From 320d7ce4e6e589fe4e38e561720dc914cb45addd Mon Sep 17 00:00:00 2001
From: "David S. Miller" <davem@davemloft.net>
Date: Wed, 9 Jul 2008 15:10:09 -0700
Subject: [PATCH] --- yaml --- r: 98835 b: refs/heads/master c:
 2ddddb98694af847f70463dbdc69aa491d9f477a h: refs/heads/master i:   98833:
 ed2de9c6a57d61ce163a272a052accbffb2db1c8   98831:
 742c0f519f9c596f29af90058d1f4bc3d0e8f20e v: v3

---
 [refs]                                       |  2 +-
 trunk/net/ipv4/netfilter/nf_nat_snmp_basic.c |  2 +-
 trunk/net/netfilter/nf_conntrack_proto_tcp.c | 10 ++++++++--
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/[refs] b/[refs]
index 9cace63ac42e..4c90c6f65ed0 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 814feefa859a736d29d0700d49debf13904b429f
+refs/heads/master: 2ddddb98694af847f70463dbdc69aa491d9f477a
diff --git a/trunk/net/ipv4/netfilter/nf_nat_snmp_basic.c b/trunk/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 7750c97fde7b..ffeaffc3fffe 100644
--- a/trunk/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/trunk/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -439,8 +439,8 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
 				     unsigned int *len)
 {
 	unsigned long subid;
-	unsigned int  size;
 	unsigned long *optr;
+	size_t size;
 
 	size = eoc - ctx->pointer + 1;
 
diff --git a/trunk/net/netfilter/nf_conntrack_proto_tcp.c b/trunk/net/netfilter/nf_conntrack_proto_tcp.c
index 271cd01d57ae..dd28fb239a60 100644
--- a/trunk/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/trunk/net/netfilter/nf_conntrack_proto_tcp.c
@@ -844,9 +844,15 @@ static int tcp_packet(struct nf_conn *ct,
 			/* Attempt to reopen a closed/aborted connection.
 			 * Delete this connection and look up again. */
 			write_unlock_bh(&tcp_lock);
-			if (del_timer(&ct->timeout))
+			/* Only repeat if we can actually remove the timer.
+			 * Destruction may already be in progress in process
+			 * context and we must give it a chance to terminate.
+			 */
+			if (del_timer(&ct->timeout)) {
 				ct->timeout.function((unsigned long)ct);
-			return -NF_REPEAT;
+				return -NF_REPEAT;
+			}
+			return -NF_DROP;
 		}
 		/* Fall through */
 	case TCP_CONNTRACK_IGNORE: