]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
bridge: mcast snooping, fix length check of snooped MLDv1/2
authorLinus Lüssing <linus.luessing@web.de>
Sat, 26 Mar 2011 20:27:24 +0000 (20:27 +0000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 30 Mar 2011 09:28:20 +0000 (02:28 -0700)
commitff9a57a62afbbe2d0f3a09af321f1fd7645f38a5
tree74a3d7cf9a7b10ad042eccf6adacf30aae8c7c15
parentfd1d9188f2cb81fe63c789d9f5463dca402ade12
bridge: mcast snooping, fix length check of snooped MLDv1/2

"len = ntohs(ip6h->payload_len)" does not include the length of the ipv6
header itself, which the rest of this function assumes, though.

This leads to a length check less restrictive as it should be in the
following line for one thing. For another, it very likely leads to an
integer underrun when substracting the offset and therefore to a very
high new value of 'len' due to its unsignedness. This will ultimately
lead to the pskb_trim_rcsum() practically never being called, even in
the cases where it should.

Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/bridge/br_multicast.c