3 files changed, 27 insertions, 9 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 908f07c3bd7d..fcdf03cf3b3f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2900,7 +2900,7 @@ int __dev_addr_add(struct dev_addr_list **list, int *count,
                 }
         }
 
-        da = kmalloc(sizeof(*da), GFP_ATOMIC);
+        da = kzalloc(sizeof(*da), GFP_ATOMIC);
         if (da == NULL)
                 return -ENOMEM;
         memcpy(da->da_addr, addr, alen);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index a16cf1ec5e5e..2328acbd16cd 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -358,11 +358,12 @@ struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 {
         struct neighbour *n;
         int key_len = tbl->key_len;
-        u32 hash_val = tbl->hash(pkey, dev);
+        u32 hash_val;
 
         NEIGH_CACHE_STAT_INC(tbl, lookups);
 
         read_lock_bh(&tbl->lock);
+        hash_val = tbl->hash(pkey, dev);
         for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
                 if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
                         neigh_hold(n);
@@ -379,11 +380,12 @@ struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 {
         struct neighbour *n;
         int key_len = tbl->key_len;
-        u32 hash_val = tbl->hash(pkey, NULL);
+        u32 hash_val;
 
         NEIGH_CACHE_STAT_INC(tbl, lookups);
 
         read_lock_bh(&tbl->lock);
+        hash_val = tbl->hash(pkey, NULL);
         for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
                 if (!memcmp(n->primary_key, pkey, key_len) &&
                     (net == n->dev->nd_net)) {
@@ -507,6 +509,7 @@ struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
         if (tbl->pconstructor && tbl->pconstructor(n)) {
                 if (dev)
                         dev_put(dev);
+                release_net(net);
                 kfree(n);
                 n = NULL;
                 goto out;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 61ac8d06292c..2bd9c5f7627d 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -689,10 +689,12 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_BROADCAST]        = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
         [IFLA_MAP]              = { .len = sizeof(struct rtnl_link_ifmap) },
         [IFLA_MTU]              = { .type = NLA_U32 },
+        [IFLA_LINK]             = { .type = NLA_U32 },
         [IFLA_TXQLEN]           = { .type = NLA_U32 },
         [IFLA_WEIGHT]           = { .type = NLA_U32 },
         [IFLA_OPERSTATE]        = { .type = NLA_U8 },
         [IFLA_LINKMODE]         = { .type = NLA_U8 },
+        [IFLA_LINKINFO]         = { .type = NLA_NESTED },
         [IFLA_NET_NS_PID]       = { .type = NLA_U32 },
 };
 
@@ -720,6 +722,21 @@ static struct net *get_net_ns_by_pid(pid_t pid)
         return net;
 }
 
+static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
+{
+        if (dev) {
+                if (tb[IFLA_ADDRESS] &&
+                    nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
+                        return -EINVAL;
+
+                if (tb[IFLA_BROADCAST] &&
+                    nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                       struct nlattr **tb, char *ifname, int modified)
 {
@@ -892,12 +909,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 goto errout;
         }
 
-        if (tb[IFLA_ADDRESS] &&
-            nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
-                goto errout_dev;
-
-        if (tb[IFLA_BROADCAST] &&
-            nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
+        if ((err = validate_linkmsg(dev, tb)) < 0)
                 goto errout_dev;
 
         err = do_setlink(dev, ifm, tb, ifname, 0);
@@ -1018,6 +1030,9 @@ replay:
         else
                 dev = NULL;
 
+        if ((err = validate_linkmsg(dev, tb)) < 0)
+                return err;
+
         if (tb[IFLA_LINKINFO]) {
                 err = nla_parse_nested(linkinfo, IFLA_INFO_MAX,
                                        tb[IFLA_LINKINFO], ifla_info_policy);