2 files changed, 2 insertions, 4 deletions

diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 6d2a08205111..dc442fb791b0 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -177,8 +177,7 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
 
         protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum,
                                          (*pskb)->len - extoff);
-        if (protoff < 0 || protoff > (*pskb)->len ||
-            pnum == NEXTHDR_FRAGMENT) {
+        if (protoff > (*pskb)->len || pnum == NEXTHDR_FRAGMENT) {
                 DEBUGP("proto header not found\n");
                 return NF_ACCEPT;
         }
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 0be790d250f9..8814b95b2326 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -168,8 +168,7 @@ icmpv6_error_message(struct sk_buff *skb,
                                            skb->len - inip6off
                                                     - sizeof(struct ipv6hdr));
 
-        if ((inprotoff < 0) || (inprotoff > skb->len) ||
-            (inprotonum == NEXTHDR_FRAGMENT)) {
+        if ((inprotoff > skb->len) || (inprotonum == NEXTHDR_FRAGMENT)) {
                 DEBUGP("icmpv6_error: Can't get protocol header in ICMPv6 payload.\n");
                 return -NF_ACCEPT;
         }