Patch "bridge: fix br_multicast_query_expired() bug" has been added to the 4.0-stable tree

[<gregkh@linuxfoundation.org>]

This is a note to let you know that I've just added the patch titled

    bridge: fix br_multicast_query_expired() bug

to the 4.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bridge-fix-br_multicast_query_expired-bug.patch
and it can be found in the queue-4.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From foo@baz Sat Jun 13 09:48:35 PDT 2015
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 28 May 2015 04:42:54 -0700
Subject: bridge: fix br_multicast_query_expired() bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 71d9f6149cac8fc6646adfb2a6f3b0de6ddd23f6 ]

br_multicast_query_expired() querier argument is a pointer to
a struct bridge_mcast_querier :

struct bridge_mcast_querier {
        struct br_ip addr;
        struct net_bridge_port __rcu    *port;
};

Intent of the code was to clear port field, not the pointer to querier.

Fixes: 2cd4143192e8 ("bridge: memorize and export selected IGMP/MLD querier port")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
Acked-by: Linus Lüssing <linus.luessing@c0d3.blue>
Cc: Linus Lüssing <linus.luessing@web.de>
Cc: Steinar H. Gunderson <sesse@samfundet.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_multicast.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1821,7 +1821,7 @@ static void br_multicast_query_expired(s
 	if (query->startup_sent < br->multicast_startup_query_count)
 		query->startup_sent++;
 
-	RCU_INIT_POINTER(querier, NULL);
+	RCU_INIT_POINTER(querier->port, NULL);
 	br_multicast_send_query(br, NULL, query);
 	spin_unlock(&br->multicast_lock);
 }


Patches currently in stable-queue which might be from edumazet@google.com are

queue-4.0/net_sched-invoke-attach-after-setting-dev-qdisc.patch
queue-4.0/udp-fix-behavior-of-wrong-checksums.patch
queue-4.0/net-ipv6-udp-fix-ipv6-multicast-socket-filter-regression.patch
queue-4.0/tcp-ipv6-fix-flow-label-setting-in-time_wait-state.patch
queue-4.0/bridge-fix-br_multicast_query_expired-bug.patch
queue-4.0/net-sched-fix-call_rcu-race-on-classifier-module-unloads.patch
queue-4.0/ipv4-avoid-crashing-in-ip_error.patch
queue-4.0/tcp-fix-child-sockets-to-use-system-default-congestion-control-if-not-set.patch