Commit ecddc523cfdb for kernel

commit ecddc523cfdb85b3e132f13e293224ebfdfab564
Author: Kuniyuki Iwashima <kuniyu@google.com>
Date:   Wed May 6 07:04:42 2026 +0000

    tcp: Fix dst leak in tcp_v6_connect().

    If a socket is bound to a wildcard address, tcp_v[46]_connect()
    updates it with a non-wildcard address based on the route lookup.

    After bhash2 was introduced in the cited commit, we must call
    inet_bhash2_update_saddr() to update the bhash2 entry as well.

    If inet_bhash2_update_saddr() fails, we must release the refcount
    for dst by ip_route_connect() or ip6_dst_lookup_flow().

    While tcp_v4_connect() calls ip_rt_put() in the error path,
    tcp_v6_connect() does not call dst_release().

    Let's call dst_release() when inet_bhash2_update_saddr() fails
    in tcp_v6_connect().

    Fixes: 28044fc1d495 ("net: Add a bhash2 table hashed by port and address")
    Reported-by: Damiano Melotti <melotti@google.com>
    Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260506070443.1699879-1-kuniyu@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 51583aef0643..d13d49bfef19 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -288,8 +288,10 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
 		saddr = &fl6->saddr;

 		err = inet_bhash2_update_saddr(sk, saddr, AF_INET6);
-		if (err)
+		if (err) {
+			dst_release(dst);
 			goto failure;
+		}
 	}

 	/* set the source address */