bridge: use skb_ip_totlen in br netfilter

These 3 places in bridge netfilter are called on RX path after GRO
and IPv4 TCP GSO packets may come through, so replace iph tot_len
accessing with skb_ip_totlen() in there.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index f20f4373ff408ffaca8e9337d4bab3a31711b5f0..b67c9c98effadc16d4480a9d133accc5c2cdf925 100644 (file)
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -214,7 +214,7 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
        if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
                goto csum_error;
 
-       len = ntohs(iph->tot_len);
+       len = skb_ip_totlen(skb);
        if (skb->len < len) {
                __IP_INC_STATS(net, IPSTATS_MIB_INTRUNCATEDPKTS);
                goto drop;

diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index 5c5dd437f1c25b93b5a23ae96578ee7a0bf1d991..71056ee847736b56fa14516c04c6ab2947100694 100644 (file)
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -212,7 +212,7 @@ static int nf_ct_br_ip_check(const struct sk_buff *skb)
            iph->version != 4)
                return -1;
 
-       len = ntohs(iph->tot_len);
+       len = skb_ip_totlen(skb);
        if (skb->len < nhoff + len ||
            len < (iph->ihl * 4))
                 return -1;
@@ -256,7 +256,7 @@ static unsigned int nf_ct_bridge_pre(void *priv, struct sk_buff *skb,
                if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                        return NF_ACCEPT;
 
-               len = ntohs(ip_hdr(skb)->tot_len);
+               len = skb_ip_totlen(skb);
                if (pskb_trim_rcsum(skb, len))
                        return NF_ACCEPT;