Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

43 files changed, 245 insertions, 141 deletions

diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 2d24fb400e0c..56f3aa47e758 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/if_vlan.h>
 #include <linux/netfilter_bridge.h>
 #include "br_private.h"
 
@@ -29,10 +30,15 @@ static inline int should_deliver(const struct net_bridge_port *p,
         return 1;
 }
 
+static inline unsigned packet_length(const struct sk_buff *skb)
+{
+        return skb->len - (skb->protocol == htons(ETH_P_8021Q) ? VLAN_HLEN : 0);
+}
+
 int br_dev_queue_push_xmit(struct sk_buff *skb)
 {
         /* drop mtu oversized packets except tso */
-        if (skb->len > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
+        if (packet_length(skb) > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
                 kfree_skb(skb);
         else {
 #ifdef CONFIG_BRIDGE_NETFILTER
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 84b9af76f0a2..3a13ed643459 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -831,7 +831,7 @@ static int translate_table(struct ebt_replace *repl,
                         return -ENOMEM;
                 for_each_possible_cpu(i) {
                         newinfo->chainstack[i] =
-                           vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
+                          vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
                         if (!newinfo->chainstack[i]) {
                                 while (i)
                                         vfree(newinfo->chainstack[--i]);
@@ -841,8 +841,7 @@ static int translate_table(struct ebt_replace *repl,
                         }
                 }
 
-                cl_s = (struct ebt_cl_stack *)
-                   vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
+                cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
                 if (!cl_s)
                         return -ENOMEM;
                 i = 0; /* the i'th udc */
@@ -944,8 +943,7 @@ static int do_replace(void __user *user, unsigned int len)
 
         countersize = COUNTER_OFFSET(tmp.nentries) * 
                                         (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
         if (!newinfo)
                 return -ENOMEM;
 
@@ -967,8 +965,7 @@ static int do_replace(void __user *user, unsigned int len)
         /* the user wants counters back
            the check on the size is done later, when we have the lock */
         if (tmp.num_counters) {
-                counterstmp = (struct ebt_counter *)
-                   vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
+                counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
                 if (!counterstmp) {
                         ret = -ENOMEM;
                         goto free_entries;
@@ -1148,8 +1145,7 @@ int ebt_register_table(struct ebt_table *table)
 
         countersize = COUNTER_OFFSET(table->table->nentries) *
                                         (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
         ret = -ENOMEM;
         if (!newinfo)
                 return -ENOMEM;
@@ -1247,8 +1243,7 @@ static int update_counters(void __user *user, unsigned int len)
         if (hlp.num_counters == 0)
                 return -EINVAL;
 
-        if ( !(tmp = (struct ebt_counter *)
-           vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
+        if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
                 MEMPRINT("Update_counters && nomemory\n");
                 return -ENOMEM;
         }
@@ -1377,8 +1372,7 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
                         BUGPRINT("Num_counters wrong\n");
                         return -EINVAL;
                 }
-                counterstmp = (struct ebt_counter *)
-                   vmalloc(nentries * sizeof(struct ebt_counter));
+                counterstmp = vmalloc(nentries * sizeof(*counterstmp));
                 if (!counterstmp) {
                         MEMPRINT("Couldn't copy counters, out of memory\n");
                         return -ENOMEM;
diff --git a/net/core/dev.c b/net/core/dev.c
index 83231a27ae02..3bad1afc89fa 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2698,7 +2698,8 @@ int dev_ioctl(unsigned int cmd, void __user *arg)
                                 /* If command is `set a parameter', or
                                  * `get the encoding parameters', check if
                                  * the user has the right to do it */
-                                if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE) {
+                                if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE
+                                    || cmd == SIOCGIWENCODEEXT) {
                                         if (!capable(CAP_NET_ADMIN))
                                                 return -EPERM;
                                 }
diff --git a/net/core/filter.c b/net/core/filter.c
index 93fbd01d2259..5b4486a60cf6 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -34,6 +34,7 @@
 #include <linux/timer.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
+#include <asm/unaligned.h>
 #include <linux/filter.h>
 
 /* No hurry in this branch */
@@ -177,7 +178,7 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
 load_w:
                         ptr = load_pointer(skb, k, 4, &tmp);
                         if (ptr != NULL) {
-                                A = ntohl(*(u32 *)ptr);
+                                A = ntohl(get_unaligned((u32 *)ptr));
                                 continue;
                         }
                         break;
@@ -186,7 +187,7 @@ load_w:
 load_h:
                         ptr = load_pointer(skb, k, 2, &tmp);
                         if (ptr != NULL) {
-                                A = ntohs(*(u16 *)ptr);
+                                A = ntohs(get_unaligned((u16 *)ptr));
                                 continue;
                         }
                         break;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 09464fa8d72f..fb3770f9c094 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -112,6 +112,14 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
         BUG();
 }
 
+void skb_truesize_bug(struct sk_buff *skb)
+{
+        printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
+               "len=%u, sizeof(sk_buff)=%Zd\n",
+               skb->truesize, skb->len, sizeof(struct sk_buff));
+}
+EXPORT_SYMBOL(skb_truesize_bug);
+
 /*      Allocate a new skbuff. We do this ourselves so we can fill in a few
  *      'private' fields and also do memory statistics to find all the
  *      [BEEP] leaks.
diff --git a/net/core/stream.c b/net/core/stream.c
index 35e25259fd95..e9489696f694 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -176,6 +176,7 @@ void sk_stream_rfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
 
+        skb_truesize_check(skb);
         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
         sk->sk_forward_alloc += skb->truesize;
 }
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 81d6995fcfdb..d2bc72d318f7 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -1726,6 +1726,14 @@ int wireless_rtnetlink_get(struct net_device *	dev,
         if(!IW_IS_GET(request->cmd))
                 return -EOPNOTSUPP;
 
+        /* If command is `get the encoding parameters', check if
+         * the user has the right to do it */
+        if (request->cmd == SIOCGIWENCODE ||
+            request->cmd == SIOCGIWENCODEEXT) {
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+        }
+
         /* Special cases */
         if(request->cmd == SIOCGIWSTATS)
                 /* Get Wireless Stats */
diff --git a/net/ieee80211/softmac/Kconfig b/net/ieee80211/softmac/Kconfig
index 6cd9f3427be6..f2a27cc6ecb1 100644
--- a/net/ieee80211/softmac/Kconfig
+++ b/net/ieee80211/softmac/Kconfig
@@ -1,6 +1,7 @@
 config IEEE80211_SOFTMAC
         tristate "Software MAC add-on to the IEEE 802.11 networking stack"
         depends on IEEE80211 && EXPERIMENTAL
+        select WIRELESS_EXT
         ---help---
         This option enables the hardware independent software MAC addon
         for the IEEE 802.11 networking stack.
diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
index be61de78dfa4..fb79ce7d6439 100644
--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
+++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
@@ -101,6 +101,7 @@ ieee80211softmac_disassoc(struct ieee80211softmac_device *mac, u16 reason)
         /* Do NOT clear bssvalid as that will break ieee80211softmac_assoc_work! */
         mac->associated = 0;
         mac->associnfo.associating = 0;
+        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
         spin_unlock_irqrestore(&mac->lock, flags);
 }
 
@@ -143,6 +144,12 @@ network_matches_request(struct ieee80211softmac_device *mac, struct ieee80211_ne
         if (!we_support_all_basic_rates(mac, net->rates_ex, net->rates_ex_len))
                 return 0;
 
+        /* assume that users know what they're doing ...
+         * (note we don't let them select a net we're incompatible with) */
+        if (mac->associnfo.bssfixed) {
+                return !memcmp(mac->associnfo.bssid, net->bssid, ETH_ALEN);
+        }
+
         /* if 'ANY' network requested, take any that doesn't have privacy enabled */
         if (mac->associnfo.req_essid.len == 0 
             && !(net->capability & WLAN_CAPABILITY_PRIVACY))
@@ -175,7 +182,7 @@ ieee80211softmac_assoc_work(void *d)
                 ieee80211softmac_disassoc(mac, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
 
         /* try to find the requested network in our list, if we found one already */
-        if (mac->associnfo.bssvalid)
+        if (mac->associnfo.bssvalid || mac->associnfo.bssfixed)
                 found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);       
         
         /* Search the ieee80211 networks for this network if we didn't find it by bssid,
@@ -240,19 +247,25 @@ ieee80211softmac_assoc_work(void *d)
                         if (ieee80211softmac_start_scan(mac))
                                 dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n");
                         return;
-                }
-                else {
+                } else {
                         spin_lock_irqsave(&mac->lock, flags);
                         mac->associnfo.associating = 0;
                         mac->associated = 0;
                         spin_unlock_irqrestore(&mac->lock, flags);
 
                         dprintk(KERN_INFO PFX "Unable to find matching network after scan!\n");
+                        /* reset the retry counter for the next user request since we
+                         * break out and don't reschedule ourselves after this point. */
+                        mac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
                         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_NET_NOT_FOUND, NULL);
                         return;
                 }
         }
-        
+
+        /* reset the retry counter for the next user request since we
+         * now found a net and will try to associate to it, but not
+         * schedule this function again. */
+        mac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
         mac->associnfo.bssvalid = 1;
         memcpy(mac->associnfo.bssid, found->bssid, ETH_ALEN);
         /* copy the ESSID for displaying it */
@@ -373,6 +386,7 @@ ieee80211softmac_handle_disassoc(struct net_device * dev,
         spin_lock_irqsave(&mac->lock, flags);
         mac->associnfo.bssvalid = 0;
         mac->associated = 0;
+        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
         schedule_work(&mac->associnfo.work);
         spin_unlock_irqrestore(&mac->lock, flags);
         
@@ -391,6 +405,7 @@ ieee80211softmac_handle_reassoc_req(struct net_device * dev,
                 dprintkl(KERN_INFO PFX "reassoc request from unknown network\n");
                 return 0;
         }
-        ieee80211softmac_assoc(mac, network);
+        schedule_work(&mac->associnfo.work);
+
         return 0;
 }
diff --git a/net/ieee80211/softmac/ieee80211softmac_event.c b/net/ieee80211/softmac/ieee80211softmac_event.c
index 0a52bbda1e4c..8cc8f3f0f8e7 100644
--- a/net/ieee80211/softmac/ieee80211softmac_event.c
+++ b/net/ieee80211/softmac/ieee80211softmac_event.c
@@ -67,6 +67,7 @@ static char *event_descriptions[IEEE80211SOFTMAC_EVENT_LAST+1] = {
         "authenticating failed",
         "authenticating timed out",
         "associating failed because no suitable network was found",
+        "disassociated",
 };
 
 
@@ -128,13 +129,42 @@ void
 ieee80211softmac_call_events_locked(struct ieee80211softmac_device *mac, int event, void *event_ctx)
 {
         struct ieee80211softmac_event *eventptr, *tmp;
-        union iwreq_data wrqu;
-        char *msg;
+        struct ieee80211softmac_network *network;
         
         if (event >= 0) {
-                msg = event_descriptions[event];
-                wrqu.data.length = strlen(msg);
-                wireless_send_event(mac->dev, IWEVCUSTOM, &wrqu, msg);
+                union iwreq_data wrqu;
+                int we_event;
+                char *msg = NULL;
+
+                switch(event) {
+                case IEEE80211SOFTMAC_EVENT_ASSOCIATED:
+                        network = (struct ieee80211softmac_network *)event_ctx;
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memcpy(wrqu.ap_addr.sa_data, &network->bssid[0], ETH_ALEN);
+                        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        we_event = SIOCGIWAP;
+                        break;
+                case IEEE80211SOFTMAC_EVENT_DISASSOCIATED:
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memset(&wrqu, '\0', sizeof (union iwreq_data));
+                        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        we_event = SIOCGIWAP;
+                        break;
+                case IEEE80211SOFTMAC_EVENT_SCAN_FINISHED:
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memset(&wrqu, '\0', sizeof (union iwreq_data));
+                        we_event = SIOCGIWSCAN;
+                        break;
+                default:
+                        msg = event_descriptions[event];
+                        wrqu.data.length = strlen(msg);
+                        we_event = IWEVCUSTOM;
+                        break;
+                }
+                wireless_send_event(mac->dev, we_event, &wrqu, msg);
         }
 
         if (!list_empty(&mac->events))
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index febc51dbb412..cc6cd56c85b1 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -180,9 +180,21 @@ ieee80211softmac_assoc_req(struct ieee80211_assoc_request **pkt,
         ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_ASSOC_REQ, net->bssid, net->bssid);
 
         /* Fill in capability Info */
-        (*pkt)->capability = (mac->ieee->iw_mode == IW_MODE_MASTER) || (mac->ieee->iw_mode == IW_MODE_INFRA) ?
-                cpu_to_le16(WLAN_CAPABILITY_ESS) :
-                cpu_to_le16(WLAN_CAPABILITY_IBSS);
+        switch (mac->ieee->iw_mode) {
+        case IW_MODE_INFRA:
+                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
+                break;
+        case IW_MODE_ADHOC:
+                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_IBSS);
+                break;
+        case IW_MODE_AUTO:
+                (*pkt)->capability = net->capabilities & (WLAN_CAPABILITY_ESS|WLAN_CAPABILITY_IBSS);
+                break;
+        default:
+                /* bleh. we don't ever go to these modes */
+                printk(KERN_ERR PFX "invalid iw_mode!\n");
+                break;
+        }
         /* Need to add this
         (*pkt)->capability |= mac->ieee->short_slot ? 
                         cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME) : 0;
diff --git a/net/ieee80211/softmac/ieee80211softmac_module.c b/net/ieee80211/softmac/ieee80211softmac_module.c
index 60f06a31f0d1..be83bdc1644a 100644
--- a/net/ieee80211/softmac/ieee80211softmac_module.c
+++ b/net/ieee80211/softmac/ieee80211softmac_module.c
@@ -45,6 +45,8 @@ struct net_device *alloc_ieee80211softmac(int sizeof_priv)
         softmac->ieee->handle_disassoc = ieee80211softmac_handle_disassoc;
         softmac->scaninfo = NULL;
 
+        softmac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
+
         /* TODO: initialise all the other callbacks in the ieee struct
          *       (once they're written)
          */
diff --git a/net/ieee80211/softmac/ieee80211softmac_scan.c b/net/ieee80211/softmac/ieee80211softmac_scan.c
index bb9ab8b45d09..2b9e7edfa3ce 100644
--- a/net/ieee80211/softmac/ieee80211softmac_scan.c
+++ b/net/ieee80211/softmac/ieee80211softmac_scan.c
@@ -47,6 +47,7 @@ ieee80211softmac_start_scan(struct ieee80211softmac_device *sm)
         sm->scanning = 1;
         spin_unlock_irqrestore(&sm->lock, flags);
 
+        netif_tx_disable(sm->ieee->dev);
         ret = sm->start_scan(sm->dev);
         if (ret) {
                 spin_lock_irqsave(&sm->lock, flags);
@@ -239,6 +240,7 @@ void ieee80211softmac_scan_finished(struct ieee80211softmac_device *sm)
                 if (net)
                         sm->set_channel(sm->dev, net->channel);
         }
+        netif_wake_queue(sm->ieee->dev);
         ieee80211softmac_call_events(sm, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, NULL);
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_scan_finished);
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index b559aa9b5507..27edb2b5581a 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -27,7 +27,8 @@
 #include "ieee80211softmac_priv.h"
 
 #include <net/iw_handler.h>
-
+/* for is_broadcast_ether_addr and is_zero_ether_addr */
+#include <linux/etherdevice.h>
 
 int
 ieee80211softmac_wx_trigger_scan(struct net_device *net_dev,
@@ -41,13 +42,23 @@ ieee80211softmac_wx_trigger_scan(struct net_device *net_dev,
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_trigger_scan);
 
 
+/* if we're still scanning, return -EAGAIN so that userspace tools
+ * can get the complete scan results, otherwise return 0. */
 int
 ieee80211softmac_wx_get_scan_results(struct net_device *net_dev,
                                      struct iw_request_info *info,
                                      union iwreq_data *data,
                                      char *extra)
 {
+        unsigned long flags;
         struct ieee80211softmac_device *sm = ieee80211_priv(net_dev);
+
+        spin_lock_irqsave(&sm->lock, flags);
+        if (sm->scanning) {
+                spin_unlock_irqrestore(&sm->lock, flags);
+                return -EAGAIN;
+        }
+        spin_unlock_irqrestore(&sm->lock, flags);
         return ieee80211_wx_get_scan(sm->ieee, info, data, extra);
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_get_scan_results);
@@ -73,7 +84,6 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
                         sm->associnfo.static_essid = 1;
                 }
         }
-        sm->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
 
         /* set our requested ESSID length.
          * If applicable, we have already copied the data in */
@@ -300,8 +310,6 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
                             char *extra)
 {
         struct ieee80211softmac_device *mac = ieee80211_priv(net_dev);
-        static const unsigned char any[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-        static const unsigned char off[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
         unsigned long flags;
 
         /* sanity check */
@@ -310,10 +318,17 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
         }
 
         spin_lock_irqsave(&mac->lock, flags);
-        if (!memcmp(any, data->ap_addr.sa_data, ETH_ALEN) ||
-            !memcmp(off, data->ap_addr.sa_data, ETH_ALEN)) {
-                schedule_work(&mac->associnfo.work);
-                goto out;
+        if (is_broadcast_ether_addr(data->ap_addr.sa_data)) {
+                /* the bssid we have is not to be fixed any longer,
+                 * and we should reassociate to the best AP. */
+                mac->associnfo.bssfixed = 0;
+                /* force reassociation */
+                mac->associnfo.bssvalid = 0;
+                if (mac->associated)
+                        schedule_work(&mac->associnfo.work);
+        } else if (is_zero_ether_addr(data->ap_addr.sa_data)) {
+                /* the bssid we have is no longer fixed */
+                mac->associnfo.bssfixed = 0;
         } else {
                 if (!memcmp(mac->associnfo.bssid, data->ap_addr.sa_data, ETH_ALEN)) {
                         if (mac->associnfo.associating || mac->associated) {
@@ -323,12 +338,14 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
                 } else {
                         /* copy new value in data->ap_addr.sa_data to bssid */
                         memcpy(mac->associnfo.bssid, data->ap_addr.sa_data, ETH_ALEN);
-                }       
+                }
+                /* tell the other code that this bssid should be used no matter what */
+                mac->associnfo.bssfixed = 1;
                 /* queue associate if new bssid or (old one again and not associated) */
                 schedule_work(&mac->associnfo.work);
         }
 
-out:
+ out:
         spin_unlock_irqrestore(&mac->lock, flags);
         return 0;
 }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index dc206f1f914f..0a277453526b 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1257,7 +1257,7 @@ out_unregister_udp_proto:
         goto out;
 }
 
-module_init(inet_init);
+fs_initcall(inet_init);
 
 /* ------------------------------------------------------------------------ */
 
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 04a429465665..cd810f41af1a 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -290,11 +290,8 @@ static void ipcomp_free_scratches(void)
         if (!scratches)
                 return;
 
-        for_each_possible_cpu(i) {
-                void *scratch = *per_cpu_ptr(scratches, i);
-                if (scratch)
-                        vfree(scratch);
-        }
+        for_each_possible_cpu(i)
+                vfree(*per_cpu_ptr(scratches, i));
 
         free_percpu(scratches);
 }
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index c60fd5c4ea1e..3d560dec63ab 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -345,7 +345,7 @@ config IP_NF_TARGET_LOG
           To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_TARGET_ULOG
-        tristate "ULOG target support (OBSOLETE)"
+        tristate "ULOG target support"
         depends on IP_NF_IPTABLES
         ---help---
 
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
index 5259abd0fb42..0416073c5600 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
@@ -235,12 +235,15 @@ static int do_basic_checks(struct ip_conntrack *conntrack,
                         flag = 1;
                 }
 
-                /* Cookie Ack/Echo chunks not the first OR 
-                   Init / Init Ack / Shutdown compl chunks not the only chunks */
-                if ((sch->type == SCTP_CID_COOKIE_ACK 
+                /*
+                 * Cookie Ack/Echo chunks not the first OR
+                 * Init / Init Ack / Shutdown compl chunks not the only chunks
+                 * OR zero-length.
+                 */
+                if (((sch->type == SCTP_CID_COOKIE_ACK
                         || sch->type == SCTP_CID_COOKIE_ECHO
                         || flag)
-                     && count !=0 ) {
+                      && count !=0) || !sch->length) {
                         DEBUGP("Basic checks failed\n");
                         return 1;
                 }
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index d25ac8ba6eba..6d1c11563943 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -956,15 +956,16 @@ struct compat_ipt_standard_target
         compat_int_t verdict;
 };
 
-#define IPT_ST_OFFSET   (sizeof(struct ipt_standard_target) - \
-                                sizeof(struct compat_ipt_standard_target))
-
 struct compat_ipt_standard
 {
         struct compat_ipt_entry entry;
         struct compat_ipt_standard_target target;
 };
 
+#define IPT_ST_LEN              XT_ALIGN(sizeof(struct ipt_standard_target))
+#define IPT_ST_COMPAT_LEN       COMPAT_XT_ALIGN(sizeof(struct compat_ipt_standard_target))
+#define IPT_ST_OFFSET           (IPT_ST_LEN - IPT_ST_COMPAT_LEN)
+
 static int compat_ipt_standard_fn(void *target,
                 void **dstptr, int *size, int convert)
 {
@@ -975,35 +976,29 @@ static int compat_ipt_standard_fn(void *target,
         ret = 0;
         switch (convert) {
                 case COMPAT_TO_USER:
-                        pst = (struct ipt_standard_target *)target;
+                        pst = target;
                         memcpy(&compat_st.target, &pst->target,
-                                        sizeof(struct ipt_entry_target));
+                                sizeof(compat_st.target));
                         compat_st.verdict = pst->verdict;
                         if (compat_st.verdict > 0)
                                 compat_st.verdict -=
                                         compat_calc_jump(compat_st.verdict);
-                        compat_st.target.u.user.target_size =
-                        sizeof(struct compat_ipt_standard_target);
-                        if (__copy_to_user(*dstptr, &compat_st,
-                                sizeof(struct compat_ipt_standard_target)))
+                        compat_st.target.u.user.target_size = IPT_ST_COMPAT_LEN;
+                        if (copy_to_user(*dstptr, &compat_st, IPT_ST_COMPAT_LEN))
                                 ret = -EFAULT;
                         *size -= IPT_ST_OFFSET;
-                        *dstptr += sizeof(struct compat_ipt_standard_target);
+                        *dstptr += IPT_ST_COMPAT_LEN;
                         break;
                 case COMPAT_FROM_USER:
-                        pcompat_st =
-                                (struct compat_ipt_standard_target *)target;
-                        memcpy(&st.target, &pcompat_st->target,
-                                        sizeof(struct ipt_entry_target));
+                        pcompat_st = target;
+                        memcpy(&st.target, &pcompat_st->target, IPT_ST_COMPAT_LEN);
                         st.verdict = pcompat_st->verdict;
                         if (st.verdict > 0)
                                 st.verdict += compat_calc_jump(st.verdict);
-                        st.target.u.user.target_size =
-                        sizeof(struct ipt_standard_target);
-                        memcpy(*dstptr, &st,
-                                        sizeof(struct ipt_standard_target));
+                        st.target.u.user.target_size = IPT_ST_LEN;
+                        memcpy(*dstptr, &st, IPT_ST_LEN);
                         *size += IPT_ST_OFFSET;
-                        *dstptr += sizeof(struct ipt_standard_target);
+                        *dstptr += IPT_ST_LEN;
                         break;
                 case COMPAT_CALC_SIZE:
                         *size += IPT_ST_OFFSET;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ff434821909f..cc9423de7311 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2741,7 +2741,10 @@ int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
         /* Reserve room for dummy headers, this skb can pass
            through good chunk of routing engine.
          */
-        skb->mac.raw = skb->data;
+        skb->mac.raw = skb->nh.raw = skb->data;
+
+        /* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
+        skb->nh.iph->protocol = IPPROTO_ICMP;
         skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
 
         if (rta[RTA_SRC - 1])
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index b871db6adc55..743016baa048 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -465,7 +465,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         TCP_INC_STATS(TCP_MIB_OUTSEGS);
 
         err = icsk->icsk_af_ops->queue_xmit(skb, 0);
-        if (unlikely(err <= 0))
+        if (likely(err <= 0))
                 return err;
 
         tcp_enter_cwr(sk);
@@ -533,6 +533,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *buff;
         int nsize, old_factor;
+        int nlen;
         u16 flags;
 
         BUG_ON(len > skb->len);
@@ -551,7 +552,11 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
         if (buff == NULL)
                 return -ENOMEM; /* We'll just try again later. */
+
         sk_charge_skb(sk, buff);
+        nlen = skb->len - len - nsize;
+        buff->truesize += nlen;
+        skb->truesize -= nlen;
 
         /* Correct the sequence numbers. */
         TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
@@ -1037,7 +1042,8 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
         if (unlikely(buff == NULL))
                 return -ENOMEM;
 
-        buff->truesize = nlen;
+        sk_charge_skb(sk, buff);
+        buff->truesize += nlen;
         skb->truesize -= nlen;
 
         /* Correct the sequence numbers. */
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 32ad229b4fed..4ef8efaf6a67 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -62,7 +62,7 @@ static void xfrm4_encap(struct sk_buff *skb)
         top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
                 0 : (iph->frag_off & htons(IP_DF));
         if (!top_iph->frag_off)
-                __ip_select_ident(top_iph, dst, 0);
+                __ip_select_ident(top_iph, dst->child, 0);
 
         top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT);
 
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 2a1e7e45b890..a18d4256372c 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -485,15 +485,27 @@ static struct tlvtype_proc tlvprochopopt_lst[] = {
         { -1, }
 };
 
-int ipv6_parse_hopopts(struct sk_buff *skb, int nhoff)
+int ipv6_parse_hopopts(struct sk_buff *skb)
 {
         struct inet6_skb_parm *opt = IP6CB(skb);
 
+        /*
+         * skb->nh.raw is equal to skb->data, and
+         * skb->h.raw - skb->nh.raw is always equal to
+         * sizeof(struct ipv6hdr) by definition of
+         * hop-by-hop options.
+         */
+        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
+            !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) {
+                kfree_skb(skb);
+                return -1;
+        }
+
         opt->hop = sizeof(struct ipv6hdr);
         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
                 skb->h.raw += (skb->h.raw[1]+1)<<3;
                 opt->nhoff = sizeof(struct ipv6hdr);
-                return sizeof(struct ipv6hdr);
+                return 1;
         }
         return -1;
 }
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 29f73592e68e..aceee252503d 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -114,11 +114,10 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         }
 
         if (hdr->nexthdr == NEXTHDR_HOP) {
-                if (ipv6_parse_hopopts(skb, IP6CB(skb)->nhoff) < 0) {
+                if (ipv6_parse_hopopts(skb) < 0) {
                         IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
                         return 0;
                 }
-                hdr = skb->nh.ipv6h;
         }
 
         return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 642b4b11464f..0a673038344f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -288,19 +288,6 @@ ip6t_do_table(struct sk_buff **pskb,
         table_base = (void *)private->entries[smp_processor_id()];
         e = get_entry(table_base, private->hook_entry[hook]);
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        /* Check noone else using our table */
-        if (((struct ip6t_entry *)table_base)->comefrom != 0xdead57ac
-            && ((struct ip6t_entry *)table_base)->comefrom != 0xeeeeeeec) {
-                printk("ASSERT: CPU #%u, %s comefrom(%p) = %X\n",
-                       smp_processor_id(),
-                       table->name,
-                       &((struct ip6t_entry *)table_base)->comefrom,
-                       ((struct ip6t_entry *)table_base)->comefrom);
-        }
-        ((struct ip6t_entry *)table_base)->comefrom = 0x57acc001;
-#endif
-
         /* For return from builtin chain */
         back = get_entry(table_base, private->underflow[hook]);
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 79078747a646..0190e39096b9 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -317,7 +317,7 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
                   __FUNCTION__, head, head ? *head : NULL, oif);
 
         for (rt = rt0, metric = rt0->rt6i_metric;
-             rt && rt->rt6i_metric == metric;
+             rt && rt->rt6i_metric == metric && (!last || rt != rt0);
              rt = rt->u.next) {
                 int m;
 
@@ -343,9 +343,12 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
             (strict & RT6_SELECT_F_REACHABLE) &&
             last && last != rt0) {
                 /* no entries matched; do round-robin */
+                static spinlock_t lock = SPIN_LOCK_UNLOCKED;
+                spin_lock(&lock);
                 *head = rt0->u.next;
                 rt0->u.next = last->u.next;
                 last->u.next = rt0;
+                spin_unlock(&lock);
         }
 
         RT6_TRACE("%s() => %p, score=%d\n",
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 91cce8b2d7a5..88c840f1beb6 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -191,16 +191,18 @@ error:
 static inline void
 _decode_session6(struct sk_buff *skb, struct flowi *fl)
 {
-        u16 offset = sizeof(struct ipv6hdr);
+        u16 offset = skb->h.raw - skb->nh.raw;
         struct ipv6hdr *hdr = skb->nh.ipv6h;
-        struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
-        u8 nexthdr = skb->nh.ipv6h->nexthdr;
+        struct ipv6_opt_hdr *exthdr;
+        u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
 
         memset(fl, 0, sizeof(struct flowi));
         ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
         ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
 
         while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
+                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+
                 switch (nexthdr) {
                 case NEXTHDR_ROUTING:
                 case NEXTHDR_HOP:
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 8f3addf0724c..d62e0f9b9da3 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -118,7 +118,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
                 u16 pdulen = eth_hdr(skb)->h_proto,
                     data_size = ntohs(pdulen) - llc_len;
 
-                skb_trim(skb, data_size);
+                if (unlikely(pskb_trim_rcsum(skb, data_size)))
+                        return 0;
         }
         return 1;
 }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e581190fb6c3..f9b83f91371a 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -178,9 +178,6 @@ static struct {
         /* allocated slab cache + modules which uses this slab cache */
         int use;
 
-        /* Initialization */
-        int (*init_conntrack)(struct nf_conn *, u_int32_t);
-
 } nf_ct_cache[NF_CT_F_NUM];
 
 /* protect members of nf_ct_cache except of "use" */
@@ -208,10 +205,8 @@ nf_ct_proto_find_get(u_int16_t l3proto, u_int8_t protocol)
 
         preempt_disable();
         p = __nf_ct_proto_find(l3proto, protocol);
-        if (p) {
-                if (!try_module_get(p->me))
-                        p = &nf_conntrack_generic_protocol;
-        }
+        if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_protocol;
         preempt_enable();
         
         return p;
@@ -229,10 +224,8 @@ nf_ct_l3proto_find_get(u_int16_t l3proto)
 
         preempt_disable();
         p = __nf_ct_l3proto_find(l3proto);
-        if (p) {
-                if (!try_module_get(p->me))
-                        p = &nf_conntrack_generic_l3proto;
-        }
+        if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_l3proto;
         preempt_enable();
 
         return p;
diff --git a/net/netfilter/nf_conntrack_l3proto_generic.c b/net/netfilter/nf_conntrack_l3proto_generic.c
index 7de4f06c63c5..3fc58e454d4e 100644
--- a/net/netfilter/nf_conntrack_l3proto_generic.c
+++ b/net/netfilter/nf_conntrack_l3proto_generic.c
@@ -94,5 +94,4 @@ struct nf_conntrack_l3proto nf_conntrack_generic_l3proto = {
         .print_conntrack = generic_print_conntrack,
         .prepare         = generic_prepare,
         .get_features    = generic_get_features,
-        .me              = THIS_MODULE,
 };
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 9cccc325b687..0c6da496cfa9 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -240,12 +240,15 @@ static int do_basic_checks(struct nf_conn *conntrack,
                         flag = 1;
                 }
 
-                /* Cookie Ack/Echo chunks not the first OR 
-                   Init / Init Ack / Shutdown compl chunks not the only chunks */
-                if ((sch->type == SCTP_CID_COOKIE_ACK 
+                /*
+                 * Cookie Ack/Echo chunks not the first OR
+                 * Init / Init Ack / Shutdown compl chunks not the only chunks
+                 * OR zero-length.
+                 */
+                if (((sch->type == SCTP_CID_COOKIE_ACK
                         || sch->type == SCTP_CID_COOKIE_ECHO
                         || flag)
-                     && count !=0 ) {
+                      && count !=0) || !sch->length) {
                         DEBUGP("Basic checks failed\n");
                         return 1;
                 }
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 00cf0a4f4d92..17abf60f9570 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -529,6 +529,7 @@ int xt_register_table(struct xt_table *table,
 
         /* Simplifies replace_table code. */
         table->private = bootstrap;
+        rwlock_init(&table->lock);
         if (!xt_replace_table(table, 0, newinfo, &ret))
                 goto unlock;
 
@@ -538,7 +539,6 @@ int xt_register_table(struct xt_table *table,
         /* save number of initial entries */
         private->initial_entries = private->number;
 
-        rwlock_init(&table->lock);
         list_prepend(&xt[table->af].tables, table);
 
         ret = 0;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2a233ffcf618..3862e73d14d7 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -56,12 +56,12 @@
 #include <linux/mm.h>
 #include <linux/types.h>
 #include <linux/audit.h>
+#include <linux/selinux.h>
 
 #include <net/sock.h>
 #include <net/scm.h>
 #include <net/netlink.h>
 
-#define Nprintk(a...)
 #define NLGRPSZ(x)      (ALIGN(x, sizeof(unsigned long) * 8) / 8)
 
 struct netlink_sock {
@@ -1157,6 +1157,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
         NETLINK_CB(skb).dst_pid = dst_pid;
         NETLINK_CB(skb).dst_group = dst_group;
         NETLINK_CB(skb).loginuid = audit_get_loginuid(current->audit_context);
+        selinux_get_task_sid(current, &(NETLINK_CB(skb).sid));
         memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
 
         /* What can I do? Netlink is asynchronous, so that
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 6056d20ef429..37640c6fc014 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -69,6 +69,11 @@ ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
         DPRINTK("ipt_init_target: found %s\n", target->name);
         t->u.kernel.target = target;
 
+        ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
+                              table, hook, 0, 0);
+        if (ret)
+                return ret;
+
         if (t->u.kernel.target->checkentry
             && !t->u.kernel.target->checkentry(table, NULL,
                                                t->u.kernel.target, t->data,
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 7228d30512c7..5a4a4d0ae502 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -167,7 +167,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (count == 0) {
                 sch->qstats.drops++;
                 kfree_skb(skb);
-                return NET_XMIT_DROP;
+                return NET_XMIT_BYPASS;
         }
 
         /*
diff --git a/net/socket.c b/net/socket.c
index 23898f45f713..02948b622bd2 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -267,6 +267,8 @@ int move_addr_to_user(void *kaddr, int klen, void __user *uaddr, int __user *ule
                 return -EINVAL;
         if(len)
         {
+                if (audit_sockaddr(klen, kaddr))
+                        return -ENOMEM;
                 if(copy_to_user(uaddr,kaddr,len))
                         return -EFAULT;
         }
@@ -490,6 +492,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
         struct file *file;
         struct socket *sock;
 
+        *err = -EBADF;
         file = fget_light(fd, fput_needed);
         if (file) {
                 sock = sock_from_file(file, err);
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 900ef31f5a0e..519ebc17c028 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -794,7 +794,6 @@ gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
 
 out_err:
         dprintk("RPC:      gss_create_cred failed with error %d\n", err);
-        if (cred) gss_destroy_cred(&cred->gc_base);
         return ERR_PTR(err);
 }
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 97c981fa6b8e..76b969e6904f 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -212,7 +212,6 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
         char                            *cksumname;
         struct crypto_tfm               *tfm = NULL; /* XXX add to ctx? */
         struct scatterlist              sg[1];
-        u32                             code = GSS_S_FAILURE;
 
         switch (cksumtype) {
                 case CKSUMTYPE_RSA_MD5:
@@ -221,13 +220,11 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
                 default:
                         dprintk("RPC:      krb5_make_checksum:"
                                 " unsupported checksum %d", cksumtype);
-                        goto out;
+                        return GSS_S_FAILURE;
         }
         if (!(tfm = crypto_alloc_tfm(cksumname, CRYPTO_TFM_REQ_MAY_SLEEP)))
-                goto out;
+                return GSS_S_FAILURE;
         cksum->len = crypto_tfm_alg_digestsize(tfm);
-        if ((cksum->data = kmalloc(cksum->len, GFP_KERNEL)) == NULL)
-                goto out;
 
         crypto_digest_init(tfm);
         sg_set_buf(sg, header, hdrlen);
@@ -235,10 +232,8 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
         process_xdr_buf(body, body_offset, body->len - body_offset,
                         checksummer, tfm);
         crypto_digest_final(tfm, cksum->data);
-        code = 0;
-out:
         crypto_free_tfm(tfm);
-        return code;
+        return 0;
 }
 
 EXPORT_SYMBOL(make_checksum);
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index dea529666d69..15c2db26767b 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -176,7 +176,8 @@ void rpc_count_iostats(struct rpc_task *task)
         op_metrics->om_execute += execute;
 }
 
-void _print_name(struct seq_file *seq, unsigned int op, struct rpc_procinfo *procs)
+static void _print_name(struct seq_file *seq, unsigned int op,
+                        struct rpc_procinfo *procs)
 {
         if (procs[op].p_name)
                 seq_printf(seq, "\t%12s: ", procs[op].p_name);
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 953307a9df1d..a3bbc891f959 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -229,8 +229,7 @@ static void node_is_down(struct publication *publ)
                                      publ->node, publ->ref, publ->key);
         assert(p == publ);
         write_unlock_bh(&tipc_nametbl_lock);
-        if (publ)
-                kfree(publ);
+        kfree(publ);
 }
 
 /**
diff --git a/net/x25/x25_timer.c b/net/x25/x25_timer.c
index 0a92e1da3922..71ff3088f6fe 100644
--- a/net/x25/x25_timer.c
+++ b/net/x25/x25_timer.c
@@ -114,8 +114,9 @@ static void x25_heartbeat_expiry(unsigned long param)
                         if (sock_flag(sk, SOCK_DESTROY) ||
                             (sk->sk_state == TCP_LISTEN &&
                              sock_flag(sk, SOCK_DEAD))) {
+                                bh_unlock_sock(sk);
                                 x25_destroy_socket(sk);
-                                goto unlock;
+                                return;
                         }
                         break;
 
@@ -128,7 +129,6 @@ static void x25_heartbeat_expiry(unsigned long param)
         }
 restart_heartbeat:
         x25_start_heartbeat(sk);
-unlock:
         bh_unlock_sock(sk);
 }
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index c3725fe2a8fb..b469c8b54613 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -57,12 +57,12 @@ int xfrm_register_type(struct xfrm_type *type, unsigned short family)
                 return -EAFNOSUPPORT;
         typemap = afinfo->type_map;
 
-        write_lock(&typemap->lock);
+        write_lock_bh(&typemap->lock);
         if (likely(typemap->map[type->proto] == NULL))
                 typemap->map[type->proto] = type;
         else
                 err = -EEXIST;
-        write_unlock(&typemap->lock);
+        write_unlock_bh(&typemap->lock);
         xfrm_policy_put_afinfo(afinfo);
         return err;
 }
@@ -78,12 +78,12 @@ int xfrm_unregister_type(struct xfrm_type *type, unsigned short family)
                 return -EAFNOSUPPORT;
         typemap = afinfo->type_map;
 
-        write_lock(&typemap->lock);
+        write_lock_bh(&typemap->lock);
         if (unlikely(typemap->map[type->proto] != type))
                 err = -ENOENT;
         else
                 typemap->map[type->proto] = NULL;
-        write_unlock(&typemap->lock);
+        write_unlock_bh(&typemap->lock);
         xfrm_policy_put_afinfo(afinfo);
         return err;
 }
@@ -1251,7 +1251,7 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                 return -EINVAL;
         if (unlikely(afinfo->family >= NPROTO))
                 return -EAFNOSUPPORT;
-        write_lock(&xfrm_policy_afinfo_lock);
+        write_lock_bh(&xfrm_policy_afinfo_lock);
         if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL))
                 err = -ENOBUFS;
         else {
@@ -1268,7 +1268,7 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                         afinfo->garbage_collect = __xfrm_garbage_collect;
                 xfrm_policy_afinfo[afinfo->family] = afinfo;
         }
-        write_unlock(&xfrm_policy_afinfo_lock);
+        write_unlock_bh(&xfrm_policy_afinfo_lock);
         return err;
 }
 EXPORT_SYMBOL(xfrm_policy_register_afinfo);
@@ -1280,7 +1280,7 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
                 return -EINVAL;
         if (unlikely(afinfo->family >= NPROTO))
                 return -EAFNOSUPPORT;
-        write_lock(&xfrm_policy_afinfo_lock);
+        write_lock_bh(&xfrm_policy_afinfo_lock);
         if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) {
                 if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo))
                         err = -EINVAL;
@@ -1294,7 +1294,7 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
                         afinfo->garbage_collect = NULL;
                 }
         }
-        write_unlock(&xfrm_policy_afinfo_lock);
+        write_unlock_bh(&xfrm_policy_afinfo_lock);
         return err;
 }
 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 3dc3e1f3b7aa..93a2f36ad3db 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1061,7 +1061,7 @@ int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
                 return -EINVAL;
         if (unlikely(afinfo->family >= NPROTO))
                 return -EAFNOSUPPORT;
-        write_lock(&xfrm_state_afinfo_lock);
+        write_lock_bh(&xfrm_state_afinfo_lock);
         if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
                 err = -ENOBUFS;
         else {
@@ -1069,7 +1069,7 @@ int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
                 afinfo->state_byspi = xfrm_state_byspi;
                 xfrm_state_afinfo[afinfo->family] = afinfo;
         }
-        write_unlock(&xfrm_state_afinfo_lock);
+        write_unlock_bh(&xfrm_state_afinfo_lock);
         return err;
 }
 EXPORT_SYMBOL(xfrm_state_register_afinfo);
@@ -1081,7 +1081,7 @@ int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
                 return -EINVAL;
         if (unlikely(afinfo->family >= NPROTO))
                 return -EAFNOSUPPORT;
-        write_lock(&xfrm_state_afinfo_lock);
+        write_lock_bh(&xfrm_state_afinfo_lock);
         if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
                 if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
                         err = -EINVAL;
@@ -1091,7 +1091,7 @@ int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
                         afinfo->state_bydst = NULL;
                 }
         }
-        write_unlock(&xfrm_state_afinfo_lock);
+        write_unlock_bh(&xfrm_state_afinfo_lock);
         return err;
 }
 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);