[PATCH net 1/1] rxrpc: release IPv6 dst on route error

[Zhiling Zou]

rxrpc_assess_MTU_size() returns early when IPv6 route lookup fails, but
ip6_route_output() returns a referenced dst even for an error route.
Release the dst before returning to avoid leaking a reference for each
new peer created against an unreachable IPv6 destination.

Fixes: 07096f612fdf ("rxrpc: Fix checking of error from ip6_route_output()")
Cc: stable at vger.kernel.org
Reported-by: Vega <vega at nebusec.ai>
Assisted-by: LLM
Signed-off-by: Zhiling Zou <zhilinz at nebusec.ai>
---
 net/rxrpc/peer_object.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index fa9a406e11683..984ab8380e925 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -193,6 +193,7 @@ void rxrpc_assess_MTU_size(struct rxrpc_local *local, struct rxrpc_peer *peer)
 		dst = ip6_route_output(net, NULL, fl6);
 		if (dst->error) {
 			_leave(" [route err %d]", dst->error);
+			dst_release(dst);
 			return;
 		}
 		break;
-- 
2.55.0