This looks bogus for IPv6.

I would rather fix skb_checksum_setup_ip() and
skb_checksum_setup_ipv6(), since you already use correctly
skb_maybe_pull_tail() there.

In general, setting network and transport header at this point seems
extra work.

Yes, I missed the IPv6 case. ;-) Thanks Eric for pointing that out.
Looking further the below commit might have already resolved the issue.

commit e5d5decaedf41f5b03e6819789cc3ba8744d9f54
Author: Jason Wang [off-list ref]
Date:   Tue Mar 26 23:11:20 2013 +0000

    net: core: let skb_partial_csum_set() set transport header

    For untrusted packets with partial checksum, we need to set the transport he
    for precise packet length estimation. We can just let skb_pratial_csum_set()
    do this to avoid extra call to skb_flow_dissect() and simplify the caller.

    Cc: Eric Dumazet [off-list ref]
    Signed-off-by: Jason Wang [off-list ref]
    Acked-by: Eric Dumazet [off-list ref]
    Signed-off-by: David S. Miller [off-list ref]

The guest we were running was older to this and didn't have the above commit.

Thanks.

Venkat