1 files changed, 10 insertions, 12 deletions

diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 2eeadfa039cb..f4f62f086096 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -578,19 +578,12 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
         IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMREQDS);
 
         /* Jumbo payload inhibits frag. header */
-        if (hdr->payload_len==0) {
-                IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
-                                  skb_network_header_len(skb));
-                return -1;
-        }
+        if (hdr->payload_len==0)
+                goto fail_hdr;
+
         if (!pskb_may_pull(skb, (skb_transport_offset(skb) +
-                                 sizeof(struct frag_hdr)))) {
-                IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
-                                  skb_network_header_len(skb));
-                return -1;
-        }
+                                 sizeof(struct frag_hdr))))
+                goto fail_hdr;
 
         hdr = ipv6_hdr(skb);
         fhdr = (struct frag_hdr *)skb_transport_header(skb);
@@ -624,6 +617,11 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
         IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
         kfree_skb(skb);
         return -1;
+
+fail_hdr:
+        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
+        icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb_network_header_len(skb));
+        return -1;
 }
 
 static struct inet6_protocol frag_protocol =