1 files changed, 18 insertions, 1 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6491b7c1f975..5555eb86e549 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1567,6 +1567,21 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(tcp_add_backlog);
 
+int tcp_filter(struct sock *sk, struct sk_buff *skb)
+{
+        struct tcphdr *th = (struct tcphdr *)skb->data;
+        unsigned int eaten = skb->len;
+        int err;
+
+        err = sk_filter_trim_cap(sk, skb, th->doff * 4);
+        if (!err) {
+                eaten -= skb->len;
+                TCP_SKB_CB(skb)->end_seq -= eaten;
+        }
+        return err;
+}
+EXPORT_SYMBOL(tcp_filter);
+
 /*
  *      From tcp_input.c
  */
@@ -1679,8 +1694,10 @@ process:
 
         nf_reset(skb);
 
-        if (sk_filter(sk, skb))
+        if (tcp_filter(sk, skb))
                 goto discard_and_relse;
+        th = (const struct tcphdr *)skb->data;
+        iph = ip_hdr(skb);
 
         skb->dev = NULL;