1 files changed, 12 insertions, 8 deletions

diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index 3bb3a891a424..d3cfaf9c7a08 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -46,11 +46,12 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
         unsigned int mss;
         unsigned int unfrag_ip6hlen, unfrag_len;
         struct frag_hdr *fptr;
-        u8 *mac_start, *prevhdr;
+        u8 *packet_start, *prevhdr;
         u8 nexthdr;
         u8 frag_hdr_sz = sizeof(struct frag_hdr);
         int offset;
         __wsum csum;
+        int tnl_hlen;
 
         mss = skb_shinfo(skb)->gso_size;
         if (unlikely(skb->len <= mss))
@@ -83,9 +84,11 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
         skb->ip_summed = CHECKSUM_NONE;
 
         /* Check if there is enough headroom to insert fragment header. */
-        if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
-            pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
-                goto out;
+        tnl_hlen = skb_tnl_header_len(skb);
+        if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) {
+                if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz))
+                        goto out;
+        }
 
         /* Find the unfragmentable header and shift it left by frag_hdr_sz
          * bytes to insert fragment header.
@@ -93,11 +96,12 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
         unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
         nexthdr = *prevhdr;
         *prevhdr = NEXTHDR_FRAGMENT;
-        unfrag_len = skb_network_header(skb) - skb_mac_header(skb) +
-                     unfrag_ip6hlen;
-        mac_start = skb_mac_header(skb);
-        memmove(mac_start-frag_hdr_sz, mac_start, unfrag_len);
+        unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +
+                     unfrag_ip6hlen + tnl_hlen;
+        packet_start = (u8 *) skb->head + SKB_GSO_CB(skb)->mac_offset;
+        memmove(packet_start-frag_hdr_sz, packet_start, unfrag_len);
 
+        SKB_GSO_CB(skb)->mac_offset -= frag_hdr_sz;
         skb->mac_header -= frag_hdr_sz;
         skb->network_header -= frag_hdr_sz;