[NETFILTER]: In conntrack, do not fragment TSO packets by accident.

diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 62c3ea2e5dd833ff70576e5a9ef2457649ead06c..4c357ef5da264306736d51743614d48700f40171 100644 (file)
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -201,7 +201,8 @@ static unsigned int ip_refrag(unsigned int hooknum,
        /* Local packets are never produced too large for their
           interface.  We degfragment them at LOCAL_OUT, however,
           so we have to refragment them here. */
-       if ((*pskb)->len > dst_pmtu(&rt->u.dst)) {
+       if ((*pskb)->len > dst_pmtu(&rt->u.dst) &&
+           !skb_shinfo(*pskb)->tso_size) {
                /* No hook can be after us, so this should be OK. */
                ip_fragment(*pskb, okfn);
                return NF_STOLEN;