Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix wrong TCP checksums on MTU probing when checksum offloading is
    disabled, from Douglas Caetano dos Santos.

 2) Fix qdisc backlog updates in qfq and sfb schedulers, from Cong Wang.

 3) Route lookup flow key protocol value is wrong in ip6gre_xmit_other(),
    fix from Lance Richardson.

 4) Scheduling while atomic in multicast routing code of ipv4 and ipv6,
    fix from Nikolay Aleksandrov.

 5) Fix packet alignment in fec driver, from Eric Nelson.

 6) Fix perf regression in sctp due to struct layout and cache misses,
    from Xin Long.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  sctp: fix the issue sctp_diag uses lock_sock in rcu_read_lock
  sctp: change to check peer prsctp_capable when using prsctp polices
  sctp: remove prsctp_param from sctp_chunk
  sctp: move sent_count to the memory hole in sctp_chunk
  tg3: Avoid NULL pointer dereference in tg3_io_error_detected()
  act_ife: Fix false encoding
  act_ife: Fix external mac header on encode
  VSOCK: Don't dec ack backlog twice for rejected connections
  Revert "net: ethernet: bcmgenet: use phydev from struct net_device"
  net: fec: align IP header in hardware
  net: fec: remove QUIRK_HAS_RACC from i.mx27
  net: fec: remove QUIRK_HAS_RACC from i.mx25
  ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route
  ip6_gre: fix flowi6_proto value in ip6gre_xmit_other()
  tcp: fix a compile error in DBGUNDO()
  tcp: fix wrong checksum calculation on MTU probing
  sch_sfb: keep backlog updated with qlen
  sch_qfq: keep backlog updated with qlen
  can: dev: fix deadlock reported after bus-off

16 files changed, 91 insertions, 65 deletions

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index a87bcd2d4a94..5f006e13de56 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2123,7 +2123,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
 
 int ipmr_get_route(struct net *net, struct sk_buff *skb,
                    __be32 saddr, __be32 daddr,
-                   struct rtmsg *rtm, int nowait)
+                   struct rtmsg *rtm, int nowait, u32 portid)
 {
         struct mfc_cache *cache;
         struct mr_table *mrt;
@@ -2168,6 +2168,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
                         return -ENOMEM;
                 }
 
+                NETLINK_CB(skb2).portid = portid;
                 skb_push(skb2, sizeof(struct iphdr));
                 skb_reset_network_header(skb2);
                 iph = ip_hdr(skb2);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index b5b47a26d4ec..62c3ed0b7556 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2503,7 +2503,8 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src, u32 table_id,
                     IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
                         int err = ipmr_get_route(net, skb,
                                                  fl4->saddr, fl4->daddr,
-                                                 r, nowait);
+                                                 r, nowait, portid);
+
                         if (err <= 0) {
                                 if (!nowait) {
                                         if (err == 0)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 08323bd95f2a..a756b8749a26 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2329,10 +2329,9 @@ static void DBGUNDO(struct sock *sk, const char *msg)
         }
 #if IS_ENABLED(CONFIG_IPV6)
         else if (sk->sk_family == AF_INET6) {
-                struct ipv6_pinfo *np = inet6_sk(sk);
                 pr_debug("Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
                          msg,
-                         &np->daddr, ntohs(inet->inet_dport),
+                         &sk->sk_v6_daddr, ntohs(inet->inet_dport),
                          tp->snd_cwnd, tcp_left_out(tp),
                          tp->snd_ssthresh, tp->prior_ssthresh,
                          tp->packets_out);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5288cec4a2b2..d48d5571e62a 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1966,12 +1966,14 @@ static int tcp_mtu_probe(struct sock *sk)
         len = 0;
         tcp_for_write_queue_from_safe(skb, next, sk) {
                 copy = min_t(int, skb->len, probe_size - len);
-                if (nskb->ip_summed)
+                if (nskb->ip_summed) {
                         skb_copy_bits(skb, 0, skb_put(nskb, copy), copy);
-                else
-                        nskb->csum = skb_copy_and_csum_bits(skb, 0,
-                                                            skb_put(nskb, copy),
-                                                            copy, nskb->csum);
+                } else {
+                        __wsum csum = skb_copy_and_csum_bits(skb, 0,
+                                                             skb_put(nskb, copy),
+                                                             copy, 0);
+                        nskb->csum = csum_block_add(nskb->csum, csum, len);
+                }
 
                 if (skb->len <= copy) {
                         /* We've eaten all the data from this skb.
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 704274cbd495..edc3daab354e 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -648,7 +648,6 @@ static int ip6gre_xmit_other(struct sk_buff *skb, struct net_device *dev)
                 encap_limit = t->parms.encap_limit;
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
-        fl6.flowi6_proto = skb->protocol;
 
         err = gre_handle_offloads(skb, !!(t->parms.o_flags & TUNNEL_CSUM));
         if (err)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index fccb5dd91902..7f4265b1649b 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -2285,8 +2285,8 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
         return 1;
 }
 
-int ip6mr_get_route(struct net *net,
-                    struct sk_buff *skb, struct rtmsg *rtm, int nowait)
+int ip6mr_get_route(struct net *net, struct sk_buff *skb, struct rtmsg *rtm,
+                    int nowait, u32 portid)
 {
         int err;
         struct mr6_table *mrt;
@@ -2331,6 +2331,7 @@ int ip6mr_get_route(struct net *net,
                         return -ENOMEM;
                 }
 
+                NETLINK_CB(skb2).portid = portid;
                 skb_reset_transport_header(skb2);
 
                 skb_put(skb2, sizeof(struct ipv6hdr));
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e3a224b97905..269218aacbea 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3202,7 +3202,9 @@ static int rt6_fill_node(struct net *net,
         if (iif) {
 #ifdef CONFIG_IPV6_MROUTE
                 if (ipv6_addr_is_multicast(&rt->rt6i_dst.addr)) {
-                        int err = ip6mr_get_route(net, skb, rtm, nowait);
+                        int err = ip6mr_get_route(net, skb, rtm, nowait,
+                                                  portid);
+
                         if (err <= 0) {
                                 if (!nowait) {
                                         if (err == 0)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index e87cd81315e1..4a60cd5e1875 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -53,7 +53,7 @@ int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, const void *dval)
         u32 *tlv = (u32 *)(skbdata);
         u16 totlen = nla_total_size(dlen);      /*alignment + hdr */
         char *dptr = (char *)tlv + NLA_HDRLEN;
-        u32 htlv = attrtype << 16 | dlen;
+        u32 htlv = attrtype << 16 | (dlen + NLA_HDRLEN);
 
         *tlv = htonl(htlv);
         memset(dptr, 0, totlen - NLA_HDRLEN);
@@ -627,7 +627,7 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
         struct tcf_ife_info *ife = to_ife(a);
         int action = ife->tcf_action;
         struct ifeheadr *ifehdr = (struct ifeheadr *)skb->data;
-        u16 ifehdrln = ifehdr->metalen;
+        int ifehdrln = (int)ifehdr->metalen;
         struct meta_tlvhdr *tlv = (struct meta_tlvhdr *)(ifehdr->tlv_data);
 
         spin_lock(&ife->tcf_lock);
@@ -740,8 +740,6 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
                 return TC_ACT_SHOT;
         }
 
-        iethh = eth_hdr(skb);
-
         err = skb_cow_head(skb, hdrm);
         if (unlikely(err)) {
                 ife->tcf_qstats.drops++;
@@ -752,6 +750,7 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
         if (!(at & AT_EGRESS))
                 skb_push(skb, skb->dev->hard_header_len);
 
+        iethh = (struct ethhdr *)skb->data;
         __skb_push(skb, hdrm);
         memcpy(skb->data, iethh, skb->mac_len);
         skb_reset_mac_header(skb);
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index f27ffee106f6..ca0516e6f743 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -1153,6 +1153,7 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
         if (!skb)
                 return NULL;
 
+        qdisc_qstats_backlog_dec(sch, skb);
         sch->q.qlen--;
         qdisc_bstats_update(sch, skb);
 
@@ -1256,6 +1257,7 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         }
 
         bstats_update(&cl->bstats, skb);
+        qdisc_qstats_backlog_inc(sch, skb);
         ++sch->q.qlen;
 
         agg = cl->agg;
@@ -1476,6 +1478,7 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
                         qdisc_reset(cl->qdisc);
                 }
         }
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
 }
 
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index add3cc7d37ec..20a350bd1b1d 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -400,6 +400,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 enqueue:
         ret = qdisc_enqueue(skb, child, to_free);
         if (likely(ret == NET_XMIT_SUCCESS)) {
+                qdisc_qstats_backlog_inc(sch, skb);
                 sch->q.qlen++;
                 increment_qlen(skb, q);
         } else if (net_xmit_drop_count(ret)) {
@@ -428,6 +429,7 @@ static struct sk_buff *sfb_dequeue(struct Qdisc *sch)
 
         if (skb) {
                 qdisc_bstats_update(sch, skb);
+                qdisc_qstats_backlog_dec(sch, skb);
                 sch->q.qlen--;
                 decrement_qlen(skb, q);
         }
@@ -450,6 +452,7 @@ static void sfb_reset(struct Qdisc *sch)
         struct sfb_sched_data *q = qdisc_priv(sch);
 
         qdisc_reset(q->qdisc);
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
         q->slot = 0;
         q->double_buffering = false;
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index a55e54738b81..0a3dbec0a8fb 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -179,6 +179,11 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                          msg, msg->expires_at, jiffies);
         }
 
+        if (asoc->peer.prsctp_capable &&
+            SCTP_PR_TTL_ENABLED(sinfo->sinfo_flags))
+                msg->expires_at =
+                        jiffies + msecs_to_jiffies(sinfo->sinfo_timetolive);
+
         /* This is the biggest possible DATA chunk that can fit into
          * the packet
          */
@@ -335,7 +340,7 @@ errout:
 /* Check whether this message has expired. */
 int sctp_chunk_abandoned(struct sctp_chunk *chunk)
 {
-        if (!chunk->asoc->prsctp_enable ||
+        if (!chunk->asoc->peer.prsctp_capable ||
             !SCTP_PR_POLICY(chunk->sinfo.sinfo_flags)) {
                 struct sctp_datamsg *msg = chunk->msg;
 
@@ -349,14 +354,14 @@ int sctp_chunk_abandoned(struct sctp_chunk *chunk)
         }
 
         if (SCTP_PR_TTL_ENABLED(chunk->sinfo.sinfo_flags) &&
-            time_after(jiffies, chunk->prsctp_param)) {
+            time_after(jiffies, chunk->msg->expires_at)) {
                 if (chunk->sent_count)
                         chunk->asoc->abandoned_sent[SCTP_PR_INDEX(TTL)]++;
                 else
                         chunk->asoc->abandoned_unsent[SCTP_PR_INDEX(TTL)]++;
                 return 1;
         } else if (SCTP_PR_RTX_ENABLED(chunk->sinfo.sinfo_flags) &&
-                   chunk->sent_count > chunk->prsctp_param) {
+                   chunk->sent_count > chunk->sinfo.sinfo_timetolive) {
                 chunk->asoc->abandoned_sent[SCTP_PR_INDEX(RTX)]++;
                 return 1;
         }
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 72e54a416af6..107233da5cc9 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -326,7 +326,7 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk, gfp_t gfp)
 
                         sctp_chunk_hold(chunk);
                         sctp_outq_tail_data(q, chunk);
-                        if (chunk->asoc->prsctp_enable &&
+                        if (chunk->asoc->peer.prsctp_capable &&
                             SCTP_PR_PRIO_ENABLED(chunk->sinfo.sinfo_flags))
                                 chunk->asoc->sent_cnt_removable++;
                         if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
@@ -383,7 +383,7 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
 
         list_for_each_entry_safe(chk, temp, queue, transmitted_list) {
                 if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
-                    chk->prsctp_param <= sinfo->sinfo_timetolive)
+                    chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
                         continue;
 
                 list_del_init(&chk->transmitted_list);
@@ -418,7 +418,7 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
 
         list_for_each_entry_safe(chk, temp, queue, list) {
                 if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
-                    chk->prsctp_param <= sinfo->sinfo_timetolive)
+                    chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
                         continue;
 
                 list_del_init(&chk->list);
@@ -442,7 +442,7 @@ void sctp_prsctp_prune(struct sctp_association *asoc,
 {
         struct sctp_transport *transport;
 
-        if (!asoc->prsctp_enable || !asoc->sent_cnt_removable)
+        if (!asoc->peer.prsctp_capable || !asoc->sent_cnt_removable)
                 return;
 
         msg_len = sctp_prsctp_prune_sent(asoc, sinfo,
@@ -1055,7 +1055,7 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
 
                                 /* Mark as failed send. */
                                 sctp_chunk_fail(chunk, SCTP_ERROR_INV_STRM);
-                                if (asoc->prsctp_enable &&
+                                if (asoc->peer.prsctp_capable &&
                                     SCTP_PR_PRIO_ENABLED(chunk->sinfo.sinfo_flags))
                                         asoc->sent_cnt_removable--;
                                 sctp_chunk_free(chunk);
@@ -1347,7 +1347,7 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_chunk *chunk)
                 tsn = ntohl(tchunk->subh.data_hdr->tsn);
                 if (TSN_lte(tsn, ctsn)) {
                         list_del_init(&tchunk->transmitted_list);
-                        if (asoc->prsctp_enable &&
+                        if (asoc->peer.prsctp_capable &&
                             SCTP_PR_PRIO_ENABLED(chunk->sinfo.sinfo_flags))
                                 asoc->sent_cnt_removable--;
                         sctp_chunk_free(tchunk);
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index f3508aa75815..cef0cee182d4 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -272,28 +272,17 @@ out:
         return err;
 }
 
-static int sctp_tsp_dump(struct sctp_transport *tsp, void *p)
+static int sctp_sock_dump(struct sock *sk, void *p)
 {
-        struct sctp_endpoint *ep = tsp->asoc->ep;
+        struct sctp_endpoint *ep = sctp_sk(sk)->ep;
         struct sctp_comm_param *commp = p;
-        struct sock *sk = ep->base.sk;
         struct sk_buff *skb = commp->skb;
         struct netlink_callback *cb = commp->cb;
         const struct inet_diag_req_v2 *r = commp->r;
-        struct sctp_association *assoc =
-                list_entry(ep->asocs.next, struct sctp_association, asocs);
+        struct sctp_association *assoc;
         int err = 0;
 
-        /* find the ep only once through the transports by this condition */
-        if (tsp->asoc != assoc)
-                goto out;
-
-        if (r->sdiag_family != AF_UNSPEC && sk->sk_family != r->sdiag_family)
-                goto out;
-
         lock_sock(sk);
-        if (sk != assoc->base.sk)
-                goto release;
         list_for_each_entry(assoc, &ep->asocs, asocs) {
                 if (cb->args[4] < cb->args[1])
                         goto next;
@@ -312,7 +301,7 @@ static int sctp_tsp_dump(struct sctp_transport *tsp, void *p)
                                         cb->nlh->nlmsg_seq,
                                         NLM_F_MULTI, cb->nlh) < 0) {
                         cb->args[3] = 1;
-                        err = 2;
+                        err = 1;
                         goto release;
                 }
                 cb->args[3] = 1;
@@ -321,7 +310,7 @@ static int sctp_tsp_dump(struct sctp_transport *tsp, void *p)
                                         sk_user_ns(NETLINK_CB(cb->skb).sk),
                                         NETLINK_CB(cb->skb).portid,
                                         cb->nlh->nlmsg_seq, 0, cb->nlh) < 0) {
-                        err = 2;
+                        err = 1;
                         goto release;
                 }
 next:
@@ -333,10 +322,35 @@ next:
         cb->args[4] = 0;
 release:
         release_sock(sk);
+        sock_put(sk);
         return err;
+}
+
+static int sctp_get_sock(struct sctp_transport *tsp, void *p)
+{
+        struct sctp_endpoint *ep = tsp->asoc->ep;
+        struct sctp_comm_param *commp = p;
+        struct sock *sk = ep->base.sk;
+        struct netlink_callback *cb = commp->cb;
+        const struct inet_diag_req_v2 *r = commp->r;
+        struct sctp_association *assoc =
+                list_entry(ep->asocs.next, struct sctp_association, asocs);
+
+        /* find the ep only once through the transports by this condition */
+        if (tsp->asoc != assoc)
+                goto out;
+
+        if (r->sdiag_family != AF_UNSPEC && sk->sk_family != r->sdiag_family)
+                goto out;
+
+        sock_hold(sk);
+        cb->args[5] = (long)sk;
+
+        return 1;
+
 out:
         cb->args[2]++;
-        return err;
+        return 0;
 }
 
 static int sctp_ep_dump(struct sctp_endpoint *ep, void *p)
@@ -472,10 +486,18 @@ skip:
          * 2 : to record the transport pos of this time's traversal
          * 3 : to mark if we have dumped the ep info of the current asoc
          * 4 : to work as a temporary variable to traversal list
+         * 5 : to save the sk we get from travelsing the tsp list.
          */
         if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
                 goto done;
-        sctp_for_each_transport(sctp_tsp_dump, net, cb->args[2], &commp);
+
+next:
+        cb->args[5] = 0;
+        sctp_for_each_transport(sctp_get_sock, net, cb->args[2], &commp);
+
+        if (cb->args[5] && !sctp_sock_dump((struct sock *)cb->args[5], &commp))
+                goto next;
+
 done:
         cb->args[1] = cb->args[4];
         cb->args[4] = 0;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 8c77b87a8565..46ffecc57214 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -706,20 +706,6 @@ nodata:
         return retval;
 }
 
-static void sctp_set_prsctp_policy(struct sctp_chunk *chunk,
-                                   const struct sctp_sndrcvinfo *sinfo)
-{
-        if (!chunk->asoc->prsctp_enable)
-                return;
-
-        if (SCTP_PR_TTL_ENABLED(sinfo->sinfo_flags))
-                chunk->prsctp_param =
-                        jiffies + msecs_to_jiffies(sinfo->sinfo_timetolive);
-        else if (SCTP_PR_RTX_ENABLED(sinfo->sinfo_flags) ||
-                 SCTP_PR_PRIO_ENABLED(sinfo->sinfo_flags))
-                chunk->prsctp_param = sinfo->sinfo_timetolive;
-}
-
 /* Make a DATA chunk for the given association from the provided
  * parameters.  However, do not populate the data payload.
  */
@@ -753,7 +739,6 @@ struct sctp_chunk *sctp_make_datafrag_empty(struct sctp_association *asoc,
 
         retval->subh.data_hdr = sctp_addto_chunk(retval, sizeof(dp), &dp);
         memcpy(&retval->sinfo, sinfo, sizeof(struct sctp_sndrcvinfo));
-        sctp_set_prsctp_policy(retval, sinfo);
 
 nodata:
         return retval;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9fc417a8b476..8ed2d99bde6d 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4469,17 +4469,21 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *),
                                   const union sctp_addr *paddr, void *p)
 {
         struct sctp_transport *transport;
-        int err = 0;
+        int err = -ENOENT;
 
         rcu_read_lock();
         transport = sctp_addrs_lookup_transport(net, laddr, paddr);
         if (!transport || !sctp_transport_hold(transport))
                 goto out;
-        err = cb(transport, p);
+
+        sctp_association_hold(transport->asoc);
         sctp_transport_put(transport);
 
-out:
         rcu_read_unlock();
+        err = cb(transport, p);
+        sctp_association_put(transport->asoc);
+
+out:
         return err;
 }
 EXPORT_SYMBOL_GPL(sctp_transport_lookup_process);
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 17dbbe64cd73..8a398b3fb532 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -465,6 +465,8 @@ void vsock_pending_work(struct work_struct *work)
 
         if (vsock_is_pending(sk)) {
                 vsock_remove_pending(listener, sk);
+
+                listener->sk_ack_backlog--;
         } else if (!vsk->rejected) {
                 /* We are not on the pending list and accept() did not reject
                  * us, so we must have been accepted by our user process.  We
@@ -475,8 +477,6 @@ void vsock_pending_work(struct work_struct *work)
                 goto out;
         }
 
-        listener->sk_ack_backlog--;
-
         /* We need to remove ourself from the global connected sockets list so
          * incoming packets can't find this socket, and to reduce the reference
          * count.
@@ -2010,5 +2010,5 @@ EXPORT_SYMBOL_GPL(vsock_core_get_transport);
 
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Virtual Socket Family");
-MODULE_VERSION("1.0.1.0-k");
+MODULE_VERSION("1.0.2.0-k");
 MODULE_LICENSE("GPL v2");