--- /dev/null
+From stable-bounces@linux.kernel.org Wed Nov 29 20:26:45 2006
+Date: Wed, 29 Nov 2006 20:21:40 -0800 (PST)
+Message-Id: <20061129.202140.23013142.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Subject: [IPV6] NDISC: Calculate packet length correctly for allocation.
+
+MAX_HEADER does not include the ipv6 header length in it,
+so we need to add it in explicitly.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/ipv6/ndisc.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- linux-2.6.19.orig/net/ipv6/ndisc.c
++++ linux-2.6.19/net/ipv6/ndisc.c
+@@ -441,7 +441,8 @@ static void ndisc_send_na(struct net_dev
+ struct sk_buff *skb;
+ int err;
+
+- len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
++ len = sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) +
++ sizeof(struct in6_addr);
+
+ /* for anycast or proxy, solicited_addr != src_addr */
+ ifp = ipv6_get_ifaddr(solicited_addr, dev, 1);
+@@ -556,7 +557,8 @@ void ndisc_send_ns(struct net_device *de
+ if (err < 0)
+ return;
+
+- len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
++ len = sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) +
++ sizeof(struct in6_addr);
+ send_llinfo = dev->addr_len && !ipv6_addr_any(saddr);
+ if (send_llinfo)
+ len += ndisc_opt_addr_space(dev);
+@@ -632,7 +634,7 @@ void ndisc_send_rs(struct net_device *de
+ if (err < 0)
+ return;
+
+- len = sizeof(struct icmp6hdr);
++ len = sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr);
+ if (dev->addr_len)
+ len += ndisc_opt_addr_space(dev);
+
+@@ -1381,7 +1383,8 @@ void ndisc_send_redirect(struct sk_buff
+ struct in6_addr *target)
+ {
+ struct sock *sk = ndisc_socket->sk;
+- int len = sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
++ int len = sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) +
++ 2 * sizeof(struct in6_addr);
+ struct sk_buff *buff;
+ struct icmp6hdr *icmph;
+ struct in6_addr saddr_buf;