16 files changed, 331 insertions, 140 deletions
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 76357b54775..c8436fa3134 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -63,7 +63,6 @@ static int __init br_init(void)
                goto err_out4;
        brioctl_set(br_ioctl_deviceless_stub);
-        br_handle_frame_hook = br_handle_frame;
 #if defined(CONFIG_ATM_LANE) || defined(CONFIG_ATM_LANE_MODULE)
        br_fdb_test_addr_hook = br_fdb_test_addr;
@@ -100,7 +99,6 @@ static void __exit br_deinit(void)
        br_fdb_test_addr_hook = NULL;
 #endif
-        br_handle_frame_hook = NULL;
        br_fdb_fini();
 }
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 753fc4221f3..cf09fe591fc 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -22,7 +22,7 @@
 #include <asm/uaccess.h>
 #include "br_private.h"
-/* net device transmit always called with no BH (preempt_disabled) */
+/* net device transmit always called with BH disabled */
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct net_bridge *br = netdev_priv(dev);
@@ -38,17 +38,26 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
        }
 #endif
+        u64_stats_update_begin(&brstats->syncp);
        brstats->tx_packets++;
        brstats->tx_bytes += skb->len;
+        u64_stats_update_end(&brstats->syncp);
        BR_INPUT_SKB_CB(skb)->brdev = dev;
        skb_reset_mac_header(skb);
        skb_pull(skb, ETH_HLEN);
+        rcu_read_lock();
        if (is_multicast_ether_addr(dest)) {
-                if (br_multicast_rcv(br, NULL, skb))
+                if (unlikely(netpoll_tx_running(dev))) {
+                        br_flood_deliver(br, skb);
+                        goto out;
+                }
+                if (br_multicast_rcv(br, NULL, skb)) {
+                        kfree_skb(skb);
                        goto out;
+                }
                mdst = br_mdb_get(br, skb);
                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
@@ -61,6 +70,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                br_flood_deliver(br, skb);
 out:
+        rcu_read_unlock();
        return NETDEV_TX_OK;
 }
@@ -92,21 +102,25 @@ static int br_dev_stop(struct net_device *dev)
        return 0;
 }
-static struct net_device_stats *br_get_stats(struct net_device *dev)
+static struct rtnl_link_stats64 *br_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *stats)
 {
        struct net_bridge *br = netdev_priv(dev);
-        struct net_device_stats *stats = &dev->stats;
+        struct br_cpu_netstats tmp, sum = { 0 };
-        struct br_cpu_netstats sum = { 0 };
        unsigned int cpu;
        for_each_possible_cpu(cpu) {
+                unsigned int start;
                const struct br_cpu_netstats *bstats
                        = per_cpu_ptr(br->stats, cpu);
+                do {
-                sum.tx_bytes   += bstats->tx_bytes;
+                        start = u64_stats_fetch_begin(&bstats->syncp);
-                sum.tx_packets += bstats->tx_packets;
+                        memcpy(&tmp, bstats, sizeof(tmp));
-                sum.rx_bytes   += bstats->rx_bytes;
+                } while (u64_stats_fetch_retry(&bstats->syncp, start));
-                sum.rx_packets += bstats->rx_packets;
+                sum.tx_bytes   += tmp.tx_bytes;
+                sum.tx_packets += tmp.tx_packets;
+                sum.rx_bytes   += tmp.rx_bytes;
+                sum.rx_packets += tmp.rx_packets;
        }
        stats->tx_bytes   = sum.tx_bytes;
@@ -127,7 +141,7 @@ static int br_change_mtu(struct net_device *dev, int new_mtu)
 #ifdef CONFIG_BRIDGE_NETFILTER
        /* remember the MTU in the rtable for PMTU */
-        br->fake_rtable.u.dst.metrics[RTAX_MTU - 1] = new_mtu;
+        br->fake_rtable.dst.metrics[RTAX_MTU - 1] = new_mtu;
 #endif
        return 0;
@@ -199,65 +213,81 @@ static int br_set_tx_csum(struct net_device *dev, u32 data)
 }
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static bool br_devices_support_netpoll(struct net_bridge *br)
+static void br_poll_controller(struct net_device *br_dev)
 {
-        struct net_bridge_port *p;
-        bool ret = true;
-        int count = 0;
-        unsigned long flags;
-        spin_lock_irqsave(&br->lock, flags);
-        list_for_each_entry(p, &br->port_list, list) {
-                count++;
-                if ((p->dev->priv_flags & IFF_DISABLE_NETPOLL) ||
-                    !p->dev->netdev_ops->ndo_poll_controller)
-                        ret = false;
-        }
-        spin_unlock_irqrestore(&br->lock, flags);
-        return count != 0 && ret;
 }
-void br_netpoll_cleanup(struct net_device *dev)
+static void br_netpoll_cleanup(struct net_device *dev)
 {
        struct net_bridge *br = netdev_priv(dev);
        struct net_bridge_port *p, *n;
-        const struct net_device_ops *ops;
-        br->dev->npinfo = NULL;
        list_for_each_entry_safe(p, n, &br->port_list, list) {
-                if (p->dev) {
+                br_netpoll_disable(p);
-                        ops = p->dev->netdev_ops;
-                        if (ops->ndo_netpoll_cleanup)
-                                ops->ndo_netpoll_cleanup(p->dev);
-                        else
-                                p->dev->npinfo = NULL;
-                }
        }
 }
-void br_netpoll_disable(struct net_bridge *br,
+static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni)
-                        struct net_device *dev)
 {
-        if (br_devices_support_netpoll(br))
+        struct net_bridge *br = netdev_priv(dev);
-                br->dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+        struct net_bridge_port *p, *n;
-        if (dev->netdev_ops->ndo_netpoll_cleanup)
+        int err = 0;
-                dev->netdev_ops->ndo_netpoll_cleanup(dev);
-        else
+        list_for_each_entry_safe(p, n, &br->port_list, list) {
-                dev->npinfo = NULL;
+                if (!p->dev)
+                        continue;
+                err = br_netpoll_enable(p);
+                if (err)
+                        goto fail;
+        }
+out:
+        return err;
+fail:
+        br_netpoll_cleanup(dev);
+        goto out;
 }
-void br_netpoll_enable(struct net_bridge *br,
+int br_netpoll_enable(struct net_bridge_port *p)
-                       struct net_device *dev)
 {
-        if (br_devices_support_netpoll(br)) {
+        struct netpoll *np;
-                br->dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+        int err = 0;
-                if (br->dev->npinfo)
-                        dev->npinfo = br->dev->npinfo;
+        np = kzalloc(sizeof(*p->np), GFP_KERNEL);
-        } else if (!(br->dev->priv_flags & IFF_DISABLE_NETPOLL)) {
+        err = -ENOMEM;
-                br->dev->priv_flags |= IFF_DISABLE_NETPOLL;
+        if (!np)
-                br_info(br,"new device %s does not support netpoll (disabling)",
+                goto out;
-                        dev->name);
+        np->dev = p->dev;
+        err = __netpoll_setup(np);
+        if (err) {
+                kfree(np);
+                goto out;
        }
+        p->np = np;
+out:
+        return err;
+}
+void br_netpoll_disable(struct net_bridge_port *p)
+{
+        struct netpoll *np = p->np;
+        if (!np)
+                return;
+        p->np = NULL;
+        /* Wait for transmitting packets to finish before freeing. */
+        synchronize_rcu_bh();
+        __netpoll_cleanup(np);
+        kfree(np);
 }
 #endif
@@ -280,13 +310,15 @@ static const struct net_device_ops br_netdev_ops = {
        .ndo_open                = br_dev_open,
        .ndo_stop                = br_dev_stop,
        .ndo_start_xmit          = br_dev_xmit,
-        .ndo_get_stats           = br_get_stats,
+        .ndo_get_stats64         = br_get_stats64,
        .ndo_set_mac_address     = br_set_mac_address,
        .ndo_set_multicast_list  = br_dev_set_multicast_list,
        .ndo_change_mtu          = br_change_mtu,
        .ndo_do_ioctl            = br_dev_ioctl,
 #ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_netpoll_setup       = br_netpoll_setup,
        .ndo_netpoll_cleanup     = br_netpoll_cleanup,
+        .ndo_poll_controller     = br_poll_controller,
 #endif
 };
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index b01dde35a69..90512ccfd3e 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -214,7 +214,7 @@ void br_fdb_delete_by_port(struct net_bridge *br,
        spin_unlock_bh(&br->hash_lock);
 }
-/* No locking or refcounting, assumes caller has no preempt (rcu_read_lock) */
+/* No locking or refcounting, assumes caller has rcu_read_lock */
 struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
                                          const unsigned char *addr)
 {
@@ -240,11 +240,11 @@ int br_fdb_test_addr(struct net_device *dev, unsigned char *addr)
        struct net_bridge_fdb_entry *fdb;
        int ret;
-        if (!dev->br_port)
+        if (!br_port_exists(dev))
                return 0;
        rcu_read_lock();
-        fdb = __br_fdb_get(dev->br_port->br, addr);
+        fdb = __br_fdb_get(br_port_get_rcu(dev)->br, addr);
        ret = fdb && fdb->dst->dev != dev &&
                fdb->dst->state == BR_STATE_FORWARDING;
        rcu_read_unlock();
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 595da45f908..cbfe87f0f34 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -67,6 +67,17 @@ int br_forward_finish(struct sk_buff *skb)
 static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
        skb->dev = to->dev;
+        if (unlikely(netpoll_tx_running(to->dev))) {
+                if (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))
+                        kfree_skb(skb);
+                else {
+                        skb_push(skb, ETH_HLEN);
+                        br_netpoll_send_skb(to, skb);
+                }
+                return;
+        }
        NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
                br_forward_finish);
 }
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 18b245e2c00..c03d2c3ff03 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -147,14 +147,17 @@ static void del_nbp(struct net_bridge_port *p)
        list_del_rcu(&p->list);
-        rcu_assign_pointer(dev->br_port, NULL);
+        dev->priv_flags &= ~IFF_BRIDGE_PORT;
+        netdev_rx_handler_unregister(dev);
        br_multicast_del_port(p);
        kobject_uevent(&p->kobj, KOBJ_REMOVE);
        kobject_del(&p->kobj);
-        br_netpoll_disable(br, dev);
+        br_netpoll_disable(p);
        call_rcu(&p->rcu, destroy_nbp_rcu);
 }
@@ -167,8 +170,6 @@ static void del_br(struct net_bridge *br, struct list_head *head)
                del_nbp(p);
        }
-        br_netpoll_cleanup(br->dev);
        del_timer_sync(&br->gc_timer);
        br_sysfs_delbr(br->dev);
@@ -400,7 +401,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
                return -ELOOP;
        /* Device is already being bridged */
-        if (dev->br_port != NULL)
+        if (br_port_exists(dev))
                return -EBUSY;
        /* No bridging devices that dislike that (e.g. wireless) */
@@ -428,7 +429,15 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
        if (err)
                goto err2;
-        rcu_assign_pointer(dev->br_port, p);
+        if (br_netpoll_info(br) && ((err = br_netpoll_enable(p))))
+                goto err3;
+        err = netdev_rx_handler_register(dev, br_handle_frame, p);
+        if (err)
+                goto err3;
+        dev->priv_flags |= IFF_BRIDGE_PORT;
        dev_disable_lro(dev);
        list_add_rcu(&p->list, &br->port_list);
@@ -448,9 +457,9 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
        kobject_uevent(&p->kobj, KOBJ_ADD);
-        br_netpoll_enable(br, dev);
        return 0;
+err3:
+        sysfs_remove_link(br->ifobj, p->dev->name);
 err2:
        br_fdb_delete_by_port(br, p, 1);
 err1:
@@ -467,9 +476,13 @@ put_back:
 /* called with RTNL */
 int br_del_if(struct net_bridge *br, struct net_device *dev)
 {
-        struct net_bridge_port *p = dev->br_port;
+        struct net_bridge_port *p;
+        if (!br_port_exists(dev))
+                return -EINVAL;
-        if (!p || p->br != br)
+        p = br_port_get(dev);
+        if (p->br != br)
                return -EINVAL;
        del_nbp(p);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index d36e700f7a2..826cd522153 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -27,8 +27,10 @@ static int br_pass_frame_up(struct sk_buff *skb)
        struct net_bridge *br = netdev_priv(brdev);
        struct br_cpu_netstats *brstats = this_cpu_ptr(br->stats);
+        u64_stats_update_begin(&brstats->syncp);
        brstats->rx_packets++;
        brstats->rx_bytes += skb->len;
+        u64_stats_update_end(&brstats->syncp);
        indev = skb->dev;
        skb->dev = brdev;
@@ -37,11 +39,11 @@ static int br_pass_frame_up(struct sk_buff *skb)
                       netif_receive_skb);
 }
-/* note: already called with rcu_read_lock (preempt_disabled) */
+/* note: already called with rcu_read_lock */
 int br_handle_frame_finish(struct sk_buff *skb)
 {
        const unsigned char *dest = eth_hdr(skb)->h_dest;
-        struct net_bridge_port *p = rcu_dereference(skb->dev->br_port);
+        struct net_bridge_port *p = br_port_get_rcu(skb->dev);
        struct net_bridge *br;
        struct net_bridge_fdb_entry *dst;
        struct net_bridge_mdb_entry *mdst;
@@ -108,13 +110,12 @@ drop:
        goto out;
 }
-/* note: already called with rcu_read_lock (preempt_disabled) */
+/* note: already called with rcu_read_lock */
 static int br_handle_local_finish(struct sk_buff *skb)
 {
-        struct net_bridge_port *p = rcu_dereference(skb->dev->br_port);
+        struct net_bridge_port *p = br_port_get_rcu(skb->dev);
-        if (p)
+        br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
-                br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
        return 0;        /* process further */
 }
@@ -131,15 +132,18 @@ static inline int is_link_local(const unsigned char *dest)
 }
 /*
- * Called via br_handle_frame_hook.
 * Return NULL if skb is handled
- * note: already called with rcu_read_lock (preempt_disabled)
+ * note: already called with rcu_read_lock
 */
-struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
+struct sk_buff *br_handle_frame(struct sk_buff *skb)
 {
+        struct net_bridge_port *p;
        const unsigned char *dest = eth_hdr(skb)->h_dest;
        int (*rhook)(struct sk_buff *skb);
+        if (skb->pkt_type == PACKET_LOOPBACK)
+                return skb;
        if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
                goto drop;
@@ -147,6 +151,8 @@ struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
        if (!skb)
                return NULL;
+        p = br_port_get_rcu(skb->dev);
        if (unlikely(is_link_local(dest))) {
                /* Pause frames shouldn't be passed up by driver anyway */
                if (skb->protocol == htons(ETH_P_PAUSE))
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 27ae946363f..eb5b256ffc8 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1435,7 +1435,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
        struct icmp6hdr *icmp6h;
        u8 nexthdr;
        unsigned len;
-        unsigned offset;
+        int offset;
        int err;
        if (!pskb_may_pull(skb, sizeof(*ip6h)))
@@ -1728,13 +1728,9 @@ unlock:
 int br_multicast_toggle(struct net_bridge *br, unsigned long val)
 {
        struct net_bridge_port *port;
-        int err = -ENOENT;
+        int err = 0;
        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev))
-                goto unlock;
-        err = 0;
        if (br->multicast_disabled == !val)
                goto unlock;
@@ -1742,6 +1738,9 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
        if (br->multicast_disabled)
                goto unlock;
+        if (!netif_running(br->dev))
+                goto unlock;
        if (br->mdb) {
                if (br->mdb->old) {
                        err = -EEXIST;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 8fb75f89c4a..2c911c0759c 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -55,6 +55,9 @@ static int brnf_call_arptables __read_mostly = 1;
 static int brnf_filter_vlan_tagged __read_mostly = 0;
 static int brnf_filter_pppoe_tagged __read_mostly = 0;
 #else
+#define brnf_call_iptables 1
+#define brnf_call_ip6tables 1
+#define brnf_call_arptables 1
 #define brnf_filter_vlan_tagged 0
 #define brnf_filter_pppoe_tagged 0
 #endif
@@ -117,26 +120,27 @@ void br_netfilter_rtable_init(struct net_bridge *br)
 {
        struct rtable *rt = &br->fake_rtable;
-        atomic_set(&rt->u.dst.__refcnt, 1);
+        atomic_set(&rt->dst.__refcnt, 1);
-        rt->u.dst.dev = br->dev;
+        rt->dst.dev = br->dev;
-        rt->u.dst.path = &rt->u.dst;
+        rt->dst.path = &rt->dst;
-        rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
+        rt->dst.metrics[RTAX_MTU - 1] = 1500;
-        rt->u.dst.flags = DST_NOXFRM;
+        rt->dst.flags   = DST_NOXFRM;
-        rt->u.dst.ops = &fake_dst_ops;
+        rt->dst.ops = &fake_dst_ops;
 }
 static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
 {
-        struct net_bridge_port *port = rcu_dereference(dev->br_port);
+        if (!br_port_exists(dev))
+                return NULL;
-        return port ? &port->br->fake_rtable : NULL;
+        return &br_port_get_rcu(dev)->br->fake_rtable;
 }
 static inline struct net_device *bridge_parent(const struct net_device *dev)
 {
-        struct net_bridge_port *port = rcu_dereference(dev->br_port);
+        if (!br_port_exists(dev))
+                return NULL;
-        return port ? port->br->dev : NULL;
+        return br_port_get_rcu(dev)->br->dev;
 }
 static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
@@ -244,8 +248,7 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
                kfree_skb(skb);
                return 0;
        }
-        dst_hold(&rt->u.dst);
+        skb_dst_set_noref(skb, &rt->dst);
-        skb_dst_set(skb, &rt->u.dst);
        skb->dev = nf_bridge->physindev;
        nf_bridge_update_protocol(skb);
@@ -396,8 +399,7 @@ bridged_dnat:
                        kfree_skb(skb);
                        return 0;
                }
-                dst_hold(&rt->u.dst);
+                skb_dst_set_noref(skb, &rt->dst);
-                skb_dst_set(skb, &rt->u.dst);
        }
        skb->dev = nf_bridge->physindev;
@@ -545,25 +547,30 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
 {
+        struct net_bridge_port *p;
+        struct net_bridge *br;
        struct iphdr *iph;
        __u32 len = nf_bridge_encap_header_len(skb);
        if (unlikely(!pskb_may_pull(skb, len)))
                goto out;
+        p = br_port_get_rcu(in);
+        if (p == NULL)
+                goto out;
+        br = p->br;
        if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
            IS_PPPOE_IPV6(skb)) {
-#ifdef CONFIG_SYSCTL
+                if (!brnf_call_ip6tables && !br->nf_call_ip6tables)
-                if (!brnf_call_ip6tables)
                        return NF_ACCEPT;
-#endif
                nf_bridge_pull_encap_header_rcsum(skb);
                return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
        }
-#ifdef CONFIG_SYSCTL
-        if (!brnf_call_iptables)
+        if (!brnf_call_iptables && !br->nf_call_iptables)
                return NF_ACCEPT;
-#endif
        if (skb->protocol != htons(ETH_P_IP) && !IS_VLAN_IP(skb) &&
            !IS_PPPOE_IP(skb))
@@ -719,12 +726,17 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
 {
+        struct net_bridge_port *p;
+        struct net_bridge *br;
        struct net_device **d = (struct net_device **)(skb->cb);
-#ifdef CONFIG_SYSCTL
+        p = br_port_get_rcu(out);
-        if (!brnf_call_arptables)
+        if (p == NULL)
+                return NF_ACCEPT;
+        br = p->br;
+        if (!brnf_call_arptables && !br->nf_call_arptables)
                return NF_ACCEPT;
-#endif
        if (skb->protocol != htons(ETH_P_ARP)) {
                if (!IS_VLAN_ARP(skb))
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index fe0a79018ab..4a6a378c84e 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -120,10 +120,11 @@ static int br_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
        idx = 0;
        for_each_netdev(net, dev) {
                /* not a bridge port */
-                if (dev->br_port == NULL || idx < cb->args[0])
+                if (!br_port_exists(dev) || idx < cb->args[0])
                        goto skip;
-                if (br_fill_ifinfo(skb, dev->br_port, NETLINK_CB(cb->skb).pid,
+                if (br_fill_ifinfo(skb, br_port_get(dev),
+                                   NETLINK_CB(cb->skb).pid,
                                   cb->nlh->nlmsg_seq, RTM_NEWLINK,
                                   NLM_F_MULTI) < 0)
                        break;
@@ -168,9 +169,9 @@ static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
        if (!dev)
                return -ENODEV;
-        p = dev->br_port;
+        if (!br_port_exists(dev))
-        if (!p)
                return -EINVAL;
+        p = br_port_get(dev);
        /* if kernel STP is running, don't allow changes */
        if (p->br->stp_enabled == BR_KERNEL_STP)
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 717e1fd6133..404d4e14c6a 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -32,14 +32,15 @@ struct notifier_block br_device_notifier = {
 static int br_device_event(struct notifier_block *unused, unsigned long event, void *ptr)
 {
        struct net_device *dev = ptr;
-        struct net_bridge_port *p = dev->br_port;
+        struct net_bridge_port *p = br_port_get(dev);
        struct net_bridge *br;
        int err;
        /* not a port of a bridge */
-        if (p == NULL)
+        if (!br_port_exists(dev))
                return NOTIFY_DONE;
+        p = br_port_get(dev);
        br = p->br;
        switch (event) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 0f4a74bc6a9..75c90edaf7d 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -15,6 +15,8 @@
 #include <linux/netdevice.h>
 #include <linux/if_bridge.h>
+#include <linux/netpoll.h>
+#include <linux/u64_stats_sync.h>
 #include <net/route.h>
 #define BR_HASH_BITS 8
@@ -143,13 +145,23 @@ struct net_bridge_port
 #ifdef CONFIG_SYSFS
        char                            sysfs_name[IFNAMSIZ];
 #endif
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        struct netpoll                  *np;
+#endif
 };
+#define br_port_get_rcu(dev) \
+        ((struct net_bridge_port *) rcu_dereference(dev->rx_handler_data))
+#define br_port_get(dev) ((struct net_bridge_port *) dev->rx_handler_data)
+#define br_port_exists(dev) (dev->priv_flags & IFF_BRIDGE_PORT)
 struct br_cpu_netstats {
-        unsigned long   rx_packets;
+        u64                     rx_packets;
-        unsigned long   rx_bytes;
+        u64                     rx_bytes;
-        unsigned long   tx_packets;
+        u64                     tx_packets;
-        unsigned long   tx_bytes;
+        u64                     tx_bytes;
+        struct u64_stats_sync   syncp;
 };
 struct net_bridge
@@ -164,6 +176,9 @@ struct net_bridge
        unsigned long                   feature_mask;
 #ifdef CONFIG_BRIDGE_NETFILTER
        struct rtable                   fake_rtable;
+        bool                            nf_call_iptables;
+        bool                            nf_call_ip6tables;
+        bool                            nf_call_arptables;
 #endif
        unsigned long                   flags;
 #define BR_SET_MAC_ADDR         0x00000001
@@ -273,16 +288,41 @@ extern void br_dev_setup(struct net_device *dev);
 extern netdev_tx_t br_dev_xmit(struct sk_buff *skb,
                               struct net_device *dev);
 #ifdef CONFIG_NET_POLL_CONTROLLER
-extern void br_netpoll_cleanup(struct net_device *dev);
+static inline struct netpoll_info *br_netpoll_info(struct net_bridge *br)
-extern void br_netpoll_enable(struct net_bridge *br,
+{
-                              struct net_device *dev);
+        return br->dev->npinfo;
-extern void br_netpoll_disable(struct net_bridge *br,
+}
-                               struct net_device *dev);
+static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
+                                       struct sk_buff *skb)
+{
+        struct netpoll *np = p->np;
+        if (np)
+                netpoll_send_skb(np, skb);
+}
+extern int br_netpoll_enable(struct net_bridge_port *p);
+extern void br_netpoll_disable(struct net_bridge_port *p);
 #else
-#define br_netpoll_cleanup(br)
+static inline struct netpoll_info *br_netpoll_info(struct net_bridge *br)
-#define br_netpoll_enable(br, dev)
+{
-#define br_netpoll_disable(br, dev)
+        return NULL;
+}
+static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
+                                       struct sk_buff *skb)
+{
+}
+static inline int br_netpoll_enable(struct net_bridge_port *p)
+{
+        return 0;
+}
+static inline void br_netpoll_disable(struct net_bridge_port *p)
+{
+}
 #endif
 /* br_fdb.c */
@@ -331,8 +371,7 @@ extern void br_features_recompute(struct net_bridge *br);
 /* br_input.c */
 extern int br_handle_frame_finish(struct sk_buff *skb);
-extern struct sk_buff *br_handle_frame(struct net_bridge_port *p,
+extern struct sk_buff *br_handle_frame(struct sk_buff *skb);
-                                       struct sk_buff *skb);
 /* br_ioctl.c */
 extern int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 217bd225a42..35cf27087b5 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -131,18 +131,19 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
 /*
 * Called from llc.
 *
- * NO locks, but rcu_read_lock (preempt_disabled)
+ * NO locks, but rcu_read_lock
 */
 void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
                struct net_device *dev)
 {
        const unsigned char *dest = eth_hdr(skb)->h_dest;
-        struct net_bridge_port *p = rcu_dereference(dev->br_port);
+        struct net_bridge_port *p;
        struct net_bridge *br;
        const unsigned char *buf;
-        if (!p)
+        if (!br_port_exists(dev))
                goto err;
+        p = br_port_get_rcu(dev);
        if (!pskb_may_pull(skb, 4))
                goto err;
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 486b8f3861d..5c1e5559ebb 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -611,6 +611,73 @@ static DEVICE_ATTR(multicast_startup_query_interval, S_IRUGO | S_IWUSR,
                   show_multicast_startup_query_interval,
                   store_multicast_startup_query_interval);
 #endif
+#ifdef CONFIG_BRIDGE_NETFILTER
+static ssize_t show_nf_call_iptables(
+        struct device *d, struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%u\n", br->nf_call_iptables);
+}
+static int set_nf_call_iptables(struct net_bridge *br, unsigned long val)
+{
+        br->nf_call_iptables = val ? true : false;
+        return 0;
+}
+static ssize_t store_nf_call_iptables(
+        struct device *d, struct device_attribute *attr, const char *buf,
+        size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_nf_call_iptables);
+}
+static DEVICE_ATTR(nf_call_iptables, S_IRUGO | S_IWUSR,
+                   show_nf_call_iptables, store_nf_call_iptables);
+static ssize_t show_nf_call_ip6tables(
+        struct device *d, struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%u\n", br->nf_call_ip6tables);
+}
+static int set_nf_call_ip6tables(struct net_bridge *br, unsigned long val)
+{
+        br->nf_call_ip6tables = val ? true : false;
+        return 0;
+}
+static ssize_t store_nf_call_ip6tables(
+        struct device *d, struct device_attribute *attr, const char *buf,
+        size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_nf_call_ip6tables);
+}
+static DEVICE_ATTR(nf_call_ip6tables, S_IRUGO | S_IWUSR,
+                   show_nf_call_ip6tables, store_nf_call_ip6tables);
+static ssize_t show_nf_call_arptables(
+        struct device *d, struct device_attribute *attr, char *buf)
+{
+        struct net_bridge *br = to_bridge(d);
+        return sprintf(buf, "%u\n", br->nf_call_arptables);
+}
+static int set_nf_call_arptables(struct net_bridge *br, unsigned long val)
+{
+        br->nf_call_arptables = val ? true : false;
+        return 0;
+}
+static ssize_t store_nf_call_arptables(
+        struct device *d, struct device_attribute *attr, const char *buf,
+        size_t len)
+{
+        return store_bridge_parm(d, buf, len, set_nf_call_arptables);
+}
+static DEVICE_ATTR(nf_call_arptables, S_IRUGO | S_IWUSR,
+                   show_nf_call_arptables, store_nf_call_arptables);
+#endif
 static struct attribute *bridge_attrs[] = {
        &dev_attr_forward_delay.attr,
@@ -645,6 +712,11 @@ static struct attribute *bridge_attrs[] = {
        &dev_attr_multicast_query_response_interval.attr,
        &dev_attr_multicast_startup_query_interval.attr,
 #endif
+#ifdef CONFIG_BRIDGE_NETFILTER
+        &dev_attr_nf_call_iptables.attr,
+        &dev_attr_nf_call_ip6tables.attr,
+        &dev_attr_nf_call_arptables.attr,
+#endif
        NULL
 };
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index 9e19166ba45..46624bb6d9b 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -24,8 +24,9 @@ ebt_redirect_tg(struct sk_buff *skb, const struct xt_action_param *par)
                return EBT_DROP;
        if (par->hooknum != NF_BR_BROUTING)
+                /* rcu_read_lock()ed by nf_hook_slow */
                memcpy(eth_hdr(skb)->h_dest,
-                       par->in->br_port->br->dev->dev_addr, ETH_ALEN);
+                       br_port_get_rcu(par->in)->br->dev->dev_addr, ETH_ALEN);
        else
                memcpy(eth_hdr(skb)->h_dest, par->in->dev_addr, ETH_ALEN);
        skb->pkt_type = PACKET_HOST;
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index ae3c7cef148..26377e96fa1 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -177,8 +177,9 @@ static void ebt_ulog_packet(unsigned int hooknr, const struct sk_buff *skb,
        if (in) {
                strcpy(pm->physindev, in->name);
                /* If in isn't a bridge, then physindev==indev */
-                if (in->br_port)
+                if (br_port_exists(in))
-                        strcpy(pm->indev, in->br_port->br->dev->name);
+                        /* rcu_read_lock()ed by nf_hook_slow */
+                        strcpy(pm->indev, br_port_get_rcu(in)->br->dev->name);
                else
                        strcpy(pm->indev, in->name);
        } else
@@ -187,7 +188,8 @@ static void ebt_ulog_packet(unsigned int hooknr, const struct sk_buff *skb,
        if (out) {
                /* If out exists, then out is a bridge port */
                strcpy(pm->physoutdev, out->name);
-                strcpy(pm->outdev, out->br_port->br->dev->name);
+                /* rcu_read_lock()ed by nf_hook_slow */
+                strcpy(pm->outdev, br_port_get_rcu(out)->br->dev->name);
        } else
                pm->outdev[0] = pm->physoutdev[0] = '\0';
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 59ca00e40de..bcc102e3be4 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -140,11 +140,14 @@ ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
                return 1;
        if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
                return 1;
-        if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
+        /* rcu_read_lock()ed by nf_hook_slow */
-           e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
+        if (in && br_port_exists(in) &&
+            FWINV2(ebt_dev_check(e->logical_in, br_port_get_rcu(in)->br->dev),
+                   EBT_ILOGICALIN))
                return 1;
-        if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
+        if (out && br_port_exists(out) &&
-           e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
+            FWINV2(ebt_dev_check(e->logical_out, br_port_get_rcu(out)->br->dev),
+                   EBT_ILOGICALOUT))
                return 1;
        if (e->bitmask & EBT_SOURCEMAC) {