diff --git a/[refs] b/[refs]
index 35b2f6ea9ed9..607cb0ce2d57 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: aad0e0b9b6e4f7085d5e2ec4b5bb59ffecd8b1fb
+refs/heads/master: 144466bdf8c479ae36678ace7a3b8e8b748df6f6
diff --git a/trunk/net/ipv6/ah6.c b/trunk/net/ipv6/ah6.c
index b696c8401200..128f94c79c64 100644
--- a/trunk/net/ipv6/ah6.c
+++ b/trunk/net/ipv6/ah6.c
@@ -247,7 +247,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
 	memcpy(tmp_base, top_iph, sizeof(tmp_base));
 
 	tmp_ext = NULL;
-	extlen = skb_transport_offset(skb) + sizeof(struct ipv6hdr);
+	extlen = skb_transport_offset(skb) - sizeof(struct ipv6hdr);
 	if (extlen) {
 		extlen += sizeof(*tmp_ext);
 		tmp_ext = kmalloc(extlen, GFP_ATOMIC);