atomic_t                refcnt;
        struct timer_list       timer;      /* when will this queue expire? */
        struct sk_buff          *fragments; /* list of received fragments */
+       struct sk_buff          *fragments_tail;
        ktime_t                 stamp;
        int                     len;        /* total length of orig datagram */
        int                     meat;
 
        qp->q.len = 0;
        qp->q.meat = 0;
        qp->q.fragments = NULL;
+       qp->q.fragments_tail = NULL;
        qp->iif = 0;
 
        return 0;
         * in the chain of fragments so far.  We must know where to put
         * this fragment, right?
         */
+       prev = qp->q.fragments_tail;
+       if (!prev || FRAG_CB(prev)->offset < offset) {
+               next = NULL;
+               goto found;
+       }
        prev = NULL;
        for (next = qp->q.fragments; next != NULL; next = next->next) {
                if (FRAG_CB(next)->offset >= offset)
                prev = next;
        }
 
+found:
        /* We found where to put this one.  Check for overlap with
         * preceding fragment, and, if needed, align things so that
         * any overlaps are eliminated.
 
        /* Insert this fragment in the chain of fragments. */
        skb->next = next;
+       if (!next)
+               qp->q.fragments_tail = skb;
        if (prev)
                prev->next = skb;
        else
                        goto out_nomem;
 
                fp->next = head->next;
+               if (!fp->next)
+                       qp->q.fragments_tail = fp;
                prev->next = fp;
 
                skb_morph(head, qp->q.fragments);
        iph->tot_len = htons(len);
        IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
        qp->q.fragments = NULL;
+       qp->q.fragments_tail = NULL;
        return 0;
 
 out_nomem:
 
         * in the chain of fragments so far.  We must know where to put
         * this fragment, right?
         */
+       prev = fq->q.fragments_tail;
+       if (!prev || FRAG6_CB(prev)->offset < offset) {
+               next = NULL;
+               goto found;
+       }
        prev = NULL;
        for(next = fq->q.fragments; next != NULL; next = next->next) {
                if (FRAG6_CB(next)->offset >= offset)
                prev = next;
        }
 
+found:
        /* We found where to put this one.  Check for overlap with
         * preceding fragment, and, if needed, align things so that
         * any overlaps are eliminated.
 
        /* Insert this fragment in the chain of fragments. */
        skb->next = next;
+       if (!next)
+               fq->q.fragments_tail = skb;
        if (prev)
                prev->next = skb;
        else
                        goto out_oom;
 
                fp->next = head->next;
+               if (!fp->next)
+                       fq->q.fragments_tail = fp;
                prev->next = fp;
 
                skb_morph(head, fq->q.fragments);
        IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
        rcu_read_unlock();
        fq->q.fragments = NULL;
+       fq->q.fragments_tail = NULL;
        return 1;
 
 out_oversize: