From d0354e3ba19cdf9acc2ca89bbb59b1e6292a4f44 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Mon, 18 Dec 2006 20:51:43 +0100 Subject: bridge-netfilter: don't overwrite memory outside of skb The bridge netfilter code needs to check for space at the front of the skb before overwriting; otherwise if skb from device doesn't have headroom, then it will cause random memory corruption. Signed-off-by: Stephen Hemminger Signed-off-by: Adrian Bunk --- include/linux/netfilter_bridge.h | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h index de4d397865ce..52502000bbca 100644 --- a/include/linux/netfilter_bridge.h +++ b/include/linux/netfilter_bridge.h @@ -65,16 +65,25 @@ struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb) } /* Only used in br_forward.c */ -static inline -void nf_bridge_maybe_copy_header(struct sk_buff *skb) +static inline int nf_bridge_maybe_copy_header(struct sk_buff *skb) { + int err; + if (skb->nf_bridge) { if (skb->protocol == __constant_htons(ETH_P_8021Q)) { + err = skb_cow(skb, 18); + if (err) + return err; memcpy(skb->data - 18, skb->nf_bridge->data, 18); skb_push(skb, 4); - } else + } else { + err = skb_cow(skb, 16); + if (err) + return err; memcpy(skb->data - 16, skb->nf_bridge->data, 16); + } } + return 0; } static inline -- cgit v1.2.3