Do not call nd6_output() without route entry argument.

ok bluhm@

1 files changed, 14 insertions, 2 deletions

diff --git a/sys/net/pf_norm.c b/sys/net/pf_norm.c
index 79088964d49..a93bf690dd3 100644
--- a/sys/net/pf_norm.c
+++ b/sys/net/pf_norm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf_norm.c,v 1.183 2015/11/24 13:37:16 mpi Exp $ */
+/*	$OpenBSD: pf_norm.c,v 1.184 2016/05/24 05:02:34 mpi Exp $ */
 
 /*
  * Copyright 2001 Niels Provos <provos@citi.umich.edu>
@@ -687,6 +687,7 @@ pf_refragment6(struct mbuf **m0, struct m_tag *mtag, struct sockaddr_in6 *dst,
 {
 	struct mbuf		*m = *m0, *t;
 	struct pf_fragment_tag	*ftag = (struct pf_fragment_tag *)(mtag + 1);
+	struct rtentry		*rt = NULL;
 	u_int32_t		 mtu;
 	u_int16_t		 hdrlen, extoff, maxlen;
 	u_int8_t		 proto;
@@ -742,6 +743,16 @@ pf_refragment6(struct mbuf **m0, struct m_tag *mtag, struct sockaddr_in6 *dst,
 		DPFPRINTF(LOG_NOTICE, "refragment error %d", error);
 		action = PF_DROP;
 	}
+
+	if (ifp == NULL) {
+		rt = rtalloc(sin6tosa(dst), RT_RESOLVE,
+		    m->m_pkthdr.ph_rtableid);
+		if (rt == NULL) {
+			ip6stat.ip6s_noroute++;
+			error = -1;
+		}
+	}
+
 	for (t = m; m; m = t) {
 		t = m->m_nextpkt;
 		m->m_nextpkt = NULL;
@@ -750,7 +761,7 @@ pf_refragment6(struct mbuf **m0, struct m_tag *mtag, struct sockaddr_in6 *dst,
 			if (ifp == NULL) {
 				ip6_forward(m, 0);
 			} else if ((u_long)m->m_pkthdr.len <= ifp->if_mtu) {
-				nd6_output(ifp, m, dst, NULL);
+				nd6_output(ifp, m, dst, rt);
 			} else {
 				icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0,
 				    ifp->if_mtu);
@@ -759,6 +770,7 @@ pf_refragment6(struct mbuf **m0, struct m_tag *mtag, struct sockaddr_in6 *dst,
 			m_freem(m);
 		}
 	}
+	rtfree(rt);
 
 	return (action);
 }