From 08f7882637f2db5b98f521498eeaf94770383a6e Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi Date: Mon, 19 Oct 2026 11:54:03 +0200 Subject: [PATCH] netfilter: flowtable: reset transport header after nf_flow_encap_pop() nf_flow_encap_pop() pulls vlan/pppoe or ip tunnel headers and resets the network header, but leaves the transport header pointing into the removed outer header. Reset the transport header to the inner L4 header, otherwise later consumers (e.g. GSO segmentation) parse a bogus header. Fixes: 4cd91f7c290f ("netfilter: flowtable: add vlan support") Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_flow_table_ip.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 2dec15d402ca..bb894c4f2b4a 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -502,6 +502,7 @@ static int nf_flow_offload_forward(struct nf_flowtable_ctx *ctx, nf_flow_encap_pop(ctx, skb, tuplehash); thoff -= ctx->offset; + skb_set_transport_header(skb, thoff); iph = ip_hdr(skb); nf_flow_nat_ip(flow, skb, thoff, dir, iph); @@ -1097,6 +1098,7 @@ static int nf_flow_offload_ipv6_forward(struct nf_flowtable_ctx *ctx, flow_offload_refresh(flow_table, flow, false); nf_flow_encap_pop(ctx, skb, tuplehash); + skb_set_transport_header(skb, sizeof(*ip6h)); ip6h = ipv6_hdr(skb); nf_flow_nat_ipv6(flow, skb, dir, ip6h);