1 files changed, 11 insertions, 10 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 614296a920c6..c1fa693511a1 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -441,9 +441,15 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
 #ifdef CONFIG_NETFILTER
         to->nfmark = from->nfmark;
         /* Connection association is same as pre-frag packet */
+        nf_conntrack_put(to->nfct);
         to->nfct = from->nfct;
         nf_conntrack_get(to->nfct);
         to->nfctinfo = from->nfctinfo;
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        nf_conntrack_put_reasm(to->nfct_reasm);
+        to->nfct_reasm = from->nfct_reasm;
+        nf_conntrack_get_reasm(to->nfct_reasm);
+#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
         nf_bridge_put(to->nf_bridge);
         to->nf_bridge = from->nf_bridge;
@@ -587,8 +593,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         skb->next = NULL;
                 }
 
-                if (tmp_hdr)
-                        kfree(tmp_hdr);
+                kfree(tmp_hdr);
 
                 if (err == 0) {
                         IP6_INC_STATS(IPSTATS_MIB_FRAGOKS);
@@ -1186,10 +1191,8 @@ int ip6_push_pending_frames(struct sock *sk)
 
 out:
         inet->cork.flags &= ~IPCORK_OPT;
-        if (np->cork.opt) {
-                kfree(np->cork.opt);
-                np->cork.opt = NULL;
-        }
+        kfree(np->cork.opt);
+        np->cork.opt = NULL;
         if (np->cork.rt) {
                 dst_release(&np->cork.rt->u.dst);
                 np->cork.rt = NULL;
@@ -1214,10 +1217,8 @@ void ip6_flush_pending_frames(struct sock *sk)
 
         inet->cork.flags &= ~IPCORK_OPT;
 
-        if (np->cork.opt) {
-                kfree(np->cork.opt);
-                np->cork.opt = NULL;
-        }
+        kfree(np->cork.opt);
+        np->cork.opt = NULL;
         if (np->cork.rt) {
                 dst_release(&np->cork.rt->u.dst);
                 np->cork.rt = NULL;