1 files changed, 17 insertions, 18 deletions

diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 15e1456b3f18..b67a45fb93e9 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -203,7 +203,7 @@ static inline void frag_free_queue(struct frag_queue *fq, int *work)
 
 static inline struct frag_queue *frag_alloc_queue(void)
 {
-        struct frag_queue *fq = kmalloc(sizeof(struct frag_queue), GFP_ATOMIC);
+        struct frag_queue *fq = kzalloc(sizeof(struct frag_queue), GFP_ATOMIC);
 
         if(!fq)
                 return NULL;
@@ -288,6 +288,7 @@ static void ip6_evictor(void)
 static void ip6_frag_expire(unsigned long data)
 {
         struct frag_queue *fq = (struct frag_queue *) data;
+        struct net_device *dev;
 
         spin_lock(&fq->lock);
 
@@ -299,22 +300,22 @@ static void ip6_frag_expire(unsigned long data)
         IP6_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
         IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 
-        /* Send error only if the first segment arrived. */
-        if (fq->last_in&FIRST_IN && fq->fragments) {
-                struct net_device *dev = dev_get_by_index(fq->iif);
+        /* Don't send error if the first segment did not arrive. */
+        if (!(fq->last_in&FIRST_IN) || !fq->fragments)
+                goto out;
 
-                /*
-                   But use as source device on which LAST ARRIVED
-                   segment was received. And do not use fq->dev
-                   pointer directly, device might already disappeared.
-                 */
-                if (dev) {
-                        fq->fragments->dev = dev;
-                        icmpv6_send(fq->fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0,
-                                    dev);
-                        dev_put(dev);
-                }
-        }
+        dev = dev_get_by_index(fq->iif);
+        if (!dev)
+                goto out;
+
+        /*
+           But use as source device on which LAST ARRIVED
+           segment was received. And do not use fq->dev
+           pointer directly, device might already disappeared.
+         */
+        fq->fragments->dev = dev;
+        icmpv6_send(fq->fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
+        dev_put(dev);
 out:
         spin_unlock(&fq->lock);
         fq_put(fq, NULL);
@@ -368,8 +369,6 @@ ip6_frag_create(unsigned int hash, u32 id, struct in6_addr *src, struct in6_addr
         if ((fq = frag_alloc_queue()) == NULL)
                 goto oom;
 
-        memset(fq, 0, sizeof(struct frag_queue));
-
         fq->id = id;
         ipv6_addr_copy(&fq->saddr, src);
         ipv6_addr_copy(&fq->daddr, dst);