2 files changed, 9 insertions, 7 deletions

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ccdc59df015f..fcb35cd5ccfd 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -278,10 +278,12 @@ void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
                                    skb_network_header(skb);
         serr->port = port;
 
-        skb->h.raw = payload;
-        if (!skb_pull(skb, payload - skb->data) ||
-            sock_queue_err_skb(sk, skb))
-                kfree_skb(skb);
+        if (skb_pull(skb, payload - skb->data) != NULL) {
+                skb_reset_transport_header(skb);
+                if (sock_queue_err_skb(sk, skb) == 0)
+                        return;
+        }
+        kfree_skb(skb);
 }
 
 void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 info)
@@ -314,8 +316,8 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
         serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
         serr->port = port;
 
-        skb->h.raw = skb->tail;
         __skb_pull(skb, skb->tail - skb->data);
+        skb_reset_transport_header(skb);
 
         if (sock_queue_err_skb(sk, skb))
                 kfree_skb(skb);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index feba6b197fe9..f16f4f0c5814 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -231,8 +231,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
                                   skb_network_header(skb);
         serr->port = port;
 
-        skb->h.raw = payload;
         __skb_pull(skb, payload - skb->data);
+        skb_reset_transport_header(skb);
 
         if (sock_queue_err_skb(sk, skb))
                 kfree_skb(skb);
@@ -268,8 +268,8 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
         serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
         serr->port = fl->fl_ip_dport;
 
-        skb->h.raw = skb->tail;
         __skb_pull(skb, skb->tail - skb->data);
+        skb_reset_transport_header(skb);
 
         if (sock_queue_err_skb(sk, skb))
                 kfree_skb(skb);