11 files changed, 134 insertions, 108 deletions
diff --git a/net/Makefile b/net/Makefile
index 4aa2f46d2a56..f5141b9d4f38 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -15,8 +15,8 @@ obj-$(CONFIG_NET)		+= $(tmp-y)
 # LLC has to be linked before the files in net/802/
 obj-$(CONFIG_LLC)               += llc/
 obj-$(CONFIG_NET)               += ethernet/ 802/ sched/ netlink/
-obj-$(CONFIG_INET)              += ipv4/
 obj-$(CONFIG_NETFILTER)         += netfilter/
+obj-$(CONFIG_INET)              += ipv4/
 obj-$(CONFIG_XFRM)              += xfrm/
 obj-$(CONFIG_UNIX)              += unix/
 ifneq ($(CONFIG_IPV6),)
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index d2a4fec22862..de9f4464438d 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -467,7 +467,7 @@ out:
 }
 #endif
-static const int cta_min_ip[CTA_IP_MAX] = {
+static const size_t cta_min_ip[CTA_IP_MAX] = {
        [CTA_IP_V4_SRC-1]       = sizeof(u_int32_t),
        [CTA_IP_V4_DST-1]       = sizeof(u_int32_t),
 };
@@ -497,7 +497,7 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
        return 0;
 }
-static const int cta_min_proto[CTA_PROTO_MAX] = {
+static const size_t cta_min_proto[CTA_PROTO_MAX] = {
        [CTA_PROTO_NUM-1]       = sizeof(u_int16_t),
        [CTA_PROTO_SRC_PORT-1]  = sizeof(u_int16_t),
        [CTA_PROTO_DST_PORT-1]  = sizeof(u_int16_t),
@@ -576,7 +576,7 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
 }
 #ifdef CONFIG_IP_NF_NAT_NEEDED
-static const int cta_min_protonat[CTA_PROTONAT_MAX] = {
+static const size_t cta_min_protonat[CTA_PROTONAT_MAX] = {
        [CTA_PROTONAT_PORT_MIN-1]       = sizeof(u_int16_t),
        [CTA_PROTONAT_PORT_MAX-1]       = sizeof(u_int16_t),
 };
@@ -614,6 +614,11 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
        return 0;
 }
+static const size_t cta_min_nat[CTA_NAT_MAX] = {
+        [CTA_NAT_MINIP-1]       = sizeof(u_int32_t),
+        [CTA_NAT_MAXIP-1]       = sizeof(u_int32_t),
+};
 static inline int
 ctnetlink_parse_nat(struct nfattr *cda[],
                    const struct ip_conntrack *ct, struct ip_nat_range *range)
@@ -627,6 +632,9 @@ ctnetlink_parse_nat(struct nfattr *cda[],
        
        nfattr_parse_nested(tb, CTA_NAT_MAX, cda[CTA_NAT-1]);
+        if (nfattr_bad_size(tb, CTA_NAT_MAX, cta_min_nat))
+                return -EINVAL;
        if (tb[CTA_NAT_MINIP-1])
                range->min_ip = *(u_int32_t *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
@@ -667,6 +675,14 @@ ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
        return 0;
 }
+static const size_t cta_min[CTA_MAX] = {
+        [CTA_STATUS-1]          = sizeof(u_int32_t),
+        [CTA_TIMEOUT-1]         = sizeof(u_int32_t),
+        [CTA_MARK-1]            = sizeof(u_int32_t),
+        [CTA_USE-1]             = sizeof(u_int32_t),
+        [CTA_ID-1]              = sizeof(u_int32_t)
+};
 static int
 ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb, 
                        struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
@@ -678,6 +694,9 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
        DEBUGP("entered %s\n", __FUNCTION__);
+        if (nfattr_bad_size(cda, CTA_MAX, cta_min))
+                return -EINVAL;
        if (cda[CTA_TUPLE_ORIG-1])
                err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG);
        else if (cda[CTA_TUPLE_REPLY-1])
@@ -760,6 +779,9 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
                return 0;
        }
+        if (nfattr_bad_size(cda, CTA_MAX, cta_min))
+                return -EINVAL;
        if (cda[CTA_TUPLE_ORIG-1])
                err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG);
        else if (cda[CTA_TUPLE_REPLY-1])
@@ -1047,6 +1069,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
        DEBUGP("entered %s\n", __FUNCTION__);
+        if (nfattr_bad_size(cda, CTA_MAX, cta_min))
+                return -EINVAL;
        if (cda[CTA_TUPLE_ORIG-1]) {
                err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG);
                if (err < 0)
@@ -1252,6 +1277,11 @@ out:
        return skb->len;
 }
+static const size_t cta_min_exp[CTA_EXPECT_MAX] = {
+        [CTA_EXPECT_TIMEOUT-1]          = sizeof(u_int32_t),
+        [CTA_EXPECT_ID-1]               = sizeof(u_int32_t)
+};
 static int
 ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb, 
                     struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
@@ -1263,6 +1293,9 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
        DEBUGP("entered %s\n", __FUNCTION__);
+        if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
+                return -EINVAL;
        if (nlh->nlmsg_flags & NLM_F_DUMP) {
                struct nfgenmsg *msg = NLMSG_DATA(nlh);
                u32 rlen;
@@ -1333,6 +1366,9 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
        struct ip_conntrack_helper *h;
        int err;
+        if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
+                return -EINVAL;
        if (cda[CTA_EXPECT_TUPLE-1]) {
                /* delete a single expect by tuple */
                err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
@@ -1462,6 +1498,9 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
        DEBUGP("entered %s\n", __FUNCTION__);   
+        if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
+                return -EINVAL;
        if (!cda[CTA_EXPECT_TUPLE-1]
            || !cda[CTA_EXPECT_MASK-1]
            || !cda[CTA_EXPECT_MASTER-1])
@@ -1504,29 +1543,22 @@ static struct notifier_block ctnl_notifier_exp = {
 static struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
        [IPCTNL_MSG_CT_NEW]             = { .call = ctnetlink_new_conntrack,
-                                            .attr_count = CTA_MAX,
+                                            .attr_count = CTA_MAX, },
-                                            .cap_required = CAP_NET_ADMIN },
        [IPCTNL_MSG_CT_GET]             = { .call = ctnetlink_get_conntrack,
-                                            .attr_count = CTA_MAX,
+                                            .attr_count = CTA_MAX, },
-                                            .cap_required = CAP_NET_ADMIN },
        [IPCTNL_MSG_CT_DELETE]          = { .call = ctnetlink_del_conntrack,
-                                            .attr_count = CTA_MAX,
+                                            .attr_count = CTA_MAX, },
-                                            .cap_required = CAP_NET_ADMIN },
        [IPCTNL_MSG_CT_GET_CTRZERO]     = { .call = ctnetlink_get_conntrack,
-                                            .attr_count = CTA_MAX,
+                                            .attr_count = CTA_MAX, },
-                                            .cap_required = CAP_NET_ADMIN },
 };
 static struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
        [IPCTNL_MSG_EXP_GET]            = { .call = ctnetlink_get_expect,
-                                            .attr_count = CTA_EXPECT_MAX,
+                                            .attr_count = CTA_EXPECT_MAX, },
-                                            .cap_required = CAP_NET_ADMIN },
        [IPCTNL_MSG_EXP_NEW]            = { .call = ctnetlink_new_expect,
-                                            .attr_count = CTA_EXPECT_MAX,
+                                            .attr_count = CTA_EXPECT_MAX, },
-                                            .cap_required = CAP_NET_ADMIN },
        [IPCTNL_MSG_EXP_DELETE]         = { .call = ctnetlink_del_expect,
-                                            .attr_count = CTA_EXPECT_MAX,
+                                            .attr_count = CTA_EXPECT_MAX, },
-                                            .cap_required = CAP_NET_ADMIN },
 };
 static struct nfnetlink_subsystem ctnl_subsys = {
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 468c6003b4c7..ee3b7d6c4d2e 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -357,6 +357,10 @@ nfattr_failure:
        return -1;
 }
+static const size_t cta_min_tcp[CTA_PROTOINFO_TCP_MAX] = {
+        [CTA_PROTOINFO_TCP_STATE-1]     = sizeof(u_int8_t),
+};
 static int nfattr_to_tcp(struct nfattr *cda[], struct ip_conntrack *ct)
 {
        struct nfattr *attr = cda[CTA_PROTOINFO_TCP-1];
@@ -369,6 +373,9 @@ static int nfattr_to_tcp(struct nfattr *cda[], struct ip_conntrack *ct)
        nfattr_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, attr);
+        if (nfattr_bad_size(tb, CTA_PROTOINFO_TCP_MAX, cta_min_tcp))
+                return -EINVAL;
        if (!tb[CTA_PROTOINFO_TCP_STATE-1])
                return -EINVAL;
@@ -814,6 +821,7 @@ static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
 {
        [TH_SYN]                        = 1,
        [TH_SYN|TH_ACK]                 = 1,
+        [TH_SYN|TH_PUSH]                = 1,
        [TH_SYN|TH_ACK|TH_PUSH]         = 1,
        [TH_RST]                        = 1,
        [TH_RST|TH_ACK]                 = 1,
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 971ba60bf6e9..060d61202412 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -5,10 +5,20 @@
 menu "IPv6: Netfilter Configuration (EXPERIMENTAL)"
        depends on INET && IPV6 && NETFILTER && EXPERIMENTAL
-#tristate 'Connection tracking (required for masq/NAT)' CONFIG_IP6_NF_CONNTRACK
+config NF_CONNTRACK_IPV6
-#if [ "$CONFIG_IP6_NF_CONNTRACK" != "n" ]; then
+        tristate "IPv6 support for new connection tracking (EXPERIMENTAL)"
-#  dep_tristate '  FTP protocol support' CONFIG_IP6_NF_FTP $CONFIG_IP6_NF_CONNTRACK
+        depends on EXPERIMENTAL && NF_CONNTRACK
-#fi
+        ---help---
+          Connection tracking keeps a record of what packets have passed
+          through your machine, in order to figure out how they are related
+          into connections.
+          This is IPv6 support on Layer 3 independent connection tracking.
+          Layer 3 independent connection tracking is experimental scheme
+          which generalize ip_conntrack to support other layer 3 protocols.
+          To compile it as a module, choose M here.  If unsure, say N.
 config IP6_NF_QUEUE
        tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
        ---help---
@@ -114,7 +124,6 @@ config IP6_NF_MATCH_OWNER
          To compile it as a module, choose M here.  If unsure, say N.
-#  dep_tristate '  MAC address match support' CONFIG_IP6_NF_MATCH_MAC $CONFIG_IP6_NF_IPTABLES
 config IP6_NF_MATCH_MARK
        tristate "netfilter MARK match support"
        depends on IP6_NF_IPTABLES
@@ -170,15 +179,6 @@ config IP6_NF_MATCH_PHYSDEV
          To compile it as a module, choose M here.  If unsure, say N.
-#  dep_tristate '  Multiple port match support' CONFIG_IP6_NF_MATCH_MULTIPORT $CONFIG_IP6_NF_IPTABLES
-#  dep_tristate '  TOS match support' CONFIG_IP6_NF_MATCH_TOS $CONFIG_IP6_NF_IPTABLES
-#  if [ "$CONFIG_IP6_NF_CONNTRACK" != "n" ]; then
-#    dep_tristate '  Connection state match support' CONFIG_IP6_NF_MATCH_STATE $CONFIG_IP6_NF_CONNTRACK $CONFIG_IP6_NF_IPTABLES 
-#  fi
-#  if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
-#    dep_tristate '  Unclean match support (EXPERIMENTAL)' CONFIG_IP6_NF_MATCH_UNCLEAN $CONFIG_IP6_NF_IPTABLES
-#    dep_tristate '  Owner match support (EXPERIMENTAL)' CONFIG_IP6_NF_MATCH_OWNER $CONFIG_IP6_NF_IPTABLES
-#  fi
 # The targets
 config IP6_NF_FILTER
        tristate "Packet filtering"
@@ -220,12 +220,6 @@ config IP6_NF_TARGET_NFQUEUE
          To compile it as a module, choose M here.  If unsure, say N.
-#  if [ "$CONFIG_IP6_NF_FILTER" != "n" ]; then
-#    dep_tristate '    REJECT target support' CONFIG_IP6_NF_TARGET_REJECT $CONFIG_IP6_NF_FILTER
-#    if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
-#      dep_tristate '    MIRROR target support (EXPERIMENTAL)' CONFIG_IP6_NF_TARGET_MIRROR $CONFIG_IP6_NF_FILTER
-#    fi
-#  fi
 config IP6_NF_MANGLE
        tristate "Packet mangling"
        depends on IP6_NF_IPTABLES
@@ -236,7 +230,6 @@ config IP6_NF_MANGLE
          To compile it as a module, choose M here.  If unsure, say N.
-#    dep_tristate '    TOS target support' CONFIG_IP6_NF_TARGET_TOS $CONFIG_IP_NF_MANGLE
 config IP6_NF_TARGET_MARK
        tristate "MARK target support"
        depends on IP6_NF_MANGLE
@@ -266,7 +259,6 @@ config IP6_NF_TARGET_HL
          To compile it as a module, choose M here.  If unsure, say N.
-#dep_tristate '  LOG target support' CONFIG_IP6_NF_TARGET_LOG $CONFIG_IP6_NF_IPTABLES
 config IP6_NF_RAW
        tristate  'raw table support (required for TRACE)'
        depends on IP6_NF_IPTABLES
@@ -278,19 +270,5 @@ config IP6_NF_RAW
          If you want to compile it as a module, say M here and read
          <file:Documentation/modules.txt>.  If unsure, say `N'.
-config NF_CONNTRACK_IPV6
-        tristate "IPv6 support for new connection tracking (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
-        ---help---
-          Connection tracking keeps a record of what packets have passed
-          through your machine, in order to figure out how they are related
-          into connections.
-          This is IPv6 support on Layer 3 independent connection tracking.
-          Layer 3 independent connection tracking is experimental scheme
-          which generalize ip_conntrack to support other layer 3 protocols.
-          To compile it as a module, choose M here.  If unsure, say N.
 endmenu
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index e2c90b3a8074..753a3ae8502b 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -339,8 +339,8 @@ extern unsigned long nf_ct_icmpv6_timeout;
 /* From nf_conntrack_frag6.c */
 extern unsigned long nf_ct_frag6_timeout;
-extern unsigned long nf_ct_frag6_low_thresh;
+extern unsigned int nf_ct_frag6_low_thresh;
-extern unsigned long nf_ct_frag6_high_thresh;
+extern unsigned int nf_ct_frag6_high_thresh;
 static struct ctl_table_header *nf_ct_ipv6_sysctl_header;
@@ -367,7 +367,7 @@ static ctl_table nf_ct_sysctl_table[] = {
                .data           = &nf_ct_frag6_low_thresh,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = &proc_dointvec,
        },
        {
                .ctl_name       = NET_NF_CONNTRACK_FRAG6_HIGH_THRESH,
@@ -375,7 +375,7 @@ static ctl_table nf_ct_sysctl_table[] = {
                .data           = &nf_ct_frag6_high_thresh,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = &proc_dointvec,
        },
        { .ctl_name = 0 }
 };
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 7640b9bb7694..c2c52af9e560 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -55,9 +55,9 @@
 #define NF_CT_FRAG6_LOW_THRESH 196608  /* == 192*1024 */
 #define NF_CT_FRAG6_TIMEOUT IPV6_FRAG_TIMEOUT
-int nf_ct_frag6_high_thresh = 256*1024;
+unsigned int nf_ct_frag6_high_thresh = 256*1024;
-int nf_ct_frag6_low_thresh = 192*1024;
+unsigned int nf_ct_frag6_low_thresh = 192*1024;
-int nf_ct_frag6_timeout = IPV6_FRAG_TIMEOUT;
+unsigned long nf_ct_frag6_timeout = IPV6_FRAG_TIMEOUT;
 struct nf_ct_frag6_skb_cb
 {
@@ -190,8 +190,10 @@ static void nf_ct_frag6_secret_rebuild(unsigned long dummy)
 atomic_t nf_ct_frag6_mem = ATOMIC_INIT(0);
 /* Memory Tracking Functions. */
-static inline void frag_kfree_skb(struct sk_buff *skb)
+static inline void frag_kfree_skb(struct sk_buff *skb, unsigned int *work)
 {
+        if (work)
+                *work -= skb->truesize;
        atomic_sub(skb->truesize, &nf_ct_frag6_mem);
        if (NFCT_FRAG6_CB(skb)->orig)
                kfree_skb(NFCT_FRAG6_CB(skb)->orig);
@@ -199,8 +201,11 @@ static inline void frag_kfree_skb(struct sk_buff *skb)
        kfree_skb(skb);
 }
-static inline void frag_free_queue(struct nf_ct_frag6_queue *fq)
+static inline void frag_free_queue(struct nf_ct_frag6_queue *fq,
+                                   unsigned int *work)
 {
+        if (work)
+                *work -= sizeof(struct nf_ct_frag6_queue);
        atomic_sub(sizeof(struct nf_ct_frag6_queue), &nf_ct_frag6_mem);
        kfree(fq);
 }
@@ -218,7 +223,8 @@ static inline struct nf_ct_frag6_queue *frag_alloc_queue(void)
 /* Destruction primitives. */
 /* Complete destruction of fq. */
-static void nf_ct_frag6_destroy(struct nf_ct_frag6_queue *fq)
+static void nf_ct_frag6_destroy(struct nf_ct_frag6_queue *fq,
+                                unsigned int *work)
 {
        struct sk_buff *fp;
@@ -230,17 +236,17 @@ static void nf_ct_frag6_destroy(struct nf_ct_frag6_queue *fq)
        while (fp) {
                struct sk_buff *xp = fp->next;
-                frag_kfree_skb(fp);
+                frag_kfree_skb(fp, work);
                fp = xp;
        }
-        frag_free_queue(fq);
+        frag_free_queue(fq, work);
 }
-static __inline__ void fq_put(struct nf_ct_frag6_queue *fq)
+static __inline__ void fq_put(struct nf_ct_frag6_queue *fq, unsigned int *work)
 {
        if (atomic_dec_and_test(&fq->refcnt))
-                nf_ct_frag6_destroy(fq);
+                nf_ct_frag6_destroy(fq, work);
 }
 /* Kill fq entry. It is not destroyed immediately,
@@ -262,16 +268,21 @@ static void nf_ct_frag6_evictor(void)
 {
        struct nf_ct_frag6_queue *fq;
        struct list_head *tmp;
+        unsigned int work;
-        for (;;) {
+        work = atomic_read(&nf_ct_frag6_mem);
-                if (atomic_read(&nf_ct_frag6_mem) <= nf_ct_frag6_low_thresh)
+        if (work <= nf_ct_frag6_low_thresh)
-                        return;
+                return;
+        work -= nf_ct_frag6_low_thresh;
+        while (work > 0) {
                read_lock(&nf_ct_frag6_lock);
                if (list_empty(&nf_ct_frag6_lru_list)) {
                        read_unlock(&nf_ct_frag6_lock);
                        return;
                }
                tmp = nf_ct_frag6_lru_list.next;
+                BUG_ON(tmp == NULL);
                fq = list_entry(tmp, struct nf_ct_frag6_queue, lru_list);
                atomic_inc(&fq->refcnt);
                read_unlock(&nf_ct_frag6_lock);
@@ -281,7 +292,7 @@ static void nf_ct_frag6_evictor(void)
                        fq_kill(fq);
                spin_unlock(&fq->lock);
-                fq_put(fq);
+                fq_put(fq, &work);
        }
 }
@@ -298,7 +309,7 @@ static void nf_ct_frag6_expire(unsigned long data)
 out:
        spin_unlock(&fq->lock);
-        fq_put(fq);
+        fq_put(fq, NULL);
 }
 /* Creation primitives. */
@@ -318,7 +329,7 @@ static struct nf_ct_frag6_queue *nf_ct_frag6_intern(unsigned int hash,
                        atomic_inc(&fq->refcnt);
                        write_unlock(&nf_ct_frag6_lock);
                        fq_in->last_in |= COMPLETE;
-                        fq_put(fq_in);
+                        fq_put(fq_in, NULL);
                        return fq;
                }
        }
@@ -535,7 +546,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                                fq->fragments = next;
                        fq->meat -= free_it->len;
-                        frag_kfree_skb(free_it);
+                        frag_kfree_skb(free_it, NULL);
                }
        }
@@ -811,7 +822,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
        if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
                spin_unlock(&fq->lock);
                DEBUGP("Can't insert skb to queue\n");
-                fq_put(fq);
+                fq_put(fq, NULL);
                goto ret_orig;
        }
@@ -822,7 +833,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
        }
        spin_unlock(&fq->lock);
-        fq_put(fq);
+        fq_put(fq, NULL);
        return ret_skb;
 ret_orig:
@@ -881,5 +892,6 @@ int nf_ct_frag6_init(void)
 void nf_ct_frag6_cleanup(void)
 {
        del_timer(&nf_ct_frag6_secret_timer);
+        nf_ct_frag6_low_thresh = 0;
        nf_ct_frag6_evictor();
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f7f42c3e96cb..9a71a8d1078a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1701,10 +1701,8 @@ static void fib6_dump_end(struct netlink_callback *cb)
                fib6_walker_unlink(w);
                kfree(w);
        }
-        if (cb->args[1]) {
+        cb->done = (void*)cb->args[1];
-                cb->done = (void*)cb->args[1];
+        cb->args[1] = 0;
-                cb->args[1] = 0;
-        }
 }
 static int fib6_dump_done(struct netlink_callback *cb)
@@ -1734,7 +1732,7 @@ int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                /*
                 * 2. allocate and initialize walker.
                 */
-                w = kmalloc(sizeof(*w), GFP_ATOMIC);
+                w = kmalloc(sizeof(*w), GFP_KERNEL);
                if (w == NULL)
                        return -ENOMEM;
                RT6_TRACE("dump<%p", w);
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 83d90dd624f0..5a6fcf349bdf 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -779,6 +779,7 @@ static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
 {
        [TH_SYN]                        = 1,
        [TH_SYN|TH_ACK]                 = 1,
+        [TH_SYN|TH_PUSH]                = 1,
        [TH_SYN|TH_ACK|TH_PUSH]         = 1,
        [TH_RST]                        = 1,
        [TH_RST|TH_ACK]                 = 1,
@@ -969,6 +970,12 @@ static int tcp_packet(struct nf_conn *conntrack,
                                conntrack->timeout.function((unsigned long)
                                                            conntrack);
                        return -NF_REPEAT;
+                } else {
+                        write_unlock_bh(&tcp_lock);
+                        if (LOG_INVALID(IPPROTO_TCP))
+                                nf_log_packet(pf, 0, skb, NULL, NULL,
+                                              NULL, "nf_ct_tcp: invalid SYN");
+                        return -NF_ACCEPT;
                }
        case TCP_CONNTRACK_CLOSE:
                if (index == TCP_RST_SET
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 83f4c53030fc..a60c59b97631 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -223,6 +223,12 @@ static inline int nfnetlink_rcv_msg(struct sk_buff *skb,
                 NFNL_SUBSYS_ID(nlh->nlmsg_type),
                 NFNL_MSG_TYPE(nlh->nlmsg_type));
+        if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN)) {
+                DEBUGP("missing CAP_NET_ADMIN\n");
+                *errp = -EPERM;
+                return -1;
+        }
        /* Only requests are handled by kernel now. */
        if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) {
                DEBUGP("received non-request message\n");
@@ -240,15 +246,12 @@ static inline int nfnetlink_rcv_msg(struct sk_buff *skb,
        ss = nfnetlink_get_subsys(type);
        if (!ss) {
 #ifdef CONFIG_KMOD
-                if (cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN)) {
+                /* don't call nfnl_shunlock, since it would reenter
-                        /* don't call nfnl_shunlock, since it would reenter
+                 * with further packet processing */
-                         * with further packet processing */
+                up(&nfnl_sem);
-                        up(&nfnl_sem);
+                request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type));
-                        request_module("nfnetlink-subsys-%d",
+                nfnl_shlock();
-                                        NFNL_SUBSYS_ID(type));
+                ss = nfnetlink_get_subsys(type);
-                        nfnl_shlock();
-                        ss = nfnetlink_get_subsys(type);
-                }
                if (!ss)
 #endif
                        goto err_inval;
@@ -260,13 +263,6 @@ static inline int nfnetlink_rcv_msg(struct sk_buff *skb,
                goto err_inval;
        }
-        if (nc->cap_required && 
-            !cap_raised(NETLINK_CB(skb).eff_cap, nc->cap_required)) {
-                DEBUGP("permission denied for type %d\n", type);
-                *errp = -EPERM;
-                return -1;
-        }
        {
                u_int16_t attr_count = 
                        ss->cb[NFNL_MSG_TYPE(nlh->nlmsg_type)].attr_count;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index d194676f3655..cba63729313d 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -862,11 +862,9 @@ out_put:
 static struct nfnl_callback nfulnl_cb[NFULNL_MSG_MAX] = {
        [NFULNL_MSG_PACKET]     = { .call = nfulnl_recv_unsupp,
-                                    .attr_count = NFULA_MAX,
+                                    .attr_count = NFULA_MAX, },
-                                    .cap_required = CAP_NET_ADMIN, },
        [NFULNL_MSG_CONFIG]     = { .call = nfulnl_recv_config,
-                                    .attr_count = NFULA_CFG_MAX,
+                                    .attr_count = NFULA_CFG_MAX, },
-                                    .cap_required = CAP_NET_ADMIN },
 };
 static struct nfnetlink_subsystem nfulnl_subsys = {
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index f065a6c94953..f28460b61e47 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -931,14 +931,11 @@ out_put:
 static struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX] = {
        [NFQNL_MSG_PACKET]      = { .call = nfqnl_recv_unsupp,
-                                    .attr_count = NFQA_MAX,
+                                    .attr_count = NFQA_MAX, },
-                                    .cap_required = CAP_NET_ADMIN },
        [NFQNL_MSG_VERDICT]     = { .call = nfqnl_recv_verdict,
-                                    .attr_count = NFQA_MAX,
+                                    .attr_count = NFQA_MAX, },
-                                    .cap_required = CAP_NET_ADMIN },
        [NFQNL_MSG_CONFIG]      = { .call = nfqnl_recv_config,
-                                    .attr_count = NFQA_CFG_MAX,
+                                    .attr_count = NFQA_CFG_MAX, },
-                                    .cap_required = CAP_NET_ADMIN },
 };
 static struct nfnetlink_subsystem nfqnl_subsys = {