7 files changed, 20 insertions, 11 deletions

diff --git a/net/can/af_can.c b/net/can/af_can.c
index 547bafc79e28..10f0528c3bf5 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -674,8 +674,8 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
 
         rcu_read_unlock();
 
-        /* free the skbuff allocated by the netdevice driver */
-        kfree_skb(skb);
+        /* consume the skbuff allocated by the netdevice driver */
+        consume_skb(skb);
 
         if (matches > 0) {
                 can_stats.matches++;
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index fe65187810f0..3229e0a81ba6 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -211,7 +211,8 @@ find_best_ips_proto(struct nf_conntrack_tuple *tuple,
         minip = ntohl(range->min_ip);
         maxip = ntohl(range->max_ip);
         j = jhash_2words((__force u32)tuple->src.u3.ip,
-                         (__force u32)tuple->dst.u3.ip, 0);
+                         range->flags & IP_NAT_RANGE_PERSISTENT ?
+                                (__force u32)tuple->dst.u3.ip : 0, 0);
         j = ((u64)j * (maxip - minip + 1)) >> 32;
         *var_ipp = htonl(minip + j);
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index fafbec8b073e..1d7f49c6f0ca 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2511,6 +2511,7 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         struct sk_buff *p;
         struct tcphdr *th;
         struct tcphdr *th2;
+        unsigned int len;
         unsigned int thlen;
         unsigned int flags;
         unsigned int mss = 1;
@@ -2531,6 +2532,7 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
         skb_gro_pull(skb, thlen);
 
+        len = skb_gro_len(skb);
         flags = tcp_flag_word(th);
 
         for (; (p = *head); head = &p->next) {
@@ -2561,7 +2563,7 @@ found:
 
         mss = skb_shinfo(p)->gso_size;
 
-        flush |= (skb_gro_len(skb) > mss) | !skb_gro_len(skb);
+        flush |= (len > mss) | !len;
         flush |= (ntohl(th2->seq) + skb_gro_len(p)) ^ ntohl(th->seq);
 
         if (flush || skb_gro_receive(head, skb)) {
@@ -2574,7 +2576,7 @@ found:
         tcp_flag_word(th2) |= flags & (TCP_FLAG_FIN | TCP_FLAG_PSH);
 
 out_check_final:
-        flush = skb_gro_len(skb) < mss;
+        flush = len < mss;
         flush |= flags & (TCP_FLAG_URG | TCP_FLAG_PSH | TCP_FLAG_RST |
                           TCP_FLAG_SYN | TCP_FLAG_FIN);
 
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 30b8e9009f99..0fa5a422959f 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -176,7 +176,7 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
         }
 
         /* Get rid of expecteds, set helpers to NULL. */
-        hlist_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
+        hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
                 unhelp(h, me);
         for (i = 0; i < nf_conntrack_htable_size; i++) {
                 hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index c6439c77953c..0ea36e0c8a0e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -512,7 +512,7 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
 
         skb = ctnetlink_alloc_skb(tuple(ct, IP_CT_DIR_ORIGINAL), GFP_ATOMIC);
         if (!skb)
-                return NOTIFY_DONE;
+                goto errout;
 
         b = skb->tail;
 
@@ -591,8 +591,9 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
 nla_put_failure:
         rcu_read_unlock();
 nlmsg_failure:
-        nfnetlink_set_err(0, group, -ENOBUFS);
         kfree_skb(skb);
+errout:
+        nfnetlink_set_err(0, group, -ENOBUFS);
         return NOTIFY_DONE;
 }
 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
@@ -1564,7 +1565,7 @@ static int ctnetlink_expect_event(struct notifier_block *this,
 
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
         if (!skb)
-                return NOTIFY_DONE;
+                goto errout;
 
         b = skb->tail;
 
@@ -1589,8 +1590,9 @@ static int ctnetlink_expect_event(struct notifier_block *this,
 nla_put_failure:
         rcu_read_unlock();
 nlmsg_failure:
-        nfnetlink_set_err(0, 0, -ENOBUFS);
         kfree_skb(skb);
+errout:
+        nfnetlink_set_err(0, 0, -ENOBUFS);
         return NOTIFY_DONE;
 }
 #endif
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 8bb998fe098b..beb37311e1a5 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -36,10 +36,14 @@ static struct nf_logger *__find_logger(int pf, const char *str_logger)
 int nf_log_register(u_int8_t pf, struct nf_logger *logger)
 {
         const struct nf_logger *llog;
+        int i;
 
         if (pf >= ARRAY_SIZE(nf_loggers))
                 return -EINVAL;
 
+        for (i = 0; i < ARRAY_SIZE(logger->list); i++)
+                INIT_LIST_HEAD(&logger->list[i]);
+
         mutex_lock(&nf_log_mutex);
 
         if (pf == NFPROTO_UNSPEC) {
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 2785d66a7e38..b8ab37ad7ed5 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -203,7 +203,7 @@ static int __init nfnetlink_init(void)
                                      nfnetlink_rcv, NULL, THIS_MODULE);
         if (!nfnl) {
                 printk(KERN_ERR "cannot initialize nfnetlink!\n");
-                return -1;
+                return -ENOMEM;
         }
 
         return 0;