2 files changed, 4 insertions, 3 deletions

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index a0902fbdb4e1..281aee42d3f0 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -883,8 +883,8 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
          */
         max_headroom += LL_RESERVED_SPACE(tdev);
 
-        if (skb_headroom(skb) < max_headroom ||
-            skb_cloned(skb) || skb_shared(skb)) {
+        if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
+            (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
                 struct sk_buff *new_skb;
 
                 if (!(new_skb = skb_realloc_headroom(skb, max_headroom)))
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1efa95a99f45..eb20bb690abd 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -532,7 +532,8 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
          */
         max_headroom = LL_RESERVED_SPACE(tdev)+sizeof(struct iphdr);
 
-        if (skb_headroom(skb) < max_headroom || skb_cloned(skb) || skb_shared(skb)) {
+        if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
+            (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);