6 files changed, 136 insertions, 116 deletions

diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index da687c8dc6ff..7fa3a5a9971f 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -79,9 +79,14 @@ static int port_cost(struct net_device *dev)
  */
 static void port_carrier_check(void *arg)
 {
-        struct net_bridge_port *p = arg;
+        struct net_device *dev = arg;
+        struct net_bridge_port *p;
 
         rtnl_lock();
+        p = dev->br_port;
+        if (!p)
+                goto done;
+
         if (netif_carrier_ok(p->dev)) {
                 u32 cost = port_cost(p->dev);
 
@@ -97,19 +102,33 @@ static void port_carrier_check(void *arg)
                         br_stp_disable_port(p);
                 spin_unlock_bh(&p->br->lock);
         }
+done:
         rtnl_unlock();
 }
 
+static void release_nbp(struct kobject *kobj)
+{
+        struct net_bridge_port *p
+                = container_of(kobj, struct net_bridge_port, kobj);
+        kfree(p);
+}
+
+static struct kobj_type brport_ktype = {
+#ifdef CONFIG_SYSFS
+        .sysfs_ops = &brport_sysfs_ops,
+#endif
+        .release = release_nbp,
+};
+
 static void destroy_nbp(struct net_bridge_port *p)
 {
         struct net_device *dev = p->dev;
 
-        dev->br_port = NULL;
         p->br = NULL;
         p->dev = NULL;
         dev_put(dev);
 
-        br_sysfs_freeif(p);
+        kobject_put(&p->kobj);
 }
 
 static void destroy_nbp_rcu(struct rcu_head *head)
@@ -133,24 +152,24 @@ static void del_nbp(struct net_bridge_port *p)
         struct net_bridge *br = p->br;
         struct net_device *dev = p->dev;
 
-        /* Race between RTNL notify and RCU callback */
-        if (p->deleted)
-                return;
+        sysfs_remove_link(&br->ifobj, dev->name);
 
         dev_set_promiscuity(dev, -1);
 
         cancel_delayed_work(&p->carrier_check);
-        flush_scheduled_work();
 
         spin_lock_bh(&br->lock);
         br_stp_disable_port(p);
-        p->deleted = 1;
         spin_unlock_bh(&br->lock);
 
         br_fdb_delete_by_port(br, p);
 
         list_del_rcu(&p->list);
 
+        rcu_assign_pointer(dev->br_port, NULL);
+
+        kobject_del(&p->kobj);
+
         call_rcu(&p->rcu, destroy_nbp_rcu);
 }
 
@@ -160,7 +179,6 @@ static void del_br(struct net_bridge *br)
         struct net_bridge_port *p, *n;
 
         list_for_each_entry_safe(p, n, &br->port_list, list) {
-                br_sysfs_removeif(p);
                 del_nbp(p);
         }
 
@@ -254,13 +272,17 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
         p->dev = dev;
         p->path_cost = port_cost(dev);
         p->priority = 0x8000 >> BR_PORT_BITS;
-        dev->br_port = p;
         p->port_no = index;
         br_init_port(p);
         p->state = BR_STATE_DISABLED;
-        INIT_WORK(&p->carrier_check, port_carrier_check, p);
+        INIT_WORK(&p->carrier_check, port_carrier_check, dev);
         kobject_init(&p->kobj);
 
+        kobject_set_name(&p->kobj, SYSFS_BRIDGE_PORT_ATTR);
+        p->kobj.ktype = &brport_ktype;
+        p->kobj.parent = &(dev->class_dev.kobj);
+        p->kobj.kset = NULL;
+
         return p;
 }
 
@@ -388,30 +410,43 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         if (dev->br_port != NULL)
                 return -EBUSY;
 
-        if (IS_ERR(p = new_nbp(br, dev)))
+        p = new_nbp(br, dev);
+        if (IS_ERR(p))
                 return PTR_ERR(p);
 
-        if ((err = br_fdb_insert(br, p, dev->dev_addr)))
-                destroy_nbp(p);
- 
-        else if ((err = br_sysfs_addif(p)))
-                del_nbp(p);
-        else {
-                dev_set_promiscuity(dev, 1);
+        err = kobject_add(&p->kobj);
+        if (err)
+                goto err0;
 
-                list_add_rcu(&p->list, &br->port_list);
+        err = br_fdb_insert(br, p, dev->dev_addr);
+        if (err)
+                goto err1;
 
-                spin_lock_bh(&br->lock);
-                br_stp_recalculate_bridge_id(br);
-                br_features_recompute(br);
-                if ((br->dev->flags & IFF_UP) 
-                    && (dev->flags & IFF_UP) && netif_carrier_ok(dev))
-                        br_stp_enable_port(p);
-                spin_unlock_bh(&br->lock);
+        err = br_sysfs_addif(p);
+        if (err)
+                goto err2;
 
-                dev_set_mtu(br->dev, br_min_mtu(br));
-        }
+        rcu_assign_pointer(dev->br_port, p);
+        dev_set_promiscuity(dev, 1);
+
+        list_add_rcu(&p->list, &br->port_list);
 
+        spin_lock_bh(&br->lock);
+        br_stp_recalculate_bridge_id(br);
+        br_features_recompute(br);
+        schedule_delayed_work(&p->carrier_check, BR_PORT_DEBOUNCE);
+        spin_unlock_bh(&br->lock);
+
+        dev_set_mtu(br->dev, br_min_mtu(br));
+        kobject_uevent(&p->kobj, KOBJ_ADD);
+
+        return 0;
+err2:
+        br_fdb_delete_by_port(br, p);
+err1:
+        kobject_del(&p->kobj);
+err0:
+        kobject_put(&p->kobj);
         return err;
 }
 
@@ -423,7 +458,6 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         if (!p || p->br != br) 
                 return -EINVAL;
 
-        br_sysfs_removeif(p);
         del_nbp(p);
 
         spin_lock_bh(&br->lock);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index e3a73cead6b6..4eef83755315 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -45,18 +45,20 @@ static void br_pass_frame_up(struct net_bridge *br, struct sk_buff *skb)
 int br_handle_frame_finish(struct sk_buff *skb)
 {
         const unsigned char *dest = eth_hdr(skb)->h_dest;
-        struct net_bridge_port *p = skb->dev->br_port;
-        struct net_bridge *br = p->br;
+        struct net_bridge_port *p = rcu_dereference(skb->dev->br_port);
+        struct net_bridge *br;
         struct net_bridge_fdb_entry *dst;
         int passedup = 0;
 
+        if (!p || p->state == BR_STATE_DISABLED)
+                goto drop;
+
         /* insert into forwarding database after filtering to avoid spoofing */
-        br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
+        br = p->br;
+        br_fdb_update(br, p, eth_hdr(skb)->h_source);
 
-        if (p->state == BR_STATE_LEARNING) {
-                kfree_skb(skb);
-                goto out;
-        }
+        if (p->state == BR_STATE_LEARNING)
+                goto drop;
 
         if (br->dev->flags & IFF_PROMISC) {
                 struct sk_buff *skb2;
@@ -93,6 +95,9 @@ int br_handle_frame_finish(struct sk_buff *skb)
 
 out:
         return 0;
+drop:
+        kfree_skb(skb);
+        goto out;
 }
 
 /*
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 7cac3fb9f809..b5018166b0e5 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -51,9 +51,6 @@
 #define store_orig_dstaddr(skb)  (skb_origaddr(skb) = (skb)->nh.iph->daddr)
 #define dnat_took_place(skb)     (skb_origaddr(skb) != (skb)->nh.iph->daddr)
 
-#define has_bridge_parent(device)       ((device)->br_port != NULL)
-#define bridge_parent(device)           ((device)->br_port->br->dev)
-
 #ifdef CONFIG_SYSCTL
 static struct ctl_table_header *brnf_sysctl_header;
 static int brnf_call_iptables = 1;
@@ -98,6 +95,12 @@ static struct rtable __fake_rtable = {
         .rt_flags       = 0,
 };
 
+static inline struct net_device *bridge_parent(const struct net_device *dev)
+{
+        struct net_bridge_port *port = rcu_dereference(dev->br_port);
+
+        return port ? port->br->dev : NULL;
+}
 
 /* PF_BRIDGE/PRE_ROUTING *********************************************/
 /* Undo the changes made for ip6tables PREROUTING and continue the
@@ -189,11 +192,15 @@ static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
         skb->nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
 
         skb->dev = bridge_parent(skb->dev);
-        if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
-                skb_pull(skb, VLAN_HLEN);
-                skb->nh.raw += VLAN_HLEN;
+        if (!skb->dev)
+                kfree_skb(skb);
+        else {
+                if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
+                        skb_pull(skb, VLAN_HLEN);
+                        skb->nh.raw += VLAN_HLEN;
+                }
+                skb->dst->output(skb);
         }
-        skb->dst->output(skb);
         return 0;
 }
 
@@ -270,7 +277,7 @@ bridged_dnat:
 }
 
 /* Some common code for IPv4/IPv6 */
-static void setup_pre_routing(struct sk_buff *skb)
+static struct net_device *setup_pre_routing(struct sk_buff *skb)
 {
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
 
@@ -282,6 +289,8 @@ static void setup_pre_routing(struct sk_buff *skb)
         nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
         nf_bridge->physindev = skb->dev;
         skb->dev = bridge_parent(skb->dev);
+
+        return skb->dev;
 }
 
 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff anyway */
@@ -376,7 +385,8 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
         nf_bridge_put(skb->nf_bridge);
         if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                 return NF_DROP;
-        setup_pre_routing(skb);
+        if (!setup_pre_routing(skb))
+                return NF_DROP;
 
         NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
                 br_nf_pre_routing_finish_ipv6);
@@ -465,7 +475,8 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
         nf_bridge_put(skb->nf_bridge);
         if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                 return NF_DROP;
-        setup_pre_routing(skb);
+        if (!setup_pre_routing(skb))
+                return NF_DROP;
         store_orig_dstaddr(skb);
 
         NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
@@ -539,11 +550,16 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
         struct sk_buff *skb = *pskb;
         struct nf_bridge_info *nf_bridge;
         struct vlan_ethhdr *hdr = vlan_eth_hdr(skb);
+        struct net_device *parent;
         int pf;
 
         if (!skb->nf_bridge)
                 return NF_ACCEPT;
 
+        parent = bridge_parent(out);
+        if (!parent)
+                return NF_DROP;
+
         if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
                 pf = PF_INET;
         else
@@ -564,8 +580,8 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
         nf_bridge->mask |= BRNF_BRIDGED;
         nf_bridge->physoutdev = skb->dev;
 
-        NF_HOOK(pf, NF_IP_FORWARD, skb, bridge_parent(in),
-                bridge_parent(out), br_nf_forward_finish);
+        NF_HOOK(pf, NF_IP_FORWARD, skb, bridge_parent(in), parent,
+                br_nf_forward_finish);
 
         return NF_STOLEN;
 }
@@ -688,6 +704,8 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
                 goto out;
         }
         realoutdev = bridge_parent(skb->dev);
+        if (!realoutdev)
+                return NF_DROP;
 
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
         /* iptables should match -o br0.x */
@@ -701,9 +719,11 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
         /* IP forwarded traffic has a physindev, locally
          * generated traffic hasn't. */
         if (realindev != NULL) {
-                if (!(nf_bridge->mask & BRNF_DONT_TAKE_PARENT) &&
-                    has_bridge_parent(realindev))
-                        realindev = bridge_parent(realindev);
+                if (!(nf_bridge->mask & BRNF_DONT_TAKE_PARENT) ) {
+                        struct net_device *parent = bridge_parent(realindev);
+                        if (parent)
+                                realindev = parent;
+                }
 
                 NF_HOOK_THRESH(pf, NF_IP_FORWARD, skb, realindev,
                                realoutdev, br_nf_local_out_finish,
@@ -743,6 +763,9 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
         if (!nf_bridge)
                 return NF_ACCEPT;
 
+        if (!realoutdev)
+                return NF_DROP;
+
         if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
                 pf = PF_INET;
         else
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index e330b17b6d81..8f10e09f251b 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -68,7 +68,6 @@ struct net_bridge_port
         /* STP */
         u8                              priority;
         u8                              state;
-        u8                              deleted;
         u16                             port_no;
         unsigned char                   topology_change_ack;
         unsigned char                   config_pending;
@@ -233,9 +232,8 @@ extern void (*br_fdb_put_hook)(struct net_bridge_fdb_entry *ent);
 
 #ifdef CONFIG_SYSFS
 /* br_sysfs_if.c */
+extern struct sysfs_ops brport_sysfs_ops;
 extern int br_sysfs_addif(struct net_bridge_port *p);
-extern void br_sysfs_removeif(struct net_bridge_port *p);
-extern void br_sysfs_freeif(struct net_bridge_port *p);
 
 /* br_sysfs_br.c */
 extern int br_sysfs_addbr(struct net_device *dev);
@@ -244,8 +242,6 @@ extern void br_sysfs_delbr(struct net_device *dev);
 #else
 
 #define br_sysfs_addif(p)       (0)
-#define br_sysfs_removeif(p)    do { } while(0)
-#define br_sysfs_freeif(p)      kfree(p)
 #define br_sysfs_addbr(dev)     (0)
 #define br_sysfs_delbr(dev)     do { } while(0)
 #endif /* CONFIG_SYSFS */
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index d071f1c9ad0b..296f6a487c52 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -133,29 +133,35 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
 
 static const unsigned char header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
 
-/* NO locks */
+/* NO locks, but rcu_read_lock (preempt_disabled)  */
 int br_stp_handle_bpdu(struct sk_buff *skb)
 {
-        struct net_bridge_port *p = skb->dev->br_port;
-        struct net_bridge *br = p->br;
+        struct net_bridge_port *p = rcu_dereference(skb->dev->br_port);
+        struct net_bridge *br;
         unsigned char *buf;
 
+        if (!p)
+                goto err;
+
+        br = p->br;
+        spin_lock(&br->lock);
+
+        if (p->state == BR_STATE_DISABLED || !(br->dev->flags & IFF_UP))
+                goto out;
+
         /* insert into forwarding database after filtering to avoid spoofing */
-        br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
+        br_fdb_update(br, p, eth_hdr(skb)->h_source);
+
+        if (!br->stp_enabled)
+                goto out;
 
         /* need at least the 802 and STP headers */
         if (!pskb_may_pull(skb, sizeof(header)+1) ||
             memcmp(skb->data, header, sizeof(header)))
-                goto err;
+                goto out;
 
         buf = skb_pull(skb, sizeof(header));
 
-        spin_lock_bh(&br->lock);
-        if (p->state == BR_STATE_DISABLED 
-            || !(br->dev->flags & IFF_UP)
-            || !br->stp_enabled)
-                goto out;
-
         if (buf[0] == BPDU_TYPE_CONFIG) {
                 struct br_config_bpdu bpdu;
 
@@ -201,7 +207,7 @@ int br_stp_handle_bpdu(struct sk_buff *skb)
                 br_received_tcn_bpdu(p);
         }
  out:
-        spin_unlock_bh(&br->lock);
+        spin_unlock(&br->lock);
  err:
         kfree_skb(skb);
         return 0;
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 0ac0355d16dd..c51c9e42aeb3 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -195,23 +195,11 @@ static ssize_t brport_store(struct kobject * kobj,
         return ret;
 }
 
-/* called from kobject_put when port ref count goes to zero. */
-static void brport_release(struct kobject *kobj)
-{
-        kfree(container_of(kobj, struct net_bridge_port, kobj));
-}
-
-static struct sysfs_ops brport_sysfs_ops = {
+struct sysfs_ops brport_sysfs_ops = {
         .show = brport_show,
         .store = brport_store,
 };
 
-static struct kobj_type brport_ktype = {
-        .sysfs_ops = &brport_sysfs_ops,
-        .release = brport_release,
-};
-
-
 /*
  * Add sysfs entries to ethernet device added to a bridge.
  * Creates a brport subdirectory with bridge attributes.
@@ -223,17 +211,6 @@ int br_sysfs_addif(struct net_bridge_port *p)
         struct brport_attribute **a;
         int err;
 
-        ASSERT_RTNL();
-
-        kobject_set_name(&p->kobj, SYSFS_BRIDGE_PORT_ATTR);
-        p->kobj.ktype = &brport_ktype;
-        p->kobj.parent = &(p->dev->class_dev.kobj);
-        p->kobj.kset = NULL;
-
-        err = kobject_add(&p->kobj);
-        if(err)
-                goto out1;
-
         err = sysfs_create_link(&p->kobj, &br->dev->class_dev.kobj, 
                                 SYSFS_BRIDGE_PORT_LINK);
         if (err)
@@ -245,28 +222,7 @@ int br_sysfs_addif(struct net_bridge_port *p)
                         goto out2;
         }
 
-        err = sysfs_create_link(&br->ifobj, &p->kobj, p->dev->name);
-        if (err)
-                goto out2;
-
-        kobject_uevent(&p->kobj, KOBJ_ADD);
-        return 0;
- out2:
-        kobject_del(&p->kobj);
- out1:
+        err= sysfs_create_link(&br->ifobj, &p->kobj, p->dev->name);
+out2:
         return err;
 }
-
-void br_sysfs_removeif(struct net_bridge_port *p)
-{
-        pr_debug("br_sysfs_removeif\n");
-        sysfs_remove_link(&p->br->ifobj, p->dev->name);
-        kobject_uevent(&p->kobj, KOBJ_REMOVE);
-        kobject_del(&p->kobj);
-}
-
-void br_sysfs_freeif(struct net_bridge_port *p)
-{
-        pr_debug("br_sysfs_freeif\n");
-        kobject_put(&p->kobj);
-}