1 files changed, 12 insertions, 8 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 58f6288e9ba5..bf8a58a1c32d 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -597,7 +597,10 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
         int ptr, offset = 0, err = 0;
         u8 *prevhdr, nexthdr = 0;
 
-        hlen = ip6_find_1stfragopt(skb, &prevhdr);
+        err = ip6_find_1stfragopt(skb, &prevhdr);
+        if (err < 0)
+                goto fail;
+        hlen = err;
         nexthdr = *prevhdr;
 
         mtu = ip6_skb_dst_mtu(skb);
@@ -1463,6 +1466,11 @@ alloc_new_skb:
                          */
                         alloclen += sizeof(struct frag_hdr);
 
+                        copy = datalen - transhdrlen - fraggap;
+                        if (copy < 0) {
+                                err = -EINVAL;
+                                goto error;
+                        }
                         if (transhdrlen) {
                                 skb = sock_alloc_send_skb(sk,
                                                 alloclen + hh_len,
@@ -1512,13 +1520,9 @@ alloc_new_skb:
                                 data += fraggap;
                                 pskb_trim_unique(skb_prev, maxfraglen);
                         }
-                        copy = datalen - transhdrlen - fraggap;
-
-                        if (copy < 0) {
-                                err = -EINVAL;
-                                kfree_skb(skb);
-                                goto error;
-                        } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
+                        if (copy > 0 &&
+                            getfrag(from, data + transhdrlen, offset,
+                                    copy, fraggap, skb) < 0) {
                                 err = -EFAULT;
                                 kfree_skb(skb);
                                 goto error;