So this is clearly an improvement over the current state of things. However, I think there is still a very slight race condition in the error case, since I imagine udp early demux might find the socket while ip6_datagram_dst_update() is running.
It's possible that inet_dport assignment could simply be postponed until after the ip6_datagram_dst_update() call. Another possibility would be to make the early demux code only capable of finding TCP_ESTABLISHED sockets. That said, I'm not sure what the right call would be.