Merge remote branch 'anholt/drm-intel-next' into drm-next

* anholt/drm-intel-next: (515 commits)
  drm/i915: Fix out of tree builds
  drm/i915: move fence lru to struct drm_i915_fence_reg
  drm/i915: don't allow tiling changes on pinned buffers v2
  drm/i915: Be extra careful about A/D matching for multifunction SDVO
  drm/i915: Fix DDC bus selection for multifunction SDVO
  drm/i915: cleanup mode setting before unmapping registers
  drm/i915: Make fbc control wrapper functions
  drm/i915: Wait for the GPU whilst shrinking, if truly desperate.
  drm/i915: Use spatio-temporal dithering on PCH
  [MTD] Remove zero-length files mtdbdi.c and internal.ho
  pata_pcmcia / ide-cs: Fix bad hashes for Transcend and kingston IDs
  libata: Fix several inaccuracies in developer's guide
  slub: Fix bad boundary check in init_kmem_cache_nodes()
  raid6: fix recovery performance regression
  KEYS: call_sbin_request_key() must write lock keyrings before modifying them
  KEYS: Use RCU dereference wrappers in keyring key type code
  KEYS: find_keyring_by_name() can gain access to a freed keyring
  ALSA: hda: Fix 0 dB for Packard Bell models using Conexant CX20549 (Venice)
  ALSA: hda - Add quirk for Dell Inspiron 19T using a Conexant CX20582
  ALSA: take tu->qlock with irqs disabled
  ...

1 files changed, 4 insertions, 4 deletions

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index f29ada827a6a..eaa0e1bae49b 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -727,7 +727,7 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
                 group = grec->grec_mca;
                 type = grec->grec_type;
 
-                len += grec->grec_nsrcs * 4;
+                len += ntohs(grec->grec_nsrcs) * 4;
                 if (!pskb_may_pull(skb, len))
                         return -EINVAL;
 
@@ -957,9 +957,6 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         unsigned offset;
         int err;
 
-        BR_INPUT_SKB_CB(skb)->igmp = 0;
-        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
-
         /* We treat OOM as packet loss for now. */
         if (!pskb_may_pull(skb, sizeof(*iph)))
                 return -EINVAL;
@@ -1049,6 +1046,9 @@ err_out:
 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
                      struct sk_buff *skb)
 {
+        BR_INPUT_SKB_CB(skb)->igmp = 0;
+        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
+
         if (br->multicast_disabled)
                 return 0;