Here's a patch originally from Keir Fraser, which we included in SLES10,
but which we forgot to submit upstream so far.

During stress testing, machines were frequently crashing in
__ipv6_ifa_notify on dst_hold(&ifp->rt.u_dst), with ifp->rt being a
NULL pointer.

The attached patch fixes the problem.

Thanks,
Olaf
-- 
Olaf Kirch   |  --- o --- Nous sommes du soleil we love when we play
okir@suse.de |    / | \   sol.dhoop.naytheet.ah kin.ir.samse.qurax