Now all code paths grab a local reference to the neigh, so if neigh
is not NULL we unconditionally release it at the end.  The old logic
would only release if we didn't have a non-NULL 'rt'.
Signed-off-by: David S. Miller <davem@davemloft.net>
 
        rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
 
-       if (rt)
-               neigh = dst_get_neighbour_noref(&rt->dst);
-
+       if (rt) {
+               neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
+               if (!neigh) {
+                       ND_PRINTK0(KERN_ERR
+                                  "ICMPv6 RA: %s() got default router without neighbour.\n",
+                                  __func__);
+                       dst_release(&rt->dst);
+                       return;
+               }
+       }
        if (rt && lifetime == 0) {
-               neigh_clone(neigh);
                ip6_del_rt(rt);
                rt = NULL;
        }
                        return;
                }
 
-               neigh = dst_get_neighbour_noref(&rt->dst);
+               neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
                if (neigh == NULL) {
                        ND_PRINTK0(KERN_ERR
                                   "ICMPv6 RA: %s() got default router without neighbour.\n",
 out:
        if (rt)
                dst_release(&rt->dst);
-       else if (neigh)
+       if (neigh)
                neigh_release(neigh);
 }