Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  packet: fix possible dev refcnt leak when bind fail
  netem: dont call vfree() under spinlock and BH disabled
  netfilter: ctnetlink: fix scheduling while atomic if helper is autoloaded
  netfilter: ctnetlink: fix return value of ctnetlink_get_expect()

3 files changed, 22 insertions, 9 deletions

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index ef21b221f03..b6977776d71 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1358,12 +1358,15 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
                                                     nf_ct_protonum(ct));
                 if (helper == NULL) {
                         rcu_read_unlock();
+                        spin_unlock_bh(&nf_conntrack_lock);
 #ifdef CONFIG_MODULES
                         if (request_module("nfct-helper-%s", helpname) < 0) {
+                                spin_lock_bh(&nf_conntrack_lock);
                                 err = -EOPNOTSUPP;
                                 goto err1;
                         }
 
+                        spin_lock_bh(&nf_conntrack_lock);
                         rcu_read_lock();
                         helper = __nf_conntrack_helper_find(helpname,
                                                             nf_ct_l3num(ct),
@@ -1869,25 +1872,30 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
 
         err = -ENOMEM;
         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (skb2 == NULL)
+        if (skb2 == NULL) {
+                nf_ct_expect_put(exp);
                 goto out;
+        }
 
         rcu_read_lock();
         err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
                                       nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);
         rcu_read_unlock();
+        nf_ct_expect_put(exp);
         if (err <= 0)
                 goto free;
 
-        nf_ct_expect_put(exp);
+        err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
+        if (err < 0)
+                goto out;
 
-        return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
+        return 0;
 
 free:
         kfree_skb(skb2);
 out:
-        nf_ct_expect_put(exp);
-        return err;
+        /* this avoids a loop in nfnetlink. */
+        return err == -EAGAIN ? -ENOBUFS : err;
 }
 
 static int
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3891702b81d..d9d4970b9b0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2448,8 +2448,12 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protoc
 {
         struct packet_sock *po = pkt_sk(sk);
 
-        if (po->fanout)
+        if (po->fanout) {
+                if (dev)
+                        dev_put(dev);
+
                 return -EINVAL;
+        }
 
         lock_sock(sk);
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index eb3b9a86c6e..a4ab207cdc5 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -488,7 +488,7 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
                 return -EINVAL;
 
         s = sizeof(struct disttable) + n * sizeof(s16);
-        d = kmalloc(s, GFP_KERNEL);
+        d = kmalloc(s, GFP_KERNEL | __GFP_NOWARN);
         if (!d)
                 d = vmalloc(s);
         if (!d)
@@ -501,9 +501,10 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
         root_lock = qdisc_root_sleeping_lock(sch);
 
         spin_lock_bh(root_lock);
-        dist_free(q->delay_dist);
-        q->delay_dist = d;
+        swap(q->delay_dist, d);
         spin_unlock_bh(root_lock);
+
+        dist_free(d);
         return 0;
 }