summaryrefslogtreecommitdiffstats
path: root/net/bridge
diff options
context:
space:
mode:
authorLinus Lüssing <linus.luessing@web.de>2013-08-06 00:32:05 +0200
committerDavid S. Miller <davem@davemloft.net>2013-08-06 00:43:39 +0200
commit248ba8ec05a2c3b118c2224e57eb10c128176ab1 (patch)
treec7349bfefa0cef9cbb43b381ae369261035a2e1e /net/bridge
parentfib_trie: remove potential out of bound access (diff)
downloadlinux-248ba8ec05a2c3b118c2224e57eb10c128176ab1.tar.xz
linux-248ba8ec05a2c3b118c2224e57eb10c128176ab1.zip
bridge: don't try to update timers in case of broken MLD queries
Currently we are reading an uninitialized value for the max_delay variable when snooping an MLD query message of invalid length and would update our timers with that. Fixing this by simply ignoring such broken MLD queries (just like we do for IGMP already). This is a regression introduced by: "bridge: disable snooping if there is no querier" (b00589af3b04) Reported-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: Linus Lüssing <linus.luessing@web.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge')
-rw-r--r--net/bridge/br_multicast.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 61c5e819380e..08e576ada0b2 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1195,7 +1195,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
if (max_delay)
group = &mld->mld_mca;
- } else if (skb->len >= sizeof(*mld2q)) {
+ } else {
if (!pskb_may_pull(skb, sizeof(*mld2q))) {
err = -EINVAL;
goto out;