IPCOMP: Fetch nexthdr before ipch is destroyed

[karo-tx-linux.git] / net / ipv4 / ipcomp.c

diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 2c44a94c2135d80aebb3a8708292b829f6f3bcf6..80cab8c73074525026c514633b415e9d36d76a98 100644 (file)
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -74,6 +74,7 @@ out:
 
 static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
 {
+       int nexthdr;
        int err = -ENOMEM;
        struct ip_comp_hdr *ipch;
 
@@ -84,13 +85,15 @@ static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
 
        /* Remove ipcomp header and decompress original payload */
        ipch = (void *)skb->data;
+       nexthdr = ipch->nexthdr;
+
        skb->transport_header = skb->network_header + sizeof(*ipch);
        __skb_pull(skb, sizeof(*ipch));
        err = ipcomp_decompress(x, skb);
        if (err)
                goto out;
 
-       err = ipch->nexthdr;
+       err = nexthdr;
 
 out:
        return err;