In raw_diag_destroy the helper raw_sock_get returns with sock_hold call, so we have to put it then. CC: David S. Miller CC: Eric Dumazet CC: David Ahern CC: Andrey Vagin CC: Stephen Hemminger Signed-off-by: Cyrill Gorcunov --- net/ipv4/raw_diag.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) Index: linux-ml.git/net/ipv4/raw_diag.c =================================================================== --- linux-ml.git.orig/net/ipv4/raw_diag.c +++ linux-ml.git/net/ipv4/raw_diag.c @@ -205,11 +205,14 @@ static int raw_diag_destroy(struct sk_bu { struct net *net = sock_net(in_skb->sk); struct sock *sk; + int err; sk = raw_sock_get(net, r); if (IS_ERR(sk)) return PTR_ERR(sk); - return sock_diag_destroy(sk, ECONNABORTED); + err = sock_diag_destroy(sk, ECONNABORTED); + sock_put(sk); + return err; } #endif