4 files changed, 26 insertions, 4 deletions

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index fa5cda4e552a..45f61c348e36 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -101,6 +101,18 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
          pppoe_proto(skb) == htons(PPP_IPV6) && \
          brnf_filter_pppoe_tagged)
 
+static void fake_update_pmtu(struct dst_entry *dst, u32 mtu)
+{
+}
+
+static struct dst_ops fake_dst_ops = {
+        .family =               AF_INET,
+        .protocol =             __constant_htons(ETH_P_IP),
+        .update_pmtu =          fake_update_pmtu,
+        .entry_size =           sizeof(struct rtable),
+        .entries =              ATOMIC_INIT(0),
+};
+
 /*
  * Initialize bogus route table used to keep netfilter happy.
  * Currently, we fill in the PMTU entry because netfilter
@@ -117,6 +129,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         rt->u.dst.path = &rt->u.dst;
         rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
         rt->u.dst.flags = DST_NOXFRM;
+        rt->u.dst.ops = &fake_dst_ops;
 }
 
 static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 622d7c671cb7..233fdd2d7d21 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -305,9 +305,7 @@ void nf_conntrack_hash_insert(struct nf_conn *ct)
         hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
         repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
-        spin_lock_bh(&nf_conntrack_lock);
         __nf_conntrack_hash_insert(ct, hash, repl_hash);
-        spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index a040d46f85d6..3b009a3e8549 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1090,7 +1090,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
         struct nf_conn_help *help;
         struct nf_conntrack_helper *helper;
 
-        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_KERNEL);
+        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
         if (ct == NULL || IS_ERR(ct))
                 return -ENOMEM;
 
@@ -1212,13 +1212,14 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         atomic_inc(&master_ct->ct_general.use);
                 }
 
-                spin_unlock_bh(&nf_conntrack_lock);
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_conntrack(cda,
                                                          &otuple,
                                                          &rtuple,
                                                          master_ct);
+                spin_unlock_bh(&nf_conntrack_lock);
+
                 if (err < 0 && master_ct)
                         nf_ct_put(master_ct);
 
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index a7f1ce11bc22..0c1cc7612800 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1072,6 +1072,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
         unsigned char *asmptr;
         int n, size, qbit = 0;
 
+        /* ROSE empty frame has no meaning : don't send */
+        if (len == 0)
+                return 0;
+
         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
                 return -EINVAL;
 
@@ -1265,6 +1269,12 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb_reset_transport_header(skb);
         copied     = skb->len;
 
+        /* ROSE empty frame has no meaning : ignore it */
+        if (copied == 0) {
+                skb_free_datagram(sk, skb);
+                return copied;
+        }
+
         if (copied > size) {
                 copied = size;
                 msg->msg_flags |= MSG_TRUNC;