diff --git a/[refs] b/[refs]
index 7f2aa08ffb26..0f80a4f587e6 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: fd1d9188f2cb81fe63c789d9f5463dca402ade12
+refs/heads/master: ff9a57a62afbbe2d0f3a09af321f1fd7645f38a5
diff --git a/trunk/net/bridge/br_multicast.c b/trunk/net/bridge/br_multicast.c
index f61eb2eff3fd..59660c909a7c 100644
--- a/trunk/net/bridge/br_multicast.c
+++ b/trunk/net/bridge/br_multicast.c
@@ -1475,7 +1475,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 	    ip6h->payload_len == 0)
 		return 0;
 
-	len = ntohs(ip6h->payload_len);
+	len = ntohs(ip6h->payload_len) + sizeof(*ip6h);
 	if (skb->len < len)
 		return -EINVAL;