From: Eric Dumazet <redacted>
Date: Wed, 26 Nov 2008 01:00:30 +0100

Hum... for a tcp connection, dst refcount should already be pinned
by a sk->sk_dst_cache. Maybe test refcount value, and if this value
is > 1, dont take a reference. (given rcu_read_lock() is done before
calling ip_rcv_finish())

Input route is different from output route.  sk->sk_dst_cache holds
the output route.  So I can't see how this can help here.