sctp_hdr(skb) only works when skb->transport_header is set
properly.
But in the path of nf_conntrack_in:
sctp_packet() -> sctp_error() -> sctp_compute_cksum().
skb->transport_header is not guaranteed to be right value
for sctp. It will cause to fail to check the checksum for
sctp packets.
So fix it by setting skb transport_header before calling
sctp_compute_cksum().
Fixes: e6d8b64b34aa ("net: sctp: fix and consolidate SCTP checksumming code")
Reported-by: Li Shuang <shuali@xxxxxxxxxx>
Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx>
Acked-by: Neil Horman <nhorman@xxxxxxxxxxxxx>
---
net/netfilter/nf_conntrack_proto_sctp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index d53e3e7..6b53cd2 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -343,7 +343,9 @@ static bool sctp_error(struct sk_buff *skb,
logmsg = "nf_ct_sctp: failed to read header ";
goto out_invalid;
}
- sh = (const struct sctphdr *)(skb->data + dataoff);
+ /* sctp_compute_cksum() depends on correct transport header */
+ skb_set_transport_header(skb, dataoff);
+ sh = sctp_hdr(skb);
if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
logmsg = "nf_ct_sctp: bad CRC ";
goto out_invalid;
--
2.1.0
