In raw_diag_destroy the helper raw_sock_get returns with sock_hold call, so we have to put it then.
CC: David S. Miller <da...@davemloft.net> CC: Eric Dumazet <eric.duma...@gmail.com> CC: David Ahern <d...@cumulusnetworks.com> CC: Andrey Vagin <ava...@openvz.org> CC: Stephen Hemminger <step...@networkplumber.org> Signed-off-by: Cyrill Gorcunov <gorcu...@openvz.org> --- net/ipv4/raw_diag.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) Index: linux-ml.git/net/ipv4/raw_diag.c =================================================================== --- linux-ml.git.orig/net/ipv4/raw_diag.c +++ linux-ml.git/net/ipv4/raw_diag.c @@ -205,11 +205,14 @@ static int raw_diag_destroy(struct sk_bu { struct net *net = sock_net(in_skb->sk); struct sock *sk; + int err; sk = raw_sock_get(net, r); if (IS_ERR(sk)) return PTR_ERR(sk); - return sock_diag_destroy(sk, ECONNABORTED); + err = sock_diag_destroy(sk, ECONNABORTED); + sock_put(sk); + return err; } #endif