2 files changed, 13 insertions, 3 deletions

diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index fe5cda0deb39..5231652a95d9 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -42,6 +42,9 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
 
 static int make_writable(struct sk_buff *skb, int write_len)
 {
+        if (!pskb_may_pull(skb, write_len))
+                return -ENOMEM;
+
         if (!skb_cloned(skb) || skb_clone_writable(skb, write_len))
                 return 0;
 
@@ -70,6 +73,8 @@ static int __pop_vlan_tci(struct sk_buff *skb, __be16 *current_tci)
 
         vlan_set_encap_proto(skb, vhdr);
         skb->mac_header += VLAN_HLEN;
+        if (skb_network_offset(skb) < ETH_HLEN)
+                skb_set_network_header(skb, ETH_HLEN);
         skb_reset_mac_len(skb);
 
         return 0;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 7228ec3faf19..91d66b7e64ac 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -265,8 +265,11 @@ void ovs_dp_process_received_packet(struct vport *p, struct sk_buff *skb)
                 upcall.key = &key;
                 upcall.userdata = NULL;
                 upcall.portid = ovs_vport_find_upcall_portid(p, skb);
-                ovs_dp_upcall(dp, skb, &upcall);
-                consume_skb(skb);
+                error = ovs_dp_upcall(dp, skb, &upcall);
+                if (unlikely(error))
+                        kfree_skb(skb);
+                else
+                        consume_skb(skb);
                 stats_counter = &stats->n_missed;
                 goto out;
         }
@@ -404,7 +407,7 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
 {
         struct ovs_header *upcall;
         struct sk_buff *nskb = NULL;
-        struct sk_buff *user_skb; /* to be queued to userspace */
+        struct sk_buff *user_skb = NULL; /* to be queued to userspace */
         struct nlattr *nla;
         struct genl_info info = {
                 .dst_sk = ovs_dp_get_net(dp)->genl_sock,
@@ -494,9 +497,11 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
         ((struct nlmsghdr *) user_skb->data)->nlmsg_len = user_skb->len;
 
         err = genlmsg_unicast(ovs_dp_get_net(dp), user_skb, upcall_info->portid);
+        user_skb = NULL;
 out:
         if (err)
                 skb_tx_error(skb);
+        kfree_skb(user_skb);
         kfree_skb(nskb);
         return err;
 }