Fedora kernel-2.6.17-1.2142_FC4 patched with stable patch-2.6.17.4-vs2.0.2-rc26.diff
[linux-2.6.git] / net / ipv4 / igmp.c
index 01db761..d512239 100644 (file)
@@ -91,6 +91,8 @@
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
 #include <linux/times.h>
+
+#include <net/arp.h>
 #include <net/ip.h>
 #include <net/protocol.h>
 #include <net/route.h>
@@ -143,8 +145,8 @@ static int sf_setstate(struct ip_mc_list *pmc);
 static void sf_markstate(struct ip_mc_list *pmc);
 #endif
 static void ip_mc_clear_src(struct ip_mc_list *pmc);
-int ip_mc_add_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
-       int sfcount, __u32 *psfsrc, int delta);
+static int ip_mc_add_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
+                        int sfcount, __u32 *psfsrc, int delta);
 
 static void ip_ma_put(struct ip_mc_list *im)
 {
@@ -231,7 +233,18 @@ static int is_in(struct ip_mc_list *pmc, struct ip_sf_list *psf, int type,
        case IGMPV3_MODE_IS_EXCLUDE:
                if (gdeleted || sdeleted)
                        return 0;
-               return !(pmc->gsquery && !psf->sf_gsresp);
+               if (!(pmc->gsquery && !psf->sf_gsresp)) {
+                       if (pmc->sfmode == MCAST_INCLUDE)
+                               return 1;
+                       /* don't include if this source is excluded
+                        * in all filters
+                        */
+                       if (psf->sf_count[MCAST_INCLUDE])
+                               return type == IGMPV3_MODE_IS_INCLUDE;
+                       return pmc->sfcount[MCAST_EXCLUDE] ==
+                               psf->sf_count[MCAST_EXCLUDE];
+               }
+               return 0;
        case IGMPV3_CHANGE_TO_INCLUDE:
                if (gdeleted || sdeleted)
                        return 0;
@@ -383,7 +396,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
        struct igmpv3_report *pih;
        struct igmpv3_grec *pgr = NULL;
        struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list;
-       int scount, first, isquery, truncate;
+       int scount, stotal, first, isquery, truncate;
 
        if (pmc->multiaddr == IGMP_ALL_HOSTS)
                return skb;
@@ -393,25 +406,13 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
        truncate = type == IGMPV3_MODE_IS_EXCLUDE ||
                    type == IGMPV3_CHANGE_TO_EXCLUDE;
 
+       stotal = scount = 0;
+
        psf_list = sdeleted ? &pmc->tomb : &pmc->sources;
 
-       if (!*psf_list) {
-               if (type == IGMPV3_ALLOW_NEW_SOURCES ||
-                   type == IGMPV3_BLOCK_OLD_SOURCES)
-                       return skb;
-               if (pmc->crcount || isquery) {
-                       /* make sure we have room for group header and at
-                        * least one source.
-                        */
-                       if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)+
-                           sizeof(__u32)) {
-                               igmpv3_sendpack(skb);
-                               skb = NULL; /* add_grhead will get a new one */
-                       }
-                       skb = add_grhead(skb, pmc, type, &pgr);
-               }
-               return skb;
-       }
+       if (!*psf_list)
+               goto empty_source;
+
        pih = skb ? (struct igmpv3_report *)skb->h.igmph : NULL;
 
        /* EX and TO_EX get a fresh packet, if needed */
@@ -424,7 +425,6 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
                }
        }
        first = 1;
-       scount = 0;
        psf_prev = NULL;
        for (psf=*psf_list; psf; psf=psf_next) {
                u32 *psrc;
@@ -458,7 +458,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
                }
                psrc = (u32 *)skb_put(skb, sizeof(u32));
                *psrc = psf->sf_inaddr;
-               scount++;
+               scount++; stotal++;
                if ((type == IGMPV3_ALLOW_NEW_SOURCES ||
                     type == IGMPV3_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
                        psf->sf_crcount--;
@@ -473,6 +473,21 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
                }
                psf_prev = psf;
        }
+
+empty_source:
+       if (!stotal) {
+               if (type == IGMPV3_ALLOW_NEW_SOURCES ||
+                   type == IGMPV3_BLOCK_OLD_SOURCES)
+                       return skb;
+               if (pmc->crcount || isquery) {
+                       /* make sure we have room for group header */
+                       if (skb && AVAILABLE(skb)<sizeof(struct igmpv3_grec)) {
+                               igmpv3_sendpack(skb);
+                               skb = NULL; /* add_grhead will get a new one */
+                       }
+                       skb = add_grhead(skb, pmc, type, &pgr);
+               }
+       }
        if (pgr)
                pgr->grec_nsrcs = htons(scount);
 
@@ -487,7 +502,7 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
        int type;
 
        if (!pmc) {
-               read_lock(&in_dev->lock);
+               read_lock(&in_dev->mc_list_lock);
                for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
                        if (pmc->multiaddr == IGMP_ALL_HOSTS)
                                continue;
@@ -499,7 +514,7 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
                        skb = add_grec(skb, pmc, type, 0, 0);
                        spin_unlock_bh(&pmc->lock);
                }
-               read_unlock(&in_dev->lock);
+               read_unlock(&in_dev->mc_list_lock);
        } else {
                spin_lock_bh(&pmc->lock);
                if (pmc->sfcount[MCAST_EXCLUDE])
@@ -541,8 +556,8 @@ static void igmpv3_send_cr(struct in_device *in_dev)
        struct sk_buff *skb = NULL;
        int type, dtype;
 
-       read_lock(&in_dev->lock);
-       write_lock_bh(&in_dev->mc_lock);
+       read_lock(&in_dev->mc_list_lock);
+       spin_lock_bh(&in_dev->mc_tomb_lock);
 
        /* deleted MCA's */
        pmc_prev = NULL;
@@ -555,11 +570,11 @@ static void igmpv3_send_cr(struct in_device *in_dev)
                        skb = add_grec(skb, pmc, dtype, 1, 1);
                }
                if (pmc->crcount) {
-                       pmc->crcount--;
                        if (pmc->sfmode == MCAST_EXCLUDE) {
                                type = IGMPV3_CHANGE_TO_INCLUDE;
                                skb = add_grec(skb, pmc, type, 1, 0);
                        }
+                       pmc->crcount--;
                        if (pmc->crcount == 0) {
                                igmpv3_clear_zeros(&pmc->tomb);
                                igmpv3_clear_zeros(&pmc->sources);
@@ -575,7 +590,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
                } else
                        pmc_prev = pmc;
        }
-       write_unlock_bh(&in_dev->mc_lock);
+       spin_unlock_bh(&in_dev->mc_tomb_lock);
 
        /* change recs */
        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
@@ -592,16 +607,17 @@ static void igmpv3_send_cr(struct in_device *in_dev)
 
                /* filter mode changes */
                if (pmc->crcount) {
-                       pmc->crcount--;
                        if (pmc->sfmode == MCAST_EXCLUDE)
                                type = IGMPV3_CHANGE_TO_EXCLUDE;
                        else
                                type = IGMPV3_CHANGE_TO_INCLUDE;
                        skb = add_grec(skb, pmc, type, 0, 0);
+                       pmc->crcount--;
                }
                spin_unlock_bh(&pmc->lock);
        }
-       read_unlock(&in_dev->lock);
+       read_unlock(&in_dev->mc_list_lock);
+
        if (!skb)
                return;
        (void) igmpv3_sendpack(skb);
@@ -732,11 +748,43 @@ static void igmp_timer_expire(unsigned long data)
        ip_ma_put(im);
 }
 
-static void igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __u32 *srcs)
+/* mark EXCLUDE-mode sources */
+static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __u32 *srcs)
+{
+       struct ip_sf_list *psf;
+       int i, scount;
+
+       scount = 0;
+       for (psf=pmc->sources; psf; psf=psf->sf_next) {
+               if (scount == nsrcs)
+                       break;
+               for (i=0; i<nsrcs; i++) {
+                       /* skip inactive filters */
+                       if (pmc->sfcount[MCAST_INCLUDE] ||
+                           pmc->sfcount[MCAST_EXCLUDE] !=
+                           psf->sf_count[MCAST_EXCLUDE])
+                               continue;
+                       if (srcs[i] == psf->sf_inaddr) {
+                               scount++;
+                               break;
+                       }
+               }
+       }
+       pmc->gsquery = 0;
+       if (scount == nsrcs)    /* all sources excluded */
+               return 0;
+       return 1;
+}
+
+static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __u32 *srcs)
 {
        struct ip_sf_list *psf;
        int i, scount;
 
+       if (pmc->sfmode == MCAST_EXCLUDE)
+               return igmp_xmarksources(pmc, nsrcs, srcs);
+
+       /* mark INCLUDE-mode sources */
        scount = 0;
        for (psf=pmc->sources; psf; psf=psf->sf_next) {
                if (scount == nsrcs)
@@ -748,6 +796,12 @@ static void igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __u32 *srcs)
                                break;
                        }
        }
+       if (!scount) {
+               pmc->gsquery = 0;
+               return 0;
+       }
+       pmc->gsquery = 1;
+       return 1;
 }
 
 static void igmp_heard_report(struct in_device *in_dev, u32 group)
@@ -759,14 +813,14 @@ static void igmp_heard_report(struct in_device *in_dev, u32 group)
        if (group == IGMP_ALL_HOSTS)
                return;
 
-       read_lock(&in_dev->lock);
+       read_lock(&in_dev->mc_list_lock);
        for (im=in_dev->mc_list; im!=NULL; im=im->next) {
                if (im->multiaddr == group) {
                        igmp_stop_timer(im);
                        break;
                }
        }
-       read_unlock(&in_dev->lock);
+       read_unlock(&in_dev->mc_list_lock);
 }
 
 static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
@@ -840,8 +894,10 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
         * - Use the igmp->igmp_code field as the maximum
         *   delay possible
         */
-       read_lock(&in_dev->lock);
+       read_lock(&in_dev->mc_list_lock);
        for (im=in_dev->mc_list; im!=NULL; im=im->next) {
+               int changed;
+
                if (group && group != im->multiaddr)
                        continue;
                if (im->multiaddr == IGMP_ALL_HOSTS)
@@ -851,12 +907,13 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                        im->gsquery = im->gsquery && mark;
                else
                        im->gsquery = mark;
-               if (im->gsquery)
-                       igmp_marksources(im, ntohs(ih3->nsrcs), ih3->srcs);
+               changed = !im->gsquery ||
+                       igmp_marksources(im, ntohs(ih3->nsrcs), ih3->srcs);
                spin_unlock_bh(&im->lock);
-               igmp_mod_timer(im, max_delay);
+               if (changed)
+                       igmp_mod_timer(im, max_delay);
        }
-       read_unlock(&in_dev->lock);
+       read_unlock(&in_dev->mc_list_lock);
 }
 
 int igmp_rcv(struct sk_buff *skb)
@@ -871,11 +928,18 @@ int igmp_rcv(struct sk_buff *skb)
                return 0;
        }
 
-       if (!pskb_may_pull(skb, sizeof(struct igmphdr)) || 
-           (u16)csum_fold(skb_checksum(skb, 0, len, 0))) {
-               in_dev_put(in_dev);
-               kfree_skb(skb);
-               return 0;
+       if (!pskb_may_pull(skb, sizeof(struct igmphdr)))
+               goto drop;
+
+       switch (skb->ip_summed) {
+       case CHECKSUM_HW:
+               if (!(u16)csum_fold(skb->csum))
+                       break;
+               /* fall through */
+       case CHECKSUM_NONE:
+               skb->csum = 0;
+               if (__skb_checksum_complete(skb))
+                       goto drop;
        }
 
        ih = skb->h.igmph;
@@ -889,7 +953,10 @@ int igmp_rcv(struct sk_buff *skb)
                /* Is it our report looped back? */
                if (((struct rtable*)skb->dst)->fl.iif == 0)
                        break;
-               igmp_heard_report(in_dev, ih->group);
+               /* don't rely on MC router hearing unicast reports */
+               if (skb->pkt_type == PACKET_MULTICAST ||
+                   skb->pkt_type == PACKET_BROADCAST)
+                       igmp_heard_report(in_dev, ih->group);
                break;
        case IGMP_PIM:
 #ifdef CONFIG_IP_PIMSM_V1
@@ -903,8 +970,10 @@ int igmp_rcv(struct sk_buff *skb)
        case IGMP_MTRACE_RESP:
                break;
        default:
-               NETDEBUG(printk(KERN_DEBUG "New IGMP type=%d, why we do not know about it?\n", ih->type));
+               break;
        }
+
+drop:
        in_dev_put(in_dev);
        kfree_skb(skb);
        return 0;
@@ -960,7 +1029,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
         * for deleted items allows change reports to use common code with
         * non-deleted or query-response MCA's.
         */
-       pmc = (struct ip_mc_list *)kmalloc(sizeof(*pmc), GFP_KERNEL);
+       pmc = kmalloc(sizeof(*pmc), GFP_KERNEL);
        if (!pmc)
                return;
        memset(pmc, 0, sizeof(*pmc));
@@ -982,10 +1051,10 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
        }
        spin_unlock_bh(&im->lock);
 
-       write_lock_bh(&in_dev->mc_lock);
+       spin_lock_bh(&in_dev->mc_tomb_lock);
        pmc->next = in_dev->mc_tomb;
        in_dev->mc_tomb = pmc;
-       write_unlock_bh(&in_dev->mc_lock);
+       spin_unlock_bh(&in_dev->mc_tomb_lock);
 }
 
 static void igmpv3_del_delrec(struct in_device *in_dev, __u32 multiaddr)
@@ -993,7 +1062,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __u32 multiaddr)
        struct ip_mc_list *pmc, *pmc_prev;
        struct ip_sf_list *psf, *psf_next;
 
-       write_lock_bh(&in_dev->mc_lock);
+       spin_lock_bh(&in_dev->mc_tomb_lock);
        pmc_prev = NULL;
        for (pmc=in_dev->mc_tomb; pmc; pmc=pmc->next) {
                if (pmc->multiaddr == multiaddr)
@@ -1006,7 +1075,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __u32 multiaddr)
                else
                        in_dev->mc_tomb = pmc->next;
        }
-       write_unlock_bh(&in_dev->mc_lock);
+       spin_unlock_bh(&in_dev->mc_tomb_lock);
        if (pmc) {
                for (psf=pmc->tomb; psf; psf=psf_next) {
                        psf_next = psf->sf_next;
@@ -1021,10 +1090,10 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
 {
        struct ip_mc_list *pmc, *nextpmc;
 
-       write_lock_bh(&in_dev->mc_lock);
+       spin_lock_bh(&in_dev->mc_tomb_lock);
        pmc = in_dev->mc_tomb;
        in_dev->mc_tomb = NULL;
-       write_unlock_bh(&in_dev->mc_lock);
+       spin_unlock_bh(&in_dev->mc_tomb_lock);
 
        for (; pmc; pmc = nextpmc) {
                nextpmc = pmc->next;
@@ -1033,7 +1102,7 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                kfree(pmc);
        }
        /* clear dead sources, too */
-       read_lock(&in_dev->lock);
+       read_lock(&in_dev->mc_list_lock);
        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
                struct ip_sf_list *psf, *psf_next;
 
@@ -1046,7 +1115,7 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                        kfree(psf);
                }
        }
-       read_unlock(&in_dev->lock);
+       read_unlock(&in_dev->mc_list_lock);
 }
 #endif
 
@@ -1140,7 +1209,7 @@ void ip_mc_inc_group(struct in_device *in_dev, u32 addr)
                }
        }
 
-       im = (struct ip_mc_list *)kmalloc(sizeof(*im), GFP_KERNEL);
+       im = kmalloc(sizeof(*im), GFP_KERNEL);
        if (!im)
                goto out;
 
@@ -1167,10 +1236,10 @@ void ip_mc_inc_group(struct in_device *in_dev, u32 addr)
        im->gsquery = 0;
 #endif
        im->loaded = 0;
-       write_lock_bh(&in_dev->lock);
+       write_lock_bh(&in_dev->mc_list_lock);
        im->next=in_dev->mc_list;
        in_dev->mc_list=im;
-       write_unlock_bh(&in_dev->lock);
+       write_unlock_bh(&in_dev->mc_list_lock);
 #ifdef CONFIG_IP_MULTICAST
        igmpv3_del_delrec(in_dev, im->multiaddr);
 #endif
@@ -1194,9 +1263,9 @@ void ip_mc_dec_group(struct in_device *in_dev, u32 addr)
        for (ip=&in_dev->mc_list; (i=*ip)!=NULL; ip=&i->next) {
                if (i->multiaddr==addr) {
                        if (--i->users == 0) {
-                               write_lock_bh(&in_dev->lock);
+                               write_lock_bh(&in_dev->mc_list_lock);
                                *ip = i->next;
-                               write_unlock_bh(&in_dev->lock);
+                               write_unlock_bh(&in_dev->mc_list_lock);
                                igmp_group_dropped(i);
 
                                if (!in_dev->dead)
@@ -1251,7 +1320,8 @@ void ip_mc_init_dev(struct in_device *in_dev)
        in_dev->mr_qrv = IGMP_Unsolicited_Report_Count;
 #endif
 
-       in_dev->mc_lock = RW_LOCK_UNLOCKED;
+       rwlock_init(&in_dev->mc_list_lock);
+       spin_lock_init(&in_dev->mc_tomb_lock);
 }
 
 /* Device going up */
@@ -1281,17 +1351,17 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
        /* Deactivate timers */
        ip_mc_down(in_dev);
 
-       write_lock_bh(&in_dev->lock);
+       write_lock_bh(&in_dev->mc_list_lock);
        while ((i = in_dev->mc_list) != NULL) {
                in_dev->mc_list = i->next;
-               write_unlock_bh(&in_dev->lock);
+               write_unlock_bh(&in_dev->mc_list_lock);
 
                igmp_group_dropped(i);
                ip_ma_put(i);
 
-               write_lock_bh(&in_dev->lock);
+               write_lock_bh(&in_dev->mc_list_lock);
        }
-       write_unlock_bh(&in_dev->lock);
+       write_unlock_bh(&in_dev->mc_list_lock);
 }
 
 static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
@@ -1312,7 +1382,7 @@ static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
                dev = ip_dev_find(imr->imr_address.s_addr);
                if (!dev)
                        return NULL;
-               __dev_put(dev);
+               dev_put(dev);
        }
 
        if (!dev && !ip_route_output_key(&rt, &fl)) {
@@ -1321,7 +1391,7 @@ static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
        }
        if (dev) {
                imr->imr_ifindex = dev->ifindex;
-               idev = __in_dev_get(dev);
+               idev = __in_dev_get_rtnl(dev);
        }
        return idev;
 }
@@ -1382,8 +1452,8 @@ static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
 #define igmp_ifc_event(x)      do { } while (0)
 #endif
 
-int ip_mc_del_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
-       int sfcount, __u32 *psfsrc, int delta)
+static int ip_mc_del_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
+                        int sfcount, __u32 *psfsrc, int delta)
 {
        struct ip_mc_list *pmc;
        int     changerec = 0;
@@ -1391,18 +1461,18 @@ int ip_mc_del_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
 
        if (!in_dev)
                return -ENODEV;
-       read_lock(&in_dev->lock);
+       read_lock(&in_dev->mc_list_lock);
        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
                if (*pmca == pmc->multiaddr)
                        break;
        }
        if (!pmc) {
                /* MCA not found?? bug */
-               read_unlock(&in_dev->lock);
+               read_unlock(&in_dev->mc_list_lock);
                return -ESRCH;
        }
        spin_lock_bh(&pmc->lock);
-       read_unlock(&in_dev->lock);
+       read_unlock(&in_dev->mc_list_lock);
 #ifdef CONFIG_IP_MULTICAST
        sf_markstate(pmc);
 #endif
@@ -1460,7 +1530,7 @@ static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
                psf_prev = psf;
        }
        if (!psf) {
-               psf = (struct ip_sf_list *)kmalloc(sizeof(*psf), GFP_ATOMIC);
+               psf = kmalloc(sizeof(*psf), GFP_ATOMIC);
                if (!psf)
                        return -ENOBUFS;
                memset(psf, 0, sizeof(*psf));
@@ -1494,7 +1564,7 @@ static void sf_markstate(struct ip_mc_list *pmc)
 
 static int sf_setstate(struct ip_mc_list *pmc)
 {
-       struct ip_sf_list *psf;
+       struct ip_sf_list *psf, *dpsf;
        int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
        int qrv = pmc->interface->mr_qrv;
        int new_in, rv;
@@ -1506,8 +1576,46 @@ static int sf_setstate(struct ip_mc_list *pmc)
                                !psf->sf_count[MCAST_INCLUDE];
                } else
                        new_in = psf->sf_count[MCAST_INCLUDE] != 0;
-               if (new_in != psf->sf_oldin) {
-                       psf->sf_crcount = qrv;
+               if (new_in) {
+                       if (!psf->sf_oldin) {
+                               struct ip_sf_list *prev = NULL;
+
+                               for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next) {
+                                       if (dpsf->sf_inaddr == psf->sf_inaddr)
+                                               break;
+                                       prev = dpsf;
+                               }
+                               if (dpsf) {
+                                       if (prev)
+                                               prev->sf_next = dpsf->sf_next;
+                                       else
+                                               pmc->tomb = dpsf->sf_next;
+                                       kfree(dpsf);
+                               }
+                               psf->sf_crcount = qrv;
+                               rv++;
+                       }
+               } else if (psf->sf_oldin) {
+
+                       psf->sf_crcount = 0;
+                       /*
+                        * add or update "delete" records if an active filter
+                        * is now inactive
+                        */
+                       for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next)
+                               if (dpsf->sf_inaddr == psf->sf_inaddr)
+                                       break;
+                       if (!dpsf) {
+                               dpsf = (struct ip_sf_list *)
+                                       kmalloc(sizeof(*dpsf), GFP_ATOMIC);
+                               if (!dpsf)
+                                       continue;
+                               *dpsf = *psf;
+                               /* pmc->lock held by callers */
+                               dpsf->sf_next = pmc->tomb;
+                               pmc->tomb = dpsf;
+                       }
+                       dpsf->sf_crcount = qrv;
                        rv++;
                }
        }
@@ -1518,8 +1626,8 @@ static int sf_setstate(struct ip_mc_list *pmc)
 /*
  * Add multicast source filter list to the interface list
  */
-int ip_mc_add_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
-       int sfcount, __u32 *psfsrc, int delta)
+static int ip_mc_add_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
+                        int sfcount, __u32 *psfsrc, int delta)
 {
        struct ip_mc_list *pmc;
        int     isexclude;
@@ -1527,18 +1635,18 @@ int ip_mc_add_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
 
        if (!in_dev)
                return -ENODEV;
-       read_lock(&in_dev->lock);
+       read_lock(&in_dev->mc_list_lock);
        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
                if (*pmca == pmc->multiaddr)
                        break;
        }
        if (!pmc) {
                /* MCA not found?? bug */
-               read_unlock(&in_dev->lock);
+               read_unlock(&in_dev->mc_list_lock);
                return -ESRCH;
        }
        spin_lock_bh(&pmc->lock);
-       read_unlock(&in_dev->lock);
+       read_unlock(&in_dev->mc_list_lock);
 
 #ifdef CONFIG_IP_MULTICAST
        sf_markstate(pmc);
@@ -1601,7 +1709,7 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
        }
        pmc->sources = NULL;
        pmc->sfmode = MCAST_EXCLUDE;
-       pmc->sfcount[MCAST_EXCLUDE] = 0;
+       pmc->sfcount[MCAST_INCLUDE] = 0;
        pmc->sfcount[MCAST_EXCLUDE] = 1;
 }
 
@@ -1613,15 +1721,16 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
 {
        int err;
        u32 addr = imr->imr_multiaddr.s_addr;
-       struct ip_mc_socklist *iml, *i;
+       struct ip_mc_socklist *iml=NULL, *i;
        struct in_device *in_dev;
-       struct inet_opt *inet = inet_sk(sk);
+       struct inet_sock *inet = inet_sk(sk);
+       int ifindex;
        int count = 0;
 
        if (!MULTICAST(addr))
                return -EINVAL;
 
-       rtnl_shlock();
+       rtnl_lock();
 
        in_dev = ip_mc_find_dev(imr);
 
@@ -1631,42 +1740,35 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
                goto done;
        }
 
-       iml = (struct ip_mc_socklist *)sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
-
        err = -EADDRINUSE;
+       ifindex = imr->imr_ifindex;
        for (i = inet->mc_list; i; i = i->next) {
-               if (memcmp(&i->multi, imr, sizeof(*imr)) == 0) {
-                       /* New style additions are reference counted */
-                       if (imr->imr_address.s_addr == 0) {
-                               i->count++;
-                               err = 0;
-                       }
+               if (i->multi.imr_multiaddr.s_addr == addr &&
+                   i->multi.imr_ifindex == ifindex)
                        goto done;
-               }
                count++;
        }
        err = -ENOBUFS;
-       if (iml == NULL || count >= sysctl_igmp_max_memberships)
+       if (count >= sysctl_igmp_max_memberships)
+               goto done;
+       iml = sock_kmalloc(sk,sizeof(*iml),GFP_KERNEL);
+       if (iml == NULL)
                goto done;
+
        memcpy(&iml->multi, imr, sizeof(*imr));
        iml->next = inet->mc_list;
-       iml->count = 1;
        iml->sflist = NULL;
        iml->sfmode = MCAST_EXCLUDE;
        inet->mc_list = iml;
        ip_mc_inc_group(in_dev, addr);
-       iml = NULL;
        err = 0;
-
 done:
-       rtnl_shunlock();
-       if (iml)
-               sock_kfree_s(sk, iml, sizeof(*iml));
+       rtnl_unlock();
        return err;
 }
 
-int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
-       struct in_device *in_dev)
+static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
+                          struct in_device *in_dev)
 {
        int err;
 
@@ -1689,32 +1791,27 @@ int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
 
 int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
 {
-       struct inet_opt *inet = inet_sk(sk);
+       struct inet_sock *inet = inet_sk(sk);
        struct ip_mc_socklist *iml, **imlp;
+       struct in_device *in_dev;
+       u32 group = imr->imr_multiaddr.s_addr;
+       u32 ifindex;
 
        rtnl_lock();
+       in_dev = ip_mc_find_dev(imr);
+       if (!in_dev) {
+               rtnl_unlock();
+               return -ENODEV;
+       }
+       ifindex = imr->imr_ifindex;
        for (imlp = &inet->mc_list; (iml = *imlp) != NULL; imlp = &iml->next) {
-               if (iml->multi.imr_multiaddr.s_addr==imr->imr_multiaddr.s_addr &&
-                   iml->multi.imr_address.s_addr==imr->imr_address.s_addr &&
-                   (!imr->imr_ifindex || iml->multi.imr_ifindex==imr->imr_ifindex)) {
-                       struct in_device *in_dev;
-
-                       in_dev = inetdev_by_index(iml->multi.imr_ifindex);
-                       if (in_dev)
-                               (void) ip_mc_leave_src(sk, iml, in_dev);
-                       if (--iml->count) {
-                               rtnl_unlock();
-                               if (in_dev)
-                                       in_dev_put(in_dev);
-                               return 0;
-                       }
+               if (iml->multi.imr_multiaddr.s_addr == group &&
+                   iml->multi.imr_ifindex == ifindex) {
+                       (void) ip_mc_leave_src(sk, iml, in_dev);
 
                        *imlp = iml->next;
 
-                       if (in_dev) {
-                               ip_mc_dec_group(in_dev, imr->imr_multiaddr.s_addr);
-                               in_dev_put(in_dev);
-                       }
+                       ip_mc_dec_group(in_dev, group);
                        rtnl_unlock();
                        sock_kfree_s(sk, iml, sizeof(*iml));
                        return 0;
@@ -1732,14 +1829,15 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
        u32 addr = mreqs->imr_multiaddr;
        struct ip_mc_socklist *pmc;
        struct in_device *in_dev = NULL;
-       struct inet_opt *inet = inet_sk(sk);
+       struct inet_sock *inet = inet_sk(sk);
        struct ip_sf_socklist *psl;
+       int leavegroup = 0;
        int i, j, rv;
 
        if (!MULTICAST(addr))
                return -EINVAL;
 
-       rtnl_shlock();
+       rtnl_lock();
 
        imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
        imr.imr_address.s_addr = mreqs->imr_interface;
@@ -1753,15 +1851,20 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
        err = -EADDRNOTAVAIL;
 
        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
-               if (memcmp(&pmc->multi, mreqs, 2*sizeof(__u32)) == 0)
+               if (pmc->multi.imr_multiaddr.s_addr == imr.imr_multiaddr.s_addr
+                   && pmc->multi.imr_ifindex == imr.imr_ifindex)
                        break;
        }
-       if (!pmc)               /* must have a prior join */
+       if (!pmc) {             /* must have a prior join */
+               err = -EINVAL;
                goto done;
+       }
        /* if a source filter was set, must be the same mode as before */
        if (pmc->sflist) {
-               if (pmc->sfmode != omode)
+               if (pmc->sfmode != omode) {
+                       err = -EINVAL;
                        goto done;
+               }
        } else if (pmc->sfmode != omode) {
                /* allow mode switches for empty-set filters */
                ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 0, NULL, 0);
@@ -1773,16 +1876,22 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
        psl = pmc->sflist;
        if (!add) {
                if (!psl)
-                       goto done;
+                       goto done;      /* err = -EADDRNOTAVAIL */
                rv = !0;
                for (i=0; i<psl->sl_count; i++) {
-                       rv = memcmp(&psl->sl_addr, &mreqs->imr_multiaddr,
+                       rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                                sizeof(__u32));
-                       if (rv >= 0)
+                       if (rv == 0)
                                break;
                }
-               if (!rv)        /* source not found */
+               if (rv)         /* source not found */
+                       goto done;      /* err = -EADDRNOTAVAIL */
+
+               /* special case - (INCLUDE, empty) == LEAVE_GROUP */
+               if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
+                       leavegroup = 1;
                        goto done;
+               }
 
                /* update the interface filter */
                ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1, 
@@ -1806,8 +1915,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
 
                if (psl)
                        count += psl->sl_max;
-               newpsl = (struct ip_sf_socklist *)sock_kmalloc(sk,
-                       IP_SFLSIZE(count), GFP_KERNEL);
+               newpsl = sock_kmalloc(sk, IP_SFLSIZE(count), GFP_KERNEL);
                if (!newpsl) {
                        err = -ENOBUFS;
                        goto done;
@@ -1823,9 +1931,9 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
        }
        rv = 1; /* > 0 for insert logic below if sl_count is 0 */
        for (i=0; i<psl->sl_count; i++) {
-               rv = memcmp(&psl->sl_addr, &mreqs->imr_multiaddr,
+               rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                        sizeof(__u32));
-               if (rv >= 0)
+               if (rv == 0)
                        break;
        }
        if (rv == 0)            /* address already there is an error */
@@ -1839,19 +1947,22 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
        ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 1, 
                &mreqs->imr_sourceaddr, 1);
 done:
-       rtnl_shunlock();
+       rtnl_unlock();
+       if (leavegroup)
+               return ip_mc_leave_group(sk, &imr);
        return err;
 }
 
 int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
 {
-       int err;
+       int err = 0;
        struct ip_mreqn imr;
        u32 addr = msf->imsf_multiaddr;
        struct ip_mc_socklist *pmc;
        struct in_device *in_dev;
-       struct inet_opt *inet = inet_sk(sk);
+       struct inet_sock *inet = inet_sk(sk);
        struct ip_sf_socklist *newpsl, *psl;
+       int leavegroup = 0;
 
        if (!MULTICAST(addr))
                return -EINVAL;
@@ -1859,7 +1970,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
            msf->imsf_fmode != MCAST_EXCLUDE)
                return -EINVAL;
 
-       rtnl_shlock();
+       rtnl_lock();
 
        imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
        imr.imr_address.s_addr = msf->imsf_interface;
@@ -1870,18 +1981,25 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                err = -ENODEV;
                goto done;
        }
-       err = -EADDRNOTAVAIL;
+
+       /* special case - (INCLUDE, empty) == LEAVE_GROUP */
+       if (msf->imsf_fmode == MCAST_INCLUDE && msf->imsf_numsrc == 0) {
+               leavegroup = 1;
+               goto done;
+       }
 
        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
                if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
                    pmc->multi.imr_ifindex == imr.imr_ifindex)
                        break;
        }
-       if (!pmc)               /* must have a prior join */
+       if (!pmc) {             /* must have a prior join */
+               err = -EINVAL;
                goto done;
+       }
        if (msf->imsf_numsrc) {
-               newpsl = (struct ip_sf_socklist *)sock_kmalloc(sk,
-                               IP_SFLSIZE(msf->imsf_numsrc), GFP_KERNEL);
+               newpsl = sock_kmalloc(sk, IP_SFLSIZE(msf->imsf_numsrc),
+                                                          GFP_KERNEL);
                if (!newpsl) {
                        err = -ENOBUFS;
                        goto done;
@@ -1895,8 +2013,11 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                        sock_kfree_s(sk, newpsl, IP_SFLSIZE(newpsl->sl_max));
                        goto done;
                }
-       } else
+       } else {
                newpsl = NULL;
+               (void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
+                                    msf->imsf_fmode, 0, NULL, 0);
+       }
        psl = pmc->sflist;
        if (psl) {
                (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
@@ -1907,8 +2028,11 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                        0, NULL, 0);
        pmc->sflist = newpsl;
        pmc->sfmode = msf->imsf_fmode;
+       err = 0;
 done:
-       rtnl_shunlock();
+       rtnl_unlock();
+       if (leavegroup)
+               err = ip_mc_leave_group(sk, &imr);
        return err;
 }
 
@@ -1920,13 +2044,13 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
        u32 addr = msf->imsf_multiaddr;
        struct ip_mc_socklist *pmc;
        struct in_device *in_dev;
-       struct inet_opt *inet = inet_sk(sk);
+       struct inet_sock *inet = inet_sk(sk);
        struct ip_sf_socklist *psl;
 
        if (!MULTICAST(addr))
                return -EINVAL;
 
-       rtnl_shlock();
+       rtnl_lock();
 
        imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
        imr.imr_address.s_addr = msf->imsf_interface;
@@ -1948,7 +2072,7 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
                goto done;
        msf->imsf_fmode = pmc->sfmode;
        psl = pmc->sflist;
-       rtnl_shunlock();
+       rtnl_unlock();
        if (!psl) {
                len = 0;
                count = 0;
@@ -1967,7 +2091,7 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
                return -EFAULT;
        return 0;
 done:
-       rtnl_shunlock();
+       rtnl_unlock();
        return err;
 }
 
@@ -1978,7 +2102,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
        struct sockaddr_in *psin;
        u32 addr;
        struct ip_mc_socklist *pmc;
-       struct inet_opt *inet = inet_sk(sk);
+       struct inet_sock *inet = inet_sk(sk);
        struct ip_sf_socklist *psl;
 
        psin = (struct sockaddr_in *)&gsf->gf_group;
@@ -1988,7 +2112,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
        if (!MULTICAST(addr))
                return -EINVAL;
 
-       rtnl_shlock();
+       rtnl_lock();
 
        err = -EADDRNOTAVAIL;
 
@@ -2001,7 +2125,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
                goto done;
        gsf->gf_fmode = pmc->sfmode;
        psl = pmc->sflist;
-       rtnl_shunlock();
+       rtnl_unlock();
        count = psl ? psl->sl_count : 0;
        copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
        gsf->gf_numsrc = count;
@@ -2022,7 +2146,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
        }
        return 0;
 done:
-       rtnl_shunlock();
+       rtnl_unlock();
        return err;
 }
 
@@ -2031,7 +2155,7 @@ done:
  */
 int ip_mc_sf_allow(struct sock *sk, u32 loc_addr, u32 rmt_addr, int dif)
 {
-       struct inet_opt *inet = inet_sk(sk);
+       struct inet_sock *inet = inet_sk(sk);
        struct ip_mc_socklist *pmc;
        struct ip_sf_socklist *psl;
        int i;
@@ -2067,7 +2191,7 @@ int ip_mc_sf_allow(struct sock *sk, u32 loc_addr, u32 rmt_addr, int dif)
 
 void ip_mc_drop_socket(struct sock *sk)
 {
-       struct inet_opt *inet = inet_sk(sk);
+       struct inet_sock *inet = inet_sk(sk);
        struct ip_mc_socklist *iml;
 
        if (inet->mc_list == NULL)
@@ -2095,7 +2219,7 @@ int ip_check_mc(struct in_device *in_dev, u32 mc_addr, u32 src_addr, u16 proto)
        struct ip_sf_list *psf;
        int rv = 0;
 
-       read_lock(&in_dev->lock);
+       read_lock(&in_dev->mc_list_lock);
        for (im=in_dev->mc_list; im; im=im->next) {
                if (im->multiaddr == mc_addr)
                        break;
@@ -2117,7 +2241,7 @@ int ip_check_mc(struct in_device *in_dev, u32 mc_addr, u32 src_addr, u16 proto)
                } else
                        rv = 1; /* unspecified source; tentatively allow */
        }
-       read_unlock(&in_dev->lock);
+       read_unlock(&in_dev->mc_list_lock);
        return rv;
 }
 
@@ -2141,13 +2265,13 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
                in_dev = in_dev_get(state->dev);
                if (!in_dev)
                        continue;
-               read_lock(&in_dev->lock);
+               read_lock(&in_dev->mc_list_lock);
                im = in_dev->mc_list;
                if (im) {
                        state->in_dev = in_dev;
                        break;
                }
-               read_unlock(&in_dev->lock);
+               read_unlock(&in_dev->mc_list_lock);
                in_dev_put(in_dev);
        }
        return im;
@@ -2159,7 +2283,7 @@ static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_li
        im = im->next;
        while (!im) {
                if (likely(state->in_dev != NULL)) {
-                       read_unlock(&state->in_dev->lock);
+                       read_unlock(&state->in_dev->mc_list_lock);
                        in_dev_put(state->in_dev);
                }
                state->dev = state->dev->next;
@@ -2170,7 +2294,7 @@ static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_li
                state->in_dev = in_dev_get(state->dev);
                if (!state->in_dev)
                        continue;
-               read_lock(&state->in_dev->lock);
+               read_lock(&state->in_dev->mc_list_lock);
                im = state->in_dev->mc_list;
        }
        return im;
@@ -2206,7 +2330,7 @@ static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
 {
        struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
        if (likely(state->in_dev != NULL)) {
-               read_unlock(&state->in_dev->lock);
+               read_unlock(&state->in_dev->mc_list_lock);
                in_dev_put(state->in_dev);
                state->in_dev = NULL;
        }
@@ -2304,7 +2428,7 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
                idev = in_dev_get(state->dev);
                if (unlikely(idev == NULL))
                        continue;
-               read_lock_bh(&idev->lock);
+               read_lock(&idev->mc_list_lock);
                im = idev->mc_list;
                if (likely(im != NULL)) {
                        spin_lock_bh(&im->lock);
@@ -2316,7 +2440,7 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
                        }
                        spin_unlock_bh(&im->lock);
                }
-               read_unlock_bh(&idev->lock);
+               read_unlock(&idev->mc_list_lock);
                in_dev_put(idev);
        }
        return psf;
@@ -2332,7 +2456,7 @@ static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_l
                state->im = state->im->next;
                while (!state->im) {
                        if (likely(state->idev != NULL)) {
-                               read_unlock_bh(&state->idev->lock);
+                               read_unlock(&state->idev->mc_list_lock);
                                in_dev_put(state->idev);
                        }
                        state->dev = state->dev->next;
@@ -2343,7 +2467,7 @@ static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_l
                        state->idev = in_dev_get(state->dev);
                        if (!state->idev)
                                continue;
-                       read_lock_bh(&state->idev->lock);
+                       read_lock(&state->idev->mc_list_lock);
                        state->im = state->idev->mc_list;
                }
                if (!state->im)
@@ -2389,7 +2513,7 @@ static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
                state->im = NULL;
        }
        if (likely(state->idev != NULL)) {
-               read_unlock_bh(&state->idev->lock);
+               read_unlock(&state->idev->mc_list_lock);
                in_dev_put(state->idev);
                state->idev = NULL;
        }