1 files changed, 15 insertions, 13 deletions

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index fd96a8dc97f4..eaa0e1bae49b 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -49,22 +49,23 @@ static struct net_bridge_mdb_entry *__br_mdb_ip_get(
 static struct net_bridge_mdb_entry *br_mdb_ip_get(
         struct net_bridge_mdb_htable *mdb, __be32 dst)
 {
+        if (!mdb)
+                return NULL;
+
         return __br_mdb_ip_get(mdb, dst, br_ip_hash(mdb, dst));
 }
 
 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
                                         struct sk_buff *skb)
 {
-        struct net_bridge_mdb_htable *mdb = br->mdb;
-
-        if (!mdb || br->multicast_disabled)
+        if (br->multicast_disabled)
                 return NULL;
 
         switch (skb->protocol) {
         case htons(ETH_P_IP):
                 if (BR_INPUT_SKB_CB(skb)->igmp)
                         break;
-                return br_mdb_ip_get(mdb, ip_hdr(skb)->daddr);
+                return br_mdb_ip_get(br->mdb, ip_hdr(skb)->daddr);
         }
 
         return NULL;
@@ -722,11 +723,11 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
                 if (!pskb_may_pull(skb, len))
                         return -EINVAL;
 
-                grec = (void *)(skb->data + len);
+                grec = (void *)(skb->data + len - sizeof(*grec));
                 group = grec->grec_mca;
                 type = grec->grec_type;
 
-                len += grec->grec_nsrcs * 4;
+                len += ntohs(grec->grec_nsrcs) * 4;
                 if (!pskb_may_pull(skb, len))
                         return -EINVAL;
 
@@ -851,8 +852,8 @@ static int br_multicast_query(struct net_bridge *br,
                 if (ih3->nsrcs)
                         goto out;
 
-                max_delay = ih3->code ? 1 :
-                            IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE);
+                max_delay = ih3->code ?
+                            IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
         }
 
         if (!group)
@@ -956,9 +957,6 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         unsigned offset;
         int err;
 
-        BR_INPUT_SKB_CB(skb)->igmp = 0;
-        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
-
         /* We treat OOM as packet loss for now. */
         if (!pskb_may_pull(skb, sizeof(*iph)))
                 return -EINVAL;
@@ -990,7 +988,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
 
                 err = pskb_trim_rcsum(skb2, len);
                 if (err)
-                        return err;
+                        goto err_out;
         }
 
         len -= ip_hdrlen(skb2);
@@ -1012,7 +1010,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         case CHECKSUM_NONE:
                 skb2->csum = 0;
                 if (skb_checksum_complete(skb2))
-                        return -EINVAL;
+                        goto out;
         }
 
         err = 0;
@@ -1039,6 +1037,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
 
 out:
         __skb_push(skb2, offset);
+err_out:
         if (skb2 != skb)
                 kfree_skb(skb2);
         return err;
@@ -1047,6 +1046,9 @@ out:
 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
                      struct sk_buff *skb)
 {
+        BR_INPUT_SKB_CB(skb)->igmp = 0;
+        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
+
         if (br->multicast_disabled)
                 return 0;