2 files changed, 34 insertions, 7 deletions

diff --git a/net/ipv6/netfilter/nf_tables_ipv6.c b/net/ipv6/netfilter/nf_tables_ipv6.c
index 3631d6238e6f..42f905a808a3 100644
--- a/net/ipv6/netfilter/nf_tables_ipv6.c
+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
@@ -14,6 +14,7 @@
 #include <linux/ipv6.h>
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables_ipv6.h>
 
 static unsigned int nft_ipv6_output(const struct nf_hook_ops *ops,
                                     struct sk_buff *skb,
@@ -21,14 +22,18 @@ static unsigned int nft_ipv6_output(const struct nf_hook_ops *ops,
                                     const struct net_device *out,
                                     int (*okfn)(struct sk_buff *))
 {
+        struct nft_pktinfo pkt;
+
         if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
                 if (net_ratelimit())
                         pr_info("nf_tables_ipv6: ignoring short SOCK_RAW "
                                 "packet\n");
                 return NF_ACCEPT;
         }
+        if (nft_set_pktinfo_ipv6(&pkt, ops, skb, in, out) < 0)
+                return NF_DROP;
 
-        return nft_do_chain(ops, skb, in, out, okfn);
+        return nft_do_chain_pktinfo(&pkt, ops);
 }
 
 static struct nft_af_info nft_af_ipv6 __read_mostly = {
@@ -40,6 +45,22 @@ static struct nft_af_info nft_af_ipv6 __read_mostly = {
         },
 };
 
+static unsigned int
+nft_do_chain_ipv6(const struct nf_hook_ops *ops,
+                  struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  int (*okfn)(struct sk_buff *))
+{
+        struct nft_pktinfo pkt;
+
+        /* malformed packet, drop it */
+        if (nft_set_pktinfo_ipv6(&pkt, ops, skb, in, out) < 0)
+                return NF_DROP;
+
+        return nft_do_chain_pktinfo(&pkt, ops);
+}
+
 static struct nf_chain_type filter_ipv6 = {
         .family         = NFPROTO_IPV6,
         .name           = "filter",
@@ -50,11 +71,11 @@ static struct nf_chain_type filter_ipv6 = {
                           (1 << NF_INET_PRE_ROUTING) |
                           (1 << NF_INET_POST_ROUTING),
         .fn             = {
-                [NF_INET_LOCAL_IN]      = nft_do_chain,
-                [NF_INET_LOCAL_OUT]     = nft_do_chain,
-                [NF_INET_FORWARD]       = nft_do_chain,
-                [NF_INET_PRE_ROUTING]   = nft_do_chain,
-                [NF_INET_POST_ROUTING]  = nft_do_chain,
+                [NF_INET_LOCAL_IN]      = nft_do_chain_ipv6,
+                [NF_INET_LOCAL_OUT]     = nft_ipv6_output,
+                [NF_INET_FORWARD]       = nft_do_chain_ipv6,
+                [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv6,
+                [NF_INET_POST_ROUTING]  = nft_do_chain_ipv6,
         },
 };
 
diff --git a/net/ipv6/netfilter/nft_chain_route_ipv6.c b/net/ipv6/netfilter/nft_chain_route_ipv6.c
index 4cdc992fa067..3fe40f0456ad 100644
--- a/net/ipv6/netfilter/nft_chain_route_ipv6.c
+++ b/net/ipv6/netfilter/nft_chain_route_ipv6.c
@@ -19,6 +19,7 @@
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables_ipv6.h>
 #include <net/route.h>
 
 static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,
@@ -28,10 +29,15 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,
                                         int (*okfn)(struct sk_buff *))
 {
         unsigned int ret;
+        struct nft_pktinfo pkt;
         struct in6_addr saddr, daddr;
         u_int8_t hop_limit;
         u32 mark, flowlabel;
 
+        /* malformed packet, drop it */
+        if (nft_set_pktinfo_ipv6(&pkt, ops, skb, in, out) < 0)
+                return NF_DROP;
+
         /* save source/dest address, mark, hoplimit, flowlabel, priority */
         memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr));
         memcpy(&daddr, &ipv6_hdr(skb)->daddr, sizeof(daddr));
@@ -41,7 +47,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,
         /* flowlabel and prio (includes version, which shouldn't change either */
         flowlabel = *((u32 *)ipv6_hdr(skb));
 
-        ret = nft_do_chain(ops, skb, in, out, okfn);
+        ret = nft_do_chain_pktinfo(&pkt, ops);
         if (ret != NF_DROP && ret != NF_QUEUE &&
             (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) ||
              memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||