diff options
| author | Xin Long <lucien.xin@gmail.com> | 2023-01-28 18:58:31 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2023-02-02 07:54:27 +0300 |
| commit | 46abd17302ba6be2e06818088e40a568e8f9e7af (patch) | |
| tree | e54548d95d87b64a1e03629f04f885733a7a0fec /net/bridge/netfilter/nf_conntrack_bridge.c | |
| parent | 058a8f7f73aae1cc22b53fcefec031b9e391b54d (diff) | |
| download | linux-46abd17302ba6be2e06818088e40a568e8f9e7af.tar.xz | |
bridge: use skb_ip_totlen in br netfilter
These 3 places in bridge netfilter are called on RX path after GRO
and IPv4 TCP GSO packets may come through, so replace iph tot_len
accessing with skb_ip_totlen() in there.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/bridge/netfilter/nf_conntrack_bridge.c')
| -rw-r--r-- | net/bridge/netfilter/nf_conntrack_bridge.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c index 5c5dd437f1c2..71056ee84773 100644 --- a/net/bridge/netfilter/nf_conntrack_bridge.c +++ b/net/bridge/netfilter/nf_conntrack_bridge.c @@ -212,7 +212,7 @@ static int nf_ct_br_ip_check(const struct sk_buff *skb) iph->version != 4) return -1; - len = ntohs(iph->tot_len); + len = skb_ip_totlen(skb); if (skb->len < nhoff + len || len < (iph->ihl * 4)) return -1; @@ -256,7 +256,7 @@ static unsigned int nf_ct_bridge_pre(void *priv, struct sk_buff *skb, if (!pskb_may_pull(skb, sizeof(struct iphdr))) return NF_ACCEPT; - len = ntohs(ip_hdr(skb)->tot_len); + len = skb_ip_totlen(skb); if (pskb_trim_rcsum(skb, len)) return NF_ACCEPT; |