[IPCOMP]: Fetch nexthdr before ipch is destroyed

When I moved the nexthdr setting out of IPComp I accidently moved
the reading of ipch->nexthdr after the decompression.  Unfortunately
this means that we'd be reading from a stale ipch pointer which
doesn't work very well.

This patch moves the reading up so that we get the correct nexthdr
value.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 4 insertions, 1 deletions

diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index f4af99ad8fdb..b79cdbee68a9 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -74,6 +74,7 @@ out:
 
 static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
 {
+        int nexthdr;
         int err = -ENOMEM;
         struct ip_comp_hdr *ipch;
 
@@ -84,13 +85,15 @@ static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
 
         /* Remove ipcomp header and decompress original payload */
         ipch = (void *)skb->data;
+        nexthdr = ipch->nexthdr;
+
         skb->transport_header = skb->network_header + sizeof(*ipch);
         __skb_pull(skb, sizeof(*ipch));
         err = ipcomp_decompress(x, skb);
         if (err)
                 goto out;
 
-        err = ipch->nexthdr;
+        err = nexthdr;
 
 out:
         return err;