1 files changed, 3 insertions, 0 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 7ebeed0a877c..3e934fe96f29 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2993,6 +2993,9 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
         skb->destructor = sock_rmem_free;
         atomic_add(skb->truesize, &sk->sk_rmem_alloc);
 
+        /* before exiting rcu section, make sure dst is refcounted */
+        skb_dst_force(skb);
+
         skb_queue_tail(&sk->sk_error_queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_data_ready(sk, skb->len);