14 files changed, 236 insertions, 113 deletions

diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index e9db889d6222..2886d2fb9ab5 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -1,12 +1,16 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/if_vlan.h>
+#include <linux/netpoll.h>
 #include "vlan.h"
 
 /* VLAN rx hw acceleration helper.  This acts like netif_{rx,receive_skb}(). */
 int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                       u16 vlan_tci, int polling)
 {
+        if (netpoll_rx(skb))
+                return NET_RX_DROP;
+
         if (skb_bond_should_drop(skb))
                 goto drop;
 
@@ -100,6 +104,9 @@ int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
 {
         int err = NET_RX_SUCCESS;
 
+        if (netpoll_receive_skb(skb))
+                return NET_RX_DROP;
+
         switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
         case -1:
                 return netif_receive_skb(skb);
@@ -126,6 +133,9 @@ int vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
         if (!skb)
                 goto out;
 
+        if (netpoll_receive_skb(skb))
+                goto out;
+
         err = NET_RX_SUCCESS;
 
         switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
diff --git a/net/core/dev.c b/net/core/dev.c
index a17e00662363..72b0d26fd46d 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2488,6 +2488,9 @@ static int __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 
 int napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
+        if (netpoll_receive_skb(skb))
+                return NET_RX_DROP;
+
         switch (__napi_gro_receive(napi, skb)) {
         case -1:
                 return netif_receive_skb(skb);
@@ -2558,6 +2561,9 @@ int napi_gro_frags(struct napi_struct *napi, struct napi_gro_fraginfo *info)
         if (!skb)
                 goto out;
 
+        if (netpoll_receive_skb(skb))
+                goto out;
+
         err = NET_RX_SUCCESS;
 
         switch (__napi_gro_receive(napi, skb)) {
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 55151faaf90c..2adb1a7d361f 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -32,24 +32,14 @@ static __net_init int setup_net(struct net *net)
 {
         /* Must be called with net_mutex held */
         struct pernet_operations *ops;
-        int error;
-        struct net_generic *ng;
+        int error = 0;
 
         atomic_set(&net->count, 1);
+
 #ifdef NETNS_REFCNT_DEBUG
         atomic_set(&net->use_count, 0);
 #endif
 
-        error = -ENOMEM;
-        ng = kzalloc(sizeof(struct net_generic) +
-                        INITIAL_NET_GEN_PTRS * sizeof(void *), GFP_KERNEL);
-        if (ng == NULL)
-                goto out;
-
-        ng->len = INITIAL_NET_GEN_PTRS;
-        rcu_assign_pointer(net->gen, ng);
-
-        error = 0;
         list_for_each_entry(ops, &pernet_list, list) {
                 if (ops->init) {
                         error = ops->init(net);
@@ -70,24 +60,50 @@ out_undo:
         }
 
         rcu_barrier();
-        kfree(ng);
         goto out;
 }
 
+static struct net_generic *net_alloc_generic(void)
+{
+        struct net_generic *ng;
+        size_t generic_size = sizeof(struct net_generic) +
+                INITIAL_NET_GEN_PTRS * sizeof(void *);
+
+        ng = kzalloc(generic_size, GFP_KERNEL);
+        if (ng)
+                ng->len = INITIAL_NET_GEN_PTRS;
+
+        return ng;
+}
+
 #ifdef CONFIG_NET_NS
 static struct kmem_cache *net_cachep;
 static struct workqueue_struct *netns_wq;
 
 static struct net *net_alloc(void)
 {
-        return kmem_cache_zalloc(net_cachep, GFP_KERNEL);
+        struct net *net = NULL;
+        struct net_generic *ng;
+
+        ng = net_alloc_generic();
+        if (!ng)
+                goto out;
+
+        net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
+        if (!net)
+                goto out_free;
+
+        rcu_assign_pointer(net->gen, ng);
+out:
+        return net;
+
+out_free:
+        kfree(ng);
+        goto out;
 }
 
 static void net_free(struct net *net)
 {
-        if (!net)
-                return;
-
 #ifdef NETNS_REFCNT_DEBUG
         if (unlikely(atomic_read(&net->use_count) != 0)) {
                 printk(KERN_EMERG "network namespace not free! Usage: %d\n",
@@ -112,27 +128,28 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
         err = -ENOMEM;
         new_net = net_alloc();
         if (!new_net)
-                goto out;
+                goto out_err;
 
         mutex_lock(&net_mutex);
         err = setup_net(new_net);
-        if (err)
-                goto out_unlock;
-
-        rtnl_lock();
-        list_add_tail(&new_net->list, &net_namespace_list);
-        rtnl_unlock();
-
-
-out_unlock:
+        if (!err) {
+                rtnl_lock();
+                list_add_tail(&new_net->list, &net_namespace_list);
+                rtnl_unlock();
+        }
         mutex_unlock(&net_mutex);
+
+        if (err)
+                goto out_free;
 out:
         put_net(old_net);
-        if (err) {
-                net_free(new_net);
-                new_net = ERR_PTR(err);
-        }
         return new_net;
+
+out_free:
+        net_free(new_net);
+out_err:
+        new_net = ERR_PTR(err);
+        goto out;
 }
 
 static void cleanup_net(struct work_struct *work)
@@ -188,6 +205,7 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
 
 static int __init net_ns_init(void)
 {
+        struct net_generic *ng;
         int err;
 
         printk(KERN_INFO "net_namespace: %zd bytes\n", sizeof(struct net));
@@ -202,6 +220,12 @@ static int __init net_ns_init(void)
                 panic("Could not create netns workq");
 #endif
 
+        ng = net_alloc_generic();
+        if (!ng)
+                panic("Could not allocate generic netns");
+
+        rcu_assign_pointer(init_net.gen, ng);
+
         mutex_lock(&net_mutex);
         err = setup_net(&init_net);
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index da74b844f4ea..c6a6b166f8d6 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -143,14 +143,6 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
         BUG();
 }
 
-void skb_truesize_bug(struct sk_buff *skb)
-{
-        WARN(net_ratelimit(), KERN_ERR "SKB BUG: Invalid truesize (%u) "
-               "len=%u, sizeof(sk_buff)=%Zd\n",
-               skb->truesize, skb->len, sizeof(struct sk_buff));
-}
-EXPORT_SYMBOL(skb_truesize_bug);
-
 /*      Allocate a new skbuff. We do this ourselves so we can fill in a few
  *      'private' fields and also do memory statistics to find all the
  *      [BEEP] leaks.
diff --git a/net/core/sock.c b/net/core/sock.c
index 6f2e1337975d..5f97caa158e8 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -696,7 +696,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
         if (len < 0)
                 return -EINVAL;
 
-        v.val = 0;
+        memset(&v, 0, sizeof(v));
 
         switch(optname) {
         case SO_DEBUG:
@@ -1137,7 +1137,6 @@ void sock_rfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
 
-        skb_truesize_check(skb);
         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
         sk_mem_uncharge(skb->sk, skb->truesize);
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a6961d75c7ea..c28976a7e596 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1374,7 +1374,8 @@ static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
 
 static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                            struct tcp_sacktag_state *state,
-                           unsigned int pcount, int shifted, int mss)
+                           unsigned int pcount, int shifted, int mss,
+                           int dup_sack)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
@@ -1410,7 +1411,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
         }
 
         /* We discard results */
-        tcp_sacktag_one(skb, sk, state, 0, pcount);
+        tcp_sacktag_one(skb, sk, state, dup_sack, pcount);
 
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
         TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
@@ -1561,7 +1562,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
 
         if (!skb_shift(prev, skb, len))
                 goto fallback;
-        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss))
+        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
                 goto out;
 
         /* Hole filled allows collapsing with the next as well, this is very
@@ -1580,7 +1581,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
         len = skb->len;
         if (skb_shift(prev, skb, len)) {
                 pcount += tcp_skb_pcount(skb);
-                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss);
+                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss, 0);
         }
 
 out:
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index dda42f0bd7a3..da2c3b8794f2 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2023,7 +2023,6 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
                 last_lost = tp->snd_una;
         }
 
-        /* First pass: retransmit lost packets. */
         tcp_for_write_queue_from(skb, sk) {
                 __u8 sacked = TCP_SKB_CB(skb)->sacked;
 
diff --git a/net/ipv4/tcp_scalable.c b/net/ipv4/tcp_scalable.c
index 2747ec7bfb63..4660b088a8ce 100644
--- a/net/ipv4/tcp_scalable.c
+++ b/net/ipv4/tcp_scalable.c
@@ -1,6 +1,6 @@
 /* Tom Kelly's Scalable TCP
  *
- * See htt://www-lce.eng.cam.ac.uk/~ctk21/scalable/
+ * See http://www.deneholme.net/tom/scalable/
  *
  * John Heffner <jheffner@sc.edu>
  */
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 8fe267feb81e..1bcc3431859e 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -258,11 +258,11 @@ unique:
 
         if (twp != NULL) {
                 *twp = tw;
-                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
         } else if (tw != NULL) {
                 /* Silly. Should hash-dance instead... */
                 inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
 
                 inet_twsk_put(tw);
         }
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index c323643ffcf9..72dbb6d1a6b3 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -201,8 +201,9 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
 
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
-                nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
-                              "nf_ct_icmpv6: ICMPv6 checksum failed\n");
+                if (LOG_INVALID(net, IPPROTO_ICMPV6))
+                        nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
+                                      "nf_ct_icmpv6: ICMPv6 checksum failed ");
                 return -NF_ACCEPT;
         }
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index fa49dc7fe100..c712e9fc6bba 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -39,7 +39,7 @@
 #endif
 
 #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
-#define NFULNL_TIMEOUT_DEFAULT  HZ      /* every second */
+#define NFULNL_TIMEOUT_DEFAULT  100     /* every second */
 #define NFULNL_QTHRESH_DEFAULT  100     /* 100 packets */
 #define NFULNL_COPY_RANGE_MAX   0xFFFF  /* max packet size is limited by 16-bit struct nfattr nfa_len field */
 
@@ -590,8 +590,10 @@ nfulnl_log_packet(u_int8_t pf,
 
         qthreshold = inst->qthreshold;
         /* per-rule qthreshold overrides per-instance */
-        if (qthreshold > li->u.ulog.qthreshold)
-                qthreshold = li->u.ulog.qthreshold;
+        if (li->u.ulog.qthreshold)
+                if (qthreshold > li->u.ulog.qthreshold)
+                        qthreshold = li->u.ulog.qthreshold;
+
 
         switch (inst->copy_mode) {
         case NFULNL_COPY_META:
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index bfbf521f6ea5..5baccfa5a0de 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -827,59 +827,143 @@ static const struct file_operations xt_table_ops = {
         .release = seq_release_net,
 };
 
-static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
+/*
+ * Traverse state for ip{,6}_{tables,matches} for helping crossing
+ * the multi-AF mutexes.
+ */
+struct nf_mttg_trav {
+        struct list_head *head, *curr;
+        uint8_t class, nfproto;
+};
+
+enum {
+        MTTG_TRAV_INIT,
+        MTTG_TRAV_NFP_UNSPEC,
+        MTTG_TRAV_NFP_SPEC,
+        MTTG_TRAV_DONE,
+};
+
+static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
+    bool is_target)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        static const uint8_t next_class[] = {
+                [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,
+                [MTTG_TRAV_NFP_SPEC]   = MTTG_TRAV_DONE,
+        };
+        struct nf_mttg_trav *trav = seq->private;
+
+        switch (trav->class) {
+        case MTTG_TRAV_INIT:
+                trav->class = MTTG_TRAV_NFP_UNSPEC;
+                mutex_lock(&xt[NFPROTO_UNSPEC].mutex);
+                trav->head = trav->curr = is_target ?
+                        &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;
+                break;
+        case MTTG_TRAV_NFP_UNSPEC:
+                trav->curr = trav->curr->next;
+                if (trav->curr != trav->head)
+                        break;
+                mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
+                mutex_lock(&xt[trav->nfproto].mutex);
+                trav->head = trav->curr = is_target ?
+                        &xt[trav->nfproto].target : &xt[trav->nfproto].match;
+                trav->class = next_class[trav->class];
+                break;
+        case MTTG_TRAV_NFP_SPEC:
+                trav->curr = trav->curr->next;
+                if (trav->curr != trav->head)
+                        break;
+                /* fallthru, _stop will unlock */
+        default:
+                return NULL;
+        }
 
-        mutex_lock(&xt[af].mutex);
-        return seq_list_start(&xt[af].match, *pos);
+        if (ppos != NULL)
+                ++*ppos;
+        return trav;
 }
 
-static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos,
+    bool is_target)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        struct nf_mttg_trav *trav = seq->private;
+        unsigned int j;
 
-        return seq_list_next(v, &xt[af].match, pos);
+        trav->class = MTTG_TRAV_INIT;
+        for (j = 0; j < *pos; ++j)
+                if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)
+                        return NULL;
+        return trav;
 }
 
-static void xt_match_seq_stop(struct seq_file *seq, void *v)
+static void xt_mttg_seq_stop(struct seq_file *seq, void *v)
 {
-        struct proc_dir_entry *pde = seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        struct nf_mttg_trav *trav = seq->private;
+
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+                mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
+                break;
+        case MTTG_TRAV_NFP_SPEC:
+                mutex_unlock(&xt[trav->nfproto].mutex);
+                break;
+        }
+}
 
-        mutex_unlock(&xt[af].mutex);
+static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        return xt_mttg_seq_start(seq, pos, false);
 }
 
-static int xt_match_seq_show(struct seq_file *seq, void *v)
+static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct xt_match *match = list_entry(v, struct xt_match, list);
+        return xt_mttg_seq_next(seq, v, ppos, false);
+}
 
-        if (strlen(match->name))
-                return seq_printf(seq, "%s\n", match->name);
-        else
-                return 0;
+static int xt_match_seq_show(struct seq_file *seq, void *v)
+{
+        const struct nf_mttg_trav *trav = seq->private;
+        const struct xt_match *match;
+
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+        case MTTG_TRAV_NFP_SPEC:
+                if (trav->curr == trav->head)
+                        return 0;
+                match = list_entry(trav->curr, struct xt_match, list);
+                return (*match->name == '\0') ? 0 :
+                       seq_printf(seq, "%s\n", match->name);
+        }
+        return 0;
 }
 
 static const struct seq_operations xt_match_seq_ops = {
         .start  = xt_match_seq_start,
         .next   = xt_match_seq_next,
-        .stop   = xt_match_seq_stop,
+        .stop   = xt_mttg_seq_stop,
         .show   = xt_match_seq_show,
 };
 
 static int xt_match_open(struct inode *inode, struct file *file)
 {
+        struct seq_file *seq;
+        struct nf_mttg_trav *trav;
         int ret;
 
-        ret = seq_open(file, &xt_match_seq_ops);
-        if (!ret) {
-                struct seq_file *seq = file->private_data;
+        trav = kmalloc(sizeof(*trav), GFP_KERNEL);
+        if (trav == NULL)
+                return -ENOMEM;
 
-                seq->private = PDE(inode);
+        ret = seq_open(file, &xt_match_seq_ops);
+        if (ret < 0) {
+                kfree(trav);
+                return ret;
         }
-        return ret;
+
+        seq = file->private_data;
+        seq->private = trav;
+        trav->nfproto = (unsigned long)PDE(inode)->data;
+        return 0;
 }
 
 static const struct file_operations xt_match_ops = {
@@ -887,62 +971,63 @@ static const struct file_operations xt_match_ops = {
         .open    = xt_match_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 
 static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-
-        mutex_lock(&xt[af].mutex);
-        return seq_list_start(&xt[af].target, *pos);
+        return xt_mttg_seq_start(seq, pos, true);
 }
 
-static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-
-        return seq_list_next(v, &xt[af].target, pos);
-}
-
-static void xt_target_seq_stop(struct seq_file *seq, void *v)
-{
-        struct proc_dir_entry *pde = seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-
-        mutex_unlock(&xt[af].mutex);
+        return xt_mttg_seq_next(seq, v, ppos, true);
 }
 
 static int xt_target_seq_show(struct seq_file *seq, void *v)
 {
-        struct xt_target *target = list_entry(v, struct xt_target, list);
-
-        if (strlen(target->name))
-                return seq_printf(seq, "%s\n", target->name);
-        else
-                return 0;
+        const struct nf_mttg_trav *trav = seq->private;
+        const struct xt_target *target;
+
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+        case MTTG_TRAV_NFP_SPEC:
+                if (trav->curr == trav->head)
+                        return 0;
+                target = list_entry(trav->curr, struct xt_target, list);
+                return (*target->name == '\0') ? 0 :
+                       seq_printf(seq, "%s\n", target->name);
+        }
+        return 0;
 }
 
 static const struct seq_operations xt_target_seq_ops = {
         .start  = xt_target_seq_start,
         .next   = xt_target_seq_next,
-        .stop   = xt_target_seq_stop,
+        .stop   = xt_mttg_seq_stop,
         .show   = xt_target_seq_show,
 };
 
 static int xt_target_open(struct inode *inode, struct file *file)
 {
+        struct seq_file *seq;
+        struct nf_mttg_trav *trav;
         int ret;
 
-        ret = seq_open(file, &xt_target_seq_ops);
-        if (!ret) {
-                struct seq_file *seq = file->private_data;
+        trav = kmalloc(sizeof(*trav), GFP_KERNEL);
+        if (trav == NULL)
+                return -ENOMEM;
 
-                seq->private = PDE(inode);
+        ret = seq_open(file, &xt_target_seq_ops);
+        if (ret < 0) {
+                kfree(trav);
+                return ret;
         }
-        return ret;
+
+        seq = file->private_data;
+        seq->private = trav;
+        trav->nfproto = (unsigned long)PDE(inode)->data;
+        return 0;
 }
 
 static const struct file_operations xt_target_ops = {
@@ -950,7 +1035,7 @@ static const struct file_operations xt_target_ops = {
         .open    = xt_target_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 
 #define FORMAT_TABLES   "_tables_names"
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index fe80b614a400..791e030ea903 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -542,7 +542,7 @@ recent_mt_proc_write(struct file *file, const char __user *input,
         struct recent_entry *e;
         char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")];
         const char *c = buf;
-        union nf_inet_addr addr;
+        union nf_inet_addr addr = {};
         u_int16_t family;
         bool add, succ;
 
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index f6b4fa97df70..e36e94ab4e10 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -66,11 +66,15 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 {
         struct drr_sched *q = qdisc_priv(sch);
         struct drr_class *cl = (struct drr_class *)*arg;
+        struct nlattr *opt = tca[TCA_OPTIONS];
         struct nlattr *tb[TCA_DRR_MAX + 1];
         u32 quantum;
         int err;
 
-        err = nla_parse_nested(tb, TCA_DRR_MAX, tca[TCA_OPTIONS], drr_policy);
+        if (!opt)
+                return -EINVAL;
+
+        err = nla_parse_nested(tb, TCA_DRR_MAX, opt, drr_policy);
         if (err < 0)
                 return err;