562 	struct sk_buff *frag;  in ip6_fragment()  local
621 		skb_walk_frags(skb, frag) {  in ip6_fragment()
623 			if (frag->len > mtu ||  in ip6_fragment()
624 			    ((frag->len & 7) && frag->next) ||  in ip6_fragment()
625 			    skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))  in ip6_fragment()
629 			if (skb_shared(frag))  in ip6_fragment()
632 			BUG_ON(frag->sk);  in ip6_fragment()
634 				frag->sk = skb->sk;  in ip6_fragment()
635 				frag->destructor = sock_wfree;  in ip6_fragment()
637 			skb->truesize -= frag->truesize;  in ip6_fragment()
652 		frag = skb_shinfo(skb)->frag_list;  in ip6_fragment()
677 			if (frag) {  in ip6_fragment()
678 				frag->ip_summed = CHECKSUM_NONE;  in ip6_fragment()
679 				skb_reset_transport_header(frag);  in ip6_fragment()
680 				fh = (struct frag_hdr *)__skb_push(frag, sizeof(struct frag_hdr));  in ip6_fragment()
681 				__skb_push(frag, hlen);  in ip6_fragment()
682 				skb_reset_network_header(frag);  in ip6_fragment()
683 				memcpy(skb_network_header(frag), tmp_hdr,  in ip6_fragment()
689 				if (frag->next)  in ip6_fragment()
692 				ipv6_hdr(frag)->payload_len =  in ip6_fragment()
693 						htons(frag->len -  in ip6_fragment()
695 				ip6_copy_metadata(frag, skb);  in ip6_fragment()
703 			if (err || !frag)  in ip6_fragment()
706 			skb = frag;  in ip6_fragment()
707 			frag = skb->next;  in ip6_fragment()
720 		kfree_skb_list(frag);  in ip6_fragment()
729 			if (frag2 == frag)  in ip6_fragment()
763 		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +  in ip6_fragment()
765 		if (!frag) {  in ip6_fragment()
776 		ip6_copy_metadata(frag, skb);  in ip6_fragment()
777 		skb_reserve(frag, hroom);  in ip6_fragment()
778 		skb_put(frag, len + hlen + sizeof(struct frag_hdr));  in ip6_fragment()
779 		skb_reset_network_header(frag);  in ip6_fragment()
780 		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);  in ip6_fragment()
781 		frag->transport_header = (frag->network_header + hlen +  in ip6_fragment()
789 			skb_set_owner_w(frag, skb->sk);  in ip6_fragment()
794 		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);  in ip6_fragment()
806 		BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),  in ip6_fragment()
813 		ipv6_hdr(frag)->payload_len = htons(frag->len -  in ip6_fragment()
822 		err = output(net, sk, frag);  in ip6_fragment()