3 files changed, 8 insertions, 5 deletions

diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index a7d089eb042e..ce6cb34e28e1 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -177,10 +177,13 @@ static inline struct tnode *node_parent_rcu(struct node *node)
         return rcu_dereference(ret);
 }
 
+/* Same as rcu_assign_pointer
+ * but that macro() assumes that value is a pointer.
+ */
 static inline void node_set_parent(struct node *node, struct tnode *ptr)
 {
-        rcu_assign_pointer(node->parent,
-                           (unsigned long)ptr | NODE_TYPE(node));
+        smp_wmb();
+        node->parent = (unsigned long)ptr | NODE_TYPE(node);
 }
 
 static inline struct node *tnode_get_child(struct tnode *tn, unsigned int i)
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index a2e92f9709db..3b2e5adca838 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -568,7 +568,7 @@ int ip_defrag(struct sk_buff *skb, u32 user)
 
         IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
 
-        net = skb->dev->nd_net;
+        net = skb->dev ? skb->dev->nd_net : skb->dst->dev->nd_net;
         /* Start by cleaning up the memory. */
         if (atomic_read(&net->ipv4.frags.mem) > net->ipv4.frags.high_thresh)
                 ip_evictor(net);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index e0fbc25ca816..58ac838bf460 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -735,7 +735,7 @@ new_segment:
                 if (!(psize -= copy))
                         goto out;
 
-                if (skb->len < mss_now || (flags & MSG_OOB))
+                if (skb->len < size_goal || (flags & MSG_OOB))
                         continue;
 
                 if (forced_push(tp)) {
@@ -981,7 +981,7 @@ new_segment:
                         if ((seglen -= copy) == 0 && iovlen == 0)
                                 goto out;
 
-                        if (skb->len < mss_now || (flags & MSG_OOB))
+                        if (skb->len < size_goal || (flags & MSG_OOB))
                                 continue;
 
                         if (forced_push(tp)) {