1 files changed, 8 insertions, 7 deletions

diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index b4baceed0d0d..beb6872a8fa5 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -141,19 +141,20 @@ void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq,
         if (!dev)
                 goto out_rcu_unlock;
 
-        if (!(fq->q.flags & INET_FRAG_EVICTED))
-                IP6_INC_STATS_BH(net, __in6_dev_get(dev),
-                                 IPSTATS_MIB_REASMTIMEOUT);
         IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
 
+        if (fq->q.flags & INET_FRAG_EVICTED)
+                goto out_rcu_unlock;
+
+        IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
+
         /* Don't send error if the first segment did not arrive. */
         if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !fq->q.fragments)
                 goto out_rcu_unlock;
 
-        /*
-           But use as source device on which LAST ARRIVED
-           segment was received. And do not use fq->dev
-           pointer directly, device might already disappeared.
+        /* But use as source device on which LAST ARRIVED
+         * segment was received. And do not use fq->dev
+         * pointer directly, device might already disappeared.
          */
         fq->q.fragments->dev = dev;
         icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0);