[BRIDGE] netfilter: memory corruption fix

The bridge-netfilter code will overwrite memory if there is not
headroom in the skb to save the header.  This first showed up when
using Xen with sky2 driver that doesn't allocate the extra space.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 12 insertions, 2 deletions

diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 10c13dc4665b..427c67ff89e9 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -48,15 +48,25 @@ enum nf_br_hook_priorities {
 
 /* Only used in br_forward.c */
 static inline
-void nf_bridge_maybe_copy_header(struct sk_buff *skb)
+int nf_bridge_maybe_copy_header(struct sk_buff *skb)
 {
+        int err;
+
         if (skb->nf_bridge) {
                 if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
+                        err = skb_cow(skb, 18);
+                        if (err)
+                                return err;
                         memcpy(skb->data - 18, skb->nf_bridge->data, 18);
                         skb_push(skb, 4);
-                } else
+                } else {
+                        err = skb_cow(skb, 16);
+                        if (err)
+                                return err;
                         memcpy(skb->data - 16, skb->nf_bridge->data, 16);
+                }
         }
+        return 0;
 }
 
 /* This is called by the IP fragmenting code and it ensures there is