3 files changed, 7 insertions, 4 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 09cb3f6dc40..bda6d004f9f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1666,7 +1666,7 @@ static inline int deliver_skb(struct sk_buff *skb,
 
 static inline bool skb_loop_sk(struct packet_type *ptype, struct sk_buff *skb)
 {
-        if (ptype->af_packet_priv == NULL)
+        if (!ptype->af_packet_priv || !skb->sk)
                 return false;
 
         if (ptype->id_match)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 76d4c2c3c89..fad649ae4de 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2192,7 +2192,8 @@ static int nlmsg_populate_fdb(struct sk_buff *skb,
                         goto skip;
 
                 err = nlmsg_populate_fdb_fill(skb, dev, ha->addr,
-                                              portid, seq, 0, NTF_SELF);
+                                              portid, seq,
+                                              RTM_NEWNEIGH, NTF_SELF);
                 if (err < 0)
                         return err;
 skip:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6e04b1fa11f..4007c1437fd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3379,10 +3379,12 @@ EXPORT_SYMBOL(__skb_warn_lro_forwarding);
 
 void kfree_skb_partial(struct sk_buff *skb, bool head_stolen)
 {
-        if (head_stolen)
+        if (head_stolen) {
+                skb_release_head_state(skb);
                 kmem_cache_free(skbuff_head_cache, skb);
-        else
+        } else {
                 __kfree_skb(skb);
+        }
 }
 EXPORT_SYMBOL(kfree_skb_partial);