From patchwork Thu Dec 30 11:32:33 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Winkler, Tomas" X-Patchwork-Id: 440521 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id oBUMBEnC000490 for ; Thu, 30 Dec 2010 22:12:51 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751543Ab0L3Lcj (ORCPT ); Thu, 30 Dec 2010 06:32:39 -0500 Received: from mga03.intel.com ([143.182.124.21]:34488 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751121Ab0L3Lci (ORCPT ); Thu, 30 Dec 2010 06:32:38 -0500 Received: from azsmga001.ch.intel.com ([10.2.17.19]) by azsmga101.ch.intel.com with ESMTP; 30 Dec 2010 03:32:36 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.60,249,1291622400"; d="scan'208";a="368033814" Received: from jrlmcp01.jer.intel.com ([10.12.224.25]) by azsmga001.ch.intel.com with ESMTP; 30 Dec 2010 03:32:34 -0800 From: Tomas Winkler To: davem@davemloft.net Cc: netdev@vger.kernel.org, linux-wireless@vger.kernel.org, Tomas Winkler , Johannes Berg Subject: [PATCH net-2.6] bridge: fix br_multicast_ipv6_rcv for paged skbs Date: Thu, 30 Dec 2010 13:32:33 +0200 Message-Id: <1293708753-17728-1-git-send-email-tomas.winkler@intel.com> X-Mailer: git-send-email 1.7.3.4 In-Reply-To: References: Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter1.kernel.org [140.211.167.41]); Thu, 30 Dec 2010 22:12:51 +0000 (UTC) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index f19e347..074c478 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -1464,6 +1464,10 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br, if (offset < 0 || nexthdr != IPPROTO_ICMPV6) return 0; + if (!pskb_may_pull(skb, + (skb_network_header(skb) + offset + 1 - skb->data))) + return 0; + /* Okay, we found ICMPv6 header */ skb2 = skb_clone(skb, GFP_ATOMIC); if (!skb2)