1 files changed, 6 insertions, 0 deletions

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 156680ddb042..5a6fcf349bdf 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -970,6 +970,12 @@ static int tcp_packet(struct nf_conn *conntrack,
                                 conntrack->timeout.function((unsigned long)
                                                             conntrack);
                         return -NF_REPEAT;
+                } else {
+                        write_unlock_bh(&tcp_lock);
+                        if (LOG_INVALID(IPPROTO_TCP))
+                                nf_log_packet(pf, 0, skb, NULL, NULL,
+                                              NULL, "nf_ct_tcp: invalid SYN");
+                        return -NF_ACCEPT;
                 }
         case TCP_CONNTRACK_CLOSE:
                 if (index == TCP_RST_SET