diff options
| author | Bart De Schuymer <bdschuym@pandora.be> | 2003-12-16 20:08:33 -0800 |
|---|---|---|
| committer | David S. Miller <davem@nuts.ninka.net> | 2003-12-16 20:08:33 -0800 |
| commit | aee70930db378de7eedb1658c51c3be8cdaea35c (patch) | |
| tree | 437b4e7dc9a4bf450d15f96ac83227518d7938d5 /net | |
| parent | 0e70f996f011c870970eee3f584a2f9b8295cf34 (diff) | |
[BRIDGE NETFILTER]: Fix leaks and crashes in SKB handling.
- Missing nf bridge info put in ip_copy_metadata()
- Do not store nf bridge private info in the SKB control block,
parts of IPv4 use that area too and this causes corruption.
Diffstat (limited to 'net')
| -rw-r--r-- | net/bridge/br_netfilter.c | 6 | ||||
| -rw-r--r-- | net/ipv4/ip_output.c | 1 |
2 files changed, 2 insertions, 5 deletions
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index 1ca3964f31e6..2f1952de98ee 100644 --- a/net/bridge/br_netfilter.c +++ b/net/bridge/br_netfilter.c @@ -38,11 +38,9 @@ #define skb_origaddr(skb) (((struct bridge_skb_cb *) \ - (skb->cb))->daddr.ipv4) + (skb->nf_bridge->data))->daddr.ipv4) #define store_orig_dstaddr(skb) (skb_origaddr(skb) = (skb)->nh.iph->daddr) #define dnat_took_place(skb) (skb_origaddr(skb) != (skb)->nh.iph->daddr) -#define clear_cb(skb) (memset(&skb_origaddr(skb), 0, \ - sizeof(struct bridge_skb_cb))) #define has_bridge_parent(device) ((device)->br_port != NULL) #define bridge_parent(device) ((device)->br_port->br->dev) @@ -203,7 +201,6 @@ bridged_dnat: */ nf_bridge->mask |= BRNF_BRIDGED_DNAT; skb->dev = nf_bridge->physindev; - clear_cb(skb); if (skb->protocol == __constant_htons(ETH_P_8021Q)) { skb_push(skb, VLAN_HLEN); @@ -224,7 +221,6 @@ bridged_dnat: dst_hold(skb->dst); } - clear_cb(skb); skb->dev = nf_bridge->physindev; if (skb->protocol == __constant_htons(ETH_P_8021Q)) { skb_push(skb, VLAN_HLEN); diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 44f1dff39fab..04e792bd1c51 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -417,6 +417,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from) to->nfct = from->nfct; nf_conntrack_get(to->nfct); #ifdef CONFIG_BRIDGE_NETFILTER + nf_bridge_put(to->nf_bridge); to->nf_bridge = from->nf_bridge; nf_bridge_get(to->nf_bridge); #endif |