A new RTF_CACHE route can be created with the socket's dst cache update between the below calls in udpv6_sendmsg(), when datagram sending results to ICMPV6_PKT_TOOBIG error:
dst = ip6_sk_dst_lookup_flow(...) ... release_dst: if (dst) { if (connected) ip6_dst_store(sk, dst) Therefore, the new socket's dst cache reset to the old one on "release_dst:". The first two patches prepare the code to store dst cache with ip6_sk_dst_lookup_flow() in udpv6_sendmsg(): * the first patch adds new wrapper ip6_dst_store_flow() to increase readability of the code and the changes. * the second patch adds new argument to ip6_sk_dst_lookup_flow() and ability to store dst in the socket's cache. Also, the two users of the function are updated without enabling the new behavior: pingv6_sendmsg() and udpv6_sendmsg(). The last patch contains the actual fix that removes sk dst cache update in the end of udpv6_sendmsg(), and allows to do it in ip6_sk_dst_lookup_flow(). v3: * instead of moving ip6_dst_store() above udp_v6_send_skb(), update socket's dst cache inside ip6_sk_dst_lookup_flow() if the current one is invalid. * the issue not reproduced in 4.1, but starting from 4.2. Add one more 'Fixes:' commit that creates new RTF_CACHE route. Though, it is also mentioned in the first one. Alexey Kodanev (3): ipv6: move ip6_dst_store() calls with flowi6 checks to a wrapper ipv6: allow to cache dst for connected sk in ip6_sk_dst_lookup_flow() ipv6: udp6: set dst cache for a connected sk if current not valid include/net/ip6_route.h | 17 +++++++++++++++++ include/net/ipv6.h | 3 ++- net/ipv6/datagram.c | 9 +-------- net/ipv6/ip6_output.c | 15 ++++++++++++--- net/ipv6/ping.c | 2 +- net/ipv6/udp.c | 21 ++------------------- 6 files changed, 35 insertions(+), 32 deletions(-) -- 1.8.3.1