1 files changed, 4 insertions, 7 deletions

diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index aceee252503d..6b8e6d76a58b 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -71,6 +71,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                 goto out;
         }
 
+        memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
+
         /*
          * Store incoming device index. When the packet will
          * be queued, we cannot refer to skb->dev anymore.
@@ -84,14 +86,9 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
          */
         IP6CB(skb)->iif = skb->dst ? ((struct rt6_info *)skb->dst)->rt6i_idev->dev->ifindex : dev->ifindex;
 
-        if (skb->len < sizeof(struct ipv6hdr))
+        if (unlikely(!pskb_may_pull(skb, sizeof(*hdr))))
                 goto err;
 
-        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
-                goto drop;
-        }
-
         hdr = skb->nh.ipv6h;
 
         if (hdr->version != 6)
@@ -114,7 +111,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         }
 
         if (hdr->nexthdr == NEXTHDR_HOP) {
-                if (ipv6_parse_hopopts(skb) < 0) {
+                if (ipv6_parse_hopopts(&skb) < 0) {
                         IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
                         return 0;
                 }