[NETFILTER]: {ip,ip6,nfnetlink}_queue: fix SKB_LINEAR_ASSERT when mangling packet data

As reported by Tomas Simonaitis <tomas.simonaitis@gmail.com>,
inserting new data in skbs queued over {ip,ip6,nfnetlink}_queue
triggers a SKB_LINEAR_ASSERT in skb_put().

Going back through the git history, it seems this bug is present since
at least 2.6.12-rc2, probably even since the removal of
skb_linearize() for netfilter.

Linearize non-linear skbs through skb_copy_expand() when enlarging
them.  Tested by Thomas, fixes bugzilla #9933.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 7 insertions, 5 deletions

diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 6bda1102851..fe05da41d6b 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -283,8 +283,8 @@ static int
 ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
 {
         int diff;
-        int err;
         struct iphdr *user_iph = (struct iphdr *)v->payload;
+        struct sk_buff *nskb;
 
         if (v->data_len < sizeof(*user_iph))
                 return 0;
@@ -296,14 +296,16 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
                 if (v->data_len > 0xFFFF)
                         return -EINVAL;
                 if (diff > skb_tailroom(e->skb)) {
-                        err = pskb_expand_head(e->skb, 0,
+                        nskb = skb_copy_expand(e->skb, 0,
                                                diff - skb_tailroom(e->skb),
                                                GFP_ATOMIC);
-                        if (err) {
+                        if (!nskb) {
                                 printk(KERN_WARNING "ip_queue: error "
-                                      "in mangle, dropping packet: %d\n", -err);
-                                return err;
+                                      "in mangle, dropping packet\n");
+                                return -ENOMEM;
                         }
+                        kfree_skb(e->skb);
+                        e->skb = nskb;
                 }
                 skb_put(e->skb, diff);
         }