Patch "netfilter: don't track fragmented packets" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

netfilter: don't track fragmented packets

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
netfilter-don-t-track-fragmented-packets.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Florian Westphal <[email protected]>
Date: Fri, 3 Mar 2017 21:44:00 +0100
Subject: netfilter: don't track fragmented packets

From: Florian Westphal <[email protected]>

[ Upstream commit 7b4fdf77a450ec0fdcb2f677b080ddbf2c186544 ]

Andrey reports syzkaller splat caused by

NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));

in ipv4 nat. But this assertion (and the comment) are wrong, this function does see fragments when IP_NODEFRAG setsockopt is used.

As conntrack doesn't track packets without complete l4 header, only the first fragment is tracked.

Because applying nat to first packet but not the rest makes no sense this also turns off tracking of all fragments.

---
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |    4 ++++
 net/ipv4/netfilter/nf_nat_l3proto_ipv4.c       |    5 -----
 2 files changed, 4 insertions(+), 5 deletions(-)

@@ -158,6 +158,10 @@ static unsigned int ipv4_conntrack_local
 	if (skb->len < sizeof(struct iphdr) ||
 	    ip_hdrlen(skb) < sizeof(struct iphdr))
 		return NF_ACCEPT;
+
+	if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */
+		return NF_ACCEPT;
+
 	return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
 }
 

@@ -255,11 +255,6 @@ nf_nat_ipv4_fn(void *priv, struct sk_buf
 	/* maniptype == SRC for postrouting. */
 	enum nf_nat_manip_type maniptype = HOOK2MANIP(state->hook);
 
-	/* We never see fragments: conntrack defrags on pre-routing
-	 * and local-out, and nf_nat_out protects post-routing.
-	 */
-	NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
-
 	ct = nf_ct_get(skb, &ctinfo);
 	/* Can't track?  It's not due to stress, or conntrack would
 	 * have dropped it.  Hence it's the user's responsibilty to

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/netfilter-don-t-track-fragmented-packets.patch