1 files changed, 11 insertions, 8 deletions

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2559fb539836..fd96a8dc97f4 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -38,7 +38,7 @@ static struct net_bridge_mdb_entry *__br_mdb_ip_get(
         struct net_bridge_mdb_entry *mp;
         struct hlist_node *p;
 
-        hlist_for_each_entry(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
+        hlist_for_each_entry_rcu(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
                 if (dst == mp->addr)
                         return mp;
         }
@@ -627,8 +627,8 @@ static void br_multicast_port_query_expired(unsigned long data)
         struct net_bridge *br = port->br;
 
         spin_lock(&br->multicast_lock);
-        if (port && (port->state == BR_STATE_DISABLED ||
-                     port->state == BR_STATE_BLOCKING))
+        if (port->state == BR_STATE_DISABLED ||
+            port->state == BR_STATE_BLOCKING)
                 goto out;
 
         if (port->multicast_startup_queries_sent <
@@ -823,6 +823,7 @@ static int br_multicast_query(struct net_bridge *br,
         unsigned long max_delay;
         unsigned long now = jiffies;
         __be32 group;
+        int err = 0;
 
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
@@ -841,12 +842,14 @@ static int br_multicast_query(struct net_bridge *br,
                         group = 0;
                 }
         } else {
-                if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
-                        return -EINVAL;
+                if (!pskb_may_pull(skb, sizeof(struct igmpv3_query))) {
+                        err = -EINVAL;
+                        goto out;
+                }
 
                 ih3 = igmpv3_query_hdr(skb);
                 if (ih3->nsrcs)
-                        return 0;
+                        goto out;
 
                 max_delay = ih3->code ? 1 :
                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE);
@@ -876,7 +879,7 @@ static int br_multicast_query(struct net_bridge *br,
 
 out:
         spin_unlock(&br->multicast_lock);
-        return 0;
+        return err;
 }
 
 static void br_multicast_leave_group(struct net_bridge *br,
@@ -1135,7 +1138,7 @@ void br_multicast_stop(struct net_bridge *br)
 
         if (mdb->old) {
                 spin_unlock_bh(&br->multicast_lock);
-                synchronize_rcu_bh();
+                rcu_barrier_bh();
                 spin_lock_bh(&br->multicast_lock);
                 WARN_ON(mdb->old);
         }