diff options
| author | Linus Lüssing <linus.luessing@web.de> | 2011-03-26 21:27:24 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-03-30 11:28:20 +0200 |
| commit | ff9a57a62afbbe2d0f3a09af321f1fd7645f38a5 (patch) | |
| tree | 74a3d7cf9a7b10ad042eccf6adacf30aae8c7c15 /net/bridge | |
| parent | via-ircc: Pass PCI device pointer to dma_{alloc, free}_coherent() (diff) | |
| download | linux-ff9a57a62afbbe2d0f3a09af321f1fd7645f38a5.tar.xz linux-ff9a57a62afbbe2d0f3a09af321f1fd7645f38a5.zip | |
bridge: mcast snooping, fix length check of snooped MLDv1/2
"len = ntohs(ip6h->payload_len)" does not include the length of the ipv6
header itself, which the rest of this function assumes, though.
This leads to a length check less restrictive as it should be in the
following line for one thing. For another, it very likely leads to an
integer underrun when substracting the offset and therefore to a very
high new value of 'len' due to its unsignedness. This will ultimately
lead to the pskb_trim_rcsum() practically never being called, even in
the cases where it should.
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge')
| -rw-r--r-- | net/bridge/br_multicast.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index f61eb2eff3fd..59660c909a7c 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -1475,7 +1475,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br, ip6h->payload_len == 0) return 0; - len = ntohs(ip6h->payload_len); + len = ntohs(ip6h->payload_len) + sizeof(*ip6h); if (skb->len < len) return -EINVAL; |