diff --git a/lib/cache_mngr.c b/lib/cache_mngr.c
index 3d51b2a75..6aca52092 100644
--- a/lib/cache_mngr.c
+++ b/lib/cache_mngr.c
@@ -311,25 +311,26 @@ int nl_cache_mngr_add_cache(struct nl_cache_mngr *mngr, struct nl_cache *cache,
 		    mngr->cm_assocs[i].ca_cache->c_ops == ops)
 			return -NLE_EXIST;
 
-retry:
 	for (i = 0; i < mngr->cm_nassocs; i++)
 		if (!mngr->cm_assocs[i].ca_cache)
 			break;
 
 	if (i >= mngr->cm_nassocs) {
-		mngr->cm_nassocs += NASSOC_EXPAND;
-		mngr->cm_assocs = realloc(mngr->cm_assocs,
-					  mngr->cm_nassocs *
-					  sizeof(struct nl_cache_assoc));
-		if (mngr->cm_assocs == NULL)
+		struct nl_cache_assoc *cm_assocs;
+		int cm_nassocs = mngr->cm_nassocs + NASSOC_EXPAND;
+
+		cm_assocs = realloc(mngr->cm_assocs,
+				    cm_nassocs * sizeof(struct nl_cache_assoc));
+		if (cm_assocs == NULL)
 			return -NLE_NOMEM;
 
-		memset(mngr->cm_assocs + (mngr->cm_nassocs - NASSOC_EXPAND), 0,
+		memset(cm_assocs + mngr->cm_nassocs, 0,
 		       NASSOC_EXPAND * sizeof(struct nl_cache_assoc));
+		mngr->cm_assocs = cm_assocs;
+		mngr->cm_nassocs = cm_nassocs;
 
 		NL_DBG(1, "Increased capacity of cache manager %p " \
 			  "to %d\n", mngr, mngr->cm_nassocs);
-		goto retry;
 	}
 
 	for (grp = ops->co_groups; grp->ag_group; grp++) {
diff --git a/lib/data.c b/lib/data.c
index 00bdb79b1..83ecd0364 100644
--- a/lib/data.c
+++ b/lib/data.c
@@ -111,15 +111,16 @@ struct nl_data *nl_data_clone(const struct nl_data *src)
 int nl_data_append(struct nl_data *data, const void *buf, size_t size)
 {
 	if (size > 0) {
-		data->d_data = realloc(data->d_data, data->d_size + size);
-		if (!data->d_data)
+		void *d_data = realloc(data->d_data, data->d_size + size);
+		if (!d_data)
 			return -NLE_NOMEM;
 
 		if (buf)
-			memcpy(data->d_data + data->d_size, buf, size);
+			memcpy(d_data + data->d_size, buf, size);
 		else
-			memset(data->d_data + data->d_size, 0, size);
+			memset(d_data + data->d_size, 0, size);
 
+		data->d_data = d_data;
 		data->d_size += size;
 	}
 
diff --git a/lib/route/cls/u32.c b/lib/route/cls/u32.c
index 087797e88..007888880 100644
--- a/lib/route/cls/u32.c
+++ b/lib/route/cls/u32.c
@@ -264,7 +264,7 @@ static void print_selector(struct nl_dump_params *p, struct tc_u32_sel *sel,
 
 
 	for (i = 0; i < sel->nkeys; i++) {
-		key = (struct tc_u32_key *) ((char *) sel + sizeof(*sel)) + i;
+		key = &sel->keys[i];
 
 		nl_dump(p, "\n");
 		nl_dump_line(p, "      match key at %s%u ",
@@ -469,7 +469,6 @@ int rtnl_u32_set_hashmask(struct rtnl_cls *cls, uint32_t hashmask, uint32_t offs
 {
 	struct rtnl_u32 *u;
 	struct tc_u32_sel *sel;
-	int err;
 
 	hashmask = htonl(hashmask);
 
@@ -480,12 +479,6 @@ int rtnl_u32_set_hashmask(struct rtnl_cls *cls, uint32_t hashmask, uint32_t offs
 	if (!sel)
 		return -NLE_NOMEM;
 
-	err = nl_data_append(u->cu_selector, NULL, sizeof(struct tc_u32_key));
-	if(err < 0)
-		return err;
-
-	sel = u32_selector(u);
-
 	sel->hmask = hashmask;
 	sel->hoff = offset;
 	return 0;
@@ -495,7 +488,6 @@ int rtnl_u32_set_selector(struct rtnl_cls *cls, int offoff, uint32_t offmask, ch
 {
 	struct rtnl_u32 *u;
 	struct tc_u32_sel *sel;
-	int err;
 
 	offmask = ntohs(offmask);
 
@@ -506,12 +498,6 @@ int rtnl_u32_set_selector(struct rtnl_cls *cls, int offoff, uint32_t offmask, ch
 	if (!sel)
 		return -NLE_NOMEM;
 
-	err = nl_data_append(u->cu_selector, NULL, sizeof(struct tc_u32_key));
-	if(err < 0)
-		return err;
-
-	sel = u32_selector(u);
-
 	sel->offoff = offoff;
 	sel->offmask = offmask;
 	sel->offshift = offshift;
@@ -525,7 +511,6 @@ int rtnl_u32_set_cls_terminal(struct rtnl_cls *cls)
 {
 	struct rtnl_u32 *u;
 	struct tc_u32_sel *sel;
-	int err;
 
 	if (!(u = (struct rtnl_u32 *) rtnl_tc_data(TC_CAST(cls))))
 		return -NLE_NOMEM;
@@ -534,12 +519,6 @@ int rtnl_u32_set_cls_terminal(struct rtnl_cls *cls)
 	if (!sel)
 		return -NLE_NOMEM;
 
-	err = nl_data_append(u->cu_selector, NULL, sizeof(struct tc_u32_key));
-	if(err < 0)
-		return err;
-
-	sel = u32_selector(u);
-
 	sel->flags |= TC_U32_TERMINAL;
 	return 0;
 }
@@ -649,6 +628,9 @@ int rtnl_u32_add_key(struct rtnl_cls *cls, uint32_t val, uint32_t mask,
 	if (!sel)
 		return -NLE_NOMEM;
 
+	if (sel->nkeys == UCHAR_MAX)
+		return -NLE_NOMEM;
+
 	err = nl_data_append(u->cu_selector, NULL, sizeof(struct tc_u32_key));
 	if (err < 0)
 		return err;
@@ -729,7 +711,6 @@ int rtnl_u32_get_key(struct rtnl_cls *cls, uint8_t index,
 	if (!(u->cu_mask & U32_ATTR_SELECTOR))
 		return -NLE_INVAL;
 
-	/* the selector might have been moved by realloc */
 	sel = u32_selector(u);
 	if (index >= sel->nkeys)
 		return -NLE_RANGE;
diff --git a/lib/route/qdisc/netem.c b/lib/route/qdisc/netem.c
index 8ecc405cb..1d7b868fa 100644
--- a/lib/route/qdisc/netem.c
+++ b/lib/route/qdisc/netem.c
@@ -203,7 +203,7 @@ static void netem_dump_details(struct rtnl_tc *tc, void *data,
 }
 
 static int netem_msg_fill_raw(struct rtnl_tc *tc, void *data,
-			      struct nl_msg *msg)
+                              struct nl_msg *msg)
 {
 	int err = 0;
 	struct tc_netem_qopt opts;
@@ -212,8 +212,8 @@ static int netem_msg_fill_raw(struct rtnl_tc *tc, void *data,
 	struct tc_netem_corrupt corrupt;
 	struct rtnl_netem *netem = data;
 
-	unsigned char set_correlation = 0, set_reorder = 0,
-		set_corrupt = 0, set_dist = 0;
+	unsigned char set_correlation = 0, set_reorder = 0;
+	unsigned char set_corrupt = 0, set_dist = 0;
 
 	if (!netem)
 		BUG();
@@ -225,60 +225,55 @@ static int netem_msg_fill_raw(struct rtnl_tc *tc, void *data,
 
 	msg->nm_nlh->nlmsg_flags |= NLM_F_REQUEST;
 
-	if ( netem->qnm_ro.nmro_probability != 0 ) {
-		if (netem->qnm_latency == 0) {
+	if (netem->qnm_ro.nmro_probability != 0) {
+		if (netem->qnm_latency == 0)
 			return -NLE_MISSING_ATTR;
-		}
-		if (netem->qnm_gap == 0) netem->qnm_gap = 1;
-	}
-	else if ( netem->qnm_gap ) { 
+		if (netem->qnm_gap == 0)
+			netem->qnm_gap = 1;
+	} else if (netem->qnm_gap)
 		return -NLE_MISSING_ATTR;
-	}
 
-	if ( netem->qnm_corr.nmc_delay != 0 ) {
-		if ( netem->qnm_latency == 0 || netem->qnm_jitter == 0) {
+	if (netem->qnm_corr.nmc_delay != 0) {
+		if (netem->qnm_latency == 0 || netem->qnm_jitter == 0)
 			return -NLE_MISSING_ATTR;
-		}
 		set_correlation = 1;
 	}
 
-	if ( netem->qnm_corr.nmc_loss != 0 ) {
-		if ( netem->qnm_loss == 0 ) {
+	if (netem->qnm_corr.nmc_loss != 0) {
+		if (netem->qnm_loss == 0)
 			return -NLE_MISSING_ATTR;
-		}
 		set_correlation = 1;
 	}
 
-	if ( netem->qnm_corr.nmc_duplicate != 0 ) {
-		if ( netem->qnm_duplicate == 0 ) {
+	if (netem->qnm_corr.nmc_duplicate != 0) {
+		if (netem->qnm_duplicate == 0)
 			return -NLE_MISSING_ATTR;
-		}
 		set_correlation = 1;
 	}
 
-	if ( netem->qnm_ro.nmro_probability != 0 ) set_reorder = 1;
-	else if ( netem->qnm_ro.nmro_correlation != 0 ) {
-			return -NLE_MISSING_ATTR;
-	}
+	if (netem->qnm_ro.nmro_probability != 0)
+		set_reorder = 1;
+	else if (netem->qnm_ro.nmro_correlation != 0)
+		return -NLE_MISSING_ATTR;
 
-	if ( netem->qnm_crpt.nmcr_probability != 0 ) set_corrupt = 1;
-	else if ( netem->qnm_crpt.nmcr_correlation != 0 ) {
-			return -NLE_MISSING_ATTR;
-	}
+	if (netem->qnm_crpt.nmcr_probability != 0)
+		set_corrupt = 1;
+	else if (netem->qnm_crpt.nmcr_correlation != 0)
+		return -NLE_MISSING_ATTR;
 
-	if ( netem->qnm_dist.dist_data && netem->qnm_dist.dist_size ) {
-		if (netem->qnm_latency == 0 || netem->qnm_jitter == 0) {
+	if (netem->qnm_dist.dist_data && netem->qnm_dist.dist_size) {
+		if (netem->qnm_latency == 0 || netem->qnm_jitter == 0)
 			return -NLE_MISSING_ATTR;
-	}
-	else {
-		/* Resize to accomodate the large distribution table */
-		int new_msg_len = msg->nm_size + netem->qnm_dist.dist_size *
-			sizeof(netem->qnm_dist.dist_data[0]);
-
-		msg->nm_nlh = (struct nlmsghdr *) realloc(msg->nm_nlh, new_msg_len);
-		if ( msg->nm_nlh == NULL )
-			return -NLE_NOMEM;
-		msg->nm_size = new_msg_len;
+		else {
+			/* Resize to accomodate the large distribution table */
+			int new_msg_len = msg->nm_size + netem->qnm_dist.dist_size *
+			                  sizeof(netem->qnm_dist.dist_data[0]);
+			struct nlmsghdr *new_nlh = realloc(msg->nm_nlh, new_msg_len);
+
+			if (new_nlh == NULL)
+				return -NLE_NOMEM;
+			msg->nm_nlh = new_nlh;
+			msg->nm_size = new_msg_len;
 			set_dist = 1;
 		}
 	}
@@ -292,7 +287,7 @@ static int netem_msg_fill_raw(struct rtnl_tc *tc, void *data,
 
 	NLA_PUT(msg, TCA_OPTIONS, sizeof(opts), &opts);
 
-	if ( set_correlation ) {
+	if (set_correlation) {
 		cor.delay_corr = netem->qnm_corr.nmc_delay;
 		cor.loss_corr = netem->qnm_corr.nmc_loss;
 		cor.dup_corr = netem->qnm_corr.nmc_duplicate;
@@ -300,24 +295,24 @@ static int netem_msg_fill_raw(struct rtnl_tc *tc, void *data,
 		NLA_PUT(msg, TCA_NETEM_CORR, sizeof(cor), &cor);
 	}
 
-	if ( set_reorder ) {
+	if (set_reorder) {
 		reorder.probability = netem->qnm_ro.nmro_probability;
 		reorder.correlation = netem->qnm_ro.nmro_correlation;
 
 		NLA_PUT(msg, TCA_NETEM_REORDER, sizeof(reorder), &reorder);
 	}
 
-	if ( set_corrupt ) {
+	if (set_corrupt) {
 		corrupt.probability = netem->qnm_crpt.nmcr_probability;
 		corrupt.correlation = netem->qnm_crpt.nmcr_correlation;
 
 		NLA_PUT(msg, TCA_NETEM_CORRUPT, sizeof(corrupt), &corrupt);
 	}
 
-	if ( set_dist ) {
+	if (set_dist) {
 		NLA_PUT(msg, TCA_NETEM_DELAY_DIST,
-			netem->qnm_dist.dist_size * sizeof(netem->qnm_dist.dist_data[0]),
-			netem->qnm_dist.dist_data);
+		        netem->qnm_dist.dist_size * sizeof(netem->qnm_dist.dist_data[0]),
+		        netem->qnm_dist.dist_data);
 	}
 
 	/* Length specified in the TCA_OPTIONS section must span the entire
@@ -325,10 +320,10 @@ static int netem_msg_fill_raw(struct rtnl_tc *tc, void *data,
 	 * Maybe there's a more succinct way to do this at a higher level.
 	 */
 	struct nlattr* head = (struct nlattr *)(NLMSG_DATA(msg->nm_nlh) +
-		NLMSG_LENGTH(sizeof(struct tcmsg)) - NLMSG_ALIGNTO);
+	                      NLMSG_LENGTH(sizeof(struct tcmsg)) - NLMSG_ALIGNTO);
 
 	struct nlattr* tail = (struct nlattr *)(((void *) (msg->nm_nlh)) +
-		NLMSG_ALIGN(msg->nm_nlh->nlmsg_len));
+	                      NLMSG_ALIGN(msg->nm_nlh->nlmsg_len));
 
 	int old_len = head->nla_len;
 	head->nla_len = (void *)tail - (void *)head;
@@ -905,7 +900,7 @@ int rtnl_netem_set_delay_distribution(struct rtnl_qdisc *qdisc, const char *dist
 			break;
 	}
 
-	if ( f == NULL )
+	if (f == NULL)
 		return -nl_syserr2nlerr(errno);
 
 	netem->qnm_dist.dist_data = (int16_t *) calloc (MAXDIST, sizeof(int16_t));