• Linus Lüssing's avatar
    bridge: mcast snooping, fix length check of snooped MLDv1/2 · ff9a57a6
    Linus Lüssing authored
    "len = ntohs(ip6h->payload_len)" does not include the length of the ipv6
    header itself, which the rest of this function assumes, though.
    
    This leads to a length check less restrictive as it should be in the
    following line for one thing. For another, it very likely leads to an
    integer underrun when substracting the offset and therefore to a very
    high new value of 'len' due to its unsignedness. This will ultimately
    lead to the pskb_trim_rcsum() practically never being called, even in
    the cases where it should.
    Signed-off-by: default avatarLinus Lüssing <linus.luessing@web.de>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    ff9a57a6
br_multicast.c 40.3 KB