diff options
| author | David Kimdon <david.kimdon@devicescape.com> | 2005-12-26 17:27:10 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2005-12-26 17:27:10 -0800 |
| commit | 79cac2a221ce18642550a13bed0f0203514923ea (patch) | |
| tree | ecc66198fee701916e247c44e6bad0db387535ce | |
| parent | 6f4353d891b5e477528cd0b996e0263fecdf5d5f (diff) | |
| download | linux-79cac2a221ce18642550a13bed0f0203514923ea.tar.gz linux-79cac2a221ce18642550a13bed0f0203514923ea.tar.bz2 linux-79cac2a221ce18642550a13bed0f0203514923ea.zip | |
[BR_NETFILTER]: Fix leak if skb traverses > 1 bridge
Call nf_bridge_put() before allocating a new nf_bridge structure and
potentially overwriting the pointer to a previously allocated one.
This fixes a memory leak which can occur when the bridge topology
allows for an skb to traverse more than one bridge.
Signed-off-by: David Kimdon <david.kimdon@devicescape.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/bridge/br_netfilter.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index 43a0b35dfe6f..23422bd53a5e 100644 --- a/net/bridge/br_netfilter.c +++ b/net/bridge/br_netfilter.c @@ -369,6 +369,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook, if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb)) goto inhdr_error; + nf_bridge_put(skb->nf_bridge); if ((nf_bridge = nf_bridge_alloc(skb)) == NULL) return NF_DROP; setup_pre_routing(skb); @@ -452,6 +453,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb, skb->ip_summed = CHECKSUM_NONE; } + nf_bridge_put(skb->nf_bridge); if ((nf_bridge = nf_bridge_alloc(skb)) == NULL) return NF_DROP; setup_pre_routing(skb); |