1 files changed, 10 insertions, 1 deletions

diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index c28e5c287447..0c17dec11c8d 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -64,6 +64,14 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
         struct inet6_protocol *ops;
         int proto;
 
+        if (unlikely(skb_shinfo(skb)->gso_type &
+                     ~(SKB_GSO_UDP |
+                       SKB_GSO_DODGY |
+                       SKB_GSO_TCP_ECN |
+                       SKB_GSO_TCPV6 |
+                       0)))
+                goto out;
+
         if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
                 goto out;
 
@@ -111,7 +119,8 @@ unlock:
 
         for (skb = segs; skb; skb = skb->next) {
                 ipv6h = skb->nh.ipv6h;
-                ipv6h->payload_len = htons(skb->len - skb->mac_len);
+                ipv6h->payload_len = htons(skb->len - skb->mac_len -
+                                           sizeof(*ipv6h));
         }
 
 out: