text ematch: check for NULL pointer before destroying textsearch config

[pandora-kernel.git] / net / sched / act_nat.c

diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 724553e..186eb83 100644 (file)
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -114,6 +114,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
        int egress;
        int action;
        int ihl;
+       int noff;
 
        spin_lock(&p->tcf_lock);
 
@@ -132,7 +133,8 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
        if (unlikely(action == TC_ACT_SHOT))
                goto drop;
 
-       if (!pskb_may_pull(skb, sizeof(*iph)))
+       noff = skb_network_offset(skb);
+       if (!pskb_may_pull(skb, sizeof(*iph) + noff))
                goto drop;
 
        iph = ip_hdr(skb);
@@ -144,7 +146,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 
        if (!((old_addr ^ addr) & mask)) {
                if (skb_cloned(skb) &&
-                   !skb_clone_writable(skb, sizeof(*iph)) &&
+                   !skb_clone_writable(skb, sizeof(*iph) + noff) &&
                    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                        goto drop;
 
@@ -172,9 +174,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
        {
                struct tcphdr *tcph;
 
-               if (!pskb_may_pull(skb, ihl + sizeof(*tcph)) ||
+               if (!pskb_may_pull(skb, ihl + sizeof(*tcph) + noff) ||
                    (skb_cloned(skb) &&
-                    !skb_clone_writable(skb, ihl + sizeof(*tcph)) &&
+                    !skb_clone_writable(skb, ihl + sizeof(*tcph) + noff) &&
                     pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
                        goto drop;
 
@@ -186,9 +188,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
        {
                struct udphdr *udph;
 
-               if (!pskb_may_pull(skb, ihl + sizeof(*udph)) ||
+               if (!pskb_may_pull(skb, ihl + sizeof(*udph) + noff) ||
                    (skb_cloned(skb) &&
-                    !skb_clone_writable(skb, ihl + sizeof(*udph)) &&
+                    !skb_clone_writable(skb, ihl + sizeof(*udph) + noff) &&
                     pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
                        goto drop;
 
@@ -205,7 +207,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
        {
                struct icmphdr *icmph;
 
-               if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
+               if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + noff))
                        goto drop;
 
                icmph = (void *)(skb_network_header(skb) + ihl);
@@ -215,9 +217,11 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                    (icmph->type != ICMP_PARAMETERPROB))
                        break;
 
-               if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
+               if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph) +
+                                       noff))
                        goto drop;
 
+               icmph = (void *)(skb_network_header(skb) + ihl);
                iph = (void *)(icmph + 1);
                if (egress)
                        addr = iph->daddr;
@@ -228,8 +232,8 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                        break;
 
                if (skb_cloned(skb) &&
-                   !skb_clone_writable(skb,
-                                       ihl + sizeof(*icmph) + sizeof(*iph)) &&
+                   !skb_clone_writable(skb, ihl + sizeof(*icmph) +
+                                            sizeof(*iph) + noff) &&
                    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                        goto drop;
 
@@ -246,7 +250,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                        iph->saddr = new_addr;
 
                inet_proto_csum_replace4(&icmph->checksum, skb, addr, new_addr,
-                                        1);
+                                        0);
                break;
        }
        default:
@@ -268,40 +272,29 @@ static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a,
 {
        unsigned char *b = skb_tail_pointer(skb);
        struct tcf_nat *p = a->priv;
-       struct tc_nat *opt;
+       struct tc_nat opt = {
+               .old_addr = p->old_addr,
+               .new_addr = p->new_addr,
+               .mask     = p->mask,
+               .flags    = p->flags,
+
+               .index    = p->tcf_index,
+               .action   = p->tcf_action,
+               .refcnt   = p->tcf_refcnt - ref,
+               .bindcnt  = p->tcf_bindcnt - bind,
+       };
        struct tcf_t t;
-       int s;
-
-       s = sizeof(*opt);
-
-       /* netlink spinlocks held above us - must use ATOMIC */
-       opt = kzalloc(s, GFP_ATOMIC);
-       if (unlikely(!opt))
-               return -ENOBUFS;
 
-       opt->old_addr = p->old_addr;
-       opt->new_addr = p->new_addr;
-       opt->mask = p->mask;
-       opt->flags = p->flags;
-
-       opt->index = p->tcf_index;
-       opt->action = p->tcf_action;
-       opt->refcnt = p->tcf_refcnt - ref;
-       opt->bindcnt = p->tcf_bindcnt - bind;
-
-       NLA_PUT(skb, TCA_NAT_PARMS, s, opt);
+       NLA_PUT(skb, TCA_NAT_PARMS, sizeof(opt), &opt);
        t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
        t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
        t.expires = jiffies_to_clock_t(p->tcf_tm.expires);
        NLA_PUT(skb, TCA_NAT_TM, sizeof(t), &t);
 
-       kfree(opt);
-
        return skb->len;
 
 nla_put_failure:
        nlmsg_trim(skb, b);
-       kfree(opt);
        return -1;
 }