5 files changed, 23 insertions, 12 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 9649579b5b9f..4a72ee4e2ae9 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -376,6 +376,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                         dev->name);
                 vlan_vid_add(dev, htons(ETH_P_8021Q), 0);
         }
+        if (event == NETDEV_DOWN &&
+            (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER))
+                vlan_vid_del(dev, htons(ETH_P_8021Q), 0);
 
         vlan_info = rtnl_dereference(dev->vlan_info);
         if (!vlan_info)
@@ -423,9 +426,6 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                 struct net_device *tmp;
                 LIST_HEAD(close_list);
 
-                if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
-                        vlan_vid_del(dev, htons(ETH_P_8021Q), 0);
-
                 /* Put all VLANs for this dev in the down state too.  */
                 vlan_group_for_each_dev(grp, i, vlandev) {
                         flgs = vlandev->flags;
diff --git a/net/dsa/switch.c b/net/dsa/switch.c
index e6c06aa349a6..1e2929f4290a 100644
--- a/net/dsa/switch.c
+++ b/net/dsa/switch.c
@@ -133,6 +133,8 @@ static int dsa_switch_mdb_add(struct dsa_switch *ds,
                         if (err)
                                 return err;
                 }
+
+                return 0;
         }
 
         for_each_set_bit(port, group, ds->num_ports)
@@ -180,6 +182,8 @@ static int dsa_switch_vlan_add(struct dsa_switch *ds,
                         if (err)
                                 return err;
                 }
+
+                return 0;
         }
 
         for_each_set_bit(port, members, ds->num_ports)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index b2fc7163bd40..b6bb3cdfad09 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2615,7 +2615,6 @@ void tcp_simple_retransmit(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         unsigned int mss = tcp_current_mss(sk);
-        u32 prior_lost = tp->lost_out;
 
         tcp_for_write_queue(skb, sk) {
                 if (skb == tcp_send_head(sk))
@@ -2632,7 +2631,7 @@ void tcp_simple_retransmit(struct sock *sk)
 
         tcp_clear_retrans_hints_partial(tp);
 
-        if (prior_lost == tp->lost_out)
+        if (!tp->lost_out)
                 return;
 
         if (tcp_is_reno(tp))
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index 11f69bbf9307..b6a2aa1dcf56 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -149,11 +149,19 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,
          * is freed by GSO engine
          */
         if (copy_destructor) {
+                int delta;
+
                 swap(gso_skb->sk, skb->sk);
                 swap(gso_skb->destructor, skb->destructor);
                 sum_truesize += skb->truesize;
-                refcount_add(sum_truesize - gso_skb->truesize,
-                           &skb->sk->sk_wmem_alloc);
+                delta = sum_truesize - gso_skb->truesize;
+                /* In some pathological cases, delta can be negative.
+                 * We need to either use refcount_add() or refcount_sub_and_test()
+                 */
+                if (likely(delta >= 0))
+                        refcount_add(delta, &skb->sk->sk_wmem_alloc);
+                else
+                        WARN_ON_ONCE(refcount_sub_and_test(-delta, &skb->sk->sk_wmem_alloc));
         }
 
         delta = htonl(oldlen + (skb_tail_pointer(skb) -
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 9722bf839d9d..b4e421aa9727 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -410,14 +410,14 @@ void rds_ib_recv_refill(struct rds_connection *conn, int prefill, gfp_t gfp)
                         break;
                 }
 
-                /* XXX when can this fail? */
-                ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
-                rdsdebug("recv %p ibinc %p page %p addr %lu ret %d\n", recv,
+                rdsdebug("recv %p ibinc %p page %p addr %lu\n", recv,
                          recv->r_ibinc, sg_page(&recv->r_frag->f_sg),
                          (long) ib_sg_dma_address(
                                 ic->i_cm_id->device,
-                                &recv->r_frag->f_sg),
-                        ret);
+                                &recv->r_frag->f_sg));
+
+                /* XXX when can this fail? */
+                ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
                 if (ret) {
                         rds_ib_conn_error(conn, "recv post on "
                                "%pI4 returned %d, disconnecting and "