diff options
| author |   Florian Westphal <fw@strlen.de> | 2015-04-20 12:35:47 +0200 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2015-04-24 20:51:40 +0200 |
| commit | 547c4b547e07dcc60874b6ef6252dd49ff74aec1 (patch) | |
| tree | 942709ba5115ae7840efc3d71b6093de4b39e575 | |
| parent | netfilter: nf_tables: fix wrong length for jump/goto verdicts (diff) | |
| download | linux-dev-547c4b547e07dcc60874b6ef6252dd49ff74aec1.tar.xz linux-dev-547c4b547e07dcc60874b6ef6252dd49ff74aec1.zip | |
netfilter: bridge: fix NULL deref in physin/out ifindex helpers
Might not have an outdev yet. We'll oops when iface goes down while skbs
are still nfqueue'd:
RIP: 0010:[<ffffffff81422a2f>] [<ffffffff81422a2f>] dev_cmp+0x4f/0x80
nfqnl_rcv_dev_event+0xe2/0x150
notifier_call_chain+0x53/0xa0
Fixes: c737b7c4510026 ("netfilter: bridge: add helpers for fetching physin/outdev")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | include/linux/netfilter_bridge.h | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h index ab8f76dba668..f2fdb5a52070 100644 --- a/include/linux/netfilter_bridge.h +++ b/include/linux/netfilter_bridge.h @@ -39,12 +39,24 @@ static inline void br_drop_fake_rtable(struct sk_buff *skb) static inline int nf_bridge_get_physinif(const struct sk_buff *skb) { - return skb->nf_bridge ? skb->nf_bridge->physindev->ifindex : 0; + struct nf_bridge_info *nf_bridge; + + if (skb->nf_bridge == NULL) + return 0; + + nf_bridge = skb->nf_bridge; + return nf_bridge->physindev ? nf_bridge->physindev->ifindex : 0; } static inline int nf_bridge_get_physoutif(const struct sk_buff *skb) { - return skb->nf_bridge ? skb->nf_bridge->physoutdev->ifindex : 0; + struct nf_bridge_info *nf_bridge; + + if (skb->nf_bridge == NULL) + return 0; + + nf_bridge = skb->nf_bridge; + return nf_bridge->physoutdev ? nf_bridge->physoutdev->ifindex : 0; } static inline struct net_device * |