1 files changed, 140 insertions, 27 deletions

diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index bc1704ac6cd9..7a241c396981 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -11,6 +11,8 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+#include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
@@ -18,6 +20,11 @@
 #include <linux/netfilter_bridge.h>
 #include "br_private.h"
 
+static int deliver_clone(const struct net_bridge_port *prev,
+                         struct sk_buff *skb,
+                         void (*__packet_hook)(const struct net_bridge_port *p,
+                                               struct sk_buff *skb));
+
 /* Don't forward packets to originating port or forwarding diasabled */
 static inline int should_deliver(const struct net_bridge_port *p,
                                  const struct sk_buff *skb)
@@ -93,61 +100,167 @@ void br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 }
 
 /* called with rcu_read_lock */
-void br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
+void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, struct sk_buff *skb0)
 {
         if (should_deliver(to, skb)) {
-                __br_forward(to, skb);
+                if (skb0)
+                        deliver_clone(to, skb, __br_forward);
+                else
+                        __br_forward(to, skb);
                 return;
         }
 
-        kfree_skb(skb);
+        if (!skb0)
+                kfree_skb(skb);
 }
 
-/* called under bridge lock */
-static void br_flood(struct net_bridge *br, struct sk_buff *skb,
+static int deliver_clone(const struct net_bridge_port *prev,
+                         struct sk_buff *skb,
+                         void (*__packet_hook)(const struct net_bridge_port *p,
+                                               struct sk_buff *skb))
+{
+        skb = skb_clone(skb, GFP_ATOMIC);
+        if (!skb) {
+                struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
+
+                dev->stats.tx_dropped++;
+                return -ENOMEM;
+        }
+
+        __packet_hook(prev, skb);
+        return 0;
+}
+
+static struct net_bridge_port *maybe_deliver(
+        struct net_bridge_port *prev, struct net_bridge_port *p,
+        struct sk_buff *skb,
         void (*__packet_hook)(const struct net_bridge_port *p,
                               struct sk_buff *skb))
 {
+        int err;
+
+        if (!should_deliver(p, skb))
+                return prev;
+
+        if (!prev)
+                goto out;
+
+        err = deliver_clone(prev, skb, __packet_hook);
+        if (err)
+                return ERR_PTR(err);
+
+out:
+        return p;
+}
+
+/* called under bridge lock */
+static void br_flood(struct net_bridge *br, struct sk_buff *skb,
+                     struct sk_buff *skb0,
+                     void (*__packet_hook)(const struct net_bridge_port *p,
+                                           struct sk_buff *skb))
+{
         struct net_bridge_port *p;
         struct net_bridge_port *prev;
 
         prev = NULL;
 
         list_for_each_entry_rcu(p, &br->port_list, list) {
-                if (should_deliver(p, skb)) {
-                        if (prev != NULL) {
-                                struct sk_buff *skb2;
-
-                                if ((skb2 = skb_clone(skb, GFP_ATOMIC)) == NULL) {
-                                        br->dev->stats.tx_dropped++;
-                                        kfree_skb(skb);
-                                        return;
-                                }
-
-                                __packet_hook(prev, skb2);
-                        }
-
-                        prev = p;
-                }
+                prev = maybe_deliver(prev, p, skb, __packet_hook);
+                if (IS_ERR(prev))
+                        goto out;
         }
 
-        if (prev != NULL) {
+        if (!prev)
+                goto out;
+
+        if (skb0)
+                deliver_clone(prev, skb, __packet_hook);
+        else
                 __packet_hook(prev, skb);
-                return;
-        }
+        return;
 
-        kfree_skb(skb);
+out:
+        if (!skb0)
+                kfree_skb(skb);
 }
 
 
 /* called with rcu_read_lock */
 void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb)
 {
-        br_flood(br, skb, __br_deliver);
+        br_flood(br, skb, NULL, __br_deliver);
 }
 
 /* called under bridge lock */
-void br_flood_forward(struct net_bridge *br, struct sk_buff *skb)
+void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
+                      struct sk_buff *skb2)
+{
+        br_flood(br, skb, skb2, __br_forward);
+}
+
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+/* called with rcu_read_lock */
+static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
+                               struct sk_buff *skb, struct sk_buff *skb0,
+                               void (*__packet_hook)(
+                                        const struct net_bridge_port *p,
+                                        struct sk_buff *skb))
+{
+        struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
+        struct net_bridge *br = netdev_priv(dev);
+        struct net_bridge_port *port;
+        struct net_bridge_port *lport, *rport;
+        struct net_bridge_port *prev;
+        struct net_bridge_port_group *p;
+        struct hlist_node *rp;
+
+        prev = NULL;
+
+        rp = br->router_list.first;
+        p = mdst ? mdst->ports : NULL;
+        while (p || rp) {
+                lport = p ? p->port : NULL;
+                rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) :
+                             NULL;
+
+                port = (unsigned long)lport > (unsigned long)rport ?
+                       lport : rport;
+
+                prev = maybe_deliver(prev, port, skb, __packet_hook);
+                if (IS_ERR(prev))
+                        goto out;
+
+                if ((unsigned long)lport >= (unsigned long)port)
+                        p = p->next;
+                if ((unsigned long)rport >= (unsigned long)port)
+                        rp = rp->next;
+        }
+
+        if (!prev)
+                goto out;
+
+        if (skb0)
+                deliver_clone(prev, skb, __packet_hook);
+        else
+                __packet_hook(prev, skb);
+        return;
+
+out:
+        if (!skb0)
+                kfree_skb(skb);
+}
+
+/* called with rcu_read_lock */
+void br_multicast_deliver(struct net_bridge_mdb_entry *mdst,
+                          struct sk_buff *skb)
+{
+        br_multicast_flood(mdst, skb, NULL, __br_deliver);
+}
+
+/* called with rcu_read_lock */
+void br_multicast_forward(struct net_bridge_mdb_entry *mdst,
+                          struct sk_buff *skb, struct sk_buff *skb2)
 {
-        br_flood(br, skb, __br_forward);
+        br_multicast_flood(mdst, skb, skb2, __br_forward);
 }
+#endif