Merge commit 'v2.6.27-rc1' into x86/core

Conflicts:

	include/asm-x86/dma-mapping.h
	include/asm-x86/namei.h
	include/asm-x86/uaccess.h

Signed-off-by: Ingo Molnar <mingo@elte.hu>

72 files changed, 335 insertions, 290 deletions

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 07b5b82c5eab..0c850427a85b 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -959,7 +959,7 @@ static unsigned long atalk_sum_skb(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -986,7 +986,7 @@ static unsigned long atalk_sum_skb(const struct sk_buff *skb, int offset,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 690bc3ab186c..1a58af51a2e2 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -93,28 +93,20 @@ static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
 
 static int __init ebtable_filter_init(void)
 {
-        int i, j, ret;
+        int ret;
 
         ret = ebt_register_table(&frame_filter);
         if (ret < 0)
                 return ret;
-        for (i = 0; i < ARRAY_SIZE(ebt_ops_filter); i++)
-                if ((ret = nf_register_hook(&ebt_ops_filter[i])) < 0)
-                        goto cleanup;
-        return ret;
-cleanup:
-        for (j = 0; j < i; j++)
-                nf_unregister_hook(&ebt_ops_filter[j]);
-        ebt_unregister_table(&frame_filter);
+        ret = nf_register_hooks(ebt_ops_filter, ARRAY_SIZE(ebt_ops_filter));
+        if (ret < 0)
+                ebt_unregister_table(&frame_filter);
         return ret;
 }
 
 static void __exit ebtable_filter_fini(void)
 {
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(ebt_ops_filter); i++)
-                nf_unregister_hook(&ebt_ops_filter[i]);
+        nf_unregister_hooks(ebt_ops_filter, ARRAY_SIZE(ebt_ops_filter));
         ebt_unregister_table(&frame_filter);
 }
 
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index 5b495fe2d0b6..f60c1e78e575 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -100,28 +100,20 @@ static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
 
 static int __init ebtable_nat_init(void)
 {
-        int i, ret, j;
+        int ret;
 
         ret = ebt_register_table(&frame_nat);
         if (ret < 0)
                 return ret;
-        for (i = 0; i < ARRAY_SIZE(ebt_ops_nat); i++)
-                if ((ret = nf_register_hook(&ebt_ops_nat[i])) < 0)
-                        goto cleanup;
-        return ret;
-cleanup:
-        for (j = 0; j < i; j++)
-                nf_unregister_hook(&ebt_ops_nat[j]);
-        ebt_unregister_table(&frame_nat);
+        ret = nf_register_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
+        if (ret < 0)
+                ebt_unregister_table(&frame_nat);
         return ret;
 }
 
 static void __exit ebtable_nat_fini(void)
 {
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(ebt_ops_nat); i++)
-                nf_unregister_hook(&ebt_ops_nat[i]);
+        nf_unregister_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
         ebt_unregister_table(&frame_nat);
 }
 
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 8a28fc93b724..dd61dcad6019 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -285,7 +285,7 @@ int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -315,7 +315,7 @@ int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -366,7 +366,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -402,7 +402,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                 for (; list; list=list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
diff --git a/net/core/dev.c b/net/core/dev.c
index 53af7841018a..8d13a9b9f1df 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1973,7 +1973,7 @@ static void net_tx_action(struct softirq_action *h)
                         struct sk_buff *skb = clist;
                         clist = clist->next;
 
-                        BUG_TRAP(!atomic_read(&skb->users));
+                        WARN_ON(atomic_read(&skb->users));
                         __kfree_skb(skb);
                 }
         }
@@ -3847,7 +3847,7 @@ static void rollback_registered(struct net_device *dev)
                 dev->uninit(dev);
 
         /* Notifier chain MUST detach us from master device. */
-        BUG_TRAP(!dev->master);
+        WARN_ON(dev->master);
 
         /* Remove entries from kobject tree */
         netdev_unregister_kobject(dev);
@@ -4169,9 +4169,9 @@ void netdev_run_todo(void)
 
                 /* paranoia */
                 BUG_ON(atomic_read(&dev->refcnt));
-                BUG_TRAP(!dev->ip_ptr);
-                BUG_TRAP(!dev->ip6_ptr);
-                BUG_TRAP(!dev->dn_ptr);
+                WARN_ON(dev->ip_ptr);
+                WARN_ON(dev->ip6_ptr);
+                WARN_ON(dev->dn_ptr);
 
                 if (dev->destructor)
                         dev->destructor(dev);
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 2d3035d3abd7..7552495aff7a 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -123,7 +123,7 @@ void reqsk_queue_destroy(struct request_sock_queue *queue)
                 }
         }
 
-        BUG_TRAP(lopt->qlen == 0);
+        WARN_ON(lopt->qlen != 0);
         if (lopt_size > PAGE_SIZE)
                 vfree(lopt);
         else
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e4115672b6cf..4e0c92274189 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1200,7 +1200,7 @@ int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len)
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -1229,7 +1229,7 @@ int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len)
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -1475,7 +1475,7 @@ int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int len)
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + frag->size;
                 if ((copy = end - offset) > 0) {
@@ -1503,7 +1503,7 @@ int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int len)
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -1552,7 +1552,7 @@ __wsum skb_checksum(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -1581,7 +1581,7 @@ __wsum skb_checksum(const struct sk_buff *skb, int offset,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -1629,7 +1629,7 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -1662,7 +1662,7 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset,
                         __wsum csum2;
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -2373,7 +2373,7 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -2397,7 +2397,7 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
diff --git a/net/core/stream.c b/net/core/stream.c
index 4a0ad152c9c4..a6b3437ff082 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -192,13 +192,13 @@ void sk_stream_kill_queues(struct sock *sk)
         __skb_queue_purge(&sk->sk_error_queue);
 
         /* Next, the write queue. */
-        BUG_TRAP(skb_queue_empty(&sk->sk_write_queue));
+        WARN_ON(!skb_queue_empty(&sk->sk_write_queue));
 
         /* Account for returned memory. */
         sk_mem_reclaim(sk);
 
-        BUG_TRAP(!sk->sk_wmem_queued);
-        BUG_TRAP(!sk->sk_forward_alloc);
+        WARN_ON(sk->sk_wmem_queued);
+        WARN_ON(sk->sk_forward_alloc);
 
         /* It is _impossible_ for the backlog to contain anything
          * when we get here.  All user references to this socket
diff --git a/net/core/user_dma.c b/net/core/user_dma.c
index 8c6b706963ff..164b090d5ac3 100644
--- a/net/core/user_dma.c
+++ b/net/core/user_dma.c
@@ -27,7 +27,6 @@
 
 #include <linux/dmaengine.h>
 #include <linux/socket.h>
-#include <linux/rtnetlink.h> /* for BUG_TRAP */
 #include <net/tcp.h>
 #include <net/netdma.h>
 
@@ -72,7 +71,7 @@ int dma_skb_copy_datagram_iovec(struct dma_chan *chan,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 copy = end - offset;
@@ -101,7 +100,7 @@ int dma_skb_copy_datagram_iovec(struct dma_chan *chan,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         copy = end - offset;
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 32617e0576cb..1c2e3ec2eb57 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -164,7 +164,7 @@ static inline bool dccp_loss_free(const u64 s1, const u64 s2, const u64 ndp)
 {
         s64 delta = dccp_delta_seqno(s1, s2);
 
-        BUG_TRAP(delta >= 0);
+        WARN_ON(delta < 0);
         return (u64)delta <= ndp + 1;
 }
 
@@ -226,7 +226,7 @@ static inline void dccp_csum_outgoing(struct sk_buff *skb)
 
 extern void dccp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb);
 
-extern int  dccp_retransmit_skb(struct sock *sk, struct sk_buff *skb);
+extern int  dccp_retransmit_skb(struct sock *sk);
 
 extern void dccp_send_ack(struct sock *sk);
 extern void dccp_reqsk_send_ack(struct sk_buff *sk, struct request_sock *rsk);
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 08392ed86c25..df2f110df94a 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -413,7 +413,7 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
 
                 /* Stop the REQUEST timer */
                 inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
-                BUG_TRAP(sk->sk_send_head != NULL);
+                WARN_ON(sk->sk_send_head == NULL);
                 __kfree_skb(sk->sk_send_head);
                 sk->sk_send_head = NULL;
 
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 2622ace17c46..882c5c4de69e 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -196,8 +196,8 @@ static inline void dccp_do_pmtu_discovery(struct sock *sk,
 static void dccp_v4_err(struct sk_buff *skb, u32 info)
 {
         const struct iphdr *iph = (struct iphdr *)skb->data;
-        const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data +
-                                                        (iph->ihl << 2));
+        const u8 offset = iph->ihl << 2;
+        const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
         struct dccp_sock *dp;
         struct inet_sock *inet;
         const int type = icmp_hdr(skb)->type;
@@ -207,7 +207,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
         int err;
         struct net *net = dev_net(skb->dev);
 
-        if (skb->len < (iph->ihl << 2) + 8) {
+        if (skb->len < offset + sizeof(*dh) ||
+            skb->len < offset + __dccp_basic_hdr_len(dh)) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
         }
@@ -238,7 +239,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
         dp = dccp_sk(sk);
         seq = dccp_hdr_seq(dh);
         if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
-            !between48(seq, dp->dccps_swl, dp->dccps_swh)) {
+            !between48(seq, dp->dccps_awl, dp->dccps_awh)) {
                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
                 goto out;
         }
@@ -283,7 +284,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
                  * ICMPs are not backlogged, hence we cannot get an established
                  * socket here.
                  */
-                BUG_TRAP(!req->sk);
+                WARN_ON(req->sk);
 
                 if (seq != dccp_rsk(req)->dreq_iss) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index b74e8b2cbe55..5e1ee0da2c40 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -89,12 +89,19 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
         struct ipv6hdr *hdr = (struct ipv6hdr *)skb->data;
         const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
+        struct dccp_sock *dp;
         struct ipv6_pinfo *np;
         struct sock *sk;
         int err;
         __u64 seq;
         struct net *net = dev_net(skb->dev);
 
+        if (skb->len < offset + sizeof(*dh) ||
+            skb->len < offset + __dccp_basic_hdr_len(dh)) {
+                ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
+                return;
+        }
+
         sk = inet6_lookup(net, &dccp_hashinfo,
                         &hdr->daddr, dh->dccph_dport,
                         &hdr->saddr, dh->dccph_sport, inet6_iif(skb));
@@ -116,6 +123,14 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (sk->sk_state == DCCP_CLOSED)
                 goto out;
 
+        dp = dccp_sk(sk);
+        seq = dccp_hdr_seq(dh);
+        if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
+            !between48(seq, dp->dccps_awl, dp->dccps_awh)) {
+                NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
+                goto out;
+        }
+
         np = inet6_sk(sk);
 
         if (type == ICMPV6_PKT_TOOBIG) {
@@ -168,7 +183,6 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         icmpv6_err_convert(type, code, &err);
 
-        seq = dccp_hdr_seq(dh);
         /* Might be for an request_sock */
         switch (sk->sk_state) {
                 struct request_sock *req, **prev;
@@ -186,7 +200,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                  * ICMPs are not backlogged, hence we cannot get an established
                  * socket here.
                  */
-                BUG_TRAP(req->sk == NULL);
+                WARN_ON(req->sk != NULL);
 
                 if (seq != dccp_rsk(req)->dreq_iss) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
diff --git a/net/dccp/output.c b/net/dccp/output.c
index fe20068c5d8e..d06945c7d3df 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -53,8 +53,11 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                                           dccp_packet_hdr_len(dcb->dccpd_type);
                 int err, set_ack = 1;
                 u64 ackno = dp->dccps_gsr;
-
-                dccp_inc_seqno(&dp->dccps_gss);
+                /*
+                 * Increment GSS here already in case the option code needs it.
+                 * Update GSS for real only if option processing below succeeds.
+                 */
+                dcb->dccpd_seq = ADD48(dp->dccps_gss, 1);
 
                 switch (dcb->dccpd_type) {
                 case DCCP_PKT_DATA:
@@ -66,6 +69,9 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 
                 case DCCP_PKT_REQUEST:
                         set_ack = 0;
+                        /* Use ISS on the first (non-retransmitted) Request. */
+                        if (icsk->icsk_retransmits == 0)
+                                dcb->dccpd_seq = dp->dccps_iss;
                         /* fall through */
 
                 case DCCP_PKT_SYNC:
@@ -84,8 +90,6 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                         break;
                 }
 
-                dcb->dccpd_seq = dp->dccps_gss;
-
                 if (dccp_insert_options(sk, skb)) {
                         kfree_skb(skb);
                         return -EPROTO;
@@ -103,7 +107,7 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 /* XXX For now we're using only 48 bits sequence numbers */
                 dh->dccph_x     = 1;
 
-                dp->dccps_awh = dp->dccps_gss;
+                dccp_update_gss(sk, dcb->dccpd_seq);
                 dccp_hdr_set_seq(dh, dp->dccps_gss);
                 if (set_ack)
                         dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), ackno);
@@ -112,6 +116,11 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 case DCCP_PKT_REQUEST:
                         dccp_hdr_request(skb)->dccph_req_service =
                                                         dp->dccps_service;
+                        /*
+                         * Limit Ack window to ISS <= P.ackno <= GSS, so that
+                         * only Responses to Requests we sent are considered.
+                         */
+                        dp->dccps_awl = dp->dccps_iss;
                         break;
                 case DCCP_PKT_RESET:
                         dccp_hdr_reset(skb)->dccph_reset_code =
@@ -284,14 +293,26 @@ void dccp_write_xmit(struct sock *sk, int block)
         }
 }
 
-int dccp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+/**
+ * dccp_retransmit_skb  -  Retransmit Request, Close, or CloseReq packets
+ * There are only four retransmittable packet types in DCCP:
+ * - Request  in client-REQUEST  state (sec. 8.1.1),
+ * - CloseReq in server-CLOSEREQ state (sec. 8.3),
+ * - Close    in   node-CLOSING  state (sec. 8.3),
+ * - Acks in client-PARTOPEN state (sec. 8.1.5, handled by dccp_delack_timer()).
+ * This function expects sk->sk_send_head to contain the original skb.
+ */
+int dccp_retransmit_skb(struct sock *sk)
 {
+        WARN_ON(sk->sk_send_head == NULL);
+
         if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk) != 0)
                 return -EHOSTUNREACH; /* Routing failure or similar. */
 
-        return dccp_transmit_skb(sk, (skb_cloned(skb) ?
-                                      pskb_copy(skb, GFP_ATOMIC):
-                                      skb_clone(skb, GFP_ATOMIC)));
+        /* this count is used to distinguish original and retransmitted skb */
+        inet_csk(sk)->icsk_retransmits++;
+
+        return dccp_transmit_skb(sk, skb_clone(sk->sk_send_head, GFP_ATOMIC));
 }
 
 struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
@@ -437,19 +458,7 @@ static inline void dccp_connect_init(struct sock *sk)
 
         dccp_sync_mss(sk, dst_mtu(dst));
 
-        /*
-         * SWL and AWL are initially adjusted so that they are not less than
-         * the initial Sequence Numbers received and sent, respectively:
-         *      SWL := max(GSR + 1 - floor(W/4), ISR),
-         *      AWL := max(GSS - W' + 1, ISS).
-         * These adjustments MUST be applied only at the beginning of the
-         * connection.
-         */
-        dccp_update_gss(sk, dp->dccps_iss);
-        dccp_set_seqno(&dp->dccps_awl, max48(dp->dccps_awl, dp->dccps_iss));
-
-        /* S.GAR - greatest valid acknowledgement number received on a non-Sync;
-         *         initialized to S.ISS (sec. 8.5)                            */
+        /* Initialise GAR as per 8.5; AWL/AWH are set in dccp_transmit_skb() */
         dp->dccps_gar = dp->dccps_iss;
 
         icsk->icsk_retransmits = 0;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index a0b56009611f..b622d9744856 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -327,7 +327,7 @@ int dccp_disconnect(struct sock *sk, int flags)
         inet_csk_delack_init(sk);
         __sk_dst_reset(sk);
 
-        BUG_TRAP(!inet->num || icsk->icsk_bind_hash);
+        WARN_ON(inet->num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
@@ -981,7 +981,7 @@ adjudge_to_death:
          */
         local_bh_disable();
         bh_lock_sock(sk);
-        BUG_TRAP(!sock_owned_by_user(sk));
+        WARN_ON(sock_owned_by_user(sk));
 
         /* Have we already been destroyed by a softirq or backlog? */
         if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index 3608d5342ca2..54b3c7e9e016 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -99,21 +99,11 @@ static void dccp_retransmit_timer(struct sock *sk)
         }
 
         /*
-         * sk->sk_send_head has to have one skb with
-         * DCCP_SKB_CB(skb)->dccpd_type set to one of the retransmittable DCCP
-         * packet types. The only packets eligible for retransmission are:
-         *      -- Requests in client-REQUEST  state (sec. 8.1.1)
-         *      -- Acks     in client-PARTOPEN state (sec. 8.1.5)
-         *      -- CloseReq in server-CLOSEREQ state (sec. 8.3)
-         *      -- Close    in   node-CLOSING  state (sec. 8.3)                */
-        BUG_TRAP(sk->sk_send_head != NULL);
-
-        /*
          * More than than 4MSL (8 minutes) has passed, a RESET(aborted) was
          * sent, no need to retransmit, this sock is dead.
          */
         if (dccp_write_timeout(sk))
-                goto out;
+                return;
 
         /*
          * We want to know the number of packets retransmitted, not the
@@ -122,30 +112,28 @@ static void dccp_retransmit_timer(struct sock *sk)
         if (icsk->icsk_retransmits == 0)
                 DCCP_INC_STATS_BH(DCCP_MIB_TIMEOUTS);
 
-        if (dccp_retransmit_skb(sk, sk->sk_send_head) < 0) {
+        if (dccp_retransmit_skb(sk) != 0) {
                 /*
                  * Retransmission failed because of local congestion,
                  * do not backoff.
                  */
-                if (icsk->icsk_retransmits == 0)
+                if (--icsk->icsk_retransmits == 0)
                         icsk->icsk_retransmits = 1;
                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                                           min(icsk->icsk_rto,
                                               TCP_RESOURCE_PROBE_INTERVAL),
                                           DCCP_RTO_MAX);
-                goto out;
+                return;
         }
 
 backoff:
         icsk->icsk_backoff++;
-        icsk->icsk_retransmits++;
 
         icsk->icsk_rto = min(icsk->icsk_rto << 1, DCCP_RTO_MAX);
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto,
                                   DCCP_RTO_MAX);
         if (icsk->icsk_retransmits > sysctl_dccp_retries1)
                 __sk_dst_reset(sk);
-out:;
 }
 
 static void dccp_write_timer(unsigned long data)
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f440a9f54924..8a3ac1fa71a9 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -148,10 +148,10 @@ void inet_sock_destruct(struct sock *sk)
                 return;
         }
 
-        BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
-        BUG_TRAP(!sk->sk_wmem_queued);
-        BUG_TRAP(!sk->sk_forward_alloc);
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(sk->sk_wmem_queued);
+        WARN_ON(sk->sk_forward_alloc);
 
         kfree(inet->opt);
         dst_release(sk->sk_dst_cache);
@@ -338,7 +338,7 @@ lookup_protocol:
         answer_flags = answer->flags;
         rcu_read_unlock();
 
-        BUG_TRAP(answer_prot->slab != NULL);
+        WARN_ON(answer_prot->slab == NULL);
 
         err = -ENOBUFS;
         sk = sk_alloc(net, PF_INET, GFP_KERNEL, answer_prot);
@@ -658,8 +658,8 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags)
 
         lock_sock(sk2);
 
-        BUG_TRAP((1 << sk2->sk_state) &
-                 (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_CLOSE));
+        WARN_ON(!((1 << sk2->sk_state) &
+                  (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_CLOSE)));
 
         sock_graft(sk2, newsock);
 
@@ -1439,6 +1439,10 @@ static int __init inet_init(void)
 
         (void)sock_register(&inet_family_ops);
 
+#ifdef CONFIG_SYSCTL
+        ip_static_sysctl_init();
+#endif
+
         /*
          *      Add all the base protocols.
          */
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 2e667e2f90df..91d3d96805d0 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -138,8 +138,8 @@ void in_dev_finish_destroy(struct in_device *idev)
 {
         struct net_device *dev = idev->dev;
 
-        BUG_TRAP(!idev->ifa_list);
-        BUG_TRAP(!idev->mc_list);
+        WARN_ON(idev->ifa_list);
+        WARN_ON(idev->mc_list);
 #ifdef NET_REFCNT_DEBUG
         printk(KERN_DEBUG "in_dev_finish_destroy: %p=%s\n",
                idev, dev ? dev->name : "NIL");
@@ -399,7 +399,7 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
         }
         ipv4_devconf_setall(in_dev);
         if (ifa->ifa_dev != in_dev) {
-                BUG_TRAP(!ifa->ifa_dev);
+                WARN_ON(ifa->ifa_dev);
                 in_dev_hold(in_dev);
                 ifa->ifa_dev = in_dev;
         }
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index bb81c958b744..0c1ae68ee84b 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -167,7 +167,7 @@ tb_not_found:
 success:
         if (!inet_csk(sk)->icsk_bind_hash)
                 inet_bind_hash(sk, tb, snum);
-        BUG_TRAP(inet_csk(sk)->icsk_bind_hash == tb);
+        WARN_ON(inet_csk(sk)->icsk_bind_hash != tb);
         ret = 0;
 
 fail_unlock:
@@ -260,7 +260,7 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
         }
 
         newsk = reqsk_queue_get_child(&icsk->icsk_accept_queue, sk);
-        BUG_TRAP(newsk->sk_state != TCP_SYN_RECV);
+        WARN_ON(newsk->sk_state == TCP_SYN_RECV);
 out:
         release_sock(sk);
         return newsk;
@@ -386,7 +386,7 @@ struct request_sock *inet_csk_search_req(const struct sock *sk,
                     ireq->rmt_addr == raddr &&
                     ireq->loc_addr == laddr &&
                     AF_INET_FAMILY(req->rsk_ops->family)) {
-                        BUG_TRAP(!req->sk);
+                        WARN_ON(req->sk);
                         *prevp = prev;
                         break;
                 }
@@ -539,14 +539,14 @@ EXPORT_SYMBOL_GPL(inet_csk_clone);
  */
 void inet_csk_destroy_sock(struct sock *sk)
 {
-        BUG_TRAP(sk->sk_state == TCP_CLOSE);
-        BUG_TRAP(sock_flag(sk, SOCK_DEAD));
+        WARN_ON(sk->sk_state != TCP_CLOSE);
+        WARN_ON(!sock_flag(sk, SOCK_DEAD));
 
         /* It cannot be in hash table! */
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
 
         /* If it has not 0 inet_sk(sk)->num, it must be bound */
-        BUG_TRAP(!inet_sk(sk)->num || inet_csk(sk)->icsk_bind_hash);
+        WARN_ON(inet_sk(sk)->num && !inet_csk(sk)->icsk_bind_hash);
 
         sk->sk_prot->destroy(sk);
 
@@ -629,7 +629,7 @@ void inet_csk_listen_stop(struct sock *sk)
 
                 local_bh_disable();
                 bh_lock_sock(child);
-                BUG_TRAP(!sock_owned_by_user(child));
+                WARN_ON(sock_owned_by_user(child));
                 sock_hold(child);
 
                 sk->sk_prot->disconnect(child, O_NONBLOCK);
@@ -647,7 +647,7 @@ void inet_csk_listen_stop(struct sock *sk)
                 sk_acceptq_removed(sk);
                 __reqsk_free(req);
         }
-        BUG_TRAP(!sk->sk_ack_backlog);
+        WARN_ON(sk->sk_ack_backlog);
 }
 
 EXPORT_SYMBOL_GPL(inet_csk_listen_stop);
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 0546a0bc97ea..6c52e08f786e 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -134,8 +134,8 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f,
         struct sk_buff *fp;
         struct netns_frags *nf;
 
-        BUG_TRAP(q->last_in & INET_FRAG_COMPLETE);
-        BUG_TRAP(del_timer(&q->timer) == 0);
+        WARN_ON(!(q->last_in & INET_FRAG_COMPLETE));
+        WARN_ON(del_timer(&q->timer) != 0);
 
         /* Release all fragment data. */
         fp = q->fragments;
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 115f53722d20..44981906fb91 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -305,7 +305,7 @@ unique:
         inet->num = lport;
         inet->sport = htons(lport);
         sk->sk_hash = hash;
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         write_unlock(lock);
@@ -342,7 +342,7 @@ void __inet_hash_nolisten(struct sock *sk)
         rwlock_t *lock;
         struct inet_ehash_bucket *head;
 
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
 
         sk->sk_hash = inet_sk_ehashfn(sk);
         head = inet_ehash_bucket(hashinfo, sk->sk_hash);
@@ -367,7 +367,7 @@ static void __inet_hash(struct sock *sk)
                 return;
         }
 
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
         lock = &hashinfo->lhash_lock;
 
@@ -450,7 +450,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
                                 if (tb->ib_net == net && tb->port == port) {
-                                        BUG_TRAP(!hlist_empty(&tb->owners));
+                                        WARN_ON(hlist_empty(&tb->owners));
                                         if (tb->fastreuse >= 0)
                                                 goto next_port;
                                         if (!check_established(death_row, sk,
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 75c2def8f9a0..d985bd613d25 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -86,7 +86,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
                         hashinfo->bhash_size)];
         spin_lock(&bhead->lock);
         tw->tw_tb = icsk->icsk_bind_hash;
-        BUG_TRAP(icsk->icsk_bind_hash);
+        WARN_ON(!icsk->icsk_bind_hash);
         inet_twsk_add_bind_node(tw, &tw->tw_tb->owners);
         spin_unlock(&bhead->lock);
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 38d38f058018..2152d222b954 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -488,8 +488,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 qp->q.fragments = head;
         }
 
-        BUG_TRAP(head != NULL);
-        BUG_TRAP(FRAG_CB(head)->offset == 0);
+        WARN_ON(head == NULL);
+        WARN_ON(FRAG_CB(head)->offset != 0);
 
         /* Allocate a new buffer for the datagram. */
         ihlen = ip_hdrlen(head);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 465544f6281a..d533a89e08de 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -118,7 +118,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         __skb_pull(newskb, skb_network_offset(newskb));
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
-        BUG_TRAP(newskb->dst);
+        WARN_ON(!newskb->dst);
         netif_rx(newskb);
         return 0;
 }
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index a42b64d040c4..38ccb6dfb02e 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -104,9 +104,7 @@ out:
 
 static int ipcomp4_init_state(struct xfrm_state *x)
 {
-        int err;
-        struct ipcomp_data *ipcd;
-        struct xfrm_algo_desc *calg_desc;
+        int err = -EINVAL;
 
         x->props.header_len = 0;
         switch (x->props.mode) {
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 3be4d07e7ed9..082f5dd3156c 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -55,32 +55,53 @@ static struct xt_table packet_filter = {
 };
 
 /* The work comes in here from netfilter.c */
-static unsigned int arpt_hook(unsigned int hook,
-                              struct sk_buff *skb,
-                              const struct net_device *in,
-                              const struct net_device *out,
-                              int (*okfn)(struct sk_buff *))
+static unsigned int arpt_in_hook(unsigned int hook,
+                                 struct sk_buff *skb,
+                                 const struct net_device *in,
+                                 const struct net_device *out,
+                                 int (*okfn)(struct sk_buff *))
 {
-        return arpt_do_table(skb, hook, in, out, init_net.ipv4.arptable_filter);
+        return arpt_do_table(skb, hook, in, out,
+                             dev_net(in)->ipv4.arptable_filter);
+}
+
+static unsigned int arpt_out_hook(unsigned int hook,
+                                  struct sk_buff *skb,
+                                  const struct net_device *in,
+                                  const struct net_device *out,
+                                  int (*okfn)(struct sk_buff *))
+{
+        return arpt_do_table(skb, hook, in, out,
+                             dev_net(out)->ipv4.arptable_filter);
+}
+
+static unsigned int arpt_forward_hook(unsigned int hook,
+                                      struct sk_buff *skb,
+                                      const struct net_device *in,
+                                      const struct net_device *out,
+                                      int (*okfn)(struct sk_buff *))
+{
+        return arpt_do_table(skb, hook, in, out,
+                             dev_net(in)->ipv4.arptable_filter);
 }
 
 static struct nf_hook_ops arpt_ops[] __read_mostly = {
         {
-                .hook           = arpt_hook,
+                .hook           = arpt_in_hook,
                 .owner          = THIS_MODULE,
                 .pf             = NF_ARP,
                 .hooknum        = NF_ARP_IN,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
-                .hook           = arpt_hook,
+                .hook           = arpt_out_hook,
                 .owner          = THIS_MODULE,
                 .pf             = NF_ARP,
                 .hooknum        = NF_ARP_OUT,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
-                .hook           = arpt_hook,
+                .hook           = arpt_forward_hook,
                 .owner          = THIS_MODULE,
                 .pf             = NF_ARP,
                 .hooknum        = NF_ARP_FORWARD,
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 2b472ac2263a..db6d312128e1 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -32,7 +32,7 @@ static struct
         struct ipt_replace repl;
         struct ipt_standard entries[3];
         struct ipt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "security",
                 .valid_hooks = SECURITY_VALID_HOOKS,
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e4ab0ac94f92..380d6474cf66 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1502,7 +1502,7 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
                                     rth->fl.iif != 0 ||
                                     dst_metric_locked(&rth->u.dst, RTAX_MTU) ||
                                     !net_eq(dev_net(rth->u.dst.dev), net) ||
-                                    !rt_is_expired(rth))
+                                    rt_is_expired(rth))
                                         continue;
 
                                 if (new_mtu < 68 || new_mtu >= old_mtu) {
@@ -2914,7 +2914,7 @@ static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
         return 0;
 }
 
-ctl_table ipv4_route_table[] = {
+static ctl_table ipv4_route_table[] = {
         {
                 .ctl_name       = NET_IPV4_ROUTE_GC_THRESH,
                 .procname       = "gc_thresh",
@@ -3216,6 +3216,15 @@ int __init ip_rt_init(void)
         return rc;
 }
 
+/*
+ * We really need to sanitize the damn ipv4 init order, then all
+ * this nonsense will go away.
+ */
+void __init ip_static_sysctl_init(void)
+{
+        register_sysctl_paths(ipv4_route_path, ipv4_route_table);
+}
+
 EXPORT_SYMBOL(__ip_select_ident);
 EXPORT_SYMBOL(ip_route_input);
 EXPORT_SYMBOL(ip_route_output_key);
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 51bc24d3b8a7..9d38005abbac 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -299,6 +299,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->rmt_port          = th->source;
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
+        ireq->ecn_ok            = 0;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->rcv_wscale        = tcp_opt.rcv_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 14ef202a2254..770d827f5ab8 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -401,13 +401,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = &ipv4_local_port_range,
                 .strategy       = &ipv4_sysctl_local_port_range,
         },
-        {
-                .ctl_name       = NET_IPV4_ROUTE,
-                .procname       = "route",
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ipv4_route_table
-        },
 #ifdef CONFIG_IP_MULTICAST
         {
                 .ctl_name       = NET_IPV4_IGMP_MAX_MEMBERSHIPS,
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0b491bf03db4..1ab341e5d3e0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1096,7 +1096,7 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
 #if TCP_DEBUG
         struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 
-        BUG_TRAP(!skb || before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
+        WARN_ON(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
 #endif
 
         if (inet_csk_ack_scheduled(sk)) {
@@ -1358,7 +1358,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                 goto found_ok_skb;
                         if (tcp_hdr(skb)->fin)
                                 goto found_fin_ok;
-                        BUG_TRAP(flags & MSG_PEEK);
+                        WARN_ON(!(flags & MSG_PEEK));
                         skb = skb->next;
                 } while (skb != (struct sk_buff *)&sk->sk_receive_queue);
 
@@ -1421,8 +1421,8 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
                         tp->ucopy.len = len;
 
-                        BUG_TRAP(tp->copied_seq == tp->rcv_nxt ||
-                                 (flags & (MSG_PEEK | MSG_TRUNC)));
+                        WARN_ON(tp->copied_seq != tp->rcv_nxt &&
+                                !(flags & (MSG_PEEK | MSG_TRUNC)));
 
                         /* Ugly... If prequeue is not empty, we have to
                          * process it before releasing socket, otherwise
@@ -1844,7 +1844,7 @@ adjudge_to_death:
          */
         local_bh_disable();
         bh_lock_sock(sk);
-        BUG_TRAP(!sock_owned_by_user(sk));
+        WARN_ON(sock_owned_by_user(sk));
 
         /* Have we already been destroyed by a softirq or backlog? */
         if (state != TCP_CLOSE && sk->sk_state == TCP_CLOSE)
@@ -1973,7 +1973,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
 
-        BUG_TRAP(!inet->num || icsk->icsk_bind_hash);
+        WARN_ON(inet->num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 75efd244f2af..67ccce2a96bd 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1629,10 +1629,10 @@ advance_sp:
 out:
 
 #if FASTRETRANS_DEBUG > 0
-        BUG_TRAP((int)tp->sacked_out >= 0);
-        BUG_TRAP((int)tp->lost_out >= 0);
-        BUG_TRAP((int)tp->retrans_out >= 0);
-        BUG_TRAP((int)tcp_packets_in_flight(tp) >= 0);
+        WARN_ON((int)tp->sacked_out < 0);
+        WARN_ON((int)tp->lost_out < 0);
+        WARN_ON((int)tp->retrans_out < 0);
+        WARN_ON((int)tcp_packets_in_flight(tp) < 0);
 #endif
         return flag;
 }
@@ -2181,7 +2181,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
         int err;
         unsigned int mss;
 
-        BUG_TRAP(packets <= tp->packets_out);
+        WARN_ON(packets > tp->packets_out);
         if (tp->lost_skb_hint) {
                 skb = tp->lost_skb_hint;
                 cnt = tp->lost_cnt_hint;
@@ -2610,7 +2610,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
         /* E. Check state exit conditions. State can be terminated
          *    when high_seq is ACKed. */
         if (icsk->icsk_ca_state == TCP_CA_Open) {
-                BUG_TRAP(tp->retrans_out == 0);
+                WARN_ON(tp->retrans_out != 0);
                 tp->retrans_stamp = 0;
         } else if (!before(tp->snd_una, tp->high_seq)) {
                 switch (icsk->icsk_ca_state) {
@@ -2972,9 +2972,9 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets)
         }
 
 #if FASTRETRANS_DEBUG > 0
-        BUG_TRAP((int)tp->sacked_out >= 0);
-        BUG_TRAP((int)tp->lost_out >= 0);
-        BUG_TRAP((int)tp->retrans_out >= 0);
+        WARN_ON((int)tp->sacked_out < 0);
+        WARN_ON((int)tp->lost_out < 0);
+        WARN_ON((int)tp->retrans_out < 0);
         if (!tp->packets_out && tcp_is_sack(tp)) {
                 icsk = inet_csk(sk);
                 if (tp->lost_out) {
@@ -3877,7 +3877,7 @@ static void tcp_sack_remove(struct tcp_sock *tp)
                         int i;
 
                         /* RCV.NXT must cover all the block! */
-                        BUG_TRAP(!before(tp->rcv_nxt, sp->end_seq));
+                        WARN_ON(before(tp->rcv_nxt, sp->end_seq));
 
                         /* Zap this SACK, by moving forward any other SACKS. */
                         for (i=this_sack+1; i < num_sacks; i++)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a82df6307567..a2b06d0cc26b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -418,7 +418,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 /* ICMPs are not backlogged, hence we cannot get
                    an established socket here.
                  */
-                BUG_TRAP(!req->sk);
+                WARN_ON(req->sk);
 
                 if (seq != tcp_rsk(req)->snt_isn) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 328e0cf42b3c..5ab6ba19c3ce 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -287,7 +287,7 @@ static void tcp_retransmit_timer(struct sock *sk)
         if (!tp->packets_out)
                 goto out;
 
-        BUG_TRAP(!tcp_write_queue_empty(sk));
+        WARN_ON(tcp_write_queue_empty(sk));
 
         if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) &&
             !((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))) {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 74d543d504a1..a7842c54f58a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -313,8 +313,10 @@ static void in6_dev_finish_destroy_rcu(struct rcu_head *head)
 void in6_dev_finish_destroy(struct inet6_dev *idev)
 {
         struct net_device *dev = idev->dev;
-        BUG_TRAP(idev->addr_list==NULL);
-        BUG_TRAP(idev->mc_list==NULL);
+
+        WARN_ON(idev->addr_list != NULL);
+        WARN_ON(idev->mc_list != NULL);
+
 #ifdef NET_REFCNT_DEBUG
         printk(KERN_DEBUG "in6_dev_finish_destroy: %s\n", dev ? dev->name : "NIL");
 #endif
@@ -517,8 +519,9 @@ static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 
 void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 {
-        BUG_TRAP(ifp->if_next==NULL);
-        BUG_TRAP(ifp->lst_next==NULL);
+        WARN_ON(ifp->if_next != NULL);
+        WARN_ON(ifp->lst_next != NULL);
+
 #ifdef NET_REFCNT_DEBUG
         printk(KERN_DEBUG "inet6_ifa_finish_destroy\n");
 #endif
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 60461ad7fa6f..95055f8c3f35 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -150,7 +150,7 @@ lookup_protocol:
         answer_flags = answer->flags;
         rcu_read_unlock();
 
-        BUG_TRAP(answer_prot->slab != NULL);
+        WARN_ON(answer_prot->slab == NULL);
 
         err = -ENOBUFS;
         sk = sk_alloc(net, PF_INET6, GFP_KERNEL, answer_prot);
@@ -934,6 +934,11 @@ static int __init inet6_init(void)
         if (err)
                 goto out_unregister_sock;
 
+#ifdef CONFIG_SYSCTL
+        err = ipv6_static_sysctl_register();
+        if (err)
+                goto static_sysctl_fail;
+#endif
         /*
          *      ipngwg API draft makes clear that the correct semantics
          *      for TCP and UDP is to consider one TCP and UDP instance
@@ -1058,6 +1063,10 @@ ipmr_fail:
 icmp_fail:
         unregister_pernet_subsys(&inet6_net_ops);
 register_pernet_fail:
+#ifdef CONFIG_SYSCTL
+        ipv6_static_sysctl_unregister();
+static_sysctl_fail:
+#endif
         cleanup_ipv6_mibs();
 out_unregister_sock:
         sock_unregister(PF_INET6);
@@ -1113,6 +1122,9 @@ static void __exit inet6_exit(void)
         rawv6_exit();
 
         unregister_pernet_subsys(&inet6_net_ops);
+#ifdef CONFIG_SYSCTL
+        ipv6_static_sysctl_unregister();
+#endif
         cleanup_ipv6_mibs();
         proto_unregister(&rawv6_prot);
         proto_unregister(&udplitev6_prot);
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 87801cc1b2f8..16d43f20b32f 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -98,7 +98,7 @@ struct request_sock *inet6_csk_search_req(const struct sock *sk,
                     ipv6_addr_equal(&treq->rmt_addr, raddr) &&
                     ipv6_addr_equal(&treq->loc_addr, laddr) &&
                     (!treq->iif || treq->iif == iif)) {
-                        BUG_TRAP(req->sk == NULL);
+                        WARN_ON(req->sk != NULL);
                         *prevp = prev;
                         return req;
                 }
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 00a8a5f9380c..1646a5658255 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -28,7 +28,7 @@ void __inet6_hash(struct sock *sk)
         struct hlist_head *list;
         rwlock_t *lock;
 
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
 
         if (sk->sk_state == TCP_LISTEN) {
                 list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
@@ -202,7 +202,7 @@ unique:
          * in hash table socket with a funny identity. */
         inet->num = lport;
         inet->sport = htons(lport);
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sk->sk_hash = hash;
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 08ea2de28d63..52dddc25d3e6 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -287,7 +287,7 @@ static int fib6_dump_node(struct fib6_walker_t *w)
                         w->leaf = rt;
                         return 1;
                 }
-                BUG_TRAP(res!=0);
+                WARN_ON(res == 0);
         }
         w->leaf = NULL;
         return 0;
@@ -778,7 +778,7 @@ out:
                         pn->leaf = fib6_find_prefix(info->nl_net, pn);
 #if RT6_DEBUG >= 2
                         if (!pn->leaf) {
-                                BUG_TRAP(pn->leaf != NULL);
+                                WARN_ON(pn->leaf == NULL);
                                 pn->leaf = info->nl_net->ipv6.ip6_null_entry;
                         }
 #endif
@@ -942,7 +942,7 @@ struct fib6_node * fib6_locate(struct fib6_node *root,
 
 #ifdef CONFIG_IPV6_SUBTREES
         if (src_len) {
-                BUG_TRAP(saddr!=NULL);
+                WARN_ON(saddr == NULL);
                 if (fn && fn->subtree)
                         fn = fib6_locate_1(fn->subtree, saddr, src_len,
                                            offsetof(struct rt6_info, rt6i_src));
@@ -996,9 +996,9 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 RT6_TRACE("fixing tree: plen=%d iter=%d\n", fn->fn_bit, iter);
                 iter++;
 
-                BUG_TRAP(!(fn->fn_flags&RTN_RTINFO));
-                BUG_TRAP(!(fn->fn_flags&RTN_TL_ROOT));
-                BUG_TRAP(fn->leaf==NULL);
+                WARN_ON(fn->fn_flags & RTN_RTINFO);
+                WARN_ON(fn->fn_flags & RTN_TL_ROOT);
+                WARN_ON(fn->leaf != NULL);
 
                 children = 0;
                 child = NULL;
@@ -1014,7 +1014,7 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                         fn->leaf = fib6_find_prefix(net, fn);
 #if RT6_DEBUG >= 2
                         if (fn->leaf==NULL) {
-                                BUG_TRAP(fn->leaf);
+                                WARN_ON(!fn->leaf);
                                 fn->leaf = net->ipv6.ip6_null_entry;
                         }
 #endif
@@ -1025,16 +1025,17 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 pn = fn->parent;
 #ifdef CONFIG_IPV6_SUBTREES
                 if (FIB6_SUBTREE(pn) == fn) {
-                        BUG_TRAP(fn->fn_flags&RTN_ROOT);
+                        WARN_ON(!(fn->fn_flags & RTN_ROOT));
                         FIB6_SUBTREE(pn) = NULL;
                         nstate = FWS_L;
                 } else {
-                        BUG_TRAP(!(fn->fn_flags&RTN_ROOT));
+                        WARN_ON(fn->fn_flags & RTN_ROOT);
 #endif
                         if (pn->right == fn) pn->right = child;
                         else if (pn->left == fn) pn->left = child;
 #if RT6_DEBUG >= 2
-                        else BUG_TRAP(0);
+                        else
+                                WARN_ON(1);
 #endif
                         if (child)
                                 child->parent = pn;
@@ -1154,14 +1155,14 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
 
 #if RT6_DEBUG >= 2
         if (rt->u.dst.obsolete>0) {
-                BUG_TRAP(fn==NULL);
+                WARN_ON(fn != NULL);
                 return -ENOENT;
         }
 #endif
         if (fn == NULL || rt == net->ipv6.ip6_null_entry)
                 return -ENOENT;
 
-        BUG_TRAP(fn->fn_flags&RTN_RTINFO);
+        WARN_ON(!(fn->fn_flags & RTN_RTINFO));
 
         if (!(rt->rt6i_flags&RTF_CACHE)) {
                 struct fib6_node *pn = fn;
@@ -1266,7 +1267,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                         w->node = pn;
 #ifdef CONFIG_IPV6_SUBTREES
                         if (FIB6_SUBTREE(pn) == fn) {
-                                BUG_TRAP(fn->fn_flags&RTN_ROOT);
+                                WARN_ON(!(fn->fn_flags & RTN_ROOT));
                                 w->state = FWS_L;
                                 continue;
                         }
@@ -1281,7 +1282,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                                 continue;
                         }
 #if RT6_DEBUG >= 2
-                        BUG_TRAP(0);
+                        WARN_ON(1);
 #endif
                 }
         }
@@ -1323,7 +1324,7 @@ static int fib6_clean_node(struct fib6_walker_t *w)
                         }
                         return 0;
                 }
-                BUG_TRAP(res==0);
+                WARN_ON(res != 0);
         }
         w->leaf = rt;
         return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6407c64ea4a5..6811901e6b1e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -116,7 +116,7 @@ static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
         __skb_pull(newskb, skb_network_offset(newskb));
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
-        BUG_TRAP(newskb->dst);
+        WARN_ON(!newskb->dst);
 
         netif_rx(newskb);
         return 0;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 0cfcea42153a..4545e4306862 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -134,9 +134,7 @@ out:
 
 static int ipcomp6_init_state(struct xfrm_state *x)
 {
-        int err;
-        struct ipcomp_data *ipcd;
-        struct xfrm_algo_desc *calg_desc;
+        int err = -EINVAL;
 
         x->props.header_len = 0;
         switch (x->props.mode) {
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index ad1cc5bbf977..31295c8f6196 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -164,8 +164,8 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
                         calc_padlen(sizeof(*dstopt), 6));
 
         hao->type = IPV6_TLV_HAO;
+        BUILD_BUG_ON(sizeof(*hao) != 18);
         hao->length = sizeof(*hao) - 2;
-        BUG_TRAP(hao->length == 16);
 
         len = ((char *)hao - (char *)dstopt) + sizeof(*hao);
 
@@ -174,7 +174,7 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
         memcpy(&iph->saddr, x->coaddr, sizeof(iph->saddr));
         spin_unlock_bh(&x->lock);
 
-        BUG_TRAP(len == x->props.header_len);
+        WARN_ON(len != x->props.header_len);
         dstopt->hdrlen = (x->props.header_len >> 3) - 1;
 
         return 0;
@@ -317,7 +317,7 @@ static int mip6_destopt_init_state(struct xfrm_state *x)
         x->props.header_len = sizeof(struct ipv6_destopt_hdr) +
                 calc_padlen(sizeof(struct ipv6_destopt_hdr), 6) +
                 sizeof(struct ipv6_destopt_hao);
-        BUG_TRAP(x->props.header_len == 24);
+        WARN_ON(x->props.header_len != 24);
 
         return 0;
 }
@@ -380,7 +380,7 @@ static int mip6_rthdr_output(struct xfrm_state *x, struct sk_buff *skb)
         rt2->rt_hdr.segments_left = 1;
         memset(&rt2->reserved, 0, sizeof(rt2->reserved));
 
-        BUG_TRAP(rt2->rt_hdr.hdrlen == 2);
+        WARN_ON(rt2->rt_hdr.hdrlen != 2);
 
         memcpy(&rt2->addr, &iph->daddr, sizeof(rt2->addr));
         spin_lock_bh(&x->lock);
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index a07abee30497..6e7131036bc6 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -31,7 +31,7 @@ static struct
         struct ip6t_replace repl;
         struct ip6t_standard entries[3];
         struct ip6t_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "security",
                 .valid_hooks = SECURITY_VALID_HOOKS,
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index cf20bc4fd60d..52d06dd4b817 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -416,8 +416,8 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 
         fq_kill(fq);
 
-        BUG_TRAP(head != NULL);
-        BUG_TRAP(NFCT_FRAG6_CB(head)->offset == 0);
+        WARN_ON(head == NULL);
+        WARN_ON(NFCT_FRAG6_CB(head)->offset != 0);
 
         /* Unfragmented part is taken from the first segment. */
         payload_len = ((head->data - skb_network_header(head)) -
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 6ab957ec2dd6..89184b576e23 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -473,8 +473,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 fq->q.fragments = head;
         }
 
-        BUG_TRAP(head != NULL);
-        BUG_TRAP(FRAG6_CB(head)->offset == 0);
+        WARN_ON(head == NULL);
+        WARN_ON(FRAG6_CB(head)->offset != 0);
 
         /* Unfragmented part is taken from the first segment. */
         payload_len = ((head->data - skb_network_header(head)) -
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 6a68eeb7bbf8..a46badd1082d 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -223,6 +223,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         req->expires = 0UL;
         req->retrans = 0;
+        ireq->ecn_ok            = 0;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->rcv_wscale        = tcp_opt.rcv_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 5c99274558bf..e6dfaeac6be3 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -150,3 +150,19 @@ void ipv6_sysctl_unregister(void)
         unregister_net_sysctl_table(ip6_header);
         unregister_pernet_subsys(&ipv6_sysctl_net_ops);
 }
+
+static struct ctl_table_header *ip6_base;
+
+int ipv6_static_sysctl_register(void)
+{
+        static struct ctl_table empty[1];
+        ip6_base = register_net_sysctl_rotable(net_ipv6_ctl_path, empty);
+        if (ip6_base == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+void ipv6_static_sysctl_unregister(void)
+{
+        unregister_net_sysctl_table(ip6_base);
+}
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ae45f9835014..cff778b23a7f 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -421,7 +421,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 /* ICMPs are not backlogged, hence we cannot get
                  * an established socket here.
                  */
-                BUG_TRAP(req->sk == NULL);
+                WARN_ON(req->sk != NULL);
 
                 if (seq != tcp_rsk(req)->snt_isn) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index f0fc46c8038d..d628df97e02e 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -96,8 +96,8 @@ static void pfkey_sock_destruct(struct sock *sk)
                 return;
         }
 
-        BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
 
         atomic_dec(&pfkey_socks_nr);
 }
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 3469bc71a385..4b2c769d555f 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -95,7 +95,7 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
         newlen = newoff + t->len;
         rcu_read_unlock();
 
-        new = krealloc(ct->ext, newlen, gfp);
+        new = __krealloc(ct->ext, newlen, gfp);
         if (!new)
                 return NULL;
 
@@ -115,10 +115,10 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
                 ct->ext = new;
         }
 
-        ct->ext->offset[id] = newoff;
-        ct->ext->len = newlen;
-        memset((void *)ct->ext + newoff, 0, newlen - newoff);
-        return (void *)ct->ext + newoff;
+        new->offset[id] = newoff;
+        new->len = newlen;
+        memset((void *)new + newoff, 0, newlen - newoff);
+        return (void *)new + newoff;
 }
 EXPORT_SYMBOL(__nf_ct_ext_add);
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 98bfe277eab2..b0eacc0007cc 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -158,9 +158,10 @@ static void netlink_sock_destruct(struct sock *sk)
                 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
                 return;
         }
-        BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
-        BUG_TRAP(!nlk_sk(sk)->groups);
+
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(nlk_sk(sk)->groups);
 }
 
 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d56cae112dc8..c718e7e3f7de 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -260,8 +260,8 @@ static inline struct packet_sock *pkt_sk(struct sock *sk)
 
 static void packet_sock_destruct(struct sock *sk)
 {
-        BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
 
         if (!sock_flag(sk, SOCK_DEAD)) {
                 printk("Attempt to release alive packet socket: %p\n", sk);
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 4b2682feeedc..32e489118beb 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -660,9 +660,9 @@ static void rxrpc_sock_destructor(struct sock *sk)
 
         rxrpc_purge_queue(&sk->sk_receive_queue);
 
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
-        BUG_TRAP(sk_unhashed(sk));
-        BUG_TRAP(!sk->sk_socket);
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(!sk_unhashed(sk));
+        WARN_ON(sk->sk_socket);
 
         if (!sock_flag(sk, SOCK_DEAD)) {
                 printk("Attempt to release alive rxrpc socket: %p\n", sk);
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 74e662cbb2c5..d308c19aa3f9 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -41,7 +41,7 @@ void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
                         return;
                 }
         }
-        BUG_TRAP(0);
+        WARN_ON(1);
 }
 EXPORT_SYMBOL(tcf_hash_destroy);
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 32c3f9d9fb7a..38015b493947 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -116,7 +116,7 @@ static void tcf_police_destroy(struct tcf_police *p)
                         return;
                 }
         }
-        BUG_TRAP(0);
+        WARN_ON(1);
 }
 
 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 527db2559dd2..246f9065ce34 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -345,7 +345,7 @@ static int u32_delete_key(struct tcf_proto *tp, struct tc_u_knode* key)
                         }
                 }
         }
-        BUG_TRAP(0);
+        WARN_ON(1);
         return 0;
 }
 
@@ -368,7 +368,7 @@ static int u32_destroy_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
         struct tc_u_common *tp_c = tp->data;
         struct tc_u_hnode **hn;
 
-        BUG_TRAP(!ht->refcnt);
+        WARN_ON(ht->refcnt);
 
         u32_clear_hnode(tp, ht);
 
@@ -380,7 +380,7 @@ static int u32_destroy_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
                 }
         }
 
-        BUG_TRAP(0);
+        WARN_ON(1);
         return -ENOENT;
 }
 
@@ -389,7 +389,7 @@ static void u32_destroy(struct tcf_proto *tp)
         struct tc_u_common *tp_c = tp->data;
         struct tc_u_hnode *root_ht = xchg(&tp->root, NULL);
 
-        BUG_TRAP(root_ht != NULL);
+        WARN_ON(root_ht == NULL);
 
         if (root_ht && --root_ht->refcnt == 0)
                 u32_destroy_hnode(tp, root_ht);
@@ -407,7 +407,7 @@ static void u32_destroy(struct tcf_proto *tp)
                 while ((ht = tp_c->hlist) != NULL) {
                         tp_c->hlist = ht->next;
 
-                        BUG_TRAP(ht->refcnt == 0);
+                        WARN_ON(ht->refcnt != 0);
 
                         kfree(ht);
                 }
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 04faa835be17..6b517b9dac5b 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -162,7 +162,7 @@ static void atm_tc_put(struct Qdisc *sch, unsigned long cl)
         qdisc_destroy(flow->q);
         tcf_destroy_chain(&flow->filter_list);
         if (flow->sock) {
-                pr_debug("atm_tc_put: f_count %d\n",
+                pr_debug("atm_tc_put: f_count %ld\n",
                         file_count(flow->sock->file));
                 flow->vcc->pop = flow->old_pop;
                 sockfd_put(flow->sock);
@@ -259,7 +259,7 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
         sock = sockfd_lookup(fd, &error);
         if (!sock)
                 return error;   /* f_count++ */
-        pr_debug("atm_tc_change: f_count %d\n", file_count(sock->file));
+        pr_debug("atm_tc_change: f_count %ld\n", file_count(sock->file));
         if (sock->ops->family != PF_ATMSVC && sock->ops->family != PF_ATMPVC) {
                 error = -EPROTOTYPE;
                 goto err_out;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index f1d2f8ec8b4c..14954bf4a683 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1175,7 +1175,7 @@ static void cbq_unlink_class(struct cbq_class *this)
                                 this->tparent->children = NULL;
                 }
         } else {
-                BUG_TRAP(this->sibling == this);
+                WARN_ON(this->sibling != this);
         }
 }
 
@@ -1699,7 +1699,7 @@ static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
 
-        BUG_TRAP(!cl->filters);
+        WARN_ON(cl->filters);
 
         tcf_destroy_chain(&cl->filter_list);
         qdisc_destroy(cl->q);
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 43abd4d27ea6..fd2a6cadb115 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -746,5 +746,5 @@ void dev_shutdown(struct net_device *dev)
 {
         netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc);
         shutdown_scheduler_queue(dev, &dev->rx_queue, NULL);
-        BUG_TRAP(!timer_pending(&dev->watchdog_timer));
+        WARN_ON(timer_pending(&dev->watchdog_timer));
 }
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 30c999c61b01..75a40951c4f2 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -524,7 +524,7 @@ htb_change_class_mode(struct htb_sched *q, struct htb_class *cl, long *diff)
  */
 static inline void htb_activate(struct htb_sched *q, struct htb_class *cl)
 {
-        BUG_TRAP(!cl->level && cl->un.leaf.q && cl->un.leaf.q->q.qlen);
+        WARN_ON(cl->level || !cl->un.leaf.q || !cl->un.leaf.q->q.qlen);
 
         if (!cl->prio_activity) {
                 cl->prio_activity = 1 << (cl->un.leaf.aprio = cl->un.leaf.prio);
@@ -542,7 +542,7 @@ static inline void htb_activate(struct htb_sched *q, struct htb_class *cl)
  */
 static inline void htb_deactivate(struct htb_sched *q, struct htb_class *cl)
 {
-        BUG_TRAP(cl->prio_activity);
+        WARN_ON(!cl->prio_activity);
 
         htb_deactivate_prios(q, cl);
         cl->prio_activity = 0;
@@ -757,7 +757,7 @@ static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
                 u32 *pid;
         } stk[TC_HTB_MAXDEPTH], *sp = stk;
 
-        BUG_TRAP(tree->rb_node);
+        WARN_ON(!tree->rb_node);
         sp->root = tree->rb_node;
         sp->pptr = pptr;
         sp->pid = pid;
@@ -777,7 +777,7 @@ static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
                                 *sp->pptr = (*sp->pptr)->rb_left;
                         if (sp > stk) {
                                 sp--;
-                                BUG_TRAP(*sp->pptr);
+                                WARN_ON(!*sp->pptr);
                                 if (!*sp->pptr)
                                         return NULL;
                                 htb_next_rb_node(sp->pptr);
@@ -792,7 +792,7 @@ static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
                         sp->pid = cl->un.inner.last_ptr_id + prio;
                 }
         }
-        BUG_TRAP(0);
+        WARN_ON(1);
         return NULL;
 }
 
@@ -810,7 +810,7 @@ static struct sk_buff *htb_dequeue_tree(struct htb_sched *q, int prio,
 
         do {
 next:
-                BUG_TRAP(cl);
+                WARN_ON(!cl);
                 if (!cl)
                         return NULL;
 
@@ -1185,7 +1185,7 @@ static void htb_parent_to_leaf(struct htb_sched *q, struct htb_class *cl,
 {
         struct htb_class *parent = cl->parent;
 
-        BUG_TRAP(!cl->level && cl->un.leaf.q && !cl->prio_activity);
+        WARN_ON(cl->level || !cl->un.leaf.q || cl->prio_activity);
 
         if (parent->cmode != HTB_CAN_SEND)
                 htb_safe_rb_erase(&parent->pq_node, q->wait_pq + parent->level);
@@ -1205,7 +1205,7 @@ static void htb_parent_to_leaf(struct htb_sched *q, struct htb_class *cl,
 static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
 {
         if (!cl->level) {
-                BUG_TRAP(cl->un.leaf.q);
+                WARN_ON(!cl->un.leaf.q);
                 qdisc_destroy(cl->un.leaf.q);
         }
         gen_kill_estimator(&cl->bstats, &cl->rate_est);
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 73f53844ce97..8589da666568 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -536,14 +536,7 @@ static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb)
 
         opt.limit = q->limit;
         opt.divisor = SFQ_HASH_DIVISOR;
-        opt.flows = 0;
-        if (q->tail != SFQ_DEPTH) {
-                unsigned int i;
-
-                for (i = 0; i < SFQ_HASH_DIVISOR; i++)
-                        if (q->ht[i] != SFQ_DEPTH)
-                                opt.flows++;
-        }
+        opt.flows = q->limit;
 
         NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
 
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index ec2a0a33fd78..8472b8b349c4 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -464,7 +464,7 @@ static void sctp_association_destroy(struct sctp_association *asoc)
                 spin_unlock_bh(&sctp_assocs_id_lock);
         }
 
-        BUG_TRAP(!atomic_read(&asoc->rmem_alloc));
+        WARN_ON(atomic_read(&asoc->rmem_alloc));
 
         if (asoc->base.malloced) {
                 kfree(asoc);
diff --git a/net/socket.c b/net/socket.c
index 1310a82cbba7..8ef8ba81b9e2 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -265,7 +265,7 @@ static void sock_destroy_inode(struct inode *inode)
                         container_of(inode, struct socket_alloc, vfs_inode));
 }
 
-static void init_once(struct kmem_cache *cachep, void *foo)
+static void init_once(void *foo)
 {
         struct socket_alloc *ei = (struct socket_alloc *)foo;
 
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 5a9b0e7828cd..23a2b8f6dc49 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -897,7 +897,7 @@ static struct file_system_type rpc_pipe_fs_type = {
 };
 
 static void
-init_once(struct kmem_cache * cachep, void *foo)
+init_once(void *foo)
 {
         struct rpc_inode *rpci = (struct rpc_inode *) foo;
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 835d27413083..5a32cb7c4bb4 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -310,8 +310,7 @@ svc_pool_map_set_cpumask(struct task_struct *task, unsigned int pidx)
         switch (m->mode) {
         case SVC_POOL_PERCPU:
         {
-                cpumask_of_cpu_ptr(cpumask, node);
-                set_cpus_allowed_ptr(task, cpumask);
+                set_cpus_allowed_ptr(task, &cpumask_of_cpu(node));
                 break;
         }
         case SVC_POOL_PERNODE:
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index a19b22b452a3..84d328329d98 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -169,7 +169,8 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
                                           (void *)
                                           vec->sge[xdr_sge_no].iov_base + sge_off,
                                           sge_bytes, DMA_TO_DEVICE);
-                if (dma_mapping_error(sge[sge_no].addr))
+                if (dma_mapping_error(xprt->sc_cm_id->device->dma_device,
+                                        sge[sge_no].addr))
                         goto err;
                 sge_off = 0;
                 sge_no++;
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 63ada437fc2f..972201cd5fa7 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -29,10 +29,15 @@
 #include <linux/if_tr.h>
 #endif
 
-static struct list_head *
+static struct ctl_table_set *
 net_ctl_header_lookup(struct ctl_table_root *root, struct nsproxy *namespaces)
 {
-        return &namespaces->net_ns->sysctl_table_headers;
+        return &namespaces->net_ns->sysctls;
+}
+
+static int is_seen(struct ctl_table_set *set)
+{
+        return &current->nsproxy->net_ns->sysctls == set;
 }
 
 /* Return standard mode bits for table entry. */
@@ -53,13 +58,6 @@ static struct ctl_table_root net_sysctl_root = {
         .permissions = net_ctl_permissions,
 };
 
-static LIST_HEAD(net_sysctl_ro_tables);
-static struct list_head *net_ctl_ro_header_lookup(struct ctl_table_root *root,
-                struct nsproxy *namespaces)
-{
-        return &net_sysctl_ro_tables;
-}
-
 static int net_ctl_ro_header_perms(struct ctl_table_root *root,
                 struct nsproxy *namespaces, struct ctl_table *table)
 {
@@ -70,19 +68,20 @@ static int net_ctl_ro_header_perms(struct ctl_table_root *root,
 }
 
 static struct ctl_table_root net_sysctl_ro_root = {
-        .lookup = net_ctl_ro_header_lookup,
         .permissions = net_ctl_ro_header_perms,
 };
 
 static int sysctl_net_init(struct net *net)
 {
-        INIT_LIST_HEAD(&net->sysctl_table_headers);
+        setup_sysctl_set(&net->sysctls,
+                         &net_sysctl_ro_root.default_set,
+                         is_seen);
         return 0;
 }
 
 static void sysctl_net_exit(struct net *net)
 {
-        WARN_ON(!list_empty(&net->sysctl_table_headers));
+        WARN_ON(!list_empty(&net->sysctls.list));
         return;
 }
 
@@ -98,6 +97,7 @@ static __init int sysctl_init(void)
         if (ret)
                 goto out;
         register_sysctl_root(&net_sysctl_root);
+        setup_sysctl_set(&net_sysctl_ro_root.default_set, NULL, NULL);
         register_sysctl_root(&net_sysctl_ro_root);
 out:
         return ret;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 70ceb1604ad8..015606b54d9b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -227,7 +227,7 @@ static void __unix_remove_socket(struct sock *sk)
 
 static void __unix_insert_socket(struct hlist_head *list, struct sock *sk)
 {
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         sk_add_node(sk, list);
 }
 
@@ -350,9 +350,9 @@ static void unix_sock_destructor(struct sock *sk)
 
         skb_queue_purge(&sk->sk_receive_queue);
 
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
-        BUG_TRAP(sk_unhashed(sk));
-        BUG_TRAP(!sk->sk_socket);
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(!sk_unhashed(sk));
+        WARN_ON(sk->sk_socket);
         if (!sock_flag(sk, SOCK_DEAD)) {
                 printk("Attempt to release alive unix socket: %p\n", sk);
                 return;
@@ -603,7 +603,7 @@ static struct sock * unix_create1(struct net *net, struct socket *sock)
         u->dentry = NULL;
         u->mnt    = NULL;
         spin_lock_init(&u->lock);
-        atomic_set(&u->inflight, 0);
+        atomic_long_set(&u->inflight, 0);
         INIT_LIST_HEAD(&u->link);
         mutex_init(&u->readlock); /* single task reading lock */
         init_waitqueue_head(&u->peer_wait);
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index ebdff3d877a1..2a27b84f740b 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -127,7 +127,7 @@ void unix_inflight(struct file *fp)
         if(s) {
                 struct unix_sock *u = unix_sk(s);
                 spin_lock(&unix_gc_lock);
-                if (atomic_inc_return(&u->inflight) == 1) {
+                if (atomic_long_inc_return(&u->inflight) == 1) {
                         BUG_ON(!list_empty(&u->link));
                         list_add_tail(&u->link, &gc_inflight_list);
                 } else {
@@ -145,7 +145,7 @@ void unix_notinflight(struct file *fp)
                 struct unix_sock *u = unix_sk(s);
                 spin_lock(&unix_gc_lock);
                 BUG_ON(list_empty(&u->link));
-                if (atomic_dec_and_test(&u->inflight))
+                if (atomic_long_dec_and_test(&u->inflight))
                         list_del_init(&u->link);
                 unix_tot_inflight--;
                 spin_unlock(&unix_gc_lock);
@@ -237,17 +237,17 @@ static void scan_children(struct sock *x, void (*func)(struct unix_sock *),
 
 static void dec_inflight(struct unix_sock *usk)
 {
-        atomic_dec(&usk->inflight);
+        atomic_long_dec(&usk->inflight);
 }
 
 static void inc_inflight(struct unix_sock *usk)
 {
-        atomic_inc(&usk->inflight);
+        atomic_long_inc(&usk->inflight);
 }
 
 static void inc_inflight_move_tail(struct unix_sock *u)
 {
-        atomic_inc(&u->inflight);
+        atomic_long_inc(&u->inflight);
         /*
          * If this is still a candidate, move it to the end of the
          * list, so that it's checked even if it was already passed
@@ -288,11 +288,11 @@ void unix_gc(void)
          * before the detach without atomicity guarantees.
          */
         list_for_each_entry_safe(u, next, &gc_inflight_list, link) {
-                int total_refs;
-                int inflight_refs;
+                long total_refs;
+                long inflight_refs;
 
                 total_refs = file_count(u->sk.sk_socket->file);
-                inflight_refs = atomic_read(&u->inflight);
+                inflight_refs = atomic_long_read(&u->inflight);
 
                 BUG_ON(inflight_refs < 1);
                 BUG_ON(total_refs < inflight_refs);
@@ -324,7 +324,7 @@ void unix_gc(void)
                 /* Move cursor to after the current position. */
                 list_move(&cursor, &u->link);
 
-                if (atomic_read(&u->inflight) > 0) {
+                if (atomic_long_read(&u->inflight) > 0) {
                         list_move_tail(&u->link, &gc_inflight_list);
                         u->gc_candidate = 0;
                         scan_children(&u->sk, inc_inflight_move_tail, NULL);
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 23a2cc04b8cd..96036cf2216d 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -718,7 +718,7 @@ int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -748,7 +748,7 @@ int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index 800f669083fb..c609a4b98e15 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -22,7 +22,6 @@
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/percpu.h>
-#include <linux/rtnetlink.h>
 #include <linux/smp.h>
 #include <linux/vmalloc.h>
 #include <net/ip.h>
@@ -251,7 +250,7 @@ static void ipcomp_free_tfms(struct crypto_comp **tfms)
                         break;
         }
 
-        BUG_TRAP(pos);
+        WARN_ON(!pos);
 
         if (--pos->users)
                 return;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 72fddafd891a..4c6914ef7d92 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -538,7 +538,7 @@ EXPORT_SYMBOL(xfrm_state_alloc);
 
 void __xfrm_state_destroy(struct xfrm_state *x)
 {
-        BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
+        WARN_ON(x->km.state != XFRM_STATE_DEAD);
 
         spin_lock_bh(&xfrm_state_lock);
         list_del(&x->all);