Commit 79cac2a2 authored by David Kimdon's avatar David Kimdon Committed by David S. Miller

[BR_NETFILTER]: Fix leak if skb traverses > 1 bridge

Call nf_bridge_put() before allocating a new nf_bridge structure and
potentially overwriting the pointer to a previously allocated one.
This fixes a memory leak which can occur when the bridge topology
allows for an skb to traverse more than one bridge.
Signed-off-by: default avatarDavid Kimdon <david.kimdon@devicescape.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6f4353d8
...@@ -369,6 +369,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook, ...@@ -369,6 +369,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb)) if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
goto inhdr_error; goto inhdr_error;
nf_bridge_put(skb->nf_bridge);
if ((nf_bridge = nf_bridge_alloc(skb)) == NULL) if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
return NF_DROP; return NF_DROP;
setup_pre_routing(skb); setup_pre_routing(skb);
...@@ -452,6 +453,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb, ...@@ -452,6 +453,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
skb->ip_summed = CHECKSUM_NONE; skb->ip_summed = CHECKSUM_NONE;
} }
nf_bridge_put(skb->nf_bridge);
if ((nf_bridge = nf_bridge_alloc(skb)) == NULL) if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
return NF_DROP; return NF_DROP;
setup_pre_routing(skb); setup_pre_routing(skb);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment