Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6

10 files changed, 215 insertions, 76 deletions

diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index fa80bb9b9c81..f2d576e6b769 100644
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -53,7 +53,8 @@ struct hash_ip4_telem {
 
 static inline bool
 hash_ip4_data_equal(const struct hash_ip4_elem *ip1,
-                    const struct hash_ip4_elem *ip2)
+                    const struct hash_ip4_elem *ip2,
+                    u32 *multi)
 {
         return ip1->ip == ip2->ip;
 }
@@ -225,7 +226,8 @@ struct hash_ip6_telem {
 
 static inline bool
 hash_ip6_data_equal(const struct hash_ip6_elem *ip1,
-                    const struct hash_ip6_elem *ip2)
+                    const struct hash_ip6_elem *ip2,
+                    u32 *multi)
 {
         return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0;
 }
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index bbf51b67b170..6ee10f5d59bd 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -60,7 +60,8 @@ struct hash_ipport4_telem {
 
 static inline bool
 hash_ipport4_data_equal(const struct hash_ipport4_elem *ip1,
-                        const struct hash_ipport4_elem *ip2)
+                        const struct hash_ipport4_elem *ip2,
+                        u32 *multi)
 {
         return ip1->ip == ip2->ip &&
                ip1->port == ip2->port &&
@@ -276,7 +277,8 @@ struct hash_ipport6_telem {
 
 static inline bool
 hash_ipport6_data_equal(const struct hash_ipport6_elem *ip1,
-                        const struct hash_ipport6_elem *ip2)
+                        const struct hash_ipport6_elem *ip2,
+                        u32 *multi)
 {
         return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
                ip1->port == ip2->port &&
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index 96525f529a54..fb90e344e907 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -62,7 +62,8 @@ struct hash_ipportip4_telem {
 
 static inline bool
 hash_ipportip4_data_equal(const struct hash_ipportip4_elem *ip1,
-                          const struct hash_ipportip4_elem *ip2)
+                          const struct hash_ipportip4_elem *ip2,
+                          u32 *multi)
 {
         return ip1->ip == ip2->ip &&
                ip1->ip2 == ip2->ip2 &&
@@ -286,7 +287,8 @@ struct hash_ipportip6_telem {
 
 static inline bool
 hash_ipportip6_data_equal(const struct hash_ipportip6_elem *ip1,
-                          const struct hash_ipportip6_elem *ip2)
+                          const struct hash_ipportip6_elem *ip2,
+                          u32 *multi)
 {
         return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
                ipv6_addr_cmp(&ip1->ip2.in6, &ip2->ip2.in6) == 0 &&
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index d2d6ab89f087..deb3e3dfa5fc 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -62,7 +62,8 @@ struct hash_ipportnet4_telem {
 
 static inline bool
 hash_ipportnet4_data_equal(const struct hash_ipportnet4_elem *ip1,
-                           const struct hash_ipportnet4_elem *ip2)
+                           const struct hash_ipportnet4_elem *ip2,
+                           u32 *multi)
 {
         return ip1->ip == ip2->ip &&
                ip1->ip2 == ip2->ip2 &&
@@ -335,7 +336,8 @@ struct hash_ipportnet6_telem {
 
 static inline bool
 hash_ipportnet6_data_equal(const struct hash_ipportnet6_elem *ip1,
-                           const struct hash_ipportnet6_elem *ip2)
+                           const struct hash_ipportnet6_elem *ip2,
+                           u32 *multi)
 {
         return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
                ipv6_addr_cmp(&ip1->ip2.in6, &ip2->ip2.in6) == 0 &&
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index 2d4b1f48e8c9..60d016541c58 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -58,7 +58,8 @@ struct hash_net4_telem {
 
 static inline bool
 hash_net4_data_equal(const struct hash_net4_elem *ip1,
-                    const struct hash_net4_elem *ip2)
+                     const struct hash_net4_elem *ip2,
+                     u32 *multi)
 {
         return ip1->ip == ip2->ip && ip1->cidr == ip2->cidr;
 }
@@ -249,7 +250,8 @@ struct hash_net6_telem {
 
 static inline bool
 hash_net6_data_equal(const struct hash_net6_elem *ip1,
-                     const struct hash_net6_elem *ip2)
+                     const struct hash_net6_elem *ip2,
+                     u32 *multi)
 {
         return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
                ip1->cidr == ip2->cidr;
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 3d6c53b6211a..e13095deb50d 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -99,7 +99,7 @@ iface_test(struct rb_root *root, const char **iface)
 
         while (n) {
                 const char *d = iface_data(n);
-                int res = ifname_compare(*iface, d);
+                long res = ifname_compare(*iface, d);
 
                 if (res < 0)
                         n = n->rb_left;
@@ -121,7 +121,7 @@ iface_add(struct rb_root *root, const char **iface)
 
         while (*n) {
                 char *ifname = iface_data(*n);
-                int res = ifname_compare(*iface, ifname);
+                long res = ifname_compare(*iface, ifname);
 
                 p = *n;
                 if (res < 0)
@@ -159,31 +159,42 @@ hash_netiface_same_set(const struct ip_set *a, const struct ip_set *b);
 
 /* The type variant functions: IPv4 */
 
+struct hash_netiface4_elem_hashed {
+        __be32 ip;
+        u8 physdev;
+        u8 cidr;
+        u16 padding;
+};
+
+#define HKEY_DATALEN    sizeof(struct hash_netiface4_elem_hashed)
+
 /* Member elements without timeout */
 struct hash_netiface4_elem {
         __be32 ip;
-        const char *iface;
         u8 physdev;
         u8 cidr;
         u16 padding;
+        const char *iface;
 };
 
 /* Member elements with timeout support */
 struct hash_netiface4_telem {
         __be32 ip;
-        const char *iface;
         u8 physdev;
         u8 cidr;
         u16 padding;
+        const char *iface;
         unsigned long timeout;
 };
 
 static inline bool
 hash_netiface4_data_equal(const struct hash_netiface4_elem *ip1,
-                          const struct hash_netiface4_elem *ip2)
+                          const struct hash_netiface4_elem *ip2,
+                          u32 *multi)
 {
         return ip1->ip == ip2->ip &&
                ip1->cidr == ip2->cidr &&
+               (++*multi) &&
                ip1->physdev == ip2->physdev &&
                ip1->iface == ip2->iface;
 }
@@ -257,6 +268,7 @@ nla_put_failure:
 
 #define IP_SET_HASH_WITH_NETS
 #define IP_SET_HASH_WITH_RBTREE
+#define IP_SET_HASH_WITH_MULTI
 
 #define PF              4
 #define HOST_MASK       32
@@ -424,29 +436,40 @@ hash_netiface_same_set(const struct ip_set *a, const struct ip_set *b)
 
 /* The type variant functions: IPv6 */
 
+struct hash_netiface6_elem_hashed {
+        union nf_inet_addr ip;
+        u8 physdev;
+        u8 cidr;
+        u16 padding;
+};
+
+#define HKEY_DATALEN    sizeof(struct hash_netiface6_elem_hashed)
+
 struct hash_netiface6_elem {
         union nf_inet_addr ip;
-        const char *iface;
         u8 physdev;
         u8 cidr;
         u16 padding;
+        const char *iface;
 };
 
 struct hash_netiface6_telem {
         union nf_inet_addr ip;
-        const char *iface;
         u8 physdev;
         u8 cidr;
         u16 padding;
+        const char *iface;
         unsigned long timeout;
 };
 
 static inline bool
 hash_netiface6_data_equal(const struct hash_netiface6_elem *ip1,
-                          const struct hash_netiface6_elem *ip2)
+                          const struct hash_netiface6_elem *ip2,
+                          u32 *multi)
 {
         return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
                ip1->cidr == ip2->cidr &&
+               (++*multi) &&
                ip1->physdev == ip2->physdev &&
                ip1->iface == ip2->iface;
 }
@@ -681,6 +704,7 @@ hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->maxelem = maxelem;
         get_random_bytes(&h->initval, sizeof(h->initval));
         h->timeout = IPSET_NO_TIMEOUT;
+        h->ahash_max = AHASH_MAX_SIZE;
 
         hbits = htable_bits(hashsize);
         h->table = ip_set_alloc(
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index fe203d12f56b..8f9de7207ec9 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -59,7 +59,8 @@ struct hash_netport4_telem {
 
 static inline bool
 hash_netport4_data_equal(const struct hash_netport4_elem *ip1,
-                         const struct hash_netport4_elem *ip2)
+                         const struct hash_netport4_elem *ip2,
+                         u32 *multi)
 {
         return ip1->ip == ip2->ip &&
                ip1->port == ip2->port &&
@@ -300,7 +301,8 @@ struct hash_netport6_telem {
 
 static inline bool
 hash_netport6_data_equal(const struct hash_netport6_elem *ip1,
-                         const struct hash_netport6_elem *ip2)
+                         const struct hash_netport6_elem *ip2,
+                         u32 *multi)
 {
         return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
                ip1->port == ip2->port &&
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index b4a4532823e8..1905976b5135 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -37,7 +37,7 @@ MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NETFILTER);
 
 static char __initdata nfversion[] = "0.30";
 
-static const struct nfnetlink_subsystem *subsys_table[NFNL_SUBSYS_COUNT];
+static const struct nfnetlink_subsystem __rcu *subsys_table[NFNL_SUBSYS_COUNT];
 static DEFINE_MUTEX(nfnl_mutex);
 
 void nfnl_lock(void)
@@ -59,7 +59,7 @@ int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n)
                 nfnl_unlock();
                 return -EBUSY;
         }
-        subsys_table[n->subsys_id] = n;
+        rcu_assign_pointer(subsys_table[n->subsys_id], n);
         nfnl_unlock();
 
         return 0;
@@ -71,7 +71,7 @@ int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n)
         nfnl_lock();
         subsys_table[n->subsys_id] = NULL;
         nfnl_unlock();
-
+        synchronize_rcu();
         return 0;
 }
 EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister);
@@ -83,7 +83,7 @@ static inline const struct nfnetlink_subsystem *nfnetlink_get_subsys(u_int16_t t
         if (subsys_id >= NFNL_SUBSYS_COUNT)
                 return NULL;
 
-        return subsys_table[subsys_id];
+        return rcu_dereference(subsys_table[subsys_id]);
 }
 
 static inline const struct nfnl_callback *
@@ -139,21 +139,27 @@ static int nfnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
         type = nlh->nlmsg_type;
 replay:
+        rcu_read_lock();
         ss = nfnetlink_get_subsys(type);
         if (!ss) {
 #ifdef CONFIG_MODULES
-                nfnl_unlock();
+                rcu_read_unlock();
                 request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type));
-                nfnl_lock();
+                rcu_read_lock();
                 ss = nfnetlink_get_subsys(type);
                 if (!ss)
 #endif
+                {
+                        rcu_read_unlock();
                         return -EINVAL;
+                }
         }
 
         nc = nfnetlink_find_client(type, ss);
-        if (!nc)
+        if (!nc) {
+                rcu_read_unlock();
                 return -EINVAL;
+        }
 
         {
                 int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
@@ -167,7 +173,23 @@ replay:
                 if (err < 0)
                         return err;
 
-                err = nc->call(net->nfnl, skb, nlh, (const struct nlattr **)cda);
+                if (nc->call_rcu) {
+                        err = nc->call_rcu(net->nfnl, skb, nlh,
+                                           (const struct nlattr **)cda);
+                        rcu_read_unlock();
+                } else {
+                        rcu_read_unlock();
+                        nfnl_lock();
+                        if (rcu_dereference_protected(
+                                        subsys_table[NFNL_SUBSYS_ID(type)],
+                                        lockdep_is_held(&nfnl_mutex)) != ss ||
+                            nfnetlink_find_client(type, ss) != nc)
+                                err = -EAGAIN;
+                        else
+                                err = nc->call(net->nfnl, skb, nlh,
+                                                   (const struct nlattr **)cda);
+                        nfnl_unlock();
+                }
                 if (err == -EAGAIN)
                         goto replay;
                 return err;
@@ -176,9 +198,7 @@ replay:
 
 static void nfnetlink_rcv(struct sk_buff *skb)
 {
-        nfnl_lock();
         netlink_rcv_skb(skb, &nfnetlink_rcv_msg);
-        nfnl_unlock();
 }
 
 static int __net_init nfnetlink_net_init(struct net *net)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index fdd2fafe0a14..49132bddd73e 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -58,7 +58,7 @@ struct nfqnl_instance {
  */
         spinlock_t      lock;
         unsigned int    queue_total;
-        atomic_t        id_sequence;            /* 'sequence' of pkt ids */
+        unsigned int    id_sequence;            /* 'sequence' of pkt ids */
         struct list_head queue_list;            /* packets in queue */
 };
 
@@ -171,6 +171,13 @@ __enqueue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
        queue->queue_total++;
 }
 
+static void
+__dequeue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
+{
+        list_del(&entry->list);
+        queue->queue_total--;
+}
+
 static struct nf_queue_entry *
 find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id)
 {
@@ -185,10 +192,8 @@ find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id)
                 }
         }
 
-        if (entry) {
-                list_del(&entry->list);
-                queue->queue_total--;
-        }
+        if (entry)
+                __dequeue_entry(queue, entry);
 
         spin_unlock_bh(&queue->lock);
 
@@ -213,13 +218,15 @@ nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
 
 static struct sk_buff *
 nfqnl_build_packet_message(struct nfqnl_instance *queue,
-                           struct nf_queue_entry *entry)
+                           struct nf_queue_entry *entry,
+                           __be32 **packet_id_ptr)
 {
         sk_buff_data_t old_tail;
         size_t size;
         size_t data_len = 0;
         struct sk_buff *skb;
-        struct nfqnl_msg_packet_hdr pmsg;
+        struct nlattr *nla;
+        struct nfqnl_msg_packet_hdr *pmsg;
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
         struct sk_buff *entskb = entry->skb;
@@ -272,12 +279,11 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         nfmsg->version = NFNETLINK_V0;
         nfmsg->res_id = htons(queue->queue_num);
 
-        entry->id = atomic_inc_return(&queue->id_sequence);
-        pmsg.packet_id          = htonl(entry->id);
-        pmsg.hw_protocol        = entskb->protocol;
-        pmsg.hook               = entry->hook;
-
-        NLA_PUT(skb, NFQA_PACKET_HDR, sizeof(pmsg), &pmsg);
+        nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg));
+        pmsg = nla_data(nla);
+        pmsg->hw_protocol       = entskb->protocol;
+        pmsg->hook              = entry->hook;
+        *packet_id_ptr          = &pmsg->packet_id;
 
         indev = entry->indev;
         if (indev) {
@@ -389,6 +395,7 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
         struct sk_buff *nskb;
         struct nfqnl_instance *queue;
         int err = -ENOBUFS;
+        __be32 *packet_id_ptr;
 
         /* rcu_read_lock()ed by nf_hook_slow() */
         queue = instance_lookup(queuenum);
@@ -402,7 +409,7 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
                 goto err_out;
         }
 
-        nskb = nfqnl_build_packet_message(queue, entry);
+        nskb = nfqnl_build_packet_message(queue, entry, &packet_id_ptr);
         if (nskb == NULL) {
                 err = -ENOMEM;
                 goto err_out;
@@ -421,6 +428,8 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
                                  queue->queue_total);
                 goto err_out_free_nskb;
         }
+        entry->id = ++queue->id_sequence;
+        *packet_id_ptr = htonl(entry->id);
 
         /* nfnetlink_unicast will either free the nskb or add it to a socket */
         err = nfnetlink_unicast(nskb, &init_net, queue->peer_pid, MSG_DONTWAIT);
@@ -608,6 +617,92 @@ static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = {
         [NFQA_PAYLOAD]          = { .type = NLA_UNSPEC },
 };
 
+static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = {
+        [NFQA_VERDICT_HDR]      = { .len = sizeof(struct nfqnl_msg_verdict_hdr) },
+        [NFQA_MARK]             = { .type = NLA_U32 },
+};
+
+static struct nfqnl_instance *verdict_instance_lookup(u16 queue_num, int nlpid)
+{
+        struct nfqnl_instance *queue;
+
+        queue = instance_lookup(queue_num);
+        if (!queue)
+                return ERR_PTR(-ENODEV);
+
+        if (queue->peer_pid != nlpid)
+                return ERR_PTR(-EPERM);
+
+        return queue;
+}
+
+static struct nfqnl_msg_verdict_hdr*
+verdicthdr_get(const struct nlattr * const nfqa[])
+{
+        struct nfqnl_msg_verdict_hdr *vhdr;
+        unsigned int verdict;
+
+        if (!nfqa[NFQA_VERDICT_HDR])
+                return NULL;
+
+        vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
+        verdict = ntohl(vhdr->verdict);
+        if ((verdict & NF_VERDICT_MASK) > NF_MAX_VERDICT)
+                return NULL;
+        return vhdr;
+}
+
+static int nfq_id_after(unsigned int id, unsigned int max)
+{
+        return (int)(id - max) > 0;
+}
+
+static int
+nfqnl_recv_verdict_batch(struct sock *ctnl, struct sk_buff *skb,
+                   const struct nlmsghdr *nlh,
+                   const struct nlattr * const nfqa[])
+{
+        struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
+        struct nf_queue_entry *entry, *tmp;
+        unsigned int verdict, maxid;
+        struct nfqnl_msg_verdict_hdr *vhdr;
+        struct nfqnl_instance *queue;
+        LIST_HEAD(batch_list);
+        u16 queue_num = ntohs(nfmsg->res_id);
+
+        queue = verdict_instance_lookup(queue_num, NETLINK_CB(skb).pid);
+        if (IS_ERR(queue))
+                return PTR_ERR(queue);
+
+        vhdr = verdicthdr_get(nfqa);
+        if (!vhdr)
+                return -EINVAL;
+
+        verdict = ntohl(vhdr->verdict);
+        maxid = ntohl(vhdr->id);
+
+        spin_lock_bh(&queue->lock);
+
+        list_for_each_entry_safe(entry, tmp, &queue->queue_list, list) {
+                if (nfq_id_after(entry->id, maxid))
+                        break;
+                __dequeue_entry(queue, entry);
+                list_add_tail(&entry->list, &batch_list);
+        }
+
+        spin_unlock_bh(&queue->lock);
+
+        if (list_empty(&batch_list))
+                return -ENOENT;
+
+        list_for_each_entry_safe(entry, tmp, &batch_list, list) {
+                if (nfqa[NFQA_MARK])
+                        entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK]));
+                nf_reinject(entry, verdict);
+        }
+        return 0;
+}
+
 static int
 nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
                    const struct nlmsghdr *nlh,
@@ -620,39 +715,23 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
         struct nfqnl_instance *queue;
         unsigned int verdict;
         struct nf_queue_entry *entry;
-        int err;
 
-        rcu_read_lock();
         queue = instance_lookup(queue_num);
-        if (!queue) {
-                err = -ENODEV;
-                goto err_out_unlock;
-        }
+        if (!queue)
 
-        if (queue->peer_pid != NETLINK_CB(skb).pid) {
-                err = -EPERM;
-                goto err_out_unlock;
-        }
+        queue = verdict_instance_lookup(queue_num, NETLINK_CB(skb).pid);
+        if (IS_ERR(queue))
+                return PTR_ERR(queue);
 
-        if (!nfqa[NFQA_VERDICT_HDR]) {
-                err = -EINVAL;
-                goto err_out_unlock;
-        }
+        vhdr = verdicthdr_get(nfqa);
+        if (!vhdr)
+                return -EINVAL;
 
-        vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
         verdict = ntohl(vhdr->verdict);
 
-        if ((verdict & NF_VERDICT_MASK) > NF_MAX_VERDICT) {
-                err = -EINVAL;
-                goto err_out_unlock;
-        }
-
         entry = find_dequeue_entry(queue, ntohl(vhdr->id));
-        if (entry == NULL) {
-                err = -ENOENT;
-                goto err_out_unlock;
-        }
-        rcu_read_unlock();
+        if (entry == NULL)
+                return -ENOENT;
 
         if (nfqa[NFQA_PAYLOAD]) {
                 if (nfqnl_mangle(nla_data(nfqa[NFQA_PAYLOAD]),
@@ -665,10 +744,6 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
 
         nf_reinject(entry, verdict);
         return 0;
-
-err_out_unlock:
-        rcu_read_unlock();
-        return err;
 }
 
 static int
@@ -781,14 +856,17 @@ err_out_unlock:
 }
 
 static const struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX] = {
-        [NFQNL_MSG_PACKET]      = { .call = nfqnl_recv_unsupp,
+        [NFQNL_MSG_PACKET]      = { .call_rcu = nfqnl_recv_unsupp,
                                     .attr_count = NFQA_MAX, },
-        [NFQNL_MSG_VERDICT]     = { .call = nfqnl_recv_verdict,
+        [NFQNL_MSG_VERDICT]     = { .call_rcu = nfqnl_recv_verdict,
                                     .attr_count = NFQA_MAX,
                                     .policy = nfqa_verdict_policy },
         [NFQNL_MSG_CONFIG]      = { .call = nfqnl_recv_config,
                                     .attr_count = NFQA_CFG_MAX,
                                     .policy = nfqa_cfg_policy },
+        [NFQNL_MSG_VERDICT_BATCH]={ .call_rcu = nfqnl_recv_verdict_batch,
+                                    .attr_count = NFQA_MAX,
+                                    .policy = nfqa_verdict_batch_policy },
 };
 
 static const struct nfnetlink_subsystem nfqnl_subsys = {
@@ -870,7 +948,7 @@ static int seq_show(struct seq_file *s, void *v)
                           inst->peer_pid, inst->queue_total,
                           inst->copy_mode, inst->copy_range,
                           inst->queue_dropped, inst->queue_user_dropped,
-                          atomic_read(&inst->id_sequence), 1);
+                          inst->id_sequence, 1);
 }
 
 static const struct seq_operations nfqnl_seq_ops = {
diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index 363a99ec0637..4bca15a0c385 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -163,6 +163,11 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par)
                 break;
         }
 
+#ifdef CONFIG_NETWORK_SECMARK
+        if (skb->secmark)
+                audit_log_secctx(ab, skb->secmark);
+#endif
+
         audit_log_end(ab);
 
 errout: