1 files changed, 7 insertions, 5 deletions

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index fda321d814d6..d859a5c36e70 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -694,6 +694,7 @@ int dccp_invalid_packet(struct sk_buff *skb)
 {
         const struct dccp_hdr *dh;
         unsigned int cscov;
+        u8 dccph_doff;
 
         if (skb->pkt_type != PACKET_HOST)
                 return 1;
@@ -715,18 +716,19 @@ int dccp_invalid_packet(struct sk_buff *skb)
         /*
          * If P.Data Offset is too small for packet type, drop packet and return
          */
-        if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
-                DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff);
+        dccph_doff = dh->dccph_doff;
+        if (dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
+                DCCP_WARN("P.Data Offset(%u) too small\n", dccph_doff);
                 return 1;
         }
         /*
          * If P.Data Offset is too too large for packet, drop packet and return
          */
-        if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) {
-                DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff);
+        if (!pskb_may_pull(skb, dccph_doff * sizeof(u32))) {
+                DCCP_WARN("P.Data Offset(%u) too large\n", dccph_doff);
                 return 1;
         }
-
+        dh = dccp_hdr(skb);
         /*
          * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
          * has short sequence numbers), drop packet and return