6 files changed, 38 insertions, 22 deletions

diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index a0196ac79051..ac3c822eb39a 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -839,7 +839,7 @@ type_pf_tdel(struct ip_set *set, void *value, u32 timeout)
         struct htable *t = h->table;
         const struct type_pf_elem *d = value;
         struct hbucket *n;
-        int i, ret = 0;
+        int i;
         struct type_pf_elem *data;
         u32 key;
 
@@ -850,7 +850,7 @@ type_pf_tdel(struct ip_set *set, void *value, u32 timeout)
                 if (!type_pf_data_equal(data, d))
                         continue;
                 if (type_pf_data_expired(data))
-                        ret = -IPSET_ERR_EXIST;
+                        return -IPSET_ERR_EXIST;
                 if (i != n->pos - 1)
                         /* Not last one */
                         type_pf_data_copy(data, ahash_tdata(n, n->pos - 1));
diff --git a/include/linux/netfilter/ipset/ip_set_timeout.h b/include/linux/netfilter/ipset/ip_set_timeout.h
index 9f30c5f2ec1c..bcdd40ad39ed 100644
--- a/include/linux/netfilter/ipset/ip_set_timeout.h
+++ b/include/linux/netfilter/ipset/ip_set_timeout.h
@@ -45,7 +45,7 @@ ip_set_timeout_test(unsigned long timeout)
 {
         return timeout != IPSET_ELEM_UNSET &&
                (timeout == IPSET_ELEM_PERMANENT ||
-                time_after(timeout, jiffies));
+                time_is_after_jiffies(timeout));
 }
 
 static inline bool
@@ -53,7 +53,7 @@ ip_set_timeout_expired(unsigned long timeout)
 {
         return timeout != IPSET_ELEM_UNSET &&
                timeout != IPSET_ELEM_PERMANENT &&
-               time_before(timeout, jiffies);
+               time_is_before_jiffies(timeout);
 }
 
 static inline unsigned long
@@ -64,7 +64,7 @@ ip_set_timeout_set(u32 timeout)
         if (!timeout)
                 return IPSET_ELEM_PERMANENT;
 
-        t = timeout * HZ + jiffies;
+        t = msecs_to_jiffies(timeout * 1000) + jiffies;
         if (t == IPSET_ELEM_UNSET || t == IPSET_ELEM_PERMANENT)
                 /* Bingo! */
                 t++;
@@ -75,7 +75,8 @@ ip_set_timeout_set(u32 timeout)
 static inline u32
 ip_set_timeout_get(unsigned long timeout)
 {
-        return timeout == IPSET_ELEM_PERMANENT ? 0 : (timeout - jiffies)/HZ;
+        return timeout == IPSET_ELEM_PERMANENT ? 0 : 
+                jiffies_to_msecs(timeout - jiffies)/1000;
 }
 
 #else
@@ -89,14 +90,14 @@ static inline bool
 ip_set_timeout_test(unsigned long timeout)
 {
         return timeout == IPSET_ELEM_PERMANENT ||
-               time_after(timeout, jiffies);
+               time_is_after_jiffies(timeout);
 }
 
 static inline bool
 ip_set_timeout_expired(unsigned long timeout)
 {
         return timeout != IPSET_ELEM_PERMANENT &&
-               time_before(timeout, jiffies);
+               time_is_before_jiffies(timeout);
 }
 
 static inline unsigned long
@@ -107,7 +108,7 @@ ip_set_timeout_set(u32 timeout)
         if (!timeout)
                 return IPSET_ELEM_PERMANENT;
 
-        t = timeout * HZ + jiffies;
+        t = msecs_to_jiffies(timeout * 1000) + jiffies;
         if (t == IPSET_ELEM_PERMANENT)
                 /* Bingo! :-) */
                 t++;
@@ -118,7 +119,8 @@ ip_set_timeout_set(u32 timeout)
 static inline u32
 ip_set_timeout_get(unsigned long timeout)
 {
-        return timeout == IPSET_ELEM_PERMANENT ? 0 : (timeout - jiffies)/HZ;
+        return timeout == IPSET_ELEM_PERMANENT ? 0 :
+                jiffies_to_msecs(timeout - jiffies)/1000;
 }
 #endif /* ! IP_SET_BITMAP_TIMEOUT */
 
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 4fff432aeade..481f856c650f 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -797,7 +797,8 @@ struct netns_ipvs {
         struct list_head        rs_table[IP_VS_RTAB_SIZE];
         /* ip_vs_app */
         struct list_head        app_list;
-
+        /* ip_vs_ftp */
+        struct ip_vs_app        *ftp_app;
         /* ip_vs_proto */
         #define IP_VS_PROTO_TAB_SIZE    32      /* must be power of 2 */
         struct ip_vs_proto_data *proto_data_table[IP_VS_PROTO_TAB_SIZE];
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 1a92b369c820..2b5ca1a0054d 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1883,14 +1883,13 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
         struct xt_target *wt;
         void *dst = NULL;
         int off, pad = 0;
-        unsigned int size_kern, entry_offset, match_size = mwt->match_size;
+        unsigned int size_kern, match_size = mwt->match_size;
 
         strlcpy(name, mwt->u.name, sizeof(name));
 
         if (state->buf_kern_start)
                 dst = state->buf_kern_start + state->buf_kern_offset;
 
-        entry_offset = (unsigned char *) mwt - base;
         switch (compat_mwt) {
         case EBT_COMPAT_MATCH:
                 match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
@@ -1933,6 +1932,9 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
                 size_kern = wt->targetsize;
                 module_put(wt->me);
                 break;
+
+        default:
+                return -EINVAL;
         }
 
         state->buf_kern_offset += match_size + off;
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 72d1ac611fdc..8041befc6555 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -815,7 +815,7 @@ ip_set_flush(struct sock *ctnl, struct sk_buff *skb,
         ip_set_id_t i;
 
         if (unlikely(protocol_failed(attr)))
-                return -EPROTO;
+                return -IPSET_ERR_PROTOCOL;
 
         if (!attr[IPSET_ATTR_SETNAME]) {
                 for (i = 0; i < ip_set_max; i++)
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 6b5dd6ddaae9..af63553fa332 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -411,25 +411,35 @@ static struct ip_vs_app ip_vs_ftp = {
 static int __net_init __ip_vs_ftp_init(struct net *net)
 {
         int i, ret;
-        struct ip_vs_app *app = &ip_vs_ftp;
+        struct ip_vs_app *app;
+        struct netns_ipvs *ipvs = net_ipvs(net);
+
+        app = kmemdup(&ip_vs_ftp, sizeof(struct ip_vs_app), GFP_KERNEL);
+        if (!app)
+                return -ENOMEM;
+        INIT_LIST_HEAD(&app->a_list);
+        INIT_LIST_HEAD(&app->incs_list);
+        ipvs->ftp_app = app;
 
         ret = register_ip_vs_app(net, app);
         if (ret)
-                return ret;
+                goto err_exit;
 
         for (i=0; i<IP_VS_APP_MAX_PORTS; i++) {
                 if (!ports[i])
                         continue;
                 ret = register_ip_vs_app_inc(net, app, app->protocol, ports[i]);
                 if (ret)
-                        break;
+                        goto err_unreg;
                 pr_info("%s: loaded support on port[%d] = %d\n",
                         app->name, i, ports[i]);
         }
+        return 0;
 
-        if (ret)
-                unregister_ip_vs_app(net, app);
-
+err_unreg:
+        unregister_ip_vs_app(net, app);
+err_exit:
+        kfree(ipvs->ftp_app);
         return ret;
 }
 /*
@@ -437,9 +447,10 @@ static int __net_init __ip_vs_ftp_init(struct net *net)
  */
 static void __ip_vs_ftp_exit(struct net *net)
 {
-        struct ip_vs_app *app = &ip_vs_ftp;
+        struct netns_ipvs *ipvs = net_ipvs(net);
 
-        unregister_ip_vs_app(net, app);
+        unregister_ip_vs_app(net, ipvs->ftp_app);
+        kfree(ipvs->ftp_app);
 }
 
 static struct pernet_operations ip_vs_ftp_ops = {