2 files changed, 9 insertions, 3 deletions

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 8fab9b0bb203..1334d7e56f02 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1319,11 +1319,15 @@ static void neigh_proxy_process(unsigned long arg)
 
                 if (tdif <= 0) {
                         struct net_device *dev = skb->dev;
+
                         __skb_unlink(skb, &tbl->proxy_queue);
-                        if (tbl->proxy_redo && netif_running(dev))
+                        if (tbl->proxy_redo && netif_running(dev)) {
+                                rcu_read_lock();
                                 tbl->proxy_redo(skb);
-                        else
+                                rcu_read_unlock();
+                        } else {
                                 kfree_skb(skb);
+                        }
 
                         dev_put(dev);
                 } else if (!sched_next || tdif < sched_next)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index adf84dd8c7b5..52622517e0d8 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -558,13 +558,14 @@ int __netpoll_rx(struct sk_buff *skb)
         if (skb_shared(skb))
                 goto out;
 
-        iph = (struct iphdr *)skb->data;
         if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                 goto out;
+        iph = (struct iphdr *)skb->data;
         if (iph->ihl < 5 || iph->version != 4)
                 goto out;
         if (!pskb_may_pull(skb, iph->ihl*4))
                 goto out;
+        iph = (struct iphdr *)skb->data;
         if (ip_fast_csum((u8 *)iph, iph->ihl) != 0)
                 goto out;
 
@@ -579,6 +580,7 @@ int __netpoll_rx(struct sk_buff *skb)
         if (pskb_trim_rcsum(skb, len))
                 goto out;
 
+        iph = (struct iphdr *)skb->data;
         if (iph->protocol != IPPROTO_UDP)
                 goto out;