2 files changed, 8 insertions, 4 deletions

diff --git a/net/ipv4/netfilter/nf_socket_ipv4.c b/net/ipv4/netfilter/nf_socket_ipv4.c
index e9293bdebba0..4824b1e183a1 100644
--- a/net/ipv4/netfilter/nf_socket_ipv4.c
+++ b/net/ipv4/netfilter/nf_socket_ipv4.c
@@ -108,10 +108,12 @@ struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb,
         int doff = 0;
 
         if (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) {
-                struct udphdr _hdr, *hp;
+                struct tcphdr _hdr;
+                struct udphdr *hp;
 
                 hp = skb_header_pointer(skb, ip_hdrlen(skb),
-                                        sizeof(_hdr), &_hdr);
+                                        iph->protocol == IPPROTO_UDP ?
+                                        sizeof(*hp) : sizeof(_hdr), &_hdr);
                 if (hp == NULL)
                         return NULL;
 
diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c
index ebb2bf84232a..f14de4b6d639 100644
--- a/net/ipv6/netfilter/nf_socket_ipv6.c
+++ b/net/ipv6/netfilter/nf_socket_ipv6.c
@@ -116,9 +116,11 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
         }
 
         if (tproto == IPPROTO_UDP || tproto == IPPROTO_TCP) {
-                struct udphdr _hdr, *hp;
+                struct tcphdr _hdr;
+                struct udphdr *hp;
 
-                hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
+                hp = skb_header_pointer(skb, thoff, tproto == IPPROTO_UDP ?
+                                        sizeof(*hp) : sizeof(_hdr), &_hdr);
                 if (hp == NULL)
                         return NULL;