549 	struct sk_buff *frag;  in ip6_fragment()  local
599 		skb_walk_frags(skb, frag) {  in ip6_fragment()
601 			if (frag->len > mtu ||  in ip6_fragment()
602 			    ((frag->len & 7) && frag->next) ||  in ip6_fragment()
603 			    skb_headroom(frag) < hlen)  in ip6_fragment()
607 			if (skb_shared(frag))  in ip6_fragment()
610 			BUG_ON(frag->sk);  in ip6_fragment()
612 				frag->sk = skb->sk;  in ip6_fragment()
613 				frag->destructor = sock_wfree;  in ip6_fragment()
615 			skb->truesize -= frag->truesize;  in ip6_fragment()
620 		frag = skb_shinfo(skb)->frag_list;  in ip6_fragment()
655 			if (frag) {  in ip6_fragment()
656 				frag->ip_summed = CHECKSUM_NONE;  in ip6_fragment()
657 				skb_reset_transport_header(frag);  in ip6_fragment()
658 				fh = (struct frag_hdr *)__skb_push(frag, sizeof(struct frag_hdr));  in ip6_fragment()
659 				__skb_push(frag, hlen);  in ip6_fragment()
660 				skb_reset_network_header(frag);  in ip6_fragment()
661 				memcpy(skb_network_header(frag), tmp_hdr,  in ip6_fragment()
667 				if (frag->next)  in ip6_fragment()
670 				ipv6_hdr(frag)->payload_len =  in ip6_fragment()
671 						htons(frag->len -  in ip6_fragment()
673 				ip6_copy_metadata(frag, skb);  in ip6_fragment()
681 			if (err || !frag)  in ip6_fragment()
684 			skb = frag;  in ip6_fragment()
685 			frag = skb->next;  in ip6_fragment()
698 		kfree_skb_list(frag);  in ip6_fragment()
707 			if (frag2 == frag)  in ip6_fragment()
746 		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +  in ip6_fragment()
748 		if (!frag) {  in ip6_fragment()
759 		ip6_copy_metadata(frag, skb);  in ip6_fragment()
760 		skb_reserve(frag, hroom);  in ip6_fragment()
761 		skb_put(frag, len + hlen + sizeof(struct frag_hdr));  in ip6_fragment()
762 		skb_reset_network_header(frag);  in ip6_fragment()
763 		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);  in ip6_fragment()
764 		frag->transport_header = (frag->network_header + hlen +  in ip6_fragment()
772 			skb_set_owner_w(frag, skb->sk);  in ip6_fragment()
777 		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);  in ip6_fragment()
793 		BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),  in ip6_fragment()
800 		ipv6_hdr(frag)->payload_len = htons(frag->len -  in ip6_fragment()
809 		err = output(sk, frag);  in ip6_fragment()