bridge.h>
+#include <linux/export.h>
 #include "br_private.h"
 
 /* Bridge group multicast address 802.1d (pg 51). */
@@ -162,14 +163,37 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
         p = br_port_get_rcu(skb->dev);
 
         if (unlikely(is_link_local(dest))) {
-                /* Pause frames shouldn't be passed up by driver anyway */
-                if (skb->protocol == htons(ETH_P_PAUSE))
+                /*
+                 * See IEEE 802.1D Table 7-10 Reserved addresses
+                 *
+                 * Assignment                           Value
+                 * Bridge Group Address         01-80-C2-00-00-00
+                 * (MAC Control) 802.3          01-80-C2-00-00-01
+                 * (Link Aggregation) 802.3     01-80-C2-00-00-02
+                 * 802.1X PAE address           01-80-C2-00-00-03
+                 *
+                 * 802.1AB LLDP                 01-80-C2-00-00-0E
+                 *
+                 * Others reserved for future standardization
+                 */
+                switch (dest[5]) {
+                case 0x00:      /* Bridge Group Address */
+                        /* If STP is turned off,
+                           then must forward to keep loop detection */
+                        if (p->br->stp_enabled == BR_NO_STP)
+                                goto forward;
+                        break;
+
+                case 0x01:      /* IEEE MAC (Pause) */
                         goto drop;
 
-                /* If STP is turned off, then forward */
-                if (p->br->stp_enabled == BR_NO_STP && dest[5] == 0)
-                        goto forward;
+                default:
+                        /* Allow selective forwarding for most other protocols */
+                        if (p->br->group_fwd_mask & (1u << dest[5]))
+                                goto forward;
+                }
 
+                /* Deliver packet to local host only */
                 if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
                             NULL, br_handle_local_finish)) {
                         return RX_HANDLER_CONSUMED; /* consumed by filter */
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2d85ca7111d3..a5f4e5769809 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1456,7 +1456,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 {
         struct sk_buff *skb2;
         const struct ipv6hdr *ip6h;
-        struct icmp6hdr *icmp6h;
+        u8 icmp6_type;
         u8 nexthdr;
         unsigned len;
         int offset;
@@ -1501,10 +1501,12 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 
         __skb_pull(skb2, offset);
         skb_reset_transport_header(skb2);
+        skb_postpull_rcsum(skb2, skb_network_header(skb2),
+                           skb_network_header_len(skb2));
 
-        icmp6h = icmp6_hdr(skb2);
+        icmp6_type = icmp6_hdr(skb2)->icmp6_type;
 
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
         case ICMPV6_MGM_QUERY:
         case ICMPV6_MGM_REPORT:
         case ICMPV6_MGM_REDUCTION:
@@ -1520,16 +1522,23 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                 err = pskb_trim_rcsum(skb2, len);
                 if (err)
                         goto out;
+                err = -EINVAL;
         }
 
+        ip6h = ipv6_hdr(skb2);
+
         switch (skb2->ip_summed) {
         case CHECKSUM_COMPLETE:
-                if (!csum_fold(skb2->csum))
+                if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, skb2->len,
+                                        IPPROTO_ICMPV6, skb2->csum))
                         break;
                 /*FALLTHROUGH*/
         case CHECKSUM_NONE:
-                skb2->csum = 0;
-                if (skb_checksum_complete(skb2))
+                skb2->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
+                                                        &ip6h->daddr,
+                                                        skb2->len,
+                                                        IPPROTO_ICMPV6, 0));
+                if (__skb_checksum_complete(skb2))
                         goto out;
         }
 
@@ -1537,7 +1546,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 
         BR_INPUT_SKB_CB(skb)->igmp = 1;
 
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
         case ICMPV6_MGM_REPORT:
             {
                 struct mld_msg *mld;
@@ -1763,7 +1772,7 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
         int err = 0;
         struct net_bridge_mdb_htable *mdb;
 
-        spin_lock(&br->multicast_lock);
+        spin_lock_bh(&br->multicast_lock);
         if (br->multicast_disabled == !val)
                 goto unlock;
 
@@ -1799,7 +1808,7 @@ rollback:
         }
 
 unlock:
-        spin_unlock(&br->multicast_lock);
+        spin_unlock_bh(&br->multicast_lock);
 
         return err;
 }
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 5b1ed1ba9aa7..e5f9ece3c9a0 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -210,6 +210,7 @@ static struct rtnl_link_ops br_link_ops __read_mostly = {
         .priv_size      = sizeof(struct net_bridge),
         .setup          = br_dev_setup,
         .validate       = br_validate,
+        .dellink        = br_dev_delete,
 };
 
 int __init br_netlink_init(void)
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 78cc364997d9..d7d6fb05411f 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -29,6 +29,11 @@
 
 #define BR_VERSION      "2.3"
 
+/* Control of forwarding link local multicast */
+#define BR_GROUPFWD_DEFAULT     0
+/* Don't allow forwarding control protocols like STP and LLDP */
+#define BR_GROUPFWD_RESTRICTED  0x4007u
+
 /* Path to usermode spanning tree program */
 #define BR_STP_PROG     "/sbin/bridge-stp"
 
@@ -193,6 +198,8 @@ struct net_bridge
         unsigned long                   flags;
 #define BR_SET_MAC_ADDR         0x00000001
 
+        u16                             group_fwd_mask;
+
         /* STP */
         bridge_id                       designated_root;
         bridge_id                       bridge_id;
@@ -294,6 +301,7 @@ static inline int br_is_root_bridge(const struct net_bridge *br)
 
 /* br_device.c */
 extern void br_dev_setup(struct net_device *dev);
+extern void br_dev_delete(struct net_device *dev, struct list_head *list);
 extern netdev_tx_t br_dev_xmit(struct sk_buff *skb,
                                struct net_device *dev);
 #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 10eda3cd1d71..19308e305d85 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/kmod.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
 
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 68b893ea8c3a..c236c0e43984 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -149,6 +149,39 @@ static ssize_t store_stp_state(struct device *d,
 static DEVICE_ATTR(stp_state, S_IRUGO | S_IWUSR, show_stp_state,
                    store_stp_state);
 
+static ssize_t show_group_fwd_mask(struct device *d,
+                              struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%#x\n", br->group_fwd_mask);
+}
+
+
+static ssize_t store_group_fwd_mask(struct device *d,
+                               struct device_attribute *attr, const char *buf,
+                               size_t len)
+{
+        struct net_bridge *br = to_bridge(d);
+        char *endp;
+        unsigned long val;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        val = simple_strtoul(buf, &endp, 0);
+        if (endp == buf)
+                return -EINVAL;
+
+        if (val & BR_GROUPFWD_RESTRICTED)
+                return -EINVAL;
+
+        br->group_fwd_mask = val;
+
+        return len;
+}
+static DEVICE_ATTR(group_fwd_mask, S_IRUGO | S_IWUSR, show_group_fwd_mask,
+                   store_group_fwd_mask);
+
 static ssize_t show_priority(struct device *d, struct device_attribute *attr,
                              char *buf)
 {
@@ -652,6 +685,7 @@ static struct attribute *bridge_attrs[] = {
         &dev_attr_max_age.attr,
         &dev_attr_ageing_time.attr,
         &dev_attr_stp_state.attr,
+        &dev_attr_group_fwd_mask.attr,
         &dev_attr_priority.attr,
         &dev_attr_bridge_id.attr,
         &dev_attr_root_id.attr,
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index ba6f73eb06c6..a9aff9c7d027 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -4,7 +4,7 @@
 
 menuconfig BRIDGE_NF_EBTABLES
         tristate "Ethernet Bridge tables (ebtables) support"
-        depends on BRIDGE && BRIDGE_NETFILTER
+        depends on BRIDGE && NETFILTER
         select NETFILTER_XTABLES
         help
           ebtables is a general, extensible frame/packet identification
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index bf2a333ca7c7..5449294bdd5e 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -102,16 +102,15 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
         unsigned int n;
 
         n = max(size, nlbufsiz);
-        skb = alloc_skb(n, GFP_ATOMIC);
+        skb = alloc_skb(n, GFP_ATOMIC | __GFP_NOWARN);
         if (!skb) {
-                pr_debug("cannot alloc whole buffer of size %ub!\n", n);
                 if (n > size) {
                         /* try to allocate only as much as we need for
                          * current packet */
                         skb = alloc_skb(size, GFP_ATOMIC);
                         if (!skb)
-                                pr_debug("cannot even allocate "
-                                         "buffer of size %ub\n", size);
+                                pr_debug("cannot even allocate buffer of size %ub\n",
+                                         size);
                 }
         }
 
diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
index 1bcaf36ad612..40d8258bf74f 100644
--- a/net/bridge/netfilter/ebtable_broute.c
+++ b/net/bridge/netfilter/ebtable_broute.c
@@ -87,14 +87,14 @@ static int __init ebtable_broute_init(void)
         if (ret < 0)
                 return ret;
         /* see br_input.c */
-        rcu_assign_pointer(br_should_route_hook,
+        RCU_INIT_POINTER(br_should_route_hook,
                            (br_should_route_hook_t *)ebt_broute);
         return 0;
 }
 
 static void __exit ebtable_broute_fini(void)
 {
-        rcu_assign_pointer(br_should_route_hook, NULL);
+        RCU_INIT_POINTER(br_should_route_hook, NULL);
         synchronize_net();
         unregister_pernet_subsys(&broute_net_ops);
 }