Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79cac2a2 authored by David Kimdon's avatar David Kimdon Committed by David S. Miller
Browse files

[BR_NETFILTER]: Fix leak if skb traverses > 1 bridge 



Call nf_bridge_put() before allocating a new nf_bridge structure and
potentially overwriting the pointer to a previously allocated one.
This fixes a memory leak which can occur when the bridge topology
allows for an skb to traverse more than one bridge.

Signed-off-by: default avatarDavid Kimdon <david.kimdon@devicescape.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6f4353d8

net/bridge/br_netfilter.c

+2 −0
Original line number Diff line number Diff line
@@ -369,6 +369,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook, 
	if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))

			goto inhdr_error;



 	nf_bridge_put(skb->nf_bridge);

	if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)

		return NF_DROP;

	setup_pre_routing(skb);
@@ -452,6 +453,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb, 
			skb->ip_summed = CHECKSUM_NONE;

	}



 	nf_bridge_put(skb->nf_bridge);

	if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)

		return NF_DROP;

	setup_pre_routing(skb);