diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 5e80e517f071013410349d1fd93afc00a394e284..46c19bd4899011d53b4feb84e25013c01ddce701 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -399,7 +399,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
        unsigned int nhoff = raw - skb->data;
        unsigned int off = nhoff + sizeof(*ipv6h);
-       u8 next, nexthdr = ipv6h->nexthdr;
+       u8 nexthdr = ipv6h->nexthdr;
 
        while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
                struct ipv6_opt_hdr *hdr;
@@ -410,25 +410,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 
                hdr = (struct ipv6_opt_hdr *)(skb->data + off);
                if (nexthdr == NEXTHDR_FRAGMENT) {
-                       struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
-                       if (frag_hdr->frag_off)
-                               break;
                        optlen = 8;
                } else if (nexthdr == NEXTHDR_AUTH) {
                        optlen = ipv6_authlen(hdr);
                } else {
                        optlen = ipv6_optlen(hdr);
                }
-               /* cache hdr->nexthdr, since pskb_may_pull() might
-                * invalidate hdr
-                */
-               next = hdr->nexthdr;
-               if (nexthdr == NEXTHDR_DEST) {
-                       u16 i = 2;
 
-                       /* Remember : hdr is no longer valid at this point. */
-                       if (!pskb_may_pull(skb, off + optlen))
+               if (!pskb_may_pull(skb, off + optlen))
+                       break;
+
+               hdr = (struct ipv6_opt_hdr *)(skb->data + off);
+               if (nexthdr == NEXTHDR_FRAGMENT) {
+                       struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr;
+
+                       if (frag_hdr->frag_off)
                                break;
+               }
+               if (nexthdr == NEXTHDR_DEST) {
+                       u16 i = 2;
 
                        while (1) {
                                struct ipv6_tlv_tnl_enc_lim *tel;
@@ -449,7 +449,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
                                        i++;
                        }
                }
-               nexthdr = next;
+               nexthdr = hdr->nexthdr;
                off += optlen;
        }
        return 0;