1 files changed, 5 insertions, 1 deletions

diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index ac858c480f2f..a2267f80febb 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -29,6 +29,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
         u8 frag_hdr_sz = sizeof(struct frag_hdr);
         __wsum csum;
         int tnl_hlen;
+        int err;
 
         mss = skb_shinfo(skb)->gso_size;
         if (unlikely(skb->len <= mss))
@@ -90,7 +91,10 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 /* Find the unfragmentable header and shift it left by frag_hdr_sz
                  * bytes to insert fragment header.
                  */
-                unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                err = ip6_find_1stfragopt(skb, &prevhdr);
+                if (err < 0)
+                        return ERR_PTR(err);
+                unfrag_ip6hlen = err;
                 nexthdr = *prevhdr;
                 *prevhdr = NEXTHDR_FRAGMENT;
                 unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +