netfilter: bridge: fix routing of bridge frames with call-iptables=1

We can't re-use the physoutdev storage area.

1.  When using NFQUEUE in PREROUTING, we attempt to bump a bogus
refcnt since nf_bridge->physoutdev is garbage (ipv4/ipv6 address)

2. for same reason, we crash in physdev match in FORWARD or later if
skb is routed instead of bridged.

This increases nf_bridge_info to 40 bytes, but we have no other choice.

Fixes: 72b1e5e4cac7 ("netfilter: bridge: reduce nf_bridge_info to 32 bytes again")
Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 2738d355cdf9a33cf3551cc16228c5d0830bab4a..9987af080fa057cf77e927376d5c96bea5cb67a8 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -179,6 +179,9 @@ struct nf_bridge_info {
        u8                      bridged_dnat:1;
        __u16                   frag_max_size;
        struct net_device       *physindev;
+
+       /* always valid & non-NULL from FORWARD on, for physdev match */
+       struct net_device       *physoutdev;
        union {
                /* prerouting: detect dnat in orig/reply direction */
                __be32          ipv4_daddr;
@@ -189,9 +192,6 @@ struct nf_bridge_info {
                 * skb is out in neigh layer.
                 */
                char neigh_header[8];
-
-               /* always valid & non-NULL from FORWARD on, for physdev match */
-               struct net_device *physoutdev;
        };
 };
 #endif