bridge: fix RCU races with bridge port

[net-next-2.6.git] / net / bridge / netfilter / ebtables.c

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index bcc102e3be4daa2c5f09ee27710cc5ed03b096fa..cbc9f395ab1ed1119bf51f460c992b1b2e315e30 100644 (file)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -124,16 +124,24 @@ ebt_dev_check(const char *entry, const struct net_device *device)
 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 /* process standard matches */
 static inline int
-ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
+ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
                 const struct net_device *in, const struct net_device *out)
 {
+       const struct ethhdr *h = eth_hdr(skb);
+       const struct net_bridge_port *p;
+       __be16 ethproto;
        int verdict, i;
 
+       if (vlan_tx_tag_present(skb))
+               ethproto = htons(ETH_P_8021Q);
+       else
+               ethproto = h->h_proto;
+
        if (e->bitmask & EBT_802_3) {
-               if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
+               if (FWINV2(ntohs(ethproto) >= 1536, EBT_IPROTO))
                        return 1;
        } else if (!(e->bitmask & EBT_NOPROTO) &&
-          FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
+          FWINV2(e->ethproto != ethproto, EBT_IPROTO))
                return 1;
 
        if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
@@ -141,13 +149,11 @@ ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
        if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
                return 1;
        /* rcu_read_lock()ed by nf_hook_slow */
-       if (in && br_port_exists(in) &&
-           FWINV2(ebt_dev_check(e->logical_in, br_port_get_rcu(in)->br->dev),
-                  EBT_ILOGICALIN))
+       if (in && (p = br_port_get_rcu(in)) != NULL &&
+           FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
                return 1;
-       if (out && br_port_exists(out) &&
-           FWINV2(ebt_dev_check(e->logical_out, br_port_get_rcu(out)->br->dev),
-                  EBT_ILOGICALOUT))
+       if (out && (p = br_port_get_rcu(out)) != NULL &&
+           FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
                return 1;
 
        if (e->bitmask & EBT_SOURCEMAC) {
@@ -213,7 +219,7 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
        base = private->entries;
        i = 0;
        while (i < nentries) {
-               if (ebt_basic_match(point, eth_hdr(skb), in, out))
+               if (ebt_basic_match(point, skb, in, out))
                        goto letscontinue;
 
                if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)