3 files changed, 16 insertions, 4 deletions

diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 6ccd32b30809..864fbbc7b24d 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -40,11 +40,15 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
         else {
 #ifdef CONFIG_BRIDGE_NETFILTER
                 /* ip_refrag calls ip_fragment, doesn't copy the MAC header. */
-                nf_bridge_maybe_copy_header(skb);
+                if (nf_bridge_maybe_copy_header(skb))
+                        kfree_skb(skb);
+                else
 #endif
-                skb_push(skb, ETH_HLEN);
+                {
+                        skb_push(skb, ETH_HLEN);
 
-                dev_queue_xmit(skb);
+                        dev_queue_xmit(skb);
+                }
         }
 
         return 0;
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index f55ef682ef84..b1211d5342f6 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -386,12 +386,17 @@ void br_features_recompute(struct net_bridge *br)
                         checksum = 0;
 
                 if (feature & NETIF_F_GSO)
-                        feature |= NETIF_F_TSO;
+                        feature |= NETIF_F_GSO_SOFTWARE;
                 feature |= NETIF_F_GSO;
 
                 features &= feature;
         }
 
+        if (!(checksum & NETIF_F_ALL_CSUM))
+                features &= ~NETIF_F_SG;
+        if (!(features & NETIF_F_SG))
+                features &= ~NETIF_F_GSO_MASK;
+
         br->dev->features = features | checksum | NETIF_F_LLTX |
                             NETIF_F_GSO_ROBUST;
 }
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 02693a230dc1..9f950db3b76f 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -74,6 +74,9 @@ static void ulog_send(unsigned int nlgroup)
         if (timer_pending(&ub->timer))
                 del_timer(&ub->timer);
 
+        if (!ub->skb)
+                return;
+
         /* last nlmsg needs NLMSG_DONE */
         if (ub->qlen > 1)
                 ub->lastnlh->nlmsg_type = NLMSG_DONE;