Incorrect SKB pointer is passed to output() callback
in ip6_fragment().

Work done by James Morris and Yoshifuji Hideaki.
Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: Yoshifuji Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@redhat.com>