2 files changed, 14 insertions, 2 deletions

diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 5493180f0d44..a16df5b27c84 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -211,6 +211,12 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                 break;
         
         case IPQ_COPY_PACKET:
+                if (entry->skb->ip_summed == CHECKSUM_HW &&
+                    (*errp = skb_checksum_help(entry->skb,
+                                               entry->info->outdev == NULL))) {
+                        read_unlock_bh(&queue_lock);
+                        return NULL;
+                }
                 if (copy_range == 0 || copy_range > entry->skb->len)
                         data_len = entry->skb->len;
                 else
@@ -381,6 +387,7 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         if (!skb_ip_make_writable(&e->skb, v->data_len))
                 return -ENOMEM;
         memcpy(e->skb->data, v->payload, v->data_len);
+        e->skb->ip_summed = CHECKSUM_NONE;
         e->skb->nfcache |= NFC_ALTERED;
 
         /*
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f6e288dc116e..ef29cfd936d3 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -158,9 +158,14 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                 tcp_port_rover = rover;
                 spin_unlock(&tcp_portalloc_lock);
 
-                /* Exhausted local port range during search? */
+                /* Exhausted local port range during search?  It is not
+                 * possible for us to be holding one of the bind hash
+                 * locks if this test triggers, because if 'remaining'
+                 * drops to zero, we broke out of the do/while loop at
+                 * the top level, not from the 'break;' statement.
+                 */
                 ret = 1;
-                if (remaining <= 0)
+                if (unlikely(remaining <= 0))
                         goto fail;
 
                 /* OK, here is the one we will use. */