bridge: mcast snooping, fix length check of snooped MLDv1/2

[cascardo/linux.git] / net / bridge / br_multicast.c

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index f61eb2e..59660c9 100644 (file)
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1475,7 +1475,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
            ip6h->payload_len == 0)
                return 0;
 
-       len = ntohs(ip6h->payload_len);
+       len = ntohs(ip6h->payload_len) + sizeof(*ip6h);
        if (skb->len < len)
                return -EINVAL;