1 files changed, 5 insertions, 4 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 1b0758254ba0..54ffe9db9b02 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1068,8 +1068,8 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
                          */
                         skb_reset_mac_header(skb2);
 
-                        if (skb2->nh.raw < skb2->data ||
-                            skb2->nh.raw > skb2->tail) {
+                        if (skb_network_header(skb2) < skb2->data ||
+                            skb_network_header(skb2) > skb2->tail) {
                                 if (net_ratelimit())
                                         printk(KERN_CRIT "protocol %04x is "
                                                "buggy, dev %s\n",
@@ -1207,7 +1207,7 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, int features)
         BUG_ON(skb_shinfo(skb)->frag_list);
 
         skb_reset_mac_header(skb);
-        skb->mac_len = skb->nh.raw - skb->data;
+        skb->mac_len = skb->nh.raw - skb->mac.raw;
         __skb_pull(skb, skb->mac_len);
 
         if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
@@ -1224,7 +1224,8 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, int features)
                                 segs = ERR_PTR(err);
                                 if (err || skb_gso_ok(skb, features))
                                         break;
-                                __skb_push(skb, skb->data - skb->nh.raw);
+                                __skb_push(skb, (skb->data -
+                                                 skb_network_header(skb)));
                         }
                         segs = ptype->gso_segment(skb, features);
                         break;