1 files changed, 8 insertions, 10 deletions

diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index eda64c1cb1e5..6f21b4377dbb 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -60,17 +60,9 @@ tcpmss_mangle_packet(struct sk_buff *skb,
         tcplen = skb->len - tcphoff;
         tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
 
-        /* Since it passed flags test in tcp match, we know it is is
-           not a fragment, and has data >= tcp header length.  SYN
-           packets should not contain data: if they did, then we risk
-           running over MTU, sending Frag Needed and breaking things
-           badly. --RR */
-        if (tcplen != tcph->doff*4) {
-                if (net_ratelimit())
-                        printk(KERN_ERR "xt_TCPMSS: bad length (%u bytes)\n",
-                               skb->len);
+        /* Header cannot be larger than the packet */
+        if (tcplen < tcph->doff*4)
                 return -1;
-        }
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
                 if (dst_mtu(skb_dst(skb)) <= minlen) {
@@ -115,6 +107,12 @@ tcpmss_mangle_packet(struct sk_buff *skb,
                 }
         }
 
+        /* There is data after the header so the option can't be added
+           without moving it, and doing so may make the SYN packet
+           itself too large. Accept the packet unmodified instead. */
+        if (tcplen > tcph->doff*4)
+                return 0;
+
         /*
          * MSS Option not found ?! add it..
          */