struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC);
 
        if (newsk != NULL) {
-               const struct dccp_request_sock *dreq = dccp_rsk(req);
+               struct dccp_request_sock *dreq = dccp_rsk(req);
                struct inet_connection_sock *newicsk = inet_csk(newsk);
                struct dccp_sock *newdp = dccp_sk(newsk);
                struct dccp_minisock *newdmsk = dccp_msk(newsk);
                newicsk->icsk_rto           = DCCP_TIMEOUT_INIT;
 
                INIT_LIST_HEAD(&newdp->dccps_featneg);
-               if (dccp_feat_clone(sk, newsk))
-                       goto out_free;
-
-               if (newdmsk->dccpms_send_ack_vector) {
-                       newdp->dccps_hc_rx_ackvec =
-                                               dccp_ackvec_alloc(GFP_ATOMIC);
-                       if (unlikely(newdp->dccps_hc_rx_ackvec == NULL))
-                               goto out_free;
-               }
-
-               newdp->dccps_hc_rx_ccid =
-                           ccid_hc_rx_new(newdmsk->dccpms_rx_ccid,
-                                          newsk, GFP_ATOMIC);
-               newdp->dccps_hc_tx_ccid =
-                           ccid_hc_tx_new(newdmsk->dccpms_tx_ccid,
-                                          newsk, GFP_ATOMIC);
-               if (unlikely(newdp->dccps_hc_rx_ccid == NULL ||
-                            newdp->dccps_hc_tx_ccid == NULL)) {
-                       dccp_ackvec_free(newdp->dccps_hc_rx_ackvec);
-                       ccid_hc_rx_delete(newdp->dccps_hc_rx_ccid, newsk);
-                       ccid_hc_tx_delete(newdp->dccps_hc_tx_ccid, newsk);
-out_free:
-                       /* It is still raw copy of parent, so invalidate
-                        * destructor and make plain sk_free() */
-                       newsk->sk_destruct = NULL;
-                       sk_free(newsk);
-                       return NULL;
-               }
-
                /*
                 * Step 3: Process LISTEN state
                 *
                dccp_set_seqno(&newdp->dccps_awl,
                               max48(newdp->dccps_awl, newdp->dccps_iss));
 
+               /*
+                * Activate features after initialising the sequence numbers,
+                * since CCID initialisation may depend on GSS, ISR, ISS etc.
+                */
+               if (dccp_feat_activate_values(newsk, &dreq->dreq_featneg)) {
+                       /* It is still raw copy of parent, so invalidate
+                        * destructor and make plain sk_free() */
+                       newsk->sk_destruct = NULL;
+                       sk_free(newsk);
+                       return NULL;
+               }
                dccp_init_xmit_timers(newsk);
 
                DCCP_INC_STATS_BH(DCCP_MIB_PASSIVEOPENS);