1 files changed, 7 insertions, 4 deletions

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 608a5446d05b..8fef859db35d 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -95,6 +95,7 @@
 #include <linux/mm.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/tcp_states.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
@@ -471,8 +472,8 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
                         if (hslot->count < hslot2->count)
                                 goto begin;
 
-                        result = udp4_lib_lookup2(net, INADDR_ANY, sport,
-                                                  daddr, hnum, dif,
+                        result = udp4_lib_lookup2(net, saddr, sport,
+                                                  INADDR_ANY, hnum, dif,
                                                   hslot2, slot2);
                 }
                 rcu_read_unlock();
@@ -1371,8 +1372,10 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 rc = __udp_queue_rcv_skb(sk, skb);
-        else
-                sk_add_backlog(sk, skb);
+        else if (sk_add_backlog(sk, skb)) {
+                bh_unlock_sock(sk);
+                goto drop;
+        }
         bh_unlock_sock(sk);
 
         return rc;