diff --git a/[refs] b/[refs]
index 22d43b731728..3c2edef52512 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b82f08ea162edeee6c2c70c6c4321bea4763fa35
+refs/heads/master: 4909122fb8350e70c347f1201256908a92058044
diff --git a/trunk/drivers/net/tun.c b/trunk/drivers/net/tun.c
index 3f0cdc14be82..8d82511aa1bc 100644
--- a/trunk/drivers/net/tun.c
+++ b/trunk/drivers/net/tun.c
@@ -565,6 +565,10 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun,
 		if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
 			return -EFAULT;
 
+		if ((gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
+		    gso.csum_start + gso.csum_offset + 2 > gso.hdr_len)
+			gso.hdr_len = gso.csum_start + gso.csum_offset + 2;
+
 		if (gso.hdr_len > len)
 			return -EINVAL;
 		offset += sizeof(pi);