diff -uNrp linux-2.6.29-rc8.orig/net/ipv4/ip_fragment.c kernel/net/ipv4/ip_fragment.c
--- linux-2.6.29-rc8.orig/net/ipv4/ip_fragment.c	2009-03-06 16:36:31.384361937 +0100
+++ kernel-netns/net/ipv4/ip_fragment.c	2009-03-05 14:31:03.443267582 +0100
@@ -84,7 +84,7 @@ int ip_frag_mem(struct net *net)
 	return atomic_read(&net->ipv4.frags.mem);
 }
 
-static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
+static int ip_frag_reasm(struct net *net, struct ipq *qp, struct sk_buff *prev,
 			 struct net_device *dev);
 
 struct ip4_create_arg {
@@ -296,7 +296,7 @@ static int ip_frag_reinit(struct ipq *qp
 }
 
 /* Add new segment to existing queue. */
-static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+static int ip_frag_queue(struct net *net, struct ipq *qp, struct sk_buff *skb)
 {
 	struct sk_buff *prev, *next;
 	struct net_device *dev;
@@ -445,7 +445,7 @@ static int ip_frag_queue(struct ipq *qp,
 
 	if (qp->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
 	    qp->q.meat == qp->q.len)
-		return ip_frag_reasm(qp, prev, dev);
+		return ip_frag_reasm(net, qp, prev, dev);
 
 	write_lock(&ip4_frags.lock);
 	list_move_tail(&qp->q.lru_list, &qp->q.net->lru_list);
@@ -460,7 +460,7 @@ err:
 
 /* Build a new IP datagram from all its fragments. */
 
-static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
+static int ip_frag_reasm(struct net *net, struct ipq *qp, struct sk_buff *prev,
 			 struct net_device *dev)
 {
 	struct iphdr *iph;
@@ -509,7 +509,6 @@ static int ip_frag_reasm(struct ipq *qp,
 	if (skb_shinfo(head)->frag_list) {
 		struct sk_buff *clone;
 		int i, plen = 0;
-
 		if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
 			goto out_nomem;
 		clone->next = head->next;
@@ -548,7 +547,7 @@ static int ip_frag_reasm(struct ipq *qp,
 	iph = ip_hdr(head);
 	iph->frag_off = 0;
 	iph->tot_len = htons(len);
-	IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMOKS);
+	IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
 	qp->q.fragments = NULL;
 	return 0;
 
@@ -562,7 +561,7 @@ out_oversize:
 		printk(KERN_INFO "Oversized IP packet from %pI4.\n",
 			&qp->saddr);
 out_fail:
-	IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
+	IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
 	return err;
 }
 
@@ -585,7 +584,7 @@ int ip_defrag(struct sk_buff *skb, u32 u
 
 		spin_lock(&qp->q.lock);
 
-		ret = ip_frag_queue(qp, skb);
+		ret = ip_frag_queue(net, qp, skb);
 
 		spin_unlock(&qp->q.lock);
 		ipq_put(qp);