16 files changed, 110 insertions, 56 deletions

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 32b8f9f7f79..dac6a214746 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -38,16 +38,17 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 #endif
 
-        u64_stats_update_begin(&brstats->syncp);
-        brstats->tx_packets++;
-        brstats->tx_bytes += skb->len;
-        u64_stats_update_end(&brstats->syncp);
-
         BR_INPUT_SKB_CB(skb)->brdev = dev;
 
         skb_reset_mac_header(skb);
         skb_pull(skb, ETH_HLEN);
 
+        u64_stats_update_begin(&brstats->syncp);
+        brstats->tx_packets++;
+        /* Exclude ETH_HLEN from byte stats for consistency with Rx chain */
+        brstats->tx_bytes += skb->len;
+        u64_stats_update_end(&brstats->syncp);
+
         rcu_read_lock();
         if (is_broadcast_ether_addr(dest))
                 br_flood_deliver(br, skb);
@@ -91,7 +92,6 @@ static int br_dev_open(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        netif_carrier_off(dev);
         netdev_update_features(dev);
         netif_start_queue(dev);
         br_stp_enable_bridge(br);
@@ -108,8 +108,6 @@ static int br_dev_stop(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        netif_carrier_off(dev);
-
         br_stp_disable_bridge(br);
         br_multicast_stop(br);
 
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index e0dfbc151dd..68def3b7fb4 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -21,7 +21,7 @@
 #include <linux/jhash.h>
 #include <linux/random.h>
 #include <linux/slab.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <asm/unaligned.h>
 #include "br_private.h"
 
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 1bacca4cb67..1d420f64ff2 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -161,9 +161,10 @@ static void del_nbp(struct net_bridge_port *p)
         call_rcu(&p->rcu, destroy_nbp_rcu);
 }
 
-/* called with RTNL */
-static void del_br(struct net_bridge *br, struct list_head *head)
+/* Delete bridge device */
+void br_dev_delete(struct net_device *dev, struct list_head *head)
 {
+        struct net_bridge *br = netdev_priv(dev);
         struct net_bridge_port *p, *n;
 
         list_for_each_entry_safe(p, n, &br->port_list, list) {
@@ -231,6 +232,7 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
 int br_add_bridge(struct net *net, const char *name)
 {
         struct net_device *dev;
+        int res;
 
         dev = alloc_netdev(sizeof(struct net_bridge), name,
                            br_dev_setup);
@@ -240,7 +242,10 @@ int br_add_bridge(struct net *net, const char *name)
 
         dev_net_set(dev, net);
 
-        return register_netdev(dev);
+        res = register_netdev(dev);
+        if (res)
+                free_netdev(dev);
+        return res;
 }
 
 int br_del_bridge(struct net *net, const char *name)
@@ -264,7 +269,7 @@ int br_del_bridge(struct net *net, const char *name)
         }
 
         else
-                del_br(netdev_priv(dev), NULL);
+                br_dev_delete(dev, NULL);
 
         rtnl_unlock();
         return ret;
@@ -388,7 +393,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         br_ifinfo_notify(RTM_NEWLINK, p);
 
         if (changed_addr)
-                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
 
         dev_set_mtu(br->dev, br_min_mtu(br));
 
@@ -417,6 +422,7 @@ put_back:
 int br_del_if(struct net_bridge *br, struct net_device *dev)
 {
         struct net_bridge_port *p;
+        bool changed_addr;
 
         p = br_port_get_rtnl(dev);
         if (!p || p->br != br)
@@ -425,9 +431,12 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         del_nbp(p);
 
         spin_lock_bh(&br->lock);
-        br_stp_recalculate_bridge_id(br);
+        changed_addr = br_stp_recalculate_bridge_id(br);
         spin_unlock_bh(&br->lock);
 
+        if (changed_addr)
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
+
         netdev_update_features(br->dev);
 
         return 0;
@@ -441,7 +450,7 @@ void __net_exit br_net_exit(struct net *net)
         rtnl_lock();
         for_each_netdev(net, dev)
                 if (dev->priv_flags & IFF_EBRIDGE)
-                        del_br(netdev_priv(dev), &list);
+                        br_dev_delete(dev, &list);
 
         unregister_netdevice_many(&list);
         rtnl_unlock();
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2d85ca7111d..e79ff75b0e7 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1456,7 +1456,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 {
         struct sk_buff *skb2;
         const struct ipv6hdr *ip6h;
-        struct icmp6hdr *icmp6h;
+        u8 icmp6_type;
         u8 nexthdr;
         unsigned len;
         int offset;
@@ -1501,10 +1501,12 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 
         __skb_pull(skb2, offset);
         skb_reset_transport_header(skb2);
+        skb_postpull_rcsum(skb2, skb_network_header(skb2),
+                           skb_network_header_len(skb2));
 
-        icmp6h = icmp6_hdr(skb2);
+        icmp6_type = icmp6_hdr(skb2)->icmp6_type;
 
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
         case ICMPV6_MGM_QUERY:
         case ICMPV6_MGM_REPORT:
         case ICMPV6_MGM_REDUCTION:
@@ -1520,16 +1522,23 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                 err = pskb_trim_rcsum(skb2, len);
                 if (err)
                         goto out;
+                err = -EINVAL;
         }
 
+        ip6h = ipv6_hdr(skb2);
+
         switch (skb2->ip_summed) {
         case CHECKSUM_COMPLETE:
-                if (!csum_fold(skb2->csum))
+                if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, skb2->len,
+                                        IPPROTO_ICMPV6, skb2->csum))
                         break;
                 /*FALLTHROUGH*/
         case CHECKSUM_NONE:
-                skb2->csum = 0;
-                if (skb_checksum_complete(skb2))
+                skb2->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
+                                                        &ip6h->daddr,
+                                                        skb2->len,
+                                                        IPPROTO_ICMPV6, 0));
+                if (__skb_checksum_complete(skb2))
                         goto out;
         }
 
@@ -1537,7 +1546,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 
         BR_INPUT_SKB_CB(skb)->igmp = 1;
 
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
         case ICMPV6_MGM_REPORT:
             {
                 struct mld_msg *mld;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 56149ec36d7..5693e5f9e03 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -109,11 +109,17 @@ static u32 *fake_cow_metrics(struct dst_entry *dst, unsigned long old)
         return NULL;
 }
 
+static struct neighbour *fake_neigh_lookup(const struct dst_entry *dst, const void *daddr)
+{
+        return NULL;
+}
+
 static struct dst_ops fake_dst_ops = {
         .family =               AF_INET,
         .protocol =             cpu_to_be16(ETH_P_IP),
         .update_pmtu =          fake_update_pmtu,
         .cow_metrics =          fake_cow_metrics,
+        .neigh_lookup =         fake_neigh_lookup,
 };
 
 /*
@@ -135,7 +141,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         rt->dst.dev = br->dev;
         rt->dst.path = &rt->dst;
         dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
-        rt->dst.flags   = DST_NOXFRM;
+        rt->dst.flags   = DST_NOXFRM | DST_NOPEER;
         rt->dst.ops = &fake_dst_ops;
 }
 
@@ -343,24 +349,26 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
 static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
 {
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
+        struct neighbour *neigh;
         struct dst_entry *dst;
 
         skb->dev = bridge_parent(skb->dev);
         if (!skb->dev)
                 goto free_skb;
         dst = skb_dst(skb);
-        if (dst->hh) {
-                neigh_hh_bridge(dst->hh, skb);
+        neigh = dst_get_neighbour(dst);
+        if (neigh->hh.hh_len) {
+                neigh_hh_bridge(&neigh->hh, skb);
                 skb->dev = nf_bridge->physindev;
                 return br_handle_frame_finish(skb);
-        } else if (dst->neighbour) {
+        } else {
                 /* the neighbour function below overwrites the complete
                  * MAC header, so we save the Ethernet source address and
                  * protocol number. */
                 skb_copy_from_linear_data_offset(skb, -(ETH_HLEN-ETH_ALEN), skb->nf_bridge->data, ETH_HLEN-ETH_ALEN);
                 /* tell br_dev_xmit to continue with forwarding */
                 nf_bridge->mask |= BRNF_BRIDGED_DNAT;
-                return dst->neighbour->output(skb);
+                return neigh->output(neigh, skb);
         }
 free_skb:
         kfree_skb(skb);
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index ffb0dc4cc0e..e5f9ece3c9a 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -188,6 +188,8 @@ static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
 
         p->state = new_state;
         br_log_state(p);
+        br_ifinfo_notify(RTM_NEWLINK, p);
+
         return 0;
 }
 
@@ -208,6 +210,7 @@ static struct rtnl_link_ops br_link_ops __read_mostly = {
         .priv_size      = sizeof(struct net_bridge),
         .setup          = br_dev_setup,
         .validate       = br_validate,
+        .dellink        = br_dev_delete,
 };
 
 int __init br_netlink_init(void)
@@ -218,19 +221,24 @@ int __init br_netlink_init(void)
         if (err < 0)
                 goto err1;
 
-        err = __rtnl_register(PF_BRIDGE, RTM_GETLINK, NULL, br_dump_ifinfo);
+        err = __rtnl_register(PF_BRIDGE, RTM_GETLINK, NULL,
+                              br_dump_ifinfo, NULL);
         if (err)
                 goto err2;
-        err = __rtnl_register(PF_BRIDGE, RTM_SETLINK, br_rtm_setlink, NULL);
+        err = __rtnl_register(PF_BRIDGE, RTM_SETLINK,
+                              br_rtm_setlink, NULL, NULL);
         if (err)
                 goto err3;
-        err = __rtnl_register(PF_BRIDGE, RTM_NEWNEIGH, br_fdb_add, NULL);
+        err = __rtnl_register(PF_BRIDGE, RTM_NEWNEIGH,
+                              br_fdb_add, NULL, NULL);
         if (err)
                 goto err3;
-        err = __rtnl_register(PF_BRIDGE, RTM_DELNEIGH, br_fdb_delete, NULL);
+        err = __rtnl_register(PF_BRIDGE, RTM_DELNEIGH,
+                              br_fdb_delete, NULL, NULL);
         if (err)
                 goto err3;
-        err = __rtnl_register(PF_BRIDGE, RTM_GETNEIGH, NULL, br_fdb_dump);
+        err = __rtnl_register(PF_BRIDGE, RTM_GETNEIGH,
+                              NULL, br_fdb_dump, NULL);
         if (err)
                 goto err3;
 
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 6545ee9591d..a76b6213555 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -34,6 +34,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         struct net_device *dev = ptr;
         struct net_bridge_port *p;
         struct net_bridge *br;
+        bool changed_addr;
         int err;
 
         /* register of bridge completed, add sysfs entries */
@@ -57,8 +58,12 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         case NETDEV_CHANGEADDR:
                 spin_lock_bh(&br->lock);
                 br_fdb_changeaddr(p, dev->dev_addr);
-                br_stp_recalculate_bridge_id(br);
+                changed_addr = br_stp_recalculate_bridge_id(br);
                 spin_unlock_bh(&br->lock);
+
+                if (changed_addr)
+                        call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
+
                 break;
 
         case NETDEV_CHANGE:
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 54578f274d8..857a021deea 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -124,6 +124,7 @@ struct net_bridge_port
         bridge_id                       designated_bridge;
         u32                             path_cost;
         u32                             designated_cost;
+        unsigned long                   designated_age;
 
         struct timer_list               forward_delay_timer;
         struct timer_list               hold_timer;
@@ -293,6 +294,7 @@ static inline int br_is_root_bridge(const struct net_bridge *br)
 
 /* br_device.c */
 extern void br_dev_setup(struct net_device *dev);
+extern void br_dev_delete(struct net_device *dev, struct list_head *list);
 extern netdev_tx_t br_dev_xmit(struct sk_buff *skb,
                                struct net_device *dev);
 #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/net/bridge/br_private_stp.h b/net/bridge/br_private_stp.h
index 642ef47a867..05ed9bc7e42 100644
--- a/net/bridge/br_private_stp.h
+++ b/net/bridge/br_private_stp.h
@@ -56,7 +56,8 @@ extern void br_become_root_bridge(struct net_bridge *br);
 extern void br_config_bpdu_generation(struct net_bridge *);
 extern void br_configuration_update(struct net_bridge *);
 extern void br_port_state_selection(struct net_bridge *);
-extern void br_received_config_bpdu(struct net_bridge_port *p, struct br_config_bpdu *bpdu);
+extern void br_received_config_bpdu(struct net_bridge_port *p,
+                                    const struct br_config_bpdu *bpdu);
 extern void br_received_tcn_bpdu(struct net_bridge_port *p);
 extern void br_transmit_config(struct net_bridge_port *p);
 extern void br_transmit_tcn(struct net_bridge *br);
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index bb4383e84de..ad0a3f7cf6c 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -109,7 +109,6 @@ static void br_root_selection(struct net_bridge *br)
         list_for_each_entry(p, &br->port_list, list) {
                 if (br_should_become_root_port(p, root_port))
                         root_port = p->port_no;
-
         }
 
         br->root_port = root_port;
@@ -145,7 +144,6 @@ void br_transmit_config(struct net_bridge_port *p)
         struct br_config_bpdu bpdu;
         struct net_bridge *br;
 
-
         if (timer_pending(&p->hold_timer)) {
                 p->config_pending = 1;
                 return;
@@ -164,8 +162,7 @@ void br_transmit_config(struct net_bridge_port *p)
         else {
                 struct net_bridge_port *root
                         = br_get_port(br, br->root_port);
-                bpdu.message_age = br->max_age
-                        - (root->message_age_timer.expires - jiffies)
+                bpdu.message_age = (jiffies - root->designated_age)
                         + MESSAGE_AGE_INCR;
         }
         bpdu.max_age = br->max_age;
@@ -182,20 +179,21 @@ void br_transmit_config(struct net_bridge_port *p)
 }
 
 /* called under bridge lock */
-static inline void br_record_config_information(struct net_bridge_port *p,
-                                                const struct br_config_bpdu *bpdu)
+static void br_record_config_information(struct net_bridge_port *p,
+                                         const struct br_config_bpdu *bpdu)
 {
         p->designated_root = bpdu->root;
         p->designated_cost = bpdu->root_path_cost;
         p->designated_bridge = bpdu->bridge_id;
         p->designated_port = bpdu->port_id;
+        p->designated_age = jiffies + bpdu->message_age;
 
         mod_timer(&p->message_age_timer, jiffies
                   + (p->br->max_age - bpdu->message_age));
 }
 
 /* called under bridge lock */
-static inline void br_record_config_timeout_values(struct net_bridge *br,
+static void br_record_config_timeout_values(struct net_bridge *br,
                                             const struct br_config_bpdu *bpdu)
 {
         br->max_age = bpdu->max_age;
@@ -254,7 +252,8 @@ static void br_designated_port_selection(struct net_bridge *br)
 }
 
 /* called under bridge lock */
-static int br_supersedes_port_info(struct net_bridge_port *p, struct br_config_bpdu *bpdu)
+static int br_supersedes_port_info(const struct net_bridge_port *p,
+                                   const struct br_config_bpdu *bpdu)
 {
         int t;
 
@@ -285,7 +284,7 @@ static int br_supersedes_port_info(struct net_bridge_port *p, struct br_config_b
 }
 
 /* called under bridge lock */
-static inline void br_topology_change_acknowledged(struct net_bridge *br)
+static void br_topology_change_acknowledged(struct net_bridge *br)
 {
         br->topology_change_detected = 0;
         del_timer(&br->tcn_timer);
@@ -327,7 +326,7 @@ void br_config_bpdu_generation(struct net_bridge *br)
 }
 
 /* called under bridge lock */
-static inline void br_reply(struct net_bridge_port *p)
+static void br_reply(struct net_bridge_port *p)
 {
         br_transmit_config(p);
 }
@@ -363,6 +362,8 @@ static void br_make_blocking(struct net_bridge_port *p)
 
                 p->state = BR_STATE_BLOCKING;
                 br_log_state(p);
+                br_ifinfo_notify(RTM_NEWLINK, p);
+
                 del_timer(&p->forward_delay_timer);
         }
 }
@@ -379,15 +380,14 @@ static void br_make_forwarding(struct net_bridge_port *p)
                 p->state = BR_STATE_FORWARDING;
                 br_topology_change_detection(br);
                 del_timer(&p->forward_delay_timer);
-        }
-        else if (br->stp_enabled == BR_KERNEL_STP)
+        } else if (br->stp_enabled == BR_KERNEL_STP)
                 p->state = BR_STATE_LISTENING;
         else
                 p->state = BR_STATE_LEARNING;
 
         br_multicast_enable_port(p);
-
         br_log_state(p);
+        br_ifinfo_notify(RTM_NEWLINK, p);
 
         if (br->forward_delay != 0)
                 mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);
@@ -431,14 +431,15 @@ void br_port_state_selection(struct net_bridge *br)
 }
 
 /* called under bridge lock */
-static inline void br_topology_change_acknowledge(struct net_bridge_port *p)
+static void br_topology_change_acknowledge(struct net_bridge_port *p)
 {
         p->topology_change_ack = 1;
         br_transmit_config(p);
 }
 
 /* called under bridge lock */
-void br_received_config_bpdu(struct net_bridge_port *p, struct br_config_bpdu *bpdu)
+void br_received_config_bpdu(struct net_bridge_port *p,
+                             const struct br_config_bpdu *bpdu)
 {
         struct net_bridge *br;
         int was_root;
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 289646ec9b7..e16aade51ae 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -210,10 +210,19 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
                 bpdu.hello_time = br_get_ticks(buf+28);
                 bpdu.forward_delay = br_get_ticks(buf+30);
 
-                br_received_config_bpdu(p, &bpdu);
-        }
+                if (bpdu.message_age > bpdu.max_age) {
+                        if (net_ratelimit())
+                                br_notice(p->br,
+                                          "port %u config from %pM"
+                                          " (message_age %ul > max_age %ul)\n",
+                                          p->port_no,
+                                          eth_hdr(skb)->h_source,
+                                          bpdu.message_age, bpdu.max_age);
+                        goto out;
+                }
 
-        else if (buf[0] == BPDU_TYPE_TCN) {
+                br_received_config_bpdu(p, &bpdu);
+        } else if (buf[0] == BPDU_TYPE_TCN) {
                 br_received_tcn_bpdu(p);
         }
  out:
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 6f615b8192f..10eda3cd1d7 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -88,6 +88,7 @@ void br_stp_enable_port(struct net_bridge_port *p)
         br_init_port(p);
         br_port_state_selection(p->br);
         br_log_state(p);
+        br_ifinfo_notify(RTM_NEWLINK, p);
 }
 
 /* called under bridge lock */
@@ -104,6 +105,8 @@ void br_stp_disable_port(struct net_bridge_port *p)
         p->topology_change_ack = 0;
         p->config_pending = 0;
 
+        br_ifinfo_notify(RTM_NEWLINK, p);
+
         del_timer(&p->message_age_timer);
         del_timer(&p->forward_delay_timer);
         del_timer(&p->hold_timer);
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index 3e965140051..58de2a0f997 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -97,6 +97,7 @@ static void br_forward_delay_timer_expired(unsigned long arg)
                 netif_carrier_on(br->dev);
         }
         br_log_state(p);
+        br_ifinfo_notify(RTM_NEWLINK, p);
         spin_unlock(&br->lock);
 }
 
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index ba6f73eb06c..a9aff9c7d02 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -4,7 +4,7 @@
 
 menuconfig BRIDGE_NF_EBTABLES
         tristate "Ethernet Bridge tables (ebtables) support"
-        depends on BRIDGE && BRIDGE_NETFILTER
+        depends on BRIDGE && NETFILTER
         select NETFILTER_XTABLES
         help
           ebtables is a general, extensible frame/packet identification
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 26377e96fa1..bf2a333ca7c 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -216,7 +216,6 @@ unlock:
 nlmsg_failure:
         pr_debug("error during NLMSG_PUT. This should "
                  "not happen, please report to author.\n");
-        goto unlock;
 alloc_failure:
         goto unlock;
 }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 2b5ca1a0054..5864cc49136 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1198,7 +1198,8 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table)
 
         if (table->check && table->check(newinfo, table->valid_hooks)) {
                 BUGPRINT("The table doesn't like its own initial data, lol\n");
-                return ERR_PTR(-EINVAL);
+                ret = -EINVAL;
+                goto free_chainstack;
         }
 
         table->private = newinfo;