4 files changed, 8 insertions, 18 deletions

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index ae088d1347af..6298cf58ff9e 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -463,6 +463,7 @@ static int dccp_v4_send_response(struct sock *sk, struct request_sock *req,
         if (skb != NULL) {
                 const struct inet_request_sock *ireq = inet_rsk(req);
 
+                memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
                                             ireq->rmt_addr,
                                             ireq->opt);
@@ -647,6 +648,7 @@ int dccp_v4_send_reset(struct sock *sk, enum dccp_reset_codes code)
         if (skb != NULL) {
                 const struct inet_sock *inet = inet_sk(sk);
 
+                memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                 err = ip_build_and_send_pkt(skb, sk,
                                             inet->saddr, inet->daddr, NULL);
                 if (err == NET_XMIT_CN)
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 4786bdcddcc9..29250749f16f 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -62,10 +62,8 @@ int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 
                 skb->h.raw = skb_push(skb, dccp_header_size);
                 dh = dccp_hdr(skb);
-                /*
-                 * Data packets are not cloned as they are never retransmitted
-                 */
-                if (skb_cloned(skb))
+
+                if (!skb->sk)
                         skb_set_owner_w(skb, sk);
 
                 /* Build DCCP header and checksum it. */
@@ -102,6 +100,7 @@ int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 
                 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
 
+                memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                 err = ip_queue_xmit(skb, 0);
                 if (err <= 0)
                         return err;
@@ -243,7 +242,8 @@ int dccp_write_xmit(struct sock *sk, struct sk_buff *skb, long *timeo)
 
                 err = dccp_transmit_skb(sk, skb);
                 ccid_hc_tx_packet_sent(dp->dccps_hc_tx_ccid, sk, 0, len);
-        }
+        } else
+                kfree_skb(skb);
 
         return err;
 }
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index a1cfd0e9e3bc..a021c3422f67 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -402,8 +402,6 @@ int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *     This bug was _quickly_ found & fixed by just looking at an OSTRA
          *     generated callgraph 8) -acme
          */
-        if (rc != 0)
-                goto out_discard;
 out_release:
         release_sock(sk);
         return rc ? : len;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7114031fdc70..b907456a79f4 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -435,17 +435,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         int nsize, old_factor;
         u16 flags;
 
-        if (unlikely(len >= skb->len)) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TCP: seg_size=%u, mss=%u, seq=%u, "
-                               "end_seq=%u, skb->len=%u.\n", len, mss_now,
-                               TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
-                               skb->len);
-                        WARN_ON(1);
-                }
-                return 0;
-        }
-
+        BUG_ON(len > skb->len);
         nsize = skb_headlen(skb) - len;
         if (nsize < 0)
                 nsize = 0;