[][Kernel][hnat][Fix possibly null pointer and memory leak]
[Description]
Fix possibly null pointer and memory leak.
When skb_headroom(skb) < FOE_INFO_LEN, it means that hnat headroom of
the message is incomplete and may have been truncated by other functions.
HNAT should return and not relalloc skb.
If without the patch, may met NULL pointer and memory leak issue.
[Release-log]
N/A
Change-Id: I490191fa2be5fd1d664b228ef7c97951d0efe036
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/7694271
diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c
index ac266b7..0f33220 100644
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c
@@ -2794,13 +2794,15 @@
mtk_hnat_ipv4_nf_local_out(void *priv, struct sk_buff *skb,
const struct nf_hook_state *state)
{
- struct sk_buff *new_skb;
struct foe_entry *entry;
struct iphdr *iph;
if (!is_magic_tag_valid(skb))
return NF_ACCEPT;
+ if (unlikely(skb_headroom(skb) < FOE_INFO_LEN))
+ return NF_ACCEPT;
+
if (!skb_hnat_is_hashed(skb))
return NF_ACCEPT;
@@ -2810,16 +2812,6 @@
entry = &hnat_priv->foe_table_cpu[skb_hnat_ppe(skb)][skb_hnat_entry(skb)];
- if (unlikely(skb_headroom(skb) < FOE_INFO_LEN)) {
- new_skb = skb_realloc_headroom(skb, FOE_INFO_LEN);
- if (!new_skb) {
- dev_info(hnat_priv->dev, "%s:drop\n", __func__);
- return NF_DROP;
- }
- dev_kfree_skb(skb);
- skb = new_skb;
- }
-
/* Make the flow from local not be bound. */
iph = ip_hdr(skb);
if (iph->protocol == IPPROTO_IPV6) {