2 files changed, 5 insertions, 3 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 150615758fdc..387030d2483c 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1099,7 +1099,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 sk->sk_sndmsg_page = NULL;
                 sk->sk_sndmsg_off = 0;
                 exthdrlen = rt->u.dst.header_len + (opt ? opt->opt_flen : 0) -
-                            rt->u.dst.nfheader_len;
+                            rt->nfheader_len;
                 length += exthdrlen;
                 transhdrlen += exthdrlen;
         } else {
@@ -1114,7 +1114,8 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 
         hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
 
-        fragheaderlen = sizeof(struct ipv6hdr) + rt->u.dst.nfheader_len + (opt ? opt->opt_nflen : 0);
+        fragheaderlen = sizeof(struct ipv6hdr) + rt->nfheader_len +
+                        (opt ? opt->opt_nflen : 0);
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
 
         if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 3cad3e8dc4da..5b02f0efd38e 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -157,7 +157,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 dst_prev = dst1;
 
                 if (xfrm[i]->type->flags & XFRM_TYPE_NON_FRAGMENT)
-                        dst->nfheader_len += xfrm[i]->props.header_len;
+                        ((struct rt6_info *)dst)->nfheader_len +=
+                                xfrm[i]->props.header_len;
                 header_len += xfrm[i]->props.header_len;
                 trailer_len += xfrm[i]->props.trailer_len;