From IT# 55725:

This bug was reported for the U4 beta, but it's in U3 as well.

Description of problem:

 The ipv6 ping packet can be transmitted only up to 1024 times or less
by repeatedly executing the "interface up/down" processing and the
transmission of the ipv6 ping packet according to the following procedure.
 This cause is leak of the dst_entry structure.

Version-Release number of selected component (if applicable):
2.4.21-20.EL

How reproducible:
Always

Steps to Reproduce:
1.Connect two hosts:
      |host1|-(eth0)-------(LAN)---------|host2|
       3ffe:501:ffff::1        3ffe:501:ffff::2
      (RHEL3 is installed in the host1.)

2. Execute the following processing more than 1024 times repeatedly at
host1.

       # ifconfig eth0 down
       # ifconfig eth0 up
       # sleep 3
       # ifconfig eth0 add 3ffe:501:ffff::1/64
       # sleep 3
       # ping6 -c1 3ffe:501:ffff::2

3. 
    

Actual Results:  The ping6 command fails after 1025 times though it
succeeds 1024 times.

Expected Results:  The ping6 command should succeed more than 1024 times.

  note: The value 1024 is the value of
        /proc/sys/net/ipv6/neigh/default/gc_thresh3.

Additional info:

There are editing mistakes in functions
 ip6_{push,flush}_pending_frames()

 This problem can be solved by applying the undermentioned patch.

--- ip6_output.c.ORIG   2004-11-29 18:51:58.000000000 +0900
+++ ip6_output.c        2004-11-29 18:53:08.000000000 +0900
@@ -1475,6 +1475,7 @@
               np->cork.opt = NULL;
       }
       if (np->cork.rt) {
+               dst_release(&np->cork.rt->u.dst);
               np->cork.rt = NULL;
       }
       if (np->cork.fl) {
@@ -1502,7 +1503,6 @@
       }
       if (np->cork.rt) {
               dst_release(&np->cork.rt->u.dst);
-               dst_release(&np->cork.rt->u.dst);
               np->cork.rt = NULL;
       }
       if (np->cork.fl) {