averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: flowtable: ensure sufficient headroom in xmit path

Browse Source 
commit ef4f741e86 upstream.

Check for headroom and call skb_expand_head() like in the IP output
path to ensure there is sufficient headroom for the mac header when
forwarding this packet as suggested by sashiko.

Fixes: b5964aac51 ("netfilter: flowtable: consolidate xmit path")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Pablo Neira Ayuso
2026-08-19 18:18:21 +02:00
committed by Greg Kroah-Hartman
parent 99ec511f25
commit 1eb0dc458b
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/netfilter/nf_flow_table_ip.c
+11 -2
View File
@@ -343,8 +343,17 @@ struct nf_flow_xmit {
static unsigned int nf_flow_queue_xmit(struct net *net, struct sk_buff *skb,
struct nf_flow_xmit *xmit)
{
skb->dev = xmit->outdev;
dev_hard_header(skb, skb->dev, ntohs(skb->protocol),
struct net_device *dev = xmit->outdev;
unsigned int hh_len = LL_RESERVED_SPACE(dev);
if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
skb = skb_expand_head(skb, hh_len);
if (!skb)
return NF_STOLEN;
}
skb->dev = dev;
dev_hard_header(skb, dev, ntohs(skb->protocol),
xmit->dest, xmit->source, skb->len);
dev_queue_xmit(skb);