1 files changed, 21 insertions, 12 deletions

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 52b8347ae3b2..90824852f598 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -34,6 +34,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 
 #include <net/ndisc.h>
@@ -258,8 +259,8 @@ static struct sock *__udp6_lib_lookup(struct net *net,
                         if (hslot->count < hslot2->count)
                                 goto begin;
 
-                        result = udp6_lib_lookup2(net, &in6addr_any, sport,
-                                                  daddr, hnum, dif,
+                        result = udp6_lib_lookup2(net, saddr, sport,
+                                                  &in6addr_any, hnum, dif,
                                                   hslot2, slot2);
                 }
                 rcu_read_unlock();
@@ -583,16 +584,20 @@ static void flush_stack(struct sock **stack, unsigned int count,
                         bh_lock_sock(sk);
                         if (!sock_owned_by_user(sk))
                                 udpv6_queue_rcv_skb(sk, skb1);
-                        else
-                                sk_add_backlog(sk, skb1);
+                        else if (sk_add_backlog(sk, skb1)) {
+                                kfree_skb(skb1);
+                                bh_unlock_sock(sk);
+                                goto drop;
+                        }
                         bh_unlock_sock(sk);
-                } else {
-                        atomic_inc(&sk->sk_drops);
-                        UDP6_INC_STATS_BH(sock_net(sk),
-                                        UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
-                        UDP6_INC_STATS_BH(sock_net(sk),
-                                        UDP_MIB_INERRORS, IS_UDPLITE(sk));
+                        continue;
                 }
+drop:
+                atomic_inc(&sk->sk_drops);
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_INERRORS, IS_UDPLITE(sk));
         }
 }
 /*
@@ -754,8 +759,12 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 udpv6_queue_rcv_skb(sk, skb);
-        else
-                sk_add_backlog(sk, skb);
+        else if (sk_add_backlog(sk, skb)) {
+                atomic_inc(&sk->sk_drops);
+                bh_unlock_sock(sk);
+                sock_put(sk);
+                goto discard;
+        }
         bh_unlock_sock(sk);
         sock_put(sk);
         return 0;