[IPV6] fix a dst leakage and clean-up in tcp_v6_connect()

net/ipv6/tcp_ipv6.c

@@ -544,7 +544,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 	struct ipv6_pinfo *np = inet6_sk(sk);
 	struct tcp_opt *tp = tcp_sk(sk);
 	struct in6_addr *saddr = NULL;
-	struct in6_addr saddr_buf;
 	struct flowi fl;
 	struct dst_entry *dst;
 	int addr_type;
@@ -671,23 +670,24 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 		goto failure;
 	}
 
-	ip6_dst_store(sk, dst, NULL);
-	sk->sk_route_caps = dst->dev->features &
-			    ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
-
 	if (saddr == NULL) {
-		err = ipv6_get_saddr(dst, &np->daddr, &saddr_buf);
-		if (err)
+		err = ipv6_get_saddr(dst, &np->daddr, &fl.fl6_src);
+		if (err) {
+			dst_release(dst);
 			goto failure;
-
-		saddr = &saddr_buf;
+		}
+		saddr = &fl.fl6_src;
+		ipv6_addr_copy(&np->rcv_saddr, saddr);
 	}
 
 	/* set the source address */
-	ipv6_addr_copy(&np->rcv_saddr, saddr);
 	ipv6_addr_copy(&np->saddr, saddr);
 	inet->rcv_saddr = LOOPBACK4_IPV6;
 
+	ip6_dst_store(sk, dst, NULL);
+	sk->sk_route_caps = dst->dev->features &
+			    ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
+
 	tp->ext_header_len = 0;
 	if (np->opt)
 		tp->ext_header_len = np->opt->opt_flen + np->opt->opt_nflen;
@@ -714,8 +714,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
 late_failure:
 	tcp_set_state(sk, TCP_CLOSE);
-failure:
 	__sk_dst_reset(sk);
+failure:
 	inet->dport = 0;
 	sk->sk_route_caps = 0;
 	return err;