1 files changed, 8 insertions, 8 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 30c7d35dd862..1b62343f5837 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3458,8 +3458,6 @@ static void sock_rmem_free(struct sk_buff *skb)
  */
 int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 {
-        int len = skb->len;
-
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
             (unsigned int)sk->sk_rcvbuf)
                 return -ENOMEM;
@@ -3474,7 +3472,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 
         skb_queue_tail(&sk->sk_error_queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, len);
+                sk->sk_data_ready(sk);
         return 0;
 }
 EXPORT_SYMBOL(sock_queue_err_skb);
@@ -3937,12 +3935,14 @@ EXPORT_SYMBOL_GPL(skb_scrub_packet);
 unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
 {
         const struct skb_shared_info *shinfo = skb_shinfo(skb);
-        unsigned int hdr_len;
 
         if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
-                hdr_len = tcp_hdrlen(skb);
-        else
-                hdr_len = sizeof(struct udphdr);
-        return hdr_len + shinfo->gso_size;
+                return tcp_hdrlen(skb) + shinfo->gso_size;
+
+        /* UFO sets gso_size to the size of the fragmentation
+         * payload, i.e. the size of the L4 (UDP) header is already
+         * accounted for.
+         */
+        return shinfo->gso_size;
 }
 EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);