1 files changed, 13 insertions, 6 deletions

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index e41ce458c2a9..fc456a7aaec3 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -315,8 +315,8 @@ err:
 static void netlink_remove(struct sock *sk)
 {
         netlink_table_grab();
-        nl_table[sk->sk_protocol].hash.entries--;
-        sk_del_node_init(sk);
+        if (sk_del_node_init(sk))
+                nl_table[sk->sk_protocol].hash.entries--;
         if (nlk_sk(sk)->groups)
                 __sk_del_bind_node(sk);
         netlink_table_ungrab();
@@ -429,7 +429,12 @@ retry:
         err = netlink_insert(sk, pid);
         if (err == -EADDRINUSE)
                 goto retry;
-        return 0;
+
+        /* If 2 threads race to autobind, that is fine.  */
+        if (err == -EBUSY)
+                err = 0;
+
+        return err;
 }
 
 static inline int netlink_capable(struct socket *sock, unsigned int flag) 
@@ -1095,8 +1100,7 @@ static int netlink_dump(struct sock *sk)
                 return 0;
         }
 
-        nlh = __nlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq, NLMSG_DONE, sizeof(int));
-        nlh->nlmsg_flags |= NLM_F_MULTI;
+        nlh = NLMSG_NEW_ANSWER(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
         memcpy(NLMSG_DATA(nlh), &len, sizeof(len));
         skb_queue_tail(&sk->sk_receive_queue, skb);
         sk->sk_data_ready(sk, skb->len);
@@ -1107,6 +1111,9 @@ static int netlink_dump(struct sock *sk)
 
         netlink_destroy_callback(cb);
         return 0;
+
+nlmsg_failure:
+        return -ENOBUFS;
 }
 
 int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
@@ -1178,7 +1185,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
         }
 
         rep = __nlmsg_put(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
-                          NLMSG_ERROR, sizeof(struct nlmsgerr));
+                          NLMSG_ERROR, sizeof(struct nlmsgerr), 0);
         errmsg = NLMSG_DATA(rep);
         errmsg->error = err;
         memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(struct nlmsghdr));