1 files changed, 1 insertions, 7 deletions

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index ad1fcda6898b..f1171b744650 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -469,7 +469,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 
         /* all original skbs are linked into the NFCT_FRAG6_CB(head).orig */
         fp = skb_shinfo(head)->frag_list;
-        if (NFCT_FRAG6_CB(fp)->orig == NULL)
+        if (fp && NFCT_FRAG6_CB(fp)->orig == NULL)
                 /* at above code, head skb is divided into two skbs. */
                 fp = fp->next;
 
@@ -595,12 +595,6 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
         hdr = ipv6_hdr(clone);
         fhdr = (struct frag_hdr *)skb_transport_header(clone);
 
-        if (!(fhdr->frag_off & htons(0xFFF9))) {
-                pr_debug("Invalid fragment offset\n");
-                /* It is not a fragmented frame */
-                goto ret_orig;
-        }
-
         if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
                 nf_ct_frag6_evictor();