ipv6: release reference of ip6_null_entry's dst entry in __ip6_del_rt

as we hold dst_entry before we call __ip6_del_rt,
so we should alse call dst_release not only return
-ENOENT when the rt6_info is ip6_null_entry.

and we already hold the dst entry, so I think it's
safe to call dst_release out of the write-read lock.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 5 deletions

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d1ddbc6ddac5..7c7e963260e1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1593,17 +1593,18 @@ static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
         struct fib6_table *table;
         struct net *net = dev_net(rt->dst.dev);
 
-        if (rt == net->ipv6.ip6_null_entry)
-                return -ENOENT;
+        if (rt == net->ipv6.ip6_null_entry) {
+                err = -ENOENT;
+                goto out;
+        }
 
         table = rt->rt6i_table;
         write_lock_bh(&table->tb6_lock);
-
         err = fib6_del(rt, info);
-        dst_release(&rt->dst);
-
         write_unlock_bh(&table->tb6_lock);
 
+out:
+        dst_release(&rt->dst);
         return err;
 }