2 files changed, 9 insertions, 6 deletions

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 880a5ec6dce0..86961bec70ab 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -314,14 +314,15 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb->ip_summed = CHECKSUM_NONE;
 
-        ah = (struct ip_auth_hdr *)skb->data;
-        iph = ip_hdr(skb);
-        ihl = ip_hdrlen(skb);
 
         if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
                 goto out;
         nfrags = err;
 
+        ah = (struct ip_auth_hdr *)skb->data;
+        iph = ip_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
         work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
         if (!work_iph)
                 goto out;
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index ee82d4ef26ce..1aba54ae53c4 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -538,14 +538,16 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!pskb_may_pull(skb, ah_hlen))
                 goto out;
 
-        ip6h = ipv6_hdr(skb);
-
-        skb_push(skb, hdr_len);
 
         if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
                 goto out;
         nfrags = err;
 
+        ah = (struct ip_auth_hdr *)skb->data;
+        ip6h = ipv6_hdr(skb);
+
+        skb_push(skb, hdr_len);
+
         work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
         if (!work_iph)
                 goto out;