50 files changed, 298 insertions, 242 deletions

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 845da3ee56a..9de93714213 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -55,7 +55,7 @@
 
 #define AUTO_OFF_TIMEOUT 2000
 
-int enable_hs;
+bool enable_hs;
 
 static void hci_rx_work(struct work_struct *work);
 static void hci_cmd_work(struct work_struct *work);
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 673728add60..82c57069415 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -59,8 +59,6 @@ struct cfcnfg *get_cfcnfg(struct net *net)
 {
         struct caif_net *caifn;
         caifn = net_generic(net, caif_net_id);
-        if (!caifn)
-                return NULL;
         return caifn->cfg;
 }
 EXPORT_SYMBOL(get_cfcnfg);
@@ -69,8 +67,6 @@ static struct caif_device_entry_list *caif_device_list(struct net *net)
 {
         struct caif_net *caifn;
         caifn = net_generic(net, caif_net_id);
-        if (!caifn)
-                return NULL;
         return &caifn->caifdevs;
 }
 
@@ -99,8 +95,6 @@ static struct caif_device_entry *caif_device_alloc(struct net_device *dev)
         struct caif_device_entry *caifd;
 
         caifdevs = caif_device_list(dev_net(dev));
-        if (!caifdevs)
-                return NULL;
 
         caifd = kzalloc(sizeof(*caifd), GFP_KERNEL);
         if (!caifd)
@@ -120,8 +114,6 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
         struct caif_device_entry_list *caifdevs =
             caif_device_list(dev_net(dev));
         struct caif_device_entry *caifd;
-        if (!caifdevs)
-                return NULL;
 
         list_for_each_entry_rcu(caifd, &caifdevs->list, list) {
                 if (caifd->netdev == dev)
@@ -321,8 +313,6 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
         struct caif_device_entry_list *caifdevs;
 
         caifdevs = caif_device_list(dev_net(dev));
-        if (!cfg || !caifdevs)
-                return;
         caifd = caif_device_alloc(dev);
         if (!caifd)
                 return;
@@ -374,8 +364,6 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
 
         cfg = get_cfcnfg(dev_net(dev));
         caifdevs = caif_device_list(dev_net(dev));
-        if (!cfg || !caifdevs)
-                return 0;
 
         caifd = caif_get(dev);
         if (caifd == NULL && dev->type != ARPHRD_CAIF)
@@ -507,9 +495,6 @@ static struct notifier_block caif_device_notifier = {
 static int caif_init_net(struct net *net)
 {
         struct caif_net *caifn = net_generic(net, caif_net_id);
-        if (WARN_ON(!caifn))
-                return -EINVAL;
-
         INIT_LIST_HEAD(&caifn->caifdevs.list);
         mutex_init(&caifn->caifdevs.lock);
 
@@ -527,9 +512,6 @@ static void caif_exit_net(struct net *net)
             caif_device_list(net);
         struct cfcnfg *cfg =  get_cfcnfg(net);
 
-        if (!cfg || !caifdevs)
-                return;
-
         rtnl_lock();
         mutex_lock(&caifdevs->lock);
 
@@ -569,7 +551,7 @@ static int __init caif_device_init(void)
 {
         int result;
 
-        result = register_pernet_device(&caif_net_ops);
+        result = register_pernet_subsys(&caif_net_ops);
 
         if (result)
                 return result;
@@ -582,7 +564,7 @@ static int __init caif_device_init(void)
 
 static void __exit caif_device_exit(void)
 {
-        unregister_pernet_device(&caif_net_ops);
+        unregister_pernet_subsys(&caif_net_ops);
         unregister_netdevice_notifier(&caif_device_notifier);
         dev_remove_pack(&caif_packet_type);
 }
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index a9862808645..a97d97a3a51 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -539,8 +539,10 @@ static int transmit_skb(struct sk_buff *skb, struct caifsock *cf_sk,
         pkt = cfpkt_fromnative(CAIF_DIR_OUT, skb);
         memset(skb->cb, 0, sizeof(struct caif_payload_info));
 
-        if (cf_sk->layer.dn == NULL)
+        if (cf_sk->layer.dn == NULL) {
+                kfree_skb(skb);
                 return -EINVAL;
+        }
 
         return cf_sk->layer.dn->transmit(cf_sk->layer.dn, pkt);
 }
@@ -683,10 +685,10 @@ static int caif_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 }
                 err = transmit_skb(skb, cf_sk,
                                 msg->msg_flags&MSG_DONTWAIT, timeo);
-                if (err < 0) {
-                        kfree_skb(skb);
+                if (err < 0)
+                        /* skb is already freed */
                         goto pipe_err;
-                }
+
                 sent += size;
         }
 
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 598aafb4cb5..ba9cfd47778 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -309,7 +309,6 @@ int caif_connect_client(struct net *net, struct caif_connect_request *conn_req,
         int err;
         struct cfctrl_link_param param;
         struct cfcnfg *cfg = get_cfcnfg(net);
-        caif_assert(cfg != NULL);
 
         rcu_read_lock();
         err = caif_connect_req_to_link_param(cfg, conn_req, &param);
diff --git a/net/caif/cfmuxl.c b/net/caif/cfmuxl.c
index b36f24a4c8e..94b08612a4d 100644
--- a/net/caif/cfmuxl.c
+++ b/net/caif/cfmuxl.c
@@ -248,7 +248,6 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
 {
         struct cfmuxl *muxl = container_obj(layr);
         struct cflayer *layer;
-        int idx;
 
         rcu_read_lock();
         list_for_each_entry_rcu(layer, &muxl->srvl_list, node) {
@@ -257,14 +256,9 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
 
                         if ((ctrl == _CAIF_CTRLCMD_PHYIF_DOWN_IND ||
                                 ctrl == CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND) &&
-                                        layer->id != 0) {
-
-                                idx = layer->id % UP_CACHE_SIZE;
-                                spin_lock_bh(&muxl->receive_lock);
-                                RCU_INIT_POINTER(muxl->up_cache[idx], NULL);
-                                list_del_rcu(&layer->node);
-                                spin_unlock_bh(&muxl->receive_lock);
-                        }
+                                        layer->id != 0)
+                                cfmuxl_remove_uplayer(layr, layer->id);
+
                         /* NOTE: ctrlcmd is not allowed to block */
                         layer->ctrlcmd(layer, ctrl, phyid);
                 }
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 97f70e50ad3..761ad9d6cc3 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -85,8 +85,6 @@ int ceph_check_fsid(struct ceph_client *client, struct ceph_fsid *fsid)
         } else {
                 pr_info("client%lld fsid %pU\n", ceph_client_id(client), fsid);
                 memcpy(&client->fsid, fsid, sizeof(*fsid));
-                ceph_debugfs_client_init(client);
-                client->have_fsid = true;
         }
         return 0;
 }
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 0b62deae42b..1845cde2622 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -8,8 +8,8 @@
 
 #include <linux/ceph/mon_client.h>
 #include <linux/ceph/libceph.h>
+#include <linux/ceph/debugfs.h>
 #include <linux/ceph/decode.h>
-
 #include <linux/ceph/auth.h>
 
 /*
@@ -340,8 +340,19 @@ static void ceph_monc_handle_map(struct ceph_mon_client *monc,
         client->monc.monmap = monmap;
         kfree(old);
 
+        if (!client->have_fsid) {
+                client->have_fsid = true;
+                mutex_unlock(&monc->mutex);
+                /*
+                 * do debugfs initialization without mutex to avoid
+                 * creating a locking dependency
+                 */
+                ceph_debugfs_client_init(client);
+                goto out_unlocked;
+        }
 out:
         mutex_unlock(&monc->mutex);
+out_unlocked:
         wake_up_all(&client->auth_wq);
 }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 115dee1d985..6ca32f6b310 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3500,14 +3500,20 @@ static inline gro_result_t
 __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         struct sk_buff *p;
+        unsigned int maclen = skb->dev->hard_header_len;
 
         for (p = napi->gro_list; p; p = p->next) {
                 unsigned long diffs;
 
                 diffs = (unsigned long)p->dev ^ (unsigned long)skb->dev;
                 diffs |= p->vlan_tci ^ skb->vlan_tci;
-                diffs |= compare_ether_header(skb_mac_header(p),
-                                              skb_gro_mac_header(skb));
+                if (maclen == ETH_HLEN)
+                        diffs |= compare_ether_header(skb_mac_header(p),
+                                                      skb_gro_mac_header(skb));
+                else if (!diffs)
+                        diffs = memcmp(skb_mac_header(p),
+                                       skb_gro_mac_header(skb),
+                                       maclen);
                 NAPI_GRO_CB(p)->same_flow = !diffs;
                 NAPI_GRO_CB(p)->flush = 0;
         }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 921aa2b4b41..3f79db1b612 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1190,6 +1190,8 @@ static noinline_for_stack int ethtool_flash_device(struct net_device *dev,
         if (!dev->ethtool_ops->flash_device)
                 return -EOPNOTSUPP;
 
+        efl.data[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
+
         return dev->ethtool_ops->flash_device(dev, &efl);
 }
 
@@ -1311,6 +1313,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GRXCSUM:
         case ETHTOOL_GTXCSUM:
         case ETHTOOL_GSG:
+        case ETHTOOL_GSSET_INFO:
         case ETHTOOL_GSTRINGS:
         case ETHTOOL_GTSO:
         case ETHTOOL_GPERMADDR:
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 0985b9b14b8..a225089df5b 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1,4 +1,5 @@
 #include <linux/skbuff.h>
+#include <linux/export.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/if_vlan.h>
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index aefcd7acbff..0e950fda9a0 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -30,6 +30,20 @@ EXPORT_SYMBOL(init_net);
 
 #define INITIAL_NET_GEN_PTRS    13 /* +1 for len +2 for rcu_head */
 
+static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
+
+static struct net_generic *net_alloc_generic(void)
+{
+        struct net_generic *ng;
+        size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
+
+        ng = kzalloc(generic_size, GFP_KERNEL);
+        if (ng)
+                ng->len = max_gen_ptrs;
+
+        return ng;
+}
+
 static int net_assign_generic(struct net *net, int id, void *data)
 {
         struct net_generic *ng, *old_ng;
@@ -43,8 +57,7 @@ static int net_assign_generic(struct net *net, int id, void *data)
         if (old_ng->len >= id)
                 goto assign;
 
-        ng = kzalloc(sizeof(struct net_generic) +
-                        id * sizeof(void *), GFP_KERNEL);
+        ng = net_alloc_generic();
         if (ng == NULL)
                 return -ENOMEM;
 
@@ -59,7 +72,6 @@ static int net_assign_generic(struct net *net, int id, void *data)
          * the old copy for kfree after a grace period.
          */
 
-        ng->len = id;
         memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
 
         rcu_assign_pointer(net->gen, ng);
@@ -161,18 +173,6 @@ out_undo:
         goto out;
 }
 
-static struct net_generic *net_alloc_generic(void)
-{
-        struct net_generic *ng;
-        size_t generic_size = sizeof(struct net_generic) +
-                INITIAL_NET_GEN_PTRS * sizeof(void *);
-
-        ng = kzalloc(generic_size, GFP_KERNEL);
-        if (ng)
-                ng->len = INITIAL_NET_GEN_PTRS;
-
-        return ng;
-}
 
 #ifdef CONFIG_NET_NS
 static struct kmem_cache *net_cachep;
@@ -483,6 +483,7 @@ again:
                         }
                         return error;
                 }
+                max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
         }
         error = __register_pernet_operations(list, ops);
         if (error) {
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 556b0829866..ddefc513b44 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -194,7 +194,7 @@ static void netpoll_poll_dev(struct net_device *dev)
 
         poll_napi(dev);
 
-        if (dev->priv_flags & IFF_SLAVE) {
+        if (dev->flags & IFF_SLAVE) {
                 if (dev->npinfo) {
                         struct net_device *bond_dev = dev->master;
                         struct sk_buff *skb;
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 3a9fd4826b7..4dacc44637e 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -58,11 +58,12 @@ static int get_prioidx(u32 *prio)
 
         spin_lock_irqsave(&prioidx_map_lock, flags);
         prioidx = find_first_zero_bit(prioidx_map, sizeof(unsigned long) * PRIOIDX_SZ);
+        if (prioidx == sizeof(unsigned long) * PRIOIDX_SZ) {
+                spin_unlock_irqrestore(&prioidx_map_lock, flags);
+                return -ENOSPC;
+        }
         set_bit(prioidx, prioidx_map);
         spin_unlock_irqrestore(&prioidx_map_lock, flags);
-        if (prioidx == sizeof(unsigned long) * PRIOIDX_SZ)
-                return -ENOSPC;
-
         atomic_set(&max_prioidx, prioidx);
         *prio = prioidx;
         return 0;
@@ -107,7 +108,7 @@ static void extend_netdev_table(struct net_device *dev, u32 new_len)
 static void update_netdev_tables(void)
 {
         struct net_device *dev;
-        u32 max_len = atomic_read(&max_prioidx);
+        u32 max_len = atomic_read(&max_prioidx) + 1;
         struct netprio_map *map;
 
         rtnl_lock();
@@ -270,7 +271,6 @@ static int netprio_device_event(struct notifier_block *unused,
 {
         struct net_device *dev = ptr;
         struct netprio_map *old;
-        u32 max_len = atomic_read(&max_prioidx);
 
         /*
          * Note this is called with rtnl_lock held so we have update side
@@ -278,11 +278,6 @@ static int netprio_device_event(struct notifier_block *unused,
          */
 
         switch (event) {
-
-        case NETDEV_REGISTER:
-                if (max_len)
-                        extend_netdev_table(dev, max_len);
-                break;
         case NETDEV_UNREGISTER:
                 old = rtnl_dereference(dev->priomap);
                 RCU_INIT_POINTER(dev->priomap, NULL);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 65f80c7b165..4d8ce93cd50 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -767,8 +767,8 @@ done:
         return i;
 }
 
-static unsigned long num_arg(const char __user * user_buffer,
-                             unsigned long maxlen, unsigned long *num)
+static long num_arg(const char __user *user_buffer, unsigned long maxlen,
+                                unsigned long *num)
 {
         int i;
         *num = 0;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f16444bc6cb..65aebd45002 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1509,6 +1509,9 @@ errout:
 
         if (send_addr_notify)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+        min_ifinfo_dump_size = max_t(u16, if_nlmsg_size(dev),
+                                     min_ifinfo_dump_size);
+
         return err;
 }
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 5c5af9988f9..02f8dfe320b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1171,13 +1171,10 @@ EXPORT_SYMBOL(sock_update_classid);
 
 void sock_update_netprioidx(struct sock *sk)
 {
-        struct cgroup_netprio_state *state;
         if (in_interrupt())
                 return;
-        rcu_read_lock();
-        state = task_netprio_state(current);
-        sk->sk_cgrp_prioidx = state ? state->prioidx : 0;
-        rcu_read_unlock();
+
+        sk->sk_cgrp_prioidx = task_netprioidx(current);
 }
 EXPORT_SYMBOL_GPL(sock_update_netprioidx);
 #endif
@@ -1827,7 +1824,7 @@ suppress_allocation:
         /* Alas. Undo changes. */
         sk->sk_forward_alloc -= amt * SK_MEM_QUANTUM;
 
-        sk_memory_allocated_sub(sk, amt, parent_status);
+        sk_memory_allocated_sub(sk, amt);
 
         return 0;
 }
@@ -1840,7 +1837,7 @@ EXPORT_SYMBOL(__sk_mem_schedule);
 void __sk_mem_reclaim(struct sock *sk)
 {
         sk_memory_allocated_sub(sk,
-                                sk->sk_forward_alloc >> SK_MEM_QUANTUM_SHIFT, 0);
+                                sk->sk_forward_alloc >> SK_MEM_QUANTUM_SHIFT);
         sk->sk_forward_alloc &= SK_MEM_QUANTUM - 1;
 
         if (sk_under_memory_pressure(sk) &&
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index aa2a2c79776..d183262943d 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -409,7 +409,7 @@ config INET_TCP_DIAG
 
 config INET_UDP_DIAG
         tristate "UDP: socket monitoring interface"
-        depends on INET_DIAG
+        depends on INET_DIAG && (IPV6 || IPV6=n)
         default n
         ---help---
           Support for UDP socket monitoring interface used by the ss tool.
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 59402be133f..63e49890ad3 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -863,7 +863,8 @@ static int arp_process(struct sk_buff *skb)
                         if (addr_type == RTN_UNICAST  &&
                             (arp_fwd_proxy(in_dev, dev, rt) ||
                              arp_fwd_pvlan(in_dev, dev, rt, sip, tip) ||
-                             pneigh_lookup(&arp_tbl, net, &tip, dev, 0))) {
+                             (rt->dst.dev != dev &&
+                              pneigh_lookup(&arp_tbl, net, &tip, dev, 0)))) {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n)
                                         neigh_release(n);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 2e4e24476c4..19d66cefd7d 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -123,11 +123,14 @@ again:
                                                 smallest_size = tb->num_owners;
                                                 smallest_rover = rover;
                                                 if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
-                                                        spin_unlock(&head->lock);
                                                         snum = smallest_rover;
-                                                        goto have_snum;
+                                                        goto tb_found;
                                                 }
                                         }
+                                        if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
+                                                snum = rover;
+                                                goto tb_found;
+                                        }
                                         goto next;
                                 }
                         break;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 2b53a1f7abf..6b3ca5ba445 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -422,6 +422,10 @@ static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
         if (register_netdevice(dev) < 0)
                 goto failed_free;
 
+        /* Can use a lockless transmit, unless we generate output sequences */
+        if (!(nt->parms.o_flags & GRE_SEQ))
+                dev->features |= NETIF_F_LLTX;
+
         dev_hold(dev);
         ipgre_tunnel_link(ign, nt);
         return nt;
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 1e60f767907..42dd1a90ede 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -573,8 +573,8 @@ void ip_forward_options(struct sk_buff *skb)
                 }
                 if (srrptr + 3 <= srrspace) {
                         opt->is_changed = 1;
-                        ip_rt_get_source(&optptr[srrptr-1], skb, rt);
                         ip_hdr(skb)->daddr = opt->nexthop;
+                        ip_rt_get_source(&optptr[srrptr-1], skb, rt);
                         optptr[2] = srrptr+4;
                 } else if (net_ratelimit())
                         printk(KERN_CRIT "ip_forward(): Argh! Destination lost!\n");
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 3569d8ecaea..6afc807ee2a 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -216,7 +216,6 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPPartialUndo", LINUX_MIB_TCPPARTIALUNDO),
         SNMP_MIB_ITEM("TCPDSACKUndo", LINUX_MIB_TCPDSACKUNDO),
         SNMP_MIB_ITEM("TCPLossUndo", LINUX_MIB_TCPLOSSUNDO),
-        SNMP_MIB_ITEM("TCPLoss", LINUX_MIB_TCPLOSS),
         SNMP_MIB_ITEM("TCPLostRetransmit", LINUX_MIB_TCPLOSTRETRANSMIT),
         SNMP_MIB_ITEM("TCPRenoFailures", LINUX_MIB_TCPRENOFAILURES),
         SNMP_MIB_ITEM("TCPSackFailures", LINUX_MIB_TCPSACKFAILURES),
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 4aa7e9dc0cb..7a7724da9bf 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -778,7 +778,6 @@ EXPORT_SYMBOL_GPL(net_ipv4_ctl_path);
 static __net_init int ipv4_sysctl_init_net(struct net *net)
 {
         struct ctl_table *table;
-        unsigned long limit;
 
         table = ipv4_net_table;
         if (!net_eq(net, &init_net)) {
@@ -814,11 +813,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
 
         net->ipv4.sysctl_rt_cache_rebuild_count = 4;
 
-        limit = nr_free_buffer_pages() / 8;
-        limit = max(limit, 128UL);
-        net->ipv4.sysctl_tcp_mem[0] = limit / 4 * 3;
-        net->ipv4.sysctl_tcp_mem[1] = limit;
-        net->ipv4.sysctl_tcp_mem[2] = net->ipv4.sysctl_tcp_mem[0] * 2;
+        tcp_init_mem(net);
 
         net->ipv4.ipv4_hdr = register_net_sysctl_table(net,
                         net_ipv4_ctl_path, table);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9bcdec3ad77..37755ccc0e9 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1876,6 +1876,20 @@ void tcp_shutdown(struct sock *sk, int how)
 }
 EXPORT_SYMBOL(tcp_shutdown);
 
+bool tcp_check_oom(struct sock *sk, int shift)
+{
+        bool too_many_orphans, out_of_socket_memory;
+
+        too_many_orphans = tcp_too_many_orphans(sk, shift);
+        out_of_socket_memory = tcp_out_of_memory(sk);
+
+        if (too_many_orphans && net_ratelimit())
+                pr_info("TCP: too many orphaned sockets\n");
+        if (out_of_socket_memory && net_ratelimit())
+                pr_info("TCP: out of memory -- consider tuning tcp_mem\n");
+        return too_many_orphans || out_of_socket_memory;
+}
+
 void tcp_close(struct sock *sk, long timeout)
 {
         struct sk_buff *skb;
@@ -2015,10 +2029,7 @@ adjudge_to_death:
         }
         if (sk->sk_state != TCP_CLOSE) {
                 sk_mem_reclaim(sk);
-                if (tcp_too_many_orphans(sk, 0)) {
-                        if (net_ratelimit())
-                                printk(KERN_INFO "TCP: too many of orphaned "
-                                       "sockets\n");
+                if (tcp_check_oom(sk, 0)) {
                         tcp_set_state(sk, TCP_CLOSE);
                         tcp_send_active_reset(sk, GFP_ATOMIC);
                         NET_INC_STATS_BH(sock_net(sk),
@@ -3216,6 +3227,15 @@ static int __init set_thash_entries(char *str)
 }
 __setup("thash_entries=", set_thash_entries);
 
+void tcp_init_mem(struct net *net)
+{
+        unsigned long limit = nr_free_buffer_pages() / 8;
+        limit = max(limit, 128UL);
+        net->ipv4.sysctl_tcp_mem[0] = limit / 4 * 3;
+        net->ipv4.sysctl_tcp_mem[1] = limit;
+        net->ipv4.sysctl_tcp_mem[2] = net->ipv4.sysctl_tcp_mem[0] * 2;
+}
+
 void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
@@ -3276,9 +3296,10 @@ void __init tcp_init(void)
         sysctl_tcp_max_orphans = cnt / 2;
         sysctl_max_syn_backlog = max(128, cnt / 256);
 
+        tcp_init_mem(&init_net);
         /* Set per-socket limits to no more than 1/128 the pressure threshold */
-        limit = ((unsigned long)init_net.ipv4.sysctl_tcp_mem[1])
-                << (PAGE_SHIFT - 7);
+        limit = nr_free_buffer_pages() << (PAGE_SHIFT - 10);
+        limit = max(limit, 128UL);
         max_share = min(4UL*1024*1024, limit);
 
         sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
index 6187eb4d1dc..f45e1c24244 100644
--- a/net/ipv4/tcp_bic.c
+++ b/net/ipv4/tcp_bic.c
@@ -63,7 +63,6 @@ static inline void bictcp_reset(struct bictcp *ca)
 {
         ca->cnt = 0;
         ca->last_max_cwnd = 0;
-        ca->loss_cwnd = 0;
         ca->last_cwnd = 0;
         ca->last_time = 0;
         ca->epoch_start = 0;
@@ -72,7 +71,11 @@ static inline void bictcp_reset(struct bictcp *ca)
 
 static void bictcp_init(struct sock *sk)
 {
-        bictcp_reset(inet_csk_ca(sk));
+        struct bictcp *ca = inet_csk_ca(sk);
+
+        bictcp_reset(ca);
+        ca->loss_cwnd = 0;
+
         if (initial_ssthresh)
                 tcp_sk(sk)->snd_ssthresh = initial_ssthresh;
 }
@@ -127,7 +130,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
         }
 
         /* if in slow start or link utilization is very low */
-        if (ca->loss_cwnd == 0) {
+        if (ca->last_max_cwnd == 0) {
                 if (ca->cnt > 20) /* increase cwnd 5% per RTT */
                         ca->cnt = 20;
         }
@@ -185,7 +188,7 @@ static u32 bictcp_undo_cwnd(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct bictcp *ca = inet_csk_ca(sk);
-        return max(tp->snd_cwnd, ca->last_max_cwnd);
+        return max(tp->snd_cwnd, ca->loss_cwnd);
 }
 
 static void bictcp_state(struct sock *sk, u8 new_state)
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index f376b05cca8..a9077f441cb 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -107,7 +107,6 @@ static inline void bictcp_reset(struct bictcp *ca)
 {
         ca->cnt = 0;
         ca->last_max_cwnd = 0;
-        ca->loss_cwnd = 0;
         ca->last_cwnd = 0;
         ca->last_time = 0;
         ca->bic_origin_point = 0;
@@ -142,7 +141,10 @@ static inline void bictcp_hystart_reset(struct sock *sk)
 
 static void bictcp_init(struct sock *sk)
 {
-        bictcp_reset(inet_csk_ca(sk));
+        struct bictcp *ca = inet_csk_ca(sk);
+
+        bictcp_reset(ca);
+        ca->loss_cwnd = 0;
 
         if (hystart)
                 bictcp_hystart_reset(sk);
@@ -275,7 +277,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
          * The initial growth of cubic function may be too conservative
          * when the available bandwidth is still unknown.
          */
-        if (ca->loss_cwnd == 0 && ca->cnt > 20)
+        if (ca->last_max_cwnd == 0 && ca->cnt > 20)
                 ca->cnt = 20;   /* increase cwnd 5% per RTT */
 
         /* TCP Friendly */
@@ -342,7 +344,7 @@ static u32 bictcp_undo_cwnd(struct sock *sk)
 {
         struct bictcp *ca = inet_csk_ca(sk);
 
-        return max(tcp_sk(sk)->snd_cwnd, ca->last_max_cwnd);
+        return max(tcp_sk(sk)->snd_cwnd, ca->loss_cwnd);
 }
 
 static void bictcp_state(struct sock *sk, u8 new_state)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2877c3e0958..53c8ce4046b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -105,7 +105,6 @@ int sysctl_tcp_abc __read_mostly;
 #define FLAG_SYN_ACKED          0x10 /* This ACK acknowledged SYN.              */
 #define FLAG_DATA_SACKED        0x20 /* New SACK.                               */
 #define FLAG_ECE                0x40 /* ECE in this ACK                         */
-#define FLAG_DATA_LOST          0x80 /* SACK detected data lossage.             */
 #define FLAG_SLOWPATH           0x100 /* Do not skip RFC checks for window update.*/
 #define FLAG_ONLY_ORIG_SACKED   0x200 /* SACKs only non-rexmit sent before RTO */
 #define FLAG_SND_UNA_ADVANCED   0x400 /* Snd_una was changed (!= FLAG_DATA_ACKED) */
@@ -1040,13 +1039,11 @@ static void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp,
  * These 6 states form finite state machine, controlled by the following events:
  * 1. New ACK (+SACK) arrives. (tcp_sacktag_write_queue())
  * 2. Retransmission. (tcp_retransmit_skb(), tcp_xmit_retransmit_queue())
- * 3. Loss detection event of one of three flavors:
+ * 3. Loss detection event of two flavors:
  *      A. Scoreboard estimator decided the packet is lost.
  *         A'. Reno "three dupacks" marks head of queue lost.
- *         A''. Its FACK modfication, head until snd.fack is lost.
- *      B. SACK arrives sacking data transmitted after never retransmitted
- *         hole was sent out.
- *      C. SACK arrives sacking SND.NXT at the moment, when the
+ *         A''. Its FACK modification, head until snd.fack is lost.
+ *      B. SACK arrives sacking SND.NXT at the moment, when the
  *         segment was retransmitted.
  * 4. D-SACK added new rule: D-SACK changes any tag to S.
  *
@@ -1153,7 +1150,7 @@ static int tcp_is_sackblock_valid(struct tcp_sock *tp, int is_dsack,
 }
 
 /* Check for lost retransmit. This superb idea is borrowed from "ratehalving".
- * Event "C". Later note: FACK people cheated me again 8), we have to account
+ * Event "B". Later note: FACK people cheated me again 8), we have to account
  * for reordering! Ugly, but should help.
  *
  * Search retransmitted skbs from write_queue that were sent when snd_nxt was
@@ -1310,25 +1307,26 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
         return in_sack;
 }
 
-static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
-                          struct tcp_sacktag_state *state,
+/* Mark the given newly-SACKed range as such, adjusting counters and hints. */
+static u8 tcp_sacktag_one(struct sock *sk,
+                          struct tcp_sacktag_state *state, u8 sacked,
+                          u32 start_seq, u32 end_seq,
                           int dup_sack, int pcount)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        u8 sacked = TCP_SKB_CB(skb)->sacked;
         int fack_count = state->fack_count;
 
         /* Account D-SACK for retransmitted packet. */
         if (dup_sack && (sacked & TCPCB_RETRANS)) {
                 if (tp->undo_marker && tp->undo_retrans &&
-                    after(TCP_SKB_CB(skb)->end_seq, tp->undo_marker))
+                    after(end_seq, tp->undo_marker))
                         tp->undo_retrans--;
                 if (sacked & TCPCB_SACKED_ACKED)
                         state->reord = min(fack_count, state->reord);
         }
 
         /* Nothing to do; acked frame is about to be dropped (was ACKed). */
-        if (!after(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
+        if (!after(end_seq, tp->snd_una))
                 return sacked;
 
         if (!(sacked & TCPCB_SACKED_ACKED)) {
@@ -1347,13 +1345,13 @@ static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
                                 /* New sack for not retransmitted frame,
                                  * which was in hole. It is reordering.
                                  */
-                                if (before(TCP_SKB_CB(skb)->seq,
+                                if (before(start_seq,
                                            tcp_highest_sack_seq(tp)))
                                         state->reord = min(fack_count,
                                                            state->reord);
 
                                 /* SACK enhanced F-RTO (RFC4138; Appendix B) */
-                                if (!after(TCP_SKB_CB(skb)->end_seq, tp->frto_highmark))
+                                if (!after(end_seq, tp->frto_highmark))
                                         state->flag |= FLAG_ONLY_ORIG_SACKED;
                         }
 
@@ -1371,8 +1369,7 @@ static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
 
                 /* Lost marker hint past SACKed? Tweak RFC3517 cnt */
                 if (!tcp_is_fack(tp) && (tp->lost_skb_hint != NULL) &&
-                    before(TCP_SKB_CB(skb)->seq,
-                           TCP_SKB_CB(tp->lost_skb_hint)->seq))
+                    before(start_seq, TCP_SKB_CB(tp->lost_skb_hint)->seq))
                         tp->lost_cnt_hint += pcount;
 
                 if (fack_count > tp->fackets_out)
@@ -1391,6 +1388,9 @@ static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
         return sacked;
 }
 
+/* Shift newly-SACKed bytes from this skb to the immediately previous
+ * already-SACKed sk_buff. Mark the newly-SACKed bytes as such.
+ */
 static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                            struct tcp_sacktag_state *state,
                            unsigned int pcount, int shifted, int mss,
@@ -1398,10 +1398,13 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
+        u32 start_seq = TCP_SKB_CB(skb)->seq;   /* start of newly-SACKed */
+        u32 end_seq = start_seq + shifted;      /* end of newly-SACKed */
 
         BUG_ON(!pcount);
 
-        if (skb == tp->lost_skb_hint)
+        /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
+        if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
                 tp->lost_cnt_hint += pcount;
 
         TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1427,8 +1430,11 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                 skb_shinfo(skb)->gso_type = 0;
         }
 
-        /* We discard results */
-        tcp_sacktag_one(skb, sk, state, dup_sack, pcount);
+        /* Adjust counters and hints for the newly sacked sequence range but
+         * discard the return value since prev is already marked.
+         */
+        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
+                        start_seq, end_seq, dup_sack, pcount);
 
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
         TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
@@ -1667,10 +1673,14 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
                         break;
 
                 if (in_sack) {
-                        TCP_SKB_CB(skb)->sacked = tcp_sacktag_one(skb, sk,
-                                                                  state,
-                                                                  dup_sack,
-                                                                  tcp_skb_pcount(skb));
+                        TCP_SKB_CB(skb)->sacked =
+                                tcp_sacktag_one(sk,
+                                                state,
+                                                TCP_SKB_CB(skb)->sacked,
+                                                TCP_SKB_CB(skb)->seq,
+                                                TCP_SKB_CB(skb)->end_seq,
+                                                dup_sack,
+                                                tcp_skb_pcount(skb));
 
                         if (!before(TCP_SKB_CB(skb)->seq,
                                     tcp_highest_sack_seq(tp)))
@@ -1844,10 +1854,6 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                 if (found_dup_sack && ((i + 1) == first_sack_index))
                         next_dup = &sp[i + 1];
 
-                /* Event "B" in the comment above. */
-                if (after(end_seq, tp->high_seq))
-                        state.flag |= FLAG_DATA_LOST;
-
                 /* Skip too early cached blocks */
                 while (tcp_sack_cache_ok(tp, cache) &&
                        !before(start_seq, cache->end_seq))
@@ -2515,8 +2521,11 @@ static void tcp_timeout_skbs(struct sock *sk)
         tcp_verify_left_out(tp);
 }
 
-/* Mark head of queue up as lost. With RFC3517 SACK, the packets is
- * is against sacked "cnt", otherwise it's against facked "cnt"
+/* Detect loss in event "A" above by marking head of queue up as lost.
+ * For FACK or non-SACK(Reno) senders, the first "packets" number of segments
+ * are considered lost. For RFC3517 SACK, a segment is considered lost if it
+ * has at least tp->reordering SACKed seqments above it; "packets" refers to
+ * the maximum SACKed segments to pass before reaching this limit.
  */
 static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 {
@@ -2525,6 +2534,8 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
         int cnt, oldcnt;
         int err;
         unsigned int mss;
+        /* Use SACK to deduce losses of new sequences sent during recovery */
+        const u32 loss_high = tcp_is_sack(tp) ?  tp->snd_nxt : tp->high_seq;
 
         WARN_ON(packets > tp->packets_out);
         if (tp->lost_skb_hint) {
@@ -2546,7 +2557,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                 tp->lost_skb_hint = skb;
                 tp->lost_cnt_hint = cnt;
 
-                if (after(TCP_SKB_CB(skb)->end_seq, tp->high_seq))
+                if (after(TCP_SKB_CB(skb)->end_seq, loss_high))
                         break;
 
                 oldcnt = cnt;
@@ -3033,19 +3044,10 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
         if (tcp_check_sack_reneging(sk, flag))
                 return;
 
-        /* C. Process data loss notification, provided it is valid. */
-        if (tcp_is_fack(tp) && (flag & FLAG_DATA_LOST) &&
-            before(tp->snd_una, tp->high_seq) &&
-            icsk->icsk_ca_state != TCP_CA_Open &&
-            tp->fackets_out > tp->reordering) {
-                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering, 0);
-                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPLOSS);
-        }
-
-        /* D. Check consistency of the current state. */
+        /* C. Check consistency of the current state. */
         tcp_verify_left_out(tp);
 
-        /* E. Check state exit conditions. State can be terminated
+        /* D. Check state exit conditions. State can be terminated
          *    when high_seq is ACKed. */
         if (icsk->icsk_ca_state == TCP_CA_Open) {
                 WARN_ON(tp->retrans_out != 0);
@@ -3077,7 +3079,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                 }
         }
 
-        /* F. Process state. */
+        /* E. Process state. */
         switch (icsk->icsk_ca_state) {
         case TCP_CA_Recovery:
                 if (!(flag & FLAG_SND_UNA_ADVANCED)) {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1eb4ad57670..94d683a61cb 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -631,7 +631,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
         arg.iov[0].iov_len  = sizeof(rep.th);
 
 #ifdef CONFIG_TCP_MD5SIG
-        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr) : NULL;
+        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
         if (key) {
                 rep.opt[0] = htonl((TCPOPT_NOP << 24) |
                                    (TCPOPT_NOP << 16) |
@@ -651,6 +651,11 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
                                       arg.iov[0].iov_len, IPPROTO_TCP, 0);
         arg.csumoffset = offsetof(struct tcphdr, check) / 2;
         arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
+        /* When socket is gone, all binding information is lost.
+         * routing might fail in this case. using iif for oif to
+         * make sure we can deliver it
+         */
+        arg.bound_dev_if = sk ? sk->sk_bound_dev_if : inet_iif(skb);
 
         net = dev_net(skb_dst(skb)->dev);
         arg.tos = ip_hdr(skb)->tos;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8c8de2780c7..4ff3b6dc74f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1141,11 +1141,9 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
         sk_mem_uncharge(sk, len);
         sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
 
-        /* Any change of skb->len requires recalculation of tso
-         * factor and mss.
-         */
+        /* Any change of skb->len requires recalculation of tso factor. */
         if (tcp_skb_pcount(skb) > 1)
-                tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk));
+                tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
 
         return 0;
 }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index a516d1e399d..cd2e0723266 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -77,10 +77,7 @@ static int tcp_out_of_resources(struct sock *sk, int do_reset)
         if (sk->sk_err_soft)
                 shift++;
 
-        if (tcp_too_many_orphans(sk, shift)) {
-                if (net_ratelimit())
-                        printk(KERN_INFO "Out of socket memory\n");
-
+        if (tcp_check_oom(sk, shift)) {
                 /* Catch exceptional cases, when connection requires reset.
                  *      1. Last segment was sent recently. */
                 if ((s32)(tcp_time_stamp - tp->lsndtime) <= TCP_TIMEWAIT_LEN ||
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a225d5ee3c2..c02280a4d12 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -502,29 +502,31 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
         rcu_read_unlock();
 }
 
-static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
+static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
 {
         struct net *net;
+        int old;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
 
         net = (struct net *)table->extra2;
-        if (p == &net->ipv6.devconf_dflt->forwarding)
-                return 0;
+        old = *p;
+        *p = newf;
 
-        if (!rtnl_trylock()) {
-                /* Restore the original values before restarting */
-                *p = old;
-                return restart_syscall();
+        if (p == &net->ipv6.devconf_dflt->forwarding) {
+                rtnl_unlock();
+                return 0;
         }
 
         if (p == &net->ipv6.devconf_all->forwarding) {
-                __s32 newf = net->ipv6.devconf_all->forwarding;
                 net->ipv6.devconf_dflt->forwarding = newf;
                 addrconf_forward_change(net, newf);
-        } else if ((!*p) ^ (!old))
+        } else if ((!newf) ^ (!old))
                 dev_forward_change((struct inet6_dev *)table->extra1);
         rtnl_unlock();
 
-        if (*p)
+        if (newf)
                 rt6_purge_dflt_routers(net);
         return 1;
 }
@@ -4260,9 +4262,17 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
+        ctl_table lctl;
         int ret;
 
-        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        /*
+         * ctl->data points to idev->cnf.forwarding, we should
+         * not modify it until we get the rtnl lock.
+         */
+        lctl = *ctl;
+        lctl.data = &val;
+
+        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_fixup_forwarding(ctl, valp, val);
@@ -4300,26 +4310,27 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
         rcu_read_unlock();
 }
 
-static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
+static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
 {
         struct net *net;
+        int old;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
 
         net = (struct net *)table->extra2;
+        old = *p;
+        *p = newf;
 
-        if (p == &net->ipv6.devconf_dflt->disable_ipv6)
+        if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
+                rtnl_unlock();
                 return 0;
-
-        if (!rtnl_trylock()) {
-                /* Restore the original values before restarting */
-                *p = old;
-                return restart_syscall();
         }
 
         if (p == &net->ipv6.devconf_all->disable_ipv6) {
-                __s32 newf = net->ipv6.devconf_all->disable_ipv6;
                 net->ipv6.devconf_dflt->disable_ipv6 = newf;
                 addrconf_disable_change(net, newf);
-        } else if ((!*p) ^ (!old))
+        } else if ((!newf) ^ (!old))
                 dev_disable_change((struct inet6_dev *)table->extra1);
 
         rtnl_unlock();
@@ -4333,9 +4344,17 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
+        ctl_table lctl;
         int ret;
 
-        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        /*
+         * ctl->data points to idev->cnf.disable_ipv6, we should
+         * not modify it until we get the rtnl lock.
+         */
+        lctl = *ctl;
+        lctl.data = &val;
+
+        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_disable_ipv6(ctl, valp, val);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 906c7ca4354..3edd05ae438 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1083,7 +1083,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 
 #ifdef CONFIG_TCP_MD5SIG
         if (sk)
-                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
+                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
 #endif
 
         if (th->ack)
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index d21e7ebd91c..55670ec3cd0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -393,11 +393,6 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
-        if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
-                goto drop;
-
-        nf_reset(skb);
-
         /* Charge it to the socket, dropping if the queue is full. */
         rc = sock_queue_rcv_skb(sk, skb);
         if (rc < 0)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index a18e6c3d36e..b9bef2c7502 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -713,6 +713,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sk_buff *skb = NULL;
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
+        unsigned long cpu_flags;
         size_t copied = 0;
         u32 peek_seq = 0;
         u32 *seq;
@@ -838,7 +839,9 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                         goto copy_uaddr;
 
                 if (!(flags & MSG_PEEK)) {
+                        spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
                         sk_eat_skb(sk, skb, 0);
+                        spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
                         *seq = 0;
                 }
 
@@ -859,7 +862,9 @@ copy_uaddr:
                 llc_cmsg_rcv(msg, skb);
 
         if (!(flags & MSG_PEEK)) {
+                        spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
                         sk_eat_skb(sk, skb, 0);
+                        spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
                         *seq = 0;
         }
 
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 38e6101190d..59edcd95a58 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -225,9 +225,9 @@ KEY_OPS(key);
                             key, &key_##name##_ops);
 
 void ieee80211_debugfs_key_add(struct ieee80211_key *key)
-  {
+{
         static int keycount;
-        char buf[50];
+        char buf[100];
         struct sta_info *sta;
 
         if (!key->local->debugfs.keys)
@@ -244,7 +244,8 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
 
         sta = key->sta;
         if (sta) {
-                sprintf(buf, "../../stations/%pM", sta->sta.addr);
+                sprintf(buf, "../../netdev:%s/stations/%pM",
+                        sta->sdata->name, sta->sta.addr);
                 key->debugfs.stalink =
                         debugfs_create_symlink("station", key->debugfs.dir, buf);
         }
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index b3d76b756cd..a4643969a13 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -106,6 +106,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
+        local->oper_channel = chan;
         channel_type = ifibss->channel_type;
         if (channel_type > NL80211_CHAN_HT20 &&
             !cfg80211_can_beacon_sec_chan(local->hw.wiphy, chan, channel_type))
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index e47768cb8cb..01a21c2f6ab 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1314,6 +1314,7 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                         continue;
                 }
                 /* count everything else */
+                sdata->vif.bss_conf.idle = false;
                 count++;
         }
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 0a0d94ad9b0..b142bd4c239 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -910,6 +910,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
                             result);
 
+        ieee80211_led_init(local);
+
         rtnl_lock();
 
         result = ieee80211_init_rate_ctrl_alg(local,
@@ -931,8 +933,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
-        ieee80211_led_init(local);
-
         local->network_latency_notifier.notifier_call =
                 ieee80211_max_network_latency;
         result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 73abb7524b2..54df1b2bafd 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -119,12 +119,12 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.mesh_action) +
                       sizeof(mgmt->u.action.u.mesh_action);
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+        skb = dev_alloc_skb(local->tx_headroom +
                             hdr_len +
                             2 + 37); /* max HWMP IE */
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
@@ -250,12 +250,12 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
         if (time_before(jiffies, ifmsh->next_perr))
                 return -EAGAIN;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+        skb = dev_alloc_skb(local->tx_headroom +
                             hdr_len +
                             2 + 15 /* PERR IE */);
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->tx_headroom + local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 41ef1b47644..a17251730b9 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -172,7 +172,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) +
                       sizeof(mgmt->u.action.u.self_prot);
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+        skb = dev_alloc_skb(local->tx_headroom +
                             hdr_len +
                             2 + /* capability info */
                             2 + /* AID */
@@ -186,7 +186,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                             sdata->u.mesh.ie_len);
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ecb4c84c1bb..295be92f7c7 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2750,7 +2750,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_work *wk;
         u8 bssid[ETH_ALEN];
         bool assoc_bss = false;
 
@@ -2763,30 +2762,47 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                 assoc_bss = true;
         } else {
                 bool not_auth_yet = false;
+                struct ieee80211_work *tmp, *wk = NULL;
 
                 mutex_unlock(&ifmgd->mtx);
 
                 mutex_lock(&local->mtx);
-                list_for_each_entry(wk, &local->work_list, list) {
-                        if (wk->sdata != sdata)
+                list_for_each_entry(tmp, &local->work_list, list) {
+                        if (tmp->sdata != sdata)
                                 continue;
 
-                        if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
-                            wk->type != IEEE80211_WORK_AUTH &&
-                            wk->type != IEEE80211_WORK_ASSOC &&
-                            wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
+                        if (tmp->type != IEEE80211_WORK_DIRECT_PROBE &&
+                            tmp->type != IEEE80211_WORK_AUTH &&
+                            tmp->type != IEEE80211_WORK_ASSOC &&
+                            tmp->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
                                 continue;
 
-                        if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
+                        if (memcmp(req->bss->bssid, tmp->filter_ta, ETH_ALEN))
                                 continue;
 
-                        not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
-                        list_del_rcu(&wk->list);
-                        free_work(wk);
+                        not_auth_yet = tmp->type == IEEE80211_WORK_DIRECT_PROBE;
+                        list_del_rcu(&tmp->list);
+                        synchronize_rcu();
+                        wk = tmp;
                         break;
                 }
                 mutex_unlock(&local->mtx);
 
+                if (wk && wk->type == IEEE80211_WORK_ASSOC) {
+                        /* clean up dummy sta & TX sync */
+                        sta_info_destroy_addr(wk->sdata, wk->filter_ta);
+                        if (wk->assoc.synced)
+                                drv_finish_tx_sync(local, wk->sdata,
+                                                   wk->filter_ta,
+                                                   IEEE80211_TX_SYNC_ASSOC);
+                } else if (wk && wk->type == IEEE80211_WORK_AUTH) {
+                        if (wk->probe_auth.synced)
+                                drv_finish_tx_sync(local, wk->sdata,
+                                                   wk->filter_ta,
+                                                   IEEE80211_TX_SYNC_AUTH);
+                }
+                kfree(wk);
+
                 /*
                  * If somebody requests authentication and we haven't
                  * sent out an auth frame yet there's no need to send
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 75140912076..5a5e504a8ff 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -611,7 +611,7 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                 tid_agg_rx->buf_size;
         if (!tid_agg_rx->reorder_buf[index] &&
-            tid_agg_rx->stored_mpdu_num > 1) {
+            tid_agg_rx->stored_mpdu_num) {
                 /*
                  * No buffers ready to be released, but check whether any
                  * frames in the reorder buffer have timed out.
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index bb6ad81b671..424ff622ab5 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -68,7 +68,6 @@ static int rds_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct rds_sock *rs;
-        unsigned long flags;
 
         if (!sk)
                 goto out;
@@ -94,10 +93,10 @@ static int rds_release(struct socket *sock)
         rds_rdma_drop_keys(rs);
         rds_notify_queue_get(rs, NULL);
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
         list_del_init(&rs->rs_item);
         rds_sock_count--;
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 
         rds_trans_put(rs->rs_transport);
 
@@ -409,7 +408,6 @@ static const struct proto_ops rds_proto_ops = {
 
 static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
 {
-        unsigned long flags;
         struct rds_sock *rs;
 
         sock_init_data(sock, sk);
@@ -426,10 +424,10 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
         spin_lock_init(&rs->rs_rdma_lock);
         rs->rs_rdma_keys = RB_ROOT;
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
         list_add_tail(&rs->rs_item, &rds_sock_list);
         rds_sock_count++;
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 
         return 0;
 }
@@ -471,12 +469,11 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
 {
         struct rds_sock *rs;
         struct rds_incoming *inc;
-        unsigned long flags;
         unsigned int total = 0;
 
         len /= sizeof(struct rds_info_message);
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
 
         list_for_each_entry(rs, &rds_sock_list, rs_item) {
                 read_lock(&rs->rs_recv_lock);
@@ -492,7 +489,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
                 read_unlock(&rs->rs_recv_lock);
         }
 
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 
         lens->nr = total;
         lens->each = sizeof(struct rds_info_message);
@@ -504,11 +501,10 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
 {
         struct rds_info_socket sinfo;
         struct rds_sock *rs;
-        unsigned long flags;
 
         len /= sizeof(struct rds_info_socket);
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
 
         if (len < rds_sock_count)
                 goto out;
@@ -529,7 +525,7 @@ out:
         lens->nr = rds_sock_count;
         lens->each = sizeof(struct rds_info_socket);
 
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 }
 
 static void rds_exit(void)
diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index 4cba13e46ff..ae3a035f539 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -232,7 +232,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
         if (toklen <= (n_parts + 1) * 4)
                 return -EINVAL;
 
-        princ->name_parts = kcalloc(sizeof(char *), n_parts, GFP_KERNEL);
+        princ->name_parts = kcalloc(n_parts, sizeof(char *), GFP_KERNEL);
         if (!princ->name_parts)
                 return -ENOMEM;
 
@@ -355,7 +355,7 @@ static int rxrpc_krb5_decode_tagged_array(struct krb5_tagged_data **_td,
 
                 _debug("n_elem %d", n_elem);
 
-                td = kcalloc(sizeof(struct krb5_tagged_data), n_elem,
+                td = kcalloc(n_elem, sizeof(struct krb5_tagged_data),
                              GFP_KERNEL);
                 if (!td)
                         return -ENOMEM;
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index e465064d39a..7e267d7b9c7 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -148,8 +148,7 @@ struct choke_skb_cb {
 
 static inline struct choke_skb_cb *choke_skb_cb(const struct sk_buff *skb)
 {
-        BUILD_BUG_ON(sizeof(skb->cb) <
-                sizeof(struct qdisc_skb_cb) + sizeof(struct choke_skb_cb));
+        qdisc_cb_private_validate(skb, sizeof(struct choke_skb_cb));
         return (struct choke_skb_cb *)qdisc_skb_cb(skb)->data;
 }
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index e7e1d0b57b3..e83d61ca78c 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -130,8 +130,7 @@ struct netem_skb_cb {
 
 static inline struct netem_skb_cb *netem_skb_cb(struct sk_buff *skb)
 {
-        BUILD_BUG_ON(sizeof(skb->cb) <
-                sizeof(struct qdisc_skb_cb) + sizeof(struct netem_skb_cb));
+        qdisc_cb_private_validate(skb, sizeof(struct netem_skb_cb));
         return (struct netem_skb_cb *)qdisc_skb_cb(skb)->data;
 }
 
@@ -419,7 +418,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         cb = netem_skb_cb(skb);
         if (q->gap == 0 ||              /* not doing reordering */
-            q->counter < q->gap ||      /* inside last reordering gap */
+            q->counter < q->gap - 1 ||  /* inside last reordering gap */
             q->reorder < get_crandom(&q->reorder_cor)) {
                 psched_time_t now;
                 psched_tdiff_t delay;
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index 96e42cae4c7..d7eea99333e 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -94,8 +94,7 @@ struct sfb_skb_cb {
 
 static inline struct sfb_skb_cb *sfb_skb_cb(const struct sk_buff *skb)
 {
-        BUILD_BUG_ON(sizeof(skb->cb) <
-                sizeof(struct qdisc_skb_cb) + sizeof(struct sfb_skb_cb));
+        qdisc_cb_private_validate(skb, sizeof(struct sfb_skb_cb));
         return (struct sfb_skb_cb *)qdisc_skb_cb(skb)->data;
 }
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 67494aef9ac..60d47180f04 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -166,9 +166,8 @@ struct sfq_skb_cb {
 
 static inline struct sfq_skb_cb *sfq_skb_cb(const struct sk_buff *skb)
 {
-       BUILD_BUG_ON(sizeof(skb->cb) <
-               sizeof(struct qdisc_skb_cb) + sizeof(struct sfq_skb_cb));
-       return (struct sfq_skb_cb *)qdisc_skb_cb(skb)->data;
+        qdisc_cb_private_validate(skb, sizeof(struct sfq_skb_cb));
+        return (struct sfq_skb_cb *)qdisc_skb_cb(skb)->data;
 }
 
 static unsigned int sfq_hash(const struct sfq_sched_data *q,
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 1426ec3d0a5..75762f34697 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -92,6 +92,7 @@ generic_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
         if (gcred->acred.group_info != NULL)
                 get_group_info(gcred->acred.group_info);
         gcred->acred.machine_cred = acred->machine_cred;
+        gcred->acred.principal = acred->principal;
 
         dprintk("RPC:       allocated %s cred %p for uid %d gid %d\n",
                         gcred->acred.machine_cred ? "machine" : "generic",
@@ -123,6 +124,17 @@ generic_destroy_cred(struct rpc_cred *cred)
         call_rcu(&cred->cr_rcu, generic_free_cred_callback);
 }
 
+static int
+machine_cred_match(struct auth_cred *acred, struct generic_cred *gcred, int flags)
+{
+        if (!gcred->acred.machine_cred ||
+            gcred->acred.principal != acred->principal ||
+            gcred->acred.uid != acred->uid ||
+            gcred->acred.gid != acred->gid)
+                return 0;
+        return 1;
+}
+
 /*
  * Match credentials against current process creds.
  */
@@ -132,9 +144,12 @@ generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
         struct generic_cred *gcred = container_of(cred, struct generic_cred, gc_base);
         int i;
 
+        if (acred->machine_cred)
+                return machine_cred_match(acred, gcred, flags);
+
         if (gcred->acred.uid != acred->uid ||
             gcred->acred.gid != acred->gid ||
-            gcred->acred.machine_cred != acred->machine_cred)
+            gcred->acred.machine_cred != 0)
                 goto out_nomatch;
 
         /* Optimisation in the case where pointers are identical... */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index aad8fb69998..85d3bb7490a 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1918,7 +1918,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 struct sk_buff *skb;
 
                 unix_state_lock(sk);
-                skb = skb_dequeue(&sk->sk_receive_queue);
+                skb = skb_peek(&sk->sk_receive_queue);
                 if (skb == NULL) {
                         unix_sk(sk)->recursion_level = 0;
                         if (copied >= target)
@@ -1958,11 +1958,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (check_creds) {
                         /* Never glue messages from different writers */
                         if ((UNIXCB(skb).pid  != siocb->scm->pid) ||
-                            (UNIXCB(skb).cred != siocb->scm->cred)) {
-                                skb_queue_head(&sk->sk_receive_queue, skb);
-                                sk->sk_data_ready(sk, skb->len);
+                            (UNIXCB(skb).cred != siocb->scm->cred))
                                 break;
-                        }
                 } else {
                         /* Copy credentials */
                         scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).cred);
@@ -1977,8 +1974,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 chunk = min_t(unsigned int, skb->len, size);
                 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        sk->sk_data_ready(sk, skb->len);
                         if (copied == 0)
                                 copied = -EFAULT;
                         break;
@@ -1993,13 +1988,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         if (UNIXCB(skb).fp)
                                 unix_detach_fds(siocb->scm, skb);
 
-                        /* put the skb back if we didn't use it up.. */
-                        if (skb->len) {
-                                skb_queue_head(&sk->sk_receive_queue, skb);
-                                sk->sk_data_ready(sk, skb->len);
+                        if (skb->len)
                                 break;
-                        }
 
+                        skb_unlink(skb, &sk->sk_receive_queue);
                         consume_skb(skb);
 
                         if (siocb->scm->fp)
@@ -2010,9 +2002,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         if (UNIXCB(skb).fp)
                                 siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
 
-                        /* put message back and return */
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        sk->sk_data_ready(sk, skb->len);
                         break;
                 }
         } while (size);