Merge branch 'linus' into core/rcu

22 files changed, 277 insertions, 121 deletions

diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 9d52ebfc196..05fafdc2eea 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -188,10 +188,13 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct br2684_dev *brdev,
                                 return 0;
                         }
                 }
-        } else {
-                skb_push(skb, 2);
-                if (brdev->payload == p_bridged)
+        } else { /* e_vc */
+                if (brdev->payload == p_bridged) {
+                        skb_push(skb, 2);
                         memset(skb->data, 0, 2);
+                } else { /* p_routed */
+                        skb_pull(skb, ETH_HLEN);
+                }
         }
         skb_debug(skb);
 
@@ -377,11 +380,8 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                                  (skb->data + 6, ethertype_ipv4,
                                   sizeof(ethertype_ipv4)) == 0)
                                 skb->protocol = __constant_htons(ETH_P_IP);
-                        else {
-                                brdev->stats.rx_errors++;
-                                dev_kfree_skb(skb);
-                                return;
-                        }
+                        else
+                                goto error;
                         skb_pull(skb, sizeof(llc_oui_ipv4));
                         skb_reset_network_header(skb);
                         skb->pkt_type = PACKET_HOST;
@@ -394,44 +394,56 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                            (memcmp(skb->data, llc_oui_pid_pad, 7) == 0)) {
                         skb_pull(skb, sizeof(llc_oui_pid_pad));
                         skb->protocol = eth_type_trans(skb, net_dev);
-                } else {
-                        brdev->stats.rx_errors++;
-                        dev_kfree_skb(skb);
-                        return;
-                }
+                } else
+                        goto error;
 
-        } else {
-                /* first 2 chars should be 0 */
-                if (*((u16 *) (skb->data)) != 0) {
-                        brdev->stats.rx_errors++;
-                        dev_kfree_skb(skb);
-                        return;
+        } else { /* e_vc */
+                if (brdev->payload == p_routed) {
+                        struct iphdr *iph;
+
+                        skb_reset_network_header(skb);
+                        iph = ip_hdr(skb);
+                        if (iph->version == 4)
+                                skb->protocol = __constant_htons(ETH_P_IP);
+                        else if (iph->version == 6)
+                                skb->protocol = __constant_htons(ETH_P_IPV6);
+                        else
+                                goto error;
+                        skb->pkt_type = PACKET_HOST;
+                } else { /* p_bridged */
+                        /* first 2 chars should be 0 */
+                        if (*((u16 *) (skb->data)) != 0)
+                                goto error;
+                        skb_pull(skb, BR2684_PAD_LEN);
+                        skb->protocol = eth_type_trans(skb, net_dev);
                 }
-                skb_pull(skb, BR2684_PAD_LEN + ETH_HLEN);       /* pad, dstmac, srcmac, ethtype */
-                skb->protocol = eth_type_trans(skb, net_dev);
         }
 
 #ifdef CONFIG_ATM_BR2684_IPFILTER
-        if (unlikely(packet_fails_filter(skb->protocol, brvcc, skb))) {
-                brdev->stats.rx_dropped++;
-                dev_kfree_skb(skb);
-                return;
-        }
+        if (unlikely(packet_fails_filter(skb->protocol, brvcc, skb)))
+                goto dropped;
 #endif /* CONFIG_ATM_BR2684_IPFILTER */
         skb->dev = net_dev;
         ATM_SKB(skb)->vcc = atmvcc;     /* needed ? */
         pr_debug("received packet's protocol: %x\n", ntohs(skb->protocol));
         skb_debug(skb);
-        if (unlikely(!(net_dev->flags & IFF_UP))) {
-                /* sigh, interface is down */
-                brdev->stats.rx_dropped++;
-                dev_kfree_skb(skb);
-                return;
-        }
+        /* sigh, interface is down? */
+        if (unlikely(!(net_dev->flags & IFF_UP)))
+                goto dropped;
         brdev->stats.rx_packets++;
         brdev->stats.rx_bytes += skb->len;
         memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
         netif_rx(skb);
+        return;
+
+dropped:
+        brdev->stats.rx_dropped++;
+        goto free_skb;
+error:
+        brdev->stats.rx_errors++;
+free_skb:
+        dev_kfree_skb(skb);
+        return;
 }
 
 /*
@@ -518,9 +530,9 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
                 struct sk_buff *next = skb->next;
 
                 skb->next = skb->prev = NULL;
+                br2684_push(atmvcc, skb);
                 BRPRIV(skb->dev)->stats.rx_bytes -= skb->len;
                 BRPRIV(skb->dev)->stats.rx_packets--;
-                br2684_push(atmvcc, skb);
 
                 skb = next;
         }
diff --git a/net/core/dev.c b/net/core/dev.c
index 58296307787..c421a1f8f0b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -119,6 +119,7 @@
 #include <linux/err.h>
 #include <linux/ctype.h>
 #include <linux/if_arp.h>
+#include <linux/if_vlan.h>
 
 #include "net-sysfs.h"
 
@@ -1362,6 +1363,29 @@ void netif_device_attach(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_device_attach);
 
+static bool can_checksum_protocol(unsigned long features, __be16 protocol)
+{
+        return ((features & NETIF_F_GEN_CSUM) ||
+                ((features & NETIF_F_IP_CSUM) &&
+                 protocol == htons(ETH_P_IP)) ||
+                ((features & NETIF_F_IPV6_CSUM) &&
+                 protocol == htons(ETH_P_IPV6)));
+}
+
+static bool dev_can_checksum(struct net_device *dev, struct sk_buff *skb)
+{
+        if (can_checksum_protocol(dev->features, skb->protocol))
+                return true;
+
+        if (skb->protocol == htons(ETH_P_8021Q)) {
+                struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+                if (can_checksum_protocol(dev->features & dev->vlan_features,
+                                          veh->h_vlan_encapsulated_proto))
+                        return true;
+        }
+
+        return false;
+}
 
 /*
  * Invalidate hardware checksum when packet is to be mangled, and
@@ -1640,14 +1664,8 @@ int dev_queue_xmit(struct sk_buff *skb)
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 skb_set_transport_header(skb, skb->csum_start -
                                               skb_headroom(skb));
-
-                if (!(dev->features & NETIF_F_GEN_CSUM) &&
-                    !((dev->features & NETIF_F_IP_CSUM) &&
-                      skb->protocol == htons(ETH_P_IP)) &&
-                    !((dev->features & NETIF_F_IPV6_CSUM) &&
-                      skb->protocol == htons(ETH_P_IPV6)))
-                        if (skb_checksum_help(skb))
-                                goto out_kfree_skb;
+                if (!dev_can_checksum(dev, skb) && skb_checksum_help(skb))
+                        goto out_kfree_skb;
         }
 
 gso:
@@ -2059,6 +2077,10 @@ int netif_receive_skb(struct sk_buff *skb)
 
         rcu_read_lock();
 
+        /* Don't receive packets in an exiting network namespace */
+        if (!net_alive(dev_net(skb->dev)))
+                goto out;
+
 #ifdef CONFIG_NET_CLS_ACT
         if (skb->tc_verd & TC_NCLS) {
                 skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 72b4c184dd8..7c52fe277b6 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -140,6 +140,9 @@ static void cleanup_net(struct work_struct *work)
         struct pernet_operations *ops;
         struct net *net;
 
+        /* Be very certain incoming network packets will not find us */
+        rcu_barrier();
+
         net = container_of(work, struct net, work);
 
         mutex_lock(&net_mutex);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 045e799d3e1..ec834480abe 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -466,9 +466,9 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                 reqp=&lopt->syn_table[i];
                 while ((req = *reqp) != NULL) {
                         if (time_after_eq(now, req->expires)) {
-                                if ((req->retrans < (inet_rsk(req)->acked ? max_retries : thresh)) &&
-                                    (inet_rsk(req)->acked ||
-                                     !req->rsk_ops->rtx_syn_ack(parent, req))) {
+                                if ((req->retrans < thresh ||
+                                     (inet_rsk(req)->acked && req->retrans < max_retries))
+                                    && !req->rsk_ops->rtx_syn_ack(parent, req)) {
                                         unsigned long timeo;
 
                                         if (req->retrans++ == 0)
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 04578593e10..d2a887fc8d9 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -556,7 +556,6 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
 
         spin_lock_bh(&nf_nat_lock);
         hlist_del_rcu(&nat->bysource);
-        nat->ct = NULL;
         spin_unlock_bh(&nf_nat_lock);
 }
 
@@ -570,8 +569,8 @@ static void nf_nat_move_storage(void *new, void *old)
                 return;
 
         spin_lock_bh(&nf_nat_lock);
-        hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource);
         new_nat->ct = ct;
+        hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource);
         spin_unlock_bh(&nf_nat_lock);
 }
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index e7e091d365f..37a1ecd9d60 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -934,7 +934,7 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
               srcp  = inet->num;
 
         seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d",
+                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
                 i, src, srcp, dest, destp, sp->sk_state,
                 atomic_read(&sp->sk_wmem_alloc),
                 atomic_read(&sp->sk_rmem_alloc),
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 97a230026e1..12695be2c25 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -85,10 +85,6 @@
 int sysctl_tcp_tw_reuse __read_mostly;
 int sysctl_tcp_low_latency __read_mostly;
 
-/* Check TCP sequence numbers in ICMP packets. */
-#define ICMP_MIN_LENGTH 8
-
-void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb);
 
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 584e6d74e3a..7135279f3f8 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -52,7 +52,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
                 IP_ECN_clear(top_iph);
 
         top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
-                            0 : XFRM_MODE_SKB_CB(skb)->frag_off;
+                0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
         ip_select_ident(top_iph, dst->child, NULL);
 
         top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 4e5c8615832..17eb48b8e32 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -102,6 +102,15 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         if (hdr->version != 6)
                 goto err;
 
+        /*
+         * RFC4291 2.5.3
+         * A packet received on an interface with a destination address
+         * of loopback must be dropped.
+         */
+        if (!(dev->flags & IFF_LOOPBACK) &&
+            ipv6_addr_loopback(&hdr->daddr))
+                goto err;
+
         skb->transport_header = skb->network_header + sizeof(*hdr);
         IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index c042ce19bd1..86e28a75267 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -345,18 +345,21 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
         case IPV6_DSTOPTS:
         {
                 struct ipv6_txoptions *opt;
+
+                /* remove any sticky options header with a zero option
+                 * length, per RFC3542.
+                 */
                 if (optlen == 0)
                         optval = NULL;
+                else if (optlen < sizeof(struct ipv6_opt_hdr) ||
+                         optlen & 0x7 || optlen > 8 * 255)
+                        goto e_inval;
 
                 /* hop-by-hop / destination options are privileged option */
                 retv = -EPERM;
                 if (optname != IPV6_RTHDR && !capable(CAP_NET_RAW))
                         break;
 
-                if (optlen < sizeof(struct ipv6_opt_hdr) ||
-                    optlen & 0x7 || optlen > 8 * 255)
-                        goto e_inval;
-
                 opt = ipv6_renew_options(sk, np->opt, optname,
                                          (struct ipv6_opt_hdr __user *)optval,
                                          optlen);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 3de6ffdaedf..32e871a6c25 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -222,15 +222,18 @@ __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 
 }
 
-static int ipip6_tunnel_get_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
+static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
+                                struct ip_tunnel_prl __user *a)
 {
-        struct ip_tunnel_prl *kp;
+        struct ip_tunnel_prl kprl, *kp;
         struct ip_tunnel_prl_entry *prl;
         unsigned int cmax, c = 0, ca, len;
         int ret = 0;
 
-        cmax = a->datalen / sizeof(*a);
-        if (cmax > 1 && a->addr != htonl(INADDR_ANY))
+        if (copy_from_user(&kprl, a, sizeof(kprl)))
+                return -EFAULT;
+        cmax = kprl.datalen / sizeof(kprl);
+        if (cmax > 1 && kprl.addr != htonl(INADDR_ANY))
                 cmax = 1;
 
         /* For simple GET or for root users,
@@ -261,26 +264,25 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
         for (prl = t->prl; prl; prl = prl->next) {
                 if (c > cmax)
                         break;
-                if (a->addr != htonl(INADDR_ANY) && prl->addr != a->addr)
+                if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
                         continue;
                 kp[c].addr = prl->addr;
                 kp[c].flags = prl->flags;
                 c++;
-                if (a->addr != htonl(INADDR_ANY))
+                if (kprl.addr != htonl(INADDR_ANY))
                         break;
         }
 out:
         read_unlock(&ipip6_lock);
 
         len = sizeof(*kp) * c;
-        ret = len ? copy_to_user(a->data, kp, len) : 0;
+        ret = 0;
+        if ((len && copy_to_user(a + 1, kp, len)) || put_user(len, &a->datalen))
+                ret = -EFAULT;
 
         kfree(kp);
-        if (ret)
-                return -EFAULT;
 
-        a->datalen = len;
-        return 0;
+        return ret;
 }
 
 static int
@@ -873,11 +875,20 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 break;
 
         case SIOCGETPRL:
+                err = -EINVAL;
+                if (dev == sitn->fb_tunnel_dev)
+                        goto done;
+                err = -ENOENT;
+                if (!(t = netdev_priv(dev)))
+                        goto done;
+                err = ipip6_tunnel_get_prl(t, ifr->ifr_ifru.ifru_data);
+                break;
+
         case SIOCADDPRL:
         case SIOCDELPRL:
         case SIOCCHGPRL:
                 err = -EPERM;
-                if (cmd != SIOCGETPRL && !capable(CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                         goto done;
                 err = -EINVAL;
                 if (dev == sitn->fb_tunnel_dev)
@@ -890,12 +901,6 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                         goto done;
 
                 switch (cmd) {
-                case SIOCGETPRL:
-                        err = ipip6_tunnel_get_prl(t, &prl);
-                        if (!err && copy_to_user(ifr->ifr_ifru.ifru_data,
-                                                 &prl, sizeof(prl)))
-                                err = -EFAULT;
-                        break;
                 case SIOCDELPRL:
                         err = ipip6_tunnel_del_prl(t, &prl);
                         break;
@@ -904,8 +909,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                         err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
                         break;
                 }
-                if (cmd != SIOCGETPRL)
-                        netdev_state_change(dev);
+                netdev_state_change(dev);
                 break;
 
         default:
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 1d7dd54aace..c80d5899f27 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1132,7 +1132,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         ieee80211_tx_handler *handler;
         struct ieee80211_tx_data tx;
         ieee80211_tx_result res = TX_DROP, res_prepare;
-        int ret, i;
+        int ret, i, retries = 0;
 
         WARN_ON(__ieee80211_queue_pending(local, control->queue));
 
@@ -1216,6 +1216,13 @@ retry:
                 if (!__ieee80211_queue_stopped(local, control->queue)) {
                         clear_bit(IEEE80211_LINK_STATE_PENDING,
                                   &local->state[control->queue]);
+                        retries++;
+                        /*
+                         * Driver bug, it's rejecting packets but
+                         * not stopping queues.
+                         */
+                        if (WARN_ON_ONCE(retries > 5))
+                                goto drop;
                         goto retry;
                 }
                 memcpy(&store->control, control,
@@ -1562,13 +1569,13 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
          * be cloned. This could happen, e.g., with Linux bridge code passing
          * us broadcast frames. */
 
-        if (head_need > 0 || skb_header_cloned(skb)) {
+        if (head_need > 0 || skb_cloned(skb)) {
 #if 0
                 printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
                        "of headroom\n", dev->name, head_need);
 #endif
 
-                if (skb_header_cloned(skb))
+                if (skb_cloned(skb))
                         I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
                 else
                         I802_DEBUG_INC(local->tx_expand_skb_head);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index a8bb8e31b1e..6106cb79060 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -496,7 +496,8 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
             sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                if (sdata->u.sta.state == IEEE80211_ASSOCIATED) {
+                if (sdata->u.sta.state == IEEE80211_ASSOCIATED ||
+                    sdata->u.sta.state == IEEE80211_IBSS_JOINED) {
                         ap_addr->sa_family = ARPHRD_ETHER;
                         memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
                         return 0;
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index dc1598b8600..635b996c8c3 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -673,7 +673,7 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                         if (net_ratelimit())
                                 printk(KERN_DEBUG "allocated aggregation queue"
-                                        " %d tid %d addr %s pool=0x%lX",
+                                        " %d tid %d addr %s pool=0x%lX\n",
                                         i, tid, print_mac(mac, sta->addr),
                                         q->qdisc_pool[0]);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index bcc19fa4ed1..8a3f8b34e46 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -59,12 +59,19 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id, gfp_t gfp)
         if (!*ext)
                 return NULL;
 
+        INIT_RCU_HEAD(&(*ext)->rcu);
         (*ext)->offset[id] = off;
         (*ext)->len = len;
 
         return (void *)(*ext) + off;
 }
 
+static void __nf_ct_ext_free_rcu(struct rcu_head *head)
+{
+        struct nf_ct_ext *ext = container_of(head, struct nf_ct_ext, rcu);
+        kfree(ext);
+}
+
 void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
 {
         struct nf_ct_ext *new;
@@ -106,7 +113,7 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
                                         (void *)ct->ext + ct->ext->offset[i]);
                         rcu_read_unlock();
                 }
-                kfree(ct->ext);
+                call_rcu(&ct->ext->rcu, __nf_ct_ext_free_rcu);
                 ct->ext = new;
         }
 
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 95da1a24aab..2f83c158934 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -619,6 +619,7 @@ static const struct nf_conntrack_expect_policy h245_exp_policy = {
 static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = {
         .name                   = "H.245",
         .me                     = THIS_MODULE,
+        .tuple.src.l3num        = AF_UNSPEC,
         .tuple.dst.protonum     = IPPROTO_UDP,
         .help                   = h245_help,
         .expect_policy          = &h245_exp_policy,
@@ -1765,6 +1766,7 @@ static void __exit nf_conntrack_h323_fini(void)
         nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
         nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
         nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
+        nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
         kfree(h323_buffer);
         pr_debug("nf_ct_h323: fini\n");
 }
@@ -1777,28 +1779,34 @@ static int __init nf_conntrack_h323_init(void)
         h323_buffer = kmalloc(65536, GFP_KERNEL);
         if (!h323_buffer)
                 return -ENOMEM;
-        ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]);
+        ret = nf_conntrack_helper_register(&nf_conntrack_helper_h245);
         if (ret < 0)
                 goto err1;
-        ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]);
+        ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]);
         if (ret < 0)
                 goto err2;
-        ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]);
+        ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]);
         if (ret < 0)
                 goto err3;
-        ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]);
+        ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]);
         if (ret < 0)
                 goto err4;
+        ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]);
+        if (ret < 0)
+                goto err5;
         pr_debug("nf_ct_h323: init success\n");
         return 0;
 
-err4:
+err5:
         nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
-err3:
+err4:
         nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
-err2:
+err3:
         nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
+err2:
+        nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
 err1:
+        kfree(h323_buffer);
         return ret;
 }
 
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index f5aa23c3e88..3e1191cecaf 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -444,8 +444,11 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (ops->dumpit == NULL)
                         return -EOPNOTSUPP;
 
-                return netlink_dump_start(genl_sock, skb, nlh,
-                                          ops->dumpit, ops->done);
+                genl_unlock();
+                err = netlink_dump_start(genl_sock, skb, nlh,
+                                         ops->dumpit, ops->done);
+                genl_lock();
+                return err;
         }
 
         if (ops->doit == NULL)
@@ -603,9 +606,6 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
         int chains_to_skip = cb->args[0];
         int fams_to_skip = cb->args[1];
 
-        if (chains_to_skip != 0)
-                genl_lock();
-
         for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
                 if (i < chains_to_skip)
                         continue;
@@ -623,9 +623,6 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
         }
 
 errout:
-        if (chains_to_skip != 0)
-                genl_unlock();
-
         cb->args[0] = i;
         cb->args[1] = n;
 
@@ -770,7 +767,7 @@ static int __init genl_init(void)
 
         /* we'll bump the group number right afterwards */
         genl_sock = netlink_kernel_create(&init_net, NETLINK_GENERIC, 0,
-                                          genl_rcv, NULL, THIS_MODULE);
+                                          genl_rcv, &genl_mutex, THIS_MODULE);
         if (genl_sock == NULL)
                 panic("GENL: Cannot initialize generic netlink\n");
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 5bc1ed49018..6807c97985a 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -28,6 +28,7 @@
  * $Id: sch_htb.c,v 1.25 2003/12/07 11:08:25 devik Exp devik $
  */
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -53,13 +54,17 @@
 */
 
 #define HTB_HSIZE 16            /* classid hash size */
-#define HTB_HYSTERESIS 1        /* whether to use mode hysteresis for speedup */
+static int htb_hysteresis __read_mostly = 0; /* whether to use mode hysteresis for speedup */
 #define HTB_VER 0x30011         /* major must be matched with number suplied by TC as version */
 
 #if HTB_VER >> 16 != TC_HTB_PROTOVER
 #error "Mismatched sch_htb.c and pkt_sch.h"
 #endif
 
+/* Module parameter and sysfs export */
+module_param    (htb_hysteresis, int, 0640);
+MODULE_PARM_DESC(htb_hysteresis, "Hysteresis mode, less CPU load, less accurate");
+
 /* used internaly to keep status of single class */
 enum htb_cmode {
         HTB_CANT_SEND,          /* class can't send and can't borrow */
@@ -462,19 +467,21 @@ static void htb_deactivate_prios(struct htb_sched *q, struct htb_class *cl)
                 htb_remove_class_from_row(q, cl, mask);
 }
 
-#if HTB_HYSTERESIS
 static inline long htb_lowater(const struct htb_class *cl)
 {
-        return cl->cmode != HTB_CANT_SEND ? -cl->cbuffer : 0;
+        if (htb_hysteresis)
+                return cl->cmode != HTB_CANT_SEND ? -cl->cbuffer : 0;
+        else
+                return 0;
 }
 static inline long htb_hiwater(const struct htb_class *cl)
 {
-        return cl->cmode == HTB_CAN_SEND ? -cl->buffer : 0;
+        if (htb_hysteresis)
+                return cl->cmode == HTB_CAN_SEND ? -cl->buffer : 0;
+        else
+                return 0;
 }
-#else
-#define htb_lowater(cl) (0)
-#define htb_hiwater(cl) (0)
-#endif
+
 
 /**
  * htb_class_mode - computes and returns current class mode
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 532634861db..024c3ebd966 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -474,6 +474,15 @@ static void sctp_association_destroy(struct sctp_association *asoc)
 void sctp_assoc_set_primary(struct sctp_association *asoc,
                             struct sctp_transport *transport)
 {
+        int changeover = 0;
+
+        /* it's a changeover only if we already have a primary path
+         * that we are changing
+         */
+        if (asoc->peer.primary_path != NULL &&
+            asoc->peer.primary_path != transport)
+                changeover = 1 ;
+
         asoc->peer.primary_path = transport;
 
         /* Set a default msg_name for events. */
@@ -499,12 +508,12 @@ void sctp_assoc_set_primary(struct sctp_association *asoc,
          * double switch to the same destination address.
          */
         if (transport->cacc.changeover_active)
-                transport->cacc.cycling_changeover = 1;
+                transport->cacc.cycling_changeover = changeover;
 
         /* 2) The sender MUST set CHANGEOVER_ACTIVE to indicate that
          * a changeover has occurred.
          */
-        transport->cacc.changeover_active = 1;
+        transport->cacc.changeover_active = changeover;
 
         /* 3) The sender MUST store the next TSN to be sent in
          * next_tsn_at_change.
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b435a193c5d..9258dfe784a 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -108,14 +108,23 @@ static __init int sctp_proc_init(void)
         }
 
         if (sctp_snmp_proc_init())
-                goto out_nomem;
+                goto out_snmp_proc_init;
         if (sctp_eps_proc_init())
-                goto out_nomem;
+                goto out_eps_proc_init;
         if (sctp_assocs_proc_init())
-                goto out_nomem;
+                goto out_assocs_proc_init;
 
         return 0;
 
+out_assocs_proc_init:
+        sctp_eps_proc_exit();
+out_eps_proc_init:
+        sctp_snmp_proc_exit();
+out_snmp_proc_init:
+        if (proc_net_sctp) {
+                proc_net_sctp = NULL;
+                remove_proc_entry("sctp", init_net.proc_net);
+        }
 out_nomem:
         return -ENOMEM;
 }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index e7e3baf7009..0dbcde6758e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4401,7 +4401,9 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len,
         if (copy_from_user(&getaddrs, optval, len))
                 return -EFAULT;
 
-        if (getaddrs.addr_num <= 0) return -EINVAL;
+        if (getaddrs.addr_num <= 0 ||
+            getaddrs.addr_num >= (INT_MAX / sizeof(union sctp_addr)))
+                return -EINVAL;
         /*
          *  For UDP-style sockets, id specifies the association to query.
          *  If the id field is set to the value '0' then the locally bound
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e18cd3628db..657835f227d 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -169,6 +169,11 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk)
         return (unix_peer(osk) == NULL || unix_our_peer(sk, osk));
 }
 
+static inline int unix_recvq_full(struct sock const *sk)
+{
+        return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
+}
+
 static struct sock *unix_peer_get(struct sock *s)
 {
         struct sock *peer;
@@ -482,6 +487,8 @@ static int unix_socketpair(struct socket *, struct socket *);
 static int unix_accept(struct socket *, struct socket *, int);
 static int unix_getname(struct socket *, struct sockaddr *, int *, int);
 static unsigned int unix_poll(struct file *, struct socket *, poll_table *);
+static unsigned int unix_datagram_poll(struct file *, struct socket *,
+                                       poll_table *);
 static int unix_ioctl(struct socket *, unsigned int, unsigned long);
 static int unix_shutdown(struct socket *, int);
 static int unix_stream_sendmsg(struct kiocb *, struct socket *,
@@ -527,7 +534,7 @@ static const struct proto_ops unix_dgram_ops = {
         .socketpair =   unix_socketpair,
         .accept =       sock_no_accept,
         .getname =      unix_getname,
-        .poll =         datagram_poll,
+        .poll =         unix_datagram_poll,
         .ioctl =        unix_ioctl,
         .listen =       sock_no_listen,
         .shutdown =     unix_shutdown,
@@ -548,7 +555,7 @@ static const struct proto_ops unix_seqpacket_ops = {
         .socketpair =   unix_socketpair,
         .accept =       unix_accept,
         .getname =      unix_getname,
-        .poll =         datagram_poll,
+        .poll =         unix_datagram_poll,
         .ioctl =        unix_ioctl,
         .listen =       unix_listen,
         .shutdown =     unix_shutdown,
@@ -983,8 +990,7 @@ static long unix_wait_for_peer(struct sock *other, long timeo)
 
         sched = !sock_flag(other, SOCK_DEAD) &&
                 !(other->sk_shutdown & RCV_SHUTDOWN) &&
-                (skb_queue_len(&other->sk_receive_queue) >
-                 other->sk_max_ack_backlog);
+                unix_recvq_full(other);
 
         unix_state_unlock(other);
 
@@ -1058,8 +1064,7 @@ restart:
         if (other->sk_state != TCP_LISTEN)
                 goto out_unlock;
 
-        if (skb_queue_len(&other->sk_receive_queue) >
-            other->sk_max_ack_backlog) {
+        if (unix_recvq_full(other)) {
                 err = -EAGAIN;
                 if (!timeo)
                         goto out_unlock;
@@ -1428,9 +1433,7 @@ restart:
                         goto out_unlock;
         }
 
-        if (unix_peer(other) != sk &&
-            (skb_queue_len(&other->sk_receive_queue) >
-             other->sk_max_ack_backlog)) {
+        if (unix_peer(other) != sk && unix_recvq_full(other)) {
                 if (!timeo) {
                         err = -EAGAIN;
                         goto out_unlock;
@@ -1991,6 +1994,64 @@ static unsigned int unix_poll(struct file * file, struct socket *sock, poll_tabl
         return mask;
 }
 
+static unsigned int unix_datagram_poll(struct file *file, struct socket *sock,
+                                       poll_table *wait)
+{
+        struct sock *sk = sock->sk, *peer;
+        unsigned int mask;
+
+        poll_wait(file, sk->sk_sleep, wait);
+
+        peer = unix_peer_get(sk);
+        if (peer) {
+                if (peer != sk) {
+                        /*
+                         * Writability of a connected socket additionally
+                         * depends on the state of the receive queue of the
+                         * peer.
+                         */
+                        poll_wait(file, &unix_sk(peer)->peer_wait, wait);
+                } else {
+                        sock_put(peer);
+                        peer = NULL;
+                }
+        }
+
+        mask = 0;
+
+        /* exceptional events? */
+        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+                mask |= POLLERR;
+        if (sk->sk_shutdown & RCV_SHUTDOWN)
+                mask |= POLLRDHUP;
+        if (sk->sk_shutdown == SHUTDOWN_MASK)
+                mask |= POLLHUP;
+
+        /* readable? */
+        if (!skb_queue_empty(&sk->sk_receive_queue) ||
+            (sk->sk_shutdown & RCV_SHUTDOWN))
+                mask |= POLLIN | POLLRDNORM;
+
+        /* Connection-based need to check for termination and startup */
+        if (sk->sk_type == SOCK_SEQPACKET) {
+                if (sk->sk_state == TCP_CLOSE)
+                        mask |= POLLHUP;
+                /* connection hasn't started yet? */
+                if (sk->sk_state == TCP_SYN_SENT)
+                        return mask;
+        }
+
+        /* writable? */
+        if (unix_writable(sk) && !(peer && unix_recvq_full(peer)))
+                mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
+        else
+                set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
+
+        if (peer)
+                sock_put(peer);
+
+        return mask;
+}
 
 #ifdef CONFIG_PROC_FS
 static struct sock *first_unix_socket(int *i)