1 files changed, 1 insertions, 1 deletions

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index b696c8401200..128f94c79c64 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -247,7 +247,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         memcpy(tmp_base, top_iph, sizeof(tmp_base));
 
         tmp_ext = NULL;
-        extlen = skb_transport_offset(skb) + sizeof(struct ipv6hdr);
+        extlen = skb_transport_offset(skb) - sizeof(struct ipv6hdr);
         if (extlen) {
                 extlen += sizeof(*tmp_ext);
                 tmp_ext = kmalloc(extlen, GFP_ATOMIC);