57 files changed, 688 insertions, 520 deletions
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1b745d412cf6..1b5096a9875a 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -466,8 +466,13 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                goto out;
        if (addr->sin_family != AF_INET) {
+                /* Compatibility games : accept AF_UNSPEC (mapped to AF_INET)
+                 * only if s_addr is INADDR_ANY.
+                 */
                err = -EAFNOSUPPORT;
-                goto out;
+                if (addr->sin_family != AF_UNSPEC ||
+                    addr->sin_addr.s_addr != htonl(INADDR_ANY))
+                        goto out;
        }
        chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
@@ -888,7 +893,7 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 EXPORT_SYMBOL(inet_ioctl);
 #ifdef CONFIG_COMPAT
-int inet_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+static int inet_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
        struct sock *sk = sock->sk;
        int err = -ENOIOCTLCMD;
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index c1f4154552fc..36d14406261e 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -136,8 +136,6 @@ static void ah_output_done(struct crypto_async_request *base, int err)
                memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
        }
-        err = ah->nexthdr;
        kfree(AH_SKB_CB(skb)->tmp);
        xfrm_output_resume(skb, err);
 }
@@ -264,12 +262,12 @@ static void ah_input_done(struct crypto_async_request *base, int err)
        if (err)
                goto out;
+        err = ah->nexthdr;
        skb->network_header += ah_hlen;
        memcpy(skb_network_header(skb), work_iph, ihl);
        __skb_pull(skb, ah_hlen + ihl);
        skb_set_transport_header(skb, -ihl);
-        err = ah->nexthdr;
 out:
        kfree(AH_SKB_CB(skb)->tmp);
        xfrm_input_resume(skb, err);
@@ -371,8 +369,6 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
                if (err == -EINPROGRESS)
                        goto out;
-                if (err == -EBUSY)
-                        err = NET_XMIT_DROP;
                goto out_free;
        }
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 2c2a98e402e7..86f3b885b4f3 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -476,7 +476,7 @@ int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
        doi = doi_def->doi;
        doi_type = doi_def->type;
-        if (doi_def == NULL || doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
+        if (doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
                goto doi_add_return;
        for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
                switch (doi_def->tags[iter]) {
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index bc19bd06dd00..c6b5092f29a1 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -258,7 +258,7 @@ static struct in_device *inetdev_init(struct net_device *dev)
                ip_mc_up(in_dev);
        /* we can receive as soon as ip_ptr is set -- do this last */
-        rcu_assign_pointer(dev->ip_ptr, in_dev);
+        RCU_INIT_POINTER(dev->ip_ptr, in_dev);
 out:
        return in_dev;
 out_kfree:
@@ -291,7 +291,7 @@ static void inetdev_destroy(struct in_device *in_dev)
                inet_free_ifa(ifa);
        }
-        rcu_assign_pointer(dev->ip_ptr, NULL);
+        RCU_INIT_POINTER(dev->ip_ptr, NULL);
        devinet_sysctl_unregister(in_dev);
        neigh_parms_release(&arp_tbl, in_dev->arp_parms);
@@ -1175,7 +1175,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
        switch (event) {
        case NETDEV_REGISTER:
                printk(KERN_DEBUG "inetdev_event: bug\n");
-                rcu_assign_pointer(dev->ip_ptr, NULL);
+                RCU_INIT_POINTER(dev->ip_ptr, NULL);
                break;
        case NETDEV_UP:
                if (!inetdev_valid_mtu(dev->mtu))
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index a53bb1b5b118..46339ba7a2d3 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -26,6 +26,7 @@
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/rcupdate.h>
+#include <linux/export.h>
 #include <net/ip.h>
 #include <net/route.h>
 #include <net/tcp.h>
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 33e2c35b74b7..80106d89d548 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -142,6 +142,14 @@ const struct fib_prop fib_props[RTN_MAX + 1] = {
 };
 /* Release a nexthop info record */
+static void free_fib_info_rcu(struct rcu_head *head)
+{
+        struct fib_info *fi = container_of(head, struct fib_info, rcu);
+        if (fi->fib_metrics != (u32 *) dst_default_metrics)
+                kfree(fi->fib_metrics);
+        kfree(fi);
+}
 void free_fib_info(struct fib_info *fi)
 {
@@ -156,7 +164,7 @@ void free_fib_info(struct fib_info *fi)
        } endfor_nexthops(fi);
        fib_info_cnt--;
        release_net(fi->fib_net);
-        kfree_rcu(fi, rcu);
+        call_rcu(&fi->rcu, free_fib_info_rcu);
 }
 void fib_release_info(struct fib_info *fi)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index de9e2978476f..37b671185c81 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -73,6 +73,7 @@
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/prefetch.h>
+#include <linux/export.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -204,7 +205,7 @@ static inline struct tnode *node_parent_rcu(const struct rt_trie_node *node)
        return (struct tnode *)(parent & ~NODE_TYPE_MASK);
 }
-/* Same as rcu_assign_pointer
+/* Same as RCU_INIT_POINTER
 * but that macro() assumes that value is a pointer.
 */
 static inline void node_set_parent(struct rt_trie_node *node, struct tnode *ptr)
@@ -528,7 +529,7 @@ static void tnode_put_child_reorg(struct tnode *tn, int i, struct rt_trie_node *
        if (n)
                node_set_parent(n, tn);
-        rcu_assign_pointer(tn->child[i], n);
+        RCU_INIT_POINTER(tn->child[i], n);
 }
 #define MAX_WORK 10
@@ -1014,7 +1015,7 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
                tp = node_parent((struct rt_trie_node *) tn);
                if (!tp)
-                        rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
+                        RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
                tnode_free_flush();
                if (!tp)
@@ -1026,7 +1027,7 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
        if (IS_TNODE(tn))
                tn = (struct tnode *)resize(t, (struct tnode *)tn);
-        rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
+        RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
        tnode_free_flush();
 }
@@ -1163,7 +1164,7 @@ static struct list_head *fib_insert_node(struct trie *t, u32 key, int plen)
                        put_child(t, (struct tnode *)tp, cindex,
                                  (struct rt_trie_node *)tn);
                } else {
-                        rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
+                        RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
                        tp = tn;
                }
        }
@@ -1621,7 +1622,7 @@ static void trie_leaf_remove(struct trie *t, struct leaf *l)
                put_child(t, (struct tnode *)tp, cindex, NULL);
                trie_rebalance(t, tp);
        } else
-                rcu_assign_pointer(t->trie, NULL);
+                RCU_INIT_POINTER(t->trie, NULL);
        free_leaf(l);
 }
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
index dbfc21de3479..8cb1ebb7cd74 100644
--- a/net/ipv4/gre.c
+++ b/net/ipv4/gre.c
@@ -34,7 +34,7 @@ int gre_add_protocol(const struct gre_protocol *proto, u8 version)
        if (gre_proto[version])
                goto err_out_unlock;
-        rcu_assign_pointer(gre_proto[version], proto);
+        RCU_INIT_POINTER(gre_proto[version], proto);
        spin_unlock(&gre_proto_lock);
        return 0;
@@ -54,7 +54,7 @@ int gre_del_protocol(const struct gre_protocol *proto, u8 version)
        if (rcu_dereference_protected(gre_proto[version],
                        lockdep_is_held(&gre_proto_lock)) != proto)
                goto err_out_unlock;
-        rcu_assign_pointer(gre_proto[version], NULL);
+        RCU_INIT_POINTER(gre_proto[version], NULL);
        spin_unlock(&gre_proto_lock);
        synchronize_rcu();
        return 0;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 23ef31baa1af..ab188ae12fd9 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1152,10 +1152,9 @@ static int __net_init icmp_sk_init(struct net *net)
                net->ipv4.icmp_sk[i] = sk;
                /* Enough space for 2 64K ICMP packets, including
-                 * sk_buff struct overhead.
+                 * sk_buff/skb_shared_info struct overhead.
                 */
-                sk->sk_sndbuf =
+                sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
-                        (2 * ((64 * 1024) + sizeof(struct sk_buff)));
                /*
                 * Speedup sock_wfree()
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 283c0a26e03f..c7472eff2d51 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -767,7 +767,7 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
                        break;
                for (i=0; i<nsrcs; i++) {
                        /* skip inactive filters */
-                        if (pmc->sfcount[MCAST_INCLUDE] ||
+                        if (psf->sf_count[MCAST_INCLUDE] ||
                            pmc->sfcount[MCAST_EXCLUDE] !=
                            psf->sf_count[MCAST_EXCLUDE])
                                continue;
@@ -1009,7 +1009,7 @@ static void ip_mc_filter_add(struct in_device *in_dev, __be32 addr)
        /* Checking for IFF_MULTICAST here is WRONG-WRONG-WRONG.
           We will get multicast token leakage, when IFF_MULTICAST
-           is changed. This check should be done in dev->set_multicast_list
+           is changed. This check should be done in ndo_set_rx_mode
           routine. Something sort of:
           if (dev->mc_list && dev->flags&IFF_MULTICAST) { do it; }
           --ANK
@@ -1242,7 +1242,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
        im->next_rcu = in_dev->mc_list;
        in_dev->mc_count++;
-        rcu_assign_pointer(in_dev->mc_list, im);
+        RCU_INIT_POINTER(in_dev->mc_list, im);
 #ifdef CONFIG_IP_MULTICAST
        igmpv3_del_delrec(in_dev, im->multiaddr);
@@ -1813,7 +1813,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
        iml->next_rcu = inet->mc_list;
        iml->sflist = NULL;
        iml->sfmode = MCAST_EXCLUDE;
-        rcu_assign_pointer(inet->mc_list, iml);
+        RCU_INIT_POINTER(inet->mc_list, iml);
        ip_mc_inc_group(in_dev, addr);
        err = 0;
 done:
@@ -1835,7 +1835,7 @@ static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
        }
        err = ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
                        iml->sfmode, psf->sl_count, psf->sl_addr, 0);
-        rcu_assign_pointer(iml->sflist, NULL);
+        RCU_INIT_POINTER(iml->sflist, NULL);
        /* decrease mem now to avoid the memleak warning */
        atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);
        kfree_rcu(psf, rcu);
@@ -2000,7 +2000,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                        atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
                        kfree_rcu(psl, rcu);
                }
-                rcu_assign_pointer(pmc->sflist, newpsl);
+                RCU_INIT_POINTER(pmc->sflist, newpsl);
                psl = newpsl;
        }
        rv = 1; /* > 0 for insert logic below if sl_count is 0 */
@@ -2103,7 +2103,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
        } else
                (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
                        0, NULL, 0);
-        rcu_assign_pointer(pmc->sflist, newpsl);
+        RCU_INIT_POINTER(pmc->sflist, newpsl);
        pmc->sfmode = msf->imsf_fmode;
        err = 0;
 done:
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 389a2e6a17fd..68e8ac514383 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -108,6 +108,9 @@ static int inet_csk_diag_fill(struct sock *sk,
                       icsk->icsk_ca_ops->name);
        }
+        if ((ext & (1 << (INET_DIAG_TOS - 1))) && (sk->sk_family != AF_INET6))
+                RTA_PUT_U8(skb, INET_DIAG_TOS, inet->tos);
        r->idiag_family = sk->sk_family;
        r->idiag_state = sk->sk_state;
        r->idiag_timer = 0;
@@ -130,6 +133,8 @@ static int inet_csk_diag_fill(struct sock *sk,
                               &np->rcv_saddr);
                ipv6_addr_copy((struct in6_addr *)r->id.idiag_dst,
                               &np->daddr);
+                if (ext & (1 << (INET_DIAG_TCLASS - 1)))
+                        RTA_PUT_U8(skb, INET_DIAG_TCLASS, np->tclass);
        }
 #endif
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index ef7ae6049a51..cc280a3f4f96 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -244,11 +244,11 @@ static void lro_add_frags(struct net_lro_desc *lro_desc,
        skb->truesize += truesize;
        skb_frags[0].page_offset += hlen;
-        skb_frags[0].size -= hlen;
+        skb_frag_size_sub(&skb_frags[0], hlen);
        while (tcp_data_len > 0) {
                *(lro_desc->next_frag) = *skb_frags;
-                tcp_data_len -= skb_frags->size;
+                tcp_data_len -= skb_frag_size(skb_frags);
                lro_desc->next_frag++;
                skb_frags++;
                skb_shinfo(skb)->nr_frags++;
@@ -400,14 +400,14 @@ static struct sk_buff *lro_gen_skb(struct net_lro_mgr *lro_mgr,
        skb_frags = skb_shinfo(skb)->frags;
        while (data_len > 0) {
                *skb_frags = *frags;
-                data_len -= frags->size;
+                data_len -= skb_frag_size(frags);
                skb_frags++;
                frags++;
                skb_shinfo(skb)->nr_frags++;
        }
        skb_shinfo(skb)->frags[0].page_offset += hdr_len;
-        skb_shinfo(skb)->frags[0].size -= hdr_len;
+        skb_frag_size_sub(&skb_shinfo(skb)->frags[0], hdr_len);
        skb->ip_summed = ip_summed;
        skb->csum = sum;
@@ -433,7 +433,7 @@ static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
        if (!lro_mgr->get_frag_header ||
            lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
                                     (void *)&tcph, &flags, priv)) {
-                mac_hdr = page_address(frags->page) + frags->page_offset;
+                mac_hdr = skb_frag_address(frags);
                goto out1;
        }
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 3c8dfa16614d..89168c6351ff 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/kmemcheck.h>
 #include <linux/slab.h>
+#include <linux/module.h>
 #include <net/inet_hashtables.h>
 #include <net/inet_timewait_sock.h>
 #include <net/ip.h>
@@ -183,6 +184,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                tw->tw_daddr        = inet->inet_daddr;
                tw->tw_rcv_saddr    = inet->inet_rcv_saddr;
                tw->tw_bound_dev_if = sk->sk_bound_dev_if;
+                tw->tw_tos          = inet->tos;
                tw->tw_num          = inet->inet_num;
                tw->tw_state        = TCP_TIME_WAIT;
                tw->tw_substate     = state;
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 0e0ab98abc6f..fdaabf2f2b68 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -599,8 +599,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                head->next = clone;
                skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
                skb_frag_list_init(head);
-                for (i=0; i<skb_shinfo(head)->nr_frags; i++)
+                for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
-                        plen += skb_shinfo(head)->frags[i].size;
+                        plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
                clone->len = clone->data_len = head->data_len - plen;
                head->data_len -= clone->len;
                head->len -= clone->len;
@@ -682,6 +682,42 @@ int ip_defrag(struct sk_buff *skb, u32 user)
 }
 EXPORT_SYMBOL(ip_defrag);
+struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
+{
+        const struct iphdr *iph;
+        u32 len;
+        if (skb->protocol != htons(ETH_P_IP))
+                return skb;
+        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+                return skb;
+        iph = ip_hdr(skb);
+        if (iph->ihl < 5 || iph->version != 4)
+                return skb;
+        if (!pskb_may_pull(skb, iph->ihl*4))
+                return skb;
+        iph = ip_hdr(skb);
+        len = ntohs(iph->tot_len);
+        if (skb->len < len || len < (iph->ihl * 4))
+                return skb;
+        if (ip_is_fragment(ip_hdr(skb))) {
+                skb = skb_share_check(skb, GFP_ATOMIC);
+                if (skb) {
+                        if (pskb_trim_rcsum(skb, len))
+                                return skb;
+                        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+                        if (ip_defrag(skb, user))
+                                return NULL;
+                        skb->rxhash = 0;
+                }
+        }
+        return skb;
+}
+EXPORT_SYMBOL(ip_check_defrag);
 #ifdef CONFIG_SYSCTL
 static int zero;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index d7bb94c48345..d55110e93120 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -835,8 +835,6 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
        if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
            (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
                struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
-                if (max_headroom > dev->needed_headroom)
-                        dev->needed_headroom = max_headroom;
                if (!new_skb) {
                        ip_rt_put(rt);
                        dev->stats.tx_dropped++;
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index ec93335901dd..05d20cca9d66 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -640,6 +640,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
        }
        if (srrptr <= srrspace) {
                opt->srr_is_hit = 1;
+                iph->daddr = nexthop;
                opt->is_changed = 1;
        }
        return 0;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 8c6563361ab5..0bc95f3977d2 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -989,13 +989,13 @@ alloc_new_skb:
                        if (page && (left = PAGE_SIZE - off) > 0) {
                                if (copy >= left)
                                        copy = left;
-                                if (page != frag->page) {
+                                if (page != skb_frag_page(frag)) {
                                        if (i == MAX_SKB_FRAGS) {
                                                err = -EMSGSIZE;
                                                goto error;
                                        }
-                                        get_page(page);
                                        skb_fill_page_desc(skb, i, page, off, 0);
+                                        skb_frag_ref(skb, i);
                                        frag = &skb_shinfo(skb)->frags[i];
                                }
                        } else if (i < MAX_SKB_FRAGS) {
@@ -1015,12 +1015,13 @@ alloc_new_skb:
                                err = -EMSGSIZE;
                                goto error;
                        }
-                        if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) {
+                        if (getfrag(from, skb_frag_address(frag)+skb_frag_size(frag),
+                                    offset, copy, skb->len, skb) < 0) {
                                err = -EFAULT;
                                goto error;
                        }
                        cork->off += copy;
-                        frag->size += copy;
+                        skb_frag_size_add(frag, copy);
                        skb->len += copy;
                        skb->data_len += copy;
                        skb->truesize += copy;
@@ -1229,7 +1230,7 @@ ssize_t	ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                if (len > size)
                        len = size;
                if (skb_can_coalesce(skb, i, page, offset)) {
-                        skb_shinfo(skb)->frags[i-1].size += len;
+                        skb_frag_size_add(&skb_shinfo(skb)->frags[i-1], len);
                } else if (i < MAX_SKB_FRAGS) {
                        get_page(page);
                        skb_fill_page_desc(skb, i, page, offset, len);
@@ -1465,7 +1466,7 @@ static int ip_reply_glue_bits(void *dptr, char *to, int offset,
 *      structure to pass arguments.
 */
 void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
-                   struct ip_reply_arg *arg, unsigned int len)
+                   const struct ip_reply_arg *arg, unsigned int len)
 {
        struct inet_sock *inet = inet_sk(sk);
        struct ip_options_data replyopts;
@@ -1488,7 +1489,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
        }
        flowi4_init_output(&fl4, arg->bound_dev_if, 0,
-                           RT_TOS(ip_hdr(skb)->tos),
+                           RT_TOS(arg->tos),
                           RT_SCOPE_UNIVERSE, sk->sk_protocol,
                           ip_reply_arg_flowi_flags(arg),
                           daddr, rt->rt_spec_dst,
@@ -1505,7 +1506,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
           with locally disabled BH and that sk cannot be already spinlocked.
         */
        bh_lock_sock(sk);
-        inet->tos = ip_hdr(skb)->tos;
+        inet->tos = arg->tos;
        sk->sk_priority = skb->priority;
        sk->sk_protocol = ip_hdr(skb)->protocol;
        sk->sk_bound_dev_if = arg->bound_dev_if;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 8905e92f896a..09ff51bf16a4 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -33,6 +33,7 @@
 #include <linux/netfilter.h>
 #include <linux/route.h>
 #include <linux/mroute.h>
+#include <net/inet_ecn.h>
 #include <net/route.h>
 #include <net/xfrm.h>
 #include <net/compat.h>
@@ -578,8 +579,8 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                break;
        case IP_TOS:    /* This sets both TOS and Precedence */
                if (sk->sk_type == SOCK_STREAM) {
-                        val &= ~3;
+                        val &= ~INET_ECN_MASK;
-                        val |= inet->tos & 3;
+                        val |= inet->tos & INET_ECN_MASK;
                }
                if (inet->tos != val) {
                        inet->tos = val;
@@ -961,7 +962,7 @@ mc_msf_out:
                break;
        case IP_TRANSPARENT:
-                if (!capable(CAP_NET_ADMIN)) {
+                if (!!val && !capable(CAP_NET_RAW) && !capable(CAP_NET_ADMIN)) {
                        err = -EPERM;
                        break;
                }
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 472a8c4f1dc0..0da2afc97f32 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -54,6 +54,7 @@
 #include <linux/delay.h>
 #include <linux/nfs_fs.h>
 #include <linux/slab.h>
+#include <linux/export.h>
 #include <net/net_namespace.h>
 #include <net/arp.h>
 #include <net/ip.h>
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 378b20b7ca6e..065effd8349a 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -231,7 +231,7 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
             (iter = rtnl_dereference(*tp)) != NULL;
             tp = &iter->next) {
                if (t == iter) {
-                        rcu_assign_pointer(*tp, t->next);
+                        RCU_INIT_POINTER(*tp, t->next);
                        break;
                }
        }
@@ -241,8 +241,8 @@ static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
 {
        struct ip_tunnel __rcu **tp = ipip_bucket(ipn, t);
-        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
+        RCU_INIT_POINTER(t->next, rtnl_dereference(*tp));
-        rcu_assign_pointer(*tp, t);
+        RCU_INIT_POINTER(*tp, t);
 }
 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
@@ -301,7 +301,7 @@ static void ipip_tunnel_uninit(struct net_device *dev)
        struct ipip_net *ipn = net_generic(net, ipip_net_id);
        if (dev == ipn->fb_tunnel_dev)
-                rcu_assign_pointer(ipn->tunnels_wc[0], NULL);
+                RCU_INIT_POINTER(ipn->tunnels_wc[0], NULL);
        else
                ipip_tunnel_unlink(ipn, netdev_priv(dev));
        dev_put(dev);
@@ -791,7 +791,7 @@ static int __net_init ipip_fb_tunnel_init(struct net_device *dev)
                return -ENOMEM;
        dev_hold(dev);
-        rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
+        RCU_INIT_POINTER(ipn->tunnels_wc[0], tunnel);
        return 0;
 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 58e879157976..76a7f07b38b6 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -61,6 +61,7 @@
 #include <linux/if_arp.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/compat.h>
+#include <linux/export.h>
 #include <net/ipip.h>
 #include <net/checksum.h>
 #include <net/netlink.h>
@@ -1176,7 +1177,7 @@ static void mrtsock_destruct(struct sock *sk)
        ipmr_for_each_table(mrt, net) {
                if (sk == rtnl_dereference(mrt->mroute_sk)) {
                        IPV4_DEVCONF_ALL(net, MC_FORWARDING)--;
-                        rcu_assign_pointer(mrt->mroute_sk, NULL);
+                        RCU_INIT_POINTER(mrt->mroute_sk, NULL);
                        mroute_clean_tables(mrt);
                }
        }
@@ -1203,7 +1204,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
                return -ENOENT;
        if (optname != MRT_INIT) {
-                if (sk != rcu_dereference_raw(mrt->mroute_sk) &&
+                if (sk != rcu_access_pointer(mrt->mroute_sk) &&
                    !capable(CAP_NET_ADMIN))
                        return -EACCES;
        }
@@ -1224,13 +1225,13 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
                ret = ip_ra_control(sk, 1, mrtsock_destruct);
                if (ret == 0) {
-                        rcu_assign_pointer(mrt->mroute_sk, sk);
+                        RCU_INIT_POINTER(mrt->mroute_sk, sk);
                        IPV4_DEVCONF_ALL(net, MC_FORWARDING)++;
                }
                rtnl_unlock();
                return ret;
        case MRT_DONE:
-                if (sk != rcu_dereference_raw(mrt->mroute_sk))
+                if (sk != rcu_access_pointer(mrt->mroute_sk))
                        return -EACCES;
                return ip_ra_control(sk, 0, NULL);
        case MRT_ADD_VIF:
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 929b27bdeb79..9899619ab9b8 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -5,6 +5,7 @@
 #include <linux/ip.h>
 #include <linux/skbuff.h>
 #include <linux/gfp.h>
+#include <linux/export.h>
 #include <net/route.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 5c9b9d963918..e59aabd0eae4 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -218,6 +218,7 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
        return skb;
 nlmsg_failure:
+        kfree_skb(skb);
        *errp = -EINVAL;
        printk(KERN_ERR "ip_queue: error creating packet message\n");
        return NULL;
@@ -313,7 +314,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
 {
        struct nf_queue_entry *entry;
-        if (vmsg->value > NF_MAX_VERDICT)
+        if (vmsg->value > NF_MAX_VERDICT || vmsg->value == NF_STOLEN)
                return -EINVAL;
        entry = ipq_find_dequeue_entry(vmsg->id);
@@ -358,12 +359,9 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
                break;
        case IPQM_VERDICT:
-                if (pmsg->msg.verdict.value > NF_MAX_VERDICT)
+                status = ipq_set_verdict(&pmsg->msg.verdict,
-                        status = -EINVAL;
+                                         len - sizeof(*pmsg));
-                else
+                break;
-                        status = ipq_set_verdict(&pmsg->msg.verdict,
-                                                 len - sizeof(*pmsg));
-                        break;
        default:
                status = -EINVAL;
        }
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index db8d22db425f..a639967eb727 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -395,7 +395,6 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
                        config = clusterip_config_init(cipinfo,
                                                        e->ip.dst.s_addr, dev);
                        if (!config) {
-                                pr_info("cannot allocate config\n");
                                dev_put(dev);
                                return -ENOMEM;
                        }
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index 446e0f467a17..b5508151e547 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -135,10 +135,8 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
         * due to slab allocator restrictions */
        n = max(size, nlbufsiz);
-        skb = alloc_skb(n, GFP_ATOMIC);
+        skb = alloc_skb(n, GFP_ATOMIC | __GFP_NOWARN);
        if (!skb) {
-                pr_debug("cannot alloc whole buffer %ub!\n", n);
                if (n > size) {
                        /* try to allocate only as much as we need for
                         * current packet */
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 5585980fce2e..9682b36df38c 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -21,6 +21,7 @@
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_acct.h>
 #include <linux/rculist_nulls.h>
+#include <linux/export.h>
 struct ct_iter_state {
        struct seq_net_private p;
diff --git a/net/ipv4/netfilter/nf_nat_amanda.c b/net/ipv4/netfilter/nf_nat_amanda.c
index 703f366fd235..7b22382ff0e9 100644
--- a/net/ipv4/netfilter/nf_nat_amanda.c
+++ b/net/ipv4/netfilter/nf_nat_amanda.c
@@ -70,14 +70,14 @@ static unsigned int help(struct sk_buff *skb,
 static void __exit nf_nat_amanda_fini(void)
 {
-        rcu_assign_pointer(nf_nat_amanda_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_amanda_hook, NULL);
        synchronize_rcu();
 }
 static int __init nf_nat_amanda_init(void)
 {
        BUG_ON(nf_nat_amanda_hook != NULL);
-        rcu_assign_pointer(nf_nat_amanda_hook, help);
+        RCU_INIT_POINTER(nf_nat_amanda_hook, help);
        return 0;
 }
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 3346de5d94d0..447bc5cfdc6c 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -514,7 +514,7 @@ int nf_nat_protocol_register(const struct nf_nat_protocol *proto)
                ret = -EBUSY;
                goto out;
        }
-        rcu_assign_pointer(nf_nat_protos[proto->protonum], proto);
+        RCU_INIT_POINTER(nf_nat_protos[proto->protonum], proto);
 out:
        spin_unlock_bh(&nf_nat_lock);
        return ret;
@@ -525,7 +525,7 @@ EXPORT_SYMBOL(nf_nat_protocol_register);
 void nf_nat_protocol_unregister(const struct nf_nat_protocol *proto)
 {
        spin_lock_bh(&nf_nat_lock);
-        rcu_assign_pointer(nf_nat_protos[proto->protonum],
+        RCU_INIT_POINTER(nf_nat_protos[proto->protonum],
                           &nf_nat_unknown_protocol);
        spin_unlock_bh(&nf_nat_lock);
        synchronize_rcu();
@@ -736,10 +736,10 @@ static int __init nf_nat_init(void)
        /* Sew in builtin protocols. */
        spin_lock_bh(&nf_nat_lock);
        for (i = 0; i < MAX_IP_NAT_PROTO; i++)
-                rcu_assign_pointer(nf_nat_protos[i], &nf_nat_unknown_protocol);
+                RCU_INIT_POINTER(nf_nat_protos[i], &nf_nat_unknown_protocol);
-        rcu_assign_pointer(nf_nat_protos[IPPROTO_TCP], &nf_nat_protocol_tcp);
+        RCU_INIT_POINTER(nf_nat_protos[IPPROTO_TCP], &nf_nat_protocol_tcp);
-        rcu_assign_pointer(nf_nat_protos[IPPROTO_UDP], &nf_nat_protocol_udp);
+        RCU_INIT_POINTER(nf_nat_protos[IPPROTO_UDP], &nf_nat_protocol_udp);
-        rcu_assign_pointer(nf_nat_protos[IPPROTO_ICMP], &nf_nat_protocol_icmp);
+        RCU_INIT_POINTER(nf_nat_protos[IPPROTO_ICMP], &nf_nat_protocol_icmp);
        spin_unlock_bh(&nf_nat_lock);
        /* Initialize fake conntrack so that NAT will skip it */
@@ -748,12 +748,12 @@ static int __init nf_nat_init(void)
        l3proto = nf_ct_l3proto_find_get((u_int16_t)AF_INET);
        BUG_ON(nf_nat_seq_adjust_hook != NULL);
-        rcu_assign_pointer(nf_nat_seq_adjust_hook, nf_nat_seq_adjust);
+        RCU_INIT_POINTER(nf_nat_seq_adjust_hook, nf_nat_seq_adjust);
        BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
-        rcu_assign_pointer(nfnetlink_parse_nat_setup_hook,
+        RCU_INIT_POINTER(nfnetlink_parse_nat_setup_hook,
                           nfnetlink_parse_nat_setup);
        BUG_ON(nf_ct_nat_offset != NULL);
-        rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset);
+        RCU_INIT_POINTER(nf_ct_nat_offset, nf_nat_get_offset);
        return 0;
 cleanup_extend:
@@ -766,9 +766,9 @@ static void __exit nf_nat_cleanup(void)
        unregister_pernet_subsys(&nf_nat_net_ops);
        nf_ct_l3proto_put(l3proto);
        nf_ct_extend_unregister(&nat_extend);
-        rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_seq_adjust_hook, NULL);
-        rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL);
+        RCU_INIT_POINTER(nfnetlink_parse_nat_setup_hook, NULL);
-        rcu_assign_pointer(nf_ct_nat_offset, NULL);
+        RCU_INIT_POINTER(nf_ct_nat_offset, NULL);
        synchronize_net();
 }
diff --git a/net/ipv4/netfilter/nf_nat_ftp.c b/net/ipv4/netfilter/nf_nat_ftp.c
index dc73abb3fe27..e462a957d080 100644
--- a/net/ipv4/netfilter/nf_nat_ftp.c
+++ b/net/ipv4/netfilter/nf_nat_ftp.c
@@ -113,14 +113,14 @@ out:
 static void __exit nf_nat_ftp_fini(void)
 {
-        rcu_assign_pointer(nf_nat_ftp_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_ftp_hook, NULL);
        synchronize_rcu();
 }
 static int __init nf_nat_ftp_init(void)
 {
        BUG_ON(nf_nat_ftp_hook != NULL);
-        rcu_assign_pointer(nf_nat_ftp_hook, nf_nat_ftp);
+        RCU_INIT_POINTER(nf_nat_ftp_hook, nf_nat_ftp);
        return 0;
 }
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index 790f3160e012..b9a1136addbd 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -581,30 +581,30 @@ static int __init init(void)
        BUG_ON(nat_callforwarding_hook != NULL);
        BUG_ON(nat_q931_hook != NULL);
-        rcu_assign_pointer(set_h245_addr_hook, set_h245_addr);
+        RCU_INIT_POINTER(set_h245_addr_hook, set_h245_addr);
-        rcu_assign_pointer(set_h225_addr_hook, set_h225_addr);
+        RCU_INIT_POINTER(set_h225_addr_hook, set_h225_addr);
-        rcu_assign_pointer(set_sig_addr_hook, set_sig_addr);
+        RCU_INIT_POINTER(set_sig_addr_hook, set_sig_addr);
-        rcu_assign_pointer(set_ras_addr_hook, set_ras_addr);
+        RCU_INIT_POINTER(set_ras_addr_hook, set_ras_addr);
-        rcu_assign_pointer(nat_rtp_rtcp_hook, nat_rtp_rtcp);
+        RCU_INIT_POINTER(nat_rtp_rtcp_hook, nat_rtp_rtcp);
-        rcu_assign_pointer(nat_t120_hook, nat_t120);
+        RCU_INIT_POINTER(nat_t120_hook, nat_t120);
-        rcu_assign_pointer(nat_h245_hook, nat_h245);
+        RCU_INIT_POINTER(nat_h245_hook, nat_h245);
-        rcu_assign_pointer(nat_callforwarding_hook, nat_callforwarding);
+        RCU_INIT_POINTER(nat_callforwarding_hook, nat_callforwarding);
-        rcu_assign_pointer(nat_q931_hook, nat_q931);
+        RCU_INIT_POINTER(nat_q931_hook, nat_q931);
        return 0;
 }
 /****************************************************************************/
 static void __exit fini(void)
 {
-        rcu_assign_pointer(set_h245_addr_hook, NULL);
+        RCU_INIT_POINTER(set_h245_addr_hook, NULL);
-        rcu_assign_pointer(set_h225_addr_hook, NULL);
+        RCU_INIT_POINTER(set_h225_addr_hook, NULL);
-        rcu_assign_pointer(set_sig_addr_hook, NULL);
+        RCU_INIT_POINTER(set_sig_addr_hook, NULL);
-        rcu_assign_pointer(set_ras_addr_hook, NULL);
+        RCU_INIT_POINTER(set_ras_addr_hook, NULL);
-        rcu_assign_pointer(nat_rtp_rtcp_hook, NULL);
+        RCU_INIT_POINTER(nat_rtp_rtcp_hook, NULL);
-        rcu_assign_pointer(nat_t120_hook, NULL);
+        RCU_INIT_POINTER(nat_t120_hook, NULL);
-        rcu_assign_pointer(nat_h245_hook, NULL);
+        RCU_INIT_POINTER(nat_h245_hook, NULL);
-        rcu_assign_pointer(nat_callforwarding_hook, NULL);
+        RCU_INIT_POINTER(nat_callforwarding_hook, NULL);
-        rcu_assign_pointer(nat_q931_hook, NULL);
+        RCU_INIT_POINTER(nat_q931_hook, NULL);
        synchronize_rcu();
 }
diff --git a/net/ipv4/netfilter/nf_nat_irc.c b/net/ipv4/netfilter/nf_nat_irc.c
index 535e1a802356..979ae165f4ef 100644
--- a/net/ipv4/netfilter/nf_nat_irc.c
+++ b/net/ipv4/netfilter/nf_nat_irc.c
@@ -75,14 +75,14 @@ static unsigned int help(struct sk_buff *skb,
 static void __exit nf_nat_irc_fini(void)
 {
-        rcu_assign_pointer(nf_nat_irc_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_irc_hook, NULL);
        synchronize_rcu();
 }
 static int __init nf_nat_irc_init(void)
 {
        BUG_ON(nf_nat_irc_hook != NULL);
-        rcu_assign_pointer(nf_nat_irc_hook, help);
+        RCU_INIT_POINTER(nf_nat_irc_hook, help);
        return 0;
 }
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 4c060038d29f..3e8284ba46b8 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -282,25 +282,25 @@ static int __init nf_nat_helper_pptp_init(void)
        nf_nat_need_gre();
        BUG_ON(nf_nat_pptp_hook_outbound != NULL);
-        rcu_assign_pointer(nf_nat_pptp_hook_outbound, pptp_outbound_pkt);
+        RCU_INIT_POINTER(nf_nat_pptp_hook_outbound, pptp_outbound_pkt);
        BUG_ON(nf_nat_pptp_hook_inbound != NULL);
-        rcu_assign_pointer(nf_nat_pptp_hook_inbound, pptp_inbound_pkt);
+        RCU_INIT_POINTER(nf_nat_pptp_hook_inbound, pptp_inbound_pkt);
        BUG_ON(nf_nat_pptp_hook_exp_gre != NULL);
-        rcu_assign_pointer(nf_nat_pptp_hook_exp_gre, pptp_exp_gre);
+        RCU_INIT_POINTER(nf_nat_pptp_hook_exp_gre, pptp_exp_gre);
        BUG_ON(nf_nat_pptp_hook_expectfn != NULL);
-        rcu_assign_pointer(nf_nat_pptp_hook_expectfn, pptp_nat_expected);
+        RCU_INIT_POINTER(nf_nat_pptp_hook_expectfn, pptp_nat_expected);
        return 0;
 }
 static void __exit nf_nat_helper_pptp_fini(void)
 {
-        rcu_assign_pointer(nf_nat_pptp_hook_expectfn, NULL);
+        RCU_INIT_POINTER(nf_nat_pptp_hook_expectfn, NULL);
-        rcu_assign_pointer(nf_nat_pptp_hook_exp_gre, NULL);
+        RCU_INIT_POINTER(nf_nat_pptp_hook_exp_gre, NULL);
-        rcu_assign_pointer(nf_nat_pptp_hook_inbound, NULL);
+        RCU_INIT_POINTER(nf_nat_pptp_hook_inbound, NULL);
-        rcu_assign_pointer(nf_nat_pptp_hook_outbound, NULL);
+        RCU_INIT_POINTER(nf_nat_pptp_hook_outbound, NULL);
        synchronize_rcu();
 }
diff --git a/net/ipv4/netfilter/nf_nat_proto_common.c b/net/ipv4/netfilter/nf_nat_proto_common.c
index f52d41ea0690..a3d997618602 100644
--- a/net/ipv4/netfilter/nf_nat_proto_common.c
+++ b/net/ipv4/netfilter/nf_nat_proto_common.c
@@ -12,6 +12,7 @@
 #include <linux/ip.h>
 #include <linux/netfilter.h>
+#include <linux/export.h>
 #include <net/secure_seq.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
diff --git a/net/ipv4/netfilter/nf_nat_proto_icmp.c b/net/ipv4/netfilter/nf_nat_proto_icmp.c
index 5744c3ec847c..9f4dc1235dc7 100644
--- a/net/ipv4/netfilter/nf_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_icmp.c
@@ -8,6 +8,7 @@
 #include <linux/types.h>
 #include <linux/init.h>
+#include <linux/export.h>
 #include <linux/ip.h>
 #include <linux/icmp.h>
diff --git a/net/ipv4/netfilter/nf_nat_proto_sctp.c b/net/ipv4/netfilter/nf_nat_proto_sctp.c
index 756331d42661..bd5a80a62a5b 100644
--- a/net/ipv4/netfilter/nf_nat_proto_sctp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_sctp.c
@@ -10,6 +10,7 @@
 #include <linux/init.h>
 #include <linux/ip.h>
 #include <linux/sctp.h>
+#include <linux/module.h>
 #include <net/sctp/checksum.h>
 #include <net/netfilter/nf_nat_protocol.h>
diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/ipv4/netfilter/nf_nat_proto_tcp.c
index aa460a595d5d..0d67bb80130f 100644
--- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_tcp.c
@@ -8,6 +8,7 @@
 #include <linux/types.h>
 #include <linux/init.h>
+#include <linux/export.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/ipv4/netfilter/nf_nat_proto_udp.c
index dfe65c7e2925..0b1b8601cba7 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_udp.c
@@ -7,6 +7,7 @@
 */
 #include <linux/types.h>
+#include <linux/export.h>
 #include <linux/init.h>
 #include <linux/ip.h>
 #include <linux/udp.h>
diff --git a/net/ipv4/netfilter/nf_nat_proto_udplite.c b/net/ipv4/netfilter/nf_nat_proto_udplite.c
index 3cc8c8af39ef..f83ef23e2ab7 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udplite.c
+++ b/net/ipv4/netfilter/nf_nat_proto_udplite.c
@@ -13,6 +13,7 @@
 #include <linux/udp.h>
 #include <linux/netfilter.h>
+#include <linux/module.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_protocol.h>
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index e40cf7816fdb..78844d9208f1 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -528,13 +528,13 @@ err1:
 static void __exit nf_nat_sip_fini(void)
 {
-        rcu_assign_pointer(nf_nat_sip_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_sip_hook, NULL);
-        rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_sip_seq_adjust_hook, NULL);
-        rcu_assign_pointer(nf_nat_sip_expect_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_sip_expect_hook, NULL);
-        rcu_assign_pointer(nf_nat_sdp_addr_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_sdp_addr_hook, NULL);
-        rcu_assign_pointer(nf_nat_sdp_port_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_sdp_port_hook, NULL);
-        rcu_assign_pointer(nf_nat_sdp_session_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_sdp_session_hook, NULL);
-        rcu_assign_pointer(nf_nat_sdp_media_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_sdp_media_hook, NULL);
        synchronize_rcu();
 }
@@ -547,13 +547,13 @@ static int __init nf_nat_sip_init(void)
        BUG_ON(nf_nat_sdp_port_hook != NULL);
        BUG_ON(nf_nat_sdp_session_hook != NULL);
        BUG_ON(nf_nat_sdp_media_hook != NULL);
-        rcu_assign_pointer(nf_nat_sip_hook, ip_nat_sip);
+        RCU_INIT_POINTER(nf_nat_sip_hook, ip_nat_sip);
-        rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, ip_nat_sip_seq_adjust);
+        RCU_INIT_POINTER(nf_nat_sip_seq_adjust_hook, ip_nat_sip_seq_adjust);
-        rcu_assign_pointer(nf_nat_sip_expect_hook, ip_nat_sip_expect);
+        RCU_INIT_POINTER(nf_nat_sip_expect_hook, ip_nat_sip_expect);
-        rcu_assign_pointer(nf_nat_sdp_addr_hook, ip_nat_sdp_addr);
+        RCU_INIT_POINTER(nf_nat_sdp_addr_hook, ip_nat_sdp_addr);
-        rcu_assign_pointer(nf_nat_sdp_port_hook, ip_nat_sdp_port);
+        RCU_INIT_POINTER(nf_nat_sdp_port_hook, ip_nat_sdp_port);
-        rcu_assign_pointer(nf_nat_sdp_session_hook, ip_nat_sdp_session);
+        RCU_INIT_POINTER(nf_nat_sdp_session_hook, ip_nat_sdp_session);
-        rcu_assign_pointer(nf_nat_sdp_media_hook, ip_nat_sdp_media);
+        RCU_INIT_POINTER(nf_nat_sdp_media_hook, ip_nat_sdp_media);
        return 0;
 }
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 076b7c8c4aa4..2133c30a4a5f 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -400,11 +400,8 @@ static unsigned char asn1_octets_decode(struct asn1_ctx *ctx,
        *len = 0;
        *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
-        if (*octets == NULL) {
+        if (*octets == NULL)
-                if (net_ratelimit())
-                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                return 0;
-        }
        ptr = *octets;
        while (ctx->pointer < eoc) {
@@ -451,11 +448,8 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
                return 0;
        *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
-        if (*oid == NULL) {
+        if (*oid == NULL)
-                if (net_ratelimit())
-                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                return 0;
-        }
        optr = *oid;
@@ -728,8 +722,6 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
                if (*obj == NULL) {
                        kfree(id);
-                        if (net_ratelimit())
-                                pr_notice("OOM in bsalg (%d)\n", __LINE__);
                        return 0;
                }
                (*obj)->syntax.l[0] = l;
@@ -744,8 +736,6 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                if (*obj == NULL) {
                        kfree(p);
                        kfree(id);
-                        if (net_ratelimit())
-                                pr_notice("OOM in bsalg (%d)\n", __LINE__);
                        return 0;
                }
                memcpy((*obj)->syntax.c, p, len);
@@ -759,8 +749,6 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                *obj = kmalloc(sizeof(struct snmp_object), GFP_ATOMIC);
                if (*obj == NULL) {
                        kfree(id);
-                        if (net_ratelimit())
-                                pr_notice("OOM in bsalg (%d)\n", __LINE__);
                        return 0;
                }
                if (!asn1_null_decode(ctx, end)) {
@@ -780,8 +768,6 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                if (*obj == NULL) {
                        kfree(lp);
                        kfree(id);
-                        if (net_ratelimit())
-                                pr_notice("OOM in bsalg (%d)\n", __LINE__);
                        return 0;
                }
                memcpy((*obj)->syntax.ul, lp, len);
@@ -801,8 +787,6 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                if (*obj == NULL) {
                        kfree(p);
                        kfree(id);
-                        if (net_ratelimit())
-                                pr_notice("OOM in bsalg (%d)\n", __LINE__);
                        return 0;
                }
                memcpy((*obj)->syntax.uc, p, len);
@@ -819,8 +803,6 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
                if (*obj == NULL) {
                        kfree(id);
-                        if (net_ratelimit())
-                                pr_notice("OOM in bsalg (%d)\n", __LINE__);
                        return 0;
                }
                (*obj)->syntax.ul[0] = ul;
@@ -1310,7 +1292,7 @@ static int __init nf_nat_snmp_basic_init(void)
        int ret = 0;
        BUG_ON(nf_nat_snmp_hook != NULL);
-        rcu_assign_pointer(nf_nat_snmp_hook, help);
+        RCU_INIT_POINTER(nf_nat_snmp_hook, help);
        ret = nf_conntrack_helper_register(&snmp_trap_helper);
        if (ret < 0) {
@@ -1322,7 +1304,7 @@ static int __init nf_nat_snmp_basic_init(void)
 static void __exit nf_nat_snmp_basic_fini(void)
 {
-        rcu_assign_pointer(nf_nat_snmp_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
        nf_conntrack_helper_unregister(&snmp_trap_helper);
 }
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index a6e606e84820..92900482edea 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -284,7 +284,7 @@ static int __init nf_nat_standalone_init(void)
 #ifdef CONFIG_XFRM
        BUG_ON(ip_nat_decode_session != NULL);
-        rcu_assign_pointer(ip_nat_decode_session, nat_decode_session);
+        RCU_INIT_POINTER(ip_nat_decode_session, nat_decode_session);
 #endif
        ret = nf_nat_rule_init();
        if (ret < 0) {
@@ -302,7 +302,7 @@ static int __init nf_nat_standalone_init(void)
        nf_nat_rule_cleanup();
 cleanup_decode_session:
 #ifdef CONFIG_XFRM
-        rcu_assign_pointer(ip_nat_decode_session, NULL);
+        RCU_INIT_POINTER(ip_nat_decode_session, NULL);
        synchronize_net();
 #endif
        return ret;
@@ -313,7 +313,7 @@ static void __exit nf_nat_standalone_fini(void)
        nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
        nf_nat_rule_cleanup();
 #ifdef CONFIG_XFRM
-        rcu_assign_pointer(ip_nat_decode_session, NULL);
+        RCU_INIT_POINTER(ip_nat_decode_session, NULL);
        synchronize_net();
 #endif
        /* Conntrack caches are unregistered in nf_conntrack_cleanup */
diff --git a/net/ipv4/netfilter/nf_nat_tftp.c b/net/ipv4/netfilter/nf_nat_tftp.c
index 7274a43c7a12..a2901bf829c0 100644
--- a/net/ipv4/netfilter/nf_nat_tftp.c
+++ b/net/ipv4/netfilter/nf_nat_tftp.c
@@ -36,14 +36,14 @@ static unsigned int help(struct sk_buff *skb,
 static void __exit nf_nat_tftp_fini(void)
 {
-        rcu_assign_pointer(nf_nat_tftp_hook, NULL);
+        RCU_INIT_POINTER(nf_nat_tftp_hook, NULL);
        synchronize_rcu();
 }
 static int __init nf_nat_tftp_init(void)
 {
        BUG_ON(nf_nat_tftp_hook != NULL);
-        rcu_assign_pointer(nf_nat_tftp_hook, help);
+        RCU_INIT_POINTER(nf_nat_tftp_hook, help);
        return 0;
 }
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 39b403f854c6..43d4c3b22369 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -39,6 +39,7 @@
 #include <net/protocol.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
+#include <linux/export.h>
 #include <net/sock.h>
 #include <net/ping.h>
 #include <net/udp.h>
@@ -338,7 +339,6 @@ void ping_err(struct sk_buff *skb, u32 info)
        sk = ping_v4_lookup(net, iph->daddr, iph->saddr,
                            ntohs(icmph->un.echo.id), skb->dev->ifindex);
        if (sk == NULL) {
-                ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                pr_debug("no socket, dropping\n");
                return; /* No socket for error */
        }
@@ -678,7 +678,6 @@ static int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
        pr_debug("ping_queue_rcv_skb(sk=%p,sk->num=%d,skb=%p)\n",
                inet_sk(sk), inet_sk(sk)->inet_num, skb);
        if (sock_queue_rcv_skb(sk, skb) < 0) {
-                ICMP_INC_STATS_BH(sock_net(sk), ICMP_MIB_INERRORS);
                kfree_skb(skb);
                pr_debug("ping_queue_rcv_skb -> failed\n");
                return -1;
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index b14ec7d03b6e..466ea8bb7a4d 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -42,6 +42,7 @@
 #include <linux/inetdevice.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/export.h>
 #include <net/sock.h>
 #include <net/raw.h>
@@ -254,6 +255,8 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPDeferAcceptDrop", LINUX_MIB_TCPDEFERACCEPTDROP),
        SNMP_MIB_ITEM("IPReversePathFilter", LINUX_MIB_IPRPFILTER),
        SNMP_MIB_ITEM("TCPTimeWaitOverflow", LINUX_MIB_TCPTIMEWAITOVERFLOW),
+        SNMP_MIB_ITEM("TCPReqQFullDoCookies", LINUX_MIB_TCPREQQFULLDOCOOKIES),
+        SNMP_MIB_ITEM("TCPReqQFullDrop", LINUX_MIB_TCPREQQFULLDROP),
        SNMP_MIB_SENTINEL
 };
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 61714bd52925..007e2eb769d3 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -48,6 +48,7 @@
 #include <linux/errno.h>
 #include <linux/aio.h>
 #include <linux/kernel.h>
+#include <linux/export.h>
 #include <linux/spinlock.h>
 #include <linux/sockios.h>
 #include <linux/socket.h>
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 075212e41b83..0c74da8a0473 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -120,7 +120,6 @@
 static int ip_rt_max_size;
 static int ip_rt_gc_timeout __read_mostly       = RT_GC_TIMEOUT;
-static int ip_rt_gc_interval __read_mostly      = 60 * HZ;
 static int ip_rt_gc_min_interval __read_mostly  = HZ / 2;
 static int ip_rt_redirect_number __read_mostly  = 9;
 static int ip_rt_redirect_load __read_mostly    = HZ / 50;
@@ -324,7 +323,7 @@ static struct rtable *rt_cache_get_first(struct seq_file *seq)
        struct rtable *r = NULL;
        for (st->bucket = rt_hash_mask; st->bucket >= 0; --st->bucket) {
-                if (!rcu_dereference_raw(rt_hash_table[st->bucket].chain))
+                if (!rcu_access_pointer(rt_hash_table[st->bucket].chain))
                        continue;
                rcu_read_lock_bh();
                r = rcu_dereference_bh(rt_hash_table[st->bucket].chain);
@@ -350,7 +349,7 @@ static struct rtable *__rt_cache_get_next(struct seq_file *seq,
                do {
                        if (--st->bucket < 0)
                                return NULL;
-                } while (!rcu_dereference_raw(rt_hash_table[st->bucket].chain));
+                } while (!rcu_access_pointer(rt_hash_table[st->bucket].chain));
                rcu_read_lock_bh();
                r = rcu_dereference_bh(rt_hash_table[st->bucket].chain);
        }
@@ -761,7 +760,7 @@ static void rt_do_flush(struct net *net, int process_context)
                if (process_context && need_resched())
                        cond_resched();
-                rth = rcu_dereference_raw(rt_hash_table[i].chain);
+                rth = rcu_access_pointer(rt_hash_table[i].chain);
                if (!rth)
                        continue;
@@ -1305,11 +1304,42 @@ static void rt_del(unsigned hash, struct rtable *rt)
        spin_unlock_bh(rt_hash_lock_addr(hash));
 }
+static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
+{
+        struct rtable *rt = (struct rtable *) dst;
+        __be32 orig_gw = rt->rt_gateway;
+        struct neighbour *n, *old_n;
+        dst_confirm(&rt->dst);
+        rt->rt_gateway = peer->redirect_learned.a4;
+        n = ipv4_neigh_lookup(&rt->dst, &rt->rt_gateway);
+        if (IS_ERR(n))
+                return PTR_ERR(n);
+        old_n = xchg(&rt->dst._neighbour, n);
+        if (old_n)
+                neigh_release(old_n);
+        if (!n || !(n->nud_state & NUD_VALID)) {
+                if (n)
+                        neigh_event_send(n, NULL);
+                rt->rt_gateway = orig_gw;
+                return -EAGAIN;
+        } else {
+                rt->rt_flags |= RTCF_REDIRECTED;
+                call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
+        }
+        return 0;
+}
 /* called in rcu_read_lock() section */
 void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                    __be32 saddr, struct net_device *dev)
 {
+        int s, i;
        struct in_device *in_dev = __in_dev_get_rcu(dev);
+        __be32 skeys[2] = { saddr, 0 };
+        int    ikeys[2] = { dev->ifindex, 0 };
        struct inet_peer *peer;
        struct net *net;
@@ -1332,13 +1362,43 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                        goto reject_redirect;
        }
-        peer = inet_getpeer_v4(daddr, 1);
+        for (s = 0; s < 2; s++) {
-        if (peer) {
+                for (i = 0; i < 2; i++) {
-                peer->redirect_learned.a4 = new_gw;
+                        unsigned int hash;
+                        struct rtable __rcu **rthp;
+                        struct rtable *rt;
-                inet_putpeer(peer);
+                        hash = rt_hash(daddr, skeys[s], ikeys[i], rt_genid(net));
+                        rthp = &rt_hash_table[hash].chain;
-                atomic_inc(&__rt_peer_genid);
+                        while ((rt = rcu_dereference(*rthp)) != NULL) {
+                                rthp = &rt->dst.rt_next;
+                                if (rt->rt_key_dst != daddr ||
+                                    rt->rt_key_src != skeys[s] ||
+                                    rt->rt_oif != ikeys[i] ||
+                                    rt_is_input_route(rt) ||
+                                    rt_is_expired(rt) ||
+                                    !net_eq(dev_net(rt->dst.dev), net) ||
+                                    rt->dst.error ||
+                                    rt->dst.dev != dev ||
+                                    rt->rt_gateway != old_gw)
+                                        continue;
+                                if (!rt->peer)
+                                        rt_bind_peer(rt, rt->rt_dst, 1);
+                                peer = rt->peer;
+                                if (peer) {
+                                        if (peer->redirect_learned.a4 != new_gw) {
+                                                peer->redirect_learned.a4 = new_gw;
+                                                atomic_inc(&__rt_peer_genid);
+                                        }
+                                        check_peer_redir(&rt->dst, peer);
+                                }
+                        }
+                }
        }
        return;
@@ -1568,11 +1628,10 @@ unsigned short ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
                        est_mtu = mtu;
                        peer->pmtu_learned = mtu;
                        peer->pmtu_expires = pmtu_expires;
+                        atomic_inc(&__rt_peer_genid);
                }
                inet_putpeer(peer);
-                atomic_inc(&__rt_peer_genid);
        }
        return est_mtu ? : new_mtu;
 }
@@ -1625,33 +1684,6 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
        }
 }
-static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
-{
-        struct rtable *rt = (struct rtable *) dst;
-        __be32 orig_gw = rt->rt_gateway;
-        struct neighbour *n, *old_n;
-        dst_confirm(&rt->dst);
-        rt->rt_gateway = peer->redirect_learned.a4;
-        n = ipv4_neigh_lookup(&rt->dst, &rt->rt_gateway);
-        if (IS_ERR(n))
-                return PTR_ERR(n);
-        old_n = xchg(&rt->dst._neighbour, n);
-        if (old_n)
-                neigh_release(old_n);
-        if (!n || !(n->nud_state & NUD_VALID)) {
-                if (n)
-                        neigh_event_send(n, NULL);
-                rt->rt_gateway = orig_gw;
-                return -EAGAIN;
-        } else {
-                rt->rt_flags |= RTCF_REDIRECTED;
-                call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
-        }
-        return 0;
-}
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 {
@@ -2821,7 +2853,7 @@ static int rt_fill_info(struct net *net,
        struct rtable *rt = skb_rtable(skb);
        struct rtmsg *r;
        struct nlmsghdr *nlh;
-        long expires = 0;
+        unsigned long expires = 0;
        const struct inet_peer *peer = rt->peer;
        u32 id = 0, ts = 0, tsage = 0, error;
@@ -2878,8 +2910,12 @@ static int rt_fill_info(struct net *net,
                        tsage = get_seconds() - peer->tcp_ts_stamp;
                }
                expires = ACCESS_ONCE(peer->pmtu_expires);
-                if (expires)
+                if (expires) {
-                        expires -= jiffies;
+                        if (time_before(jiffies, expires))
+                                expires -= jiffies;
+                        else
+                                expires = 0;
+                }
        }
        if (rt_is_input_route(rt)) {
@@ -3121,13 +3157,6 @@ static ctl_table ipv4_route_table[] = {
                .proc_handler   = proc_dointvec_jiffies,
        },
        {
-                .procname       = "gc_interval",
-                .data           = &ip_rt_gc_interval,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_jiffies,
-        },
-        {
                .procname       = "redirect_load",
                .data           = &ip_rt_redirect_load,
                .maxlen         = sizeof(int),
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 3bc5c8f7c71b..90f6544c13e2 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -15,6 +15,7 @@
 #include <linux/random.h>
 #include <linux/cryptohash.h>
 #include <linux/kernel.h>
+#include <linux/export.h>
 #include <net/tcp.h>
 #include <net/route.h>
@@ -265,7 +266,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                             struct ip_options *opt)
 {
        struct tcp_options_received tcp_opt;
-        u8 *hash_location;
+        const u8 *hash_location;
        struct inet_request_sock *ireq;
        struct tcp_request_sock *treq;
        struct tcp_sock *tp = tcp_sk(sk);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 46febcacb729..34f5db1e1c8b 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -374,7 +374,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
        unsigned int mask;
        struct sock *sk = sock->sk;
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        sock_poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == TCP_LISTEN)
@@ -524,11 +524,11 @@ EXPORT_SYMBOL(tcp_ioctl);
 static inline void tcp_mark_push(struct tcp_sock *tp, struct sk_buff *skb)
 {
-        TCP_SKB_CB(skb)->flags |= TCPHDR_PSH;
+        TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
        tp->pushed_seq = tp->write_seq;
 }
-static inline int forced_push(struct tcp_sock *tp)
+static inline int forced_push(const struct tcp_sock *tp)
 {
        return after(tp->write_seq, tp->pushed_seq + (tp->max_window >> 1));
 }
@@ -540,7 +540,7 @@ static inline void skb_entail(struct sock *sk, struct sk_buff *skb)
        skb->csum    = 0;
        tcb->seq     = tcb->end_seq = tp->write_seq;
-        tcb->flags   = TCPHDR_ACK;
+        tcb->tcp_flags = TCPHDR_ACK;
        tcb->sacked  = 0;
        skb_header_release(skb);
        tcp_add_write_queue_tail(sk, skb);
@@ -813,7 +813,7 @@ new_segment:
                        goto wait_for_memory;
                if (can_coalesce) {
-                        skb_shinfo(skb)->frags[i - 1].size += copy;
+                        skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
                } else {
                        get_page(page);
                        skb_fill_page_desc(skb, i, page, offset, copy);
@@ -830,7 +830,7 @@ new_segment:
                skb_shinfo(skb)->gso_segs = 0;
                if (!copied)
-                        TCP_SKB_CB(skb)->flags &= ~TCPHDR_PSH;
+                        TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH;
                copied += copy;
                poffset += copy;
@@ -891,9 +891,9 @@ EXPORT_SYMBOL(tcp_sendpage);
 #define TCP_PAGE(sk)    (sk->sk_sndmsg_page)
 #define TCP_OFF(sk)     (sk->sk_sndmsg_off)
-static inline int select_size(struct sock *sk, int sg)
+static inline int select_size(const struct sock *sk, int sg)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        int tmp = tp->mss_cache;
        if (sg) {
@@ -1058,8 +1058,7 @@ new_segment:
                                /* Update the skb. */
                                if (merge) {
-                                        skb_shinfo(skb)->frags[i - 1].size +=
+                                        skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
-                                                                        copy;
                                } else {
                                        skb_fill_page_desc(skb, i, page, off, copy);
                                        if (TCP_PAGE(sk)) {
@@ -1074,7 +1073,7 @@ new_segment:
                        }
                        if (!copied)
-                                TCP_SKB_CB(skb)->flags &= ~TCPHDR_PSH;
+                                TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH;
                        tp->write_seq += copy;
                        TCP_SKB_CB(skb)->end_seq += copy;
@@ -1194,13 +1193,11 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
        struct tcp_sock *tp = tcp_sk(sk);
        int time_to_ack = 0;
-#if TCP_DEBUG
        struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
        WARN(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq),
             "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",
             tp->copied_seq, TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt);
-#endif
        if (inet_csk_ack_scheduled(sk)) {
                const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -2409,7 +2406,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
 int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                   unsigned int optlen)
 {
-        struct inet_connection_sock *icsk = inet_csk(sk);
+        const struct inet_connection_sock *icsk = inet_csk(sk);
        if (level != SOL_TCP)
                return icsk->icsk_af_ops->setsockopt(sk, level, optname,
@@ -2431,9 +2428,9 @@ EXPORT_SYMBOL(compat_tcp_setsockopt);
 #endif
 /* Return information about state of tcp endpoint in API format. */
-void tcp_get_info(struct sock *sk, struct tcp_info *info)
+void tcp_get_info(const struct sock *sk, struct tcp_info *info)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        const struct inet_connection_sock *icsk = inet_csk(sk);
        u32 now = tcp_time_stamp;
@@ -2455,8 +2452,10 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
                info->tcpi_rcv_wscale = tp->rx_opt.rcv_wscale;
        }
-        if (tp->ecn_flags&TCP_ECN_OK)
+        if (tp->ecn_flags & TCP_ECN_OK)
                info->tcpi_options |= TCPI_OPT_ECN;
+        if (tp->ecn_flags & TCP_ECN_SEEN)
+                info->tcpi_options |= TCPI_OPT_ECN_SEEN;
        info->tcpi_rto = jiffies_to_usecs(icsk->icsk_rto);
        info->tcpi_ato = jiffies_to_usecs(icsk->icsk_ack.ato);
@@ -2857,26 +2856,25 @@ EXPORT_SYMBOL(tcp_gro_complete);
 #ifdef CONFIG_TCP_MD5SIG
 static unsigned long tcp_md5sig_users;
-static struct tcp_md5sig_pool * __percpu *tcp_md5sig_pool;
+static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool;
 static DEFINE_SPINLOCK(tcp_md5sig_pool_lock);
-static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool * __percpu *pool)
+static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool __percpu *pool)
 {
        int cpu;
        for_each_possible_cpu(cpu) {
-                struct tcp_md5sig_pool *p = *per_cpu_ptr(pool, cpu);
+                struct tcp_md5sig_pool *p = per_cpu_ptr(pool, cpu);
-                if (p) {
-                        if (p->md5_desc.tfm)
+                if (p->md5_desc.tfm)
-                                crypto_free_hash(p->md5_desc.tfm);
+                        crypto_free_hash(p->md5_desc.tfm);
-                        kfree(p);
-                }
        }
        free_percpu(pool);
 }
 void tcp_free_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool * __percpu *pool = NULL;
+        struct tcp_md5sig_pool __percpu *pool = NULL;
        spin_lock_bh(&tcp_md5sig_pool_lock);
        if (--tcp_md5sig_users == 0) {
@@ -2889,30 +2887,24 @@ void tcp_free_md5sig_pool(void)
 }
 EXPORT_SYMBOL(tcp_free_md5sig_pool);
-static struct tcp_md5sig_pool * __percpu *
+static struct tcp_md5sig_pool __percpu *
 __tcp_alloc_md5sig_pool(struct sock *sk)
 {
        int cpu;
-        struct tcp_md5sig_pool * __percpu *pool;
+        struct tcp_md5sig_pool __percpu *pool;
-        pool = alloc_percpu(struct tcp_md5sig_pool *);
+        pool = alloc_percpu(struct tcp_md5sig_pool);
        if (!pool)
                return NULL;
        for_each_possible_cpu(cpu) {
-                struct tcp_md5sig_pool *p;
                struct crypto_hash *hash;
-                p = kzalloc(sizeof(*p), sk->sk_allocation);
-                if (!p)
-                        goto out_free;
-                *per_cpu_ptr(pool, cpu) = p;
                hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
                if (!hash || IS_ERR(hash))
                        goto out_free;
-                p->md5_desc.tfm = hash;
+                per_cpu_ptr(pool, cpu)->md5_desc.tfm = hash;
        }
        return pool;
 out_free:
@@ -2920,9 +2912,9 @@ out_free:
        return NULL;
 }
-struct tcp_md5sig_pool * __percpu *tcp_alloc_md5sig_pool(struct sock *sk)
+struct tcp_md5sig_pool __percpu *tcp_alloc_md5sig_pool(struct sock *sk)
 {
-        struct tcp_md5sig_pool * __percpu *pool;
+        struct tcp_md5sig_pool __percpu *pool;
        int alloc = 0;
 retry:
@@ -2941,7 +2933,7 @@ retry:
        if (alloc) {
                /* we cannot hold spinlock here because this may sleep. */
-                struct tcp_md5sig_pool * __percpu *p;
+                struct tcp_md5sig_pool __percpu *p;
                p = __tcp_alloc_md5sig_pool(sk);
                spin_lock_bh(&tcp_md5sig_pool_lock);
@@ -2974,7 +2966,7 @@ EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
 */
 struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool * __percpu *p;
+        struct tcp_md5sig_pool __percpu *p;
        local_bh_disable();
@@ -2985,7 +2977,7 @@ struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
        spin_unlock(&tcp_md5sig_pool_lock);
        if (p)
-                return *this_cpu_ptr(p);
+                return this_cpu_ptr(p);
        local_bh_enable();
        return NULL;
@@ -3000,23 +2992,25 @@ void tcp_put_md5sig_pool(void)
 EXPORT_SYMBOL(tcp_put_md5sig_pool);
 int tcp_md5_hash_header(struct tcp_md5sig_pool *hp,
-                        struct tcphdr *th)
+                        const struct tcphdr *th)
 {
        struct scatterlist sg;
+        struct tcphdr hdr;
        int err;
-        __sum16 old_checksum = th->check;
+        /* We are not allowed to change tcphdr, make a local copy */
-        th->check = 0;
+        memcpy(&hdr, th, sizeof(hdr));
+        hdr.check = 0;
        /* options aren't included in the hash */
-        sg_init_one(&sg, th, sizeof(struct tcphdr));
+        sg_init_one(&sg, &hdr, sizeof(hdr));
-        err = crypto_hash_update(&hp->md5_desc, &sg, sizeof(struct tcphdr));
+        err = crypto_hash_update(&hp->md5_desc, &sg, sizeof(hdr));
-        th->check = old_checksum;
        return err;
 }
 EXPORT_SYMBOL(tcp_md5_hash_header);
 int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
-                          struct sk_buff *skb, unsigned header_len)
+                          const struct sk_buff *skb, unsigned int header_len)
 {
        struct scatterlist sg;
        const struct tcphdr *tp = tcp_hdr(skb);
@@ -3035,8 +3029,9 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
        for (i = 0; i < shi->nr_frags; ++i) {
                const struct skb_frag_struct *f = &shi->frags[i];
-                sg_set_page(&sg, f->page, f->size, f->page_offset);
+                struct page *page = skb_frag_page(f);
-                if (crypto_hash_update(desc, &sg, f->size))
+                sg_set_page(&sg, page, skb_frag_size(f), f->page_offset);
+                if (crypto_hash_update(desc, &sg, skb_frag_size(f)))
                        return 1;
        }
@@ -3048,7 +3043,7 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
 }
 EXPORT_SYMBOL(tcp_md5_hash_skb_data);
-int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, struct tcp_md5sig_key *key)
+int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key)
 {
        struct scatterlist sg;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index ea0d2183df4b..52b5c2d0ecd0 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -206,7 +206,7 @@ static inline void TCP_ECN_queue_cwr(struct tcp_sock *tp)
                tp->ecn_flags |= TCP_ECN_QUEUE_CWR;
 }
-static inline void TCP_ECN_accept_cwr(struct tcp_sock *tp, struct sk_buff *skb)
+static inline void TCP_ECN_accept_cwr(struct tcp_sock *tp, const struct sk_buff *skb)
 {
        if (tcp_hdr(skb)->cwr)
                tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
@@ -217,32 +217,41 @@ static inline void TCP_ECN_withdraw_cwr(struct tcp_sock *tp)
        tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
 }
-static inline void TCP_ECN_check_ce(struct tcp_sock *tp, struct sk_buff *skb)
+static inline void TCP_ECN_check_ce(struct tcp_sock *tp, const struct sk_buff *skb)
 {
-        if (tp->ecn_flags & TCP_ECN_OK) {
+        if (!(tp->ecn_flags & TCP_ECN_OK))
-                if (INET_ECN_is_ce(TCP_SKB_CB(skb)->flags))
+                return;
-                        tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
+        switch (TCP_SKB_CB(skb)->ip_dsfield & INET_ECN_MASK) {
+        case INET_ECN_NOT_ECT:
                /* Funny extension: if ECT is not set on a segment,
-                 * it is surely retransmit. It is not in ECN RFC,
+                 * and we already seen ECT on a previous segment,
-                 * but Linux follows this rule. */
+                 * it is probably a retransmit.
-                else if (INET_ECN_is_not_ect((TCP_SKB_CB(skb)->flags)))
+                 */
+                if (tp->ecn_flags & TCP_ECN_SEEN)
                        tcp_enter_quickack_mode((struct sock *)tp);
+                break;
+        case INET_ECN_CE:
+                tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
+                /* fallinto */
+        default:
+                tp->ecn_flags |= TCP_ECN_SEEN;
        }
 }
-static inline void TCP_ECN_rcv_synack(struct tcp_sock *tp, struct tcphdr *th)
+static inline void TCP_ECN_rcv_synack(struct tcp_sock *tp, const struct tcphdr *th)
 {
        if ((tp->ecn_flags & TCP_ECN_OK) && (!th->ece || th->cwr))
                tp->ecn_flags &= ~TCP_ECN_OK;
 }
-static inline void TCP_ECN_rcv_syn(struct tcp_sock *tp, struct tcphdr *th)
+static inline void TCP_ECN_rcv_syn(struct tcp_sock *tp, const struct tcphdr *th)
 {
        if ((tp->ecn_flags & TCP_ECN_OK) && (!th->ece || !th->cwr))
                tp->ecn_flags &= ~TCP_ECN_OK;
 }
-static inline int TCP_ECN_rcv_ecn_echo(struct tcp_sock *tp, struct tcphdr *th)
+static inline int TCP_ECN_rcv_ecn_echo(const struct tcp_sock *tp, const struct tcphdr *th)
 {
        if (th->ece && !th->syn && (tp->ecn_flags & TCP_ECN_OK))
                return 1;
@@ -256,14 +265,11 @@ static inline int TCP_ECN_rcv_ecn_echo(struct tcp_sock *tp, struct tcphdr *th)
 static void tcp_fixup_sndbuf(struct sock *sk)
 {
-        int sndmem = tcp_sk(sk)->rx_opt.mss_clamp + MAX_TCP_HEADER + 16 +
+        int sndmem = SKB_TRUESIZE(tcp_sk(sk)->rx_opt.mss_clamp + MAX_TCP_HEADER);
-                     sizeof(struct sk_buff);
-        if (sk->sk_sndbuf < 3 * sndmem) {
+        sndmem *= TCP_INIT_CWND;
-                sk->sk_sndbuf = 3 * sndmem;
+        if (sk->sk_sndbuf < sndmem)
-                if (sk->sk_sndbuf > sysctl_tcp_wmem[2])
+                sk->sk_sndbuf = min(sndmem, sysctl_tcp_wmem[2]);
-                        sk->sk_sndbuf = sysctl_tcp_wmem[2];
-        }
 }
 /* 2. Tuning advertised window (window_clamp, rcv_ssthresh)
@@ -309,7 +315,7 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb)
        return 0;
 }
-static void tcp_grow_window(struct sock *sk, struct sk_buff *skb)
+static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -339,17 +345,24 @@ static void tcp_grow_window(struct sock *sk, struct sk_buff *skb)
 static void tcp_fixup_rcvbuf(struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        u32 mss = tcp_sk(sk)->advmss;
-        int rcvmem = tp->advmss + MAX_TCP_HEADER + 16 + sizeof(struct sk_buff);
+        u32 icwnd = TCP_DEFAULT_INIT_RCVWND;
+        int rcvmem;
-        /* Try to select rcvbuf so that 4 mss-sized segments
+        /* Limit to 10 segments if mss <= 1460,
-         * will fit to window and corresponding skbs will fit to our rcvbuf.
+         * or 14600/mss segments, with a minimum of two segments.
-         * (was 3; 4 is minimum to allow fast retransmit to work.)
         */
-        while (tcp_win_from_space(rcvmem) < tp->advmss)
+        if (mss > 1460)
+                icwnd = max_t(u32, (1460 * TCP_DEFAULT_INIT_RCVWND) / mss, 2);
+        rcvmem = SKB_TRUESIZE(mss + MAX_TCP_HEADER);
+        while (tcp_win_from_space(rcvmem) < mss)
                rcvmem += 128;
-        if (sk->sk_rcvbuf < 4 * rcvmem)
-                sk->sk_rcvbuf = min(4 * rcvmem, sysctl_tcp_rmem[2]);
+        rcvmem *= icwnd;
+        if (sk->sk_rcvbuf < rcvmem)
+                sk->sk_rcvbuf = min(rcvmem, sysctl_tcp_rmem[2]);
 }
 /* 4. Try to fixup all. It is made immediately after connection enters
@@ -416,7 +429,7 @@ static void tcp_clamp_window(struct sock *sk)
 */
 void tcp_initialize_rcv_mss(struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        unsigned int hint = min_t(unsigned int, tp->advmss, tp->mss_cache);
        hint = min(hint, tp->rcv_wnd / 2);
@@ -531,8 +544,7 @@ void tcp_rcv_space_adjust(struct sock *sk)
                        space /= tp->advmss;
                        if (!space)
                                space = 1;
-                        rcvmem = (tp->advmss + MAX_TCP_HEADER +
+                        rcvmem = SKB_TRUESIZE(tp->advmss + MAX_TCP_HEADER);
-                                  16 + sizeof(struct sk_buff));
                        while (tcp_win_from_space(rcvmem) < tp->advmss)
                                rcvmem += 128;
                        space *= rcvmem;
@@ -812,7 +824,7 @@ void tcp_update_metrics(struct sock *sk)
        }
 }
-__u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst)
+__u32 tcp_init_cwnd(const struct tcp_sock *tp, const struct dst_entry *dst)
 {
        __u32 cwnd = (dst ? dst_metric(dst, RTAX_INITCWND) : 0);
@@ -1124,7 +1136,7 @@ static int tcp_is_sackblock_valid(struct tcp_sock *tp, int is_dsack,
                return 0;
        /* ...Then it's D-SACK, and must reside below snd_una completely */
-        if (!after(end_seq, tp->snd_una))
+        if (after(end_seq, tp->snd_una))
                return 0;
        if (!before(start_seq, tp->undo_marker))
@@ -1204,7 +1216,7 @@ static void tcp_mark_lost_retrans(struct sock *sk)
                tp->lost_retrans_low = new_low_seq;
 }
-static int tcp_check_dsack(struct sock *sk, struct sk_buff *ack_skb,
+static int tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb,
                           struct tcp_sack_block_wire *sp, int num_sacks,
                           u32 prior_snd_una)
 {
@@ -1298,7 +1310,7 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
        return in_sack;
 }
-static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
+static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
                          struct tcp_sacktag_state *state,
                          int dup_sack, int pcount)
 {
@@ -1389,9 +1401,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
        BUG_ON(!pcount);
-        /* Tweak before seqno plays */
+        if (skb == tp->lost_skb_hint)
-        if (!tcp_is_fack(tp) && tcp_is_sack(tp) && tp->lost_skb_hint &&
-            !before(TCP_SKB_CB(tp->lost_skb_hint)->seq, TCP_SKB_CB(skb)->seq))
                tp->lost_cnt_hint += pcount;
        TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1440,7 +1450,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                tp->lost_cnt_hint -= tcp_skb_pcount(prev);
        }
-        TCP_SKB_CB(skb)->flags |= TCP_SKB_CB(prev)->flags;
+        TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(prev)->tcp_flags;
        if (skb == tcp_highest_sack(sk))
                tcp_advance_highest_sack(sk, skb);
@@ -1455,13 +1465,13 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 /* I wish gso_size would have a bit more sane initialization than
 * something-or-zero which complicates things
 */
-static int tcp_skb_seglen(struct sk_buff *skb)
+static int tcp_skb_seglen(const struct sk_buff *skb)
 {
        return tcp_skb_pcount(skb) == 1 ? skb->len : tcp_skb_mss(skb);
 }
 /* Shifting pages past head area doesn't work */
-static int skb_can_shift(struct sk_buff *skb)
+static int skb_can_shift(const struct sk_buff *skb)
 {
        return !skb_headlen(skb) && skb_is_nonlinear(skb);
 }
@@ -1710,19 +1720,19 @@ static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
        return skb;
 }
-static int tcp_sack_cache_ok(struct tcp_sock *tp, struct tcp_sack_block *cache)
+static int tcp_sack_cache_ok(const struct tcp_sock *tp, const struct tcp_sack_block *cache)
 {
        return cache < tp->recv_sack_cache + ARRAY_SIZE(tp->recv_sack_cache);
 }
 static int
-tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb,
+tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                        u32 prior_snd_una)
 {
        const struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
-        unsigned char *ptr = (skb_transport_header(ack_skb) +
+        const unsigned char *ptr = (skb_transport_header(ack_skb) +
-                              TCP_SKB_CB(ack_skb)->sacked);
+                                    TCP_SKB_CB(ack_skb)->sacked);
        struct tcp_sack_block_wire *sp_wire = (struct tcp_sack_block_wire *)(ptr+2);
        struct tcp_sack_block sp[TCP_NUM_SACKS];
        struct tcp_sack_block *cache;
@@ -2286,7 +2296,7 @@ static int tcp_check_sack_reneging(struct sock *sk, int flag)
        return 0;
 }
-static inline int tcp_fackets_out(struct tcp_sock *tp)
+static inline int tcp_fackets_out(const struct tcp_sock *tp)
 {
        return tcp_is_reno(tp) ? tp->sacked_out + 1 : tp->fackets_out;
 }
@@ -2306,19 +2316,20 @@ static inline int tcp_fackets_out(struct tcp_sock *tp)
 * they differ. Since neither occurs due to loss, TCP should really
 * ignore them.
 */
-static inline int tcp_dupack_heuristics(struct tcp_sock *tp)
+static inline int tcp_dupack_heuristics(const struct tcp_sock *tp)
 {
        return tcp_is_fack(tp) ? tp->fackets_out : tp->sacked_out + 1;
 }
-static inline int tcp_skb_timedout(struct sock *sk, struct sk_buff *skb)
+static inline int tcp_skb_timedout(const struct sock *sk,
+                                   const struct sk_buff *skb)
 {
        return tcp_time_stamp - TCP_SKB_CB(skb)->when > inet_csk(sk)->icsk_rto;
 }
-static inline int tcp_head_timedout(struct sock *sk)
+static inline int tcp_head_timedout(const struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        return tp->packets_out &&
               tcp_skb_timedout(sk, tcp_write_queue_head(sk));
@@ -2629,7 +2640,7 @@ static void tcp_cwnd_down(struct sock *sk, int flag)
 /* Nothing was retransmitted or returned timestamp is less
 * than timestamp of the first retransmission.
 */
-static inline int tcp_packet_delayed(struct tcp_sock *tp)
+static inline int tcp_packet_delayed(const struct tcp_sock *tp)
 {
        return !tp->retrans_stamp ||
                (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
@@ -2690,7 +2701,7 @@ static void tcp_undo_cwr(struct sock *sk, const bool undo_ssthresh)
        tp->snd_cwnd_stamp = tcp_time_stamp;
 }
-static inline int tcp_may_undo(struct tcp_sock *tp)
+static inline int tcp_may_undo(const struct tcp_sock *tp)
 {
        return tp->undo_marker && (!tp->undo_retrans || tcp_packet_delayed(tp));
 }
@@ -2754,9 +2765,9 @@ static void tcp_try_undo_dsack(struct sock *sk)
 * that successive retransmissions of a segment must not advance
 * retrans_stamp under any conditions.
 */
-static int tcp_any_retrans_done(struct sock *sk)
+static int tcp_any_retrans_done(const struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *skb;
        if (tp->retrans_out)
@@ -2830,9 +2841,13 @@ static int tcp_try_undo_loss(struct sock *sk)
 static inline void tcp_complete_cwr(struct sock *sk)
 {
        struct tcp_sock *tp = tcp_sk(sk);
-        /* Do not moderate cwnd if it's already undone in cwr or recovery */
-        if (tp->undo_marker && tp->snd_cwnd > tp->snd_ssthresh) {
+        /* Do not moderate cwnd if it's already undone in cwr or recovery. */
-                tp->snd_cwnd = tp->snd_ssthresh;
+        if (tp->undo_marker) {
+                if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR)
+                        tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+                else /* PRR */
+                        tp->snd_cwnd = tp->snd_ssthresh;
                tp->snd_cwnd_stamp = tcp_time_stamp;
        }
        tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
@@ -2950,6 +2965,38 @@ void tcp_simple_retransmit(struct sock *sk)
 }
 EXPORT_SYMBOL(tcp_simple_retransmit);
+/* This function implements the PRR algorithm, specifcally the PRR-SSRB
+ * (proportional rate reduction with slow start reduction bound) as described in
+ * http://www.ietf.org/id/draft-mathis-tcpm-proportional-rate-reduction-01.txt.
+ * It computes the number of packets to send (sndcnt) based on packets newly
+ * delivered:
+ *   1) If the packets in flight is larger than ssthresh, PRR spreads the
+ *      cwnd reductions across a full RTT.
+ *   2) If packets in flight is lower than ssthresh (such as due to excess
+ *      losses and/or application stalls), do not perform any further cwnd
+ *      reductions, but instead slow start up to ssthresh.
+ */
+static void tcp_update_cwnd_in_recovery(struct sock *sk, int newly_acked_sacked,
+                                        int fast_rexmit, int flag)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int sndcnt = 0;
+        int delta = tp->snd_ssthresh - tcp_packets_in_flight(tp);
+        if (tcp_packets_in_flight(tp) > tp->snd_ssthresh) {
+                u64 dividend = (u64)tp->snd_ssthresh * tp->prr_delivered +
+                               tp->prior_cwnd - 1;
+                sndcnt = div_u64(dividend, tp->prior_cwnd) - tp->prr_out;
+        } else {
+                sndcnt = min_t(int, delta,
+                               max_t(int, tp->prr_delivered - tp->prr_out,
+                                     newly_acked_sacked) + 1);
+        }
+        sndcnt = max(sndcnt, (fast_rexmit ? 1 : 0));
+        tp->snd_cwnd = tcp_packets_in_flight(tp) + sndcnt;
+}
 /* Process an event, which can update packets-in-flight not trivially.
 * Main goal of this function is to calculate new estimate for left_out,
 * taking into account both packets sitting in receiver's buffer and
@@ -2961,7 +3008,8 @@ EXPORT_SYMBOL(tcp_simple_retransmit);
 * It does _not_ decide what to send, it is made in function
 * tcp_xmit_retransmit_queue().
 */
-static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
+static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
+                                  int newly_acked_sacked, int flag)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
@@ -3111,13 +3159,17 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
                tp->bytes_acked = 0;
                tp->snd_cwnd_cnt = 0;
+                tp->prior_cwnd = tp->snd_cwnd;
+                tp->prr_delivered = 0;
+                tp->prr_out = 0;
                tcp_set_ca_state(sk, TCP_CA_Recovery);
                fast_rexmit = 1;
        }
        if (do_lost || (tcp_is_fack(tp) && tcp_head_timedout(sk)))
                tcp_update_scoreboard(sk, fast_rexmit);
-        tcp_cwnd_down(sk, flag);
+        tp->prr_delivered += newly_acked_sacked;
+        tcp_update_cwnd_in_recovery(sk, newly_acked_sacked, fast_rexmit, flag);
        tcp_xmit_retransmit_queue(sk);
 }
@@ -3194,7 +3246,7 @@ static void tcp_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 */
 static void tcp_rearm_rto(struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        if (!tp->packets_out) {
                inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
@@ -3298,7 +3350,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                 * connection startup slow start one packet too
                 * quickly.  This is severely frowned upon behavior.
                 */
-                if (!(scb->flags & TCPHDR_SYN)) {
+                if (!(scb->tcp_flags & TCPHDR_SYN)) {
                        flag |= FLAG_DATA_ACKED;
                } else {
                        flag |= FLAG_SYN_ACKED;
@@ -3446,7 +3498,7 @@ static inline int tcp_may_update_window(const struct tcp_sock *tp,
 * Window update algorithm, described in RFC793/RFC1122 (used in linux-2.2
 * and in FreeBSD. NetBSD's one is even worse.) is wrong.
 */
-static int tcp_ack_update_window(struct sock *sk, struct sk_buff *skb, u32 ack,
+static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32 ack,
                                 u32 ack_seq)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -3622,7 +3674,7 @@ static int tcp_process_frto(struct sock *sk, int flag)
 }
 /* This routine deals with incoming acks, but not outgoing ones. */
-static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
+static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
@@ -3632,6 +3684,8 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
        u32 prior_in_flight;
        u32 prior_fackets;
        int prior_packets;
+        int prior_sacked = tp->sacked_out;
+        int newly_acked_sacked = 0;
        int frto_cwnd = 0;
        /* If the ack is older than previous acks
@@ -3703,6 +3757,9 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
        /* See if we can take anything off of the retransmit queue. */
        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una);
+        newly_acked_sacked = (prior_packets - prior_sacked) -
+                             (tp->packets_out - tp->sacked_out);
        if (tp->frto_counter)
                frto_cwnd = tcp_process_frto(sk, flag);
        /* Guarantee sacktag reordering detection against wrap-arounds */
@@ -3715,7 +3772,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
                    tcp_may_raise_cwnd(sk, flag))
                        tcp_cong_avoid(sk, ack, prior_in_flight);
                tcp_fastretrans_alert(sk, prior_packets - tp->packets_out,
-                                      flag);
+                                      newly_acked_sacked, flag);
        } else {
                if ((flag & FLAG_DATA_ACKED) && !frto_cwnd)
                        tcp_cong_avoid(sk, ack, prior_in_flight);
@@ -3754,14 +3811,14 @@ old_ack:
 * But, this can also be called on packets in the established flow when
 * the fast version below fails.
 */
-void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
+void tcp_parse_options(const struct sk_buff *skb, struct tcp_options_received *opt_rx,
-                       u8 **hvpp, int estab)
+                       const u8 **hvpp, int estab)
 {
-        unsigned char *ptr;
+        const unsigned char *ptr;
-        struct tcphdr *th = tcp_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
        int length = (th->doff * 4) - sizeof(struct tcphdr);
-        ptr = (unsigned char *)(th + 1);
+        ptr = (const unsigned char *)(th + 1);
        opt_rx->saw_tstamp = 0;
        while (length > 0) {
@@ -3872,9 +3929,9 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
 }
 EXPORT_SYMBOL(tcp_parse_options);
-static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, struct tcphdr *th)
+static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, const struct tcphdr *th)
 {
-        __be32 *ptr = (__be32 *)(th + 1);
+        const __be32 *ptr = (const __be32 *)(th + 1);
        if (*ptr == htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
                          | (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP)) {
@@ -3891,8 +3948,9 @@ static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, struct tcphdr *th)
 /* Fast parse options. This hopes to only see timestamps.
 * If it is wrong it falls back on tcp_parse_options().
 */
-static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
+static int tcp_fast_parse_options(const struct sk_buff *skb,
-                                  struct tcp_sock *tp, u8 **hvpp)
+                                  const struct tcphdr *th,
+                                  struct tcp_sock *tp, const u8 **hvpp)
 {
        /* In the spirit of fast parsing, compare doff directly to constant
         * values.  Because equality is used, short doff can be ignored here.
@@ -3913,10 +3971,10 @@ static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
 /*
 * Parse MD5 Signature option
 */
-u8 *tcp_parse_md5sig_option(struct tcphdr *th)
+const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
 {
-        int length = (th->doff << 2) - sizeof (*th);
+        int length = (th->doff << 2) - sizeof(*th);
-        u8 *ptr = (u8*)(th + 1);
+        const u8 *ptr = (const u8 *)(th + 1);
        /* If the TCP option is too short, we can short cut */
        if (length < TCPOLEN_MD5SIG)
@@ -3993,8 +4051,8 @@ static inline void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq)
 static int tcp_disordered_ack(const struct sock *sk, const struct sk_buff *skb)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
-        struct tcphdr *th = tcp_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
        u32 seq = TCP_SKB_CB(skb)->seq;
        u32 ack = TCP_SKB_CB(skb)->ack_seq;
@@ -4033,7 +4091,7 @@ static inline int tcp_paws_discard(const struct sock *sk,
 * (borrowed from freebsd)
 */
-static inline int tcp_sequence(struct tcp_sock *tp, u32 seq, u32 end_seq)
+static inline int tcp_sequence(const struct tcp_sock *tp, u32 seq, u32 end_seq)
 {
        return  !before(end_seq, tp->rcv_wup) &&
                !after(seq, tp->rcv_nxt + tcp_receive_window(tp));
@@ -4078,7 +4136,7 @@ static void tcp_reset(struct sock *sk)
 *
 *      If we are in FINWAIT-2, a received FIN moves us to TIME-WAIT.
 */
-static void tcp_fin(struct sk_buff *skb, struct sock *sk, struct tcphdr *th)
+static void tcp_fin(struct sock *sk)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -4190,7 +4248,7 @@ static void tcp_dsack_extend(struct sock *sk, u32 seq, u32 end_seq)
                tcp_sack_extend(tp->duplicate_sack, seq, end_seq);
 }
-static void tcp_send_dupack(struct sock *sk, struct sk_buff *skb)
+static void tcp_send_dupack(struct sock *sk, const struct sk_buff *skb)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -4349,7 +4407,7 @@ static void tcp_ofo_queue(struct sock *sk)
                __skb_queue_tail(&sk->sk_receive_queue, skb);
                tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                if (tcp_hdr(skb)->fin)
-                        tcp_fin(skb, sk, tcp_hdr(skb));
+                        tcp_fin(sk);
        }
 }
@@ -4377,7 +4435,7 @@ static inline int tcp_try_rmem_schedule(struct sock *sk, unsigned int size)
 static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 {
-        struct tcphdr *th = tcp_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
        struct tcp_sock *tp = tcp_sk(sk);
        int eaten = -1;
@@ -4431,7 +4489,7 @@ queue_and_out:
                if (skb->len)
                        tcp_event_data_recv(sk, skb);
                if (th->fin)
-                        tcp_fin(skb, sk, th);
+                        tcp_fin(sk);
                if (!skb_queue_empty(&tp->out_of_order_queue)) {
                        tcp_ofo_queue(sk);
@@ -4861,9 +4919,9 @@ void tcp_cwnd_application_limited(struct sock *sk)
        tp->snd_cwnd_stamp = tcp_time_stamp;
 }
-static int tcp_should_expand_sndbuf(struct sock *sk)
+static int tcp_should_expand_sndbuf(const struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        /* If the user specified a specific send buffer setting, do
         * not modify it.
@@ -4897,8 +4955,10 @@ static void tcp_new_space(struct sock *sk)
        struct tcp_sock *tp = tcp_sk(sk);
        if (tcp_should_expand_sndbuf(sk)) {
-                int sndmem = max_t(u32, tp->rx_opt.mss_clamp, tp->mss_cache) +
+                int sndmem = SKB_TRUESIZE(max_t(u32,
-                        MAX_TCP_HEADER + 16 + sizeof(struct sk_buff);
+                                                tp->rx_opt.mss_clamp,
+                                                tp->mss_cache) +
+                                          MAX_TCP_HEADER);
                int demanded = max_t(unsigned int, tp->snd_cwnd,
                                     tp->reordering + 1);
                sndmem *= 2 * demanded;
@@ -4970,7 +5030,7 @@ static inline void tcp_ack_snd_check(struct sock *sk)
 *      either form (or just set the sysctl tcp_stdurg).
 */
-static void tcp_check_urg(struct sock *sk, struct tcphdr *th)
+static void tcp_check_urg(struct sock *sk, const struct tcphdr *th)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        u32 ptr = ntohs(th->urg_ptr);
@@ -5036,7 +5096,7 @@ static void tcp_check_urg(struct sock *sk, struct tcphdr *th)
 }
 /* This is the 'fast' part of urgent handling. */
-static void tcp_urg(struct sock *sk, struct sk_buff *skb, struct tcphdr *th)
+static void tcp_urg(struct sock *sk, struct sk_buff *skb, const struct tcphdr *th)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -5157,9 +5217,9 @@ out:
 * play significant role here.
 */
 static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
-                              struct tcphdr *th, int syn_inerr)
+                              const struct tcphdr *th, int syn_inerr)
 {
-        u8 *hash_location;
+        const u8 *hash_location;
        struct tcp_sock *tp = tcp_sk(sk);
        /* RFC1323: H1. Apply PAWS check first. */
@@ -5240,7 +5300,7 @@ discard:
 *      tcp_data_queue when everything is OK.
 */
 int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                        struct tcphdr *th, unsigned len)
+                        const struct tcphdr *th, unsigned int len)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        int res;
@@ -5451,9 +5511,9 @@ discard:
 EXPORT_SYMBOL(tcp_rcv_established);
 static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
-                                         struct tcphdr *th, unsigned len)
+                                         const struct tcphdr *th, unsigned int len)
 {
-        u8 *hash_location;
+        const u8 *hash_location;
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
        struct tcp_cookie_values *cvp = tp->cookie_values;
@@ -5728,7 +5788,7 @@ reset_and_undo:
 */
 int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
-                          struct tcphdr *th, unsigned len)
+                          const struct tcphdr *th, unsigned int len)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct inet_connection_sock *icsk = inet_csk(sk);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1c12b8ec849d..a9db4b1a2215 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -92,7 +92,7 @@ EXPORT_SYMBOL(sysctl_tcp_low_latency);
 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
                                                   __be32 addr);
 static int tcp_v4_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
-                               __be32 daddr, __be32 saddr, struct tcphdr *th);
+                               __be32 daddr, __be32 saddr, const struct tcphdr *th);
 #else
 static inline
 struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk, __be32 addr)
@@ -104,7 +104,7 @@ struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk, __be32 addr)
 struct inet_hashinfo tcp_hashinfo;
 EXPORT_SYMBOL(tcp_hashinfo);
-static inline __u32 tcp_v4_init_sequence(struct sk_buff *skb)
+static inline __u32 tcp_v4_init_sequence(const struct sk_buff *skb)
 {
        return secure_tcp_sequence_number(ip_hdr(skb)->daddr,
                                          ip_hdr(skb)->saddr,
@@ -552,7 +552,7 @@ static void __tcp_v4_send_check(struct sk_buff *skb,
 /* This routine computes an IPv4 TCP checksum. */
 void tcp_v4_send_check(struct sock *sk, struct sk_buff *skb)
 {
-        struct inet_sock *inet = inet_sk(sk);
+        const struct inet_sock *inet = inet_sk(sk);
        __tcp_v4_send_check(skb, inet->inet_saddr, inet->inet_daddr);
 }
@@ -590,7 +590,7 @@ int tcp_v4_gso_send_check(struct sk_buff *skb)
 static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
 {
-        struct tcphdr *th = tcp_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
        struct {
                struct tcphdr th;
 #ifdef CONFIG_TCP_MD5SIG
@@ -652,6 +652,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
        arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
        net = dev_net(skb_dst(skb)->dev);
+        arg.tos = ip_hdr(skb)->tos;
        ip_send_reply(net->ipv4.tcp_sock, skb, ip_hdr(skb)->saddr,
                      &arg, arg.iov[0].iov_len);
@@ -666,9 +667,9 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
 static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
                            u32 win, u32 ts, int oif,
                            struct tcp_md5sig_key *key,
-                            int reply_flags)
+                            int reply_flags, u8 tos)
 {
-        struct tcphdr *th = tcp_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
        struct {
                struct tcphdr th;
                __be32 opt[(TCPOLEN_TSTAMP_ALIGNED >> 2)
@@ -726,7 +727,7 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
        arg.csumoffset = offsetof(struct tcphdr, check) / 2;
        if (oif)
                arg.bound_dev_if = oif;
+        arg.tos = tos;
        ip_send_reply(net->ipv4.tcp_sock, skb, ip_hdr(skb)->saddr,
                      &arg, arg.iov[0].iov_len);
@@ -743,7 +744,8 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
                        tcptw->tw_ts_recent,
                        tw->tw_bound_dev_if,
                        tcp_twsk_md5_key(tcptw),
-                        tw->tw_transparent ? IP_REPLY_ARG_NOSRCCHECK : 0
+                        tw->tw_transparent ? IP_REPLY_ARG_NOSRCCHECK : 0,
+                        tw->tw_tos
                        );
        inet_twsk_put(tw);
@@ -757,7 +759,8 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                        req->ts_recent,
                        0,
                        tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr),
-                        inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0);
+                        inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0,
+                        ip_hdr(skb)->tos);
 }
 /*
@@ -808,20 +811,38 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
        kfree(inet_rsk(req)->opt);
 }
-static void syn_flood_warning(const struct sk_buff *skb)
+/*
+ * Return 1 if a syncookie should be sent
+ */
+int tcp_syn_flood_action(struct sock *sk,
+                         const struct sk_buff *skb,
+                         const char *proto)
 {
-        const char *msg;
+        const char *msg = "Dropping request";
+        int want_cookie = 0;
+        struct listen_sock *lopt;
 #ifdef CONFIG_SYN_COOKIES
-        if (sysctl_tcp_syncookies)
+        if (sysctl_tcp_syncookies) {
                msg = "Sending cookies";
-        else
+                want_cookie = 1;
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES);
+        } else
 #endif
-                msg = "Dropping request";
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
-        pr_info("TCP: Possible SYN flooding on port %d. %s.\n",
+        lopt = inet_csk(sk)->icsk_accept_queue.listen_opt;
-                                ntohs(tcp_hdr(skb)->dest), msg);
+        if (!lopt->synflood_warned) {
+                lopt->synflood_warned = 1;
+                pr_info("%s: Possible SYN flooding on port %d. %s. "
+                        " Check SNMP counters.\n",
+                        proto, ntohs(tcp_hdr(skb)->dest), msg);
+        }
+        return want_cookie;
 }
+EXPORT_SYMBOL(tcp_syn_flood_action);
 /*
 * Save and compile IPv4 options into the request_sock if needed.
@@ -909,18 +930,21 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                        }
                        sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+                md5sig = tp->md5sig_info;
+                if (md5sig->entries4 == 0 &&
+                    tcp_alloc_md5sig_pool(sk) == NULL) {
                        kfree(newkey);
                        return -ENOMEM;
                }
-                md5sig = tp->md5sig_info;
                if (md5sig->alloced4 == md5sig->entries4) {
                        keys = kmalloc((sizeof(*keys) *
                                        (md5sig->entries4 + 1)), GFP_ATOMIC);
                        if (!keys) {
                                kfree(newkey);
-                                tcp_free_md5sig_pool();
+                                if (md5sig->entries4 == 0)
+                                        tcp_free_md5sig_pool();
                                return -ENOMEM;
                        }
@@ -964,6 +988,7 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                kfree(tp->md5sig_info->keys4);
                                tp->md5sig_info->keys4 = NULL;
                                tp->md5sig_info->alloced4 = 0;
+                                tcp_free_md5sig_pool();
                        } else if (tp->md5sig_info->entries4 != i) {
                                /* Need to do some manipulation */
                                memmove(&tp->md5sig_info->keys4[i],
@@ -971,7 +996,6 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                        (tp->md5sig_info->entries4 - i) *
                                         sizeof(struct tcp4_md5sig_key));
                        }
-                        tcp_free_md5sig_pool();
                        return 0;
                }
        }
@@ -1069,7 +1093,7 @@ static int tcp_v4_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 }
 static int tcp_v4_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
-                               __be32 daddr, __be32 saddr, struct tcphdr *th)
+                               __be32 daddr, __be32 saddr, const struct tcphdr *th)
 {
        struct tcp_md5sig_pool *hp;
        struct hash_desc *desc;
@@ -1101,12 +1125,12 @@ clear_hash_noput:
 }
 int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
-                        struct sock *sk, struct request_sock *req,
+                        const struct sock *sk, const struct request_sock *req,
-                        struct sk_buff *skb)
+                        const struct sk_buff *skb)
 {
        struct tcp_md5sig_pool *hp;
        struct hash_desc *desc;
-        struct tcphdr *th = tcp_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
        __be32 saddr, daddr;
        if (sk) {
@@ -1151,7 +1175,7 @@ clear_hash_noput:
 }
 EXPORT_SYMBOL(tcp_v4_md5_hash_skb);
-static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
+static int tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 {
        /*
         * This gets called for each TCP segment that arrives
@@ -1161,10 +1185,10 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
         * o MD5 hash and we're not expecting one.
         * o MD5 hash and its wrong.
         */
-        __u8 *hash_location = NULL;
+        const __u8 *hash_location = NULL;
        struct tcp_md5sig_key *hash_expected;
        const struct iphdr *iph = ip_hdr(skb);
-        struct tcphdr *th = tcp_hdr(skb);
+        const struct tcphdr *th = tcp_hdr(skb);
        int genhash;
        unsigned char newhash[16];
@@ -1227,7 +1251,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
        struct tcp_extend_values tmp_ext;
        struct tcp_options_received tmp_opt;
-        u8 *hash_location;
+        const u8 *hash_location;
        struct request_sock *req;
        struct inet_request_sock *ireq;
        struct tcp_sock *tp = tcp_sk(sk);
@@ -1235,11 +1259,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
        __be32 saddr = ip_hdr(skb)->saddr;
        __be32 daddr = ip_hdr(skb)->daddr;
        __u32 isn = TCP_SKB_CB(skb)->when;
-#ifdef CONFIG_SYN_COOKIES
        int want_cookie = 0;
-#else
-#define want_cookie 0 /* Argh, why doesn't gcc optimize this :( */
-#endif
        /* Never answer to SYNs send to broadcast or multicast */
        if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -1250,14 +1270,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         * evidently real one.
         */
        if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
-                if (net_ratelimit())
+                want_cookie = tcp_syn_flood_action(sk, skb, "TCP");
-                        syn_flood_warning(skb);
+                if (!want_cookie)
-#ifdef CONFIG_SYN_COOKIES
+                        goto drop;
-                if (sysctl_tcp_syncookies) {
-                        want_cookie = 1;
-                } else
-#endif
-                goto drop;
        }
        /* Accept backlog is full. If we have already queued enough
@@ -1303,9 +1318,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                while (l-- > 0)
                        *c++ ^= *hash_location++;
-#ifdef CONFIG_SYN_COOKIES
                want_cookie = 0;        /* not our kind of cookie */
-#endif
                tmp_ext.cookie_out_never = 0; /* false */
                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
        } else if (!tp->rx_opt.cookie_in_always) {
@@ -1497,6 +1510,8 @@ exit:
        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
        return NULL;
 put_and_exit:
+        tcp_clear_xmit_timers(newsk);
+        bh_unlock_sock(newsk);
        sock_put(newsk);
        goto exit;
 }
@@ -1578,7 +1593,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
 #endif
        if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
-                sock_rps_save_rxhash(sk, skb->rxhash);
+                sock_rps_save_rxhash(sk, skb);
                if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
                        rsk = sk;
                        goto reset;
@@ -1595,7 +1610,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                        goto discard;
                if (nsk != sk) {
-                        sock_rps_save_rxhash(nsk, skb->rxhash);
+                        sock_rps_save_rxhash(nsk, skb);
                        if (tcp_child_process(sk, nsk, skb)) {
                                rsk = nsk;
                                goto reset;
@@ -1603,7 +1618,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                        return 0;
                }
        } else
-                sock_rps_save_rxhash(sk, skb->rxhash);
+                sock_rps_save_rxhash(sk, skb);
        if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len)) {
                rsk = sk;
@@ -1635,7 +1650,7 @@ EXPORT_SYMBOL(tcp_v4_do_rcv);
 int tcp_v4_rcv(struct sk_buff *skb)
 {
        const struct iphdr *iph;
-        struct tcphdr *th;
+        const struct tcphdr *th;
        struct sock *sk;
        int ret;
        struct net *net = dev_net(skb->dev);
@@ -1670,7 +1685,7 @@ int tcp_v4_rcv(struct sk_buff *skb)
                                    skb->len - th->doff * 4);
        TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
        TCP_SKB_CB(skb)->when    = 0;
-        TCP_SKB_CB(skb)->flags   = iph->tos;
+        TCP_SKB_CB(skb)->ip_dsfield = ipv4_get_dsfield(iph);
        TCP_SKB_CB(skb)->sacked  = 0;
        sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -1799,7 +1814,7 @@ EXPORT_SYMBOL(tcp_v4_get_peer);
 void *tcp_v4_tw_get_peer(struct sock *sk)
 {
-        struct inet_timewait_sock *tw = inet_twsk(sk);
+        const struct inet_timewait_sock *tw = inet_twsk(sk);
        return inet_getpeer_v4(tw->tw_daddr, 1);
 }
@@ -2326,7 +2341,7 @@ static void tcp_seq_stop(struct seq_file *seq, void *v)
        }
 }
-static int tcp_seq_open(struct inode *inode, struct file *file)
+int tcp_seq_open(struct inode *inode, struct file *file)
 {
        struct tcp_seq_afinfo *afinfo = PDE(inode)->data;
        struct tcp_iter_state *s;
@@ -2342,23 +2357,19 @@ static int tcp_seq_open(struct inode *inode, struct file *file)
        s->last_pos             = 0;
        return 0;
 }
+EXPORT_SYMBOL(tcp_seq_open);
 int tcp_proc_register(struct net *net, struct tcp_seq_afinfo *afinfo)
 {
        int rc = 0;
        struct proc_dir_entry *p;
-        afinfo->seq_fops.open           = tcp_seq_open;
-        afinfo->seq_fops.read           = seq_read;
-        afinfo->seq_fops.llseek         = seq_lseek;
-        afinfo->seq_fops.release        = seq_release_net;
        afinfo->seq_ops.start           = tcp_seq_start;
        afinfo->seq_ops.next            = tcp_seq_next;
        afinfo->seq_ops.stop            = tcp_seq_stop;
        p = proc_create_data(afinfo->name, S_IRUGO, net->proc_net,
-                             &afinfo->seq_fops, afinfo);
+                             afinfo->seq_fops, afinfo);
        if (!p)
                rc = -ENOMEM;
        return rc;
@@ -2371,7 +2382,7 @@ void tcp_proc_unregister(struct net *net, struct tcp_seq_afinfo *afinfo)
 }
 EXPORT_SYMBOL(tcp_proc_unregister);
-static void get_openreq4(struct sock *sk, struct request_sock *req,
+static void get_openreq4(const struct sock *sk, const struct request_sock *req,
                         struct seq_file *f, int i, int uid, int *len)
 {
        const struct inet_request_sock *ireq = inet_rsk(req);
@@ -2401,9 +2412,9 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
 {
        int timer_active;
        unsigned long timer_expires;
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        const struct inet_connection_sock *icsk = inet_csk(sk);
-        struct inet_sock *inet = inet_sk(sk);
+        const struct inet_sock *inet = inet_sk(sk);
        __be32 dest = inet->inet_daddr;
        __be32 src = inet->inet_rcv_saddr;
        __u16 destp = ntohs(inet->inet_dport);
@@ -2452,7 +2463,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                len);
 }
-static void get_timewait4_sock(struct inet_timewait_sock *tw,
+static void get_timewait4_sock(const struct inet_timewait_sock *tw,
                               struct seq_file *f, int i, int *len)
 {
        __be32 dest, src;
@@ -2507,12 +2518,18 @@ out:
        return 0;
 }
+static const struct file_operations tcp_afinfo_seq_fops = {
+        .owner   = THIS_MODULE,
+        .open    = tcp_seq_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = seq_release_net
+};
 static struct tcp_seq_afinfo tcp4_seq_afinfo = {
        .name           = "tcp",
        .family         = AF_INET,
-        .seq_fops       = {
+        .seq_fops       = &tcp_afinfo_seq_fops,
-                .owner          = THIS_MODULE,
-        },
        .seq_ops        = {
                .show           = tcp4_seq_show,
        },
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index d2fe4e06b472..66363b689ad6 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -141,7 +141,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
                           const struct tcphdr *th)
 {
        struct tcp_options_received tmp_opt;
-        u8 *hash_location;
+        const u8 *hash_location;
        struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
        int paws_reject = 0;
@@ -328,6 +328,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
                const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
+                tw->tw_transparent      = inet_sk(sk)->transparent;
                tw->tw_rcv_wscale       = tp->rx_opt.rcv_wscale;
                tcptw->tw_rcv_nxt       = tp->rcv_nxt;
                tcptw->tw_snd_nxt       = tp->snd_nxt;
@@ -344,6 +345,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                        tw6 = inet6_twsk((struct sock *)tw);
                        ipv6_addr_copy(&tw6->tw_v6_daddr, &np->daddr);
                        ipv6_addr_copy(&tw6->tw_v6_rcv_saddr, &np->rcv_saddr);
+                        tw->tw_tclass = np->tclass;
                        tw->tw_ipv6only = np->ipv6only;
                }
 #endif
@@ -566,7 +568,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                           struct request_sock **prev)
 {
        struct tcp_options_received tmp_opt;
-        u8 *hash_location;
+        const u8 *hash_location;
        struct sock *child;
        const struct tcphdr *th = tcp_hdr(skb);
        __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 882e0b0964d0..63170e297540 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -65,7 +65,7 @@ EXPORT_SYMBOL_GPL(sysctl_tcp_cookie_size);
 /* Account for new data that has been sent to the network. */
-static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
+static void tcp_event_new_data_sent(struct sock *sk, const struct sk_buff *skb)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        unsigned int prior_packets = tp->packets_out;
@@ -89,9 +89,9 @@ static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
 * Anything in between SND.UNA...SND.UNA+SND.WND also can be already
 * invalid. OK, let's make this for now:
 */
-static inline __u32 tcp_acceptable_seq(struct sock *sk)
+static inline __u32 tcp_acceptable_seq(const struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        if (!before(tcp_wnd_end(tp), tp->snd_nxt))
                return tp->snd_nxt;
@@ -116,7 +116,7 @@ static inline __u32 tcp_acceptable_seq(struct sock *sk)
 static __u16 tcp_advertise_mss(struct sock *sk)
 {
        struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
+        const struct dst_entry *dst = __sk_dst_get(sk);
        int mss = tp->advmss;
        if (dst) {
@@ -133,7 +133,7 @@ static __u16 tcp_advertise_mss(struct sock *sk)
 /* RFC2861. Reset CWND after idle period longer RTO to "restart window".
 * This is the first part of cwnd validation mechanism. */
-static void tcp_cwnd_restart(struct sock *sk, struct dst_entry *dst)
+static void tcp_cwnd_restart(struct sock *sk, const struct dst_entry *dst)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        s32 delta = tcp_time_stamp - tp->lsndtime;
@@ -154,7 +154,7 @@ static void tcp_cwnd_restart(struct sock *sk, struct dst_entry *dst)
 /* Congestion state accounting after a packet has been sent. */
 static void tcp_event_data_sent(struct tcp_sock *tp,
-                                struct sk_buff *skb, struct sock *sk)
+                                struct sock *sk)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
        const u32 now = tcp_time_stamp;
@@ -295,11 +295,11 @@ static u16 tcp_select_window(struct sock *sk)
 }
 /* Packet ECN state for a SYN-ACK */
-static inline void TCP_ECN_send_synack(struct tcp_sock *tp, struct sk_buff *skb)
+static inline void TCP_ECN_send_synack(const struct tcp_sock *tp, struct sk_buff *skb)
 {
-        TCP_SKB_CB(skb)->flags &= ~TCPHDR_CWR;
+        TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_CWR;
        if (!(tp->ecn_flags & TCP_ECN_OK))
-                TCP_SKB_CB(skb)->flags &= ~TCPHDR_ECE;
+                TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_ECE;
 }
 /* Packet ECN state for a SYN.  */
@@ -309,13 +309,13 @@ static inline void TCP_ECN_send_syn(struct sock *sk, struct sk_buff *skb)
        tp->ecn_flags = 0;
        if (sysctl_tcp_ecn == 1) {
-                TCP_SKB_CB(skb)->flags |= TCPHDR_ECE | TCPHDR_CWR;
+                TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ECE | TCPHDR_CWR;
                tp->ecn_flags = TCP_ECN_OK;
        }
 }
 static __inline__ void
-TCP_ECN_make_synack(struct request_sock *req, struct tcphdr *th)
+TCP_ECN_make_synack(const struct request_sock *req, struct tcphdr *th)
 {
        if (inet_rsk(req)->ecn_ok)
                th->ece = 1;
@@ -356,7 +356,7 @@ static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
        skb->ip_summed = CHECKSUM_PARTIAL;
        skb->csum = 0;
-        TCP_SKB_CB(skb)->flags = flags;
+        TCP_SKB_CB(skb)->tcp_flags = flags;
        TCP_SKB_CB(skb)->sacked = 0;
        skb_shinfo(skb)->gso_segs = 1;
@@ -565,7 +565,8 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
 */
 static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                struct tcp_out_options *opts,
-                                struct tcp_md5sig_key **md5) {
+                                struct tcp_md5sig_key **md5)
+{
        struct tcp_sock *tp = tcp_sk(sk);
        struct tcp_cookie_values *cvp = tp->cookie_values;
        unsigned remaining = MAX_TCP_OPTION_SPACE;
@@ -743,7 +744,8 @@ static unsigned tcp_synack_options(struct sock *sk,
 */
 static unsigned tcp_established_options(struct sock *sk, struct sk_buff *skb,
                                        struct tcp_out_options *opts,
-                                        struct tcp_md5sig_key **md5) {
+                                        struct tcp_md5sig_key **md5)
+{
        struct tcp_skb_cb *tcb = skb ? TCP_SKB_CB(skb) : NULL;
        struct tcp_sock *tp = tcp_sk(sk);
        unsigned size = 0;
@@ -826,7 +828,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
        tcb = TCP_SKB_CB(skb);
        memset(&opts, 0, sizeof(opts));
-        if (unlikely(tcb->flags & TCPHDR_SYN))
+        if (unlikely(tcb->tcp_flags & TCPHDR_SYN))
                tcp_options_size = tcp_syn_options(sk, skb, &opts, &md5);
        else
                tcp_options_size = tcp_established_options(sk, skb, &opts,
@@ -850,9 +852,9 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
        th->seq                 = htonl(tcb->seq);
        th->ack_seq             = htonl(tp->rcv_nxt);
        *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
-                                        tcb->flags);
+                                        tcb->tcp_flags);
-        if (unlikely(tcb->flags & TCPHDR_SYN)) {
+        if (unlikely(tcb->tcp_flags & TCPHDR_SYN)) {
                /* RFC1323: The window in SYN & SYN/ACK segments
                 * is never scaled.
                 */
@@ -875,7 +877,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
        }
        tcp_options_write((__be32 *)(th + 1), tp, &opts);
-        if (likely((tcb->flags & TCPHDR_SYN) == 0))
+        if (likely((tcb->tcp_flags & TCPHDR_SYN) == 0))
                TCP_ECN_send(sk, skb, tcp_header_size);
 #ifdef CONFIG_TCP_MD5SIG
@@ -889,11 +891,11 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
        icsk->icsk_af_ops->send_check(sk, skb);
-        if (likely(tcb->flags & TCPHDR_ACK))
+        if (likely(tcb->tcp_flags & TCPHDR_ACK))
                tcp_event_ack_sent(sk, tcp_skb_pcount(skb));
        if (skb->len != tcp_header_size)
-                tcp_event_data_sent(tp, skb, sk);
+                tcp_event_data_sent(tp, sk);
        if (after(tcb->end_seq, tp->snd_nxt) || tcb->seq == tcb->end_seq)
                TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS,
@@ -926,7 +928,7 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 }
 /* Initialize TSO segments for a packet. */
-static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
+static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                                 unsigned int mss_now)
 {
        if (skb->len <= mss_now || !sk_can_gso(sk) ||
@@ -947,7 +949,7 @@ static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
 /* When a modification to fackets out becomes necessary, we need to check
 * skb is counted to fackets_out or not.
 */
-static void tcp_adjust_fackets_out(struct sock *sk, struct sk_buff *skb,
+static void tcp_adjust_fackets_out(struct sock *sk, const struct sk_buff *skb,
                                   int decr)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -962,7 +964,7 @@ static void tcp_adjust_fackets_out(struct sock *sk, struct sk_buff *skb,
 /* Pcount in the middle of the write queue got changed, we need to do various
 * tweaks to fix counters
 */
-static void tcp_adjust_pcount(struct sock *sk, struct sk_buff *skb, int decr)
+static void tcp_adjust_pcount(struct sock *sk, const struct sk_buff *skb, int decr)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -1032,9 +1034,9 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
        TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
        /* PSH and FIN should only be set in the second packet. */
-        flags = TCP_SKB_CB(skb)->flags;
+        flags = TCP_SKB_CB(skb)->tcp_flags;
-        TCP_SKB_CB(skb)->flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
+        TCP_SKB_CB(skb)->tcp_flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
-        TCP_SKB_CB(buff)->flags = flags;
+        TCP_SKB_CB(buff)->tcp_flags = flags;
        TCP_SKB_CB(buff)->sacked = TCP_SKB_CB(skb)->sacked;
        if (!skb_shinfo(skb)->nr_frags && skb->ip_summed != CHECKSUM_PARTIAL) {
@@ -1094,14 +1096,16 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
        eat = len;
        k = 0;
        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                if (skb_shinfo(skb)->frags[i].size <= eat) {
+                int size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
-                        put_page(skb_shinfo(skb)->frags[i].page);
-                        eat -= skb_shinfo(skb)->frags[i].size;
+                if (size <= eat) {
+                        skb_frag_unref(skb, i);
+                        eat -= size;
                } else {
                        skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
                        if (eat) {
                                skb_shinfo(skb)->frags[k].page_offset += eat;
-                                skb_shinfo(skb)->frags[k].size -= eat;
+                                skb_frag_size_sub(&skb_shinfo(skb)->frags[k], eat);
                                eat = 0;
                        }
                        k++;
@@ -1144,10 +1148,10 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
 }
 /* Calculate MSS. Not accounting for SACKs here.  */
-int tcp_mtu_to_mss(struct sock *sk, int pmtu)
+int tcp_mtu_to_mss(const struct sock *sk, int pmtu)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
-        struct inet_connection_sock *icsk = inet_csk(sk);
+        const struct inet_connection_sock *icsk = inet_csk(sk);
        int mss_now;
        /* Calculate base mss without TCP options:
@@ -1173,10 +1177,10 @@ int tcp_mtu_to_mss(struct sock *sk, int pmtu)
 }
 /* Inverse of above */
-int tcp_mss_to_mtu(struct sock *sk, int mss)
+int tcp_mss_to_mtu(const struct sock *sk, int mss)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
-        struct inet_connection_sock *icsk = inet_csk(sk);
+        const struct inet_connection_sock *icsk = inet_csk(sk);
        int mtu;
        mtu = mss +
@@ -1250,8 +1254,8 @@ EXPORT_SYMBOL(tcp_sync_mss);
 */
 unsigned int tcp_current_mss(struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
+        const struct dst_entry *dst = __sk_dst_get(sk);
        u32 mss_now;
        unsigned header_len;
        struct tcp_out_options opts;
@@ -1311,10 +1315,10 @@ static void tcp_cwnd_validate(struct sock *sk)
 * modulo only when the receiver window alone is the limiting factor or
 * when we would be allowed to send the split-due-to-Nagle skb fully.
 */
-static unsigned int tcp_mss_split_point(struct sock *sk, struct sk_buff *skb,
+static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
                                        unsigned int mss_now, unsigned int cwnd)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        u32 needed, window, cwnd_len;
        window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
@@ -1334,13 +1338,14 @@ static unsigned int tcp_mss_split_point(struct sock *sk, struct sk_buff *skb,
 /* Can at least one segment of SKB be sent right now, according to the
 * congestion window rules?  If so, return how many segments are allowed.
 */
-static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp,
+static inline unsigned int tcp_cwnd_test(const struct tcp_sock *tp,
-                                         struct sk_buff *skb)
+                                         const struct sk_buff *skb)
 {
        u32 in_flight, cwnd;
        /* Don't be strict about the congestion window for the final FIN.  */
-        if ((TCP_SKB_CB(skb)->flags & TCPHDR_FIN) && tcp_skb_pcount(skb) == 1)
+        if ((TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) &&
+            tcp_skb_pcount(skb) == 1)
                return 1;
        in_flight = tcp_packets_in_flight(tp);
@@ -1355,7 +1360,7 @@ static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp,
 * This must be invoked the first time we consider transmitting
 * SKB onto the wire.
 */
-static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
+static int tcp_init_tso_segs(const struct sock *sk, struct sk_buff *skb,
                             unsigned int mss_now)
 {
        int tso_segs = tcp_skb_pcount(skb);
@@ -1377,7 +1382,7 @@ static inline int tcp_minshall_check(const struct tcp_sock *tp)
 /* Return 0, if packet can be sent now without violation Nagle's rules:
 * 1. It is full sized.
 * 2. Or it contains FIN. (already checked by caller)
- * 3. Or TCP_NODELAY was set.
+ * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
 * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
 *    With Minshall's modification: all sent small packets are ACKed.
 */
@@ -1393,7 +1398,7 @@ static inline int tcp_nagle_check(const struct tcp_sock *tp,
 /* Return non-zero if the Nagle test allows this packet to be
 * sent now.
 */
-static inline int tcp_nagle_test(struct tcp_sock *tp, struct sk_buff *skb,
+static inline int tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buff *skb,
                                 unsigned int cur_mss, int nonagle)
 {
        /* Nagle rule does not apply to frames, which sit in the middle of the
@@ -1409,7 +1414,7 @@ static inline int tcp_nagle_test(struct tcp_sock *tp, struct sk_buff *skb,
         * Nagle can be ignored during F-RTO too (see RFC4138).
         */
        if (tcp_urg_mode(tp) || (tp->frto_counter == 2) ||
-            (TCP_SKB_CB(skb)->flags & TCPHDR_FIN))
+            (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
                return 1;
        if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
@@ -1419,7 +1424,7 @@ static inline int tcp_nagle_test(struct tcp_sock *tp, struct sk_buff *skb,
 }
 /* Does at least the first segment of SKB fit into the send window? */
-static inline int tcp_snd_wnd_test(struct tcp_sock *tp, struct sk_buff *skb,
+static inline int tcp_snd_wnd_test(const struct tcp_sock *tp, const struct sk_buff *skb,
                                   unsigned int cur_mss)
 {
        u32 end_seq = TCP_SKB_CB(skb)->end_seq;
@@ -1434,10 +1439,10 @@ static inline int tcp_snd_wnd_test(struct tcp_sock *tp, struct sk_buff *skb,
 * should be put on the wire right now.  If so, it returns the number of
 * packets allowed by the congestion window.
 */
-static unsigned int tcp_snd_test(struct sock *sk, struct sk_buff *skb,
+static unsigned int tcp_snd_test(const struct sock *sk, struct sk_buff *skb,
                                 unsigned int cur_mss, int nonagle)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        unsigned int cwnd_quota;
        tcp_init_tso_segs(sk, skb, cur_mss);
@@ -1455,7 +1460,7 @@ static unsigned int tcp_snd_test(struct sock *sk, struct sk_buff *skb,
 /* Test if sending is allowed right now. */
 int tcp_may_send_now(struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *skb = tcp_send_head(sk);
        return skb &&
@@ -1497,9 +1502,9 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
        TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
        /* PSH and FIN should only be set in the second packet. */
-        flags = TCP_SKB_CB(skb)->flags;
+        flags = TCP_SKB_CB(skb)->tcp_flags;
-        TCP_SKB_CB(skb)->flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
+        TCP_SKB_CB(skb)->tcp_flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
-        TCP_SKB_CB(buff)->flags = flags;
+        TCP_SKB_CB(buff)->tcp_flags = flags;
        /* This packet was never sent out yet, so no SACK bits. */
        TCP_SKB_CB(buff)->sacked = 0;
@@ -1530,7 +1535,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
        u32 send_win, cong_win, limit, in_flight;
        int win_divisor;
-        if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN)
+        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
                goto send_now;
        if (icsk->icsk_ca_state != TCP_CA_Open)
@@ -1657,7 +1662,7 @@ static int tcp_mtu_probe(struct sock *sk)
        TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
        TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;
-        TCP_SKB_CB(nskb)->flags = TCPHDR_ACK;
+        TCP_SKB_CB(nskb)->tcp_flags = TCPHDR_ACK;
        TCP_SKB_CB(nskb)->sacked = 0;
        nskb->csum = 0;
        nskb->ip_summed = skb->ip_summed;
@@ -1677,11 +1682,11 @@ static int tcp_mtu_probe(struct sock *sk)
                if (skb->len <= copy) {
                        /* We've eaten all the data from this skb.
                         * Throw it away. */
-                        TCP_SKB_CB(nskb)->flags |= TCP_SKB_CB(skb)->flags;
+                        TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
                        tcp_unlink_write_queue(skb, sk);
                        sk_wmem_free_skb(sk, skb);
                } else {
-                        TCP_SKB_CB(nskb)->flags |= TCP_SKB_CB(skb)->flags &
+                        TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags &
                                                   ~(TCPHDR_FIN|TCPHDR_PSH);
                        if (!skb_shinfo(skb)->nr_frags) {
                                skb_pull(skb, copy);
@@ -1796,11 +1801,13 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                tcp_event_new_data_sent(sk, skb);
                tcp_minshall_update(tp, mss_now, skb);
-                sent_pkts++;
+                sent_pkts += tcp_skb_pcount(skb);
                if (push_one)
                        break;
        }
+        if (inet_csk(sk)->icsk_ca_state == TCP_CA_Recovery)
+                tp->prr_out += sent_pkts;
        if (likely(sent_pkts)) {
                tcp_cwnd_validate(sk);
@@ -1985,7 +1992,7 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
        TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(next_skb)->end_seq;
        /* Merge over control information. This moves PSH/FIN etc. over */
-        TCP_SKB_CB(skb)->flags |= TCP_SKB_CB(next_skb)->flags;
+        TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(next_skb)->tcp_flags;
        /* All done, get rid of second SKB and account for it so
         * packet counting does not break.
@@ -2003,7 +2010,7 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
 }
 /* Check if coalescing SKBs is legal. */
-static int tcp_can_collapse(struct sock *sk, struct sk_buff *skb)
+static int tcp_can_collapse(const struct sock *sk, const struct sk_buff *skb)
 {
        if (tcp_skb_pcount(skb) > 1)
                return 0;
@@ -2033,7 +2040,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
        if (!sysctl_tcp_retrans_collapse)
                return;
-        if (TCP_SKB_CB(skb)->flags & TCPHDR_SYN)
+        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
                return;
        tcp_for_write_queue_from_safe(skb, tmp, sk) {
@@ -2125,12 +2132,12 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         * since it is cheap to do so and saves bytes on the network.
         */
        if (skb->len > 0 &&
-            (TCP_SKB_CB(skb)->flags & TCPHDR_FIN) &&
+            (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) &&
            tp->snd_una == (TCP_SKB_CB(skb)->end_seq - 1)) {
                if (!pskb_trim(skb, 0)) {
                        /* Reuse, even though it does some unnecessary work */
                        tcp_init_nondata_skb(skb, TCP_SKB_CB(skb)->end_seq - 1,
-                                             TCP_SKB_CB(skb)->flags);
+                                             TCP_SKB_CB(skb)->tcp_flags);
                        skb->ip_summed = CHECKSUM_NONE;
                }
        }
@@ -2179,7 +2186,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
 static int tcp_can_forward_retransmit(struct sock *sk)
 {
        const struct inet_connection_sock *icsk = inet_csk(sk);
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        /* Forward retransmissions are possible only during Recovery. */
        if (icsk->icsk_ca_state != TCP_CA_Recovery)
@@ -2294,6 +2301,9 @@ begin_fwd:
                        return;
                NET_INC_STATS_BH(sock_net(sk), mib_idx);
+                if (inet_csk(sk)->icsk_ca_state == TCP_CA_Recovery)
+                        tp->prr_out += tcp_skb_pcount(skb);
                if (skb == tcp_write_queue_head(sk))
                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                                                  inet_csk(sk)->icsk_rto,
@@ -2317,7 +2327,7 @@ void tcp_send_fin(struct sock *sk)
        mss_now = tcp_current_mss(sk);
        if (tcp_send_head(sk) != NULL) {
-                TCP_SKB_CB(skb)->flags |= TCPHDR_FIN;
+                TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_FIN;
                TCP_SKB_CB(skb)->end_seq++;
                tp->write_seq++;
        } else {
@@ -2379,11 +2389,11 @@ int tcp_send_synack(struct sock *sk)
        struct sk_buff *skb;
        skb = tcp_write_queue_head(sk);
-        if (skb == NULL || !(TCP_SKB_CB(skb)->flags & TCPHDR_SYN)) {
+        if (skb == NULL || !(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
                printk(KERN_DEBUG "tcp_send_synack: wrong queue state\n");
                return -EFAULT;
        }
-        if (!(TCP_SKB_CB(skb)->flags & TCPHDR_ACK)) {
+        if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_ACK)) {
                if (skb_cloned(skb)) {
                        struct sk_buff *nskb = skb_copy(skb, GFP_ATOMIC);
                        if (nskb == NULL)
@@ -2397,7 +2407,7 @@ int tcp_send_synack(struct sock *sk)
                        skb = nskb;
                }
-                TCP_SKB_CB(skb)->flags |= TCPHDR_ACK;
+                TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ACK;
                TCP_ECN_send_synack(tcp_sk(sk), skb);
        }
        TCP_SKB_CB(skb)->when = tcp_time_stamp;
@@ -2542,7 +2552,7 @@ EXPORT_SYMBOL(tcp_make_synack);
 /* Do all connect socket setups that can be done AF independent. */
 static void tcp_connect_init(struct sock *sk)
 {
-        struct dst_entry *dst = __sk_dst_get(sk);
+        const struct dst_entry *dst = __sk_dst_get(sk);
        struct tcp_sock *tp = tcp_sk(sk);
        __u8 rcv_wscale;
@@ -2794,13 +2804,13 @@ int tcp_write_wakeup(struct sock *sk)
                if (seg_size < TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq ||
                    skb->len > mss) {
                        seg_size = min(seg_size, mss);
-                        TCP_SKB_CB(skb)->flags |= TCPHDR_PSH;
+                        TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
                        if (tcp_fragment(sk, skb, seg_size, mss))
                                return -1;
                } else if (!tcp_skb_pcount(skb))
                        tcp_set_skb_tso_segs(sk, skb, mss);
-                TCP_SKB_CB(skb)->flags |= TCPHDR_PSH;
+                TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
                TCP_SKB_CB(skb)->when = tcp_time_stamp;
                err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
                if (!err)
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index ecd44b0c45f1..2e0f0af76c19 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -334,7 +334,6 @@ void tcp_retransmit_timer(struct sock *sk)
                 * connection. If the socket is an orphan, time it out,
                 * we cannot allow such beasts to hang infinitely.
                 */
-#ifdef TCP_DEBUG
                struct inet_sock *inet = inet_sk(sk);
                if (sk->sk_family == AF_INET) {
                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI4:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
@@ -349,7 +348,6 @@ void tcp_retransmit_timer(struct sock *sk)
                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                }
 #endif
-#endif
                if (tcp_time_stamp - tp->rcv_tstamp > TCP_RTO_MAX) {
                        tcp_write_err(sk);
                        goto out;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1b5a19340a95..ab0966df1e2a 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1267,7 +1267,7 @@ int udp_disconnect(struct sock *sk, int flags)
        sk->sk_state = TCP_CLOSE;
        inet->inet_daddr = 0;
        inet->inet_dport = 0;
-        sock_rps_save_rxhash(sk, 0);
+        sock_rps_reset_rxhash(sk);
        sk->sk_bound_dev_if = 0;
        if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                inet_reset_saddr(sk);
@@ -1355,7 +1355,7 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
        int rc;
        if (inet_sk(sk)->inet_daddr)
-                sock_rps_save_rxhash(sk, skb->rxhash);
+                sock_rps_save_rxhash(sk, skb);
        rc = ip_queue_rcv_skb(sk, skb);
        if (rc < 0) {
@@ -1397,6 +1397,8 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
        nf_reset(skb);
        if (up->encap_type) {
+                int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
                /*
                 * This is an encapsulation socket so pass the skb to
                 * the socket's udp_encap_rcv() hook. Otherwise, just
@@ -1409,11 +1411,11 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 */
                /* if we're overly short, let UDP handle it */
-                if (skb->len > sizeof(struct udphdr) &&
+                encap_rcv = ACCESS_ONCE(up->encap_rcv);
-                    up->encap_rcv != NULL) {
+                if (skb->len > sizeof(struct udphdr) && encap_rcv != NULL) {
                        int ret;
-                        ret = (*up->encap_rcv)(sk, skb);
+                        ret = encap_rcv(sk, skb);
                        if (ret <= 0) {
                                UDP_INC_STATS_BH(sock_net(sk),
                                                 UDP_MIB_INDATAGRAMS,
@@ -1461,10 +1463,9 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                }
        }
-        if (rcu_dereference_raw(sk->sk_filter)) {
+        if (rcu_access_pointer(sk->sk_filter) &&
-                if (udp_lib_checksum_complete(skb))
+            udp_lib_checksum_complete(skb))
-                        goto drop;
+                goto drop;
-        }
        if (sk_rcvqueues_full(sk, skb))
@@ -2038,7 +2039,7 @@ static void udp_seq_stop(struct seq_file *seq, void *v)
                spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
 }
-static int udp_seq_open(struct inode *inode, struct file *file)
+int udp_seq_open(struct inode *inode, struct file *file)
 {
        struct udp_seq_afinfo *afinfo = PDE(inode)->data;
        struct udp_iter_state *s;
@@ -2054,6 +2055,7 @@ static int udp_seq_open(struct inode *inode, struct file *file)
        s->udp_table            = afinfo->udp_table;
        return err;
 }
+EXPORT_SYMBOL(udp_seq_open);
 /* ------------------------------------------------------------------------ */
 int udp_proc_register(struct net *net, struct udp_seq_afinfo *afinfo)
@@ -2061,17 +2063,12 @@ int udp_proc_register(struct net *net, struct udp_seq_afinfo *afinfo)
        struct proc_dir_entry *p;
        int rc = 0;
-        afinfo->seq_fops.open           = udp_seq_open;
-        afinfo->seq_fops.read           = seq_read;
-        afinfo->seq_fops.llseek         = seq_lseek;
-        afinfo->seq_fops.release        = seq_release_net;
        afinfo->seq_ops.start           = udp_seq_start;
        afinfo->seq_ops.next            = udp_seq_next;
        afinfo->seq_ops.stop            = udp_seq_stop;
        p = proc_create_data(afinfo->name, S_IRUGO, net->proc_net,
-                             &afinfo->seq_fops, afinfo);
+                             afinfo->seq_fops, afinfo);
        if (!p)
                rc = -ENOMEM;
        return rc;
@@ -2121,14 +2118,20 @@ int udp4_seq_show(struct seq_file *seq, void *v)
        return 0;
 }
+static const struct file_operations udp_afinfo_seq_fops = {
+        .owner    = THIS_MODULE,
+        .open     = udp_seq_open,
+        .read     = seq_read,
+        .llseek   = seq_lseek,
+        .release  = seq_release_net
+};
 /* ------------------------------------------------------------------------ */
 static struct udp_seq_afinfo udp4_seq_afinfo = {
        .name           = "udp",
        .family         = AF_INET,
        .udp_table      = &udp_table,
-        .seq_fops       = {
+        .seq_fops       = &udp_afinfo_seq_fops,
-                .owner  =       THIS_MODULE,
-        },
        .seq_ops        = {
                .show           = udp4_seq_show,
        },
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index aee9963f7f5a..12e9499a1a6c 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -10,6 +10,7 @@
 *              as published by the Free Software Foundation; either version
 *              2 of the License, or (at your option) any later version.
 */
+#include <linux/export.h>
 #include "udp_impl.h"
 struct udp_table        udplite_table __read_mostly;
@@ -71,13 +72,20 @@ static struct inet_protosw udplite4_protosw = {
 };
 #ifdef CONFIG_PROC_FS
+static const struct file_operations udplite_afinfo_seq_fops = {
+        .owner    = THIS_MODULE,
+        .open     = udp_seq_open,
+        .read     = seq_read,
+        .llseek   = seq_lseek,
+        .release  = seq_release_net
+};
 static struct udp_seq_afinfo udplite4_seq_afinfo = {
        .name           = "udplite",
        .family         = AF_INET,
        .udp_table      = &udplite_table,
-        .seq_fops       = {
+        .seq_fops       = &udplite_afinfo_seq_fops,
-                .owner  =       THIS_MODULE,
-        },
        .seq_ops        = {
                .show           = udp4_seq_show,
        },
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index fc5368ad2b0d..a0b4c5da8d43 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -79,13 +79,13 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
        struct rtable *rt = (struct rtable *)xdst->route;
        const struct flowi4 *fl4 = &fl->u.ip4;
-        rt->rt_key_dst = fl4->daddr;
+        xdst->u.rt.rt_key_dst = fl4->daddr;
-        rt->rt_key_src = fl4->saddr;
+        xdst->u.rt.rt_key_src = fl4->saddr;
-        rt->rt_key_tos = fl4->flowi4_tos;
+        xdst->u.rt.rt_key_tos = fl4->flowi4_tos;
-        rt->rt_route_iif = fl4->flowi4_iif;
+        xdst->u.rt.rt_route_iif = fl4->flowi4_iif;
-        rt->rt_iif = fl4->flowi4_iif;
+        xdst->u.rt.rt_iif = fl4->flowi4_iif;
-        rt->rt_oif = fl4->flowi4_oif;
+        xdst->u.rt.rt_oif = fl4->flowi4_oif;
-        rt->rt_mark = fl4->flowi4_mark;
+        xdst->u.rt.rt_mark = fl4->flowi4_mark;
        xdst->u.dst.dev = dev;
        dev_hold(dev);
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index d9ac0a0058b5..9258e751baba 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -12,6 +12,7 @@
 #include <linux/pfkeyv2.h>
 #include <linux/ipsec.h>
 #include <linux/netfilter_ipv4.h>
+#include <linux/export.h>
 static int xfrm4_init_flags(struct xfrm_state *x)
 {