netfilter: bridge: fix routing of bridge frames with call-iptables=1 (63cdbc06) · Commits · 戴 / test

We can't re-use the physoutdev storage area. 1. When using NFQUEUE in PREROUTING, we attempt to bump a bogus refcnt since nf_bridge->physoutdev is garbage (ipv4/ipv6 address) 2. for same reason, we crash in physdev match in FORWARD or later if skb is routed instead of bridged. This increases nf_bridge_info to 40 bytes, but we have no other choice. Fixes: ("netfilter: bridge: reduce nf_bridge_info to 32 bytes again") Reported-by:

Sander Eikelenboom <linux@eikelenboom.it> Signed-off-by:

Florian Westphal <fw@strlen.de> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

include/linux/skbuff.h

+3 −3

Original line number	Original line	Diff line number	Diff line
	@@ -179,6 +179,9 @@ struct nf_bridge_info {
	u8 bridged_dnat:1;		u8 bridged_dnat:1;
	__u16 frag_max_size;		__u16 frag_max_size;
	struct net_device *physindev;		struct net_device *physindev;

			/* always valid & non-NULL from FORWARD on, for physdev match */
			struct net_device *physoutdev;
	union {		union {
	/* prerouting: detect dnat in orig/reply direction */		/* prerouting: detect dnat in orig/reply direction */
	__be32 ipv4_daddr;		__be32 ipv4_daddr;
	@@ -189,9 +192,6 @@ struct nf_bridge_info {
	* skb is out in neigh layer.		* skb is out in neigh layer.
	*/		*/
	char neigh_header[8];		char neigh_header[8];

	/* always valid & non-NULL from FORWARD on, for physdev match */
	struct net_device *physoutdev;
	};		};
	};		};
	#endif		#endif

Admin message