31 files changed, 97 insertions, 87 deletions

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index a606025814a..f2fb67e701a 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -365,10 +365,10 @@ static struct tc_action_ops *tc_lookup_action_id(u32 type)
 }
 #endif
 
-int tcf_action_exec(struct sk_buff *skb, struct tc_action *act,
+int tcf_action_exec(struct sk_buff *skb, const struct tc_action *act,
                     struct tcf_result *res)
 {
-        struct tc_action *a;
+        const struct tc_action *a;
         int ret = -1;
 
         if (skb->tc_verd & TC_NCLS) {
@@ -1115,9 +1115,10 @@ nlmsg_failure:
 
 static int __init tc_action_init(void)
 {
-        rtnl_register(PF_UNSPEC, RTM_NEWACTION, tc_ctl_action, NULL);
-        rtnl_register(PF_UNSPEC, RTM_DELACTION, tc_ctl_action, NULL);
-        rtnl_register(PF_UNSPEC, RTM_GETACTION, tc_ctl_action, tc_dump_action);
+        rtnl_register(PF_UNSPEC, RTM_NEWACTION, tc_ctl_action, NULL, NULL);
+        rtnl_register(PF_UNSPEC, RTM_DELACTION, tc_ctl_action, NULL, NULL);
+        rtnl_register(PF_UNSPEC, RTM_GETACTION, tc_ctl_action, tc_dump_action,
+                      NULL);
 
         return 0;
 }
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 6cdf9abe475..453a73431ac 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -500,7 +500,7 @@ fail:
 }
 
 static int tcf_csum(struct sk_buff *skb,
-                    struct tc_action *a, struct tcf_result *res)
+                    const struct tc_action *a, struct tcf_result *res)
 {
         struct tcf_csum *p = a->priv;
         int action;
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 2b4ab4b05ce..b77f5a06a65 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -125,7 +125,8 @@ static int tcf_gact_cleanup(struct tc_action *a, int bind)
         return 0;
 }
 
-static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res)
+static int tcf_gact(struct sk_buff *skb, const struct tc_action *a,
+                    struct tcf_result *res)
 {
         struct tcf_gact *gact = a->priv;
         int action = TC_ACT_SHOT;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 9fc211a1b20..60f8f616e8f 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -195,7 +195,7 @@ static int tcf_ipt_cleanup(struct tc_action *a, int bind)
         return tcf_ipt_release(ipt, bind);
 }
 
-static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
+static int tcf_ipt(struct sk_buff *skb, const struct tc_action *a,
                    struct tcf_result *res)
 {
         int ret = 0, result = 0;
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 961386e2f2c..e051398fdf6 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -154,7 +154,7 @@ static int tcf_mirred_cleanup(struct tc_action *a, int bind)
         return 0;
 }
 
-static int tcf_mirred(struct sk_buff *skb, struct tc_action *a,
+static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
                       struct tcf_result *res)
 {
         struct tcf_mirred *m = a->priv;
@@ -196,8 +196,7 @@ static int tcf_mirred(struct sk_buff *skb, struct tc_action *a,
 
         skb2->skb_iif = skb->dev->ifindex;
         skb2->dev = dev;
-        dev_queue_xmit(skb2);
-        err = 0;
+        err = dev_queue_xmit(skb2);
 
 out:
         if (err) {
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 762b027650a..001d1b35486 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -102,7 +102,7 @@ static int tcf_nat_cleanup(struct tc_action *a, int bind)
         return tcf_hash_release(&p->common, bind, &nat_hash_info);
 }
 
-static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
+static int tcf_nat(struct sk_buff *skb, const struct tc_action *a,
                    struct tcf_result *res)
 {
         struct tcf_nat *p = a->priv;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 7affe9a9275..10d3aed8656 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -120,7 +120,7 @@ static int tcf_pedit_cleanup(struct tc_action *a, int bind)
         return 0;
 }
 
-static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
+static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                      struct tcf_result *res)
 {
         struct tcf_pedit *p = a->priv;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index b3b9b32f4e0..6fb3f5af0f8 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -282,7 +282,7 @@ static int tcf_act_police_cleanup(struct tc_action *a, int bind)
         return ret;
 }
 
-static int tcf_act_police(struct sk_buff *skb, struct tc_action *a,
+static int tcf_act_police(struct sk_buff *skb, const struct tc_action *a,
                           struct tcf_result *res)
 {
         struct tcf_police *police = a->priv;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index a34a22de60b..73e0a3ab4d5 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -36,7 +36,8 @@ static struct tcf_hashinfo simp_hash_info = {
 };
 
 #define SIMP_MAX_DATA   32
-static int tcf_simp(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res)
+static int tcf_simp(struct sk_buff *skb, const struct tc_action *a,
+                    struct tcf_result *res)
 {
         struct tcf_defact *d = a->priv;
 
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 5f6f0c7c390..35dbbe91027 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -39,7 +39,7 @@ static struct tcf_hashinfo skbedit_hash_info = {
         .lock   =       &skbedit_lock,
 };
 
-static int tcf_skbedit(struct sk_buff *skb, struct tc_action *a,
+static int tcf_skbedit(struct sk_buff *skb, const struct tc_action *a,
                        struct tcf_result *res)
 {
         struct tcf_skbedit *d = a->priv;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index bb2c523f815..a69d44f1dac 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -40,9 +40,9 @@ static DEFINE_RWLOCK(cls_mod_lock);
 
 /* Find classifier type by string name */
 
-static struct tcf_proto_ops *tcf_proto_lookup_ops(struct nlattr *kind)
+static const struct tcf_proto_ops *tcf_proto_lookup_ops(struct nlattr *kind)
 {
-        struct tcf_proto_ops *t = NULL;
+        const struct tcf_proto_ops *t = NULL;
 
         if (kind) {
                 read_lock(&cls_mod_lock);
@@ -132,7 +132,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
         struct Qdisc  *q;
         struct tcf_proto **back, **chain;
         struct tcf_proto *tp;
-        struct tcf_proto_ops *tp_ops;
+        const struct tcf_proto_ops *tp_ops;
         const struct Qdisc_class_ops *cops;
         unsigned long cl;
         unsigned long fh;
@@ -610,10 +610,10 @@ EXPORT_SYMBOL(tcf_exts_dump_stats);
 
 static int __init tc_filter_init(void)
 {
-        rtnl_register(PF_UNSPEC, RTM_NEWTFILTER, tc_ctl_tfilter, NULL);
-        rtnl_register(PF_UNSPEC, RTM_DELTFILTER, tc_ctl_tfilter, NULL);
+        rtnl_register(PF_UNSPEC, RTM_NEWTFILTER, tc_ctl_tfilter, NULL, NULL);
+        rtnl_register(PF_UNSPEC, RTM_DELTFILTER, tc_ctl_tfilter, NULL, NULL);
         rtnl_register(PF_UNSPEC, RTM_GETTFILTER, tc_ctl_tfilter,
-                                                 tc_dump_tfilter);
+                      tc_dump_tfilter, NULL);
 
         return 0;
 }
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 8be8872dd57..ea1f70b5a5f 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -39,7 +39,7 @@ static const struct tcf_ext_map basic_ext_map = {
         .police = TCA_BASIC_POLICE
 };
 
-static int basic_classify(struct sk_buff *skb, struct tcf_proto *tp,
+static int basic_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                           struct tcf_result *res)
 {
         int r;
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 32a335194ca..f84fdc3a7f2 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -101,7 +101,7 @@ struct cls_cgroup_head {
         struct tcf_ematch_tree  ematches;
 };
 
-static int cls_cgroup_classify(struct sk_buff *skb, struct tcf_proto *tp,
+static int cls_cgroup_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                                struct tcf_result *res)
 {
         struct cls_cgroup_head *head = tp->root;
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 8ec01391d98..6994214db8f 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -121,7 +121,7 @@ static u32 flow_get_proto_src(struct sk_buff *skb)
                 if (!pskb_network_may_pull(skb, sizeof(*iph)))
                         break;
                 iph = ip_hdr(skb);
-                if (iph->frag_off & htons(IP_MF | IP_OFFSET))
+                if (ip_is_fragment(iph))
                         break;
                 poff = proto_ports_offset(iph->protocol);
                 if (poff >= 0 &&
@@ -163,7 +163,7 @@ static u32 flow_get_proto_dst(struct sk_buff *skb)
                 if (!pskb_network_may_pull(skb, sizeof(*iph)))
                         break;
                 iph = ip_hdr(skb);
-                if (iph->frag_off & htons(IP_MF | IP_OFFSET))
+                if (ip_is_fragment(iph))
                         break;
                 poff = proto_ports_offset(iph->protocol);
                 if (poff >= 0 &&
@@ -356,7 +356,7 @@ static u32 flow_key_get(struct sk_buff *skb, int key)
         }
 }
 
-static int flow_classify(struct sk_buff *skb, struct tcf_proto *tp,
+static int flow_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                          struct tcf_result *res)
 {
         struct flow_head *head = tp->root;
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 26e7bc4ffb7..389af152ec4 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -77,7 +77,7 @@ static inline int fw_hash(u32 handle)
                 return handle & (HTSIZE - 1);
 }
 
-static int fw_classify(struct sk_buff *skb, struct tcf_proto *tp,
+static int fw_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                           struct tcf_result *res)
 {
         struct fw_head *head = (struct fw_head *)tp->root;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index a907905376d..13ab66e9df5 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -125,7 +125,7 @@ static inline int route4_hash_wild(void)
         return 0;                                               \
 }
 
-static int route4_classify(struct sk_buff *skb, struct tcf_proto *tp,
+static int route4_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                            struct tcf_result *res)
 {
         struct route4_head *head = (struct route4_head *)tp->root;
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 402c44b241a..b01427924f8 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -130,7 +130,7 @@ static struct tcf_ext_map rsvp_ext_map = {
                 return r;                               \
 }
 
-static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
+static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                          struct tcf_result *res)
 {
         struct rsvp_session **sht = ((struct rsvp_head *)tp->root)->ht;
@@ -167,7 +167,7 @@ restart:
         dst = &nhptr->daddr;
         protocol = nhptr->protocol;
         xprt = ((u8 *)nhptr) + (nhptr->ihl<<2);
-        if (nhptr->frag_off & htons(IP_MF | IP_OFFSET))
+        if (ip_is_fragment(nhptr))
                 return -1;
 #endif
 
@@ -425,7 +425,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
         struct rsvp_filter *f, **fp;
         struct rsvp_session *s, **sp;
         struct tc_rsvp_pinfo *pinfo = NULL;
-        struct nlattr *opt = tca[TCA_OPTIONS-1];
+        struct nlattr *opt = tca[TCA_OPTIONS];
         struct nlattr *tb[TCA_RSVP_MAX + 1];
         struct tcf_exts e;
         unsigned int h1, h2;
@@ -439,7 +439,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
         if (err < 0)
                 return err;
 
-        err = tcf_exts_validate(tp, tb, tca[TCA_RATE-1], &e, &rsvp_ext_map);
+        err = tcf_exts_validate(tp, tb, tca[TCA_RATE], &e, &rsvp_ext_map);
         if (err < 0)
                 return err;
 
@@ -449,8 +449,8 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
 
                 if (f->handle != handle && handle)
                         goto errout2;
-                if (tb[TCA_RSVP_CLASSID-1]) {
-                        f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID-1]);
+                if (tb[TCA_RSVP_CLASSID]) {
+                        f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
                         tcf_bind_filter(tp, &f->res, base);
                 }
 
@@ -462,7 +462,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
         err = -EINVAL;
         if (handle)
                 goto errout2;
-        if (tb[TCA_RSVP_DST-1] == NULL)
+        if (tb[TCA_RSVP_DST] == NULL)
                 goto errout2;
 
         err = -ENOBUFS;
@@ -471,19 +471,19 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
                 goto errout2;
 
         h2 = 16;
-        if (tb[TCA_RSVP_SRC-1]) {
-                memcpy(f->src, nla_data(tb[TCA_RSVP_SRC-1]), sizeof(f->src));
+        if (tb[TCA_RSVP_SRC]) {
+                memcpy(f->src, nla_data(tb[TCA_RSVP_SRC]), sizeof(f->src));
                 h2 = hash_src(f->src);
         }
-        if (tb[TCA_RSVP_PINFO-1]) {
-                pinfo = nla_data(tb[TCA_RSVP_PINFO-1]);
+        if (tb[TCA_RSVP_PINFO]) {
+                pinfo = nla_data(tb[TCA_RSVP_PINFO]);
                 f->spi = pinfo->spi;
                 f->tunnelhdr = pinfo->tunnelhdr;
         }
-        if (tb[TCA_RSVP_CLASSID-1])
-                f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID-1]);
+        if (tb[TCA_RSVP_CLASSID])
+                f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
 
-        dst = nla_data(tb[TCA_RSVP_DST-1]);
+        dst = nla_data(tb[TCA_RSVP_DST]);
         h1 = hash_dst(dst, pinfo ? pinfo->protocol : 0, pinfo ? pinfo->tunnelid : 0);
 
         err = -ENOMEM;
@@ -642,8 +642,7 @@ nla_put_failure:
         return -1;
 }
 
-static struct tcf_proto_ops RSVP_OPS = {
-        .next           =       NULL,
+static struct tcf_proto_ops RSVP_OPS __read_mostly = {
         .kind           =       RSVP_ID,
         .classify       =       rsvp_classify,
         .init           =       rsvp_init,
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 36667fa6423..dbe199234c6 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -79,7 +79,7 @@ tcindex_lookup(struct tcindex_data *p, u16 key)
 }
 
 
-static int tcindex_classify(struct sk_buff *skb, struct tcf_proto *tp,
+static int tcindex_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                             struct tcf_result *res)
 {
         struct tcindex_data *p = PRIV(tp);
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 3b93fc0c895..939b627b479 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -93,7 +93,7 @@ static inline unsigned int u32_hash_fold(__be32 key,
         return h;
 }
 
-static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_result *res)
+static int u32_classify(struct sk_buff *skb, const struct tcf_proto *tp, struct tcf_result *res)
 {
         struct {
                 struct tc_u_knode *knode;
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index 49130e8abff..1363bf14e61 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -404,12 +404,6 @@ META_COLLECTOR(int_sk_alloc)
         dst->value = (__force int) skb->sk->sk_allocation;
 }
 
-META_COLLECTOR(int_sk_route_caps)
-{
-        SKIP_NONLOCAL(skb);
-        dst->value = skb->sk->sk_route_caps;
-}
-
 META_COLLECTOR(int_sk_hash)
 {
         SKIP_NONLOCAL(skb);
@@ -530,7 +524,6 @@ static struct meta_ops __meta_ops[TCF_META_TYPE_MAX + 1][TCF_META_ID_MAX + 1] =
                 [META_ID(SK_ERR_QLEN)]          = META_FUNC(int_sk_err_qlen),
                 [META_ID(SK_FORWARD_ALLOCS)]    = META_FUNC(int_sk_fwd_alloc),
                 [META_ID(SK_ALLOCS)]            = META_FUNC(int_sk_alloc),
-                [META_ID(SK_ROUTE_CAPS)]        = META_FUNC(int_sk_route_caps),
                 [META_ID(SK_HASH)]              = META_FUNC(int_sk_hash),
                 [META_ID(SK_LINGERTIME)]        = META_FUNC(int_sk_lingertime),
                 [META_ID(SK_ACK_BACKLOG)]       = META_FUNC(int_sk_ack_bl),
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 6b8627661c9..dca6c1a576f 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1644,7 +1644,7 @@ done:
  * to this qdisc, (optionally) tests for protocol and asks
  * specific classifiers.
  */
-int tc_classify_compat(struct sk_buff *skb, struct tcf_proto *tp,
+int tc_classify_compat(struct sk_buff *skb, const struct tcf_proto *tp,
                        struct tcf_result *res)
 {
         __be16 protocol = skb->protocol;
@@ -1668,12 +1668,12 @@ int tc_classify_compat(struct sk_buff *skb, struct tcf_proto *tp,
 }
 EXPORT_SYMBOL(tc_classify_compat);
 
-int tc_classify(struct sk_buff *skb, struct tcf_proto *tp,
+int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                 struct tcf_result *res)
 {
         int err = 0;
 #ifdef CONFIG_NET_CLS_ACT
-        struct tcf_proto *otp = tp;
+        const struct tcf_proto *otp = tp;
 reclassify:
 #endif
 
@@ -1792,12 +1792,12 @@ static int __init pktsched_init(void)
         register_qdisc(&pfifo_head_drop_qdisc_ops);
         register_qdisc(&mq_qdisc_ops);
 
-        rtnl_register(PF_UNSPEC, RTM_NEWQDISC, tc_modify_qdisc, NULL);
-        rtnl_register(PF_UNSPEC, RTM_DELQDISC, tc_get_qdisc, NULL);
-        rtnl_register(PF_UNSPEC, RTM_GETQDISC, tc_get_qdisc, tc_dump_qdisc);
-        rtnl_register(PF_UNSPEC, RTM_NEWTCLASS, tc_ctl_tclass, NULL);
-        rtnl_register(PF_UNSPEC, RTM_DELTCLASS, tc_ctl_tclass, NULL);
-        rtnl_register(PF_UNSPEC, RTM_GETTCLASS, tc_ctl_tclass, tc_dump_tclass);
+        rtnl_register(PF_UNSPEC, RTM_NEWQDISC, tc_modify_qdisc, NULL, NULL);
+        rtnl_register(PF_UNSPEC, RTM_DELQDISC, tc_get_qdisc, NULL, NULL);
+        rtnl_register(PF_UNSPEC, RTM_GETQDISC, tc_get_qdisc, tc_dump_qdisc, NULL);
+        rtnl_register(PF_UNSPEC, RTM_NEWTCLASS, tc_ctl_tclass, NULL, NULL);
+        rtnl_register(PF_UNSPEC, RTM_DELTCLASS, tc_ctl_tclass, NULL, NULL);
+        rtnl_register(PF_UNSPEC, RTM_GETTCLASS, tc_ctl_tclass, tc_dump_tclass, NULL);
 
         return 0;
 }
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 3f08158b868..e25e49061a0 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -5,6 +5,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/init.h>
+#include <linux/interrupt.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/skbuff.h>
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index 06afbaeb4c8..3422b25df9e 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -181,7 +181,7 @@ static bool choke_match_flow(struct sk_buff *skb1,
                     ip1->saddr != ip2->saddr || ip1->daddr != ip2->daddr)
                         return false;
 
-                if ((ip1->frag_off | ip2->frag_off) & htons(IP_MF | IP_OFFSET))
+                if (ip_is_fragment(ip1) | ip_is_fragment(ip2))
                         ip_proto = 0;
                 off1 += ip1->ihl * 4;
                 off2 += ip2->ihl * 4;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index b4c680900d7..69fca279880 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -189,15 +189,15 @@ static inline int qdisc_restart(struct Qdisc *q)
 
 void __qdisc_run(struct Qdisc *q)
 {
-        unsigned long start_time = jiffies;
+        int quota = weight_p;
 
         while (qdisc_restart(q)) {
                 /*
-                 * Postpone processing if
-                 * 1. another process needs the CPU;
-                 * 2. we've been doing it for too long.
+                 * Ordered by possible occurrence: Postpone processing if
+                 * 1. we've exceeded packet quota
+                 * 2. another process needs the CPU;
                  */
-                if (need_resched() || jiffies != start_time) {
+                if (--quota <= 0 || need_resched()) {
                         __netif_schedule(q);
                         break;
                 }
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index b9493a09a87..6cd8ddfb512 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -385,7 +385,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
         struct gred_sched_data *q;
 
         if (table->tab[dp] == NULL) {
-                table->tab[dp] = kzalloc(sizeof(*q), GFP_KERNEL);
+                table->tab[dp] = kzalloc(sizeof(*q), GFP_ATOMIC);
                 if (table->tab[dp] == NULL)
                         return -ENOMEM;
         }
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index ea17cbed29e..59b26b8ff4b 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -106,7 +106,7 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
         if (!netif_is_multiqueue(dev))
                 return -EOPNOTSUPP;
 
-        if (nla_len(opt) < sizeof(*qopt))
+        if (!opt || nla_len(opt) < sizeof(*qopt))
                 return -EINVAL;
 
         qopt = nla_data(opt);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 69c35f6cd13..eb3b9a86c6e 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -13,6 +13,7 @@
  *              Catalin(ux aka Dino) BOIE <catab at umbrella dot ro>
  */
 
+#include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/types.h>
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 2a318f2dc3e..b5d56a22b1d 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -112,7 +112,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc *sch)
 
         for (prio = 0; prio < q->bands; prio++) {
                 struct Qdisc *qdisc = q->queues[prio];
-                struct sk_buff *skb = qdisc->dequeue(qdisc);
+                struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
                 if (skb) {
                         qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 6649463da1b..d617161f8dd 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -209,8 +209,8 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
                                  ctl->Plog, ctl->Scell_log,
                                  nla_data(tb[TCA_RED_STAB]));
 
-        if (skb_queue_empty(&sch->q))
-                red_end_of_idle_period(&q->parms);
+        if (!q->qdisc->q.qlen)
+                red_start_of_idle_period(&q->parms);
 
         sch_tree_unlock(sch);
         return 0;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index b6ea6afa55b..4f5510e2bd6 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -157,7 +157,7 @@ static unsigned int sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
                 iph = ip_hdr(skb);
                 h = (__force u32)iph->daddr;
                 h2 = (__force u32)iph->saddr ^ iph->protocol;
-                if (iph->frag_off & htons(IP_MF | IP_OFFSET))
+                if (ip_is_fragment(iph))
                         break;
                 poff = proto_ports_offset(iph->protocol);
                 if (poff >= 0 &&
@@ -410,7 +410,12 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         /* Return Congestion Notification only if we dropped a packet
          * from this flow.
          */
-        return (qlen != slot->qlen) ? NET_XMIT_CN : NET_XMIT_SUCCESS;
+        if (qlen != slot->qlen)
+                return NET_XMIT_CN;
+
+        /* As we dropped a packet, better let upper stack know this */
+        qdisc_tree_decrease_qlen(sch, 1);
+        return NET_XMIT_SUCCESS;
 }
 
 static struct sk_buff *
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 45cd30098e3..4f4c52c0eeb 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -225,11 +225,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt)
 
 
 static int
-__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *dev)
+__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res,
+               struct net_device *dev, struct netdev_queue *txq,
+               struct neighbour *mn)
 {
-        struct netdev_queue *dev_queue = netdev_get_tx_queue(dev, 0);
-        struct teql_sched_data *q = qdisc_priv(dev_queue->qdisc);
-        struct neighbour *mn = skb_dst(skb)->neighbour;
+        struct teql_sched_data *q = qdisc_priv(txq->qdisc);
         struct neighbour *n = q->ncache;
 
         if (mn->tbl == NULL)
@@ -262,17 +262,26 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *
 }
 
 static inline int teql_resolve(struct sk_buff *skb,
-                               struct sk_buff *skb_res, struct net_device *dev)
+                               struct sk_buff *skb_res,
+                               struct net_device *dev,
+                               struct netdev_queue *txq)
 {
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
+        struct dst_entry *dst = skb_dst(skb);
+        struct neighbour *mn;
+        int res;
+
         if (txq->qdisc == &noop_qdisc)
                 return -ENODEV;
 
-        if (dev->header_ops == NULL ||
-            skb_dst(skb) == NULL ||
-            skb_dst(skb)->neighbour == NULL)
+        if (!dev->header_ops || !dst)
                 return 0;
-        return __teql_resolve(skb, skb_res, dev);
+
+        rcu_read_lock();
+        mn = dst_get_neighbour(dst);
+        res = mn ? __teql_resolve(skb, skb_res, dev, txq, mn) : 0;
+        rcu_read_unlock();
+
+        return res;
 }
 
 static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -307,7 +316,7 @@ restart:
                         continue;
                 }
 
-                switch (teql_resolve(skb, skb_res, slave)) {
+                switch (teql_resolve(skb, skb_res, slave, slave_txq)) {
                 case 0:
                         if (__netif_tx_trylock(slave_txq)) {
                                 unsigned int length = qdisc_pkt_len(skb);