Commit aee70930 authored by Bart De Schuymer's avatar Bart De Schuymer Committed by David S. Miller

[BRIDGE NETFILTER]: Fix leaks and crashes in SKB handling.

- Missing nf bridge info put in ip_copy_metadata()
- Do not store nf bridge private info in the SKB control block,
  parts of IPv4 use that area too and this causes corruption.
parent 0e70f996
......@@ -73,11 +73,11 @@ void nf_bridge_maybe_copy_header(struct sk_buff *skb)
if (skb->nf_bridge) {
#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
memcpy(skb->data - 18, skb->nf_bridge->hh, 18);
memcpy(skb->data - 18, skb->nf_bridge->data, 18);
skb_push(skb, 4);
} else
#endif
memcpy(skb->data - 16, skb->nf_bridge->hh, 16);
memcpy(skb->data - 16, skb->nf_bridge->data, 16);
}
}
......@@ -90,7 +90,7 @@ void nf_bridge_save_header(struct sk_buff *skb)
if (skb->protocol == __constant_htons(ETH_P_8021Q))
header_size = 18;
#endif
memcpy(skb->nf_bridge->hh, skb->data - header_size, header_size);
memcpy(skb->nf_bridge->data, skb->data - header_size, header_size);
}
struct bridge_skb_cb {
......
......@@ -107,7 +107,7 @@ struct nf_bridge_info {
struct net_device *netoutdev;
#endif
unsigned int mask;
unsigned long hh[32 / sizeof(unsigned long)];
unsigned long data[32 / sizeof(unsigned long)];
};
#endif
......
......@@ -38,11 +38,9 @@
#define skb_origaddr(skb) (((struct bridge_skb_cb *) \
(skb->cb))->daddr.ipv4)
(skb->nf_bridge->data))->daddr.ipv4)
#define store_orig_dstaddr(skb) (skb_origaddr(skb) = (skb)->nh.iph->daddr)
#define dnat_took_place(skb) (skb_origaddr(skb) != (skb)->nh.iph->daddr)
#define clear_cb(skb) (memset(&skb_origaddr(skb), 0, \
sizeof(struct bridge_skb_cb)))
#define has_bridge_parent(device) ((device)->br_port != NULL)
#define bridge_parent(device) ((device)->br_port->br->dev)
......@@ -203,7 +201,6 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb)
*/
nf_bridge->mask |= BRNF_BRIDGED_DNAT;
skb->dev = nf_bridge->physindev;
clear_cb(skb);
if (skb->protocol ==
__constant_htons(ETH_P_8021Q)) {
skb_push(skb, VLAN_HLEN);
......@@ -224,7 +221,6 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb)
dst_hold(skb->dst);
}
clear_cb(skb);
skb->dev = nf_bridge->physindev;
if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
skb_push(skb, VLAN_HLEN);
......
......@@ -417,6 +417,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
to->nfct = from->nfct;
nf_conntrack_get(to->nfct);
#ifdef CONFIG_BRIDGE_NETFILTER
nf_bridge_put(to->nf_bridge);
to->nf_bridge = from->nf_bridge;
nf_bridge_get(to->nf_bridge);
#endif
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment