bridge: mcast snooping, fix length check of snooped MLDv1/2

[cascardo/linux.git] / net / bridge / br_multicast.c

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 030a002..59660c9 100644 (file)
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -445,9 +445,9 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
        ip6h->payload_len = htons(8 + sizeof(*mldq));
        ip6h->nexthdr = IPPROTO_HOPOPTS;
        ip6h->hop_limit = 1;
+       ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
        ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
                           &ip6h->saddr);
-       ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
        ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
        hopopt = (u8 *)(ip6h + 1);
@@ -1475,7 +1475,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
            ip6h->payload_len == 0)
                return 0;
 
-       len = ntohs(ip6h->payload_len);
+       len = ntohs(ip6h->payload_len) + sizeof(*ip6h);
        if (skb->len < len)
                return -EINVAL;