Merge branch 'bugfixes' into nfs-for-2.6.38

Conflicts:
	fs/nfs/nfs2xdr.c
	fs/nfs/nfs3xdr.c
	fs/nfs/nfs4xdr.c

26 files changed, 278 insertions, 113 deletions

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index fa642aa652b..432a9a633e8 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -311,6 +311,7 @@ static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
         d->state      = BT_OPEN;
         d->flags      = 0;
         d->mscex      = 0;
+        d->sec_level  = BT_SECURITY_LOW;
         d->mtu        = RFCOMM_DEFAULT_MTU;
         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index eb5b256ffc8..543b3262d00 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -437,7 +437,7 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         ip6h = ipv6_hdr(skb);
 
         *(__force __be32 *)ip6h = htonl(0x60000000);
-        ip6h->payload_len = 8 + sizeof(*mldq);
+        ip6h->payload_len = htons(8 + sizeof(*mldq));
         ip6h->nexthdr = IPPROTO_HOPOPTS;
         ip6h->hop_limit = 1;
         ipv6_addr_set(&ip6h->saddr, 0, 0, 0, 0);
@@ -1430,7 +1430,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                                  struct net_bridge_port *port,
                                  struct sk_buff *skb)
 {
-        struct sk_buff *skb2 = skb;
+        struct sk_buff *skb2;
         struct ipv6hdr *ip6h;
         struct icmp6hdr *icmp6h;
         u8 nexthdr;
@@ -1469,15 +1469,15 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
         if (!skb2)
                 return -ENOMEM;
 
+        err = -EINVAL;
+        if (!pskb_may_pull(skb2, offset + sizeof(struct icmp6hdr)))
+                goto out;
+
         len -= offset - skb_network_offset(skb2);
 
         __skb_pull(skb2, offset);
         skb_reset_transport_header(skb2);
 
-        err = -EINVAL;
-        if (!pskb_may_pull(skb2, sizeof(*icmp6h)))
-                goto out;
-
         icmp6h = icmp6_hdr(skb2);
 
         switch (icmp6h->icmp6_type) {
@@ -1516,7 +1516,12 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
         switch (icmp6h->icmp6_type) {
         case ICMPV6_MGM_REPORT:
             {
-                struct mld_msg *mld = (struct mld_msg *)icmp6h;
+                struct mld_msg *mld;
+                if (!pskb_may_pull(skb2, sizeof(*mld))) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                mld = (struct mld_msg *)skb_transport_header(skb2);
                 BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
                 err = br_ip6_multicast_add_group(br, port, &mld->mld_mca);
                 break;
@@ -1529,15 +1534,18 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                 break;
         case ICMPV6_MGM_REDUCTION:
             {
-                struct mld_msg *mld = (struct mld_msg *)icmp6h;
+                struct mld_msg *mld;
+                if (!pskb_may_pull(skb2, sizeof(*mld))) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                mld = (struct mld_msg *)skb_transport_header(skb2);
                 br_ip6_multicast_leave_group(br, port, &mld->mld_mca);
             }
         }
 
 out:
-        __skb_push(skb2, offset);
-        if (skb2 != skb)
-                kfree_skb(skb2);
+        kfree_skb(skb2);
         return err;
 }
 #endif
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 35cf27087b5..e3d7aefa918 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -50,6 +50,8 @@ static void br_send_bpdu(struct net_bridge_port *p,
 
         llc_mac_hdr_init(skb, p->dev->dev_addr, p->br->group_addr);
 
+        skb_reset_mac_header(skb);
+
         NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
                 dev_queue_xmit);
 }
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 6faa8256e10..9d5e8accfab 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -125,7 +125,7 @@ struct bcm_sock {
         struct list_head tx_ops;
         unsigned long dropped_usr_msgs;
         struct proc_dir_entry *bcm_proc_read;
-        char procname [20]; /* pointer printed in ASCII with \0 */
+        char procname [32]; /* inode number in decimal with \0 */
 };
 
 static inline struct bcm_sock *bcm_sk(const struct sock *sk)
@@ -1521,7 +1521,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
 
         if (proc_dir) {
                 /* unique socket address as filename */
-                sprintf(bo->procname, "%p", sock);
+                sprintf(bo->procname, "%lu", sock_i_ino(sk));
                 bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
                                                      proc_dir,
                                                      &bcm_proc_fops, sk);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 1c7a2ec4f3c..b6ff4a1519a 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -97,11 +97,9 @@ struct workqueue_struct *ceph_msgr_wq;
 int ceph_msgr_init(void)
 {
         ceph_msgr_wq = create_workqueue("ceph-msgr");
-        if (IS_ERR(ceph_msgr_wq)) {
-                int ret = PTR_ERR(ceph_msgr_wq);
-                pr_err("msgr_init failed to create workqueue: %d\n", ret);
-                ceph_msgr_wq = NULL;
-                return ret;
+        if (!ceph_msgr_wq) {
+                pr_err("msgr_init failed to create workqueue\n");
+                return -ENOMEM;
         }
         return 0;
 }
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index ac34feeb2b3..1a040e64c69 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -13,7 +13,7 @@
  * build a vector of user pages
  */
 struct page **ceph_get_direct_page_vector(const char __user *data,
-                                          int num_pages)
+                                          int num_pages, bool write_page)
 {
         struct page **pages;
         int rc;
@@ -24,24 +24,27 @@ struct page **ceph_get_direct_page_vector(const char __user *data,
 
         down_read(&current->mm->mmap_sem);
         rc = get_user_pages(current, current->mm, (unsigned long)data,
-                            num_pages, 0, 0, pages, NULL);
+                            num_pages, write_page, 0, pages, NULL);
         up_read(&current->mm->mmap_sem);
-        if (rc < 0)
+        if (rc < num_pages)
                 goto fail;
         return pages;
 
 fail:
-        kfree(pages);
+        ceph_put_page_vector(pages, rc > 0 ? rc : 0, false);
         return ERR_PTR(rc);
 }
 EXPORT_SYMBOL(ceph_get_direct_page_vector);
 
-void ceph_put_page_vector(struct page **pages, int num_pages)
+void ceph_put_page_vector(struct page **pages, int num_pages, bool dirty)
 {
         int i;
 
-        for (i = 0; i < num_pages; i++)
+        for (i = 0; i < num_pages; i++) {
+                if (dirty)
+                        set_page_dirty_lock(pages[i]);
                 put_page(pages[i]);
+        }
         kfree(pages);
 }
 EXPORT_SYMBOL(ceph_put_page_vector);
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 82a4369ae15..a20e5d3bbfa 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -181,8 +181,7 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
 {
         int ret = 0;
 
-        if (rule->iifindex && (rule->iifindex != fl->iif) &&
-            !(fl->flags & FLOWI_FLAG_MATCH_ANY_IIF))
+        if (rule->iifindex && (rule->iifindex != fl->iif))
                 goto out;
 
         if (rule->oifindex && (rule->oifindex != fl->oif))
diff --git a/net/core/sock.c b/net/core/sock.c
index fb608011146..e5af8d5d5b5 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1009,6 +1009,36 @@ static void sock_copy(struct sock *nsk, const struct sock *osk)
 #endif
 }
 
+/*
+ * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
+ * un-modified. Special care is taken when initializing object to zero.
+ */
+static inline void sk_prot_clear_nulls(struct sock *sk, int size)
+{
+        if (offsetof(struct sock, sk_node.next) != 0)
+                memset(sk, 0, offsetof(struct sock, sk_node.next));
+        memset(&sk->sk_node.pprev, 0,
+               size - offsetof(struct sock, sk_node.pprev));
+}
+
+void sk_prot_clear_portaddr_nulls(struct sock *sk, int size)
+{
+        unsigned long nulls1, nulls2;
+
+        nulls1 = offsetof(struct sock, __sk_common.skc_node.next);
+        nulls2 = offsetof(struct sock, __sk_common.skc_portaddr_node.next);
+        if (nulls1 > nulls2)
+                swap(nulls1, nulls2);
+
+        if (nulls1 != 0)
+                memset((char *)sk, 0, nulls1);
+        memset((char *)sk + nulls1 + sizeof(void *), 0,
+               nulls2 - nulls1 - sizeof(void *));
+        memset((char *)sk + nulls2 + sizeof(void *), 0,
+               size - nulls2 - sizeof(void *));
+}
+EXPORT_SYMBOL(sk_prot_clear_portaddr_nulls);
+
 static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
                 int family)
 {
@@ -1021,19 +1051,12 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
                 if (!sk)
                         return sk;
                 if (priority & __GFP_ZERO) {
-                        /*
-                         * caches using SLAB_DESTROY_BY_RCU should let
-                         * sk_node.next un-modified. Special care is taken
-                         * when initializing object to zero.
-                         */
-                        if (offsetof(struct sock, sk_node.next) != 0)
-                                memset(sk, 0, offsetof(struct sock, sk_node.next));
-                        memset(&sk->sk_node.pprev, 0,
-                               prot->obj_size - offsetof(struct sock,
-                                                         sk_node.pprev));
+                        if (prot->clear_sk)
+                                prot->clear_sk(sk, prot->obj_size);
+                        else
+                                sk_prot_clear_nulls(sk, prot->obj_size);
                 }
-        }
-        else
+        } else
                 sk = kmalloc(prot->obj_size, priority);
 
         if (sk != NULL) {
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index eb6f69a8f27..c19c1f739fb 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -163,13 +163,19 @@ struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
                                 .daddr = addr
                         }
                 },
-                .flags = FLOWI_FLAG_MATCH_ANY_IIF
         };
         struct fib_result res = { 0 };
         struct net_device *dev = NULL;
+        struct fib_table *local_table;
+
+#ifdef CONFIG_IP_MULTIPLE_TABLES
+        res.r = NULL;
+#endif
 
         rcu_read_lock();
-        if (fib_lookup(net, &fl, &res)) {
+        local_table = fib_get_table(net, RT_TABLE_LOCAL);
+        if (!local_table ||
+            fib_table_lookup(local_table, &fl, &res, FIB_LOOKUP_NOREF)) {
                 rcu_read_unlock();
                 return NULL;
         }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 987bf9adb31..93bfd95584f 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2585,9 +2585,10 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                         goto out;
 
                 /* RACE: Check return value of inet_select_addr instead. */
-                if (rcu_dereference(dev_out->ip_ptr) == NULL)
-                        goto out;       /* Wrong error code */
-
+                if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
+                        err = -ENETUNREACH;
+                        goto out;
+                }
                 if (ipv4_is_local_multicast(oldflp->fl4_dst) ||
                     ipv4_is_lbcast(oldflp->fl4_dst)) {
                         if (!fl.fl4_src)
@@ -2648,8 +2649,12 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
         }
 
         if (res.type == RTN_LOCAL) {
-                if (!fl.fl4_src)
-                        fl.fl4_src = fl.fl4_dst;
+                if (!fl.fl4_src) {
+                        if (res.fi->fib_prefsrc)
+                                fl.fl4_src = res.fi->fib_prefsrc;
+                        else
+                                fl.fl4_src = fl.fl4_dst;
+                }
                 dev_out = net->loopback_dev;
                 fl.oif = dev_out->ifindex;
                 res.fi = NULL;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index e13da6de1fc..d978bb2f748 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2030,7 +2030,7 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
 get_req:
                         req = icsk->icsk_accept_queue.listen_opt->syn_table[st->sbucket];
                 }
-                sk        = sk_next(st->syn_wait_sk);
+                sk        = sk_nulls_next(st->syn_wait_sk);
                 st->state = TCP_SEQ_STATE_LISTENING;
                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
         } else {
@@ -2039,7 +2039,7 @@ get_req:
                 if (reqsk_queue_len(&icsk->icsk_accept_queue))
                         goto start_req;
                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
-                sk = sk_next(sk);
+                sk = sk_nulls_next(sk);
         }
 get_sk:
         sk_nulls_for_each_from(sk, node) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 5e0a3a582a5..2d3ded4d078 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1899,6 +1899,7 @@ struct proto udp_prot = {
         .compat_setsockopt = compat_udp_setsockopt,
         .compat_getsockopt = compat_udp_getsockopt,
 #endif
+        .clear_sk          = sk_prot_clear_portaddr_nulls,
 };
 EXPORT_SYMBOL(udp_prot);
 
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index ab76aa928fa..aee9963f7f5 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -57,6 +57,7 @@ struct proto 	udplite_prot = {
         .compat_setsockopt = compat_udp_setsockopt,
         .compat_getsockopt = compat_udp_getsockopt,
 #endif
+        .clear_sk          = sk_prot_clear_portaddr_nulls,
 };
 EXPORT_SYMBOL(udplite_prot);
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 93b7a933a77..848b3559104 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2669,7 +2669,9 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
         ASSERT_RTNL();
 
-        rt6_ifdown(net, dev);
+        /* Flush routes if device is being removed or it is not loopback */
+        if (how || !(dev->flags & IFF_LOOPBACK))
+                rt6_ifdown(net, dev);
         neigh_ifdown(&nd_tbl, dev);
 
         idev = __in6_dev_get(dev);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 99157b4cd56..94b5bf132b2 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -56,7 +56,7 @@
 #include <net/checksum.h>
 #include <linux/mroute6.h>
 
-static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
 
 int __ip6_local_out(struct sk_buff *skb)
 {
@@ -145,14 +145,6 @@ static int ip6_finish_output2(struct sk_buff *skb)
         return -EINVAL;
 }
 
-static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
-{
-        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
-
-        return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
-               skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
-}
-
 static int ip6_finish_output(struct sk_buff *skb)
 {
         if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
@@ -601,7 +593,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
         return offset;
 }
 
-static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
         struct sk_buff *frag;
         struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 96455ffb76f..7659d6f16e6 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1565,11 +1565,16 @@ static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
 {
         struct rt6_info *rt, *nrt;
         int allfrag = 0;
-
+again:
         rt = rt6_lookup(net, daddr, saddr, ifindex, 0);
         if (rt == NULL)
                 return;
 
+        if (rt6_check_expired(rt)) {
+                ip6_del_rt(rt);
+                goto again;
+        }
+
         if (pmtu >= dst_mtu(&rt->dst))
                 goto out;
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 91def93bec8..cd6cb7c3e56 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1477,6 +1477,7 @@ struct proto udpv6_prot = {
         .compat_setsockopt = compat_udpv6_setsockopt,
         .compat_getsockopt = compat_udpv6_getsockopt,
 #endif
+        .clear_sk          = sk_prot_clear_portaddr_nulls,
 };
 
 static struct inet_protosw udpv6_protosw = {
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 5f48fadc27f..986c4de5292 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -55,6 +55,7 @@ struct proto udplitev6_prot = {
         .compat_setsockopt = compat_udpv6_setsockopt,
         .compat_getsockopt = compat_udpv6_getsockopt,
 #endif
+        .clear_sk          = sk_prot_clear_portaddr_nulls,
 };
 
 static struct inet_protosw udplite6_protosw = {
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 6434bd5ce08..8e688b3de9a 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -17,6 +17,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <net/dst.h>
 #include <net/ipv6.h>
+#include <net/ip6_route.h>
 #include <net/xfrm.h>
 
 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
@@ -88,8 +89,21 @@ static int xfrm6_output_finish(struct sk_buff *skb)
         return xfrm_output(skb);
 }
 
+static int __xfrm6_output(struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        struct xfrm_state *x = dst->xfrm;
+
+        if ((x && x->props.mode == XFRM_MODE_TUNNEL) &&
+            ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
+                dst_allfrag(skb_dst(skb)))) {
+                        return ip6_fragment(skb, xfrm6_output_finish);
+        }
+        return xfrm6_output_finish(skb);
+}
+
 int xfrm6_output(struct sk_buff *skb)
 {
         return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL,
-                       skb_dst(skb)->dev, xfrm6_output_finish);
+                       skb_dst(skb)->dev, __xfrm6_output);
 }
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index a6de3059746..c9890e25cd4 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2280,6 +2280,16 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 
         switch (optname) {
         case IRLMP_ENUMDEVICES:
+
+                /* Offset to first device entry */
+                offset = sizeof(struct irda_device_list) -
+                        sizeof(struct irda_device_info);
+
+                if (len < offset) {
+                        err = -EINVAL;
+                        goto out;
+                }
+
                 /* Ask lmp for the current discovery log */
                 discoveries = irlmp_get_discoveries(&list.len, self->mask.word,
                                                     self->nslots);
@@ -2290,15 +2300,9 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
                 }
 
                 /* Write total list length back to client */
-                if (copy_to_user(optval, &list,
-                                 sizeof(struct irda_device_list) -
-                                 sizeof(struct irda_device_info)))
+                if (copy_to_user(optval, &list, offset))
                         err = -EFAULT;
 
-                /* Offset to first device entry */
-                offset = sizeof(struct irda_device_list) -
-                        sizeof(struct irda_device_info);
-
                 /* Copy the list itself - watch for overflow */
                 if (list.len > 2048) {
                         err = -EINVAL;
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 239c4836a94..077a93dd167 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -780,6 +780,9 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
         mutex_lock(&sdata->u.ibss.mtx);
 
+        if (!sdata->u.ibss.ssid_len)
+                goto mgmt_out; /* not ready to merge yet */
+
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_PROBE_REQ:
                 ieee80211_rx_mgmt_probe_req(sdata, mgmt, skb->len);
@@ -797,6 +800,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 break;
         }
 
+ mgmt_out:
         mutex_unlock(&sdata->u.ibss.mtx);
 }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 54fb4a0e76f..b01e467b76c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1788,9 +1788,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 
                         fwd_skb = skb_copy(skb, GFP_ATOMIC);
 
-                        if (!fwd_skb && net_ratelimit())
+                        if (!fwd_skb && net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
                                                    sdata->name);
+                                goto out;
+                        }
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
                         memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
@@ -1828,6 +1830,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 }
         }
 
+ out:
         if (is_multicast_ether_addr(hdr->addr1) ||
             sdata->dev->flags & IFF_PROMISC)
                 return RX_CONTINUE;
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index ae344d1ba05..146097cb43a 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -1051,11 +1051,13 @@ void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_work *wk;
+        bool cleanup = false;
 
         mutex_lock(&local->mtx);
         list_for_each_entry(wk, &local->work_list, list) {
                 if (wk->sdata != sdata)
                         continue;
+                cleanup = true;
                 wk->type = IEEE80211_WORK_ABORT;
                 wk->started = true;
                 wk->timeout = jiffies;
@@ -1063,7 +1065,8 @@ void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&local->mtx);
 
         /* run cleanups etc. */
-        ieee80211_work_work(&local->work_work);
+        if (cleanup)
+                ieee80211_work_work(&local->work_work);
 
         mutex_lock(&local->mtx);
         list_for_each_entry(wk, &local->work_list, list) {
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 3cf478d012d..7150705f1d0 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -270,7 +270,6 @@ static unsigned int sfq_drop(struct Qdisc *sch)
                 /* It is difficult to believe, but ALL THE SLOTS HAVE LENGTH 1. */
                 d = q->next[q->tail];
                 q->next[q->tail] = q->next[d];
-                q->allot[q->next[d]] += q->quantum;
                 skb = q->qs[d].prev;
                 len = qdisc_pkt_len(skb);
                 __skb_unlink(skb, &q->qs[d]);
@@ -321,14 +320,13 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         sfq_inc(q, x);
         if (q->qs[x].qlen == 1) {               /* The flow is new */
                 if (q->tail == SFQ_DEPTH) {     /* It is the first flow */
-                        q->tail = x;
                         q->next[x] = x;
-                        q->allot[x] = q->quantum;
                 } else {
                         q->next[x] = q->next[q->tail];
                         q->next[q->tail] = x;
-                        q->tail = x;
                 }
+                q->tail = x;
+                q->allot[x] = q->quantum;
         }
         if (++sch->q.qlen <= q->limit) {
                 sch->bstats.bytes += qdisc_pkt_len(skb);
@@ -359,13 +357,13 @@ sfq_dequeue(struct Qdisc *sch)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
         struct sk_buff *skb;
-        sfq_index a, old_a;
+        sfq_index a, next_a;
 
         /* No active slots */
         if (q->tail == SFQ_DEPTH)
                 return NULL;
 
-        a = old_a = q->next[q->tail];
+        a = q->next[q->tail];
 
         /* Grab packet */
         skb = __skb_dequeue(&q->qs[a]);
@@ -376,17 +374,15 @@ sfq_dequeue(struct Qdisc *sch)
         /* Is the slot empty? */
         if (q->qs[a].qlen == 0) {
                 q->ht[q->hash[a]] = SFQ_DEPTH;
-                a = q->next[a];
-                if (a == old_a) {
+                next_a = q->next[a];
+                if (a == next_a) {
                         q->tail = SFQ_DEPTH;
                         return skb;
                 }
-                q->next[q->tail] = a;
-                q->allot[a] += q->quantum;
+                q->next[q->tail] = next_a;
         } else if ((q->allot[a] -= qdisc_pkt_len(skb)) <= 0) {
-                q->tail = a;
-                a = q->next[a];
                 q->allot[a] += q->quantum;
+                q->tail = a;
         }
         return skb;
 }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 0b9ee34ad35..fff0926b111 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5053,7 +5053,7 @@ static int sctp_getsockopt_partial_delivery_point(struct sock *sk, int len,
         if (copy_to_user(optval, &val, len))
                 return -EFAULT;
 
-        return -ENOTSUPP;
+        return 0;
 }
 
 /*
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index cd9e841e749..679cd674b81 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -552,6 +552,74 @@ void xdr_write_pages(struct xdr_stream *xdr, struct page **pages, unsigned int b
 }
 EXPORT_SYMBOL_GPL(xdr_write_pages);
 
+static void xdr_set_iov(struct xdr_stream *xdr, struct kvec *iov,
+                __be32 *p, unsigned int len)
+{
+        if (len > iov->iov_len)
+                len = iov->iov_len;
+        if (p == NULL)
+                p = (__be32*)iov->iov_base;
+        xdr->p = p;
+        xdr->end = (__be32*)(iov->iov_base + len);
+        xdr->iov = iov;
+        xdr->page_ptr = NULL;
+}
+
+static int xdr_set_page_base(struct xdr_stream *xdr,
+                unsigned int base, unsigned int len)
+{
+        unsigned int pgnr;
+        unsigned int maxlen;
+        unsigned int pgoff;
+        unsigned int pgend;
+        void *kaddr;
+
+        maxlen = xdr->buf->page_len;
+        if (base >= maxlen)
+                return -EINVAL;
+        maxlen -= base;
+        if (len > maxlen)
+                len = maxlen;
+
+        base += xdr->buf->page_base;
+
+        pgnr = base >> PAGE_SHIFT;
+        xdr->page_ptr = &xdr->buf->pages[pgnr];
+        kaddr = page_address(*xdr->page_ptr);
+
+        pgoff = base & ~PAGE_MASK;
+        xdr->p = (__be32*)(kaddr + pgoff);
+
+        pgend = pgoff + len;
+        if (pgend > PAGE_SIZE)
+                pgend = PAGE_SIZE;
+        xdr->end = (__be32*)(kaddr + pgend);
+        xdr->iov = NULL;
+        return 0;
+}
+
+static void xdr_set_next_page(struct xdr_stream *xdr)
+{
+        unsigned int newbase;
+
+        newbase = (1 + xdr->page_ptr - xdr->buf->pages) << PAGE_SHIFT;
+        newbase -= xdr->buf->page_base;
+
+        if (xdr_set_page_base(xdr, newbase, PAGE_SIZE) < 0)
+                xdr_set_iov(xdr, xdr->buf->tail, NULL, xdr->buf->len);
+}
+
+static bool xdr_set_next_buffer(struct xdr_stream *xdr)
+{
+        if (xdr->page_ptr != NULL)
+                xdr_set_next_page(xdr);
+        else if (xdr->iov == xdr->buf->head) {
+                if (xdr_set_page_base(xdr, 0, PAGE_SIZE) < 0)
+                        xdr_set_iov(xdr, xdr->buf->tail, NULL, xdr->buf->len);
+        }
+        return xdr->p != xdr->end;
+}
+
 /**
  * xdr_init_decode - Initialize an xdr_stream for decoding data.
  * @xdr: pointer to xdr_stream struct
@@ -560,41 +628,67 @@ EXPORT_SYMBOL_GPL(xdr_write_pages);
  */
 void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p)
 {
-        struct kvec *iov = buf->head;
-        unsigned int len = iov->iov_len;
-
-        if (len > buf->len)
-                len = buf->len;
         xdr->buf = buf;
-        xdr->iov = iov;
-        xdr->p = p;
-        xdr->end = (__be32 *)((char *)iov->iov_base + len);
+        xdr->scratch.iov_base = NULL;
+        xdr->scratch.iov_len = 0;
+        if (buf->head[0].iov_len != 0)
+                xdr_set_iov(xdr, buf->head, p, buf->len);
+        else if (buf->page_len != 0)
+                xdr_set_page_base(xdr, 0, buf->len);
 }
 EXPORT_SYMBOL_GPL(xdr_init_decode);
 
-/**
- * xdr_inline_peek - Allow read-ahead in the XDR data stream
- * @xdr: pointer to xdr_stream struct
- * @nbytes: number of bytes of data to decode
- *
- * Check if the input buffer is long enough to enable us to decode
- * 'nbytes' more bytes of data starting at the current position.
- * If so return the current pointer without updating the current
- * pointer position.
- */
-__be32 * xdr_inline_peek(struct xdr_stream *xdr, size_t nbytes)
+static __be32 * __xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
 {
         __be32 *p = xdr->p;
         __be32 *q = p + XDR_QUADLEN(nbytes);
 
         if (unlikely(q > xdr->end || q < p))
                 return NULL;
+        xdr->p = q;
         return p;
 }
-EXPORT_SYMBOL_GPL(xdr_inline_peek);
 
 /**
- * xdr_inline_decode - Retrieve non-page XDR data to decode
+ * xdr_set_scratch_buffer - Attach a scratch buffer for decoding data.
+ * @xdr: pointer to xdr_stream struct
+ * @buf: pointer to an empty buffer
+ * @buflen: size of 'buf'
+ *
+ * The scratch buffer is used when decoding from an array of pages.
+ * If an xdr_inline_decode() call spans across page boundaries, then
+ * we copy the data into the scratch buffer in order to allow linear
+ * access.
+ */
+void xdr_set_scratch_buffer(struct xdr_stream *xdr, void *buf, size_t buflen)
+{
+        xdr->scratch.iov_base = buf;
+        xdr->scratch.iov_len = buflen;
+}
+EXPORT_SYMBOL_GPL(xdr_set_scratch_buffer);
+
+static __be32 *xdr_copy_to_scratch(struct xdr_stream *xdr, size_t nbytes)
+{
+        __be32 *p;
+        void *cpdest = xdr->scratch.iov_base;
+        size_t cplen = (char *)xdr->end - (char *)xdr->p;
+
+        if (nbytes > xdr->scratch.iov_len)
+                return NULL;
+        memcpy(cpdest, xdr->p, cplen);
+        cpdest += cplen;
+        nbytes -= cplen;
+        if (!xdr_set_next_buffer(xdr))
+                return NULL;
+        p = __xdr_inline_decode(xdr, nbytes);
+        if (p == NULL)
+                return NULL;
+        memcpy(cpdest, p, nbytes);
+        return xdr->scratch.iov_base;
+}
+
+/**
+ * xdr_inline_decode - Retrieve XDR data to decode
  * @xdr: pointer to xdr_stream struct
  * @nbytes: number of bytes of data to decode
  *
@@ -605,13 +699,16 @@ EXPORT_SYMBOL_GPL(xdr_inline_peek);
  */
 __be32 * xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
 {
-        __be32 *p = xdr->p;
-        __be32 *q = p + XDR_QUADLEN(nbytes);
+        __be32 *p;
 
-        if (unlikely(q > xdr->end || q < p))
+        if (nbytes == 0)
+                return xdr->p;
+        if (xdr->p == xdr->end && !xdr_set_next_buffer(xdr))
                 return NULL;
-        xdr->p = q;
-        return p;
+        p = __xdr_inline_decode(xdr, nbytes);
+        if (p != NULL)
+                return p;
+        return xdr_copy_to_scratch(xdr, nbytes);
 }
 EXPORT_SYMBOL_GPL(xdr_inline_decode);
 
@@ -671,16 +768,12 @@ EXPORT_SYMBOL_GPL(xdr_read_pages);
  */
 void xdr_enter_page(struct xdr_stream *xdr, unsigned int len)
 {
-        char * kaddr = page_address(xdr->buf->pages[0]);
         xdr_read_pages(xdr, len);
         /*
          * Position current pointer at beginning of tail, and
          * set remaining message length.
          */
-        if (len > PAGE_CACHE_SIZE - xdr->buf->page_base)
-                len = PAGE_CACHE_SIZE - xdr->buf->page_base;
-        xdr->p = (__be32 *)(kaddr + xdr->buf->page_base);
-        xdr->end = (__be32 *)((char *)xdr->p + len);
+        xdr_set_page_base(xdr, 0, len);
 }
 EXPORT_SYMBOL_GPL(xdr_enter_page);