1 files changed, 7 insertions, 10 deletions

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index d8e36b775125..43a0b35dfe6f 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -295,7 +295,7 @@ static int check_hbh_len(struct sk_buff *skb)
         len -= 2;
 
         while (len > 0) {
-                int optlen = raw[off+1]+2;
+                int optlen = skb->nh.raw[off+1]+2;
 
                 switch (skb->nh.raw[off]) {
                 case IPV6_TLV_PAD0:
@@ -308,18 +308,15 @@ static int check_hbh_len(struct sk_buff *skb)
                 case IPV6_TLV_JUMBO:
                         if (skb->nh.raw[off+1] != 4 || (off&3) != 2)
                                 goto bad;
-
                         pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2));
-
+                        if (pkt_len <= IPV6_MAXPLEN ||
+                            skb->nh.ipv6h->payload_len)
+                                goto bad;
                         if (pkt_len > skb->len - sizeof(struct ipv6hdr))
                                 goto bad;
-                        if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
-                                if (__pskb_trim(skb,
-                                    pkt_len + sizeof(struct ipv6hdr)))
-                                        goto bad;
-                                if (skb->ip_summed == CHECKSUM_HW)
-                                        skb->ip_summed = CHECKSUM_NONE;
-                        }
+                        if (pskb_trim_rcsum(skb,
+                            pkt_len+sizeof(struct ipv6hdr)))
+                                goto bad;
                         break;
                 default:
                         if (optlen > len)