1 files changed, 7 insertions, 16 deletions

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index fa9512d86f3..02162cfa504 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -165,6 +165,8 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 } else
                         dst_hold(dst);
 
+                dst->ops->update_pmtu(dst, ntohl(info));
+
                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
                         dccp_sync_mss(sk, dst_mtu(dst));
                 } /* else let the usual retransmit timer handle it */
@@ -237,7 +239,6 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req,
         struct inet6_request_sock *ireq6 = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sk_buff *skb;
-        struct ipv6_txoptions *opt = NULL;
         struct in6_addr *final_p, final;
         struct flowi6 fl6;
         int err = -1;
@@ -253,9 +254,8 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req,
         fl6.fl6_sport = inet_rsk(req)->loc_port;
         security_req_classify_flow(req, flowi6_to_flowi(&fl6));
 
-        opt = np->opt;
 
-        final_p = fl6_update_dst(&fl6, opt, &final);
+        final_p = fl6_update_dst(&fl6, np->opt, &final);
 
         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
         if (IS_ERR(dst)) {
@@ -272,13 +272,11 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req,
                                                          &ireq6->loc_addr,
                                                          &ireq6->rmt_addr);
                 fl6.daddr = ireq6->rmt_addr;
-                err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
+                err = ip6_xmit(sk, skb, &fl6, np->opt, np->tclass);
                 err = net_xmit_eval(err);
         }
 
 done:
-        if (opt != NULL && opt != np->opt)
-                sock_kfree_s(sk, opt, opt->tot_len);
         dst_release(dst);
         return err;
 }
@@ -473,7 +471,6 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
         struct inet_sock *newinet;
         struct dccp6_sock *newdp6;
         struct sock *newsk;
-        struct ipv6_txoptions *opt;
 
         if (skb->protocol == htons(ETH_P_IP)) {
                 /*
@@ -518,7 +515,6 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
                 return newsk;
         }
 
-        opt = np->opt;
 
         if (sk_acceptq_is_full(sk))
                 goto out_overflow;
@@ -530,7 +526,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
                 memset(&fl6, 0, sizeof(fl6));
                 fl6.flowi6_proto = IPPROTO_DCCP;
                 fl6.daddr = ireq6->rmt_addr;
-                final_p = fl6_update_dst(&fl6, opt, &final);
+                final_p = fl6_update_dst(&fl6, np->opt, &final);
                 fl6.saddr = ireq6->loc_addr;
                 fl6.flowi6_oif = sk->sk_bound_dev_if;
                 fl6.fl6_dport = inet_rsk(req)->rmt_port;
@@ -595,11 +591,8 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
          * Yes, keeping reference count would be much more clever, but we make
          * one more one thing there: reattach optmem to newsk.
          */
-        if (opt != NULL) {
-                newnp->opt = ipv6_dup_options(newsk, opt);
-                if (opt != np->opt)
-                        sock_kfree_s(sk, opt, opt->tot_len);
-        }
+        if (np->opt != NULL)
+                newnp->opt = ipv6_dup_options(newsk, np->opt);
 
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (newnp->opt != NULL)
@@ -625,8 +618,6 @@ out_nonewsk:
         dst_release(dst);
 out:
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
-        if (opt != NULL && opt != np->opt)
-                sock_kfree_s(sk, opt, opt->tot_len);
         return NULL;
 }