3 files changed, 14 insertions, 6 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4406546d3ce8..8a7b5c760147 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -191,7 +191,9 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
                         ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
         }
 
-        hdr = skb->nh.ipv6h = (struct ipv6hdr*)skb_push(skb, sizeof(struct ipv6hdr));
+        skb_push(skb, sizeof(struct ipv6hdr));
+        skb_reset_network_header(skb);
+        hdr = skb->nh.ipv6h;
 
         /*
          *      Fill in the IPv6 header
@@ -626,7 +628,8 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
                 __skb_pull(skb, hlen);
                 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
-                skb->nh.raw = __skb_push(skb, hlen);
+                __skb_push(skb, hlen);
+                skb_reset_network_header(skb);
                 memcpy(skb->nh.raw, tmp_hdr, hlen);
 
                 ipv6_select_ident(skb, fh);
@@ -649,7 +652,8 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                                 frag->ip_summed = CHECKSUM_NONE;
                                 frag->h.raw = frag->data;
                                 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
-                                frag->nh.raw = __skb_push(frag, hlen);
+                                __skb_push(frag, hlen);
+                                skb_reset_network_header(frag);
                                 memcpy(frag->nh.raw, tmp_hdr, hlen);
                                 offset += skb->len - hlen - sizeof(struct frag_hdr);
                                 fh->nexthdr = nexthdr;
@@ -1346,7 +1350,9 @@ int ip6_push_pending_frames(struct sock *sk)
         if (opt && opt->opt_nflen)
                 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
 
-        skb->nh.ipv6h = hdr = (struct ipv6hdr*) skb_push(skb, sizeof(struct ipv6hdr));
+        skb_push(skb, sizeof(struct ipv6hdr));
+        skb_reset_network_header(skb);
+        hdr = skb->nh.ipv6h;
 
         *(__be32*)hdr = fl->fl6_flowlabel |
                      htonl(0x60000000 | ((int)np->cork.tclass << 20));
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 30df8e6c42cc..a1e4f39c6793 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -907,7 +907,8 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 init_tel_txopt(&opt, encap_limit);
                 ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
         }
-        skb->nh.raw = skb_push(skb, sizeof(struct ipv6hdr));
+        skb_push(skb, sizeof(struct ipv6hdr));
+        skb_reset_network_header(skb);
         ipv6h = skb->nh.ipv6h;
         *(__be32*)ipv6h = fl->fl6_flowlabel | htonl(0x60000000);
         dsfield = INET_ECN_encapsulate(0, dsfield);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 0477728578fe..62883d41b6c3 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -554,7 +554,8 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         skb->h.raw = skb->nh.raw;
-        skb->nh.raw = skb_push(skb, sizeof(struct iphdr));
+        skb_push(skb, sizeof(struct iphdr));
+        skb_reset_network_header(skb);
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
         IPCB(skb)->flags = 0;
         dst_release(skb->dst);