1 files changed, 8 insertions, 3 deletions

diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index ac49f84fe2c3..5f983644373a 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -170,8 +170,10 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_DCCP:
                         if (!onlyproto && (nh + offset + 4 < skb->data ||
                              pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
-                                __be16 *ports = (__be16 *)exthdr;
+                                __be16 *ports;
 
+                                nh = skb_network_header(skb);
+                                ports = (__be16 *)(nh + offset);
                                 fl6->fl6_sport = ports[!!reverse];
                                 fl6->fl6_dport = ports[!reverse];
                         }
@@ -180,8 +182,10 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 
                 case IPPROTO_ICMPV6:
                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
-                                u8 *icmp = (u8 *)exthdr;
+                                u8 *icmp;
 
+                                nh = skb_network_header(skb);
+                                icmp = (u8 *)(nh + offset);
                                 fl6->fl6_icmp_type = icmp[0];
                                 fl6->fl6_icmp_code = icmp[1];
                         }
@@ -192,8 +196,9 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_MH:
                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                 struct ip6_mh *mh;
-                                mh = (struct ip6_mh *)exthdr;
 
+                                nh = skb_network_header(skb);
+                                mh = (struct ip6_mh *)(nh + offset);
                                 fl6->fl6_mh_type = mh->ip6mh_type;
                         }
                         fl6->flowi6_proto = nexthdr;