1 files changed, 7 insertions, 5 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 82a6f34d39d0..d9d4970b9b07 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1630,8 +1630,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
         if (snaplen > res)
                 snaplen = res;
 
-        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-            (unsigned)sk->sk_rcvbuf)
+        if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
                 goto drop_n_acct;
 
         if (skb_shared(skb)) {
@@ -1762,8 +1761,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
         if (po->tp_version <= TPACKET_V2) {
                 if (macoff + snaplen > po->rx_ring.frame_size) {
                         if (po->copy_thresh &&
-                                atomic_read(&sk->sk_rmem_alloc) + skb->truesize
-                                < (unsigned)sk->sk_rcvbuf) {
+                            atomic_read(&sk->sk_rmem_alloc) < sk->sk_rcvbuf) {
                                 if (skb_shared(skb)) {
                                         copy_skb = skb_clone(skb, GFP_ATOMIC);
                                 } else {
@@ -2450,8 +2448,12 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protoc
 {
         struct packet_sock *po = pkt_sk(sk);
 
-        if (po->fanout)
+        if (po->fanout) {
+                if (dev)
+                        dev_put(dev);
+
                 return -EINVAL;
+        }
 
         lock_sock(sk);