5 files changed, 9 insertions, 5 deletions

diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 82fd4c9c4a1b..06b147d7d9e2 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
 
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                 return -EFAULT;
+        ifr.ifr_name[IFNAMSIZ-1] = 0;
 
         error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
         if (error)
@@ -424,6 +425,8 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 if (copy_from_user(&iwr, arg, sizeof(iwr)))
                         return -EFAULT;
 
+                iwr.ifr_name[sizeof(iwr.ifr_name) - 1] = 0;
+
                 return wext_handle_ioctl(net, &iwr, cmd, arg);
         }
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index a0093e1b0235..fdcb1bcd2afa 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -400,6 +400,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                 err = -ENOMEM;
                 goto errout;
         }
+        refcount_set(&rule->refcnt, 1);
         rule->fr_net = net;
 
         rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY])
@@ -517,8 +518,6 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                 last = r;
         }
 
-        refcount_set(&rule->refcnt, 1);
-
         if (last)
                 list_add_rcu(&rule->list, &last->list);
         else
diff --git a/net/core/filter.c b/net/core/filter.c
index c7f737058d89..f44fc22fd45a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2248,7 +2248,7 @@ static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
                        bpf_skb_net_grow(skb, len_diff_abs);
 
         bpf_compute_data_end(skb);
-        return 0;
+        return ret;
 }
 
 BPF_CALL_4(bpf_skb_adjust_room, struct sk_buff *, skb, s32, len_diff,
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index d3408a693166..8357f164c660 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -277,7 +277,7 @@ static void zap_completion_queue(void)
                         struct sk_buff *skb = clist;
                         clist = clist->next;
                         if (!skb_irq_freeable(skb)) {
-                                refcount_inc(&skb->users);
+                                refcount_set(&skb->users, 1);
                                 dev_kfree_skb_any(skb); /* put this one back */
                         } else {
                                 __kfree_skb(skb);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d1ba90980be1..9201e3621351 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2031,7 +2031,8 @@ static int do_setlink(const struct sk_buff *skb,
                 struct sockaddr *sa;
                 int len;
 
-                len = sizeof(sa_family_t) + dev->addr_len;
+                len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len,
+                                                  sizeof(*sa));
                 sa = kmalloc(len, GFP_KERNEL);
                 if (!sa) {
                         err = -ENOMEM;
@@ -4241,6 +4242,7 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
 
         switch (event) {
         case NETDEV_REBOOT:
+        case NETDEV_CHANGEADDR:
         case NETDEV_CHANGENAME:
         case NETDEV_FEAT_CHANGE:
         case NETDEV_BONDING_FAILOVER: