mtu = IPV6_MIN_MTU;
        }
 
-       if (np && np->frag_size < mtu) {
-               if (np->frag_size)
-                       mtu = np->frag_size;
+       if (np) {
+               u32 frag_size = READ_ONCE(np->frag_size);
+
+               if (frag_size && frag_size < mtu)
+                       mtu = frag_size;
        }
        if (mtu < hlen + sizeof(struct frag_hdr) + 8)
                goto fail_toobig;
                          struct rt6_info *rt)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
-       unsigned int mtu;
+       unsigned int mtu, frag_size;
        struct ipv6_txoptions *nopt, *opt = ipc6->opt;
 
        /* callers pass dst together with a reference, set it first so
        else
                mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
                        READ_ONCE(rt->dst.dev->mtu) : dst_mtu(xfrm_dst_path(&rt->dst));
-       if (np->frag_size < mtu) {
-               if (np->frag_size)
-                       mtu = np->frag_size;
-       }
+
+       frag_size = READ_ONCE(np->frag_size);
+       if (frag_size && frag_size < mtu)
+               mtu = frag_size;
+
        cork->base.fragsize = mtu;
        cork->base.gso_size = ipc6->gso_size;
        cork->base.tx_flags = 0;
 
                WRITE_ONCE(np->mcast_hops,
                           val == -1 ? IPV6_DEFAULT_MCASTHOPS : val);
                return 0;
+       case IPV6_MTU:
+               if (optlen < sizeof(int))
+                       return -EINVAL;
+               if (val && val < IPV6_MIN_MTU)
+                       return -EINVAL;
+               WRITE_ONCE(np->frag_size, val);
+               return 0;
        }
        if (needs_rtnl)
                rtnl_lock();
                np->pmtudisc = val;
                retv = 0;
                break;
-       case IPV6_MTU:
-               if (optlen < sizeof(int))
-                       goto e_inval;
-               if (val && val < IPV6_MIN_MTU)
-                       goto e_inval;
-               np->frag_size = val;
-               retv = 0;
-               break;
        case IPV6_RECVERR:
                if (optlen < sizeof(int))
                        goto e_inval;