1 files changed, 24 insertions, 14 deletions

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 9cbf363172bd..b444483cdb2b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -102,7 +102,7 @@ int udp_v6_get_port(struct sock *sk, unsigned short snum)
         return udp_lib_get_port(sk, snum, hash2_nulladdr);
 }
 
-static void udp_v6_rehash(struct sock *sk)
+void udp_v6_rehash(struct sock *sk)
 {
         u16 new_hash = ipv6_portaddr_hash(sock_net(sk),
                                           &sk->sk_v6_rcv_saddr,
@@ -288,8 +288,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
         int peeked, peeking, off;
         int err;
         int is_udplite = IS_UDPLITE(sk);
+        struct udp_mib __percpu *mib;
         bool checksum_valid = false;
-        struct udp_mib *mib;
         int is_udp4;
 
         if (flags & MSG_ERRQUEUE)
@@ -420,17 +420,19 @@ EXPORT_SYMBOL(udpv6_encap_enable);
  */
 static int __udp6_lib_err_encap_no_sk(struct sk_buff *skb,
                                       struct inet6_skb_parm *opt,
-                                      u8 type, u8 code, int offset, u32 info)
+                                      u8 type, u8 code, int offset, __be32 info)
 {
         int i;
 
         for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {
                 int (*handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                               u8 type, u8 code, int offset, u32 info);
+                               u8 type, u8 code, int offset, __be32 info);
+                const struct ip6_tnl_encap_ops *encap;
 
-                if (!ip6tun_encaps[i])
+                encap = rcu_dereference(ip6tun_encaps[i]);
+                if (!encap)
                         continue;
-                handler = rcu_dereference(ip6tun_encaps[i]->err_handler);
+                handler = encap->err_handler;
                 if (handler && !handler(skb, opt, type, code, offset, info))
                         return 0;
         }
@@ -1132,15 +1134,23 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
                 const int hlen = skb_network_header_len(skb) +
                                  sizeof(struct udphdr);
 
-                if (hlen + cork->gso_size > cork->fragsize)
+                if (hlen + cork->gso_size > cork->fragsize) {
+                        kfree_skb(skb);
                         return -EINVAL;
-                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
+                }
+                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
+                        kfree_skb(skb);
                         return -EINVAL;
-                if (udp_sk(sk)->no_check6_tx)
+                }
+                if (udp_sk(sk)->no_check6_tx) {
+                        kfree_skb(skb);
                         return -EINVAL;
+                }
                 if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite ||
-                    dst_xfrm(skb_dst(skb)))
+                    dst_xfrm(skb_dst(skb))) {
+                        kfree_skb(skb);
                         return -EIO;
+                }
 
                 skb_shinfo(skb)->gso_size = cork->gso_size;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
@@ -1390,10 +1400,7 @@ do_udp_sendmsg:
         ipc6.opt = opt;
 
         fl6.flowi6_proto = sk->sk_protocol;
-        if (!ipv6_addr_any(daddr))
-                fl6.daddr = *daddr;
-        else
-                fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
+        fl6.daddr = *daddr;
         if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
                 fl6.saddr = np->saddr;
         fl6.fl6_sport = inet->inet_sport;
@@ -1421,6 +1428,9 @@ do_udp_sendmsg:
                 }
         }
 
+        if (ipv6_addr_any(&fl6.daddr))
+                fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
+
         final_p = fl6_update_dst(&fl6, opt, &final);
         if (final_p)
                 connected = false;