netfilter: bridge: fix routing of bridge frames with call-iptables=1
We can't re-use the physoutdev storage area.
1. When using NFQUEUE in PREROUTING, we attempt to bump a bogus
refcnt since nf_bridge->physoutdev is garbage (ipv4/ipv6 address)
2. for same reason, we crash in physdev match in FORWARD or later if
skb is routed instead of bridged.
This increases nf_bridge_info to 40 bytes, but we have no other choice.
Fixes: 72b1e5e4ca
("netfilter: bridge: reduce nf_bridge_info to 32 bytes again")
Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
205ee117d4
commit
63cdbc06b3
|
@ -179,6 +179,9 @@ struct nf_bridge_info {
|
|||
u8 bridged_dnat:1;
|
||||
__u16 frag_max_size;
|
||||
struct net_device *physindev;
|
||||
|
||||
/* always valid & non-NULL from FORWARD on, for physdev match */
|
||||
struct net_device *physoutdev;
|
||||
union {
|
||||
/* prerouting: detect dnat in orig/reply direction */
|
||||
__be32 ipv4_daddr;
|
||||
|
@ -189,9 +192,6 @@ struct nf_bridge_info {
|
|||
* skb is out in neigh layer.
|
||||
*/
|
||||
char neigh_header[8];
|
||||
|
||||
/* always valid & non-NULL from FORWARD on, for physdev match */
|
||||
struct net_device *physoutdev;
|
||||
};
|
||||
};
|
||||
#endif
|
||||
|
|
Loading…
Reference in New Issue