2 files changed, 4 insertions, 4 deletions

diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 437070d1ffb1..79e98e21cdd7 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -1024,7 +1024,7 @@ static int gue_err(struct sk_buff *skb, u32 info)
         int ret;
 
         len = sizeof(struct udphdr) + sizeof(struct guehdr);
-        if (!pskb_may_pull(skb, len))
+        if (!pskb_may_pull(skb, transport_offset + len))
                 return -EINVAL;
 
         guehdr = (struct guehdr *)&udp_hdr(skb)[1];
@@ -1059,7 +1059,7 @@ static int gue_err(struct sk_buff *skb, u32 info)
 
         optlen = guehdr->hlen << 2;
 
-        if (!pskb_may_pull(skb, len + optlen))
+        if (!pskb_may_pull(skb, transport_offset + len + optlen))
                 return -EINVAL;
 
         guehdr = (struct guehdr *)&udp_hdr(skb)[1];
diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c
index 867474abe269..ec4e2ed95f36 100644
--- a/net/ipv6/fou6.c
+++ b/net/ipv6/fou6.c
@@ -94,7 +94,7 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         int ret;
 
         len = sizeof(struct udphdr) + sizeof(struct guehdr);
-        if (!pskb_may_pull(skb, len))
+        if (!pskb_may_pull(skb, transport_offset + len))
                 return -EINVAL;
 
         guehdr = (struct guehdr *)&udp_hdr(skb)[1];
@@ -129,7 +129,7 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         optlen = guehdr->hlen << 2;
 
-        if (!pskb_may_pull(skb, len + optlen))
+        if (!pskb_may_pull(skb, transport_offset + len + optlen))
                 return -EINVAL;
 
         guehdr = (struct guehdr *)&udp_hdr(skb)[1];