Merge branch 'linus' into x86/amd-iommu

author: Ingo Molnar <mingo@elte.hu> 2008-07-18 12:43:08 -0400
committer: Ingo Molnar <mingo@elte.hu> 2008-07-18 12:43:08 -0400
commit: f1b0c8d3d3b5ff9c0b14bb2383a4bc38d8922bd1 (patch)
tree: b7d9f439d5b99d8b03bf490d4b17156414e48d45 /net
parent: d591b0a3ae25f587d0c4da1e1d1a425143590790 (diff)
parent: 5b664cb235e97afbf34db9c4d77f08ebd725335e (diff)
76 files changed, 686 insertions, 423 deletions
diff --git a/net/802/psnap.c b/net/802/psnap.c
index 31128cb92a23..ea4643931446 100644
--- a/net/802/psnap.c
+++ b/net/802/psnap.c
@@ -20,6 +20,7 @@
 #include <linux/mm.h>
 #include <linux/in.h>
 #include <linux/init.h>
+#include <linux/rculist.h>
 static LIST_HEAD(snap_list);
 static DEFINE_SPINLOCK(snap_lock);
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index ab2225da0ee2..08f14f6c5fd6 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -27,6 +27,7 @@
 #include <linux/mm.h>
 #include <linux/in.h>
 #include <linux/init.h>
+#include <linux/rculist.h>
 #include <net/p8022.h>
 #include <net/arp.h>
 #include <linux/rtnetlink.h>
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 72c5976a5ce3..142060f02054 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/rculist.h>
 #include <linux/spinlock.h>
 #include <linux/times.h>
 #include <linux/netdevice.h>
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c2397f503b0f..f38cc5317b88 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -442,12 +442,16 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
 void __exit br_cleanup_bridges(void)
 {
-        struct net_device *dev, *nxt;
+        struct net_device *dev;
        rtnl_lock();
-        for_each_netdev_safe(&init_net, dev, nxt)
+restart:
-                if (dev->priv_flags & IFF_EBRIDGE)
+        for_each_netdev(&init_net, dev) {
+                if (dev->priv_flags & IFF_EBRIDGE) {
                        del_br(dev->priv);
+                        goto restart;
+                }
+        }
        rtnl_unlock();
 }
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index e38034aa56f5..9e96ffcd29a3 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -13,6 +13,7 @@
 *      2 of the License, or (at your option) any later version.
 */
 #include <linux/kernel.h>
+#include <linux/rculist.h>
 #include "br_private.h"
 #include "br_private_stp.h"
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7e8ca2836452..484bbf6dd032 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -205,12 +205,19 @@ static int can_create(struct net *net, struct socket *sock, int protocol)
 *  -ENOBUFS on full driver queue (see net_xmit_errno())
 *  -ENOMEM when local loopback failed at calling skb_clone()
 *  -EPERM when trying to send on a non-CAN interface
+ *  -EINVAL when the skb->data does not contain a valid CAN frame
 */
 int can_send(struct sk_buff *skb, int loop)
 {
        struct sk_buff *newskb = NULL;
+        struct can_frame *cf = (struct can_frame *)skb->data;
        int err;
+        if (skb->len != sizeof(struct can_frame) || cf->can_dlc > 8) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
        if (skb->dev->type != ARPHRD_CAN) {
                kfree_skb(skb);
                return -EPERM;
@@ -605,6 +612,7 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
                   struct packet_type *pt, struct net_device *orig_dev)
 {
        struct dev_rcv_lists *d;
+        struct can_frame *cf = (struct can_frame *)skb->data;
        int matches;
        if (dev->type != ARPHRD_CAN || dev_net(dev) != &init_net) {
@@ -612,6 +620,8 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
                return 0;
        }
+        BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8);
        /* update statistics */
        can_stats.rx_frames++;
        can_stats.rx_frames_delta++;
diff --git a/net/can/bcm.c b/net/can/bcm.c
index d9a3a9d13bed..72c2ce904f83 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -298,7 +298,7 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
        if (head->nframes) {
                /* can_frames starting here */
-                firstframe = (struct can_frame *) skb_tail_pointer(skb);
+                firstframe = (struct can_frame *)skb_tail_pointer(skb);
                memcpy(skb_put(skb, datalen), frames, datalen);
@@ -826,6 +826,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                for (i = 0; i < msg_head->nframes; i++) {
                        err = memcpy_fromiovec((u8 *)&op->frames[i],
                                               msg->msg_iov, CFSIZ);
+                        if (op->frames[i].can_dlc > 8)
+                                err = -EINVAL;
                        if (err < 0)
                                return err;
@@ -858,6 +862,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                for (i = 0; i < msg_head->nframes; i++) {
                        err = memcpy_fromiovec((u8 *)&op->frames[i],
                                               msg->msg_iov, CFSIZ);
+                        if (op->frames[i].can_dlc > 8)
+                                err = -EINVAL;
                        if (err < 0) {
                                if (op->frames != &op->sframe)
                                        kfree(op->frames);
@@ -1164,9 +1172,12 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk)
        skb->dev = dev;
        skb->sk  = sk;
-        can_send(skb, 1); /* send with loopback */
+        err = can_send(skb, 1); /* send with loopback */
        dev_put(dev);
+        if (err)
+                return err;
        return CFSIZ + MHSIZ;
 }
@@ -1185,6 +1196,10 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock,
        if (!bo->bound)
                return -ENOTCONN;
+        /* check for valid message length from userspace */
+        if (size < MHSIZ || (size - MHSIZ) % CFSIZ)
+                return -EINVAL;
        /* check for alternative ifindex for this bcm_op */
        if (!ifindex && msg->msg_name) {
@@ -1259,8 +1274,8 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock,
                break;
        case TX_SEND:
-                /* we need at least one can_frame */
+                /* we need exactly one can_frame behind the msg head */
-                if (msg_head.nframes < 1)
+                if ((msg_head.nframes != 1) || (size != CFSIZ + MHSIZ))
                        ret = -EINVAL;
                else
                        ret = bcm_tx_send(msg, ifindex, sk);
diff --git a/net/can/raw.c b/net/can/raw.c
index 69877b8e7e9c..3e46ee36a1aa 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -632,6 +632,9 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
        } else
                ifindex = ro->ifindex;
+        if (size != sizeof(struct can_frame))
+                return -EINVAL;
        dev = dev_get_by_index(&init_net, ifindex);
        if (!dev)
                return -ENXIO;
diff --git a/net/core/dev.c b/net/core/dev.c
index c421a1f8f0b9..821cb1628e5e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -454,7 +454,7 @@ static int netdev_boot_setup_add(char *name, struct ifmap *map)
        for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
                if (s[i].name[0] == '\0' || s[i].name[0] == ' ') {
                        memset(s[i].name, 0, sizeof(s[i].name));
-                        strcpy(s[i].name, name);
+                        strlcpy(s[i].name, name, IFNAMSIZ);
                        memcpy(&s[i].map, map, sizeof(s[i].map));
                        break;
                }
@@ -479,7 +479,7 @@ int netdev_boot_setup_check(struct net_device *dev)
        for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
                if (s[i].name[0] != '\0' && s[i].name[0] != ' ' &&
-                    !strncmp(dev->name, s[i].name, strlen(s[i].name))) {
+                    !strcmp(dev->name, s[i].name)) {
                        dev->irq        = s[i].map.irq;
                        dev->base_addr  = s[i].map.base_addr;
                        dev->mem_start  = s[i].map.mem_start;
@@ -2973,7 +2973,7 @@ EXPORT_SYMBOL(dev_unicast_delete);
 /**
 *      dev_unicast_add         - add a secondary unicast address
 *      @dev: device
- *      @addr: address to delete
+ *      @addr: address to add
 *      @alen: length of @addr
 *
 *      Add a secondary unicast address to the device or increase
@@ -4585,8 +4585,8 @@ static int __init net_dev_init(void)
        dev_boot_phase = 0;
-        open_softirq(NET_TX_SOFTIRQ, net_tx_action, NULL);
+        open_softirq(NET_TX_SOFTIRQ, net_tx_action);
-        open_softirq(NET_RX_SOFTIRQ, net_rx_action, NULL);
+        open_softirq(NET_RX_SOFTIRQ, net_rx_action);
        hotcpu_notifier(dev_cpu_callback, 0);
        dst_init();
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index e3e9ab0f74e3..277a2302eb3a 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -226,7 +226,7 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        ops = lookup_rules_ops(net, frh->family);
        if (ops == NULL) {
-                err = EAFNOSUPPORT;
+                err = -EAFNOSUPPORT;
                goto errout;
        }
@@ -365,7 +365,7 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        ops = lookup_rules_ops(net, frh->family);
        if (ops == NULL) {
-                err = EAFNOSUPPORT;
+                err = -EAFNOSUPPORT;
                goto errout;
        }
diff --git a/net/core/filter.c b/net/core/filter.c
index 4f8369729a4e..df3744355839 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -68,7 +68,6 @@ static inline void *load_pointer(struct sk_buff *skb, int k,
 *      sk_filter - run a packet through a socket filter
 *      @sk: sock associated with &sk_buff
 *      @skb: buffer to filter
- *      @needlock: set to 1 if the sock is not locked by caller.
 *
 * Run the filter code and then cut skb->data to correct size returned by
 * sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
diff --git a/net/core/flow.c b/net/core/flow.c
index 19991175fdeb..5cf81052d044 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -298,7 +298,7 @@ void flow_cache_flush(void)
        init_completion(&info.completion);
        local_bh_disable();
-        smp_call_function(flow_cache_flush_per_cpu, &info, 1, 0);
+        smp_call_function(flow_cache_flush_per_cpu, &info, 0);
        flow_cache_flush_tasklet((unsigned long)&info);
        local_bh_enable();
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 1e556d312117..366621610e76 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1292,12 +1292,14 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
 {
        unsigned int nr_pages = spd->nr_pages;
        unsigned int poff, plen, len, toff, tlen;
-        int headlen, seg;
+        int headlen, seg, error = 0;
        toff = *offset;
        tlen = *total_len;
-        if (!tlen)
+        if (!tlen) {
+                error = 1;
                goto err;
+        }
        /*
         * if the offset is greater than the linear part, go directly to
@@ -1339,7 +1341,8 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
                 * just jump directly to update and return, no point
                 * in going over fragments when the output is full.
                 */
-                if (spd_fill_page(spd, virt_to_page(p), plen, poff, skb))
+                error = spd_fill_page(spd, virt_to_page(p), plen, poff, skb);
+                if (error)
                        goto done;
                tlen -= plen;
@@ -1369,7 +1372,8 @@ map_frag:
                if (!plen)
                        break;
-                if (spd_fill_page(spd, f->page, plen, poff, skb))
+                error = spd_fill_page(spd, f->page, plen, poff, skb);
+                if (error)
                        break;
                tlen -= plen;
@@ -1382,7 +1386,10 @@ done:
                return 0;
        }
 err:
-        return 1;
+        /* update the offset to reflect the linear part skip, if any */
+        if (!error)
+                *offset = toff;
+        return error;
 }
 /*
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 4b02d14e7ab9..e1600ad8fb0e 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1359,17 +1359,17 @@ static int check_leaf(struct trie *t, struct leaf *l,
                        t->stats.semantic_match_miss++;
 #endif
                if (err <= 0)
-                        return plen;
+                        return err;
        }
-        return -1;
+        return 1;
 }
 static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
                          struct fib_result *res)
 {
        struct trie *t = (struct trie *) tb->tb_data;
-        int plen, ret = 0;
+        int ret;
        struct node *n;
        struct tnode *pn;
        int pos, bits;
@@ -1393,10 +1393,7 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
        /* Just a leaf? */
        if (IS_LEAF(n)) {
-                plen = check_leaf(t, (struct leaf *)n, key, flp, res);
+                ret = check_leaf(t, (struct leaf *)n, key, flp, res);
-                if (plen < 0)
-                        goto failed;
-                ret = 0;
                goto found;
        }
@@ -1421,11 +1418,9 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
                }
                if (IS_LEAF(n)) {
-                        plen = check_leaf(t, (struct leaf *)n, key, flp, res);
+                        ret = check_leaf(t, (struct leaf *)n, key, flp, res);
-                        if (plen < 0)
+                        if (ret > 0)
                                goto backtrace;
-                        ret = 0;
                        goto found;
                }
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 4ed429bd5951..0546a0bc97ea 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -192,14 +192,21 @@ EXPORT_SYMBOL(inet_frag_evictor);
 static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
                struct inet_frag_queue *qp_in, struct inet_frags *f,
-                unsigned int hash, void *arg)
+                void *arg)
 {
        struct inet_frag_queue *qp;
 #ifdef CONFIG_SMP
        struct hlist_node *n;
 #endif
+        unsigned int hash;
        write_lock(&f->lock);
+        /*
+         * While we stayed w/o the lock other CPU could update
+         * the rnd seed, so we need to re-calculate the hash
+         * chain. Fortunatelly the qp_in can be used to get one.
+         */
+        hash = f->hashfn(qp_in);
 #ifdef CONFIG_SMP
        /* With SMP race we have to recheck hash table, because
         * such entry could be created on other cpu, while we
@@ -247,7 +254,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 }
 static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
-                struct inet_frags *f, void *arg, unsigned int hash)
+                struct inet_frags *f, void *arg)
 {
        struct inet_frag_queue *q;
@@ -255,7 +262,7 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
        if (q == NULL)
                return NULL;
-        return inet_frag_intern(nf, q, f, hash, arg);
+        return inet_frag_intern(nf, q, f, arg);
 }
 struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
@@ -264,7 +271,6 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
        struct inet_frag_queue *q;
        struct hlist_node *n;
-        read_lock(&f->lock);
        hlist_for_each_entry(q, n, &f->hash[hash], list) {
                if (q->net == nf && f->match(q, key)) {
                        atomic_inc(&q->refcnt);
@@ -274,6 +280,6 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
        }
        read_unlock(&f->lock);
-        return inet_frag_create(nf, f, key, hash);
+        return inet_frag_create(nf, f, key);
 }
 EXPORT_SYMBOL(inet_frag_find);
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 4a4d49fca1f2..cfd034a2b96e 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -383,8 +383,7 @@ static int __lro_proc_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
 out2: /* send aggregated SKBs to stack */
        lro_flush(lro_mgr, lro_desc);
-out:  /* Original SKB has to be posted to stack */
+out:
-        skb->ip_summed = lro_mgr->ip_summed;
        return 1;
 }
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index cd6ce6ac6358..37221f659159 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -229,6 +229,8 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user)
        arg.iph = iph;
        arg.user = user;
+        read_lock(&ip4_frags.lock);
        hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol);
        q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash);
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 7750c97fde7b..ffeaffc3fffe 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -439,8 +439,8 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
                                     unsigned int *len)
 {
        unsigned long subid;
-        unsigned int  size;
        unsigned long *optr;
+        size_t size;
        size = eoc - ctx->pointer + 1;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index fc54a48fde1e..1d723de18686 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -255,11 +255,14 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/skbuff.h>
+#include <linux/scatterlist.h>
 #include <linux/splice.h>
 #include <linux/net.h>
 #include <linux/socket.h>
 #include <linux/random.h>
 #include <linux/bootmem.h>
+#include <linux/highmem.h>
+#include <linux/swap.h>
 #include <linux/cache.h>
 #include <linux/err.h>
 #include <linux/crypto.h>
@@ -1206,7 +1209,8 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                return -ENOTCONN;
        while ((skb = tcp_recv_skb(sk, seq, &offset)) != NULL) {
                if (offset < skb->len) {
-                        size_t used, len;
+                        int used;
+                        size_t len;
                        len = skb->len - offset;
                        /* Stop reading if we hit a patch of urgent data */
@@ -2620,7 +2624,7 @@ __setup("thash_entries=", set_thash_entries);
 void __init tcp_init(void)
 {
        struct sk_buff *skb = NULL;
-        unsigned long limit;
+        unsigned long nr_pages, limit;
        int order, i, max_share;
        BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
@@ -2689,8 +2693,9 @@ void __init tcp_init(void)
         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
         * memory, with a floor of 128 pages.
         */
-        limit = min(nr_all_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
+        nr_pages = totalram_pages - totalhigh_pages;
-        limit = (limit * (nr_all_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
+        limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
        limit = max(limit, 128UL);
        sysctl_tcp_mem[0] = limit / 4 * 3;
        sysctl_tcp_mem[1] = limit;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 12695be2c255..ffe869ac1bcf 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2291,7 +2291,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
        }
        seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
-                        "%08X %5d %8d %lu %d %p %u %u %u %u %d%n",
+                        "%08X %5d %8d %lu %d %p %lu %lu %u %u %d%n",
                i, src, srcp, dest, destp, sk->sk_state,
                tp->write_seq - tp->snd_una,
                sk->sk_state == TCP_LISTEN ? sk->sk_ack_backlog :
@@ -2303,8 +2303,8 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                icsk->icsk_probes_out,
                sock_i_ino(sk),
                atomic_read(&sk->sk_refcnt), sk,
-                icsk->icsk_rto,
+                jiffies_to_clock_t(icsk->icsk_rto),
-                icsk->icsk_ack.ato,
+                jiffies_to_clock_t(icsk->icsk_ack.ato),
                (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
                tp->snd_cwnd,
                tp->snd_ssthresh >= 0xFFFF ? -1 : tp->snd_ssthresh,
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 5ff0ce6e9d39..7ddc30f0744f 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -224,7 +224,7 @@ static __init int tcpprobe_init(void)
        if (bufsize < 0)
                return -EINVAL;
-        tcp_probe.log = kcalloc(sizeof(struct tcp_log), bufsize, GFP_KERNEL);
+        tcp_probe.log = kcalloc(bufsize, sizeof(struct tcp_log), GFP_KERNEL);
        if (!tcp_probe.log)
                goto err0;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 147588f4c7c0..ff61a5cdb0b3 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -749,12 +749,12 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
        }
        write_unlock_bh(&idev->lock);
+        addrconf_del_timer(ifp);
        ipv6_ifa_notify(RTM_DELADDR, ifp);
        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifp);
-        addrconf_del_timer(ifp);
        /*
         * Purge or update corresponding prefix
         *
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 3cd1c993d52b..dcf94fdfb863 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -445,7 +445,7 @@ looped_back:
                        kfree_skb(skb);
                        return -1;
                }
-                if (!ipv6_chk_home_addr(&init_net, addr)) {
+                if (!ipv6_chk_home_addr(dev_net(skb->dst->dev), addr)) {
                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                         IPSTATS_MIB_INADDRERRORS);
                        kfree_skb(skb);
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 27a5e8b48d93..f405cea21a8b 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -129,7 +129,7 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
                .priority       = NF_IP6_PRI_MANGLE,
        },
        {
-                .hook           = ip6t_local_hook,
+                .hook           = ip6t_route_hook,
                .owner          = THIS_MODULE,
                .pf             = PF_INET6,
                .hooknum        = NF_INET_LOCAL_IN,
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index e65e26e210ee..cf20bc4fd60d 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -207,9 +207,10 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
        arg.id = id;
        arg.src = src;
        arg.dst = dst;
+        read_lock_bh(&nf_frags.lock);
        hash = ip6qhashfn(id, src, dst);
-        local_bh_disable();
        q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
        local_bh_enable();
        if (q == NULL)
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 798cabc7535b..a60d7d129713 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -247,6 +247,8 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
        arg.id = id;
        arg.src = src;
        arg.dst = dst;
+        read_lock(&ip6_frags.lock);
        hash = ip6qhashfn(id, src, dst);
        q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d1f3e19b06c7..7ff687020fa9 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -240,7 +240,7 @@ static inline int rt6_need_strict(struct in6_addr *daddr)
 static inline struct rt6_info *rt6_device_match(struct net *net,
                                                    struct rt6_info *rt,
                                                    int oif,
-                                                    int strict)
+                                                    int flags)
 {
        struct rt6_info *local = NULL;
        struct rt6_info *sprt;
@@ -253,7 +253,7 @@ static inline struct rt6_info *rt6_device_match(struct net *net,
                        if (dev->flags & IFF_LOOPBACK) {
                                if (sprt->rt6i_idev == NULL ||
                                    sprt->rt6i_idev->dev->ifindex != oif) {
-                                        if (strict && oif)
+                                        if (flags & RT6_LOOKUP_F_IFACE && oif)
                                                continue;
                                        if (local && (!oif ||
                                                      local->rt6i_idev->dev->ifindex == oif))
@@ -266,7 +266,7 @@ static inline struct rt6_info *rt6_device_match(struct net *net,
                if (local)
                        return local;
-                if (strict)
+                if (flags & RT6_LOOKUP_F_IFACE)
                        return net->ipv6.ip6_null_entry;
        }
        return rt;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index cb46749d4c32..40ea9c36d24b 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -2036,7 +2036,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u %d\n",
                   i,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2052,8 +2052,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                   icsk->icsk_probes_out,
                   sock_i_ino(sp),
                   atomic_read(&sp->sk_refcnt), sp,
-                   icsk->icsk_rto,
+                   jiffies_to_clock_t(icsk->icsk_rto),
-                   icsk->icsk_ack.ato,
+                   jiffies_to_clock_t(icsk->icsk_ack.ato),
                   (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
                   tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
                   );
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index b001c361ad30..bccf4d0059f0 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -241,6 +241,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/smp_lock.h>
 #include <linux/skbuff.h>
 #include <linux/tty.h>
 #include <linux/proc_fs.h>
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index e0eab5927c4f..e84a70dd346b 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -479,6 +479,7 @@ dev_irnet_open(struct inode *	inode,
  ap = kzalloc(sizeof(*ap), GFP_KERNEL);
  DABORT(ap == NULL, -ENOMEM, FS_ERROR, "Can't allocate struct irnet...\n");
+  lock_kernel();
  /* initialize the irnet structure */
  ap->file = file;
@@ -500,6 +501,7 @@ dev_irnet_open(struct inode *	inode,
    {
      DERROR(FS_ERROR, "Can't setup IrDA link...\n");
      kfree(ap);
+      unlock_kernel();
      return err;
    }
@@ -510,6 +512,7 @@ dev_irnet_open(struct inode *	inode,
  file->private_data = ap;
  DEXIT(FS_TRACE, " - ap=0x%p\n", ap);
+  unlock_kernel();
  return 0;
 }
diff --git a/net/irda/irnetlink.c b/net/irda/irnetlink.c
index 9e1fb82e3220..2f05ec1037ab 100644
--- a/net/irda/irnetlink.c
+++ b/net/irda/irnetlink.c
@@ -101,8 +101,8 @@ static int irda_nl_get_mode(struct sk_buff *skb, struct genl_info *info)
        hdr = genlmsg_put(msg, info->snd_pid, info->snd_seq,
                          &irda_nl_family, 0,  IRDA_NL_CMD_GET_MODE);
-        if (IS_ERR(hdr)) {
+        if (hdr == NULL) {
-                ret = PTR_ERR(hdr);
+                ret = -EMSGSIZE;
                goto err_out;
        }
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 7b0038f45b16..bda71015885c 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1135,8 +1135,7 @@ static void iucv_callback_txdone(struct iucv_path *path,
                if (this)
                        kfree_skb(this);
        }
-        if (!this)
+        BUG_ON(!this);
-                printk(KERN_ERR "AF_IUCV msg tag %u not found\n", msg->tag);
        if (sk->sk_state == IUCV_CLOSING) {
                if (skb_queue_empty(&iucv_sk(sk)->send_skb_q)) {
@@ -1196,7 +1195,7 @@ static int __init afiucv_init(void)
        }
        cpcmd("QUERY USERID", iucv_userid, sizeof(iucv_userid), &err);
        if (unlikely(err)) {
-                printk(KERN_ERR "AF_IUCV needs the VM userid\n");
+                WARN_ON(err);
                err = -EPROTONOSUPPORT;
                goto out;
        }
@@ -1210,7 +1209,6 @@ static int __init afiucv_init(void)
        err = sock_register(&iucv_sock_family_ops);
        if (err)
                goto out_proto;
-        printk(KERN_INFO "AF_IUCV lowlevel driver initialized\n");
        return 0;
 out_proto:
@@ -1226,8 +1224,6 @@ static void __exit afiucv_exit(void)
        sock_unregister(PF_IUCV);
        proto_unregister(&iucv_proto);
        iucv_unregister(&af_iucv_handler, 0);
-        printk(KERN_INFO "AF_IUCV lowlevel driver unloaded\n");
 }
 module_init(afiucv_init);
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 918970762131..cc34ac769a3c 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -480,7 +480,7 @@ static void iucv_setmask_mp(void)
                if (cpu_isset(cpu, iucv_buffer_cpumask) &&
                    !cpu_isset(cpu, iucv_irq_cpumask))
                        smp_call_function_single(cpu, iucv_allow_cpu,
-                                                 NULL, 0, 1);
+                                                 NULL, 1);
        preempt_enable();
 }
@@ -498,7 +498,7 @@ static void iucv_setmask_up(void)
        cpumask = iucv_irq_cpumask;
        cpu_clear(first_cpu(iucv_irq_cpumask), cpumask);
        for_each_cpu_mask(cpu, cpumask)
-                smp_call_function_single(cpu, iucv_block_cpu, NULL, 0, 1);
+                smp_call_function_single(cpu, iucv_block_cpu, NULL, 1);
 }
 /**
@@ -523,7 +523,7 @@ static int iucv_enable(void)
        rc = -EIO;
        preempt_disable();
        for_each_online_cpu(cpu)
-                smp_call_function_single(cpu, iucv_declare_cpu, NULL, 0, 1);
+                smp_call_function_single(cpu, iucv_declare_cpu, NULL, 1);
        preempt_enable();
        if (cpus_empty(iucv_buffer_cpumask))
                /* No cpu could declare an iucv buffer. */
@@ -545,7 +545,7 @@ out:
 */
 static void iucv_disable(void)
 {
-        on_each_cpu(iucv_retrieve_cpu, NULL, 0, 1);
+        on_each_cpu(iucv_retrieve_cpu, NULL, 1);
        kfree(iucv_path_table);
 }
@@ -580,7 +580,7 @@ static int __cpuinit iucv_cpu_notify(struct notifier_block *self,
        case CPU_ONLINE_FROZEN:
        case CPU_DOWN_FAILED:
        case CPU_DOWN_FAILED_FROZEN:
-                smp_call_function_single(cpu, iucv_declare_cpu, NULL, 0, 1);
+                smp_call_function_single(cpu, iucv_declare_cpu, NULL, 1);
                break;
        case CPU_DOWN_PREPARE:
        case CPU_DOWN_PREPARE_FROZEN:
@@ -589,10 +589,10 @@ static int __cpuinit iucv_cpu_notify(struct notifier_block *self,
                if (cpus_empty(cpumask))
                        /* Can't offline last IUCV enabled cpu. */
                        return NOTIFY_BAD;
-                smp_call_function_single(cpu, iucv_retrieve_cpu, NULL, 0, 1);
+                smp_call_function_single(cpu, iucv_retrieve_cpu, NULL, 1);
                if (cpus_empty(iucv_irq_cpumask))
                        smp_call_function_single(first_cpu(iucv_buffer_cpumask),
-                                                 iucv_allow_cpu, NULL, 0, 1);
+                                                 iucv_allow_cpu, NULL, 1);
                break;
        }
        return NOTIFY_OK;
@@ -652,7 +652,7 @@ static void iucv_cleanup_queue(void)
         * pending interrupts force them to the work queue by calling
         * an empty function on all cpus.
         */
-        smp_call_function(__iucv_cleanup_queue, NULL, 0, 1);
+        smp_call_function(__iucv_cleanup_queue, NULL, 1);
        spin_lock_irq(&iucv_queue_lock);
        list_for_each_entry_safe(p, n, &iucv_task_queue, list) {
                /* Remove stale work items from the task queue. */
@@ -1559,16 +1559,11 @@ static void iucv_external_interrupt(u16 code)
        p = iucv_irq_data[smp_processor_id()];
        if (p->ippathid >= iucv_max_pathid) {
-                printk(KERN_WARNING "iucv_do_int: Got interrupt with "
+                WARN_ON(p->ippathid >= iucv_max_pathid);
-                       "pathid %d > max_connections (%ld)\n",
-                       p->ippathid, iucv_max_pathid - 1);
                iucv_sever_pathid(p->ippathid, iucv_error_no_listener);
                return;
        }
-        if (p->iptype  < 0x01 || p->iptype > 0x09) {
+        BUG_ON(p->iptype  < 0x01 || p->iptype > 0x09);
-                printk(KERN_ERR "iucv_do_int: unknown iucv interrupt\n");
-                return;
-        }
        work = kmalloc(sizeof(struct iucv_irq_list), GFP_ATOMIC);
        if (!work) {
                printk(KERN_WARNING "iucv_external_interrupt: out of memory\n");
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 150d66dbda9d..220e83be3ef4 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -380,6 +380,15 @@ void ieee80211_key_free(struct ieee80211_key *key)
        if (!key)
                return;
+        if (!key->sdata) {
+                /* The key has not been linked yet, simply free it
+                 * and don't Oops */
+                if (key->conf.alg == ALG_CCMP)
+                        ieee80211_aes_key_free(key->u.ccmp.tfm);
+                kfree(key);
+                return;
+        }
        spin_lock_irqsave(&key->sdata->local->key_lock, flags);
        __ieee80211_key_free(key);
        spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 98c0b5e56ecc..df0836ff1a20 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -530,8 +530,6 @@ static int ieee80211_stop(struct net_device *dev)
                                local->sta_hw_scanning = 0;
                }
-                flush_workqueue(local->hw.workqueue);
                sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
                kfree(sdata->u.sta.extra_ie);
                sdata->u.sta.extra_ie = NULL;
@@ -555,6 +553,8 @@ static int ieee80211_stop(struct net_device *dev)
                ieee80211_led_radio(local, 0);
+                flush_workqueue(local->hw.workqueue);
                tasklet_disable(&local->tx_pending_tasklet);
                tasklet_disable(&local->tasklet);
        }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 4d2b582dd055..b404537c0bcd 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -547,15 +547,14 @@ static void ieee80211_set_associated(struct net_device *dev,
                        sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
                }
-                netif_carrier_on(dev);
                ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
                memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
                memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
                ieee80211_sta_send_associnfo(dev, ifsta);
        } else {
+                netif_carrier_off(dev);
                ieee80211_sta_tear_down_BA_sessions(dev, ifsta->bssid);
                ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
-                netif_carrier_off(dev);
                ieee80211_reset_erp_info(dev);
                sdata->bss_conf.assoc_ht = 0;
@@ -569,6 +568,10 @@ static void ieee80211_set_associated(struct net_device *dev,
        sdata->bss_conf.assoc = assoc;
        ieee80211_bss_info_change_notify(sdata, changed);
+        if (assoc)
+                netif_carrier_on(dev);
        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 }
@@ -3611,8 +3614,10 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
        spin_unlock_bh(&local->sta_bss_lock);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
+        if (found)
-               "%s\n", print_mac(mac, bssid), print_mac(mac2, ifsta->bssid));
+                printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
+                       "%s\n", print_mac(mac, bssid),
+                       print_mac(mac2, ifsta->bssid));
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
        if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
            (bss = ieee80211_rx_bss_get(dev, bssid,
diff --git a/net/mac80211/rc80211_pid.h b/net/mac80211/rc80211_pid.h
index 04afc13ed825..4ea7b97d1af1 100644
--- a/net/mac80211/rc80211_pid.h
+++ b/net/mac80211/rc80211_pid.h
@@ -141,7 +141,6 @@ struct rc_pid_events_file_info {
 *      rate behaviour values (lower means we should trust more what we learnt
 *      about behaviour of rates, higher means we should trust more the natural
 *      ordering of rates)
- * @fast_start: if Y, push high rates right after initialization
 */
 struct rc_pid_debugfs_entries {
        struct dentry *dir;
@@ -154,7 +153,6 @@ struct rc_pid_debugfs_entries {
        struct dentry *sharpen_factor;
        struct dentry *sharpen_duration;
        struct dentry *norm_offset;
-        struct dentry *fast_start;
 };
 void rate_control_pid_event_tx_status(struct rc_pid_event_buffer *buf,
@@ -267,9 +265,6 @@ struct rc_pid_info {
        /* Normalization offset. */
        unsigned int norm_offset;
-        /* Fast starst parameter. */
-        unsigned int fast_start;
        /* Rates information. */
        struct rc_pid_rateinfo *rinfo;
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index a849b745bdb5..bcd27c1d7594 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -398,13 +398,25 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
                return NULL;
        }
+        pinfo->target = RC_PID_TARGET_PF;
+        pinfo->sampling_period = RC_PID_INTERVAL;
+        pinfo->coeff_p = RC_PID_COEFF_P;
+        pinfo->coeff_i = RC_PID_COEFF_I;
+        pinfo->coeff_d = RC_PID_COEFF_D;
+        pinfo->smoothing_shift = RC_PID_SMOOTHING_SHIFT;
+        pinfo->sharpen_factor = RC_PID_SHARPENING_FACTOR;
+        pinfo->sharpen_duration = RC_PID_SHARPENING_DURATION;
+        pinfo->norm_offset = RC_PID_NORM_OFFSET;
+        pinfo->rinfo = rinfo;
+        pinfo->oldrate = 0;
        /* Sort the rates. This is optimized for the most common case (i.e.
         * almost-sorted CCK+OFDM rates). Kind of bubble-sort with reversed
         * mapping too. */
        for (i = 0; i < sband->n_bitrates; i++) {
                rinfo[i].index = i;
                rinfo[i].rev_index = i;
-                if (pinfo->fast_start)
+                if (RC_PID_FAST_START)
                        rinfo[i].diff = 0;
                else
                        rinfo[i].diff = i * pinfo->norm_offset;
@@ -425,19 +437,6 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
                        break;
        }
-        pinfo->target = RC_PID_TARGET_PF;
-        pinfo->sampling_period = RC_PID_INTERVAL;
-        pinfo->coeff_p = RC_PID_COEFF_P;
-        pinfo->coeff_i = RC_PID_COEFF_I;
-        pinfo->coeff_d = RC_PID_COEFF_D;
-        pinfo->smoothing_shift = RC_PID_SMOOTHING_SHIFT;
-        pinfo->sharpen_factor = RC_PID_SHARPENING_FACTOR;
-        pinfo->sharpen_duration = RC_PID_SHARPENING_DURATION;
-        pinfo->norm_offset = RC_PID_NORM_OFFSET;
-        pinfo->fast_start = RC_PID_FAST_START;
-        pinfo->rinfo = rinfo;
-        pinfo->oldrate = 0;
 #ifdef CONFIG_MAC80211_DEBUGFS
        de = &pinfo->dentries;
        de->dir = debugfs_create_dir("rc80211_pid",
@@ -465,9 +464,6 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
        de->norm_offset = debugfs_create_u32("norm_offset",
                                             S_IRUSR | S_IWUSR, de->dir,
                                             &pinfo->norm_offset);
-        de->fast_start = debugfs_create_bool("fast_start",
-                                             S_IRUSR | S_IWUSR, de->dir,
-                                             &pinfo->fast_start);
 #endif
        return pinfo;
@@ -479,7 +475,6 @@ static void rate_control_pid_free(void *priv)
 #ifdef CONFIG_MAC80211_DEBUGFS
        struct rc_pid_debugfs_entries *de = &pinfo->dentries;
-        debugfs_remove(de->fast_start);
        debugfs_remove(de->norm_offset);
        debugfs_remove(de->sharpen_duration);
        debugfs_remove(de->sharpen_factor);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 6106cb79060c..e8404212ad57 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -95,6 +95,13 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
                        }
                }
+                if (alg == ALG_WEP &&
+                        key_len != LEN_WEP40 && key_len != LEN_WEP104) {
+                        ieee80211_key_free(key);
+                        err = -EINVAL;
+                        goto out_unlock;
+                }
                ieee80211_key_link(key, sdata, sta);
                if (set_tx_key || (!sta && !sdata->default_key && key))
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 635b996c8c35..5d09e8698b57 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -323,8 +323,7 @@ static void wme_qdiscop_destroy(struct Qdisc* qd)
        struct ieee80211_hw *hw = &local->hw;
        int queue;
-        tcf_destroy_chain(q->filter_list);
+        tcf_destroy_chain(&q->filter_list);
-        q->filter_list = NULL;
        for (queue=0; queue < hw->queues; queue++) {
                skb_queue_purge(&q->requeued[queue]);
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 7d1b11703741..8e0b4c8f62a8 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -20,6 +20,7 @@
 #include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/rculist.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 0edefcfc5949..077bcd228799 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -18,6 +18,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/rculist.h>
 #include <linux/types.h>
 #include <linux/timer.h>
 #include <linux/skbuff.h>
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index ba94004fe323..dd28fb239a60 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -331,12 +331,13 @@ static unsigned int get_conntrack_index(const struct tcphdr *tcph)
   I.   Upper bound for valid data:     seq <= sender.td_maxend
   II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
-   III. Upper bound for valid ack:      sack <= receiver.td_end
+   III. Upper bound for valid (s)ack:   sack <= receiver.td_end
-   IV.  Lower bound for valid ack:      ack >= receiver.td_end - MAXACKWINDOW
+   IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
-   where sack is the highest right edge of sack block found in the packet.
+   where sack is the highest right edge of sack block found in the packet
+   or ack in the case of packet without SACK option.
-   The upper bound limit for a valid ack is not ignored -
+   The upper bound limit for a valid (s)ack is not ignored -
   we doesn't have to deal with fragments.
 */
@@ -606,12 +607,12 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 before(seq, sender->td_maxend + 1),
                 after(end, sender->td_end - receiver->td_maxwin - 1),
                 before(sack, receiver->td_end + 1),
-                 after(ack, receiver->td_end - MAXACKWINDOW(sender)));
+                 after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
        if (before(seq, sender->td_maxend + 1) &&
            after(end, sender->td_end - receiver->td_maxwin - 1) &&
            before(sack, receiver->td_end + 1) &&
-            after(ack, receiver->td_end - MAXACKWINDOW(sender))) {
+            after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
                /*
                 * Take into account window scaling (RFC 1323).
                 */
@@ -843,9 +844,15 @@ static int tcp_packet(struct nf_conn *ct,
                        /* Attempt to reopen a closed/aborted connection.
                         * Delete this connection and look up again. */
                        write_unlock_bh(&tcp_lock);
-                        if (del_timer(&ct->timeout))
+                        /* Only repeat if we can actually remove the timer.
+                         * Destruction may already be in progress in process
+                         * context and we must give it a chance to terminate.
+                         */
+                        if (del_timer(&ct->timeout)) {
                                ct->timeout.function((unsigned long)ct);
-                        return -NF_REPEAT;
+                                return -NF_REPEAT;
+                        }
+                        return -NF_DROP;
                }
                /* Fall through */
        case TCP_CONNTRACK_IGNORE:
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index fdc14a0d21af..9080c61b71a5 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -584,12 +584,7 @@ list_start:
        rcu_read_unlock();
        genlmsg_end(ans_skb, data);
+        return genlmsg_reply(ans_skb, info);
-        ret_val = genlmsg_reply(ans_skb, info);
-        if (ret_val != 0)
-                goto list_failure;
-        return 0;
 list_retry:
        /* XXX - this limit is a guesstimate */
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index 02c2f7c0b255..643c032a3a57 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -30,8 +30,7 @@
 */
 #include <linux/types.h>
-#include <linux/rcupdate.h>
+#include <linux/rculist.h>
-#include <linux/list.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 22c191267808..44be5d5261f4 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -386,11 +386,7 @@ static int netlbl_mgmt_listdef(struct sk_buff *skb, struct genl_info *info)
        rcu_read_unlock();
        genlmsg_end(ans_skb, data);
+        return genlmsg_reply(ans_skb, info);
-        ret_val = genlmsg_reply(ans_skb, info);
-        if (ret_val != 0)
-                goto listdef_failure;
-        return 0;
 listdef_failure_lock:
        rcu_read_unlock();
@@ -501,11 +497,7 @@ static int netlbl_mgmt_version(struct sk_buff *skb, struct genl_info *info)
                goto version_failure;
        genlmsg_end(ans_skb, data);
+        return genlmsg_reply(ans_skb, info);
-        ret_val = genlmsg_reply(ans_skb, info);
-        if (ret_val != 0)
-                goto version_failure;
-        return 0;
 version_failure:
        kfree_skb(ans_skb);
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 0099da5b2591..56f80872924e 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1107,11 +1107,7 @@ static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
                goto list_failure;
        genlmsg_end(ans_skb, data);
+        return genlmsg_reply(ans_skb, info);
-        ret_val = genlmsg_reply(ans_skb, info);
-        if (ret_val != 0)
-                goto list_failure;
-        return 0;
 list_failure:
        kfree_skb(ans_skb);
@@ -1534,7 +1530,7 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
                }
        }
        list_for_each_entry_rcu(addr6, &iface->addr6_list, list) {
-                if (addr6->valid || iter_addr6++ < skip_addr6)
+                if (!addr6->valid || iter_addr6++ < skip_addr6)
                        continue;
                if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
                                           iface,
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 9b97f8006c9c..349aba189558 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -886,7 +886,7 @@ retry:
                return netlink_unicast_kernel(sk, skb);
        if (sk_filter(sk, skb)) {
-                int err = skb->len;
+                err = skb->len;
                kfree_skb(skb);
                sock_put(sk);
                return err;
diff --git a/net/netlink/attr.c b/net/netlink/attr.c
index 47bbf45ae5d7..2d106cfe1d27 100644
--- a/net/netlink/attr.c
+++ b/net/netlink/attr.c
@@ -132,6 +132,7 @@ errout:
 * @maxtype: maximum attribute type to be expected
 * @head: head of attribute stream
 * @len: length of attribute stream
+ * @policy: validation policy
 *
 * Parses a stream of attributes and stores a pointer to each attribute in
 * the tb array accessable via the attribute type. Attributes with a type
@@ -194,7 +195,7 @@ struct nlattr *nla_find(struct nlattr *head, int len, int attrtype)
 /**
 * nla_strlcpy - Copy string attribute payload into a sized buffer
 * @dst: where to copy the string to
- * @src: attribute to copy the string from
+ * @nla: attribute to copy the string from
 * @dstsize: size of destination buffer
 *
 * Copies at most dstsize - 1 bytes into the destination buffer.
@@ -340,9 +341,9 @@ struct nlattr *nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
 }
 /**
- * nla_reserve - reserve room for attribute without header
+ * nla_reserve_nohdr - reserve room for attribute without header
 * @skb: socket buffer to reserve room on
- * @len: length of attribute payload
+ * @attrlen: length of attribute payload
 *
 * Reserves room for attribute payload without a header.
 *
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 82adfe6447d7..9437b27ff84d 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -106,17 +106,6 @@ config NET_SCH_PRIO
          To compile this code as a module, choose M here: the
          module will be called sch_prio.
-config NET_SCH_RR
-        tristate "Multi Band Round Robin Queuing (RR)"
-        select NET_SCH_PRIO
-        ---help---
-          Say Y here if you want to use an n-band round robin packet
-          scheduler.
-          The module uses sch_prio for its framework and is aliased as
-          sch_rr, so it will load sch_prio, although it is referred
-          to using sch_rr.
 config NET_SCH_RED
        tristate "Random Early Detection (RED)"
        ---help---
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index c40773cdbe45..10f01ad04380 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1252,12 +1252,12 @@ void tcf_destroy(struct tcf_proto *tp)
        kfree(tp);
 }
-void tcf_destroy_chain(struct tcf_proto *fl)
+void tcf_destroy_chain(struct tcf_proto **fl)
 {
        struct tcf_proto *tp;
-        while ((tp = fl) != NULL) {
+        while ((tp = *fl) != NULL) {
-                fl = tp->next;
+                *fl = tp->next;
                tcf_destroy(tp);
        }
 }
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 335273416384..db0e23ae85f8 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -160,7 +160,7 @@ static void atm_tc_put(struct Qdisc *sch, unsigned long cl)
        *prev = flow->next;
        pr_debug("atm_tc_put: qdisc %p\n", flow->q);
        qdisc_destroy(flow->q);
-        tcf_destroy_chain(flow->filter_list);
+        tcf_destroy_chain(&flow->filter_list);
        if (flow->sock) {
                pr_debug("atm_tc_put: f_count %d\n",
                        file_count(flow->sock->file));
@@ -586,10 +586,11 @@ static void atm_tc_destroy(struct Qdisc *sch)
        struct atm_flow_data *flow;
        pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
+        for (flow = p->flows; flow; flow = flow->next)
+                tcf_destroy_chain(&flow->filter_list);
        /* races ? */
        while ((flow = p->flows)) {
-                tcf_destroy_chain(flow->filter_list);
-                flow->filter_list = NULL;
                if (flow->ref > 1)
                        printk(KERN_ERR "atm_destroy: %p->ref = %d\n", flow,
                               flow->ref);
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 09969c1fbc08..2a3c97f7dc63 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1704,7 +1704,7 @@ static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
        BUG_TRAP(!cl->filters);
-        tcf_destroy_chain(cl->filter_list);
+        tcf_destroy_chain(&cl->filter_list);
        qdisc_destroy(cl->q);
        qdisc_put_rtab(cl->R_tab);
        gen_kill_estimator(&cl->bstats, &cl->rate_est);
@@ -1728,10 +1728,8 @@ cbq_destroy(struct Qdisc* sch)
         * be bound to classes which have been destroyed already. --TGR '04
         */
        for (h = 0; h < 16; h++) {
-                for (cl = q->classes[h]; cl; cl = cl->next) {
+                for (cl = q->classes[h]; cl; cl = cl->next)
-                        tcf_destroy_chain(cl->filter_list);
+                        tcf_destroy_chain(&cl->filter_list);
-                        cl->filter_list = NULL;
-                }
        }
        for (h = 0; h < 16; h++) {
                struct cbq_class *next;
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 64465bacbe79..c4c1317cd47d 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -416,7 +416,7 @@ static void dsmark_destroy(struct Qdisc *sch)
        pr_debug("dsmark_destroy(sch %p,[qdisc %p])\n", sch, p);
-        tcf_destroy_chain(p->filter_list);
+        tcf_destroy_chain(&p->filter_list);
        qdisc_destroy(p->q);
        kfree(p->mask);
 }
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index d355e5e47fe3..13afa7214392 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -468,7 +468,7 @@ struct Qdisc *qdisc_alloc(struct net_device *dev, struct Qdisc_ops *ops)
        return sch;
 errout:
-        return ERR_PTR(-err);
+        return ERR_PTR(err);
 }
 struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops,
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index fdfaa3fcc16d..e817aa00441d 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1123,7 +1123,7 @@ hfsc_destroy_class(struct Qdisc *sch, struct hfsc_class *cl)
 {
        struct hfsc_sched *q = qdisc_priv(sch);
-        tcf_destroy_chain(cl->filter_list);
+        tcf_destroy_chain(&cl->filter_list);
        qdisc_destroy(cl->qdisc);
        gen_kill_estimator(&cl->bstats, &cl->rate_est);
        if (cl != &q->root)
@@ -1541,6 +1541,10 @@ hfsc_destroy_qdisc(struct Qdisc *sch)
        unsigned int i;
        for (i = 0; i < HFSC_HSIZE; i++) {
+                list_for_each_entry(cl, &q->clhash[i], hlist)
+                        tcf_destroy_chain(&cl->filter_list);
+        }
+        for (i = 0; i < HFSC_HSIZE; i++) {
                list_for_each_entry_safe(cl, next, &q->clhash[i], hlist)
                        hfsc_destroy_class(sch, cl);
        }
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 6807c97985a5..3fb58f428f72 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1238,7 +1238,7 @@ static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
        qdisc_put_rtab(cl->rate);
        qdisc_put_rtab(cl->ceil);
-        tcf_destroy_chain(cl->filter_list);
+        tcf_destroy_chain(&cl->filter_list);
        while (!list_empty(&cl->children))
                htb_destroy_class(sch, list_entry(cl->children.next,
@@ -1267,7 +1267,7 @@ static void htb_destroy(struct Qdisc *sch)
           and surprisingly it worked in 2.4. But it must precede it
           because filter need its target class alive to be able to call
           unbind_filter on it (without Oops). */
-        tcf_destroy_chain(q->filter_list);
+        tcf_destroy_chain(&q->filter_list);
        while (!list_empty(&q->root))
                htb_destroy_class(sch, list_entry(q->root.next,
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 274b1ddb160c..956c80ad5965 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -104,7 +104,7 @@ static void ingress_destroy(struct Qdisc *sch)
 {
        struct ingress_qdisc_data *p = qdisc_priv(sch);
-        tcf_destroy_chain(p->filter_list);
+        tcf_destroy_chain(&p->filter_list);
 }
 static int ingress_dump(struct Qdisc *sch, struct sk_buff *skb)
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 4aa2b45dad0a..5532f1031ab5 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -219,7 +219,7 @@ prio_destroy(struct Qdisc* sch)
        int prio;
        struct prio_sched_data *q = qdisc_priv(sch);
-        tcf_destroy_chain(q->filter_list);
+        tcf_destroy_chain(&q->filter_list);
        for (prio=0; prio<q->bands; prio++)
                qdisc_destroy(q->queues[prio]);
 }
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index f0463d757a98..6a97afbfb952 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -520,7 +520,7 @@ static void sfq_destroy(struct Qdisc *sch)
 {
        struct sfq_sched_data *q = qdisc_priv(sch);
-        tcf_destroy_chain(q->filter_list);
+        tcf_destroy_chain(&q->filter_list);
        q->perturb_period = 0;
        del_timer_sync(&q->perturb_timer);
 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 0c9d5a6950fe..fcdb45d1071b 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -5899,12 +5899,6 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                return SCTP_IERROR_NO_DATA;
        }
-        /* If definately accepting the DATA chunk, record its TSN, otherwise
-         * wait for renege processing.
-         */
-        if (SCTP_CMD_CHUNK_ULP == deliver)
-                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
        chunk->data_accepted = 1;
        /* Note: Some chunks may get overcounted (if we drop) or overcounted
@@ -5924,6 +5918,9 @@ static int sctp_eat_data(const struct sctp_association *asoc,
         * and discard the DATA chunk.
         */
        if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {
+                /* Mark tsn as received even though we drop it */
+                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
                err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
                                         &data_hdr->stream,
                                         sizeof(data_hdr->stream));
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index ce6cda6b6994..a1f654aea268 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -710,6 +710,11 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
        if (!skb)
                goto fail;
+        /* Now that all memory allocations for this chunk succeeded, we
+         * can mark it as received so the tsn_map is updated correctly.
+         */
+        sctp_tsnmap_mark(&asoc->peer.tsn_map, ntohl(chunk->subh.data_hdr->tsn));
        /* First calculate the padding, so we don't inadvertently
         * pass up the wrong length to the user.
         *
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index cc12d5f5d5da..834a83199bdf 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -63,22 +63,11 @@ static const struct rpc_credops gss_nullops;
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
-#define NFS_NGROUPS     16
+#define GSS_CRED_SLACK          1024
-#define GSS_CRED_SLACK          1024            /* XXX: unused */
 /* length of a krb5 verifier (48), plus data added before arguments when
 * using integrity (two 4-byte integers): */
 #define GSS_VERF_SLACK          100
-/* XXX this define must match the gssd define
-* as it is passed to gssd to signal the use of
-* machine creds should be part of the shared rpc interface */
-#define CA_RUN_AS_MACHINE  0x00000200
-/* dump the buffer in `emacs-hexl' style */
-#define isprint(c)      ((c > 0x1f) && (c < 0x7f))
 struct gss_auth {
        struct kref kref;
        struct rpc_auth rpc_auth;
@@ -146,7 +135,7 @@ simple_get_netobj(const void *p, const void *end, struct xdr_netobj *dest)
        q = (const void *)((const char *)p + len);
        if (unlikely(q > end || q < p))
                return ERR_PTR(-EFAULT);
-        dest->data = kmemdup(p, len, GFP_KERNEL);
+        dest->data = kmemdup(p, len, GFP_NOFS);
        if (unlikely(dest->data == NULL))
                return ERR_PTR(-ENOMEM);
        dest->len = len;
@@ -171,7 +160,7 @@ gss_alloc_context(void)
 {
        struct gss_cl_ctx *ctx;
-        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+        ctx = kzalloc(sizeof(*ctx), GFP_NOFS);
        if (ctx != NULL) {
                ctx->gc_proc = RPC_GSS_PROC_DATA;
                ctx->gc_seq = 1;        /* NetApp 6.4R1 doesn't accept seq. no. 0 */
@@ -272,7 +261,7 @@ __gss_find_upcall(struct rpc_inode *rpci, uid_t uid)
        return NULL;
 }
-/* Try to add a upcall to the pipefs queue.
+/* Try to add an upcall to the pipefs queue.
 * If an upcall owned by our uid already exists, then we return a reference
 * to that upcall instead of adding the new upcall.
 */
@@ -341,7 +330,7 @@ gss_alloc_msg(struct gss_auth *gss_auth, uid_t uid)
 {
        struct gss_upcall_msg *gss_msg;
-        gss_msg = kzalloc(sizeof(*gss_msg), GFP_KERNEL);
+        gss_msg = kzalloc(sizeof(*gss_msg), GFP_NOFS);
        if (gss_msg != NULL) {
                INIT_LIST_HEAD(&gss_msg->list);
                rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
@@ -493,7 +482,6 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 {
        const void *p, *end;
        void *buf;
-        struct rpc_clnt *clnt;
        struct gss_upcall_msg *gss_msg;
        struct inode *inode = filp->f_path.dentry->d_inode;
        struct gss_cl_ctx *ctx;
@@ -503,11 +491,10 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
        if (mlen > MSG_BUF_MAXSIZE)
                goto out;
        err = -ENOMEM;
-        buf = kmalloc(mlen, GFP_KERNEL);
+        buf = kmalloc(mlen, GFP_NOFS);
        if (!buf)
                goto out;
-        clnt = RPC_I(inode)->private;
        err = -EFAULT;
        if (copy_from_user(buf, src, mlen))
                goto err;
@@ -806,7 +793,7 @@ gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
        dprintk("RPC:       gss_create_cred for uid %d, flavor %d\n",
                acred->uid, auth->au_flavor);
-        if (!(cred = kzalloc(sizeof(*cred), GFP_KERNEL)))
+        if (!(cred = kzalloc(sizeof(*cred), GFP_NOFS)))
                goto out_err;
        rpcauth_init_cred(&cred->gc_base, acred, auth, &gss_credops);
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 60c3dba545d7..ef45eba22485 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -70,7 +70,7 @@ simple_get_netobj(const void *p, const void *end, struct xdr_netobj *res)
        q = (const void *)((const char *)p + len);
        if (unlikely(q > end || q < p))
                return ERR_PTR(-EFAULT);
-        res->data = kmemdup(p, len, GFP_KERNEL);
+        res->data = kmemdup(p, len, GFP_NOFS);
        if (unlikely(res->data == NULL))
                return ERR_PTR(-ENOMEM);
        res->len = len;
@@ -131,7 +131,7 @@ gss_import_sec_context_kerberos(const void *p,
        struct  krb5_ctx *ctx;
        int tmp;
-        if (!(ctx = kzalloc(sizeof(*ctx), GFP_KERNEL)))
+        if (!(ctx = kzalloc(sizeof(*ctx), GFP_NOFS)))
                goto out_err;
        p = simple_get_bytes(p, end, &ctx->initiate, sizeof(ctx->initiate));
diff --git a/net/sunrpc/auth_gss/gss_spkm3_mech.c b/net/sunrpc/auth_gss/gss_spkm3_mech.c
index 5deb4b6e4514..035e1dd6af1b 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_mech.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_mech.c
@@ -76,7 +76,7 @@ simple_get_netobj(const void *p, const void *end, struct xdr_netobj *res)
        q = (const void *)((const char *)p + len);
        if (unlikely(q > end || q < p))
                return ERR_PTR(-EFAULT);
-        res->data = kmemdup(p, len, GFP_KERNEL);
+        res->data = kmemdup(p, len, GFP_NOFS);
        if (unlikely(res->data == NULL))
                return ERR_PTR(-ENOMEM);
        return q;
@@ -90,7 +90,7 @@ gss_import_sec_context_spkm3(const void *p, size_t len,
        struct  spkm3_ctx *ctx;
        int     version;
-        if (!(ctx = kzalloc(sizeof(*ctx), GFP_KERNEL)))
+        if (!(ctx = kzalloc(sizeof(*ctx), GFP_NOFS)))
                goto out_err;
        p = simple_get_bytes(p, end, &version, sizeof(version));
diff --git a/net/sunrpc/auth_gss/gss_spkm3_token.c b/net/sunrpc/auth_gss/gss_spkm3_token.c
index 6cdd241ad267..3308157436d2 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_token.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_token.c
@@ -90,7 +90,7 @@ asn1_bitstring_len(struct xdr_netobj *in, int *enclen, int *zerobits)
 int
 decode_asn1_bitstring(struct xdr_netobj *out, char *in, int enclen, int explen)
 {
-        if (!(out->data = kzalloc(explen,GFP_KERNEL)))
+        if (!(out->data = kzalloc(explen,GFP_NOFS)))
                return 0;
        out->len = explen;
        memcpy(out->data, in, enclen);
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 5905d56737d6..81ae3d62a0cc 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1144,20 +1144,20 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
                case RPC_GSS_SVC_NONE:
                        break;
                case RPC_GSS_SVC_INTEGRITY:
+                        /* placeholders for length and seq. number: */
+                        svc_putnl(resv, 0);
+                        svc_putnl(resv, 0);
                        if (unwrap_integ_data(&rqstp->rq_arg,
                                        gc->gc_seq, rsci->mechctx))
                                goto garbage_args;
+                        break;
+                case RPC_GSS_SVC_PRIVACY:
                        /* placeholders for length and seq. number: */
                        svc_putnl(resv, 0);
                        svc_putnl(resv, 0);
-                        break;
-                case RPC_GSS_SVC_PRIVACY:
                        if (unwrap_priv_data(rqstp, &rqstp->rq_arg,
                                        gc->gc_seq, rsci->mechctx))
                                goto garbage_args;
-                        /* placeholders for length and seq. number: */
-                        svc_putnl(resv, 0);
-                        svc_putnl(resv, 0);
                        break;
                default:
                        goto auth_err;
@@ -1170,8 +1170,6 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
                goto out;
        }
 garbage_args:
-        /* Restore write pointer to its original value: */
-        xdr_ressize_check(rqstp, reject_stat);
        ret = SVC_GARBAGE;
        goto out;
 auth_err:
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index 44920b90bdc4..46b2647c5bd2 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -66,7 +66,7 @@ unx_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
        dprintk("RPC:       allocating UNIX cred for uid %d gid %d\n",
                        acred->uid, acred->gid);
-        if (!(cred = kmalloc(sizeof(*cred), GFP_KERNEL)))
+        if (!(cred = kmalloc(sizeof(*cred), GFP_NOFS)))
                return ERR_PTR(-ENOMEM);
        rpcauth_init_cred(&cred->uc_base, acred, auth, &unix_credops);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 8945307556ec..76739e928d0d 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -25,6 +25,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/kallsyms.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
@@ -58,7 +59,6 @@ static void	call_start(struct rpc_task *task);
 static void     call_reserve(struct rpc_task *task);
 static void     call_reserveresult(struct rpc_task *task);
 static void     call_allocate(struct rpc_task *task);
-static void     call_encode(struct rpc_task *task);
 static void     call_decode(struct rpc_task *task);
 static void     call_bind(struct rpc_task *task);
 static void     call_bind_status(struct rpc_task *task);
@@ -70,9 +70,9 @@ static void	call_refreshresult(struct rpc_task *task);
 static void     call_timeout(struct rpc_task *task);
 static void     call_connect(struct rpc_task *task);
 static void     call_connect_status(struct rpc_task *task);
-static __be32 * call_header(struct rpc_task *task);
-static __be32 * call_verify(struct rpc_task *task);
+static __be32   *rpc_encode_header(struct rpc_task *task);
+static __be32   *rpc_verify_header(struct rpc_task *task);
 static int      rpc_ping(struct rpc_clnt *clnt, int flags);
 static void rpc_register_client(struct rpc_clnt *clnt)
@@ -324,6 +324,8 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
                clnt->cl_autobind = 1;
        if (args->flags & RPC_CLNT_CREATE_DISCRTRY)
                clnt->cl_discrtry = 1;
+        if (!(args->flags & RPC_CLNT_CREATE_QUIET))
+                clnt->cl_chatty = 1;
        return clnt;
 }
@@ -690,6 +692,21 @@ rpc_restart_call(struct rpc_task *task)
 }
 EXPORT_SYMBOL_GPL(rpc_restart_call);
+#ifdef RPC_DEBUG
+static const char *rpc_proc_name(const struct rpc_task *task)
+{
+        const struct rpc_procinfo *proc = task->tk_msg.rpc_proc;
+        if (proc) {
+                if (proc->p_name)
+                        return proc->p_name;
+                else
+                        return "NULL";
+        } else
+                return "no proc";
+}
+#endif
 /*
 * 0.  Initial state
 *
@@ -701,9 +718,9 @@ call_start(struct rpc_task *task)
 {
        struct rpc_clnt *clnt = task->tk_client;
-        dprintk("RPC: %5u call_start %s%d proc %d (%s)\n", task->tk_pid,
+        dprintk("RPC: %5u call_start %s%d proc %s (%s)\n", task->tk_pid,
                        clnt->cl_protname, clnt->cl_vers,
-                        task->tk_msg.rpc_proc->p_proc,
+                        rpc_proc_name(task),
                        (RPC_IS_ASYNC(task) ? "async" : "sync"));
        /* Increment call count */
@@ -861,7 +878,7 @@ rpc_xdr_buf_init(struct xdr_buf *buf, void *start, size_t len)
 * 3.   Encode arguments of an RPC call
 */
 static void
-call_encode(struct rpc_task *task)
+rpc_xdr_encode(struct rpc_task *task)
 {
        struct rpc_rqst *req = task->tk_rqstp;
        kxdrproc_t      encode;
@@ -876,23 +893,19 @@ call_encode(struct rpc_task *task)
                         (char *)req->rq_buffer + req->rq_callsize,
                         req->rq_rcvsize);
-        /* Encode header and provided arguments */
+        p = rpc_encode_header(task);
-        encode = task->tk_msg.rpc_proc->p_encode;
+        if (p == NULL) {
-        if (!(p = call_header(task))) {
+                printk(KERN_INFO "RPC: couldn't encode RPC header, exit EIO\n");
-                printk(KERN_INFO "RPC: call_header failed, exit EIO\n");
                rpc_exit(task, -EIO);
                return;
        }
+        encode = task->tk_msg.rpc_proc->p_encode;
        if (encode == NULL)
                return;
        task->tk_status = rpcauth_wrap_req(task, encode, req, p,
                        task->tk_msg.rpc_argp);
-        if (task->tk_status == -ENOMEM) {
-                /* XXX: Is this sane? */
-                rpc_delay(task, 3*HZ);
-                task->tk_status = -EAGAIN;
-        }
 }
 /*
@@ -929,11 +942,9 @@ call_bind_status(struct rpc_task *task)
        }
        switch (task->tk_status) {
-        case -EAGAIN:
+        case -ENOMEM:
-                dprintk("RPC: %5u rpcbind waiting for another request "
+                dprintk("RPC: %5u rpcbind out of memory\n", task->tk_pid);
-                                "to finish\n", task->tk_pid);
+                rpc_delay(task, HZ >> 2);
-                /* avoid busy-waiting here -- could be a network outage. */
-                rpc_delay(task, 5*HZ);
                goto retry_timeout;
        case -EACCES:
                dprintk("RPC: %5u remote rpcbind: RPC program/version "
@@ -1046,10 +1057,16 @@ call_transmit(struct rpc_task *task)
        /* Encode here so that rpcsec_gss can use correct sequence number. */
        if (rpc_task_need_encode(task)) {
                BUG_ON(task->tk_rqstp->rq_bytes_sent != 0);
-                call_encode(task);
+                rpc_xdr_encode(task);
                /* Did the encode result in an error condition? */
-                if (task->tk_status != 0)
+                if (task->tk_status != 0) {
+                        /* Was the error nonfatal? */
+                        if (task->tk_status == -EAGAIN)
+                                rpc_delay(task, HZ >> 4);
+                        else
+                                rpc_exit(task, task->tk_status);
                        return;
+                }
        }
        xprt_transmit(task);
        if (task->tk_status < 0)
@@ -1132,7 +1149,8 @@ call_status(struct rpc_task *task)
                rpc_exit(task, status);
                break;
        default:
-                printk("%s: RPC call returned error %d\n",
+                if (clnt->cl_chatty)
+                        printk("%s: RPC call returned error %d\n",
                               clnt->cl_protname, -status);
                rpc_exit(task, status);
        }
@@ -1157,7 +1175,8 @@ call_timeout(struct rpc_task *task)
        task->tk_timeouts++;
        if (RPC_IS_SOFT(task)) {
-                printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
+                if (clnt->cl_chatty)
+                        printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
                                clnt->cl_protname, clnt->cl_server);
                rpc_exit(task, -EIO);
                return;
@@ -1165,7 +1184,8 @@ call_timeout(struct rpc_task *task)
        if (!(task->tk_flags & RPC_CALL_MAJORSEEN)) {
                task->tk_flags |= RPC_CALL_MAJORSEEN;
-                printk(KERN_NOTICE "%s: server %s not responding, still trying\n",
+                if (clnt->cl_chatty)
+                        printk(KERN_NOTICE "%s: server %s not responding, still trying\n",
                        clnt->cl_protname, clnt->cl_server);
        }
        rpc_force_rebind(clnt);
@@ -1196,8 +1216,9 @@ call_decode(struct rpc_task *task)
                        task->tk_pid, task->tk_status);
        if (task->tk_flags & RPC_CALL_MAJORSEEN) {
-                printk(KERN_NOTICE "%s: server %s OK\n",
+                if (clnt->cl_chatty)
-                        clnt->cl_protname, clnt->cl_server);
+                        printk(KERN_NOTICE "%s: server %s OK\n",
+                                clnt->cl_protname, clnt->cl_server);
                task->tk_flags &= ~RPC_CALL_MAJORSEEN;
        }
@@ -1224,8 +1245,7 @@ call_decode(struct rpc_task *task)
                goto out_retry;
        }
-        /* Verify the RPC header */
+        p = rpc_verify_header(task);
-        p = call_verify(task);
        if (IS_ERR(p)) {
                if (p == ERR_PTR(-EAGAIN))
                        goto out_retry;
@@ -1243,7 +1263,7 @@ call_decode(struct rpc_task *task)
        return;
 out_retry:
        task->tk_status = 0;
-        /* Note: call_verify() may have freed the RPC slot */
+        /* Note: rpc_verify_header() may have freed the RPC slot */
        if (task->tk_rqstp == req) {
                req->rq_received = req->rq_rcv_buf.len = 0;
                if (task->tk_client->cl_discrtry)
@@ -1290,11 +1310,8 @@ call_refreshresult(struct rpc_task *task)
        return;
 }
-/*
- * Call header serialization
- */
 static __be32 *
-call_header(struct rpc_task *task)
+rpc_encode_header(struct rpc_task *task)
 {
        struct rpc_clnt *clnt = task->tk_client;
        struct rpc_rqst *req = task->tk_rqstp;
@@ -1314,11 +1331,8 @@ call_header(struct rpc_task *task)
        return p;
 }
-/*
- * Reply header verification
- */
 static __be32 *
-call_verify(struct rpc_task *task)
+rpc_verify_header(struct rpc_task *task)
 {
        struct kvec *iov = &task->tk_rqstp->rq_rcv_buf.head[0];
        int len = task->tk_rqstp->rq_rcv_buf.len >> 2;
@@ -1392,7 +1406,7 @@ call_verify(struct rpc_task *task)
                        task->tk_action = call_bind;
                        goto out_retry;
                case RPC_AUTH_TOOWEAK:
-                        printk(KERN_NOTICE "call_verify: server %s requires stronger "
+                        printk(KERN_NOTICE "RPC: server %s requires stronger "
                               "authentication.\n", task->tk_client->cl_server);
                        break;
                default:
@@ -1431,10 +1445,10 @@ call_verify(struct rpc_task *task)
                error = -EPROTONOSUPPORT;
                goto out_err;
        case RPC_PROC_UNAVAIL:
-                dprintk("RPC: %5u %s: proc %p unsupported by program %u, "
+                dprintk("RPC: %5u %s: proc %s unsupported by program %u, "
                                "version %u on server %s\n",
                                task->tk_pid, __func__,
-                                task->tk_msg.rpc_proc,
+                                rpc_proc_name(task),
                                task->tk_client->cl_prog,
                                task->tk_client->cl_vers,
                                task->tk_client->cl_server);
@@ -1517,44 +1531,53 @@ struct rpc_task *rpc_call_null(struct rpc_clnt *clnt, struct rpc_cred *cred, int
 EXPORT_SYMBOL_GPL(rpc_call_null);
 #ifdef RPC_DEBUG
+static void rpc_show_header(void)
+{
+        printk(KERN_INFO "-pid- flgs status -client- --rqstp- "
+                "-timeout ---ops--\n");
+}
+static void rpc_show_task(const struct rpc_clnt *clnt,
+                          const struct rpc_task *task)
+{
+        const char *rpc_waitq = "none";
+        char *p, action[KSYM_SYMBOL_LEN];
+        if (RPC_IS_QUEUED(task))
+                rpc_waitq = rpc_qname(task->tk_waitqueue);
+        /* map tk_action pointer to a function name; then trim off
+         * the "+0x0 [sunrpc]" */
+        sprint_symbol(action, (unsigned long)task->tk_action);
+        p = strchr(action, '+');
+        if (p)
+                *p = '\0';
+        printk(KERN_INFO "%5u %04x %6d %8p %8p %8ld %8p %sv%u %s a:%s q:%s\n",
+                task->tk_pid, task->tk_flags, task->tk_status,
+                clnt, task->tk_rqstp, task->tk_timeout, task->tk_ops,
+                clnt->cl_protname, clnt->cl_vers, rpc_proc_name(task),
+                action, rpc_waitq);
+}
 void rpc_show_tasks(void)
 {
        struct rpc_clnt *clnt;
-        struct rpc_task *t;
+        struct rpc_task *task;
+        int header = 0;
        spin_lock(&rpc_client_lock);
-        if (list_empty(&all_clients))
-                goto out;
-        printk("-pid- proc flgs status -client- -prog- --rqstp- -timeout "
-                "-rpcwait -action- ---ops--\n");
        list_for_each_entry(clnt, &all_clients, cl_clients) {
-                if (list_empty(&clnt->cl_tasks))
-                        continue;
                spin_lock(&clnt->cl_lock);
-                list_for_each_entry(t, &clnt->cl_tasks, tk_task) {
+                list_for_each_entry(task, &clnt->cl_tasks, tk_task) {
-                        const char *rpc_waitq = "none";
+                        if (!header) {
-                        int proc;
+                                rpc_show_header();
+                                header++;
-                        if (t->tk_msg.rpc_proc)
+                        }
-                                proc = t->tk_msg.rpc_proc->p_proc;
+                        rpc_show_task(clnt, task);
-                        else
-                                proc = -1;
-                        if (RPC_IS_QUEUED(t))
-                                rpc_waitq = rpc_qname(t->tk_waitqueue);
-                        printk("%5u %04d %04x %6d %8p %6d %8p %8ld %8s %8p %8p\n",
-                                t->tk_pid, proc,
-                                t->tk_flags, t->tk_status,
-                                t->tk_client,
-                                (t->tk_client ? t->tk_client->cl_prog : 0),
-                                t->tk_rqstp, t->tk_timeout,
-                                rpc_waitq,
-                                t->tk_action, t->tk_ops);
                }
                spin_unlock(&clnt->cl_lock);
        }
-out:
        spin_unlock(&rpc_client_lock);
 }
 #endif
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 0517967a68bf..24db2b4d12d3 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -32,6 +32,10 @@
 #define RPCBIND_PROGRAM         (100000u)
 #define RPCBIND_PORT            (111u)
+#define RPCBVERS_2              (2u)
+#define RPCBVERS_3              (3u)
+#define RPCBVERS_4              (4u)
 enum {
        RPCBPROC_NULL,
        RPCBPROC_SET,
@@ -64,6 +68,7 @@ enum {
 #define RPCB_MAXOWNERLEN        sizeof(RPCB_OWNER_STRING)
 static void                     rpcb_getport_done(struct rpc_task *, void *);
+static void                     rpcb_map_release(void *data);
 static struct rpc_program       rpcb_program;
 struct rpcbind_args {
@@ -76,41 +81,73 @@ struct rpcbind_args {
        const char *            r_netid;
        const char *            r_addr;
        const char *            r_owner;
+        int                     r_status;
 };
 static struct rpc_procinfo rpcb_procedures2[];
 static struct rpc_procinfo rpcb_procedures3[];
+static struct rpc_procinfo rpcb_procedures4[];
 struct rpcb_info {
-        int                     rpc_vers;
+        u32                     rpc_vers;
        struct rpc_procinfo *   rpc_proc;
 };
 static struct rpcb_info rpcb_next_version[];
 static struct rpcb_info rpcb_next_version6[];
+static const struct rpc_call_ops rpcb_getport_ops = {
+        .rpc_call_done          = rpcb_getport_done,
+        .rpc_release            = rpcb_map_release,
+};
+static void rpcb_wake_rpcbind_waiters(struct rpc_xprt *xprt, int status)
+{
+        xprt_clear_binding(xprt);
+        rpc_wake_up_status(&xprt->binding, status);
+}
 static void rpcb_map_release(void *data)
 {
        struct rpcbind_args *map = data;
+        rpcb_wake_rpcbind_waiters(map->r_xprt, map->r_status);
        xprt_put(map->r_xprt);
        kfree(map);
 }
-static const struct rpc_call_ops rpcb_getport_ops = {
+static const struct sockaddr_in rpcb_inaddr_loopback = {
-        .rpc_call_done          = rpcb_getport_done,
+        .sin_family             = AF_INET,
-        .rpc_release            = rpcb_map_release,
+        .sin_addr.s_addr        = htonl(INADDR_LOOPBACK),
+        .sin_port               = htons(RPCBIND_PORT),
 };
-static void rpcb_wake_rpcbind_waiters(struct rpc_xprt *xprt, int status)
+static const struct sockaddr_in6 rpcb_in6addr_loopback = {
+        .sin6_family            = AF_INET6,
+        .sin6_addr              = IN6ADDR_LOOPBACK_INIT,
+        .sin6_port              = htons(RPCBIND_PORT),
+};
+static struct rpc_clnt *rpcb_create_local(struct sockaddr *addr,
+                                          size_t addrlen, u32 version)
 {
-        xprt_clear_binding(xprt);
+        struct rpc_create_args args = {
-        rpc_wake_up_status(&xprt->binding, status);
+                .protocol       = XPRT_TRANSPORT_UDP,
+                .address        = addr,
+                .addrsize       = addrlen,
+                .servername     = "localhost",
+                .program        = &rpcb_program,
+                .version        = version,
+                .authflavor     = RPC_AUTH_UNIX,
+                .flags          = RPC_CLNT_CREATE_NOPING,
+        };
+        return rpc_create(&args);
 }
 static struct rpc_clnt *rpcb_create(char *hostname, struct sockaddr *srvaddr,
-                                    size_t salen, int proto, u32 version,
+                                    size_t salen, int proto, u32 version)
-                                    int privileged)
 {
        struct rpc_create_args args = {
                .protocol       = proto,
@@ -120,7 +157,8 @@ static struct rpc_clnt *rpcb_create(char *hostname, struct sockaddr *srvaddr,
                .program        = &rpcb_program,
                .version        = version,
                .authflavor     = RPC_AUTH_UNIX,
-                .flags          = RPC_CLNT_CREATE_NOPING,
+                .flags          = (RPC_CLNT_CREATE_NOPING |
+                                        RPC_CLNT_CREATE_NONPRIVPORT),
        };
        switch (srvaddr->sa_family) {
@@ -134,29 +172,72 @@ static struct rpc_clnt *rpcb_create(char *hostname, struct sockaddr *srvaddr,
                return NULL;
        }
-        if (!privileged)
-                args.flags |= RPC_CLNT_CREATE_NONPRIVPORT;
        return rpc_create(&args);
 }
+static int rpcb_register_call(struct sockaddr *addr, size_t addrlen,
+                              u32 version, struct rpc_message *msg,
+                              int *result)
+{
+        struct rpc_clnt *rpcb_clnt;
+        int error = 0;
+        *result = 0;
+        rpcb_clnt = rpcb_create_local(addr, addrlen, version);
+        if (!IS_ERR(rpcb_clnt)) {
+                error = rpc_call_sync(rpcb_clnt, msg, 0);
+                rpc_shutdown_client(rpcb_clnt);
+        } else
+                error = PTR_ERR(rpcb_clnt);
+        if (error < 0)
+                printk(KERN_WARNING "RPC: failed to contact local rpcbind "
+                                "server (errno %d).\n", -error);
+        dprintk("RPC:       registration status %d/%d\n", error, *result);
+        return error;
+}
 /**
 * rpcb_register - set or unset a port registration with the local rpcbind svc
 * @prog: RPC program number to bind
 * @vers: RPC version number to bind
- * @prot: transport protocol to use to make this request
+ * @prot: transport protocol to register
 * @port: port value to register
- * @okay: result code
+ * @okay: OUT: result code
+ *
+ * RPC services invoke this function to advertise their contact
+ * information via the system's rpcbind daemon.  RPC services
+ * invoke this function once for each [program, version, transport]
+ * tuple they wish to advertise.
+ *
+ * Callers may also unregister RPC services that are no longer
+ * available by setting the passed-in port to zero.  This removes
+ * all registered transports for [program, version] from the local
+ * rpcbind database.
+ *
+ * Returns zero if the registration request was dispatched
+ * successfully and a reply was received.  The rpcbind daemon's
+ * boolean result code is stored in *okay.
+ *
+ * Returns an errno value and sets *result to zero if there was
+ * some problem that prevented the rpcbind request from being
+ * dispatched, or if the rpcbind daemon did not respond within
+ * the timeout.
 *
- * port == 0 means unregister, port != 0 means register.
+ * This function uses rpcbind protocol version 2 to contact the
+ * local rpcbind daemon.
 *
- * This routine supports only rpcbind version 2.
+ * Registration works over both AF_INET and AF_INET6, and services
+ * registered via this function are advertised as available for any
+ * address.  If the local rpcbind daemon is listening on AF_INET6,
+ * services registered via this function will be advertised on
+ * IN6ADDR_ANY (ie available for all AF_INET and AF_INET6
+ * addresses).
 */
 int rpcb_register(u32 prog, u32 vers, int prot, unsigned short port, int *okay)
 {
-        struct sockaddr_in sin = {
-                .sin_family             = AF_INET,
-                .sin_addr.s_addr        = htonl(INADDR_LOOPBACK),
-        };
        struct rpcbind_args map = {
                .r_prog         = prog,
                .r_vers         = vers,
@@ -164,32 +245,159 @@ int rpcb_register(u32 prog, u32 vers, int prot, unsigned short port, int *okay)
                .r_port         = port,
        };
        struct rpc_message msg = {
-                .rpc_proc       = &rpcb_procedures2[port ?
-                                        RPCBPROC_SET : RPCBPROC_UNSET],
                .rpc_argp       = &map,
                .rpc_resp       = okay,
        };
-        struct rpc_clnt *rpcb_clnt;
-        int error = 0;
        dprintk("RPC:       %sregistering (%u, %u, %d, %u) with local "
                        "rpcbind\n", (port ? "" : "un"),
                        prog, vers, prot, port);
-        rpcb_clnt = rpcb_create("localhost", (struct sockaddr *) &sin,
+        msg.rpc_proc = &rpcb_procedures2[RPCBPROC_UNSET];
-                                sizeof(sin), XPRT_TRANSPORT_UDP, 2, 1);
+        if (port)
-        if (IS_ERR(rpcb_clnt))
+                msg.rpc_proc = &rpcb_procedures2[RPCBPROC_SET];
-                return PTR_ERR(rpcb_clnt);
-        error = rpc_call_sync(rpcb_clnt, &msg, 0);
+        return rpcb_register_call((struct sockaddr *)&rpcb_inaddr_loopback,
+                                        sizeof(rpcb_inaddr_loopback),
+                                        RPCBVERS_2, &msg, okay);
+}
-        rpc_shutdown_client(rpcb_clnt);
+/*
-        if (error < 0)
+ * Fill in AF_INET family-specific arguments to register
-                printk(KERN_WARNING "RPC: failed to contact local rpcbind "
+ */
-                                "server (errno %d).\n", -error);
+static int rpcb_register_netid4(struct sockaddr_in *address_to_register,
-        dprintk("RPC:       registration status %d/%d\n", error, *okay);
+                                struct rpc_message *msg)
+{
+        struct rpcbind_args *map = msg->rpc_argp;
+        unsigned short port = ntohs(address_to_register->sin_port);
+        char buf[32];
+        /* Construct AF_INET universal address */
+        snprintf(buf, sizeof(buf),
+                        NIPQUAD_FMT".%u.%u",
+                        NIPQUAD(address_to_register->sin_addr.s_addr),
+                        port >> 8, port & 0xff);
+        map->r_addr = buf;
+        dprintk("RPC:       %sregistering [%u, %u, %s, '%s'] with "
+                "local rpcbind\n", (port ? "" : "un"),
+                        map->r_prog, map->r_vers,
+                        map->r_addr, map->r_netid);
+        msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
+        if (port)
+                msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
+        return rpcb_register_call((struct sockaddr *)&rpcb_inaddr_loopback,
+                                        sizeof(rpcb_inaddr_loopback),
+                                        RPCBVERS_4, msg, msg->rpc_resp);
+}
-        return error;
+/*
+ * Fill in AF_INET6 family-specific arguments to register
+ */
+static int rpcb_register_netid6(struct sockaddr_in6 *address_to_register,
+                                struct rpc_message *msg)
+{
+        struct rpcbind_args *map = msg->rpc_argp;
+        unsigned short port = ntohs(address_to_register->sin6_port);
+        char buf[64];
+        /* Construct AF_INET6 universal address */
+        snprintf(buf, sizeof(buf),
+                        NIP6_FMT".%u.%u",
+                        NIP6(address_to_register->sin6_addr),
+                        port >> 8, port & 0xff);
+        map->r_addr = buf;
+        dprintk("RPC:       %sregistering [%u, %u, %s, '%s'] with "
+                "local rpcbind\n", (port ? "" : "un"),
+                        map->r_prog, map->r_vers,
+                        map->r_addr, map->r_netid);
+        msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
+        if (port)
+                msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
+        return rpcb_register_call((struct sockaddr *)&rpcb_in6addr_loopback,
+                                        sizeof(rpcb_in6addr_loopback),
+                                        RPCBVERS_4, msg, msg->rpc_resp);
+}
+/**
+ * rpcb_v4_register - set or unset a port registration with the local rpcbind
+ * @program: RPC program number of service to (un)register
+ * @version: RPC version number of service to (un)register
+ * @address: address family, IP address, and port to (un)register
+ * @netid: netid of transport protocol to (un)register
+ * @result: result code from rpcbind RPC call
+ *
+ * RPC services invoke this function to advertise their contact
+ * information via the system's rpcbind daemon.  RPC services
+ * invoke this function once for each [program, version, address,
+ * netid] tuple they wish to advertise.
+ *
+ * Callers may also unregister RPC services that are no longer
+ * available by setting the port number in the passed-in address
+ * to zero.  Callers pass a netid of "" to unregister all
+ * transport netids associated with [program, version, address].
+ *
+ * Returns zero if the registration request was dispatched
+ * successfully and a reply was received.  The rpcbind daemon's
+ * result code is stored in *result.
+ *
+ * Returns an errno value and sets *result to zero if there was
+ * some problem that prevented the rpcbind request from being
+ * dispatched, or if the rpcbind daemon did not respond within
+ * the timeout.
+ *
+ * This function uses rpcbind protocol version 4 to contact the
+ * local rpcbind daemon.  The local rpcbind daemon must support
+ * version 4 of the rpcbind protocol in order for these functions
+ * to register a service successfully.
+ *
+ * Supported netids include "udp" and "tcp" for UDP and TCP over
+ * IPv4, and "udp6" and "tcp6" for UDP and TCP over IPv6,
+ * respectively.
+ *
+ * The contents of @address determine the address family and the
+ * port to be registered.  The usual practice is to pass INADDR_ANY
+ * as the raw address, but specifying a non-zero address is also
+ * supported by this API if the caller wishes to advertise an RPC
+ * service on a specific network interface.
+ *
+ * Note that passing in INADDR_ANY does not create the same service
+ * registration as IN6ADDR_ANY.  The former advertises an RPC
+ * service on any IPv4 address, but not on IPv6.  The latter
+ * advertises the service on all IPv4 and IPv6 addresses.
+ */
+int rpcb_v4_register(const u32 program, const u32 version,
+                     const struct sockaddr *address, const char *netid,
+                     int *result)
+{
+        struct rpcbind_args map = {
+                .r_prog         = program,
+                .r_vers         = version,
+                .r_netid        = netid,
+                .r_owner        = RPCB_OWNER_STRING,
+        };
+        struct rpc_message msg = {
+                .rpc_argp       = &map,
+                .rpc_resp       = result,
+        };
+        *result = 0;
+        switch (address->sa_family) {
+        case AF_INET:
+                return rpcb_register_netid4((struct sockaddr_in *)address,
+                                            &msg);
+        case AF_INET6:
+                return rpcb_register_netid6((struct sockaddr_in6 *)address,
+                                            &msg);
+        }
+        return -EAFNOSUPPORT;
 }
 /**
@@ -227,7 +435,7 @@ int rpcb_getport_sync(struct sockaddr_in *sin, u32 prog, u32 vers, int prot)
                __func__, NIPQUAD(sin->sin_addr.s_addr), prog, vers, prot);
        rpcb_clnt = rpcb_create(NULL, (struct sockaddr *)sin,
-                                sizeof(*sin), prot, 2, 0);
+                                sizeof(*sin), prot, RPCBVERS_2);
        if (IS_ERR(rpcb_clnt))
                return PTR_ERR(rpcb_clnt);
@@ -243,10 +451,10 @@ int rpcb_getport_sync(struct sockaddr_in *sin, u32 prog, u32 vers, int prot)
 }
 EXPORT_SYMBOL_GPL(rpcb_getport_sync);
-static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbind_args *map, int version)
+static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbind_args *map, struct rpc_procinfo *proc)
 {
        struct rpc_message msg = {
-                .rpc_proc = rpcb_next_version[version].rpc_proc,
+                .rpc_proc = proc,
                .rpc_argp = map,
                .rpc_resp = &map->r_port,
        };
@@ -271,6 +479,7 @@ static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbi
 void rpcb_getport_async(struct rpc_task *task)
 {
        struct rpc_clnt *clnt = task->tk_client;
+        struct rpc_procinfo *proc;
        u32 bind_version;
        struct rpc_xprt *xprt = task->tk_xprt;
        struct rpc_clnt *rpcb_clnt;
@@ -280,7 +489,6 @@ void rpcb_getport_async(struct rpc_task *task)
        struct sockaddr *sap = (struct sockaddr *)&addr;
        size_t salen;
        int status;
-        struct rpcb_info *info;
        dprintk("RPC: %5u %s(%s, %u, %u, %d)\n",
                task->tk_pid, __func__,
@@ -289,17 +497,16 @@ void rpcb_getport_async(struct rpc_task *task)
        /* Autobind on cloned rpc clients is discouraged */
        BUG_ON(clnt->cl_parent != clnt);
+        /* Put self on the wait queue to ensure we get notified if
+         * some other task is already attempting to bind the port */
+        rpc_sleep_on(&xprt->binding, task, NULL);
        if (xprt_test_and_set_binding(xprt)) {
-                status = -EAGAIN;       /* tell caller to check again */
                dprintk("RPC: %5u %s: waiting for another binder\n",
                        task->tk_pid, __func__);
-                goto bailout_nowake;
+                return;
        }
-        /* Put self on queue before sending rpcbind request, in case
-         * rpcb_getport_done completes before we return from rpc_run_task */
-        rpc_sleep_on(&xprt->binding, task, NULL);
        /* Someone else may have bound if we slept */
        if (xprt_bound(xprt)) {
                status = 0;
@@ -313,10 +520,12 @@ void rpcb_getport_async(struct rpc_task *task)
        /* Don't ever use rpcbind v2 for AF_INET6 requests */
        switch (sap->sa_family) {
        case AF_INET:
-                info = rpcb_next_version;
+                proc = rpcb_next_version[xprt->bind_index].rpc_proc;
+                bind_version = rpcb_next_version[xprt->bind_index].rpc_vers;
                break;
        case AF_INET6:
-                info = rpcb_next_version6;
+                proc = rpcb_next_version6[xprt->bind_index].rpc_proc;
+                bind_version = rpcb_next_version6[xprt->bind_index].rpc_vers;
                break;
        default:
                status = -EAFNOSUPPORT;
@@ -324,20 +533,19 @@ void rpcb_getport_async(struct rpc_task *task)
                                task->tk_pid, __func__);
                goto bailout_nofree;
        }
-        if (info[xprt->bind_index].rpc_proc == NULL) {
+        if (proc == NULL) {
                xprt->bind_index = 0;
                status = -EPFNOSUPPORT;
                dprintk("RPC: %5u %s: no more getport versions available\n",
                        task->tk_pid, __func__);
                goto bailout_nofree;
        }
-        bind_version = info[xprt->bind_index].rpc_vers;
        dprintk("RPC: %5u %s: trying rpcbind version %u\n",
                task->tk_pid, __func__, bind_version);
        rpcb_clnt = rpcb_create(clnt->cl_server, sap, salen, xprt->prot,
-                                bind_version, 0);
+                                bind_version);
        if (IS_ERR(rpcb_clnt)) {
                status = PTR_ERR(rpcb_clnt);
                dprintk("RPC: %5u %s: rpcb_create failed, error %ld\n",
@@ -360,26 +568,23 @@ void rpcb_getport_async(struct rpc_task *task)
        map->r_netid = rpc_peeraddr2str(clnt, RPC_DISPLAY_NETID);
        map->r_addr = rpc_peeraddr2str(rpcb_clnt, RPC_DISPLAY_UNIVERSAL_ADDR);
        map->r_owner = RPCB_OWNER_STRING;       /* ignored for GETADDR */
+        map->r_status = -EIO;
-        child = rpcb_call_async(rpcb_clnt, map, xprt->bind_index);
+        child = rpcb_call_async(rpcb_clnt, map, proc);
        rpc_release_client(rpcb_clnt);
        if (IS_ERR(child)) {
-                status = -EIO;
+                /* rpcb_map_release() has freed the arguments */
                dprintk("RPC: %5u %s: rpc_run_task failed\n",
                        task->tk_pid, __func__);
-                goto bailout;
+                return;
        }
        rpc_put_task(child);
        task->tk_xprt->stat.bind_count++;
        return;
-bailout:
-        kfree(map);
-        xprt_put(xprt);
 bailout_nofree:
        rpcb_wake_rpcbind_waiters(xprt, status);
-bailout_nowake:
        task->tk_status = status;
 }
 EXPORT_SYMBOL_GPL(rpcb_getport_async);
@@ -418,9 +623,13 @@ static void rpcb_getport_done(struct rpc_task *child, void *data)
        dprintk("RPC: %5u rpcb_getport_done(status %d, port %u)\n",
                        child->tk_pid, status, map->r_port);
-        rpcb_wake_rpcbind_waiters(xprt, status);
+        map->r_status = status;
 }
+/*
+ * XDR functions for rpcbind
+ */
 static int rpcb_encode_mapping(struct rpc_rqst *req, __be32 *p,
                               struct rpcbind_args *rpcb)
 {
@@ -439,7 +648,7 @@ static int rpcb_decode_getport(struct rpc_rqst *req, __be32 *p,
                               unsigned short *portp)
 {
        *portp = (unsigned short) ntohl(*p++);
-        dprintk("RPC:      rpcb_decode_getport result %u\n",
+        dprintk("RPC:       rpcb_decode_getport result %u\n",
                        *portp);
        return 0;
 }
@@ -448,8 +657,8 @@ static int rpcb_decode_set(struct rpc_rqst *req, __be32 *p,
                           unsigned int *boolp)
 {
        *boolp = (unsigned int) ntohl(*p++);
-        dprintk("RPC:      rpcb_decode_set result %u\n",
+        dprintk("RPC:       rpcb_decode_set: call %s\n",
-                        *boolp);
+                        (*boolp ? "succeeded" : "failed"));
        return 0;
 }
@@ -572,52 +781,60 @@ out_err:
 static struct rpc_procinfo rpcb_procedures2[] = {
        PROC(SET,               mapping,        set),
        PROC(UNSET,             mapping,        set),
-        PROC(GETADDR,           mapping,        getport),
+        PROC(GETPORT,           mapping,        getport),
 };
 static struct rpc_procinfo rpcb_procedures3[] = {
-        PROC(SET,               mapping,        set),
+        PROC(SET,               getaddr,        set),
-        PROC(UNSET,             mapping,        set),
+        PROC(UNSET,             getaddr,        set),
        PROC(GETADDR,           getaddr,        getaddr),
 };
 static struct rpc_procinfo rpcb_procedures4[] = {
-        PROC(SET,               mapping,        set),
+        PROC(SET,               getaddr,        set),
-        PROC(UNSET,             mapping,        set),
+        PROC(UNSET,             getaddr,        set),
+        PROC(GETADDR,           getaddr,        getaddr),
        PROC(GETVERSADDR,       getaddr,        getaddr),
 };
 static struct rpcb_info rpcb_next_version[] = {
-#ifdef CONFIG_SUNRPC_BIND34
+        {
-        { 4, &rpcb_procedures4[RPCBPROC_GETVERSADDR] },
+                .rpc_vers       = RPCBVERS_2,
-        { 3, &rpcb_procedures3[RPCBPROC_GETADDR] },
+                .rpc_proc       = &rpcb_procedures2[RPCBPROC_GETPORT],
-#endif
+        },
-        { 2, &rpcb_procedures2[RPCBPROC_GETPORT] },
+        {
-        { 0, NULL },
+                .rpc_proc       = NULL,
+        },
 };
 static struct rpcb_info rpcb_next_version6[] = {
-#ifdef CONFIG_SUNRPC_BIND34
+        {
-        { 4, &rpcb_procedures4[RPCBPROC_GETVERSADDR] },
+                .rpc_vers       = RPCBVERS_4,
-        { 3, &rpcb_procedures3[RPCBPROC_GETADDR] },
+                .rpc_proc       = &rpcb_procedures4[RPCBPROC_GETADDR],
-#endif
+        },
-        { 0, NULL },
+        {
+                .rpc_vers       = RPCBVERS_3,
+                .rpc_proc       = &rpcb_procedures3[RPCBPROC_GETADDR],
+        },
+        {
+                .rpc_proc       = NULL,
+        },
 };
 static struct rpc_version rpcb_version2 = {
-        .number         = 2,
+        .number         = RPCBVERS_2,
        .nrprocs        = RPCB_HIGHPROC_2,
        .procs          = rpcb_procedures2
 };
 static struct rpc_version rpcb_version3 = {
-        .number         = 3,
+        .number         = RPCBVERS_3,
        .nrprocs        = RPCB_HIGHPROC_3,
        .procs          = rpcb_procedures3
 };
 static struct rpc_version rpcb_version4 = {
-        .number         = 4,
+        .number         = RPCBVERS_4,
        .nrprocs        = RPCB_HIGHPROC_4,
        .procs          = rpcb_procedures4
 };
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 6eab9bf94baf..385f427bedad 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -576,9 +576,7 @@ EXPORT_SYMBOL_GPL(rpc_delay);
 */
 static void rpc_prepare_task(struct rpc_task *task)
 {
-        lock_kernel();
        task->tk_ops->rpc_call_prepare(task, task->tk_calldata);
-        unlock_kernel();
 }
 /*
@@ -588,9 +586,7 @@ void rpc_exit_task(struct rpc_task *task)
 {
        task->tk_action = NULL;
        if (task->tk_ops->rpc_call_done != NULL) {
-                lock_kernel();
                task->tk_ops->rpc_call_done(task, task->tk_calldata);
-                unlock_kernel();
                if (task->tk_action != NULL) {
                        WARN_ON(RPC_ASSASSINATED(task));
                        /* Always release the RPC slot and buffer memory */
@@ -602,11 +598,8 @@ EXPORT_SYMBOL_GPL(rpc_exit_task);
 void rpc_release_calldata(const struct rpc_call_ops *ops, void *calldata)
 {
-        if (ops->rpc_release != NULL) {
+        if (ops->rpc_release != NULL)
-                lock_kernel();
                ops->rpc_release(calldata);
-                unlock_kernel();
-        }
 }
 /*
@@ -626,19 +619,15 @@ static void __rpc_execute(struct rpc_task *task)
                /*
                 * Execute any pending callback.
                 */
-                if (RPC_DO_CALLBACK(task)) {
+                if (task->tk_callback) {
-                        /* Define a callback save pointer */
                        void (*save_callback)(struct rpc_task *);
                        /*
-                         * If a callback exists, save it, reset it,
+                         * We set tk_callback to NULL before calling it,
-                         * call it.
+                         * in case it sets the tk_callback field itself:
-                         * The save is needed to stop from resetting
-                         * another callback set within the callback handler
-                         * - Dave
                         */
-                        save_callback=task->tk_callback;
+                        save_callback = task->tk_callback;
-                        task->tk_callback=NULL;
+                        task->tk_callback = NULL;
                        save_callback(task);
                }
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index e1770f7ba0b3..99a52aabe332 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -690,7 +690,7 @@ static void xprt_connect_status(struct rpc_task *task)
 {
        struct rpc_xprt *xprt = task->tk_xprt;
-        if (task->tk_status >= 0) {
+        if (task->tk_status == 0) {
                xprt->stat.connect_count++;
                xprt->stat.connect_time += (long)jiffies - xprt->stat.connect_start;
                dprintk("RPC: %5u xprt_connect_status: connection established\n",
@@ -699,12 +699,6 @@ static void xprt_connect_status(struct rpc_task *task)
        }
        switch (task->tk_status) {
-        case -ECONNREFUSED:
-        case -ECONNRESET:
-                dprintk("RPC: %5u xprt_connect_status: server %s refused "
-                                "connection\n", task->tk_pid,
-                                task->tk_client->cl_server);
-                break;
        case -ENOTCONN:
                dprintk("RPC: %5u xprt_connect_status: connection broken\n",
                                task->tk_pid);
@@ -878,6 +872,7 @@ void xprt_transmit(struct rpc_task *task)
                return;
        req->rq_connect_cookie = xprt->connect_cookie;
+        req->rq_xtime = jiffies;
        status = xprt->ops->send_request(task);
        if (status == 0) {
                dprintk("RPC: %5u xmit complete\n", task->tk_pid);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index ddbe981ab516..4486c59c3aca 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -579,7 +579,6 @@ static int xs_udp_send_request(struct rpc_task *task)
                                req->rq_svec->iov_base,
                                req->rq_svec->iov_len);
-        req->rq_xtime = jiffies;
        status = xs_sendpages(transport->sock,
                              xs_addr(xprt),
                              xprt->addrlen, xdr,
@@ -671,7 +670,6 @@ static int xs_tcp_send_request(struct rpc_task *task)
         * to cope with writespace callbacks arriving _after_ we have
         * called sendmsg(). */
        while (1) {
-                req->rq_xtime = jiffies;
                status = xs_sendpages(transport->sock,
                                        NULL, 0, xdr, req->rq_bytes_sent);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 657835f227d3..783317dacd30 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -487,8 +487,8 @@ static int unix_socketpair(struct socket *, struct socket *);
 static int unix_accept(struct socket *, struct socket *, int);
 static int unix_getname(struct socket *, struct sockaddr *, int *, int);
 static unsigned int unix_poll(struct file *, struct socket *, poll_table *);
-static unsigned int unix_datagram_poll(struct file *, struct socket *,
+static unsigned int unix_dgram_poll(struct file *, struct socket *,
-                                       poll_table *);
+                                    poll_table *);
 static int unix_ioctl(struct socket *, unsigned int, unsigned long);
 static int unix_shutdown(struct socket *, int);
 static int unix_stream_sendmsg(struct kiocb *, struct socket *,
@@ -534,7 +534,7 @@ static const struct proto_ops unix_dgram_ops = {
        .socketpair =   unix_socketpair,
        .accept =       sock_no_accept,
        .getname =      unix_getname,
-        .poll =         unix_datagram_poll,
+        .poll =         unix_dgram_poll,
        .ioctl =        unix_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     unix_shutdown,
@@ -555,7 +555,7 @@ static const struct proto_ops unix_seqpacket_ops = {
        .socketpair =   unix_socketpair,
        .accept =       unix_accept,
        .getname =      unix_getname,
-        .poll =         unix_datagram_poll,
+        .poll =         unix_dgram_poll,
        .ioctl =        unix_ioctl,
        .listen =       unix_listen,
        .shutdown =     unix_shutdown,
@@ -1994,29 +1994,13 @@ static unsigned int unix_poll(struct file * file, struct socket *sock, poll_tabl
        return mask;
 }
-static unsigned int unix_datagram_poll(struct file *file, struct socket *sock,
+static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
-                                       poll_table *wait)
+                                    poll_table *wait)
 {
-        struct sock *sk = sock->sk, *peer;
+        struct sock *sk = sock->sk, *other;
-        unsigned int mask;
+        unsigned int mask, writable;
        poll_wait(file, sk->sk_sleep, wait);
-        peer = unix_peer_get(sk);
-        if (peer) {
-                if (peer != sk) {
-                        /*
-                         * Writability of a connected socket additionally
-                         * depends on the state of the receive queue of the
-                         * peer.
-                         */
-                        poll_wait(file, &unix_sk(peer)->peer_wait, wait);
-                } else {
-                        sock_put(peer);
-                        peer = NULL;
-                }
-        }
        mask = 0;
        /* exceptional events? */
@@ -2042,14 +2026,26 @@ static unsigned int unix_datagram_poll(struct file *file, struct socket *sock,
        }
        /* writable? */
-        if (unix_writable(sk) && !(peer && unix_recvq_full(peer)))
+        writable = unix_writable(sk);
+        if (writable) {
+                other = unix_peer_get(sk);
+                if (other) {
+                        if (unix_peer(other) != sk) {
+                                poll_wait(file, &unix_sk(other)->peer_wait,
+                                          wait);
+                                if (unix_recvq_full(other))
+                                        writable = 0;
+                        }
+                        sock_put(other);
+                }
+        }
+        if (writable)
                mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
        else
                set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
-        if (peer)
-                sock_put(peer);
        return mask;
 }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 185488da2466..855bff4b3250 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -80,6 +80,23 @@ static const struct ieee80211_channel_range ieee80211_JP_channels[] = {
                                     IEEE80211_CHAN_RADAR),
 };
+static const struct ieee80211_channel_range ieee80211_EU_channels[] = {
+        /* IEEE 802.11b/g, channels 1..13 */
+        RANGE_PWR(2412, 2472, 20, 6, 0),
+        /* IEEE 802.11a, channel 36*/
+        RANGE_PWR(5180, 5180, 23, 6, IEEE80211_CHAN_PASSIVE_SCAN),
+        /* IEEE 802.11a, channel 40*/
+        RANGE_PWR(5200, 5200, 23, 6, IEEE80211_CHAN_PASSIVE_SCAN),
+        /* IEEE 802.11a, channel 44*/
+        RANGE_PWR(5220, 5220, 23, 6, IEEE80211_CHAN_PASSIVE_SCAN),
+        /* IEEE 802.11a, channels 48..64 */
+        RANGE_PWR(5240, 5320, 23, 6, IEEE80211_CHAN_NO_IBSS |
+                                     IEEE80211_CHAN_RADAR),
+        /* IEEE 802.11a, channels 100..140 */
+        RANGE_PWR(5500, 5700, 30, 6, IEEE80211_CHAN_NO_IBSS |
+                                     IEEE80211_CHAN_RADAR),
+};
 #define REGDOM(_code)                                                   \
        {                                                               \
                .code = __stringify(_code),                             \
@@ -90,6 +107,7 @@ static const struct ieee80211_channel_range ieee80211_JP_channels[] = {
 static const struct ieee80211_regdomain ieee80211_regdoms[] = {
        REGDOM(US),
        REGDOM(JP),
+        REGDOM(EU),
 };
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b976d9ed10e4..04c41504f84c 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -277,9 +277,8 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
        memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
        x->props.flags = p->flags;
-        if (!x->sel.family)
+        if (!x->sel.family && !(p->flags & XFRM_STATE_AF_UNSPEC))
                x->sel.family = p->family;
 }
 /*
author	Ingo Molnar <mingo@elte.hu>	2008-07-18 12:43:08 -0400
committer	Ingo Molnar <mingo@elte.hu>	2008-07-18 12:43:08 -0400
commit	f1b0c8d3d3b5ff9c0b14bb2383a4bc38d8922bd1 (patch)
tree	b7d9f439d5b99d8b03bf490d4b17156414e48d45 /net
parent	d591b0a3ae25f587d0c4da1e1d1a425143590790 (diff)
parent	5b664cb235e97afbf34db9c4d77f08ebd725335e (diff)