1 files changed, 17 insertions, 7 deletions

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 3fb0ed5e4789..372fdc5381a9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -562,10 +562,12 @@ static int __udp4_lib_err_encap_no_sk(struct sk_buff *skb, u32 info)
 
         for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {
                 int (*handler)(struct sk_buff *skb, u32 info);
+                const struct ip_tunnel_encap_ops *encap;
 
-                if (!iptun_encaps[i])
+                encap = rcu_dereference(iptun_encaps[i]);
+                if (!encap)
                         continue;
-                handler = rcu_dereference(iptun_encaps[i]->err_handler);
+                handler = encap->err_handler;
                 if (handler && !handler(skb, info))
                         return 0;
         }
@@ -847,15 +849,23 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
                 const int hlen = skb_network_header_len(skb) +
                                  sizeof(struct udphdr);
 
-                if (hlen + cork->gso_size > cork->fragsize)
+                if (hlen + cork->gso_size > cork->fragsize) {
+                        kfree_skb(skb);
                         return -EINVAL;
-                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
+                }
+                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
+                        kfree_skb(skb);
                         return -EINVAL;
-                if (sk->sk_no_check_tx)
+                }
+                if (sk->sk_no_check_tx) {
+                        kfree_skb(skb);
                         return -EINVAL;
+                }
                 if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite ||
-                    dst_xfrm(skb_dst(skb)))
+                    dst_xfrm(skb_dst(skb))) {
+                        kfree_skb(skb);
                         return -EIO;
+                }
 
                 skb_shinfo(skb)->gso_size = cork->gso_size;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
@@ -1918,7 +1928,7 @@ void udp_lib_rehash(struct sock *sk, u16 newhash)
 }
 EXPORT_SYMBOL(udp_lib_rehash);
 
-static void udp_v4_rehash(struct sock *sk)
+void udp_v4_rehash(struct sock *sk)
 {
         u16 new_hash = ipv4_portaddr_hash(sock_net(sk),
                                           inet_sk(sk)->inet_rcv_saddr,