4 files changed, 18 insertions, 14 deletions

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index b853f06cc148..16c33e308121 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -257,7 +257,6 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
 
                 if (rt) {
                         dev = rt->dst.dev;
-                        dev_hold(dev);
                         dst_release(&rt->dst);
                 }
         } else
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8c2e3ab58f2a..22b766407de1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1077,7 +1077,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         struct net *net = dev_net(dev);
 
         if (unlikely(!idev))
-                return NULL;
+                return ERR_PTR(-ENODEV);
 
         rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, dev, 0);
         if (unlikely(!rt)) {
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 10687692831e..b49da6c925b3 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -943,20 +943,21 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 }
         }
 
-        if (nf_conntrack_event_report(IPCT_DESTROY, ct,
-                                      NETLINK_CB(skb).pid,
-                                      nlmsg_report(nlh)) < 0) {
+        if (del_timer(&ct->timeout)) {
+                if (nf_conntrack_event_report(IPCT_DESTROY, ct,
+                                              NETLINK_CB(skb).pid,
+                                              nlmsg_report(nlh)) < 0) {
+                        nf_ct_delete_from_lists(ct);
+                        /* we failed to report the event, try later */
+                        nf_ct_insert_dying_list(ct);
+                        nf_ct_put(ct);
+                        return 0;
+                }
+                /* death_by_timeout would report the event again */
+                set_bit(IPS_DYING_BIT, &ct->status);
                 nf_ct_delete_from_lists(ct);
-                /* we failed to report the event, try later */
-                nf_ct_insert_dying_list(ct);
                 nf_ct_put(ct);
-                return 0;
         }
-
-        /* death_by_timeout would report the event again */
-        set_bit(IPS_DYING_BIT, &ct->status);
-
-        nf_ct_kill(ct);
         nf_ct_put(ct);
 
         return 0;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 60d47180f043..02a21abea65e 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -469,11 +469,15 @@ enqueue:
         if (slot->qlen == 1) {          /* The flow is new */
                 if (q->tail == NULL) {  /* It is the first flow */
                         slot->next = x;
-                        q->tail = slot;
                 } else {
                         slot->next = q->tail->next;
                         q->tail->next = x;
                 }
+                /* We put this flow at the end of our flow list.
+                 * This might sound unfair for a new flow to wait after old ones,
+                 * but we could endup servicing new flows only, and freeze old ones.
+                 */
+                q->tail = slot;
                 /* We could use a bigger initial quantum for new flows */
                 slot->allot = q->scaled_quantum;
         }