1 files changed, 12 insertions, 3 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5a5b7d4ad31c..f508171bab73 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -137,9 +137,17 @@ static int ip6_output2(struct sk_buff *skb)
         return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb,NULL, skb->dev,ip6_output_finish);
 }
 
+static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+{
+        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+
+        return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
+               skb->dst->dev->mtu : dst_mtu(skb->dst);
+}
+
 int ip6_output(struct sk_buff *skb)
 {
-        if ((skb->len > dst_mtu(skb->dst) && !skb_is_gso(skb)) ||
+        if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
                                 dst_allfrag(skb->dst))
                 return ip6_fragment(skb, ip6_output2);
         else
@@ -566,7 +574,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         hlen = ip6_find_1stfragopt(skb, &prevhdr);
         nexthdr = *prevhdr;
 
-        mtu = dst_mtu(&rt->u.dst);
+        mtu = ip6_skb_dst_mtu(skb);
 
         /* We must not fragment if the socket is set to force MTU discovery
          * or if the skb it not generated by a local socket.  (This last
@@ -1063,7 +1071,8 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 inet->cork.fl = *fl;
                 np->cork.hop_limit = hlimit;
                 np->cork.tclass = tclass;
-                mtu = dst_mtu(rt->u.dst.path);
+                mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                      rt->u.dst.dev->mtu : dst_mtu(rt->u.dst.path);
                 if (np->frag_size < mtu) {
                         if (np->frag_size)
                                 mtu = np->frag_size;