diff --git a/[refs] b/[refs]
index 89f21ebabea1..525c419534cd 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8bd170750400bfa5e14c3dd2e2d0f305e1ab0e57
+refs/heads/master: bee0b40c0621396326d1c17b81833f59118a2d80
diff --git a/trunk/net/ipv6/xfrm6_mode_beet.c b/trunk/net/ipv6/xfrm6_mode_beet.c
index 65e6b2a7fb31..d9366dfbf868 100644
--- a/trunk/net/ipv6/xfrm6_mode_beet.c
+++ b/trunk/net/ipv6/xfrm6_mode_beet.c
@@ -44,9 +44,9 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 	hdr_len = ip6_find_1stfragopt(skb, &prevhdr);
 	memmove(skb->data, iph, hdr_len);
 
-	skb_set_mac_header(skb, offsetof(struct ipv6hdr, nexthdr));
+	skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
 	skb_reset_network_header(skb);
-	skb_set_transport_header(skb, sizeof(struct ipv6hdr));
+	skb_set_transport_header(skb, hdr_len);
 	top_iph = ipv6_hdr(skb);
 
 	ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);