1 files changed, 9 insertions, 6 deletions

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index d4ce1224e008..b963f35c65f6 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -168,7 +168,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                 goto out;
                         }
 
-                        err = xfrm_lookup(&dst, &fl, sk, 0);
+                        err = xfrm_lookup(net, &dst, &fl, sk, 0);
                         if (err < 0) {
                                 sk->sk_err_soft = -err;
                                 goto out;
@@ -279,7 +279,7 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req)
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        err = xfrm_lookup(&dst, &fl, sk, 0);
+        err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0);
         if (err < 0)
                 goto done;
 
@@ -304,6 +304,7 @@ done:
 
 static void dccp_v6_reqsk_destructor(struct request_sock *req)
 {
+        dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
         if (inet6_rsk(req)->pktopts != NULL)
                 kfree_skb(inet6_rsk(req)->pktopts);
 }
@@ -342,7 +343,7 @@ static void dccp_v6_ctl_send_reset(struct sock *sk, struct sk_buff *rxskb)
 
         /* sk = NULL, but it is safe for now. RST socket required. */
         if (!ip6_dst_lookup(ctl_sk, &skb->dst, &fl)) {
-                if (xfrm_lookup(&skb->dst, &fl, NULL, 0) >= 0) {
+                if (xfrm_lookup(net, &skb->dst, &fl, NULL, 0) >= 0) {
                         ip6_xmit(ctl_sk, skb, &fl, NULL, 0);
                         DCCP_INC_STATS_BH(DCCP_MIB_OUTSEGS);
                         DCCP_INC_STATS_BH(DCCP_MIB_OUTRSTS);
@@ -426,7 +427,8 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         if (req == NULL)
                 goto drop;
 
-        dccp_reqsk_init(req, skb);
+        if (dccp_reqsk_init(req, dccp_sk(sk), skb))
+                goto drop_and_free;
 
         dreq = dccp_rsk(req);
         if (dccp_parse_options(sk, dreq, skb))
@@ -567,7 +569,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
                 if (final_p)
                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-                if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+                if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                         goto out;
         }
 
@@ -1002,7 +1004,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT);
+        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
         if (err < 0) {
                 if (err == -EREMOTE)
                         err = ip6_dst_blackhole(sk, &dst, &fl);
@@ -1138,6 +1140,7 @@ static struct proto dccp_v6_prot = {
         .orphan_count      = &dccp_orphan_count,
         .max_header        = MAX_DCCP_HEADER,
         .obj_size          = sizeof(struct dccp6_sock),
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .rsk_prot          = &dccp6_request_sock_ops,
         .twsk_prot         = &dccp6_timewait_sock_ops,
         .h.hashinfo        = &dccp_hashinfo,