3 files changed, 4 insertions, 2 deletions

diff --git a/net/tipc/group.c b/net/tipc/group.c
index e82f13cb2dc5..06fee142f09f 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -666,6 +666,7 @@ static void tipc_group_create_event(struct tipc_group *grp,
         struct sk_buff *skb;
         struct tipc_msg *hdr;
 
+        memset(&evt, 0, sizeof(evt));
         evt.event = event;
         evt.found_lower = m->instance;
         evt.found_upper = m->instance;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index f6552e4f4b43..201c3b5bc96b 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1041,6 +1041,7 @@ static int tipc_link_retrans(struct tipc_link *l, struct tipc_link *r,
         if (r->last_retransm != buf_seqno(skb)) {
                 r->last_retransm = buf_seqno(skb);
                 r->stale_limit = jiffies + msecs_to_jiffies(r->tolerance);
+                r->stale_cnt = 0;
         } else if (++r->stale_cnt > 99 && time_after(jiffies, r->stale_limit)) {
                 link_retransmit_failure(l, skb);
                 if (link_is_bc_sndlink(l))
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 51b4b96f89db..3cfeb9df64b0 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -115,7 +115,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ)
         struct sk_buff *buf;
         struct distr_item *item;
 
-        list_del(&publ->binding_node);
+        list_del_rcu(&publ->binding_node);
 
         if (publ->scope == TIPC_NODE_SCOPE)
                 return NULL;
@@ -147,7 +147,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
                         ITEM_SIZE) * ITEM_SIZE;
         u32 msg_rem = msg_dsz;
 
-        list_for_each_entry(publ, pls, binding_node) {
+        list_for_each_entry_rcu(publ, pls, binding_node) {
                 /* Prepare next buffer: */
                 if (!skb) {
                         skb = named_prepare_buf(net, PUBLICATION, msg_rem,