From: Herbert Xu Date: Fri, 18 Mar 2011 05:27:28 +0000 (+0000) Subject: bridge: Reset IPCB when entering IP stack on NF_FORWARD X-Git-Tag: upstream/snapshot3+hdmi~10756^2~92 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=6b1e960fdbd75dcd9bcc3ba5ff8898ff1ad30b6e;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git bridge: Reset IPCB when entering IP stack on NF_FORWARD Whenever we enter the IP stack proper from bridge netfilter we need to ensure that the skb is in a form the IP stack expects it to be in. The entry point on NF_FORWARD did not meet the requirements of the IP stack, therefore leading to potential crashes/panics. This patch fixes the problem. Signed-off-by: Herbert Xu Acked-by: Stephen Hemminger Signed-off-by: David S. Miller --- diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index f97af559..008ff6c 100644 --- a/net/bridge/br_netfilter.c +++ b/net/bridge/br_netfilter.c @@ -739,6 +739,9 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb, nf_bridge->mask |= BRNF_PKT_TYPE; } + if (br_parse_ip_options(skb)) + return NF_DROP; + /* The physdev module checks on this */ nf_bridge->mask |= BRNF_BRIDGED; nf_bridge->physoutdev = skb->dev;