Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	drivers/net/usb/cdc_ether.c

All CDC ethernet devices of type USB_CLASS_COMM need to use
'&mbm_info'.

Signed-off-by: David S. Miller <davem@davemloft.net>

19 files changed, 139 insertions, 108 deletions

diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 2117e5ba24c8..a6f74b2b9571 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -377,12 +377,16 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         struct net_bridge_port *p;
         int err = 0;
 
-        if (dev->flags & IFF_LOOPBACK || dev->type != ARPHRD_ETHER)
+        /* Don't allow bridging non-ethernet like devices */
+        if ((dev->flags & IFF_LOOPBACK) ||
+            dev->type != ARPHRD_ETHER || dev->addr_len != ETH_ALEN)
                 return -EINVAL;
 
+        /* No bridging of bridges */
         if (dev->netdev_ops->ndo_start_xmit == br_dev_xmit)
                 return -ELOOP;
 
+        /* Device is already being bridged */
         if (dev->br_port != NULL)
                 return -EBUSY;
 
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 4d57f5e12b05..95c2e0840d0d 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -224,6 +224,15 @@ void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
         consume_skb(skb);
         sk_mem_reclaim_partial(sk);
 }
+EXPORT_SYMBOL(skb_free_datagram);
+
+void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb)
+{
+        lock_sock(sk);
+        skb_free_datagram(sk, skb);
+        release_sock(sk);
+}
+EXPORT_SYMBOL(skb_free_datagram_locked);
 
 /**
  *      skb_kill_datagram - Free a datagram skbuff forcibly
@@ -753,5 +762,4 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
 EXPORT_SYMBOL(datagram_poll);
 EXPORT_SYMBOL(skb_copy_and_csum_datagram_iovec);
 EXPORT_SYMBOL(skb_copy_datagram_iovec);
-EXPORT_SYMBOL(skb_free_datagram);
 EXPORT_SYMBOL(skb_recv_datagram);
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index 26b0ab1e9f56..2036568beea9 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -263,11 +263,10 @@ static int dn_def_dev_strategy(ctl_table *table,
                         return -ENODEV;
 
                 rv = -ENODEV;
-                if (dev->dn_ptr != NULL) {
+                if (dev->dn_ptr != NULL)
                         rv = dn_dev_set_default(dev, 1);
-                        if (rv)
-                                dev_put(dev);
-                }
+                if (rv)
+                        dev_put(dev);
         }
 
         return rv;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index f73dbed0f0d7..816e2180bd60 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -229,14 +229,17 @@ unsigned int inet_dev_addr_type(struct net *net, const struct net_device *dev,
  */
 
 int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
-                        struct net_device *dev, __be32 *spec_dst, u32 *itag)
+                        struct net_device *dev, __be32 *spec_dst,
+                        u32 *itag, u32 mark)
 {
         struct in_device *in_dev;
         struct flowi fl = { .nl_u = { .ip4_u =
                                       { .daddr = src,
                                         .saddr = dst,
                                         .tos = tos } },
+                            .mark = mark,
                             .iif = oif };
+
         struct fib_result res;
         int no_addr, rpf;
         int ret;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index a77807d449e3..71a3242fb7d0 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1476,7 +1476,7 @@ static void ipgre_tap_setup(struct net_device *dev)
 
         ether_setup(dev);
 
-        dev->netdev_ops         = &ipgre_netdev_ops;
+        dev->netdev_ops         = &ipgre_tap_netdev_ops;
         dev->destructor         = free_netdev;
 
         dev->iflink             = 0;
@@ -1537,25 +1537,29 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
                 if (t->dev != dev)
                         return -EEXIST;
         } else {
-                unsigned nflags = 0;
-
                 t = nt;
 
-                if (ipv4_is_multicast(p.iph.daddr))
-                        nflags = IFF_BROADCAST;
-                else if (p.iph.daddr)
-                        nflags = IFF_POINTOPOINT;
+                if (dev->type != ARPHRD_ETHER) {
+                        unsigned nflags = 0;
 
-                if ((dev->flags ^ nflags) &
-                    (IFF_POINTOPOINT | IFF_BROADCAST))
-                        return -EINVAL;
+                        if (ipv4_is_multicast(p.iph.daddr))
+                                nflags = IFF_BROADCAST;
+                        else if (p.iph.daddr)
+                                nflags = IFF_POINTOPOINT;
+
+                        if ((dev->flags ^ nflags) &
+                            (IFF_POINTOPOINT | IFF_BROADCAST))
+                                return -EINVAL;
+                }
 
                 ipgre_tunnel_unlink(ign, t);
                 t->parms.iph.saddr = p.iph.saddr;
                 t->parms.iph.daddr = p.iph.daddr;
                 t->parms.i_key = p.i_key;
-                memcpy(dev->dev_addr, &p.iph.saddr, 4);
-                memcpy(dev->broadcast, &p.iph.daddr, 4);
+                if (dev->type != ARPHRD_ETHER) {
+                        memcpy(dev->dev_addr, &p.iph.saddr, 4);
+                        memcpy(dev->broadcast, &p.iph.daddr, 4);
+                }
                 ipgre_tunnel_link(ign, t);
                 netdev_state_change(dev);
         }
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 68afc6ecd343..fe1a64479dd0 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -750,6 +750,8 @@ static int __init nf_nat_init(void)
         BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
         rcu_assign_pointer(nfnetlink_parse_nat_setup_hook,
                            nfnetlink_parse_nat_setup);
+        BUG_ON(nf_ct_nat_offset != NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset);
         return 0;
 
  cleanup_extend:
@@ -764,6 +766,7 @@ static void __exit nf_nat_cleanup(void)
         nf_ct_extend_unregister(&nat_extend);
         rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
         rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, NULL);
         synchronize_net();
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 09172a65d9b6..f9520fa3aba9 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -73,6 +73,28 @@ adjust_tcp_sequence(u32 seq,
         DUMP_OFFSET(this_way);
 }
 
+/* Get the offset value, for conntrack */
+s16 nf_nat_get_offset(const struct nf_conn *ct,
+                      enum ip_conntrack_dir dir,
+                      u32 seq)
+{
+        struct nf_conn_nat *nat = nfct_nat(ct);
+        struct nf_nat_seq *this_way;
+        s16 offset;
+
+        if (!nat)
+                return 0;
+
+        this_way = &nat->seq[dir];
+        spin_lock_bh(&nf_nat_seqofs_lock);
+        offset = after(seq, this_way->correction_pos)
+                 ? this_way->offset_after : this_way->offset_before;
+        spin_unlock_bh(&nf_nat_seqofs_lock);
+
+        return offset;
+}
+EXPORT_SYMBOL_GPL(nf_nat_get_offset);
+
 /* Frobs data inside this packet, which is linear. */
 static void mangle_contents(struct sk_buff *skb,
                             unsigned int dataoff,
@@ -189,11 +211,6 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                 adjust_tcp_sequence(ntohl(tcph->seq),
                                     (int)rep_len - (int)match_len,
                                     ct, ctinfo);
-                /* Tell TCP window tracking about seq change */
-                nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
-                                        ct, CTINFO2DIR(ctinfo),
-                                        (int)rep_len - (int)match_len);
-
                 nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
         }
         return 1;
@@ -415,12 +432,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         tcph->seq = newseq;
         tcph->ack_seq = newack;
 
-        if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
-                return 0;
-
-        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
-
-        return 1;
+        return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
 }
 
 /* Setup NAT on this expected conntrack so it follows master. */
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 68fb22702051..ff258b57680b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1851,7 +1851,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                         goto e_inval;
                 spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
         } else if (fib_validate_source(saddr, 0, tos, 0,
-                                        dev, &spec_dst, &itag) < 0)
+                                        dev, &spec_dst, &itag, 0) < 0)
                 goto e_inval;
 
         rth = dst_alloc(&ipv4_dst_ops);
@@ -1964,7 +1964,7 @@ static int __mkroute_input(struct sk_buff *skb,
 
 
         err = fib_validate_source(saddr, daddr, tos, FIB_RES_OIF(*res),
-                                  in_dev->dev, &spec_dst, &itag);
+                                  in_dev->dev, &spec_dst, &itag, skb->mark);
         if (err < 0) {
                 ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
                                          saddr);
@@ -2138,7 +2138,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 int result;
                 result = fib_validate_source(saddr, daddr, tos,
                                              net->loopback_dev->ifindex,
-                                             dev, &spec_dst, &itag);
+                                             dev, &spec_dst, &itag, skb->mark);
                 if (result < 0)
                         goto martian_source;
                 if (result)
@@ -2167,7 +2167,7 @@ brd_input:
                 spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
         else {
                 err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
-                                          &itag);
+                                          &itag, skb->mark);
                 if (err < 0)
                         goto martian_source;
                 if (err)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4274c1cc78fd..d5e75e976513 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1005,9 +1005,7 @@ try_again:
                 err = ulen;
 
 out_free:
-        lock_sock(sk);
-        skb_free_datagram(sk, skb);
-        release_sock(sk);
+        skb_free_datagram_locked(sk, skb);
 out:
         return err;
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index bbe2f3e445fc..5bc7cdbf030a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -288,9 +288,7 @@ try_again:
                 err = ulen;
 
 out_free:
-        lock_sock(sk);
-        skb_free_datagram(sk, skb);
-        release_sock(sk);
+        skb_free_datagram_locked(sk, skb);
 out:
         return err;
 
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index bd765f30dba2..b09948ceec4a 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -666,26 +666,25 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
 
+        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+
         spin_lock_bh(&sta->lock);
 
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->lock);
-                return;
-        }
+        if (!(*state & HT_ADDBA_REQUESTED_MSK))
+                goto timer_still_needed;
 
         if (mgmt->u.action.u.addba_resp.dialog_token !=
                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
-                spin_unlock_bh(&sta->lock);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
-                return;
+                goto timer_still_needed;
         }
 
-        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
+
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                         == WLAN_STATUS_SUCCESS) {
                 u8 curstate = *state;
@@ -699,5 +698,11 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
         } else {
                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);
         }
+
+        goto out;
+
+ timer_still_needed:
+        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+ out:
         spin_unlock_bh(&sta->lock);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 5608f6c68413..7b5131bd6fa1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -72,6 +72,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         struct ieee80211_sub_if_data *sdata;
         int ret;
 
+        if (netif_running(dev))
+                return -EBUSY;
+
         if (!nl80211_type_check(type))
                 return -EINVAL;
 
@@ -81,9 +84,6 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         if (ret)
                 return ret;
 
-        if (netif_running(sdata->dev))
-                return -EBUSY;
-
         if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len)
                 ieee80211_sdata_set_mesh_id(sdata,
                                             params->mesh_id_len,
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 0891bfb06996..48ef1a282b91 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -153,7 +153,7 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
         if (net_ratelimit())
                 printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
                         mgmt->sa, initiator ? "initiator" : "recipient", tid,
-                        mgmt->u.action.u.delba.reason_code);
+                        le16_to_cpu(mgmt->u.action.u.delba.reason_code));
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (initiator == WLAN_BACK_INITIATOR)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index ca8ecce31d34..f1362f32c17d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -73,6 +73,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
         struct ieee80211_supported_band *sband;
+        struct cfg80211_bss *bss;
         u32 bss_change;
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
 
@@ -177,8 +178,9 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
-        cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
-                                  mgmt, skb->len, 0, GFP_KERNEL);
+        bss = cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
+                                        mgmt, skb->len, 0, GFP_KERNEL);
+        cfg80211_put_bss(bss);
         cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
 }
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7c9ec3dee96e..0cdfb388a191 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1350,6 +1350,11 @@ err_stat:
         return ret;
 }
 
+s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
+                        enum ip_conntrack_dir dir,
+                        u32 seq);
+EXPORT_SYMBOL_GPL(nf_ct_nat_offset);
+
 int nf_conntrack_init(struct net *net)
 {
         int ret;
@@ -1367,6 +1372,9 @@ int nf_conntrack_init(struct net *net)
                 /* For use by REJECT target */
                 rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
                 rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
+
+                /* Howto get NAT offsets */
+                rcu_assign_pointer(nf_ct_nat_offset, NULL);
         }
         return 0;
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 97a82ba75376..ba2b76937283 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -492,6 +492,21 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
         }
 }
 
+#ifdef CONFIG_NF_NAT_NEEDED
+static inline s16 nat_offset(const struct nf_conn *ct,
+                             enum ip_conntrack_dir dir,
+                             u32 seq)
+{
+        typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
+
+        return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
+}
+#define NAT_OFFSET(pf, ct, dir, seq) \
+        (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
+#else
+#define NAT_OFFSET(pf, ct, dir, seq)    0
+#endif
+
 static bool tcp_in_window(const struct nf_conn *ct,
                           struct ip_ct_tcp *state,
                           enum ip_conntrack_dir dir,
@@ -506,6 +521,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
         __u32 seq, ack, sack, end, win, swin;
+        s16 receiver_offset;
         bool res;
 
         /*
@@ -519,11 +535,16 @@ static bool tcp_in_window(const struct nf_conn *ct,
         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
                 tcp_sack(skb, dataoff, tcph, &sack);
 
+        /* Take into account NAT sequence number mangling */
+        receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
+        ack -= receiver_offset;
+        sack -= receiver_offset;
+
         pr_debug("tcp_in_window: START\n");
         pr_debug("tcp_in_window: ");
         nf_ct_dump_tuple(tuple);
-        pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
-                 seq, ack, sack, win, end);
+        pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
+                 seq, ack, receiver_offset, sack, receiver_offset, win, end);
         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
                  sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -613,8 +634,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
 
         pr_debug("tcp_in_window: ");
         nf_ct_dump_tuple(tuple);
-        pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
-                 seq, ack, sack, win, end);
+        pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
+                 seq, ack, receiver_offset, sack, receiver_offset, win, end);
         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
                  sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -700,7 +721,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         before(seq, sender->td_maxend + 1) ?
                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
                         before(sack, receiver->td_end + 1) ?
-                        after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
+                        after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
                         : "ACK is under the lower bound (possible overly delayed ACK)"
                         : "ACK is over the upper bound (ACKed data not seen yet)"
                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
@@ -715,39 +736,6 @@ static bool tcp_in_window(const struct nf_conn *ct,
         return res;
 }
 
-#ifdef CONFIG_NF_NAT_NEEDED
-/* Update sender->td_end after NAT successfully mangled the packet */
-/* Caller must linearize skb at tcp header. */
-void nf_conntrack_tcp_update(const struct sk_buff *skb,
-                             unsigned int dataoff,
-                             struct nf_conn *ct, int dir,
-                             s16 offset)
-{
-        const struct tcphdr *tcph = (const void *)skb->data + dataoff;
-        const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
-        const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
-        __u32 end;
-
-        end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
-
-        spin_lock_bh(&ct->lock);
-        /*
-         * We have to worry for the ack in the reply packet only...
-         */
-        if (ct->proto.tcp.seen[dir].td_end + offset == end)
-                ct->proto.tcp.seen[dir].td_end = end;
-        ct->proto.tcp.last_end = end;
-        spin_unlock_bh(&ct->lock);
-        pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
-                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
-                 sender->td_end, sender->td_maxend, sender->td_maxwin,
-                 sender->td_scale,
-                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
-                 receiver->td_scale);
-}
-EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
-#endif
-
 #define TH_FIN  0x01
 #define TH_SYN  0x02
 #define TH_RST  0x04
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index d936226916f2..ea2e72337e2f 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -578,18 +578,18 @@ static int rose_clear_routes(void)
 
 /*
  *      Check that the device given is a valid AX.25 interface that is "up".
+ *      called whith RTNL
  */
-static struct net_device *rose_ax25_dev_get(char *devname)
+static struct net_device *rose_ax25_dev_find(char *devname)
 {
         struct net_device *dev;
 
-        if ((dev = dev_get_by_name(&init_net, devname)) == NULL)
+        if ((dev = __dev_get_by_name(&init_net, devname)) == NULL)
                 return NULL;
 
         if ((dev->flags & IFF_UP) && dev->type == ARPHRD_AX25)
                 return dev;
 
-        dev_put(dev);
         return NULL;
 }
 
@@ -720,27 +720,23 @@ int rose_rt_ioctl(unsigned int cmd, void __user *arg)
         case SIOCADDRT:
                 if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
                         return -EFAULT;
-                if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
+                if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
                         return -EINVAL;
-                if (rose_dev_exists(&rose_route.address)) { /* Can't add routes to ourself */
-                        dev_put(dev);
+                if (rose_dev_exists(&rose_route.address)) /* Can't add routes to ourself */
                         return -EINVAL;
-                }
                 if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
                         return -EINVAL;
                 if (rose_route.ndigis > AX25_MAX_DIGIS)
                         return -EINVAL;
                 err = rose_add_node(&rose_route, dev);
-                dev_put(dev);
                 return err;
 
         case SIOCDELRT:
                 if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
                         return -EFAULT;
-                if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
+                if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
                         return -EINVAL;
                 err = rose_del_node(&rose_route, dev);
-                dev_put(dev);
                 return err;
 
         case SIOCRSCLRRT:
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index c2a17876defd..870929e08e5d 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -111,7 +111,7 @@ static void svc_release_skb(struct svc_rqst *rqstp)
                 rqstp->rq_xprt_ctxt = NULL;
 
                 dprintk("svc: service %p, releasing skb %p\n", rqstp, skb);
-                skb_free_datagram(svsk->sk_sk, skb);
+                skb_free_datagram_locked(svsk->sk_sk, skb);
         }
 }
 
@@ -578,7 +578,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                                 "svc: received unknown control message %d/%d; "
                                 "dropping RPC reply datagram\n",
                                         cmh->cmsg_level, cmh->cmsg_type);
-                skb_free_datagram(svsk->sk_sk, skb);
+                skb_free_datagram_locked(svsk->sk_sk, skb);
                 return 0;
         }
 
@@ -588,18 +588,18 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                 if (csum_partial_copy_to_xdr(&rqstp->rq_arg, skb)) {
                         local_bh_enable();
                         /* checksum error */
-                        skb_free_datagram(svsk->sk_sk, skb);
+                        skb_free_datagram_locked(svsk->sk_sk, skb);
                         return 0;
                 }
                 local_bh_enable();
-                skb_free_datagram(svsk->sk_sk, skb);
+                skb_free_datagram_locked(svsk->sk_sk, skb);
         } else {
                 /* we can use it in-place */
                 rqstp->rq_arg.head[0].iov_base = skb->data +
                         sizeof(struct udphdr);
                 rqstp->rq_arg.head[0].iov_len = len;
                 if (skb_checksum_complete(skb)) {
-                        skb_free_datagram(svsk->sk_sk, skb);
+                        skb_free_datagram_locked(svsk->sk_sk, skb);
                         return 0;
                 }
                 rqstp->rq_xprt_ctxt = skb;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 98a3b7efac4c..0115d07d2c1a 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -165,7 +165,7 @@ void cfg80211_conn_work(struct work_struct *work)
         struct cfg80211_registered_device *rdev =
                 container_of(work, struct cfg80211_registered_device, conn_work);
         struct wireless_dev *wdev;
-        u8 bssid[ETH_ALEN];
+        u8 bssid_buf[ETH_ALEN], *bssid = NULL;
 
         rtnl_lock();
         cfg80211_lock_rdev(rdev);
@@ -181,7 +181,10 @@ void cfg80211_conn_work(struct work_struct *work)
                         wdev_unlock(wdev);
                         continue;
                 }
-                memcpy(bssid, wdev->conn->params.bssid, ETH_ALEN);
+                if (wdev->conn->params.bssid) {
+                        memcpy(bssid_buf, wdev->conn->params.bssid, ETH_ALEN);
+                        bssid = bssid_buf;
+                }
                 if (cfg80211_conn_do_work(wdev))
                         __cfg80211_connect_result(
                                         wdev->netdev, bssid,