[NETFILTER]: nf_conntrack: Fix TCP/UDP HW checksum handling for IPv6 packet

If skb->ip_summed is CHECKSUM_HW here, skb->csum includes checksum
of actual IPv6 header and extension headers. Then such excess
checksum must be subtruct when nf_conntrack calculates TCP/UDP checksum
with pseudo IPv6 header. Spotted by Ben Skeggs.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 6 insertions, 2 deletions

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index df99138c3b3b..6492ed66fb3c 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -864,7 +864,9 @@ static int csum6(const struct sk_buff *skb, unsigned int dataoff)
 {
         return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
                                skb->len - dataoff, IPPROTO_TCP,
-                               skb->ip_summed == CHECKSUM_HW ? skb->csum
+                               skb->ip_summed == CHECKSUM_HW
+                               ? csum_sub(skb->csum,
+                                          skb_checksum(skb, 0, dataoff, 0))
                                : skb_checksum(skb, dataoff, skb->len - dataoff,
                                               0));
 }
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 4264dd079a16..831d206344e0 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -161,7 +161,9 @@ static int csum6(const struct sk_buff *skb, unsigned int dataoff)
 {
         return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
                                skb->len - dataoff, IPPROTO_UDP,
-                               skb->ip_summed == CHECKSUM_HW ? skb->csum
+                               skb->ip_summed == CHECKSUM_HW
+                               ? csum_sub(skb->csum,
+                                          skb_checksum(skb, 0, dataoff, 0))
                                : skb_checksum(skb, dataoff, skb->len - dataoff,
                                               0));
 }