3 files changed, 14 insertions, 5 deletions

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 9efbdbde2b08..91aea071ab27 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -191,6 +191,7 @@ void tipc_link_add_bc_peer(struct tipc_link *snd_l,
 
         snd_l->ackers++;
         rcv_l->acked = snd_l->snd_nxt - 1;
+        snd_l->state = LINK_ESTABLISHED;
         tipc_link_build_bc_init_msg(uc_l, xmitq);
 }
 
@@ -206,6 +207,7 @@ void tipc_link_remove_bc_peer(struct tipc_link *snd_l,
         rcv_l->state = LINK_RESET;
         if (!snd_l->ackers) {
                 tipc_link_reset(snd_l);
+                snd_l->state = LINK_RESET;
                 __skb_queue_purge(xmitq);
         }
 }
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 552dbaba9cf3..b53246fb0412 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -105,6 +105,7 @@ struct tipc_sock {
 static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb);
 static void tipc_data_ready(struct sock *sk);
 static void tipc_write_space(struct sock *sk);
+static void tipc_sock_destruct(struct sock *sk);
 static int tipc_release(struct socket *sock);
 static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags);
 static int tipc_wait_for_sndmsg(struct socket *sock, long *timeo_p);
@@ -381,6 +382,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
         sk->sk_rcvbuf = sysctl_tipc_rmem[1];
         sk->sk_data_ready = tipc_data_ready;
         sk->sk_write_space = tipc_write_space;
+        sk->sk_destruct = tipc_sock_destruct;
         tsk->conn_timeout = CONN_TIMEOUT_DEFAULT;
         tsk->sent_unacked = 0;
         atomic_set(&tsk->dupl_rcvcnt, 0);
@@ -470,9 +472,6 @@ static int tipc_release(struct socket *sock)
                 tipc_node_remove_conn(net, dnode, tsk->portid);
         }
 
-        /* Discard any remaining (connection-based) messages in receive queue */
-        __skb_queue_purge(&sk->sk_receive_queue);
-
         /* Reject any messages that accumulated in backlog queue */
         sock->state = SS_DISCONNECTING;
         release_sock(sk);
@@ -1515,6 +1514,11 @@ static void tipc_data_ready(struct sock *sk)
         rcu_read_unlock();
 }
 
+static void tipc_sock_destruct(struct sock *sk)
+{
+        __skb_queue_purge(&sk->sk_receive_queue);
+}
+
 /**
  * filter_connect - Handle all incoming messages for a connection-based socket
  * @tsk: TIPC socket
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index ad2719ad4c1b..70c03271b798 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -158,8 +158,11 @@ static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
         struct udp_media_addr *src = (struct udp_media_addr *)&b->addr.value;
         struct rtable *rt;
 
-        if (skb_headroom(skb) < UDP_MIN_HEADROOM)
-                pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
+        if (skb_headroom(skb) < UDP_MIN_HEADROOM) {
+                err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
+                if (err)
+                        goto tx_error;
+        }
 
         skb_set_inner_protocol(skb, htons(ETH_P_TIPC));
         ub = rcu_dereference_rtnl(b->media_ptr);