[PATCH] irda: Free skb on irda_accept error path.

skb is not freed if newsk is NULL. Rework the error path so free_skb is unconditionally called on function exit. Fixes: c3ea9fa27413 ("[IrDA] af_irda: IRDA_ASSERT cleanups") Signed-off-by: Phil Turnbull <phil.turnb...@oracle.com> --- net/irda/af_irda.c | 5 ++--- 1 file chang

[PATCH net] sit: Correctly return -ENOMEM from SIOCGETPRL ioctl.

-ENOMEM is never returned because the 'out' path unconditionally sets 'ret' to zero. Remove the 'out' path and return directly when the allocation fails. Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.") Signed-off-by: Phil Turnbull <phil.turnb...@oracle.com&g

[PATCH net] l2tp: Correctly return -EBADF from pppol2tp_getname.

If 'tunnel' is NULL we should return -EBADF but the 'end_put_sess' path unconditionally sets 'error' back to zero. Rework the error path so it more closely matches pppol2tp_sendmsg. Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Signed-off-by: Phi

[PATCH nf] netfilter: nfnetlink: correctly validate length of batch messages

From: Phil Turnbull <phil.turnb...@oracle.com> If nlh->nlmsg_len is zero then an infinite loop is triggered because 'skb_pull(skb, msglen);' pulls zero bytes. The calculation in nlmsg_len() underflows if 'nlh->nlmsg_len < NLMSG_HDRLEN' which bypasses the length validation and wil