[IPV6]: Close small race in ip6_del_rt

There is a small SMP race in ip6_del_rt where we maybe dereferencing a dst
that has been freed.  This patch fixes it.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/ipv6/route.c

@@ -979,9 +979,9 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
 
 	rt6_reset_dflt_pointer(NULL);
 
+	err = fib6_del(rt, nlh, _rtattr);
 	dst_release(&rt->u.dst);
 
-	err = fib6_del(rt, nlh, _rtattr);
 	write_unlock_bh(&rt6_lock);
 
 	return err;