bridge: ensure to unlock in error path in br_multicast_query().

[safe/jmp/linux-2.6] / net / bridge / br_forward.c

diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 6cd50c6..d61e6f7 100644 (file)
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -11,6 +11,7 @@
  *     2 of the License, or (at your option) any later version.
  */
 
+#include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
@@ -103,6 +104,44 @@ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
        kfree_skb(skb);
 }
 
+static int deliver_clone(struct net_bridge_port *prev, struct sk_buff *skb,
+                        void (*__packet_hook)(const struct net_bridge_port *p,
+                                              struct sk_buff *skb))
+{
+       skb = skb_clone(skb, GFP_ATOMIC);
+       if (!skb) {
+               struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
+
+               dev->stats.tx_dropped++;
+               return -ENOMEM;
+       }
+
+       __packet_hook(prev, skb);
+       return 0;
+}
+
+static struct net_bridge_port *maybe_deliver(
+       struct net_bridge_port *prev, struct net_bridge_port *p,
+       struct sk_buff *skb,
+       void (*__packet_hook)(const struct net_bridge_port *p,
+                             struct sk_buff *skb))
+{
+       int err;
+
+       if (!should_deliver(p, skb))
+               return prev;
+
+       if (!prev)
+               goto out;
+
+       err = deliver_clone(prev, skb, __packet_hook);
+       if (err)
+               return ERR_PTR(err);
+
+out:
+       return p;
+}
+
 /* called under bridge lock */
 static void br_flood(struct net_bridge *br, struct sk_buff *skb,
                     struct sk_buff *skb0,
@@ -115,33 +154,18 @@ static void br_flood(struct net_bridge *br, struct sk_buff *skb,
        prev = NULL;
 
        list_for_each_entry_rcu(p, &br->port_list, list) {
-               if (should_deliver(p, skb)) {
-                       if (prev != NULL) {
-                               struct sk_buff *skb2;
-
-                               if ((skb2 = skb_clone(skb, GFP_ATOMIC)) == NULL) {
-                                       br->dev->stats.tx_dropped++;
-                                       goto out;
-                               }
-
-                               __packet_hook(prev, skb2);
-                       }
-
-                       prev = p;
-               }
+               prev = maybe_deliver(prev, p, skb, __packet_hook);
+               if (IS_ERR(prev))
+                       goto out;
        }
 
        if (!prev)
                goto out;
 
-       if (skb0) {
-               skb = skb_clone(skb, GFP_ATOMIC);
-               if (!skb) {
-                       br->dev->stats.tx_dropped++;
-                       goto out;
-               }
-       }
-       __packet_hook(prev, skb);
+       if (skb0)
+               deliver_clone(prev, skb, __packet_hook);
+       else
+               __packet_hook(prev, skb);
        return;
 
 out:
@@ -162,3 +186,70 @@ void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
 {
        br_flood(br, skb, skb2, __br_forward);
 }
+
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+/* called with rcu_read_lock */
+static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
+                              struct sk_buff *skb, struct sk_buff *skb0,
+                              void (*__packet_hook)(
+                                       const struct net_bridge_port *p,
+                                       struct sk_buff *skb))
+{
+       struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
+       struct net_bridge *br = netdev_priv(dev);
+       struct net_bridge_port *port;
+       struct net_bridge_port *lport, *rport;
+       struct net_bridge_port *prev;
+       struct net_bridge_port_group *p;
+       struct hlist_node *rp;
+
+       prev = NULL;
+
+       rp = br->router_list.first;
+       p = mdst ? mdst->ports : NULL;
+       while (p || rp) {
+               lport = p ? p->port : NULL;
+               rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) :
+                            NULL;
+
+               port = (unsigned long)lport > (unsigned long)rport ?
+                      lport : rport;
+
+               prev = maybe_deliver(prev, port, skb, __packet_hook);
+               if (IS_ERR(prev))
+                       goto out;
+
+               if ((unsigned long)lport >= (unsigned long)port)
+                       p = p->next;
+               if ((unsigned long)rport >= (unsigned long)port)
+                       rp = rp->next;
+       }
+
+       if (!prev)
+               goto out;
+
+       if (skb0)
+               deliver_clone(prev, skb, __packet_hook);
+       else
+               __packet_hook(prev, skb);
+       return;
+
+out:
+       if (!skb0)
+               kfree_skb(skb);
+}
+
+/* called with rcu_read_lock */
+void br_multicast_deliver(struct net_bridge_mdb_entry *mdst,
+                         struct sk_buff *skb)
+{
+       br_multicast_flood(mdst, skb, NULL, __br_deliver);
+}
+
+/* called with rcu_read_lock */
+void br_multicast_forward(struct net_bridge_mdb_entry *mdst,
+                         struct sk_buff *skb, struct sk_buff *skb2)
+{
+       br_multicast_flood(mdst, skb, skb2, __br_forward);
+}
+#endif