diff mbox series

[net-next,v2,04/15] net: bridge: mcast: add support for group-and-source specific queries

Message ID 20200902112529.1570040-5-nikolay@cumulusnetworks.com
State New
Headers show
Series net: bridge: mcast: initial IGMPv3 support (part 1) | expand

Commit Message

Nikolay Aleksandrov Sept. 2, 2020, 11:25 a.m. UTC 
Allows br_ip4_multicast_alloc_query to build queries with the port group's
source lists and sends a query for sources over and under lmqt when
necessary as per RFC 3376 with the suppress flag set appropriately.

Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
---
 net/bridge/br_multicast.c | 126 +++++++++++++++++++++++++++++---------
 net/bridge/br_private.h   |   1 +
 2 files changed, 99 insertions(+), 28 deletions(-)

Comments

Dan Carpenter Sept. 3, 2020, 12:18 p.m. UTC | #1 
Hi Nikolay,

url:    https://github.com/0day-ci/linux/commits/Nikolay-Aleksandrov/net-bridge-mcast-initial-IGMPv3-support-part-1/20200902-193339
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git dc1a9bf2c8169d9f607502162af1858a73a18cb8
config: i386-randconfig-m021-20200902 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

New smatch warnings:
net/bridge/br_multicast.c:359 br_ip4_multicast_alloc_query() error: use kfree_skb() here instead of kfree(skb)

Old smatch warnings:
net/bridge/br_multicast.c:711 br_multicast_add_group() error: potential null dereference 'mp'.  (br_multicast_new_group returns null)

# https://github.com/0day-ci/linux/commit/6ed1da60b015f4e607ee2dcaaf557306a1bd3b57
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Nikolay-Aleksandrov/net-bridge-mcast-initial-IGMPv3-support-part-1/20200902-193339
git checkout 6ed1da60b015f4e607ee2dcaaf557306a1bd3b57
vim +359 net/bridge/br_multicast.c

8ef2a9a5985499 YOSHIFUJI Hideaki   2010-04-18  230  static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  231  						    struct net_bridge_port_group *pg,
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  232  						    __be32 ip_dst, __be32 group,
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  233  						    bool with_srcs, bool over_lmqt,
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  234  						    u8 sflag, u8 *igmp_type)
eb1d16414339a6 Herbert Xu          2010-02-27  235  {
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  236  	struct net_bridge_port *p = pg ? pg->port : NULL;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  237  	struct net_bridge_group_src *ent;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  238  	size_t pkt_size, igmp_hdr_size;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  239  	unsigned long now = jiffies;
5e9235853d652a Nikolay Aleksandrov 2016-11-21  240  	struct igmpv3_query *ihv3;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  241  	void *csum_start = NULL;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  242  	__sum16 *csum = NULL;
eb1d16414339a6 Herbert Xu          2010-02-27  243  	struct sk_buff *skb;
eb1d16414339a6 Herbert Xu          2010-02-27  244  	struct igmphdr *ih;
eb1d16414339a6 Herbert Xu          2010-02-27  245  	struct ethhdr *eth;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  246  	unsigned long lmqt;
eb1d16414339a6 Herbert Xu          2010-02-27  247  	struct iphdr *iph;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  248  	u16 lmqt_srcs = 0;
eb1d16414339a6 Herbert Xu          2010-02-27  249  
5e9235853d652a Nikolay Aleksandrov 2016-11-21  250  	igmp_hdr_size = sizeof(*ih);
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  251  	if (br->multicast_igmp_version == 3) {
5e9235853d652a Nikolay Aleksandrov 2016-11-21  252  		igmp_hdr_size = sizeof(*ihv3);
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  253  		if (pg && with_srcs) {
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  254  			lmqt = now + (br->multicast_last_member_interval *
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  255  				      br->multicast_last_member_count);
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  256  			hlist_for_each_entry(ent, &pg->src_list, node) {
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  257  				if (over_lmqt == time_after(ent->timer.expires,
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  258  							    lmqt) &&
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  259  				    ent->src_query_rexmit_cnt > 0)
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  260  					lmqt_srcs++;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  261  			}
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  262  
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  263  			if (!lmqt_srcs)
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  264  				return NULL;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  265  			igmp_hdr_size += lmqt_srcs * sizeof(__be32);
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  266  		}
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  267  	}
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  268  
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  269  	pkt_size = sizeof(*eth) + sizeof(*iph) + 4 + igmp_hdr_size;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  270  	if ((p && pkt_size > p->dev->mtu) ||
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  271  	    pkt_size > br->dev->mtu)
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  272  		return NULL;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  273  
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  274  	skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
                                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

eb1d16414339a6 Herbert Xu          2010-02-27  275  	if (!skb)
eb1d16414339a6 Herbert Xu          2010-02-27  276  		goto out;
eb1d16414339a6 Herbert Xu          2010-02-27  277  
eb1d16414339a6 Herbert Xu          2010-02-27  278  	skb->protocol = htons(ETH_P_IP);
eb1d16414339a6 Herbert Xu          2010-02-27  279  
eb1d16414339a6 Herbert Xu          2010-02-27  280  	skb_reset_mac_header(skb);
eb1d16414339a6 Herbert Xu          2010-02-27  281  	eth = eth_hdr(skb);
eb1d16414339a6 Herbert Xu          2010-02-27  282  
e5a727f6632654 Joe Perches         2014-02-23  283  	ether_addr_copy(eth->h_source, br->dev->dev_addr);
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  284  	ip_eth_mc_map(ip_dst, eth->h_dest);
eb1d16414339a6 Herbert Xu          2010-02-27  285  	eth->h_proto = htons(ETH_P_IP);
eb1d16414339a6 Herbert Xu          2010-02-27  286  	skb_put(skb, sizeof(*eth));
eb1d16414339a6 Herbert Xu          2010-02-27  287  
eb1d16414339a6 Herbert Xu          2010-02-27  288  	skb_set_network_header(skb, skb->len);
eb1d16414339a6 Herbert Xu          2010-02-27  289  	iph = ip_hdr(skb);
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  290  	iph->tot_len = htons(pkt_size - sizeof(*eth));
eb1d16414339a6 Herbert Xu          2010-02-27  291  
eb1d16414339a6 Herbert Xu          2010-02-27  292  	iph->version = 4;
eb1d16414339a6 Herbert Xu          2010-02-27  293  	iph->ihl = 6;
eb1d16414339a6 Herbert Xu          2010-02-27  294  	iph->tos = 0xc0;
eb1d16414339a6 Herbert Xu          2010-02-27  295  	iph->id = 0;
eb1d16414339a6 Herbert Xu          2010-02-27  296  	iph->frag_off = htons(IP_DF);
eb1d16414339a6 Herbert Xu          2010-02-27  297  	iph->ttl = 1;
eb1d16414339a6 Herbert Xu          2010-02-27  298  	iph->protocol = IPPROTO_IGMP;
675779adbf7c80 Nikolay Aleksandrov 2018-09-26  299  	iph->saddr = br_opt_get(br, BROPT_MULTICAST_QUERY_USE_IFADDR) ?
1c8ad5bfa2be50 Cong Wang           2013-05-21  300  		     inet_select_addr(br->dev, 0, RT_SCOPE_LINK) : 0;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  301  	iph->daddr = ip_dst;
eb1d16414339a6 Herbert Xu          2010-02-27  302  	((u8 *)&iph[1])[0] = IPOPT_RA;
eb1d16414339a6 Herbert Xu          2010-02-27  303  	((u8 *)&iph[1])[1] = 4;
eb1d16414339a6 Herbert Xu          2010-02-27  304  	((u8 *)&iph[1])[2] = 0;
eb1d16414339a6 Herbert Xu          2010-02-27  305  	((u8 *)&iph[1])[3] = 0;
eb1d16414339a6 Herbert Xu          2010-02-27  306  	ip_send_check(iph);
eb1d16414339a6 Herbert Xu          2010-02-27  307  	skb_put(skb, 24);
eb1d16414339a6 Herbert Xu          2010-02-27  308  
eb1d16414339a6 Herbert Xu          2010-02-27  309  	skb_set_transport_header(skb, skb->len);
1080ab95e3c7bd Nikolay Aleksandrov 2016-06-28  310  	*igmp_type = IGMP_HOST_MEMBERSHIP_QUERY;
5e9235853d652a Nikolay Aleksandrov 2016-11-21  311  
5e9235853d652a Nikolay Aleksandrov 2016-11-21  312  	switch (br->multicast_igmp_version) {
5e9235853d652a Nikolay Aleksandrov 2016-11-21  313  	case 2:
5e9235853d652a Nikolay Aleksandrov 2016-11-21  314  		ih = igmp_hdr(skb);
eb1d16414339a6 Herbert Xu          2010-02-27  315  		ih->type = IGMP_HOST_MEMBERSHIP_QUERY;
eb1d16414339a6 Herbert Xu          2010-02-27  316  		ih->code = (group ? br->multicast_last_member_interval :
eb1d16414339a6 Herbert Xu          2010-02-27  317  				    br->multicast_query_response_interval) /
eb1d16414339a6 Herbert Xu          2010-02-27  318  			   (HZ / IGMP_TIMER_SCALE);
eb1d16414339a6 Herbert Xu          2010-02-27  319  		ih->group = group;
eb1d16414339a6 Herbert Xu          2010-02-27  320  		ih->csum = 0;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  321  		csum = &ih->csum;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  322  		csum_start = (void *)ih;
5e9235853d652a Nikolay Aleksandrov 2016-11-21  323  		break;
5e9235853d652a Nikolay Aleksandrov 2016-11-21  324  	case 3:
5e9235853d652a Nikolay Aleksandrov 2016-11-21  325  		ihv3 = igmpv3_query_hdr(skb);
5e9235853d652a Nikolay Aleksandrov 2016-11-21  326  		ihv3->type = IGMP_HOST_MEMBERSHIP_QUERY;
5e9235853d652a Nikolay Aleksandrov 2016-11-21  327  		ihv3->code = (group ? br->multicast_last_member_interval :
5e9235853d652a Nikolay Aleksandrov 2016-11-21  328  				      br->multicast_query_response_interval) /
5e9235853d652a Nikolay Aleksandrov 2016-11-21  329  			     (HZ / IGMP_TIMER_SCALE);
5e9235853d652a Nikolay Aleksandrov 2016-11-21  330  		ihv3->group = group;
5e9235853d652a Nikolay Aleksandrov 2016-11-21  331  		ihv3->qqic = br->multicast_query_interval / HZ;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  332  		ihv3->nsrcs = htons(lmqt_srcs);
5e9235853d652a Nikolay Aleksandrov 2016-11-21  333  		ihv3->resv = 0;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  334  		ihv3->suppress = sflag;
5e9235853d652a Nikolay Aleksandrov 2016-11-21  335  		ihv3->qrv = 2;
5e9235853d652a Nikolay Aleksandrov 2016-11-21  336  		ihv3->csum = 0;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  337  		csum = &ihv3->csum;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  338  		csum_start = (void *)ihv3;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  339  		if (!pg || !with_srcs)
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  340  			break;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  341  
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  342  		lmqt_srcs = 0;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  343  		hlist_for_each_entry(ent, &pg->src_list, node) {
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  344  			if (over_lmqt == time_after(ent->timer.expires,
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  345  						    lmqt) &&
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  346  			    ent->src_query_rexmit_cnt > 0) {
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  347  				ihv3->srcs[lmqt_srcs++] = ent->addr.u.ip4;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  348  				ent->src_query_rexmit_cnt--;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  349  			}
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  350  		}
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  351  		if (WARN_ON(lmqt_srcs != ntohs(ihv3->nsrcs))) {
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  352  			kfree_skb(skb);
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  353  			return NULL;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  354  		}
5e9235853d652a Nikolay Aleksandrov 2016-11-21  355  		break;
5e9235853d652a Nikolay Aleksandrov 2016-11-21  356  	}
eb1d16414339a6 Herbert Xu          2010-02-27  357  
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  358  	if (WARN_ON(!csum || !csum_start)) {
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02 @359  		kfree(skb);

This should be kfree_skb(skb);

6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  360  		return NULL;
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  361  	}
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  362  
6ed1da60b015f4 Nikolay Aleksandrov 2020-09-02  363  	*csum = ip_compute_csum(csum_start, igmp_hdr_size);
5e9235853d652a Nikolay Aleksandrov 2016-11-21  364  	skb_put(skb, igmp_hdr_size);
eb1d16414339a6 Herbert Xu          2010-02-27  365  	__skb_pull(skb, sizeof(*eth));
eb1d16414339a6 Herbert Xu          2010-02-27  366  
eb1d16414339a6 Herbert Xu          2010-02-27  367  out:
eb1d16414339a6 Herbert Xu          2010-02-27  368  	return skb;
eb1d16414339a6 Herbert Xu          2010-02-27  369  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
diff mbox series

Patch

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 9269d62884e5..8a415672764a 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -228,21 +228,50 @@  static void br_multicast_port_group_expired(struct timer_list *t)
 }
 
 static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
-						    __be32 group,
-						    u8 *igmp_type)
+						    struct net_bridge_port_group *pg,
+						    __be32 ip_dst, __be32 group,
+						    bool with_srcs, bool over_lmqt,
+						    u8 sflag, u8 *igmp_type)
 {
+	struct net_bridge_port *p = pg ? pg->port : NULL;
+	struct net_bridge_group_src *ent;
+	size_t pkt_size, igmp_hdr_size;
+	unsigned long now = jiffies;
 	struct igmpv3_query *ihv3;
-	size_t igmp_hdr_size;
+	void *csum_start = NULL;
+	__sum16 *csum = NULL;
 	struct sk_buff *skb;
 	struct igmphdr *ih;
 	struct ethhdr *eth;
+	unsigned long lmqt;
 	struct iphdr *iph;
+	u16 lmqt_srcs = 0;
 
 	igmp_hdr_size = sizeof(*ih);
-	if (br->multicast_igmp_version == 3)
+	if (br->multicast_igmp_version == 3) {
 		igmp_hdr_size = sizeof(*ihv3);
-	skb = netdev_alloc_skb_ip_align(br->dev, sizeof(*eth) + sizeof(*iph) +
-						 igmp_hdr_size + 4);
+		if (pg && with_srcs) {
+			lmqt = now + (br->multicast_last_member_interval *
+				      br->multicast_last_member_count);
+			hlist_for_each_entry(ent, &pg->src_list, node) {
+				if (over_lmqt == time_after(ent->timer.expires,
+							    lmqt) &&
+				    ent->src_query_rexmit_cnt > 0)
+					lmqt_srcs++;
+			}
+
+			if (!lmqt_srcs)
+				return NULL;
+			igmp_hdr_size += lmqt_srcs * sizeof(__be32);
+		}
+	}
+
+	pkt_size = sizeof(*eth) + sizeof(*iph) + 4 + igmp_hdr_size;
+	if ((p && pkt_size > p->dev->mtu) ||
+	    pkt_size > br->dev->mtu)
+		return NULL;
+
+	skb = netdev_alloc_skb_ip_align(br->dev, pkt_size);
 	if (!skb)
 		goto out;
 
@@ -252,29 +281,24 @@  static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
 	eth = eth_hdr(skb);
 
 	ether_addr_copy(eth->h_source, br->dev->dev_addr);
-	eth->h_dest[0] = 1;
-	eth->h_dest[1] = 0;
-	eth->h_dest[2] = 0x5e;
-	eth->h_dest[3] = 0;
-	eth->h_dest[4] = 0;
-	eth->h_dest[5] = 1;
+	ip_eth_mc_map(ip_dst, eth->h_dest);
 	eth->h_proto = htons(ETH_P_IP);
 	skb_put(skb, sizeof(*eth));
 
 	skb_set_network_header(skb, skb->len);
 	iph = ip_hdr(skb);
+	iph->tot_len = htons(pkt_size - sizeof(*eth));
 
 	iph->version = 4;
 	iph->ihl = 6;
 	iph->tos = 0xc0;
-	iph->tot_len = htons(sizeof(*iph) + igmp_hdr_size + 4);
 	iph->id = 0;
 	iph->frag_off = htons(IP_DF);
 	iph->ttl = 1;
 	iph->protocol = IPPROTO_IGMP;
 	iph->saddr = br_opt_get(br, BROPT_MULTICAST_QUERY_USE_IFADDR) ?
 		     inet_select_addr(br->dev, 0, RT_SCOPE_LINK) : 0;
-	iph->daddr = htonl(INADDR_ALLHOSTS_GROUP);
+	iph->daddr = ip_dst;
 	((u8 *)&iph[1])[0] = IPOPT_RA;
 	((u8 *)&iph[1])[1] = 4;
 	((u8 *)&iph[1])[2] = 0;
@@ -294,7 +318,8 @@  static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
 			   (HZ / IGMP_TIMER_SCALE);
 		ih->group = group;
 		ih->csum = 0;
-		ih->csum = ip_compute_csum((void *)ih, sizeof(*ih));
+		csum = &ih->csum;
+		csum_start = (void *)ih;
 		break;
 	case 3:
 		ihv3 = igmpv3_query_hdr(skb);
@@ -304,15 +329,38 @@  static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
 			     (HZ / IGMP_TIMER_SCALE);
 		ihv3->group = group;
 		ihv3->qqic = br->multicast_query_interval / HZ;
-		ihv3->nsrcs = 0;
+		ihv3->nsrcs = htons(lmqt_srcs);
 		ihv3->resv = 0;
-		ihv3->suppress = 0;
+		ihv3->suppress = sflag;
 		ihv3->qrv = 2;
 		ihv3->csum = 0;
-		ihv3->csum = ip_compute_csum((void *)ihv3, sizeof(*ihv3));
+		csum = &ihv3->csum;
+		csum_start = (void *)ihv3;
+		if (!pg || !with_srcs)
+			break;
+
+		lmqt_srcs = 0;
+		hlist_for_each_entry(ent, &pg->src_list, node) {
+			if (over_lmqt == time_after(ent->timer.expires,
+						    lmqt) &&
+			    ent->src_query_rexmit_cnt > 0) {
+				ihv3->srcs[lmqt_srcs++] = ent->addr.u.ip4;
+				ent->src_query_rexmit_cnt--;
+			}
+		}
+		if (WARN_ON(lmqt_srcs != ntohs(ihv3->nsrcs))) {
+			kfree_skb(skb);
+			return NULL;
+		}
 		break;
 	}
 
+	if (WARN_ON(!csum || !csum_start)) {
+		kfree(skb);
+		return NULL;
+	}
+
+	*csum = ip_compute_csum(csum_start, igmp_hdr_size);
 	skb_put(skb, igmp_hdr_size);
 	__skb_pull(skb, sizeof(*eth));
 
@@ -435,15 +483,24 @@  static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
 #endif
 
 static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
-						struct br_ip *addr,
-						u8 *igmp_type)
+						struct net_bridge_port_group *pg,
+						struct br_ip *ip_dst,
+						struct br_ip *group,
+						bool with_srcs, bool over_lmqt,
+						u8 sflag, u8 *igmp_type)
 {
-	switch (addr->proto) {
+	__be32 ip4_dst;
+
+	switch (group->proto) {
 	case htons(ETH_P_IP):
-		return br_ip4_multicast_alloc_query(br, addr->u.ip4, igmp_type);
+		ip4_dst = ip_dst ? ip_dst->u.ip4 : htonl(INADDR_ALLHOSTS_GROUP);
+		return br_ip4_multicast_alloc_query(br, pg,
+						    ip4_dst, group->u.ip4,
+						    with_srcs, over_lmqt,
+						    sflag, igmp_type);
 #if IS_ENABLED(CONFIG_IPV6)
 	case htons(ETH_P_IPV6):
-		return br_ip6_multicast_alloc_query(br, &addr->u.ip6,
+		return br_ip6_multicast_alloc_query(br, &group->u.ip6,
 						    igmp_type);
 #endif
 	}
@@ -808,12 +865,19 @@  static void br_multicast_select_own_querier(struct net_bridge *br,
 
 static void __br_multicast_send_query(struct net_bridge *br,
 				      struct net_bridge_port *port,
-				      struct br_ip *ip)
+				      struct net_bridge_port_group *pg,
+				      struct br_ip *ip_dst,
+				      struct br_ip *group,
+				      bool with_srcs,
+				      u8 sflag)
 {
+	bool over_lmqt = !!sflag;
 	struct sk_buff *skb;
 	u8 igmp_type;
 
-	skb = br_multicast_alloc_query(br, ip, &igmp_type);
+again_under_lmqt:
+	skb = br_multicast_alloc_query(br, pg, ip_dst, group, with_srcs,
+				       over_lmqt, sflag, &igmp_type);
 	if (!skb)
 		return;
 
@@ -824,8 +888,13 @@  static void __br_multicast_send_query(struct net_bridge *br,
 		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
 			dev_net(port->dev), NULL, skb, NULL, skb->dev,
 			br_dev_queue_push_xmit);
+
+		if (over_lmqt && with_srcs && sflag) {
+			over_lmqt = false;
+			goto again_under_lmqt;
+		}
 	} else {
-		br_multicast_select_own_querier(br, ip, skb);
+		br_multicast_select_own_querier(br, group, skb);
 		br_multicast_count(br, port, skb, igmp_type,
 				   BR_MCAST_DIR_RX);
 		netif_rx(skb);
@@ -861,7 +930,7 @@  static void br_multicast_send_query(struct net_bridge *br,
 	if (!other_query || timer_pending(&other_query->timer))
 		return;
 
-	__br_multicast_send_query(br, port, &br_group);
+	__br_multicast_send_query(br, port, NULL, NULL, &br_group, false, 0);
 
 	time = jiffies;
 	time += own_query->startup_sent < br->multicast_startup_query_count ?
@@ -1522,7 +1591,8 @@  br_multicast_leave_group(struct net_bridge *br,
 		goto out;
 
 	if (br_opt_get(br, BROPT_MULTICAST_QUERIER)) {
-		__br_multicast_send_query(br, port, &mp->addr);
+		__br_multicast_send_query(br, port, NULL, NULL, &mp->addr,
+					  false, 0);
 
 		time = jiffies + br->multicast_last_member_count *
 				 br->multicast_last_member_interval;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 311ad0e402dc..87610d6c0b3f 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -225,6 +225,7 @@  struct net_bridge_group_src {
 	struct br_ip			addr;
 	struct net_bridge_port_group	*pg;
 	u8				flags;
+	u8				src_query_rexmit_cnt;
 	struct timer_list		timer;
 
 	struct net_bridge		*br;