search for: hash_lock

...73,7 @@ static __inline__ void fdb_delete(struct net_bridge_fdb_entry *f) { - hlist_del(&f->hlist); + hlist_del_rcu(&f->hlist); if (!f->is_static) list_del(&f->age_list); @@ -85,7 +85,7 @@ struct net_bridge *br = p->br; int i; - write_lock_bh(&br->hash_lock); + spin_lock_bh(&br->hash_lock); /* Search all chains since old address/hash is unknown */ for (i = 0; i < BR_HASH_SIZE; i++) { @@ -117,7 +117,7 @@ fdb_insert(br, p, newaddr, 1); - write_unlock_bh(&br->hash_lock); + spin_unlock_bh(&br->hash_lock); } void br_...

...ount of learned entries to a user specified maximum. For backwards compatibility the default setting of 0 disables the limit. User-added entries by netlink or from bridge or bridge port addresses are never blocked and do not count towards that limit. All changes to fdb_n_entries are under br->hash_lock, which means we do not need additional locking. The call paths are (? denotes that br->hash_lock is taken around the next call): - fdb_delete <-+- fdb_delete_local <-+- br_fdb_changeaddr ? | +- br_fdb_change_mac_address ? |...

...(test_bit(nr, &br_fdb_not_learned_mask)); > > + > > + /* learned before, but we set a flag that implies it's manually added */ > > + if (!(fdb->flags & BR_FDB_NOT_LEARNED_MASK)) > > Please use *_bit This will be fixed by the redesign to get rid of my use of hash_lock (proposed later in this mail), as I'll only have to test one bit and can use test_and_clear_bit then. > > + br->fdb_cur_learned_entries--; > > + set_bit(nr, &fdb->flags); > > +} > > Having a helper that conditionally decrements only is counterintuitive and &...

...earned_mask)); > >>> + >>> + /* learned before, but we set a flag that implies it's manually added */ >>> + if (!(fdb->flags & BR_FDB_NOT_LEARNED_MASK)) >> >> Please use *_bit > > This will be fixed by the redesign to get rid of my use of hash_lock > (proposed later in this mail), as I'll only have to test one bit and can > use test_and_clear_bit then. > >>> + br->fdb_cur_learned_entries--; >>> + set_bit(nr, &fdb->flags); >>> +} >> >> Having a helper that conditionally decrements...

Introduce a limit on the amount of learned FDB entries on a bridge, configured by netlink with a build time default on bridge creation in the kernel config. For backwards compatibility the kernel config default is disabling the limit (0). Without any limit a malicious actor may OOM a kernel by spamming packets with changing MAC addresses on their bridge port, so allow the bridge creator to limit

...o much for most computers. Mitigate this by adding a bridge netlink setting IFLA_BR_FDB_MAX_ENTRIES, which, if nonzero, limits the amount of entries to a user specified maximum. For backwards compatibility the default setting of 0 disables the limit. All changes to fdb_n_entries are under br->hash_lock, which means we do not need additional locking. The call paths are (? denotes that br->hash_lock is taken around the next call): - fdb_delete <-+- fdb_delete_local <-+- br_fdb_changeaddr ? | +- br_fdb_change_mac_address ? |...

...rogram terminated with signal 6, Aborted. #0 0x00002afcd767847b in raise () from /lib/libc.so.6 (gdb) bt #0 0x00002afcd767847b in raise () from /lib/libc.so.6 #1 0x00002afcd7679da0 in abort () from /lib/libc.so.6 #2 0x0000000000454dff in arc_change_state (new_state=0x591aa0, ab=0x2aaabe2930c0, hash_lock=<value optimized out>) at lib/libzpool/build-kernel/arc.c:735 #3 0x0000000000457f32 in arc_access (buf=0x2aaabe2930c0, hash_lock=0x592c30) at lib/libzpool/build-kernel/arc.c:1637 #4 0x0000000000458ff9 in arc_read_done (zio=0x2aaabcfa4ed0) at lib/libzpool/build-kernel/arc.c:1850 #5 0x...

...file changed, 4 insertions(+) diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c index c41d5fb..baedc32 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -172,6 +172,10 @@ void br_dev_delete(struct net_device *dev, struct list_head *head) del_nbp(p); } + spin_lock_bh(&br->hash_lock); + fdb_delete_by_addr(br, br->dev->dev_addr, 0); + spin_unlock_bh(&br->hash_lock); + del_timer_sync(&br->gc_timer); br_sysfs_delbr(br->dev); -- 1.7.12

...file changed, 4 insertions(+) diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c index c41d5fb..baedc32 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -172,6 +172,10 @@ void br_dev_delete(struct net_device *dev, struct list_head *head) del_nbp(p); } + spin_lock_bh(&br->hash_lock); + fdb_delete_by_addr(br, br->dev->dev_addr, 0); + spin_unlock_bh(&br->hash_lock); + del_timer_sync(&br->gc_timer); br_sysfs_delbr(br->dev); -- 1.7.12

...en I want passup a skb to the higher protocol layer use function netif_rx ,the higher layer not response ,the skb must have not passup yet .Why ?I'm puzzling about it for some days . Sorry my english is so poor:) Thanks ! //my own bridge struct struct Bridge{ rwlock_t lock; rwlock_t hash_lock; struct net_device dev; struct Bridge_fdb_entry *hash[BR_HASH_SIZE]; }; extern struct Bridge *brg; //the bridge initiation , will be called in module_init struct Bridge *Bridge_fdb_init() { struct Bridge *br; if ((br = kmalloc(sizeof(*br),GFP_KERNEL)) == NULL) return NULL; memset(br,0,s...

Changes since v9: * series re-ordering so make functionality more distinct. Basic vlan filtering is patches 1-4. Support for PVID/untagged vlans is patches 5 and 6. VLAN support for FDB/MDB is patches 7-11. Patch 12 is still additional egress policy. * Slight simplification to code that extracts the VID from skb. Since we now depend on the vlan module, at the time of input skb_tci is

...tigate this by adding a bridge netlink setting IFLA_BR_FDB_MAX_ENTRIES, > which, if nonzero, limits the amount of entries to a user specified > maximum. > > For backwards compatibility the default setting of 0 disables the limit. > > All changes to fdb_n_entries are under br->hash_lock, which means we do > not need additional locking. The call paths are (? denotes that > br->hash_lock is taken around the next call): > > - fdb_delete <-+- fdb_delete_local <-+- br_fdb_changeaddr ? > | +- br_fdb_change_mac_address ? >...

This series of patches provides an ability to add VLANs to the bridge ports. This is similar to what can be found in most switches. The bridge port may have any number of VLANs added to it including vlan 0 priority tagged traffic. When vlans are added to the port, only traffic tagged with particular vlan will forwarded over this port. Additionally, vlan ids are added to FDB entries and become

...f->flags) || test_bit(BR_FDB_ADDED_BY_EXT_LEARN, &f->flags)) { if (test_bit(BR_FDB_NOTIFY, &f->flags)) { if (time_after(this_timer, now)) @@ -1465,7 +1466,9 @@ int br_fdb_external_learn_del(struct net_bridge *br, struct net_bridge_port *p, spin_lock_bh(&br->hash_lock); fdb = br_fdb_find(br, addr, vid); - if (fdb && test_bit(BR_FDB_ADDED_BY_EXT_LEARN, &fdb->flags)) + if (fdb && + (test_bit(BR_FDB_ADDED_BY_EXT_LEARN, &fdb->flags) || + test_bit(BR_FDB_OFFLOADED, &fdb->flags))) fdb_delete(br, fdb, swdev_notify);...

On Mon, Mar 27, 2023 at 14:52, Vladimir Oltean <olteanv at gmail.com> wrote: > > By the way, there is a behavior change here. > > Before: > > $ ip link add br0 type bridge && ip link set br0 up > $ ip link set swp0 master br0 && ip link set swp0 up > $ bridge fdb add dev swp0 00:01:02:03:04:05 master dynamic > [ 70.010181] mscc_felix 0000:00:00.5:

...;& + fdb->dst != br->uplink) + return; + /* attempt to update an entry for a local interface */ if (unlikely(fdb->is_local)) { if (net_ratelimit()) @@ -415,3 +424,16 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source, spin_unlock(&br->hash_lock); } } + +struct net_bridge_port *br_vepa_find_src(struct net_bridge *br, + const unsigned char *addr) +{ + struct hlist_head *head = &br->hash[br_mac_hash(addr)]; + struct net_bridge_fdb_entry *fdb; + + fdb = fdb_find(head, addr); + if (fdb) + return fdb->dst; + else + return NUL...

...;& + fdb->dst != br->uplink) + return; + /* attempt to update an entry for a local interface */ if (unlikely(fdb->is_local)) { if (net_ratelimit()) @@ -415,3 +424,16 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source, spin_unlock(&br->hash_lock); } } + +struct net_bridge_port *br_vepa_find_src(struct net_bridge *br, + const unsigned char *addr) +{ + struct hlist_head *head = &br->hash[br_mac_hash(addr)]; + struct net_bridge_fdb_entry *fdb; + + fdb = fdb_find(head, addr); + if (fdb) + return fdb->dst; + else + return NUL...

...;& + fdb->dst != br->uplink) + return; + /* attempt to update an entry for a local interface */ if (unlikely(fdb->is_local)) { if (net_ratelimit()) @@ -415,3 +424,16 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source, spin_unlock(&br->hash_lock); } } + +struct net_bridge_port *br_vepa_find_src(struct net_bridge *br, + const unsigned char *addr) +{ + struct hlist_head *head = &br->hash[br_mac_hash(addr)]; + struct net_bridge_fdb_entry *fdb; + + fdb = fdb_find(head, addr); + if (fdb) + return fdb->dst; + else + return NUL...