1 files changed, 13 insertions, 5 deletions

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 6001948600f3..bf9519341fd3 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -99,7 +99,7 @@ static int udp_v6_get_port(struct sock *sk, unsigned short snum)
                 next:;
                 }
                 result = best;
-                for(;; result += UDP_HTABLE_SIZE) {
+                for(i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++, result += UDP_HTABLE_SIZE) {
                         if (result > sysctl_local_port_range[1])
                                 result = sysctl_local_port_range[0]
                                         + ((result - sysctl_local_port_range[0]) &
@@ -107,6 +107,8 @@ static int udp_v6_get_port(struct sock *sk, unsigned short snum)
                         if (!udp_lport_inuse(result))
                                 break;
                 }
+                if (i >= (1 << 16) / UDP_HTABLE_SIZE)
+                        goto fail;
 gotit:
                 udp_port_rover = snum = result;
         } else {
@@ -852,10 +854,16 @@ do_append_data:
         else if (!corkreq)
                 err = udp_v6_push_pending_frames(sk, up);
 
-        if (dst && connected)
-                ip6_dst_store(sk, dst,
-                              ipv6_addr_equal(&fl->fl6_dst, &np->daddr) ?
-                              &np->daddr : NULL);
+        if (dst) {
+                if (connected) {
+                        ip6_dst_store(sk, dst,
+                                      ipv6_addr_equal(&fl->fl6_dst, &np->daddr) ?
+                                      &np->daddr : NULL);
+                } else {
+                        dst_release(dst);
+                }
+        }
+
         if (err > 0)
                 err = np->recverr ? net_xmit_errno(err) : 0;
         release_sock(sk);