6 files changed, 22 insertions, 32 deletions

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 7427ab5e27d8..981fed397d1d 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -606,21 +606,11 @@ static ssize_t show_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue,
         return sprintf(buf, "%lu\n", val);
 }
 
-static void rps_dev_flow_table_release_work(struct work_struct *work)
-{
-        struct rps_dev_flow_table *table = container_of(work,
-            struct rps_dev_flow_table, free_work);
-
-        vfree(table);
-}
-
 static void rps_dev_flow_table_release(struct rcu_head *rcu)
 {
         struct rps_dev_flow_table *table = container_of(rcu,
             struct rps_dev_flow_table, rcu);
-
-        INIT_WORK(&table->free_work, rps_dev_flow_table_release_work);
-        schedule_work(&table->free_work);
+        vfree(table);
 }
 
 static ssize_t store_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue,
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index a5802a8b652f..cec074be8c43 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -206,7 +206,7 @@ static void netpoll_poll_dev(struct net_device *dev)
          * the dev_open/close paths use this to block netpoll activity
          * while changing device state
          */
-        if (!down_trylock(&ni->dev_lock))
+        if (down_trylock(&ni->dev_lock))
                 return;
 
         if (!netif_running(dev)) {
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index ff06b7543d9f..49616fed9340 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -125,7 +125,6 @@ struct tnode {
         unsigned int empty_children;    /* KEYLENGTH bits needed */
         union {
                 struct rcu_head rcu;
-                struct work_struct work;
                 struct tnode *tnode_free;
         };
         struct rt_trie_node __rcu *child[0];
@@ -383,12 +382,6 @@ static struct tnode *tnode_alloc(size_t size)
                 return vzalloc(size);
 }
 
-static void __tnode_vfree(struct work_struct *arg)
-{
-        struct tnode *tn = container_of(arg, struct tnode, work);
-        vfree(tn);
-}
-
 static void __tnode_free_rcu(struct rcu_head *head)
 {
         struct tnode *tn = container_of(head, struct tnode, rcu);
@@ -397,10 +390,8 @@ static void __tnode_free_rcu(struct rcu_head *head)
 
         if (size <= PAGE_SIZE)
                 kfree(tn);
-        else {
-                INIT_WORK(&tn->work, __tnode_vfree);
-                schedule_work(&tn->work);
-        }
+        else
+                vfree(tn);
 }
 
 static inline void tnode_free(struct tnode *tn)
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index e97d66a1fdde..7e06641e36ae 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -305,6 +305,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
         setup_timer(&q->timer, f->frag_expire, (unsigned long)q);
         spin_lock_init(&q->lock);
         atomic_set(&q->refcnt, 1);
+        INIT_LIST_HEAD(&q->lru_list);
 
         return q;
 }
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index f696d7c2e9fa..f6a005c485a9 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -96,7 +96,8 @@ struct tcpm_hash_bucket {
 
 static DEFINE_SPINLOCK(tcp_metrics_lock);
 
-static void tcpm_suck_dst(struct tcp_metrics_block *tm, struct dst_entry *dst)
+static void tcpm_suck_dst(struct tcp_metrics_block *tm, struct dst_entry *dst,
+                          bool fastopen_clear)
 {
         u32 val;
 
@@ -122,9 +123,11 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm, struct dst_entry *dst)
         tm->tcpm_vals[TCP_METRIC_REORDERING] = dst_metric_raw(dst, RTAX_REORDERING);
         tm->tcpm_ts = 0;
         tm->tcpm_ts_stamp = 0;
-        tm->tcpm_fastopen.mss = 0;
-        tm->tcpm_fastopen.syn_loss = 0;
-        tm->tcpm_fastopen.cookie.len = 0;
+        if (fastopen_clear) {
+                tm->tcpm_fastopen.mss = 0;
+                tm->tcpm_fastopen.syn_loss = 0;
+                tm->tcpm_fastopen.cookie.len = 0;
+        }
 }
 
 static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
@@ -154,7 +157,7 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
         }
         tm->tcpm_addr = *addr;
 
-        tcpm_suck_dst(tm, dst);
+        tcpm_suck_dst(tm, dst, true);
 
         if (likely(!reclaim)) {
                 tm->tcpm_next = net->ipv4.tcp_metrics_hash[hash].chain;
@@ -171,7 +174,7 @@ out_unlock:
 static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
 {
         if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
-                tcpm_suck_dst(tm, dst);
+                tcpm_suck_dst(tm, dst, false);
 }
 
 #define TCP_METRICS_RECLAIM_DEPTH       5
diff --git a/net/tipc/link.c b/net/tipc/link.c
index daa6080a2a0c..a80feee5197a 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2306,8 +2306,11 @@ static int link_recv_changeover_msg(struct tipc_link **l_ptr,
         struct tipc_msg *tunnel_msg = buf_msg(tunnel_buf);
         u32 msg_typ = msg_type(tunnel_msg);
         u32 msg_count = msg_msgcnt(tunnel_msg);
+        u32 bearer_id = msg_bearer_id(tunnel_msg);
 
-        dest_link = (*l_ptr)->owner->links[msg_bearer_id(tunnel_msg)];
+        if (bearer_id >= MAX_BEARERS)
+                goto exit;
+        dest_link = (*l_ptr)->owner->links[bearer_id];
         if (!dest_link)
                 goto exit;
         if (dest_link == *l_ptr) {
@@ -2521,14 +2524,16 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                 struct tipc_msg *imsg = (struct tipc_msg *)msg_data(fragm);
                 u32 msg_sz = msg_size(imsg);
                 u32 fragm_sz = msg_data_sz(fragm);
-                u32 exp_fragm_cnt = msg_sz/fragm_sz + !!(msg_sz % fragm_sz);
+                u32 exp_fragm_cnt;
                 u32 max =  TIPC_MAX_USER_MSG_SIZE + NAMED_H_SIZE;
+
                 if (msg_type(imsg) == TIPC_MCAST_MSG)
                         max = TIPC_MAX_USER_MSG_SIZE + MCAST_H_SIZE;
-                if (msg_size(imsg) > max) {
+                if (fragm_sz == 0 || msg_size(imsg) > max) {
                         kfree_skb(fbuf);
                         return 0;
                 }
+                exp_fragm_cnt = msg_sz / fragm_sz + !!(msg_sz % fragm_sz);
                 pbuf = tipc_buf_acquire(msg_size(imsg));
                 if (pbuf != NULL) {
                         pbuf->next = *pending;