diff options
| -rw-r--r-- | sys/netinet6/nd6.c | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c index e13b08ee32cf2..57009fba58866 100644 --- a/sys/netinet6/nd6.c +++ b/sys/netinet6/nd6.c @@ -821,9 +821,27 @@ nd6_llinfo_timer(void *arg) clear_llinfo_pqueue(ln); } nd6_free(&ln, 0); - if (m != NULL) - icmp6_error2(m, ICMP6_DST_UNREACH, - ICMP6_DST_UNREACH_ADDR, 0, ifp); + if (m != NULL) { + struct mbuf *n = m; + + /* + * if there are any ummapped mbufs, we + * must free them, rather than using + * them for an ICMP, as they cannot be + * checksummed. + */ + while ((n = n->m_next) != NULL) { + if (n->m_flags & M_EXTPG) + break; + } + if (n != NULL) { + m_freem(m); + m = NULL; + } else { + icmp6_error2(m, ICMP6_DST_UNREACH, + ICMP6_DST_UNREACH_ADDR, 0, ifp); + } + } } break; case ND6_LLINFO_REACHABLE: |