--- initial
+++ final
@@ -1,109 +1,109 @@
 static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_device *dev) {
   struct net *net = container_of(fq->q.net, struct net, ipv6.frags);
   struct sk_buff *fp, *head = fq->q.fragments;
   int payload_len;
   unsigned int nhoff;
   int sum_truesize;
   u8 ecn;
   inet_frag_kill(&fq->q);
   ecn = ip_frag_ecn_table[fq->ecn];
   if (unlikely(ecn == 0xff)) goto out_fail;
   /* Make the one we just received the head. */
   if (prev) {
     head = prev->next;
     fp = skb_clone(head, GFP_ATOMIC);
     if (!fp) goto out_oom;
     fp->next = head->next;
     if (!fp->next) fq->q.fragments_tail = fp;
     prev->next = fp;
     skb_morph(head, fq->q.fragments);
     head->next = fq->q.fragments->next;
     consume_skb(fq->q.fragments);
     fq->q.fragments = head;
   }
   WARN_ON(head == NULL);
   WARN_ON(head->ip_defrag_offset != 0);
   /* Unfragmented part is taken from the first segment. */
   payload_len = ((head->data - skb_network_header(head)) - sizeof(struct ipv6hdr) + fq->q.len - sizeof(struct frag_hdr));
   if (payload_len > IPV6_MAXPLEN) goto out_oversize;
   /* Head of list must not be cloned. */
   if (skb_unclone(head, GFP_ATOMIC)) goto out_oom;
   /* If the first fragment is fragmented itself, we split
    * it to two chunks: the first with data and paged part
    * and the second, holding only fragments. */
   if (skb_has_frag_list(head)) {
     struct sk_buff *clone;
     int i, plen = 0;
     clone = alloc_skb(0, GFP_ATOMIC);
     if (!clone) goto out_oom;
     clone->next = head->next;
     head->next = clone;
     skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
     skb_frag_list_init(head);
     for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
       plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
     clone->len = clone->data_len = head->data_len - plen;
     head->data_len -= clone->len;
     head->len -= clone->len;
     clone->csum = 0;
     clone->ip_summed = head->ip_summed;
     add_frag_mem_limit(fq->q.net, clone->truesize);
   }
   /* We have to remove fragment header from datagram and to relocate
    * header in order to calculate ICV correctly. */
   nhoff = fq->nhoffset;
   skb_network_header(head)[nhoff] = skb_transport_header(head)[0];
   memmove(head->head + sizeof(struct frag_hdr), head->head, (head->data - head->head) - sizeof(struct frag_hdr));
   if (skb_mac_header_was_set(head)) head->mac_header += sizeof(struct frag_hdr);
   head->network_header += sizeof(struct frag_hdr);
   skb_reset_transport_header(head);
   skb_push(head, head->data - skb_network_header(head));
   sum_truesize = head->truesize;
   for (fp = head->next; fp;) {
     bool headstolen;
     int delta;
     struct sk_buff *next = fp->next;
     sum_truesize += fp->truesize;
     if (head->ip_summed != fp->ip_summed)
       head->ip_summed = CHECKSUM_NONE;
     else if (head->ip_summed == CHECKSUM_COMPLETE)
       head->csum = csum_add(head->csum, fp->csum);
     if (skb_try_coalesce(head, fp, &headstolen, &delta)) {
       kfree_skb_partial(fp, headstolen);
     } else {
       if (!skb_shinfo(head)->frag_list) skb_shinfo(head)->frag_list = fp;
       head->data_len += fp->len;
       head->len += fp->len;
       head->truesize += fp->truesize;
     }
     fp = next;
   }
   sub_frag_mem_limit(fq->q.net, sum_truesize);
-  head->next = NULL;
+  skb_mark_not_on_list(head);
   head->dev = dev;
   head->tstamp = fq->q.stamp;
   ipv6_hdr(head)->payload_len = htons(payload_len);
   ipv6_change_dsfield(ipv6_hdr(head), 0xff, ecn);
   IP6CB(head)->nhoff = nhoff;
   IP6CB(head)->flags |= IP6SKB_FRAGMENTED;
   IP6CB(head)->frag_max_size = fq->q.max_size;
   /* Yes, and fold redundant checksum back. 8) */
   skb_postpush_rcsum(head, skb_network_header(head), skb_network_header_len(head));
   rcu_read_lock();
   __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
   rcu_read_unlock();
   fq->q.fragments = NULL;
   fq->q.rb_fragments = RB_ROOT;
   fq->q.fragments_tail = NULL;
   return 1;
 out_oversize:
   net_dbg_ratelimited("ip6_frag_reasm: payload len = %d\n", payload_len);
   goto out_fail;
 out_oom:
   net_dbg_ratelimited("ip6_frag_reasm: no memory for reassembly\n");
 out_fail:
   rcu_read_lock();
   __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
   rcu_read_unlock();
   return -1;
 }<sep>@@
struct sk_buff *skb;
@@
- skb->next = NULL
+ skb_mark_not_on_list(skb)