| From ab7d2e828b2e44afd86df3597d98bad14855efc3 Mon Sep 17 00:00:00 2001 |
| From: Marco Oliverio <marco.oliverio@tanaza.com> |
| Date: Mon, 2 Dec 2019 19:54:30 +0100 |
| Subject: [PATCH] netfilter: nf_queue: enqueue skbs with NULL dst |
| |
| commit 0b9173f4688dfa7c5d723426be1d979c24ce3d51 upstream. |
| |
| Bridge packets that are forwarded have skb->dst == NULL and get |
| dropped by the check introduced by |
| b60a77386b1d4868f72f6353d35dabe5fbe981f2 (net: make skb_dst_force |
| return true when dst is refcounted). |
| |
| To fix this we check skb_dst() before skb_dst_force(), so we don't |
| drop skb packet with dst == NULL. This holds also for skb at the |
| PRE_ROUTING hook so we remove the second check. |
| |
| Fixes: b60a77386b1d ("net: make skb_dst_force return true when dst is refcounted") |
| Signed-off-by: Marco Oliverio <marco.oliverio@tanaza.com> |
| Signed-off-by: Rocco Folino <rocco.folino@tanaza.com> |
| Acked-by: Florian Westphal <fw@strlen.de> |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c |
| index 2c440015ff0c..3d8aca9ac06d 100644 |
| --- a/net/netfilter/nf_queue.c |
| +++ b/net/netfilter/nf_queue.c |
| @@ -190,7 +190,7 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, |
| goto err; |
| } |
| |
| - if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) { |
| + if (skb_dst(skb) && !skb_dst_force(skb)) { |
| status = -ENETDOWN; |
| goto err; |
| } |
| -- |
| 2.7.4 |
| |
