1 files changed, 17 insertions, 12 deletions

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index ee90d74d7516..46b6ed534ef2 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -41,6 +41,7 @@
 #include "link.h"
 #include "name_distr.h"
 #include "socket.h"
+#include "bcast.h"
 
 #define SS_LISTENING            -1      /* socket is listening */
 #define SS_READY                -2      /* socket is connectionless */
@@ -342,7 +343,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
         }
 
         /* Allocate socket's protocol area */
-        sk = sk_alloc(net, AF_TIPC, GFP_KERNEL, &tipc_proto);
+        sk = sk_alloc(net, AF_TIPC, GFP_KERNEL, &tipc_proto, kern);
         if (sk == NULL)
                 return -ENOMEM;
 
@@ -409,7 +410,7 @@ static int tipc_release(struct socket *sock)
         struct net *net;
         struct tipc_sock *tsk;
         struct sk_buff *skb;
-        u32 dnode, probing_state;
+        u32 dnode;
 
         /*
          * Exit if socket isn't fully initialized (occurs when a failed accept()
@@ -447,10 +448,7 @@ static int tipc_release(struct socket *sock)
         }
 
         tipc_sk_withdraw(tsk, 0, NULL);
-        probing_state = tsk->probing_state;
-        if (del_timer_sync(&sk->sk_timer) &&
-            probing_state != TIPC_CONN_PROBING)
-                sock_put(sk);
+        sk_stop_timer(sk, &sk->sk_timer);
         tipc_sk_remove(tsk);
         if (tsk->connected) {
                 skb = tipc_msg_create(TIPC_CRITICAL_IMPORTANCE,
@@ -1764,13 +1762,14 @@ static int tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
 int tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq)
 {
         u32 dnode, dport = 0;
-        int err = -TIPC_ERR_NO_PORT;
+        int err;
         struct sk_buff *skb;
         struct tipc_sock *tsk;
         struct tipc_net *tn;
         struct sock *sk;
 
         while (skb_queue_len(inputq)) {
+                err = -TIPC_ERR_NO_PORT;
                 skb = NULL;
                 dport = tipc_skb_peek_port(inputq, dport);
                 tsk = tipc_sk_lookup(net, dport);
@@ -2141,11 +2140,17 @@ static void tipc_sk_timeout(unsigned long data)
         peer_node = tsk_peer_node(tsk);
 
         if (tsk->probing_state == TIPC_CONN_PROBING) {
-                /* Previous probe not answered -> self abort */
-                skb = tipc_msg_create(TIPC_CRITICAL_IMPORTANCE,
-                                      TIPC_CONN_MSG, SHORT_H_SIZE, 0,
-                                      own_node, peer_node, tsk->portid,
-                                      peer_port, TIPC_ERR_NO_PORT);
+                if (!sock_owned_by_user(sk)) {
+                        sk->sk_socket->state = SS_DISCONNECTING;
+                        tsk->connected = 0;
+                        tipc_node_remove_conn(sock_net(sk), tsk_peer_node(tsk),
+                                              tsk_peer_port(tsk));
+                        sk->sk_state_change(sk);
+                } else {
+                        /* Try again later */
+                        sk_reset_timer(sk, &sk->sk_timer, (HZ / 20));
+                }
+
         } else {
                 skb = tipc_msg_create(CONN_MANAGER, CONN_PROBE,
                                       INT_H_SIZE, 0, peer_node, own_node,