1 files changed, 143 insertions, 123 deletions

diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index d9576e6de2b..68def3b7fb4 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -28,8 +28,7 @@
 static struct kmem_cache *br_fdb_cache __read_mostly;
 static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                       const unsigned char *addr);
-static void fdb_notify(struct net_bridge *br,
-                       const struct net_bridge_fdb_entry *, int);
+static void fdb_notify(const struct net_bridge_fdb_entry *, int);
 
 static u32 fdb_salt __read_mostly;
 
@@ -81,10 +80,10 @@ static void fdb_rcu_free(struct rcu_head *head)
         kmem_cache_free(br_fdb_cache, ent);
 }
 
-static void fdb_delete(struct net_bridge *br, struct net_bridge_fdb_entry *f)
+static inline void fdb_delete(struct net_bridge_fdb_entry *f)
 {
+        fdb_notify(f, RTM_DELNEIGH);
         hlist_del_rcu(&f->hlist);
-        fdb_notify(br, f, RTM_DELNEIGH);
         call_rcu(&f->rcu, fdb_rcu_free);
 }
 
@@ -107,15 +106,15 @@ void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
                                 struct net_bridge_port *op;
                                 list_for_each_entry(op, &br->port_list, list) {
                                         if (op != p &&
-                                            ether_addr_equal(op->dev->dev_addr,
-                                                             f->addr.addr)) {
+                                            !compare_ether_addr(op->dev->dev_addr,
+                                                                f->addr.addr)) {
                                                 f->dst = op;
                                                 goto insert;
                                         }
                                 }
 
                                 /* delete old one */
-                                fdb_delete(br, f);
+                                fdb_delete(f);
                                 goto insert;
                         }
                 }
@@ -127,18 +126,6 @@ void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
         spin_unlock_bh(&br->hash_lock);
 }
 
-void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
-{
-        struct net_bridge_fdb_entry *f;
-
-        /* If old entry was unassociated with any port, then delete it. */
-        f = __br_fdb_get(br, br->dev->dev_addr);
-        if (f && f->is_local && !f->dst)
-                fdb_delete(br, f);
-
-        fdb_insert(br, NULL, newaddr);
-}
-
 void br_fdb_cleanup(unsigned long _data)
 {
         struct net_bridge *br = (struct net_bridge *)_data;
@@ -146,7 +133,7 @@ void br_fdb_cleanup(unsigned long _data)
         unsigned long next_timer = jiffies + br->ageing_time;
         int i;
 
-        spin_lock(&br->hash_lock);
+        spin_lock_bh(&br->hash_lock);
         for (i = 0; i < BR_HASH_SIZE; i++) {
                 struct net_bridge_fdb_entry *f;
                 struct hlist_node *h, *n;
@@ -157,12 +144,12 @@ void br_fdb_cleanup(unsigned long _data)
                                 continue;
                         this_timer = f->updated + delay;
                         if (time_before_eq(this_timer, jiffies))
-                                fdb_delete(br, f);
+                                fdb_delete(f);
                         else if (time_before(this_timer, next_timer))
                                 next_timer = this_timer;
                 }
         }
-        spin_unlock(&br->hash_lock);
+        spin_unlock_bh(&br->hash_lock);
 
         mod_timer(&br->gc_timer, round_jiffies_up(next_timer));
 }
@@ -178,7 +165,7 @@ void br_fdb_flush(struct net_bridge *br)
                 struct hlist_node *h, *n;
                 hlist_for_each_entry_safe(f, h, n, &br->hash[i], hlist) {
                         if (!f->is_static)
-                                fdb_delete(br, f);
+                                fdb_delete(f);
                 }
         }
         spin_unlock_bh(&br->hash_lock);
@@ -214,15 +201,15 @@ void br_fdb_delete_by_port(struct net_bridge *br,
                                 struct net_bridge_port *op;
                                 list_for_each_entry(op, &br->port_list, list) {
                                         if (op != p &&
-                                            ether_addr_equal(op->dev->dev_addr,
-                                                             f->addr.addr)) {
+                                            !compare_ether_addr(op->dev->dev_addr,
+                                                                f->addr.addr)) {
                                                 f->dst = op;
                                                 goto skip_delete;
                                         }
                                 }
                         }
 
-                        fdb_delete(br, f);
+                        fdb_delete(f);
                 skip_delete: ;
                 }
         }
@@ -237,7 +224,7 @@ struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
         struct net_bridge_fdb_entry *fdb;
 
         hlist_for_each_entry_rcu(fdb, h, &br->hash[br_mac_hash(addr)], hlist) {
-                if (ether_addr_equal(fdb->addr.addr, addr)) {
+                if (!compare_ether_addr(fdb->addr.addr, addr)) {
                         if (unlikely(has_expired(br, fdb)))
                                 break;
                         return fdb;
@@ -247,7 +234,7 @@ struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
         return NULL;
 }
 
-#if IS_ENABLED(CONFIG_ATM_LANE)
+#if defined(CONFIG_ATM_LANE) || defined(CONFIG_ATM_LANE_MODULE)
 /* Interface used by ATM LANE hook to test
  * if an addr is on some other bridge port */
 int br_fdb_test_addr(struct net_device *dev, unsigned char *addr)
@@ -262,7 +249,7 @@ int br_fdb_test_addr(struct net_device *dev, unsigned char *addr)
                 ret = 0;
         else {
                 fdb = __br_fdb_get(port->br, addr);
-                ret = fdb && fdb->dst && fdb->dst->dev != dev &&
+                ret = fdb && fdb->dst->dev != dev &&
                         fdb->dst->state == BR_STATE_FORWARDING;
         }
         rcu_read_unlock();
@@ -294,10 +281,6 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf,
                         if (has_expired(br, f))
                                 continue;
 
-                        /* ignore pseudo entry for local MAC address */
-                        if (!f->dst)
-                                continue;
-
                         if (skip) {
                                 --skip;
                                 continue;
@@ -312,7 +295,7 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf,
 
                         fe->is_local = f->is_local;
                         if (!f->is_static)
-                                fe->ageing_timer_value = jiffies_delta_to_clock_t(jiffies - f->updated);
+                                fe->ageing_timer_value = jiffies_to_clock_t(jiffies - f->updated);
                         ++fe;
                         ++num;
                 }
@@ -331,7 +314,7 @@ static struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
         struct net_bridge_fdb_entry *fdb;
 
         hlist_for_each_entry(fdb, h, head, hlist) {
-                if (ether_addr_equal(fdb->addr.addr, addr))
+                if (!compare_ether_addr(fdb->addr.addr, addr))
                         return fdb;
         }
         return NULL;
@@ -344,7 +327,7 @@ static struct net_bridge_fdb_entry *fdb_find_rcu(struct hlist_head *head,
         struct net_bridge_fdb_entry *fdb;
 
         hlist_for_each_entry_rcu(fdb, h, head, hlist) {
-                if (ether_addr_equal(fdb->addr.addr, addr))
+                if (!compare_ether_addr(fdb->addr.addr, addr))
                         return fdb;
         }
         return NULL;
@@ -364,6 +347,7 @@ static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
                 fdb->is_static = 0;
                 fdb->updated = fdb->used = jiffies;
                 hlist_add_head_rcu(&fdb->hlist, head);
+                fdb_notify(fdb, RTM_NEWNEIGH);
         }
         return fdb;
 }
@@ -387,7 +371,7 @@ static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                 br_warn(br, "adding interface %s with same address "
                        "as a received packet\n",
                        source->dev->name);
-                fdb_delete(br, fdb);
+                fdb_delete(fdb);
         }
 
         fdb = fdb_create(head, source, addr);
@@ -395,7 +379,6 @@ static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                 return -ENOMEM;
 
         fdb->is_local = fdb->is_static = 1;
-        fdb_notify(br, fdb, RTM_NEWNEIGH);
         return 0;
 }
 
@@ -441,11 +424,9 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                 }
         } else {
                 spin_lock(&br->hash_lock);
-                if (likely(!fdb_find(head, addr))) {
-                        fdb = fdb_create(head, source, addr);
-                        if (fdb)
-                                fdb_notify(br, fdb, RTM_NEWNEIGH);
-                }
+                if (likely(!fdb_find(head, addr)))
+                        fdb_create(head, source, addr);
+
                 /* else  we lose race and someone else inserts
                  * it first, don't bother updating
                  */
@@ -465,36 +446,37 @@ static int fdb_to_nud(const struct net_bridge_fdb_entry *fdb)
                 return NUD_REACHABLE;
 }
 
-static int fdb_fill_info(struct sk_buff *skb, const struct net_bridge *br,
+static int fdb_fill_info(struct sk_buff *skb,
                          const struct net_bridge_fdb_entry *fdb,
-                         u32 portid, u32 seq, int type, unsigned int flags)
+                         u32 pid, u32 seq, int type, unsigned int flags)
 {
         unsigned long now = jiffies;
         struct nda_cacheinfo ci;
         struct nlmsghdr *nlh;
         struct ndmsg *ndm;
 
-        nlh = nlmsg_put(skb, portid, seq, type, sizeof(*ndm), flags);
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
         if (nlh == NULL)
                 return -EMSGSIZE;
 
+
         ndm = nlmsg_data(nlh);
         ndm->ndm_family  = AF_BRIDGE;
         ndm->ndm_pad1    = 0;
         ndm->ndm_pad2    = 0;
         ndm->ndm_flags   = 0;
         ndm->ndm_type    = 0;
-        ndm->ndm_ifindex = fdb->dst ? fdb->dst->dev->ifindex : br->dev->ifindex;
+        ndm->ndm_ifindex = fdb->dst->dev->ifindex;
         ndm->ndm_state   = fdb_to_nud(fdb);
 
-        if (nla_put(skb, NDA_LLADDR, ETH_ALEN, &fdb->addr))
-                goto nla_put_failure;
+        NLA_PUT(skb, NDA_LLADDR, ETH_ALEN, &fdb->addr);
+
         ci.ndm_used      = jiffies_to_clock_t(now - fdb->used);
         ci.ndm_confirmed = 0;
         ci.ndm_updated   = jiffies_to_clock_t(now - fdb->updated);
         ci.ndm_refcnt    = 0;
-        if (nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
-                goto nla_put_failure;
+        NLA_PUT(skb, NDA_CACHEINFO, sizeof(ci), &ci);
+
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -509,10 +491,9 @@ static inline size_t fdb_nlmsg_size(void)
                 + nla_total_size(sizeof(struct nda_cacheinfo));
 }
 
-static void fdb_notify(struct net_bridge *br,
-                       const struct net_bridge_fdb_entry *fdb, int type)
+static void fdb_notify(const struct net_bridge_fdb_entry *fdb, int type)
 {
-        struct net *net = dev_net(br->dev);
+        struct net *net = dev_net(fdb->dst->dev);
         struct sk_buff *skb;
         int err = -ENOBUFS;
 
@@ -520,7 +501,7 @@ static void fdb_notify(struct net_bridge *br,
         if (skb == NULL)
                 goto errout;
 
-        err = fdb_fill_info(skb, br, fdb, 0, 0, type, 0);
+        err = fdb_fill_info(skb, fdb, 0, 0, type, 0);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in fdb_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
@@ -535,88 +516,105 @@ errout:
 }
 
 /* Dump information about entries, in response to GETNEIGH */
-int br_fdb_dump(struct sk_buff *skb,
-                struct netlink_callback *cb,
-                struct net_device *dev,
-                int idx)
+int br_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct net_bridge *br = netdev_priv(dev);
-        int i;
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+        int idx = 0;
+
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
+                struct net_bridge *br = netdev_priv(dev);
+                int i;
 
-        if (!(dev->priv_flags & IFF_EBRIDGE))
-                goto out;
+                if (!(dev->priv_flags & IFF_EBRIDGE))
+                        continue;
 
-        for (i = 0; i < BR_HASH_SIZE; i++) {
-                struct hlist_node *h;
-                struct net_bridge_fdb_entry *f;
+                for (i = 0; i < BR_HASH_SIZE; i++) {
+                        struct hlist_node *h;
+                        struct net_bridge_fdb_entry *f;
 
-                hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
-                        if (idx < cb->args[0])
-                                goto skip;
-
-                        if (fdb_fill_info(skb, br, f,
-                                          NETLINK_CB(cb->skb).portid,
-                                          cb->nlh->nlmsg_seq,
-                                          RTM_NEWNEIGH,
-                                          NLM_F_MULTI) < 0)
-                                break;
+                        hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
+                                if (idx < cb->args[0])
+                                        goto skip;
+
+                                if (fdb_fill_info(skb, f,
+                                                  NETLINK_CB(cb->skb).pid,
+                                                  cb->nlh->nlmsg_seq,
+                                                  RTM_NEWNEIGH,
+                                                  NLM_F_MULTI) < 0)
+                                        break;
 skip:
-                        ++idx;
+                                ++idx;
+                        }
                 }
         }
+        rcu_read_unlock();
+
+        cb->args[0] = idx;
 
-out:
-        return idx;
+        return skb->len;
 }
 
-/* Update (create or replace) forwarding database entry */
+/* Create new static fdb entry */
 static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
-                         __u16 state, __u16 flags)
+                         __u16 state)
 {
         struct net_bridge *br = source->br;
         struct hlist_head *head = &br->hash[br_mac_hash(addr)];
         struct net_bridge_fdb_entry *fdb;
 
         fdb = fdb_find(head, addr);
-        if (fdb == NULL) {
-                if (!(flags & NLM_F_CREATE))
-                        return -ENOENT;
-
-                fdb = fdb_create(head, source, addr);
-                if (!fdb)
-                        return -ENOMEM;
-                fdb_notify(br, fdb, RTM_NEWNEIGH);
-        } else {
-                if (flags & NLM_F_EXCL)
-                        return -EEXIST;
-        }
+        if (fdb)
+                return -EEXIST;
 
-        if (fdb_to_nud(fdb) != state) {
-                if (state & NUD_PERMANENT)
-                        fdb->is_local = fdb->is_static = 1;
-                else if (state & NUD_NOARP) {
-                        fdb->is_local = 0;
-                        fdb->is_static = 1;
-                } else
-                        fdb->is_local = fdb->is_static = 0;
-
-                fdb->updated = fdb->used = jiffies;
-                fdb_notify(br, fdb, RTM_NEWNEIGH);
-        }
+        fdb = fdb_create(head, source, addr);
+        if (!fdb)
+                return -ENOMEM;
 
+        if (state & NUD_PERMANENT)
+                fdb->is_local = fdb->is_static = 1;
+        else if (state & NUD_NOARP)
+                fdb->is_static = 1;
         return 0;
 }
 
 /* Add new permanent fdb entry with RTM_NEWNEIGH */
-int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
-               struct net_device *dev,
-               const unsigned char *addr, u16 nlh_flags)
+int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 {
+        struct net *net = sock_net(skb->sk);
+        struct ndmsg *ndm;
+        struct nlattr *tb[NDA_MAX+1];
+        struct net_device *dev;
         struct net_bridge_port *p;
-        int err = 0;
+        const __u8 *addr;
+        int err;
 
-        if (!(ndm->ndm_state & (NUD_PERMANENT|NUD_NOARP|NUD_REACHABLE))) {
-                pr_info("bridge: RTM_NEWNEIGH with invalid state %#x\n", ndm->ndm_state);
+        ASSERT_RTNL();
+        err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
+        if (err < 0)
+                return err;
+
+        ndm = nlmsg_data(nlh);
+        if (ndm->ndm_ifindex == 0) {
+                pr_info("bridge: RTM_NEWNEIGH with invalid ifindex\n");
+                return -EINVAL;
+        }
+
+        dev = __dev_get_by_index(net, ndm->ndm_ifindex);
+        if (dev == NULL) {
+                pr_info("bridge: RTM_NEWNEIGH with unknown ifindex\n");
+                return -ENODEV;
+        }
+
+        if (!tb[NDA_LLADDR] || nla_len(tb[NDA_LLADDR]) != ETH_ALEN) {
+                pr_info("bridge: RTM_NEWNEIGH with invalid address\n");
+                return -EINVAL;
+        }
+
+        addr = nla_data(tb[NDA_LLADDR]);
+        if (!is_valid_ether_addr(addr)) {
+                pr_info("bridge: RTM_NEWNEIGH with invalid ether address\n");
                 return -EINVAL;
         }
 
@@ -627,15 +625,9 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 return -EINVAL;
         }
 
-        if (ndm->ndm_flags & NTF_USE) {
-                rcu_read_lock();
-                br_fdb_update(p->br, p, addr);
-                rcu_read_unlock();
-        } else {
-                spin_lock_bh(&p->br->hash_lock);
-                err = fdb_add_entry(p, addr, ndm->ndm_state, nlh_flags);
-                spin_unlock_bh(&p->br->hash_lock);
-        }
+        spin_lock_bh(&p->br->hash_lock);
+        err = fdb_add_entry(p, addr, ndm->ndm_state);
+        spin_unlock_bh(&p->br->hash_lock);
 
         return err;
 }
@@ -650,17 +642,45 @@ static int fdb_delete_by_addr(struct net_bridge_port *p, const u8 *addr)
         if (!fdb)
                 return -ENOENT;
 
-        fdb_delete(p->br, fdb);
+        fdb_delete(fdb);
         return 0;
 }
 
 /* Remove neighbor entry with RTM_DELNEIGH */
-int br_fdb_delete(struct ndmsg *ndm, struct net_device *dev,
-                  const unsigned char *addr)
+int br_fdb_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 {
+        struct net *net = sock_net(skb->sk);
+        struct ndmsg *ndm;
         struct net_bridge_port *p;
+        struct nlattr *llattr;
+        const __u8 *addr;
+        struct net_device *dev;
         int err;
 
+        ASSERT_RTNL();
+        if (nlmsg_len(nlh) < sizeof(*ndm))
+                return -EINVAL;
+
+        ndm = nlmsg_data(nlh);
+        if (ndm->ndm_ifindex == 0) {
+                pr_info("bridge: RTM_DELNEIGH with invalid ifindex\n");
+                return -EINVAL;
+        }
+
+        dev = __dev_get_by_index(net, ndm->ndm_ifindex);
+        if (dev == NULL) {
+                pr_info("bridge: RTM_DELNEIGH with unknown ifindex\n");
+                return -ENODEV;
+        }
+
+        llattr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_LLADDR);
+        if (llattr == NULL || nla_len(llattr) != ETH_ALEN) {
+                pr_info("bridge: RTM_DELNEIGH with invalid address\n");
+                return -EINVAL;
+        }
+
+        addr = nla_data(llattr);
+
         p = br_port_get_rtnl(dev);
         if (p == NULL) {
                 pr_info("bridge: RTM_DELNEIGH %s not a bridge port\n",