ctnetlink_get_conntrack is always called from user context, so GFP_KERNEL is enough. Signed-off-by: Pablo Neira Ayuso Index: net-2.6.git/net/ipv4/netfilter/ip_conntrack_netlink.c =================================================================== --- net-2.6.git.orig/net/ipv4/netfilter/ip_conntrack_netlink.c 2005-11-04 18:16:26.000000000 +0100 +++ net-2.6.git/net/ipv4/netfilter/ip_conntrack_netlink.c 2005-11-04 18:17:39.000000000 +0100 @@ -779,7 +779,7 @@ ctnetlink_get_conntrack(struct sock *ctn ct = tuplehash_to_ctrack(h); err = -ENOMEM; - skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); + skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); if (!skb2) { ip_conntrack_put(ct); return -ENOMEM;