2 files changed, 19 insertions, 5 deletions

diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index cb29ef7ba2f0..609c30c80816 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -460,6 +460,7 @@ static void bearer_disable(struct tipc_bearer *b_ptr)
 {
         struct tipc_link *l_ptr;
         struct tipc_link *temp_l_ptr;
+        struct tipc_link_req *temp_req;
 
         pr_info("Disabling bearer <%s>\n", b_ptr->name);
         spin_lock_bh(&b_ptr->lock);
@@ -468,9 +469,13 @@ static void bearer_disable(struct tipc_bearer *b_ptr)
         list_for_each_entry_safe(l_ptr, temp_l_ptr, &b_ptr->links, link_list) {
                 tipc_link_delete(l_ptr);
         }
-        if (b_ptr->link_req)
-                tipc_disc_delete(b_ptr->link_req);
+        temp_req = b_ptr->link_req;
+        b_ptr->link_req = NULL;
         spin_unlock_bh(&b_ptr->lock);
+
+        if (temp_req)
+                tipc_disc_delete(temp_req);
+
         memset(b_ptr, 0, sizeof(struct tipc_bearer));
 }
 
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 19da5abe0fa6..fd3fa57a410e 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -355,8 +355,12 @@ static int tipc_open_listening_sock(struct tipc_server *s)
                 return PTR_ERR(con);
 
         sock = tipc_create_listen_sock(con);
-        if (!sock)
+        if (!sock) {
+                idr_remove(&s->conn_idr, con->conid);
+                s->idr_in_use--;
+                kfree(con);
                 return -EINVAL;
+        }
 
         tipc_register_callbacks(sock, con);
         return 0;
@@ -563,9 +567,14 @@ int tipc_server_start(struct tipc_server *s)
                 kmem_cache_destroy(s->rcvbuf_cache);
                 return ret;
         }
+        ret = tipc_open_listening_sock(s);
+        if (ret < 0) {
+                tipc_work_stop(s);
+                kmem_cache_destroy(s->rcvbuf_cache);
+                return ret;
+        }
         s->enabled = 1;
-
-        return tipc_open_listening_sock(s);
+        return ret;
 }
 
 void tipc_server_stop(struct tipc_server *s)