diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 4872b30ba5d83e5501b3039637257072e7b08929..f09055d3a76866acd3d9ab51f9e8f198492ae8f6 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -91,6 +91,7 @@ static int xfrm4_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm4_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
 	struct iphdr *iph = skb->nh.iph;
+	const unsigned char *old_mac;
 	int err = -EINVAL;
 
 	switch (iph->protocol){
@@ -125,8 +126,9 @@ static int xfrm4_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 		skb->protocol = htons(ETH_P_IPV6);
 	}
 #endif
-	skb->mac.raw = memmove(skb->data - skb->mac_len,
-			       skb->mac.raw, skb->mac_len);
+	old_mac = skb->mac.raw;
+	skb_set_mac_header(skb, -skb->mac_len);
+	memmove(skb->mac.raw, old_mac, skb->mac_len);
 	skb->nh.raw = skb->data;
 	err = 0;
 
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index edcfffa9e87b1395723cbf5e07df05ed3bca43ee..53cfe1a10ccd6612788aad4c6c6a3f7ee6705e9e 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -59,6 +59,7 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 {
 	struct ipv6hdr *ip6h;
+	const unsigned char *old_mac;
 	int size = sizeof(struct ipv6hdr);
 	int err = -EINVAL;
 
@@ -69,8 +70,9 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 	memmove(skb->data, skb->nh.raw, size);
 	skb->nh.raw = skb->data;
 
-	skb->mac.raw = memmove(skb->data - skb->mac_len,
-			       skb->mac.raw, skb->mac_len);
+	old_mac = skb->mac.raw;
+	skb_set_mac_header(skb, -skb->mac_len);
+	memmove(skb->mac.raw, old_mac, skb->mac_len);
 
 	ip6h = skb->nh.ipv6h;
 	ip6h->payload_len = htons(skb->len - size);
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 0bc866c0d83c4d4e352fa484ede378ca2134ed29..d2c560c181a1c02dbcc92be2a394c0e40df589c2 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -86,6 +86,7 @@ static int xfrm6_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
 	int err = -EINVAL;
+	const unsigned char *old_mac;
 
 	if (skb->nh.raw[IP6CB(skb)->nhoff] != IPPROTO_IPV6
 	    && skb->nh.raw[IP6CB(skb)->nhoff] != IPPROTO_IPIP)
@@ -107,8 +108,9 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 			ip6ip_ecn_decapsulate(skb);
 		skb->protocol = htons(ETH_P_IP);
 	}
-	skb->mac.raw = memmove(skb->data - skb->mac_len,
-			       skb->mac.raw, skb->mac_len);
+	old_mac = skb->mac.raw;
+	skb_set_mac_header(skb, -skb->mac_len);
+	memmove(skb->mac.raw, old_mac, skb->mac_len);
 	skb->nh.raw = skb->data;
 	err = 0;