diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 5aa8ec88f1946296ce4f776f8927f764cf4edbc1..59dccfbb5b11332f7f3957d2fb80a0f94a2784da 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -371,7 +371,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
 	iv = esp_tmp_iv(aead, tmp, seqhilen);
 	req = esp_tmp_req(aead, iv);
 	asg = esp_req_sg(aead, req);
-	sg = asg + 1;
+	sg = asg + sglists;
 
 	skb->ip_summed = CHECKSUM_NONE;