Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...

[mv-sheeva.git] / net / bridge / br_multicast.c

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 6980625537caa15e5f0a479eccca15c3341073a3..eaa0e1bae49bcf28dff4f10e648dbd5ee418554f 100644 (file)
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -723,11 +723,11 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
                if (!pskb_may_pull(skb, len))
                        return -EINVAL;
 
-               grec = (void *)(skb->data + len);
+               grec = (void *)(skb->data + len - sizeof(*grec));
                group = grec->grec_mca;
                type = grec->grec_type;
 
-               len += grec->grec_nsrcs * 4;
+               len += ntohs(grec->grec_nsrcs) * 4;
                if (!pskb_may_pull(skb, len))
                        return -EINVAL;
 
@@ -957,9 +957,6 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
        unsigned offset;
        int err;
 
-       BR_INPUT_SKB_CB(skb)->igmp = 0;
-       BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
-
        /* We treat OOM as packet loss for now. */
        if (!pskb_may_pull(skb, sizeof(*iph)))
                return -EINVAL;
@@ -1049,6 +1046,9 @@ err_out:
 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
                     struct sk_buff *skb)
 {
+       BR_INPUT_SKB_CB(skb)->igmp = 0;
+       BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
+
        if (br->multicast_disabled)
                return 0;