1 files changed, 3 insertions, 4 deletions

diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index bac1a91f0cbe..f1d41ea34785 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -35,9 +35,6 @@ static inline void ipip6_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
  * in it shall be filled in by x->type->output:
  *      tot_len
  *      check
- *
- * On exit, skb->h will be set to the start of the payload to be processed
- * by x->type->output and skb->nh will be set to the top IP header.
  */
 static int xfrm4_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 {
@@ -47,9 +44,11 @@ static int xfrm4_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
         int flags;
 
         iph = ip_hdr(skb);
-        skb->transport_header = skb->network_header;
 
         skb_set_network_header(skb, -x->props.header_len);
+        skb->mac_header = skb->network_header +
+                          offsetof(struct iphdr, protocol);
+        skb->transport_header = skb->network_header + sizeof(*iph);
         top_iph = ip_hdr(skb);
 
         top_iph->ihl = 5;