linux-stable.git/net/bridge, branch v4.4.26

bridge: re-introduce 'fix parsing of MLDv2 reports'

2016-09-30T08:18:37+00:00

[ Upstream commit 9264251ee2a55bce8fb93826b3f581fb9eb7e2c2 ]

commit bc8c20acaea1 ("bridge: multicast: treat igmpv3 report with
INCLUDE and no sources as a leave") seems to have accidentally reverted
commit 47cc84ce0c2f ("bridge: fix parsing of MLDv2 reports"). This
commit brings back a change to br_ip6_multicast_mld2_report() where
parsing of MLDv2 reports stops when the first group is successfully
added to the MDB cache.

Fixes: bc8c20acaea1 ("bridge: multicast: treat igmpv3 report with INCLUDE and no sources as a leave")
Signed-off-by: Davide Caratti 
Acked-by: Nikolay Aleksandrov 
Acked-by: Thadeu Lima de Souza Cascardo 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Bridge: Fix ipv6 mc snooping if bridge has no ipv6 address

2016-07-11T16:31:11+00:00

[ Upstream commit 0888d5f3c0f183ea6177355752ada433d370ac89 ]

The bridge is falsly dropping ipv6 mulitcast packets if there is:
 1. No ipv6 address assigned on the brigde.
 2. No external mld querier present.
 3. The internal querier enabled.

When the bridge fails to build mld queries, because it has no
ipv6 address, it slilently returns, but keeps the local querier enabled.
This specific case causes confusing packet loss.

Ipv6 multicast snooping can only work if:
 a) An external querier is present
 OR
 b) The bridge has an ipv6 address an is capable of sending own queries

Otherwise it has to forward/flood the ipv6 multicast traffic,
because snooping cannot work.

This patch fixes the issue by adding a flag to the bridge struct that
indicates that there is currently no ipv6 address assinged to the bridge
and returns a false state for the local querier in
__br_multicast_querier_exists().

Special thanks to Linus Lüssing.

Fixes: d1d81d4c3dd8 ("bridge: check return value of ipv6_dev_get_saddr()")
Signed-off-by: Daniel Danzberger 
Acked-by: Linus Lüssing 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bridge: Don't insert unnecessary local fdb entry on changing mac address

2016-06-24T17:18:17+00:00

[ Upstream commit 0b148def403153a4d1565f1640356cb78ce5109f ]

The missing br_vlan_should_use() test caused creation of an unneeded
local fdb entry on changing mac address of a bridge device when there is
a vlan which is configured on a bridge port but not on the bridge
device.

Fixes: 2594e9064a57 ("bridge: vlan: add per-vlan struct and move to rhashtables")
Signed-off-by: Toshiaki Makita 
Acked-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bridge: fix igmp / mld query parsing

2016-05-19T00:06:42+00:00

[ Upstream commit 856ce5d083e14571d051301fe3c65b32b8cbe321 ]

With the newly introduced helper functions the skb pulling is hidden
in the checksumming function - and undone before returning to the
caller.

The IGMP and MLD query parsing functions in the bridge still
assumed that the skb is pointing to the beginning of the IGMP/MLD
message while it is now kept at the beginning of the IPv4/6 header.

If there is a querier somewhere else, then this either causes
the multicast snooping to stay disabled even though it could be
enabled. Or, if we have the querier enabled too, then this can
create unnecessary IGMP / MLD query messages on the link.

Fixing this by taking the offset between IP and IGMP/MLD header into
account, too.

Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code")
Reported-by: Simon Wunderlich 
Signed-off-by: Linus Lüssing 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: bridge: fix old ioctl unlocked net device walk

2016-05-19T00:06:42+00:00

[ Upstream commit 31ca0458a61a502adb7ed192bf9716c6d05791a5 ]

get_bridge_ifindices() is used from the old "deviceless" bridge ioctl
calls which aren't called with rtnl held. The comment above says that it is
called with rtnl but that is not really the case.
Here's a sample output from a test ASSERT_RTNL() which I put in
get_bridge_ifindices and executed "brctl show":
[  957.422726] RTNL: assertion failed at net/bridge//br_ioctl.c (30)
[  957.422925] CPU: 0 PID: 1862 Comm: brctl Tainted: G        W  O
4.6.0-rc4+ #157
[  957.423009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.8.1-20150318_183358- 04/01/2014
[  957.423009]  0000000000000000 ffff880058adfdf0 ffffffff8138dec5
0000000000000400
[  957.423009]  ffffffff81ce8380 ffff880058adfe58 ffffffffa05ead32
0000000000000001
[  957.423009]  00007ffec1a444b0 0000000000000400 ffff880053c19130
0000000000008940
[  957.423009] Call Trace:
[  957.423009]  [] dump_stack+0x85/0xc0
[  957.423009]  []
br_ioctl_deviceless_stub+0x212/0x2e0 [bridge]
[  957.423009]  [] sock_ioctl+0x22b/0x290
[  957.423009]  [] do_vfs_ioctl+0x95/0x700
[  957.423009]  [] SyS_ioctl+0x79/0x90
[  957.423009]  [] entry_SYSCALL_64_fastpath+0x23/0xc1

Since it only reads bridge ifindices, we can use rcu to safely walk the net
device list. Also remove the wrong rtnl comment above.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bridge: Allow set bridge ageing time when switchdev disabled

2016-04-20T06:42:05+00:00

[ Upstream commit 5e263f712691615fb802f06c98d7638c378f5d11 ]

When NET_SWITCHDEV=n, switchdev_port_attr_set will return -EOPNOTSUPP,
we should ignore this error code and continue to set the ageing time.

Fixes: c62987bbd8a1 ("bridge: push bridge setting ageing_time down to switchdev")
Signed-off-by: Haishuang Yan 
Acked-by: Ido Schimmel 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bridge: allow zero ageing time

2016-04-20T06:42:02+00:00

[ Upstream commit 4c656c13b254d598e83e586b7b4d36a2043dad85 ]

This fixes a regression in the bridge ageing time caused by:
commit c62987bbd8a1 ("bridge: push bridge setting ageing_time down to switchdev")

There are users of Linux bridge which use the feature that if ageing time
is set to 0 it causes entries to never expire. See:
  https://www.linuxfoundation.org/collaborate/workgroups/networking/bridge

For a pure software bridge, it is unnecessary for the code to have
arbitrary restrictions on what values are allowable.

Signed-off-by: Stephen Hemminger 
Acked-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

switchdev: Require RTNL mutex to be held when sending FDB notifications

2016-03-03T23:07:04+00:00

[ Upstream commit 4f2c6ae5c64c353fb1b0425e4747e5603feadba1 ]

When switchdev drivers process FDB notifications from the underlying
device they resolve the netdev to which the entry points to and notify
the bridge using the switchdev notifier.

However, since the RTNL mutex is not held there is nothing preventing
the netdev from disappearing in the middle, which will cause
br_switchdev_event() to dereference a non-existing netdev.

Make switchdev drivers hold the lock at the beginning of the
notification processing session and release it once it ends, after
notifying the bridge.

Also, remove switchdev_mutex and fdb_lock, as they are no longer needed
when RTNL mutex is held.

Fixes: 03bf0c281234 ("switchdev: introduce switchdev notifier")
Signed-off-by: Ido Schimmel 
Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bridge: fix lockdep addr_list_lock false positive splat

2016-01-31T19:29:01+00:00

[ Upstream commit c6894dec8ea9ae05747124dce98b3b5c2e69b168 ]

After promisc mode management was introduced a bridge device could do
dev_set_promiscuity from its ndo_change_rx_flags() callback which in
turn can be called after the bridge's addr_list_lock has been taken
(e.g. by dev_uc_add). This causes a false positive lockdep splat because
the port interfaces' addr_list_lock is taken when br_manage_promisc()
runs after the bridge's addr list lock was already taken.
To remove the false positive introduce a custom bridge addr_list_lock
class and set it on bridge init.
A simple way to reproduce this is with the following:
$ brctl addbr br0
$ ip l add l br0 br0.100 type vlan id 100
$ ip l set br0 up
$ ip l set br0.100 up
$ echo 1 > /sys/class/net/br0/bridge/vlan_filtering
$ brctl addif br0 eth0
Splat:
[   43.684325] =============================================
[   43.684485] [ INFO: possible recursive locking detected ]
[   43.684636] 4.4.0-rc8+ #54 Not tainted
[   43.684755] ---------------------------------------------
[   43.684906] brctl/1187 is trying to acquire lock:
[   43.685047]  (_xmit_ETHER){+.....}, at: [] dev_set_rx_mode+0x1e/0x40
[   43.685460]  but task is already holding lock:
[   43.685618]  (_xmit_ETHER){+.....}, at: [] dev_uc_add+0x27/0x80
[   43.686015]  other info that might help us debug this:
[   43.686316]  Possible unsafe locking scenario:

[   43.686743]        CPU0
[   43.686967]        ----
[   43.687197]   lock(_xmit_ETHER);
[   43.687544]   lock(_xmit_ETHER);
[   43.687886] *** DEADLOCK ***

[   43.688438]  May be due to missing lock nesting notation

[   43.688882] 2 locks held by brctl/1187:
[   43.689134]  #0:  (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x17/0x20
[   43.689852]  #1:  (_xmit_ETHER){+.....}, at: [] dev_uc_add+0x27/0x80
[   43.690575] stack backtrace:
[   43.690970] CPU: 0 PID: 1187 Comm: brctl Not tainted 4.4.0-rc8+ #54
[   43.691270] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
[   43.691770]  ffffffff826a25c0 ffff8800369fb8e0 ffffffff81360ceb ffffffff826a25c0
[   43.692425]  ffff8800369fb9b8 ffffffff810d0466 ffff8800369fb968 ffffffff81537139
[   43.693071]  ffff88003a08c880 0000000000000000 00000000ffffffff 0000000002080020
[   43.693709] Call Trace:
[   43.693931]  [] dump_stack+0x4b/0x70
[   43.694199]  [] __lock_acquire+0x1e46/0x1e90
[   43.694483]  [] ? netlink_broadcast_filtered+0x139/0x3e0
[   43.694789]  [] ? nlmsg_notify+0x5a/0xc0
[   43.695064]  [] lock_acquire+0xe5/0x1f0
[   43.695340]  [] ? dev_set_rx_mode+0x1e/0x40
[   43.695623]  [] _raw_spin_lock_bh+0x45/0x80
[   43.695901]  [] ? dev_set_rx_mode+0x1e/0x40
[   43.696180]  [] dev_set_rx_mode+0x1e/0x40
[   43.696460]  [] dev_set_promiscuity+0x3c/0x50
[   43.696750]  [] br_port_set_promisc+0x25/0x50 [bridge]
[   43.697052]  [] br_manage_promisc+0x8a/0xe0 [bridge]
[   43.697348]  [] br_dev_change_rx_flags+0x1e/0x20 [bridge]
[   43.697655]  [] __dev_set_promiscuity+0x132/0x1f0
[   43.697943]  [] __dev_set_rx_mode+0x82/0x90
[   43.698223]  [] dev_uc_add+0x5e/0x80
[   43.698498]  [] vlan_device_event+0x542/0x650 [8021q]
[   43.698798]  [] notifier_call_chain+0x5d/0x80
[   43.699083]  [] raw_notifier_call_chain+0x16/0x20
[   43.699374]  [] call_netdevice_notifiers_info+0x6e/0x80
[   43.699678]  [] call_netdevice_notifiers+0x16/0x20
[   43.699973]  [] br_add_if+0x47e/0x4c0 [bridge]
[   43.700259]  [] add_del_if+0x6e/0x80 [bridge]
[   43.700548]  [] br_dev_ioctl+0xaf/0xc0 [bridge]
[   43.700836]  [] dev_ifsioc+0x30c/0x3c0
[   43.701106]  [] dev_ioctl+0xf9/0x6f0
[   43.701379]  [] ? mntput_no_expire+0x5/0x450
[   43.701665]  [] ? mntput_no_expire+0xae/0x450
[   43.701947]  [] sock_do_ioctl+0x42/0x50
[   43.702219]  [] sock_ioctl+0x1e5/0x290
[   43.702500]  [] do_vfs_ioctl+0x2cb/0x5c0
[   43.702771]  [] SyS_ioctl+0x79/0x90
[   43.703033]  [] entry_SYSCALL_64_fastpath+0x16/0x7a

CC: Vlad Yasevich 
CC: Stephen Hemminger 
CC: Bridge list 
CC: Andy Gospodarek 
CC: Roopa Prabhu 
Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
Reported-by: Andy Gospodarek 
Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bridge: Only call /sbin/bridge-stp for the initial network namespace

2016-01-05T21:46:17+00:00

[I stole this patch from Eric Biederman. He wrote:]

> There is no defined mechanism to pass network namespace information
> into /sbin/bridge-stp therefore don't even try to invoke it except
> for bridge devices in the initial network namespace.
>
> It is possible for unprivileged users to cause /sbin/bridge-stp to be
> invoked for any network device name which if /sbin/bridge-stp does not
> guard against unreasonable arguments or being invoked twice on the
> same network device could cause problems.

[Hannes: changed patch using netns_eq]

Cc: Eric W. Biederman 
Signed-off-by: Eric W. Biederman 
Signed-off-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller