[PATCH 3.2 063/110] netfilter: bridge: don't leak skb in error paths

From: Ben Hutchings
Date: Mon Aug 10 2015 - 06:24:59 EST

3.2.71-rc1 review patch. If anyone has any objections, please let me know.


From: Florian Westphal <fw@xxxxxxxxx>

commit dd302b59bde0149c20df7278c0d36c765e66afbd upstream.

br_nf_dev_queue_xmit must free skb in its error path.
NF_DROP is misleading -- its an okfn, not a netfilter hook.

Fixes: 462fb2af9788a ("bridge : Sanitize skb before it enters the IP stack")
Fixes: efb6de9b4ba00 ("netfilter: bridge: forward IPv6 fragmented packets")
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
[bwh: Backported to 3.2:
- Adjust filename
- Drop IPv6 changes]
Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -822,12 +822,15 @@ static int br_nf_dev_queue_xmit(struct s
!skb_is_gso(skb)) {
if (br_parse_ip_options(skb))
/* Drop invalid packet */
- return NF_DROP;
+ goto drop;
ret = ip_fragment(skb, br_dev_queue_push_xmit);
} else
ret = br_dev_queue_push_xmit(skb);

return ret;
+ drop:
+ kfree_skb(skb);
+ return 0;
static int br_nf_dev_queue_xmit(struct sk_buff *skb)

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/