From 1a092fa0d8d2793e54971f00fadf478edf40e0ec Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 29 Jan 2022 15:47:29 +0100 Subject: [PATCH] 4.14-stable patches added patches: netfilter-nft_payload-do-not-update-layer-4-checksum-when-mangling-fragments.patch --- ...r-4-checksum-when-mangling-fragments.patch | 33 +++++++++++++++++++ queue-4.14/series | 1 + 2 files changed, 34 insertions(+) create mode 100644 queue-4.14/netfilter-nft_payload-do-not-update-layer-4-checksum-when-mangling-fragments.patch diff --git a/queue-4.14/netfilter-nft_payload-do-not-update-layer-4-checksum-when-mangling-fragments.patch b/queue-4.14/netfilter-nft_payload-do-not-update-layer-4-checksum-when-mangling-fragments.patch new file mode 100644 index 00000000000..489212bd57b --- /dev/null +++ b/queue-4.14/netfilter-nft_payload-do-not-update-layer-4-checksum-when-mangling-fragments.patch @@ -0,0 +1,33 @@ +From 4e1860a3863707e8177329c006d10f9e37e097a8 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Wed, 5 Jan 2022 16:09:57 +0100 +Subject: netfilter: nft_payload: do not update layer 4 checksum when mangling fragments + +From: Pablo Neira Ayuso + +commit 4e1860a3863707e8177329c006d10f9e37e097a8 upstream. + +IP fragments do not come with the transport header, hence skip bogus +layer 4 checksum updates. + +Fixes: 1814096980bb ("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields") +Reported-and-tested-by: Steffen Weinreich +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nft_payload.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -194,6 +194,9 @@ static int nft_payload_l4csum_offset(con + struct sk_buff *skb, + unsigned int *l4csum_offset) + { ++ if (pkt->xt.fragoff) ++ return -1; ++ + switch (pkt->tprot) { + case IPPROTO_TCP: + *l4csum_offset = offsetof(struct tcphdr, check); diff --git a/queue-4.14/series b/queue-4.14/series index cd10ee5cef3..39331c13160 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -4,3 +4,4 @@ scsi-zfcp-fix-failed-recovery-on-gone-remote-port-with-non-npiv-fcp-devices.patc udf-restore-i_lenalloc-when-inode-expansion-fails.patch udf-fix-null-ptr-deref-when-converting-from-inline-format.patch pm-wakeup-simplify-the-output-logic-of-pm_show_wakelocks.patch +netfilter-nft_payload-do-not-update-layer-4-checksum-when-mangling-fragments.patch -- 2.47.2