22 files changed, 124 insertions, 60 deletions
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 7550abb0c96a..675614e38e14 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -859,6 +859,7 @@ static void __l2cap_sock_close(struct sock *sk, int reason)
                                result = L2CAP_CR_SEC_BLOCK;
                        else
                                result = L2CAP_CR_BAD_PSM;
+                        sk->sk_state = BT_DISCONN;
                        rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
                        rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 6f6d8e1b776f..88e4aa9cb1f9 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -80,7 +80,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
        if (is_multicast_ether_addr(dest)) {
                mdst = br_mdb_get(br, skb);
                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
-                        if ((mdst && !hlist_unhashed(&mdst->mglist)) ||
+                        if ((mdst && mdst->mglist) ||
                            br_multicast_is_router(br))
                                skb2 = skb;
                        br_multicast_forward(mdst, skb, skb2);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index f701a21acb34..09d5c0987925 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -232,8 +232,7 @@ static void br_multicast_group_expired(unsigned long data)
        if (!netif_running(br->dev) || timer_pending(&mp->timer))
                goto out;
-        if (!hlist_unhashed(&mp->mglist))
+        mp->mglist = false;
-                hlist_del_init(&mp->mglist);
        if (mp->ports)
                goto out;
@@ -276,7 +275,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
                del_timer(&p->query_timer);
                call_rcu_bh(&p->rcu, br_multicast_free_pg);
-                if (!mp->ports && hlist_unhashed(&mp->mglist) &&
+                if (!mp->ports && !mp->mglist &&
                    netif_running(br->dev))
                        mod_timer(&mp->timer, jiffies);
@@ -528,7 +527,7 @@ static void br_multicast_group_query_expired(unsigned long data)
        struct net_bridge *br = mp->br;
        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || hlist_unhashed(&mp->mglist) ||
+        if (!netif_running(br->dev) || !mp->mglist ||
            mp->queries_sent >= br->multicast_last_member_count)
                goto out;
@@ -719,7 +718,7 @@ static int br_multicast_add_group(struct net_bridge *br,
                goto err;
        if (!port) {
-                hlist_add_head(&mp->mglist, &br->mglist);
+                mp->mglist = true;
                mod_timer(&mp->timer, now + br->multicast_membership_interval);
                goto out;
        }
@@ -1165,7 +1164,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
        max_delay *= br->multicast_last_member_count;
-        if (!hlist_unhashed(&mp->mglist) &&
+        if (mp->mglist &&
            (timer_pending(&mp->timer) ?
             time_after(mp->timer.expires, now + max_delay) :
             try_to_del_timer_sync(&mp->timer) >= 0))
@@ -1177,7 +1176,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                if (timer_pending(&p->timer) ?
                    time_after(p->timer.expires, now + max_delay) :
                    try_to_del_timer_sync(&p->timer) >= 0)
-                        mod_timer(&mp->timer, now + max_delay);
+                        mod_timer(&p->timer, now + max_delay);
        }
 out:
@@ -1236,7 +1235,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                goto out;
        max_delay *= br->multicast_last_member_count;
-        if (!hlist_unhashed(&mp->mglist) &&
+        if (mp->mglist &&
            (timer_pending(&mp->timer) ?
             time_after(mp->timer.expires, now + max_delay) :
             try_to_del_timer_sync(&mp->timer) >= 0))
@@ -1248,7 +1247,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                if (timer_pending(&p->timer) ?
                    time_after(p->timer.expires, now + max_delay) :
                    try_to_del_timer_sync(&p->timer) >= 0)
-                        mod_timer(&mp->timer, now + max_delay);
+                        mod_timer(&p->timer, now + max_delay);
        }
 out:
@@ -1283,7 +1282,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
                     br->multicast_last_member_interval;
        if (!port) {
-                if (!hlist_unhashed(&mp->mglist) &&
+                if (mp->mglist &&
                    (timer_pending(&mp->timer) ?
                     time_after(mp->timer.expires, time) :
                     try_to_del_timer_sync(&mp->timer) >= 0)) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 9f22898c5359..f7afc364d777 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -84,13 +84,13 @@ struct net_bridge_port_group {
 struct net_bridge_mdb_entry
 {
        struct hlist_node               hlist[2];
-        struct hlist_node               mglist;
        struct net_bridge               *br;
        struct net_bridge_port_group __rcu *ports;
        struct rcu_head                 rcu;
        struct timer_list               timer;
        struct timer_list               query_timer;
        struct br_ip                    addr;
+        bool                            mglist;
        u32                             queries_sent;
 };
@@ -238,7 +238,6 @@ struct net_bridge
        spinlock_t                      multicast_lock;
        struct net_bridge_mdb_htable __rcu *mdb;
        struct hlist_head               router_list;
-        struct hlist_head               mglist;
        struct timer_list               multicast_router_timer;
        struct timer_list               multicast_querier_timer;
diff --git a/net/core/dev.c b/net/core/dev.c
index 4f6943928fe8..9d8bfd9d444b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1281,10 +1281,13 @@ static int __dev_close_many(struct list_head *head)
 static int __dev_close(struct net_device *dev)
 {
+        int retval;
        LIST_HEAD(single);
        list_add(&dev->unreg_list, &single);
-        return __dev_close_many(&single);
+        retval = __dev_close_many(&single);
+        list_del(&single);
+        return retval;
 }
 static int dev_close_many(struct list_head *head)
@@ -1326,7 +1329,7 @@ int dev_close(struct net_device *dev)
        list_add(&dev->unreg_list, &single);
        dev_close_many(&single);
+        list_del(&single);
        return 0;
 }
 EXPORT_SYMBOL(dev_close);
@@ -5243,6 +5246,7 @@ static void rollback_registered(struct net_device *dev)
        list_add(&dev->unreg_list, &single);
        rollback_registered_many(&single);
+        list_del(&single);
 }
 u32 netdev_fix_features(struct net_device *dev, u32 features)
@@ -6433,6 +6437,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
                }
        }
        unregister_netdevice_many(&dev_kill_list);
+        list_del(&dev_kill_list);
        rtnl_unlock();
 }
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 6b03f561caec..d5074a567289 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -626,6 +626,9 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
        dcb->cmd = DCB_CMD_GAPP;
        app_nest = nla_nest_start(dcbnl_skb, DCB_ATTR_APP);
+        if (!app_nest)
+                goto out_cancel;
        ret = nla_put_u8(dcbnl_skb, DCB_APP_ATTR_IDTYPE, idtype);
        if (ret)
                goto out_cancel;
@@ -1613,6 +1616,10 @@ EXPORT_SYMBOL(dcb_getapp);
 u8 dcb_setapp(struct net_device *dev, struct dcb_app *new)
 {
        struct dcb_app_type *itr;
+        struct dcb_app_type event;
+        memcpy(&event.name, dev->name, sizeof(event.name));
+        memcpy(&event.app, new, sizeof(event.app));
        spin_lock(&dcb_lock);
        /* Search for existing match and replace */
@@ -1644,7 +1651,7 @@ u8 dcb_setapp(struct net_device *dev, struct dcb_app *new)
        }
 out:
        spin_unlock(&dcb_lock);
-        call_dcbevent_notifiers(DCB_APP_EVENT, new);
+        call_dcbevent_notifiers(DCB_APP_EVENT, &event);
        return 0;
 }
 EXPORT_SYMBOL(dcb_setapp);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index ee144a4fca41..90389281d97a 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1102,6 +1102,21 @@ static inline bool inetdev_valid_mtu(unsigned mtu)
        return mtu >= 68;
 }
+static void inetdev_send_gratuitous_arp(struct net_device *dev,
+                                        struct in_device *in_dev)
+{
+        struct in_ifaddr *ifa = in_dev->ifa_list;
+        if (!ifa)
+                return;
+        arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                 ifa->ifa_address, dev,
+                 ifa->ifa_address, NULL,
+                 dev->dev_addr, NULL);
+}
 /* Called only under RTNL semaphore */
 static int inetdev_event(struct notifier_block *this, unsigned long event,
@@ -1155,18 +1170,13 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                }
                ip_mc_up(in_dev);
                /* fall through */
-        case NETDEV_NOTIFY_PEERS:
        case NETDEV_CHANGEADDR:
+                if (!IN_DEV_ARP_NOTIFY(in_dev))
+                        break;
+                /* fall through */
+        case NETDEV_NOTIFY_PEERS:
                /* Send gratuitous ARP to notify of link change */
-                if (IN_DEV_ARP_NOTIFY(in_dev)) {
+                inetdev_send_gratuitous_arp(dev, in_dev);
-                        struct in_ifaddr *ifa = in_dev->ifa_list;
-                        if (ifa)
-                                arp_send(ARPOP_REQUEST, ETH_P_ARP,
-                                         ifa->ifa_address, dev,
-                                         ifa->ifa_address, NULL,
-                                         dev->dev_addr, NULL);
-                }
                break;
        case NETDEV_DOWN:
                ip_mc_down(in_dev);
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index c5af909cf701..3c8dfa16614d 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -505,7 +505,9 @@ restart:
                        }
                        rcu_read_unlock();
+                        local_bh_disable();
                        inet_twsk_deschedule(tw, twdr);
+                        local_bh_enable();
                        inet_twsk_put(tw);
                        goto restart_rcu;
                }
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index eb68a0e34e49..6613edfac28c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -775,6 +775,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                        .fl4_dst = dst,
                        .fl4_src = tiph->saddr,
                        .fl4_tos = RT_TOS(tos),
+                        .proto = IPPROTO_GRE,
                        .fl_gre_key = tunnel->parms.o_key
                };
                if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 2facde0985f9..52b077d45208 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2671,6 +2671,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
        .destroy                =       ipv4_dst_destroy,
        .check                  =       ipv4_blackhole_dst_check,
        .default_mtu            =       ipv4_blackhole_default_mtu,
+        .default_advmss         =       ipv4_default_advmss,
        .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
 };
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 05027b753721..e6af8d72f26b 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -410,7 +410,7 @@ fallback:
                if (p != NULL) {
                        sb_add(m, "%02x", *p++);
                        for (i = 1; i < len; i++)
-                                sb_add(m, ":%02x", p[i]);
+                                sb_add(m, ":%02x", *p++);
                }
                sb_add(m, " ");
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7946b53692da..f786aed02a6e 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -159,6 +159,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
        .destroy                =       ip6_dst_destroy,
        .check                  =       ip6_dst_check,
        .default_mtu            =       ip6_blackhole_default_mtu,
+        .default_advmss         =       ip6_default_advmss,
        .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
 };
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index cf68700abffa..d036597aabbe 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1210,7 +1210,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                switch (sdata->vif.type) {
                case NL80211_IFTYPE_STATION:
                        changed |= BSS_CHANGED_ASSOC;
+                        mutex_lock(&sdata->u.mgd.mtx);
                        ieee80211_bss_info_change_notify(sdata, changed);
+                        mutex_unlock(&sdata->u.mgd.mtx);
                        break;
                case NL80211_IFTYPE_ADHOC:
                        changed |= BSS_CHANGED_IBSS;
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 1e00bf7d27c5..899b71c0ff5d 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -133,6 +133,7 @@ unsigned int nf_iterate(struct list_head *head,
                /* Optimization: we don't need to hold module
                   reference here, since function can't sleep. --RR */
+repeat:
                verdict = elem->hook(hook, skb, indev, outdev, okfn);
                if (verdict != NF_ACCEPT) {
 #ifdef CONFIG_NETFILTER_DEBUG
@@ -145,7 +146,7 @@ unsigned int nf_iterate(struct list_head *head,
 #endif
                        if (verdict != NF_REPEAT)
                                return verdict;
-                        *i = (*i)->prev;
+                        goto repeat;
                }
        }
        return NF_ACCEPT;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 1909311c392a..2f454efa1a8b 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -959,8 +959,15 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
        if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
                nf_conntrack_event_cache(IPCT_REPLY, ct);
 out:
-        if (tmpl)
+        if (tmpl) {
-                nf_ct_put(tmpl);
+                /* Special case: we have to repeat this hook, assign the
+                 * template again to this packet. We assume that this packet
+                 * has no conntrack assigned. This is used by nf_ct_tcp. */
+                if (ret == NF_REPEAT)
+                        skb->nfct = (struct nf_conntrack *)tmpl;
+                else
+                        nf_ct_put(tmpl);
+        }
        return ret;
 }
diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c
index 4d87befb04c0..474d621cbc2e 100644
--- a/net/netfilter/nf_tproxy_core.c
+++ b/net/netfilter/nf_tproxy_core.c
@@ -28,26 +28,23 @@ nf_tproxy_destructor(struct sk_buff *skb)
        skb->destructor = NULL;
        if (sk)
-                nf_tproxy_put_sock(sk);
+                sock_put(sk);
 }
 /* consumes sk */
-int
+void
 nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
 {
-        bool transparent = (sk->sk_state == TCP_TIME_WAIT) ?
+        /* assigning tw sockets complicates things; most
-                                inet_twsk(sk)->tw_transparent :
+         * skb->sk->X checks would have to test sk->sk_state first */
-                                inet_sk(sk)->transparent;
+        if (sk->sk_state == TCP_TIME_WAIT) {
+                inet_twsk_put(inet_twsk(sk));
-        if (transparent) {
+                return;
-                skb_orphan(skb);
+        }
-                skb->sk = sk;
-                skb->destructor = nf_tproxy_destructor;
+        skb_orphan(skb);
-                return 1;
+        skb->sk = sk;
-        } else
+        skb->destructor = nf_tproxy_destructor;
-                nf_tproxy_put_sock(sk);
-        return 0;
 }
 EXPORT_SYMBOL_GPL(nf_tproxy_assign_sock);
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 640678f47a2a..dcfd57eb9d02 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -33,6 +33,20 @@
 #include <net/netfilter/nf_tproxy_core.h>
 #include <linux/netfilter/xt_TPROXY.h>
+static bool tproxy_sk_is_transparent(struct sock *sk)
+{
+        if (sk->sk_state != TCP_TIME_WAIT) {
+                if (inet_sk(sk)->transparent)
+                        return true;
+                sock_put(sk);
+        } else {
+                if (inet_twsk(sk)->tw_transparent)
+                        return true;
+                inet_twsk_put(inet_twsk(sk));
+        }
+        return false;
+}
 static inline __be32
 tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
 {
@@ -141,7 +155,7 @@ tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,
                                           skb->dev, NFT_LOOKUP_LISTENER);
        /* NOTE: assign_sock consumes our sk reference */
-        if (sk && nf_tproxy_assign_sock(skb, sk)) {
+        if (sk && tproxy_sk_is_transparent(sk)) {
                /* This should be in a separate target, but we don't do multiple
                   targets on the same rule yet */
                skb->mark = (skb->mark & ~mark_mask) ^ mark_value;
@@ -149,6 +163,8 @@ tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,
                pr_debug("redirecting: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
                         iph->protocol, &iph->daddr, ntohs(hp->dest),
                         &laddr, ntohs(lport), skb->mark);
+                nf_tproxy_assign_sock(skb, sk);
                return NF_ACCEPT;
        }
@@ -306,7 +322,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
                                           par->in, NFT_LOOKUP_LISTENER);
        /* NOTE: assign_sock consumes our sk reference */
-        if (sk && nf_tproxy_assign_sock(skb, sk)) {
+        if (sk && tproxy_sk_is_transparent(sk)) {
                /* This should be in a separate target, but we don't do multiple
                   targets on the same rule yet */
                skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value;
@@ -314,6 +330,8 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
                pr_debug("redirecting: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n",
                         tproto, &iph->saddr, ntohs(hp->source),
                         laddr, ntohs(lport), skb->mark);
+                nf_tproxy_assign_sock(skb, sk);
                return NF_ACCEPT;
        }
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 00d6ae838303..9cc46356b577 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -35,6 +35,15 @@
 #include <net/netfilter/nf_conntrack.h>
 #endif
+static void
+xt_socket_put_sk(struct sock *sk)
+{
+        if (sk->sk_state == TCP_TIME_WAIT)
+                inet_twsk_put(inet_twsk(sk));
+        else
+                sock_put(sk);
+}
 static int
 extract_icmp4_fields(const struct sk_buff *skb,
                    u8 *protocol,
@@ -164,7 +173,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
                                       (sk->sk_state == TCP_TIME_WAIT &&
                                        inet_twsk(sk)->tw_transparent));
-                nf_tproxy_put_sock(sk);
+                xt_socket_put_sk(sk);
                if (wildcard || !transparent)
                        sk = NULL;
@@ -298,7 +307,7 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
                                       (sk->sk_state == TCP_TIME_WAIT &&
                                        inet_twsk(sk)->tw_transparent));
-                nf_tproxy_put_sock(sk);
+                xt_socket_put_sk(sk);
                if (wildcard || !transparent)
                        sk = NULL;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 2cc46f0962ca..b23428f3c0dd 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2029,11 +2029,11 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
                        *errp = sctp_make_op_error_fixed(asoc, chunk);
                if (*errp) {
-                        sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+                        if (!sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
-                                        WORD_ROUND(ntohs(param.p->length)));
+                                        WORD_ROUND(ntohs(param.p->length))))
-                        sctp_addto_chunk_fixed(*errp,
+                                sctp_addto_chunk_fixed(*errp,
-                                        WORD_ROUND(ntohs(param.p->length)),
+                                                WORD_ROUND(ntohs(param.p->length)),
-                                        param.v);
+                                                param.v);
                } else {
                        /* If there is no memory for generating the ERROR
                         * report as specified, an ABORT will be triggered
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 7bd3bbba4710..d802e941d365 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1609,9 +1609,7 @@ static struct svc_xprt *svc_bc_create_socket(struct svc_serv *serv,
 */
 static void svc_bc_sock_free(struct svc_xprt *xprt)
 {
-        if (xprt) {
+        if (xprt)
-                kfree(xprt->xpt_bc_sid);
                kfree(container_of(xprt, struct svc_sock, sk_xprt));
-        }
 }
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index 4cbc942f762a..21306928d47f 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -396,9 +396,12 @@ void __exit x25_link_free(void)
        write_lock_bh(&x25_neigh_list_lock);
        list_for_each_safe(entry, tmp, &x25_neigh_list) {
+                struct net_device *dev;
                nb = list_entry(entry, struct x25_neigh, node);
+                dev = nb->dev;
                __x25_remove_neigh(nb);
-                dev_put(nb->dev);
+                dev_put(dev);
        }
        write_unlock_bh(&x25_neigh_list_lock);
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 3f1257add4f3..7a8e2c77d08f 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1340,10 +1340,13 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
        default:
                BUG();
        }
-        xdst = dst_alloc(dst_ops, 0) ?: ERR_PTR(-ENOBUFS);
+        xdst = dst_alloc(dst_ops, 0);
        xfrm_policy_put_afinfo(afinfo);
-        xdst->flo.ops = &xfrm_bundle_fc_ops;
+        if (likely(xdst))
+                xdst->flo.ops = &xfrm_bundle_fc_ops;
+        else
+                xdst = ERR_PTR(-ENOBUFS);
        return xdst;
 }