--- net/ipv6/netfilter/ip6t_REJECT.c

+++ net/ipv6/netfilter/ip6t_REJECT.c

@@ -95,9 +95,11 @@ static void send_reset(struct net *net,

fl.fl_ip_dport = otcph.source;

security_skb_classify_flow(oldskb, &fl);

dst = ip6_route_output(net, NULL, &fl);

- if (dst == NULL)

+ if (dst == NULL || dst->error) {

+ dst_release(dst);

return;

- if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0))

+ }

+ if (xfrm_lookup(net, &dst, &fl, NULL, 0))

return;

hh_len = (dst->dev->hard_header_len + 15)&~15;