From 723758b7ce99f88833ad313418c47a1e29f26f00 Mon Sep 17 00:00:00 2001
From: "Andrey V. Elsukov" <ae@FreeBSD.org>
Date: Tue, 2 Aug 2016 12:18:06 +0000
Subject: [PATCH] Fix NULL pointer dereference. ro pointer can be NULL when
 IPSec consumes mbuf.

PR:		211486
MFC after:	3 days
---
 sys/netinet6/ip6_output.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index a393cb51aaac..f31679e3bd9f 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1058,7 +1058,8 @@ done:
 	 * Release the route if using our private route, or if
 	 * (with flowtable) we don't have our own reference.
 	 */
-	if (ro == &ip6route || ro->ro_flags & RT_NORTREF)
+	if (ro == &ip6route ||
+	    (ro != NULL && ro->ro_flags & RT_NORTREF))
 		RO_RTFREE(ro);
 	return (error);