Alexey Dobriyan wrote:

It does "kfree(list_head)" which looks wrong because entity that was
allocated is definitely not list_head.

However, this all works because list_head is first item in
struct nf_ct_gre_keymap .

The first three patches are already in Linus' tree.