2 files changed, 4 insertions, 7 deletions

diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 51fc2a1dcdd3..b3ac3c3f6219 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -190,15 +190,14 @@ static int ipip_rcv(struct sk_buff *skb)
         struct ip_tunnel *tunnel;
         const struct iphdr *iph;
 
-        if (iptunnel_pull_header(skb, 0, tpi.proto))
-                goto drop;
-
         iph = ip_hdr(skb);
         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
                         iph->saddr, iph->daddr, 0);
         if (tunnel) {
                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
                         goto drop;
+                if (iptunnel_pull_header(skb, 0, tpi.proto))
+                        goto drop;
                 return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
         }
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index fbfc5a83867f..21b25dd8466b 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -645,11 +645,7 @@ static int ipip_rcv(struct sk_buff *skb)
         const struct iphdr *iph;
         struct ip_tunnel *tunnel;
 
-        if (iptunnel_pull_header(skb, 0, tpi.proto))
-                goto drop;
-
         iph = ip_hdr(skb);
-
         tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                      iph->saddr, iph->daddr);
         if (tunnel != NULL) {
@@ -659,6 +655,8 @@ static int ipip_rcv(struct sk_buff *skb)
 
                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
                         goto drop;
+                if (iptunnel_pull_header(skb, 0, tpi.proto))
+                        goto drop;
                 return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
         }