3 files changed, 16 insertions, 30 deletions

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 5bffbbaf1fac..25a9615b3b88 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -306,6 +306,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
                 if (!between48(seq, dccp_rsk(req)->dreq_iss,
                                     dccp_rsk(req)->dreq_gss)) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
+                        reqsk_put(req);
                         goto out;
                 }
                 /*
@@ -315,6 +316,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
                  * errors returned from accept().
                  */
                 inet_csk_reqsk_queue_drop(sk, req);
+                reqsk_put(req);
                 goto out;
 
         case DCCP_REQUESTING:
@@ -451,9 +453,11 @@ static struct sock *dccp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
         /* Find possible connection requests. */
         struct request_sock *req = inet_csk_search_req(sk, dh->dccph_sport,
                                                        iph->saddr, iph->daddr);
-        if (req)
-                return dccp_check_req(sk, skb, req);
-
+        if (req) {
+                nsk = dccp_check_req(sk, skb, req);
+                reqsk_put(req);
+                return nsk;
+        }
         nsk = inet_lookup_established(sock_net(sk), &dccp_hashinfo,
                                       iph->saddr, dh->dccph_sport,
                                       iph->daddr, dh->dccph_dport,
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index ae2184039fe3..69d8f13895ba 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -157,7 +157,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 req = inet6_csk_search_req(sk, dh->dccph_dport,
                                            &hdr->daddr, &hdr->saddr,
                                            inet6_iif(skb));
-                if (req == NULL)
+                if (!req)
                         goto out;
 
                 /*
@@ -169,10 +169,12 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 if (!between48(seq, dccp_rsk(req)->dreq_iss,
                                     dccp_rsk(req)->dreq_gss)) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
+                        reqsk_put(req);
                         goto out;
                 }
 
                 inet_csk_reqsk_queue_drop(sk, req);
+                reqsk_put(req);
                 goto out;
 
         case DCCP_REQUESTING:
@@ -322,9 +324,11 @@ static struct sock *dccp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 
         req = inet6_csk_search_req(sk, dh->dccph_sport, &iph->saddr,
                                    &iph->daddr, inet6_iif(skb));
-        if (req != NULL)
-                return dccp_check_req(sk, skb, req);
-
+        if (req) {
+                nsk = dccp_check_req(sk, skb, req);
+                reqsk_put(req);
+                return nsk;
+        }
         nsk = __inet6_lookup_established(sock_net(sk), &dccp_hashinfo,
                                          &iph->saddr, dh->dccph_sport,
                                          &iph->daddr, ntohs(dh->dccph_dport),
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index 1cd46a345cb0..3ef7acef3ce8 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -161,33 +161,11 @@ out:
         sock_put(sk);
 }
 
-/*
- *      Timer for listening sockets
- */
-static void dccp_response_timer(struct sock *sk)
-{
-        inet_csk_reqsk_queue_prune(sk, TCP_SYNQ_INTERVAL, DCCP_TIMEOUT_INIT,
-                                   DCCP_RTO_MAX);
-}
-
 static void dccp_keepalive_timer(unsigned long data)
 {
         struct sock *sk = (struct sock *)data;
 
-        /* Only process if socket is not in use. */
-        bh_lock_sock(sk);
-        if (sock_owned_by_user(sk)) {
-                /* Try again later. */
-                inet_csk_reset_keepalive_timer(sk, HZ / 20);
-                goto out;
-        }
-
-        if (sk->sk_state == DCCP_LISTEN) {
-                dccp_response_timer(sk);
-                goto out;
-        }
-out:
-        bh_unlock_sock(sk);
+        pr_err("dccp should not use a keepalive timer !\n");
         sock_put(sk);
 }