1 files changed, 12 insertions, 9 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index eb6d09728633..dabf108ad811 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -267,7 +267,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         if (net_ratelimit())
                 printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
         skb->dev = dst->dev;
-        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
         kfree_skb(skb);
         return -EMSGSIZE;
@@ -402,6 +402,7 @@ int ip6_forward(struct sk_buff *skb)
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct net *net = dev_net(dst->dev);
+        u32 mtu;
 
         if (net->ipv6.devconf_all->forwarding == 0)
                 goto error;
@@ -441,8 +442,7 @@ int ip6_forward(struct sk_buff *skb)
         if (hdr->hop_limit <= 1) {
                 /* Force OUTPUT device used as source address */
                 skb->dev = dst->dev;
-                icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
-                            0, skb->dev);
+                icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
                 IP6_INC_STATS_BH(net,
                                  ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 
@@ -504,15 +504,19 @@ int ip6_forward(struct sk_buff *skb)
                         goto error;
                 if (addrtype & IPV6_ADDR_LINKLOCAL) {
                         icmpv6_send(skb, ICMPV6_DEST_UNREACH,
-                                ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);
+                                    ICMPV6_NOT_NEIGHBOUR, 0);
                         goto error;
                 }
         }
 
-        if (skb->len > dst_mtu(dst)) {
+        mtu = dst_mtu(dst);
+        if (mtu < IPV6_MIN_MTU)
+                mtu = IPV6_MIN_MTU;
+
+        if (skb->len > mtu) {
                 /* Again, force OUTPUT device used as source address */
                 skb->dev = dst->dev;
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, dst_mtu(dst), skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP6_INC_STATS_BH(net,
                                  ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
                 IP6_INC_STATS_BH(net,
@@ -622,12 +626,11 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         mtu = ip6_skb_dst_mtu(skb);
 
         /* We must not fragment if the socket is set to force MTU discovery
-         * or if the skb it not generated by a local socket.  (This last
-         * check should be redundant, but it's free.)
+         * or if the skb it not generated by a local socket.
          */
         if (!skb->local_df) {
                 skb->dev = skb_dst(skb)->dev;
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                               IPSTATS_MIB_FRAGFAILS);
                 kfree_skb(skb);