572 	struct sk_buff *frag;  in ip6_fragment()  local
636 		skb_walk_frags(skb, frag) {  in ip6_fragment()
638 			if (frag->len > mtu ||  in ip6_fragment()
639 			    ((frag->len & 7) && frag->next) ||  in ip6_fragment()
640 			    skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))  in ip6_fragment()
644 			if (skb_shared(frag))  in ip6_fragment()
647 			BUG_ON(frag->sk);  in ip6_fragment()
649 				frag->sk = skb->sk;  in ip6_fragment()
650 				frag->destructor = sock_wfree;  in ip6_fragment()
652 			skb->truesize -= frag->truesize;  in ip6_fragment()
665 		frag = skb_shinfo(skb)->frag_list;  in ip6_fragment()
690 			if (frag) {  in ip6_fragment()
691 				frag->ip_summed = CHECKSUM_NONE;  in ip6_fragment()
692 				skb_reset_transport_header(frag);  in ip6_fragment()
693 				fh = (struct frag_hdr *)__skb_push(frag, sizeof(struct frag_hdr));  in ip6_fragment()
694 				__skb_push(frag, hlen);  in ip6_fragment()
695 				skb_reset_network_header(frag);  in ip6_fragment()
696 				memcpy(skb_network_header(frag), tmp_hdr,  in ip6_fragment()
702 				if (frag->next)  in ip6_fragment()
705 				ipv6_hdr(frag)->payload_len =  in ip6_fragment()
706 						htons(frag->len -  in ip6_fragment()
708 				ip6_copy_metadata(frag, skb);  in ip6_fragment()
716 			if (err || !frag)  in ip6_fragment()
719 			skb = frag;  in ip6_fragment()
720 			frag = skb->next;  in ip6_fragment()
733 		kfree_skb_list(frag);  in ip6_fragment()
742 			if (frag2 == frag)  in ip6_fragment()
777 		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +  in ip6_fragment()
779 		if (!frag) {  in ip6_fragment()
788 		ip6_copy_metadata(frag, skb);  in ip6_fragment()
789 		skb_reserve(frag, hroom);  in ip6_fragment()
790 		skb_put(frag, len + hlen + sizeof(struct frag_hdr));  in ip6_fragment()
791 		skb_reset_network_header(frag);  in ip6_fragment()
792 		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);  in ip6_fragment()
793 		frag->transport_header = (frag->network_header + hlen +  in ip6_fragment()
801 			skb_set_owner_w(frag, skb->sk);  in ip6_fragment()
806 		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);  in ip6_fragment()
808 		fragnexthdr_offset = skb_network_header(frag);  in ip6_fragment()
822 		BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),  in ip6_fragment()
829 		ipv6_hdr(frag)->payload_len = htons(frag->len -  in ip6_fragment()
838 		err = output(net, sk, frag);  in ip6_fragment()