2 files changed, 12 insertions, 6 deletions

diff --git a/net/tipc/core.c b/net/tipc/core.c
index fd4eeeaa972a..c6d3f75a9e1b 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -113,7 +113,6 @@ err:
 static void tipc_core_stop(void)
 {
         tipc_netlink_stop();
-        tipc_handler_stop();
         tipc_cfg_stop();
         tipc_subscr_stop();
         tipc_nametbl_stop();
@@ -146,9 +145,10 @@ static int tipc_core_start(void)
                 res = tipc_subscr_start();
         if (!res)
                 res = tipc_cfg_init();
-        if (res)
+        if (res) {
+                tipc_handler_stop();
                 tipc_core_stop();
-
+        }
         return res;
 }
 
@@ -178,6 +178,7 @@ static int __init tipc_init(void)
 
 static void __exit tipc_exit(void)
 {
+        tipc_handler_stop();
         tipc_core_stop_net();
         tipc_core_stop();
         pr_info("Deactivated\n");
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index b36f0fcd9bdf..e4bc8a296744 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -56,12 +56,13 @@ unsigned int tipc_k_signal(Handler routine, unsigned long argument)
 {
         struct queue_item *item;
 
+        spin_lock_bh(&qitem_lock);
         if (!handler_enabled) {
                 pr_err("Signal request ignored by handler\n");
+                spin_unlock_bh(&qitem_lock);
                 return -ENOPROTOOPT;
         }
 
-        spin_lock_bh(&qitem_lock);
         item = kmem_cache_alloc(tipc_queue_item_cache, GFP_ATOMIC);
         if (!item) {
                 pr_err("Signal queue out of memory\n");
@@ -112,10 +113,14 @@ void tipc_handler_stop(void)
         struct list_head *l, *n;
         struct queue_item *item;
 
-        if (!handler_enabled)
+        spin_lock_bh(&qitem_lock);
+        if (!handler_enabled) {
+                spin_unlock_bh(&qitem_lock);
                 return;
-
+        }
         handler_enabled = 0;
+        spin_unlock_bh(&qitem_lock);
+
         tasklet_kill(&tipc_tasklet);
 
         spin_lock_bh(&qitem_lock);