21 files changed, 72 insertions, 61 deletions

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index a2a1814c7a8d..8c2588e4edc0 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -735,12 +735,14 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                 if (!*p)
                         continue;
                 token = match_token(p, tokens, args);
-                r = match_int(&args[0], &option);
-                if (r < 0) {
-                        P9_DPRINTK(P9_DEBUG_ERROR,
-                         "integer field, but no integer?\n");
-                        ret = r;
-                        continue;
+                if (token != Opt_err) {
+                        r = match_int(&args[0], &option);
+                        if (r < 0) {
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                "integer field, but no integer?\n");
+                                ret = r;
+                                continue;
+                        }
                 }
                 switch (token) {
                 case Opt_port:
diff --git a/net/atm/common.c b/net/atm/common.c
index c1c97936192c..8c4d843eb17f 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -92,7 +92,7 @@ static void vcc_sock_destruct(struct sock *sk)
 static void vcc_def_wakeup(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up(sk->sk_sleep);
         read_unlock(&sk->sk_callback_lock);
 }
@@ -110,7 +110,7 @@ static void vcc_write_space(struct sock *sk)
         read_lock(&sk->sk_callback_lock);
 
         if (vcc_writable(sk)) {
-                if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+                if (sk_has_sleeper(sk))
                         wake_up_interruptible(sk->sk_sleep);
 
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
@@ -594,7 +594,7 @@ unsigned int vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct atm_vcc *vcc;
         unsigned int mask;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         vcc = ATM_SD(sock);
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 58abee1f1df1..b0fe69211eef 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -712,7 +712,7 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk;
         unsigned int mask;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         /* exceptional events? */
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 9675f312830d..df30feb2fc72 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -740,7 +740,7 @@ int netpoll_setup(struct netpoll *np)
                                        np->name);
                                 break;
                         }
-                        cond_resched();
+                        msleep(1);
                 }
 
                 /* If carrier appears to come up instantly, we don't
diff --git a/net/core/sock.c b/net/core/sock.c
index b0ba569bc973..6354863b1c68 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1715,7 +1715,7 @@ EXPORT_SYMBOL(sock_no_sendpage);
 static void sock_def_wakeup(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible_all(sk->sk_sleep);
         read_unlock(&sk->sk_callback_lock);
 }
@@ -1723,7 +1723,7 @@ static void sock_def_wakeup(struct sock *sk)
 static void sock_def_error_report(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible_poll(sk->sk_sleep, POLLERR);
         sk_wake_async(sk, SOCK_WAKE_IO, POLL_ERR);
         read_unlock(&sk->sk_callback_lock);
@@ -1732,7 +1732,7 @@ static void sock_def_error_report(struct sock *sk)
 static void sock_def_readable(struct sock *sk, int len)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible_sync_poll(sk->sk_sleep, POLLIN |
                                                 POLLRDNORM | POLLRDBAND);
         sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
@@ -1747,7 +1747,7 @@ static void sock_def_write_space(struct sock *sk)
          * progress.  --DaveM
          */
         if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf) {
-                if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+                if (sk_has_sleeper(sk))
                         wake_up_interruptible_sync_poll(sk->sk_sleep, POLLOUT |
                                                 POLLWRNORM | POLLWRBAND);
 
diff --git a/net/dccp/output.c b/net/dccp/output.c
index c0e88c16d088..c96119fda688 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -196,7 +196,7 @@ void dccp_write_space(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
 
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible(sk->sk_sleep);
         /* Should agree with poll, otherwise some programs break */
         if (sock_writeable(sk))
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 314a1b5c033c..94ca8eaace7d 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -311,7 +311,7 @@ unsigned int dccp_poll(struct file *file, struct socket *sock,
         unsigned int mask;
         struct sock *sk = sock->sk;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         if (sk->sk_state == DCCP_LISTEN)
                 return inet_csk_listen_poll(sk);
 
diff --git a/net/dsa/mv88e6xxx.c b/net/dsa/mv88e6xxx.c
index 4e4d8b5ad03d..efe661a9def4 100644
--- a/net/dsa/mv88e6xxx.c
+++ b/net/dsa/mv88e6xxx.c
@@ -418,7 +418,7 @@ static int mv88e6xxx_stats_wait(struct dsa_switch *ds)
         int i;
 
         for (i = 0; i < 10; i++) {
-                ret = REG_READ(REG_GLOBAL2, 0x1d);
+                ret = REG_READ(REG_GLOBAL, 0x1d);
                 if ((ret & 0x8000) == 0)
                         return 0;
         }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 00a54b246dfe..63c2fa7b68c4 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -316,8 +316,8 @@ static inline void check_tnode(const struct tnode *tn)
 
 static const int halve_threshold = 25;
 static const int inflate_threshold = 50;
-static const int halve_threshold_root = 8;
-static const int inflate_threshold_root = 15;
+static const int halve_threshold_root = 15;
+static const int inflate_threshold_root = 25;
 
 
 static void __alias_free_mem(struct rcu_head *head)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 7870a535dac6..91145244ea63 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -339,7 +339,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct sock *sk = sock->sk;
         struct tcp_sock *tp = tcp_sk(sk);
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         if (sk->sk_state == TCP_LISTEN)
                 return inet_csk_listen_poll(sk);
 
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 60d918c96a4f..0071ee6f441f 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -136,7 +136,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
                 case IPPROTO_DCCP:
-                        if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
+                        if (xprth + 4 < skb->data ||
+                            pskb_may_pull(skb, xprth + 4 - skb->data)) {
                                 __be16 *ports = (__be16 *)xprth;
 
                                 fl->fl_ip_sport = ports[!!reverse];
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3883b4036a74..43b3c9f89c12 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1916,8 +1916,32 @@ ok:
                                         update_lft = 1;
                                 else if (stored_lft <= MIN_VALID_LIFETIME) {
                                         /* valid_lft <= stored_lft is always true */
-                                        /* XXX: IPsec */
-                                        update_lft = 0;
+                                        /*
+                                         * RFC 4862 Section 5.5.3e:
+                                         * "Note that the preferred lifetime of
+                                         *  the corresponding address is always
+                                         *  reset to the Preferred Lifetime in
+                                         *  the received Prefix Information
+                                         *  option, regardless of whether the
+                                         *  valid lifetime is also reset or
+                                         *  ignored."
+                                         *
+                                         *  So if the preferred lifetime in
+                                         *  this advertisement is different
+                                         *  than what we have stored, but the
+                                         *  valid lifetime is invalid, just
+                                         *  reset prefered_lft.
+                                         *
+                                         *  We must set the valid lifetime
+                                         *  to the stored lifetime since we'll
+                                         *  be updating the timestamp below,
+                                         *  else we'll set it back to the
+                                         *  minumum.
+                                         */
+                                        if (prefered_lft != ifp->prefered_lft) {
+                                                valid_lft = stored_lft;
+                                                update_lft = 1;
+                                        }
                                 } else {
                                         valid_lft = MIN_VALID_LIFETIME;
                                         if (valid_lft < prefered_lft)
@@ -3085,7 +3109,7 @@ restart:
                                 spin_unlock(&ifp->lock);
                                 continue;
                         } else if (age >= ifp->prefered_lft) {
-                                /* jiffies - ifp->tsamp > age >= ifp->prefered_lft */
+                                /* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
                                 int deprecate = 0;
 
                                 if (!(ifp->flags&IFA_F_DEPRECATED)) {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index b4b16a43f277..3a3c677bc0f2 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -157,7 +157,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
         ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
 
-        while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
+        while (nh + offset + 1 < skb->data ||
+               pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
                 nh = skb_network_header(skb);
                 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
 
@@ -177,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
                 case IPPROTO_DCCP:
-                        if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) {
+                        if (!onlyproto && (nh + offset + 4 < skb->data ||
+                             pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
                                 __be16 *ports = (__be16 *)exthdr;
 
                                 fl->fl_ip_sport = ports[!!reverse];
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 6be5f92d1094..49c15b48408e 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -306,7 +306,7 @@ static inline int iucv_below_msglim(struct sock *sk)
 static void iucv_sock_wake_msglim(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible_all(sk->sk_sleep);
         sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         read_unlock(&sk->sk_callback_lock);
@@ -1256,7 +1256,7 @@ unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk;
         unsigned int mask = 0;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
 
         if (sk->sk_state == IUCV_LISTEN)
                 return iucv_accept_poll(sk);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 003cb470ac84..f49ef288e2e2 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -637,7 +637,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_preq_queue *preq_node;
 
-        preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_KERNEL);
+        preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_ATOMIC);
         if (!preq_node) {
                 printk(KERN_DEBUG "Mesh HWMP: could not allocate PREQ node\n");
                 return;
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index b218b98fba7f..37771abd8f5a 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -66,7 +66,7 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix)
         for (i = rix; i >= 0; i--)
                 if (mi->r[i].rix == rix)
                         break;
-        WARN_ON(mi->r[i].rix != rix);
+        WARN_ON(i < 0);
         return i;
 }
 
@@ -181,6 +181,9 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
                         break;
 
                 ndx = rix_to_ndx(mi, ar[i].idx);
+                if (ndx < 0)
+                        continue;
+
                 mi->r[ndx].attempts += ar[i].count;
 
                 if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index eac5e7bb7365..bfe493ebf27c 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -63,7 +63,7 @@ static void rxrpc_write_space(struct sock *sk)
         _enter("%p", sk);
         read_lock(&sk->sk_callback_lock);
         if (rxrpc_writable(sk)) {
-                if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+                if (sk_has_sleeper(sk))
                         wake_up_interruptible(sk->sk_sleep);
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
@@ -588,7 +588,7 @@ static unsigned int rxrpc_poll(struct file *file, struct socket *sock,
         unsigned int mask;
         struct sock *sk = sock->sk;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         /* the socket is readable if there are any messages waiting on the Rx
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 35ba035970a2..971890dbfea0 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6652,21 +6652,6 @@ static void sctp_wait_for_close(struct sock *sk, long timeout)
         finish_wait(sk->sk_sleep, &wait);
 }
 
-static void sctp_sock_rfree_frag(struct sk_buff *skb)
-{
-        struct sk_buff *frag;
-
-        if (!skb->data_len)
-                goto done;
-
-        /* Don't forget the fragments. */
-        skb_walk_frags(skb, frag)
-                sctp_sock_rfree_frag(frag);
-
-done:
-        sctp_sock_rfree(skb);
-}
-
 static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
 {
         struct sk_buff *frag;
@@ -6776,7 +6761,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
                 event = sctp_skb2event(skb);
                 if (event->asoc == assoc) {
-                        sctp_sock_rfree_frag(skb);
                         __skb_unlink(skb, &oldsk->sk_receive_queue);
                         __skb_queue_tail(&newsk->sk_receive_queue, skb);
                         sctp_skb_set_owner_r_frag(skb, newsk);
@@ -6807,7 +6791,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
                 sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
                         event = sctp_skb2event(skb);
                         if (event->asoc == assoc) {
-                                sctp_sock_rfree_frag(skb);
                                 __skb_unlink(skb, &oldsp->pd_lobby);
                                 __skb_queue_tail(queue, skb);
                                 sctp_skb_set_owner_r_frag(skb, newsk);
@@ -6822,15 +6805,11 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 
         }
 
-        sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp) {
-                sctp_sock_rfree_frag(skb);
+        sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp)
                 sctp_skb_set_owner_r_frag(skb, newsk);
-        }
 
-        sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp) {
-                sctp_sock_rfree_frag(skb);
+        sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp)
                 sctp_skb_set_owner_r_frag(skb, newsk);
-        }
 
         /* Set the type of socket to indicate that it is peeled off from the
          * original UDP-style socket or created with the accept() call on a
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 36d4e44d6233..fc3ebb906911 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -315,7 +315,7 @@ static void unix_write_space(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
         if (unix_writable(sk)) {
-                if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+                if (sk_has_sleeper(sk))
                         wake_up_interruptible_sync(sk->sk_sleep);
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
@@ -1985,7 +1985,7 @@ static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table
         struct sock *sk = sock->sk;
         unsigned int mask;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         /* exceptional events? */
@@ -2022,7 +2022,7 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk, *other;
         unsigned int mask, writable;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         /* exceptional events? */
@@ -2053,7 +2053,7 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
                 other = unix_peer_get(sk);
                 if (other) {
                         if (unix_peer(other) != sk) {
-                                poll_wait(file, &unix_sk(other)->peer_wait,
+                                sock_poll_wait(file, &unix_sk(other)->peer_wait,
                                           wait);
                                 if (unix_recvq_full(other))
                                         writable = 0;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 241bddd0b4f1..43bdb1372cae 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -447,6 +447,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 
         rdev = __cfg80211_drv_from_info(info);
         if (IS_ERR(rdev)) {
+                mutex_unlock(&cfg80211_mutex);
                 result = PTR_ERR(rdev);
                 goto unlock;
         }
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index e95b638b919f..f8e71b300001 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -366,7 +366,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
         found = rb_find_bss(dev, res);
 
         if (found) {
-                kref_get(&found->ref);
                 found->pub.beacon_interval = res->pub.beacon_interval;
                 found->pub.tsf = res->pub.tsf;
                 found->pub.signal = res->pub.signal;