31 files changed, 178 insertions, 227 deletions
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index fa5cda4e552..45f61c348e3 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -101,6 +101,18 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
         pppoe_proto(skb) == htons(PPP_IPV6) && \
         brnf_filter_pppoe_tagged)
+static void fake_update_pmtu(struct dst_entry *dst, u32 mtu)
+{
+}
+static struct dst_ops fake_dst_ops = {
+        .family =               AF_INET,
+        .protocol =             __constant_htons(ETH_P_IP),
+        .update_pmtu =          fake_update_pmtu,
+        .entry_size =           sizeof(struct rtable),
+        .entries =              ATOMIC_INIT(0),
+};
 /*
 * Initialize bogus route table used to keep netfilter happy.
 * Currently, we fill in the PMTU entry because netfilter
@@ -117,6 +129,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
        rt->u.dst.path = &rt->u.dst;
        rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
        rt->u.dst.flags = DST_NOXFRM;
+        rt->u.dst.ops = &fake_dst_ops;
 }
 static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
diff --git a/net/compat.c b/net/compat.c
index 6ce1a1cadcc..a3a2ba0fac0 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -725,7 +725,7 @@ EXPORT_SYMBOL(compat_mc_getsockopt);
 static unsigned char nas[19]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
                                AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
                                AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-                                AL(6)};
+                                AL(4)};
 #undef AL
 asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
@@ -738,52 +738,13 @@ asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, uns
        return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
-asmlinkage long compat_sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
-                                   int __user *upeer_addrlen,
-                                   const compat_sigset_t __user *sigmask,
-                                   compat_size_t sigsetsize, int flags)
-{
-        compat_sigset_t ss32;
-        sigset_t ksigmask, sigsaved;
-        int ret;
-        if (sigmask) {
-                if (sigsetsize != sizeof(compat_sigset_t))
-                        return -EINVAL;
-                if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
-                        return -EFAULT;
-                sigset_from_compat(&ksigmask, &ss32);
-                sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
-                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
-        }
-        ret = do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
-        if (ret == -ERESTARTNOHAND) {
-                /*
-                 * Don't restore the signal mask yet. Let do_signal() deliver
-                 * the signal on the way back to userspace, before the signal
-                 * mask is restored.
-                 */
-                if (sigmask) {
-                        memcpy(&current->saved_sigmask, &sigsaved,
-                               sizeof(sigsaved));
-                        set_restore_sigmask();
-                }
-        } else if (sigmask)
-                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
-        return ret;
-}
 asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
 {
        int ret;
        u32 a[6];
        u32 a0, a1;
-        if (call < SYS_SOCKET || call > SYS_PACCEPT)
+        if (call < SYS_SOCKET || call > SYS_ACCEPT4)
                return -EINVAL;
        if (copy_from_user(a, args, nas[call]))
                return -EFAULT;
@@ -804,7 +765,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
                ret = sys_listen(a0, a1);
                break;
        case SYS_ACCEPT:
-                ret = do_accept(a0, compat_ptr(a1), compat_ptr(a[2]), 0);
+                ret = sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), 0);
                break;
        case SYS_GETSOCKNAME:
                ret = sys_getsockname(a0, compat_ptr(a1), compat_ptr(a[2]));
@@ -844,9 +805,8 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
        case SYS_RECVMSG:
                ret = compat_sys_recvmsg(a0, compat_ptr(a1), a[2]);
                break;
-        case SYS_PACCEPT:
+        case SYS_ACCEPT4:
-                ret = compat_sys_paccept(a0, compat_ptr(a1), compat_ptr(a[2]),
+                ret = sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), a[3]);
-                                         compat_ptr(a[3]), a[4], a[5]);
                break;
        default:
                ret = -EINVAL;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index a47f5bad110..8997e912aaa 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1973,13 +1973,7 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
        /* make sure that we don't pick a non-existing transmit queue */
        ntxq = pkt_dev->odev->real_num_tx_queues;
-        if (ntxq > num_online_cpus() && (pkt_dev->flags & F_QUEUE_MAP_CPU)) {
-                printk(KERN_WARNING "pktgen: WARNING: QUEUE_MAP_CPU "
-                       "disabled because CPU count (%d) exceeds number "
-                       "of tx queues (%d) on %s\n", num_online_cpus(), ntxq,
-                       pkt_dev->odev->name);
-                pkt_dev->flags &= ~F_QUEUE_MAP_CPU;
-        }
        if (ntxq <= pkt_dev->queue_map_min) {
                printk(KERN_WARNING "pktgen: WARNING: Requested "
                       "queue_map_min (zero-based) (%d) exceeds valid range "
@@ -2202,6 +2196,7 @@ static void set_cur_queue_map(struct pktgen_dev *pkt_dev)
                }
                pkt_dev->cur_queue_map = t;
        }
+        pkt_dev->cur_queue_map  = pkt_dev->cur_queue_map % pkt_dev->odev->real_num_tx_queues;
 }
 /* Increment/randomize headers according to flags and current values
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 31f29d2989f..4dfb6b4d455 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -878,7 +878,9 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                if (ifm->ifi_change)
                        flags = (flags & ifm->ifi_change) |
                                (dev->flags & ~ifm->ifi_change);
-                dev_change_flags(dev, flags);
+                err = dev_change_flags(dev, flags);
+                if (err < 0)
+                        goto errout;
        }
        if (tb[IFLA_TXQLEN])
diff --git a/net/core/scm.c b/net/core/scm.c
index ab242cc1acc..b12303dd39d 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -75,7 +75,6 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                if (!fpl)
                        return -ENOMEM;
                *fplp = fpl;
-                INIT_LIST_HEAD(&fpl->list);
                fpl->count = 0;
        }
        fpp = &fpl->fp[fpl->count];
@@ -301,7 +300,6 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
        new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
        if (new_fpl) {
-                INIT_LIST_HEAD(&new_fpl->list);
                for (i=fpl->count-1; i>=0; i--)
                        get_file(fpl->fp[i]);
                memcpy(new_fpl, fpl, sizeof(*fpl));
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d49ef8301b5..65f7757465b 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -149,7 +149,7 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 void skb_truesize_bug(struct sk_buff *skb)
 {
-        printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
+        WARN(net_ratelimit(), KERN_ERR "SKB BUG: Invalid truesize (%u) "
               "len=%u, sizeof(sk_buff)=%Zd\n",
               skb->truesize, skb->len, sizeof(struct sk_buff));
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 5e2a3132a8c..edf7220889a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -136,7 +136,6 @@
 static struct lock_class_key af_family_keys[AF_MAX];
 static struct lock_class_key af_family_slock_keys[AF_MAX];
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
 /*
 * Make lock validator output more readable. (we pre-construct these
 * strings build-time, so that runtime initialization of socket
@@ -187,7 +186,6 @@ static const char *af_family_clock_key_strings[AF_MAX+1] = {
  "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
  "clock-AF_MAX"
 };
-#endif
 /*
 * sk_callback_lock locking rules are per-address-family,
@@ -2037,9 +2035,6 @@ static inline void release_proto_idx(struct proto *prot)
 int proto_register(struct proto *prot, int alloc_slab)
 {
-        char *request_sock_slab_name = NULL;
-        char *timewait_sock_slab_name;
        if (alloc_slab) {
                prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0,
                                               SLAB_HWCACHE_ALIGN, NULL);
@@ -2053,12 +2048,12 @@ int proto_register(struct proto *prot, int alloc_slab)
                if (prot->rsk_prot != NULL) {
                        static const char mask[] = "request_sock_%s";
-                        request_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->rsk_prot->slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
-                        if (request_sock_slab_name == NULL)
+                        if (prot->rsk_prot->slab_name == NULL)
                                goto out_free_sock_slab;
-                        sprintf(request_sock_slab_name, mask, prot->name);
+                        sprintf(prot->rsk_prot->slab_name, mask, prot->name);
-                        prot->rsk_prot->slab = kmem_cache_create(request_sock_slab_name,
+                        prot->rsk_prot->slab = kmem_cache_create(prot->rsk_prot->slab_name,
                                                                 prot->rsk_prot->obj_size, 0,
                                                                 SLAB_HWCACHE_ALIGN, NULL);
@@ -2072,14 +2067,14 @@ int proto_register(struct proto *prot, int alloc_slab)
                if (prot->twsk_prot != NULL) {
                        static const char mask[] = "tw_sock_%s";
-                        timewait_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->twsk_prot->twsk_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
-                        if (timewait_sock_slab_name == NULL)
+                        if (prot->twsk_prot->twsk_slab_name == NULL)
                                goto out_free_request_sock_slab;
-                        sprintf(timewait_sock_slab_name, mask, prot->name);
+                        sprintf(prot->twsk_prot->twsk_slab_name, mask, prot->name);
                        prot->twsk_prot->twsk_slab =
-                                kmem_cache_create(timewait_sock_slab_name,
+                                kmem_cache_create(prot->twsk_prot->twsk_slab_name,
                                                  prot->twsk_prot->twsk_obj_size,
                                                  0, SLAB_HWCACHE_ALIGN,
                                                  NULL);
@@ -2095,14 +2090,14 @@ int proto_register(struct proto *prot, int alloc_slab)
        return 0;
 out_free_timewait_sock_slab_name:
-        kfree(timewait_sock_slab_name);
+        kfree(prot->twsk_prot->twsk_slab_name);
 out_free_request_sock_slab:
        if (prot->rsk_prot && prot->rsk_prot->slab) {
                kmem_cache_destroy(prot->rsk_prot->slab);
                prot->rsk_prot->slab = NULL;
        }
 out_free_request_sock_slab_name:
-        kfree(request_sock_slab_name);
+        kfree(prot->rsk_prot->slab_name);
 out_free_sock_slab:
        kmem_cache_destroy(prot->slab);
        prot->slab = NULL;
@@ -2125,18 +2120,14 @@ void proto_unregister(struct proto *prot)
        }
        if (prot->rsk_prot != NULL && prot->rsk_prot->slab != NULL) {
-                const char *name = kmem_cache_name(prot->rsk_prot->slab);
                kmem_cache_destroy(prot->rsk_prot->slab);
-                kfree(name);
+                kfree(prot->rsk_prot->slab_name);
                prot->rsk_prot->slab = NULL;
        }
        if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) {
-                const char *name = kmem_cache_name(prot->twsk_prot->twsk_slab);
                kmem_cache_destroy(prot->twsk_prot->twsk_slab);
-                kfree(name);
+                kfree(prot->twsk_prot->twsk_slab_name);
                prot->twsk_prot->twsk_slab = NULL;
        }
 }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1fbff5fa424..1aa2dc9e380 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1117,6 +1117,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                        },
                },
                .proto = sk->sk_protocol,
+                .flags = inet_sk_flowi_flags(sk),
                .uli_u = {
                        .ports = {
                                .sport = inet->sport,
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 861978a4f1a..cfb38ac9d69 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -209,9 +209,17 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
                hash = protocol & (MAX_INET_PROTOS - 1);
                ipprot = rcu_dereference(inet_protos[hash]);
-                if (ipprot != NULL && (net == &init_net || ipprot->netns_ok)) {
+                if (ipprot != NULL) {
                        int ret;
+                        if (!net_eq(net, &init_net) && !ipprot->netns_ok) {
+                                if (net_ratelimit())
+                                        printk("%s: proto %d isn't netns-ready\n",
+                                                __func__, protocol);
+                                kfree_skb(skb);
+                                goto out;
+                        }
                        if (!ipprot->no_policy) {
                                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                                        kfree_skb(skb);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b42e082cc17..25924b1eb2e 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1945,13 +1945,14 @@ int __init ip_mr_init(void)
                goto proc_cache_fail;
 #endif
        return 0;
-reg_notif_fail:
-        kmem_cache_destroy(mrt_cachep);
 #ifdef CONFIG_PROC_FS
-proc_vif_fail:
-        unregister_netdevice_notifier(&ip_mr_notifier);
 proc_cache_fail:
        proc_net_remove(&init_net, "ip_mr_vif");
+proc_vif_fail:
+        unregister_netdevice_notifier(&ip_mr_notifier);
 #endif
+reg_notif_fail:
+        del_timer(&ipmr_expire_timer);
+        kmem_cache_destroy(mrt_cachep);
        return err;
 }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ba85d883189..85b07eba187 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -722,7 +722,8 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
                                 unsigned int mss_now)
 {
-        if (skb->len <= mss_now || !sk_can_gso(sk)) {
+        if (skb->len <= mss_now || !sk_can_gso(sk) ||
+            tcp_urg_mode(tcp_sk(sk))) {
                /* Avoid the costly divide in the normal
                 * non-TSO case.
                 */
@@ -1163,7 +1164,9 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
 {
        int tso_segs = tcp_skb_pcount(skb);
-        if (!tso_segs || (tso_segs > 1 && tcp_skb_mss(skb) != mss_now)) {
+        if (!tso_segs ||
+            (tso_segs > 1 && (tcp_skb_mss(skb) != mss_now ||
+                              tcp_urg_mode(tcp_sk(sk))))) {
                tcp_set_skb_tso_segs(sk, skb, mss_now);
                tso_segs = tcp_skb_pcount(skb);
        }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cf02701ced4..98c1fd09be8 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -633,6 +633,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                                .saddr = saddr,
                                                .tos = tos } },
                                    .proto = sk->sk_protocol,
+                                    .flags = inet_sk_flowi_flags(sk),
                                    .uli_u = { .ports =
                                               { .sport = inet->sport,
                                                 .dport = dport } } };
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 410046a8cc9..e44deb8d4df 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -661,6 +661,11 @@ int datagram_send_ctl(struct net *net,
                        switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                        case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1) {
+                                        err = -EINVAL;
+                                        goto exit_f;
+                                }
                                break;
 #endif
                        default:
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 52a7eb0e2c2..0524769632e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -224,7 +224,7 @@ static struct file_operations ip6mr_vif_fops = {
        .open    = ip6mr_vif_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
@@ -338,7 +338,7 @@ static struct file_operations ip6mr_mfc_fops = {
        .open    = ipmr_mfc_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 #endif
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4e5eac301f9..2aa294be0c7 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -366,11 +366,16 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                }
                /* routing header option needs extra check */
+                retv = -EINVAL;
                if (optname == IPV6_RTHDR && opt && opt->srcrt) {
                        struct ipv6_rt_hdr *rthdr = opt->srcrt;
                        switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                        case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1)
+                                        goto sticky_done;
                                break;
 #endif
                        default:
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 07f0b76e742..97c17fdd6f7 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -132,7 +132,7 @@ static struct snmp_mib snmp6_udplite6_list[] = {
 static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
 {
-        static char name[32];
+        char name[32];
        int i;
        /* print by name -- deprecated items */
@@ -144,7 +144,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
                p = icmp6type2name[icmptype];
                if (!p) /* don't print un-named types here */
                        continue;
-                (void) snprintf(name, sizeof(name)-1, "Icmp6%s%s",
+                snprintf(name, sizeof(name), "Icmp6%s%s",
                        i & 0x100 ? "Out" : "In", p);
                seq_printf(seq, "%-32s\t%lu\n", name,
                        snmp_fold_field(mib, i));
@@ -157,7 +157,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
                val = snmp_fold_field(mib, i);
                if (!val)
                        continue;
-                (void) snprintf(name, sizeof(name)-1, "Icmp6%sType%u",
+                snprintf(name, sizeof(name), "Icmp6%sType%u",
                        i & 0x100 ?  "Out" : "In", i & 0xff);
                seq_printf(seq, "%-32s\t%lu\n", name, val);
        }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 14d165f0df7..409bb771623 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2560,25 +2560,3 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
                ieee80211_restart_sta_timer(sdata);
        rcu_read_unlock();
 }
-/* driver notification call */
-void ieee80211_notify_mac(struct ieee80211_hw *hw,
-                          enum ieee80211_notification_types  notif_type)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
-        switch (notif_type) {
-        case IEEE80211_NOTIFY_RE_ASSOC:
-                rtnl_lock();
-                list_for_each_entry(sdata, &local->interfaces, list) {
-                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                                continue;
-                        ieee80211_sta_req_auth(sdata, &sdata->u.sta);
-                }
-                rtnl_unlock();
-                break;
-        }
-}
-EXPORT_SYMBOL(ieee80211_notify_mac);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 742f811ca41..ab4ddba874b 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -271,6 +271,7 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
                                   __u32 *mode, char *extra)
 {
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
        int type;
        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -281,6 +282,13 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
                type = NL80211_IFTYPE_STATION;
                break;
        case IW_MODE_ADHOC:
+                /* Setting ad-hoc mode on non ibss channel is not
+                 * supported.
+                 */
+                if (local->oper_channel &&
+                    (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS))
+                        return -EOPNOTSUPP;
                type = NL80211_IFTYPE_ADHOC;
                break;
        case IW_MODE_REPEAT:
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 622d7c671cb..233fdd2d7d2 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -305,9 +305,7 @@ void nf_conntrack_hash_insert(struct nf_conn *ct)
        hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
        repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
-        spin_lock_bh(&nf_conntrack_lock);
        __nf_conntrack_hash_insert(ct, hash, repl_hash);
-        spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index a040d46f85d..5f4a6516b3b 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1090,7 +1090,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
        struct nf_conn_help *help;
        struct nf_conntrack_helper *helper;
-        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_KERNEL);
+        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
        if (ct == NULL || IS_ERR(ct))
                return -ENOMEM;
@@ -1138,7 +1138,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                }
        }
-        nf_ct_acct_ext_add(ct, GFP_KERNEL);
+        nf_ct_acct_ext_add(ct, GFP_ATOMIC);
 #if defined(CONFIG_NF_CONNTRACK_MARK)
        if (cda[CTA_MARK])
@@ -1212,13 +1212,14 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                        atomic_inc(&master_ct->ct_general.use);
                }
-                spin_unlock_bh(&nf_conntrack_lock);
                err = -ENOENT;
                if (nlh->nlmsg_flags & NLM_F_CREATE)
                        err = ctnetlink_create_conntrack(cda,
                                                         &otuple,
                                                         &rtuple,
                                                         master_ct);
+                spin_unlock_bh(&nf_conntrack_lock);
                if (err < 0 && master_ct)
                        nf_ct_put(master_ct);
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index defeb7a0d50..9d211f12582 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -33,9 +33,30 @@
 #include <net/phonet/phonet.h>
 #include <net/phonet/pn_dev.h>
-static struct net_proto_family phonet_proto_family;
+/* Transport protocol registration */
-static struct phonet_protocol *phonet_proto_get(int protocol);
+static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static inline void phonet_proto_put(struct phonet_protocol *pp);
+static DEFINE_SPINLOCK(proto_tab_lock);
+static struct phonet_protocol *phonet_proto_get(int protocol)
+{
+        struct phonet_protocol *pp;
+        if (protocol >= PHONET_NPROTO)
+                return NULL;
+        spin_lock(&proto_tab_lock);
+        pp = proto_tab[protocol];
+        if (pp && !try_module_get(pp->prot->owner))
+                pp = NULL;
+        spin_unlock(&proto_tab_lock);
+        return pp;
+}
+static inline void phonet_proto_put(struct phonet_protocol *pp)
+{
+        module_put(pp->prot->owner);
+}
 /* protocol family functions */
@@ -144,8 +165,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
        struct phonethdr *ph;
        int err;
-        if (skb->len + 2 > 0xffff) {
+        if (skb->len + 2 > 0xffff /* Phonet length field limit */ ||
-                /* Phonet length field would overflow */
+            skb->len + sizeof(struct phonethdr) > dev->mtu) {
                err = -EMSGSIZE;
                goto drop;
        }
@@ -375,10 +396,6 @@ static struct packet_type phonet_packet_type = {
        .func = phonet_rcv,
 };
-/* Transport protocol registration */
-static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static DEFINE_SPINLOCK(proto_tab_lock);
 int __init_or_module phonet_proto_register(int protocol,
                                                struct phonet_protocol *pp)
 {
@@ -412,27 +429,6 @@ void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
 }
 EXPORT_SYMBOL(phonet_proto_unregister);
-static struct phonet_protocol *phonet_proto_get(int protocol)
-{
-        struct phonet_protocol *pp;
-        if (protocol >= PHONET_NPROTO)
-                return NULL;
-        spin_lock(&proto_tab_lock);
-        pp = proto_tab[protocol];
-        if (pp && !try_module_get(pp->prot->owner))
-                pp = NULL;
-        spin_unlock(&proto_tab_lock);
-        return pp;
-}
-static inline void phonet_proto_put(struct phonet_protocol *pp)
-{
-        module_put(pp->prot->owner);
-}
 /* Module registration */
 static int __init phonet_init(void)
 {
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 53be9fc82aa..f93ff8ef47d 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -115,7 +115,7 @@ int phonet_address_del(struct net_device *dev, u8 addr)
        pnd = __phonet_get(dev);
        if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
                err = -EADDRNOTAVAIL;
-        if (bitmap_empty(pnd->addrs, 64))
+        else if (bitmap_empty(pnd->addrs, 64))
                __phonet_device_free(pnd);
        spin_unlock_bh(&pndevs.lock);
        return err;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index a7f1ce11bc2..0c1cc761280 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1072,6 +1072,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
        unsigned char *asmptr;
        int n, size, qbit = 0;
+        /* ROSE empty frame has no meaning : don't send */
+        if (len == 0)
+                return 0;
        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
                return -EINVAL;
@@ -1265,6 +1269,12 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
        skb_reset_transport_header(skb);
        copied     = skb->len;
+        /* ROSE empty frame has no meaning : ignore it */
+        if (copied == 0) {
+                skb_free_datagram(sk, skb);
+                return copied;
+        }
        if (copied > size) {
                copied = size;
                msg->msg_flags |= MSG_TRUNC;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b16ad2972c6..6ab4a2f92ca 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -417,6 +417,8 @@ static int qdisc_dump_stab(struct sk_buff *skb, struct qdisc_size_table *stab)
        struct nlattr *nest;
        nest = nla_nest_start(skb, TCA_STAB);
+        if (nest == NULL)
+                goto nla_put_failure;
        NLA_PUT(skb, TCA_STAB_BASE, sizeof(stab->szopts), &stab->szopts);
        nla_nest_end(skb, nest);
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 93cd30ce650..cdcd16fcfed 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -270,6 +270,8 @@ static void dev_watchdog_down(struct net_device *dev)
 void netif_carrier_on(struct net_device *dev)
 {
        if (test_and_clear_bit(__LINK_STATE_NOCARRIER, &dev->state)) {
+                if (dev->reg_state == NETREG_UNINITIALIZED)
+                        return;
                linkwatch_fire_event(dev);
                if (netif_running(dev))
                        __netdev_watchdog_up(dev);
@@ -285,8 +287,11 @@ EXPORT_SYMBOL(netif_carrier_on);
 */
 void netif_carrier_off(struct net_device *dev)
 {
-        if (!test_and_set_bit(__LINK_STATE_NOCARRIER, &dev->state))
+        if (!test_and_set_bit(__LINK_STATE_NOCARRIER, &dev->state)) {
+                if (dev->reg_state == NETREG_UNINITIALIZED)
+                        return;
                linkwatch_fire_event(dev);
+        }
 }
 EXPORT_SYMBOL(netif_carrier_off);
diff --git a/net/socket.c b/net/socket.c
index 57550c3bcab..92764d83689 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1426,8 +1426,8 @@ asmlinkage long sys_listen(int fd, int backlog)
 *      clean when we restucture accept also.
 */
-long do_accept(int fd, struct sockaddr __user *upeer_sockaddr,
+asmlinkage long sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
-               int __user *upeer_addrlen, int flags)
+                            int __user *upeer_addrlen, int flags)
 {
        struct socket *sock, *newsock;
        struct file *newfile;
@@ -1510,66 +1510,10 @@ out_fd:
        goto out_put;
 }
-#if 0
-#ifdef HAVE_SET_RESTORE_SIGMASK
-asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
-                            int __user *upeer_addrlen,
-                            const sigset_t __user *sigmask,
-                            size_t sigsetsize, int flags)
-{
-        sigset_t ksigmask, sigsaved;
-        int ret;
-        if (sigmask) {
-                /* XXX: Don't preclude handling different sized sigset_t's.  */
-                if (sigsetsize != sizeof(sigset_t))
-                        return -EINVAL;
-                if (copy_from_user(&ksigmask, sigmask, sizeof(ksigmask)))
-                        return -EFAULT;
-                sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
-                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
-        }
-        ret = do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
-        if (ret < 0 && signal_pending(current)) {
-                /*
-                 * Don't restore the signal mask yet. Let do_signal() deliver
-                 * the signal on the way back to userspace, before the signal
-                 * mask is restored.
-                 */
-                if (sigmask) {
-                        memcpy(&current->saved_sigmask, &sigsaved,
-                               sizeof(sigsaved));
-                        set_restore_sigmask();
-                }
-        } else if (sigmask)
-                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
-        return ret;
-}
-#else
-asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
-                            int __user *upeer_addrlen,
-                            const sigset_t __user *sigmask,
-                            size_t sigsetsize, int flags)
-{
-        /* The platform does not support restoring the signal mask in the
-         * return path.  So we do not allow using paccept() with a signal
-         * mask.  */
-        if (sigmask)
-                return -EINVAL;
-        return do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
-}
-#endif
-#endif
 asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
                           int __user *upeer_addrlen)
 {
-        return do_accept(fd, upeer_sockaddr, upeer_addrlen, 0);
+        return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
 }
 /*
@@ -2096,7 +2040,7 @@ static const unsigned char nargs[19]={
        AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
        AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
        AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-        AL(6)
+        AL(4)
 };
 #undef AL
@@ -2115,7 +2059,7 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
        unsigned long a0, a1;
        int err;
-        if (call < 1 || call > SYS_PACCEPT)
+        if (call < 1 || call > SYS_ACCEPT4)
                return -EINVAL;
        /* copy_from_user should be SMP safe. */
@@ -2143,9 +2087,8 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
                err = sys_listen(a0, a1);
                break;
        case SYS_ACCEPT:
-                err =
+                err = sys_accept4(a0, (struct sockaddr __user *)a1,
-                    do_accept(a0, (struct sockaddr __user *)a1,
+                                  (int __user *)a[2], 0);
-                              (int __user *)a[2], 0);
                break;
        case SYS_GETSOCKNAME:
                err =
@@ -2192,12 +2135,9 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
        case SYS_RECVMSG:
                err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
                break;
-        case SYS_PACCEPT:
+        case SYS_ACCEPT4:
-                err =
+                err = sys_accept4(a0, (struct sockaddr __user *)a1,
-                    sys_paccept(a0, (struct sockaddr __user *)a1,
+                                  (int __user *)a[2], a[3]);
-                                (int __user *)a[2],
-                                (const sigset_t __user *) a[3],
-                                a[4], a[5]);
                break;
        default:
                err = -EINVAL;
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 744b79fdcb1..4028502f052 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -133,13 +133,29 @@ static int
 generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
 {
        struct generic_cred *gcred = container_of(cred, struct generic_cred, gc_base);
+        int i;
        if (gcred->acred.uid != acred->uid ||
            gcred->acred.gid != acred->gid ||
-            gcred->acred.group_info != acred->group_info ||
            gcred->acred.machine_cred != acred->machine_cred)
-                return 0;
+                goto out_nomatch;
+        /* Optimisation in the case where pointers are identical... */
+        if (gcred->acred.group_info == acred->group_info)
+                goto out_match;
+        /* Slow path... */
+        if (gcred->acred.group_info->ngroups != acred->group_info->ngroups)
+                goto out_nomatch;
+        for (i = 0; i < gcred->acred.group_info->ngroups; i++) {
+                if (GROUP_AT(gcred->acred.group_info, i) !=
+                                GROUP_AT(acred->group_info, i))
+                        goto out_nomatch;
+        }
+out_match:
        return 1;
+out_nomatch:
+        return 0;
 }
 void __init rpc_init_generic_auth(void)
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 95293f549e9..a1951dcc577 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1183,7 +1183,11 @@ int svc_addsock(struct svc_serv *serv,
        else if (so->state > SS_UNCONNECTED)
                err = -EISCONN;
        else {
-                svsk = svc_setup_socket(serv, so, &err, SVC_SOCK_DEFAULTS);
+                if (!try_module_get(THIS_MODULE))
+                        err = -ENOENT;
+                else
+                        svsk = svc_setup_socket(serv, so, &err,
+                                                SVC_SOCK_DEFAULTS);
                if (svsk) {
                        struct sockaddr_storage addr;
                        struct sockaddr *sin = (struct sockaddr *)&addr;
@@ -1196,7 +1200,8 @@ int svc_addsock(struct svc_serv *serv,
                        spin_unlock_bh(&serv->sv_lock);
                        svc_xprt_received(&svsk->sk_xprt);
                        err = 0;
-                }
+                } else
+                        module_put(THIS_MODULE);
        }
        if (err) {
                sockfd_put(so);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index eb90f77bb0e..66d5ac4773a 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1343,6 +1343,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
        if (NULL == siocb->scm)
                siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
        err = scm_send(sock, msg, siocb->scm);
        if (err < 0)
                return err;
@@ -1493,6 +1494,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
        if (NULL == siocb->scm)
                siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
        err = scm_send(sock, msg, siocb->scm);
        if (err < 0)
                return err;
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6d4a9a8de5e..abb3ab34cb1 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -80,6 +80,7 @@
 #include <linux/file.h>
 #include <linux/proc_fs.h>
 #include <linux/mutex.h>
+#include <linux/wait.h>
 #include <net/sock.h>
 #include <net/af_unix.h>
@@ -91,6 +92,7 @@
 static LIST_HEAD(gc_inflight_list);
 static LIST_HEAD(gc_candidates);
 static DEFINE_SPINLOCK(unix_gc_lock);
+static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 unsigned int unix_tot_inflight;
@@ -266,12 +268,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
                list_move_tail(&u->link, &gc_candidates);
 }
-/* The external entry point: unix_gc() */
+static bool gc_in_progress = false;
-void unix_gc(void)
+void wait_for_unix_gc(void)
 {
-        static bool gc_in_progress = false;
+        wait_event(unix_gc_wait, gc_in_progress == false);
+}
+/* The external entry point: unix_gc() */
+void unix_gc(void)
+{
        struct unix_sock *u;
        struct unix_sock *next;
        struct sk_buff_head hitlist;
@@ -376,6 +382,7 @@ void unix_gc(void)
        /* All candidates should have been detached by now. */
        BUG_ON(!list_empty(&gc_candidates));
        gc_in_progress = false;
+        wake_up(&unix_gc_wait);
 out:
        spin_unlock(&unix_gc_lock);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 626dbb68849..eb3b1a9f9b1 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -343,9 +343,9 @@ static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
                                return 0;
                        return -EALREADY;
                }
-                if (WARN_ON(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2)),
+                if (WARN(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2),
                                "Invalid Country IE regulatory hint passed "
-                                "to the wireless core\n")
+                                "to the wireless core\n"))
                        return -EINVAL;
                /* We ignore Country IE hints for now, as we haven't yet
                 * added the dot11MultiDomainCapabilityEnabled flag