From 8d40c35d5e53732fa2265d5460457ee3c4872ad0 Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@redhat.com>
Date: Mon, 22 Jul 2013 14:55:50 -0400
Subject: [PATCH] Fix timer issue in bridge code (rhbz 980254)

---
 ...-not-call-setup_timer-multiple-times.patch | 50 +++++++++++++++++++
 kernel.spec                                   |  9 ++++
 2 files changed, 59 insertions(+)
 create mode 100644 bridge-do-not-call-setup_timer-multiple-times.patch

diff --git a/bridge-do-not-call-setup_timer-multiple-times.patch b/bridge-do-not-call-setup_timer-multiple-times.patch
new file mode 100644
index 000000000..c8c7bf747
--- /dev/null
+++ b/bridge-do-not-call-setup_timer-multiple-times.patch
@@ -0,0 +1,50 @@
+From 1faabf2aab1fdaa1ace4e8c829d1b9cf7bfec2f1 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 20 Jul 2013 03:07:16 +0000
+Subject: bridge: do not call setup_timer() multiple times
+
+commit 9f00b2e7cf24 ("bridge: only expire the mdb entry when query is
+received") added a nasty bug as an active timer can be reinitialized.
+
+setup_timer() must be done once, no matter how many time mod_timer()
+is called. br_multicast_new_group() is the right place to do this.
+
+Reported-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Diagnosed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Tested-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Cc: Cong Wang <amwang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 69af490..4b99c9a 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -619,6 +619,9 @@ rehash:
+ 	mp->br = br;
+ 	mp->addr = *group;
+ 
++	setup_timer(&mp->timer, br_multicast_group_expired,
++		    (unsigned long)mp);
++
+ 	hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
+ 	mdb->size++;
+ 
+@@ -1126,7 +1129,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
+ 	if (!mp)
+ 		goto out;
+ 
+-	setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
+ 	mod_timer(&mp->timer, now + br->multicast_membership_interval);
+ 	mp->timer_armed = true;
+ 
+@@ -1204,7 +1206,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
+ 	if (!mp)
+ 		goto out;
+ 
+-	setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
+ 	mod_timer(&mp->timer, now + br->multicast_membership_interval);
+ 	mp->timer_armed = true;
+ 
+--
+cgit v0.9.2
diff --git a/kernel.spec b/kernel.spec
index 29bc1b78a..55476e548 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -737,6 +737,9 @@ Patch25032: cve-2013-2147-ciss-info-leak.patch
 
 Patch25047: drm-radeon-Disable-writeback-by-default-on-ppc.patch
 
+#rhbz 980254
+Patch25066: bridge-do-not-call-setup_timer-multiple-times.patch
+
 #rhbz 977558
 Patch25055: ath3k-dont-use-stack-memory-for-DMA.patch
 
@@ -1434,6 +1437,9 @@ ApplyPatch cve-2013-2147-ciss-info-leak.patch
 
 ApplyPatch drm-radeon-Disable-writeback-by-default-on-ppc.patch
 
+#rhbz 980254
+ApplyPatch bridge-do-not-call-setup_timer-multiple-times.patch
+
 #rhbz 977558
 ApplyPatch ath3k-dont-use-stack-memory-for-DMA.patch
 
@@ -2240,6 +2246,9 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Mon Jul 22 2013 Josh Boyer <jwboyer@redhat.com>
+- Fix timer issue in bridge code (rhbz 980254)
+
 * Mon Jul 22 2013 Justin M. Forbes <jforbes@redhat.com> - 3.11.0-0.rc2.git0.1
 - Linux v3.11-rc2
 - Disable debugging options.