diff --git a/[refs] b/[refs]
index 2d57e73dd037..ed7def97d954 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 58d5a0257d2fd89fbe4451f704193cc95b0a9c97
+refs/heads/master: db898aa2ef6529fa80891e754d353063611c77de
diff --git a/trunk/net/ipv4/netfilter/ipt_ecn.c b/trunk/net/ipv4/netfilter/ipt_ecn.c
index aaa85be1b2d8..2b57e52c746c 100644
--- a/trunk/net/ipv4/netfilter/ipt_ecn.c
+++ b/trunk/net/ipv4/netfilter/ipt_ecn.c
@@ -25,7 +25,8 @@ MODULE_LICENSE("GPL");
 static inline bool match_ip(const struct sk_buff *skb,
 			    const struct ipt_ecn_info *einfo)
 {
-	return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect;
+	return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^
+	       !!(einfo->invert & IPT_ECN_OP_MATCH_IP);
 }
 
 static inline bool match_tcp(const struct sk_buff *skb,