[IPV6]: Fix payload length of reassembled packet.

net/ipv6/reassembly.c

@@ -596,10 +596,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
 	BUG_TRAP(FRAG6_CB(head)->offset == 0);
 
 	/* Unfragmented part is taken from the first segment. */
-	payload_len = (head->data - head->nh.raw) - sizeof(struct ipv6hdr) + fq->len;
-	nhoff = head->h.raw - head->nh.raw;
-
-	if (payload_len > 65535 + 8)
+	payload_len = (head->data - head->nh.raw) - sizeof(struct ipv6hdr) + fq->len - 8;
+	if (payload_len > 65535)
 		goto out_oversize;
 
 	/* Head of list must not be cloned. */