6 files changed, 33 insertions, 33 deletions

diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 767e0537dde5..89cd061c4468 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -65,6 +65,8 @@ static struct tipc_bearer *bearer_get(struct net *net, int bearer_id)
 }
 
 static void bearer_disable(struct net *net, struct tipc_bearer *b);
+static int tipc_l2_rcv_msg(struct sk_buff *skb, struct net_device *dev,
+                           struct packet_type *pt, struct net_device *orig_dev);
 
 /**
  * tipc_media_find - locates specified media object by name
@@ -428,6 +430,10 @@ int tipc_enable_l2_media(struct net *net, struct tipc_bearer *b,
 
         /* Associate TIPC bearer with L2 bearer */
         rcu_assign_pointer(b->media_ptr, dev);
+        b->pt.dev = dev;
+        b->pt.type = htons(ETH_P_TIPC);
+        b->pt.func = tipc_l2_rcv_msg;
+        dev_add_pack(&b->pt);
         memset(&b->bcast_addr, 0, sizeof(b->bcast_addr));
         memcpy(b->bcast_addr.value, dev->broadcast, b->media->hwaddr_len);
         b->bcast_addr.media_id = b->media->type_id;
@@ -447,6 +453,7 @@ void tipc_disable_l2_media(struct tipc_bearer *b)
         struct net_device *dev;
 
         dev = (struct net_device *)rtnl_dereference(b->media_ptr);
+        dev_remove_pack(&b->pt);
         RCU_INIT_POINTER(dev->tipc_ptr, NULL);
         synchronize_net();
         dev_put(dev);
@@ -594,11 +601,12 @@ static int tipc_l2_rcv_msg(struct sk_buff *skb, struct net_device *dev,
         struct tipc_bearer *b;
 
         rcu_read_lock();
-        b = rcu_dereference_rtnl(dev->tipc_ptr);
+        b = rcu_dereference_rtnl(dev->tipc_ptr) ?:
+                rcu_dereference_rtnl(orig_dev->tipc_ptr);
         if (likely(b && test_bit(0, &b->up) &&
                    (skb->pkt_type <= PACKET_MULTICAST))) {
                 skb->next = NULL;
-                tipc_rcv(dev_net(dev), skb, b);
+                tipc_rcv(dev_net(b->pt.dev), skb, b);
                 rcu_read_unlock();
                 return NET_RX_SUCCESS;
         }
@@ -659,11 +667,6 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
         return NOTIFY_OK;
 }
 
-static struct packet_type tipc_packet_type __read_mostly = {
-        .type = htons(ETH_P_TIPC),
-        .func = tipc_l2_rcv_msg,
-};
-
 static struct notifier_block notifier = {
         .notifier_call  = tipc_l2_device_event,
         .priority       = 0,
@@ -671,19 +674,12 @@ static struct notifier_block notifier = {
 
 int tipc_bearer_setup(void)
 {
-        int err;
-
-        err = register_netdevice_notifier(&notifier);
-        if (err)
-                return err;
-        dev_add_pack(&tipc_packet_type);
-        return 0;
+        return register_netdevice_notifier(&notifier);
 }
 
 void tipc_bearer_cleanup(void)
 {
         unregister_netdevice_notifier(&notifier);
-        dev_remove_pack(&tipc_packet_type);
 }
 
 void tipc_bearer_stop(struct net *net)
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 635c9086e19a..e07a55a80c18 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -131,6 +131,7 @@ struct tipc_media {
  * @name: bearer name (format = media:interface)
  * @media: ptr to media structure associated with bearer
  * @bcast_addr: media address used in broadcasting
+ * @pt: packet type for bearer
  * @rcu: rcu struct for tipc_bearer
  * @priority: default link priority for bearer
  * @window: default window size for bearer
@@ -151,6 +152,7 @@ struct tipc_bearer {
         char name[TIPC_MAX_BEARER_NAME];
         struct tipc_media *media;
         struct tipc_media_addr bcast_addr;
+        struct packet_type pt;
         struct rcu_head rcu;
         u32 priority;
         u32 window;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index dcd90e6fa7c3..6ef379f004ac 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -479,13 +479,14 @@ bool tipc_msg_make_bundle(struct sk_buff **skb,  struct tipc_msg *msg,
 bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
 {
         struct sk_buff *_skb = *skb;
-        struct tipc_msg *hdr = buf_msg(_skb);
+        struct tipc_msg *hdr;
         struct tipc_msg ohdr;
-        int dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE);
+        int dlen;
 
         if (skb_linearize(_skb))
                 goto exit;
         hdr = buf_msg(_skb);
+        dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE);
         if (msg_dest_droppable(hdr))
                 goto exit;
         if (msg_errcode(hdr))
@@ -511,6 +512,8 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
             pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
                 goto exit;
 
+        /* reassign after skb header modifications */
+        hdr = buf_msg(_skb);
         /* Now reverse the concerned fields */
         msg_set_errcode(hdr, err);
         msg_set_non_seq(hdr, 0);
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 9b4dcb6a16b5..7dd22330a6b4 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1126,8 +1126,8 @@ int tipc_node_get_linkname(struct net *net, u32 bearer_id, u32 addr,
                 strncpy(linkname, tipc_link_name(link), len);
                 err = 0;
         }
-exit:
         tipc_node_read_unlock(node);
+exit:
         tipc_node_put(node);
         return err;
 }
@@ -1557,6 +1557,8 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b)
 
         /* Check/update node state before receiving */
         if (unlikely(skb)) {
+                if (unlikely(skb_linearize(skb)))
+                        goto discard;
                 tipc_node_write_lock(n);
                 if (tipc_node_check_state(n, skb, bearer_id, &xmitq)) {
                         if (le->link) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 101e3597338f..d50edd6e0019 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2255,8 +2255,8 @@ void tipc_sk_reinit(struct net *net)
 
         do {
                 tsk = ERR_PTR(rhashtable_walk_start(&iter));
-                if (tsk)
-                        continue;
+                if (IS_ERR(tsk))
+                        goto walk_stop;
 
                 while ((tsk = rhashtable_walk_next(&iter)) && !IS_ERR(tsk)) {
                         spin_lock_bh(&tsk->sk.sk_lock.slock);
@@ -2265,7 +2265,7 @@ void tipc_sk_reinit(struct net *net)
                         msg_set_orignode(msg, tn->own_addr);
                         spin_unlock_bh(&tsk->sk.sk_lock.slock);
                 }
-
+walk_stop:
                 rhashtable_walk_stop(&iter);
         } while (tsk == ERR_PTR(-EAGAIN));
 }
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 0bf91cd3733c..be3d9e3183dc 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -52,7 +52,6 @@ struct tipc_subscriber {
         struct list_head subscrp_list;
 };
 
-static void tipc_subscrp_delete(struct tipc_subscription *sub);
 static void tipc_subscrb_put(struct tipc_subscriber *subscriber);
 
 /**
@@ -197,15 +196,19 @@ static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber,
 {
         struct list_head *subscription_list = &subscriber->subscrp_list;
         struct tipc_subscription *sub, *temp;
+        u32 timeout;
 
         spin_lock_bh(&subscriber->lock);
         list_for_each_entry_safe(sub, temp, subscription_list,  subscrp_list) {
                 if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr)))
                         continue;
 
-                tipc_nametbl_unsubscribe(sub);
-                list_del(&sub->subscrp_list);
-                tipc_subscrp_delete(sub);
+                timeout = htohl(sub->evt.s.timeout, sub->swap);
+                if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer)) {
+                        tipc_nametbl_unsubscribe(sub);
+                        list_del(&sub->subscrp_list);
+                        tipc_subscrp_put(sub);
+                }
 
                 if (s)
                         break;
@@ -236,18 +239,12 @@ static void tipc_subscrb_delete(struct tipc_subscriber *subscriber)
         tipc_subscrb_put(subscriber);
 }
 
-static void tipc_subscrp_delete(struct tipc_subscription *sub)
-{
-        u32 timeout = htohl(sub->evt.s.timeout, sub->swap);
-
-        if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer))
-                tipc_subscrp_put(sub);
-}
-
 static void tipc_subscrp_cancel(struct tipc_subscr *s,
                                 struct tipc_subscriber *subscriber)
 {
+        tipc_subscrb_get(subscriber);
         tipc_subscrb_subscrp_delete(subscriber, s);
+        tipc_subscrb_put(subscriber);
 }
 
 static struct tipc_subscription *tipc_subscrp_create(struct net *net,