[BR_NETFILTER]: Fix leak if skb traverses > 1 bridge

Call nf_bridge_put() before allocating a new nf_bridge structure and
potentially overwriting the pointer to a previously allocated one.
This fixes a memory leak which can occur when the bridge topology
allows for an skb to traverse more than one bridge.

Signed-off-by: David Kimdon <david.kimdon@devicescape.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 0 deletions

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 43a0b35dfe6f..23422bd53a5e 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -369,6 +369,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
         if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
                         goto inhdr_error;
 
+        nf_bridge_put(skb->nf_bridge);
         if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                 return NF_DROP;
         setup_pre_routing(skb);
@@ -452,6 +453,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
                         skb->ip_summed = CHECKSUM_NONE;
         }
 
+        nf_bridge_put(skb->nf_bridge);
         if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                 return NF_DROP;
         setup_pre_routing(skb);