[PATCH v18 nf-next 1/4] netfilter: utils: nf_checksum(_partial) correct data!=networkheader

Eric Woudstra
2026-02-22T19:59:03Z

In the conntrack hook it may not always be the case that:
skb_network_header(skb) == skb->data, i.e. skb_network_offset(skb)
is zero.

This is problematic when L4 function nf_conntrack_handle_packet()
is accessing L3 data. This function uses thoff and ip_hdr()
to finds it's data. But it also calculates the checksum.
nf_checksum() and nf_checksum_partial() both use lower skb-checksum
functions that are based on using skb->data.

Adjust for skb_network_offset(skb), so that the checksum is calculated
correctly.

Signed-off-by: Eric Woudstra <ericwouds@gmail.com>
---
net/netfilter/utils.c | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/net/netfilter/utils.c b/net/netfilter/utils.c
index 008419db815a..4f8b5442b650 100644
--- a/net/netfilter/utils.c
+++ b/net/netfilter/utils.c
@@ -124,16 +124,25 @@ __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
unsigned int dataoff, u8 protocol,
unsigned short family)
{
+ unsigned int nhpull = skb_network_offset(skb);
__sum16 csum = 0;

+ if (WARN_ON_ONCE(!skb_pointer_if_linear(skb, nhpull, 0)))
+ return 0;
+
+ /* pull/push because the lower csum functions assume that
+ * skb_network_offset(skb) is zero.
+ */
+ __skb_pull(skb, nhpull);
switch (family) {
case AF_INET:
- csum = nf_ip_checksum(skb, hook, dataoff, protocol);
+ csum = nf_ip_checksum(skb, hook, dataoff - nhpull, protocol);
break;
case AF_INET6:
- csum = nf_ip6_checksum(skb, hook, dataoff, protocol);
+ csum = nf_ip6_checksum(skb, hook, dataoff - nhpull, protocol);
break;
}
+ __skb_push(skb, nhpull);

return csum;
}
@@ -143,18 +152,25 @@ __sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
unsigned int dataoff, unsigned int len,
u8 protocol, unsigned short family)
{
+ unsigned int nhpull = skb_network_offset(skb);
__sum16 csum = 0;

+ if (WARN_ON_ONCE(!skb_pointer_if_linear(skb, nhpull, 0)))
+ return 0;
+
+ /* See nf_checksum() */
+ __skb_pull(skb, nhpull);
switch (family) {
case AF_INET:
- csum = nf_ip_checksum_partial(skb, hook, dataoff, len,
- protocol);
+ csum = nf_ip_checksum_partial(skb, hook, dataoff - nhpull,
+ len, protocol);
break;
case AF_INET6:
- csum = nf_ip6_checksum_partial(skb, hook, dataoff, len,
- protocol);
+ csum = nf_ip6_checksum_partial(skb, hook, dataoff - nhpull,
+ len, protocol);
break;
}
+ __skb_push(skb, nhpull);

return csum;
}
--
2.53.0