netfilter: bridge: fix routing of bridge frames with call-iptables=1
authorFlorian Westphal <fw@strlen.de>
Mon, 14 Sep 2015 15:06:27 +0000 (17:06 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 14 Sep 2015 16:08:33 +0000 (18:08 +0200)
commit63cdbc06b357dcb3a7104a421ee4a4550d7fadfd
tree2fb2ea7a51b185f2786f4ee61773b470b9a5eb7a
parent205ee117d4dc4a11ac3bd9638bb9b2e839f4de9a
netfilter: bridge: fix routing of bridge frames with call-iptables=1

We can't re-use the physoutdev storage area.

1.  When using NFQUEUE in PREROUTING, we attempt to bump a bogus
refcnt since nf_bridge->physoutdev is garbage (ipv4/ipv6 address)

2. for same reason, we crash in physdev match in FORWARD or later if
skb is routed instead of bridged.

This increases nf_bridge_info to 40 bytes, but we have no other choice.

Fixes: 72b1e5e4cac7 ("netfilter: bridge: reduce nf_bridge_info to 32 bytes again")
Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/linux/skbuff.h