3 files changed, 11 insertions, 5 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f012ebd87b43..12368c586068 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                         "%s(): cannot allocate memory for statistics; dev=%s.\n",
                         __func__, dev->name));
                 neigh_parms_release(&nd_tbl, ndev->nd_parms);
-                ndev->dead = 1;
-                in6_dev_finish_destroy(ndev);
+                dev_put(dev);
+                kfree(ndev);
                 return NULL;
         }
 
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 705c82886281..def0538e2413 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -696,8 +696,10 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
         int err;
 
         err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         read_lock(&mrt_lock);
         dev->stats.tx_bytes += skb->len;
@@ -2052,8 +2054,10 @@ int ip6_mr_input(struct sk_buff *skb)
         int err;
 
         err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         read_lock(&mrt_lock);
         cache = ip6mr_cache_find(mrt,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1250f9020670..fb545edef6ea 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -244,7 +244,9 @@ static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops,
 {
         struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, flags);
 
-        memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
+        if (rt != NULL)
+                memset(&rt->rt6i_table, 0,
+                        sizeof(*rt) - sizeof(struct dst_entry));
 
         return rt;
 }