1 files changed, 8 insertions, 11 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 167da8ba416a..54119d5aae8f 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -802,8 +802,6 @@ static int __ip_append_data(struct sock *sk,
         skb = skb_peek_tail(queue);
 
         exthdrlen = !skb ? rt->dst.header_len : 0;
-        length += exthdrlen;
-        transhdrlen += exthdrlen;
         mtu = cork->fragsize;
 
         hh_len = LL_RESERVED_SPACE(rt->dst.dev);
@@ -830,7 +828,7 @@ static int __ip_append_data(struct sock *sk,
         cork->length += length;
         if (((length > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO)) {
+            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
                                          mtu, flags);
@@ -883,17 +881,16 @@ alloc_new_skb:
                         else
                                 alloclen = fraglen;
 
+                        alloclen += exthdrlen;
+
                         /* The last fragment gets additional space at tail.
                          * Note, with MSG_MORE we overallocate on fragments,
                          * because we have no idea what fragment will be
                          * the last.
                          */
-                        if (datalen == length + fraggap) {
+                        if (datalen == length + fraggap)
                                 alloclen += rt->dst.trailer_len;
-                                /* make sure mtu is not reached */
-                                if (datalen > mtu - fragheaderlen - rt->dst.trailer_len)
-                                        datalen -= ALIGN(rt->dst.trailer_len, 8);
-                        }
+
                         if (transhdrlen) {
                                 skb = sock_alloc_send_skb(sk,
                                                 alloclen + hh_len + 15,
@@ -926,11 +923,11 @@ alloc_new_skb:
                         /*
                          *      Find where to start putting bytes.
                          */
-                        data = skb_put(skb, fraglen);
+                        data = skb_put(skb, fraglen + exthdrlen);
                         skb_set_network_header(skb, exthdrlen);
                         skb->transport_header = (skb->network_header +
                                                  fragheaderlen);
-                        data += fragheaderlen;
+                        data += fragheaderlen + exthdrlen;
 
                         if (fraggap) {
                                 skb->csum = skb_copy_and_csum_bits(
@@ -1064,7 +1061,7 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
          */
         *rtp = NULL;
         cork->fragsize = inet->pmtudisc == IP_PMTUDISC_PROBE ?
-                         rt->dst.dev->mtu : dst_mtu(rt->dst.path);
+                         rt->dst.dev->mtu : dst_mtu(&rt->dst);
         cork->dst = &rt->dst;
         cork->length = 0;
         cork->tx_flags = ipc->tx_flags;