x25_connect() takes a reference on the route with x25_get_route() and drops it at out_put_route. The nonblocking path after x25_write_internal() jumps straight to out instead, so the reference is leaked on every nonblocking connect. That path cannot use out_put_neigh because the neighbour is still needed by the pending call, but the route is no longer referenced once the neighbour has been looked up. Jump to out_put_route so only the route reference is dropped. Fixes: e21dba7a4df4 ("net/x25: fix nonblocking connect") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- net/x25/af_x25.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c index f45c9ec7d2c6..89e0f247c5b1 100644 --- a/net/x25/af_x25.c +++ b/net/x25/af_x25.c @@ -812,7 +812,7 @@ static int x25_connect(struct socket *sock, struct sockaddr_unsized *uaddr, /* Now the loop */ rc = -EINPROGRESS; if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK)) - goto out; + goto out_put_route; rc = x25_wait_for_connection_establishment(sk); if (rc) -- 2.34.1