From 8ca9fb2cdc1b6ffc92877dbcf1d8d05c15070c1e Mon Sep 17 00:00:00 2001
From: Kazunori MIYAZAWA <miyazawa@linux-ipv6.org>
Date: Fri, 25 May 2007 01:22:25 -0700
Subject: [PATCH] --- yaml --- r: 57154 b: refs/heads/master c:
 144466bdf8c479ae36678ace7a3b8e8b748df6f6 h: refs/heads/master v: v3

---
 [refs]               | 2 +-
 trunk/net/ipv6/ah6.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 35b2f6ea9ed9..607cb0ce2d57 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: aad0e0b9b6e4f7085d5e2ec4b5bb59ffecd8b1fb
+refs/heads/master: 144466bdf8c479ae36678ace7a3b8e8b748df6f6
diff --git a/trunk/net/ipv6/ah6.c b/trunk/net/ipv6/ah6.c
index b696c8401200..128f94c79c64 100644
--- a/trunk/net/ipv6/ah6.c
+++ b/trunk/net/ipv6/ah6.c
@@ -247,7 +247,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
 	memcpy(tmp_base, top_iph, sizeof(tmp_base));
 
 	tmp_ext = NULL;
-	extlen = skb_transport_offset(skb) + sizeof(struct ipv6hdr);
+	extlen = skb_transport_offset(skb) - sizeof(struct ipv6hdr);
 	if (extlen) {
 		extlen += sizeof(*tmp_ext);
 		tmp_ext = kmalloc(extlen, GFP_ATOMIC);