From: Kevin Cernekee <cernekee@chromium.org>

NULL sockets are used for NDP, BOOTP, and other critical operations.
If the topmost mbuf in a NULL session is blocked pending resolution,
it may cause problems if it blocks other packets with a NULL socket.
So do not add mbufs with a NULL socket field to the same session.

Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
---
 slirp/if.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/slirp/if.c b/slirp/if.c
index 6262d77495..590753c658 100644
--- a/slirp/if.c
+++ b/slirp/if.c
@@ -73,14 +73,16 @@ if_output(struct socket *so, struct mbuf *ifm)
 	 * We mustn't put this packet back on the fastq (or we'll send it out of order)
 	 * XXX add cache here?
 	 */
-	for (ifq = (struct mbuf *) slirp->if_batchq.qh_rlink;
-	     (struct quehead *) ifq != &slirp->if_batchq;
-	     ifq = ifq->ifq_prev) {
-		if (so == ifq->ifq_so) {
-			/* A match! */
-			ifm->ifq_so = so;
-			ifs_insque(ifm, ifq->ifs_prev);
-			goto diddit;
+	if (so) {
+		for (ifq = (struct mbuf *) slirp->if_batchq.qh_rlink;
+		     (struct quehead *) ifq != &slirp->if_batchq;
+		     ifq = ifq->ifq_prev) {
+			if (so == ifq->ifq_so) {
+				/* A match! */
+				ifm->ifq_so = so;
+				ifs_insque(ifm, ifq->ifs_prev);
+				goto diddit;
+			}
 		}
 	}
 
-- 
2.14.1