1 files changed, 8 insertions, 1 deletions

diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index f42cd0915966..8a90d756c904 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -395,6 +395,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         struct pppol2tp_session *ps;
         int old_headroom;
         int new_headroom;
+        int uhlen, headroom;
 
         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
                 goto abort;
@@ -413,7 +414,13 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                 goto abort_put_sess;
 
         old_headroom = skb_headroom(skb);
-        if (skb_cow_head(skb, sizeof(ppph)))
+        uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
+        headroom = NET_SKB_PAD +
+                   sizeof(struct iphdr) + /* IP header */
+                   uhlen +              /* UDP header (if L2TP_ENCAPTYPE_UDP) */
+                   session->hdr_len +   /* L2TP header */
+                   sizeof(ppph);        /* PPP header */
+        if (skb_cow_head(skb, headroom))
                 goto abort_put_sess_tun;
 
         new_headroom = skb_headroom(skb);