igmp: call ip_mc_clear_src() only when we have no users of ip_mc_list

In igmp_group_dropped() we call ip_mc_clear_src(), which resets the number
of source filters per mulitcast. However, igmp_group_dropped() is also
called on NETDEV_DOWN, NETDEV_PRE_TYPE_CHANGE and NETDEV_UNREGISTER, which
means that the group might get added back on NETDEV_UP, NETDEV_REGISTER and
NETDEV_POST_TYPE_CHANGE respectively, leaving us with broken source
filters.

To fix that, we must clear the source filters only when there are no users
in the ip_mc_list, i.e. in ip_mc_dec_group() and on device destroy.

Acked-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: Veaceslav Falico <vfalico@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 5 deletions

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 672e476c8c8a..f1d27f6c9351 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1155,20 +1155,18 @@ static void igmp_group_dropped(struct ip_mc_list *im)
 
         if (!in_dev->dead) {
                 if (IGMP_V1_SEEN(in_dev))
-                        goto done;
+                        return;
                 if (IGMP_V2_SEEN(in_dev)) {
                         if (reporter)
                                 igmp_send_report(in_dev, im, IGMP_HOST_LEAVE_MESSAGE);
-                        goto done;
+                        return;
                 }
                 /* IGMPv3 */
                 igmpv3_add_delrec(in_dev, im);
 
                 igmp_ifc_event(in_dev);
         }
-done:
 #endif
-        ip_mc_clear_src(im);
 }
 
 static void igmp_group_added(struct ip_mc_list *im)
@@ -1305,6 +1303,7 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
                                 *ip = i->next_rcu;
                                 in_dev->mc_count--;
                                 igmp_group_dropped(i);
+                                ip_mc_clear_src(i);
 
                                 if (!in_dev->dead)
                                         ip_rt_multicast_event(in_dev);
@@ -1414,7 +1413,8 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
                 in_dev->mc_list = i->next_rcu;
                 in_dev->mc_count--;
 
-                igmp_group_dropped(i);
+                /* We've dropped the groups in ip_mc_down already */
+                ip_mc_clear_src(i);
                 ip_ma_put(i);
         }
 }