[IPV6] Fix BUG when appending destination options headers

    
This patch fixes BUG when pushing IPv6 destination options over an
IPv6 raw socket.  Patch is based on one from Thomas Graf <tgr@reeler.org>.

net/ipv6/ip6_output.c

@@ -1239,7 +1239,6 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
 			memcpy(np->cork.opt, opt, opt->tot_len);
 			inet->cork.flags |= IPCORK_OPT;
 			/* need source address above miyazawa*/
-			exthdrlen += opt->opt_flen ? opt->opt_flen : 0;
 		}
 		dst_hold(&rt->u.dst);
 		np->cork.rt = rt;
@@ -1252,6 +1251,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
 			length += exthdrlen;
 			transhdrlen += exthdrlen;
 		}
+		exthdrlen += opt ? opt->opt_flen : 0;
 	} else {
 		rt = np->cork.rt;
 		if (inet->cork.flags & IPCORK_OPT)

net/ipv6/raw.c

@@ -624,6 +624,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg
 	if (msg->msg_controllen) {
 		opt = &opt_space;
 		memset(opt, 0, sizeof(struct ipv6_txoptions));
+		opt->tot_len = sizeof(struct ipv6_txoptions);
 
 		err = datagram_send_ctl(msg, &fl, opt, &hlimit);
 		if (err < 0) {