1 files changed, 94 insertions, 44 deletions

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 76c08402c933..2a4bb76f2132 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -71,6 +71,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/types.h>
@@ -311,7 +312,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
                 return NULL;
         }
 
-        skb_dst_set(skb, &rt->u.dst);
+        skb_dst_set(skb, &rt->dst);
         skb->dev = dev;
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
@@ -329,7 +330,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         pip->saddr    = rt->rt_src;
         pip->protocol = IPPROTO_IGMP;
         pip->tot_len  = 0;      /* filled in later */
-        ip_select_ident(pip, &rt->u.dst, NULL);
+        ip_select_ident(pip, &rt->dst, NULL);
         ((u8*)&pip[1])[0] = IPOPT_RA;
         ((u8*)&pip[1])[1] = 4;
         ((u8*)&pip[1])[2] = 0;
@@ -659,7 +660,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
                 return -1;
         }
 
-        skb_dst_set(skb, &rt->u.dst);
+        skb_dst_set(skb, &rt->dst);
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 
@@ -675,7 +676,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         iph->daddr    = dst;
         iph->saddr    = rt->rt_src;
         iph->protocol = IPPROTO_IGMP;
-        ip_select_ident(iph, &rt->u.dst, NULL);
+        ip_select_ident(iph, &rt->dst, NULL);
         ((u8*)&iph[1])[0] = IPOPT_RA;
         ((u8*)&iph[1])[1] = 4;
         ((u8*)&iph[1])[2] = 0;
@@ -855,6 +856,18 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                 igmpv3_clear_delrec(in_dev);
         } else if (len < 12) {
                 return; /* ignore bogus packet; freed by caller */
+        } else if (IGMP_V1_SEEN(in_dev)) {
+                /* This is a v3 query with v1 queriers present */
+                max_delay = IGMP_Query_Response_Interval;
+                group = 0;
+        } else if (IGMP_V2_SEEN(in_dev)) {
+                /* this is a v3 query with v2 queriers present;
+                 * Interpretation of the max_delay code is problematic here.
+                 * A real v2 host would use ih_code directly, while v3 has a
+                 * different encoding. We use the v3 encoding as more likely
+                 * to be intended in a v3 query.
+                 */
+                max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
         } else { /* v3 */
                 if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
                         return;
@@ -915,18 +928,19 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
         read_unlock(&in_dev->mc_list_lock);
 }
 
+/* called in rcu_read_lock() section */
 int igmp_rcv(struct sk_buff *skb)
 {
         /* This basically follows the spec line by line -- see RFC1112 */
         struct igmphdr *ih;
-        struct in_device *in_dev = in_dev_get(skb->dev);
+        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
         int len = skb->len;
 
         if (in_dev == NULL)
                 goto drop;
 
         if (!pskb_may_pull(skb, sizeof(struct igmphdr)))
-                goto drop_ref;
+                goto drop;
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
@@ -936,7 +950,7 @@ int igmp_rcv(struct sk_buff *skb)
         case CHECKSUM_NONE:
                 skb->csum = 0;
                 if (__skb_checksum_complete(skb))
-                        goto drop_ref;
+                        goto drop;
         }
 
         ih = igmp_hdr(skb);
@@ -946,7 +960,6 @@ int igmp_rcv(struct sk_buff *skb)
                 break;
         case IGMP_HOST_MEMBERSHIP_REPORT:
         case IGMPV2_HOST_MEMBERSHIP_REPORT:
-        case IGMPV3_HOST_MEMBERSHIP_REPORT:
                 /* Is it our report looped back? */
                 if (skb_rtable(skb)->fl.iif == 0)
                         break;
@@ -957,9 +970,9 @@ int igmp_rcv(struct sk_buff *skb)
                 break;
         case IGMP_PIM:
 #ifdef CONFIG_IP_PIMSM_V1
-                in_dev_put(in_dev);
                 return pim_rcv_v1(skb);
 #endif
+        case IGMPV3_HOST_MEMBERSHIP_REPORT:
         case IGMP_DVMRP:
         case IGMP_TRACE:
         case IGMP_HOST_LEAVE_MESSAGE:
@@ -970,8 +983,6 @@ int igmp_rcv(struct sk_buff *skb)
                 break;
         }
 
-drop_ref:
-        in_dev_put(in_dev);
 drop:
         kfree_skb(skb);
         return 0;
@@ -997,7 +1008,7 @@ static void ip_mc_filter_add(struct in_device *in_dev, __be32 addr)
            --ANK
            */
         if (arp_mc_map(addr, buf, dev, 0) == 0)
-                dev_mc_add(dev, buf, dev->addr_len, 0);
+                dev_mc_add(dev, buf);
 }
 
 /*
@@ -1010,7 +1021,7 @@ static void ip_mc_filter_del(struct in_device *in_dev, __be32 addr)
         struct net_device *dev = in_dev->dev;
 
         if (arp_mc_map(addr, buf, dev, 0) == 0)
-                dev_mc_delete(dev, buf, dev->addr_len, 0);
+                dev_mc_del(dev, buf);
 }
 
 #ifdef CONFIG_IP_MULTICAST
@@ -1245,6 +1256,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 out:
         return;
 }
+EXPORT_SYMBOL(ip_mc_inc_group);
 
 /*
  *      Resend IGMP JOIN report; used for bonding.
@@ -1267,6 +1279,7 @@ void ip_mc_rejoin_group(struct ip_mc_list *im)
         igmp_ifc_event(in_dev);
 #endif
 }
+EXPORT_SYMBOL(ip_mc_rejoin_group);
 
 /*
  *      A socket has left a multicast group on device dev
@@ -1297,6 +1310,7 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
                 }
         }
 }
+EXPORT_SYMBOL(ip_mc_dec_group);
 
 /* Device changing type */
 
@@ -1426,7 +1440,7 @@ static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
         }
 
         if (!dev && !ip_route_output_key(net, &rt, &fl)) {
-                dev = rt->u.dst.dev;
+                dev = rt->dst.dev;
                 ip_rt_put(rt);
         }
         if (dev) {
@@ -1645,8 +1659,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                                 if (dpsf->sf_inaddr == psf->sf_inaddr)
                                         break;
                         if (!dpsf) {
-                                dpsf = (struct ip_sf_list *)
-                                        kmalloc(sizeof(*dpsf), GFP_ATOMIC);
+                                dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
                                 if (!dpsf)
                                         continue;
                                 *dpsf = *psf;
@@ -1799,32 +1812,55 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
         iml->next = inet->mc_list;
         iml->sflist = NULL;
         iml->sfmode = MCAST_EXCLUDE;
-        inet->mc_list = iml;
+        rcu_assign_pointer(inet->mc_list, iml);
         ip_mc_inc_group(in_dev, addr);
         err = 0;
 done:
         rtnl_unlock();
         return err;
 }
+EXPORT_SYMBOL(ip_mc_join_group);
+
+static void ip_sf_socklist_reclaim(struct rcu_head *rp)
+{
+        struct ip_sf_socklist *psf;
+
+        psf = container_of(rp, struct ip_sf_socklist, rcu);
+        /* sk_omem_alloc should have been decreased by the caller*/
+        kfree(psf);
+}
 
 static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
                            struct in_device *in_dev)
 {
+        struct ip_sf_socklist *psf = iml->sflist;
         int err;
 
-        if (iml->sflist == NULL) {
+        if (psf == NULL) {
                 /* any-source empty exclude case */
                 return ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
                         iml->sfmode, 0, NULL, 0);
         }
         err = ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
-                        iml->sfmode, iml->sflist->sl_count,
-                        iml->sflist->sl_addr, 0);
-        sock_kfree_s(sk, iml->sflist, IP_SFLSIZE(iml->sflist->sl_max));
-        iml->sflist = NULL;
+                        iml->sfmode, psf->sl_count, psf->sl_addr, 0);
+        rcu_assign_pointer(iml->sflist, NULL);
+        /* decrease mem now to avoid the memleak warning */
+        atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);
+        call_rcu(&psf->rcu, ip_sf_socklist_reclaim);
         return err;
 }
 
+
+static void ip_mc_socklist_reclaim(struct rcu_head *rp)
+{
+        struct ip_mc_socklist *iml;
+
+        iml = container_of(rp, struct ip_mc_socklist, rcu);
+        /* sk_omem_alloc should have been decreased by the caller*/
+        kfree(iml);
+}
+
+
 /*
  *      Ask a socket to leave a group.
  */
@@ -1854,12 +1890,14 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
 
                 (void) ip_mc_leave_src(sk, iml, in_dev);
 
-                *imlp = iml->next;
+                rcu_assign_pointer(*imlp, iml->next);
 
                 if (in_dev)
                         ip_mc_dec_group(in_dev, group);
                 rtnl_unlock();
-                sock_kfree_s(sk, iml, sizeof(*iml));
+                /* decrease mem now to avoid the memleak warning */
+                atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
+                call_rcu(&iml->rcu, ip_mc_socklist_reclaim);
                 return 0;
         }
         if (!in_dev)
@@ -1974,9 +2012,12 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 if (psl) {
                         for (i=0; i<psl->sl_count; i++)
                                 newpsl->sl_addr[i] = psl->sl_addr[i];
-                        sock_kfree_s(sk, psl, IP_SFLSIZE(psl->sl_max));
+                        /* decrease mem now to avoid the memleak warning */
+                        atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+                        call_rcu(&psl->rcu, ip_sf_socklist_reclaim);
                 }
-                pmc->sflist = psl = newpsl;
+                rcu_assign_pointer(pmc->sflist, newpsl);
+                psl = newpsl;
         }
         rv = 1; /* > 0 for insert logic below if sl_count is 0 */
         for (i=0; i<psl->sl_count; i++) {
@@ -2072,11 +2113,13 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
         if (psl) {
                 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
                         psl->sl_count, psl->sl_addr, 0);
-                sock_kfree_s(sk, psl, IP_SFLSIZE(psl->sl_max));
+                /* decrease mem now to avoid the memleak warning */
+                atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+                call_rcu(&psl->rcu, ip_sf_socklist_reclaim);
         } else
                 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
                         0, NULL, 0);
-        pmc->sflist = newpsl;
+        rcu_assign_pointer(pmc->sflist, newpsl);
         pmc->sfmode = msf->imsf_fmode;
         err = 0;
 done:
@@ -2209,30 +2252,40 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
         struct ip_mc_socklist *pmc;
         struct ip_sf_socklist *psl;
         int i;
+        int ret;
 
+        ret = 1;
         if (!ipv4_is_multicast(loc_addr))
-                return 1;
+                goto out;
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        rcu_read_lock();
+        for (pmc=rcu_dereference(inet->mc_list); pmc; pmc=rcu_dereference(pmc->next)) {
                 if (pmc->multi.imr_multiaddr.s_addr == loc_addr &&
                     pmc->multi.imr_ifindex == dif)
                         break;
         }
+        ret = inet->mc_all;
         if (!pmc)
-                return inet->mc_all;
+                goto unlock;
         psl = pmc->sflist;
+        ret = (pmc->sfmode == MCAST_EXCLUDE);
         if (!psl)
-                return pmc->sfmode == MCAST_EXCLUDE;
+                goto unlock;
 
         for (i=0; i<psl->sl_count; i++) {
                 if (psl->sl_addr[i] == rmt_addr)
                         break;
         }
+        ret = 0;
         if (pmc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
-                return 0;
+                goto unlock;
         if (pmc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
-                return 0;
-        return 1;
+                goto unlock;
+        ret = 1;
+unlock:
+        rcu_read_unlock();
+out:
+        return ret;
 }
 
 /*
@@ -2251,7 +2304,7 @@ void ip_mc_drop_socket(struct sock *sk)
         rtnl_lock();
         while ((iml = inet->mc_list) != NULL) {
                 struct in_device *in_dev;
-                inet->mc_list = iml->next;
+                rcu_assign_pointer(inet->mc_list, iml->next);
 
                 in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
                 (void) ip_mc_leave_src(sk, iml, in_dev);
@@ -2259,7 +2312,9 @@ void ip_mc_drop_socket(struct sock *sk)
                         ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
                         in_dev_put(in_dev);
                 }
-                sock_kfree_s(sk, iml, sizeof(*iml));
+                /* decrease mem now to avoid the memleak warning */
+                atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
+                call_rcu(&iml->rcu, ip_mc_socklist_reclaim);
         }
         rtnl_unlock();
 }
@@ -2603,7 +2658,7 @@ static const struct file_operations igmp_mcf_seq_fops = {
         .release        =       seq_release_net,
 };
 
-static int igmp_net_init(struct net *net)
+static int __net_init igmp_net_init(struct net *net)
 {
         struct proc_dir_entry *pde;
 
@@ -2621,7 +2676,7 @@ out_igmp:
         return -ENOMEM;
 }
 
-static void igmp_net_exit(struct net *net)
+static void __net_exit igmp_net_exit(struct net *net)
 {
         proc_net_remove(net, "mcfilter");
         proc_net_remove(net, "igmp");
@@ -2637,8 +2692,3 @@ int __init igmp_mc_proc_init(void)
         return register_pernet_subsys(&igmp_net_ops);
 }
 #endif
-
-EXPORT_SYMBOL(ip_mc_dec_group);
-EXPORT_SYMBOL(ip_mc_inc_group);
-EXPORT_SYMBOL(ip_mc_join_group);
-EXPORT_SYMBOL(ip_mc_rejoin_group);