3 files changed, 7 insertions, 2 deletions

diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index 11641c9384f7..c5d7f920c352 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -145,7 +145,7 @@ static inline struct request_sock *
 {
         struct request_sock *req = queue->rskq_accept_head;
 
-        queue->rskq_accept_head = queue->rskq_accept_head = NULL;
+        queue->rskq_accept_head = NULL;
         return req;
 }
 
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 98f0fc923f91..1e44eda1fda9 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -51,7 +51,7 @@ int reqsk_queue_alloc(struct request_sock_queue *queue,
 
         get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd));
         rwlock_init(&queue->syn_wait_lock);
-        queue->rskq_accept_head = queue->rskq_accept_head = NULL;
+        queue->rskq_accept_head = NULL;
         lopt->nr_table_entries = nr_table_entries;
 
         write_lock_bh(&queue->syn_wait_lock);
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 028b636687ec..d4cfec3f414e 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -228,6 +228,9 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
 
         t->id.proto = IPPROTO_IPV6;
         t->id.spi = xfrm6_tunnel_alloc_spi((xfrm_address_t *)&x->props.saddr);
+        if (!t->id.spi)
+                goto error;
+
         memcpy(t->id.daddr.a6, x->id.daddr.a6, sizeof(struct in6_addr));
         memcpy(&t->sel, &x->sel, sizeof(t->sel));
         t->props.family = AF_INET6;
@@ -243,7 +246,9 @@ out:
         return t;
 
 error:
+        t->km.state = XFRM_STATE_DEAD;
         xfrm_state_put(t);
+        t = NULL;
         goto out;
 }