Commit 63cdbc06 authored Sep 14, 2015 by Florian Westphal Committed by Pablo Neira Ayuso Sep 14, 2015

netfilter: bridge: fix routing of bridge frames with call-iptables=1



We can't re-use the physoutdev storage area.

1.  When using NFQUEUE in PREROUTING, we attempt to bump a bogus
refcnt since nf_bridge->physoutdev is garbage (ipv4/ipv6 address)

2. for same reason, we crash in physdev match in FORWARD or later if
skb is routed instead of bridged.

This increases nf_bridge_info to 40 bytes, but we have no other choice.

Fixes: 72b1e5e4 ("netfilter: bridge: reduce nf_bridge_info to 32 bytes again")
Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 205ee117

include/linux/skbuff.h

+3 −3

Original line number	Diff line number	Diff line
		@@ -179,6 +179,9 @@ struct nf_bridge_info {
		u8 bridged_dnat:1;
		__u16 frag_max_size;
		struct net_device *physindev;

		/* always valid & non-NULL from FORWARD on, for physdev match */
		struct net_device *physoutdev;
		union {
		/* prerouting: detect dnat in orig/reply direction */
		__be32 ipv4_daddr;
		@@ -189,9 +192,6 @@ struct nf_bridge_info {
		* skb is out in neigh layer.
		*/
		char neigh_header[8];

		/* always valid & non-NULL from FORWARD on, for physdev match */
		struct net_device *physoutdev;
		};
		};
		#endif