---

yaml
---
r: 310751
b: refs/heads/master
c: 4399a4d
h: refs/heads/master
i:
  310749: d5302e1
  310747: af34d44
  310743: 96447ed
  310735: 93f4f42
  310719: 7d94017
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 6a2b28ef036ab5c66fdc606fe97d9e5cb34ea409
+refs/heads/master: 4399a4df98a63e30fd16e9d0cecc46ea92269e8f

trunk/net/l2tp/l2tp_ip.c

@@ -464,17 +464,20 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
 					   sk->sk_bound_dev_if);
 		if (IS_ERR(rt))
 			goto no_route;
-		if (connected)
+		if (connected) {
 			sk_setup_caps(sk, &rt->dst);
-		else
-			dst_release(&rt->dst); /* safe since we hold rcu_read_lock */
+		} else {
+			skb_dst_set(skb, &rt->dst);
+			goto xmit;
+		}
 	}
 
 	/* We dont need to clone dst here, it is guaranteed to not disappear.
 	 *  __dev_xmit_skb() might force a refcount if needed.
 	 */
 	skb_dst_set_noref(skb, &rt->dst);
 
+xmit:
 	/* Queue the packet to IP for output */
 	rc = ip_queue_xmit(skb, &inet->cork.fl);
 	rcu_read_unlock();