diff --git a/[refs] b/[refs]
index 8d417f76a35c..59ca4732d7de 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: aff65da0f1be5daec44231972b6b5fc45bfa7a58
+refs/heads/master: 408dadf03fe365f12f85d5c3d959f4bb888b9f3e
diff --git a/trunk/net/ipv6/ip6_output.c b/trunk/net/ipv6/ip6_output.c
index 4c882cf4e8a1..835c04b5239f 100644
--- a/trunk/net/ipv6/ip6_output.c
+++ b/trunk/net/ipv6/ip6_output.c
@@ -1480,13 +1480,13 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 			if (page && (left = PAGE_SIZE - off) > 0) {
 				if (copy >= left)
 					copy = left;
-				if (page != frag->page) {
+				if (page != skb_frag_page(frag)) {
 					if (i == MAX_SKB_FRAGS) {
 						err = -EMSGSIZE;
 						goto error;
 					}
-					get_page(page);
 					skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
+					skb_frag_ref(skb, i);
 					frag = &skb_shinfo(skb)->frags[i];
 				}
 			} else if(i < MAX_SKB_FRAGS) {
@@ -1506,7 +1506,8 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 				err = -EMSGSIZE;
 				goto error;
 			}
-			if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) {
+			if (getfrag(from, skb_frag_address(frag)+frag->size,
+				    offset, copy, skb->len, skb) < 0) {
 				err = -EFAULT;
 				goto error;
 			}