1 files changed, 3 insertions, 2 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 150615758fdc..387030d2483c 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1099,7 +1099,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 sk->sk_sndmsg_page = NULL;
                 sk->sk_sndmsg_off = 0;
                 exthdrlen = rt->u.dst.header_len + (opt ? opt->opt_flen : 0) -
-                            rt->u.dst.nfheader_len;
+                            rt->nfheader_len;
                 length += exthdrlen;
                 transhdrlen += exthdrlen;
         } else {
@@ -1114,7 +1114,8 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 
         hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
 
-        fragheaderlen = sizeof(struct ipv6hdr) + rt->u.dst.nfheader_len + (opt ? opt->opt_nflen : 0);
+        fragheaderlen = sizeof(struct ipv6hdr) + rt->nfheader_len +
+                        (opt ? opt->opt_nflen : 0);
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
 
         if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {