56 files changed, 266 insertions, 206 deletions

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 26eaebf4aaa..bb86d293239 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1392,6 +1392,7 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
         ax25_cb *ax25;
         int err = 0;
 
+        memset(fsa, 0, sizeof(fsa));
         lock_sock(sk);
         ax25 = ax25_sk(sk);
 
@@ -1403,7 +1404,6 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
 
                 fsa->fsa_ax25.sax25_family = AF_AX25;
                 fsa->fsa_ax25.sax25_call   = ax25->dest_addr;
-                fsa->fsa_ax25.sax25_ndigis = 0;
 
                 if (ax25->digipeat != NULL) {
                         ndigi = ax25->digipeat->ndigi;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index bfef5bae0b3..84093b0000b 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1175,6 +1175,12 @@ static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff
                                 hci_send_cmd(hdev,
                                         HCI_OP_READ_REMOTE_EXT_FEATURES,
                                                         sizeof(cp), &cp);
+                        } else if (!ev->status && conn->out &&
+                                        conn->sec_level == BT_SECURITY_HIGH) {
+                                struct hci_cp_auth_requested cp;
+                                cp.handle = ev->handle;
+                                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
+                                                        sizeof(cp), &cp);
                         } else {
                                 conn->state = BT_CONNECTED;
                                 hci_proto_connect_cfm(conn, ev->status);
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
index 98fdfa1fbdd..86a91543172 100644
--- a/net/bluetooth/hidp/Kconfig
+++ b/net/bluetooth/hidp/Kconfig
@@ -1,6 +1,6 @@
 config BT_HIDP
         tristate "HIDP protocol support"
-        depends on BT && BT_L2CAP && INPUT
+        depends on BT && BT_L2CAP && INPUT && HID_SUPPORT
         select HID
         help
           HIDP (Human Interface Device Protocol) is a transport layer
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index daa7a988d9a..cd8f6ea0384 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2421,11 +2421,11 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned
                 break;
 
         case 2:
-                *val = __le16_to_cpu(*((__le16 *) opt->val));
+                *val = get_unaligned_le16(opt->val);
                 break;
 
         case 4:
-                *val = __le32_to_cpu(*((__le32 *) opt->val));
+                *val = get_unaligned_le32(opt->val);
                 break;
 
         default:
@@ -2452,11 +2452,11 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
                 break;
 
         case 2:
-                *((__le16 *) opt->val) = cpu_to_le16(val);
+                put_unaligned_le16(val, opt->val);
                 break;
 
         case 4:
-                *((__le32 *) opt->val) = cpu_to_le32(val);
+                put_unaligned_le32(val, opt->val);
                 break;
 
         default:
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 39a5d87e33b..fa642aa652b 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -79,7 +79,10 @@ static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
 
 static void rfcomm_process_connect(struct rfcomm_session *s);
 
-static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
+                                                        bdaddr_t *dst,
+                                                        u8 sec_level,
+                                                        int *err);
 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
 static void rfcomm_session_del(struct rfcomm_session *s);
 
@@ -401,7 +404,7 @@ static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
 
         s = rfcomm_session_get(src, dst);
         if (!s) {
-                s = rfcomm_session_create(src, dst, &err);
+                s = rfcomm_session_create(src, dst, d->sec_level, &err);
                 if (!s)
                         return err;
         }
@@ -679,7 +682,10 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
         rfcomm_session_put(s);
 }
 
-static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
+                                                        bdaddr_t *dst,
+                                                        u8 sec_level,
+                                                        int *err)
 {
         struct rfcomm_session *s = NULL;
         struct sockaddr_l2 addr;
@@ -704,6 +710,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         sk = sock->sk;
         lock_sock(sk);
         l2cap_pi(sk)->imtu = l2cap_mtu;
+        l2cap_pi(sk)->sec_level = sec_level;
         if (l2cap_ertm)
                 l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
         release_sock(sk);
diff --git a/net/caif/caif_config_util.c b/net/caif/caif_config_util.c
index 76ae68303d3..d522d8c1703 100644
--- a/net/caif/caif_config_util.c
+++ b/net/caif/caif_config_util.c
@@ -16,11 +16,18 @@ int connect_req_to_link_param(struct cfcnfg *cnfg,
 {
         struct dev_info *dev_info;
         enum cfcnfg_phy_preference pref;
+        int res;
+
         memset(l, 0, sizeof(*l));
-        l->priority = s->priority;
+        /* In caif protocol low value is high priority */
+        l->priority = CAIF_PRIO_MAX - s->priority + 1;
 
-        if (s->link_name[0] != '\0')
-                l->phyid = cfcnfg_get_named(cnfg, s->link_name);
+        if (s->ifindex != 0){
+                res = cfcnfg_get_id_from_ifi(cnfg, s->ifindex);
+                if (res < 0)
+                        return res;
+                l->phyid = res;
+        }
         else {
                 switch (s->link_selector) {
                 case CAIF_LINK_HIGH_BANDW:
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index b99369a055d..a42a408306e 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -307,6 +307,8 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
 
         case NETDEV_UNREGISTER:
                 caifd = caif_get(dev);
+                if (caifd == NULL)
+                        break;
                 netdev_info(dev, "unregister\n");
                 atomic_set(&caifd->state, what);
                 caif_device_destroy(dev);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 2eca2dd0000..1bf0cf50379 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -716,8 +716,7 @@ static int setsockopt(struct socket *sock,
 {
         struct sock *sk = sock->sk;
         struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
-        int prio, linksel;
-        struct ifreq ifreq;
+        int linksel;
 
         if (cf_sk->sk.sk_socket->state != SS_UNCONNECTED)
                 return -ENOPROTOOPT;
@@ -735,33 +734,6 @@ static int setsockopt(struct socket *sock,
                 release_sock(&cf_sk->sk);
                 return 0;
 
-        case SO_PRIORITY:
-                if (lvl != SOL_SOCKET)
-                        goto bad_sol;
-                if (ol < sizeof(int))
-                        return -EINVAL;
-                if (copy_from_user(&prio, ov, sizeof(int)))
-                        return -EINVAL;
-                lock_sock(&(cf_sk->sk));
-                cf_sk->conn_req.priority = prio;
-                release_sock(&cf_sk->sk);
-                return 0;
-
-        case SO_BINDTODEVICE:
-                if (lvl != SOL_SOCKET)
-                        goto bad_sol;
-                if (ol < sizeof(struct ifreq))
-                        return -EINVAL;
-                if (copy_from_user(&ifreq, ov, sizeof(ifreq)))
-                        return -EFAULT;
-                lock_sock(&(cf_sk->sk));
-                strncpy(cf_sk->conn_req.link_name, ifreq.ifr_name,
-                        sizeof(cf_sk->conn_req.link_name));
-                cf_sk->conn_req.link_name
-                        [sizeof(cf_sk->conn_req.link_name)-1] = 0;
-                release_sock(&cf_sk->sk);
-                return 0;
-
         case CAIFSO_REQ_PARAM:
                 if (lvl != SOL_CAIF)
                         goto bad_sol;
@@ -880,6 +852,18 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
         sock->state = SS_CONNECTING;
         sk->sk_state = CAIF_CONNECTING;
 
+        /* Check priority value comming from socket */
+        /* if priority value is out of range it will be ajusted */
+        if (cf_sk->sk.sk_priority > CAIF_PRIO_MAX)
+                cf_sk->conn_req.priority = CAIF_PRIO_MAX;
+        else if (cf_sk->sk.sk_priority < CAIF_PRIO_MIN)
+                cf_sk->conn_req.priority = CAIF_PRIO_MIN;
+        else
+                cf_sk->conn_req.priority = cf_sk->sk.sk_priority;
+
+        /*ifindex = id of the interface.*/
+        cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
+
         dbfs_atomic_inc(&cnt.num_connect_req);
         cf_sk->layer.receive = caif_sktrecv_cb;
         err = caif_connect_client(&cf_sk->conn_req,
@@ -905,6 +889,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
         cf_sk->maxframe = mtu - (headroom + tailroom);
         if (cf_sk->maxframe < 1) {
                 pr_warn("CAIF Interface MTU too small (%d)\n", dev->mtu);
+                err = -ENODEV;
                 goto out;
         }
 
@@ -1142,7 +1127,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
         set_rx_flow_on(cf_sk);
 
         /* Set default options on configuration */
-        cf_sk->conn_req.priority = CAIF_PRIO_NORMAL;
+        cf_sk->sk.sk_priority= CAIF_PRIO_NORMAL;
         cf_sk->conn_req.link_selector = CAIF_LINK_LOW_LATENCY;
         cf_sk->conn_req.protocol = protocol;
         /* Increase the number of sockets created. */
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 41adafd1891..21ede141018 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -173,18 +173,15 @@ static struct cfcnfg_phyinfo *cfcnfg_get_phyinfo(struct cfcnfg *cnfg,
         return NULL;
 }
 
-int cfcnfg_get_named(struct cfcnfg *cnfg, char *name)
+
+int cfcnfg_get_id_from_ifi(struct cfcnfg *cnfg, int ifi)
 {
         int i;
-
-        /* Try to match with specified name */
-        for (i = 0; i < MAX_PHY_LAYERS; i++) {
-                if (cnfg->phy_layers[i].frm_layer != NULL
-                    && strcmp(cnfg->phy_layers[i].phy_layer->name,
-                              name) == 0)
-                        return cnfg->phy_layers[i].frm_layer->id;
-        }
-        return 0;
+        for (i = 0; i < MAX_PHY_LAYERS; i++)
+                if (cnfg->phy_layers[i].frm_layer != NULL &&
+                                cnfg->phy_layers[i].ifindex == ifi)
+                        return i;
+        return -ENODEV;
 }
 
 int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
index 08f267a109a..3cd8f978e30 100644
--- a/net/caif/cfctrl.c
+++ b/net/caif/cfctrl.c
@@ -361,11 +361,10 @@ void cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer)
         struct cfctrl_request_info *p, *tmp;
         struct cfctrl *ctrl = container_obj(layr);
         spin_lock(&ctrl->info_list_lock);
-        pr_warn("enter\n");
 
         list_for_each_entry_safe(p, tmp, &ctrl->list, list) {
                 if (p->client_layer == adap_layer) {
-                        pr_warn("cancel req :%d\n", p->sequence_no);
+                        pr_debug("cancel req :%d\n", p->sequence_no);
                         list_del(&p->list);
                         kfree(p);
                 }
diff --git a/net/caif/cfdbgl.c b/net/caif/cfdbgl.c
index 496fda9ac66..11a2af4c162 100644
--- a/net/caif/cfdbgl.c
+++ b/net/caif/cfdbgl.c
@@ -12,6 +12,8 @@
 #include <net/caif/cfsrvl.h>
 #include <net/caif/cfpkt.h>
 
+#define container_obj(layr) ((struct cfsrvl *) layr)
+
 static int cfdbgl_receive(struct cflayer *layr, struct cfpkt *pkt);
 static int cfdbgl_transmit(struct cflayer *layr, struct cfpkt *pkt);
 
@@ -38,5 +40,17 @@ static int cfdbgl_receive(struct cflayer *layr, struct cfpkt *pkt)
 
 static int cfdbgl_transmit(struct cflayer *layr, struct cfpkt *pkt)
 {
+        struct cfsrvl *service = container_obj(layr);
+        struct caif_payload_info *info;
+        int ret;
+
+        if (!cfsrvl_ready(service, &ret))
+                return ret;
+
+        /* Add info for MUX-layer to route the packet out */
+        info = cfpkt_info(pkt);
+        info->channel_id = service->layer.id;
+        info->dev_info = &service->dev_info;
+
         return layr->dn->transmit(layr->dn, pkt);
 }
diff --git a/net/caif/cfrfml.c b/net/caif/cfrfml.c
index bde8481e8d2..e2fb5fa7579 100644
--- a/net/caif/cfrfml.c
+++ b/net/caif/cfrfml.c
@@ -193,7 +193,7 @@ out:
 
 static int cfrfml_transmit_segment(struct cfrfml *rfml, struct cfpkt *pkt)
 {
-        caif_assert(cfpkt_getlen(pkt) >= rfml->fragment_size);
+        caif_assert(cfpkt_getlen(pkt) < rfml->fragment_size);
 
         /* Add info for MUX-layer to route the packet out. */
         cfpkt_info(pkt)->channel_id = rfml->serv.layer.id;
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 08ffe9e4be2..6faa8256e10 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -125,7 +125,7 @@ struct bcm_sock {
         struct list_head tx_ops;
         unsigned long dropped_usr_msgs;
         struct proc_dir_entry *bcm_proc_read;
-        char procname [9]; /* pointer printed in ASCII with \0 */
+        char procname [20]; /* pointer printed in ASCII with \0 */
 };
 
 static inline struct bcm_sock *bcm_sk(const struct sock *sk)
diff --git a/net/core/dev.c b/net/core/dev.c
index 35dfb831848..0dd54a69dac 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2131,7 +2131,7 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
         } else {
                 struct sock *sk = skb->sk;
                 queue_index = sk_tx_queue_get(sk);
-                if (queue_index < 0) {
+                if (queue_index < 0 || queue_index >= dev->real_num_tx_queues) {
 
                         queue_index = 0;
                         if (dev->real_num_tx_queues > 1)
diff --git a/net/core/dst.c b/net/core/dst.c
index 8abe628b79f..b99c7c7ffce 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -370,6 +370,7 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event,
 
 static struct notifier_block dst_dev_notifier = {
         .notifier_call  = dst_dev_event,
+        .priority = -10, /* must be called after other network notifiers */
 };
 
 void __init dst_init(void)
diff --git a/net/core/filter.c b/net/core/filter.c
index 7beaec36b54..23e9b2a6b4c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -112,39 +112,41 @@ EXPORT_SYMBOL(sk_filter);
  */
 unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
 {
-        struct sock_filter *fentry;     /* We walk down these */
         void *ptr;
         u32 A = 0;                      /* Accumulator */
         u32 X = 0;                      /* Index Register */
         u32 mem[BPF_MEMWORDS];          /* Scratch Memory Store */
+        unsigned long memvalid = 0;
         u32 tmp;
         int k;
         int pc;
 
+        BUILD_BUG_ON(BPF_MEMWORDS > BITS_PER_LONG);
         /*
          * Process array of filter instructions.
          */
         for (pc = 0; pc < flen; pc++) {
-                fentry = &filter[pc];
+                const struct sock_filter *fentry = &filter[pc];
+                u32 f_k = fentry->k;
 
                 switch (fentry->code) {
                 case BPF_S_ALU_ADD_X:
                         A += X;
                         continue;
                 case BPF_S_ALU_ADD_K:
-                        A += fentry->k;
+                        A += f_k;
                         continue;
                 case BPF_S_ALU_SUB_X:
                         A -= X;
                         continue;
                 case BPF_S_ALU_SUB_K:
-                        A -= fentry->k;
+                        A -= f_k;
                         continue;
                 case BPF_S_ALU_MUL_X:
                         A *= X;
                         continue;
                 case BPF_S_ALU_MUL_K:
-                        A *= fentry->k;
+                        A *= f_k;
                         continue;
                 case BPF_S_ALU_DIV_X:
                         if (X == 0)
@@ -152,49 +154,49 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
                         A /= X;
                         continue;
                 case BPF_S_ALU_DIV_K:
-                        A /= fentry->k;
+                        A /= f_k;
                         continue;
                 case BPF_S_ALU_AND_X:
                         A &= X;
                         continue;
                 case BPF_S_ALU_AND_K:
-                        A &= fentry->k;
+                        A &= f_k;
                         continue;
                 case BPF_S_ALU_OR_X:
                         A |= X;
                         continue;
                 case BPF_S_ALU_OR_K:
-                        A |= fentry->k;
+                        A |= f_k;
                         continue;
                 case BPF_S_ALU_LSH_X:
                         A <<= X;
                         continue;
                 case BPF_S_ALU_LSH_K:
-                        A <<= fentry->k;
+                        A <<= f_k;
                         continue;
                 case BPF_S_ALU_RSH_X:
                         A >>= X;
                         continue;
                 case BPF_S_ALU_RSH_K:
-                        A >>= fentry->k;
+                        A >>= f_k;
                         continue;
                 case BPF_S_ALU_NEG:
                         A = -A;
                         continue;
                 case BPF_S_JMP_JA:
-                        pc += fentry->k;
+                        pc += f_k;
                         continue;
                 case BPF_S_JMP_JGT_K:
-                        pc += (A > fentry->k) ? fentry->jt : fentry->jf;
+                        pc += (A > f_k) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JGE_K:
-                        pc += (A >= fentry->k) ? fentry->jt : fentry->jf;
+                        pc += (A >= f_k) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JEQ_K:
-                        pc += (A == fentry->k) ? fentry->jt : fentry->jf;
+                        pc += (A == f_k) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JSET_K:
-                        pc += (A & fentry->k) ? fentry->jt : fentry->jf;
+                        pc += (A & f_k) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JGT_X:
                         pc += (A > X) ? fentry->jt : fentry->jf;
@@ -209,7 +211,7 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
                         pc += (A & X) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_LD_W_ABS:
-                        k = fentry->k;
+                        k = f_k;
 load_w:
                         ptr = load_pointer(skb, k, 4, &tmp);
                         if (ptr != NULL) {
@@ -218,7 +220,7 @@ load_w:
                         }
                         break;
                 case BPF_S_LD_H_ABS:
-                        k = fentry->k;
+                        k = f_k;
 load_h:
                         ptr = load_pointer(skb, k, 2, &tmp);
                         if (ptr != NULL) {
@@ -227,7 +229,7 @@ load_h:
                         }
                         break;
                 case BPF_S_LD_B_ABS:
-                        k = fentry->k;
+                        k = f_k;
 load_b:
                         ptr = load_pointer(skb, k, 1, &tmp);
                         if (ptr != NULL) {
@@ -242,32 +244,34 @@ load_b:
                         X = skb->len;
                         continue;
                 case BPF_S_LD_W_IND:
-                        k = X + fentry->k;
+                        k = X + f_k;
                         goto load_w;
                 case BPF_S_LD_H_IND:
-                        k = X + fentry->k;
+                        k = X + f_k;
                         goto load_h;
                 case BPF_S_LD_B_IND:
-                        k = X + fentry->k;
+                        k = X + f_k;
                         goto load_b;
                 case BPF_S_LDX_B_MSH:
-                        ptr = load_pointer(skb, fentry->k, 1, &tmp);
+                        ptr = load_pointer(skb, f_k, 1, &tmp);
                         if (ptr != NULL) {
                                 X = (*(u8 *)ptr & 0xf) << 2;
                                 continue;
                         }
                         return 0;
                 case BPF_S_LD_IMM:
-                        A = fentry->k;
+                        A = f_k;
                         continue;
                 case BPF_S_LDX_IMM:
-                        X = fentry->k;
+                        X = f_k;
                         continue;
                 case BPF_S_LD_MEM:
-                        A = mem[fentry->k];
+                        A = (memvalid & (1UL << f_k)) ?
+                                mem[f_k] : 0;
                         continue;
                 case BPF_S_LDX_MEM:
-                        X = mem[fentry->k];
+                        X = (memvalid & (1UL << f_k)) ?
+                                mem[f_k] : 0;
                         continue;
                 case BPF_S_MISC_TAX:
                         X = A;
@@ -276,14 +280,16 @@ load_b:
                         A = X;
                         continue;
                 case BPF_S_RET_K:
-                        return fentry->k;
+                        return f_k;
                 case BPF_S_RET_A:
                         return A;
                 case BPF_S_ST:
-                        mem[fentry->k] = A;
+                        memvalid |= 1UL << f_k;
+                        mem[f_k] = A;
                         continue;
                 case BPF_S_STX:
-                        mem[fentry->k] = X;
+                        memvalid |= 1UL << f_k;
+                        mem[f_k] = X;
                         continue;
                 default:
                         WARN_ON(1);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index fbce4b05a53..33bc3823ac6 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -887,7 +887,7 @@ static ssize_t pktgen_if_write(struct file *file,
         i += len;
 
         if (debug) {
-                size_t copy = min(count, 1023);
+                size_t copy = min_t(size_t, count, 1023);
                 char tb[copy + 1];
                 if (copy_from_user(tb, user_buffer, copy))
                         return -EFAULT;
@@ -2612,8 +2612,8 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         /* Update any of the values, used when we're incrementing various
          * fields.
          */
-        queue_map = pkt_dev->cur_queue_map;
         mod_cur_headers(pkt_dev);
+        queue_map = pkt_dev->cur_queue_map;
 
         datalen = (odev->hard_header_len + 16) & ~0xf;
 
@@ -2976,8 +2976,8 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         /* Update any of the values, used when we're incrementing various
          * fields.
          */
-        queue_map = pkt_dev->cur_queue_map;
         mod_cur_headers(pkt_dev);
+        queue_map = pkt_dev->cur_queue_map;
 
         skb = __netdev_alloc_skb(odev,
                                  pkt_dev->cur_pkt_size + 64
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 8121268ddbd..841c287ef40 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -347,16 +347,17 @@ static size_t rtnl_link_get_size(const struct net_device *dev)
         if (!ops)
                 return 0;
 
-        size = nlmsg_total_size(sizeof(struct nlattr)) + /* IFLA_LINKINFO */
-               nlmsg_total_size(strlen(ops->kind) + 1);  /* IFLA_INFO_KIND */
+        size = nla_total_size(sizeof(struct nlattr)) + /* IFLA_LINKINFO */
+               nla_total_size(strlen(ops->kind) + 1);  /* IFLA_INFO_KIND */
 
         if (ops->get_size)
                 /* IFLA_INFO_DATA + nested data */
-                size += nlmsg_total_size(sizeof(struct nlattr)) +
+                size += nla_total_size(sizeof(struct nlattr)) +
                         ops->get_size(dev);
 
         if (ops->get_xstats_size)
-                size += ops->get_xstats_size(dev);      /* IFLA_INFO_XSTATS */
+                /* IFLA_INFO_XSTATS */
+                size += nla_total_size(ops->get_xstats_size(dev));
 
         return size;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 3eed5424e65..fb608011146 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1653,10 +1653,10 @@ int __sk_mem_schedule(struct sock *sk, int size, int kind)
 {
         struct proto *prot = sk->sk_prot;
         int amt = sk_mem_pages(size);
-        int allocated;
+        long allocated;
 
         sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
-        allocated = atomic_add_return(amt, prot->memory_allocated);
+        allocated = atomic_long_add_return(amt, prot->memory_allocated);
 
         /* Under limit. */
         if (allocated <= prot->sysctl_mem[0]) {
@@ -1714,7 +1714,7 @@ suppress_allocation:
 
         /* Alas. Undo changes. */
         sk->sk_forward_alloc -= amt * SK_MEM_QUANTUM;
-        atomic_sub(amt, prot->memory_allocated);
+        atomic_long_sub(amt, prot->memory_allocated);
         return 0;
 }
 EXPORT_SYMBOL(__sk_mem_schedule);
@@ -1727,12 +1727,12 @@ void __sk_mem_reclaim(struct sock *sk)
 {
         struct proto *prot = sk->sk_prot;
 
-        atomic_sub(sk->sk_forward_alloc >> SK_MEM_QUANTUM_SHIFT,
+        atomic_long_sub(sk->sk_forward_alloc >> SK_MEM_QUANTUM_SHIFT,
                    prot->memory_allocated);
         sk->sk_forward_alloc &= SK_MEM_QUANTUM - 1;
 
         if (prot->memory_pressure && *prot->memory_pressure &&
-            (atomic_read(prot->memory_allocated) < prot->sysctl_mem[0]))
+            (atomic_long_read(prot->memory_allocated) < prot->sysctl_mem[0]))
                 *prot->memory_pressure = 0;
 }
 EXPORT_SYMBOL(__sk_mem_reclaim);
@@ -2452,12 +2452,12 @@ static char proto_method_implemented(const void *method)
 
 static void proto_seq_printf(struct seq_file *seq, struct proto *proto)
 {
-        seq_printf(seq, "%-9s %4u %6d  %6d   %-3s %6u   %-3s  %-10s "
+        seq_printf(seq, "%-9s %4u %6d  %6ld   %-3s %6u   %-3s  %-10s "
                         "%2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c\n",
                    proto->name,
                    proto->obj_size,
                    sock_prot_inuse_get(seq_file_net(seq), proto),
-                   proto->memory_allocated != NULL ? atomic_read(proto->memory_allocated) : -1,
+                   proto->memory_allocated != NULL ? atomic_long_read(proto->memory_allocated) : -1L,
                    proto->memory_pressure != NULL ? *proto->memory_pressure ? "yes" : "no" : "NI",
                    proto->max_header,
                    proto->slab == NULL ? "no" : "yes",
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index d6b93d19790..a76b78de679 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -155,7 +155,7 @@ static const struct proto_ops dn_proto_ops;
 static DEFINE_RWLOCK(dn_hash_lock);
 static struct hlist_head dn_sk_hash[DN_SK_HASH_SIZE];
 static struct hlist_head dn_wild_sk;
-static atomic_t decnet_memory_allocated;
+static atomic_long_t decnet_memory_allocated;
 
 static int __dn_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen, int flags);
 static int __dn_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen, int flags);
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index be3eb8e2328..28f8b5e5f73 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -38,7 +38,7 @@ int decnet_log_martians = 1;
 int decnet_no_fc_max_cwnd = NSP_MIN_WINDOW;
 
 /* Reasonable defaults, I hope, based on tcp's defaults */
-int sysctl_decnet_mem[3] = { 768 << 3, 1024 << 3, 1536 << 3 };
+long sysctl_decnet_mem[3] = { 768 << 3, 1024 << 3, 1536 << 3 };
 int sysctl_decnet_wmem[3] = { 4 * 1024, 16 * 1024, 128 * 1024 };
 int sysctl_decnet_rmem[3] = { 4 * 1024, 87380, 87380 * 2 };
 
@@ -324,7 +324,7 @@ static ctl_table dn_table[] = {
                 .data = &sysctl_decnet_mem,
                 .maxlen = sizeof(sysctl_decnet_mem),
                 .mode = 0644,
-                .proc_handler = proc_dointvec,
+                .proc_handler = proc_doulongvec_minmax
         },
         {
                 .procname = "decnet_rmem",
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index a29edf2219c..c079cc0ec65 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -47,11 +47,8 @@ extern int fib_detect_death(struct fib_info *fi, int order,
 static inline void fib_result_assign(struct fib_result *res,
                                      struct fib_info *fi)
 {
-        if (res->fi != NULL)
-                fib_info_put(res->fi);
+        /* we used to play games with refcounts, but we now use RCU */
         res->fi = fi;
-        if (fi != NULL)
-                atomic_inc(&fi->fib_clntref);
 }
 
 #endif /* _FIB_LOOKUP_H */
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index c8877c6c721..3c53c2d89e3 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2306,10 +2306,8 @@ void ip_mc_drop_socket(struct sock *sk)
 
                 in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
                 (void) ip_mc_leave_src(sk, iml, in_dev);
-                if (in_dev != NULL) {
+                if (in_dev != NULL)
                         ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
-                        in_dev_put(in_dev);
-                }
                 /* decrease mem now to avoid the memleak warning */
                 atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
                 call_rcu(&iml->rcu, ip_mc_socklist_reclaim);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index ba804266584..2ada17129fc 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -490,9 +490,11 @@ static int inet_csk_diag_dump(struct sock *sk,
 {
         struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
 
-        if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+        if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
                 struct inet_diag_entry entry;
-                struct rtattr *bc = (struct rtattr *)(r + 1);
+                const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
+                                                          sizeof(*r),
+                                                          INET_DIAG_REQ_BYTECODE);
                 struct inet_sock *inet = inet_sk(sk);
 
                 entry.family = sk->sk_family;
@@ -512,7 +514,7 @@ static int inet_csk_diag_dump(struct sock *sk,
                 entry.dport = ntohs(inet->inet_dport);
                 entry.userlocks = sk->sk_userlocks;
 
-                if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
+                if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
                         return 0;
         }
 
@@ -527,9 +529,11 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
 {
         struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
 
-        if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+        if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
                 struct inet_diag_entry entry;
-                struct rtattr *bc = (struct rtattr *)(r + 1);
+                const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
+                                                          sizeof(*r),
+                                                          INET_DIAG_REQ_BYTECODE);
 
                 entry.family = tw->tw_family;
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
@@ -548,7 +552,7 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
                 entry.dport = ntohs(tw->tw_dport);
                 entry.userlocks = 0;
 
-                if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
+                if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
                         return 0;
         }
 
@@ -618,7 +622,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
         struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct listen_sock *lopt;
-        struct rtattr *bc = NULL;
+        const struct nlattr *bc = NULL;
         struct inet_sock *inet = inet_sk(sk);
         int j, s_j;
         int reqnum, s_reqnum;
@@ -638,8 +642,9 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
         if (!lopt || !lopt->qlen)
                 goto out;
 
-        if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
-                bc = (struct rtattr *)(r + 1);
+        if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
+                bc = nlmsg_find_attr(cb->nlh, sizeof(*r),
+                                     INET_DIAG_REQ_BYTECODE);
                 entry.sport = inet->inet_num;
                 entry.userlocks = sk->sk_userlocks;
         }
@@ -672,8 +677,8 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
                                         &ireq->rmt_addr;
                                 entry.dport = ntohs(ireq->rmt_port);
 
-                                if (!inet_diag_bc_run(RTA_DATA(bc),
-                                                    RTA_PAYLOAD(bc), &entry))
+                                if (!inet_diag_bc_run(nla_data(bc),
+                                                      nla_len(bc), &entry))
                                         continue;
                         }
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 3cad2591ace..3fac340a28d 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -927,6 +927,7 @@ static int get_info(struct net *net, void __user *user,
                         private = &tmp;
                 }
 #endif
+                memset(&info, 0, sizeof(info));
                 info.valid_hooks = t->valid_hooks;
                 memcpy(info.hook_entry, private->hook_entry,
                        sizeof(info.hook_entry));
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index d31b007a6d8..a846d633b3b 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1124,6 +1124,7 @@ static int get_info(struct net *net, void __user *user,
                         private = &tmp;
                 }
 #endif
+                memset(&info, 0, sizeof(info));
                 info.valid_hooks = t->valid_hooks;
                 memcpy(info.hook_entry, private->hook_entry,
                        sizeof(info.hook_entry));
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 295c97431e4..c04787ce1a7 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -47,26 +47,6 @@ __nf_nat_proto_find(u_int8_t protonum)
         return rcu_dereference(nf_nat_protos[protonum]);
 }
 
-static const struct nf_nat_protocol *
-nf_nat_proto_find_get(u_int8_t protonum)
-{
-        const struct nf_nat_protocol *p;
-
-        rcu_read_lock();
-        p = __nf_nat_proto_find(protonum);
-        if (!try_module_get(p->me))
-                p = &nf_nat_unknown_protocol;
-        rcu_read_unlock();
-
-        return p;
-}
-
-static void
-nf_nat_proto_put(const struct nf_nat_protocol *p)
-{
-        module_put(p->me);
-}
-
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
 hash_by_src(const struct net *net, u16 zone,
@@ -588,6 +568,26 @@ static struct nf_ct_ext_type nat_extend __read_mostly = {
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 
+static const struct nf_nat_protocol *
+nf_nat_proto_find_get(u_int8_t protonum)
+{
+        const struct nf_nat_protocol *p;
+
+        rcu_read_lock();
+        p = __nf_nat_proto_find(protonum);
+        if (!try_module_get(p->me))
+                p = &nf_nat_unknown_protocol;
+        rcu_read_unlock();
+
+        return p;
+}
+
+static void
+nf_nat_proto_put(const struct nf_nat_protocol *p)
+{
+        module_put(p->me);
+}
+
 static const struct nla_policy protonat_nla_policy[CTA_PROTONAT_MAX+1] = {
         [CTA_PROTONAT_PORT_MIN] = { .type = NLA_U16 },
         [CTA_PROTONAT_PORT_MAX] = { .type = NLA_U16 },
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 4ae1f203f7c..1b48eb1ed45 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -59,13 +59,13 @@ static int sockstat_seq_show(struct seq_file *seq, void *v)
         local_bh_enable();
 
         socket_seq_show(seq);
-        seq_printf(seq, "TCP: inuse %d orphan %d tw %d alloc %d mem %d\n",
+        seq_printf(seq, "TCP: inuse %d orphan %d tw %d alloc %d mem %ld\n",
                    sock_prot_inuse_get(net, &tcp_prot), orphans,
                    tcp_death_row.tw_count, sockets,
-                   atomic_read(&tcp_memory_allocated));
-        seq_printf(seq, "UDP: inuse %d mem %d\n",
+                   atomic_long_read(&tcp_memory_allocated));
+        seq_printf(seq, "UDP: inuse %d mem %ld\n",
                    sock_prot_inuse_get(net, &udp_prot),
-                   atomic_read(&udp_memory_allocated));
+                   atomic_long_read(&udp_memory_allocated));
         seq_printf(seq, "UDPLITE: inuse %d\n",
                    sock_prot_inuse_get(net, &udplite_prot));
         seq_printf(seq, "RAW: inuse %d\n",
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index d96c1da4b17..e91911d7aae 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -398,7 +398,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_mem,
                 .maxlen         = sizeof(sysctl_tcp_mem),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_doulongvec_minmax
         },
         {
                 .procname       = "tcp_wmem",
@@ -602,8 +602,7 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &zero
+                .proc_handler   = proc_doulongvec_minmax,
         },
         {
                 .procname       = "udp_rmem_min",
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1664a0590bb..08141996948 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -282,7 +282,7 @@ int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
 
-int sysctl_tcp_mem[3] __read_mostly;
+long sysctl_tcp_mem[3] __read_mostly;
 int sysctl_tcp_wmem[3] __read_mostly;
 int sysctl_tcp_rmem[3] __read_mostly;
 
@@ -290,7 +290,7 @@ EXPORT_SYMBOL(sysctl_tcp_mem);
 EXPORT_SYMBOL(sysctl_tcp_rmem);
 EXPORT_SYMBOL(sysctl_tcp_wmem);
 
-atomic_t tcp_memory_allocated;  /* Current allocated memory. */
+atomic_long_t tcp_memory_allocated;     /* Current allocated memory. */
 EXPORT_SYMBOL(tcp_memory_allocated);
 
 /*
@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 /* Values greater than interface MTU won't take effect. However
                  * at the point when this call is done we typically don't yet
                  * know which interface is going to be used */
-                if (val < 8 || val > MAX_TCP_WINDOW) {
+                if (val < 64 || val > MAX_TCP_WINDOW) {
                         err = -EINVAL;
                         break;
                 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3357f69e353..6d8ab1c4efc 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -259,8 +259,11 @@ static void tcp_fixup_sndbuf(struct sock *sk)
         int sndmem = tcp_sk(sk)->rx_opt.mss_clamp + MAX_TCP_HEADER + 16 +
                      sizeof(struct sk_buff);
 
-        if (sk->sk_sndbuf < 3 * sndmem)
-                sk->sk_sndbuf = min(3 * sndmem, sysctl_tcp_wmem[2]);
+        if (sk->sk_sndbuf < 3 * sndmem) {
+                sk->sk_sndbuf = 3 * sndmem;
+                if (sk->sk_sndbuf > sysctl_tcp_wmem[2])
+                        sk->sk_sndbuf = sysctl_tcp_wmem[2];
+        }
 }
 
 /* 2. Tuning advertised window (window_clamp, rcv_ssthresh)
@@ -396,7 +399,7 @@ static void tcp_clamp_window(struct sock *sk)
         if (sk->sk_rcvbuf < sysctl_tcp_rmem[2] &&
             !(sk->sk_userlocks & SOCK_RCVBUF_LOCK) &&
             !tcp_memory_pressure &&
-            atomic_read(&tcp_memory_allocated) < sysctl_tcp_mem[0]) {
+            atomic_long_read(&tcp_memory_allocated) < sysctl_tcp_mem[0]) {
                 sk->sk_rcvbuf = min(atomic_read(&sk->sk_rmem_alloc),
                                     sysctl_tcp_rmem[2]);
         }
@@ -4861,7 +4864,7 @@ static int tcp_should_expand_sndbuf(struct sock *sk)
                 return 0;
 
         /* If we are under soft global TCP memory pressure, do not expand.  */
-        if (atomic_read(&tcp_memory_allocated) >= sysctl_tcp_mem[0])
+        if (atomic_long_read(&tcp_memory_allocated) >= sysctl_tcp_mem[0])
                 return 0;
 
         /* If we filled the congestion window, do not expand.  */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 8f8527d4168..69ccbc1dde9 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -415,6 +415,9 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                     !icsk->icsk_backoff)
                         break;
 
+                if (sock_owned_by_user(sk))
+                        break;
+
                 icsk->icsk_backoff--;
                 inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
                                          icsk->icsk_backoff;
@@ -429,11 +432,6 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                 if (remaining) {
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                                                   remaining, TCP_RTO_MAX);
-                } else if (sock_owned_by_user(sk)) {
-                        /* RTO revert clocked out retransmission,
-                         * but socket is locked. Will defer. */
-                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-                                                  HZ/20, TCP_RTO_MAX);
                 } else {
                         /* RTO revert clocked out retransmission.
                          * Will retransmit now */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 28cb2d733a3..5e0a3a582a5 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -110,7 +110,7 @@
 struct udp_table udp_table __read_mostly;
 EXPORT_SYMBOL(udp_table);
 
-int sysctl_udp_mem[3] __read_mostly;
+long sysctl_udp_mem[3] __read_mostly;
 EXPORT_SYMBOL(sysctl_udp_mem);
 
 int sysctl_udp_rmem_min __read_mostly;
@@ -119,7 +119,7 @@ EXPORT_SYMBOL(sysctl_udp_rmem_min);
 int sysctl_udp_wmem_min __read_mostly;
 EXPORT_SYMBOL(sysctl_udp_wmem_min);
 
-atomic_t udp_memory_allocated;
+atomic_long_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
 #define MAX_UDP_PORTS 65536
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e048ec62d10..b41ce0f0d51 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2740,10 +2740,6 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                         /* Flag it for later restoration when link comes up */
                         ifa->flags |= IFA_F_TENTATIVE;
                         ifa->state = INET6_IFADDR_STATE_DAD;
-
-                        write_unlock_bh(&idev->lock);
-
-                        in6_ifa_hold(ifa);
                 } else {
                         list_del(&ifa->if_list);
 
@@ -2758,19 +2754,15 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                         ifa->state = INET6_IFADDR_STATE_DEAD;
                         spin_unlock_bh(&ifa->state_lock);
 
-                        if (state == INET6_IFADDR_STATE_DEAD)
-                                goto put_ifa;
+                        if (state == INET6_IFADDR_STATE_DEAD) {
+                                in6_ifa_put(ifa);
+                        } else {
+                                __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                                atomic_notifier_call_chain(&inet6addr_chain,
+                                                           NETDEV_DOWN, ifa);
+                        }
+                        write_lock_bh(&idev->lock);
                 }
-
-                __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                if (ifa->state == INET6_IFADDR_STATE_DEAD)
-                        atomic_notifier_call_chain(&inet6addr_chain,
-                                                   NETDEV_DOWN, ifa);
-
-put_ifa:
-                in6_ifa_put(ifa);
-
-                write_lock_bh(&idev->lock);
         }
 
         list_splice(&keep_list, &idev->addr_list);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 51df035897e..455582384ec 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1137,6 +1137,7 @@ static int get_info(struct net *net, void __user *user,
                         private = &tmp;
                 }
 #endif
+                memset(&info, 0, sizeof(info));
                 info.valid_hooks = t->valid_hooks;
                 memcpy(info.hook_entry, private->hook_entry,
                        sizeof(info.hook_entry));
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 3a3f129a44c..79d43aa8fa8 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -286,7 +286,7 @@ found:
 
         /* Check for overlap with preceding fragment. */
         if (prev &&
-            (NFCT_FRAG6_CB(prev)->offset + prev->len) - offset > 0)
+            (NFCT_FRAG6_CB(prev)->offset + prev->len) > offset)
                 goto discard_fq;
 
         /* Look for overlap with succeeding segment. */
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index c7ba3149633..0f276645375 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -349,7 +349,7 @@ found:
 
         /* Check for overlap with preceding fragment. */
         if (prev &&
-            (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
+            (FRAG6_CB(prev)->offset + prev->len) > offset)
                 goto discard_fq;
 
         /* Look for overlap with succeeding segment. */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 25661f968f3..96455ffb76f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1945,8 +1945,12 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
         struct neighbour *neigh;
 
-        if (rt == NULL)
+        if (rt == NULL) {
+                if (net_ratelimit())
+                        pr_warning("IPv6:  Maximum number of routes reached,"
+                                   " consider increasing route/max_size.\n");
                 return ERR_PTR(-ENOMEM);
+        }
 
         dev_hold(net->loopback_dev);
         in6_dev_hold(idev);
@@ -2741,6 +2745,7 @@ static void __net_exit ip6_route_net_exit(struct net *net)
         kfree(net->ipv6.ip6_prohibit_entry);
         kfree(net->ipv6.ip6_blk_hole_entry);
 #endif
+        dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 }
 
 static struct pernet_operations ip6_route_net_ops = {
@@ -2832,5 +2837,6 @@ void ip6_route_cleanup(void)
         xfrm6_fini();
         fib6_gc_cleanup();
         unregister_pernet_subsys(&ip6_route_net_ops);
+        dst_entries_destroy(&ip6_dst_blackhole_ops);
         kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
 }
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 104ec3b283d..b8dbae82fab 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -249,7 +249,7 @@ static int l2tp_dfs_seq_open(struct inode *inode, struct file *file)
         struct seq_file *seq;
         int rc = -ENOMEM;
 
-        pd = kzalloc(GFP_KERNEL, sizeof(*pd));
+        pd = kzalloc(sizeof(*pd), GFP_KERNEL);
         if (pd == NULL)
                 goto out;
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index f9163b12c7f..7aa85591dbe 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -391,6 +391,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         u32 hw_reconf_flags = 0;
         int i;
 
+        if (local->scan_sdata == sdata)
+                ieee80211_scan_cancel(local);
+
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
         /*
@@ -523,9 +526,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 synchronize_rcu();
                 skb_queue_purge(&sdata->skb_queue);
 
-                if (local->scan_sdata == sdata)
-                        ieee80211_scan_cancel(local);
-
                 /*
                  * Disable beaconing here for mesh only, AP and IBSS
                  * are already taken care of.
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 1eacf8d9966..27a5ea6b6a0 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1312,7 +1312,8 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced, int nulls)
         if (!hash) {
                 *vmalloced = 1;
                 printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
-                hash = __vmalloc(sz, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+                hash = __vmalloc(sz, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
+                                 PAGE_KERNEL);
         }
 
         if (hash && nulls)
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index ed6d9295802..dc7bb74110d 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -292,6 +292,12 @@ int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *l4proto)
 
                 for (i = 0; i < MAX_NF_CT_PROTO; i++)
                         proto_array[i] = &nf_conntrack_l4proto_generic;
+
+                /* Before making proto_array visible to lockless readers,
+                 * we must make sure its content is committed to memory.
+                 */
+                smp_wmb();
+
                 nf_ct_protos[l4proto->l3proto] = proto_array;
         } else if (nf_ct_protos[l4proto->l3proto][l4proto->l4proto] !=
                                         &nf_conntrack_l4proto_generic) {
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3616f27b9d4..8298e676f5a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1610,9 +1610,11 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 err = -EINVAL;
                 vnet_hdr_len = sizeof(vnet_hdr);
-                if ((len -= vnet_hdr_len) < 0)
+                if (len < vnet_hdr_len)
                         goto out_free;
 
+                len -= vnet_hdr_len;
+
                 if (skb_is_gso(skb)) {
                         struct skb_shared_info *sinfo = skb_shinfo(skb);
 
@@ -1719,7 +1721,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
         rcu_read_lock();
         dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex);
         if (dev)
-                strlcpy(uaddr->sa_data, dev->name, 15);
+                strncpy(uaddr->sa_data, dev->name, 14);
         else
                 memset(uaddr->sa_data, 0, 14);
         rcu_read_unlock();
@@ -1742,6 +1744,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
         sll->sll_family = AF_PACKET;
         sll->sll_ifindex = po->ifindex;
         sll->sll_protocol = po->num;
+        sll->sll_pkttype = 0;
         rcu_read_lock();
         dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex);
         if (dev) {
diff --git a/net/rds/loop.c b/net/rds/loop.c
index c390156b426..aeec1d483b1 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -134,8 +134,12 @@ static int rds_loop_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 static void rds_loop_conn_free(void *arg)
 {
         struct rds_loop_connection *lc = arg;
+        unsigned long flags;
+
         rdsdebug("lc %p\n", lc);
+        spin_lock_irqsave(&loop_conns_lock, flags);
         list_del(&lc->loop_node);
+        spin_unlock_irqrestore(&loop_conns_lock, flags);
         kfree(lc);
 }
 
diff --git a/net/rds/message.c b/net/rds/message.c
index 848cff45183..1fd3d29023d 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -249,8 +249,10 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
         rm->m_inc.i_hdr.h_len = cpu_to_be32(total_len);
         rm->data.op_nents = ceil(total_len, PAGE_SIZE);
         rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
-        if (!rm->data.op_sg)
+        if (!rm->data.op_sg) {
+                rds_message_put(rm);
                 return ERR_PTR(-ENOMEM);
+        }
 
         for (i = 0; i < rm->data.op_nents; ++i) {
                 sg_set_page(&rm->data.op_sg[i],
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 08a8c6cf2d1..8e0a32001c9 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -221,7 +221,13 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 static void rds_tcp_conn_free(void *arg)
 {
         struct rds_tcp_connection *tc = arg;
+        unsigned long flags;
         rdsdebug("freeing tc %p\n", tc);
+
+        spin_lock_irqsave(&rds_tcp_conn_lock, flags);
+        list_del(&tc->t_tcp_node);
+        spin_unlock_irqrestore(&rds_tcp_conn_lock, flags);
+
         kmem_cache_free(rds_tcp_conn_slab, tc);
 }
 
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index efd4f95fd05..f23d9155b1e 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -268,6 +268,10 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
                 goto nla_put_failure;
 
         nla_nest_end(skb, nest);
+
+        if (tcf_exts_dump_stats(skb, &f->exts, &basic_ext_map) < 0)
+                goto nla_put_failure;
+
         return skb->len;
 
 nla_put_failure:
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 37dff78e9cb..d49c40fb7e0 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -34,8 +34,6 @@ struct cgroup_subsys net_cls_subsys = {
         .populate       = cgrp_populate,
 #ifdef CONFIG_NET_CLS_CGROUP
         .subsys_id      = net_cls_subsys_id,
-#else
-#define net_cls_subsys_id net_cls_subsys.subsys_id
 #endif
         .module         = THIS_MODULE,
 };
diff --git a/net/sched/em_text.c b/net/sched/em_text.c
index 76325325741..ea8f566e720 100644
--- a/net/sched/em_text.c
+++ b/net/sched/em_text.c
@@ -103,7 +103,8 @@ retry:
 
 static void em_text_destroy(struct tcf_proto *tp, struct tcf_ematch *m)
 {
-        textsearch_destroy(EM_TEXT_PRIV(m)->config);
+        if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config)
+                textsearch_destroy(EM_TEXT_PRIV(m)->config);
 }
 
 static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 1ef29c74d85..e58f9476f29 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -92,7 +92,7 @@ static struct sctp_af *sctp_af_v6_specific;
 struct kmem_cache *sctp_chunk_cachep __read_mostly;
 struct kmem_cache *sctp_bucket_cachep __read_mostly;
 
-int sysctl_sctp_mem[3];
+long sysctl_sctp_mem[3];
 int sysctl_sctp_rmem[3];
 int sysctl_sctp_wmem[3];
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index e34ca9cc116..6bd554323a3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -111,12 +111,12 @@ static void sctp_sock_migrate(struct sock *, struct sock *,
 static char *sctp_hmac_alg = SCTP_COOKIE_HMAC_ALG;
 
 extern struct kmem_cache *sctp_bucket_cachep;
-extern int sysctl_sctp_mem[3];
+extern long sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
 extern int sysctl_sctp_wmem[3];
 
 static int sctp_memory_pressure;
-static atomic_t sctp_memory_allocated;
+static atomic_long_t sctp_memory_allocated;
 struct percpu_counter sctp_sockets_allocated;
 
 static void sctp_enter_memory_pressure(struct sock *sk)
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 832590bbe0c..50cb57f0919 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -54,7 +54,7 @@ static int sack_timer_max = 500;
 static int addr_scope_max = 3; /* check sctp_scope_policy_t in include/net/sctp/constants.h for max entries */
 static int rwnd_scale_max = 16;
 
-extern int sysctl_sctp_mem[3];
+extern long sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
 extern int sysctl_sctp_wmem[3];
 
@@ -203,7 +203,7 @@ static ctl_table sctp_table[] = {
                 .data           = &sysctl_sctp_mem,
                 .maxlen         = sizeof(sysctl_sctp_mem),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_doulongvec_minmax
         },
         {
                 .procname       = "sctp_rmem",
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 33217fc3d69..e9f0d500448 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -396,6 +396,7 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
         struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
         struct tipc_sock *tsock = tipc_sk(sock->sk);
 
+        memset(addr, 0, sizeof(*addr));
         if (peer) {
                 if ((sock->state != SS_CONNECTED) &&
                         ((peer != 2) || (sock->state != SS_DISCONNECTING)))
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index c506241f863..4e78e3f2679 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -224,8 +224,8 @@ static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
         }
 
         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
-        if (IS_ERR(dev)) {
-                err = PTR_ERR(dev);
+        if (IS_ERR(*rdev)) {
+                err = PTR_ERR(*rdev);
                 goto out_rtnl;
         }
 
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 771bab00754..55187c8f642 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -61,6 +61,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
         while (len > 0) {
                 switch (*p & X25_FAC_CLASS_MASK) {
                 case X25_FAC_CLASS_A:
+                        if (len < 2)
+                                return 0;
                         switch (*p) {
                         case X25_FAC_REVERSE:
                                 if((p[1] & 0x81) == 0x81) {
@@ -104,6 +106,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         len -= 2;
                         break;
                 case X25_FAC_CLASS_B:
+                        if (len < 3)
+                                return 0;
                         switch (*p) {
                         case X25_FAC_PACKET_SIZE:
                                 facilities->pacsize_in  = p[1];
@@ -125,6 +129,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         len -= 3;
                         break;
                 case X25_FAC_CLASS_C:
+                        if (len < 4)
+                                return 0;
                         printk(KERN_DEBUG "X.25: unknown facility %02X, "
                                "values %02X, %02X, %02X\n",
                                p[0], p[1], p[2], p[3]);
@@ -132,26 +138,26 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         len -= 4;
                         break;
                 case X25_FAC_CLASS_D:
+                        if (len < p[1] + 2)
+                                return 0;
                         switch (*p) {
                         case X25_FAC_CALLING_AE:
-                                if (p[1] > X25_MAX_DTE_FACIL_LEN)
-                                        break;
+                                if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+                                        return 0;
                                 dte_facs->calling_len = p[2];
                                 memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLING_AE;
                                 break;
                         case X25_FAC_CALLED_AE:
-                                if (p[1] > X25_MAX_DTE_FACIL_LEN)
-                                        break;
+                                if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+                                        return 0;
                                 dte_facs->called_len = p[2];
                                 memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLED_AE;
                                 break;
                         default:
                                 printk(KERN_DEBUG "X.25: unknown facility %02X,"
-                                        "length %d, values %02X, %02X, "
-                                        "%02X, %02X\n",
-                                        p[0], p[1], p[2], p[3], p[4], p[5]);
+                                        "length %d\n", p[0], p[1]);
                                 break;
                         }
                         len -= p[1] + 2;
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 63178961efa..f729f022be6 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -119,6 +119,8 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                                                 &x25->vc_facil_mask);
                         if (len > 0)
                                 skb_pull(skb, len);
+                        else
+                                return -1;
                         /*
                          *      Copy any Call User Data.
                          */