Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 06cdb634 authored by Florian Westphal's avatar Florian Westphal Committed by Patrick McHardy
Browse files

netfilter: nfnetlink_queue: do not free skb on error 



Move free responsibility from nf_queue to caller.
This enables more flexible error handling; we can now accept the skb
instead of freeing it.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent f1585086

net/netfilter/core.c

+5 −2
Original line number Diff line number Diff line
@@ -181,8 +181,11 @@ next_hook: 
	} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {

		ret = nf_queue(skb, elem, pf, hook, indev, outdev, okfn,

			       verdict >> NF_VERDICT_BITS);

		if (ret < 0) {

			if (ret == -ECANCELED)

				goto next_hook;

			kfree_skb(skb);

		}

		ret = 0;

	}

	rcu_read_unlock();

net/netfilter/nf_queue.c

+10 −7
Original line number Diff line number Diff line
@@ -163,9 +163,8 @@ static int __nf_queue(struct sk_buff *skb, 


	/* If it's going away, ignore hook. */

	if (!try_module_get(entry->elem->owner)) {

		rcu_read_unlock();

		kfree(entry);

		return -ECANCELED;

		status = -ECANCELED;

		goto err_unlock;

	}

	/* Bump dev refs so they don't vanish while packet is out */

	if (indev)
@@ -198,7 +197,6 @@ static int __nf_queue(struct sk_buff *skb, 
err_unlock:

	rcu_read_unlock();

err:

	kfree_skb(skb);

	kfree(entry);

	return status;

}
@@ -229,7 +227,6 @@ int nf_queue(struct sk_buff *skb, 
	}



	segs = skb_gso_segment(skb, 0);

	kfree_skb(skb);

	/* Does not use PTR_ERR to limit the number of error codes that can be

	 * returned by nf_queue.  For instance, callers rely on -ECANCELED to mean

	 * 'ignore this hook'.
@@ -253,8 +250,11 @@ int nf_queue(struct sk_buff *skb, 
		segs = nskb;

	} while (segs);



	/* also free orig skb if only some segments were queued */

	if (unlikely(err && queued))

		err = 0;

	if (err == 0)

		kfree_skb(skb);

	return err;

}
@@ -300,8 +300,11 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) 
		err = __nf_queue(skb, elem, entry->pf, entry->hook,

				 entry->indev, entry->outdev, entry->okfn,

				 verdict >> NF_VERDICT_BITS);

		if (err < 0) {

			if (err == -ECANCELED)

				goto next_hook;

			kfree_skb(skb);

		}

		break;

	case NF_STOLEN:

	default: