2.6.24.4

 net

 ipv6

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 3bef30e..5b4095b 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -593,7 +593,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
     * or if the skb it not generated by a local socket.  (This last
     * check should be redundant, but it's free.)
     */
-   if (!np || np->pmtudisc >= IPV6_PMTUDISC_DO) {
+   if (!skb->local_df) {
       skb->dev = skb->dst->dev;
       icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
       IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
@@ -609,6 +609,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
    if (skb_shinfo(skb)->frag_list) {
       int first_len = skb_pagelen(skb);
+      int truesizes = 0;
 
       if (first_len - hlen > mtu ||
           ((first_len - hlen) & 7) ||
@@ -631,7 +632,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
             sock_hold(skb->sk);
             frag->sk = skb->sk;
             frag->destructor = sock_wfree;
-            skb->truesize -= frag->truesize;
+            truesizes += frag->truesize;
          }
       }
 
@@ -662,6 +663,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
       first_len = skb_pagelen(skb);
       skb->data_len = first_len - skb_headlen(skb);
+      skb->truesize -= truesizes;
       skb->len = first_len;
       ipv6_hdr(skb)->payload_len = htons(first_len -
                      sizeof(struct ipv6hdr));
@@ -1387,6 +1389,10 @@ int ip6_push_pending_frames(struct sock *sk)
       tmp_skb->sk = NULL;
    }
 
+   /* Allow local fragmentation. */
+   if (np->pmtudisc < IPV6_PMTUDISC_DO)
+      skb->local_df = 1;
+
    ipv6_addr_copy(final_dst, &fl->fl6_dst);
    __skb_pull(skb, skb_network_header_len(skb));
    if (opt && opt->opt_flen)