When checking the length of the headers at this point, the IP level options have not been added to the mbuf chain. So don't take them into account.
This issue was reported by
- syzbot+16025fff7ee5f7c5957b@syzkaller.appspotmail.com
- syzbot+adb5836b8a9ff621b2aa@syzkaller.appspotmail.com
- syzbot+d25a5352bcdf40acdbb8@syzkaller.appspotmail.com