Merge commit 'v2.6.27-rc3' into x86/prototypes

Conflicts:

	include/asm-x86/dma-mapping.h

Signed-off-by: Ingo Molnar <mingo@elte.hu>

149 files changed, 2125 insertions, 1792 deletions

diff --git a/net/802/psnap.c b/net/802/psnap.c
index ea4643931446..b3cfe5a14fca 100644
--- a/net/802/psnap.c
+++ b/net/802/psnap.c
@@ -31,11 +31,9 @@ static struct llc_sap *snap_sap;
  */
 static struct datalink_proto *find_snap_client(unsigned char *desc)
 {
-        struct list_head *entry;
         struct datalink_proto *proto = NULL, *p;
 
-        list_for_each_rcu(entry, &snap_list) {
-                p = list_entry(entry, struct datalink_proto, node);
+        list_for_each_entry_rcu(p, &snap_list, node) {
                 if (!memcmp(p->type, desc, 5)) {
                         proto = p;
                         break;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index f42bc2b26b85..4bf014e51f8c 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -569,6 +569,7 @@ static void vlan_dev_set_rx_mode(struct net_device *vlan_dev)
  * separate class since they always nest.
  */
 static struct lock_class_key vlan_netdev_xmit_lock_key;
+static struct lock_class_key vlan_netdev_addr_lock_key;
 
 static void vlan_dev_set_lockdep_one(struct net_device *dev,
                                      struct netdev_queue *txq,
@@ -581,6 +582,9 @@ static void vlan_dev_set_lockdep_one(struct net_device *dev,
 
 static void vlan_dev_set_lockdep_class(struct net_device *dev, int subclass)
 {
+        lockdep_set_class_and_subclass(&dev->addr_list_lock,
+                                       &vlan_netdev_addr_lock_key,
+                                       subclass);
         netdev_for_each_tx_queue(dev, vlan_dev_set_lockdep_one, &subclass);
 }
 
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 4507f744f44e..cdf137af7adc 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -1285,7 +1285,7 @@ static int p9_socket_open(struct p9_trans *trans, struct socket *csocket)
         int fd, ret;
 
         csocket->sk->sk_allocation = GFP_NOIO;
-        fd = sock_map_fd(csocket);
+        fd = sock_map_fd(csocket, 0);
         if (fd < 0) {
                 P9_EPRINTK(KERN_ERR, "p9_socket_open: failed to map fd\n");
                 return fd;
diff --git a/net/Kconfig b/net/Kconfig
index b98668751749..7612cc8c337c 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -2,9 +2,7 @@
 # Network configuration
 #
 
-menu "Networking"
-
-config NET
+menuconfig NET
         bool "Networking support"
         ---help---
           Unless you really know what you are doing, you should say Y here.
@@ -22,7 +20,6 @@ config NET
           recommended to read the NET-HOWTO, available from
           <http://www.tldp.org/docs.html#howto>.
 
-# Make sure that all config symbols are dependent on NET
 if NET
 
 menu "Networking options"
@@ -252,5 +249,3 @@ source "net/rfkill/Kconfig"
 source "net/9p/Kconfig"
 
 endif   # if NET
-endmenu # Networking
-
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 07b5b82c5eab..0c850427a85b 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -959,7 +959,7 @@ static unsigned long atalk_sum_skb(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -986,7 +986,7 @@ static unsigned long atalk_sum_skb(const struct sk_buff *skb, int offset,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 4fccaa1e07be..11b16d16661c 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -62,11 +62,13 @@ static void MPOA_cache_impos_rcvd(struct k_message *msg, struct mpoa_client *mpc
 static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
 static void set_mps_mac_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
 
-static uint8_t *copy_macs(struct mpoa_client *mpc, uint8_t *router_mac,
-                          uint8_t *tlvs, uint8_t mps_macs, uint8_t device_type);
+static const uint8_t *copy_macs(struct mpoa_client *mpc,
+                                const uint8_t *router_mac,
+                                const uint8_t *tlvs, uint8_t mps_macs,
+                                uint8_t device_type);
 static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry);
 
-static void send_set_mps_ctrl_addr(char *addr, struct mpoa_client *mpc);
+static void send_set_mps_ctrl_addr(const char *addr, struct mpoa_client *mpc);
 static void mpoad_close(struct atm_vcc *vcc);
 static int msg_from_mpoad(struct atm_vcc *vcc, struct sk_buff *skb);
 
@@ -351,12 +353,12 @@ static const char *mpoa_device_type_string(char type)
  * lec sees a TLV it uses the pointer to call this function.
  *
  */
-static void lane2_assoc_ind(struct net_device *dev, uint8_t *mac_addr,
-                            uint8_t *tlvs, uint32_t sizeoftlvs)
+static void lane2_assoc_ind(struct net_device *dev, const u8 *mac_addr,
+                            const u8 *tlvs, u32 sizeoftlvs)
 {
         uint32_t type;
         uint8_t length, mpoa_device_type, number_of_mps_macs;
-        uint8_t *end_of_tlvs;
+        const uint8_t *end_of_tlvs;
         struct mpoa_client *mpc;
 
         mpoa_device_type = number_of_mps_macs = 0; /* silence gcc */
@@ -430,8 +432,10 @@ static void lane2_assoc_ind(struct net_device *dev, uint8_t *mac_addr,
  * plus the possible MAC address(es) to mpc->mps_macs.
  * For a freshly allocated MPOA client mpc->mps_macs == 0.
  */
-static uint8_t *copy_macs(struct mpoa_client *mpc, uint8_t *router_mac,
-                          uint8_t *tlvs, uint8_t mps_macs, uint8_t device_type)
+static const uint8_t *copy_macs(struct mpoa_client *mpc,
+                                const uint8_t *router_mac,
+                                const uint8_t *tlvs, uint8_t mps_macs,
+                                uint8_t device_type)
 {
         int num_macs;
         num_macs = (mps_macs > 1) ? mps_macs : 1;
@@ -811,7 +815,7 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
         return arg;
 }
 
-static void send_set_mps_ctrl_addr(char *addr, struct mpoa_client *mpc)
+static void send_set_mps_ctrl_addr(const char *addr, struct mpoa_client *mpc)
 {
         struct k_message mesg;
 
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index f597987b2424..f288fc4aef9b 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -36,6 +36,7 @@ static struct ctl_path ax25_path[] = {
         { .procname = "ax25", .ctl_name = NET_AX25, },
         { }
 };
+
 static const ctl_table ax25_param_table[] = {
         {
                 .ctl_name       = NET_AX25_IP_DEFAULT_MODE,
@@ -167,6 +168,7 @@ static const ctl_table ax25_param_table[] = {
                 .extra1         = &min_proto,
                 .extra2         = &max_proto
         },
+#ifdef CONFIG_AX25_DAMA_SLAVE
         {
                 .ctl_name       = NET_AX25_DAMA_SLAVE_TIMEOUT,
                 .procname       = "dama_slave_timeout",
@@ -177,6 +179,8 @@ static const ctl_table ax25_param_table[] = {
                 .extra1         = &min_ds_timeout,
                 .extra2         = &max_ds_timeout
         },
+#endif
+
         { .ctl_name = 0 }       /* that's all, folks! */
 };
 
@@ -210,16 +214,6 @@ void ax25_register_sysctl(void)
                 ax25_table[n].procname     = ax25_dev->dev->name;
                 ax25_table[n].mode         = 0555;
 
-#ifndef CONFIG_AX25_DAMA_SLAVE
-                /*
-                 * We do not wish to have a representation of this parameter
-                 * in /proc/sys/ when configured *not* to include the
-                 * AX.25 DAMA slave code, do we?
-                 */
-
-                child[AX25_VALUES_DS_TIMEOUT].procname = NULL;
-#endif
-
                 child[AX25_MAX_VALUES].ctl_name = 0;    /* just in case... */
 
                 for (k = 0; k < AX25_MAX_VALUES; k++)
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 021172c0e666..12bba6207a8d 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -57,7 +57,10 @@
 #define BT_DBG(D...)
 #endif
 
-#define VERSION "1.2"
+#define VERSION "1.3"
+
+static int compress_src = 1;
+static int compress_dst = 1;
 
 static LIST_HEAD(bnep_session_list);
 static DECLARE_RWSEM(bnep_session_sem);
@@ -418,10 +421,10 @@ static inline int bnep_tx_frame(struct bnep_session *s, struct sk_buff *skb)
         iv[il++] = (struct kvec) { &type, 1 };
         len++;
 
-        if (!compare_ether_addr(eh->h_dest, s->eh.h_source))
+        if (compress_src && !compare_ether_addr(eh->h_dest, s->eh.h_source))
                 type |= 0x01;
 
-        if (!compare_ether_addr(eh->h_source, s->eh.h_dest))
+        if (compress_dst && !compare_ether_addr(eh->h_source, s->eh.h_dest))
                 type |= 0x02;
 
         if (type)
@@ -727,6 +730,12 @@ static void __exit bnep_exit(void)
 module_init(bnep_init);
 module_exit(bnep_exit);
 
+module_param(compress_src, bool, 0644);
+MODULE_PARM_DESC(compress_src, "Compress sources headers");
+
+module_param(compress_dst, bool, 0644);
+MODULE_PARM_DESC(compress_dst, "Compress destination headers");
+
 MODULE_AUTHOR("David Libault <david.libault@inventel.fr>, Maxim Krasnyansky <maxk@qualcomm.com>");
 MODULE_DESCRIPTION("Bluetooth BNEP ver " VERSION);
 MODULE_VERSION(VERSION);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 844ca5f1b2d4..c85bf8f678dc 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -398,10 +398,6 @@ int hci_register_sysfs(struct hci_dev *hdev)
                 if (device_create_file(dev, bt_attrs[i]) < 0)
                         BT_ERR("Failed to create device attribute");
 
-        if (sysfs_create_link(&bt_class->subsys.kobj,
-                                &dev->kobj, kobject_name(&dev->kobj)) < 0)
-                BT_ERR("Failed to create class symlink");
-
         return 0;
 }
 
@@ -409,9 +405,6 @@ void hci_unregister_sysfs(struct hci_dev *hdev)
 {
         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
 
-        sysfs_remove_link(&bt_class->subsys.kobj,
-                                        kobject_name(&hdev->dev.kobj));
-
         device_del(&hdev->dev);
 }
 
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index d9449df7cad5..9b58d70b0e7d 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -68,10 +68,17 @@ static int br_dev_stop(struct net_device *dev)
 
 static int br_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if (new_mtu < 68 || new_mtu > br_min_mtu(netdev_priv(dev)))
+        struct net_bridge *br = netdev_priv(dev);
+        if (new_mtu < 68 || new_mtu > br_min_mtu(br))
                 return -EINVAL;
 
         dev->mtu = new_mtu;
+
+#ifdef CONFIG_BRIDGE_NETFILTER
+        /* remember the MTU in the rtable for PMTU */
+        br->fake_rtable.u.dst.metrics[RTAX_MTU - 1] = new_mtu;
+#endif
+
         return 0;
 }
 
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index a072ea5ca6f5..63c18aacde8c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -202,6 +202,9 @@ static struct net_device *new_bridge_dev(const char *name)
         br->topology_change = 0;
         br->topology_change_detected = 0;
         br->ageing_time = 300 * HZ;
+
+        br_netfilter_rtable_init(br);
+
         INIT_LIST_HEAD(&br->age_list);
 
         br_stp_timer_init(br);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index bb90cd7bace3..6a9a6cd74b1e 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -101,33 +101,30 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
          pppoe_proto(skb) == htons(PPP_IPV6) && \
          brnf_filter_pppoe_tagged)
 
-/* We need these fake structures to make netfilter happy --
- * lots of places assume that skb->dst != NULL, which isn't
- * all that unreasonable.
- *
+/*
+ * Initialize bogus route table used to keep netfilter happy.
  * Currently, we fill in the PMTU entry because netfilter
  * refragmentation needs it, and the rt_flags entry because
  * ipt_REJECT needs it.  Future netfilter modules might
- * require us to fill additional fields. */
-static struct net_device __fake_net_device = {
-        .hard_header_len        = ETH_HLEN,
-#ifdef CONFIG_NET_NS
-        .nd_net                 = &init_net,
-#endif
-};
+ * require us to fill additional fields.
+ */
+void br_netfilter_rtable_init(struct net_bridge *br)
+{
+        struct rtable *rt = &br->fake_rtable;
 
-static struct rtable __fake_rtable = {
-        .u = {
-                .dst = {
-                        .__refcnt               = ATOMIC_INIT(1),
-                        .dev                    = &__fake_net_device,
-                        .path                   = &__fake_rtable.u.dst,
-                        .metrics                = {[RTAX_MTU - 1] = 1500},
-                        .flags                  = DST_NOXFRM,
-                }
-        },
-        .rt_flags       = 0,
-};
+        atomic_set(&rt->u.dst.__refcnt, 1);
+        rt->u.dst.dev = br->dev;
+        rt->u.dst.path = &rt->u.dst;
+        rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
+        rt->u.dst.flags = DST_NOXFRM;
+}
+
+static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
+{
+        struct net_bridge_port *port = rcu_dereference(dev->br_port);
+
+        return port ? &port->br->fake_rtable : NULL;
+}
 
 static inline struct net_device *bridge_parent(const struct net_device *dev)
 {
@@ -226,8 +223,12 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
         }
         nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
 
-        skb->rtable = &__fake_rtable;
-        dst_hold(&__fake_rtable.u.dst);
+        skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
+        if (!skb->rtable) {
+                kfree_skb(skb);
+                return 0;
+        }
+        dst_hold(&skb->rtable->u.dst);
 
         skb->dev = nf_bridge->physindev;
         nf_bridge_push_encap_header(skb);
@@ -391,8 +392,12 @@ bridged_dnat:
                         skb->pkt_type = PACKET_HOST;
                 }
         } else {
-                skb->rtable = &__fake_rtable;
-                dst_hold(&__fake_rtable.u.dst);
+                skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
+                if (!skb->rtable) {
+                        kfree_skb(skb);
+                        return 0;
+                }
+                dst_hold(&skb->rtable->u.dst);
         }
 
         skb->dev = nf_bridge->physindev;
@@ -611,8 +616,8 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
                                    const struct net_device *out,
                                    int (*okfn)(struct sk_buff *))
 {
-        if (skb->rtable == &__fake_rtable) {
-                dst_release(&__fake_rtable.u.dst);
+        if (skb->rtable && skb->rtable == bridge_parent_rtable(in)) {
+                dst_release(&skb->rtable->u.dst);
                 skb->rtable = NULL;
         }
 
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 815ed38925b2..c3dc18ddc043 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -15,6 +15,7 @@
 
 #include <linux/netdevice.h>
 #include <linux/if_bridge.h>
+#include <net/route.h>
 
 #define BR_HASH_BITS 8
 #define BR_HASH_SIZE (1 << BR_HASH_BITS)
@@ -92,6 +93,9 @@ struct net_bridge
         struct hlist_head               hash[BR_HASH_SIZE];
         struct list_head                age_list;
         unsigned long                   feature_mask;
+#ifdef CONFIG_BRIDGE_NETFILTER
+        struct rtable                   fake_rtable;
+#endif
         unsigned long                   flags;
 #define BR_SET_MAC_ADDR         0x00000001
 
@@ -197,9 +201,11 @@ extern int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __us
 #ifdef CONFIG_BRIDGE_NETFILTER
 extern int br_netfilter_init(void);
 extern void br_netfilter_fini(void);
+extern void br_netfilter_rtable_init(struct net_bridge *);
 #else
 #define br_netfilter_init()     (0)
 #define br_netfilter_fini()     do { } while(0)
+#define br_netfilter_rtable_init(x)
 #endif
 
 /* br_stp.c */
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 921bbe5cb94a..6e63ec3f1fcf 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -368,14 +368,25 @@ static void br_make_blocking(struct net_bridge_port *p)
 /* called under bridge lock */
 static void br_make_forwarding(struct net_bridge_port *p)
 {
-        if (p->state == BR_STATE_BLOCKING) {
-                if (p->br->stp_enabled == BR_KERNEL_STP)
-                        p->state = BR_STATE_LISTENING;
-                else
-                        p->state = BR_STATE_LEARNING;
+        struct net_bridge *br = p->br;
 
-                br_log_state(p);
-                mod_timer(&p->forward_delay_timer, jiffies + p->br->forward_delay);     }
+        if (p->state != BR_STATE_BLOCKING)
+                return;
+
+        if (br->forward_delay == 0) {
+                p->state = BR_STATE_FORWARDING;
+                br_topology_change_detection(br);
+                del_timer(&p->forward_delay_timer);
+        }
+        else if (p->br->stp_enabled == BR_KERNEL_STP)
+                p->state = BR_STATE_LISTENING;
+        else
+                p->state = BR_STATE_LEARNING;
+
+        br_log_state(p);
+
+        if (br->forward_delay != 0)
+                mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);
 }
 
 /* called under bridge lock */
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 690bc3ab186c..1a58af51a2e2 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -93,28 +93,20 @@ static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
 
 static int __init ebtable_filter_init(void)
 {
-        int i, j, ret;
+        int ret;
 
         ret = ebt_register_table(&frame_filter);
         if (ret < 0)
                 return ret;
-        for (i = 0; i < ARRAY_SIZE(ebt_ops_filter); i++)
-                if ((ret = nf_register_hook(&ebt_ops_filter[i])) < 0)
-                        goto cleanup;
-        return ret;
-cleanup:
-        for (j = 0; j < i; j++)
-                nf_unregister_hook(&ebt_ops_filter[j]);
-        ebt_unregister_table(&frame_filter);
+        ret = nf_register_hooks(ebt_ops_filter, ARRAY_SIZE(ebt_ops_filter));
+        if (ret < 0)
+                ebt_unregister_table(&frame_filter);
         return ret;
 }
 
 static void __exit ebtable_filter_fini(void)
 {
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(ebt_ops_filter); i++)
-                nf_unregister_hook(&ebt_ops_filter[i]);
+        nf_unregister_hooks(ebt_ops_filter, ARRAY_SIZE(ebt_ops_filter));
         ebt_unregister_table(&frame_filter);
 }
 
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index 5b495fe2d0b6..f60c1e78e575 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -100,28 +100,20 @@ static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
 
 static int __init ebtable_nat_init(void)
 {
-        int i, ret, j;
+        int ret;
 
         ret = ebt_register_table(&frame_nat);
         if (ret < 0)
                 return ret;
-        for (i = 0; i < ARRAY_SIZE(ebt_ops_nat); i++)
-                if ((ret = nf_register_hook(&ebt_ops_nat[i])) < 0)
-                        goto cleanup;
-        return ret;
-cleanup:
-        for (j = 0; j < i; j++)
-                nf_unregister_hook(&ebt_ops_nat[j]);
-        ebt_unregister_table(&frame_nat);
+        ret = nf_register_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
+        if (ret < 0)
+                ebt_unregister_table(&frame_nat);
         return ret;
 }
 
 static void __exit ebtable_nat_fini(void)
 {
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(ebt_ops_nat); i++)
-                nf_unregister_hook(&ebt_ops_nat[i]);
+        nf_unregister_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
         ebt_unregister_table(&frame_nat);
 }
 
diff --git a/net/compat.c b/net/compat.c
index 6e1b03b51933..67fb6a3834a3 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -722,9 +722,10 @@ EXPORT_SYMBOL(compat_mc_getsockopt);
 
 /* Argument list sizes for compat_sys_socketcall */
 #define AL(x) ((x) * sizeof(u32))
-static unsigned char nas[18]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
+static unsigned char nas[19]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
                                 AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
-                                AL(6),AL(2),AL(5),AL(5),AL(3),AL(3)};
+                                AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
+                                AL(6)};
 #undef AL
 
 asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
@@ -737,13 +738,52 @@ asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, uns
         return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
+asmlinkage long compat_sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
+                                   int __user *upeer_addrlen,
+                                   const compat_sigset_t __user *sigmask,
+                                   compat_size_t sigsetsize, int flags)
+{
+        compat_sigset_t ss32;
+        sigset_t ksigmask, sigsaved;
+        int ret;
+
+        if (sigmask) {
+                if (sigsetsize != sizeof(compat_sigset_t))
+                        return -EINVAL;
+                if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
+                        return -EFAULT;
+                sigset_from_compat(&ksigmask, &ss32);
+
+                sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
+                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
+        }
+
+        ret = do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
+
+        if (ret == -ERESTARTNOHAND) {
+                /*
+                 * Don't restore the signal mask yet. Let do_signal() deliver
+                 * the signal on the way back to userspace, before the signal
+                 * mask is restored.
+                 */
+                if (sigmask) {
+                        memcpy(&current->saved_sigmask, &sigsaved,
+                               sizeof(sigsaved));
+                        set_restore_sigmask();
+                }
+        } else if (sigmask)
+                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
+
+        return ret;
+}
+
 asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
 {
         int ret;
         u32 a[6];
         u32 a0, a1;
 
-        if (call < SYS_SOCKET || call > SYS_RECVMSG)
+        if (call < SYS_SOCKET || call > SYS_PACCEPT)
                 return -EINVAL;
         if (copy_from_user(a, args, nas[call]))
                 return -EFAULT;
@@ -764,7 +804,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
                 ret = sys_listen(a0, a1);
                 break;
         case SYS_ACCEPT:
-                ret = sys_accept(a0, compat_ptr(a1), compat_ptr(a[2]));
+                ret = do_accept(a0, compat_ptr(a1), compat_ptr(a[2]), 0);
                 break;
         case SYS_GETSOCKNAME:
                 ret = sys_getsockname(a0, compat_ptr(a1), compat_ptr(a[2]));
@@ -804,6 +844,10 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
         case SYS_RECVMSG:
                 ret = compat_sys_recvmsg(a0, compat_ptr(a1), a[2]);
                 break;
+        case SYS_PACCEPT:
+                ret = compat_sys_paccept(a0, compat_ptr(a1), compat_ptr(a[2]),
+                                         compat_ptr(a[3]), a[4], a[5]);
+                break;
         default:
                 ret = -EINVAL;
                 break;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 8a28fc93b724..dd61dcad6019 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -285,7 +285,7 @@ int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -315,7 +315,7 @@ int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -366,7 +366,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -402,7 +402,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                 for (; list; list=list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
diff --git a/net/core/dev.c b/net/core/dev.c
index cbc34c0db376..600bb23c4c2e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -261,7 +261,7 @@ static RAW_NOTIFIER_HEAD(netdev_chain);
 
 DEFINE_PER_CPU(struct softnet_data, softnet_data);
 
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
+#ifdef CONFIG_LOCKDEP
 /*
  * register_netdevice() inits txq->_xmit_lock and sets lockdep class
  * according to dev->type
@@ -301,6 +301,7 @@ static const char *netdev_lock_name[] =
          "_xmit_NONE"};
 
 static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE(netdev_lock_type)];
+static struct lock_class_key netdev_addr_lock_key[ARRAY_SIZE(netdev_lock_type)];
 
 static inline unsigned short netdev_lock_pos(unsigned short dev_type)
 {
@@ -313,8 +314,8 @@ static inline unsigned short netdev_lock_pos(unsigned short dev_type)
         return ARRAY_SIZE(netdev_lock_type) - 1;
 }
 
-static inline void netdev_set_lockdep_class(spinlock_t *lock,
-                                            unsigned short dev_type)
+static inline void netdev_set_xmit_lockdep_class(spinlock_t *lock,
+                                                 unsigned short dev_type)
 {
         int i;
 
@@ -322,9 +323,22 @@ static inline void netdev_set_lockdep_class(spinlock_t *lock,
         lockdep_set_class_and_name(lock, &netdev_xmit_lock_key[i],
                                    netdev_lock_name[i]);
 }
+
+static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
+{
+        int i;
+
+        i = netdev_lock_pos(dev->type);
+        lockdep_set_class_and_name(&dev->addr_list_lock,
+                                   &netdev_addr_lock_key[i],
+                                   netdev_lock_name[i]);
+}
 #else
-static inline void netdev_set_lockdep_class(spinlock_t *lock,
-                                            unsigned short dev_type)
+static inline void netdev_set_xmit_lockdep_class(spinlock_t *lock,
+                                                 unsigned short dev_type)
+{
+}
+static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
 {
 }
 #endif
@@ -1327,9 +1341,6 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
 
 void __netif_schedule(struct Qdisc *q)
 {
-        if (WARN_ON_ONCE(q == &noop_qdisc))
-                return;
-
         if (!test_and_set_bit(__QDISC_STATE_SCHED, &q->state)) {
                 struct softnet_data *sd;
                 unsigned long flags;
@@ -1645,32 +1656,6 @@ out_kfree_skb:
         return 0;
 }
 
-/**
- *      dev_queue_xmit - transmit a buffer
- *      @skb: buffer to transmit
- *
- *      Queue a buffer for transmission to a network device. The caller must
- *      have set the device and priority and built the buffer before calling
- *      this function. The function can be called from an interrupt.
- *
- *      A negative errno code is returned on a failure. A success does not
- *      guarantee the frame will be transmitted as it may be dropped due
- *      to congestion or traffic shaping.
- *
- * -----------------------------------------------------------------------------------
- *      I notice this method can also return errors from the queue disciplines,
- *      including NET_XMIT_DROP, which is a positive value.  So, errors can also
- *      be positive.
- *
- *      Regardless of the return value, the skb is consumed, so it is currently
- *      difficult to retry a send to this method.  (You can bump the ref count
- *      before sending to hold a reference for retry if you are careful.)
- *
- *      When calling this method, interrupts MUST be enabled.  This is because
- *      the BH enable code must have IRQs enabled so that it will not deadlock.
- *          --BLG
- */
-
 static u32 simple_tx_hashrnd;
 static int simple_tx_hashrnd_initialized = 0;
 
@@ -1738,6 +1723,31 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
         return netdev_get_tx_queue(dev, queue_index);
 }
 
+/**
+ *      dev_queue_xmit - transmit a buffer
+ *      @skb: buffer to transmit
+ *
+ *      Queue a buffer for transmission to a network device. The caller must
+ *      have set the device and priority and built the buffer before calling
+ *      this function. The function can be called from an interrupt.
+ *
+ *      A negative errno code is returned on a failure. A success does not
+ *      guarantee the frame will be transmitted as it may be dropped due
+ *      to congestion or traffic shaping.
+ *
+ * -----------------------------------------------------------------------------------
+ *      I notice this method can also return errors from the queue disciplines,
+ *      including NET_XMIT_DROP, which is a positive value.  So, errors can also
+ *      be positive.
+ *
+ *      Regardless of the return value, the skb is consumed, so it is currently
+ *      difficult to retry a send to this method.  (You can bump the ref count
+ *      before sending to hold a reference for retry if you are careful.)
+ *
+ *      When calling this method, interrupts MUST be enabled.  This is because
+ *      the BH enable code must have IRQs enabled so that it will not deadlock.
+ *          --BLG
+ */
 int dev_queue_xmit(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
@@ -1786,7 +1796,7 @@ gso:
         skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_EGRESS);
 #endif
         if (q->enqueue) {
-                spinlock_t *root_lock = qdisc_root_lock(q);
+                spinlock_t *root_lock = qdisc_lock(q);
 
                 spin_lock(root_lock);
 
@@ -1795,7 +1805,6 @@ gso:
 
                 spin_unlock(root_lock);
 
-                rc = rc == NET_XMIT_BYPASS ? NET_XMIT_SUCCESS : rc;
                 goto out;
         }
 
@@ -1899,7 +1908,6 @@ int netif_rx(struct sk_buff *skb)
         if (queue->input_pkt_queue.qlen <= netdev_max_backlog) {
                 if (queue->input_pkt_queue.qlen) {
 enqueue:
-                        dev_hold(skb->dev);
                         __skb_queue_tail(&queue->input_pkt_queue, skb);
                         local_irq_restore(flags);
                         return NET_RX_SUCCESS;
@@ -1931,22 +1939,6 @@ int netif_rx_ni(struct sk_buff *skb)
 
 EXPORT_SYMBOL(netif_rx_ni);
 
-static inline struct net_device *skb_bond(struct sk_buff *skb)
-{
-        struct net_device *dev = skb->dev;
-
-        if (dev->master) {
-                if (skb_bond_should_drop(skb)) {
-                        kfree_skb(skb);
-                        return NULL;
-                }
-                skb->dev = dev->master;
-        }
-
-        return dev;
-}
-
-
 static void net_tx_action(struct softirq_action *h)
 {
         struct softnet_data *sd = &__get_cpu_var(softnet_data);
@@ -1963,7 +1955,7 @@ static void net_tx_action(struct softirq_action *h)
                         struct sk_buff *skb = clist;
                         clist = clist->next;
 
-                        BUG_TRAP(!atomic_read(&skb->users));
+                        WARN_ON(atomic_read(&skb->users));
                         __kfree_skb(skb);
                 }
         }
@@ -1985,7 +1977,7 @@ static void net_tx_action(struct softirq_action *h)
                         smp_mb__before_clear_bit();
                         clear_bit(__QDISC_STATE_SCHED, &q->state);
 
-                        root_lock = qdisc_root_lock(q);
+                        root_lock = qdisc_lock(q);
                         if (spin_trylock(root_lock)) {
                                 qdisc_run(q);
                                 spin_unlock(root_lock);
@@ -2090,7 +2082,7 @@ static int ing_filter(struct sk_buff *skb)
         rxq = &dev->rx_queue;
 
         q = rxq->qdisc;
-        if (q) {
+        if (q != &noop_qdisc) {
                 spin_lock(qdisc_lock(q));
                 result = qdisc_enqueue_root(skb, q);
                 spin_unlock(qdisc_lock(q));
@@ -2103,7 +2095,7 @@ static inline struct sk_buff *handle_ing(struct sk_buff *skb,
                                          struct packet_type **pt_prev,
                                          int *ret, struct net_device *orig_dev)
 {
-        if (!skb->dev->rx_queue.qdisc)
+        if (skb->dev->rx_queue.qdisc == &noop_qdisc)
                 goto out;
 
         if (*pt_prev) {
@@ -2173,6 +2165,7 @@ int netif_receive_skb(struct sk_buff *skb)
 {
         struct packet_type *ptype, *pt_prev;
         struct net_device *orig_dev;
+        struct net_device *null_or_orig;
         int ret = NET_RX_DROP;
         __be16 type;
 
@@ -2186,10 +2179,14 @@ int netif_receive_skb(struct sk_buff *skb)
         if (!skb->iif)
                 skb->iif = skb->dev->ifindex;
 
-        orig_dev = skb_bond(skb);
-
-        if (!orig_dev)
-                return NET_RX_DROP;
+        null_or_orig = NULL;
+        orig_dev = skb->dev;
+        if (orig_dev->master) {
+                if (skb_bond_should_drop(skb))
+                        null_or_orig = orig_dev; /* deliver only exact match */
+                else
+                        skb->dev = orig_dev->master;
+        }
 
         __get_cpu_var(netdev_rx_stat).total++;
 
@@ -2213,7 +2210,8 @@ int netif_receive_skb(struct sk_buff *skb)
 #endif
 
         list_for_each_entry_rcu(ptype, &ptype_all, list) {
-                if (!ptype->dev || ptype->dev == skb->dev) {
+                if (ptype->dev == null_or_orig || ptype->dev == skb->dev ||
+                    ptype->dev == orig_dev) {
                         if (pt_prev)
                                 ret = deliver_skb(skb, pt_prev, orig_dev);
                         pt_prev = ptype;
@@ -2238,7 +2236,8 @@ ncls:
         list_for_each_entry_rcu(ptype,
                         &ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) {
                 if (ptype->type == type &&
-                    (!ptype->dev || ptype->dev == skb->dev)) {
+                    (ptype->dev == null_or_orig || ptype->dev == skb->dev ||
+                     ptype->dev == orig_dev)) {
                         if (pt_prev)
                                 ret = deliver_skb(skb, pt_prev, orig_dev);
                         pt_prev = ptype;
@@ -2260,6 +2259,20 @@ out:
         return ret;
 }
 
+/* Network device is going away, flush any packets still pending  */
+static void flush_backlog(void *arg)
+{
+        struct net_device *dev = arg;
+        struct softnet_data *queue = &__get_cpu_var(softnet_data);
+        struct sk_buff *skb, *tmp;
+
+        skb_queue_walk_safe(&queue->input_pkt_queue, skb, tmp)
+                if (skb->dev == dev) {
+                        __skb_unlink(skb, &queue->input_pkt_queue);
+                        kfree_skb(skb);
+                }
+}
+
 static int process_backlog(struct napi_struct *napi, int quota)
 {
         int work = 0;
@@ -2269,7 +2282,6 @@ static int process_backlog(struct napi_struct *napi, int quota)
         napi->weight = weight_p;
         do {
                 struct sk_buff *skb;
-                struct net_device *dev;
 
                 local_irq_disable();
                 skb = __skb_dequeue(&queue->input_pkt_queue);
@@ -2278,14 +2290,9 @@ static int process_backlog(struct napi_struct *napi, int quota)
                         local_irq_enable();
                         break;
                 }
-
                 local_irq_enable();
 
-                dev = skb->dev;
-
                 netif_receive_skb(skb);
-
-                dev_put(dev);
         } while (++work < quota && jiffies == start_time);
 
         return work;
@@ -2385,7 +2392,7 @@ out:
          */
         if (!cpus_empty(net_dma.channel_mask)) {
                 int chan_idx;
-                for_each_cpu_mask(chan_idx, net_dma.channel_mask) {
+                for_each_cpu_mask_nr(chan_idx, net_dma.channel_mask) {
                         struct dma_chan *chan = net_dma.channels[chan_idx];
                         if (chan)
                                 dma_async_memcpy_issue_pending(chan);
@@ -3837,7 +3844,7 @@ static void rollback_registered(struct net_device *dev)
                 dev->uninit(dev);
 
         /* Notifier chain MUST detach us from master device. */
-        BUG_TRAP(!dev->master);
+        WARN_ON(dev->master);
 
         /* Remove entries from kobject tree */
         netdev_unregister_kobject(dev);
@@ -3852,7 +3859,7 @@ static void __netdev_init_queue_locks_one(struct net_device *dev,
                                           void *_unused)
 {
         spin_lock_init(&dev_queue->_xmit_lock);
-        netdev_set_lockdep_class(&dev_queue->_xmit_lock, dev->type);
+        netdev_set_xmit_lockdep_class(&dev_queue->_xmit_lock, dev->type);
         dev_queue->xmit_lock_owner = -1;
 }
 
@@ -3897,6 +3904,7 @@ int register_netdevice(struct net_device *dev)
         net = dev_net(dev);
 
         spin_lock_init(&dev->addr_list_lock);
+        netdev_set_addr_lockdep_class(dev);
         netdev_init_queue_locks(dev);
 
         dev->iflink = -1;
@@ -3977,6 +3985,10 @@ int register_netdevice(struct net_device *dev)
                 }
         }
 
+        /* Enable software GSO if SG is supported. */
+        if (dev->features & NETIF_F_SG)
+                dev->features |= NETIF_F_GSO;
+
         netdev_initialize_kobject(dev);
         ret = netdev_register_kobject(dev);
         if (ret)
@@ -4154,13 +4166,15 @@ void netdev_run_todo(void)
 
                 dev->reg_state = NETREG_UNREGISTERED;
 
+                on_each_cpu(flush_backlog, dev, 1);
+
                 netdev_wait_allrefs(dev);
 
                 /* paranoia */
                 BUG_ON(atomic_read(&dev->refcnt));
-                BUG_TRAP(!dev->ip_ptr);
-                BUG_TRAP(!dev->ip6_ptr);
-                BUG_TRAP(!dev->dn_ptr);
+                WARN_ON(dev->ip_ptr);
+                WARN_ON(dev->ip6_ptr);
+                WARN_ON(dev->dn_ptr);
 
                 if (dev->destructor)
                         dev->destructor(dev);
@@ -4189,6 +4203,7 @@ static void netdev_init_queues(struct net_device *dev)
 {
         netdev_init_one_queue(dev, &dev->rx_queue, NULL);
         netdev_for_each_tx_queue(dev, netdev_init_one_queue, NULL);
+        spin_lock_init(&dev->tx_global_lock);
 }
 
 /**
@@ -4207,7 +4222,7 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
 {
         struct netdev_queue *tx;
         struct net_device *dev;
-        int alloc_size;
+        size_t alloc_size;
         void *p;
 
         BUG_ON(strlen(name) >= sizeof(dev->name));
@@ -4227,7 +4242,7 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
                 return NULL;
         }
 
-        tx = kzalloc(sizeof(struct netdev_queue) * queue_count, GFP_KERNEL);
+        tx = kcalloc(queue_count, sizeof(struct netdev_queue), GFP_KERNEL);
         if (!tx) {
                 printk(KERN_ERR "alloc_netdev: Unable to allocate "
                        "tx qdiscs.\n");
@@ -4519,7 +4534,7 @@ static void net_dma_rebalance(struct net_dma *net_dma)
         i = 0;
         cpu = first_cpu(cpu_online_map);
 
-        for_each_cpu_mask(chan_idx, net_dma->channel_mask) {
+        for_each_cpu_mask_nr(chan_idx, net_dma->channel_mask) {
                 chan = net_dma->channels[chan_idx];
 
                 n = ((num_online_cpus() / cpus_weight(net_dma->channel_mask))
@@ -4686,6 +4701,26 @@ err_name:
         return -ENOMEM;
 }
 
+char *netdev_drivername(struct net_device *dev, char *buffer, int len)
+{
+        struct device_driver *driver;
+        struct device *parent;
+
+        if (len <= 0 || !buffer)
+                return buffer;
+        buffer[0] = 0;
+
+        parent = dev->dev.parent;
+
+        if (!parent)
+                return buffer;
+
+        driver = parent->driver;
+        if (driver && driver->name)
+                strlcpy(buffer, driver->name, len);
+        return buffer;
+}
+
 static void __net_exit netdev_exit(struct net *net)
 {
         kfree(net->dev_name_head);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f62c8af85d38..9d92e41826e7 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2281,6 +2281,7 @@ static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
         struct neighbour *n = neigh_get_first(seq);
 
         if (n) {
+                --(*pos);
                 while (*pos) {
                         n = neigh_get_next(seq, n, pos);
                         if (!n)
@@ -2341,6 +2342,7 @@ static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
         struct pneigh_entry *pn = pneigh_get_first(seq);
 
         if (pn) {
+                --(*pos);
                 while (*pos) {
                         pn = pneigh_get_next(seq, pn, pos);
                         if (!pn)
@@ -2354,10 +2356,11 @@ static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
 {
         struct neigh_seq_state *state = seq->private;
         void *rc;
+        loff_t idxpos = *pos;
 
-        rc = neigh_get_idx(seq, pos);
+        rc = neigh_get_idx(seq, &idxpos);
         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
-                rc = pneigh_get_idx(seq, pos);
+                rc = pneigh_get_idx(seq, &idxpos);
 
         return rc;
 }
@@ -2366,7 +2369,6 @@ void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl
         __acquires(tbl->lock)
 {
         struct neigh_seq_state *state = seq->private;
-        loff_t pos_minus_one;
 
         state->tbl = tbl;
         state->bucket = 0;
@@ -2374,8 +2376,7 @@ void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl
 
         read_lock_bh(&tbl->lock);
 
-        pos_minus_one = *pos - 1;
-        return *pos ? neigh_get_idx_any(seq, &pos_minus_one) : SEQ_START_TOKEN;
+        return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
 }
 EXPORT_SYMBOL(neigh_seq_start);
 
@@ -2385,7 +2386,7 @@ void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         void *rc;
 
         if (v == SEQ_START_TOKEN) {
-                rc = neigh_get_idx(seq, pos);
+                rc = neigh_get_first(seq);
                 goto out;
         }
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index c12720895ecf..6c7af390be0a 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -70,6 +70,7 @@ static void queue_process(struct work_struct *work)
                 local_irq_save(flags);
                 __netif_tx_lock(txq, smp_processor_id());
                 if (netif_tx_queue_stopped(txq) ||
+                    netif_tx_queue_frozen(txq) ||
                     dev->hard_start_xmit(skb, dev) != NETDEV_TX_OK) {
                         skb_queue_head(&npinfo->txq, skb);
                         __netif_tx_unlock(txq);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index c7d484f7e1c4..526236453908 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -168,7 +168,7 @@
 #include <asm/div64.h>          /* do_div */
 #include <asm/timex.h>
 
-#define VERSION  "pktgen v2.69: Packet Generator for packet performance testing.\n"
+#define VERSION  "pktgen v2.70: Packet Generator for packet performance testing.\n"
 
 #define IP_NAME_SZ 32
 #define MAX_MPLS_LABELS 16 /* This is the max label stack depth */
@@ -189,6 +189,7 @@
 #define F_FLOW_SEQ    (1<<11)   /* Sequential flows */
 #define F_IPSEC_ON    (1<<12)   /* ipsec on for flows */
 #define F_QUEUE_MAP_RND (1<<13) /* queue map Random */
+#define F_QUEUE_MAP_CPU (1<<14) /* queue map mirrors smp_processor_id() */
 
 /* Thread control flag bits */
 #define T_TERMINATE   (1<<0)
@@ -621,6 +622,9 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
         if (pkt_dev->flags & F_QUEUE_MAP_RND)
                 seq_printf(seq,  "QUEUE_MAP_RND  ");
 
+        if (pkt_dev->flags & F_QUEUE_MAP_CPU)
+                seq_printf(seq,  "QUEUE_MAP_CPU  ");
+
         if (pkt_dev->cflows) {
                 if (pkt_dev->flags & F_FLOW_SEQ)
                         seq_printf(seq,  "FLOW_SEQ  "); /*in sequence flows*/
@@ -1134,6 +1138,12 @@ static ssize_t pktgen_if_write(struct file *file,
 
                 else if (strcmp(f, "!QUEUE_MAP_RND") == 0)
                         pkt_dev->flags &= ~F_QUEUE_MAP_RND;
+
+                else if (strcmp(f, "QUEUE_MAP_CPU") == 0)
+                        pkt_dev->flags |= F_QUEUE_MAP_CPU;
+
+                else if (strcmp(f, "!QUEUE_MAP_CPU") == 0)
+                        pkt_dev->flags &= ~F_QUEUE_MAP_CPU;
 #ifdef CONFIG_XFRM
                 else if (strcmp(f, "IPSEC") == 0)
                         pkt_dev->flags |= F_IPSEC_ON;
@@ -1895,6 +1905,23 @@ static int pktgen_device_event(struct notifier_block *unused,
         return NOTIFY_DONE;
 }
 
+static struct net_device *pktgen_dev_get_by_name(struct pktgen_dev *pkt_dev, const char *ifname)
+{
+        char b[IFNAMSIZ+5];
+        int i = 0;
+
+        for(i=0; ifname[i] != '@'; i++) {
+                if(i == IFNAMSIZ)
+                        break;
+
+                b[i] = ifname[i];
+        }
+        b[i] = 0;
+
+        return dev_get_by_name(&init_net, b);
+}
+
+
 /* Associate pktgen_dev with a device. */
 
 static int pktgen_setup_dev(struct pktgen_dev *pkt_dev, const char *ifname)
@@ -1908,7 +1935,7 @@ static int pktgen_setup_dev(struct pktgen_dev *pkt_dev, const char *ifname)
                 pkt_dev->odev = NULL;
         }
 
-        odev = dev_get_by_name(&init_net, ifname);
+        odev = pktgen_dev_get_by_name(pkt_dev, ifname);
         if (!odev) {
                 printk(KERN_ERR "pktgen: no such netdevice: \"%s\"\n", ifname);
                 return -ENODEV;
@@ -2085,15 +2112,19 @@ static inline int f_pick(struct pktgen_dev *pkt_dev)
                 if (pkt_dev->flows[flow].count >= pkt_dev->lflow) {
                         /* reset time */
                         pkt_dev->flows[flow].count = 0;
+                        pkt_dev->flows[flow].flags = 0;
                         pkt_dev->curfl += 1;
                         if (pkt_dev->curfl >= pkt_dev->cflows)
                                 pkt_dev->curfl = 0; /*reset */
                 }
         } else {
                 flow = random32() % pkt_dev->cflows;
+                pkt_dev->curfl = flow;
 
-                if (pkt_dev->flows[flow].count > pkt_dev->lflow)
+                if (pkt_dev->flows[flow].count > pkt_dev->lflow) {
                         pkt_dev->flows[flow].count = 0;
+                        pkt_dev->flows[flow].flags = 0;
+                }
         }
 
         return pkt_dev->curfl;
@@ -2125,7 +2156,11 @@ static void get_ipsec_sa(struct pktgen_dev *pkt_dev, int flow)
 #endif
 static void set_cur_queue_map(struct pktgen_dev *pkt_dev)
 {
-        if (pkt_dev->queue_map_min < pkt_dev->queue_map_max) {
+
+        if (pkt_dev->flags & F_QUEUE_MAP_CPU)
+                pkt_dev->cur_queue_map = smp_processor_id();
+
+        else if (pkt_dev->queue_map_min < pkt_dev->queue_map_max) {
                 __u16 t;
                 if (pkt_dev->flags & F_QUEUE_MAP_RND) {
                         t = random32() %
@@ -2162,7 +2197,7 @@ static void mod_cur_headers(struct pktgen_dev *pkt_dev)
                         mc = random32() % pkt_dev->src_mac_count;
                 else {
                         mc = pkt_dev->cur_src_mac_offset++;
-                        if (pkt_dev->cur_src_mac_offset >
+                        if (pkt_dev->cur_src_mac_offset >=
                             pkt_dev->src_mac_count)
                                 pkt_dev->cur_src_mac_offset = 0;
                 }
@@ -2189,7 +2224,7 @@ static void mod_cur_headers(struct pktgen_dev *pkt_dev)
 
                 else {
                         mc = pkt_dev->cur_dst_mac_offset++;
-                        if (pkt_dev->cur_dst_mac_offset >
+                        if (pkt_dev->cur_dst_mac_offset >=
                             pkt_dev->dst_mac_count) {
                                 pkt_dev->cur_dst_mac_offset = 0;
                         }
@@ -3305,6 +3340,7 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
 
         txq = netdev_get_tx_queue(odev, queue_map);
         if (netif_tx_queue_stopped(txq) ||
+            netif_tx_queue_frozen(txq) ||
             need_resched()) {
                 idle_start = getCurUs();
 
@@ -3320,7 +3356,8 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
 
                 pkt_dev->idle_acc += getCurUs() - idle_start;
 
-                if (netif_tx_queue_stopped(txq)) {
+                if (netif_tx_queue_stopped(txq) ||
+                    netif_tx_queue_frozen(txq)) {
                         pkt_dev->next_tx_us = getCurUs();       /* TODO */
                         pkt_dev->next_tx_ns = 0;
                         goto out;       /* Try the next interface */
@@ -3352,7 +3389,8 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
         txq = netdev_get_tx_queue(odev, queue_map);
 
         __netif_tx_lock_bh(txq);
-        if (!netif_tx_queue_stopped(txq)) {
+        if (!netif_tx_queue_stopped(txq) &&
+            !netif_tx_queue_frozen(txq)) {
 
                 atomic_inc(&(pkt_dev->skb->users));
               retry_now:
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 2d3035d3abd7..7552495aff7a 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -123,7 +123,7 @@ void reqsk_queue_destroy(struct request_sock_queue *queue)
                 }
         }
 
-        BUG_TRAP(lopt->qlen == 0);
+        WARN_ON(lopt->qlen != 0);
         if (lopt_size > PAGE_SIZE)
                 vfree(lopt);
         else
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e4115672b6cf..84640172d65d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -485,6 +485,9 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
         C(head);
         C(data);
         C(truesize);
+#if defined(CONFIG_MAC80211) || defined(CONFIG_MAC80211_MODULE)
+        C(do_not_encrypt);
+#endif
         atomic_set(&n->users, 1);
 
         atomic_inc(&(skb_shinfo(skb)->dataref));
@@ -1200,7 +1203,7 @@ int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len)
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -1229,7 +1232,7 @@ int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len)
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -1475,7 +1478,7 @@ int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int len)
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + frag->size;
                 if ((copy = end - offset) > 0) {
@@ -1503,7 +1506,7 @@ int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int len)
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -1552,7 +1555,7 @@ __wsum skb_checksum(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -1581,7 +1584,7 @@ __wsum skb_checksum(const struct sk_buff *skb, int offset,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -1629,7 +1632,7 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -1662,7 +1665,7 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset,
                         __wsum csum2;
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
@@ -2373,7 +2376,7 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -2397,7 +2400,7 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
diff --git a/net/core/sock.c b/net/core/sock.c
index 10a64d57078c..91f8bbc93526 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -180,7 +180,7 @@ static const char *af_family_clock_key_strings[AF_MAX+1] = {
   "clock-AF_ASH"   , "clock-AF_ECONET"   , "clock-AF_ATMSVC"   ,
   "clock-21"       , "clock-AF_SNA"      , "clock-AF_IRDA"     ,
   "clock-AF_PPPOX" , "clock-AF_WANPIPE"  , "clock-AF_LLC"      ,
-  "clock-27"       , "clock-28"          , "clock-29"          ,
+  "clock-27"       , "clock-28"          , "clock-AF_CAN"      ,
   "clock-AF_TIPC"  , "clock-AF_BLUETOOTH", "clock-AF_IUCV"     ,
   "clock-AF_RXRPC" , "clock-AF_MAX"
 };
diff --git a/net/core/stream.c b/net/core/stream.c
index 4a0ad152c9c4..a6b3437ff082 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -192,13 +192,13 @@ void sk_stream_kill_queues(struct sock *sk)
         __skb_queue_purge(&sk->sk_error_queue);
 
         /* Next, the write queue. */
-        BUG_TRAP(skb_queue_empty(&sk->sk_write_queue));
+        WARN_ON(!skb_queue_empty(&sk->sk_write_queue));
 
         /* Account for returned memory. */
         sk_mem_reclaim(sk);
 
-        BUG_TRAP(!sk->sk_wmem_queued);
-        BUG_TRAP(!sk->sk_forward_alloc);
+        WARN_ON(sk->sk_wmem_queued);
+        WARN_ON(sk->sk_forward_alloc);
 
         /* It is _impossible_ for the backlog to contain anything
          * when we get here.  All user references to this socket
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index a570e2af22cb..f686467ff12b 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -67,7 +67,7 @@ static struct ctl_table net_core_table[] = {
         {
                 .ctl_name       = NET_CORE_MSG_COST,
                 .procname       = "message_cost",
-                .data           = &net_msg_cost,
+                .data           = &net_ratelimit_state.interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec_jiffies,
@@ -76,7 +76,7 @@ static struct ctl_table net_core_table[] = {
         {
                 .ctl_name       = NET_CORE_MSG_BURST,
                 .procname       = "message_burst",
-                .data           = &net_msg_burst,
+                .data           = &net_ratelimit_state.burst,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
diff --git a/net/core/user_dma.c b/net/core/user_dma.c
index c77aff9c6eb3..164b090d5ac3 100644
--- a/net/core/user_dma.c
+++ b/net/core/user_dma.c
@@ -27,13 +27,13 @@
 
 #include <linux/dmaengine.h>
 #include <linux/socket.h>
-#include <linux/rtnetlink.h> /* for BUG_TRAP */
 #include <net/tcp.h>
 #include <net/netdma.h>
 
 #define NET_DMA_DEFAULT_COPYBREAK 4096
 
 int sysctl_tcp_dma_copybreak = NET_DMA_DEFAULT_COPYBREAK;
+EXPORT_SYMBOL(sysctl_tcp_dma_copybreak);
 
 /**
  *      dma_skb_copy_datagram_iovec - Copy a datagram to an iovec.
@@ -71,7 +71,7 @@ int dma_skb_copy_datagram_iovec(struct dma_chan *chan,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 copy = end - offset;
@@ -100,7 +100,7 @@ int dma_skb_copy_datagram_iovec(struct dma_chan *chan,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         copy = end - offset;
diff --git a/net/core/utils.c b/net/core/utils.c
index 8031eb59054e..72e0ebe964a0 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -31,17 +31,16 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 
-int net_msg_cost __read_mostly = 5*HZ;
-int net_msg_burst __read_mostly = 10;
 int net_msg_warn __read_mostly = 1;
 EXPORT_SYMBOL(net_msg_warn);
 
+DEFINE_RATELIMIT_STATE(net_ratelimit_state, 5 * HZ, 10);
 /*
  * All net warning printk()s should be guarded by this function.
  */
 int net_ratelimit(void)
 {
-        return __printk_ratelimit(net_msg_cost, net_msg_burst);
+        return __ratelimit(&net_ratelimit_state);
 }
 EXPORT_SYMBOL(net_ratelimit);
 
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 32617e0576cb..b4bc6e095a0e 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -164,7 +164,7 @@ static inline bool dccp_loss_free(const u64 s1, const u64 s2, const u64 ndp)
 {
         s64 delta = dccp_delta_seqno(s1, s2);
 
-        BUG_TRAP(delta >= 0);
+        WARN_ON(delta < 0);
         return (u64)delta <= ndp + 1;
 }
 
@@ -226,10 +226,11 @@ static inline void dccp_csum_outgoing(struct sk_buff *skb)
 
 extern void dccp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb);
 
-extern int  dccp_retransmit_skb(struct sock *sk, struct sk_buff *skb);
+extern int  dccp_retransmit_skb(struct sock *sk);
 
 extern void dccp_send_ack(struct sock *sk);
-extern void dccp_reqsk_send_ack(struct sk_buff *sk, struct request_sock *rsk);
+extern void dccp_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                                struct request_sock *rsk);
 
 extern void dccp_send_sync(struct sock *sk, const u64 seq,
                            const enum dccp_pkt_type pkt_type);
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 08392ed86c25..df2f110df94a 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -413,7 +413,7 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
 
                 /* Stop the REQUEST timer */
                 inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
-                BUG_TRAP(sk->sk_send_head != NULL);
+                WARN_ON(sk->sk_send_head == NULL);
                 __kfree_skb(sk->sk_send_head);
                 sk->sk_send_head = NULL;
 
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 2622ace17c46..882c5c4de69e 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -196,8 +196,8 @@ static inline void dccp_do_pmtu_discovery(struct sock *sk,
 static void dccp_v4_err(struct sk_buff *skb, u32 info)
 {
         const struct iphdr *iph = (struct iphdr *)skb->data;
-        const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data +
-                                                        (iph->ihl << 2));
+        const u8 offset = iph->ihl << 2;
+        const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
         struct dccp_sock *dp;
         struct inet_sock *inet;
         const int type = icmp_hdr(skb)->type;
@@ -207,7 +207,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
         int err;
         struct net *net = dev_net(skb->dev);
 
-        if (skb->len < (iph->ihl << 2) + 8) {
+        if (skb->len < offset + sizeof(*dh) ||
+            skb->len < offset + __dccp_basic_hdr_len(dh)) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
         }
@@ -238,7 +239,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
         dp = dccp_sk(sk);
         seq = dccp_hdr_seq(dh);
         if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
-            !between48(seq, dp->dccps_swl, dp->dccps_swh)) {
+            !between48(seq, dp->dccps_awl, dp->dccps_awh)) {
                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
                 goto out;
         }
@@ -283,7 +284,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
                  * ICMPs are not backlogged, hence we cannot get an established
                  * socket here.
                  */
-                BUG_TRAP(!req->sk);
+                WARN_ON(req->sk);
 
                 if (seq != dccp_rsk(req)->dreq_iss) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index b74e8b2cbe55..5e1ee0da2c40 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -89,12 +89,19 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
         struct ipv6hdr *hdr = (struct ipv6hdr *)skb->data;
         const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
+        struct dccp_sock *dp;
         struct ipv6_pinfo *np;
         struct sock *sk;
         int err;
         __u64 seq;
         struct net *net = dev_net(skb->dev);
 
+        if (skb->len < offset + sizeof(*dh) ||
+            skb->len < offset + __dccp_basic_hdr_len(dh)) {
+                ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
+                return;
+        }
+
         sk = inet6_lookup(net, &dccp_hashinfo,
                         &hdr->daddr, dh->dccph_dport,
                         &hdr->saddr, dh->dccph_sport, inet6_iif(skb));
@@ -116,6 +123,14 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (sk->sk_state == DCCP_CLOSED)
                 goto out;
 
+        dp = dccp_sk(sk);
+        seq = dccp_hdr_seq(dh);
+        if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
+            !between48(seq, dp->dccps_awl, dp->dccps_awh)) {
+                NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
+                goto out;
+        }
+
         np = inet6_sk(sk);
 
         if (type == ICMPV6_PKT_TOOBIG) {
@@ -168,7 +183,6 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         icmpv6_err_convert(type, code, &err);
 
-        seq = dccp_hdr_seq(dh);
         /* Might be for an request_sock */
         switch (sk->sk_state) {
                 struct request_sock *req, **prev;
@@ -186,7 +200,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                  * ICMPs are not backlogged, hence we cannot get an established
                  * socket here.
                  */
-                BUG_TRAP(req->sk == NULL);
+                WARN_ON(req->sk != NULL);
 
                 if (seq != dccp_rsk(req)->dreq_iss) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 66dca5bba858..b2804e2d1b8c 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -296,7 +296,8 @@ int dccp_child_process(struct sock *parent, struct sock *child,
 
 EXPORT_SYMBOL_GPL(dccp_child_process);
 
-void dccp_reqsk_send_ack(struct sk_buff *skb, struct request_sock *rsk)
+void dccp_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                         struct request_sock *rsk)
 {
         DCCP_BUG("DCCP-ACK packets are never sent in LISTEN/RESPOND state");
 }
diff --git a/net/dccp/output.c b/net/dccp/output.c
index fe20068c5d8e..d06945c7d3df 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -53,8 +53,11 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                                           dccp_packet_hdr_len(dcb->dccpd_type);
                 int err, set_ack = 1;
                 u64 ackno = dp->dccps_gsr;
-
-                dccp_inc_seqno(&dp->dccps_gss);
+                /*
+                 * Increment GSS here already in case the option code needs it.
+                 * Update GSS for real only if option processing below succeeds.
+                 */
+                dcb->dccpd_seq = ADD48(dp->dccps_gss, 1);
 
                 switch (dcb->dccpd_type) {
                 case DCCP_PKT_DATA:
@@ -66,6 +69,9 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 
                 case DCCP_PKT_REQUEST:
                         set_ack = 0;
+                        /* Use ISS on the first (non-retransmitted) Request. */
+                        if (icsk->icsk_retransmits == 0)
+                                dcb->dccpd_seq = dp->dccps_iss;
                         /* fall through */
 
                 case DCCP_PKT_SYNC:
@@ -84,8 +90,6 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                         break;
                 }
 
-                dcb->dccpd_seq = dp->dccps_gss;
-
                 if (dccp_insert_options(sk, skb)) {
                         kfree_skb(skb);
                         return -EPROTO;
@@ -103,7 +107,7 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 /* XXX For now we're using only 48 bits sequence numbers */
                 dh->dccph_x     = 1;
 
-                dp->dccps_awh = dp->dccps_gss;
+                dccp_update_gss(sk, dcb->dccpd_seq);
                 dccp_hdr_set_seq(dh, dp->dccps_gss);
                 if (set_ack)
                         dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), ackno);
@@ -112,6 +116,11 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 case DCCP_PKT_REQUEST:
                         dccp_hdr_request(skb)->dccph_req_service =
                                                         dp->dccps_service;
+                        /*
+                         * Limit Ack window to ISS <= P.ackno <= GSS, so that
+                         * only Responses to Requests we sent are considered.
+                         */
+                        dp->dccps_awl = dp->dccps_iss;
                         break;
                 case DCCP_PKT_RESET:
                         dccp_hdr_reset(skb)->dccph_reset_code =
@@ -284,14 +293,26 @@ void dccp_write_xmit(struct sock *sk, int block)
         }
 }
 
-int dccp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+/**
+ * dccp_retransmit_skb  -  Retransmit Request, Close, or CloseReq packets
+ * There are only four retransmittable packet types in DCCP:
+ * - Request  in client-REQUEST  state (sec. 8.1.1),
+ * - CloseReq in server-CLOSEREQ state (sec. 8.3),
+ * - Close    in   node-CLOSING  state (sec. 8.3),
+ * - Acks in client-PARTOPEN state (sec. 8.1.5, handled by dccp_delack_timer()).
+ * This function expects sk->sk_send_head to contain the original skb.
+ */
+int dccp_retransmit_skb(struct sock *sk)
 {
+        WARN_ON(sk->sk_send_head == NULL);
+
         if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk) != 0)
                 return -EHOSTUNREACH; /* Routing failure or similar. */
 
-        return dccp_transmit_skb(sk, (skb_cloned(skb) ?
-                                      pskb_copy(skb, GFP_ATOMIC):
-                                      skb_clone(skb, GFP_ATOMIC)));
+        /* this count is used to distinguish original and retransmitted skb */
+        inet_csk(sk)->icsk_retransmits++;
+
+        return dccp_transmit_skb(sk, skb_clone(sk->sk_send_head, GFP_ATOMIC));
 }
 
 struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
@@ -437,19 +458,7 @@ static inline void dccp_connect_init(struct sock *sk)
 
         dccp_sync_mss(sk, dst_mtu(dst));
 
-        /*
-         * SWL and AWL are initially adjusted so that they are not less than
-         * the initial Sequence Numbers received and sent, respectively:
-         *      SWL := max(GSR + 1 - floor(W/4), ISR),
-         *      AWL := max(GSS - W' + 1, ISS).
-         * These adjustments MUST be applied only at the beginning of the
-         * connection.
-         */
-        dccp_update_gss(sk, dp->dccps_iss);
-        dccp_set_seqno(&dp->dccps_awl, max48(dp->dccps_awl, dp->dccps_iss));
-
-        /* S.GAR - greatest valid acknowledgement number received on a non-Sync;
-         *         initialized to S.ISS (sec. 8.5)                            */
+        /* Initialise GAR as per 8.5; AWL/AWH are set in dccp_transmit_skb() */
         dp->dccps_gar = dp->dccps_iss;
 
         icsk->icsk_retransmits = 0;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index a0b56009611f..b622d9744856 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -327,7 +327,7 @@ int dccp_disconnect(struct sock *sk, int flags)
         inet_csk_delack_init(sk);
         __sk_dst_reset(sk);
 
-        BUG_TRAP(!inet->num || icsk->icsk_bind_hash);
+        WARN_ON(inet->num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
@@ -981,7 +981,7 @@ adjudge_to_death:
          */
         local_bh_disable();
         bh_lock_sock(sk);
-        BUG_TRAP(!sock_owned_by_user(sk));
+        WARN_ON(sock_owned_by_user(sk));
 
         /* Have we already been destroyed by a softirq or backlog? */
         if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index 3608d5342ca2..54b3c7e9e016 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -99,21 +99,11 @@ static void dccp_retransmit_timer(struct sock *sk)
         }
 
         /*
-         * sk->sk_send_head has to have one skb with
-         * DCCP_SKB_CB(skb)->dccpd_type set to one of the retransmittable DCCP
-         * packet types. The only packets eligible for retransmission are:
-         *      -- Requests in client-REQUEST  state (sec. 8.1.1)
-         *      -- Acks     in client-PARTOPEN state (sec. 8.1.5)
-         *      -- CloseReq in server-CLOSEREQ state (sec. 8.3)
-         *      -- Close    in   node-CLOSING  state (sec. 8.3)                */
-        BUG_TRAP(sk->sk_send_head != NULL);
-
-        /*
          * More than than 4MSL (8 minutes) has passed, a RESET(aborted) was
          * sent, no need to retransmit, this sock is dead.
          */
         if (dccp_write_timeout(sk))
-                goto out;
+                return;
 
         /*
          * We want to know the number of packets retransmitted, not the
@@ -122,30 +112,28 @@ static void dccp_retransmit_timer(struct sock *sk)
         if (icsk->icsk_retransmits == 0)
                 DCCP_INC_STATS_BH(DCCP_MIB_TIMEOUTS);
 
-        if (dccp_retransmit_skb(sk, sk->sk_send_head) < 0) {
+        if (dccp_retransmit_skb(sk) != 0) {
                 /*
                  * Retransmission failed because of local congestion,
                  * do not backoff.
                  */
-                if (icsk->icsk_retransmits == 0)
+                if (--icsk->icsk_retransmits == 0)
                         icsk->icsk_retransmits = 1;
                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                                           min(icsk->icsk_rto,
                                               TCP_RESOURCE_PROBE_INTERVAL),
                                           DCCP_RTO_MAX);
-                goto out;
+                return;
         }
 
 backoff:
         icsk->icsk_backoff++;
-        icsk->icsk_retransmits++;
 
         icsk->icsk_rto = min(icsk->icsk_rto << 1, DCCP_RTO_MAX);
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto,
                                   DCCP_RTO_MAX);
         if (icsk->icsk_retransmits > sysctl_dccp_retries1)
                 __sk_dst_reset(sk);
-out:;
 }
 
 static void dccp_write_timer(unsigned long data)
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 4670683b4688..591ea23639ca 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -356,10 +356,8 @@ config INET_ESP
 
 config INET_IPCOMP
         tristate "IP: IPComp transformation"
-        select XFRM
         select INET_XFRM_TUNNEL
-        select CRYPTO
-        select CRYPTO_DEFLATE
+        select XFRM_IPCOMP
         ---help---
           Support for IP Payload Compression Protocol (IPComp) (RFC3173),
           typically needed for IPsec.
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index dd919d84285f..8a3ac1fa71a9 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -148,10 +148,10 @@ void inet_sock_destruct(struct sock *sk)
                 return;
         }
 
-        BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
-        BUG_TRAP(!sk->sk_wmem_queued);
-        BUG_TRAP(!sk->sk_forward_alloc);
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(sk->sk_wmem_queued);
+        WARN_ON(sk->sk_forward_alloc);
 
         kfree(inet->opt);
         dst_release(sk->sk_dst_cache);
@@ -264,7 +264,6 @@ static inline int inet_netns_ok(struct net *net, int protocol)
 static int inet_create(struct net *net, struct socket *sock, int protocol)
 {
         struct sock *sk;
-        struct list_head *p;
         struct inet_protosw *answer;
         struct inet_sock *inet;
         struct proto *answer_prot;
@@ -281,13 +280,12 @@ static int inet_create(struct net *net, struct socket *sock, int protocol)
         sock->state = SS_UNCONNECTED;
 
         /* Look for the requested type/protocol pair. */
-        answer = NULL;
 lookup_protocol:
         err = -ESOCKTNOSUPPORT;
         rcu_read_lock();
-        list_for_each_rcu(p, &inetsw[sock->type]) {
-                answer = list_entry(p, struct inet_protosw, list);
+        list_for_each_entry_rcu(answer, &inetsw[sock->type], list) {
 
+                err = 0;
                 /* Check the non-wild match. */
                 if (protocol == answer->protocol) {
                         if (protocol != IPPROTO_IP)
@@ -302,10 +300,9 @@ lookup_protocol:
                                 break;
                 }
                 err = -EPROTONOSUPPORT;
-                answer = NULL;
         }
 
-        if (unlikely(answer == NULL)) {
+        if (unlikely(err)) {
                 if (try_loading_module < 2) {
                         rcu_read_unlock();
                         /*
@@ -341,7 +338,7 @@ lookup_protocol:
         answer_flags = answer->flags;
         rcu_read_unlock();
 
-        BUG_TRAP(answer_prot->slab != NULL);
+        WARN_ON(answer_prot->slab == NULL);
 
         err = -ENOBUFS;
         sk = sk_alloc(net, PF_INET, GFP_KERNEL, answer_prot);
@@ -661,8 +658,8 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags)
 
         lock_sock(sk2);
 
-        BUG_TRAP((1 << sk2->sk_state) &
-                 (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_CLOSE));
+        WARN_ON(!((1 << sk2->sk_state) &
+                  (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_CLOSE)));
 
         sock_graft(sk2, newsock);
 
@@ -1442,6 +1439,10 @@ static int __init inet_init(void)
 
         (void)sock_register(&inet_family_ops);
 
+#ifdef CONFIG_SYSCTL
+        ip_static_sysctl_init();
+#endif
+
         /*
          *      Add all the base protocols.
          */
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 2e667e2f90df..91d3d96805d0 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -138,8 +138,8 @@ void in_dev_finish_destroy(struct in_device *idev)
 {
         struct net_device *dev = idev->dev;
 
-        BUG_TRAP(!idev->ifa_list);
-        BUG_TRAP(!idev->mc_list);
+        WARN_ON(idev->ifa_list);
+        WARN_ON(idev->mc_list);
 #ifdef NET_REFCNT_DEBUG
         printk(KERN_DEBUG "in_dev_finish_destroy: %p=%s\n",
                idev, dev ? dev->name : "NIL");
@@ -399,7 +399,7 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
         }
         ipv4_devconf_setall(in_dev);
         if (ifa->ifa_dev != in_dev) {
-                BUG_TRAP(!ifa->ifa_dev);
+                WARN_ON(ifa->ifa_dev);
                 in_dev_hold(in_dev);
                 ifa->ifa_dev = in_dev;
         }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 4e73e5708e70..21515d4c49eb 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -575,7 +575,7 @@ static int esp_init_state(struct xfrm_state *x)
                               crypto_aead_ivsize(aead);
         if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct iphdr);
-        else if (x->props.mode == XFRM_MODE_BEET)
+        else if (x->props.mode == XFRM_MODE_BEET && x->sel.family != AF_INET6)
                 x->props.header_len += IPV4_BEET_PHMAXLEN;
         if (x->encap) {
                 struct xfrm_encap_tmpl *encap = x->encap;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index bb81c958b744..0c1ae68ee84b 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -167,7 +167,7 @@ tb_not_found:
 success:
         if (!inet_csk(sk)->icsk_bind_hash)
                 inet_bind_hash(sk, tb, snum);
-        BUG_TRAP(inet_csk(sk)->icsk_bind_hash == tb);
+        WARN_ON(inet_csk(sk)->icsk_bind_hash != tb);
         ret = 0;
 
 fail_unlock:
@@ -260,7 +260,7 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
         }
 
         newsk = reqsk_queue_get_child(&icsk->icsk_accept_queue, sk);
-        BUG_TRAP(newsk->sk_state != TCP_SYN_RECV);
+        WARN_ON(newsk->sk_state == TCP_SYN_RECV);
 out:
         release_sock(sk);
         return newsk;
@@ -386,7 +386,7 @@ struct request_sock *inet_csk_search_req(const struct sock *sk,
                     ireq->rmt_addr == raddr &&
                     ireq->loc_addr == laddr &&
                     AF_INET_FAMILY(req->rsk_ops->family)) {
-                        BUG_TRAP(!req->sk);
+                        WARN_ON(req->sk);
                         *prevp = prev;
                         break;
                 }
@@ -539,14 +539,14 @@ EXPORT_SYMBOL_GPL(inet_csk_clone);
  */
 void inet_csk_destroy_sock(struct sock *sk)
 {
-        BUG_TRAP(sk->sk_state == TCP_CLOSE);
-        BUG_TRAP(sock_flag(sk, SOCK_DEAD));
+        WARN_ON(sk->sk_state != TCP_CLOSE);
+        WARN_ON(!sock_flag(sk, SOCK_DEAD));
 
         /* It cannot be in hash table! */
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
 
         /* If it has not 0 inet_sk(sk)->num, it must be bound */
-        BUG_TRAP(!inet_sk(sk)->num || inet_csk(sk)->icsk_bind_hash);
+        WARN_ON(inet_sk(sk)->num && !inet_csk(sk)->icsk_bind_hash);
 
         sk->sk_prot->destroy(sk);
 
@@ -629,7 +629,7 @@ void inet_csk_listen_stop(struct sock *sk)
 
                 local_bh_disable();
                 bh_lock_sock(child);
-                BUG_TRAP(!sock_owned_by_user(child));
+                WARN_ON(sock_owned_by_user(child));
                 sock_hold(child);
 
                 sk->sk_prot->disconnect(child, O_NONBLOCK);
@@ -647,7 +647,7 @@ void inet_csk_listen_stop(struct sock *sk)
                 sk_acceptq_removed(sk);
                 __reqsk_free(req);
         }
-        BUG_TRAP(!sk->sk_ack_backlog);
+        WARN_ON(sk->sk_ack_backlog);
 }
 
 EXPORT_SYMBOL_GPL(inet_csk_listen_stop);
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 0546a0bc97ea..6c52e08f786e 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -134,8 +134,8 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f,
         struct sk_buff *fp;
         struct netns_frags *nf;
 
-        BUG_TRAP(q->last_in & INET_FRAG_COMPLETE);
-        BUG_TRAP(del_timer(&q->timer) == 0);
+        WARN_ON(!(q->last_in & INET_FRAG_COMPLETE));
+        WARN_ON(del_timer(&q->timer) != 0);
 
         /* Release all fragment data. */
         fp = q->fragments;
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 115f53722d20..44981906fb91 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -305,7 +305,7 @@ unique:
         inet->num = lport;
         inet->sport = htons(lport);
         sk->sk_hash = hash;
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         write_unlock(lock);
@@ -342,7 +342,7 @@ void __inet_hash_nolisten(struct sock *sk)
         rwlock_t *lock;
         struct inet_ehash_bucket *head;
 
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
 
         sk->sk_hash = inet_sk_ehashfn(sk);
         head = inet_ehash_bucket(hashinfo, sk->sk_hash);
@@ -367,7 +367,7 @@ static void __inet_hash(struct sock *sk)
                 return;
         }
 
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
         lock = &hashinfo->lhash_lock;
 
@@ -450,7 +450,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
                                 if (tb->ib_net == net && tb->port == port) {
-                                        BUG_TRAP(!hlist_empty(&tb->owners));
+                                        WARN_ON(hlist_empty(&tb->owners));
                                         if (tb->fastreuse >= 0)
                                                 goto next_port;
                                         if (!check_established(death_row, sk,
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 75c2def8f9a0..d985bd613d25 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -86,7 +86,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
                         hashinfo->bhash_size)];
         spin_lock(&bhead->lock);
         tw->tw_tb = icsk->icsk_bind_hash;
-        BUG_TRAP(icsk->icsk_bind_hash);
+        WARN_ON(!icsk->icsk_bind_hash);
         inet_twsk_add_bind_node(tw, &tw->tw_tb->owners);
         spin_unlock(&bhead->lock);
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 38d38f058018..2152d222b954 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -488,8 +488,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 qp->q.fragments = head;
         }
 
-        BUG_TRAP(head != NULL);
-        BUG_TRAP(FRAG_CB(head)->offset == 0);
+        WARN_ON(head == NULL);
+        WARN_ON(FRAG_CB(head)->offset != 0);
 
         /* Allocate a new buffer for the datagram. */
         ihlen = ip_hdrlen(head);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 465544f6281a..d533a89e08de 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -118,7 +118,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         __skb_pull(newskb, skb_network_offset(newskb));
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
-        BUG_TRAP(newskb->dst);
+        WARN_ON(!newskb->dst);
         netif_rx(newskb);
         return 0;
 }
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index a75807b971b3..38ccb6dfb02e 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -14,153 +14,14 @@
  *   - Adaptive compression.
  */
 #include <linux/module.h>
-#include <linux/crypto.h>
 #include <linux/err.h>
-#include <linux/pfkeyv2.h>
-#include <linux/percpu.h>
-#include <linux/smp.h>
-#include <linux/list.h>
-#include <linux/vmalloc.h>
 #include <linux/rtnetlink.h>
-#include <linux/mutex.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/icmp.h>
 #include <net/ipcomp.h>
 #include <net/protocol.h>
-
-struct ipcomp_tfms {
-        struct list_head list;
-        struct crypto_comp **tfms;
-        int users;
-};
-
-static DEFINE_MUTEX(ipcomp_resource_mutex);
-static void **ipcomp_scratches;
-static int ipcomp_scratch_users;
-static LIST_HEAD(ipcomp_tfms_list);
-
-static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb)
-{
-        struct ipcomp_data *ipcd = x->data;
-        const int plen = skb->len;
-        int dlen = IPCOMP_SCRATCH_SIZE;
-        const u8 *start = skb->data;
-        const int cpu = get_cpu();
-        u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
-        struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
-        int err = crypto_comp_decompress(tfm, start, plen, scratch, &dlen);
-
-        if (err)
-                goto out;
-
-        if (dlen < (plen + sizeof(struct ip_comp_hdr))) {
-                err = -EINVAL;
-                goto out;
-        }
-
-        err = pskb_expand_head(skb, 0, dlen - plen, GFP_ATOMIC);
-        if (err)
-                goto out;
-
-        skb->truesize += dlen - plen;
-        __skb_put(skb, dlen - plen);
-        skb_copy_to_linear_data(skb, scratch, dlen);
-out:
-        put_cpu();
-        return err;
-}
-
-static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
-{
-        int nexthdr;
-        int err = -ENOMEM;
-        struct ip_comp_hdr *ipch;
-
-        if (skb_linearize_cow(skb))
-                goto out;
-
-        skb->ip_summed = CHECKSUM_NONE;
-
-        /* Remove ipcomp header and decompress original payload */
-        ipch = (void *)skb->data;
-        nexthdr = ipch->nexthdr;
-
-        skb->transport_header = skb->network_header + sizeof(*ipch);
-        __skb_pull(skb, sizeof(*ipch));
-        err = ipcomp_decompress(x, skb);
-        if (err)
-                goto out;
-
-        err = nexthdr;
-
-out:
-        return err;
-}
-
-static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
-{
-        struct ipcomp_data *ipcd = x->data;
-        const int plen = skb->len;
-        int dlen = IPCOMP_SCRATCH_SIZE;
-        u8 *start = skb->data;
-        const int cpu = get_cpu();
-        u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
-        struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
-        int err;
-
-        local_bh_disable();
-        err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
-        local_bh_enable();
-        if (err)
-                goto out;
-
-        if ((dlen + sizeof(struct ip_comp_hdr)) >= plen) {
-                err = -EMSGSIZE;
-                goto out;
-        }
-
-        memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
-        put_cpu();
-
-        pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
-        return 0;
-
-out:
-        put_cpu();
-        return err;
-}
-
-static int ipcomp_output(struct xfrm_state *x, struct sk_buff *skb)
-{
-        int err;
-        struct ip_comp_hdr *ipch;
-        struct ipcomp_data *ipcd = x->data;
-
-        if (skb->len < ipcd->threshold) {
-                /* Don't bother compressing */
-                goto out_ok;
-        }
-
-        if (skb_linearize_cow(skb))
-                goto out_ok;
-
-        err = ipcomp_compress(x, skb);
-
-        if (err) {
-                goto out_ok;
-        }
-
-        /* Install ipcomp header, convert into ipcomp datagram. */
-        ipch = ip_comp_hdr(skb);
-        ipch->nexthdr = *skb_mac_header(skb);
-        ipch->flags = 0;
-        ipch->cpi = htons((u16 )ntohl(x->id.spi));
-        *skb_mac_header(skb) = IPPROTO_COMP;
-out_ok:
-        skb_push(skb, -skb_network_offset(skb));
-        return 0;
-}
+#include <net/sock.h>
 
 static void ipcomp4_err(struct sk_buff *skb, u32 info)
 {
@@ -241,155 +102,9 @@ out:
         return err;
 }
 
-static void ipcomp_free_scratches(void)
-{
-        int i;
-        void **scratches;
-
-        if (--ipcomp_scratch_users)
-                return;
-
-        scratches = ipcomp_scratches;
-        if (!scratches)
-                return;
-
-        for_each_possible_cpu(i)
-                vfree(*per_cpu_ptr(scratches, i));
-
-        free_percpu(scratches);
-}
-
-static void **ipcomp_alloc_scratches(void)
-{
-        int i;
-        void **scratches;
-
-        if (ipcomp_scratch_users++)
-                return ipcomp_scratches;
-
-        scratches = alloc_percpu(void *);
-        if (!scratches)
-                return NULL;
-
-        ipcomp_scratches = scratches;
-
-        for_each_possible_cpu(i) {
-                void *scratch = vmalloc(IPCOMP_SCRATCH_SIZE);
-                if (!scratch)
-                        return NULL;
-                *per_cpu_ptr(scratches, i) = scratch;
-        }
-
-        return scratches;
-}
-
-static void ipcomp_free_tfms(struct crypto_comp **tfms)
-{
-        struct ipcomp_tfms *pos;
-        int cpu;
-
-        list_for_each_entry(pos, &ipcomp_tfms_list, list) {
-                if (pos->tfms == tfms)
-                        break;
-        }
-
-        BUG_TRAP(pos);
-
-        if (--pos->users)
-                return;
-
-        list_del(&pos->list);
-        kfree(pos);
-
-        if (!tfms)
-                return;
-
-        for_each_possible_cpu(cpu) {
-                struct crypto_comp *tfm = *per_cpu_ptr(tfms, cpu);
-                crypto_free_comp(tfm);
-        }
-        free_percpu(tfms);
-}
-
-static struct crypto_comp **ipcomp_alloc_tfms(const char *alg_name)
-{
-        struct ipcomp_tfms *pos;
-        struct crypto_comp **tfms;
-        int cpu;
-
-        /* This can be any valid CPU ID so we don't need locking. */
-        cpu = raw_smp_processor_id();
-
-        list_for_each_entry(pos, &ipcomp_tfms_list, list) {
-                struct crypto_comp *tfm;
-
-                tfms = pos->tfms;
-                tfm = *per_cpu_ptr(tfms, cpu);
-
-                if (!strcmp(crypto_comp_name(tfm), alg_name)) {
-                        pos->users++;
-                        return tfms;
-                }
-        }
-
-        pos = kmalloc(sizeof(*pos), GFP_KERNEL);
-        if (!pos)
-                return NULL;
-
-        pos->users = 1;
-        INIT_LIST_HEAD(&pos->list);
-        list_add(&pos->list, &ipcomp_tfms_list);
-
-        pos->tfms = tfms = alloc_percpu(struct crypto_comp *);
-        if (!tfms)
-                goto error;
-
-        for_each_possible_cpu(cpu) {
-                struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
-                                                            CRYPTO_ALG_ASYNC);
-                if (IS_ERR(tfm))
-                        goto error;
-                *per_cpu_ptr(tfms, cpu) = tfm;
-        }
-
-        return tfms;
-
-error:
-        ipcomp_free_tfms(tfms);
-        return NULL;
-}
-
-static void ipcomp_free_data(struct ipcomp_data *ipcd)
+static int ipcomp4_init_state(struct xfrm_state *x)
 {
-        if (ipcd->tfms)
-                ipcomp_free_tfms(ipcd->tfms);
-        ipcomp_free_scratches();
-}
-
-static void ipcomp_destroy(struct xfrm_state *x)
-{
-        struct ipcomp_data *ipcd = x->data;
-        if (!ipcd)
-                return;
-        xfrm_state_delete_tunnel(x);
-        mutex_lock(&ipcomp_resource_mutex);
-        ipcomp_free_data(ipcd);
-        mutex_unlock(&ipcomp_resource_mutex);
-        kfree(ipcd);
-}
-
-static int ipcomp_init_state(struct xfrm_state *x)
-{
-        int err;
-        struct ipcomp_data *ipcd;
-        struct xfrm_algo_desc *calg_desc;
-
-        err = -EINVAL;
-        if (!x->calg)
-                goto out;
-
-        if (x->encap)
-                goto out;
+        int err = -EINVAL;
 
         x->props.header_len = 0;
         switch (x->props.mode) {
@@ -402,40 +117,22 @@ static int ipcomp_init_state(struct xfrm_state *x)
                 goto out;
         }
 
-        err = -ENOMEM;
-        ipcd = kzalloc(sizeof(*ipcd), GFP_KERNEL);
-        if (!ipcd)
+        err = ipcomp_init_state(x);
+        if (err)
                 goto out;
 
-        mutex_lock(&ipcomp_resource_mutex);
-        if (!ipcomp_alloc_scratches())
-                goto error;
-
-        ipcd->tfms = ipcomp_alloc_tfms(x->calg->alg_name);
-        if (!ipcd->tfms)
-                goto error;
-        mutex_unlock(&ipcomp_resource_mutex);
-
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp_tunnel_attach(x);
                 if (err)
                         goto error_tunnel;
         }
 
-        calg_desc = xfrm_calg_get_byname(x->calg->alg_name, 0);
-        BUG_ON(!calg_desc);
-        ipcd->threshold = calg_desc->uinfo.comp.threshold;
-        x->data = ipcd;
         err = 0;
 out:
         return err;
 
 error_tunnel:
-        mutex_lock(&ipcomp_resource_mutex);
-error:
-        ipcomp_free_data(ipcd);
-        mutex_unlock(&ipcomp_resource_mutex);
-        kfree(ipcd);
+        ipcomp_destroy(x);
         goto out;
 }
 
@@ -443,7 +140,7 @@ static const struct xfrm_type ipcomp_type = {
         .description    = "IPCOMP4",
         .owner          = THIS_MODULE,
         .proto          = IPPROTO_COMP,
-        .init_state     = ipcomp_init_state,
+        .init_state     = ipcomp4_init_state,
         .destructor     = ipcomp_destroy,
         .input          = ipcomp_input,
         .output         = ipcomp_output
@@ -481,7 +178,7 @@ module_init(ipcomp4_init);
 module_exit(ipcomp4_fini);
 
 MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("IP Payload Compression Protocol (IPComp) - RFC3173");
+MODULE_DESCRIPTION("IP Payload Compression Protocol (IPComp/IPv4) - RFC3173");
 MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
 
 MODULE_ALIAS_XFRM_TYPE(AF_INET, XFRM_PROTO_COMP);
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index f23e60c93ef9..90eb7cb47e77 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -369,7 +369,7 @@ config IP_NF_SECURITY
         tristate "Security table"
         depends on IP_NF_IPTABLES
         depends on SECURITY
-        default m if NETFILTER_ADVANCED=n
+        depends on NETFILTER_ADVANCED
         help
           This option adds a `security' table to iptables, for use
           with Mandatory Access Control (MAC) policy.
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 3be4d07e7ed9..082f5dd3156c 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -55,32 +55,53 @@ static struct xt_table packet_filter = {
 };
 
 /* The work comes in here from netfilter.c */
-static unsigned int arpt_hook(unsigned int hook,
-                              struct sk_buff *skb,
-                              const struct net_device *in,
-                              const struct net_device *out,
-                              int (*okfn)(struct sk_buff *))
+static unsigned int arpt_in_hook(unsigned int hook,
+                                 struct sk_buff *skb,
+                                 const struct net_device *in,
+                                 const struct net_device *out,
+                                 int (*okfn)(struct sk_buff *))
 {
-        return arpt_do_table(skb, hook, in, out, init_net.ipv4.arptable_filter);
+        return arpt_do_table(skb, hook, in, out,
+                             dev_net(in)->ipv4.arptable_filter);
+}
+
+static unsigned int arpt_out_hook(unsigned int hook,
+                                  struct sk_buff *skb,
+                                  const struct net_device *in,
+                                  const struct net_device *out,
+                                  int (*okfn)(struct sk_buff *))
+{
+        return arpt_do_table(skb, hook, in, out,
+                             dev_net(out)->ipv4.arptable_filter);
+}
+
+static unsigned int arpt_forward_hook(unsigned int hook,
+                                      struct sk_buff *skb,
+                                      const struct net_device *in,
+                                      const struct net_device *out,
+                                      int (*okfn)(struct sk_buff *))
+{
+        return arpt_do_table(skb, hook, in, out,
+                             dev_net(in)->ipv4.arptable_filter);
 }
 
 static struct nf_hook_ops arpt_ops[] __read_mostly = {
         {
-                .hook           = arpt_hook,
+                .hook           = arpt_in_hook,
                 .owner          = THIS_MODULE,
                 .pf             = NF_ARP,
                 .hooknum        = NF_ARP_IN,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
-                .hook           = arpt_hook,
+                .hook           = arpt_out_hook,
                 .owner          = THIS_MODULE,
                 .pf             = NF_ARP,
                 .hooknum        = NF_ARP_OUT,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
-                .hook           = arpt_hook,
+                .hook           = arpt_forward_hook,
                 .owner          = THIS_MODULE,
                 .pf             = NF_ARP,
                 .hooknum        = NF_ARP_FORWARD,
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 1819ad7ab910..fafe8ebb4c55 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -475,11 +475,10 @@ static void arp_print(struct arp_payload *payload)
 #define HBUFFERLEN 30
         char hbuffer[HBUFFERLEN];
         int j,k;
-        const char hexbuf[]= "0123456789abcdef";
 
         for (k=0, j=0; k < HBUFFERLEN-3 && j < ETH_ALEN; j++) {
-                hbuffer[k++]=hexbuf[(payload->src_hw[j]>>4)&15];
-                hbuffer[k++]=hexbuf[payload->src_hw[j]&15];
+                hbuffer[k++] = hex_asc_hi(payload->src_hw[j]);
+                hbuffer[k++] = hex_asc_lo(payload->src_hw[j]);
                 hbuffer[k++]=':';
         }
         hbuffer[--k]='\0';
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 21cb053f5d7d..3974d7cae5c0 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -305,10 +305,10 @@ static void recent_mt_destroy(const struct xt_match *match, void *matchinfo)
                 spin_lock_bh(&recent_lock);
                 list_del(&t->list);
                 spin_unlock_bh(&recent_lock);
-                recent_table_flush(t);
 #ifdef CONFIG_PROC_FS
                 remove_proc_entry(t->name, proc_dir);
 #endif
+                recent_table_flush(t);
                 kfree(t);
         }
         mutex_unlock(&recent_mutex);
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 2b472ac2263a..db6d312128e1 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -32,7 +32,7 @@ static struct
         struct ipt_replace repl;
         struct ipt_standard entries[3];
         struct ipt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "security",
                 .valid_hooks = SECURITY_VALID_HOOKS,
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 834356ea99df..8f5a403f6f6b 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -232,6 +232,8 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPDSACKIgnoredOld", LINUX_MIB_TCPDSACKIGNOREDOLD),
         SNMP_MIB_ITEM("TCPDSACKIgnoredNoUndo", LINUX_MIB_TCPDSACKIGNOREDNOUNDO),
         SNMP_MIB_ITEM("TCPSpuriousRTOs", LINUX_MIB_TCPSPURIOUSRTOS),
+        SNMP_MIB_ITEM("TCPMD5NotFound", LINUX_MIB_TCPMD5NOTFOUND),
+        SNMP_MIB_ITEM("TCPMD5Unexpected", LINUX_MIB_TCPMD5UNEXPECTED),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e4ab0ac94f92..16fc6f454a31 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1502,21 +1502,21 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
                                     rth->fl.iif != 0 ||
                                     dst_metric_locked(&rth->u.dst, RTAX_MTU) ||
                                     !net_eq(dev_net(rth->u.dst.dev), net) ||
-                                    !rt_is_expired(rth))
+                                    rt_is_expired(rth))
                                         continue;
 
                                 if (new_mtu < 68 || new_mtu >= old_mtu) {
 
                                         /* BSD 4.2 compatibility hack :-( */
                                         if (mtu == 0 &&
-                                            old_mtu >= dst_metric(&rth->u.dst, RTAX_MTU) &&
+                                            old_mtu >= dst_mtu(&rth->u.dst) &&
                                             old_mtu >= 68 + (iph->ihl << 2))
                                                 old_mtu -= iph->ihl << 2;
 
                                         mtu = guess_mtu(old_mtu);
                                 }
-                                if (mtu <= dst_metric(&rth->u.dst, RTAX_MTU)) {
-                                        if (mtu < dst_metric(&rth->u.dst, RTAX_MTU)) {
+                                if (mtu <= dst_mtu(&rth->u.dst)) {
+                                        if (mtu < dst_mtu(&rth->u.dst)) {
                                                 dst_confirm(&rth->u.dst);
                                                 if (mtu < ip_rt_min_pmtu) {
                                                         mtu = ip_rt_min_pmtu;
@@ -1538,7 +1538,7 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
 
 static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
-        if (dst_metric(dst, RTAX_MTU) > mtu && mtu >= 68 &&
+        if (dst_mtu(dst) > mtu && mtu >= 68 &&
             !(dst_metric_locked(dst, RTAX_MTU))) {
                 if (mtu < ip_rt_min_pmtu) {
                         mtu = ip_rt_min_pmtu;
@@ -1667,7 +1667,7 @@ static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag)
 
         if (dst_metric(&rt->u.dst, RTAX_HOPLIMIT) == 0)
                 rt->u.dst.metrics[RTAX_HOPLIMIT-1] = sysctl_ip_default_ttl;
-        if (dst_metric(&rt->u.dst, RTAX_MTU) > IP_MAX_MTU)
+        if (dst_mtu(&rt->u.dst) > IP_MAX_MTU)
                 rt->u.dst.metrics[RTAX_MTU-1] = IP_MAX_MTU;
         if (dst_metric(&rt->u.dst, RTAX_ADVMSS) == 0)
                 rt->u.dst.metrics[RTAX_ADVMSS-1] = max_t(unsigned int, rt->u.dst.dev->mtu - 40,
@@ -2914,7 +2914,7 @@ static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
         return 0;
 }
 
-ctl_table ipv4_route_table[] = {
+static ctl_table ipv4_route_table[] = {
         {
                 .ctl_name       = NET_IPV4_ROUTE_GC_THRESH,
                 .procname       = "gc_thresh",
@@ -3216,6 +3216,17 @@ int __init ip_rt_init(void)
         return rc;
 }
 
+#ifdef CONFIG_SYSCTL
+/*
+ * We really need to sanitize the damn ipv4 init order, then all
+ * this nonsense will go away.
+ */
+void __init ip_static_sysctl_init(void)
+{
+        register_sysctl_paths(ipv4_route_path, ipv4_route_table);
+}
+#endif
+
 EXPORT_SYMBOL(__ip_select_ident);
 EXPORT_SYMBOL(ip_route_input);
 EXPORT_SYMBOL(ip_route_output_key);
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 51bc24d3b8a7..9d38005abbac 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -299,6 +299,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->rmt_port          = th->source;
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
+        ireq->ecn_ok            = 0;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->rcv_wscale        = tcp_opt.rcv_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 14ef202a2254..e0689fd7b798 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -232,6 +232,7 @@ static struct ctl_table ipv4_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &ipv4_doint_and_flush,
                 .strategy       = &ipv4_doint_and_flush_strategy,
+                .extra2         = &init_net,
         },
         {
                 .ctl_name       = NET_IPV4_NO_PMTU_DISC,
@@ -401,13 +402,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = &ipv4_local_port_range,
                 .strategy       = &ipv4_sysctl_local_port_range,
         },
-        {
-                .ctl_name       = NET_IPV4_ROUTE,
-                .procname       = "route",
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ipv4_route_table
-        },
 #ifdef CONFIG_IP_MULTICAST
         {
                 .ctl_name       = NET_IPV4_IGMP_MAX_MEMBERSHIPS,
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0b491bf03db4..1ab341e5d3e0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1096,7 +1096,7 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
 #if TCP_DEBUG
         struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 
-        BUG_TRAP(!skb || before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
+        WARN_ON(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
 #endif
 
         if (inet_csk_ack_scheduled(sk)) {
@@ -1358,7 +1358,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                 goto found_ok_skb;
                         if (tcp_hdr(skb)->fin)
                                 goto found_fin_ok;
-                        BUG_TRAP(flags & MSG_PEEK);
+                        WARN_ON(!(flags & MSG_PEEK));
                         skb = skb->next;
                 } while (skb != (struct sk_buff *)&sk->sk_receive_queue);
 
@@ -1421,8 +1421,8 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
                         tp->ucopy.len = len;
 
-                        BUG_TRAP(tp->copied_seq == tp->rcv_nxt ||
-                                 (flags & (MSG_PEEK | MSG_TRUNC)));
+                        WARN_ON(tp->copied_seq != tp->rcv_nxt &&
+                                !(flags & (MSG_PEEK | MSG_TRUNC)));
 
                         /* Ugly... If prequeue is not empty, we have to
                          * process it before releasing socket, otherwise
@@ -1844,7 +1844,7 @@ adjudge_to_death:
          */
         local_bh_disable();
         bh_lock_sock(sk);
-        BUG_TRAP(!sock_owned_by_user(sk));
+        WARN_ON(sock_owned_by_user(sk));
 
         /* Have we already been destroyed by a softirq or backlog? */
         if (state != TCP_CLOSE && sk->sk_state == TCP_CLOSE)
@@ -1973,7 +1973,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
 
-        BUG_TRAP(!inet->num || icsk->icsk_bind_hash);
+        WARN_ON(inet->num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 1f5e6049883e..67ccce2a96bd 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1629,10 +1629,10 @@ advance_sp:
 out:
 
 #if FASTRETRANS_DEBUG > 0
-        BUG_TRAP((int)tp->sacked_out >= 0);
-        BUG_TRAP((int)tp->lost_out >= 0);
-        BUG_TRAP((int)tp->retrans_out >= 0);
-        BUG_TRAP((int)tcp_packets_in_flight(tp) >= 0);
+        WARN_ON((int)tp->sacked_out < 0);
+        WARN_ON((int)tp->lost_out < 0);
+        WARN_ON((int)tp->retrans_out < 0);
+        WARN_ON((int)tcp_packets_in_flight(tp) < 0);
 #endif
         return flag;
 }
@@ -2181,7 +2181,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
         int err;
         unsigned int mss;
 
-        BUG_TRAP(packets <= tp->packets_out);
+        WARN_ON(packets > tp->packets_out);
         if (tp->lost_skb_hint) {
                 skb = tp->lost_skb_hint;
                 cnt = tp->lost_cnt_hint;
@@ -2610,7 +2610,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
         /* E. Check state exit conditions. State can be terminated
          *    when high_seq is ACKed. */
         if (icsk->icsk_ca_state == TCP_CA_Open) {
-                BUG_TRAP(tp->retrans_out == 0);
+                WARN_ON(tp->retrans_out != 0);
                 tp->retrans_stamp = 0;
         } else if (!before(tp->snd_una, tp->high_seq)) {
                 switch (icsk->icsk_ca_state) {
@@ -2972,9 +2972,9 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets)
         }
 
 #if FASTRETRANS_DEBUG > 0
-        BUG_TRAP((int)tp->sacked_out >= 0);
-        BUG_TRAP((int)tp->lost_out >= 0);
-        BUG_TRAP((int)tp->retrans_out >= 0);
+        WARN_ON((int)tp->sacked_out < 0);
+        WARN_ON((int)tp->lost_out < 0);
+        WARN_ON((int)tp->retrans_out < 0);
         if (!tp->packets_out && tcp_is_sack(tp)) {
                 icsk = inet_csk(sk);
                 if (tp->lost_out) {
@@ -3292,6 +3292,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
          * log. Something worked...
          */
         sk->sk_err_soft = 0;
+        icsk->icsk_probes_out = 0;
         tp->rcv_tstamp = tcp_time_stamp;
         prior_packets = tp->packets_out;
         if (!prior_packets)
@@ -3324,8 +3325,6 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
         return 1;
 
 no_queue:
-        icsk->icsk_probes_out = 0;
-
         /* If this ack opens up a zero window, clear backoff.  It was
          * being used to time the probes, and is probably far higher than
          * it needs to be for normal retransmission.
@@ -3878,7 +3877,7 @@ static void tcp_sack_remove(struct tcp_sock *tp)
                         int i;
 
                         /* RCV.NXT must cover all the block! */
-                        BUG_TRAP(!before(tp->rcv_nxt, sp->end_seq));
+                        WARN_ON(before(tp->rcv_nxt, sp->end_seq));
 
                         /* Zap this SACK, by moving forward any other SACKS. */
                         for (i=this_sack+1; i < num_sacks; i++)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a82df6307567..44c1e934824b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -418,7 +418,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 /* ICMPs are not backlogged, hence we cannot get
                    an established socket here.
                  */
-                BUG_TRAP(!req->sk);
+                WARN_ON(req->sk);
 
                 if (seq != tcp_rsk(req)->snt_isn) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
@@ -655,8 +655,8 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
                 rep.th.doff = arg.iov[0].iov_len/4;
 
                 tcp_v4_md5_hash_hdr((__u8 *) &rep.opt[offset],
-                                    key, ip_hdr(skb)->daddr,
-                                    ip_hdr(skb)->saddr, &rep.th);
+                                    key, ip_hdr(skb)->saddr,
+                                    ip_hdr(skb)->daddr, &rep.th);
         }
 #endif
         arg.csum = csum_tcpudp_nofold(ip_hdr(skb)->daddr,
@@ -687,14 +687,14 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
         inet_twsk_put(tw);
 }
 
-static void tcp_v4_reqsk_send_ack(struct sk_buff *skb,
+static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                   struct request_sock *req)
 {
         tcp_v4_send_ack(skb, tcp_rsk(req)->snt_isn + 1,
                         tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd,
                         req->ts_recent,
                         0,
-                        tcp_v4_md5_do_lookup(skb->sk, ip_hdr(skb)->daddr));
+                        tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr));
 }
 
 /*
@@ -1116,18 +1116,12 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
                 return 0;
 
         if (hash_expected && !hash_location) {
-                LIMIT_NETDEBUG(KERN_INFO "MD5 Hash expected but NOT found "
-                               "(" NIPQUAD_FMT ", %d)->(" NIPQUAD_FMT ", %d)\n",
-                               NIPQUAD(iph->saddr), ntohs(th->source),
-                               NIPQUAD(iph->daddr), ntohs(th->dest));
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
                 return 1;
         }
 
         if (!hash_expected && hash_location) {
-                LIMIT_NETDEBUG(KERN_INFO "MD5 Hash NOT expected but found "
-                               "(" NIPQUAD_FMT ", %d)->(" NIPQUAD_FMT ", %d)\n",
-                               NIPQUAD(iph->saddr), ntohs(th->source),
-                               NIPQUAD(iph->daddr), ntohs(th->dest));
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
                 return 1;
         }
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 204c42162660..f976fc57892c 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -609,7 +609,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                                           tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {
                 /* Out of window: send ACK and drop. */
                 if (!(flg & TCP_FLAG_RST))
-                        req->rsk_ops->send_ack(skb, req);
+                        req->rsk_ops->send_ack(sk, skb, req);
                 if (paws_reject)
                         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
                 return NULL;
@@ -618,89 +618,87 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
         /* In sequence, PAWS is OK. */
 
         if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))
-                        req->ts_recent = tmp_opt.rcv_tsval;
+                req->ts_recent = tmp_opt.rcv_tsval;
 
-                if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
-                        /* Truncate SYN, it is out of window starting
-                           at tcp_rsk(req)->rcv_isn + 1. */
-                        flg &= ~TCP_FLAG_SYN;
-                }
+        if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
+                /* Truncate SYN, it is out of window starting
+                   at tcp_rsk(req)->rcv_isn + 1. */
+                flg &= ~TCP_FLAG_SYN;
+        }
 
-                /* RFC793: "second check the RST bit" and
-                 *         "fourth, check the SYN bit"
-                 */
-                if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
-                        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
-                        goto embryonic_reset;
-                }
+        /* RFC793: "second check the RST bit" and
+         *         "fourth, check the SYN bit"
+         */
+        if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
+                TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
+                goto embryonic_reset;
+        }
 
-                /* ACK sequence verified above, just make sure ACK is
-                 * set.  If ACK not set, just silently drop the packet.
-                 */
-                if (!(flg & TCP_FLAG_ACK))
-                        return NULL;
-
-                /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
-                if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
-                    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
-                        inet_rsk(req)->acked = 1;
-                        return NULL;
-                }
+        /* ACK sequence verified above, just make sure ACK is
+         * set.  If ACK not set, just silently drop the packet.
+         */
+        if (!(flg & TCP_FLAG_ACK))
+                return NULL;
 
-                /* OK, ACK is valid, create big socket and
-                 * feed this segment to it. It will repeat all
-                 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
-                 * ESTABLISHED STATE. If it will be dropped after
-                 * socket is created, wait for troubles.
-                 */
-                child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb,
-                                                                 req, NULL);
-                if (child == NULL)
-                        goto listen_overflow;
+        /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
+        if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
+            TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
+                inet_rsk(req)->acked = 1;
+                return NULL;
+        }
+
+        /* OK, ACK is valid, create big socket and
+         * feed this segment to it. It will repeat all
+         * the tests. THIS SEGMENT MUST MOVE SOCKET TO
+         * ESTABLISHED STATE. If it will be dropped after
+         * socket is created, wait for troubles.
+         */
+        child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL);
+        if (child == NULL)
+                goto listen_overflow;
 #ifdef CONFIG_TCP_MD5SIG
-                else {
-                        /* Copy over the MD5 key from the original socket */
-                        struct tcp_md5sig_key *key;
-                        struct tcp_sock *tp = tcp_sk(sk);
-                        key = tp->af_specific->md5_lookup(sk, child);
-                        if (key != NULL) {
-                                /*
-                                 * We're using one, so create a matching key on the
-                                 * newsk structure. If we fail to get memory then we
-                                 * end up not copying the key across. Shucks.
-                                 */
-                                char *newkey = kmemdup(key->key, key->keylen,
-                                                       GFP_ATOMIC);
-                                if (newkey) {
-                                        if (!tcp_alloc_md5sig_pool())
-                                                BUG();
-                                        tp->af_specific->md5_add(child, child,
-                                                                 newkey,
-                                                                 key->keylen);
-                                }
+        else {
+                /* Copy over the MD5 key from the original socket */
+                struct tcp_md5sig_key *key;
+                struct tcp_sock *tp = tcp_sk(sk);
+                key = tp->af_specific->md5_lookup(sk, child);
+                if (key != NULL) {
+                        /*
+                         * We're using one, so create a matching key on the
+                         * newsk structure. If we fail to get memory then we
+                         * end up not copying the key across. Shucks.
+                         */
+                        char *newkey = kmemdup(key->key, key->keylen,
+                                               GFP_ATOMIC);
+                        if (newkey) {
+                                if (!tcp_alloc_md5sig_pool())
+                                        BUG();
+                                tp->af_specific->md5_add(child, child, newkey,
+                                                         key->keylen);
                         }
                 }
+        }
 #endif
 
-                inet_csk_reqsk_queue_unlink(sk, req, prev);
-                inet_csk_reqsk_queue_removed(sk, req);
+        inet_csk_reqsk_queue_unlink(sk, req, prev);
+        inet_csk_reqsk_queue_removed(sk, req);
 
-                inet_csk_reqsk_queue_add(sk, req, child);
-                return child;
+        inet_csk_reqsk_queue_add(sk, req, child);
+        return child;
 
-        listen_overflow:
-                if (!sysctl_tcp_abort_on_overflow) {
-                        inet_rsk(req)->acked = 1;
-                        return NULL;
-                }
+listen_overflow:
+        if (!sysctl_tcp_abort_on_overflow) {
+                inet_rsk(req)->acked = 1;
+                return NULL;
+        }
 
-        embryonic_reset:
-                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-                if (!(flg & TCP_FLAG_RST))
-                        req->rsk_ops->send_reset(sk, skb);
+embryonic_reset:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
+        if (!(flg & TCP_FLAG_RST))
+                req->rsk_ops->send_reset(sk, skb);
 
-                inet_csk_reqsk_queue_drop(sk, req, prev);
-                return NULL;
+        inet_csk_reqsk_queue_drop(sk, req, prev);
+        return NULL;
 }
 
 /*
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 1fa683c0ba9b..a00532de2a8c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -472,7 +472,7 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         }
         if (likely(sysctl_tcp_sack)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
-                if (unlikely(!OPTION_TS & opts->options))
+                if (unlikely(!(OPTION_TS & opts->options)))
                         size += TCPOLEN_SACKPERM_ALIGNED;
         }
 
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 328e0cf42b3c..5ab6ba19c3ce 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -287,7 +287,7 @@ static void tcp_retransmit_timer(struct sock *sk)
         if (!tp->packets_out)
                 goto out;
 
-        BUG_TRAP(!tcp_write_queue_empty(sk));
+        WARN_ON(tcp_write_queue_empty(sk));
 
         if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) &&
             !((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index a751770947a3..383d17359d01 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1325,6 +1325,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
                         return -ENOPROTOOPT;
                 if (val != 0 && val < 8) /* Illegal coverage: use default (8) */
                         val = 8;
+                else if (val > USHORT_MAX)
+                        val = USHORT_MAX;
                 up->pcslen = val;
                 up->pcflag |= UDPLITE_SEND_CC;
                 break;
@@ -1337,6 +1339,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
                         return -ENOPROTOOPT;
                 if (val != 0 && val < 8) /* Avoid silly minimal values.       */
                         val = 8;
+                else if (val > USHORT_MAX)
+                        val = USHORT_MAX;
                 up->pcrlen = val;
                 up->pcflag |= UDPLITE_RECV_CC;
                 break;
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 9c798abce736..63418185f524 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -47,8 +47,10 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
         if (unlikely(optlen))
                 hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
 
-        skb_set_network_header(skb, IPV4_BEET_PHMAXLEN - x->props.header_len -
-                                    hdrlen);
+        skb_set_network_header(skb, -x->props.header_len -
+                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
+        if (x->sel.family != AF_INET6)
+                skb->network_header += IPV4_BEET_PHMAXLEN;
         skb->mac_header = skb->network_header +
                           offsetof(struct iphdr, protocol);
         skb->transport_header = skb->network_header + sizeof(*top_iph);
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 42814a2ec9d7..ec992159b5f8 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -96,10 +96,8 @@ config INET6_ESP
 
 config INET6_IPCOMP
         tristate "IPv6: IPComp transformation"
-        select XFRM
         select INET6_XFRM_TUNNEL
-        select CRYPTO
-        select CRYPTO_DEFLATE
+        select XFRM_IPCOMP
         ---help---
           Support for IP Payload Compression Protocol (IPComp) (RFC3173),
           typically needed for IPsec.
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9f4fcce6379b..a7842c54f58a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -153,7 +153,7 @@ static int ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
 
 static ATOMIC_NOTIFIER_HEAD(inet6addr_chain);
 
-struct ipv6_devconf ipv6_devconf __read_mostly = {
+static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .forwarding             = 0,
         .hop_limit              = IPV6_DEFAULT_HOPLIMIT,
         .mtu6                   = IPV6_MIN_MTU,
@@ -313,8 +313,10 @@ static void in6_dev_finish_destroy_rcu(struct rcu_head *head)
 void in6_dev_finish_destroy(struct inet6_dev *idev)
 {
         struct net_device *dev = idev->dev;
-        BUG_TRAP(idev->addr_list==NULL);
-        BUG_TRAP(idev->mc_list==NULL);
+
+        WARN_ON(idev->addr_list != NULL);
+        WARN_ON(idev->mc_list != NULL);
+
 #ifdef NET_REFCNT_DEBUG
         printk(KERN_DEBUG "in6_dev_finish_destroy: %s\n", dev ? dev->name : "NIL");
 #endif
@@ -517,8 +519,9 @@ static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 
 void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 {
-        BUG_TRAP(ifp->if_next==NULL);
-        BUG_TRAP(ifp->lst_next==NULL);
+        WARN_ON(ifp->if_next != NULL);
+        WARN_ON(ifp->lst_next != NULL);
+
 #ifdef NET_REFCNT_DEBUG
         printk(KERN_DEBUG "inet6_ifa_finish_destroy\n");
 #endif
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3d828bc4b1cf..95055f8c3f35 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -83,7 +83,6 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol)
         struct inet_sock *inet;
         struct ipv6_pinfo *np;
         struct sock *sk;
-        struct list_head *p;
         struct inet_protosw *answer;
         struct proto *answer_prot;
         unsigned char answer_flags;
@@ -97,13 +96,12 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol)
                 build_ehash_secret();
 
         /* Look for the requested type/protocol pair. */
-        answer = NULL;
 lookup_protocol:
         err = -ESOCKTNOSUPPORT;
         rcu_read_lock();
-        list_for_each_rcu(p, &inetsw6[sock->type]) {
-                answer = list_entry(p, struct inet_protosw, list);
+        list_for_each_entry_rcu(answer, &inetsw6[sock->type], list) {
 
+                err = 0;
                 /* Check the non-wild match. */
                 if (protocol == answer->protocol) {
                         if (protocol != IPPROTO_IP)
@@ -118,10 +116,9 @@ lookup_protocol:
                                 break;
                 }
                 err = -EPROTONOSUPPORT;
-                answer = NULL;
         }
 
-        if (!answer) {
+        if (err) {
                 if (try_loading_module < 2) {
                         rcu_read_unlock();
                         /*
@@ -153,7 +150,7 @@ lookup_protocol:
         answer_flags = answer->flags;
         rcu_read_unlock();
 
-        BUG_TRAP(answer_prot->slab != NULL);
+        WARN_ON(answer_prot->slab == NULL);
 
         err = -ENOBUFS;
         sk = sk_alloc(net, PF_INET6, GFP_KERNEL, answer_prot);
@@ -937,6 +934,11 @@ static int __init inet6_init(void)
         if (err)
                 goto out_unregister_sock;
 
+#ifdef CONFIG_SYSCTL
+        err = ipv6_static_sysctl_register();
+        if (err)
+                goto static_sysctl_fail;
+#endif
         /*
          *      ipngwg API draft makes clear that the correct semantics
          *      for TCP and UDP is to consider one TCP and UDP instance
@@ -1061,6 +1063,10 @@ ipmr_fail:
 icmp_fail:
         unregister_pernet_subsys(&inet6_net_ops);
 register_pernet_fail:
+#ifdef CONFIG_SYSCTL
+        ipv6_static_sysctl_unregister();
+static_sysctl_fail:
+#endif
         cleanup_ipv6_mibs();
 out_unregister_sock:
         sock_unregister(PF_INET6);
@@ -1116,6 +1122,9 @@ static void __exit inet6_exit(void)
         rawv6_exit();
 
         unregister_pernet_subsys(&inet6_net_ops);
+#ifdef CONFIG_SYSCTL
+        ipv6_static_sysctl_unregister();
+#endif
         cleanup_ipv6_mibs();
         proto_unregister(&rawv6_prot);
         proto_unregister(&udplitev6_prot);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index f7b535dec860..410046a8cc91 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -732,7 +732,7 @@ int datagram_send_ctl(struct net *net,
                         LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
                                        cmsg->cmsg_type);
                         err = -EINVAL;
-                        break;
+                        goto exit_f;
                 }
         }
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index c6bb4c6d24b3..b181b08fb761 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -521,6 +521,10 @@ static int esp6_init_state(struct xfrm_state *x)
                               crypto_aead_ivsize(aead);
         switch (x->props.mode) {
         case XFRM_MODE_BEET:
+                if (x->sel.family != AF_INET6)
+                        x->props.header_len += IPV4_BEET_PHMAXLEN +
+                                               (sizeof(struct ipv6hdr) - sizeof(struct iphdr));
+                break;
         case XFRM_MODE_TRANSPORT:
                 break;
         case XFRM_MODE_TUNNEL:
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 87801cc1b2f8..16d43f20b32f 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -98,7 +98,7 @@ struct request_sock *inet6_csk_search_req(const struct sock *sk,
                     ipv6_addr_equal(&treq->rmt_addr, raddr) &&
                     ipv6_addr_equal(&treq->loc_addr, laddr) &&
                     (!treq->iif || treq->iif == iif)) {
-                        BUG_TRAP(req->sk == NULL);
+                        WARN_ON(req->sk != NULL);
                         *prevp = prev;
                         return req;
                 }
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 00a8a5f9380c..1646a5658255 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -28,7 +28,7 @@ void __inet6_hash(struct sock *sk)
         struct hlist_head *list;
         rwlock_t *lock;
 
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
 
         if (sk->sk_state == TCP_LISTEN) {
                 list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
@@ -202,7 +202,7 @@ unique:
          * in hash table socket with a funny identity. */
         inet->num = lport;
         inet->sport = htons(lport);
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sk->sk_hash = hash;
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 4de2b9efcacb..52dddc25d3e6 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -287,7 +287,7 @@ static int fib6_dump_node(struct fib6_walker_t *w)
                         w->leaf = rt;
                         return 1;
                 }
-                BUG_TRAP(res!=0);
+                WARN_ON(res == 0);
         }
         w->leaf = NULL;
         return 0;
@@ -661,17 +661,17 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
 
 static __inline__ void fib6_start_gc(struct net *net, struct rt6_info *rt)
 {
-        if (net->ipv6.ip6_fib_timer->expires == 0 &&
+        if (!timer_pending(&net->ipv6.ip6_fib_timer) &&
             (rt->rt6i_flags & (RTF_EXPIRES|RTF_CACHE)))
-                mod_timer(net->ipv6.ip6_fib_timer, jiffies +
-                          net->ipv6.sysctl.ip6_rt_gc_interval);
+                mod_timer(&net->ipv6.ip6_fib_timer,
+                          jiffies + net->ipv6.sysctl.ip6_rt_gc_interval);
 }
 
 void fib6_force_start_gc(struct net *net)
 {
-        if (net->ipv6.ip6_fib_timer->expires == 0)
-                mod_timer(net->ipv6.ip6_fib_timer, jiffies +
-                          net->ipv6.sysctl.ip6_rt_gc_interval);
+        if (!timer_pending(&net->ipv6.ip6_fib_timer))
+                mod_timer(&net->ipv6.ip6_fib_timer,
+                          jiffies + net->ipv6.sysctl.ip6_rt_gc_interval);
 }
 
 /*
@@ -778,7 +778,7 @@ out:
                         pn->leaf = fib6_find_prefix(info->nl_net, pn);
 #if RT6_DEBUG >= 2
                         if (!pn->leaf) {
-                                BUG_TRAP(pn->leaf != NULL);
+                                WARN_ON(pn->leaf == NULL);
                                 pn->leaf = info->nl_net->ipv6.ip6_null_entry;
                         }
 #endif
@@ -942,7 +942,7 @@ struct fib6_node * fib6_locate(struct fib6_node *root,
 
 #ifdef CONFIG_IPV6_SUBTREES
         if (src_len) {
-                BUG_TRAP(saddr!=NULL);
+                WARN_ON(saddr == NULL);
                 if (fn && fn->subtree)
                         fn = fib6_locate_1(fn->subtree, saddr, src_len,
                                            offsetof(struct rt6_info, rt6i_src));
@@ -996,9 +996,9 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 RT6_TRACE("fixing tree: plen=%d iter=%d\n", fn->fn_bit, iter);
                 iter++;
 
-                BUG_TRAP(!(fn->fn_flags&RTN_RTINFO));
-                BUG_TRAP(!(fn->fn_flags&RTN_TL_ROOT));
-                BUG_TRAP(fn->leaf==NULL);
+                WARN_ON(fn->fn_flags & RTN_RTINFO);
+                WARN_ON(fn->fn_flags & RTN_TL_ROOT);
+                WARN_ON(fn->leaf != NULL);
 
                 children = 0;
                 child = NULL;
@@ -1014,7 +1014,7 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                         fn->leaf = fib6_find_prefix(net, fn);
 #if RT6_DEBUG >= 2
                         if (fn->leaf==NULL) {
-                                BUG_TRAP(fn->leaf);
+                                WARN_ON(!fn->leaf);
                                 fn->leaf = net->ipv6.ip6_null_entry;
                         }
 #endif
@@ -1025,16 +1025,17 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 pn = fn->parent;
 #ifdef CONFIG_IPV6_SUBTREES
                 if (FIB6_SUBTREE(pn) == fn) {
-                        BUG_TRAP(fn->fn_flags&RTN_ROOT);
+                        WARN_ON(!(fn->fn_flags & RTN_ROOT));
                         FIB6_SUBTREE(pn) = NULL;
                         nstate = FWS_L;
                 } else {
-                        BUG_TRAP(!(fn->fn_flags&RTN_ROOT));
+                        WARN_ON(fn->fn_flags & RTN_ROOT);
 #endif
                         if (pn->right == fn) pn->right = child;
                         else if (pn->left == fn) pn->left = child;
 #if RT6_DEBUG >= 2
-                        else BUG_TRAP(0);
+                        else
+                                WARN_ON(1);
 #endif
                         if (child)
                                 child->parent = pn;
@@ -1154,14 +1155,14 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
 
 #if RT6_DEBUG >= 2
         if (rt->u.dst.obsolete>0) {
-                BUG_TRAP(fn==NULL);
+                WARN_ON(fn != NULL);
                 return -ENOENT;
         }
 #endif
         if (fn == NULL || rt == net->ipv6.ip6_null_entry)
                 return -ENOENT;
 
-        BUG_TRAP(fn->fn_flags&RTN_RTINFO);
+        WARN_ON(!(fn->fn_flags & RTN_RTINFO));
 
         if (!(rt->rt6i_flags&RTF_CACHE)) {
                 struct fib6_node *pn = fn;
@@ -1266,7 +1267,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                         w->node = pn;
 #ifdef CONFIG_IPV6_SUBTREES
                         if (FIB6_SUBTREE(pn) == fn) {
-                                BUG_TRAP(fn->fn_flags&RTN_ROOT);
+                                WARN_ON(!(fn->fn_flags & RTN_ROOT));
                                 w->state = FWS_L;
                                 continue;
                         }
@@ -1281,7 +1282,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                                 continue;
                         }
 #if RT6_DEBUG >= 2
-                        BUG_TRAP(0);
+                        WARN_ON(1);
 #endif
                 }
         }
@@ -1323,7 +1324,7 @@ static int fib6_clean_node(struct fib6_walker_t *w)
                         }
                         return 0;
                 }
-                BUG_TRAP(res==0);
+                WARN_ON(res != 0);
         }
         w->leaf = rt;
         return 0;
@@ -1447,27 +1448,23 @@ void fib6_run_gc(unsigned long expires, struct net *net)
                 gc_args.timeout = expires ? (int)expires :
                         net->ipv6.sysctl.ip6_rt_gc_interval;
         } else {
-                local_bh_disable();
-                if (!spin_trylock(&fib6_gc_lock)) {
-                        mod_timer(net->ipv6.ip6_fib_timer, jiffies + HZ);
-                        local_bh_enable();
+                if (!spin_trylock_bh(&fib6_gc_lock)) {
+                        mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
                         return;
                 }
                 gc_args.timeout = net->ipv6.sysctl.ip6_rt_gc_interval;
         }
-        gc_args.more = 0;
 
-        icmp6_dst_gc(&gc_args.more);
+        gc_args.more = icmp6_dst_gc();
 
         fib6_clean_all(net, fib6_age, 0, NULL);
 
         if (gc_args.more)
-                mod_timer(net->ipv6.ip6_fib_timer, jiffies +
-                          net->ipv6.sysctl.ip6_rt_gc_interval);
-        else {
-                del_timer(net->ipv6.ip6_fib_timer);
-                net->ipv6.ip6_fib_timer->expires = 0;
-        }
+                mod_timer(&net->ipv6.ip6_fib_timer,
+                          round_jiffies(jiffies
+                                        + net->ipv6.sysctl.ip6_rt_gc_interval));
+        else
+                del_timer(&net->ipv6.ip6_fib_timer);
         spin_unlock_bh(&fib6_gc_lock);
 }
 
@@ -1478,24 +1475,15 @@ static void fib6_gc_timer_cb(unsigned long arg)
 
 static int fib6_net_init(struct net *net)
 {
-        int ret;
-        struct timer_list *timer;
-
-        ret = -ENOMEM;
-        timer = kzalloc(sizeof(*timer), GFP_KERNEL);
-        if (!timer)
-                goto out;
-
-        setup_timer(timer, fib6_gc_timer_cb, (unsigned long)net);
-        net->ipv6.ip6_fib_timer = timer;
+        setup_timer(&net->ipv6.ip6_fib_timer, fib6_gc_timer_cb, (unsigned long)net);
 
         net->ipv6.rt6_stats = kzalloc(sizeof(*net->ipv6.rt6_stats), GFP_KERNEL);
         if (!net->ipv6.rt6_stats)
                 goto out_timer;
 
-        net->ipv6.fib_table_hash =
-                kzalloc(sizeof(*net->ipv6.fib_table_hash)*FIB_TABLE_HASHSZ,
-                        GFP_KERNEL);
+        net->ipv6.fib_table_hash = kcalloc(FIB_TABLE_HASHSZ,
+                                           sizeof(*net->ipv6.fib_table_hash),
+                                           GFP_KERNEL);
         if (!net->ipv6.fib_table_hash)
                 goto out_rt6_stats;
 
@@ -1521,9 +1509,7 @@ static int fib6_net_init(struct net *net)
 #endif
         fib6_tables_init(net);
 
-        ret = 0;
-out:
-        return ret;
+        return 0;
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 out_fib6_main_tbl:
@@ -1534,15 +1520,14 @@ out_fib_table_hash:
 out_rt6_stats:
         kfree(net->ipv6.rt6_stats);
 out_timer:
-        kfree(timer);
-        goto out;
+        return -ENOMEM;
  }
 
 static void fib6_net_exit(struct net *net)
 {
         rt6_ifdown(net, NULL);
-        del_timer_sync(net->ipv6.ip6_fib_timer);
-        kfree(net->ipv6.ip6_fib_timer);
+        del_timer_sync(&net->ipv6.ip6_fib_timer);
+
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
         kfree(net->ipv6.fib6_local_tbl);
 #endif
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6407c64ea4a5..a4402de425d9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -116,7 +116,7 @@ static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
         __skb_pull(newskb, skb_network_offset(newskb));
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
-        BUG_TRAP(newskb->dst);
+        WARN_ON(!newskb->dst);
 
         netif_rx(newskb);
         return 0;
@@ -236,6 +236,10 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         skb_reset_network_header(skb);
         hdr = ipv6_hdr(skb);
 
+        /* Allow local fragmentation. */
+        if (ipfragok)
+                skb->local_df = 1;
+
         /*
          *      Fill in the IPv6 header
          */
@@ -265,7 +269,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         skb->mark = sk->sk_mark;
 
         mtu = dst_mtu(dst);
-        if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
+        if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
                 IP6_INC_STATS(ip6_dst_idev(skb->dst),
                               IPSTATS_MIB_OUTREQUESTS);
                 return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index ee6de425ce6b..4545e4306862 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -50,125 +50,6 @@
 #include <linux/icmpv6.h>
 #include <linux/mutex.h>
 
-struct ipcomp6_tfms {
-        struct list_head list;
-        struct crypto_comp **tfms;
-        int users;
-};
-
-static DEFINE_MUTEX(ipcomp6_resource_mutex);
-static void **ipcomp6_scratches;
-static int ipcomp6_scratch_users;
-static LIST_HEAD(ipcomp6_tfms_list);
-
-static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
-{
-        int nexthdr;
-        int err = -ENOMEM;
-        struct ip_comp_hdr *ipch;
-        int plen, dlen;
-        struct ipcomp_data *ipcd = x->data;
-        u8 *start, *scratch;
-        struct crypto_comp *tfm;
-        int cpu;
-
-        if (skb_linearize_cow(skb))
-                goto out;
-
-        skb->ip_summed = CHECKSUM_NONE;
-
-        /* Remove ipcomp header and decompress original payload */
-        ipch = (void *)skb->data;
-        nexthdr = ipch->nexthdr;
-
-        skb->transport_header = skb->network_header + sizeof(*ipch);
-        __skb_pull(skb, sizeof(*ipch));
-
-        /* decompression */
-        plen = skb->len;
-        dlen = IPCOMP_SCRATCH_SIZE;
-        start = skb->data;
-
-        cpu = get_cpu();
-        scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);
-        tfm = *per_cpu_ptr(ipcd->tfms, cpu);
-
-        err = crypto_comp_decompress(tfm, start, plen, scratch, &dlen);
-        if (err)
-                goto out_put_cpu;
-
-        if (dlen < (plen + sizeof(*ipch))) {
-                err = -EINVAL;
-                goto out_put_cpu;
-        }
-
-        err = pskb_expand_head(skb, 0, dlen - plen, GFP_ATOMIC);
-        if (err) {
-                goto out_put_cpu;
-        }
-
-        skb->truesize += dlen - plen;
-        __skb_put(skb, dlen - plen);
-        skb_copy_to_linear_data(skb, scratch, dlen);
-        err = nexthdr;
-
-out_put_cpu:
-        put_cpu();
-out:
-        return err;
-}
-
-static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
-{
-        int err;
-        struct ip_comp_hdr *ipch;
-        struct ipcomp_data *ipcd = x->data;
-        int plen, dlen;
-        u8 *start, *scratch;
-        struct crypto_comp *tfm;
-        int cpu;
-
-        /* check whether datagram len is larger than threshold */
-        if (skb->len < ipcd->threshold) {
-                goto out_ok;
-        }
-
-        if (skb_linearize_cow(skb))
-                goto out_ok;
-
-        /* compression */
-        plen = skb->len;
-        dlen = IPCOMP_SCRATCH_SIZE;
-        start = skb->data;
-
-        cpu = get_cpu();
-        scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);
-        tfm = *per_cpu_ptr(ipcd->tfms, cpu);
-
-        local_bh_disable();
-        err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
-        local_bh_enable();
-        if (err || (dlen + sizeof(*ipch)) >= plen) {
-                put_cpu();
-                goto out_ok;
-        }
-        memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
-        put_cpu();
-        pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
-
-        /* insert ipcomp header and replace datagram */
-        ipch = ip_comp_hdr(skb);
-        ipch->nexthdr = *skb_mac_header(skb);
-        ipch->flags = 0;
-        ipch->cpi = htons((u16 )ntohl(x->id.spi));
-        *skb_mac_header(skb) = IPPROTO_COMP;
-
-out_ok:
-        skb_push(skb, -skb_network_offset(skb));
-
-        return 0;
-}
-
 static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                 int type, int code, int offset, __be32 info)
 {
@@ -251,160 +132,9 @@ out:
         return err;
 }
 
-static void ipcomp6_free_scratches(void)
-{
-        int i;
-        void **scratches;
-
-        if (--ipcomp6_scratch_users)
-                return;
-
-        scratches = ipcomp6_scratches;
-        if (!scratches)
-                return;
-
-        for_each_possible_cpu(i) {
-                void *scratch = *per_cpu_ptr(scratches, i);
-
-                vfree(scratch);
-        }
-
-        free_percpu(scratches);
-}
-
-static void **ipcomp6_alloc_scratches(void)
-{
-        int i;
-        void **scratches;
-
-        if (ipcomp6_scratch_users++)
-                return ipcomp6_scratches;
-
-        scratches = alloc_percpu(void *);
-        if (!scratches)
-                return NULL;
-
-        ipcomp6_scratches = scratches;
-
-        for_each_possible_cpu(i) {
-                void *scratch = vmalloc(IPCOMP_SCRATCH_SIZE);
-                if (!scratch)
-                        return NULL;
-                *per_cpu_ptr(scratches, i) = scratch;
-        }
-
-        return scratches;
-}
-
-static void ipcomp6_free_tfms(struct crypto_comp **tfms)
-{
-        struct ipcomp6_tfms *pos;
-        int cpu;
-
-        list_for_each_entry(pos, &ipcomp6_tfms_list, list) {
-                if (pos->tfms == tfms)
-                        break;
-        }
-
-        BUG_TRAP(pos);
-
-        if (--pos->users)
-                return;
-
-        list_del(&pos->list);
-        kfree(pos);
-
-        if (!tfms)
-                return;
-
-        for_each_possible_cpu(cpu) {
-                struct crypto_comp *tfm = *per_cpu_ptr(tfms, cpu);
-                crypto_free_comp(tfm);
-        }
-        free_percpu(tfms);
-}
-
-static struct crypto_comp **ipcomp6_alloc_tfms(const char *alg_name)
-{
-        struct ipcomp6_tfms *pos;
-        struct crypto_comp **tfms;
-        int cpu;
-
-        /* This can be any valid CPU ID so we don't need locking. */
-        cpu = raw_smp_processor_id();
-
-        list_for_each_entry(pos, &ipcomp6_tfms_list, list) {
-                struct crypto_comp *tfm;
-
-                tfms = pos->tfms;
-                tfm = *per_cpu_ptr(tfms, cpu);
-
-                if (!strcmp(crypto_comp_name(tfm), alg_name)) {
-                        pos->users++;
-                        return tfms;
-                }
-        }
-
-        pos = kmalloc(sizeof(*pos), GFP_KERNEL);
-        if (!pos)
-                return NULL;
-
-        pos->users = 1;
-        INIT_LIST_HEAD(&pos->list);
-        list_add(&pos->list, &ipcomp6_tfms_list);
-
-        pos->tfms = tfms = alloc_percpu(struct crypto_comp *);
-        if (!tfms)
-                goto error;
-
-        for_each_possible_cpu(cpu) {
-                struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
-                                                            CRYPTO_ALG_ASYNC);
-                if (IS_ERR(tfm))
-                        goto error;
-                *per_cpu_ptr(tfms, cpu) = tfm;
-        }
-
-        return tfms;
-
-error:
-        ipcomp6_free_tfms(tfms);
-        return NULL;
-}
-
-static void ipcomp6_free_data(struct ipcomp_data *ipcd)
-{
-        if (ipcd->tfms)
-                ipcomp6_free_tfms(ipcd->tfms);
-        ipcomp6_free_scratches();
-}
-
-static void ipcomp6_destroy(struct xfrm_state *x)
-{
-        struct ipcomp_data *ipcd = x->data;
-        if (!ipcd)
-                return;
-        xfrm_state_delete_tunnel(x);
-        mutex_lock(&ipcomp6_resource_mutex);
-        ipcomp6_free_data(ipcd);
-        mutex_unlock(&ipcomp6_resource_mutex);
-        kfree(ipcd);
-
-        xfrm6_tunnel_free_spi((xfrm_address_t *)&x->props.saddr);
-}
-
 static int ipcomp6_init_state(struct xfrm_state *x)
 {
-        int err;
-        struct ipcomp_data *ipcd;
-        struct xfrm_algo_desc *calg_desc;
-
-        err = -EINVAL;
-        if (!x->calg)
-                goto out;
-
-        if (x->encap)
-                goto out;
+        int err = -EINVAL;
 
         x->props.header_len = 0;
         switch (x->props.mode) {
@@ -417,39 +147,21 @@ static int ipcomp6_init_state(struct xfrm_state *x)
                 goto out;
         }
 
-        err = -ENOMEM;
-        ipcd = kzalloc(sizeof(*ipcd), GFP_KERNEL);
-        if (!ipcd)
+        err = ipcomp_init_state(x);
+        if (err)
                 goto out;
 
-        mutex_lock(&ipcomp6_resource_mutex);
-        if (!ipcomp6_alloc_scratches())
-                goto error;
-
-        ipcd->tfms = ipcomp6_alloc_tfms(x->calg->alg_name);
-        if (!ipcd->tfms)
-                goto error;
-        mutex_unlock(&ipcomp6_resource_mutex);
-
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp6_tunnel_attach(x);
                 if (err)
                         goto error_tunnel;
         }
 
-        calg_desc = xfrm_calg_get_byname(x->calg->alg_name, 0);
-        BUG_ON(!calg_desc);
-        ipcd->threshold = calg_desc->uinfo.comp.threshold;
-        x->data = ipcd;
         err = 0;
 out:
         return err;
 error_tunnel:
-        mutex_lock(&ipcomp6_resource_mutex);
-error:
-        ipcomp6_free_data(ipcd);
-        mutex_unlock(&ipcomp6_resource_mutex);
-        kfree(ipcd);
+        ipcomp_destroy(x);
 
         goto out;
 }
@@ -460,9 +172,9 @@ static const struct xfrm_type ipcomp6_type =
         .owner          = THIS_MODULE,
         .proto          = IPPROTO_COMP,
         .init_state     = ipcomp6_init_state,
-        .destructor     = ipcomp6_destroy,
-        .input          = ipcomp6_input,
-        .output         = ipcomp6_output,
+        .destructor     = ipcomp_destroy,
+        .input          = ipcomp_input,
+        .output         = ipcomp_output,
         .hdr_offset     = xfrm6_find_1stfragopt,
 };
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ea33b26512c2..741cfcd96f88 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -346,6 +346,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                  */
                 if (optlen == 0)
                         optval = NULL;
+                else if (optval == NULL)
+                        goto e_inval;
                 else if (optlen < sizeof(struct ipv6_opt_hdr) ||
                          optlen & 0x7 || optlen > 8 * 255)
                         goto e_inval;
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index ad1cc5bbf977..31295c8f6196 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -164,8 +164,8 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
                         calc_padlen(sizeof(*dstopt), 6));
 
         hao->type = IPV6_TLV_HAO;
+        BUILD_BUG_ON(sizeof(*hao) != 18);
         hao->length = sizeof(*hao) - 2;
-        BUG_TRAP(hao->length == 16);
 
         len = ((char *)hao - (char *)dstopt) + sizeof(*hao);
 
@@ -174,7 +174,7 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
         memcpy(&iph->saddr, x->coaddr, sizeof(iph->saddr));
         spin_unlock_bh(&x->lock);
 
-        BUG_TRAP(len == x->props.header_len);
+        WARN_ON(len != x->props.header_len);
         dstopt->hdrlen = (x->props.header_len >> 3) - 1;
 
         return 0;
@@ -317,7 +317,7 @@ static int mip6_destopt_init_state(struct xfrm_state *x)
         x->props.header_len = sizeof(struct ipv6_destopt_hdr) +
                 calc_padlen(sizeof(struct ipv6_destopt_hdr), 6) +
                 sizeof(struct ipv6_destopt_hao);
-        BUG_TRAP(x->props.header_len == 24);
+        WARN_ON(x->props.header_len != 24);
 
         return 0;
 }
@@ -380,7 +380,7 @@ static int mip6_rthdr_output(struct xfrm_state *x, struct sk_buff *skb)
         rt2->rt_hdr.segments_left = 1;
         memset(&rt2->reserved, 0, sizeof(rt2->reserved));
 
-        BUG_TRAP(rt2->rt_hdr.hdrlen == 2);
+        WARN_ON(rt2->rt_hdr.hdrlen != 2);
 
         memcpy(&rt2->addr, &iph->daddr, sizeof(rt2->addr));
         spin_lock_bh(&x->lock);
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 689dec899c57..0cfcce7b18d8 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -213,7 +213,7 @@ config IP6_NF_SECURITY
        tristate "Security table"
        depends on IP6_NF_IPTABLES
        depends on SECURITY
-       default m if NETFILTER_ADVANCED=n
+       depends on NETFILTER_ADVANCED
        help
          This option adds a `security' table to iptables, for use
          with Mandatory Access Control (MAC) policy.
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index a07abee30497..6e7131036bc6 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -31,7 +31,7 @@ static struct
         struct ip6t_replace repl;
         struct ip6t_standard entries[3];
         struct ip6t_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "security",
                 .valid_hooks = SECURITY_VALID_HOOKS,
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index cf20bc4fd60d..52d06dd4b817 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -416,8 +416,8 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 
         fq_kill(fq);
 
-        BUG_TRAP(head != NULL);
-        BUG_TRAP(NFCT_FRAG6_CB(head)->offset == 0);
+        WARN_ON(head == NULL);
+        WARN_ON(NFCT_FRAG6_CB(head)->offset != 0);
 
         /* Unfragmented part is taken from the first segment. */
         payload_len = ((head->data - skb_network_header(head)) -
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index f82f6074cf85..0179b66864f1 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -286,7 +286,6 @@ proc_net_fail:
 
 void ipv6_misc_proc_exit(void)
 {
-        proc_net_remove(&init_net, "sockstat6");
         proc_net_remove(&init_net, "dev_snmp6");
         proc_net_remove(&init_net, "snmp6");
         unregister_pernet_subsys(&ipv6_proc_ops);
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 6ab957ec2dd6..89184b576e23 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -473,8 +473,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 fq->q.fragments = head;
         }
 
-        BUG_TRAP(head != NULL);
-        BUG_TRAP(FRAG6_CB(head)->offset == 0);
+        WARN_ON(head == NULL);
+        WARN_ON(FRAG6_CB(head)->offset != 0);
 
         /* Unfragmented part is taken from the first segment. */
         payload_len = ((head->data - skb_network_header(head)) -
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 615b328de251..5a3e87e4b18f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -978,13 +978,12 @@ out:
         return &rt->u.dst;
 }
 
-int icmp6_dst_gc(int *more)
+int icmp6_dst_gc(void)
 {
         struct dst_entry *dst, *next, **pprev;
-        int freed;
+        int more = 0;
 
         next = NULL;
-        freed = 0;
 
         spin_lock_bh(&icmp6_dst_lock);
         pprev = &icmp6_dst_gc_list;
@@ -993,16 +992,15 @@ int icmp6_dst_gc(int *more)
                 if (!atomic_read(&dst->__refcnt)) {
                         *pprev = dst->next;
                         dst_free(dst);
-                        freed++;
                 } else {
                         pprev = &dst->next;
-                        (*more)++;
+                        ++more;
                 }
         }
 
         spin_unlock_bh(&icmp6_dst_lock);
 
-        return freed;
+        return more;
 }
 
 static int ip6_dst_gc(struct dst_ops *ops)
@@ -1251,7 +1249,7 @@ install_route:
 
         if (dst_metric(&rt->u.dst, RTAX_HOPLIMIT) == 0)
                 rt->u.dst.metrics[RTAX_HOPLIMIT-1] = -1;
-        if (!dst_metric(&rt->u.dst, RTAX_MTU))
+        if (!dst_mtu(&rt->u.dst))
                 rt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(dev);
         if (!dst_metric(&rt->u.dst, RTAX_ADVMSS))
                 rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->u.dst));
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 6a68eeb7bbf8..ec394cf5a19b 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -199,10 +199,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq6 = inet6_rsk(req);
         treq = tcp_rsk(req);
 
-        if (security_inet_conn_request(sk, skb, req)) {
-                reqsk_free(req);
-                goto out;
-        }
+        if (security_inet_conn_request(sk, skb, req))
+                goto out_free;
 
         req->mss = mss;
         ireq->rmt_port = th->source;
@@ -223,6 +221,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         req->expires = 0UL;
         req->retrans = 0;
+        ireq->ecn_ok            = 0;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->rcv_wscale        = tcp_opt.rcv_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
@@ -254,14 +253,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_sk(sk)->sport;
                 security_req_classify_flow(req, &fl);
-                if (ip6_dst_lookup(sk, &dst, &fl)) {
-                        reqsk_free(req);
-                        goto out;
-                }
+                if (ip6_dst_lookup(sk, &dst, &fl))
+                        goto out_free;
+
                 if (final_p)
                         ipv6_addr_copy(&fl.fl6_dst, final_p);
                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
-                        goto out;
+                        goto out_free;
         }
 
         req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
@@ -272,7 +270,10 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq->rcv_wscale = rcv_wscale;
 
         ret = get_cookie_sock(sk, skb, req, dst);
-
-out:    return ret;
+out:
+        return ret;
+out_free:
+        reqsk_free(req);
+        return NULL;
 }
 
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 5c99274558bf..e6dfaeac6be3 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -150,3 +150,19 @@ void ipv6_sysctl_unregister(void)
         unregister_net_sysctl_table(ip6_header);
         unregister_pernet_subsys(&ipv6_sysctl_net_ops);
 }
+
+static struct ctl_table_header *ip6_base;
+
+int ipv6_static_sysctl_register(void)
+{
+        static struct ctl_table empty[1];
+        ip6_base = register_net_sysctl_rotable(net_ipv6_ctl_path, empty);
+        if (ip6_base == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+void ipv6_static_sysctl_unregister(void)
+{
+        unregister_net_sysctl_table(ip6_base);
+}
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ae45f9835014..5b90b369ccb2 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -69,7 +69,8 @@
 #include <linux/scatterlist.h>
 
 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
-static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
+static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                                      struct request_sock *req);
 
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
 
@@ -421,7 +422,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 /* ICMPs are not backlogged, hence we cannot get
                  * an established socket here.
                  */
-                BUG_TRAP(req->sk == NULL);
+                WARN_ON(req->sk != NULL);
 
                 if (seq != tcp_rsk(req)->snt_isn) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
@@ -748,7 +749,7 @@ static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
         ipv6_addr_copy(&bp->saddr, saddr);
         ipv6_addr_copy(&bp->daddr, daddr);
         bp->protocol = cpu_to_be32(IPPROTO_TCP);
-        bp->len = cpu_to_be16(nbytes);
+        bp->len = cpu_to_be32(nbytes);
 
         sg_init_one(&sg, bp, sizeof(*bp));
         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
@@ -849,28 +850,17 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
         hash_location = tcp_parse_md5sig_option(th);
 
-        /* do we have a hash as expected? */
-        if (!hash_expected) {
-                if (!hash_location)
-                        return 0;
-                if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash NOT expected but found "
-                               "(" NIP6_FMT ", %u)->"
-                               "(" NIP6_FMT ", %u)\n",
-                               NIP6(ip6h->saddr), ntohs(th->source),
-                               NIP6(ip6h->daddr), ntohs(th->dest));
-                }
+        /* We've parsed the options - do we have a hash? */
+        if (!hash_expected && !hash_location)
+                return 0;
+
+        if (hash_expected && !hash_location) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
                 return 1;
         }
 
-        if (!hash_location) {
-                if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash expected but NOT found "
-                               "(" NIP6_FMT ", %u)->"
-                               "(" NIP6_FMT ", %u)\n",
-                               NIP6(ip6h->saddr), ntohs(th->source),
-                               NIP6(ip6h->daddr), ntohs(th->dest));
-                }
+        if (!hash_expected && hash_location) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
                 return 1;
         }
 
@@ -1105,8 +1095,8 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
-                                    &ipv6_hdr(skb)->daddr,
-                                    &ipv6_hdr(skb)->saddr, t1);
+                                    &ipv6_hdr(skb)->saddr,
+                                    &ipv6_hdr(skb)->daddr, t1);
         }
 #endif
 
@@ -1149,10 +1139,11 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
         inet_twsk_put(tw);
 }
 
-static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
+static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                                  struct request_sock *req)
 {
         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
-                        tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr));
+                        tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr));
 }
 
 
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index d6ce400f585f..bbd48b101bae 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -40,16 +40,39 @@ static void xfrm6_beet_make_header(struct sk_buff *skb)
 static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *top_iph;
-
-        skb_set_network_header(skb, -x->props.header_len);
+        struct ip_beet_phdr *ph;
+        struct iphdr *iphv4;
+        int optlen, hdr_len;
+
+        iphv4 = ip_hdr(skb);
+        hdr_len = 0;
+        optlen = XFRM_MODE_SKB_CB(skb)->optlen;
+        if (unlikely(optlen))
+                hdr_len += IPV4_BEET_PHMAXLEN - (optlen & 4);
+
+        skb_set_network_header(skb, -x->props.header_len - hdr_len);
+        if (x->sel.family != AF_INET6)
+                skb->network_header += IPV4_BEET_PHMAXLEN;
         skb->mac_header = skb->network_header +
                           offsetof(struct ipv6hdr, nexthdr);
         skb->transport_header = skb->network_header + sizeof(*top_iph);
-        __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl);
+        ph = (struct ip_beet_phdr *)__skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl-hdr_len);
 
         xfrm6_beet_make_header(skb);
 
         top_iph = ipv6_hdr(skb);
+        if (unlikely(optlen)) {
+
+                BUG_ON(optlen < 0);
+
+                ph->padlen = 4 - (optlen & 4);
+                ph->hdrlen = optlen / 8;
+                ph->nexthdr = top_iph->nexthdr;
+                if (ph->padlen)
+                        memset(ph + 1, IPOPT_NOP, ph->padlen);
+
+                top_iph->nexthdr = IPPROTO_BEETPH;
+        }
 
         ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
         ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 265b1b289a32..705959b31e24 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -497,7 +497,7 @@ static void iucv_setmask_up(void)
         /* Disable all cpu but the first in cpu_irq_cpumask. */
         cpumask = iucv_irq_cpumask;
         cpu_clear(first_cpu(iucv_irq_cpumask), cpumask);
-        for_each_cpu_mask(cpu, cpumask)
+        for_each_cpu_mask_nr(cpu, cpumask)
                 smp_call_function_single(cpu, iucv_block_cpu, NULL, 1);
 }
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index f0fc46c8038d..d628df97e02e 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -96,8 +96,8 @@ static void pfkey_sock_destruct(struct sock *sk)
                 return;
         }
 
-        BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
 
         atomic_dec(&pfkey_socks_nr);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8e7ba0e62cf5..297c257864c7 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -81,6 +81,7 @@ static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
                                   enum nl80211_iftype type, u32 *flags,
                                   struct vif_params *params)
 {
+        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct net_device *dev;
         enum ieee80211_if_types itype;
         struct ieee80211_sub_if_data *sdata;
@@ -95,6 +96,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
         if (itype == IEEE80211_IF_TYPE_INVALID)
                 return -EINVAL;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         ret = ieee80211_if_change_type(sdata, itype);
@@ -117,12 +121,16 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                              u8 key_idx, u8 *mac_addr,
                              struct key_params *params)
 {
+        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta = NULL;
         enum ieee80211_key_alg alg;
         struct ieee80211_key *key;
         int err;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         switch (params->cipher) {
@@ -167,10 +175,14 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                              u8 key_idx, u8 *mac_addr)
 {
+        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
         int ret;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         rcu_read_lock();
@@ -211,7 +223,8 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                              void (*callback)(void *cookie,
                                               struct key_params *params))
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta = NULL;
         u8 seq[6] = {0};
         struct key_params params;
@@ -220,6 +233,11 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
         u16 iv16;
         int err = -ENOENT;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         rcu_read_lock();
 
         if (mac_addr) {
@@ -293,8 +311,12 @@ static int ieee80211_config_default_key(struct wiphy *wiphy,
                                         struct net_device *dev,
                                         u8 key_idx)
 {
+        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
         rcu_read_lock();
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -475,9 +497,15 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
                                 struct beacon_parameters *params)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
         struct beacon_data *old;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
                 return -EINVAL;
 
@@ -492,9 +520,15 @@ static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
                                 struct beacon_parameters *params)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
         struct beacon_data *old;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
                 return -EINVAL;
 
@@ -508,9 +542,15 @@ static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
 
 static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
         struct beacon_data *old;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
                 return -EINVAL;
 
@@ -646,11 +686,14 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *mac, struct station_parameters *params)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata;
         int err;
 
+        if (dev == local->mdev || params->vlan == local->mdev)
+                return -EOPNOTSUPP;
+
         /* Prevent a race with changing the rate control algorithm */
         if (!netif_running(dev))
                 return -ENETDOWN;
@@ -701,10 +744,15 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *mac)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (mac) {
                 rcu_read_lock();
 
@@ -730,10 +778,13 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                                     u8 *mac,
                                     struct station_parameters *params)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *vlansdata;
 
+        if (dev == local->mdev || params->vlan == local->mdev)
+                return -EOPNOTSUPP;
+
         rcu_read_lock();
 
         /* XXX: get sta belonging to dev */
@@ -752,7 +803,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                         return -EINVAL;
                 }
 
-                sta->sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
+                sta->sdata = vlansdata;
                 ieee80211_send_layer2_update(sta);
         }
 
@@ -767,15 +818,20 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *dst, u8 *next_hop)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
         struct sta_info *sta;
         int err;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
         if (!netif_running(dev))
                 return -ENETDOWN;
 
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                 return -ENOTSUPP;
 
@@ -817,14 +873,19 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
                                     struct net_device *dev,
                                     u8 *dst, u8 *next_hop)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
         struct sta_info *sta;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
         if (!netif_running(dev))
                 return -ENETDOWN;
 
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                 return -ENOTSUPP;
 
@@ -891,9 +952,15 @@ static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
                                u8 *dst, u8 *next_hop, struct mpath_info *pinfo)
 
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                 return -ENOTSUPP;
 
@@ -913,9 +980,15 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
                                  int idx, u8 *dst, u8 *next_hop,
                                  struct mpath_info *pinfo)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
 
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
                 return -ENOTSUPP;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index a4f9a832722a..ec59345af65b 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -82,6 +82,7 @@ struct ieee80211_sta_bss {
 
         u8 bssid[ETH_ALEN];
         u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 dtim_period;
         u16 capability; /* host byte order */
         enum ieee80211_band band;
         int freq;
@@ -586,6 +587,7 @@ struct ieee80211_local {
         struct timer_list sta_cleanup;
 
         unsigned long queues_pending[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
+        unsigned long queues_pending_run[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
         struct ieee80211_tx_stored_packet pending_packet[IEEE80211_MAX_QUEUES];
         struct tasklet_struct tx_pending_tasklet;
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index f1a83d450ea0..aa5a191598c9 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -245,10 +245,13 @@ static int ieee80211_open(struct net_device *dev)
         case IEEE80211_IF_TYPE_AP:
                 sdata->bss = &sdata->u.ap;
                 break;
+        case IEEE80211_IF_TYPE_MESH_POINT:
+                /* mesh ifaces must set allmulti to forward mcast traffic */
+                atomic_inc(&local->iff_allmultis);
+                break;
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_MNTR:
         case IEEE80211_IF_TYPE_IBSS:
-        case IEEE80211_IF_TYPE_MESH_POINT:
                 /* no special treatment */
                 break;
         case IEEE80211_IF_TYPE_INVALID:
@@ -495,6 +498,9 @@ static int ieee80211_stop(struct net_device *dev)
                 netif_addr_unlock_bh(local->mdev);
                 break;
         case IEEE80211_IF_TYPE_MESH_POINT:
+                /* allmulti is always set on mesh ifaces */
+                atomic_dec(&local->iff_allmultis);
+                /* fall through */
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_IBSS:
                 sdata->u.sta.state = IEEE80211_DISABLED;
@@ -1233,18 +1239,12 @@ static void ieee80211_tasklet_handler(unsigned long data)
 /* Remove added headers (e.g., QoS control), encryption header/MIC, etc. to
  * make a prepared TX frame (one that has been given to hw) to look like brand
  * new IEEE 802.11 frame that is ready to go through TX processing again.
- * Also, tx_packet_data in cb is restored from tx_control. */
+ */
 static void ieee80211_remove_tx_extra(struct ieee80211_local *local,
                                       struct ieee80211_key *key,
                                       struct sk_buff *skb)
 {
         int hdrlen, iv_len, mic_len;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-
-        info->flags &=  IEEE80211_TX_CTL_REQ_TX_STATUS |
-                        IEEE80211_TX_CTL_DO_NOT_ENCRYPT |
-                        IEEE80211_TX_CTL_REQUEUE |
-                        IEEE80211_TX_CTL_EAPOL_FRAME;
 
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
 
@@ -1695,6 +1695,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (local->hw.conf.beacon_int < 10)
                 local->hw.conf.beacon_int = 100;
 
+        if (local->hw.max_listen_interval == 0)
+                local->hw.max_listen_interval = 1;
+
+        local->hw.conf.listen_interval = local->hw.max_listen_interval;
+
         local->wstats_flags |= local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
                                                   IEEE80211_HW_SIGNAL_DB |
                                                   IEEE80211_HW_SIGNAL_DBM) ?
@@ -1731,8 +1736,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         result = ieee80211_wep_init(local);
 
         if (result < 0) {
-                printk(KERN_DEBUG "%s: Failed to initialize wep\n",
-                       wiphy_name(local->hw.wiphy));
+                printk(KERN_DEBUG "%s: Failed to initialize wep: %d\n",
+                       wiphy_name(local->hw.wiphy), result);
                 goto fail_wep;
         }
 
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 669eafafe497..7495fbb0d211 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -214,8 +214,7 @@ void ieee80211s_stop(void);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
 
 /* Mesh paths */
-int mesh_nexthop_lookup(u8 *next_hop, struct sk_buff *skb,
-                struct net_device *dev);
+int mesh_nexthop_lookup(struct sk_buff *skb, struct net_device *dev);
 void mesh_path_start_discovery(struct net_device *dev);
 struct mesh_path *mesh_path_lookup(u8 *dst, struct net_device *dev);
 struct mesh_path *mesh_path_lookup_by_idx(int idx, struct net_device *dev);
@@ -286,6 +285,4 @@ static inline void mesh_path_activate(struct mesh_path *mpath)
 #define mesh_allocated  0
 #endif
 
-#define MESH_PREQ(skb)  (skb->cb + 30)
-
 #endif /* IEEE80211S_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 7fa149e230e6..08aca446ca01 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -758,29 +758,30 @@ enddiscovery:
 /**
  * ieee80211s_lookup_nexthop - put the appropriate next hop on a mesh frame
  *
- * @next_hop: output argument for next hop address
- * @skb: frame to be sent
+ * @skb: 802.11 frame to be sent
  * @dev: network device the frame will be sent through
+ * @fwd_frame: true if this frame was originally from a different host
  *
  * Returns: 0 if the next hop was found. Nonzero otherwise. If no next hop is
  * found, the function will start a path discovery and queue the frame so it is
  * sent when the path is resolved. This means the caller must not free the skb
  * in this case.
  */
-int mesh_nexthop_lookup(u8 *next_hop, struct sk_buff *skb,
-                struct net_device *dev)
+int mesh_nexthop_lookup(struct sk_buff *skb, struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sk_buff *skb_to_free = NULL;
         struct mesh_path *mpath;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        u8 *dst_addr = hdr->addr3;
         int err = 0;
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(skb->data, dev);
+        mpath = mesh_path_lookup(dst_addr, dev);
 
         if (!mpath) {
-                mesh_path_add(skb->data, dev);
-                mpath = mesh_path_lookup(skb->data, dev);
+                mesh_path_add(dst_addr, dev);
+                mpath = mesh_path_lookup(dst_addr, dev);
                 if (!mpath) {
                         dev_kfree_skb(skb);
                         sdata->u.sta.mshstats.dropped_frames_no_route++;
@@ -792,13 +793,13 @@ int mesh_nexthop_lookup(u8 *next_hop, struct sk_buff *skb,
         if (mpath->flags & MESH_PATH_ACTIVE) {
                 if (time_after(jiffies, mpath->exp_time -
                         msecs_to_jiffies(sdata->u.sta.mshcfg.path_refresh_time))
-                                && skb->pkt_type != PACKET_OTHERHOST
+                                && !memcmp(dev->dev_addr, hdr->addr4, ETH_ALEN)
                                 && !(mpath->flags & MESH_PATH_RESOLVING)
                                 && !(mpath->flags & MESH_PATH_FIXED)) {
                         mesh_queue_preq(mpath,
                                         PREQ_Q_F_START | PREQ_Q_F_REFRESH);
                 }
-                memcpy(next_hop, mpath->next_hop->addr,
+                memcpy(hdr->addr1, mpath->next_hop->addr,
                                 ETH_ALEN);
         } else {
                 if (!(mpath->flags & MESH_PATH_RESOLVING)) {
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 5f88a2e6ee50..838ee60492ad 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -388,18 +388,15 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
 void mesh_path_discard_frame(struct sk_buff *skb, struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct mesh_path *mpath;
         u32 dsn = 0;
 
-        if (skb->pkt_type == PACKET_OTHERHOST) {
-                struct ieee80211s_hdr *prev_meshhdr;
-                int mshhdrlen;
+        if (memcmp(hdr->addr4, dev->dev_addr, ETH_ALEN) != 0) {
                 u8 *ra, *da;
 
-                prev_meshhdr = ((struct ieee80211s_hdr *)skb->cb);
-                mshhdrlen = ieee80211_get_mesh_hdrlen(prev_meshhdr);
-                da = skb->data;
-                ra = MESH_PREQ(skb);
+                da = hdr->addr3;
+                ra = hdr->addr2;
                 mpath = mesh_path_lookup(da, dev);
                 if (mpath)
                         dsn = ++mpath->dsn;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d7c371e36bf0..e1d11c9b6729 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -551,6 +551,7 @@ static void ieee80211_set_associated(struct net_device *dev,
                         /* set timing information */
                         sdata->bss_conf.beacon_int = bss->beacon_int;
                         sdata->bss_conf.timestamp = bss->timestamp;
+                        sdata->bss_conf.dtim_period = bss->dtim_period;
 
                         changed |= ieee80211_handle_bss_capability(sdata, bss);
 
@@ -606,7 +607,6 @@ void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
                       int encrypt)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_tx_info *info;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         skb->dev = sdata->local->mdev;
@@ -614,11 +614,8 @@ void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
         skb_set_network_header(skb, 0);
         skb_set_transport_header(skb, 0);
 
-        info = IEEE80211_SKB_CB(skb);
-        memset(info, 0, sizeof(struct ieee80211_tx_info));
-        info->control.ifindex = sdata->dev->ifindex;
-        if (!encrypt)
-                info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        skb->iif = sdata->dev->ifindex;
+        skb->do_not_encrypt = !encrypt;
 
         dev_queue_xmit(skb);
 }
@@ -777,7 +774,8 @@ static void ieee80211_send_assoc(struct net_device *dev,
                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
                                                    IEEE80211_STYPE_REASSOC_REQ);
                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.reassoc_req.listen_interval = cpu_to_le16(1);
+                mgmt->u.reassoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
                 memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
                        ETH_ALEN);
         } else {
@@ -785,7 +783,8 @@ static void ieee80211_send_assoc(struct net_device *dev,
                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
                                                    IEEE80211_STYPE_ASSOC_REQ);
                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.assoc_req.listen_interval = cpu_to_le16(1);
+                mgmt->u.reassoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
         }
 
         /* SSID */
@@ -2692,6 +2691,16 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
 
+        if (elems->tim) {
+                struct ieee80211_tim_ie *tim_ie =
+                        (struct ieee80211_tim_ie *)elems->tim;
+                bss->dtim_period = tim_ie->dtim_period;
+        }
+
+        /* set default value for buggy APs */
+        if (!elems->tim || bss->dtim_period == 0)
+                bss->dtim_period = 1;
+
         bss->supp_rates_len = 0;
         if (elems->supp_rates) {
                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
@@ -3303,6 +3312,7 @@ void ieee80211_start_mesh(struct net_device *dev)
         ifsta = &sdata->u.sta;
         ifsta->state = IEEE80211_MESH_UP;
         ieee80211_sta_timer((unsigned long)sdata);
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
 }
 #endif
 
@@ -3653,11 +3663,21 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                        "%s\n", print_mac(mac, bssid),
                        print_mac(mac2, ifsta->bssid));
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
-            (bss = ieee80211_rx_bss_get(dev, bssid,
-                                        local->hw.conf.channel->center_freq,
-                                        ifsta->ssid, ifsta->ssid_len))) {
+
+        if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
                 int ret;
+                int search_freq;
+
+                if (ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
+                        search_freq = bss->freq;
+                else
+                        search_freq = local->hw.conf.channel->center_freq;
+
+                bss = ieee80211_rx_bss_get(dev, bssid, search_freq,
+                                           ifsta->ssid, ifsta->ssid_len);
+                if (!bss)
+                        goto dont_join;
+
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
                        " based on configured SSID\n",
                        dev->name, print_mac(mac, bssid));
@@ -3665,6 +3685,8 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                 ieee80211_rx_bss_put(local, bss);
                 return ret;
         }
+
+dont_join:
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "   did not try to join ibss\n");
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
@@ -3898,7 +3920,7 @@ done:
         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
                 if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
-                    (!ifsta->state == IEEE80211_IBSS_JOINED &&
+                    (!(ifsta->state == IEEE80211_IBSS_JOINED) &&
                     !ieee80211_sta_active_ibss(dev)))
                         ieee80211_sta_find_ibss(dev, ifsta);
         }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 6d9ae67c27ca..6db854505193 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1109,20 +1109,9 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 
         hdrlen = ieee80211_get_hdrlen(fc);
 
-        if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                int meshhdrlen = ieee80211_get_mesh_hdrlen(
+        if (ieee80211_vif_is_mesh(&sdata->vif))
+                hdrlen += ieee80211_get_mesh_hdrlen(
                                 (struct ieee80211s_hdr *) (skb->data + hdrlen));
-                /* Copy on cb:
-                 *  - mesh header: to be used for mesh forwarding
-                 * decision. It will also be used as mesh header template at
-                 * tx.c:ieee80211_subif_start_xmit() if interface
-                 * type is mesh and skb->pkt_type == PACKET_OTHERHOST
-                 *  - ta: to be used if a RERR needs to be sent.
-                 */
-                memcpy(skb->cb, skb->data + hdrlen, meshhdrlen);
-                memcpy(MESH_PREQ(skb), hdr->addr2, ETH_ALEN);
-                hdrlen += meshhdrlen;
-        }
 
         /* convert IEEE 802.11 header + possible LLC headers into Ethernet
          * header
@@ -1269,38 +1258,6 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                 }
         }
 
-        /* Mesh forwarding */
-        if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                u8 *mesh_ttl = &((struct ieee80211s_hdr *)skb->cb)->ttl;
-                (*mesh_ttl)--;
-
-                if (is_multicast_ether_addr(skb->data)) {
-                        if (*mesh_ttl > 0) {
-                                xmit_skb = skb_copy(skb, GFP_ATOMIC);
-                                if (xmit_skb)
-                                        xmit_skb->pkt_type = PACKET_OTHERHOST;
-                                else if (net_ratelimit())
-                                        printk(KERN_DEBUG "%s: failed to clone "
-                                               "multicast frame\n", dev->name);
-                        } else
-                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
-                                                             dropped_frames_ttl);
-                } else if (skb->pkt_type != PACKET_OTHERHOST &&
-                        compare_ether_addr(dev->dev_addr, skb->data) != 0) {
-                        if (*mesh_ttl == 0) {
-                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
-                                                             dropped_frames_ttl);
-                                dev_kfree_skb(skb);
-                                skb = NULL;
-                        } else {
-                                xmit_skb = skb;
-                                xmit_skb->pkt_type = PACKET_OTHERHOST;
-                                if (!(dev->flags & IFF_PROMISC))
-                                        skb  = NULL;
-                        }
-                }
-        }
-
         if (skb) {
                 /* deliver to local stack */
                 skb->protocol = eth_type_trans(skb, dev);
@@ -1431,6 +1388,63 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 }
 
 static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_hdr *hdr;
+        struct ieee80211s_hdr *mesh_hdr;
+        unsigned int hdrlen;
+        struct sk_buff *skb = rx->skb, *fwd_skb;
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
+        if (!ieee80211_is_data(hdr->frame_control))
+                return RX_CONTINUE;
+
+        if (!mesh_hdr->ttl)
+                /* illegal frame */
+                return RX_DROP_MONITOR;
+
+        if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
+                return RX_CONTINUE;
+
+        mesh_hdr->ttl--;
+
+        if (rx->flags & IEEE80211_RX_RA_MATCH) {
+                if (!mesh_hdr->ttl)
+                        IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.sta,
+                                                     dropped_frames_ttl);
+                else {
+                        struct ieee80211_hdr *fwd_hdr;
+                        fwd_skb = skb_copy(skb, GFP_ATOMIC);
+
+                        if (!fwd_skb && net_ratelimit())
+                                printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
+                                                   rx->dev->name);
+
+                        fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
+                        /*
+                         * Save TA to addr1 to send TA a path error if a
+                         * suitable next hop is not found
+                         */
+                        memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
+                        memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
+                        fwd_skb->dev = rx->local->mdev;
+                        fwd_skb->iif = rx->dev->ifindex;
+                        dev_queue_xmit(fwd_skb);
+                }
+        }
+
+        if (is_multicast_ether_addr(hdr->addr3) ||
+            rx->dev->flags & IFF_PROMISC)
+                return RX_CONTINUE;
+        else
+                return RX_DROP_MONITOR;
+}
+
+
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->dev;
@@ -1663,10 +1677,12 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
         rx->sdata = sdata;
         rx->dev = sdata->dev;
 
-#define CALL_RXH(rxh)           \
-        res = rxh(rx);          \
-        if (res != RX_CONTINUE) \
-                goto rxh_done;
+#define CALL_RXH(rxh)                   \
+        do {                            \
+                res = rxh(rx);          \
+                if (res != RX_CONTINUE) \
+                        goto rxh_done;  \
+        } while (0);
 
         CALL_RXH(ieee80211_rx_h_passive_scan)
         CALL_RXH(ieee80211_rx_h_check)
@@ -1678,6 +1694,8 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
         /* must be after MMIC verify so header is counted in MPDU mic */
         CALL_RXH(ieee80211_rx_h_remove_qos_control)
         CALL_RXH(ieee80211_rx_h_amsdu)
+        if (ieee80211_vif_is_mesh(&sdata->vif))
+                CALL_RXH(ieee80211_rx_h_mesh_fwding);
         CALL_RXH(ieee80211_rx_h_data)
         CALL_RXH(ieee80211_rx_h_ctrl)
         CALL_RXH(ieee80211_rx_h_mgmt)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 0fbadd8b983c..4788f7b91f49 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -305,7 +305,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
         rcu_read_unlock();
 
         local->total_ps_buffered = total;
-#ifdef MAC80211_VERBOSE_PS_DEBUG
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: PS buffers full - purged %d frames\n",
                wiphy_name(local->hw.wiphy), purged);
 #endif
@@ -342,7 +342,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
                         purge_old_ps_buffers(tx->local);
                 if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >=
                     AP_MAX_BC_BUFFER) {
-#ifdef MAC80211_VERBOSE_PS_DEBUG
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                         if (net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: BC TX buffer full - "
                                        "dropping the oldest frame\n",
@@ -389,7 +389,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                         purge_old_ps_buffers(tx->local);
                 if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
-#ifdef MAC80211_VERBOSE_PS_DEBUG
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                         if (net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: STA %s TX "
                                        "buffer full - dropping oldest frame\n",
@@ -439,14 +439,14 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         u16 fc = tx->fc;
 
-        if (unlikely(info->flags & IEEE80211_TX_CTL_DO_NOT_ENCRYPT))
+        if (unlikely(tx->skb->do_not_encrypt))
                 tx->key = NULL;
         else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
                 tx->key = key;
         else if ((key = rcu_dereference(tx->sdata->default_key)))
                 tx->key = key;
         else if (tx->sdata->drop_unencrypted &&
-                 !(info->flags & IEEE80211_TX_CTL_EAPOL_FRAME) &&
+                 (tx->skb->protocol != cpu_to_be16(ETH_P_PAE)) &&
                  !(info->flags & IEEE80211_TX_CTL_INJECTED)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
                 return TX_DROP;
@@ -476,7 +476,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         }
 
         if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
-                info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+                tx->skb->do_not_encrypt = 1;
 
         return TX_CONTINUE;
 }
@@ -732,6 +732,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                 memcpy(skb_put(frag, copylen), pos, copylen);
                 memcpy(frag->cb, first->cb, sizeof(frag->cb));
                 skb_copy_queue_mapping(frag, first);
+                frag->do_not_encrypt = first->do_not_encrypt;
 
                 pos += copylen;
                 left -= copylen;
@@ -852,7 +853,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
 
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        skb->do_not_encrypt = 1;
         info->flags |= IEEE80211_TX_CTL_INJECTED;
         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 
@@ -925,8 +926,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                 skb_trim(skb, skb->len - FCS_LEN);
                         }
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
-                                info->flags &=
-                                        ~IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+                                tx->skb->do_not_encrypt = 0;
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
                                 tx->flags |= IEEE80211_TX_FRAGMENTED;
                         break;
@@ -1042,10 +1042,9 @@ static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
                                 struct sk_buff *skb,
                                 struct net_device *mdev)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct net_device *dev;
 
-        dev = dev_get_by_index(&init_net, info->control.ifindex);
+        dev = dev_get_by_index(&init_net, skb->iif);
         if (unlikely(dev && !is_ieee80211_device(dev, mdev))) {
                 dev_put(dev);
                 dev = NULL;
@@ -1061,13 +1060,14 @@ static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_tx_info *info;
         int ret, i;
 
-        if (netif_subqueue_stopped(local->mdev, skb))
-                return IEEE80211_TX_AGAIN;
-
         if (skb) {
+                if (netif_subqueue_stopped(local->mdev, skb))
+                        return IEEE80211_TX_AGAIN;
+                info =  IEEE80211_SKB_CB(skb);
+
                 ieee80211_dump_frame(wiphy_name(local->hw.wiphy),
                                      "TX to low-level driver", skb);
                 ret = local->ops->tx(local_to_hw(local), skb);
@@ -1216,6 +1216,7 @@ retry:
 
                 if (ret == IEEE80211_TX_FRAG_AGAIN)
                         skb = NULL;
+
                 set_bit(queue, local->queues_pending);
                 smp_mb();
                 /*
@@ -1300,14 +1301,15 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                                 struct net_device *dev)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct net_device *odev = NULL;
         struct ieee80211_sub_if_data *osdata;
         int headroom;
         bool may_encrypt;
         int ret;
 
-        if (info->control.ifindex)
-                odev = dev_get_by_index(&init_net, info->control.ifindex);
+        if (skb->iif)
+                odev = dev_get_by_index(&init_net, skb->iif);
         if (unlikely(odev && !is_ieee80211_device(odev, dev))) {
                 dev_put(odev);
                 odev = NULL;
@@ -1321,9 +1323,27 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                 return 0;
         }
 
+        memset(info, 0, sizeof(*info));
+
+        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+
         osdata = IEEE80211_DEV_TO_SUB_IF(odev);
 
-        may_encrypt = !(info->flags & IEEE80211_TX_CTL_DO_NOT_ENCRYPT);
+        if (ieee80211_vif_is_mesh(&osdata->vif) &&
+            ieee80211_is_data(hdr->frame_control)) {
+                if (ieee80211_is_data(hdr->frame_control)) {
+                        if (is_multicast_ether_addr(hdr->addr3))
+                                memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
+                        else
+                                if (mesh_nexthop_lookup(skb, odev))
+                                        return  0;
+                        if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
+                                IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.sta,
+                                                             fwded_frames);
+                }
+        }
+
+        may_encrypt = !skb->do_not_encrypt;
 
         headroom = osdata->local->tx_headroom;
         if (may_encrypt)
@@ -1348,7 +1368,6 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                  struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_radiotap_header *prthdr =
                 (struct ieee80211_radiotap_header *)skb->data;
         u16 len_rthdr;
@@ -1371,11 +1390,11 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
         skb->dev = local->mdev;
 
         /* needed because we set skb device to master */
-        info->control.ifindex = dev->ifindex;
+        skb->iif = dev->ifindex;
 
-        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
-        /* Interfaces should always request a status report */
-        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+        /* sometimes we do encrypt injected frames, will be fixed
+         * up in radiotap parser if not wanted */
+        skb->do_not_encrypt = 0;
 
         /*
          * fix up the pointers accounting for the radiotap
@@ -1419,7 +1438,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                                struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_info *info;
         struct ieee80211_sub_if_data *sdata;
         int ret = 1, head_need;
         u16 ethertype, hdrlen,  meshhdrlen = 0;
@@ -1469,30 +1487,17 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         case IEEE80211_IF_TYPE_MESH_POINT:
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 /* RA TA DA SA */
-                if (is_multicast_ether_addr(skb->data))
-                        memcpy(hdr.addr1, skb->data, ETH_ALEN);
-                else if (mesh_nexthop_lookup(hdr.addr1, skb, dev))
-                                return 0;
+                memset(hdr.addr1, 0, ETH_ALEN);
                 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
                 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
-                if (skb->pkt_type == PACKET_OTHERHOST) {
-                        /* Forwarded frame, keep mesh ttl and seqnum */
-                        struct ieee80211s_hdr *prev_meshhdr;
-                        prev_meshhdr = ((struct ieee80211s_hdr *)skb->cb);
-                        meshhdrlen = ieee80211_get_mesh_hdrlen(prev_meshhdr);
-                        memcpy(&mesh_hdr, prev_meshhdr, meshhdrlen);
-                        sdata->u.sta.mshstats.fwded_frames++;
-                } else {
-                        if (!sdata->u.sta.mshcfg.dot11MeshTTL) {
-                                /* Do not send frames with mesh_ttl == 0 */
-                                sdata->u.sta.mshstats.dropped_frames_ttl++;
-                                ret = 0;
-                                goto fail;
-                        }
-                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
-                                                               sdata);
+                if (!sdata->u.sta.mshcfg.dot11MeshTTL) {
+                        /* Do not send frames with mesh_ttl == 0 */
+                        sdata->u.sta.mshstats.dropped_frames_ttl++;
+                        ret = 0;
+                        goto fail;
                 }
+                meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata);
                 hdrlen = 30;
                 break;
 #endif
@@ -1540,7 +1545,8 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
          * Drop unicast frames to unauthorised stations unless they are
          * EAPOL frames from the local station.
          */
-        if (unlikely(!is_multicast_ether_addr(hdr.addr1) &&
+        if (!ieee80211_vif_is_mesh(&sdata->vif) &&
+                unlikely(!is_multicast_ether_addr(hdr.addr1) &&
                       !(sta_flags & WLAN_STA_AUTHORIZED) &&
                       !(ethertype == ETH_P_PAE &&
                        compare_ether_addr(dev->dev_addr,
@@ -1645,14 +1651,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         nh_pos += hdrlen;
         h_pos += hdrlen;
 
-        info = IEEE80211_SKB_CB(skb);
-        memset(info, 0, sizeof(*info));
-        info->control.ifindex = dev->ifindex;
-        if (ethertype == ETH_P_PAE)
-                info->flags |= IEEE80211_TX_CTL_EAPOL_FRAME;
-
-        /* Interfaces should always request a status report */
-        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+        skb->iif = dev->ifindex;
 
         skb->dev = local->mdev;
         dev->stats.tx_packets++;
@@ -1714,14 +1713,19 @@ void ieee80211_tx_pending(unsigned long data)
         netif_tx_lock_bh(dev);
         for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
                 /* Check that this queue is ok */
-                if (__netif_subqueue_stopped(local->mdev, i))
+                if (__netif_subqueue_stopped(local->mdev, i) &&
+                    !test_bit(i, local->queues_pending_run))
                         continue;
 
                 if (!test_bit(i, local->queues_pending)) {
+                        clear_bit(i, local->queues_pending_run);
                         ieee80211_wake_queue(&local->hw, i);
                         continue;
                 }
 
+                clear_bit(i, local->queues_pending_run);
+                netif_start_subqueue(local->mdev, i);
+
                 store = &local->pending_packet[i];
                 tx.extra_frag = store->extra_frag;
                 tx.num_extra_frag = store->num_extra_frag;
@@ -1922,6 +1926,8 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 
         info = IEEE80211_SKB_CB(skb);
 
+        skb->do_not_encrypt = 1;
+
         info->band = band;
         rate_control_get_rate(local->mdev, sband, skb, &rsel);
 
@@ -1931,7 +1937,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                                "no rate found\n",
                                wiphy_name(local->hw.wiphy));
                 }
-                dev_kfree_skb(skb);
+                dev_kfree_skb_any(skb);
                 skb = NULL;
                 goto out;
         }
@@ -1940,7 +1946,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         info->tx_rate_idx = rsel.rate_idx;
 
         info->flags |= IEEE80211_TX_CTL_NO_ACK;
-        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
         info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
         info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
         if (sdata->bss_conf.use_short_preamble &&
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 19f85e1b3695..0d463c80c404 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -361,6 +361,7 @@ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
         struct ieee80211_local *local = hw_to_local(hw);
 
         if (test_bit(queue, local->queues_pending)) {
+                set_bit(queue, local->queues_pending_run);
                 tasklet_schedule(&local->tx_pending_tasklet);
         } else {
                 netif_wake_subqueue(local->mdev, queue);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 872d2fcd1a5b..5c2bf0a3d4db 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -31,13 +31,13 @@ int ieee80211_wep_init(struct ieee80211_local *local)
         local->wep_tx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0,
                                                 CRYPTO_ALG_ASYNC);
         if (IS_ERR(local->wep_tx_tfm))
-                return -ENOMEM;
+                return PTR_ERR(local->wep_tx_tfm);
 
         local->wep_rx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0,
                                                 CRYPTO_ALG_ASYNC);
         if (IS_ERR(local->wep_rx_tfm)) {
                 crypto_free_blkcipher(local->wep_tx_tfm);
-                return -ENOMEM;
+                return PTR_ERR(local->wep_rx_tfm);
         }
 
         return 0;
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 07edda0b8a5c..4310e2f65661 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -188,6 +188,9 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
 {
         int i;
 
+        /* XXX: currently broken due to cb/requeue use */
+        return -EPERM;
+
         /* prepare the filter and save it for the SW queue
          * matching the received HW queue */
 
@@ -238,12 +241,14 @@ void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
         } else {
                 struct netdev_queue *txq;
                 spinlock_t *root_lock;
+                struct Qdisc *q;
 
                 txq = netdev_get_tx_queue(local->mdev, agg_queue);
-                root_lock = qdisc_root_lock(txq->qdisc);
+                q = rcu_dereference(txq->qdisc);
+                root_lock = qdisc_lock(q);
 
                 spin_lock_bh(root_lock);
-                qdisc_reset(txq->qdisc);
+                qdisc_reset(q);
                 spin_unlock_bh(root_lock);
         }
 }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index c519d090bdb9..9d1830da8e84 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1032,10 +1032,10 @@ void nf_conntrack_cleanup(void)
         nf_ct_free_hashtable(nf_conntrack_hash, nf_conntrack_vmalloc,
                              nf_conntrack_htable_size);
 
-        nf_conntrack_proto_fini();
-        nf_conntrack_helper_fini();
-        nf_conntrack_expect_fini();
         nf_conntrack_acct_fini();
+        nf_conntrack_expect_fini();
+        nf_conntrack_helper_fini();
+        nf_conntrack_proto_fini();
 }
 
 struct hlist_head *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced)
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 3469bc71a385..4b2c769d555f 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -95,7 +95,7 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
         newlen = newoff + t->len;
         rcu_read_unlock();
 
-        new = krealloc(ct->ext, newlen, gfp);
+        new = __krealloc(ct->ext, newlen, gfp);
         if (!new)
                 return NULL;
 
@@ -115,10 +115,10 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
                 ct->ext = new;
         }
 
-        ct->ext->offset[id] = newoff;
-        ct->ext->len = newlen;
-        memset((void *)ct->ext + newoff, 0, newlen - newoff);
-        return (void *)ct->ext + newoff;
+        new->offset[id] = newoff;
+        new->len = newlen;
+        memset((void *)new + newoff, 0, newlen - newoff);
+        return (void *)new + newoff;
 }
 EXPORT_SYMBOL(__nf_ct_ext_add);
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 420a10d8eb1e..6f61261888ef 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -67,7 +67,8 @@ static const char *const tcp_conntrack_names[] = {
 /* RFC1122 says the R2 limit should be at least 100 seconds.
    Linux uses 15 packets as limit, which corresponds
    to ~13-30min depending on RTO. */
-static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly =   5 MINS;
+static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
+static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
 
 static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
@@ -625,8 +626,10 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 swin = win + (sack - ack);
                 if (sender->td_maxwin < swin)
                         sender->td_maxwin = swin;
-                if (after(end, sender->td_end))
+                if (after(end, sender->td_end)) {
                         sender->td_end = end;
+                        sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
+                }
                 /*
                  * Update receiver data.
                  */
@@ -637,6 +640,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         if (win == 0)
                                 receiver->td_maxend++;
                 }
+                if (ack == receiver->td_end)
+                        receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 
                 /*
                  * Check retransmissions.
@@ -951,9 +956,16 @@ static int tcp_packet(struct nf_conn *ct,
         if (old_state != new_state
             && new_state == TCP_CONNTRACK_FIN_WAIT)
                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
-        timeout = ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans
-                  && tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans
-                  ? nf_ct_tcp_timeout_max_retrans : tcp_timeouts[new_state];
+
+        if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
+            tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
+                timeout = nf_ct_tcp_timeout_max_retrans;
+        else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
+                 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
+                 tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
+                timeout = nf_ct_tcp_timeout_unacknowledged;
+        else
+                timeout = tcp_timeouts[new_state];
         write_unlock_bh(&tcp_lock);
 
         nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
@@ -1236,6 +1248,13 @@ static struct ctl_table tcp_sysctl_table[] = {
                 .proc_handler   = &proc_dointvec_jiffies,
         },
         {
+                .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
+                .data           = &nf_ct_tcp_timeout_unacknowledged,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_jiffies,
+        },
+        {
                 .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
                 .procname       = "nf_conntrack_tcp_loose",
                 .data           = &nf_ct_tcp_loose,
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 869ef9349d0f..8509db14670b 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -324,6 +324,7 @@ static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
 
 static struct ctl_table_header *nf_ct_sysctl_header;
+static struct ctl_table_header *nf_ct_netfilter_header;
 
 static ctl_table nf_ct_sysctl_table[] = {
         {
@@ -384,12 +385,6 @@ static ctl_table nf_ct_sysctl_table[] = {
 
 static ctl_table nf_ct_netfilter_table[] = {
         {
-                .ctl_name       = NET_NETFILTER,
-                .procname       = "netfilter",
-                .mode           = 0555,
-                .child          = nf_ct_sysctl_table,
-        },
-        {
                 .ctl_name       = NET_NF_CONNTRACK_MAX,
                 .procname       = "nf_conntrack_max",
                 .data           = &nf_conntrack_max,
@@ -409,18 +404,29 @@ EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
 
 static int nf_conntrack_standalone_init_sysctl(void)
 {
-        nf_ct_sysctl_header =
+        nf_ct_netfilter_header =
                 register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
-        if (nf_ct_sysctl_header == NULL) {
-                printk("nf_conntrack: can't register to sysctl.\n");
-                return -ENOMEM;
-        }
+        if (!nf_ct_netfilter_header)
+                goto out;
+
+        nf_ct_sysctl_header =
+                 register_sysctl_paths(nf_net_netfilter_sysctl_path,
+                                        nf_ct_sysctl_table);
+        if (!nf_ct_sysctl_header)
+                goto out_unregister_netfilter;
+
         return 0;
 
+out_unregister_netfilter:
+        unregister_sysctl_table(nf_ct_netfilter_header);
+out:
+        printk("nf_conntrack: can't register to sysctl.\n");
+        return -ENOMEM;
 }
 
 static void nf_conntrack_standalone_fini_sysctl(void)
 {
+        unregister_sysctl_table(nf_ct_netfilter_header);
         unregister_sysctl_table(nf_ct_sysctl_header);
 }
 #else
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 6809af542a2c..d9418a267812 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -367,9 +367,7 @@ static void htable_gc(unsigned long htlong)
 
 static void htable_destroy(struct xt_hashlimit_htable *hinfo)
 {
-        /* remove timer, if it is pending */
-        if (timer_pending(&hinfo->timer))
-                del_timer(&hinfo->timer);
+        del_timer_sync(&hinfo->timer);
 
         /* remove proc entry */
         remove_proc_entry(hinfo->pde->name,
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 98bfe277eab2..b0eacc0007cc 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -158,9 +158,10 @@ static void netlink_sock_destruct(struct sock *sk)
                 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
                 return;
         }
-        BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
-        BUG_TRAP(!nlk_sk(sk)->groups);
+
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(nlk_sk(sk)->groups);
 }
 
 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index fccc250f95f5..532e4faa29f7 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -73,6 +73,7 @@ static const struct proto_ops nr_proto_ops;
  * separate class since they always nest.
  */
 static struct lock_class_key nr_netdev_xmit_lock_key;
+static struct lock_class_key nr_netdev_addr_lock_key;
 
 static void nr_set_lockdep_one(struct net_device *dev,
                                struct netdev_queue *txq,
@@ -83,6 +84,7 @@ static void nr_set_lockdep_one(struct net_device *dev,
 
 static void nr_set_lockdep_key(struct net_device *dev)
 {
+        lockdep_set_class(&dev->addr_list_lock, &nr_netdev_addr_lock_key);
         netdev_for_each_tx_queue(dev, nr_set_lockdep_one, NULL);
 }
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d56cae112dc8..c718e7e3f7de 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -260,8 +260,8 @@ static inline struct packet_sock *pkt_sk(struct sock *sk)
 
 static void packet_sock_destruct(struct sock *sk)
 {
-        BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
 
         if (!sock_flag(sk, SOCK_DEAD)) {
                 printk("Attempt to release alive packet socket: %p\n", sk);
diff --git a/net/rfkill/rfkill-input.c b/net/rfkill/rfkill-input.c
index 8aa822730145..e5b69556bb5b 100644
--- a/net/rfkill/rfkill-input.c
+++ b/net/rfkill/rfkill-input.c
@@ -109,6 +109,25 @@ static DEFINE_RFKILL_TASK(rfkill_uwb, RFKILL_TYPE_UWB);
 static DEFINE_RFKILL_TASK(rfkill_wimax, RFKILL_TYPE_WIMAX);
 static DEFINE_RFKILL_TASK(rfkill_wwan, RFKILL_TYPE_WWAN);
 
+static void rfkill_schedule_evsw_rfkillall(int state)
+{
+        /* EVERY radio type. state != 0 means radios ON */
+        /* handle EPO (emergency power off) through shortcut */
+        if (state) {
+                rfkill_schedule_set(&rfkill_wwan,
+                                    RFKILL_STATE_UNBLOCKED);
+                rfkill_schedule_set(&rfkill_wimax,
+                                    RFKILL_STATE_UNBLOCKED);
+                rfkill_schedule_set(&rfkill_uwb,
+                                    RFKILL_STATE_UNBLOCKED);
+                rfkill_schedule_set(&rfkill_bt,
+                                    RFKILL_STATE_UNBLOCKED);
+                rfkill_schedule_set(&rfkill_wlan,
+                                    RFKILL_STATE_UNBLOCKED);
+        } else
+                rfkill_schedule_epo();
+}
+
 static void rfkill_event(struct input_handle *handle, unsigned int type,
                         unsigned int code, int data)
 {
@@ -132,21 +151,7 @@ static void rfkill_event(struct input_handle *handle, unsigned int type,
         } else if (type == EV_SW) {
                 switch (code) {
                 case SW_RFKILL_ALL:
-                        /* EVERY radio type. data != 0 means radios ON */
-                        /* handle EPO (emergency power off) through shortcut */
-                        if (data) {
-                                rfkill_schedule_set(&rfkill_wwan,
-                                                    RFKILL_STATE_UNBLOCKED);
-                                rfkill_schedule_set(&rfkill_wimax,
-                                                    RFKILL_STATE_UNBLOCKED);
-                                rfkill_schedule_set(&rfkill_uwb,
-                                                    RFKILL_STATE_UNBLOCKED);
-                                rfkill_schedule_set(&rfkill_bt,
-                                                    RFKILL_STATE_UNBLOCKED);
-                                rfkill_schedule_set(&rfkill_wlan,
-                                                    RFKILL_STATE_UNBLOCKED);
-                        } else
-                                rfkill_schedule_epo();
+                        rfkill_schedule_evsw_rfkillall(data);
                         break;
                 default:
                         break;
@@ -168,6 +173,7 @@ static int rfkill_connect(struct input_handler *handler, struct input_dev *dev,
         handle->handler = handler;
         handle->name = "rfkill";
 
+        /* causes rfkill_start() to be called */
         error = input_register_handle(handle);
         if (error)
                 goto err_free_handle;
@@ -185,6 +191,23 @@ static int rfkill_connect(struct input_handler *handler, struct input_dev *dev,
         return error;
 }
 
+static void rfkill_start(struct input_handle *handle)
+{
+        /* Take event_lock to guard against configuration changes, we
+         * should be able to deal with concurrency with rfkill_event()
+         * just fine (which event_lock will also avoid). */
+        spin_lock_irq(&handle->dev->event_lock);
+
+        if (test_bit(EV_SW, handle->dev->evbit)) {
+                if (test_bit(SW_RFKILL_ALL, handle->dev->swbit))
+                        rfkill_schedule_evsw_rfkillall(test_bit(SW_RFKILL_ALL,
+                                                        handle->dev->sw));
+                /* add resync for further EV_SW events here */
+        }
+
+        spin_unlock_irq(&handle->dev->event_lock);
+}
+
 static void rfkill_disconnect(struct input_handle *handle)
 {
         input_close_device(handle);
@@ -225,6 +248,7 @@ static struct input_handler rfkill_handler = {
         .event =        rfkill_event,
         .connect =      rfkill_connect,
         .disconnect =   rfkill_disconnect,
+        .start =        rfkill_start,
         .name =         "rfkill",
         .id_table =     rfkill_ids,
 };
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 7a560b785097..d2d45655cd1a 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -105,6 +105,16 @@ static void rfkill_led_trigger(struct rfkill *rfkill,
 #endif /* CONFIG_RFKILL_LEDS */
 }
 
+#ifdef CONFIG_RFKILL_LEDS
+static void rfkill_led_trigger_activate(struct led_classdev *led)
+{
+        struct rfkill *rfkill = container_of(led->trigger,
+                        struct rfkill, led_trigger);
+
+        rfkill_led_trigger(rfkill, rfkill->state);
+}
+#endif /* CONFIG_RFKILL_LEDS */
+
 static void notify_rfkill_state_change(struct rfkill *rfkill)
 {
         blocking_notifier_call_chain(&rfkill_notifier_list,
@@ -130,7 +140,6 @@ static void update_rfkill_state(struct rfkill *rfkill)
 
 /**
  * rfkill_toggle_radio - wrapper for toggle_radio hook
- *
  * @rfkill: the rfkill struct to use
  * @force: calls toggle_radio even if cache says it is not needed,
  *      and also makes sure notifications of the state will be
@@ -141,8 +150,8 @@ static void update_rfkill_state(struct rfkill *rfkill)
  * calls and handling all the red tape such as issuing notifications
  * if the call is successful.
  *
- * Note that @force cannot override a (possibly cached) state of
- * RFKILL_STATE_HARD_BLOCKED.  Any device making use of
+ * Note that the @force parameter cannot override a (possibly cached)
+ * state of RFKILL_STATE_HARD_BLOCKED.  Any device making use of
  * RFKILL_STATE_HARD_BLOCKED implements either get_state() or
  * rfkill_force_state(), so the cache either is bypassed or valid.
  *
@@ -150,7 +159,7 @@ static void update_rfkill_state(struct rfkill *rfkill)
  * even if the radio is in RFKILL_STATE_HARD_BLOCKED state, so as to
  * give the driver a hint that it should double-BLOCK the transmitter.
  *
- * Caller must have aquired rfkill_mutex.
+ * Caller must have acquired rfkill->mutex.
  */
 static int rfkill_toggle_radio(struct rfkill *rfkill,
                                 enum rfkill_state state,
@@ -200,12 +209,12 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
 
 /**
  * rfkill_switch_all - Toggle state of all switches of given type
- * @type: type of interfaces to be affeceted
+ * @type: type of interfaces to be affected
  * @state: the new state
  *
- * This function toggles state of all switches of given type unless
- * a specific switch is claimed by userspace in which case it is
- * left alone.
+ * This function toggles the state of all switches of given type,
+ * unless a specific switch is claimed by userspace (in which case,
+ * that switch is left alone).
  */
 void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
 {
@@ -216,8 +225,11 @@ void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
         rfkill_states[type] = state;
 
         list_for_each_entry(rfkill, &rfkill_list, node) {
-                if ((!rfkill->user_claim) && (rfkill->type == type))
+                if ((!rfkill->user_claim) && (rfkill->type == type)) {
+                        mutex_lock(&rfkill->mutex);
                         rfkill_toggle_radio(rfkill, state, 0);
+                        mutex_unlock(&rfkill->mutex);
+                }
         }
 
         mutex_unlock(&rfkill_mutex);
@@ -228,7 +240,7 @@ EXPORT_SYMBOL(rfkill_switch_all);
  * rfkill_epo - emergency power off all transmitters
  *
  * This kicks all rfkill devices to RFKILL_STATE_SOFT_BLOCKED, ignoring
- * everything in its path but rfkill_mutex.
+ * everything in its path but rfkill_mutex and rfkill->mutex.
  */
 void rfkill_epo(void)
 {
@@ -236,7 +248,9 @@ void rfkill_epo(void)
 
         mutex_lock(&rfkill_mutex);
         list_for_each_entry(rfkill, &rfkill_list, node) {
+                mutex_lock(&rfkill->mutex);
                 rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
+                mutex_unlock(&rfkill->mutex);
         }
         mutex_unlock(&rfkill_mutex);
 }
@@ -252,7 +266,12 @@ EXPORT_SYMBOL_GPL(rfkill_epo);
  * a notification by the firmware/hardware of the current *real*
  * state of the radio rfkill switch.
  *
- * It may not be called from an atomic context.
+ * Devices which are subject to external changes on their rfkill
+ * state (such as those caused by a hardware rfkill line) MUST
+ * have their driver arrange to call rfkill_force_state() as soon
+ * as possible after such a change.
+ *
+ * This function may not be called from an atomic context.
  */
 int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state)
 {
@@ -367,6 +386,9 @@ static ssize_t rfkill_claim_store(struct device *dev,
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
+        if (rfkill->user_claim_unsupported)
+                return -EOPNOTSUPP;
+
         /*
          * Take the global lock to make sure the kernel is not in
          * the middle of rfkill_switch_all
@@ -375,19 +397,17 @@ static ssize_t rfkill_claim_store(struct device *dev,
         if (error)
                 return error;
 
-        if (rfkill->user_claim_unsupported) {
-                error = -EOPNOTSUPP;
-                goto out_unlock;
-        }
         if (rfkill->user_claim != claim) {
-                if (!claim)
+                if (!claim) {
+                        mutex_lock(&rfkill->mutex);
                         rfkill_toggle_radio(rfkill,
                                             rfkill_states[rfkill->type],
                                             0);
+                        mutex_unlock(&rfkill->mutex);
+                }
                 rfkill->user_claim = claim;
         }
 
-out_unlock:
         mutex_unlock(&rfkill_mutex);
 
         return error ? error : count;
@@ -516,8 +536,11 @@ static void rfkill_remove_switch(struct rfkill *rfkill)
 {
         mutex_lock(&rfkill_mutex);
         list_del_init(&rfkill->node);
-        rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
         mutex_unlock(&rfkill_mutex);
+
+        mutex_lock(&rfkill->mutex);
+        rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
+        mutex_unlock(&rfkill->mutex);
 }
 
 /**
@@ -526,9 +549,10 @@ static void rfkill_remove_switch(struct rfkill *rfkill)
  * @type: type of the switch (RFKILL_TYPE_*)
  *
  * This function should be called by the network driver when it needs
- * rfkill structure. Once the structure is allocated the driver shoud
- * finish its initialization by setting name, private data, enable_radio
+ * rfkill structure.  Once the structure is allocated the driver should
+ * finish its initialization by setting the name, private data, enable_radio
  * and disable_radio methods and then register it with rfkill_register().
+ *
  * NOTE: If registration fails the structure shoudl be freed by calling
  * rfkill_free() otherwise rfkill_unregister() should be used.
  */
@@ -560,7 +584,7 @@ EXPORT_SYMBOL(rfkill_allocate);
  * rfkill_free - Mark rfkill structure for deletion
  * @rfkill: rfkill structure to be destroyed
  *
- * Decrements reference count of rfkill structure so it is destroyed.
+ * Decrements reference count of the rfkill structure so it is destroyed.
  * Note that rfkill_free() should _not_ be called after rfkill_unregister().
  */
 void rfkill_free(struct rfkill *rfkill)
@@ -575,7 +599,10 @@ static void rfkill_led_trigger_register(struct rfkill *rfkill)
 #ifdef CONFIG_RFKILL_LEDS
         int error;
 
-        rfkill->led_trigger.name = rfkill->dev.bus_id;
+        if (!rfkill->led_trigger.name)
+                rfkill->led_trigger.name = rfkill->dev.bus_id;
+        if (!rfkill->led_trigger.activate)
+                rfkill->led_trigger.activate = rfkill_led_trigger_activate;
         error = led_trigger_register(&rfkill->led_trigger);
         if (error)
                 rfkill->led_trigger.name = NULL;
@@ -585,8 +612,10 @@ static void rfkill_led_trigger_register(struct rfkill *rfkill)
 static void rfkill_led_trigger_unregister(struct rfkill *rfkill)
 {
 #ifdef CONFIG_RFKILL_LEDS
-        if (rfkill->led_trigger.name)
+        if (rfkill->led_trigger.name) {
                 led_trigger_unregister(&rfkill->led_trigger);
+                rfkill->led_trigger.name = NULL;
+        }
 #endif
 }
 
@@ -622,8 +651,8 @@ int rfkill_register(struct rfkill *rfkill)
 
         error = device_add(dev);
         if (error) {
-                rfkill_led_trigger_unregister(rfkill);
                 rfkill_remove_switch(rfkill);
+                rfkill_led_trigger_unregister(rfkill);
                 return error;
         }
 
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index dbc963b4f5fb..a7f1ce11bc22 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -74,6 +74,7 @@ ax25_address rose_callsign;
  * separate class since they always nest.
  */
 static struct lock_class_key rose_netdev_xmit_lock_key;
+static struct lock_class_key rose_netdev_addr_lock_key;
 
 static void rose_set_lockdep_one(struct net_device *dev,
                                  struct netdev_queue *txq,
@@ -84,6 +85,7 @@ static void rose_set_lockdep_one(struct net_device *dev,
 
 static void rose_set_lockdep_key(struct net_device *dev)
 {
+        lockdep_set_class(&dev->addr_list_lock, &rose_netdev_addr_lock_key);
         netdev_for_each_tx_queue(dev, rose_set_lockdep_one, NULL);
 }
 
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 4b2682feeedc..32e489118beb 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -660,9 +660,9 @@ static void rxrpc_sock_destructor(struct sock *sk)
 
         rxrpc_purge_queue(&sk->sk_receive_queue);
 
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
-        BUG_TRAP(sk_unhashed(sk));
-        BUG_TRAP(!sk->sk_socket);
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(!sk_unhashed(sk));
+        WARN_ON(sk->sk_socket);
 
         if (!sock_flag(sk, SOCK_DEAD)) {
                 printk("Attempt to release alive rxrpc socket: %p\n", sk);
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 74e662cbb2c5..26c7e1f9a350 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -41,7 +41,7 @@ void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
                         return;
                 }
         }
-        BUG_TRAP(0);
+        WARN_ON(1);
 }
 EXPORT_SYMBOL(tcf_hash_destroy);
 
@@ -205,10 +205,9 @@ struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a, int bind,
 {
         struct tcf_common *p = NULL;
         if (index && (p = tcf_hash_lookup(index, hinfo)) != NULL) {
-                if (bind) {
+                if (bind)
                         p->tcfc_bindcnt++;
-                        p->tcfc_refcnt++;
-                }
+                p->tcfc_refcnt++;
                 a->priv = p;
         }
         return p;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 32c3f9d9fb7a..38015b493947 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -116,7 +116,7 @@ static void tcf_police_destroy(struct tcf_police *p)
                         return;
                 }
         }
-        BUG_TRAP(0);
+        WARN_ON(1);
 }
 
 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 527db2559dd2..246f9065ce34 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -345,7 +345,7 @@ static int u32_delete_key(struct tcf_proto *tp, struct tc_u_knode* key)
                         }
                 }
         }
-        BUG_TRAP(0);
+        WARN_ON(1);
         return 0;
 }
 
@@ -368,7 +368,7 @@ static int u32_destroy_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
         struct tc_u_common *tp_c = tp->data;
         struct tc_u_hnode **hn;
 
-        BUG_TRAP(!ht->refcnt);
+        WARN_ON(ht->refcnt);
 
         u32_clear_hnode(tp, ht);
 
@@ -380,7 +380,7 @@ static int u32_destroy_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
                 }
         }
 
-        BUG_TRAP(0);
+        WARN_ON(1);
         return -ENOENT;
 }
 
@@ -389,7 +389,7 @@ static void u32_destroy(struct tcf_proto *tp)
         struct tc_u_common *tp_c = tp->data;
         struct tc_u_hnode *root_ht = xchg(&tp->root, NULL);
 
-        BUG_TRAP(root_ht != NULL);
+        WARN_ON(root_ht == NULL);
 
         if (root_ht && --root_ht->refcnt == 0)
                 u32_destroy_hnode(tp, root_ht);
@@ -407,7 +407,7 @@ static void u32_destroy(struct tcf_proto *tp)
                 while ((ht = tp_c->hlist) != NULL) {
                         tp_c->hlist = ht->next;
 
-                        BUG_TRAP(ht->refcnt == 0);
+                        WARN_ON(ht->refcnt != 0);
 
                         kfree(ht);
                 }
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 5219d5f9d754..ba1d121f3127 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -189,7 +189,7 @@ struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
 
         for (i = 0; i < dev->num_tx_queues; i++) {
                 struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
-                struct Qdisc *q, *txq_root = txq->qdisc;
+                struct Qdisc *q, *txq_root = txq->qdisc_sleeping;
 
                 if (!(txq_root->flags & TCQ_F_BUILTIN) &&
                     txq_root->handle == handle)
@@ -447,7 +447,7 @@ void qdisc_watchdog_cancel(struct qdisc_watchdog *wd)
 }
 EXPORT_SYMBOL(qdisc_watchdog_cancel);
 
-struct hlist_head *qdisc_class_hash_alloc(unsigned int n)
+static struct hlist_head *qdisc_class_hash_alloc(unsigned int n)
 {
         unsigned int size = n * sizeof(struct hlist_head), i;
         struct hlist_head *h;
@@ -572,44 +572,21 @@ static u32 qdisc_alloc_handle(struct net_device *dev)
 static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
                                      struct Qdisc *qdisc)
 {
+        struct Qdisc *oqdisc = dev_queue->qdisc_sleeping;
         spinlock_t *root_lock;
-        struct Qdisc *oqdisc;
-        int ingress;
-
-        ingress = 0;
-        if (qdisc && qdisc->flags&TCQ_F_INGRESS)
-                ingress = 1;
-
-        if (ingress) {
-                oqdisc = dev_queue->qdisc;
-        } else {
-                oqdisc = dev_queue->qdisc_sleeping;
-        }
 
         root_lock = qdisc_root_lock(oqdisc);
         spin_lock_bh(root_lock);
 
-        if (ingress) {
-                /* Prune old scheduler */
-                if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1) {
-                        /* delete */
-                        qdisc_reset(oqdisc);
-                        dev_queue->qdisc = NULL;
-                } else {  /* new */
-                        dev_queue->qdisc = qdisc;
-                }
+        /* Prune old scheduler */
+        if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1)
+                qdisc_reset(oqdisc);
 
-        } else {
-                /* Prune old scheduler */
-                if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1)
-                        qdisc_reset(oqdisc);
-
-                /* ... and graft new one */
-                if (qdisc == NULL)
-                        qdisc = &noop_qdisc;
-                dev_queue->qdisc_sleeping = qdisc;
-                dev_queue->qdisc = &noop_qdisc;
-        }
+        /* ... and graft new one */
+        if (qdisc == NULL)
+                qdisc = &noop_qdisc;
+        dev_queue->qdisc_sleeping = qdisc;
+        dev_queue->qdisc = &noop_qdisc;
 
         spin_unlock_bh(root_lock);
 
@@ -678,7 +655,8 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
 
                 ingress = 0;
                 num_q = dev->num_tx_queues;
-                if (q && q->flags & TCQ_F_INGRESS) {
+                if ((q && q->flags & TCQ_F_INGRESS) ||
+                    (new && new->flags & TCQ_F_INGRESS)) {
                         num_q = 1;
                         ingress = 1;
                 }
@@ -692,13 +670,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
                         if (!ingress)
                                 dev_queue = netdev_get_tx_queue(dev, i);
 
-                        if (ingress) {
-                                old = dev_graft_qdisc(dev_queue, q);
-                        } else {
-                                old = dev_graft_qdisc(dev_queue, new);
-                                if (new && i > 0)
-                                        atomic_inc(&new->refcnt);
-                        }
+                        old = dev_graft_qdisc(dev_queue, new);
+                        if (new && i > 0)
+                                atomic_inc(&new->refcnt);
+
                         notify_and_destroy(skb, n, classid, old, new);
                 }
 
@@ -817,8 +792,8 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                                 goto err_out3;
                         }
                 }
-                if (parent)
-                        list_add_tail(&sch->list, &dev_queue->qdisc->list);
+                if ((parent != TC_H_ROOT) && !(sch->flags & TCQ_F_INGRESS))
+                        list_add_tail(&sch->list, &dev_queue->qdisc_sleeping->list);
 
                 return sch;
         }
@@ -1261,11 +1236,11 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
                 q_idx = 0;
 
                 dev_queue = netdev_get_tx_queue(dev, 0);
-                if (tc_dump_qdisc_root(dev_queue->qdisc, skb, cb, &q_idx, s_q_idx) < 0)
+                if (tc_dump_qdisc_root(dev_queue->qdisc_sleeping, skb, cb, &q_idx, s_q_idx) < 0)
                         goto done;
 
                 dev_queue = &dev->rx_queue;
-                if (tc_dump_qdisc_root(dev_queue->qdisc, skb, cb, &q_idx, s_q_idx) < 0)
+                if (tc_dump_qdisc_root(dev_queue->qdisc_sleeping, skb, cb, &q_idx, s_q_idx) < 0)
                         goto done;
 
 cont:
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 04faa835be17..43d37256c15e 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -162,7 +162,7 @@ static void atm_tc_put(struct Qdisc *sch, unsigned long cl)
         qdisc_destroy(flow->q);
         tcf_destroy_chain(&flow->filter_list);
         if (flow->sock) {
-                pr_debug("atm_tc_put: f_count %d\n",
+                pr_debug("atm_tc_put: f_count %ld\n",
                         file_count(flow->sock->file));
                 flow->vcc->pop = flow->old_pop;
                 sockfd_put(flow->sock);
@@ -259,7 +259,7 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
         sock = sockfd_lookup(fd, &error);
         if (!sock)
                 return error;   /* f_count++ */
-        pr_debug("atm_tc_change: f_count %d\n", file_count(sock->file));
+        pr_debug("atm_tc_change: f_count %ld\n", file_count(sock->file));
         if (sock->ops->family != PF_ATMSVC && sock->ops->family != PF_ATMPVC) {
                 error = -EPROTOTYPE;
                 goto err_out;
@@ -415,7 +415,7 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
                         kfree_skb(skb);
-                        return NET_XMIT_SUCCESS;
+                        return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         kfree_skb(skb);
                         goto drop;
@@ -432,9 +432,11 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         ret = qdisc_enqueue(skb, flow->q);
         if (ret != 0) {
 drop: __maybe_unused
-                sch->qstats.drops++;
-                if (flow)
-                        flow->qstats.drops++;
+                if (net_xmit_drop_count(ret)) {
+                        sch->qstats.drops++;
+                        if (flow)
+                                flow->qstats.drops++;
+                }
                 return ret;
         }
         sch->bstats.bytes += qdisc_pkt_len(skb);
@@ -455,7 +457,7 @@ drop: __maybe_unused
                 return 0;
         }
         tasklet_schedule(&p->task);
-        return NET_XMIT_BYPASS;
+        return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
 }
 
 /*
@@ -530,7 +532,7 @@ static int atm_tc_requeue(struct sk_buff *skb, struct Qdisc *sch)
         if (!ret) {
                 sch->q.qlen++;
                 sch->qstats.requeues++;
-        } else {
+        } else if (net_xmit_drop_count(ret)) {
                 sch->qstats.drops++;
                 p->link.qstats.drops++;
         }
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index f1d2f8ec8b4c..4e261ce62f48 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -230,7 +230,7 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
             (cl = cbq_class_lookup(q, prio)) != NULL)
                 return cl;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         for (;;) {
                 int result = 0;
                 defmap = head->defaults;
@@ -256,7 +256,7 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                 switch (result) {
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return NULL;
                 case TC_ACT_RECLASSIFY:
@@ -377,7 +377,7 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         q->rx_class = cl;
 #endif
         if (cl == NULL) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
@@ -397,9 +397,11 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return ret;
         }
 
-        sch->qstats.drops++;
-        cbq_mark_toplevel(q, cl);
-        cl->qstats.drops++;
+        if (net_xmit_drop_count(ret)) {
+                sch->qstats.drops++;
+                cbq_mark_toplevel(q, cl);
+                cl->qstats.drops++;
+        }
         return ret;
 }
 
@@ -430,8 +432,10 @@ cbq_requeue(struct sk_buff *skb, struct Qdisc *sch)
                         cbq_activate_class(cl);
                 return 0;
         }
-        sch->qstats.drops++;
-        cl->qstats.drops++;
+        if (net_xmit_drop_count(ret)) {
+                sch->qstats.drops++;
+                cl->qstats.drops++;
+        }
         return ret;
 }
 
@@ -664,13 +668,15 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
         q->rx_class = NULL;
 
         if (cl && (cl = cbq_reclassify(skb, cl)) != NULL) {
+                int ret;
 
                 cbq_mark_toplevel(q, cl);
 
                 q->rx_class = cl;
                 cl->q->__parent = sch;
 
-                if (qdisc_enqueue(skb, cl->q) == 0) {
+                ret = qdisc_enqueue(skb, cl->q);
+                if (ret == NET_XMIT_SUCCESS) {
                         sch->q.qlen++;
                         sch->bstats.packets++;
                         sch->bstats.bytes += qdisc_pkt_len(skb);
@@ -678,7 +684,8 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
                                 cbq_activate_class(cl);
                         return 0;
                 }
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(ret))
+                        sch->qstats.drops++;
                 return 0;
         }
 
@@ -1175,7 +1182,7 @@ static void cbq_unlink_class(struct cbq_class *this)
                                 this->tparent->children = NULL;
                 }
         } else {
-                BUG_TRAP(this->sibling == this);
+                WARN_ON(this->sibling != this);
         }
 }
 
@@ -1699,7 +1706,7 @@ static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
 
-        BUG_TRAP(!cl->filters);
+        WARN_ON(cl->filters);
 
         tcf_destroy_chain(&cl->filter_list);
         qdisc_destroy(cl->q);
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index a935676987e2..edd1298f85f6 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -236,7 +236,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
                         kfree_skb(skb);
-                        return NET_XMIT_SUCCESS;
+                        return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
 
                 case TC_ACT_SHOT:
                         goto drop;
@@ -254,7 +254,8 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         err = qdisc_enqueue(skb, p->q);
         if (err != NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(err))
+                        sch->qstats.drops++;
                 return err;
         }
 
@@ -267,7 +268,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 drop:
         kfree_skb(skb);
         sch->qstats.drops++;
-        return NET_XMIT_BYPASS;
+        return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
 }
 
 static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
@@ -321,7 +322,8 @@ static int dsmark_requeue(struct sk_buff *skb, struct Qdisc *sch)
 
         err = p->q->ops->requeue(skb, p->q);
         if (err != NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(err))
+                        sch->qstats.drops++;
                 return err;
         }
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index cb625b4d6da5..7cf83b37459d 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -29,7 +29,7 @@
 /* Main transmission queue. */
 
 /* Modifications to data participating in scheduling must be protected with
- * qdisc_root_lock(qdisc) spinlock.
+ * qdisc_lock(qdisc) spinlock.
  *
  * The idea is the following:
  * - enqueue, dequeue are serialized via qdisc root lock
@@ -126,7 +126,7 @@ static inline int qdisc_restart(struct Qdisc *q)
         if (unlikely((skb = dequeue_skb(q)) == NULL))
                 return 0;
 
-        root_lock = qdisc_root_lock(q);
+        root_lock = qdisc_lock(q);
 
         /* And release qdisc */
         spin_unlock(root_lock);
@@ -135,7 +135,8 @@ static inline int qdisc_restart(struct Qdisc *q)
         txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
 
         HARD_TX_LOCK(dev, txq, smp_processor_id());
-        if (!netif_subqueue_stopped(dev, skb))
+        if (!netif_tx_queue_stopped(txq) &&
+            !netif_tx_queue_frozen(txq))
                 ret = dev_hard_start_xmit(skb, dev, txq);
         HARD_TX_UNLOCK(dev, txq);
 
@@ -162,7 +163,8 @@ static inline int qdisc_restart(struct Qdisc *q)
                 break;
         }
 
-        if (ret && netif_tx_queue_stopped(txq))
+        if (ret && (netif_tx_queue_stopped(txq) ||
+                    netif_tx_queue_frozen(txq)))
                 ret = 0;
 
         return ret;
@@ -212,9 +214,9 @@ static void dev_watchdog(unsigned long arg)
                         if (some_queue_stopped &&
                             time_after(jiffies, (dev->trans_start +
                                                  dev->watchdog_timeo))) {
-                                printk(KERN_INFO "NETDEV WATCHDOG: %s: "
-                                       "transmit timed out\n",
-                                       dev->name);
+                                char drivername[64];
+                                printk(KERN_INFO "NETDEV WATCHDOG: %s (%s): transmit timed out\n",
+                                       dev->name, netdev_drivername(dev, drivername, 64));
                                 dev->tx_timeout(dev);
                                 WARN_ON_ONCE(1);
                         }
@@ -505,7 +507,7 @@ errout:
 }
 EXPORT_SYMBOL(qdisc_create_dflt);
 
-/* Under qdisc_root_lock(qdisc) and BH! */
+/* Under qdisc_lock(qdisc) and BH! */
 
 void qdisc_reset(struct Qdisc *qdisc)
 {
@@ -541,7 +543,7 @@ static void __qdisc_destroy(struct rcu_head *head)
         kfree((char *) qdisc - qdisc->padded);
 }
 
-/* Under qdisc_root_lock(qdisc) and BH! */
+/* Under qdisc_lock(qdisc) and BH! */
 
 void qdisc_destroy(struct Qdisc *qdisc)
 {
@@ -596,7 +598,7 @@ static void transition_one_qdisc(struct net_device *dev,
         int *need_watchdog_p = _need_watchdog;
 
         rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
-        if (new_qdisc != &noqueue_qdisc)
+        if (need_watchdog_p && new_qdisc != &noqueue_qdisc)
                 *need_watchdog_p = 1;
 }
 
@@ -619,6 +621,7 @@ void dev_activate(struct net_device *dev)
 
         need_watchdog = 0;
         netdev_for_each_tx_queue(dev, transition_one_qdisc, &need_watchdog);
+        transition_one_qdisc(dev, &dev->rx_queue, NULL);
 
         if (need_watchdog) {
                 dev->trans_start = jiffies;
@@ -656,7 +659,7 @@ static bool some_qdisc_is_running(struct net_device *dev, int lock)
 
                 dev_queue = netdev_get_tx_queue(dev, i);
                 q = dev_queue->qdisc;
-                root_lock = qdisc_root_lock(q);
+                root_lock = qdisc_lock(q);
 
                 if (lock)
                         spin_lock_bh(root_lock);
@@ -677,6 +680,7 @@ void dev_deactivate(struct net_device *dev)
         bool running;
 
         netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc);
+        dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc);
 
         dev_watchdog_down(dev);
 
@@ -718,7 +722,7 @@ static void dev_init_scheduler_queue(struct net_device *dev,
 void dev_init_scheduler(struct net_device *dev)
 {
         netdev_for_each_tx_queue(dev, dev_init_scheduler_queue, &noop_qdisc);
-        dev_init_scheduler_queue(dev, &dev->rx_queue, NULL);
+        dev_init_scheduler_queue(dev, &dev->rx_queue, &noop_qdisc);
 
         setup_timer(&dev->watchdog_timer, dev_watchdog, (unsigned long)dev);
 }
@@ -731,20 +735,20 @@ static void shutdown_scheduler_queue(struct net_device *dev,
         struct Qdisc *qdisc_default = _qdisc_default;
 
         if (qdisc) {
-                spinlock_t *root_lock = qdisc_root_lock(qdisc);
+                spinlock_t *root_lock = qdisc_lock(qdisc);
 
                 dev_queue->qdisc = qdisc_default;
                 dev_queue->qdisc_sleeping = qdisc_default;
 
-                spin_lock(root_lock);
+                spin_lock_bh(root_lock);
                 qdisc_destroy(qdisc);
-                spin_unlock(root_lock);
+                spin_unlock_bh(root_lock);
         }
 }
 
 void dev_shutdown(struct net_device *dev)
 {
         netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc);
-        shutdown_scheduler_queue(dev, &dev->rx_queue, NULL);
-        BUG_TRAP(!timer_pending(&dev->watchdog_timer));
+        shutdown_scheduler_queue(dev, &dev->rx_queue, &noop_qdisc);
+        WARN_ON(timer_pending(&dev->watchdog_timer));
 }
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 0ae7d19dcba8..c2b8d9cce3d2 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1159,14 +1159,14 @@ hfsc_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                 if (cl->level == 0)
                         return cl;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         tcf = q->root.filter_list;
         while (tcf && (result = tc_classify(skb, tcf, &res)) >= 0) {
 #ifdef CONFIG_NET_CLS_ACT
                 switch (result) {
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -1578,7 +1578,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         cl = hfsc_classify(skb, sch, &err);
         if (cl == NULL) {
-                if (err == NET_XMIT_BYPASS)
+                if (err & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return err;
@@ -1586,8 +1586,10 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         err = qdisc_enqueue(skb, cl->qdisc);
         if (unlikely(err != NET_XMIT_SUCCESS)) {
-                cl->qstats.drops++;
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(err)) {
+                        cl->qstats.drops++;
+                        sch->qstats.drops++;
+                }
                 return err;
         }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 30c999c61b01..be35422711a3 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -214,14 +214,14 @@ static struct htb_class *htb_classify(struct sk_buff *skb, struct Qdisc *sch,
         if ((cl = htb_find(skb->priority, sch)) != NULL && cl->level == 0)
                 return cl;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         tcf = q->filter_list;
         while (tcf && (result = tc_classify(skb, tcf, &res)) >= 0) {
 #ifdef CONFIG_NET_CLS_ACT
                 switch (result) {
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -524,7 +524,7 @@ htb_change_class_mode(struct htb_sched *q, struct htb_class *cl, long *diff)
  */
 static inline void htb_activate(struct htb_sched *q, struct htb_class *cl)
 {
-        BUG_TRAP(!cl->level && cl->un.leaf.q && cl->un.leaf.q->q.qlen);
+        WARN_ON(cl->level || !cl->un.leaf.q || !cl->un.leaf.q->q.qlen);
 
         if (!cl->prio_activity) {
                 cl->prio_activity = 1 << (cl->un.leaf.aprio = cl->un.leaf.prio);
@@ -542,7 +542,7 @@ static inline void htb_activate(struct htb_sched *q, struct htb_class *cl)
  */
 static inline void htb_deactivate(struct htb_sched *q, struct htb_class *cl)
 {
-        BUG_TRAP(cl->prio_activity);
+        WARN_ON(!cl->prio_activity);
 
         htb_deactivate_prios(q, cl);
         cl->prio_activity = 0;
@@ -567,14 +567,16 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 }
 #ifdef CONFIG_NET_CLS_ACT
         } else if (!cl) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
 #endif
-        } else if (qdisc_enqueue(skb, cl->un.leaf.q) != NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
-                cl->qstats.drops++;
+        } else if ((ret = qdisc_enqueue(skb, cl->un.leaf.q)) != NET_XMIT_SUCCESS) {
+                if (net_xmit_drop_count(ret)) {
+                        sch->qstats.drops++;
+                        cl->qstats.drops++;
+                }
                 return NET_XMIT_DROP;
         } else {
                 cl->bstats.packets +=
@@ -610,15 +612,17 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
                 }
 #ifdef CONFIG_NET_CLS_ACT
         } else if (!cl) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
 #endif
-        } else if (cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q) !=
+        } else if ((ret = cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q)) !=
                    NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
-                cl->qstats.drops++;
+                if (net_xmit_drop_count(ret)) {
+                        sch->qstats.drops++;
+                        cl->qstats.drops++;
+                }
                 return NET_XMIT_DROP;
         } else
                 htb_activate(q, cl);
@@ -757,7 +761,7 @@ static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
                 u32 *pid;
         } stk[TC_HTB_MAXDEPTH], *sp = stk;
 
-        BUG_TRAP(tree->rb_node);
+        WARN_ON(!tree->rb_node);
         sp->root = tree->rb_node;
         sp->pptr = pptr;
         sp->pid = pid;
@@ -777,7 +781,7 @@ static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
                                 *sp->pptr = (*sp->pptr)->rb_left;
                         if (sp > stk) {
                                 sp--;
-                                BUG_TRAP(*sp->pptr);
+                                WARN_ON(!*sp->pptr);
                                 if (!*sp->pptr)
                                         return NULL;
                                 htb_next_rb_node(sp->pptr);
@@ -792,7 +796,7 @@ static struct htb_class *htb_lookup_leaf(struct rb_root *tree, int prio,
                         sp->pid = cl->un.inner.last_ptr_id + prio;
                 }
         }
-        BUG_TRAP(0);
+        WARN_ON(1);
         return NULL;
 }
 
@@ -810,7 +814,7 @@ static struct sk_buff *htb_dequeue_tree(struct htb_sched *q, int prio,
 
         do {
 next:
-                BUG_TRAP(cl);
+                WARN_ON(!cl);
                 if (!cl)
                         return NULL;
 
@@ -1185,7 +1189,7 @@ static void htb_parent_to_leaf(struct htb_sched *q, struct htb_class *cl,
 {
         struct htb_class *parent = cl->parent;
 
-        BUG_TRAP(!cl->level && cl->un.leaf.q && !cl->prio_activity);
+        WARN_ON(cl->level || !cl->un.leaf.q || cl->prio_activity);
 
         if (parent->cmode != HTB_CAN_SEND)
                 htb_safe_rb_erase(&parent->pq_node, q->wait_pq + parent->level);
@@ -1205,7 +1209,7 @@ static void htb_parent_to_leaf(struct htb_sched *q, struct htb_class *cl,
 static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
 {
         if (!cl->level) {
-                BUG_TRAP(cl->un.leaf.q);
+                WARN_ON(!cl->un.leaf.q);
                 qdisc_destroy(cl->un.leaf.q);
         }
         gen_kill_estimator(&cl->bstats, &cl->rate_est);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a59085700678..fb0294d0b55e 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -176,7 +176,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (count == 0) {
                 sch->qstats.drops++;
                 kfree_skb(skb);
-                return NET_XMIT_BYPASS;
+                return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         }
 
         skb_orphan(skb);
@@ -240,8 +240,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 sch->q.qlen++;
                 sch->bstats.bytes += qdisc_pkt_len(skb);
                 sch->bstats.packets++;
-        } else
+        } else if (net_xmit_drop_count(ret)) {
                 sch->qstats.drops++;
+        }
 
         pr_debug("netem: enqueue ret %d\n", ret);
         return ret;
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index f849243eb095..eac197610edf 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -38,14 +38,14 @@ prio_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
         struct tcf_result res;
         int err;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         if (TC_H_MAJ(skb->priority) != sch->handle) {
                 err = tc_classify(skb, q->filter_list, &res);
 #ifdef CONFIG_NET_CLS_ACT
                 switch (err) {
                 case TC_ACT_STOLEN:
                 case TC_ACT_QUEUED:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -74,7 +74,7 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 #ifdef CONFIG_NET_CLS_ACT
         if (qdisc == NULL) {
 
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
@@ -88,7 +88,8 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
-        sch->qstats.drops++;
+        if (net_xmit_drop_count(ret))
+                sch->qstats.drops++;
         return ret;
 }
 
@@ -102,7 +103,7 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
         qdisc = prio_classify(skb, sch, &ret);
 #ifdef CONFIG_NET_CLS_ACT
         if (qdisc == NULL) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
@@ -114,7 +115,8 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
                 sch->qstats.requeues++;
                 return 0;
         }
-        sch->qstats.drops++;
+        if (net_xmit_drop_count(ret))
+                sch->qstats.drops++;
         return NET_XMIT_DROP;
 }
 
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 3f2d1d7f3bbd..5da05839e225 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -97,7 +97,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                 sch->bstats.bytes += qdisc_pkt_len(skb);
                 sch->bstats.packets++;
                 sch->q.qlen++;
-        } else {
+        } else if (net_xmit_drop_count(ret)) {
                 q->stats.pdrop++;
                 sch->qstats.drops++;
         }
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 8589da666568..6e041d10dbdb 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -171,14 +171,14 @@ static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
         if (!q->filter_list)
                 return sfq_hash(q, skb) + 1;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         result = tc_classify(skb, q->filter_list, &res);
         if (result >= 0) {
 #ifdef CONFIG_NET_CLS_ACT
                 switch (result) {
                 case TC_ACT_STOLEN:
                 case TC_ACT_QUEUED:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return 0;
                 }
@@ -285,7 +285,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         hash = sfq_classify(skb, sch, &ret);
         if (hash == 0) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
@@ -339,7 +339,7 @@ sfq_requeue(struct sk_buff *skb, struct Qdisc *sch)
 
         hash = sfq_classify(skb, sch, &ret);
         if (hash == 0) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index b296672f7632..7d3b7ff3bf07 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -135,7 +135,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
         ret = qdisc_enqueue(skb, q->qdisc);
         if (ret != 0) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(ret))
+                        sch->qstats.drops++;
                 return ret;
         }
 
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 537223642b6e..2c35c678563b 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -305,10 +305,11 @@ restart:
 
                 switch (teql_resolve(skb, skb_res, slave)) {
                 case 0:
-                        if (netif_tx_trylock(slave)) {
-                                if (!__netif_subqueue_stopped(slave, subq) &&
+                        if (__netif_tx_trylock(slave_txq)) {
+                                if (!netif_tx_queue_stopped(slave_txq) &&
+                                    !netif_tx_queue_frozen(slave_txq) &&
                                     slave->hard_start_xmit(skb, slave) == 0) {
-                                        netif_tx_unlock(slave);
+                                        __netif_tx_unlock(slave_txq);
                                         master->slaves = NEXT_SLAVE(q);
                                         netif_wake_queue(dev);
                                         master->stats.tx_packets++;
@@ -316,7 +317,7 @@ restart:
                                                 qdisc_pkt_len(skb);
                                         return 0;
                                 }
-                                netif_tx_unlock(slave);
+                                __netif_tx_unlock(slave_txq);
                         }
                         if (netif_queue_stopped(dev))
                                 busy = 1;
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index ec2a0a33fd78..8472b8b349c4 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -464,7 +464,7 @@ static void sctp_association_destroy(struct sctp_association *asoc)
                 spin_unlock_bh(&sctp_assocs_id_lock);
         }
 
-        BUG_TRAP(!atomic_read(&asoc->rmem_alloc));
+        WARN_ON(atomic_read(&asoc->rmem_alloc));
 
         if (asoc->base.malloced) {
                 kfree(asoc);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index a238d6834b33..483a01d0740a 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -195,8 +195,7 @@ out:
 }
 
 /* Based on tcp_v6_xmit() in tcp_ipv6.c. */
-static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport,
-                        int ipfragok)
+static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
 {
         struct sock *sk = skb->sk;
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -231,7 +230,10 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport,
 
         SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
 
-        return ip6_xmit(sk, skb, &fl, np->opt, ipfragok);
+        if (!(transport->param_flags & SPP_PMTUD_ENABLE))
+                skb->local_df = 1;
+
+        return ip6_xmit(sk, skb, &fl, np->opt, 0);
 }
 
 /* Returns the dst cache entry for the given source and destination ip
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 45684646b1db..0dc4a7dfb234 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -586,10 +586,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         SCTP_DEBUG_PRINTK("***sctp_transmit_packet*** skb len %d\n",
                           nskb->len);
 
-        if (tp->param_flags & SPP_PMTUD_ENABLE)
-                (*tp->af_specific->sctp_xmit)(nskb, tp, packet->ipfragok);
-        else
-                (*tp->af_specific->sctp_xmit)(nskb, tp, 1);
+        nskb->local_df = packet->ipfragok;
+        (*tp->af_specific->sctp_xmit)(nskb, tp);
 
 out:
         packet->size = packet->overhead;
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 70ead8dc3485..4328ad5439c9 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -71,6 +71,8 @@ static void sctp_mark_missing(struct sctp_outq *q,
 
 static void sctp_generate_fwdtsn(struct sctp_outq *q, __u32 sack_ctsn);
 
+static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout);
+
 /* Add data to the front of the queue. */
 static inline void sctp_outq_head_data(struct sctp_outq *q,
                                         struct sctp_chunk *ch)
@@ -712,7 +714,7 @@ int sctp_outq_uncork(struct sctp_outq *q)
  * locking concerns must be made.  Today we use the sock lock to protect
  * this function.
  */
-int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
+static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
 {
         struct sctp_packet *packet;
         struct sctp_packet singleton;
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 5dd89831eceb..f268910620be 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -519,8 +519,3 @@ int __init sctp_remaddr_proc_init(void)
 
         return 0;
 }
-
-void sctp_assoc_proc_exit(void)
-{
-        remove_proc_entry("remaddr", proc_net_sctp);
-}
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index a6e0818bcff5..0b65354aaf64 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -862,16 +862,21 @@ static int sctp_inet_supported_addrs(const struct sctp_sock *opt,
 
 /* Wrapper routine that calls the ip transmit routine. */
 static inline int sctp_v4_xmit(struct sk_buff *skb,
-                               struct sctp_transport *transport, int ipfragok)
+                               struct sctp_transport *transport)
 {
+        struct inet_sock *inet = inet_sk(skb->sk);
+
         SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, "
                           "src:%u.%u.%u.%u, dst:%u.%u.%u.%u\n",
                           __func__, skb, skb->len,
                           NIPQUAD(skb->rtable->rt_src),
                           NIPQUAD(skb->rtable->rt_dst));
 
+        inet->pmtudisc = transport->param_flags & SPP_PMTUD_ENABLE ?
+                         IP_PMTUDISC_DO : IP_PMTUDISC_DONT;
+
         SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
-        return ip_queue_xmit(skb, ipfragok);
+        return ip_queue_xmit(skb, 0);
 }
 
 static struct sctp_af sctp_af_inet;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 79bece16aede..dbb79adf8f3c 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3910,7 +3910,7 @@ static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval
                 goto out;
 
         /* Map the socket to an unused fd that can be returned to the user.  */
-        retval = sock_map_fd(newsock);
+        retval = sock_map_fd(newsock, 0);
         if (retval < 0) {
                 sock_release(newsock);
                 goto out;
diff --git a/net/socket.c b/net/socket.c
index 1ba57d888981..8ef8ba81b9e2 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -63,11 +63,13 @@
 #include <linux/file.h>
 #include <linux/net.h>
 #include <linux/interrupt.h>
+#include <linux/thread_info.h>
 #include <linux/rcupdate.h>
 #include <linux/netdevice.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/mutex.h>
+#include <linux/thread_info.h>
 #include <linux/wanrouter.h>
 #include <linux/if_bridge.h>
 #include <linux/if_frad.h>
@@ -263,7 +265,7 @@ static void sock_destroy_inode(struct inode *inode)
                         container_of(inode, struct socket_alloc, vfs_inode));
 }
 
-static void init_once(struct kmem_cache *cachep, void *foo)
+static void init_once(void *foo)
 {
         struct socket_alloc *ei = (struct socket_alloc *)foo;
 
@@ -349,11 +351,11 @@ static struct dentry_operations sockfs_dentry_operations = {
  *      but we take care of internal coherence yet.
  */
 
-static int sock_alloc_fd(struct file **filep)
+static int sock_alloc_fd(struct file **filep, int flags)
 {
         int fd;
 
-        fd = get_unused_fd();
+        fd = get_unused_fd_flags(flags);
         if (likely(fd >= 0)) {
                 struct file *file = get_empty_filp();
 
@@ -367,7 +369,7 @@ static int sock_alloc_fd(struct file **filep)
         return fd;
 }
 
-static int sock_attach_fd(struct socket *sock, struct file *file)
+static int sock_attach_fd(struct socket *sock, struct file *file, int flags)
 {
         struct dentry *dentry;
         struct qstr name = { .name = "" };
@@ -389,20 +391,20 @@ static int sock_attach_fd(struct socket *sock, struct file *file)
         init_file(file, sock_mnt, dentry, FMODE_READ | FMODE_WRITE,
                   &socket_file_ops);
         SOCK_INODE(sock)->i_fop = &socket_file_ops;
-        file->f_flags = O_RDWR;
+        file->f_flags = O_RDWR | (flags & O_NONBLOCK);
         file->f_pos = 0;
         file->private_data = sock;
 
         return 0;
 }
 
-int sock_map_fd(struct socket *sock)
+int sock_map_fd(struct socket *sock, int flags)
 {
         struct file *newfile;
-        int fd = sock_alloc_fd(&newfile);
+        int fd = sock_alloc_fd(&newfile, flags);
 
         if (likely(fd >= 0)) {
-                int err = sock_attach_fd(sock, newfile);
+                int err = sock_attach_fd(sock, newfile, flags);
 
                 if (unlikely(err < 0)) {
                         put_filp(newfile);
@@ -1218,12 +1220,27 @@ asmlinkage long sys_socket(int family, int type, int protocol)
 {
         int retval;
         struct socket *sock;
+        int flags;
+
+        /* Check the SOCK_* constants for consistency.  */
+        BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
+        BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
+        BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
+        BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
+
+        flags = type & ~SOCK_TYPE_MASK;
+        if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
+                return -EINVAL;
+        type &= SOCK_TYPE_MASK;
+
+        if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
+                flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
 
         retval = sock_create(family, type, protocol, &sock);
         if (retval < 0)
                 goto out;
 
-        retval = sock_map_fd(sock);
+        retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
         if (retval < 0)
                 goto out_release;
 
@@ -1246,6 +1263,15 @@ asmlinkage long sys_socketpair(int family, int type, int protocol,
         struct socket *sock1, *sock2;
         int fd1, fd2, err;
         struct file *newfile1, *newfile2;
+        int flags;
+
+        flags = type & ~SOCK_TYPE_MASK;
+        if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
+                return -EINVAL;
+        type &= SOCK_TYPE_MASK;
+
+        if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
+                flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
 
         /*
          * Obtain the first socket and check if the underlying protocol
@@ -1264,13 +1290,13 @@ asmlinkage long sys_socketpair(int family, int type, int protocol,
         if (err < 0)
                 goto out_release_both;
 
-        fd1 = sock_alloc_fd(&newfile1);
+        fd1 = sock_alloc_fd(&newfile1, flags & O_CLOEXEC);
         if (unlikely(fd1 < 0)) {
                 err = fd1;
                 goto out_release_both;
         }
 
-        fd2 = sock_alloc_fd(&newfile2);
+        fd2 = sock_alloc_fd(&newfile2, flags & O_CLOEXEC);
         if (unlikely(fd2 < 0)) {
                 err = fd2;
                 put_filp(newfile1);
@@ -1278,12 +1304,12 @@ asmlinkage long sys_socketpair(int family, int type, int protocol,
                 goto out_release_both;
         }
 
-        err = sock_attach_fd(sock1, newfile1);
+        err = sock_attach_fd(sock1, newfile1, flags & O_NONBLOCK);
         if (unlikely(err < 0)) {
                 goto out_fd2;
         }
 
-        err = sock_attach_fd(sock2, newfile2);
+        err = sock_attach_fd(sock2, newfile2, flags & O_NONBLOCK);
         if (unlikely(err < 0)) {
                 fput(newfile1);
                 goto out_fd1;
@@ -1401,14 +1427,20 @@ asmlinkage long sys_listen(int fd, int backlog)
  *      clean when we restucture accept also.
  */
 
-asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
-                           int __user *upeer_addrlen)
+long do_accept(int fd, struct sockaddr __user *upeer_sockaddr,
+               int __user *upeer_addrlen, int flags)
 {
         struct socket *sock, *newsock;
         struct file *newfile;
         int err, len, newfd, fput_needed;
         struct sockaddr_storage address;
 
+        if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
+                return -EINVAL;
+
+        if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
+                flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
+
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
@@ -1426,14 +1458,14 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
          */
         __module_get(newsock->ops->owner);
 
-        newfd = sock_alloc_fd(&newfile);
+        newfd = sock_alloc_fd(&newfile, flags & O_CLOEXEC);
         if (unlikely(newfd < 0)) {
                 err = newfd;
                 sock_release(newsock);
                 goto out_put;
         }
 
-        err = sock_attach_fd(newsock, newfile);
+        err = sock_attach_fd(newsock, newfile, flags & O_NONBLOCK);
         if (err < 0)
                 goto out_fd_simple;
 
@@ -1479,6 +1511,66 @@ out_fd:
         goto out_put;
 }
 
+#ifdef HAVE_SET_RESTORE_SIGMASK
+asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
+                            int __user *upeer_addrlen,
+                            const sigset_t __user *sigmask,
+                            size_t sigsetsize, int flags)
+{
+        sigset_t ksigmask, sigsaved;
+        int ret;
+
+        if (sigmask) {
+                /* XXX: Don't preclude handling different sized sigset_t's.  */
+                if (sigsetsize != sizeof(sigset_t))
+                        return -EINVAL;
+                if (copy_from_user(&ksigmask, sigmask, sizeof(ksigmask)))
+                        return -EFAULT;
+
+                sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
+                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
+        }
+
+        ret = do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
+
+        if (ret < 0 && signal_pending(current)) {
+                /*
+                 * Don't restore the signal mask yet. Let do_signal() deliver
+                 * the signal on the way back to userspace, before the signal
+                 * mask is restored.
+                 */
+                if (sigmask) {
+                        memcpy(&current->saved_sigmask, &sigsaved,
+                               sizeof(sigsaved));
+                        set_restore_sigmask();
+                }
+        } else if (sigmask)
+                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
+
+        return ret;
+}
+#else
+asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
+                            int __user *upeer_addrlen,
+                            const sigset_t __user *sigmask,
+                            size_t sigsetsize, int flags)
+{
+        /* The platform does not support restoring the signal mask in the
+         * return path.  So we do not allow using paccept() with a signal
+         * mask.  */
+        if (sigmask)
+                return -EINVAL;
+
+        return do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
+}
+#endif
+
+asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
+                           int __user *upeer_addrlen)
+{
+        return do_accept(fd, upeer_sockaddr, upeer_addrlen, 0);
+}
+
 /*
  *      Attempt to connect to a socket with the server address.  The address
  *      is in user space so we verify it is OK and move it to kernel space.
@@ -1999,10 +2091,11 @@ out:
 
 /* Argument list sizes for sys_socketcall */
 #define AL(x) ((x) * sizeof(unsigned long))
-static const unsigned char nargs[18]={
+static const unsigned char nargs[19]={
         AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
         AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
-        AL(6),AL(2),AL(5),AL(5),AL(3),AL(3)
+        AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
+        AL(6)
 };
 
 #undef AL
@@ -2021,7 +2114,7 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
         unsigned long a0, a1;
         int err;
 
-        if (call < 1 || call > SYS_RECVMSG)
+        if (call < 1 || call > SYS_PACCEPT)
                 return -EINVAL;
 
         /* copy_from_user should be SMP safe. */
@@ -2050,8 +2143,8 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
                 break;
         case SYS_ACCEPT:
                 err =
-                    sys_accept(a0, (struct sockaddr __user *)a1,
-                               (int __user *)a[2]);
+                    do_accept(a0, (struct sockaddr __user *)a1,
+                              (int __user *)a[2], 0);
                 break;
         case SYS_GETSOCKNAME:
                 err =
@@ -2098,6 +2191,13 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
         case SYS_RECVMSG:
                 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
                 break;
+        case SYS_PACCEPT:
+                err =
+                    sys_paccept(a0, (struct sockaddr __user *)a1,
+                                (int __user *)a[2],
+                                (const sigset_t __user *) a[3],
+                                a[4], a[5]);
+                break;
         default:
                 err = -EINVAL;
                 break;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 5a9b0e7828cd..23a2b8f6dc49 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -897,7 +897,7 @@ static struct file_system_type rpc_pipe_fs_type = {
 };
 
 static void
-init_once(struct kmem_cache * cachep, void *foo)
+init_once(void *foo)
 {
         struct rpc_inode *rpci = (struct rpc_inode *) foo;
 
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index a19b22b452a3..84d328329d98 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -169,7 +169,8 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
                                           (void *)
                                           vec->sge[xdr_sge_no].iov_base + sge_off,
                                           sge_bytes, DMA_TO_DEVICE);
-                if (dma_mapping_error(sge[sge_no].addr))
+                if (dma_mapping_error(xprt->sc_cm_id->device->dma_device,
+                                        sge[sge_no].addr))
                         goto err;
                 sge_off = 0;
                 sge_no++;
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 007c1a6708ee..972201cd5fa7 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -29,23 +29,35 @@
 #include <linux/if_tr.h>
 #endif
 
-static struct list_head *
+static struct ctl_table_set *
 net_ctl_header_lookup(struct ctl_table_root *root, struct nsproxy *namespaces)
 {
-        return &namespaces->net_ns->sysctl_table_headers;
+        return &namespaces->net_ns->sysctls;
 }
 
-static struct ctl_table_root net_sysctl_root = {
-        .lookup = net_ctl_header_lookup,
-};
+static int is_seen(struct ctl_table_set *set)
+{
+        return &current->nsproxy->net_ns->sysctls == set;
+}
 
-static LIST_HEAD(net_sysctl_ro_tables);
-static struct list_head *net_ctl_ro_header_lookup(struct ctl_table_root *root,
-                struct nsproxy *namespaces)
+/* Return standard mode bits for table entry. */
+static int net_ctl_permissions(struct ctl_table_root *root,
+                               struct nsproxy *nsproxy,
+                               struct ctl_table *table)
 {
-        return &net_sysctl_ro_tables;
+        /* Allow network administrator to have same access as root. */
+        if (capable(CAP_NET_ADMIN)) {
+                int mode = (table->mode >> 6) & 7;
+                return (mode << 6) | (mode << 3) | mode;
+        }
+        return table->mode;
 }
 
+static struct ctl_table_root net_sysctl_root = {
+        .lookup = net_ctl_header_lookup,
+        .permissions = net_ctl_permissions,
+};
+
 static int net_ctl_ro_header_perms(struct ctl_table_root *root,
                 struct nsproxy *namespaces, struct ctl_table *table)
 {
@@ -56,19 +68,20 @@ static int net_ctl_ro_header_perms(struct ctl_table_root *root,
 }
 
 static struct ctl_table_root net_sysctl_ro_root = {
-        .lookup = net_ctl_ro_header_lookup,
         .permissions = net_ctl_ro_header_perms,
 };
 
 static int sysctl_net_init(struct net *net)
 {
-        INIT_LIST_HEAD(&net->sysctl_table_headers);
+        setup_sysctl_set(&net->sysctls,
+                         &net_sysctl_ro_root.default_set,
+                         is_seen);
         return 0;
 }
 
 static void sysctl_net_exit(struct net *net)
 {
-        WARN_ON(!list_empty(&net->sysctl_table_headers));
+        WARN_ON(!list_empty(&net->sysctls.list));
         return;
 }
 
@@ -84,6 +97,7 @@ static __init int sysctl_init(void)
         if (ret)
                 goto out;
         register_sysctl_root(&net_sysctl_root);
+        setup_sysctl_set(&net_sysctl_ro_root.default_set, NULL, NULL);
         register_sysctl_root(&net_sysctl_ro_root);
 out:
         return ret;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 70ceb1604ad8..015606b54d9b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -227,7 +227,7 @@ static void __unix_remove_socket(struct sock *sk)
 
 static void __unix_insert_socket(struct hlist_head *list, struct sock *sk)
 {
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         sk_add_node(sk, list);
 }
 
@@ -350,9 +350,9 @@ static void unix_sock_destructor(struct sock *sk)
 
         skb_queue_purge(&sk->sk_receive_queue);
 
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
-        BUG_TRAP(sk_unhashed(sk));
-        BUG_TRAP(!sk->sk_socket);
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(!sk_unhashed(sk));
+        WARN_ON(sk->sk_socket);
         if (!sock_flag(sk, SOCK_DEAD)) {
                 printk("Attempt to release alive unix socket: %p\n", sk);
                 return;
@@ -603,7 +603,7 @@ static struct sock * unix_create1(struct net *net, struct socket *sock)
         u->dentry = NULL;
         u->mnt    = NULL;
         spin_lock_init(&u->lock);
-        atomic_set(&u->inflight, 0);
+        atomic_long_set(&u->inflight, 0);
         INIT_LIST_HEAD(&u->link);
         mutex_init(&u->readlock); /* single task reading lock */
         init_waitqueue_head(&u->peer_wait);
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index ebdff3d877a1..2a27b84f740b 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -127,7 +127,7 @@ void unix_inflight(struct file *fp)
         if(s) {
                 struct unix_sock *u = unix_sk(s);
                 spin_lock(&unix_gc_lock);
-                if (atomic_inc_return(&u->inflight) == 1) {
+                if (atomic_long_inc_return(&u->inflight) == 1) {
                         BUG_ON(!list_empty(&u->link));
                         list_add_tail(&u->link, &gc_inflight_list);
                 } else {
@@ -145,7 +145,7 @@ void unix_notinflight(struct file *fp)
                 struct unix_sock *u = unix_sk(s);
                 spin_lock(&unix_gc_lock);
                 BUG_ON(list_empty(&u->link));
-                if (atomic_dec_and_test(&u->inflight))
+                if (atomic_long_dec_and_test(&u->inflight))
                         list_del_init(&u->link);
                 unix_tot_inflight--;
                 spin_unlock(&unix_gc_lock);
@@ -237,17 +237,17 @@ static void scan_children(struct sock *x, void (*func)(struct unix_sock *),
 
 static void dec_inflight(struct unix_sock *usk)
 {
-        atomic_dec(&usk->inflight);
+        atomic_long_dec(&usk->inflight);
 }
 
 static void inc_inflight(struct unix_sock *usk)
 {
-        atomic_inc(&usk->inflight);
+        atomic_long_inc(&usk->inflight);
 }
 
 static void inc_inflight_move_tail(struct unix_sock *u)
 {
-        atomic_inc(&u->inflight);
+        atomic_long_inc(&u->inflight);
         /*
          * If this is still a candidate, move it to the end of the
          * list, so that it's checked even if it was already passed
@@ -288,11 +288,11 @@ void unix_gc(void)
          * before the detach without atomicity guarantees.
          */
         list_for_each_entry_safe(u, next, &gc_inflight_list, link) {
-                int total_refs;
-                int inflight_refs;
+                long total_refs;
+                long inflight_refs;
 
                 total_refs = file_count(u->sk.sk_socket->file);
-                inflight_refs = atomic_read(&u->inflight);
+                inflight_refs = atomic_long_read(&u->inflight);
 
                 BUG_ON(inflight_refs < 1);
                 BUG_ON(total_refs < inflight_refs);
@@ -324,7 +324,7 @@ void unix_gc(void)
                 /* Move cursor to after the current position. */
                 list_move(&cursor, &u->link);
 
-                if (atomic_read(&u->inflight) > 0) {
+                if (atomic_long_read(&u->inflight) > 0) {
                         list_move_tail(&u->link, &gc_inflight_list);
                         u->gc_candidate = 0;
                         scan_children(&u->sk, inc_inflight_move_tail, NULL);
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index b210a88d0960..7f07152bc109 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -57,7 +57,6 @@
 #include <linux/vmalloc.h>      /* vmalloc, vfree */
 #include <asm/uaccess.h>        /* copy_to/from_user */
 #include <linux/init.h>         /* __initfunc et al. */
-#include <net/syncppp.h>
 
 #define KMEM_SAFETYZONE 8
 
@@ -567,9 +566,6 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
 {
         wanif_conf_t *cnf;
         struct net_device *dev = NULL;
-#ifdef CONFIG_WANPIPE_MULTPPP
-        struct ppp_device *pppdev=NULL;
-#endif
         int err;
 
         if ((wandev->state == WAN_UNCONFIGURED) || (wandev->new_if == NULL))
@@ -588,25 +584,10 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                 goto out;
 
         if (cnf->config_id == WANCONFIG_MPPP) {
-#ifdef CONFIG_WANPIPE_MULTPPP
-                pppdev = kzalloc(sizeof(struct ppp_device), GFP_KERNEL);
-                err = -ENOBUFS;
-                if (pppdev == NULL)
-                        goto out;
-                pppdev->dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
-                if (pppdev->dev == NULL) {
-                        kfree(pppdev);
-                        err = -ENOBUFS;
-                        goto out;
-                }
-                err = wandev->new_if(wandev, (struct net_device *)pppdev, cnf);
-                dev = pppdev->dev;
-#else
                 printk(KERN_INFO "%s: Wanpipe Mulit-Port PPP support has not been compiled in!\n",
                                 wandev->name);
                 err = -EPROTONOSUPPORT;
                 goto out;
-#endif
         } else {
                 dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
                 err = -ENOBUFS;
@@ -661,17 +642,9 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
         kfree(dev->priv);
         dev->priv = NULL;
 
-#ifdef CONFIG_WANPIPE_MULTPPP
-        if (cnf->config_id == WANCONFIG_MPPP)
-                kfree(pppdev);
-        else
-                kfree(dev);
-#else
         /* Sync PPP is disabled */
         if (cnf->config_id != WANCONFIG_MPPP)
                 kfree(dev);
-#endif
-
 out:
         kfree(cnf);
         return err;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b7fefffd2d0d..59eb2cf42e5f 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -29,16 +29,16 @@ static struct genl_family nl80211_fam = {
 };
 
 /* internal helper: get drv and dev */
-static int get_drv_dev_by_info_ifindex(struct genl_info *info,
+static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
                                        struct cfg80211_registered_device **drv,
                                        struct net_device **dev)
 {
         int ifindex;
 
-        if (!info->attrs[NL80211_ATTR_IFINDEX])
+        if (!attrs[NL80211_ATTR_IFINDEX])
                 return -EINVAL;
 
-        ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
+        ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
         *dev = dev_get_by_index(&init_net, ifindex);
         if (!*dev)
                 return -ENODEV;
@@ -291,21 +291,31 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
 
         mutex_lock(&cfg80211_drv_mutex);
         list_for_each_entry(dev, &cfg80211_drv_list, list) {
-                if (++wp_idx < wp_start)
+                if (wp_idx < wp_start) {
+                        wp_idx++;
                         continue;
+                }
                 if_idx = 0;
 
                 mutex_lock(&dev->devlist_mtx);
                 list_for_each_entry(wdev, &dev->netdev_list, list) {
-                        if (++if_idx < if_start)
+                        if (if_idx < if_start) {
+                                if_idx++;
                                 continue;
+                        }
                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                               wdev->netdev) < 0)
-                                break;
+                                               wdev->netdev) < 0) {
+                                mutex_unlock(&dev->devlist_mtx);
+                                goto out;
+                        }
+                        if_idx++;
                 }
                 mutex_unlock(&dev->devlist_mtx);
+
+                wp_idx++;
         }
+ out:
         mutex_unlock(&cfg80211_drv_mutex);
 
         cb->args[0] = wp_idx;
@@ -321,7 +331,7 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
         struct net_device *netdev;
         int err;
 
-        err = get_drv_dev_by_info_ifindex(info, &dev, &netdev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
         if (err)
                 return err;
 
@@ -392,7 +402,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         } else
                 return -EINVAL;
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
         ifindex = dev->ifindex;
@@ -477,7 +487,7 @@ static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
         int ifindex, err;
         struct net_device *dev;
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
         ifindex = dev->ifindex;
@@ -545,7 +555,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_MAC])
                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -618,7 +628,7 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT])
                 return -EINVAL;
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -699,7 +709,7 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
         }
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -735,7 +745,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_MAC])
                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -764,7 +774,7 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
         struct beacon_parameters params;
         int haveinfo = 0;
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -843,7 +853,7 @@ static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
         int err;
         struct net_device *dev;
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -937,67 +947,78 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
 }
 
 static int nl80211_dump_station(struct sk_buff *skb,
-                struct netlink_callback *cb)
+                                struct netlink_callback *cb)
 {
-        int wp_idx = 0;
-        int if_idx = 0;
-        int sta_idx = cb->args[2];
-        int wp_start = cb->args[0];
-        int if_start = cb->args[1];
         struct station_info sinfo;
         struct cfg80211_registered_device *dev;
-        struct wireless_dev *wdev;
+        struct net_device *netdev;
         u8 mac_addr[ETH_ALEN];
+        int ifidx = cb->args[0];
+        int sta_idx = cb->args[1];
         int err;
-        int exit = 0;
 
-        /* TODO: filter by device */
-        mutex_lock(&cfg80211_drv_mutex);
-        list_for_each_entry(dev, &cfg80211_drv_list, list) {
-                if (exit)
+        if (!ifidx) {
+                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
+                                  nl80211_policy);
+                if (err)
+                        return err;
+
+                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
+                        return -EINVAL;
+
+                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
+                if (!ifidx)
+                        return -EINVAL;
+        }
+
+        netdev = dev_get_by_index(&init_net, ifidx);
+        if (!netdev)
+                return -ENODEV;
+
+        dev = cfg80211_get_dev_from_ifindex(ifidx);
+        if (IS_ERR(dev)) {
+                err = PTR_ERR(dev);
+                goto out_put_netdev;
+        }
+
+        if (!dev->ops->dump_station) {
+                err = -ENOSYS;
+                goto out_err;
+        }
+
+        rtnl_lock();
+
+        while (1) {
+                err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
+                                             mac_addr, &sinfo);
+                if (err == -ENOENT)
                         break;
-                if (++wp_idx < wp_start)
-                        continue;
-                if_idx = 0;
+                if (err)
+                        goto out_err_rtnl;
 
-                mutex_lock(&dev->devlist_mtx);
-                list_for_each_entry(wdev, &dev->netdev_list, list) {
-                        if (exit)
-                                break;
-                        if (++if_idx < if_start)
-                                continue;
-                        if (!dev->ops->dump_station)
-                                continue;
+                if (nl80211_send_station(skb,
+                                NETLINK_CB(cb->skb).pid,
+                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                netdev, mac_addr,
+                                &sinfo) < 0)
+                        goto out;
 
-                        for (;; ++sta_idx) {
-                                rtnl_lock();
-                                err = dev->ops->dump_station(&dev->wiphy,
-                                                wdev->netdev, sta_idx, mac_addr,
-                                                &sinfo);
-                                rtnl_unlock();
-                                if (err) {
-                                        sta_idx = 0;
-                                        break;
-                                }
-                                if (nl80211_send_station(skb,
-                                                NETLINK_CB(cb->skb).pid,
-                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                                wdev->netdev, mac_addr,
-                                                &sinfo) < 0) {
-                                        exit = 1;
-                                        break;
-                                }
-                        }
-                }
-                mutex_unlock(&dev->devlist_mtx);
+                sta_idx++;
         }
-        mutex_unlock(&cfg80211_drv_mutex);
 
-        cb->args[0] = wp_idx;
-        cb->args[1] = if_idx;
-        cb->args[2] = sta_idx;
 
-        return skb->len;
+ out:
+        cb->args[1] = sta_idx;
+        err = skb->len;
+ out_err_rtnl:
+        rtnl_unlock();
+ out_err:
+        cfg80211_put_dev(dev);
+ out_put_netdev:
+        dev_put(netdev);
+
+        return err;
 }
 
 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
@@ -1016,7 +1037,7 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 
         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -1112,7 +1133,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 params.plink_action =
                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -1172,7 +1193,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                                 &params.station_flags))
                 return -EINVAL;
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -1207,7 +1228,7 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_MAC])
                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -1277,68 +1298,78 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
 }
 
 static int nl80211_dump_mpath(struct sk_buff *skb,
-                struct netlink_callback *cb)
+                              struct netlink_callback *cb)
 {
-        int wp_idx = 0;
-        int if_idx = 0;
-        int sta_idx = cb->args[2];
-        int wp_start = cb->args[0];
-        int if_start = cb->args[1];
         struct mpath_info pinfo;
         struct cfg80211_registered_device *dev;
-        struct wireless_dev *wdev;
+        struct net_device *netdev;
         u8 dst[ETH_ALEN];
         u8 next_hop[ETH_ALEN];
+        int ifidx = cb->args[0];
+        int path_idx = cb->args[1];
         int err;
-        int exit = 0;
 
-        /* TODO: filter by device */
-        mutex_lock(&cfg80211_drv_mutex);
-        list_for_each_entry(dev, &cfg80211_drv_list, list) {
-                if (exit)
+        if (!ifidx) {
+                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
+                                  nl80211_policy);
+                if (err)
+                        return err;
+
+                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
+                        return -EINVAL;
+
+                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
+                if (!ifidx)
+                        return -EINVAL;
+        }
+
+        netdev = dev_get_by_index(&init_net, ifidx);
+        if (!netdev)
+                return -ENODEV;
+
+        dev = cfg80211_get_dev_from_ifindex(ifidx);
+        if (IS_ERR(dev)) {
+                err = PTR_ERR(dev);
+                goto out_put_netdev;
+        }
+
+        if (!dev->ops->dump_mpath) {
+                err = -ENOSYS;
+                goto out_err;
+        }
+
+        rtnl_lock();
+
+        while (1) {
+                err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
+                                           dst, next_hop, &pinfo);
+                if (err == -ENOENT)
                         break;
-                if (++wp_idx < wp_start)
-                        continue;
-                if_idx = 0;
+                if (err)
+                        goto out_err_rtnl;
 
-                mutex_lock(&dev->devlist_mtx);
-                list_for_each_entry(wdev, &dev->netdev_list, list) {
-                        if (exit)
-                                break;
-                        if (++if_idx < if_start)
-                                continue;
-                        if (!dev->ops->dump_mpath)
-                                continue;
+                if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
+                                       cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                       netdev, dst, next_hop,
+                                       &pinfo) < 0)
+                        goto out;
 
-                        for (;; ++sta_idx) {
-                                rtnl_lock();
-                                err = dev->ops->dump_mpath(&dev->wiphy,
-                                                wdev->netdev, sta_idx, dst,
-                                                next_hop, &pinfo);
-                                rtnl_unlock();
-                                if (err) {
-                                        sta_idx = 0;
-                                        break;
-                                }
-                                if (nl80211_send_mpath(skb,
-                                                NETLINK_CB(cb->skb).pid,
-                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                                wdev->netdev, dst, next_hop,
-                                                &pinfo) < 0) {
-                                        exit = 1;
-                                        break;
-                                }
-                        }
-                }
-                mutex_unlock(&dev->devlist_mtx);
+                path_idx++;
         }
-        mutex_unlock(&cfg80211_drv_mutex);
 
-        cb->args[0] = wp_idx;
-        cb->args[1] = if_idx;
-        cb->args[2] = sta_idx;
 
-        return skb->len;
+ out:
+        cb->args[1] = path_idx;
+        err = skb->len;
+ out_err_rtnl:
+        rtnl_unlock();
+ out_err:
+        cfg80211_put_dev(dev);
+ out_put_netdev:
+        dev_put(netdev);
+
+        return err;
 }
 
 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
@@ -1358,7 +1389,7 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
 
         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -1411,7 +1442,7 @@ static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -1446,7 +1477,7 @@ static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
@@ -1475,7 +1506,7 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_MAC])
                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        err = get_drv_dev_by_info_ifindex(info, &drv, &dev);
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
index 9201ef8ad90e..6d081674515f 100644
--- a/net/xfrm/Kconfig
+++ b/net/xfrm/Kconfig
@@ -46,6 +46,12 @@ config XFRM_STATISTICS
 
           If unsure, say N.
 
+config XFRM_IPCOMP
+        tristate
+        select XFRM
+        select CRYPTO
+        select CRYPTO_DEFLATE
+
 config NET_KEY
         tristate "PF_KEY sockets"
         select XFRM
diff --git a/net/xfrm/Makefile b/net/xfrm/Makefile
index 332cfb0ff566..0f439a72ccab 100644
--- a/net/xfrm/Makefile
+++ b/net/xfrm/Makefile
@@ -6,4 +6,5 @@ obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \
                       xfrm_input.o xfrm_output.o xfrm_algo.o
 obj-$(CONFIG_XFRM_STATISTICS) += xfrm_proc.o
 obj-$(CONFIG_XFRM_USER) += xfrm_user.o
+obj-$(CONFIG_XFRM_IPCOMP) += xfrm_ipcomp.o
 
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 23a2cc04b8cd..96036cf2216d 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -718,7 +718,7 @@ int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 int end;
 
-                BUG_TRAP(start <= offset + len);
+                WARN_ON(start > offset + len);
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 if ((copy = end - offset) > 0) {
@@ -748,7 +748,7 @@ int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
                 for (; list; list = list->next) {
                         int end;
 
-                        BUG_TRAP(start <= offset + len);
+                        WARN_ON(start > offset + len);
 
                         end = start + list->len;
                         if ((copy = end - offset) > 0) {
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
new file mode 100644
index 000000000000..c609a4b98e15
--- /dev/null
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -0,0 +1,384 @@
+/*
+ * IP Payload Compression Protocol (IPComp) - RFC3173.
+ *
+ * Copyright (c) 2003 James Morris <jmorris@intercode.com.au>
+ * Copyright (c) 2003-2008 Herbert Xu <herbert@gondor.apana.org.au>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ * Todo:
+ *   - Tunable compression parameters.
+ *   - Compression stats.
+ *   - Adaptive compression.
+ */
+
+#include <linux/crypto.h>
+#include <linux/err.h>
+#include <linux/gfp.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/percpu.h>
+#include <linux/smp.h>
+#include <linux/vmalloc.h>
+#include <net/ip.h>
+#include <net/ipcomp.h>
+#include <net/xfrm.h>
+
+struct ipcomp_tfms {
+        struct list_head list;
+        struct crypto_comp **tfms;
+        int users;
+};
+
+static DEFINE_MUTEX(ipcomp_resource_mutex);
+static void **ipcomp_scratches;
+static int ipcomp_scratch_users;
+static LIST_HEAD(ipcomp_tfms_list);
+
+static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct ipcomp_data *ipcd = x->data;
+        const int plen = skb->len;
+        int dlen = IPCOMP_SCRATCH_SIZE;
+        const u8 *start = skb->data;
+        const int cpu = get_cpu();
+        u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
+        struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
+        int err = crypto_comp_decompress(tfm, start, plen, scratch, &dlen);
+        int len;
+
+        if (err)
+                goto out;
+
+        if (dlen < (plen + sizeof(struct ip_comp_hdr))) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        len = dlen - plen;
+        if (len > skb_tailroom(skb))
+                len = skb_tailroom(skb);
+
+        skb->truesize += len;
+        __skb_put(skb, len);
+
+        len += plen;
+        skb_copy_to_linear_data(skb, scratch, len);
+
+        while ((scratch += len, dlen -= len) > 0) {
+                skb_frag_t *frag;
+
+                err = -EMSGSIZE;
+                if (WARN_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS))
+                        goto out;
+
+                frag = skb_shinfo(skb)->frags + skb_shinfo(skb)->nr_frags;
+                frag->page = alloc_page(GFP_ATOMIC);
+
+                err = -ENOMEM;
+                if (!frag->page)
+                        goto out;
+
+                len = PAGE_SIZE;
+                if (dlen < len)
+                        len = dlen;
+
+                memcpy(page_address(frag->page), scratch, len);
+
+                frag->page_offset = 0;
+                frag->size = len;
+                skb->truesize += len;
+                skb->data_len += len;
+                skb->len += len;
+
+                skb_shinfo(skb)->nr_frags++;
+        }
+
+        err = 0;
+
+out:
+        put_cpu();
+        return err;
+}
+
+int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
+{
+        int nexthdr;
+        int err = -ENOMEM;
+        struct ip_comp_hdr *ipch;
+
+        if (skb_linearize_cow(skb))
+                goto out;
+
+        skb->ip_summed = CHECKSUM_NONE;
+
+        /* Remove ipcomp header and decompress original payload */
+        ipch = (void *)skb->data;
+        nexthdr = ipch->nexthdr;
+
+        skb->transport_header = skb->network_header + sizeof(*ipch);
+        __skb_pull(skb, sizeof(*ipch));
+        err = ipcomp_decompress(x, skb);
+        if (err)
+                goto out;
+
+        err = nexthdr;
+
+out:
+        return err;
+}
+EXPORT_SYMBOL_GPL(ipcomp_input);
+
+static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct ipcomp_data *ipcd = x->data;
+        const int plen = skb->len;
+        int dlen = IPCOMP_SCRATCH_SIZE;
+        u8 *start = skb->data;
+        const int cpu = get_cpu();
+        u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
+        struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
+        int err;
+
+        local_bh_disable();
+        err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
+        local_bh_enable();
+        if (err)
+                goto out;
+
+        if ((dlen + sizeof(struct ip_comp_hdr)) >= plen) {
+                err = -EMSGSIZE;
+                goto out;
+        }
+
+        memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
+        put_cpu();
+
+        pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
+        return 0;
+
+out:
+        put_cpu();
+        return err;
+}
+
+int ipcomp_output(struct xfrm_state *x, struct sk_buff *skb)
+{
+        int err;
+        struct ip_comp_hdr *ipch;
+        struct ipcomp_data *ipcd = x->data;
+
+        if (skb->len < ipcd->threshold) {
+                /* Don't bother compressing */
+                goto out_ok;
+        }
+
+        if (skb_linearize_cow(skb))
+                goto out_ok;
+
+        err = ipcomp_compress(x, skb);
+
+        if (err) {
+                goto out_ok;
+        }
+
+        /* Install ipcomp header, convert into ipcomp datagram. */
+        ipch = ip_comp_hdr(skb);
+        ipch->nexthdr = *skb_mac_header(skb);
+        ipch->flags = 0;
+        ipch->cpi = htons((u16 )ntohl(x->id.spi));
+        *skb_mac_header(skb) = IPPROTO_COMP;
+out_ok:
+        skb_push(skb, -skb_network_offset(skb));
+        return 0;
+}
+EXPORT_SYMBOL_GPL(ipcomp_output);
+
+static void ipcomp_free_scratches(void)
+{
+        int i;
+        void **scratches;
+
+        if (--ipcomp_scratch_users)
+                return;
+
+        scratches = ipcomp_scratches;
+        if (!scratches)
+                return;
+
+        for_each_possible_cpu(i)
+                vfree(*per_cpu_ptr(scratches, i));
+
+        free_percpu(scratches);
+}
+
+static void **ipcomp_alloc_scratches(void)
+{
+        int i;
+        void **scratches;
+
+        if (ipcomp_scratch_users++)
+                return ipcomp_scratches;
+
+        scratches = alloc_percpu(void *);
+        if (!scratches)
+                return NULL;
+
+        ipcomp_scratches = scratches;
+
+        for_each_possible_cpu(i) {
+                void *scratch = vmalloc(IPCOMP_SCRATCH_SIZE);
+                if (!scratch)
+                        return NULL;
+                *per_cpu_ptr(scratches, i) = scratch;
+        }
+
+        return scratches;
+}
+
+static void ipcomp_free_tfms(struct crypto_comp **tfms)
+{
+        struct ipcomp_tfms *pos;
+        int cpu;
+
+        list_for_each_entry(pos, &ipcomp_tfms_list, list) {
+                if (pos->tfms == tfms)
+                        break;
+        }
+
+        WARN_ON(!pos);
+
+        if (--pos->users)
+                return;
+
+        list_del(&pos->list);
+        kfree(pos);
+
+        if (!tfms)
+                return;
+
+        for_each_possible_cpu(cpu) {
+                struct crypto_comp *tfm = *per_cpu_ptr(tfms, cpu);
+                crypto_free_comp(tfm);
+        }
+        free_percpu(tfms);
+}
+
+static struct crypto_comp **ipcomp_alloc_tfms(const char *alg_name)
+{
+        struct ipcomp_tfms *pos;
+        struct crypto_comp **tfms;
+        int cpu;
+
+        /* This can be any valid CPU ID so we don't need locking. */
+        cpu = raw_smp_processor_id();
+
+        list_for_each_entry(pos, &ipcomp_tfms_list, list) {
+                struct crypto_comp *tfm;
+
+                tfms = pos->tfms;
+                tfm = *per_cpu_ptr(tfms, cpu);
+
+                if (!strcmp(crypto_comp_name(tfm), alg_name)) {
+                        pos->users++;
+                        return tfms;
+                }
+        }
+
+        pos = kmalloc(sizeof(*pos), GFP_KERNEL);
+        if (!pos)
+                return NULL;
+
+        pos->users = 1;
+        INIT_LIST_HEAD(&pos->list);
+        list_add(&pos->list, &ipcomp_tfms_list);
+
+        pos->tfms = tfms = alloc_percpu(struct crypto_comp *);
+        if (!tfms)
+                goto error;
+
+        for_each_possible_cpu(cpu) {
+                struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
+                                                            CRYPTO_ALG_ASYNC);
+                if (IS_ERR(tfm))
+                        goto error;
+                *per_cpu_ptr(tfms, cpu) = tfm;
+        }
+
+        return tfms;
+
+error:
+        ipcomp_free_tfms(tfms);
+        return NULL;
+}
+
+static void ipcomp_free_data(struct ipcomp_data *ipcd)
+{
+        if (ipcd->tfms)
+                ipcomp_free_tfms(ipcd->tfms);
+        ipcomp_free_scratches();
+}
+
+void ipcomp_destroy(struct xfrm_state *x)
+{
+        struct ipcomp_data *ipcd = x->data;
+        if (!ipcd)
+                return;
+        xfrm_state_delete_tunnel(x);
+        mutex_lock(&ipcomp_resource_mutex);
+        ipcomp_free_data(ipcd);
+        mutex_unlock(&ipcomp_resource_mutex);
+        kfree(ipcd);
+}
+EXPORT_SYMBOL_GPL(ipcomp_destroy);
+
+int ipcomp_init_state(struct xfrm_state *x)
+{
+        int err;
+        struct ipcomp_data *ipcd;
+        struct xfrm_algo_desc *calg_desc;
+
+        err = -EINVAL;
+        if (!x->calg)
+                goto out;
+
+        if (x->encap)
+                goto out;
+
+        err = -ENOMEM;
+        ipcd = kzalloc(sizeof(*ipcd), GFP_KERNEL);
+        if (!ipcd)
+                goto out;
+
+        mutex_lock(&ipcomp_resource_mutex);
+        if (!ipcomp_alloc_scratches())
+                goto error;
+
+        ipcd->tfms = ipcomp_alloc_tfms(x->calg->alg_name);
+        if (!ipcd->tfms)
+                goto error;
+        mutex_unlock(&ipcomp_resource_mutex);
+
+        calg_desc = xfrm_calg_get_byname(x->calg->alg_name, 0);
+        BUG_ON(!calg_desc);
+        ipcd->threshold = calg_desc->uinfo.comp.threshold;
+        x->data = ipcd;
+        err = 0;
+out:
+        return err;
+
+error:
+        ipcomp_free_data(ipcd);
+        mutex_unlock(&ipcomp_resource_mutex);
+        kfree(ipcd);
+        goto out;
+}
+EXPORT_SYMBOL_GPL(ipcomp_init_state);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("IP Payload Compression Protocol (IPComp) - RFC3173");
+MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 72fddafd891a..4c6914ef7d92 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -538,7 +538,7 @@ EXPORT_SYMBOL(xfrm_state_alloc);
 
 void __xfrm_state_destroy(struct xfrm_state *x)
 {
-        BUG_TRAP(x->km.state == XFRM_STATE_DEAD);
+        WARN_ON(x->km.state != XFRM_STATE_DEAD);
 
         spin_lock_bh(&xfrm_state_lock);
         list_del(&x->all);