583 	struct sk_buff *frag;  in ip6_fragment()  local
645 		skb_walk_frags(skb, frag) {  in ip6_fragment()
647 			if (frag->len > mtu ||  in ip6_fragment()
648 			    ((frag->len & 7) && frag->next) ||  in ip6_fragment()
649 			    skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))  in ip6_fragment()
653 			if (skb_shared(frag))  in ip6_fragment()
656 			BUG_ON(frag->sk);  in ip6_fragment()
658 				frag->sk = skb->sk;  in ip6_fragment()
659 				frag->destructor = sock_wfree;  in ip6_fragment()
661 			skb->truesize -= frag->truesize;  in ip6_fragment()
674 		frag = skb_shinfo(skb)->frag_list;  in ip6_fragment()
697 			if (frag) {  in ip6_fragment()
698 				frag->ip_summed = CHECKSUM_NONE;  in ip6_fragment()
699 				skb_reset_transport_header(frag);  in ip6_fragment()
700 				fh = __skb_push(frag, sizeof(struct frag_hdr));  in ip6_fragment()
701 				__skb_push(frag, hlen);  in ip6_fragment()
702 				skb_reset_network_header(frag);  in ip6_fragment()
703 				memcpy(skb_network_header(frag), tmp_hdr,  in ip6_fragment()
709 				if (frag->next)  in ip6_fragment()
712 				ipv6_hdr(frag)->payload_len =  in ip6_fragment()
713 						htons(frag->len -  in ip6_fragment()
715 				ip6_copy_metadata(frag, skb);  in ip6_fragment()
723 			if (err || !frag)  in ip6_fragment()
726 			skb = frag;  in ip6_fragment()
727 			frag = skb->next;  in ip6_fragment()
739 		kfree_skb_list(frag);  in ip6_fragment()
747 			if (frag2 == frag)  in ip6_fragment()
782 		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +  in ip6_fragment()
784 		if (!frag) {  in ip6_fragment()
793 		ip6_copy_metadata(frag, skb);  in ip6_fragment()
794 		skb_reserve(frag, hroom);  in ip6_fragment()
795 		skb_put(frag, len + hlen + sizeof(struct frag_hdr));  in ip6_fragment()
796 		skb_reset_network_header(frag);  in ip6_fragment()
797 		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);  in ip6_fragment()
798 		frag->transport_header = (frag->network_header + hlen +  in ip6_fragment()
806 			skb_set_owner_w(frag, skb->sk);  in ip6_fragment()
811 		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);  in ip6_fragment()
813 		fragnexthdr_offset = skb_network_header(frag);  in ip6_fragment()
827 		BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),  in ip6_fragment()
834 		ipv6_hdr(frag)->payload_len = htons(frag->len -  in ip6_fragment()
843 		err = output(net, sk, frag);  in ip6_fragment()