2 files changed, 5 insertions, 3 deletions

diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 9f481cfdf77d..e8090f099eb8 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -352,19 +352,21 @@ out:
  */
 int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface)
 {
+        static const size_t tvlv_padding = sizeof(__be32);
         struct batadv_elp_packet *elp_packet;
         unsigned char *elp_buff;
         u32 random_seqno;
         size_t size;
         int res = -ENOMEM;
 
-        size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN;
+        size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN + tvlv_padding;
         hard_iface->bat_v.elp_skb = dev_alloc_skb(size);
         if (!hard_iface->bat_v.elp_skb)
                 goto out;
 
         skb_reserve(hard_iface->bat_v.elp_skb, ETH_HLEN + NET_IP_ALIGN);
-        elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
+        elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb,
+                                BATADV_ELP_HLEN + tvlv_padding);
         elp_packet = (struct batadv_elp_packet *)elp_buff;
 
         elp_packet->packet_type = BATADV_ELP;
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 0fddc17106bd..5b71a289d04f 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -275,7 +275,7 @@ batadv_frag_merge_packets(struct hlist_head *chain)
         kfree(entry);
 
         packet = (struct batadv_frag_packet *)skb_out->data;
-        size = ntohs(packet->total_size);
+        size = ntohs(packet->total_size) + hdr_size;
 
         /* Make room for the rest of the fragments. */
         if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {