Eric Dumazet 22df13319d bridge: fix a possible use after free ...

br_multicast_ipv6_rcv() can call pskb_trim_rcsum() and therefore skb
head can be reallocated.

Cache icmp6_type field instead of dereferencing twice the struct
icmp6hdr pointer.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2011-08-24 17:49:24 -07:00

41 KiB

Raw Blame History

View Raw