| commit | af674335761a7ab9b015ec7e051ae232d5c0efab | [log] [tgz] |
|---|---|---|
| author | Eric Dumazet <eric.dumazet@gmail.com> | Tue Aug 23 19:57:05 2011 +0000 |
| committer | Greg Kroah-Hartman <gregkh@suse.de> | Mon Oct 03 11:40:56 2011 -0700 |
| tree | 54e6a8956a8fd62d31dffed1a79912187c75fb16 | |
| parent | 42270cd40ba8e0134cffd1c036a1aa3d844369a8 [diff] |
bridge: fix a possible use after free [ Upstream commit 22df13319d1fec30b8f9bcaadc295829647109bb ] br_multicast_ipv6_rcv() can call pskb_trim_rcsum() and therefore skb head can be reallocated. Cache icmp6_type field instead of dereferencing twice the struct icmp6hdr pointer. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>