1 files changed, 6 insertions, 1 deletions

diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 2fa108245413..e9bbfde19ac3 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -54,12 +54,14 @@ static int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
         int xfrm_nr = 0;
         int decaps = 0;
         int err = xfrm4_parse_spi(skb, ip_hdr(skb)->protocol, &spi, &seq);
+        unsigned int nhoff = offsetof(struct iphdr, protocol);
 
         if (err != 0)
                 goto drop;
 
         do {
                 const struct iphdr *iph = ip_hdr(skb);
+                int nexthdr;
 
                 if (xfrm_nr == XFRM_MAX_DEPTH)
                         goto drop;
@@ -82,9 +84,12 @@ static int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
                 if (xfrm_state_check_expire(x))
                         goto drop_unlock;
 
-                if (x->type->input(x, skb))
+                nexthdr = x->type->input(x, skb);
+                if (nexthdr <= 0)
                         goto drop_unlock;
 
+                skb_network_header(skb)[nhoff] = nexthdr;
+
                 /* only the first xfrm gets the encap type */
                 encap_type = 0;