bridge: ebtables: don't crash when using dnat target in output chains

xt_in() returns NULL in the output hook, skip the pkt_type change for
that case, redirection only makes sense in broute/prerouting hooks.

Reported-by: Tom Yan <tom.ty89@gmail.com>
Cc: Linus Lüssing <linus.luessing@c0d3.blue>
Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index ed91ea31978afff3e2751387954c0e146cd737b8..12a4f4d9368109999d5b2d3c5fe24957c5e7f747 100644 (file)
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -20,7 +20,6 @@ static unsigned int
 ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
        const struct ebt_nat_info *info = par->targinfo;
-       struct net_device *dev;
 
        if (skb_ensure_writable(skb, ETH_ALEN))
                return EBT_DROP;
@@ -33,10 +32,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
                else
                        skb->pkt_type = PACKET_MULTICAST;
        } else {
-               if (xt_hooknum(par) != NF_BR_BROUTING)
-                       dev = br_port_get_rcu(xt_in(par))->br->dev;
-               else
+               const struct net_device *dev;
+
+               switch (xt_hooknum(par)) {
+               case NF_BR_BROUTING:
                        dev = xt_in(par);
+                       break;
+               case NF_BR_PRE_ROUTING:
+                       dev = br_port_get_rcu(xt_in(par))->br->dev;
+                       break;
+               default:
+                       dev = NULL;
+                       break;
+               }
+
+               if (!dev) /* NF_BR_LOCAL_OUT */
+                       return info->target;
 
                if (ether_addr_equal(info->mac, dev->dev_addr))
                        skb->pkt_type = PACKET_HOST;