for kernel V2.6.23

static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
{
...
if (skb_shinfo(head)->frag_list) {
...
}
...
}

the above red font statement implies that there are maybe some fragments associated with the head skb in its frag_list, but I have no idea that why the head has something in its frag_list.

As we know, after ip_push_pending_frames, the first skb's frag_list is used to link all following fragments, but after ip_fragment() is called, all fragments are sent out one by one, so when the receiver recives a fragment coming from the network, how can we expect that fragment's frag_list still has fragments with it? in other words, under what condition in ip_frag_reasm(), the head fragment'frag_list does have following fragments?

for higher versions above 2.6.23, there are still equivalent codes to the above example.

can any one help me with this question?

I think it might be a requirement of the use case, in the following method they are writing the skb to a paging file so they are attempting to resolve/exclude the possibility of additional bytes in the fragment list. Seems like it's roughly equivalent to a python 'assert' sanity check (i.e. assuming this thing isn't hosed and half of it is in the fragment list)