bridge: fix RCU races with bridge port

[net-next-2.6.git] / net / bridge / netfilter / ebtables.c

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index a1dcf83f0d5860743906f75bcae5a23477c9b098..cbc9f395ab1ed1119bf51f460c992b1b2e315e30 100644 (file)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -128,6 +128,7 @@ ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
                 const struct net_device *in, const struct net_device *out)
 {
        const struct ethhdr *h = eth_hdr(skb);
+       const struct net_bridge_port *p;
        __be16 ethproto;
        int verdict, i;
 
@@ -148,13 +149,11 @@ ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
        if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
                return 1;
        /* rcu_read_lock()ed by nf_hook_slow */
-       if (in && br_port_exists(in) &&
-           FWINV2(ebt_dev_check(e->logical_in, br_port_get_rcu(in)->br->dev),
-                  EBT_ILOGICALIN))
+       if (in && (p = br_port_get_rcu(in)) != NULL &&
+           FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
                return 1;
-       if (out && br_port_exists(out) &&
-           FWINV2(ebt_dev_check(e->logical_out, br_port_get_rcu(out)->br->dev),
-                  EBT_ILOGICALOUT))
+       if (out && (p = br_port_get_rcu(out)) != NULL &&
+           FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
                return 1;
 
        if (e->bitmask & EBT_SOURCEMAC) {