3 files changed, 7 insertions, 9 deletions

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 977c3ee02e6..1093c89095d 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -622,7 +622,7 @@ out:
 struct net_bridge_port_group *br_multicast_new_port_group(
                         struct net_bridge_port *port,
                         struct br_ip *group,
-                        struct net_bridge_port_group *next)
+                        struct net_bridge_port_group __rcu *next)
 {
         struct net_bridge_port_group *p;
 
@@ -632,7 +632,7 @@ struct net_bridge_port_group *br_multicast_new_port_group(
 
         p->addr = *group;
         p->port = port;
-        p->next = next;
+        rcu_assign_pointer(p->next, next);
         hlist_add_head(&p->mglist, &port->mglist);
         setup_timer(&p->timer, br_multicast_port_group_expired,
                     (unsigned long)p);
@@ -1138,7 +1138,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                                   struct sk_buff *skb)
 {
         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
-        struct mld_msg *mld = (struct mld_msg *) icmp6_hdr(skb);
+        struct mld_msg *mld;
         struct net_bridge_mdb_entry *mp;
         struct mld2_query *mld2q;
         struct net_bridge_port_group *p;
@@ -1165,6 +1165,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 if (max_delay)
                         group = &mld->mld_mca;
         } else if (skb->len >= sizeof(*mld2q)) {
+                u16 mrc;
                 if (!pskb_may_pull(skb, sizeof(*mld2q))) {
                         err = -EINVAL;
                         goto out;
@@ -1172,7 +1173,8 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
                 if (!mld2q->mld2q_nsrcs)
                         group = &mld2q->mld2q_mca;
-                max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(mld2q->mld2q_mrc) : 1;
+                mrc = ntohs(mld2q->mld2q_mrc);
+                max_delay = mrc ? MLDV2_MRC(mrc) : 1;
         }
 
         if (!group)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 4c02e6ab96e..f2a007b7bde 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -151,8 +151,8 @@ static inline int ndisc_opt_addr_space(struct net_device *dev)
 static u8 *ndisc_fill_addr_option(u8 *opt, int type, void *data, int data_len,
                                   unsigned short addr_type)
 {
-        int space = NDISC_OPT_SPACE(data_len);
         int pad   = ndisc_addr_option_pad(addr_type);
+        int space = NDISC_OPT_SPACE(data_len + pad);
 
         opt[0] = type;
         opt[1] = space>>3;
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 0fa1e92ceac..fea22eb41b8 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -614,10 +614,6 @@ static int llcp_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
                 if (msg->msg_namelen < sizeof(*addr)) {
                         release_sock(sk);
-
-                        pr_err("Invalid socket address length %d\n",
-                               msg->msg_namelen);
-
                         return -EINVAL;
                 }