713 	iter->frag = skb_shinfo(skb)->frag_list;  in ip6_fraglist_init()
744 	struct sk_buff *frag = iter->frag;  in ip6_fraglist_prepare()  local
748 	frag->ip_summed = CHECKSUM_NONE;  in ip6_fraglist_prepare()
749 	skb_reset_transport_header(frag);  in ip6_fraglist_prepare()
750 	fh = __skb_push(frag, sizeof(struct frag_hdr));  in ip6_fraglist_prepare()
751 	__skb_push(frag, hlen);  in ip6_fraglist_prepare()
752 	skb_reset_network_header(frag);  in ip6_fraglist_prepare()
753 	memcpy(skb_network_header(frag), iter->tmp_hdr, hlen);  in ip6_fraglist_prepare()
758 	if (frag->next)  in ip6_fraglist_prepare()
761 	ipv6_hdr(frag)->payload_len = htons(frag->len - sizeof(struct ipv6hdr));  in ip6_fraglist_prepare()
762 	ip6_copy_metadata(frag, skb);  in ip6_fraglist_prepare()
790 	struct sk_buff *frag;  in ip6_frag_next()  local
804 	frag = alloc_skb(len + state->hlen + sizeof(struct frag_hdr) +  in ip6_frag_next()
806 	if (!frag)  in ip6_frag_next()
813 	ip6_copy_metadata(frag, skb);  in ip6_frag_next()
814 	skb_reserve(frag, state->hroom);  in ip6_frag_next()
815 	skb_put(frag, len + state->hlen + sizeof(struct frag_hdr));  in ip6_frag_next()
816 	skb_reset_network_header(frag);  in ip6_frag_next()
817 	fh = (struct frag_hdr *)(skb_network_header(frag) + state->hlen);  in ip6_frag_next()
818 	frag->transport_header = (frag->network_header + state->hlen +  in ip6_frag_next()
826 		skb_set_owner_w(frag, skb->sk);  in ip6_frag_next()
831 	skb_copy_from_linear_data(skb, skb_network_header(frag), state->hlen);  in ip6_frag_next()
833 	fragnexthdr_offset = skb_network_header(frag);  in ip6_frag_next()
847 	BUG_ON(skb_copy_bits(skb, state->ptr, skb_transport_header(frag),  in ip6_frag_next()
854 	ipv6_hdr(frag)->payload_len = htons(frag->len - sizeof(struct ipv6hdr));  in ip6_frag_next()
859 	return frag;  in ip6_frag_next()
866 	struct sk_buff *frag;  in ip6_fragment()  local
933 		skb_walk_frags(skb, frag) {  in ip6_fragment()
935 			if (frag->len > mtu ||  in ip6_fragment()
936 			    ((frag->len & 7) && frag->next) ||  in ip6_fragment()
937 			    skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))  in ip6_fragment()
941 			if (skb_shared(frag))  in ip6_fragment()
944 			BUG_ON(frag->sk);  in ip6_fragment()
946 				frag->sk = skb->sk;  in ip6_fragment()
947 				frag->destructor = sock_wfree;  in ip6_fragment()
949 			skb->truesize -= frag->truesize;  in ip6_fragment()
963 			if (iter.frag)  in ip6_fragment()
972 			if (err || !iter.frag)  in ip6_fragment()
987 		kfree_skb_list(iter.frag);  in ip6_fragment()
996 			if (frag2 == frag)  in ip6_fragment()
1018 		frag = ip6_frag_next(skb, &state);  in ip6_fragment()
1019 		if (IS_ERR(frag)) {  in ip6_fragment()
1020 			err = PTR_ERR(frag);  in ip6_fragment()
1027 		skb_set_delivery_time(frag, tstamp, tstamp_type);  in ip6_fragment()
1028 		err = output(net, sk, frag);  in ip6_fragment()