1 files changed, 13 insertions, 5 deletions

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 24431e578310..448703312fed 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -324,6 +324,10 @@ void rtnl_unregister_all(int protocol)
 
         rtnl_lock();
         tab = rtnl_msg_handlers[protocol];
+        if (!tab) {
+                rtnl_unlock();
+                return;
+        }
         RCU_INIT_POINTER(rtnl_msg_handlers[protocol], NULL);
         for (msgindex = 0; msgindex < RTM_NR_MSGTYPES; msgindex++) {
                 link = tab[msgindex];
@@ -1894,10 +1898,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                 if (tb[IFLA_IF_NETNSID]) {
                         netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]);
                         tgt_net = get_target_net(skb->sk, netnsid);
-                        if (IS_ERR(tgt_net)) {
-                                tgt_net = net;
-                                netnsid = -1;
-                        }
+                        if (IS_ERR(tgt_net))
+                                return PTR_ERR(tgt_net);
                 }
 
                 if (tb[IFLA_EXT_MASK])
@@ -2806,7 +2808,7 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm)
         }
 
         if (dev->rtnl_link_state == RTNL_LINK_INITIALIZED) {
-                __dev_notify_flags(dev, old_flags, 0U);
+                __dev_notify_flags(dev, old_flags, (old_flags ^ dev->flags));
         } else {
                 dev->rtnl_link_state = RTNL_LINK_INITIALIZED;
                 __dev_notify_flags(dev, old_flags, ~0U);
@@ -2833,6 +2835,12 @@ struct net_device *rtnl_create_link(struct net *net,
         else if (ops->get_num_rx_queues)
                 num_rx_queues = ops->get_num_rx_queues();
 
+        if (num_tx_queues < 1 || num_tx_queues > 4096)
+                return ERR_PTR(-EINVAL);
+
+        if (num_rx_queues < 1 || num_rx_queues > 4096)
+                return ERR_PTR(-EINVAL);
+
         dev = alloc_netdev_mqs(ops->priv_size, ifname, name_assign_type,
                                ops->setup, num_tx_queues, num_rx_queues);
         if (!dev)