2 files changed, 14 insertions, 1 deletions

diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index 109333c8ec..f8842ca443 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -43,6 +43,10 @@ static ssize_t dlm_control_store(struct dlm_ls *ls, const char *buf, size_t len)
         ssize_t ret = len;
         int n = simple_strtol(buf, NULL, 0);
 
+        ls = dlm_find_lockspace_local(ls->ls_local_handle);
+        if (!ls)
+                return -EINVAL;
+
         switch (n) {
         case 0:
                 dlm_ls_stop(ls);
@@ -53,6 +57,7 @@ static ssize_t dlm_control_store(struct dlm_ls *ls, const char *buf, size_t len)
         default:
                 ret = -EINVAL;
         }
+        dlm_put_lockspace(ls);
         return ret;
 }
 
@@ -143,6 +148,12 @@ static ssize_t dlm_attr_store(struct kobject *kobj, struct attribute *attr,
         return a->store ? a->store(ls, buf, len) : len;
 }
 
+static void lockspace_kobj_release(struct kobject *k)
+{
+        struct dlm_ls *ls  = container_of(k, struct dlm_ls, ls_kobj);
+        kfree(ls);
+}
+
 static struct sysfs_ops dlm_attr_ops = {
         .show  = dlm_attr_show,
         .store = dlm_attr_store,
@@ -151,6 +162,7 @@ static struct sysfs_ops dlm_attr_ops = {
 static struct kobj_type dlm_ktype = {
         .default_attrs = dlm_attrs,
         .sysfs_ops     = &dlm_attr_ops,
+        .release       = lockspace_kobj_release,
 };
 
 static struct kset dlm_kset = {
@@ -678,7 +690,7 @@ static int release_lockspace(struct dlm_ls *ls, int force)
         dlm_clear_members_gone(ls);
         kfree(ls->ls_node_array);
         kobject_unregister(&ls->ls_kobj);
-        kfree(ls);
+        /* The ls structure will be freed when the kobject is done with */
 
         mutex_lock(&ls_lock);
         ls_count--;
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 867f93d041..6da6b14d5a 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -519,6 +519,7 @@ static int receive_from_sock(void)
         msg.msg_flags = 0;
         msg.msg_control = incmsg;
         msg.msg_controllen = sizeof(incmsg);
+        msg.msg_iovlen = 1;
 
         /* I don't see why this circular buffer stuff is necessary for SCTP
          * which is a packet-based protocol, but the whole thing breaks under