2 files changed, 21 insertions, 9 deletions

diff --git a/net/tipc/core.c b/net/tipc/core.c
index ed536c05252a..c8370722f0bb 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -134,7 +134,7 @@ static int __init tipc_init(void)
         if (err)
                 goto out_sysctl;
 
-        err = register_pernet_subsys(&tipc_net_ops);
+        err = register_pernet_device(&tipc_net_ops);
         if (err)
                 goto out_pernet;
 
@@ -142,7 +142,7 @@ static int __init tipc_init(void)
         if (err)
                 goto out_socket;
 
-        err = register_pernet_subsys(&tipc_topsrv_net_ops);
+        err = register_pernet_device(&tipc_topsrv_net_ops);
         if (err)
                 goto out_pernet_topsrv;
 
@@ -153,11 +153,11 @@ static int __init tipc_init(void)
         pr_info("Started in single node mode\n");
         return 0;
 out_bearer:
-        unregister_pernet_subsys(&tipc_topsrv_net_ops);
+        unregister_pernet_device(&tipc_topsrv_net_ops);
 out_pernet_topsrv:
         tipc_socket_stop();
 out_socket:
-        unregister_pernet_subsys(&tipc_net_ops);
+        unregister_pernet_device(&tipc_net_ops);
 out_pernet:
         tipc_unregister_sysctl();
 out_sysctl:
@@ -172,9 +172,9 @@ out_netlink:
 static void __exit tipc_exit(void)
 {
         tipc_bearer_cleanup();
-        unregister_pernet_subsys(&tipc_topsrv_net_ops);
+        unregister_pernet_device(&tipc_topsrv_net_ops);
         tipc_socket_stop();
-        unregister_pernet_subsys(&tipc_net_ops);
+        unregister_pernet_device(&tipc_net_ops);
         tipc_netlink_stop();
         tipc_netlink_compat_stop();
         tipc_unregister_sysctl();
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index c6a04c09d075..cf155061c472 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -445,7 +445,11 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
         if (!bearer)
                 return -EMSGSIZE;
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(name, len))
                 return -EINVAL;
 
@@ -539,7 +543,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
 
         name = (char *)TLV_DATA(msg->req);
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(name, len))
                 return -EINVAL;
 
@@ -817,7 +825,11 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
         if (!link)
                 return -EMSGSIZE;
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(name, len))
                 return -EINVAL;