2 files changed, 13 insertions, 7 deletions

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index ff9040c92556..a995796b5a57 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -519,9 +519,6 @@ ip6ip6_rcv(struct sk_buff *skb)
         struct ipv6hdr *ipv6h;
         struct ip6_tnl *t;
 
-        if (!pskb_may_pull(skb, sizeof (*ipv6h)))
-                goto discard;
-
         ipv6h = skb->nh.ipv6h;
 
         read_lock(&ip6ip6_lock);
@@ -529,8 +526,7 @@ ip6ip6_rcv(struct sk_buff *skb)
         if ((t = ip6ip6_tnl_lookup(&ipv6h->saddr, &ipv6h->daddr)) != NULL) {
                 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                         read_unlock(&ip6ip6_lock);
-                        kfree_skb(skb);
-                        return 0;
+                        goto discard;
                 }
 
                 if (!(t->parms.flags & IP6_TNL_F_CAP_RCV)) {
@@ -557,9 +553,11 @@ ip6ip6_rcv(struct sk_buff *skb)
                 return 0;
         }
         read_unlock(&ip6ip6_lock);
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0, skb->dev);
-discard:
         return 1;
+
+discard:
+        kfree_skb(skb);
+        return 0;
 }
 
 static inline struct ipv6_txoptions *create_tel(__u8 encap_limit)
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 5659b52284bd..0ef9a35798d1 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -19,11 +19,13 @@
  *              YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
  */
 
+#include <linux/icmpv6.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
@@ -87,10 +89,16 @@ static int tunnel6_rcv(struct sk_buff **pskb)
         struct sk_buff *skb = *pskb;
         struct xfrm6_tunnel *handler;
 
+        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
+                goto drop;
+
         for (handler = tunnel6_handlers; handler; handler = handler->next)
                 if (!handler->handler(skb))
                         return 0;
 
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, skb->dev);
+
+drop:
         kfree_skb(skb);
         return 0;
 }