#else if (entry->info->pf == PF_BRIDGE) { /* Case 1: outdev is physical output device, we need to * look for bridge group (when called from * netfilter_bridge) */ NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV, sizeof(tmp_uint), &tmp_uint); /* this is the bridge group "brX" */ tmp_uint = htonl(entry->info->outdev->br_port->br->dev->ifindex); NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint); } else { /* Case 2: outdev is bridge group, we need to look for * physical output device (when called from ipv4) */ NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint); if (entry->skb->nf_bridge && entry->skb->nf_bridge->physoutdev) { tmp_uint = htonl(entry->skb->nf_bridge->physoutdev->ifindex); NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV, sizeof(tmp_uint), &tmp_uint); } } #endif 
nfqnl_build_packet_message(struct nfqnl_instance *queue,			   struct nfqnl_queue_entry *entry, int *errp){	unsigned char *old_tail;	size_t size;	size_t data_len = 0;	struct sk_buff *skb;	struct nfqnl_msg_packet_hdr pmsg;	struct nlmsghdr *nlh;	struct nfgenmsg *nfmsg;	unsigned int tmp_uint;	QDEBUG("entered\n");	/* all macros expand to constant values at compile time */	size =    NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hdr))		+ NLMSG_SPACE(sizeof(u_int32_t))	/* ifindex */		+ NLMSG_SPACE(sizeof(u_int32_t))	/* ifindex */		+ NLMSG_SPACE(sizeof(u_int32_t))	/* mark */		+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hw))		+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_timestamp));	spin_lock_bh(&queue->lock);		switch (queue->copy_mode) {	case NFQNL_COPY_META:	case NFQNL_COPY_NONE:		data_len = 0;		break;		case NFQNL_COPY_PACKET:		if (queue->copy_range == 0 		    || queue->copy_range > entry->skb->len)			data_len = entry->skb->len;		else			data_len = queue->copy_range;				size += NLMSG_SPACE(data_len);		break;		default:		*errp = -EINVAL;		spin_unlock_bh(&queue->lock);		return NULL;	}	spin_unlock_bh(&queue->lock);	skb = alloc_skb(size, GFP_ATOMIC);	if (!skb)		goto nlmsg_failure;			old_tail= skb->tail;	nlh = NLMSG_PUT(skb, 0, 0, 			NFNL_SUBSYS_QUEUE << 8 | NFQNL_MSG_PACKET,			sizeof(struct nfgenmsg));	nfmsg = NLMSG_DATA(nlh);	nfmsg->nfgen_family = entry->info->pf;	nfmsg->version = NFNETLINK_V0;	nfmsg->res_id = htons(queue->queue_num);	pmsg.packet_id 		= htonl(entry->id);	pmsg.hw_protocol	= htons(entry->skb->protocol);	pmsg.hook		= entry->info->hook;	NFA_PUT(skb, NFQA_PACKET_HDR, sizeof(pmsg), &pmsg);	if (entry->info->indev) {		tmp_uint = htonl(entry->info->indev->ifindex);		NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint), &tmp_uint);	}	if (entry->info->outdev) {		tmp_uint = htonl(entry->info->outdev->ifindex);		NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint);	}	if (entry->skb->nfmark) {		tmp_uint = htonl(entry->skb->nfmark);		NFA_PUT(skb, NFQA_MARK, sizeof(u_int32_t), &tmp_uint);	}	if (entry->info->indev && entry->skb->dev	    && entry->skb->dev->hard_header_parse) {		struct nfqnl_msg_packet_hw phw;		phw.hw_addrlen =			entry->skb->dev->hard_header_parse(entry->skb,			                                   phw.hw_addr);		phw.hw_addrlen = htons(phw.hw_addrlen);		NFA_PUT(skb, NFQA_HWADDR, sizeof(phw), &phw);	}	if (entry->skb->stamp.tv_sec) {		struct nfqnl_msg_packet_timestamp ts;		ts.sec = htonll(entry->skb->stamp.tv_sec);		ts.usec = htonll(entry->skb->stamp.tv_usec);		NFA_PUT(skb, NFQA_TIMESTAMP, sizeof(ts), &ts);	}	if (data_len) {		struct nfattr *nfa;		int size = NFA_LENGTH(data_len);		if (skb_tailroom(skb) < (int)NFA_SPACE(data_len)) {			printk(KERN_WARNING "nf_queue: no tailroom!\n");			goto nlmsg_failure;		}		nfa = (struct nfattr *)skb_put(skb, NFA_ALIGN(size));		nfa->nfa_type = NFQA_PAYLOAD;		nfa->nfa_len = size;		if (skb_copy_bits(entry->skb, 0, NFA_DATA(nfa), data_len))			BUG();	}			nlh->nlmsg_len = skb->tail - old_tail;	return skb;nlmsg_failure:nfattr_failure:	if (skb)		kfree_skb(skb);	*errp = -EINVAL;	if (net_ratelimit())		printk(KERN_ERR "nf_queue: error creating packet message\n");	return NULL;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/fbcd923c3e0c8ec9e4ed64f5a4e5766807b32729/nfnetlink_queue.c/buggy/net/netfilter/nfnetlink_queue.c