xref: /openbmc/linux/net/bridge/br_multicast.c (revision f0931824)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Bridge multicast support.
4  *
5  * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au>
6  */
7 
8 #include <linux/err.h>
9 #include <linux/export.h>
10 #include <linux/if_ether.h>
11 #include <linux/igmp.h>
12 #include <linux/in.h>
13 #include <linux/jhash.h>
14 #include <linux/kernel.h>
15 #include <linux/log2.h>
16 #include <linux/netdevice.h>
17 #include <linux/netfilter_bridge.h>
18 #include <linux/random.h>
19 #include <linux/rculist.h>
20 #include <linux/skbuff.h>
21 #include <linux/slab.h>
22 #include <linux/timer.h>
23 #include <linux/inetdevice.h>
24 #include <linux/mroute.h>
25 #include <net/ip.h>
26 #include <net/switchdev.h>
27 #if IS_ENABLED(CONFIG_IPV6)
28 #include <linux/icmpv6.h>
29 #include <net/ipv6.h>
30 #include <net/mld.h>
31 #include <net/ip6_checksum.h>
32 #include <net/addrconf.h>
33 #endif
34 #include <trace/events/bridge.h>
35 
36 #include "br_private.h"
37 #include "br_private_mcast_eht.h"
38 
39 static const struct rhashtable_params br_mdb_rht_params = {
40 	.head_offset = offsetof(struct net_bridge_mdb_entry, rhnode),
41 	.key_offset = offsetof(struct net_bridge_mdb_entry, addr),
42 	.key_len = sizeof(struct br_ip),
43 	.automatic_shrinking = true,
44 };
45 
46 static const struct rhashtable_params br_sg_port_rht_params = {
47 	.head_offset = offsetof(struct net_bridge_port_group, rhnode),
48 	.key_offset = offsetof(struct net_bridge_port_group, key),
49 	.key_len = sizeof(struct net_bridge_port_group_sg_key),
50 	.automatic_shrinking = true,
51 };
52 
53 static void br_multicast_start_querier(struct net_bridge_mcast *brmctx,
54 				       struct bridge_mcast_own_query *query);
55 static void br_ip4_multicast_add_router(struct net_bridge_mcast *brmctx,
56 					struct net_bridge_mcast_port *pmctx);
57 static void br_ip4_multicast_leave_group(struct net_bridge_mcast *brmctx,
58 					 struct net_bridge_mcast_port *pmctx,
59 					 __be32 group,
60 					 __u16 vid,
61 					 const unsigned char *src);
62 static void br_multicast_port_group_rexmit(struct timer_list *t);
63 
64 static void
65 br_multicast_rport_del_notify(struct net_bridge_mcast_port *pmctx, bool deleted);
66 static void br_ip6_multicast_add_router(struct net_bridge_mcast *brmctx,
67 					struct net_bridge_mcast_port *pmctx);
68 #if IS_ENABLED(CONFIG_IPV6)
69 static void br_ip6_multicast_leave_group(struct net_bridge_mcast *brmctx,
70 					 struct net_bridge_mcast_port *pmctx,
71 					 const struct in6_addr *group,
72 					 __u16 vid, const unsigned char *src);
73 #endif
74 static struct net_bridge_port_group *
75 __br_multicast_add_group(struct net_bridge_mcast *brmctx,
76 			 struct net_bridge_mcast_port *pmctx,
77 			 struct br_ip *group,
78 			 const unsigned char *src,
79 			 u8 filter_mode,
80 			 bool igmpv2_mldv1,
81 			 bool blocked);
82 static void br_multicast_find_del_pg(struct net_bridge *br,
83 				     struct net_bridge_port_group *pg);
84 static void __br_multicast_stop(struct net_bridge_mcast *brmctx);
85 
86 static int br_mc_disabled_update(struct net_device *dev, bool value,
87 				 struct netlink_ext_ack *extack);
88 
89 static struct net_bridge_port_group *
90 br_sg_port_find(struct net_bridge *br,
91 		struct net_bridge_port_group_sg_key *sg_p)
92 {
93 	lockdep_assert_held_once(&br->multicast_lock);
94 
95 	return rhashtable_lookup_fast(&br->sg_port_tbl, sg_p,
96 				      br_sg_port_rht_params);
97 }
98 
99 static struct net_bridge_mdb_entry *br_mdb_ip_get_rcu(struct net_bridge *br,
100 						      struct br_ip *dst)
101 {
102 	return rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
103 }
104 
105 struct net_bridge_mdb_entry *br_mdb_ip_get(struct net_bridge *br,
106 					   struct br_ip *dst)
107 {
108 	struct net_bridge_mdb_entry *ent;
109 
110 	lockdep_assert_held_once(&br->multicast_lock);
111 
112 	rcu_read_lock();
113 	ent = rhashtable_lookup(&br->mdb_hash_tbl, dst, br_mdb_rht_params);
114 	rcu_read_unlock();
115 
116 	return ent;
117 }
118 
119 static struct net_bridge_mdb_entry *br_mdb_ip4_get(struct net_bridge *br,
120 						   __be32 dst, __u16 vid)
121 {
122 	struct br_ip br_dst;
123 
124 	memset(&br_dst, 0, sizeof(br_dst));
125 	br_dst.dst.ip4 = dst;
126 	br_dst.proto = htons(ETH_P_IP);
127 	br_dst.vid = vid;
128 
129 	return br_mdb_ip_get(br, &br_dst);
130 }
131 
132 #if IS_ENABLED(CONFIG_IPV6)
133 static struct net_bridge_mdb_entry *br_mdb_ip6_get(struct net_bridge *br,
134 						   const struct in6_addr *dst,
135 						   __u16 vid)
136 {
137 	struct br_ip br_dst;
138 
139 	memset(&br_dst, 0, sizeof(br_dst));
140 	br_dst.dst.ip6 = *dst;
141 	br_dst.proto = htons(ETH_P_IPV6);
142 	br_dst.vid = vid;
143 
144 	return br_mdb_ip_get(br, &br_dst);
145 }
146 #endif
147 
148 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge_mcast *brmctx,
149 					struct sk_buff *skb, u16 vid)
150 {
151 	struct net_bridge *br = brmctx->br;
152 	struct br_ip ip;
153 
154 	if (!br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
155 	    br_multicast_ctx_vlan_global_disabled(brmctx))
156 		return NULL;
157 
158 	if (BR_INPUT_SKB_CB(skb)->igmp)
159 		return NULL;
160 
161 	memset(&ip, 0, sizeof(ip));
162 	ip.proto = skb->protocol;
163 	ip.vid = vid;
164 
165 	switch (skb->protocol) {
166 	case htons(ETH_P_IP):
167 		ip.dst.ip4 = ip_hdr(skb)->daddr;
168 		if (brmctx->multicast_igmp_version == 3) {
169 			struct net_bridge_mdb_entry *mdb;
170 
171 			ip.src.ip4 = ip_hdr(skb)->saddr;
172 			mdb = br_mdb_ip_get_rcu(br, &ip);
173 			if (mdb)
174 				return mdb;
175 			ip.src.ip4 = 0;
176 		}
177 		break;
178 #if IS_ENABLED(CONFIG_IPV6)
179 	case htons(ETH_P_IPV6):
180 		ip.dst.ip6 = ipv6_hdr(skb)->daddr;
181 		if (brmctx->multicast_mld_version == 2) {
182 			struct net_bridge_mdb_entry *mdb;
183 
184 			ip.src.ip6 = ipv6_hdr(skb)->saddr;
185 			mdb = br_mdb_ip_get_rcu(br, &ip);
186 			if (mdb)
187 				return mdb;
188 			memset(&ip.src.ip6, 0, sizeof(ip.src.ip6));
189 		}
190 		break;
191 #endif
192 	default:
193 		ip.proto = 0;
194 		ether_addr_copy(ip.dst.mac_addr, eth_hdr(skb)->h_dest);
195 	}
196 
197 	return br_mdb_ip_get_rcu(br, &ip);
198 }
199 
200 /* IMPORTANT: this function must be used only when the contexts cannot be
201  * passed down (e.g. timer) and must be used for read-only purposes because
202  * the vlan snooping option can change, so it can return any context
203  * (non-vlan or vlan). Its initial intended purpose is to read timer values
204  * from the *current* context based on the option. At worst that could lead
205  * to inconsistent timers when the contexts are changed, i.e. src timer
206  * which needs to re-arm with a specific delay taken from the old context
207  */
208 static struct net_bridge_mcast_port *
209 br_multicast_pg_to_port_ctx(const struct net_bridge_port_group *pg)
210 {
211 	struct net_bridge_mcast_port *pmctx = &pg->key.port->multicast_ctx;
212 	struct net_bridge_vlan *vlan;
213 
214 	lockdep_assert_held_once(&pg->key.port->br->multicast_lock);
215 
216 	/* if vlan snooping is disabled use the port's multicast context */
217 	if (!pg->key.addr.vid ||
218 	    !br_opt_get(pg->key.port->br, BROPT_MCAST_VLAN_SNOOPING_ENABLED))
219 		goto out;
220 
221 	/* locking is tricky here, due to different rules for multicast and
222 	 * vlans we need to take rcu to find the vlan and make sure it has
223 	 * the BR_VLFLAG_MCAST_ENABLED flag set, it can only change under
224 	 * multicast_lock which must be already held here, so the vlan's pmctx
225 	 * can safely be used on return
226 	 */
227 	rcu_read_lock();
228 	vlan = br_vlan_find(nbp_vlan_group_rcu(pg->key.port), pg->key.addr.vid);
229 	if (vlan && !br_multicast_port_ctx_vlan_disabled(&vlan->port_mcast_ctx))
230 		pmctx = &vlan->port_mcast_ctx;
231 	else
232 		pmctx = NULL;
233 	rcu_read_unlock();
234 out:
235 	return pmctx;
236 }
237 
238 static struct net_bridge_mcast_port *
239 br_multicast_port_vid_to_port_ctx(struct net_bridge_port *port, u16 vid)
240 {
241 	struct net_bridge_mcast_port *pmctx = NULL;
242 	struct net_bridge_vlan *vlan;
243 
244 	lockdep_assert_held_once(&port->br->multicast_lock);
245 
246 	if (!br_opt_get(port->br, BROPT_MCAST_VLAN_SNOOPING_ENABLED))
247 		return NULL;
248 
249 	/* Take RCU to access the vlan. */
250 	rcu_read_lock();
251 
252 	vlan = br_vlan_find(nbp_vlan_group_rcu(port), vid);
253 	if (vlan && !br_multicast_port_ctx_vlan_disabled(&vlan->port_mcast_ctx))
254 		pmctx = &vlan->port_mcast_ctx;
255 
256 	rcu_read_unlock();
257 
258 	return pmctx;
259 }
260 
261 /* when snooping we need to check if the contexts should be used
262  * in the following order:
263  * - if pmctx is non-NULL (port), check if it should be used
264  * - if pmctx is NULL (bridge), check if brmctx should be used
265  */
266 static bool
267 br_multicast_ctx_should_use(const struct net_bridge_mcast *brmctx,
268 			    const struct net_bridge_mcast_port *pmctx)
269 {
270 	if (!netif_running(brmctx->br->dev))
271 		return false;
272 
273 	if (pmctx)
274 		return !br_multicast_port_ctx_state_disabled(pmctx);
275 	else
276 		return !br_multicast_ctx_vlan_disabled(brmctx);
277 }
278 
279 static bool br_port_group_equal(struct net_bridge_port_group *p,
280 				struct net_bridge_port *port,
281 				const unsigned char *src)
282 {
283 	if (p->key.port != port)
284 		return false;
285 
286 	if (!(port->flags & BR_MULTICAST_TO_UNICAST))
287 		return true;
288 
289 	return ether_addr_equal(src, p->eth_addr);
290 }
291 
292 static void __fwd_add_star_excl(struct net_bridge_mcast_port *pmctx,
293 				struct net_bridge_port_group *pg,
294 				struct br_ip *sg_ip)
295 {
296 	struct net_bridge_port_group_sg_key sg_key;
297 	struct net_bridge_port_group *src_pg;
298 	struct net_bridge_mcast *brmctx;
299 
300 	memset(&sg_key, 0, sizeof(sg_key));
301 	brmctx = br_multicast_port_ctx_get_global(pmctx);
302 	sg_key.port = pg->key.port;
303 	sg_key.addr = *sg_ip;
304 	if (br_sg_port_find(brmctx->br, &sg_key))
305 		return;
306 
307 	src_pg = __br_multicast_add_group(brmctx, pmctx,
308 					  sg_ip, pg->eth_addr,
309 					  MCAST_INCLUDE, false, false);
310 	if (IS_ERR_OR_NULL(src_pg) ||
311 	    src_pg->rt_protocol != RTPROT_KERNEL)
312 		return;
313 
314 	src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
315 }
316 
317 static void __fwd_del_star_excl(struct net_bridge_port_group *pg,
318 				struct br_ip *sg_ip)
319 {
320 	struct net_bridge_port_group_sg_key sg_key;
321 	struct net_bridge *br = pg->key.port->br;
322 	struct net_bridge_port_group *src_pg;
323 
324 	memset(&sg_key, 0, sizeof(sg_key));
325 	sg_key.port = pg->key.port;
326 	sg_key.addr = *sg_ip;
327 	src_pg = br_sg_port_find(br, &sg_key);
328 	if (!src_pg || !(src_pg->flags & MDB_PG_FLAGS_STAR_EXCL) ||
329 	    src_pg->rt_protocol != RTPROT_KERNEL)
330 		return;
331 
332 	br_multicast_find_del_pg(br, src_pg);
333 }
334 
335 /* When a port group transitions to (or is added as) EXCLUDE we need to add it
336  * to all other ports' S,G entries which are not blocked by the current group
337  * for proper replication, the assumption is that any S,G blocked entries
338  * are already added so the S,G,port lookup should skip them.
339  * When a port group transitions from EXCLUDE -> INCLUDE mode or is being
340  * deleted we need to remove it from all ports' S,G entries where it was
341  * automatically installed before (i.e. where it's MDB_PG_FLAGS_STAR_EXCL).
342  */
343 void br_multicast_star_g_handle_mode(struct net_bridge_port_group *pg,
344 				     u8 filter_mode)
345 {
346 	struct net_bridge *br = pg->key.port->br;
347 	struct net_bridge_port_group *pg_lst;
348 	struct net_bridge_mcast_port *pmctx;
349 	struct net_bridge_mdb_entry *mp;
350 	struct br_ip sg_ip;
351 
352 	if (WARN_ON(!br_multicast_is_star_g(&pg->key.addr)))
353 		return;
354 
355 	mp = br_mdb_ip_get(br, &pg->key.addr);
356 	if (!mp)
357 		return;
358 	pmctx = br_multicast_pg_to_port_ctx(pg);
359 	if (!pmctx)
360 		return;
361 
362 	memset(&sg_ip, 0, sizeof(sg_ip));
363 	sg_ip = pg->key.addr;
364 
365 	for (pg_lst = mlock_dereference(mp->ports, br);
366 	     pg_lst;
367 	     pg_lst = mlock_dereference(pg_lst->next, br)) {
368 		struct net_bridge_group_src *src_ent;
369 
370 		if (pg_lst == pg)
371 			continue;
372 		hlist_for_each_entry(src_ent, &pg_lst->src_list, node) {
373 			if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
374 				continue;
375 			sg_ip.src = src_ent->addr.src;
376 			switch (filter_mode) {
377 			case MCAST_INCLUDE:
378 				__fwd_del_star_excl(pg, &sg_ip);
379 				break;
380 			case MCAST_EXCLUDE:
381 				__fwd_add_star_excl(pmctx, pg, &sg_ip);
382 				break;
383 			}
384 		}
385 	}
386 }
387 
388 /* called when adding a new S,G with host_joined == false by default */
389 static void br_multicast_sg_host_state(struct net_bridge_mdb_entry *star_mp,
390 				       struct net_bridge_port_group *sg)
391 {
392 	struct net_bridge_mdb_entry *sg_mp;
393 
394 	if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
395 		return;
396 	if (!star_mp->host_joined)
397 		return;
398 
399 	sg_mp = br_mdb_ip_get(star_mp->br, &sg->key.addr);
400 	if (!sg_mp)
401 		return;
402 	sg_mp->host_joined = true;
403 }
404 
405 /* set the host_joined state of all of *,G's S,G entries */
406 static void br_multicast_star_g_host_state(struct net_bridge_mdb_entry *star_mp)
407 {
408 	struct net_bridge *br = star_mp->br;
409 	struct net_bridge_mdb_entry *sg_mp;
410 	struct net_bridge_port_group *pg;
411 	struct br_ip sg_ip;
412 
413 	if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
414 		return;
415 
416 	memset(&sg_ip, 0, sizeof(sg_ip));
417 	sg_ip = star_mp->addr;
418 	for (pg = mlock_dereference(star_mp->ports, br);
419 	     pg;
420 	     pg = mlock_dereference(pg->next, br)) {
421 		struct net_bridge_group_src *src_ent;
422 
423 		hlist_for_each_entry(src_ent, &pg->src_list, node) {
424 			if (!(src_ent->flags & BR_SGRP_F_INSTALLED))
425 				continue;
426 			sg_ip.src = src_ent->addr.src;
427 			sg_mp = br_mdb_ip_get(br, &sg_ip);
428 			if (!sg_mp)
429 				continue;
430 			sg_mp->host_joined = star_mp->host_joined;
431 		}
432 	}
433 }
434 
435 static void br_multicast_sg_del_exclude_ports(struct net_bridge_mdb_entry *sgmp)
436 {
437 	struct net_bridge_port_group __rcu **pp;
438 	struct net_bridge_port_group *p;
439 
440 	/* *,G exclude ports are only added to S,G entries */
441 	if (WARN_ON(br_multicast_is_star_g(&sgmp->addr)))
442 		return;
443 
444 	/* we need the STAR_EXCLUDE ports if there are non-STAR_EXCLUDE ports
445 	 * we should ignore perm entries since they're managed by user-space
446 	 */
447 	for (pp = &sgmp->ports;
448 	     (p = mlock_dereference(*pp, sgmp->br)) != NULL;
449 	     pp = &p->next)
450 		if (!(p->flags & (MDB_PG_FLAGS_STAR_EXCL |
451 				  MDB_PG_FLAGS_PERMANENT)))
452 			return;
453 
454 	/* currently the host can only have joined the *,G which means
455 	 * we treat it as EXCLUDE {}, so for an S,G it's considered a
456 	 * STAR_EXCLUDE entry and we can safely leave it
457 	 */
458 	sgmp->host_joined = false;
459 
460 	for (pp = &sgmp->ports;
461 	     (p = mlock_dereference(*pp, sgmp->br)) != NULL;) {
462 		if (!(p->flags & MDB_PG_FLAGS_PERMANENT))
463 			br_multicast_del_pg(sgmp, p, pp);
464 		else
465 			pp = &p->next;
466 	}
467 }
468 
469 void br_multicast_sg_add_exclude_ports(struct net_bridge_mdb_entry *star_mp,
470 				       struct net_bridge_port_group *sg)
471 {
472 	struct net_bridge_port_group_sg_key sg_key;
473 	struct net_bridge *br = star_mp->br;
474 	struct net_bridge_mcast_port *pmctx;
475 	struct net_bridge_port_group *pg;
476 	struct net_bridge_mcast *brmctx;
477 
478 	if (WARN_ON(br_multicast_is_star_g(&sg->key.addr)))
479 		return;
480 	if (WARN_ON(!br_multicast_is_star_g(&star_mp->addr)))
481 		return;
482 
483 	br_multicast_sg_host_state(star_mp, sg);
484 	memset(&sg_key, 0, sizeof(sg_key));
485 	sg_key.addr = sg->key.addr;
486 	/* we need to add all exclude ports to the S,G */
487 	for (pg = mlock_dereference(star_mp->ports, br);
488 	     pg;
489 	     pg = mlock_dereference(pg->next, br)) {
490 		struct net_bridge_port_group *src_pg;
491 
492 		if (pg == sg || pg->filter_mode == MCAST_INCLUDE)
493 			continue;
494 
495 		sg_key.port = pg->key.port;
496 		if (br_sg_port_find(br, &sg_key))
497 			continue;
498 
499 		pmctx = br_multicast_pg_to_port_ctx(pg);
500 		if (!pmctx)
501 			continue;
502 		brmctx = br_multicast_port_ctx_get_global(pmctx);
503 
504 		src_pg = __br_multicast_add_group(brmctx, pmctx,
505 						  &sg->key.addr,
506 						  sg->eth_addr,
507 						  MCAST_INCLUDE, false, false);
508 		if (IS_ERR_OR_NULL(src_pg) ||
509 		    src_pg->rt_protocol != RTPROT_KERNEL)
510 			continue;
511 		src_pg->flags |= MDB_PG_FLAGS_STAR_EXCL;
512 	}
513 }
514 
515 static void br_multicast_fwd_src_add(struct net_bridge_group_src *src)
516 {
517 	struct net_bridge_mdb_entry *star_mp;
518 	struct net_bridge_mcast_port *pmctx;
519 	struct net_bridge_port_group *sg;
520 	struct net_bridge_mcast *brmctx;
521 	struct br_ip sg_ip;
522 
523 	if (src->flags & BR_SGRP_F_INSTALLED)
524 		return;
525 
526 	memset(&sg_ip, 0, sizeof(sg_ip));
527 	pmctx = br_multicast_pg_to_port_ctx(src->pg);
528 	if (!pmctx)
529 		return;
530 	brmctx = br_multicast_port_ctx_get_global(pmctx);
531 	sg_ip = src->pg->key.addr;
532 	sg_ip.src = src->addr.src;
533 
534 	sg = __br_multicast_add_group(brmctx, pmctx, &sg_ip,
535 				      src->pg->eth_addr, MCAST_INCLUDE, false,
536 				      !timer_pending(&src->timer));
537 	if (IS_ERR_OR_NULL(sg))
538 		return;
539 	src->flags |= BR_SGRP_F_INSTALLED;
540 	sg->flags &= ~MDB_PG_FLAGS_STAR_EXCL;
541 
542 	/* if it was added by user-space as perm we can skip next steps */
543 	if (sg->rt_protocol != RTPROT_KERNEL &&
544 	    (sg->flags & MDB_PG_FLAGS_PERMANENT))
545 		return;
546 
547 	/* the kernel is now responsible for removing this S,G */
548 	del_timer(&sg->timer);
549 	star_mp = br_mdb_ip_get(src->br, &src->pg->key.addr);
550 	if (!star_mp)
551 		return;
552 
553 	br_multicast_sg_add_exclude_ports(star_mp, sg);
554 }
555 
556 static void br_multicast_fwd_src_remove(struct net_bridge_group_src *src,
557 					bool fastleave)
558 {
559 	struct net_bridge_port_group *p, *pg = src->pg;
560 	struct net_bridge_port_group __rcu **pp;
561 	struct net_bridge_mdb_entry *mp;
562 	struct br_ip sg_ip;
563 
564 	memset(&sg_ip, 0, sizeof(sg_ip));
565 	sg_ip = pg->key.addr;
566 	sg_ip.src = src->addr.src;
567 
568 	mp = br_mdb_ip_get(src->br, &sg_ip);
569 	if (!mp)
570 		return;
571 
572 	for (pp = &mp->ports;
573 	     (p = mlock_dereference(*pp, src->br)) != NULL;
574 	     pp = &p->next) {
575 		if (!br_port_group_equal(p, pg->key.port, pg->eth_addr))
576 			continue;
577 
578 		if (p->rt_protocol != RTPROT_KERNEL &&
579 		    (p->flags & MDB_PG_FLAGS_PERMANENT) &&
580 		    !(src->flags & BR_SGRP_F_USER_ADDED))
581 			break;
582 
583 		if (fastleave)
584 			p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
585 		br_multicast_del_pg(mp, p, pp);
586 		break;
587 	}
588 	src->flags &= ~BR_SGRP_F_INSTALLED;
589 }
590 
591 /* install S,G and based on src's timer enable or disable forwarding */
592 static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)
593 {
594 	struct net_bridge_port_group_sg_key sg_key;
595 	struct net_bridge_port_group *sg;
596 	u8 old_flags;
597 
598 	br_multicast_fwd_src_add(src);
599 
600 	memset(&sg_key, 0, sizeof(sg_key));
601 	sg_key.addr = src->pg->key.addr;
602 	sg_key.addr.src = src->addr.src;
603 	sg_key.port = src->pg->key.port;
604 
605 	sg = br_sg_port_find(src->br, &sg_key);
606 	if (!sg || (sg->flags & MDB_PG_FLAGS_PERMANENT))
607 		return;
608 
609 	old_flags = sg->flags;
610 	if (timer_pending(&src->timer))
611 		sg->flags &= ~MDB_PG_FLAGS_BLOCKED;
612 	else
613 		sg->flags |= MDB_PG_FLAGS_BLOCKED;
614 
615 	if (old_flags != sg->flags) {
616 		struct net_bridge_mdb_entry *sg_mp;
617 
618 		sg_mp = br_mdb_ip_get(src->br, &sg_key.addr);
619 		if (!sg_mp)
620 			return;
621 		br_mdb_notify(src->br->dev, sg_mp, sg, RTM_NEWMDB);
622 	}
623 }
624 
625 static void br_multicast_destroy_mdb_entry(struct net_bridge_mcast_gc *gc)
626 {
627 	struct net_bridge_mdb_entry *mp;
628 
629 	mp = container_of(gc, struct net_bridge_mdb_entry, mcast_gc);
630 	WARN_ON(!hlist_unhashed(&mp->mdb_node));
631 	WARN_ON(mp->ports);
632 
633 	timer_shutdown_sync(&mp->timer);
634 	kfree_rcu(mp, rcu);
635 }
636 
637 static void br_multicast_del_mdb_entry(struct net_bridge_mdb_entry *mp)
638 {
639 	struct net_bridge *br = mp->br;
640 
641 	rhashtable_remove_fast(&br->mdb_hash_tbl, &mp->rhnode,
642 			       br_mdb_rht_params);
643 	hlist_del_init_rcu(&mp->mdb_node);
644 	hlist_add_head(&mp->mcast_gc.gc_node, &br->mcast_gc_list);
645 	queue_work(system_long_wq, &br->mcast_gc_work);
646 }
647 
648 static void br_multicast_group_expired(struct timer_list *t)
649 {
650 	struct net_bridge_mdb_entry *mp = from_timer(mp, t, timer);
651 	struct net_bridge *br = mp->br;
652 
653 	spin_lock(&br->multicast_lock);
654 	if (hlist_unhashed(&mp->mdb_node) || !netif_running(br->dev) ||
655 	    timer_pending(&mp->timer))
656 		goto out;
657 
658 	br_multicast_host_leave(mp, true);
659 
660 	if (mp->ports)
661 		goto out;
662 	br_multicast_del_mdb_entry(mp);
663 out:
664 	spin_unlock(&br->multicast_lock);
665 }
666 
667 static void br_multicast_destroy_group_src(struct net_bridge_mcast_gc *gc)
668 {
669 	struct net_bridge_group_src *src;
670 
671 	src = container_of(gc, struct net_bridge_group_src, mcast_gc);
672 	WARN_ON(!hlist_unhashed(&src->node));
673 
674 	timer_shutdown_sync(&src->timer);
675 	kfree_rcu(src, rcu);
676 }
677 
678 void __br_multicast_del_group_src(struct net_bridge_group_src *src)
679 {
680 	struct net_bridge *br = src->pg->key.port->br;
681 
682 	hlist_del_init_rcu(&src->node);
683 	src->pg->src_ents--;
684 	hlist_add_head(&src->mcast_gc.gc_node, &br->mcast_gc_list);
685 	queue_work(system_long_wq, &br->mcast_gc_work);
686 }
687 
688 void br_multicast_del_group_src(struct net_bridge_group_src *src,
689 				bool fastleave)
690 {
691 	br_multicast_fwd_src_remove(src, fastleave);
692 	__br_multicast_del_group_src(src);
693 }
694 
695 static int
696 br_multicast_port_ngroups_inc_one(struct net_bridge_mcast_port *pmctx,
697 				  struct netlink_ext_ack *extack,
698 				  const char *what)
699 {
700 	u32 max = READ_ONCE(pmctx->mdb_max_entries);
701 	u32 n = READ_ONCE(pmctx->mdb_n_entries);
702 
703 	if (max && n >= max) {
704 		NL_SET_ERR_MSG_FMT_MOD(extack, "%s is already in %u groups, and mcast_max_groups=%u",
705 				       what, n, max);
706 		return -E2BIG;
707 	}
708 
709 	WRITE_ONCE(pmctx->mdb_n_entries, n + 1);
710 	return 0;
711 }
712 
713 static void br_multicast_port_ngroups_dec_one(struct net_bridge_mcast_port *pmctx)
714 {
715 	u32 n = READ_ONCE(pmctx->mdb_n_entries);
716 
717 	WARN_ON_ONCE(n == 0);
718 	WRITE_ONCE(pmctx->mdb_n_entries, n - 1);
719 }
720 
721 static int br_multicast_port_ngroups_inc(struct net_bridge_port *port,
722 					 const struct br_ip *group,
723 					 struct netlink_ext_ack *extack)
724 {
725 	struct net_bridge_mcast_port *pmctx;
726 	int err;
727 
728 	lockdep_assert_held_once(&port->br->multicast_lock);
729 
730 	/* Always count on the port context. */
731 	err = br_multicast_port_ngroups_inc_one(&port->multicast_ctx, extack,
732 						"Port");
733 	if (err) {
734 		trace_br_mdb_full(port->dev, group);
735 		return err;
736 	}
737 
738 	/* Only count on the VLAN context if VID is given, and if snooping on
739 	 * that VLAN is enabled.
740 	 */
741 	if (!group->vid)
742 		return 0;
743 
744 	pmctx = br_multicast_port_vid_to_port_ctx(port, group->vid);
745 	if (!pmctx)
746 		return 0;
747 
748 	err = br_multicast_port_ngroups_inc_one(pmctx, extack, "Port-VLAN");
749 	if (err) {
750 		trace_br_mdb_full(port->dev, group);
751 		goto dec_one_out;
752 	}
753 
754 	return 0;
755 
756 dec_one_out:
757 	br_multicast_port_ngroups_dec_one(&port->multicast_ctx);
758 	return err;
759 }
760 
761 static void br_multicast_port_ngroups_dec(struct net_bridge_port *port, u16 vid)
762 {
763 	struct net_bridge_mcast_port *pmctx;
764 
765 	lockdep_assert_held_once(&port->br->multicast_lock);
766 
767 	if (vid) {
768 		pmctx = br_multicast_port_vid_to_port_ctx(port, vid);
769 		if (pmctx)
770 			br_multicast_port_ngroups_dec_one(pmctx);
771 	}
772 	br_multicast_port_ngroups_dec_one(&port->multicast_ctx);
773 }
774 
775 u32 br_multicast_ngroups_get(const struct net_bridge_mcast_port *pmctx)
776 {
777 	return READ_ONCE(pmctx->mdb_n_entries);
778 }
779 
780 void br_multicast_ngroups_set_max(struct net_bridge_mcast_port *pmctx, u32 max)
781 {
782 	WRITE_ONCE(pmctx->mdb_max_entries, max);
783 }
784 
785 u32 br_multicast_ngroups_get_max(const struct net_bridge_mcast_port *pmctx)
786 {
787 	return READ_ONCE(pmctx->mdb_max_entries);
788 }
789 
790 static void br_multicast_destroy_port_group(struct net_bridge_mcast_gc *gc)
791 {
792 	struct net_bridge_port_group *pg;
793 
794 	pg = container_of(gc, struct net_bridge_port_group, mcast_gc);
795 	WARN_ON(!hlist_unhashed(&pg->mglist));
796 	WARN_ON(!hlist_empty(&pg->src_list));
797 
798 	timer_shutdown_sync(&pg->rexmit_timer);
799 	timer_shutdown_sync(&pg->timer);
800 	kfree_rcu(pg, rcu);
801 }
802 
803 void br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
804 			 struct net_bridge_port_group *pg,
805 			 struct net_bridge_port_group __rcu **pp)
806 {
807 	struct net_bridge *br = pg->key.port->br;
808 	struct net_bridge_group_src *ent;
809 	struct hlist_node *tmp;
810 
811 	rcu_assign_pointer(*pp, pg->next);
812 	hlist_del_init(&pg->mglist);
813 	br_multicast_eht_clean_sets(pg);
814 	hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
815 		br_multicast_del_group_src(ent, false);
816 	br_mdb_notify(br->dev, mp, pg, RTM_DELMDB);
817 	if (!br_multicast_is_star_g(&mp->addr)) {
818 		rhashtable_remove_fast(&br->sg_port_tbl, &pg->rhnode,
819 				       br_sg_port_rht_params);
820 		br_multicast_sg_del_exclude_ports(mp);
821 	} else {
822 		br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
823 	}
824 	br_multicast_port_ngroups_dec(pg->key.port, pg->key.addr.vid);
825 	hlist_add_head(&pg->mcast_gc.gc_node, &br->mcast_gc_list);
826 	queue_work(system_long_wq, &br->mcast_gc_work);
827 
828 	if (!mp->ports && !mp->host_joined && netif_running(br->dev))
829 		mod_timer(&mp->timer, jiffies);
830 }
831 
832 static void br_multicast_find_del_pg(struct net_bridge *br,
833 				     struct net_bridge_port_group *pg)
834 {
835 	struct net_bridge_port_group __rcu **pp;
836 	struct net_bridge_mdb_entry *mp;
837 	struct net_bridge_port_group *p;
838 
839 	mp = br_mdb_ip_get(br, &pg->key.addr);
840 	if (WARN_ON(!mp))
841 		return;
842 
843 	for (pp = &mp->ports;
844 	     (p = mlock_dereference(*pp, br)) != NULL;
845 	     pp = &p->next) {
846 		if (p != pg)
847 			continue;
848 
849 		br_multicast_del_pg(mp, pg, pp);
850 		return;
851 	}
852 
853 	WARN_ON(1);
854 }
855 
856 static void br_multicast_port_group_expired(struct timer_list *t)
857 {
858 	struct net_bridge_port_group *pg = from_timer(pg, t, timer);
859 	struct net_bridge_group_src *src_ent;
860 	struct net_bridge *br = pg->key.port->br;
861 	struct hlist_node *tmp;
862 	bool changed;
863 
864 	spin_lock(&br->multicast_lock);
865 	if (!netif_running(br->dev) || timer_pending(&pg->timer) ||
866 	    hlist_unhashed(&pg->mglist) || pg->flags & MDB_PG_FLAGS_PERMANENT)
867 		goto out;
868 
869 	changed = !!(pg->filter_mode == MCAST_EXCLUDE);
870 	pg->filter_mode = MCAST_INCLUDE;
871 	hlist_for_each_entry_safe(src_ent, tmp, &pg->src_list, node) {
872 		if (!timer_pending(&src_ent->timer)) {
873 			br_multicast_del_group_src(src_ent, false);
874 			changed = true;
875 		}
876 	}
877 
878 	if (hlist_empty(&pg->src_list)) {
879 		br_multicast_find_del_pg(br, pg);
880 	} else if (changed) {
881 		struct net_bridge_mdb_entry *mp = br_mdb_ip_get(br, &pg->key.addr);
882 
883 		if (changed && br_multicast_is_star_g(&pg->key.addr))
884 			br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
885 
886 		if (WARN_ON(!mp))
887 			goto out;
888 		br_mdb_notify(br->dev, mp, pg, RTM_NEWMDB);
889 	}
890 out:
891 	spin_unlock(&br->multicast_lock);
892 }
893 
894 static void br_multicast_gc(struct hlist_head *head)
895 {
896 	struct net_bridge_mcast_gc *gcent;
897 	struct hlist_node *tmp;
898 
899 	hlist_for_each_entry_safe(gcent, tmp, head, gc_node) {
900 		hlist_del_init(&gcent->gc_node);
901 		gcent->destroy(gcent);
902 	}
903 }
904 
905 static void __br_multicast_query_handle_vlan(struct net_bridge_mcast *brmctx,
906 					     struct net_bridge_mcast_port *pmctx,
907 					     struct sk_buff *skb)
908 {
909 	struct net_bridge_vlan *vlan = NULL;
910 
911 	if (pmctx && br_multicast_port_ctx_is_vlan(pmctx))
912 		vlan = pmctx->vlan;
913 	else if (br_multicast_ctx_is_vlan(brmctx))
914 		vlan = brmctx->vlan;
915 
916 	if (vlan && !(vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED)) {
917 		u16 vlan_proto;
918 
919 		if (br_vlan_get_proto(brmctx->br->dev, &vlan_proto) != 0)
920 			return;
921 		__vlan_hwaccel_put_tag(skb, htons(vlan_proto), vlan->vid);
922 	}
923 }
924 
925 static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge_mcast *brmctx,
926 						    struct net_bridge_mcast_port *pmctx,
927 						    struct net_bridge_port_group *pg,
928 						    __be32 ip_dst, __be32 group,
929 						    bool with_srcs, bool over_lmqt,
930 						    u8 sflag, u8 *igmp_type,
931 						    bool *need_rexmit)
932 {
933 	struct net_bridge_port *p = pg ? pg->key.port : NULL;
934 	struct net_bridge_group_src *ent;
935 	size_t pkt_size, igmp_hdr_size;
936 	unsigned long now = jiffies;
937 	struct igmpv3_query *ihv3;
938 	void *csum_start = NULL;
939 	__sum16 *csum = NULL;
940 	struct sk_buff *skb;
941 	struct igmphdr *ih;
942 	struct ethhdr *eth;
943 	unsigned long lmqt;
944 	struct iphdr *iph;
945 	u16 lmqt_srcs = 0;
946 
947 	igmp_hdr_size = sizeof(*ih);
948 	if (brmctx->multicast_igmp_version == 3) {
949 		igmp_hdr_size = sizeof(*ihv3);
950 		if (pg && with_srcs) {
951 			lmqt = now + (brmctx->multicast_last_member_interval *
952 				      brmctx->multicast_last_member_count);
953 			hlist_for_each_entry(ent, &pg->src_list, node) {
954 				if (over_lmqt == time_after(ent->timer.expires,
955 							    lmqt) &&
956 				    ent->src_query_rexmit_cnt > 0)
957 					lmqt_srcs++;
958 			}
959 
960 			if (!lmqt_srcs)
961 				return NULL;
962 			igmp_hdr_size += lmqt_srcs * sizeof(__be32);
963 		}
964 	}
965 
966 	pkt_size = sizeof(*eth) + sizeof(*iph) + 4 + igmp_hdr_size;
967 	if ((p && pkt_size > p->dev->mtu) ||
968 	    pkt_size > brmctx->br->dev->mtu)
969 		return NULL;
970 
971 	skb = netdev_alloc_skb_ip_align(brmctx->br->dev, pkt_size);
972 	if (!skb)
973 		goto out;
974 
975 	__br_multicast_query_handle_vlan(brmctx, pmctx, skb);
976 	skb->protocol = htons(ETH_P_IP);
977 
978 	skb_reset_mac_header(skb);
979 	eth = eth_hdr(skb);
980 
981 	ether_addr_copy(eth->h_source, brmctx->br->dev->dev_addr);
982 	ip_eth_mc_map(ip_dst, eth->h_dest);
983 	eth->h_proto = htons(ETH_P_IP);
984 	skb_put(skb, sizeof(*eth));
985 
986 	skb_set_network_header(skb, skb->len);
987 	iph = ip_hdr(skb);
988 	iph->tot_len = htons(pkt_size - sizeof(*eth));
989 
990 	iph->version = 4;
991 	iph->ihl = 6;
992 	iph->tos = 0xc0;
993 	iph->id = 0;
994 	iph->frag_off = htons(IP_DF);
995 	iph->ttl = 1;
996 	iph->protocol = IPPROTO_IGMP;
997 	iph->saddr = br_opt_get(brmctx->br, BROPT_MULTICAST_QUERY_USE_IFADDR) ?
998 		     inet_select_addr(brmctx->br->dev, 0, RT_SCOPE_LINK) : 0;
999 	iph->daddr = ip_dst;
1000 	((u8 *)&iph[1])[0] = IPOPT_RA;
1001 	((u8 *)&iph[1])[1] = 4;
1002 	((u8 *)&iph[1])[2] = 0;
1003 	((u8 *)&iph[1])[3] = 0;
1004 	ip_send_check(iph);
1005 	skb_put(skb, 24);
1006 
1007 	skb_set_transport_header(skb, skb->len);
1008 	*igmp_type = IGMP_HOST_MEMBERSHIP_QUERY;
1009 
1010 	switch (brmctx->multicast_igmp_version) {
1011 	case 2:
1012 		ih = igmp_hdr(skb);
1013 		ih->type = IGMP_HOST_MEMBERSHIP_QUERY;
1014 		ih->code = (group ? brmctx->multicast_last_member_interval :
1015 				    brmctx->multicast_query_response_interval) /
1016 			   (HZ / IGMP_TIMER_SCALE);
1017 		ih->group = group;
1018 		ih->csum = 0;
1019 		csum = &ih->csum;
1020 		csum_start = (void *)ih;
1021 		break;
1022 	case 3:
1023 		ihv3 = igmpv3_query_hdr(skb);
1024 		ihv3->type = IGMP_HOST_MEMBERSHIP_QUERY;
1025 		ihv3->code = (group ? brmctx->multicast_last_member_interval :
1026 				      brmctx->multicast_query_response_interval) /
1027 			     (HZ / IGMP_TIMER_SCALE);
1028 		ihv3->group = group;
1029 		ihv3->qqic = brmctx->multicast_query_interval / HZ;
1030 		ihv3->nsrcs = htons(lmqt_srcs);
1031 		ihv3->resv = 0;
1032 		ihv3->suppress = sflag;
1033 		ihv3->qrv = 2;
1034 		ihv3->csum = 0;
1035 		csum = &ihv3->csum;
1036 		csum_start = (void *)ihv3;
1037 		if (!pg || !with_srcs)
1038 			break;
1039 
1040 		lmqt_srcs = 0;
1041 		hlist_for_each_entry(ent, &pg->src_list, node) {
1042 			if (over_lmqt == time_after(ent->timer.expires,
1043 						    lmqt) &&
1044 			    ent->src_query_rexmit_cnt > 0) {
1045 				ihv3->srcs[lmqt_srcs++] = ent->addr.src.ip4;
1046 				ent->src_query_rexmit_cnt--;
1047 				if (need_rexmit && ent->src_query_rexmit_cnt)
1048 					*need_rexmit = true;
1049 			}
1050 		}
1051 		if (WARN_ON(lmqt_srcs != ntohs(ihv3->nsrcs))) {
1052 			kfree_skb(skb);
1053 			return NULL;
1054 		}
1055 		break;
1056 	}
1057 
1058 	if (WARN_ON(!csum || !csum_start)) {
1059 		kfree_skb(skb);
1060 		return NULL;
1061 	}
1062 
1063 	*csum = ip_compute_csum(csum_start, igmp_hdr_size);
1064 	skb_put(skb, igmp_hdr_size);
1065 	__skb_pull(skb, sizeof(*eth));
1066 
1067 out:
1068 	return skb;
1069 }
1070 
1071 #if IS_ENABLED(CONFIG_IPV6)
1072 static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge_mcast *brmctx,
1073 						    struct net_bridge_mcast_port *pmctx,
1074 						    struct net_bridge_port_group *pg,
1075 						    const struct in6_addr *ip6_dst,
1076 						    const struct in6_addr *group,
1077 						    bool with_srcs, bool over_llqt,
1078 						    u8 sflag, u8 *igmp_type,
1079 						    bool *need_rexmit)
1080 {
1081 	struct net_bridge_port *p = pg ? pg->key.port : NULL;
1082 	struct net_bridge_group_src *ent;
1083 	size_t pkt_size, mld_hdr_size;
1084 	unsigned long now = jiffies;
1085 	struct mld2_query *mld2q;
1086 	void *csum_start = NULL;
1087 	unsigned long interval;
1088 	__sum16 *csum = NULL;
1089 	struct ipv6hdr *ip6h;
1090 	struct mld_msg *mldq;
1091 	struct sk_buff *skb;
1092 	unsigned long llqt;
1093 	struct ethhdr *eth;
1094 	u16 llqt_srcs = 0;
1095 	u8 *hopopt;
1096 
1097 	mld_hdr_size = sizeof(*mldq);
1098 	if (brmctx->multicast_mld_version == 2) {
1099 		mld_hdr_size = sizeof(*mld2q);
1100 		if (pg && with_srcs) {
1101 			llqt = now + (brmctx->multicast_last_member_interval *
1102 				      brmctx->multicast_last_member_count);
1103 			hlist_for_each_entry(ent, &pg->src_list, node) {
1104 				if (over_llqt == time_after(ent->timer.expires,
1105 							    llqt) &&
1106 				    ent->src_query_rexmit_cnt > 0)
1107 					llqt_srcs++;
1108 			}
1109 
1110 			if (!llqt_srcs)
1111 				return NULL;
1112 			mld_hdr_size += llqt_srcs * sizeof(struct in6_addr);
1113 		}
1114 	}
1115 
1116 	pkt_size = sizeof(*eth) + sizeof(*ip6h) + 8 + mld_hdr_size;
1117 	if ((p && pkt_size > p->dev->mtu) ||
1118 	    pkt_size > brmctx->br->dev->mtu)
1119 		return NULL;
1120 
1121 	skb = netdev_alloc_skb_ip_align(brmctx->br->dev, pkt_size);
1122 	if (!skb)
1123 		goto out;
1124 
1125 	__br_multicast_query_handle_vlan(brmctx, pmctx, skb);
1126 	skb->protocol = htons(ETH_P_IPV6);
1127 
1128 	/* Ethernet header */
1129 	skb_reset_mac_header(skb);
1130 	eth = eth_hdr(skb);
1131 
1132 	ether_addr_copy(eth->h_source, brmctx->br->dev->dev_addr);
1133 	eth->h_proto = htons(ETH_P_IPV6);
1134 	skb_put(skb, sizeof(*eth));
1135 
1136 	/* IPv6 header + HbH option */
1137 	skb_set_network_header(skb, skb->len);
1138 	ip6h = ipv6_hdr(skb);
1139 
1140 	*(__force __be32 *)ip6h = htonl(0x60000000);
1141 	ip6h->payload_len = htons(8 + mld_hdr_size);
1142 	ip6h->nexthdr = IPPROTO_HOPOPTS;
1143 	ip6h->hop_limit = 1;
1144 	ip6h->daddr = *ip6_dst;
1145 	if (ipv6_dev_get_saddr(dev_net(brmctx->br->dev), brmctx->br->dev,
1146 			       &ip6h->daddr, 0, &ip6h->saddr)) {
1147 		kfree_skb(skb);
1148 		br_opt_toggle(brmctx->br, BROPT_HAS_IPV6_ADDR, false);
1149 		return NULL;
1150 	}
1151 
1152 	br_opt_toggle(brmctx->br, BROPT_HAS_IPV6_ADDR, true);
1153 	ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
1154 
1155 	hopopt = (u8 *)(ip6h + 1);
1156 	hopopt[0] = IPPROTO_ICMPV6;		/* next hdr */
1157 	hopopt[1] = 0;				/* length of HbH */
1158 	hopopt[2] = IPV6_TLV_ROUTERALERT;	/* Router Alert */
1159 	hopopt[3] = 2;				/* Length of RA Option */
1160 	hopopt[4] = 0;				/* Type = 0x0000 (MLD) */
1161 	hopopt[5] = 0;
1162 	hopopt[6] = IPV6_TLV_PAD1;		/* Pad1 */
1163 	hopopt[7] = IPV6_TLV_PAD1;		/* Pad1 */
1164 
1165 	skb_put(skb, sizeof(*ip6h) + 8);
1166 
1167 	/* ICMPv6 */
1168 	skb_set_transport_header(skb, skb->len);
1169 	interval = ipv6_addr_any(group) ?
1170 			brmctx->multicast_query_response_interval :
1171 			brmctx->multicast_last_member_interval;
1172 	*igmp_type = ICMPV6_MGM_QUERY;
1173 	switch (brmctx->multicast_mld_version) {
1174 	case 1:
1175 		mldq = (struct mld_msg *)icmp6_hdr(skb);
1176 		mldq->mld_type = ICMPV6_MGM_QUERY;
1177 		mldq->mld_code = 0;
1178 		mldq->mld_cksum = 0;
1179 		mldq->mld_maxdelay = htons((u16)jiffies_to_msecs(interval));
1180 		mldq->mld_reserved = 0;
1181 		mldq->mld_mca = *group;
1182 		csum = &mldq->mld_cksum;
1183 		csum_start = (void *)mldq;
1184 		break;
1185 	case 2:
1186 		mld2q = (struct mld2_query *)icmp6_hdr(skb);
1187 		mld2q->mld2q_mrc = htons((u16)jiffies_to_msecs(interval));
1188 		mld2q->mld2q_type = ICMPV6_MGM_QUERY;
1189 		mld2q->mld2q_code = 0;
1190 		mld2q->mld2q_cksum = 0;
1191 		mld2q->mld2q_resv1 = 0;
1192 		mld2q->mld2q_resv2 = 0;
1193 		mld2q->mld2q_suppress = sflag;
1194 		mld2q->mld2q_qrv = 2;
1195 		mld2q->mld2q_nsrcs = htons(llqt_srcs);
1196 		mld2q->mld2q_qqic = brmctx->multicast_query_interval / HZ;
1197 		mld2q->mld2q_mca = *group;
1198 		csum = &mld2q->mld2q_cksum;
1199 		csum_start = (void *)mld2q;
1200 		if (!pg || !with_srcs)
1201 			break;
1202 
1203 		llqt_srcs = 0;
1204 		hlist_for_each_entry(ent, &pg->src_list, node) {
1205 			if (over_llqt == time_after(ent->timer.expires,
1206 						    llqt) &&
1207 			    ent->src_query_rexmit_cnt > 0) {
1208 				mld2q->mld2q_srcs[llqt_srcs++] = ent->addr.src.ip6;
1209 				ent->src_query_rexmit_cnt--;
1210 				if (need_rexmit && ent->src_query_rexmit_cnt)
1211 					*need_rexmit = true;
1212 			}
1213 		}
1214 		if (WARN_ON(llqt_srcs != ntohs(mld2q->mld2q_nsrcs))) {
1215 			kfree_skb(skb);
1216 			return NULL;
1217 		}
1218 		break;
1219 	}
1220 
1221 	if (WARN_ON(!csum || !csum_start)) {
1222 		kfree_skb(skb);
1223 		return NULL;
1224 	}
1225 
1226 	*csum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, mld_hdr_size,
1227 				IPPROTO_ICMPV6,
1228 				csum_partial(csum_start, mld_hdr_size, 0));
1229 	skb_put(skb, mld_hdr_size);
1230 	__skb_pull(skb, sizeof(*eth));
1231 
1232 out:
1233 	return skb;
1234 }
1235 #endif
1236 
1237 static struct sk_buff *br_multicast_alloc_query(struct net_bridge_mcast *brmctx,
1238 						struct net_bridge_mcast_port *pmctx,
1239 						struct net_bridge_port_group *pg,
1240 						struct br_ip *ip_dst,
1241 						struct br_ip *group,
1242 						bool with_srcs, bool over_lmqt,
1243 						u8 sflag, u8 *igmp_type,
1244 						bool *need_rexmit)
1245 {
1246 	__be32 ip4_dst;
1247 
1248 	switch (group->proto) {
1249 	case htons(ETH_P_IP):
1250 		ip4_dst = ip_dst ? ip_dst->dst.ip4 : htonl(INADDR_ALLHOSTS_GROUP);
1251 		return br_ip4_multicast_alloc_query(brmctx, pmctx, pg,
1252 						    ip4_dst, group->dst.ip4,
1253 						    with_srcs, over_lmqt,
1254 						    sflag, igmp_type,
1255 						    need_rexmit);
1256 #if IS_ENABLED(CONFIG_IPV6)
1257 	case htons(ETH_P_IPV6): {
1258 		struct in6_addr ip6_dst;
1259 
1260 		if (ip_dst)
1261 			ip6_dst = ip_dst->dst.ip6;
1262 		else
1263 			ipv6_addr_set(&ip6_dst, htonl(0xff020000), 0, 0,
1264 				      htonl(1));
1265 
1266 		return br_ip6_multicast_alloc_query(brmctx, pmctx, pg,
1267 						    &ip6_dst, &group->dst.ip6,
1268 						    with_srcs, over_lmqt,
1269 						    sflag, igmp_type,
1270 						    need_rexmit);
1271 	}
1272 #endif
1273 	}
1274 	return NULL;
1275 }
1276 
1277 struct net_bridge_mdb_entry *br_multicast_new_group(struct net_bridge *br,
1278 						    struct br_ip *group)
1279 {
1280 	struct net_bridge_mdb_entry *mp;
1281 	int err;
1282 
1283 	mp = br_mdb_ip_get(br, group);
1284 	if (mp)
1285 		return mp;
1286 
1287 	if (atomic_read(&br->mdb_hash_tbl.nelems) >= br->hash_max) {
1288 		trace_br_mdb_full(br->dev, group);
1289 		br_mc_disabled_update(br->dev, false, NULL);
1290 		br_opt_toggle(br, BROPT_MULTICAST_ENABLED, false);
1291 		return ERR_PTR(-E2BIG);
1292 	}
1293 
1294 	mp = kzalloc(sizeof(*mp), GFP_ATOMIC);
1295 	if (unlikely(!mp))
1296 		return ERR_PTR(-ENOMEM);
1297 
1298 	mp->br = br;
1299 	mp->addr = *group;
1300 	mp->mcast_gc.destroy = br_multicast_destroy_mdb_entry;
1301 	timer_setup(&mp->timer, br_multicast_group_expired, 0);
1302 	err = rhashtable_lookup_insert_fast(&br->mdb_hash_tbl, &mp->rhnode,
1303 					    br_mdb_rht_params);
1304 	if (err) {
1305 		kfree(mp);
1306 		mp = ERR_PTR(err);
1307 	} else {
1308 		hlist_add_head_rcu(&mp->mdb_node, &br->mdb_list);
1309 	}
1310 
1311 	return mp;
1312 }
1313 
1314 static void br_multicast_group_src_expired(struct timer_list *t)
1315 {
1316 	struct net_bridge_group_src *src = from_timer(src, t, timer);
1317 	struct net_bridge_port_group *pg;
1318 	struct net_bridge *br = src->br;
1319 
1320 	spin_lock(&br->multicast_lock);
1321 	if (hlist_unhashed(&src->node) || !netif_running(br->dev) ||
1322 	    timer_pending(&src->timer))
1323 		goto out;
1324 
1325 	pg = src->pg;
1326 	if (pg->filter_mode == MCAST_INCLUDE) {
1327 		br_multicast_del_group_src(src, false);
1328 		if (!hlist_empty(&pg->src_list))
1329 			goto out;
1330 		br_multicast_find_del_pg(br, pg);
1331 	} else {
1332 		br_multicast_fwd_src_handle(src);
1333 	}
1334 
1335 out:
1336 	spin_unlock(&br->multicast_lock);
1337 }
1338 
1339 struct net_bridge_group_src *
1340 br_multicast_find_group_src(struct net_bridge_port_group *pg, struct br_ip *ip)
1341 {
1342 	struct net_bridge_group_src *ent;
1343 
1344 	switch (ip->proto) {
1345 	case htons(ETH_P_IP):
1346 		hlist_for_each_entry(ent, &pg->src_list, node)
1347 			if (ip->src.ip4 == ent->addr.src.ip4)
1348 				return ent;
1349 		break;
1350 #if IS_ENABLED(CONFIG_IPV6)
1351 	case htons(ETH_P_IPV6):
1352 		hlist_for_each_entry(ent, &pg->src_list, node)
1353 			if (!ipv6_addr_cmp(&ent->addr.src.ip6, &ip->src.ip6))
1354 				return ent;
1355 		break;
1356 #endif
1357 	}
1358 
1359 	return NULL;
1360 }
1361 
1362 struct net_bridge_group_src *
1363 br_multicast_new_group_src(struct net_bridge_port_group *pg, struct br_ip *src_ip)
1364 {
1365 	struct net_bridge_group_src *grp_src;
1366 
1367 	if (unlikely(pg->src_ents >= PG_SRC_ENT_LIMIT))
1368 		return NULL;
1369 
1370 	switch (src_ip->proto) {
1371 	case htons(ETH_P_IP):
1372 		if (ipv4_is_zeronet(src_ip->src.ip4) ||
1373 		    ipv4_is_multicast(src_ip->src.ip4))
1374 			return NULL;
1375 		break;
1376 #if IS_ENABLED(CONFIG_IPV6)
1377 	case htons(ETH_P_IPV6):
1378 		if (ipv6_addr_any(&src_ip->src.ip6) ||
1379 		    ipv6_addr_is_multicast(&src_ip->src.ip6))
1380 			return NULL;
1381 		break;
1382 #endif
1383 	}
1384 
1385 	grp_src = kzalloc(sizeof(*grp_src), GFP_ATOMIC);
1386 	if (unlikely(!grp_src))
1387 		return NULL;
1388 
1389 	grp_src->pg = pg;
1390 	grp_src->br = pg->key.port->br;
1391 	grp_src->addr = *src_ip;
1392 	grp_src->mcast_gc.destroy = br_multicast_destroy_group_src;
1393 	timer_setup(&grp_src->timer, br_multicast_group_src_expired, 0);
1394 
1395 	hlist_add_head_rcu(&grp_src->node, &pg->src_list);
1396 	pg->src_ents++;
1397 
1398 	return grp_src;
1399 }
1400 
1401 struct net_bridge_port_group *br_multicast_new_port_group(
1402 			struct net_bridge_port *port,
1403 			const struct br_ip *group,
1404 			struct net_bridge_port_group __rcu *next,
1405 			unsigned char flags,
1406 			const unsigned char *src,
1407 			u8 filter_mode,
1408 			u8 rt_protocol,
1409 			struct netlink_ext_ack *extack)
1410 {
1411 	struct net_bridge_port_group *p;
1412 	int err;
1413 
1414 	err = br_multicast_port_ngroups_inc(port, group, extack);
1415 	if (err)
1416 		return NULL;
1417 
1418 	p = kzalloc(sizeof(*p), GFP_ATOMIC);
1419 	if (unlikely(!p)) {
1420 		NL_SET_ERR_MSG_MOD(extack, "Couldn't allocate new port group");
1421 		goto dec_out;
1422 	}
1423 
1424 	p->key.addr = *group;
1425 	p->key.port = port;
1426 	p->flags = flags;
1427 	p->filter_mode = filter_mode;
1428 	p->rt_protocol = rt_protocol;
1429 	p->eht_host_tree = RB_ROOT;
1430 	p->eht_set_tree = RB_ROOT;
1431 	p->mcast_gc.destroy = br_multicast_destroy_port_group;
1432 	INIT_HLIST_HEAD(&p->src_list);
1433 
1434 	if (!br_multicast_is_star_g(group) &&
1435 	    rhashtable_lookup_insert_fast(&port->br->sg_port_tbl, &p->rhnode,
1436 					  br_sg_port_rht_params)) {
1437 		NL_SET_ERR_MSG_MOD(extack, "Couldn't insert new port group");
1438 		goto free_out;
1439 	}
1440 
1441 	rcu_assign_pointer(p->next, next);
1442 	timer_setup(&p->timer, br_multicast_port_group_expired, 0);
1443 	timer_setup(&p->rexmit_timer, br_multicast_port_group_rexmit, 0);
1444 	hlist_add_head(&p->mglist, &port->mglist);
1445 
1446 	if (src)
1447 		memcpy(p->eth_addr, src, ETH_ALEN);
1448 	else
1449 		eth_broadcast_addr(p->eth_addr);
1450 
1451 	return p;
1452 
1453 free_out:
1454 	kfree(p);
1455 dec_out:
1456 	br_multicast_port_ngroups_dec(port, group->vid);
1457 	return NULL;
1458 }
1459 
1460 void br_multicast_del_port_group(struct net_bridge_port_group *p)
1461 {
1462 	struct net_bridge_port *port = p->key.port;
1463 	__u16 vid = p->key.addr.vid;
1464 
1465 	hlist_del_init(&p->mglist);
1466 	if (!br_multicast_is_star_g(&p->key.addr))
1467 		rhashtable_remove_fast(&port->br->sg_port_tbl, &p->rhnode,
1468 				       br_sg_port_rht_params);
1469 	kfree(p);
1470 	br_multicast_port_ngroups_dec(port, vid);
1471 }
1472 
1473 void br_multicast_host_join(const struct net_bridge_mcast *brmctx,
1474 			    struct net_bridge_mdb_entry *mp, bool notify)
1475 {
1476 	if (!mp->host_joined) {
1477 		mp->host_joined = true;
1478 		if (br_multicast_is_star_g(&mp->addr))
1479 			br_multicast_star_g_host_state(mp);
1480 		if (notify)
1481 			br_mdb_notify(mp->br->dev, mp, NULL, RTM_NEWMDB);
1482 	}
1483 
1484 	if (br_group_is_l2(&mp->addr))
1485 		return;
1486 
1487 	mod_timer(&mp->timer, jiffies + brmctx->multicast_membership_interval);
1488 }
1489 
1490 void br_multicast_host_leave(struct net_bridge_mdb_entry *mp, bool notify)
1491 {
1492 	if (!mp->host_joined)
1493 		return;
1494 
1495 	mp->host_joined = false;
1496 	if (br_multicast_is_star_g(&mp->addr))
1497 		br_multicast_star_g_host_state(mp);
1498 	if (notify)
1499 		br_mdb_notify(mp->br->dev, mp, NULL, RTM_DELMDB);
1500 }
1501 
1502 static struct net_bridge_port_group *
1503 __br_multicast_add_group(struct net_bridge_mcast *brmctx,
1504 			 struct net_bridge_mcast_port *pmctx,
1505 			 struct br_ip *group,
1506 			 const unsigned char *src,
1507 			 u8 filter_mode,
1508 			 bool igmpv2_mldv1,
1509 			 bool blocked)
1510 {
1511 	struct net_bridge_port_group __rcu **pp;
1512 	struct net_bridge_port_group *p = NULL;
1513 	struct net_bridge_mdb_entry *mp;
1514 	unsigned long now = jiffies;
1515 
1516 	if (!br_multicast_ctx_should_use(brmctx, pmctx))
1517 		goto out;
1518 
1519 	mp = br_multicast_new_group(brmctx->br, group);
1520 	if (IS_ERR(mp))
1521 		return ERR_CAST(mp);
1522 
1523 	if (!pmctx) {
1524 		br_multicast_host_join(brmctx, mp, true);
1525 		goto out;
1526 	}
1527 
1528 	for (pp = &mp->ports;
1529 	     (p = mlock_dereference(*pp, brmctx->br)) != NULL;
1530 	     pp = &p->next) {
1531 		if (br_port_group_equal(p, pmctx->port, src))
1532 			goto found;
1533 		if ((unsigned long)p->key.port < (unsigned long)pmctx->port)
1534 			break;
1535 	}
1536 
1537 	p = br_multicast_new_port_group(pmctx->port, group, *pp, 0, src,
1538 					filter_mode, RTPROT_KERNEL, NULL);
1539 	if (unlikely(!p)) {
1540 		p = ERR_PTR(-ENOMEM);
1541 		goto out;
1542 	}
1543 	rcu_assign_pointer(*pp, p);
1544 	if (blocked)
1545 		p->flags |= MDB_PG_FLAGS_BLOCKED;
1546 	br_mdb_notify(brmctx->br->dev, mp, p, RTM_NEWMDB);
1547 
1548 found:
1549 	if (igmpv2_mldv1)
1550 		mod_timer(&p->timer,
1551 			  now + brmctx->multicast_membership_interval);
1552 
1553 out:
1554 	return p;
1555 }
1556 
1557 static int br_multicast_add_group(struct net_bridge_mcast *brmctx,
1558 				  struct net_bridge_mcast_port *pmctx,
1559 				  struct br_ip *group,
1560 				  const unsigned char *src,
1561 				  u8 filter_mode,
1562 				  bool igmpv2_mldv1)
1563 {
1564 	struct net_bridge_port_group *pg;
1565 	int err;
1566 
1567 	spin_lock(&brmctx->br->multicast_lock);
1568 	pg = __br_multicast_add_group(brmctx, pmctx, group, src, filter_mode,
1569 				      igmpv2_mldv1, false);
1570 	/* NULL is considered valid for host joined groups */
1571 	err = PTR_ERR_OR_ZERO(pg);
1572 	spin_unlock(&brmctx->br->multicast_lock);
1573 
1574 	return err;
1575 }
1576 
1577 static int br_ip4_multicast_add_group(struct net_bridge_mcast *brmctx,
1578 				      struct net_bridge_mcast_port *pmctx,
1579 				      __be32 group,
1580 				      __u16 vid,
1581 				      const unsigned char *src,
1582 				      bool igmpv2)
1583 {
1584 	struct br_ip br_group;
1585 	u8 filter_mode;
1586 
1587 	if (ipv4_is_local_multicast(group))
1588 		return 0;
1589 
1590 	memset(&br_group, 0, sizeof(br_group));
1591 	br_group.dst.ip4 = group;
1592 	br_group.proto = htons(ETH_P_IP);
1593 	br_group.vid = vid;
1594 	filter_mode = igmpv2 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1595 
1596 	return br_multicast_add_group(brmctx, pmctx, &br_group, src,
1597 				      filter_mode, igmpv2);
1598 }
1599 
1600 #if IS_ENABLED(CONFIG_IPV6)
1601 static int br_ip6_multicast_add_group(struct net_bridge_mcast *brmctx,
1602 				      struct net_bridge_mcast_port *pmctx,
1603 				      const struct in6_addr *group,
1604 				      __u16 vid,
1605 				      const unsigned char *src,
1606 				      bool mldv1)
1607 {
1608 	struct br_ip br_group;
1609 	u8 filter_mode;
1610 
1611 	if (ipv6_addr_is_ll_all_nodes(group))
1612 		return 0;
1613 
1614 	memset(&br_group, 0, sizeof(br_group));
1615 	br_group.dst.ip6 = *group;
1616 	br_group.proto = htons(ETH_P_IPV6);
1617 	br_group.vid = vid;
1618 	filter_mode = mldv1 ? MCAST_EXCLUDE : MCAST_INCLUDE;
1619 
1620 	return br_multicast_add_group(brmctx, pmctx, &br_group, src,
1621 				      filter_mode, mldv1);
1622 }
1623 #endif
1624 
1625 static bool br_multicast_rport_del(struct hlist_node *rlist)
1626 {
1627 	if (hlist_unhashed(rlist))
1628 		return false;
1629 
1630 	hlist_del_init_rcu(rlist);
1631 	return true;
1632 }
1633 
1634 static bool br_ip4_multicast_rport_del(struct net_bridge_mcast_port *pmctx)
1635 {
1636 	return br_multicast_rport_del(&pmctx->ip4_rlist);
1637 }
1638 
1639 static bool br_ip6_multicast_rport_del(struct net_bridge_mcast_port *pmctx)
1640 {
1641 #if IS_ENABLED(CONFIG_IPV6)
1642 	return br_multicast_rport_del(&pmctx->ip6_rlist);
1643 #else
1644 	return false;
1645 #endif
1646 }
1647 
1648 static void br_multicast_router_expired(struct net_bridge_mcast_port *pmctx,
1649 					struct timer_list *t,
1650 					struct hlist_node *rlist)
1651 {
1652 	struct net_bridge *br = pmctx->port->br;
1653 	bool del;
1654 
1655 	spin_lock(&br->multicast_lock);
1656 	if (pmctx->multicast_router == MDB_RTR_TYPE_DISABLED ||
1657 	    pmctx->multicast_router == MDB_RTR_TYPE_PERM ||
1658 	    timer_pending(t))
1659 		goto out;
1660 
1661 	del = br_multicast_rport_del(rlist);
1662 	br_multicast_rport_del_notify(pmctx, del);
1663 out:
1664 	spin_unlock(&br->multicast_lock);
1665 }
1666 
1667 static void br_ip4_multicast_router_expired(struct timer_list *t)
1668 {
1669 	struct net_bridge_mcast_port *pmctx = from_timer(pmctx, t,
1670 							 ip4_mc_router_timer);
1671 
1672 	br_multicast_router_expired(pmctx, t, &pmctx->ip4_rlist);
1673 }
1674 
1675 #if IS_ENABLED(CONFIG_IPV6)
1676 static void br_ip6_multicast_router_expired(struct timer_list *t)
1677 {
1678 	struct net_bridge_mcast_port *pmctx = from_timer(pmctx, t,
1679 							 ip6_mc_router_timer);
1680 
1681 	br_multicast_router_expired(pmctx, t, &pmctx->ip6_rlist);
1682 }
1683 #endif
1684 
1685 static void br_mc_router_state_change(struct net_bridge *p,
1686 				      bool is_mc_router)
1687 {
1688 	struct switchdev_attr attr = {
1689 		.orig_dev = p->dev,
1690 		.id = SWITCHDEV_ATTR_ID_BRIDGE_MROUTER,
1691 		.flags = SWITCHDEV_F_DEFER,
1692 		.u.mrouter = is_mc_router,
1693 	};
1694 
1695 	switchdev_port_attr_set(p->dev, &attr, NULL);
1696 }
1697 
1698 static void br_multicast_local_router_expired(struct net_bridge_mcast *brmctx,
1699 					      struct timer_list *timer)
1700 {
1701 	spin_lock(&brmctx->br->multicast_lock);
1702 	if (brmctx->multicast_router == MDB_RTR_TYPE_DISABLED ||
1703 	    brmctx->multicast_router == MDB_RTR_TYPE_PERM ||
1704 	    br_ip4_multicast_is_router(brmctx) ||
1705 	    br_ip6_multicast_is_router(brmctx))
1706 		goto out;
1707 
1708 	br_mc_router_state_change(brmctx->br, false);
1709 out:
1710 	spin_unlock(&brmctx->br->multicast_lock);
1711 }
1712 
1713 static void br_ip4_multicast_local_router_expired(struct timer_list *t)
1714 {
1715 	struct net_bridge_mcast *brmctx = from_timer(brmctx, t,
1716 						     ip4_mc_router_timer);
1717 
1718 	br_multicast_local_router_expired(brmctx, t);
1719 }
1720 
1721 #if IS_ENABLED(CONFIG_IPV6)
1722 static void br_ip6_multicast_local_router_expired(struct timer_list *t)
1723 {
1724 	struct net_bridge_mcast *brmctx = from_timer(brmctx, t,
1725 						     ip6_mc_router_timer);
1726 
1727 	br_multicast_local_router_expired(brmctx, t);
1728 }
1729 #endif
1730 
1731 static void br_multicast_querier_expired(struct net_bridge_mcast *brmctx,
1732 					 struct bridge_mcast_own_query *query)
1733 {
1734 	spin_lock(&brmctx->br->multicast_lock);
1735 	if (!netif_running(brmctx->br->dev) ||
1736 	    br_multicast_ctx_vlan_global_disabled(brmctx) ||
1737 	    !br_opt_get(brmctx->br, BROPT_MULTICAST_ENABLED))
1738 		goto out;
1739 
1740 	br_multicast_start_querier(brmctx, query);
1741 
1742 out:
1743 	spin_unlock(&brmctx->br->multicast_lock);
1744 }
1745 
1746 static void br_ip4_multicast_querier_expired(struct timer_list *t)
1747 {
1748 	struct net_bridge_mcast *brmctx = from_timer(brmctx, t,
1749 						     ip4_other_query.timer);
1750 
1751 	br_multicast_querier_expired(brmctx, &brmctx->ip4_own_query);
1752 }
1753 
1754 #if IS_ENABLED(CONFIG_IPV6)
1755 static void br_ip6_multicast_querier_expired(struct timer_list *t)
1756 {
1757 	struct net_bridge_mcast *brmctx = from_timer(brmctx, t,
1758 						     ip6_other_query.timer);
1759 
1760 	br_multicast_querier_expired(brmctx, &brmctx->ip6_own_query);
1761 }
1762 #endif
1763 
1764 static void br_multicast_query_delay_expired(struct timer_list *t)
1765 {
1766 }
1767 
1768 static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx,
1769 					    struct br_ip *ip,
1770 					    struct sk_buff *skb)
1771 {
1772 	if (ip->proto == htons(ETH_P_IP))
1773 		brmctx->ip4_querier.addr.src.ip4 = ip_hdr(skb)->saddr;
1774 #if IS_ENABLED(CONFIG_IPV6)
1775 	else
1776 		brmctx->ip6_querier.addr.src.ip6 = ipv6_hdr(skb)->saddr;
1777 #endif
1778 }
1779 
1780 static void __br_multicast_send_query(struct net_bridge_mcast *brmctx,
1781 				      struct net_bridge_mcast_port *pmctx,
1782 				      struct net_bridge_port_group *pg,
1783 				      struct br_ip *ip_dst,
1784 				      struct br_ip *group,
1785 				      bool with_srcs,
1786 				      u8 sflag,
1787 				      bool *need_rexmit)
1788 {
1789 	bool over_lmqt = !!sflag;
1790 	struct sk_buff *skb;
1791 	u8 igmp_type;
1792 
1793 	if (!br_multicast_ctx_should_use(brmctx, pmctx) ||
1794 	    !br_multicast_ctx_matches_vlan_snooping(brmctx))
1795 		return;
1796 
1797 again_under_lmqt:
1798 	skb = br_multicast_alloc_query(brmctx, pmctx, pg, ip_dst, group,
1799 				       with_srcs, over_lmqt, sflag, &igmp_type,
1800 				       need_rexmit);
1801 	if (!skb)
1802 		return;
1803 
1804 	if (pmctx) {
1805 		skb->dev = pmctx->port->dev;
1806 		br_multicast_count(brmctx->br, pmctx->port, skb, igmp_type,
1807 				   BR_MCAST_DIR_TX);
1808 		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
1809 			dev_net(pmctx->port->dev), NULL, skb, NULL, skb->dev,
1810 			br_dev_queue_push_xmit);
1811 
1812 		if (over_lmqt && with_srcs && sflag) {
1813 			over_lmqt = false;
1814 			goto again_under_lmqt;
1815 		}
1816 	} else {
1817 		br_multicast_select_own_querier(brmctx, group, skb);
1818 		br_multicast_count(brmctx->br, NULL, skb, igmp_type,
1819 				   BR_MCAST_DIR_RX);
1820 		netif_rx(skb);
1821 	}
1822 }
1823 
1824 static void br_multicast_read_querier(const struct bridge_mcast_querier *querier,
1825 				      struct bridge_mcast_querier *dest)
1826 {
1827 	unsigned int seq;
1828 
1829 	memset(dest, 0, sizeof(*dest));
1830 	do {
1831 		seq = read_seqcount_begin(&querier->seq);
1832 		dest->port_ifidx = querier->port_ifidx;
1833 		memcpy(&dest->addr, &querier->addr, sizeof(struct br_ip));
1834 	} while (read_seqcount_retry(&querier->seq, seq));
1835 }
1836 
1837 static void br_multicast_update_querier(struct net_bridge_mcast *brmctx,
1838 					struct bridge_mcast_querier *querier,
1839 					int ifindex,
1840 					struct br_ip *saddr)
1841 {
1842 	write_seqcount_begin(&querier->seq);
1843 	querier->port_ifidx = ifindex;
1844 	memcpy(&querier->addr, saddr, sizeof(*saddr));
1845 	write_seqcount_end(&querier->seq);
1846 }
1847 
1848 static void br_multicast_send_query(struct net_bridge_mcast *brmctx,
1849 				    struct net_bridge_mcast_port *pmctx,
1850 				    struct bridge_mcast_own_query *own_query)
1851 {
1852 	struct bridge_mcast_other_query *other_query = NULL;
1853 	struct bridge_mcast_querier *querier;
1854 	struct br_ip br_group;
1855 	unsigned long time;
1856 
1857 	if (!br_multicast_ctx_should_use(brmctx, pmctx) ||
1858 	    !br_opt_get(brmctx->br, BROPT_MULTICAST_ENABLED) ||
1859 	    !brmctx->multicast_querier)
1860 		return;
1861 
1862 	memset(&br_group.dst, 0, sizeof(br_group.dst));
1863 
1864 	if (pmctx ? (own_query == &pmctx->ip4_own_query) :
1865 		    (own_query == &brmctx->ip4_own_query)) {
1866 		querier = &brmctx->ip4_querier;
1867 		other_query = &brmctx->ip4_other_query;
1868 		br_group.proto = htons(ETH_P_IP);
1869 #if IS_ENABLED(CONFIG_IPV6)
1870 	} else {
1871 		querier = &brmctx->ip6_querier;
1872 		other_query = &brmctx->ip6_other_query;
1873 		br_group.proto = htons(ETH_P_IPV6);
1874 #endif
1875 	}
1876 
1877 	if (!other_query || timer_pending(&other_query->timer))
1878 		return;
1879 
1880 	/* we're about to select ourselves as querier */
1881 	if (!pmctx && querier->port_ifidx) {
1882 		struct br_ip zeroip = {};
1883 
1884 		br_multicast_update_querier(brmctx, querier, 0, &zeroip);
1885 	}
1886 
1887 	__br_multicast_send_query(brmctx, pmctx, NULL, NULL, &br_group, false,
1888 				  0, NULL);
1889 
1890 	time = jiffies;
1891 	time += own_query->startup_sent < brmctx->multicast_startup_query_count ?
1892 		brmctx->multicast_startup_query_interval :
1893 		brmctx->multicast_query_interval;
1894 	mod_timer(&own_query->timer, time);
1895 }
1896 
1897 static void
1898 br_multicast_port_query_expired(struct net_bridge_mcast_port *pmctx,
1899 				struct bridge_mcast_own_query *query)
1900 {
1901 	struct net_bridge *br = pmctx->port->br;
1902 	struct net_bridge_mcast *brmctx;
1903 
1904 	spin_lock(&br->multicast_lock);
1905 	if (br_multicast_port_ctx_state_stopped(pmctx))
1906 		goto out;
1907 
1908 	brmctx = br_multicast_port_ctx_get_global(pmctx);
1909 	if (query->startup_sent < brmctx->multicast_startup_query_count)
1910 		query->startup_sent++;
1911 
1912 	br_multicast_send_query(brmctx, pmctx, query);
1913 
1914 out:
1915 	spin_unlock(&br->multicast_lock);
1916 }
1917 
1918 static void br_ip4_multicast_port_query_expired(struct timer_list *t)
1919 {
1920 	struct net_bridge_mcast_port *pmctx = from_timer(pmctx, t,
1921 							 ip4_own_query.timer);
1922 
1923 	br_multicast_port_query_expired(pmctx, &pmctx->ip4_own_query);
1924 }
1925 
1926 #if IS_ENABLED(CONFIG_IPV6)
1927 static void br_ip6_multicast_port_query_expired(struct timer_list *t)
1928 {
1929 	struct net_bridge_mcast_port *pmctx = from_timer(pmctx, t,
1930 							 ip6_own_query.timer);
1931 
1932 	br_multicast_port_query_expired(pmctx, &pmctx->ip6_own_query);
1933 }
1934 #endif
1935 
1936 static void br_multicast_port_group_rexmit(struct timer_list *t)
1937 {
1938 	struct net_bridge_port_group *pg = from_timer(pg, t, rexmit_timer);
1939 	struct bridge_mcast_other_query *other_query = NULL;
1940 	struct net_bridge *br = pg->key.port->br;
1941 	struct net_bridge_mcast_port *pmctx;
1942 	struct net_bridge_mcast *brmctx;
1943 	bool need_rexmit = false;
1944 
1945 	spin_lock(&br->multicast_lock);
1946 	if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
1947 	    !br_opt_get(br, BROPT_MULTICAST_ENABLED))
1948 		goto out;
1949 
1950 	pmctx = br_multicast_pg_to_port_ctx(pg);
1951 	if (!pmctx)
1952 		goto out;
1953 	brmctx = br_multicast_port_ctx_get_global(pmctx);
1954 	if (!brmctx->multicast_querier)
1955 		goto out;
1956 
1957 	if (pg->key.addr.proto == htons(ETH_P_IP))
1958 		other_query = &brmctx->ip4_other_query;
1959 #if IS_ENABLED(CONFIG_IPV6)
1960 	else
1961 		other_query = &brmctx->ip6_other_query;
1962 #endif
1963 
1964 	if (!other_query || timer_pending(&other_query->timer))
1965 		goto out;
1966 
1967 	if (pg->grp_query_rexmit_cnt) {
1968 		pg->grp_query_rexmit_cnt--;
1969 		__br_multicast_send_query(brmctx, pmctx, pg, &pg->key.addr,
1970 					  &pg->key.addr, false, 1, NULL);
1971 	}
1972 	__br_multicast_send_query(brmctx, pmctx, pg, &pg->key.addr,
1973 				  &pg->key.addr, true, 0, &need_rexmit);
1974 
1975 	if (pg->grp_query_rexmit_cnt || need_rexmit)
1976 		mod_timer(&pg->rexmit_timer, jiffies +
1977 					     brmctx->multicast_last_member_interval);
1978 out:
1979 	spin_unlock(&br->multicast_lock);
1980 }
1981 
1982 static int br_mc_disabled_update(struct net_device *dev, bool value,
1983 				 struct netlink_ext_ack *extack)
1984 {
1985 	struct switchdev_attr attr = {
1986 		.orig_dev = dev,
1987 		.id = SWITCHDEV_ATTR_ID_BRIDGE_MC_DISABLED,
1988 		.flags = SWITCHDEV_F_DEFER,
1989 		.u.mc_disabled = !value,
1990 	};
1991 
1992 	return switchdev_port_attr_set(dev, &attr, extack);
1993 }
1994 
1995 void br_multicast_port_ctx_init(struct net_bridge_port *port,
1996 				struct net_bridge_vlan *vlan,
1997 				struct net_bridge_mcast_port *pmctx)
1998 {
1999 	pmctx->port = port;
2000 	pmctx->vlan = vlan;
2001 	pmctx->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
2002 	timer_setup(&pmctx->ip4_mc_router_timer,
2003 		    br_ip4_multicast_router_expired, 0);
2004 	timer_setup(&pmctx->ip4_own_query.timer,
2005 		    br_ip4_multicast_port_query_expired, 0);
2006 #if IS_ENABLED(CONFIG_IPV6)
2007 	timer_setup(&pmctx->ip6_mc_router_timer,
2008 		    br_ip6_multicast_router_expired, 0);
2009 	timer_setup(&pmctx->ip6_own_query.timer,
2010 		    br_ip6_multicast_port_query_expired, 0);
2011 #endif
2012 }
2013 
2014 void br_multicast_port_ctx_deinit(struct net_bridge_mcast_port *pmctx)
2015 {
2016 #if IS_ENABLED(CONFIG_IPV6)
2017 	del_timer_sync(&pmctx->ip6_mc_router_timer);
2018 #endif
2019 	del_timer_sync(&pmctx->ip4_mc_router_timer);
2020 }
2021 
2022 int br_multicast_add_port(struct net_bridge_port *port)
2023 {
2024 	int err;
2025 
2026 	port->multicast_eht_hosts_limit = BR_MCAST_DEFAULT_EHT_HOSTS_LIMIT;
2027 	br_multicast_port_ctx_init(port, NULL, &port->multicast_ctx);
2028 
2029 	err = br_mc_disabled_update(port->dev,
2030 				    br_opt_get(port->br,
2031 					       BROPT_MULTICAST_ENABLED),
2032 				    NULL);
2033 	if (err && err != -EOPNOTSUPP)
2034 		return err;
2035 
2036 	port->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
2037 	if (!port->mcast_stats)
2038 		return -ENOMEM;
2039 
2040 	return 0;
2041 }
2042 
2043 void br_multicast_del_port(struct net_bridge_port *port)
2044 {
2045 	struct net_bridge *br = port->br;
2046 	struct net_bridge_port_group *pg;
2047 	HLIST_HEAD(deleted_head);
2048 	struct hlist_node *n;
2049 
2050 	/* Take care of the remaining groups, only perm ones should be left */
2051 	spin_lock_bh(&br->multicast_lock);
2052 	hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
2053 		br_multicast_find_del_pg(br, pg);
2054 	hlist_move_list(&br->mcast_gc_list, &deleted_head);
2055 	spin_unlock_bh(&br->multicast_lock);
2056 	br_multicast_gc(&deleted_head);
2057 	br_multicast_port_ctx_deinit(&port->multicast_ctx);
2058 	free_percpu(port->mcast_stats);
2059 }
2060 
2061 static void br_multicast_enable(struct bridge_mcast_own_query *query)
2062 {
2063 	query->startup_sent = 0;
2064 
2065 	if (try_to_del_timer_sync(&query->timer) >= 0 ||
2066 	    del_timer(&query->timer))
2067 		mod_timer(&query->timer, jiffies);
2068 }
2069 
2070 static void __br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx)
2071 {
2072 	struct net_bridge *br = pmctx->port->br;
2073 	struct net_bridge_mcast *brmctx;
2074 
2075 	brmctx = br_multicast_port_ctx_get_global(pmctx);
2076 	if (!br_opt_get(br, BROPT_MULTICAST_ENABLED) ||
2077 	    !netif_running(br->dev))
2078 		return;
2079 
2080 	br_multicast_enable(&pmctx->ip4_own_query);
2081 #if IS_ENABLED(CONFIG_IPV6)
2082 	br_multicast_enable(&pmctx->ip6_own_query);
2083 #endif
2084 	if (pmctx->multicast_router == MDB_RTR_TYPE_PERM) {
2085 		br_ip4_multicast_add_router(brmctx, pmctx);
2086 		br_ip6_multicast_add_router(brmctx, pmctx);
2087 	}
2088 
2089 	if (br_multicast_port_ctx_is_vlan(pmctx)) {
2090 		struct net_bridge_port_group *pg;
2091 		u32 n = 0;
2092 
2093 		/* The mcast_n_groups counter might be wrong. First,
2094 		 * BR_VLFLAG_MCAST_ENABLED is toggled before temporary entries
2095 		 * are flushed, thus mcast_n_groups after the toggle does not
2096 		 * reflect the true values. And second, permanent entries added
2097 		 * while BR_VLFLAG_MCAST_ENABLED was disabled, are not reflected
2098 		 * either. Thus we have to refresh the counter.
2099 		 */
2100 
2101 		hlist_for_each_entry(pg, &pmctx->port->mglist, mglist) {
2102 			if (pg->key.addr.vid == pmctx->vlan->vid)
2103 				n++;
2104 		}
2105 		WRITE_ONCE(pmctx->mdb_n_entries, n);
2106 	}
2107 }
2108 
2109 void br_multicast_enable_port(struct net_bridge_port *port)
2110 {
2111 	struct net_bridge *br = port->br;
2112 
2113 	spin_lock_bh(&br->multicast_lock);
2114 	__br_multicast_enable_port_ctx(&port->multicast_ctx);
2115 	spin_unlock_bh(&br->multicast_lock);
2116 }
2117 
2118 static void __br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx)
2119 {
2120 	struct net_bridge_port_group *pg;
2121 	struct hlist_node *n;
2122 	bool del = false;
2123 
2124 	hlist_for_each_entry_safe(pg, n, &pmctx->port->mglist, mglist)
2125 		if (!(pg->flags & MDB_PG_FLAGS_PERMANENT) &&
2126 		    (!br_multicast_port_ctx_is_vlan(pmctx) ||
2127 		     pg->key.addr.vid == pmctx->vlan->vid))
2128 			br_multicast_find_del_pg(pmctx->port->br, pg);
2129 
2130 	del |= br_ip4_multicast_rport_del(pmctx);
2131 	del_timer(&pmctx->ip4_mc_router_timer);
2132 	del_timer(&pmctx->ip4_own_query.timer);
2133 	del |= br_ip6_multicast_rport_del(pmctx);
2134 #if IS_ENABLED(CONFIG_IPV6)
2135 	del_timer(&pmctx->ip6_mc_router_timer);
2136 	del_timer(&pmctx->ip6_own_query.timer);
2137 #endif
2138 	br_multicast_rport_del_notify(pmctx, del);
2139 }
2140 
2141 void br_multicast_disable_port(struct net_bridge_port *port)
2142 {
2143 	spin_lock_bh(&port->br->multicast_lock);
2144 	__br_multicast_disable_port_ctx(&port->multicast_ctx);
2145 	spin_unlock_bh(&port->br->multicast_lock);
2146 }
2147 
2148 static int __grp_src_delete_marked(struct net_bridge_port_group *pg)
2149 {
2150 	struct net_bridge_group_src *ent;
2151 	struct hlist_node *tmp;
2152 	int deleted = 0;
2153 
2154 	hlist_for_each_entry_safe(ent, tmp, &pg->src_list, node)
2155 		if (ent->flags & BR_SGRP_F_DELETE) {
2156 			br_multicast_del_group_src(ent, false);
2157 			deleted++;
2158 		}
2159 
2160 	return deleted;
2161 }
2162 
2163 static void __grp_src_mod_timer(struct net_bridge_group_src *src,
2164 				unsigned long expires)
2165 {
2166 	mod_timer(&src->timer, expires);
2167 	br_multicast_fwd_src_handle(src);
2168 }
2169 
2170 static void __grp_src_query_marked_and_rexmit(struct net_bridge_mcast *brmctx,
2171 					      struct net_bridge_mcast_port *pmctx,
2172 					      struct net_bridge_port_group *pg)
2173 {
2174 	struct bridge_mcast_other_query *other_query = NULL;
2175 	u32 lmqc = brmctx->multicast_last_member_count;
2176 	unsigned long lmqt, lmi, now = jiffies;
2177 	struct net_bridge_group_src *ent;
2178 
2179 	if (!netif_running(brmctx->br->dev) ||
2180 	    !br_opt_get(brmctx->br, BROPT_MULTICAST_ENABLED))
2181 		return;
2182 
2183 	if (pg->key.addr.proto == htons(ETH_P_IP))
2184 		other_query = &brmctx->ip4_other_query;
2185 #if IS_ENABLED(CONFIG_IPV6)
2186 	else
2187 		other_query = &brmctx->ip6_other_query;
2188 #endif
2189 
2190 	lmqt = now + br_multicast_lmqt(brmctx);
2191 	hlist_for_each_entry(ent, &pg->src_list, node) {
2192 		if (ent->flags & BR_SGRP_F_SEND) {
2193 			ent->flags &= ~BR_SGRP_F_SEND;
2194 			if (ent->timer.expires > lmqt) {
2195 				if (brmctx->multicast_querier &&
2196 				    other_query &&
2197 				    !timer_pending(&other_query->timer))
2198 					ent->src_query_rexmit_cnt = lmqc;
2199 				__grp_src_mod_timer(ent, lmqt);
2200 			}
2201 		}
2202 	}
2203 
2204 	if (!brmctx->multicast_querier ||
2205 	    !other_query || timer_pending(&other_query->timer))
2206 		return;
2207 
2208 	__br_multicast_send_query(brmctx, pmctx, pg, &pg->key.addr,
2209 				  &pg->key.addr, true, 1, NULL);
2210 
2211 	lmi = now + brmctx->multicast_last_member_interval;
2212 	if (!timer_pending(&pg->rexmit_timer) ||
2213 	    time_after(pg->rexmit_timer.expires, lmi))
2214 		mod_timer(&pg->rexmit_timer, lmi);
2215 }
2216 
2217 static void __grp_send_query_and_rexmit(struct net_bridge_mcast *brmctx,
2218 					struct net_bridge_mcast_port *pmctx,
2219 					struct net_bridge_port_group *pg)
2220 {
2221 	struct bridge_mcast_other_query *other_query = NULL;
2222 	unsigned long now = jiffies, lmi;
2223 
2224 	if (!netif_running(brmctx->br->dev) ||
2225 	    !br_opt_get(brmctx->br, BROPT_MULTICAST_ENABLED))
2226 		return;
2227 
2228 	if (pg->key.addr.proto == htons(ETH_P_IP))
2229 		other_query = &brmctx->ip4_other_query;
2230 #if IS_ENABLED(CONFIG_IPV6)
2231 	else
2232 		other_query = &brmctx->ip6_other_query;
2233 #endif
2234 
2235 	if (brmctx->multicast_querier &&
2236 	    other_query && !timer_pending(&other_query->timer)) {
2237 		lmi = now + brmctx->multicast_last_member_interval;
2238 		pg->grp_query_rexmit_cnt = brmctx->multicast_last_member_count - 1;
2239 		__br_multicast_send_query(brmctx, pmctx, pg, &pg->key.addr,
2240 					  &pg->key.addr, false, 0, NULL);
2241 		if (!timer_pending(&pg->rexmit_timer) ||
2242 		    time_after(pg->rexmit_timer.expires, lmi))
2243 			mod_timer(&pg->rexmit_timer, lmi);
2244 	}
2245 
2246 	if (pg->filter_mode == MCAST_EXCLUDE &&
2247 	    (!timer_pending(&pg->timer) ||
2248 	     time_after(pg->timer.expires, now + br_multicast_lmqt(brmctx))))
2249 		mod_timer(&pg->timer, now + br_multicast_lmqt(brmctx));
2250 }
2251 
2252 /* State          Msg type      New state                Actions
2253  * INCLUDE (A)    IS_IN (B)     INCLUDE (A+B)            (B)=GMI
2254  * INCLUDE (A)    ALLOW (B)     INCLUDE (A+B)            (B)=GMI
2255  * EXCLUDE (X,Y)  ALLOW (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
2256  */
2257 static bool br_multicast_isinc_allow(const struct net_bridge_mcast *brmctx,
2258 				     struct net_bridge_port_group *pg, void *h_addr,
2259 				     void *srcs, u32 nsrcs, size_t addr_size,
2260 				     int grec_type)
2261 {
2262 	struct net_bridge_group_src *ent;
2263 	unsigned long now = jiffies;
2264 	bool changed = false;
2265 	struct br_ip src_ip;
2266 	u32 src_idx;
2267 
2268 	memset(&src_ip, 0, sizeof(src_ip));
2269 	src_ip.proto = pg->key.addr.proto;
2270 	for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2271 		memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2272 		ent = br_multicast_find_group_src(pg, &src_ip);
2273 		if (!ent) {
2274 			ent = br_multicast_new_group_src(pg, &src_ip);
2275 			if (ent)
2276 				changed = true;
2277 		}
2278 
2279 		if (ent)
2280 			__grp_src_mod_timer(ent, now + br_multicast_gmi(brmctx));
2281 	}
2282 
2283 	if (br_multicast_eht_handle(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2284 				    grec_type))
2285 		changed = true;
2286 
2287 	return changed;
2288 }
2289 
2290 /* State          Msg type      New state                Actions
2291  * INCLUDE (A)    IS_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
2292  *                                                       Delete (A-B)
2293  *                                                       Group Timer=GMI
2294  */
2295 static void __grp_src_isexc_incl(const struct net_bridge_mcast *brmctx,
2296 				 struct net_bridge_port_group *pg, void *h_addr,
2297 				 void *srcs, u32 nsrcs, size_t addr_size,
2298 				 int grec_type)
2299 {
2300 	struct net_bridge_group_src *ent;
2301 	struct br_ip src_ip;
2302 	u32 src_idx;
2303 
2304 	hlist_for_each_entry(ent, &pg->src_list, node)
2305 		ent->flags |= BR_SGRP_F_DELETE;
2306 
2307 	memset(&src_ip, 0, sizeof(src_ip));
2308 	src_ip.proto = pg->key.addr.proto;
2309 	for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2310 		memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2311 		ent = br_multicast_find_group_src(pg, &src_ip);
2312 		if (ent)
2313 			ent->flags &= ~BR_SGRP_F_DELETE;
2314 		else
2315 			ent = br_multicast_new_group_src(pg, &src_ip);
2316 		if (ent)
2317 			br_multicast_fwd_src_handle(ent);
2318 	}
2319 
2320 	br_multicast_eht_handle(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2321 				grec_type);
2322 
2323 	__grp_src_delete_marked(pg);
2324 }
2325 
2326 /* State          Msg type      New state                Actions
2327  * EXCLUDE (X,Y)  IS_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=GMI
2328  *                                                       Delete (X-A)
2329  *                                                       Delete (Y-A)
2330  *                                                       Group Timer=GMI
2331  */
2332 static bool __grp_src_isexc_excl(const struct net_bridge_mcast *brmctx,
2333 				 struct net_bridge_port_group *pg, void *h_addr,
2334 				 void *srcs, u32 nsrcs, size_t addr_size,
2335 				 int grec_type)
2336 {
2337 	struct net_bridge_group_src *ent;
2338 	unsigned long now = jiffies;
2339 	bool changed = false;
2340 	struct br_ip src_ip;
2341 	u32 src_idx;
2342 
2343 	hlist_for_each_entry(ent, &pg->src_list, node)
2344 		ent->flags |= BR_SGRP_F_DELETE;
2345 
2346 	memset(&src_ip, 0, sizeof(src_ip));
2347 	src_ip.proto = pg->key.addr.proto;
2348 	for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2349 		memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2350 		ent = br_multicast_find_group_src(pg, &src_ip);
2351 		if (ent) {
2352 			ent->flags &= ~BR_SGRP_F_DELETE;
2353 		} else {
2354 			ent = br_multicast_new_group_src(pg, &src_ip);
2355 			if (ent) {
2356 				__grp_src_mod_timer(ent,
2357 						    now + br_multicast_gmi(brmctx));
2358 				changed = true;
2359 			}
2360 		}
2361 	}
2362 
2363 	if (br_multicast_eht_handle(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2364 				    grec_type))
2365 		changed = true;
2366 
2367 	if (__grp_src_delete_marked(pg))
2368 		changed = true;
2369 
2370 	return changed;
2371 }
2372 
2373 static bool br_multicast_isexc(const struct net_bridge_mcast *brmctx,
2374 			       struct net_bridge_port_group *pg, void *h_addr,
2375 			       void *srcs, u32 nsrcs, size_t addr_size,
2376 			       int grec_type)
2377 {
2378 	bool changed = false;
2379 
2380 	switch (pg->filter_mode) {
2381 	case MCAST_INCLUDE:
2382 		__grp_src_isexc_incl(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2383 				     grec_type);
2384 		br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
2385 		changed = true;
2386 		break;
2387 	case MCAST_EXCLUDE:
2388 		changed = __grp_src_isexc_excl(brmctx, pg, h_addr, srcs, nsrcs,
2389 					       addr_size, grec_type);
2390 		break;
2391 	}
2392 
2393 	pg->filter_mode = MCAST_EXCLUDE;
2394 	mod_timer(&pg->timer, jiffies + br_multicast_gmi(brmctx));
2395 
2396 	return changed;
2397 }
2398 
2399 /* State          Msg type      New state                Actions
2400  * INCLUDE (A)    TO_IN (B)     INCLUDE (A+B)            (B)=GMI
2401  *                                                       Send Q(G,A-B)
2402  */
2403 static bool __grp_src_toin_incl(struct net_bridge_mcast *brmctx,
2404 				struct net_bridge_mcast_port *pmctx,
2405 				struct net_bridge_port_group *pg, void *h_addr,
2406 				void *srcs, u32 nsrcs, size_t addr_size,
2407 				int grec_type)
2408 {
2409 	u32 src_idx, to_send = pg->src_ents;
2410 	struct net_bridge_group_src *ent;
2411 	unsigned long now = jiffies;
2412 	bool changed = false;
2413 	struct br_ip src_ip;
2414 
2415 	hlist_for_each_entry(ent, &pg->src_list, node)
2416 		ent->flags |= BR_SGRP_F_SEND;
2417 
2418 	memset(&src_ip, 0, sizeof(src_ip));
2419 	src_ip.proto = pg->key.addr.proto;
2420 	for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2421 		memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2422 		ent = br_multicast_find_group_src(pg, &src_ip);
2423 		if (ent) {
2424 			ent->flags &= ~BR_SGRP_F_SEND;
2425 			to_send--;
2426 		} else {
2427 			ent = br_multicast_new_group_src(pg, &src_ip);
2428 			if (ent)
2429 				changed = true;
2430 		}
2431 		if (ent)
2432 			__grp_src_mod_timer(ent, now + br_multicast_gmi(brmctx));
2433 	}
2434 
2435 	if (br_multicast_eht_handle(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2436 				    grec_type))
2437 		changed = true;
2438 
2439 	if (to_send)
2440 		__grp_src_query_marked_and_rexmit(brmctx, pmctx, pg);
2441 
2442 	return changed;
2443 }
2444 
2445 /* State          Msg type      New state                Actions
2446  * EXCLUDE (X,Y)  TO_IN (A)     EXCLUDE (X+A,Y-A)        (A)=GMI
2447  *                                                       Send Q(G,X-A)
2448  *                                                       Send Q(G)
2449  */
2450 static bool __grp_src_toin_excl(struct net_bridge_mcast *brmctx,
2451 				struct net_bridge_mcast_port *pmctx,
2452 				struct net_bridge_port_group *pg, void *h_addr,
2453 				void *srcs, u32 nsrcs, size_t addr_size,
2454 				int grec_type)
2455 {
2456 	u32 src_idx, to_send = pg->src_ents;
2457 	struct net_bridge_group_src *ent;
2458 	unsigned long now = jiffies;
2459 	bool changed = false;
2460 	struct br_ip src_ip;
2461 
2462 	hlist_for_each_entry(ent, &pg->src_list, node)
2463 		if (timer_pending(&ent->timer))
2464 			ent->flags |= BR_SGRP_F_SEND;
2465 
2466 	memset(&src_ip, 0, sizeof(src_ip));
2467 	src_ip.proto = pg->key.addr.proto;
2468 	for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2469 		memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2470 		ent = br_multicast_find_group_src(pg, &src_ip);
2471 		if (ent) {
2472 			if (timer_pending(&ent->timer)) {
2473 				ent->flags &= ~BR_SGRP_F_SEND;
2474 				to_send--;
2475 			}
2476 		} else {
2477 			ent = br_multicast_new_group_src(pg, &src_ip);
2478 			if (ent)
2479 				changed = true;
2480 		}
2481 		if (ent)
2482 			__grp_src_mod_timer(ent, now + br_multicast_gmi(brmctx));
2483 	}
2484 
2485 	if (br_multicast_eht_handle(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2486 				    grec_type))
2487 		changed = true;
2488 
2489 	if (to_send)
2490 		__grp_src_query_marked_and_rexmit(brmctx, pmctx, pg);
2491 
2492 	__grp_send_query_and_rexmit(brmctx, pmctx, pg);
2493 
2494 	return changed;
2495 }
2496 
2497 static bool br_multicast_toin(struct net_bridge_mcast *brmctx,
2498 			      struct net_bridge_mcast_port *pmctx,
2499 			      struct net_bridge_port_group *pg, void *h_addr,
2500 			      void *srcs, u32 nsrcs, size_t addr_size,
2501 			      int grec_type)
2502 {
2503 	bool changed = false;
2504 
2505 	switch (pg->filter_mode) {
2506 	case MCAST_INCLUDE:
2507 		changed = __grp_src_toin_incl(brmctx, pmctx, pg, h_addr, srcs,
2508 					      nsrcs, addr_size, grec_type);
2509 		break;
2510 	case MCAST_EXCLUDE:
2511 		changed = __grp_src_toin_excl(brmctx, pmctx, pg, h_addr, srcs,
2512 					      nsrcs, addr_size, grec_type);
2513 		break;
2514 	}
2515 
2516 	if (br_multicast_eht_should_del_pg(pg)) {
2517 		pg->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2518 		br_multicast_find_del_pg(pg->key.port->br, pg);
2519 		/* a notification has already been sent and we shouldn't
2520 		 * access pg after the delete so we have to return false
2521 		 */
2522 		changed = false;
2523 	}
2524 
2525 	return changed;
2526 }
2527 
2528 /* State          Msg type      New state                Actions
2529  * INCLUDE (A)    TO_EX (B)     EXCLUDE (A*B,B-A)        (B-A)=0
2530  *                                                       Delete (A-B)
2531  *                                                       Send Q(G,A*B)
2532  *                                                       Group Timer=GMI
2533  */
2534 static void __grp_src_toex_incl(struct net_bridge_mcast *brmctx,
2535 				struct net_bridge_mcast_port *pmctx,
2536 				struct net_bridge_port_group *pg, void *h_addr,
2537 				void *srcs, u32 nsrcs, size_t addr_size,
2538 				int grec_type)
2539 {
2540 	struct net_bridge_group_src *ent;
2541 	u32 src_idx, to_send = 0;
2542 	struct br_ip src_ip;
2543 
2544 	hlist_for_each_entry(ent, &pg->src_list, node)
2545 		ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2546 
2547 	memset(&src_ip, 0, sizeof(src_ip));
2548 	src_ip.proto = pg->key.addr.proto;
2549 	for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2550 		memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2551 		ent = br_multicast_find_group_src(pg, &src_ip);
2552 		if (ent) {
2553 			ent->flags = (ent->flags & ~BR_SGRP_F_DELETE) |
2554 				     BR_SGRP_F_SEND;
2555 			to_send++;
2556 		} else {
2557 			ent = br_multicast_new_group_src(pg, &src_ip);
2558 		}
2559 		if (ent)
2560 			br_multicast_fwd_src_handle(ent);
2561 	}
2562 
2563 	br_multicast_eht_handle(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2564 				grec_type);
2565 
2566 	__grp_src_delete_marked(pg);
2567 	if (to_send)
2568 		__grp_src_query_marked_and_rexmit(brmctx, pmctx, pg);
2569 }
2570 
2571 /* State          Msg type      New state                Actions
2572  * EXCLUDE (X,Y)  TO_EX (A)     EXCLUDE (A-Y,Y*A)        (A-X-Y)=Group Timer
2573  *                                                       Delete (X-A)
2574  *                                                       Delete (Y-A)
2575  *                                                       Send Q(G,A-Y)
2576  *                                                       Group Timer=GMI
2577  */
2578 static bool __grp_src_toex_excl(struct net_bridge_mcast *brmctx,
2579 				struct net_bridge_mcast_port *pmctx,
2580 				struct net_bridge_port_group *pg, void *h_addr,
2581 				void *srcs, u32 nsrcs, size_t addr_size,
2582 				int grec_type)
2583 {
2584 	struct net_bridge_group_src *ent;
2585 	u32 src_idx, to_send = 0;
2586 	bool changed = false;
2587 	struct br_ip src_ip;
2588 
2589 	hlist_for_each_entry(ent, &pg->src_list, node)
2590 		ent->flags = (ent->flags & ~BR_SGRP_F_SEND) | BR_SGRP_F_DELETE;
2591 
2592 	memset(&src_ip, 0, sizeof(src_ip));
2593 	src_ip.proto = pg->key.addr.proto;
2594 	for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2595 		memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2596 		ent = br_multicast_find_group_src(pg, &src_ip);
2597 		if (ent) {
2598 			ent->flags &= ~BR_SGRP_F_DELETE;
2599 		} else {
2600 			ent = br_multicast_new_group_src(pg, &src_ip);
2601 			if (ent) {
2602 				__grp_src_mod_timer(ent, pg->timer.expires);
2603 				changed = true;
2604 			}
2605 		}
2606 		if (ent && timer_pending(&ent->timer)) {
2607 			ent->flags |= BR_SGRP_F_SEND;
2608 			to_send++;
2609 		}
2610 	}
2611 
2612 	if (br_multicast_eht_handle(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2613 				    grec_type))
2614 		changed = true;
2615 
2616 	if (__grp_src_delete_marked(pg))
2617 		changed = true;
2618 	if (to_send)
2619 		__grp_src_query_marked_and_rexmit(brmctx, pmctx, pg);
2620 
2621 	return changed;
2622 }
2623 
2624 static bool br_multicast_toex(struct net_bridge_mcast *brmctx,
2625 			      struct net_bridge_mcast_port *pmctx,
2626 			      struct net_bridge_port_group *pg, void *h_addr,
2627 			      void *srcs, u32 nsrcs, size_t addr_size,
2628 			      int grec_type)
2629 {
2630 	bool changed = false;
2631 
2632 	switch (pg->filter_mode) {
2633 	case MCAST_INCLUDE:
2634 		__grp_src_toex_incl(brmctx, pmctx, pg, h_addr, srcs, nsrcs,
2635 				    addr_size, grec_type);
2636 		br_multicast_star_g_handle_mode(pg, MCAST_EXCLUDE);
2637 		changed = true;
2638 		break;
2639 	case MCAST_EXCLUDE:
2640 		changed = __grp_src_toex_excl(brmctx, pmctx, pg, h_addr, srcs,
2641 					      nsrcs, addr_size, grec_type);
2642 		break;
2643 	}
2644 
2645 	pg->filter_mode = MCAST_EXCLUDE;
2646 	mod_timer(&pg->timer, jiffies + br_multicast_gmi(brmctx));
2647 
2648 	return changed;
2649 }
2650 
2651 /* State          Msg type      New state                Actions
2652  * INCLUDE (A)    BLOCK (B)     INCLUDE (A)              Send Q(G,A*B)
2653  */
2654 static bool __grp_src_block_incl(struct net_bridge_mcast *brmctx,
2655 				 struct net_bridge_mcast_port *pmctx,
2656 				 struct net_bridge_port_group *pg, void *h_addr,
2657 				 void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2658 {
2659 	struct net_bridge_group_src *ent;
2660 	u32 src_idx, to_send = 0;
2661 	bool changed = false;
2662 	struct br_ip src_ip;
2663 
2664 	hlist_for_each_entry(ent, &pg->src_list, node)
2665 		ent->flags &= ~BR_SGRP_F_SEND;
2666 
2667 	memset(&src_ip, 0, sizeof(src_ip));
2668 	src_ip.proto = pg->key.addr.proto;
2669 	for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2670 		memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2671 		ent = br_multicast_find_group_src(pg, &src_ip);
2672 		if (ent) {
2673 			ent->flags |= BR_SGRP_F_SEND;
2674 			to_send++;
2675 		}
2676 	}
2677 
2678 	if (br_multicast_eht_handle(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2679 				    grec_type))
2680 		changed = true;
2681 
2682 	if (to_send)
2683 		__grp_src_query_marked_and_rexmit(brmctx, pmctx, pg);
2684 
2685 	return changed;
2686 }
2687 
2688 /* State          Msg type      New state                Actions
2689  * EXCLUDE (X,Y)  BLOCK (A)     EXCLUDE (X+(A-Y),Y)      (A-X-Y)=Group Timer
2690  *                                                       Send Q(G,A-Y)
2691  */
2692 static bool __grp_src_block_excl(struct net_bridge_mcast *brmctx,
2693 				 struct net_bridge_mcast_port *pmctx,
2694 				 struct net_bridge_port_group *pg, void *h_addr,
2695 				 void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2696 {
2697 	struct net_bridge_group_src *ent;
2698 	u32 src_idx, to_send = 0;
2699 	bool changed = false;
2700 	struct br_ip src_ip;
2701 
2702 	hlist_for_each_entry(ent, &pg->src_list, node)
2703 		ent->flags &= ~BR_SGRP_F_SEND;
2704 
2705 	memset(&src_ip, 0, sizeof(src_ip));
2706 	src_ip.proto = pg->key.addr.proto;
2707 	for (src_idx = 0; src_idx < nsrcs; src_idx++) {
2708 		memcpy(&src_ip.src, srcs + (src_idx * addr_size), addr_size);
2709 		ent = br_multicast_find_group_src(pg, &src_ip);
2710 		if (!ent) {
2711 			ent = br_multicast_new_group_src(pg, &src_ip);
2712 			if (ent) {
2713 				__grp_src_mod_timer(ent, pg->timer.expires);
2714 				changed = true;
2715 			}
2716 		}
2717 		if (ent && timer_pending(&ent->timer)) {
2718 			ent->flags |= BR_SGRP_F_SEND;
2719 			to_send++;
2720 		}
2721 	}
2722 
2723 	if (br_multicast_eht_handle(brmctx, pg, h_addr, srcs, nsrcs, addr_size,
2724 				    grec_type))
2725 		changed = true;
2726 
2727 	if (to_send)
2728 		__grp_src_query_marked_and_rexmit(brmctx, pmctx, pg);
2729 
2730 	return changed;
2731 }
2732 
2733 static bool br_multicast_block(struct net_bridge_mcast *brmctx,
2734 			       struct net_bridge_mcast_port *pmctx,
2735 			       struct net_bridge_port_group *pg, void *h_addr,
2736 			       void *srcs, u32 nsrcs, size_t addr_size, int grec_type)
2737 {
2738 	bool changed = false;
2739 
2740 	switch (pg->filter_mode) {
2741 	case MCAST_INCLUDE:
2742 		changed = __grp_src_block_incl(brmctx, pmctx, pg, h_addr, srcs,
2743 					       nsrcs, addr_size, grec_type);
2744 		break;
2745 	case MCAST_EXCLUDE:
2746 		changed = __grp_src_block_excl(brmctx, pmctx, pg, h_addr, srcs,
2747 					       nsrcs, addr_size, grec_type);
2748 		break;
2749 	}
2750 
2751 	if ((pg->filter_mode == MCAST_INCLUDE && hlist_empty(&pg->src_list)) ||
2752 	    br_multicast_eht_should_del_pg(pg)) {
2753 		if (br_multicast_eht_should_del_pg(pg))
2754 			pg->flags |= MDB_PG_FLAGS_FAST_LEAVE;
2755 		br_multicast_find_del_pg(pg->key.port->br, pg);
2756 		/* a notification has already been sent and we shouldn't
2757 		 * access pg after the delete so we have to return false
2758 		 */
2759 		changed = false;
2760 	}
2761 
2762 	return changed;
2763 }
2764 
2765 static struct net_bridge_port_group *
2766 br_multicast_find_port(struct net_bridge_mdb_entry *mp,
2767 		       struct net_bridge_port *p,
2768 		       const unsigned char *src)
2769 {
2770 	struct net_bridge *br __maybe_unused = mp->br;
2771 	struct net_bridge_port_group *pg;
2772 
2773 	for (pg = mlock_dereference(mp->ports, br);
2774 	     pg;
2775 	     pg = mlock_dereference(pg->next, br))
2776 		if (br_port_group_equal(pg, p, src))
2777 			return pg;
2778 
2779 	return NULL;
2780 }
2781 
2782 static int br_ip4_multicast_igmp3_report(struct net_bridge_mcast *brmctx,
2783 					 struct net_bridge_mcast_port *pmctx,
2784 					 struct sk_buff *skb,
2785 					 u16 vid)
2786 {
2787 	bool igmpv2 = brmctx->multicast_igmp_version == 2;
2788 	struct net_bridge_mdb_entry *mdst;
2789 	struct net_bridge_port_group *pg;
2790 	const unsigned char *src;
2791 	struct igmpv3_report *ih;
2792 	struct igmpv3_grec *grec;
2793 	int i, len, num, type;
2794 	__be32 group, *h_addr;
2795 	bool changed = false;
2796 	int err = 0;
2797 	u16 nsrcs;
2798 
2799 	ih = igmpv3_report_hdr(skb);
2800 	num = ntohs(ih->ngrec);
2801 	len = skb_transport_offset(skb) + sizeof(*ih);
2802 
2803 	for (i = 0; i < num; i++) {
2804 		len += sizeof(*grec);
2805 		if (!ip_mc_may_pull(skb, len))
2806 			return -EINVAL;
2807 
2808 		grec = (void *)(skb->data + len - sizeof(*grec));
2809 		group = grec->grec_mca;
2810 		type = grec->grec_type;
2811 		nsrcs = ntohs(grec->grec_nsrcs);
2812 
2813 		len += nsrcs * 4;
2814 		if (!ip_mc_may_pull(skb, len))
2815 			return -EINVAL;
2816 
2817 		switch (type) {
2818 		case IGMPV3_MODE_IS_INCLUDE:
2819 		case IGMPV3_MODE_IS_EXCLUDE:
2820 		case IGMPV3_CHANGE_TO_INCLUDE:
2821 		case IGMPV3_CHANGE_TO_EXCLUDE:
2822 		case IGMPV3_ALLOW_NEW_SOURCES:
2823 		case IGMPV3_BLOCK_OLD_SOURCES:
2824 			break;
2825 
2826 		default:
2827 			continue;
2828 		}
2829 
2830 		src = eth_hdr(skb)->h_source;
2831 		if (nsrcs == 0 &&
2832 		    (type == IGMPV3_CHANGE_TO_INCLUDE ||
2833 		     type == IGMPV3_MODE_IS_INCLUDE)) {
2834 			if (!pmctx || igmpv2) {
2835 				br_ip4_multicast_leave_group(brmctx, pmctx,
2836 							     group, vid, src);
2837 				continue;
2838 			}
2839 		} else {
2840 			err = br_ip4_multicast_add_group(brmctx, pmctx, group,
2841 							 vid, src, igmpv2);
2842 			if (err)
2843 				break;
2844 		}
2845 
2846 		if (!pmctx || igmpv2)
2847 			continue;
2848 
2849 		spin_lock(&brmctx->br->multicast_lock);
2850 		if (!br_multicast_ctx_should_use(brmctx, pmctx))
2851 			goto unlock_continue;
2852 
2853 		mdst = br_mdb_ip4_get(brmctx->br, group, vid);
2854 		if (!mdst)
2855 			goto unlock_continue;
2856 		pg = br_multicast_find_port(mdst, pmctx->port, src);
2857 		if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2858 			goto unlock_continue;
2859 		/* reload grec and host addr */
2860 		grec = (void *)(skb->data + len - sizeof(*grec) - (nsrcs * 4));
2861 		h_addr = &ip_hdr(skb)->saddr;
2862 		switch (type) {
2863 		case IGMPV3_ALLOW_NEW_SOURCES:
2864 			changed = br_multicast_isinc_allow(brmctx, pg, h_addr,
2865 							   grec->grec_src,
2866 							   nsrcs, sizeof(__be32), type);
2867 			break;
2868 		case IGMPV3_MODE_IS_INCLUDE:
2869 			changed = br_multicast_isinc_allow(brmctx, pg, h_addr,
2870 							   grec->grec_src,
2871 							   nsrcs, sizeof(__be32), type);
2872 			break;
2873 		case IGMPV3_MODE_IS_EXCLUDE:
2874 			changed = br_multicast_isexc(brmctx, pg, h_addr,
2875 						     grec->grec_src,
2876 						     nsrcs, sizeof(__be32), type);
2877 			break;
2878 		case IGMPV3_CHANGE_TO_INCLUDE:
2879 			changed = br_multicast_toin(brmctx, pmctx, pg, h_addr,
2880 						    grec->grec_src,
2881 						    nsrcs, sizeof(__be32), type);
2882 			break;
2883 		case IGMPV3_CHANGE_TO_EXCLUDE:
2884 			changed = br_multicast_toex(brmctx, pmctx, pg, h_addr,
2885 						    grec->grec_src,
2886 						    nsrcs, sizeof(__be32), type);
2887 			break;
2888 		case IGMPV3_BLOCK_OLD_SOURCES:
2889 			changed = br_multicast_block(brmctx, pmctx, pg, h_addr,
2890 						     grec->grec_src,
2891 						     nsrcs, sizeof(__be32), type);
2892 			break;
2893 		}
2894 		if (changed)
2895 			br_mdb_notify(brmctx->br->dev, mdst, pg, RTM_NEWMDB);
2896 unlock_continue:
2897 		spin_unlock(&brmctx->br->multicast_lock);
2898 	}
2899 
2900 	return err;
2901 }
2902 
2903 #if IS_ENABLED(CONFIG_IPV6)
2904 static int br_ip6_multicast_mld2_report(struct net_bridge_mcast *brmctx,
2905 					struct net_bridge_mcast_port *pmctx,
2906 					struct sk_buff *skb,
2907 					u16 vid)
2908 {
2909 	bool mldv1 = brmctx->multicast_mld_version == 1;
2910 	struct net_bridge_mdb_entry *mdst;
2911 	struct net_bridge_port_group *pg;
2912 	unsigned int nsrcs_offset;
2913 	struct mld2_report *mld2r;
2914 	const unsigned char *src;
2915 	struct in6_addr *h_addr;
2916 	struct mld2_grec *grec;
2917 	unsigned int grec_len;
2918 	bool changed = false;
2919 	int i, len, num;
2920 	int err = 0;
2921 
2922 	if (!ipv6_mc_may_pull(skb, sizeof(*mld2r)))
2923 		return -EINVAL;
2924 
2925 	mld2r = (struct mld2_report *)icmp6_hdr(skb);
2926 	num = ntohs(mld2r->mld2r_ngrec);
2927 	len = skb_transport_offset(skb) + sizeof(*mld2r);
2928 
2929 	for (i = 0; i < num; i++) {
2930 		__be16 *_nsrcs, __nsrcs;
2931 		u16 nsrcs;
2932 
2933 		nsrcs_offset = len + offsetof(struct mld2_grec, grec_nsrcs);
2934 
2935 		if (skb_transport_offset(skb) + ipv6_transport_len(skb) <
2936 		    nsrcs_offset + sizeof(__nsrcs))
2937 			return -EINVAL;
2938 
2939 		_nsrcs = skb_header_pointer(skb, nsrcs_offset,
2940 					    sizeof(__nsrcs), &__nsrcs);
2941 		if (!_nsrcs)
2942 			return -EINVAL;
2943 
2944 		nsrcs = ntohs(*_nsrcs);
2945 		grec_len = struct_size(grec, grec_src, nsrcs);
2946 
2947 		if (!ipv6_mc_may_pull(skb, len + grec_len))
2948 			return -EINVAL;
2949 
2950 		grec = (struct mld2_grec *)(skb->data + len);
2951 		len += grec_len;
2952 
2953 		switch (grec->grec_type) {
2954 		case MLD2_MODE_IS_INCLUDE:
2955 		case MLD2_MODE_IS_EXCLUDE:
2956 		case MLD2_CHANGE_TO_INCLUDE:
2957 		case MLD2_CHANGE_TO_EXCLUDE:
2958 		case MLD2_ALLOW_NEW_SOURCES:
2959 		case MLD2_BLOCK_OLD_SOURCES:
2960 			break;
2961 
2962 		default:
2963 			continue;
2964 		}
2965 
2966 		src = eth_hdr(skb)->h_source;
2967 		if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
2968 		     grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
2969 		    nsrcs == 0) {
2970 			if (!pmctx || mldv1) {
2971 				br_ip6_multicast_leave_group(brmctx, pmctx,
2972 							     &grec->grec_mca,
2973 							     vid, src);
2974 				continue;
2975 			}
2976 		} else {
2977 			err = br_ip6_multicast_add_group(brmctx, pmctx,
2978 							 &grec->grec_mca, vid,
2979 							 src, mldv1);
2980 			if (err)
2981 				break;
2982 		}
2983 
2984 		if (!pmctx || mldv1)
2985 			continue;
2986 
2987 		spin_lock(&brmctx->br->multicast_lock);
2988 		if (!br_multicast_ctx_should_use(brmctx, pmctx))
2989 			goto unlock_continue;
2990 
2991 		mdst = br_mdb_ip6_get(brmctx->br, &grec->grec_mca, vid);
2992 		if (!mdst)
2993 			goto unlock_continue;
2994 		pg = br_multicast_find_port(mdst, pmctx->port, src);
2995 		if (!pg || (pg->flags & MDB_PG_FLAGS_PERMANENT))
2996 			goto unlock_continue;
2997 		h_addr = &ipv6_hdr(skb)->saddr;
2998 		switch (grec->grec_type) {
2999 		case MLD2_ALLOW_NEW_SOURCES:
3000 			changed = br_multicast_isinc_allow(brmctx, pg, h_addr,
3001 							   grec->grec_src, nsrcs,
3002 							   sizeof(struct in6_addr),
3003 							   grec->grec_type);
3004 			break;
3005 		case MLD2_MODE_IS_INCLUDE:
3006 			changed = br_multicast_isinc_allow(brmctx, pg, h_addr,
3007 							   grec->grec_src, nsrcs,
3008 							   sizeof(struct in6_addr),
3009 							   grec->grec_type);
3010 			break;
3011 		case MLD2_MODE_IS_EXCLUDE:
3012 			changed = br_multicast_isexc(brmctx, pg, h_addr,
3013 						     grec->grec_src, nsrcs,
3014 						     sizeof(struct in6_addr),
3015 						     grec->grec_type);
3016 			break;
3017 		case MLD2_CHANGE_TO_INCLUDE:
3018 			changed = br_multicast_toin(brmctx, pmctx, pg, h_addr,
3019 						    grec->grec_src, nsrcs,
3020 						    sizeof(struct in6_addr),
3021 						    grec->grec_type);
3022 			break;
3023 		case MLD2_CHANGE_TO_EXCLUDE:
3024 			changed = br_multicast_toex(brmctx, pmctx, pg, h_addr,
3025 						    grec->grec_src, nsrcs,
3026 						    sizeof(struct in6_addr),
3027 						    grec->grec_type);
3028 			break;
3029 		case MLD2_BLOCK_OLD_SOURCES:
3030 			changed = br_multicast_block(brmctx, pmctx, pg, h_addr,
3031 						     grec->grec_src, nsrcs,
3032 						     sizeof(struct in6_addr),
3033 						     grec->grec_type);
3034 			break;
3035 		}
3036 		if (changed)
3037 			br_mdb_notify(brmctx->br->dev, mdst, pg, RTM_NEWMDB);
3038 unlock_continue:
3039 		spin_unlock(&brmctx->br->multicast_lock);
3040 	}
3041 
3042 	return err;
3043 }
3044 #endif
3045 
3046 static bool br_multicast_select_querier(struct net_bridge_mcast *brmctx,
3047 					struct net_bridge_mcast_port *pmctx,
3048 					struct br_ip *saddr)
3049 {
3050 	int port_ifidx = pmctx ? pmctx->port->dev->ifindex : 0;
3051 	struct timer_list *own_timer, *other_timer;
3052 	struct bridge_mcast_querier *querier;
3053 
3054 	switch (saddr->proto) {
3055 	case htons(ETH_P_IP):
3056 		querier = &brmctx->ip4_querier;
3057 		own_timer = &brmctx->ip4_own_query.timer;
3058 		other_timer = &brmctx->ip4_other_query.timer;
3059 		if (!querier->addr.src.ip4 ||
3060 		    ntohl(saddr->src.ip4) <= ntohl(querier->addr.src.ip4))
3061 			goto update;
3062 		break;
3063 #if IS_ENABLED(CONFIG_IPV6)
3064 	case htons(ETH_P_IPV6):
3065 		querier = &brmctx->ip6_querier;
3066 		own_timer = &brmctx->ip6_own_query.timer;
3067 		other_timer = &brmctx->ip6_other_query.timer;
3068 		if (ipv6_addr_cmp(&saddr->src.ip6, &querier->addr.src.ip6) <= 0)
3069 			goto update;
3070 		break;
3071 #endif
3072 	default:
3073 		return false;
3074 	}
3075 
3076 	if (!timer_pending(own_timer) && !timer_pending(other_timer))
3077 		goto update;
3078 
3079 	return false;
3080 
3081 update:
3082 	br_multicast_update_querier(brmctx, querier, port_ifidx, saddr);
3083 
3084 	return true;
3085 }
3086 
3087 static struct net_bridge_port *
3088 __br_multicast_get_querier_port(struct net_bridge *br,
3089 				const struct bridge_mcast_querier *querier)
3090 {
3091 	int port_ifidx = READ_ONCE(querier->port_ifidx);
3092 	struct net_bridge_port *p;
3093 	struct net_device *dev;
3094 
3095 	if (port_ifidx == 0)
3096 		return NULL;
3097 
3098 	dev = dev_get_by_index_rcu(dev_net(br->dev), port_ifidx);
3099 	if (!dev)
3100 		return NULL;
3101 	p = br_port_get_rtnl_rcu(dev);
3102 	if (!p || p->br != br)
3103 		return NULL;
3104 
3105 	return p;
3106 }
3107 
3108 size_t br_multicast_querier_state_size(void)
3109 {
3110 	return nla_total_size(0) +		/* nest attribute */
3111 	       nla_total_size(sizeof(__be32)) + /* BRIDGE_QUERIER_IP_ADDRESS */
3112 	       nla_total_size(sizeof(int)) +    /* BRIDGE_QUERIER_IP_PORT */
3113 	       nla_total_size_64bit(sizeof(u64)) + /* BRIDGE_QUERIER_IP_OTHER_TIMER */
3114 #if IS_ENABLED(CONFIG_IPV6)
3115 	       nla_total_size(sizeof(struct in6_addr)) + /* BRIDGE_QUERIER_IPV6_ADDRESS */
3116 	       nla_total_size(sizeof(int)) +		 /* BRIDGE_QUERIER_IPV6_PORT */
3117 	       nla_total_size_64bit(sizeof(u64)) +	 /* BRIDGE_QUERIER_IPV6_OTHER_TIMER */
3118 #endif
3119 	       0;
3120 }
3121 
3122 /* protected by rtnl or rcu */
3123 int br_multicast_dump_querier_state(struct sk_buff *skb,
3124 				    const struct net_bridge_mcast *brmctx,
3125 				    int nest_attr)
3126 {
3127 	struct bridge_mcast_querier querier = {};
3128 	struct net_bridge_port *p;
3129 	struct nlattr *nest;
3130 
3131 	if (!br_opt_get(brmctx->br, BROPT_MULTICAST_ENABLED) ||
3132 	    br_multicast_ctx_vlan_global_disabled(brmctx))
3133 		return 0;
3134 
3135 	nest = nla_nest_start(skb, nest_attr);
3136 	if (!nest)
3137 		return -EMSGSIZE;
3138 
3139 	rcu_read_lock();
3140 	if (!brmctx->multicast_querier &&
3141 	    !timer_pending(&brmctx->ip4_other_query.timer))
3142 		goto out_v6;
3143 
3144 	br_multicast_read_querier(&brmctx->ip4_querier, &querier);
3145 	if (nla_put_in_addr(skb, BRIDGE_QUERIER_IP_ADDRESS,
3146 			    querier.addr.src.ip4)) {
3147 		rcu_read_unlock();
3148 		goto out_err;
3149 	}
3150 
3151 	p = __br_multicast_get_querier_port(brmctx->br, &querier);
3152 	if (timer_pending(&brmctx->ip4_other_query.timer) &&
3153 	    (nla_put_u64_64bit(skb, BRIDGE_QUERIER_IP_OTHER_TIMER,
3154 			       br_timer_value(&brmctx->ip4_other_query.timer),
3155 			       BRIDGE_QUERIER_PAD) ||
3156 	     (p && nla_put_u32(skb, BRIDGE_QUERIER_IP_PORT, p->dev->ifindex)))) {
3157 		rcu_read_unlock();
3158 		goto out_err;
3159 	}
3160 
3161 out_v6:
3162 #if IS_ENABLED(CONFIG_IPV6)
3163 	if (!brmctx->multicast_querier &&
3164 	    !timer_pending(&brmctx->ip6_other_query.timer))
3165 		goto out;
3166 
3167 	br_multicast_read_querier(&brmctx->ip6_querier, &querier);
3168 	if (nla_put_in6_addr(skb, BRIDGE_QUERIER_IPV6_ADDRESS,
3169 			     &querier.addr.src.ip6)) {
3170 		rcu_read_unlock();
3171 		goto out_err;
3172 	}
3173 
3174 	p = __br_multicast_get_querier_port(brmctx->br, &querier);
3175 	if (timer_pending(&brmctx->ip6_other_query.timer) &&
3176 	    (nla_put_u64_64bit(skb, BRIDGE_QUERIER_IPV6_OTHER_TIMER,
3177 			       br_timer_value(&brmctx->ip6_other_query.timer),
3178 			       BRIDGE_QUERIER_PAD) ||
3179 	     (p && nla_put_u32(skb, BRIDGE_QUERIER_IPV6_PORT,
3180 			       p->dev->ifindex)))) {
3181 		rcu_read_unlock();
3182 		goto out_err;
3183 	}
3184 out:
3185 #endif
3186 	rcu_read_unlock();
3187 	nla_nest_end(skb, nest);
3188 	if (!nla_len(nest))
3189 		nla_nest_cancel(skb, nest);
3190 
3191 	return 0;
3192 
3193 out_err:
3194 	nla_nest_cancel(skb, nest);
3195 	return -EMSGSIZE;
3196 }
3197 
3198 static void
3199 br_multicast_update_query_timer(struct net_bridge_mcast *brmctx,
3200 				struct bridge_mcast_other_query *query,
3201 				unsigned long max_delay)
3202 {
3203 	if (!timer_pending(&query->timer))
3204 		mod_timer(&query->delay_timer, jiffies + max_delay);
3205 
3206 	mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval);
3207 }
3208 
3209 static void br_port_mc_router_state_change(struct net_bridge_port *p,
3210 					   bool is_mc_router)
3211 {
3212 	struct switchdev_attr attr = {
3213 		.orig_dev = p->dev,
3214 		.id = SWITCHDEV_ATTR_ID_PORT_MROUTER,
3215 		.flags = SWITCHDEV_F_DEFER,
3216 		.u.mrouter = is_mc_router,
3217 	};
3218 
3219 	switchdev_port_attr_set(p->dev, &attr, NULL);
3220 }
3221 
3222 static struct net_bridge_port *
3223 br_multicast_rport_from_node(struct net_bridge_mcast *brmctx,
3224 			     struct hlist_head *mc_router_list,
3225 			     struct hlist_node *rlist)
3226 {
3227 	struct net_bridge_mcast_port *pmctx;
3228 
3229 #if IS_ENABLED(CONFIG_IPV6)
3230 	if (mc_router_list == &brmctx->ip6_mc_router_list)
3231 		pmctx = hlist_entry(rlist, struct net_bridge_mcast_port,
3232 				    ip6_rlist);
3233 	else
3234 #endif
3235 		pmctx = hlist_entry(rlist, struct net_bridge_mcast_port,
3236 				    ip4_rlist);
3237 
3238 	return pmctx->port;
3239 }
3240 
3241 static struct hlist_node *
3242 br_multicast_get_rport_slot(struct net_bridge_mcast *brmctx,
3243 			    struct net_bridge_port *port,
3244 			    struct hlist_head *mc_router_list)
3245 
3246 {
3247 	struct hlist_node *slot = NULL;
3248 	struct net_bridge_port *p;
3249 	struct hlist_node *rlist;
3250 
3251 	hlist_for_each(rlist, mc_router_list) {
3252 		p = br_multicast_rport_from_node(brmctx, mc_router_list, rlist);
3253 
3254 		if ((unsigned long)port >= (unsigned long)p)
3255 			break;
3256 
3257 		slot = rlist;
3258 	}
3259 
3260 	return slot;
3261 }
3262 
3263 static bool br_multicast_no_router_otherpf(struct net_bridge_mcast_port *pmctx,
3264 					   struct hlist_node *rnode)
3265 {
3266 #if IS_ENABLED(CONFIG_IPV6)
3267 	if (rnode != &pmctx->ip6_rlist)
3268 		return hlist_unhashed(&pmctx->ip6_rlist);
3269 	else
3270 		return hlist_unhashed(&pmctx->ip4_rlist);
3271 #else
3272 	return true;
3273 #endif
3274 }
3275 
3276 /* Add port to router_list
3277  *  list is maintained ordered by pointer value
3278  *  and locked by br->multicast_lock and RCU
3279  */
3280 static void br_multicast_add_router(struct net_bridge_mcast *brmctx,
3281 				    struct net_bridge_mcast_port *pmctx,
3282 				    struct hlist_node *rlist,
3283 				    struct hlist_head *mc_router_list)
3284 {
3285 	struct hlist_node *slot;
3286 
3287 	if (!hlist_unhashed(rlist))
3288 		return;
3289 
3290 	slot = br_multicast_get_rport_slot(brmctx, pmctx->port, mc_router_list);
3291 
3292 	if (slot)
3293 		hlist_add_behind_rcu(rlist, slot);
3294 	else
3295 		hlist_add_head_rcu(rlist, mc_router_list);
3296 
3297 	/* For backwards compatibility for now, only notify if we
3298 	 * switched from no IPv4/IPv6 multicast router to a new
3299 	 * IPv4 or IPv6 multicast router.
3300 	 */
3301 	if (br_multicast_no_router_otherpf(pmctx, rlist)) {
3302 		br_rtr_notify(pmctx->port->br->dev, pmctx, RTM_NEWMDB);
3303 		br_port_mc_router_state_change(pmctx->port, true);
3304 	}
3305 }
3306 
3307 /* Add port to router_list
3308  *  list is maintained ordered by pointer value
3309  *  and locked by br->multicast_lock and RCU
3310  */
3311 static void br_ip4_multicast_add_router(struct net_bridge_mcast *brmctx,
3312 					struct net_bridge_mcast_port *pmctx)
3313 {
3314 	br_multicast_add_router(brmctx, pmctx, &pmctx->ip4_rlist,
3315 				&brmctx->ip4_mc_router_list);
3316 }
3317 
3318 /* Add port to router_list
3319  *  list is maintained ordered by pointer value
3320  *  and locked by br->multicast_lock and RCU
3321  */
3322 static void br_ip6_multicast_add_router(struct net_bridge_mcast *brmctx,
3323 					struct net_bridge_mcast_port *pmctx)
3324 {
3325 #if IS_ENABLED(CONFIG_IPV6)
3326 	br_multicast_add_router(brmctx, pmctx, &pmctx->ip6_rlist,
3327 				&brmctx->ip6_mc_router_list);
3328 #endif
3329 }
3330 
3331 static void br_multicast_mark_router(struct net_bridge_mcast *brmctx,
3332 				     struct net_bridge_mcast_port *pmctx,
3333 				     struct timer_list *timer,
3334 				     struct hlist_node *rlist,
3335 				     struct hlist_head *mc_router_list)
3336 {
3337 	unsigned long now = jiffies;
3338 
3339 	if (!br_multicast_ctx_should_use(brmctx, pmctx))
3340 		return;
3341 
3342 	if (!pmctx) {
3343 		if (brmctx->multicast_router == MDB_RTR_TYPE_TEMP_QUERY) {
3344 			if (!br_ip4_multicast_is_router(brmctx) &&
3345 			    !br_ip6_multicast_is_router(brmctx))
3346 				br_mc_router_state_change(brmctx->br, true);
3347 			mod_timer(timer, now + brmctx->multicast_querier_interval);
3348 		}
3349 		return;
3350 	}
3351 
3352 	if (pmctx->multicast_router == MDB_RTR_TYPE_DISABLED ||
3353 	    pmctx->multicast_router == MDB_RTR_TYPE_PERM)
3354 		return;
3355 
3356 	br_multicast_add_router(brmctx, pmctx, rlist, mc_router_list);
3357 	mod_timer(timer, now + brmctx->multicast_querier_interval);
3358 }
3359 
3360 static void br_ip4_multicast_mark_router(struct net_bridge_mcast *brmctx,
3361 					 struct net_bridge_mcast_port *pmctx)
3362 {
3363 	struct timer_list *timer = &brmctx->ip4_mc_router_timer;
3364 	struct hlist_node *rlist = NULL;
3365 
3366 	if (pmctx) {
3367 		timer = &pmctx->ip4_mc_router_timer;
3368 		rlist = &pmctx->ip4_rlist;
3369 	}
3370 
3371 	br_multicast_mark_router(brmctx, pmctx, timer, rlist,
3372 				 &brmctx->ip4_mc_router_list);
3373 }
3374 
3375 static void br_ip6_multicast_mark_router(struct net_bridge_mcast *brmctx,
3376 					 struct net_bridge_mcast_port *pmctx)
3377 {
3378 #if IS_ENABLED(CONFIG_IPV6)
3379 	struct timer_list *timer = &brmctx->ip6_mc_router_timer;
3380 	struct hlist_node *rlist = NULL;
3381 
3382 	if (pmctx) {
3383 		timer = &pmctx->ip6_mc_router_timer;
3384 		rlist = &pmctx->ip6_rlist;
3385 	}
3386 
3387 	br_multicast_mark_router(brmctx, pmctx, timer, rlist,
3388 				 &brmctx->ip6_mc_router_list);
3389 #endif
3390 }
3391 
3392 static void
3393 br_ip4_multicast_query_received(struct net_bridge_mcast *brmctx,
3394 				struct net_bridge_mcast_port *pmctx,
3395 				struct bridge_mcast_other_query *query,
3396 				struct br_ip *saddr,
3397 				unsigned long max_delay)
3398 {
3399 	if (!br_multicast_select_querier(brmctx, pmctx, saddr))
3400 		return;
3401 
3402 	br_multicast_update_query_timer(brmctx, query, max_delay);
3403 	br_ip4_multicast_mark_router(brmctx, pmctx);
3404 }
3405 
3406 #if IS_ENABLED(CONFIG_IPV6)
3407 static void
3408 br_ip6_multicast_query_received(struct net_bridge_mcast *brmctx,
3409 				struct net_bridge_mcast_port *pmctx,
3410 				struct bridge_mcast_other_query *query,
3411 				struct br_ip *saddr,
3412 				unsigned long max_delay)
3413 {
3414 	if (!br_multicast_select_querier(brmctx, pmctx, saddr))
3415 		return;
3416 
3417 	br_multicast_update_query_timer(brmctx, query, max_delay);
3418 	br_ip6_multicast_mark_router(brmctx, pmctx);
3419 }
3420 #endif
3421 
3422 static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
3423 				   struct net_bridge_mcast_port *pmctx,
3424 				   struct sk_buff *skb,
3425 				   u16 vid)
3426 {
3427 	unsigned int transport_len = ip_transport_len(skb);
3428 	const struct iphdr *iph = ip_hdr(skb);
3429 	struct igmphdr *ih = igmp_hdr(skb);
3430 	struct net_bridge_mdb_entry *mp;
3431 	struct igmpv3_query *ih3;
3432 	struct net_bridge_port_group *p;
3433 	struct net_bridge_port_group __rcu **pp;
3434 	struct br_ip saddr = {};
3435 	unsigned long max_delay;
3436 	unsigned long now = jiffies;
3437 	__be32 group;
3438 
3439 	spin_lock(&brmctx->br->multicast_lock);
3440 	if (!br_multicast_ctx_should_use(brmctx, pmctx))
3441 		goto out;
3442 
3443 	group = ih->group;
3444 
3445 	if (transport_len == sizeof(*ih)) {
3446 		max_delay = ih->code * (HZ / IGMP_TIMER_SCALE);
3447 
3448 		if (!max_delay) {
3449 			max_delay = 10 * HZ;
3450 			group = 0;
3451 		}
3452 	} else if (transport_len >= sizeof(*ih3)) {
3453 		ih3 = igmpv3_query_hdr(skb);
3454 		if (ih3->nsrcs ||
3455 		    (brmctx->multicast_igmp_version == 3 && group &&
3456 		     ih3->suppress))
3457 			goto out;
3458 
3459 		max_delay = ih3->code ?
3460 			    IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
3461 	} else {
3462 		goto out;
3463 	}
3464 
3465 	if (!group) {
3466 		saddr.proto = htons(ETH_P_IP);
3467 		saddr.src.ip4 = iph->saddr;
3468 
3469 		br_ip4_multicast_query_received(brmctx, pmctx,
3470 						&brmctx->ip4_other_query,
3471 						&saddr, max_delay);
3472 		goto out;
3473 	}
3474 
3475 	mp = br_mdb_ip4_get(brmctx->br, group, vid);
3476 	if (!mp)
3477 		goto out;
3478 
3479 	max_delay *= brmctx->multicast_last_member_count;
3480 
3481 	if (mp->host_joined &&
3482 	    (timer_pending(&mp->timer) ?
3483 	     time_after(mp->timer.expires, now + max_delay) :
3484 	     try_to_del_timer_sync(&mp->timer) >= 0))
3485 		mod_timer(&mp->timer, now + max_delay);
3486 
3487 	for (pp = &mp->ports;
3488 	     (p = mlock_dereference(*pp, brmctx->br)) != NULL;
3489 	     pp = &p->next) {
3490 		if (timer_pending(&p->timer) ?
3491 		    time_after(p->timer.expires, now + max_delay) :
3492 		    try_to_del_timer_sync(&p->timer) >= 0 &&
3493 		    (brmctx->multicast_igmp_version == 2 ||
3494 		     p->filter_mode == MCAST_EXCLUDE))
3495 			mod_timer(&p->timer, now + max_delay);
3496 	}
3497 
3498 out:
3499 	spin_unlock(&brmctx->br->multicast_lock);
3500 }
3501 
3502 #if IS_ENABLED(CONFIG_IPV6)
3503 static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
3504 				  struct net_bridge_mcast_port *pmctx,
3505 				  struct sk_buff *skb,
3506 				  u16 vid)
3507 {
3508 	unsigned int transport_len = ipv6_transport_len(skb);
3509 	struct mld_msg *mld;
3510 	struct net_bridge_mdb_entry *mp;
3511 	struct mld2_query *mld2q;
3512 	struct net_bridge_port_group *p;
3513 	struct net_bridge_port_group __rcu **pp;
3514 	struct br_ip saddr = {};
3515 	unsigned long max_delay;
3516 	unsigned long now = jiffies;
3517 	unsigned int offset = skb_transport_offset(skb);
3518 	const struct in6_addr *group = NULL;
3519 	bool is_general_query;
3520 	int err = 0;
3521 
3522 	spin_lock(&brmctx->br->multicast_lock);
3523 	if (!br_multicast_ctx_should_use(brmctx, pmctx))
3524 		goto out;
3525 
3526 	if (transport_len == sizeof(*mld)) {
3527 		if (!pskb_may_pull(skb, offset + sizeof(*mld))) {
3528 			err = -EINVAL;
3529 			goto out;
3530 		}
3531 		mld = (struct mld_msg *) icmp6_hdr(skb);
3532 		max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
3533 		if (max_delay)
3534 			group = &mld->mld_mca;
3535 	} else {
3536 		if (!pskb_may_pull(skb, offset + sizeof(*mld2q))) {
3537 			err = -EINVAL;
3538 			goto out;
3539 		}
3540 		mld2q = (struct mld2_query *)icmp6_hdr(skb);
3541 		if (!mld2q->mld2q_nsrcs)
3542 			group = &mld2q->mld2q_mca;
3543 		if (brmctx->multicast_mld_version == 2 &&
3544 		    !ipv6_addr_any(&mld2q->mld2q_mca) &&
3545 		    mld2q->mld2q_suppress)
3546 			goto out;
3547 
3548 		max_delay = max(msecs_to_jiffies(mldv2_mrc(mld2q)), 1UL);
3549 	}
3550 
3551 	is_general_query = group && ipv6_addr_any(group);
3552 
3553 	if (is_general_query) {
3554 		saddr.proto = htons(ETH_P_IPV6);
3555 		saddr.src.ip6 = ipv6_hdr(skb)->saddr;
3556 
3557 		br_ip6_multicast_query_received(brmctx, pmctx,
3558 						&brmctx->ip6_other_query,
3559 						&saddr, max_delay);
3560 		goto out;
3561 	} else if (!group) {
3562 		goto out;
3563 	}
3564 
3565 	mp = br_mdb_ip6_get(brmctx->br, group, vid);
3566 	if (!mp)
3567 		goto out;
3568 
3569 	max_delay *= brmctx->multicast_last_member_count;
3570 	if (mp->host_joined &&
3571 	    (timer_pending(&mp->timer) ?
3572 	     time_after(mp->timer.expires, now + max_delay) :
3573 	     try_to_del_timer_sync(&mp->timer) >= 0))
3574 		mod_timer(&mp->timer, now + max_delay);
3575 
3576 	for (pp = &mp->ports;
3577 	     (p = mlock_dereference(*pp, brmctx->br)) != NULL;
3578 	     pp = &p->next) {
3579 		if (timer_pending(&p->timer) ?
3580 		    time_after(p->timer.expires, now + max_delay) :
3581 		    try_to_del_timer_sync(&p->timer) >= 0 &&
3582 		    (brmctx->multicast_mld_version == 1 ||
3583 		     p->filter_mode == MCAST_EXCLUDE))
3584 			mod_timer(&p->timer, now + max_delay);
3585 	}
3586 
3587 out:
3588 	spin_unlock(&brmctx->br->multicast_lock);
3589 	return err;
3590 }
3591 #endif
3592 
3593 static void
3594 br_multicast_leave_group(struct net_bridge_mcast *brmctx,
3595 			 struct net_bridge_mcast_port *pmctx,
3596 			 struct br_ip *group,
3597 			 struct bridge_mcast_other_query *other_query,
3598 			 struct bridge_mcast_own_query *own_query,
3599 			 const unsigned char *src)
3600 {
3601 	struct net_bridge_mdb_entry *mp;
3602 	struct net_bridge_port_group *p;
3603 	unsigned long now;
3604 	unsigned long time;
3605 
3606 	spin_lock(&brmctx->br->multicast_lock);
3607 	if (!br_multicast_ctx_should_use(brmctx, pmctx))
3608 		goto out;
3609 
3610 	mp = br_mdb_ip_get(brmctx->br, group);
3611 	if (!mp)
3612 		goto out;
3613 
3614 	if (pmctx && (pmctx->port->flags & BR_MULTICAST_FAST_LEAVE)) {
3615 		struct net_bridge_port_group __rcu **pp;
3616 
3617 		for (pp = &mp->ports;
3618 		     (p = mlock_dereference(*pp, brmctx->br)) != NULL;
3619 		     pp = &p->next) {
3620 			if (!br_port_group_equal(p, pmctx->port, src))
3621 				continue;
3622 
3623 			if (p->flags & MDB_PG_FLAGS_PERMANENT)
3624 				break;
3625 
3626 			p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
3627 			br_multicast_del_pg(mp, p, pp);
3628 		}
3629 		goto out;
3630 	}
3631 
3632 	if (timer_pending(&other_query->timer))
3633 		goto out;
3634 
3635 	if (brmctx->multicast_querier) {
3636 		__br_multicast_send_query(brmctx, pmctx, NULL, NULL, &mp->addr,
3637 					  false, 0, NULL);
3638 
3639 		time = jiffies + brmctx->multicast_last_member_count *
3640 				 brmctx->multicast_last_member_interval;
3641 
3642 		mod_timer(&own_query->timer, time);
3643 
3644 		for (p = mlock_dereference(mp->ports, brmctx->br);
3645 		     p != NULL && pmctx != NULL;
3646 		     p = mlock_dereference(p->next, brmctx->br)) {
3647 			if (!br_port_group_equal(p, pmctx->port, src))
3648 				continue;
3649 
3650 			if (!hlist_unhashed(&p->mglist) &&
3651 			    (timer_pending(&p->timer) ?
3652 			     time_after(p->timer.expires, time) :
3653 			     try_to_del_timer_sync(&p->timer) >= 0)) {
3654 				mod_timer(&p->timer, time);
3655 			}
3656 
3657 			break;
3658 		}
3659 	}
3660 
3661 	now = jiffies;
3662 	time = now + brmctx->multicast_last_member_count *
3663 		     brmctx->multicast_last_member_interval;
3664 
3665 	if (!pmctx) {
3666 		if (mp->host_joined &&
3667 		    (timer_pending(&mp->timer) ?
3668 		     time_after(mp->timer.expires, time) :
3669 		     try_to_del_timer_sync(&mp->timer) >= 0)) {
3670 			mod_timer(&mp->timer, time);
3671 		}
3672 
3673 		goto out;
3674 	}
3675 
3676 	for (p = mlock_dereference(mp->ports, brmctx->br);
3677 	     p != NULL;
3678 	     p = mlock_dereference(p->next, brmctx->br)) {
3679 		if (p->key.port != pmctx->port)
3680 			continue;
3681 
3682 		if (!hlist_unhashed(&p->mglist) &&
3683 		    (timer_pending(&p->timer) ?
3684 		     time_after(p->timer.expires, time) :
3685 		     try_to_del_timer_sync(&p->timer) >= 0)) {
3686 			mod_timer(&p->timer, time);
3687 		}
3688 
3689 		break;
3690 	}
3691 out:
3692 	spin_unlock(&brmctx->br->multicast_lock);
3693 }
3694 
3695 static void br_ip4_multicast_leave_group(struct net_bridge_mcast *brmctx,
3696 					 struct net_bridge_mcast_port *pmctx,
3697 					 __be32 group,
3698 					 __u16 vid,
3699 					 const unsigned char *src)
3700 {
3701 	struct br_ip br_group;
3702 	struct bridge_mcast_own_query *own_query;
3703 
3704 	if (ipv4_is_local_multicast(group))
3705 		return;
3706 
3707 	own_query = pmctx ? &pmctx->ip4_own_query : &brmctx->ip4_own_query;
3708 
3709 	memset(&br_group, 0, sizeof(br_group));
3710 	br_group.dst.ip4 = group;
3711 	br_group.proto = htons(ETH_P_IP);
3712 	br_group.vid = vid;
3713 
3714 	br_multicast_leave_group(brmctx, pmctx, &br_group,
3715 				 &brmctx->ip4_other_query,
3716 				 own_query, src);
3717 }
3718 
3719 #if IS_ENABLED(CONFIG_IPV6)
3720 static void br_ip6_multicast_leave_group(struct net_bridge_mcast *brmctx,
3721 					 struct net_bridge_mcast_port *pmctx,
3722 					 const struct in6_addr *group,
3723 					 __u16 vid,
3724 					 const unsigned char *src)
3725 {
3726 	struct br_ip br_group;
3727 	struct bridge_mcast_own_query *own_query;
3728 
3729 	if (ipv6_addr_is_ll_all_nodes(group))
3730 		return;
3731 
3732 	own_query = pmctx ? &pmctx->ip6_own_query : &brmctx->ip6_own_query;
3733 
3734 	memset(&br_group, 0, sizeof(br_group));
3735 	br_group.dst.ip6 = *group;
3736 	br_group.proto = htons(ETH_P_IPV6);
3737 	br_group.vid = vid;
3738 
3739 	br_multicast_leave_group(brmctx, pmctx, &br_group,
3740 				 &brmctx->ip6_other_query,
3741 				 own_query, src);
3742 }
3743 #endif
3744 
3745 static void br_multicast_err_count(const struct net_bridge *br,
3746 				   const struct net_bridge_port *p,
3747 				   __be16 proto)
3748 {
3749 	struct bridge_mcast_stats __percpu *stats;
3750 	struct bridge_mcast_stats *pstats;
3751 
3752 	if (!br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
3753 		return;
3754 
3755 	if (p)
3756 		stats = p->mcast_stats;
3757 	else
3758 		stats = br->mcast_stats;
3759 	if (WARN_ON(!stats))
3760 		return;
3761 
3762 	pstats = this_cpu_ptr(stats);
3763 
3764 	u64_stats_update_begin(&pstats->syncp);
3765 	switch (proto) {
3766 	case htons(ETH_P_IP):
3767 		pstats->mstats.igmp_parse_errors++;
3768 		break;
3769 #if IS_ENABLED(CONFIG_IPV6)
3770 	case htons(ETH_P_IPV6):
3771 		pstats->mstats.mld_parse_errors++;
3772 		break;
3773 #endif
3774 	}
3775 	u64_stats_update_end(&pstats->syncp);
3776 }
3777 
3778 static void br_multicast_pim(struct net_bridge_mcast *brmctx,
3779 			     struct net_bridge_mcast_port *pmctx,
3780 			     const struct sk_buff *skb)
3781 {
3782 	unsigned int offset = skb_transport_offset(skb);
3783 	struct pimhdr *pimhdr, _pimhdr;
3784 
3785 	pimhdr = skb_header_pointer(skb, offset, sizeof(_pimhdr), &_pimhdr);
3786 	if (!pimhdr || pim_hdr_version(pimhdr) != PIM_VERSION ||
3787 	    pim_hdr_type(pimhdr) != PIM_TYPE_HELLO)
3788 		return;
3789 
3790 	spin_lock(&brmctx->br->multicast_lock);
3791 	br_ip4_multicast_mark_router(brmctx, pmctx);
3792 	spin_unlock(&brmctx->br->multicast_lock);
3793 }
3794 
3795 static int br_ip4_multicast_mrd_rcv(struct net_bridge_mcast *brmctx,
3796 				    struct net_bridge_mcast_port *pmctx,
3797 				    struct sk_buff *skb)
3798 {
3799 	if (ip_hdr(skb)->protocol != IPPROTO_IGMP ||
3800 	    igmp_hdr(skb)->type != IGMP_MRDISC_ADV)
3801 		return -ENOMSG;
3802 
3803 	spin_lock(&brmctx->br->multicast_lock);
3804 	br_ip4_multicast_mark_router(brmctx, pmctx);
3805 	spin_unlock(&brmctx->br->multicast_lock);
3806 
3807 	return 0;
3808 }
3809 
3810 static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
3811 				 struct net_bridge_mcast_port *pmctx,
3812 				 struct sk_buff *skb,
3813 				 u16 vid)
3814 {
3815 	struct net_bridge_port *p = pmctx ? pmctx->port : NULL;
3816 	const unsigned char *src;
3817 	struct igmphdr *ih;
3818 	int err;
3819 
3820 	err = ip_mc_check_igmp(skb);
3821 
3822 	if (err == -ENOMSG) {
3823 		if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
3824 			BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3825 		} else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
3826 			if (ip_hdr(skb)->protocol == IPPROTO_PIM)
3827 				br_multicast_pim(brmctx, pmctx, skb);
3828 		} else if (ipv4_is_all_snoopers(ip_hdr(skb)->daddr)) {
3829 			br_ip4_multicast_mrd_rcv(brmctx, pmctx, skb);
3830 		}
3831 
3832 		return 0;
3833 	} else if (err < 0) {
3834 		br_multicast_err_count(brmctx->br, p, skb->protocol);
3835 		return err;
3836 	}
3837 
3838 	ih = igmp_hdr(skb);
3839 	src = eth_hdr(skb)->h_source;
3840 	BR_INPUT_SKB_CB(skb)->igmp = ih->type;
3841 
3842 	switch (ih->type) {
3843 	case IGMP_HOST_MEMBERSHIP_REPORT:
3844 	case IGMPV2_HOST_MEMBERSHIP_REPORT:
3845 		BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3846 		err = br_ip4_multicast_add_group(brmctx, pmctx, ih->group, vid,
3847 						 src, true);
3848 		break;
3849 	case IGMPV3_HOST_MEMBERSHIP_REPORT:
3850 		err = br_ip4_multicast_igmp3_report(brmctx, pmctx, skb, vid);
3851 		break;
3852 	case IGMP_HOST_MEMBERSHIP_QUERY:
3853 		br_ip4_multicast_query(brmctx, pmctx, skb, vid);
3854 		break;
3855 	case IGMP_HOST_LEAVE_MESSAGE:
3856 		br_ip4_multicast_leave_group(brmctx, pmctx, ih->group, vid, src);
3857 		break;
3858 	}
3859 
3860 	br_multicast_count(brmctx->br, p, skb, BR_INPUT_SKB_CB(skb)->igmp,
3861 			   BR_MCAST_DIR_RX);
3862 
3863 	return err;
3864 }
3865 
3866 #if IS_ENABLED(CONFIG_IPV6)
3867 static void br_ip6_multicast_mrd_rcv(struct net_bridge_mcast *brmctx,
3868 				     struct net_bridge_mcast_port *pmctx,
3869 				     struct sk_buff *skb)
3870 {
3871 	if (icmp6_hdr(skb)->icmp6_type != ICMPV6_MRDISC_ADV)
3872 		return;
3873 
3874 	spin_lock(&brmctx->br->multicast_lock);
3875 	br_ip6_multicast_mark_router(brmctx, pmctx);
3876 	spin_unlock(&brmctx->br->multicast_lock);
3877 }
3878 
3879 static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
3880 				 struct net_bridge_mcast_port *pmctx,
3881 				 struct sk_buff *skb,
3882 				 u16 vid)
3883 {
3884 	struct net_bridge_port *p = pmctx ? pmctx->port : NULL;
3885 	const unsigned char *src;
3886 	struct mld_msg *mld;
3887 	int err;
3888 
3889 	err = ipv6_mc_check_mld(skb);
3890 
3891 	if (err == -ENOMSG || err == -ENODATA) {
3892 		if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
3893 			BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3894 		if (err == -ENODATA &&
3895 		    ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
3896 			br_ip6_multicast_mrd_rcv(brmctx, pmctx, skb);
3897 
3898 		return 0;
3899 	} else if (err < 0) {
3900 		br_multicast_err_count(brmctx->br, p, skb->protocol);
3901 		return err;
3902 	}
3903 
3904 	mld = (struct mld_msg *)skb_transport_header(skb);
3905 	BR_INPUT_SKB_CB(skb)->igmp = mld->mld_type;
3906 
3907 	switch (mld->mld_type) {
3908 	case ICMPV6_MGM_REPORT:
3909 		src = eth_hdr(skb)->h_source;
3910 		BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
3911 		err = br_ip6_multicast_add_group(brmctx, pmctx, &mld->mld_mca,
3912 						 vid, src, true);
3913 		break;
3914 	case ICMPV6_MLD2_REPORT:
3915 		err = br_ip6_multicast_mld2_report(brmctx, pmctx, skb, vid);
3916 		break;
3917 	case ICMPV6_MGM_QUERY:
3918 		err = br_ip6_multicast_query(brmctx, pmctx, skb, vid);
3919 		break;
3920 	case ICMPV6_MGM_REDUCTION:
3921 		src = eth_hdr(skb)->h_source;
3922 		br_ip6_multicast_leave_group(brmctx, pmctx, &mld->mld_mca, vid,
3923 					     src);
3924 		break;
3925 	}
3926 
3927 	br_multicast_count(brmctx->br, p, skb, BR_INPUT_SKB_CB(skb)->igmp,
3928 			   BR_MCAST_DIR_RX);
3929 
3930 	return err;
3931 }
3932 #endif
3933 
3934 int br_multicast_rcv(struct net_bridge_mcast **brmctx,
3935 		     struct net_bridge_mcast_port **pmctx,
3936 		     struct net_bridge_vlan *vlan,
3937 		     struct sk_buff *skb, u16 vid)
3938 {
3939 	int ret = 0;
3940 
3941 	BR_INPUT_SKB_CB(skb)->igmp = 0;
3942 	BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
3943 
3944 	if (!br_opt_get((*brmctx)->br, BROPT_MULTICAST_ENABLED))
3945 		return 0;
3946 
3947 	if (br_opt_get((*brmctx)->br, BROPT_MCAST_VLAN_SNOOPING_ENABLED) && vlan) {
3948 		const struct net_bridge_vlan *masterv;
3949 
3950 		/* the vlan has the master flag set only when transmitting
3951 		 * through the bridge device
3952 		 */
3953 		if (br_vlan_is_master(vlan)) {
3954 			masterv = vlan;
3955 			*brmctx = &vlan->br_mcast_ctx;
3956 			*pmctx = NULL;
3957 		} else {
3958 			masterv = vlan->brvlan;
3959 			*brmctx = &vlan->brvlan->br_mcast_ctx;
3960 			*pmctx = &vlan->port_mcast_ctx;
3961 		}
3962 
3963 		if (!(masterv->priv_flags & BR_VLFLAG_GLOBAL_MCAST_ENABLED))
3964 			return 0;
3965 	}
3966 
3967 	switch (skb->protocol) {
3968 	case htons(ETH_P_IP):
3969 		ret = br_multicast_ipv4_rcv(*brmctx, *pmctx, skb, vid);
3970 		break;
3971 #if IS_ENABLED(CONFIG_IPV6)
3972 	case htons(ETH_P_IPV6):
3973 		ret = br_multicast_ipv6_rcv(*brmctx, *pmctx, skb, vid);
3974 		break;
3975 #endif
3976 	}
3977 
3978 	return ret;
3979 }
3980 
3981 static void br_multicast_query_expired(struct net_bridge_mcast *brmctx,
3982 				       struct bridge_mcast_own_query *query,
3983 				       struct bridge_mcast_querier *querier)
3984 {
3985 	spin_lock(&brmctx->br->multicast_lock);
3986 	if (br_multicast_ctx_vlan_disabled(brmctx))
3987 		goto out;
3988 
3989 	if (query->startup_sent < brmctx->multicast_startup_query_count)
3990 		query->startup_sent++;
3991 
3992 	br_multicast_send_query(brmctx, NULL, query);
3993 out:
3994 	spin_unlock(&brmctx->br->multicast_lock);
3995 }
3996 
3997 static void br_ip4_multicast_query_expired(struct timer_list *t)
3998 {
3999 	struct net_bridge_mcast *brmctx = from_timer(brmctx, t,
4000 						     ip4_own_query.timer);
4001 
4002 	br_multicast_query_expired(brmctx, &brmctx->ip4_own_query,
4003 				   &brmctx->ip4_querier);
4004 }
4005 
4006 #if IS_ENABLED(CONFIG_IPV6)
4007 static void br_ip6_multicast_query_expired(struct timer_list *t)
4008 {
4009 	struct net_bridge_mcast *brmctx = from_timer(brmctx, t,
4010 						     ip6_own_query.timer);
4011 
4012 	br_multicast_query_expired(brmctx, &brmctx->ip6_own_query,
4013 				   &brmctx->ip6_querier);
4014 }
4015 #endif
4016 
4017 static void br_multicast_gc_work(struct work_struct *work)
4018 {
4019 	struct net_bridge *br = container_of(work, struct net_bridge,
4020 					     mcast_gc_work);
4021 	HLIST_HEAD(deleted_head);
4022 
4023 	spin_lock_bh(&br->multicast_lock);
4024 	hlist_move_list(&br->mcast_gc_list, &deleted_head);
4025 	spin_unlock_bh(&br->multicast_lock);
4026 
4027 	br_multicast_gc(&deleted_head);
4028 }
4029 
4030 void br_multicast_ctx_init(struct net_bridge *br,
4031 			   struct net_bridge_vlan *vlan,
4032 			   struct net_bridge_mcast *brmctx)
4033 {
4034 	brmctx->br = br;
4035 	brmctx->vlan = vlan;
4036 	brmctx->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
4037 	brmctx->multicast_last_member_count = 2;
4038 	brmctx->multicast_startup_query_count = 2;
4039 
4040 	brmctx->multicast_last_member_interval = HZ;
4041 	brmctx->multicast_query_response_interval = 10 * HZ;
4042 	brmctx->multicast_startup_query_interval = 125 * HZ / 4;
4043 	brmctx->multicast_query_interval = 125 * HZ;
4044 	brmctx->multicast_querier_interval = 255 * HZ;
4045 	brmctx->multicast_membership_interval = 260 * HZ;
4046 
4047 	brmctx->ip4_querier.port_ifidx = 0;
4048 	seqcount_spinlock_init(&brmctx->ip4_querier.seq, &br->multicast_lock);
4049 	brmctx->multicast_igmp_version = 2;
4050 #if IS_ENABLED(CONFIG_IPV6)
4051 	brmctx->multicast_mld_version = 1;
4052 	brmctx->ip6_querier.port_ifidx = 0;
4053 	seqcount_spinlock_init(&brmctx->ip6_querier.seq, &br->multicast_lock);
4054 #endif
4055 
4056 	timer_setup(&brmctx->ip4_mc_router_timer,
4057 		    br_ip4_multicast_local_router_expired, 0);
4058 	timer_setup(&brmctx->ip4_other_query.timer,
4059 		    br_ip4_multicast_querier_expired, 0);
4060 	timer_setup(&brmctx->ip4_other_query.delay_timer,
4061 		    br_multicast_query_delay_expired, 0);
4062 	timer_setup(&brmctx->ip4_own_query.timer,
4063 		    br_ip4_multicast_query_expired, 0);
4064 #if IS_ENABLED(CONFIG_IPV6)
4065 	timer_setup(&brmctx->ip6_mc_router_timer,
4066 		    br_ip6_multicast_local_router_expired, 0);
4067 	timer_setup(&brmctx->ip6_other_query.timer,
4068 		    br_ip6_multicast_querier_expired, 0);
4069 	timer_setup(&brmctx->ip6_other_query.delay_timer,
4070 		    br_multicast_query_delay_expired, 0);
4071 	timer_setup(&brmctx->ip6_own_query.timer,
4072 		    br_ip6_multicast_query_expired, 0);
4073 #endif
4074 }
4075 
4076 void br_multicast_ctx_deinit(struct net_bridge_mcast *brmctx)
4077 {
4078 	__br_multicast_stop(brmctx);
4079 }
4080 
4081 void br_multicast_init(struct net_bridge *br)
4082 {
4083 	br->hash_max = BR_MULTICAST_DEFAULT_HASH_MAX;
4084 
4085 	br_multicast_ctx_init(br, NULL, &br->multicast_ctx);
4086 
4087 	br_opt_toggle(br, BROPT_MULTICAST_ENABLED, true);
4088 	br_opt_toggle(br, BROPT_HAS_IPV6_ADDR, true);
4089 
4090 	spin_lock_init(&br->multicast_lock);
4091 	INIT_HLIST_HEAD(&br->mdb_list);
4092 	INIT_HLIST_HEAD(&br->mcast_gc_list);
4093 	INIT_WORK(&br->mcast_gc_work, br_multicast_gc_work);
4094 }
4095 
4096 static void br_ip4_multicast_join_snoopers(struct net_bridge *br)
4097 {
4098 	struct in_device *in_dev = in_dev_get(br->dev);
4099 
4100 	if (!in_dev)
4101 		return;
4102 
4103 	__ip_mc_inc_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
4104 	in_dev_put(in_dev);
4105 }
4106 
4107 #if IS_ENABLED(CONFIG_IPV6)
4108 static void br_ip6_multicast_join_snoopers(struct net_bridge *br)
4109 {
4110 	struct in6_addr addr;
4111 
4112 	ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
4113 	ipv6_dev_mc_inc(br->dev, &addr);
4114 }
4115 #else
4116 static inline void br_ip6_multicast_join_snoopers(struct net_bridge *br)
4117 {
4118 }
4119 #endif
4120 
4121 void br_multicast_join_snoopers(struct net_bridge *br)
4122 {
4123 	br_ip4_multicast_join_snoopers(br);
4124 	br_ip6_multicast_join_snoopers(br);
4125 }
4126 
4127 static void br_ip4_multicast_leave_snoopers(struct net_bridge *br)
4128 {
4129 	struct in_device *in_dev = in_dev_get(br->dev);
4130 
4131 	if (WARN_ON(!in_dev))
4132 		return;
4133 
4134 	__ip_mc_dec_group(in_dev, htonl(INADDR_ALLSNOOPERS_GROUP), GFP_ATOMIC);
4135 	in_dev_put(in_dev);
4136 }
4137 
4138 #if IS_ENABLED(CONFIG_IPV6)
4139 static void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
4140 {
4141 	struct in6_addr addr;
4142 
4143 	ipv6_addr_set(&addr, htonl(0xff020000), 0, 0, htonl(0x6a));
4144 	ipv6_dev_mc_dec(br->dev, &addr);
4145 }
4146 #else
4147 static inline void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
4148 {
4149 }
4150 #endif
4151 
4152 void br_multicast_leave_snoopers(struct net_bridge *br)
4153 {
4154 	br_ip4_multicast_leave_snoopers(br);
4155 	br_ip6_multicast_leave_snoopers(br);
4156 }
4157 
4158 static void __br_multicast_open_query(struct net_bridge *br,
4159 				      struct bridge_mcast_own_query *query)
4160 {
4161 	query->startup_sent = 0;
4162 
4163 	if (!br_opt_get(br, BROPT_MULTICAST_ENABLED))
4164 		return;
4165 
4166 	mod_timer(&query->timer, jiffies);
4167 }
4168 
4169 static void __br_multicast_open(struct net_bridge_mcast *brmctx)
4170 {
4171 	__br_multicast_open_query(brmctx->br, &brmctx->ip4_own_query);
4172 #if IS_ENABLED(CONFIG_IPV6)
4173 	__br_multicast_open_query(brmctx->br, &brmctx->ip6_own_query);
4174 #endif
4175 }
4176 
4177 void br_multicast_open(struct net_bridge *br)
4178 {
4179 	ASSERT_RTNL();
4180 
4181 	if (br_opt_get(br, BROPT_MCAST_VLAN_SNOOPING_ENABLED)) {
4182 		struct net_bridge_vlan_group *vg;
4183 		struct net_bridge_vlan *vlan;
4184 
4185 		vg = br_vlan_group(br);
4186 		if (vg) {
4187 			list_for_each_entry(vlan, &vg->vlan_list, vlist) {
4188 				struct net_bridge_mcast *brmctx;
4189 
4190 				brmctx = &vlan->br_mcast_ctx;
4191 				if (br_vlan_is_brentry(vlan) &&
4192 				    !br_multicast_ctx_vlan_disabled(brmctx))
4193 					__br_multicast_open(&vlan->br_mcast_ctx);
4194 			}
4195 		}
4196 	} else {
4197 		__br_multicast_open(&br->multicast_ctx);
4198 	}
4199 }
4200 
4201 static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
4202 {
4203 	del_timer_sync(&brmctx->ip4_mc_router_timer);
4204 	del_timer_sync(&brmctx->ip4_other_query.timer);
4205 	del_timer_sync(&brmctx->ip4_other_query.delay_timer);
4206 	del_timer_sync(&brmctx->ip4_own_query.timer);
4207 #if IS_ENABLED(CONFIG_IPV6)
4208 	del_timer_sync(&brmctx->ip6_mc_router_timer);
4209 	del_timer_sync(&brmctx->ip6_other_query.timer);
4210 	del_timer_sync(&brmctx->ip6_other_query.delay_timer);
4211 	del_timer_sync(&brmctx->ip6_own_query.timer);
4212 #endif
4213 }
4214 
4215 void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan, bool on)
4216 {
4217 	struct net_bridge *br;
4218 
4219 	/* it's okay to check for the flag without the multicast lock because it
4220 	 * can only change under RTNL -> multicast_lock, we need the latter to
4221 	 * sync with timers and packets
4222 	 */
4223 	if (on == !!(vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED))
4224 		return;
4225 
4226 	if (br_vlan_is_master(vlan)) {
4227 		br = vlan->br;
4228 
4229 		if (!br_vlan_is_brentry(vlan) ||
4230 		    (on &&
4231 		     br_multicast_ctx_vlan_global_disabled(&vlan->br_mcast_ctx)))
4232 			return;
4233 
4234 		spin_lock_bh(&br->multicast_lock);
4235 		vlan->priv_flags ^= BR_VLFLAG_MCAST_ENABLED;
4236 		spin_unlock_bh(&br->multicast_lock);
4237 
4238 		if (on)
4239 			__br_multicast_open(&vlan->br_mcast_ctx);
4240 		else
4241 			__br_multicast_stop(&vlan->br_mcast_ctx);
4242 	} else {
4243 		struct net_bridge_mcast *brmctx;
4244 
4245 		brmctx = br_multicast_port_ctx_get_global(&vlan->port_mcast_ctx);
4246 		if (on && br_multicast_ctx_vlan_global_disabled(brmctx))
4247 			return;
4248 
4249 		br = vlan->port->br;
4250 		spin_lock_bh(&br->multicast_lock);
4251 		vlan->priv_flags ^= BR_VLFLAG_MCAST_ENABLED;
4252 		if (on)
4253 			__br_multicast_enable_port_ctx(&vlan->port_mcast_ctx);
4254 		else
4255 			__br_multicast_disable_port_ctx(&vlan->port_mcast_ctx);
4256 		spin_unlock_bh(&br->multicast_lock);
4257 	}
4258 }
4259 
4260 static void br_multicast_toggle_vlan(struct net_bridge_vlan *vlan, bool on)
4261 {
4262 	struct net_bridge_port *p;
4263 
4264 	if (WARN_ON_ONCE(!br_vlan_is_master(vlan)))
4265 		return;
4266 
4267 	list_for_each_entry(p, &vlan->br->port_list, list) {
4268 		struct net_bridge_vlan *vport;
4269 
4270 		vport = br_vlan_find(nbp_vlan_group(p), vlan->vid);
4271 		if (!vport)
4272 			continue;
4273 		br_multicast_toggle_one_vlan(vport, on);
4274 	}
4275 
4276 	if (br_vlan_is_brentry(vlan))
4277 		br_multicast_toggle_one_vlan(vlan, on);
4278 }
4279 
4280 int br_multicast_toggle_vlan_snooping(struct net_bridge *br, bool on,
4281 				      struct netlink_ext_ack *extack)
4282 {
4283 	struct net_bridge_vlan_group *vg;
4284 	struct net_bridge_vlan *vlan;
4285 	struct net_bridge_port *p;
4286 
4287 	if (br_opt_get(br, BROPT_MCAST_VLAN_SNOOPING_ENABLED) == on)
4288 		return 0;
4289 
4290 	if (on && !br_opt_get(br, BROPT_VLAN_ENABLED)) {
4291 		NL_SET_ERR_MSG_MOD(extack, "Cannot enable multicast vlan snooping with vlan filtering disabled");
4292 		return -EINVAL;
4293 	}
4294 
4295 	vg = br_vlan_group(br);
4296 	if (!vg)
4297 		return 0;
4298 
4299 	br_opt_toggle(br, BROPT_MCAST_VLAN_SNOOPING_ENABLED, on);
4300 
4301 	/* disable/enable non-vlan mcast contexts based on vlan snooping */
4302 	if (on)
4303 		__br_multicast_stop(&br->multicast_ctx);
4304 	else
4305 		__br_multicast_open(&br->multicast_ctx);
4306 	list_for_each_entry(p, &br->port_list, list) {
4307 		if (on)
4308 			br_multicast_disable_port(p);
4309 		else
4310 			br_multicast_enable_port(p);
4311 	}
4312 
4313 	list_for_each_entry(vlan, &vg->vlan_list, vlist)
4314 		br_multicast_toggle_vlan(vlan, on);
4315 
4316 	return 0;
4317 }
4318 
4319 bool br_multicast_toggle_global_vlan(struct net_bridge_vlan *vlan, bool on)
4320 {
4321 	ASSERT_RTNL();
4322 
4323 	/* BR_VLFLAG_GLOBAL_MCAST_ENABLED relies on eventual consistency and
4324 	 * requires only RTNL to change
4325 	 */
4326 	if (on == !!(vlan->priv_flags & BR_VLFLAG_GLOBAL_MCAST_ENABLED))
4327 		return false;
4328 
4329 	vlan->priv_flags ^= BR_VLFLAG_GLOBAL_MCAST_ENABLED;
4330 	br_multicast_toggle_vlan(vlan, on);
4331 
4332 	return true;
4333 }
4334 
4335 void br_multicast_stop(struct net_bridge *br)
4336 {
4337 	ASSERT_RTNL();
4338 
4339 	if (br_opt_get(br, BROPT_MCAST_VLAN_SNOOPING_ENABLED)) {
4340 		struct net_bridge_vlan_group *vg;
4341 		struct net_bridge_vlan *vlan;
4342 
4343 		vg = br_vlan_group(br);
4344 		if (vg) {
4345 			list_for_each_entry(vlan, &vg->vlan_list, vlist) {
4346 				struct net_bridge_mcast *brmctx;
4347 
4348 				brmctx = &vlan->br_mcast_ctx;
4349 				if (br_vlan_is_brentry(vlan) &&
4350 				    !br_multicast_ctx_vlan_disabled(brmctx))
4351 					__br_multicast_stop(&vlan->br_mcast_ctx);
4352 			}
4353 		}
4354 	} else {
4355 		__br_multicast_stop(&br->multicast_ctx);
4356 	}
4357 }
4358 
4359 void br_multicast_dev_del(struct net_bridge *br)
4360 {
4361 	struct net_bridge_mdb_entry *mp;
4362 	HLIST_HEAD(deleted_head);
4363 	struct hlist_node *tmp;
4364 
4365 	spin_lock_bh(&br->multicast_lock);
4366 	hlist_for_each_entry_safe(mp, tmp, &br->mdb_list, mdb_node)
4367 		br_multicast_del_mdb_entry(mp);
4368 	hlist_move_list(&br->mcast_gc_list, &deleted_head);
4369 	spin_unlock_bh(&br->multicast_lock);
4370 
4371 	br_multicast_ctx_deinit(&br->multicast_ctx);
4372 	br_multicast_gc(&deleted_head);
4373 	cancel_work_sync(&br->mcast_gc_work);
4374 
4375 	rcu_barrier();
4376 }
4377 
4378 int br_multicast_set_router(struct net_bridge_mcast *brmctx, unsigned long val)
4379 {
4380 	int err = -EINVAL;
4381 
4382 	spin_lock_bh(&brmctx->br->multicast_lock);
4383 
4384 	switch (val) {
4385 	case MDB_RTR_TYPE_DISABLED:
4386 	case MDB_RTR_TYPE_PERM:
4387 		br_mc_router_state_change(brmctx->br, val == MDB_RTR_TYPE_PERM);
4388 		del_timer(&brmctx->ip4_mc_router_timer);
4389 #if IS_ENABLED(CONFIG_IPV6)
4390 		del_timer(&brmctx->ip6_mc_router_timer);
4391 #endif
4392 		brmctx->multicast_router = val;
4393 		err = 0;
4394 		break;
4395 	case MDB_RTR_TYPE_TEMP_QUERY:
4396 		if (brmctx->multicast_router != MDB_RTR_TYPE_TEMP_QUERY)
4397 			br_mc_router_state_change(brmctx->br, false);
4398 		brmctx->multicast_router = val;
4399 		err = 0;
4400 		break;
4401 	}
4402 
4403 	spin_unlock_bh(&brmctx->br->multicast_lock);
4404 
4405 	return err;
4406 }
4407 
4408 static void
4409 br_multicast_rport_del_notify(struct net_bridge_mcast_port *pmctx, bool deleted)
4410 {
4411 	if (!deleted)
4412 		return;
4413 
4414 	/* For backwards compatibility for now, only notify if there is
4415 	 * no multicast router anymore for both IPv4 and IPv6.
4416 	 */
4417 	if (!hlist_unhashed(&pmctx->ip4_rlist))
4418 		return;
4419 #if IS_ENABLED(CONFIG_IPV6)
4420 	if (!hlist_unhashed(&pmctx->ip6_rlist))
4421 		return;
4422 #endif
4423 
4424 	br_rtr_notify(pmctx->port->br->dev, pmctx, RTM_DELMDB);
4425 	br_port_mc_router_state_change(pmctx->port, false);
4426 
4427 	/* don't allow timer refresh */
4428 	if (pmctx->multicast_router == MDB_RTR_TYPE_TEMP)
4429 		pmctx->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
4430 }
4431 
4432 int br_multicast_set_port_router(struct net_bridge_mcast_port *pmctx,
4433 				 unsigned long val)
4434 {
4435 	struct net_bridge_mcast *brmctx;
4436 	unsigned long now = jiffies;
4437 	int err = -EINVAL;
4438 	bool del = false;
4439 
4440 	brmctx = br_multicast_port_ctx_get_global(pmctx);
4441 	spin_lock_bh(&brmctx->br->multicast_lock);
4442 	if (pmctx->multicast_router == val) {
4443 		/* Refresh the temp router port timer */
4444 		if (pmctx->multicast_router == MDB_RTR_TYPE_TEMP) {
4445 			mod_timer(&pmctx->ip4_mc_router_timer,
4446 				  now + brmctx->multicast_querier_interval);
4447 #if IS_ENABLED(CONFIG_IPV6)
4448 			mod_timer(&pmctx->ip6_mc_router_timer,
4449 				  now + brmctx->multicast_querier_interval);
4450 #endif
4451 		}
4452 		err = 0;
4453 		goto unlock;
4454 	}
4455 	switch (val) {
4456 	case MDB_RTR_TYPE_DISABLED:
4457 		pmctx->multicast_router = MDB_RTR_TYPE_DISABLED;
4458 		del |= br_ip4_multicast_rport_del(pmctx);
4459 		del_timer(&pmctx->ip4_mc_router_timer);
4460 		del |= br_ip6_multicast_rport_del(pmctx);
4461 #if IS_ENABLED(CONFIG_IPV6)
4462 		del_timer(&pmctx->ip6_mc_router_timer);
4463 #endif
4464 		br_multicast_rport_del_notify(pmctx, del);
4465 		break;
4466 	case MDB_RTR_TYPE_TEMP_QUERY:
4467 		pmctx->multicast_router = MDB_RTR_TYPE_TEMP_QUERY;
4468 		del |= br_ip4_multicast_rport_del(pmctx);
4469 		del |= br_ip6_multicast_rport_del(pmctx);
4470 		br_multicast_rport_del_notify(pmctx, del);
4471 		break;
4472 	case MDB_RTR_TYPE_PERM:
4473 		pmctx->multicast_router = MDB_RTR_TYPE_PERM;
4474 		del_timer(&pmctx->ip4_mc_router_timer);
4475 		br_ip4_multicast_add_router(brmctx, pmctx);
4476 #if IS_ENABLED(CONFIG_IPV6)
4477 		del_timer(&pmctx->ip6_mc_router_timer);
4478 #endif
4479 		br_ip6_multicast_add_router(brmctx, pmctx);
4480 		break;
4481 	case MDB_RTR_TYPE_TEMP:
4482 		pmctx->multicast_router = MDB_RTR_TYPE_TEMP;
4483 		br_ip4_multicast_mark_router(brmctx, pmctx);
4484 		br_ip6_multicast_mark_router(brmctx, pmctx);
4485 		break;
4486 	default:
4487 		goto unlock;
4488 	}
4489 	err = 0;
4490 unlock:
4491 	spin_unlock_bh(&brmctx->br->multicast_lock);
4492 
4493 	return err;
4494 }
4495 
4496 int br_multicast_set_vlan_router(struct net_bridge_vlan *v, u8 mcast_router)
4497 {
4498 	int err;
4499 
4500 	if (br_vlan_is_master(v))
4501 		err = br_multicast_set_router(&v->br_mcast_ctx, mcast_router);
4502 	else
4503 		err = br_multicast_set_port_router(&v->port_mcast_ctx,
4504 						   mcast_router);
4505 
4506 	return err;
4507 }
4508 
4509 static void br_multicast_start_querier(struct net_bridge_mcast *brmctx,
4510 				       struct bridge_mcast_own_query *query)
4511 {
4512 	struct net_bridge_port *port;
4513 
4514 	if (!br_multicast_ctx_matches_vlan_snooping(brmctx))
4515 		return;
4516 
4517 	__br_multicast_open_query(brmctx->br, query);
4518 
4519 	rcu_read_lock();
4520 	list_for_each_entry_rcu(port, &brmctx->br->port_list, list) {
4521 		struct bridge_mcast_own_query *ip4_own_query;
4522 #if IS_ENABLED(CONFIG_IPV6)
4523 		struct bridge_mcast_own_query *ip6_own_query;
4524 #endif
4525 
4526 		if (br_multicast_port_ctx_state_stopped(&port->multicast_ctx))
4527 			continue;
4528 
4529 		if (br_multicast_ctx_is_vlan(brmctx)) {
4530 			struct net_bridge_vlan *vlan;
4531 
4532 			vlan = br_vlan_find(nbp_vlan_group_rcu(port),
4533 					    brmctx->vlan->vid);
4534 			if (!vlan ||
4535 			    br_multicast_port_ctx_state_stopped(&vlan->port_mcast_ctx))
4536 				continue;
4537 
4538 			ip4_own_query = &vlan->port_mcast_ctx.ip4_own_query;
4539 #if IS_ENABLED(CONFIG_IPV6)
4540 			ip6_own_query = &vlan->port_mcast_ctx.ip6_own_query;
4541 #endif
4542 		} else {
4543 			ip4_own_query = &port->multicast_ctx.ip4_own_query;
4544 #if IS_ENABLED(CONFIG_IPV6)
4545 			ip6_own_query = &port->multicast_ctx.ip6_own_query;
4546 #endif
4547 		}
4548 
4549 		if (query == &brmctx->ip4_own_query)
4550 			br_multicast_enable(ip4_own_query);
4551 #if IS_ENABLED(CONFIG_IPV6)
4552 		else
4553 			br_multicast_enable(ip6_own_query);
4554 #endif
4555 	}
4556 	rcu_read_unlock();
4557 }
4558 
4559 int br_multicast_toggle(struct net_bridge *br, unsigned long val,
4560 			struct netlink_ext_ack *extack)
4561 {
4562 	struct net_bridge_port *port;
4563 	bool change_snoopers = false;
4564 	int err = 0;
4565 
4566 	spin_lock_bh(&br->multicast_lock);
4567 	if (!!br_opt_get(br, BROPT_MULTICAST_ENABLED) == !!val)
4568 		goto unlock;
4569 
4570 	err = br_mc_disabled_update(br->dev, val, extack);
4571 	if (err == -EOPNOTSUPP)
4572 		err = 0;
4573 	if (err)
4574 		goto unlock;
4575 
4576 	br_opt_toggle(br, BROPT_MULTICAST_ENABLED, !!val);
4577 	if (!br_opt_get(br, BROPT_MULTICAST_ENABLED)) {
4578 		change_snoopers = true;
4579 		goto unlock;
4580 	}
4581 
4582 	if (!netif_running(br->dev))
4583 		goto unlock;
4584 
4585 	br_multicast_open(br);
4586 	list_for_each_entry(port, &br->port_list, list)
4587 		__br_multicast_enable_port_ctx(&port->multicast_ctx);
4588 
4589 	change_snoopers = true;
4590 
4591 unlock:
4592 	spin_unlock_bh(&br->multicast_lock);
4593 
4594 	/* br_multicast_join_snoopers has the potential to cause
4595 	 * an MLD Report/Leave to be delivered to br_multicast_rcv,
4596 	 * which would in turn call br_multicast_add_group, which would
4597 	 * attempt to acquire multicast_lock. This function should be
4598 	 * called after the lock has been released to avoid deadlocks on
4599 	 * multicast_lock.
4600 	 *
4601 	 * br_multicast_leave_snoopers does not have the problem since
4602 	 * br_multicast_rcv first checks BROPT_MULTICAST_ENABLED, and
4603 	 * returns without calling br_multicast_ipv4/6_rcv if it's not
4604 	 * enabled. Moved both functions out just for symmetry.
4605 	 */
4606 	if (change_snoopers) {
4607 		if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
4608 			br_multicast_join_snoopers(br);
4609 		else
4610 			br_multicast_leave_snoopers(br);
4611 	}
4612 
4613 	return err;
4614 }
4615 
4616 bool br_multicast_enabled(const struct net_device *dev)
4617 {
4618 	struct net_bridge *br = netdev_priv(dev);
4619 
4620 	return !!br_opt_get(br, BROPT_MULTICAST_ENABLED);
4621 }
4622 EXPORT_SYMBOL_GPL(br_multicast_enabled);
4623 
4624 bool br_multicast_router(const struct net_device *dev)
4625 {
4626 	struct net_bridge *br = netdev_priv(dev);
4627 	bool is_router;
4628 
4629 	spin_lock_bh(&br->multicast_lock);
4630 	is_router = br_multicast_is_router(&br->multicast_ctx, NULL);
4631 	spin_unlock_bh(&br->multicast_lock);
4632 	return is_router;
4633 }
4634 EXPORT_SYMBOL_GPL(br_multicast_router);
4635 
4636 int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
4637 {
4638 	unsigned long max_delay;
4639 
4640 	val = !!val;
4641 
4642 	spin_lock_bh(&brmctx->br->multicast_lock);
4643 	if (brmctx->multicast_querier == val)
4644 		goto unlock;
4645 
4646 	WRITE_ONCE(brmctx->multicast_querier, val);
4647 	if (!val)
4648 		goto unlock;
4649 
4650 	max_delay = brmctx->multicast_query_response_interval;
4651 
4652 	if (!timer_pending(&brmctx->ip4_other_query.timer))
4653 		mod_timer(&brmctx->ip4_other_query.delay_timer,
4654 			  jiffies + max_delay);
4655 
4656 	br_multicast_start_querier(brmctx, &brmctx->ip4_own_query);
4657 
4658 #if IS_ENABLED(CONFIG_IPV6)
4659 	if (!timer_pending(&brmctx->ip6_other_query.timer))
4660 		mod_timer(&brmctx->ip6_other_query.delay_timer,
4661 			  jiffies + max_delay);
4662 
4663 	br_multicast_start_querier(brmctx, &brmctx->ip6_own_query);
4664 #endif
4665 
4666 unlock:
4667 	spin_unlock_bh(&brmctx->br->multicast_lock);
4668 
4669 	return 0;
4670 }
4671 
4672 int br_multicast_set_igmp_version(struct net_bridge_mcast *brmctx,
4673 				  unsigned long val)
4674 {
4675 	/* Currently we support only version 2 and 3 */
4676 	switch (val) {
4677 	case 2:
4678 	case 3:
4679 		break;
4680 	default:
4681 		return -EINVAL;
4682 	}
4683 
4684 	spin_lock_bh(&brmctx->br->multicast_lock);
4685 	brmctx->multicast_igmp_version = val;
4686 	spin_unlock_bh(&brmctx->br->multicast_lock);
4687 
4688 	return 0;
4689 }
4690 
4691 #if IS_ENABLED(CONFIG_IPV6)
4692 int br_multicast_set_mld_version(struct net_bridge_mcast *brmctx,
4693 				 unsigned long val)
4694 {
4695 	/* Currently we support version 1 and 2 */
4696 	switch (val) {
4697 	case 1:
4698 	case 2:
4699 		break;
4700 	default:
4701 		return -EINVAL;
4702 	}
4703 
4704 	spin_lock_bh(&brmctx->br->multicast_lock);
4705 	brmctx->multicast_mld_version = val;
4706 	spin_unlock_bh(&brmctx->br->multicast_lock);
4707 
4708 	return 0;
4709 }
4710 #endif
4711 
4712 void br_multicast_set_query_intvl(struct net_bridge_mcast *brmctx,
4713 				  unsigned long val)
4714 {
4715 	unsigned long intvl_jiffies = clock_t_to_jiffies(val);
4716 
4717 	if (intvl_jiffies < BR_MULTICAST_QUERY_INTVL_MIN) {
4718 		br_info(brmctx->br,
4719 			"trying to set multicast query interval below minimum, setting to %lu (%ums)\n",
4720 			jiffies_to_clock_t(BR_MULTICAST_QUERY_INTVL_MIN),
4721 			jiffies_to_msecs(BR_MULTICAST_QUERY_INTVL_MIN));
4722 		intvl_jiffies = BR_MULTICAST_QUERY_INTVL_MIN;
4723 	}
4724 
4725 	brmctx->multicast_query_interval = intvl_jiffies;
4726 }
4727 
4728 void br_multicast_set_startup_query_intvl(struct net_bridge_mcast *brmctx,
4729 					  unsigned long val)
4730 {
4731 	unsigned long intvl_jiffies = clock_t_to_jiffies(val);
4732 
4733 	if (intvl_jiffies < BR_MULTICAST_STARTUP_QUERY_INTVL_MIN) {
4734 		br_info(brmctx->br,
4735 			"trying to set multicast startup query interval below minimum, setting to %lu (%ums)\n",
4736 			jiffies_to_clock_t(BR_MULTICAST_STARTUP_QUERY_INTVL_MIN),
4737 			jiffies_to_msecs(BR_MULTICAST_STARTUP_QUERY_INTVL_MIN));
4738 		intvl_jiffies = BR_MULTICAST_STARTUP_QUERY_INTVL_MIN;
4739 	}
4740 
4741 	brmctx->multicast_startup_query_interval = intvl_jiffies;
4742 }
4743 
4744 /**
4745  * br_multicast_list_adjacent - Returns snooped multicast addresses
4746  * @dev:	The bridge port adjacent to which to retrieve addresses
4747  * @br_ip_list:	The list to store found, snooped multicast IP addresses in
4748  *
4749  * Creates a list of IP addresses (struct br_ip_list) sensed by the multicast
4750  * snooping feature on all bridge ports of dev's bridge device, excluding
4751  * the addresses from dev itself.
4752  *
4753  * Returns the number of items added to br_ip_list.
4754  *
4755  * Notes:
4756  * - br_ip_list needs to be initialized by caller
4757  * - br_ip_list might contain duplicates in the end
4758  *   (needs to be taken care of by caller)
4759  * - br_ip_list needs to be freed by caller
4760  */
4761 int br_multicast_list_adjacent(struct net_device *dev,
4762 			       struct list_head *br_ip_list)
4763 {
4764 	struct net_bridge *br;
4765 	struct net_bridge_port *port;
4766 	struct net_bridge_port_group *group;
4767 	struct br_ip_list *entry;
4768 	int count = 0;
4769 
4770 	rcu_read_lock();
4771 	if (!br_ip_list || !netif_is_bridge_port(dev))
4772 		goto unlock;
4773 
4774 	port = br_port_get_rcu(dev);
4775 	if (!port || !port->br)
4776 		goto unlock;
4777 
4778 	br = port->br;
4779 
4780 	list_for_each_entry_rcu(port, &br->port_list, list) {
4781 		if (!port->dev || port->dev == dev)
4782 			continue;
4783 
4784 		hlist_for_each_entry_rcu(group, &port->mglist, mglist) {
4785 			entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
4786 			if (!entry)
4787 				goto unlock;
4788 
4789 			entry->addr = group->key.addr;
4790 			list_add(&entry->list, br_ip_list);
4791 			count++;
4792 		}
4793 	}
4794 
4795 unlock:
4796 	rcu_read_unlock();
4797 	return count;
4798 }
4799 EXPORT_SYMBOL_GPL(br_multicast_list_adjacent);
4800 
4801 /**
4802  * br_multicast_has_querier_anywhere - Checks for a querier on a bridge
4803  * @dev: The bridge port providing the bridge on which to check for a querier
4804  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
4805  *
4806  * Checks whether the given interface has a bridge on top and if so returns
4807  * true if a valid querier exists anywhere on the bridged link layer.
4808  * Otherwise returns false.
4809  */
4810 bool br_multicast_has_querier_anywhere(struct net_device *dev, int proto)
4811 {
4812 	struct net_bridge *br;
4813 	struct net_bridge_port *port;
4814 	struct ethhdr eth;
4815 	bool ret = false;
4816 
4817 	rcu_read_lock();
4818 	if (!netif_is_bridge_port(dev))
4819 		goto unlock;
4820 
4821 	port = br_port_get_rcu(dev);
4822 	if (!port || !port->br)
4823 		goto unlock;
4824 
4825 	br = port->br;
4826 
4827 	memset(&eth, 0, sizeof(eth));
4828 	eth.h_proto = htons(proto);
4829 
4830 	ret = br_multicast_querier_exists(&br->multicast_ctx, &eth, NULL);
4831 
4832 unlock:
4833 	rcu_read_unlock();
4834 	return ret;
4835 }
4836 EXPORT_SYMBOL_GPL(br_multicast_has_querier_anywhere);
4837 
4838 /**
4839  * br_multicast_has_querier_adjacent - Checks for a querier behind a bridge port
4840  * @dev: The bridge port adjacent to which to check for a querier
4841  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
4842  *
4843  * Checks whether the given interface has a bridge on top and if so returns
4844  * true if a selected querier is behind one of the other ports of this
4845  * bridge. Otherwise returns false.
4846  */
4847 bool br_multicast_has_querier_adjacent(struct net_device *dev, int proto)
4848 {
4849 	struct net_bridge_mcast *brmctx;
4850 	struct net_bridge *br;
4851 	struct net_bridge_port *port;
4852 	bool ret = false;
4853 	int port_ifidx;
4854 
4855 	rcu_read_lock();
4856 	if (!netif_is_bridge_port(dev))
4857 		goto unlock;
4858 
4859 	port = br_port_get_rcu(dev);
4860 	if (!port || !port->br)
4861 		goto unlock;
4862 
4863 	br = port->br;
4864 	brmctx = &br->multicast_ctx;
4865 
4866 	switch (proto) {
4867 	case ETH_P_IP:
4868 		port_ifidx = brmctx->ip4_querier.port_ifidx;
4869 		if (!timer_pending(&brmctx->ip4_other_query.timer) ||
4870 		    port_ifidx == port->dev->ifindex)
4871 			goto unlock;
4872 		break;
4873 #if IS_ENABLED(CONFIG_IPV6)
4874 	case ETH_P_IPV6:
4875 		port_ifidx = brmctx->ip6_querier.port_ifidx;
4876 		if (!timer_pending(&brmctx->ip6_other_query.timer) ||
4877 		    port_ifidx == port->dev->ifindex)
4878 			goto unlock;
4879 		break;
4880 #endif
4881 	default:
4882 		goto unlock;
4883 	}
4884 
4885 	ret = true;
4886 unlock:
4887 	rcu_read_unlock();
4888 	return ret;
4889 }
4890 EXPORT_SYMBOL_GPL(br_multicast_has_querier_adjacent);
4891 
4892 /**
4893  * br_multicast_has_router_adjacent - Checks for a router behind a bridge port
4894  * @dev: The bridge port adjacent to which to check for a multicast router
4895  * @proto: The protocol family to check for: IGMP -> ETH_P_IP, MLD -> ETH_P_IPV6
4896  *
4897  * Checks whether the given interface has a bridge on top and if so returns
4898  * true if a multicast router is behind one of the other ports of this
4899  * bridge. Otherwise returns false.
4900  */
4901 bool br_multicast_has_router_adjacent(struct net_device *dev, int proto)
4902 {
4903 	struct net_bridge_mcast_port *pmctx;
4904 	struct net_bridge_mcast *brmctx;
4905 	struct net_bridge_port *port;
4906 	bool ret = false;
4907 
4908 	rcu_read_lock();
4909 	port = br_port_get_check_rcu(dev);
4910 	if (!port)
4911 		goto unlock;
4912 
4913 	brmctx = &port->br->multicast_ctx;
4914 	switch (proto) {
4915 	case ETH_P_IP:
4916 		hlist_for_each_entry_rcu(pmctx, &brmctx->ip4_mc_router_list,
4917 					 ip4_rlist) {
4918 			if (pmctx->port == port)
4919 				continue;
4920 
4921 			ret = true;
4922 			goto unlock;
4923 		}
4924 		break;
4925 #if IS_ENABLED(CONFIG_IPV6)
4926 	case ETH_P_IPV6:
4927 		hlist_for_each_entry_rcu(pmctx, &brmctx->ip6_mc_router_list,
4928 					 ip6_rlist) {
4929 			if (pmctx->port == port)
4930 				continue;
4931 
4932 			ret = true;
4933 			goto unlock;
4934 		}
4935 		break;
4936 #endif
4937 	default:
4938 		/* when compiled without IPv6 support, be conservative and
4939 		 * always assume presence of an IPv6 multicast router
4940 		 */
4941 		ret = true;
4942 	}
4943 
4944 unlock:
4945 	rcu_read_unlock();
4946 	return ret;
4947 }
4948 EXPORT_SYMBOL_GPL(br_multicast_has_router_adjacent);
4949 
4950 static void br_mcast_stats_add(struct bridge_mcast_stats __percpu *stats,
4951 			       const struct sk_buff *skb, u8 type, u8 dir)
4952 {
4953 	struct bridge_mcast_stats *pstats = this_cpu_ptr(stats);
4954 	__be16 proto = skb->protocol;
4955 	unsigned int t_len;
4956 
4957 	u64_stats_update_begin(&pstats->syncp);
4958 	switch (proto) {
4959 	case htons(ETH_P_IP):
4960 		t_len = ntohs(ip_hdr(skb)->tot_len) - ip_hdrlen(skb);
4961 		switch (type) {
4962 		case IGMP_HOST_MEMBERSHIP_REPORT:
4963 			pstats->mstats.igmp_v1reports[dir]++;
4964 			break;
4965 		case IGMPV2_HOST_MEMBERSHIP_REPORT:
4966 			pstats->mstats.igmp_v2reports[dir]++;
4967 			break;
4968 		case IGMPV3_HOST_MEMBERSHIP_REPORT:
4969 			pstats->mstats.igmp_v3reports[dir]++;
4970 			break;
4971 		case IGMP_HOST_MEMBERSHIP_QUERY:
4972 			if (t_len != sizeof(struct igmphdr)) {
4973 				pstats->mstats.igmp_v3queries[dir]++;
4974 			} else {
4975 				unsigned int offset = skb_transport_offset(skb);
4976 				struct igmphdr *ih, _ihdr;
4977 
4978 				ih = skb_header_pointer(skb, offset,
4979 							sizeof(_ihdr), &_ihdr);
4980 				if (!ih)
4981 					break;
4982 				if (!ih->code)
4983 					pstats->mstats.igmp_v1queries[dir]++;
4984 				else
4985 					pstats->mstats.igmp_v2queries[dir]++;
4986 			}
4987 			break;
4988 		case IGMP_HOST_LEAVE_MESSAGE:
4989 			pstats->mstats.igmp_leaves[dir]++;
4990 			break;
4991 		}
4992 		break;
4993 #if IS_ENABLED(CONFIG_IPV6)
4994 	case htons(ETH_P_IPV6):
4995 		t_len = ntohs(ipv6_hdr(skb)->payload_len) +
4996 			sizeof(struct ipv6hdr);
4997 		t_len -= skb_network_header_len(skb);
4998 		switch (type) {
4999 		case ICMPV6_MGM_REPORT:
5000 			pstats->mstats.mld_v1reports[dir]++;
5001 			break;
5002 		case ICMPV6_MLD2_REPORT:
5003 			pstats->mstats.mld_v2reports[dir]++;
5004 			break;
5005 		case ICMPV6_MGM_QUERY:
5006 			if (t_len != sizeof(struct mld_msg))
5007 				pstats->mstats.mld_v2queries[dir]++;
5008 			else
5009 				pstats->mstats.mld_v1queries[dir]++;
5010 			break;
5011 		case ICMPV6_MGM_REDUCTION:
5012 			pstats->mstats.mld_leaves[dir]++;
5013 			break;
5014 		}
5015 		break;
5016 #endif /* CONFIG_IPV6 */
5017 	}
5018 	u64_stats_update_end(&pstats->syncp);
5019 }
5020 
5021 void br_multicast_count(struct net_bridge *br,
5022 			const struct net_bridge_port *p,
5023 			const struct sk_buff *skb, u8 type, u8 dir)
5024 {
5025 	struct bridge_mcast_stats __percpu *stats;
5026 
5027 	/* if multicast_disabled is true then igmp type can't be set */
5028 	if (!type || !br_opt_get(br, BROPT_MULTICAST_STATS_ENABLED))
5029 		return;
5030 
5031 	if (p)
5032 		stats = p->mcast_stats;
5033 	else
5034 		stats = br->mcast_stats;
5035 	if (WARN_ON(!stats))
5036 		return;
5037 
5038 	br_mcast_stats_add(stats, skb, type, dir);
5039 }
5040 
5041 int br_multicast_init_stats(struct net_bridge *br)
5042 {
5043 	br->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);
5044 	if (!br->mcast_stats)
5045 		return -ENOMEM;
5046 
5047 	return 0;
5048 }
5049 
5050 void br_multicast_uninit_stats(struct net_bridge *br)
5051 {
5052 	free_percpu(br->mcast_stats);
5053 }
5054 
5055 /* noinline for https://bugs.llvm.org/show_bug.cgi?id=45802#c9 */
5056 static noinline_for_stack void mcast_stats_add_dir(u64 *dst, u64 *src)
5057 {
5058 	dst[BR_MCAST_DIR_RX] += src[BR_MCAST_DIR_RX];
5059 	dst[BR_MCAST_DIR_TX] += src[BR_MCAST_DIR_TX];
5060 }
5061 
5062 void br_multicast_get_stats(const struct net_bridge *br,
5063 			    const struct net_bridge_port *p,
5064 			    struct br_mcast_stats *dest)
5065 {
5066 	struct bridge_mcast_stats __percpu *stats;
5067 	struct br_mcast_stats tdst;
5068 	int i;
5069 
5070 	memset(dest, 0, sizeof(*dest));
5071 	if (p)
5072 		stats = p->mcast_stats;
5073 	else
5074 		stats = br->mcast_stats;
5075 	if (WARN_ON(!stats))
5076 		return;
5077 
5078 	memset(&tdst, 0, sizeof(tdst));
5079 	for_each_possible_cpu(i) {
5080 		struct bridge_mcast_stats *cpu_stats = per_cpu_ptr(stats, i);
5081 		struct br_mcast_stats temp;
5082 		unsigned int start;
5083 
5084 		do {
5085 			start = u64_stats_fetch_begin(&cpu_stats->syncp);
5086 			memcpy(&temp, &cpu_stats->mstats, sizeof(temp));
5087 		} while (u64_stats_fetch_retry(&cpu_stats->syncp, start));
5088 
5089 		mcast_stats_add_dir(tdst.igmp_v1queries, temp.igmp_v1queries);
5090 		mcast_stats_add_dir(tdst.igmp_v2queries, temp.igmp_v2queries);
5091 		mcast_stats_add_dir(tdst.igmp_v3queries, temp.igmp_v3queries);
5092 		mcast_stats_add_dir(tdst.igmp_leaves, temp.igmp_leaves);
5093 		mcast_stats_add_dir(tdst.igmp_v1reports, temp.igmp_v1reports);
5094 		mcast_stats_add_dir(tdst.igmp_v2reports, temp.igmp_v2reports);
5095 		mcast_stats_add_dir(tdst.igmp_v3reports, temp.igmp_v3reports);
5096 		tdst.igmp_parse_errors += temp.igmp_parse_errors;
5097 
5098 		mcast_stats_add_dir(tdst.mld_v1queries, temp.mld_v1queries);
5099 		mcast_stats_add_dir(tdst.mld_v2queries, temp.mld_v2queries);
5100 		mcast_stats_add_dir(tdst.mld_leaves, temp.mld_leaves);
5101 		mcast_stats_add_dir(tdst.mld_v1reports, temp.mld_v1reports);
5102 		mcast_stats_add_dir(tdst.mld_v2reports, temp.mld_v2reports);
5103 		tdst.mld_parse_errors += temp.mld_parse_errors;
5104 	}
5105 	memcpy(dest, &tdst, sizeof(*dest));
5106 }
5107 
5108 int br_mdb_hash_init(struct net_bridge *br)
5109 {
5110 	int err;
5111 
5112 	err = rhashtable_init(&br->sg_port_tbl, &br_sg_port_rht_params);
5113 	if (err)
5114 		return err;
5115 
5116 	err = rhashtable_init(&br->mdb_hash_tbl, &br_mdb_rht_params);
5117 	if (err) {
5118 		rhashtable_destroy(&br->sg_port_tbl);
5119 		return err;
5120 	}
5121 
5122 	return 0;
5123 }
5124 
5125 void br_mdb_hash_fini(struct net_bridge *br)
5126 {
5127 	rhashtable_destroy(&br->sg_port_tbl);
5128 	rhashtable_destroy(&br->mdb_hash_tbl);
5129 }
5130