Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into sh-fixes-for-linus

46 files changed, 214 insertions, 180 deletions

diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 41495dc2a4c9..fcc684678af6 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -23,6 +23,31 @@ bool vlan_do_receive(struct sk_buff **skbp)
                 return false;
 
         skb->dev = vlan_dev;
+        if (skb->pkt_type == PACKET_OTHERHOST) {
+                /* Our lower layer thinks this is not local, let's make sure.
+                 * This allows the VLAN to have a different MAC than the
+                 * underlying device, and still route correctly. */
+                if (!compare_ether_addr(eth_hdr(skb)->h_dest,
+                                        vlan_dev->dev_addr))
+                        skb->pkt_type = PACKET_HOST;
+        }
+
+        if (!(vlan_dev_info(vlan_dev)->flags & VLAN_FLAG_REORDER_HDR)) {
+                unsigned int offset = skb->data - skb_mac_header(skb);
+
+                /*
+                 * vlan_insert_tag expect skb->data pointing to mac header.
+                 * So change skb->data before calling it and change back to
+                 * original position later
+                 */
+                skb_push(skb, offset);
+                skb = *skbp = vlan_insert_tag(skb, skb->vlan_tci);
+                if (!skb)
+                        return false;
+                skb_pull(skb, offset + VLAN_HLEN);
+                skb_reset_mac_len(skb);
+        }
+
         skb->priority = vlan_get_ingress_priority(vlan_dev, skb->vlan_tci);
         skb->vlan_tci = 0;
 
@@ -31,22 +56,8 @@ bool vlan_do_receive(struct sk_buff **skbp)
         u64_stats_update_begin(&rx_stats->syncp);
         rx_stats->rx_packets++;
         rx_stats->rx_bytes += skb->len;
-
-        switch (skb->pkt_type) {
-        case PACKET_BROADCAST:
-                break;
-        case PACKET_MULTICAST:
+        if (skb->pkt_type == PACKET_MULTICAST)
                 rx_stats->rx_multicast++;
-                break;
-        case PACKET_OTHERHOST:
-                /* Our lower layer thinks this is not local, let's make sure.
-                 * This allows the VLAN to have a different MAC than the
-                 * underlying device, and still route correctly. */
-                if (!compare_ether_addr(eth_hdr(skb)->h_dest,
-                                        vlan_dev->dev_addr))
-                        skb->pkt_type = PACKET_HOST;
-                break;
-        }
         u64_stats_update_end(&rx_stats->syncp);
 
         return true;
@@ -89,18 +100,13 @@ gro_result_t vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
 }
 EXPORT_SYMBOL(vlan_gro_frags);
 
-static struct sk_buff *vlan_check_reorder_header(struct sk_buff *skb)
+static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)
 {
-        if (vlan_dev_info(skb->dev)->flags & VLAN_FLAG_REORDER_HDR) {
-                if (skb_cow(skb, skb_headroom(skb)) < 0)
-                        skb = NULL;
-                if (skb) {
-                        /* Lifted from Gleb's VLAN code... */
-                        memmove(skb->data - ETH_HLEN,
-                                skb->data - VLAN_ETH_HLEN, 12);
-                        skb->mac_header += VLAN_HLEN;
-                }
-        }
+        if (skb_cow(skb, skb_headroom(skb)) < 0)
+                return NULL;
+        memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
+        skb->mac_header += VLAN_HLEN;
+        skb_reset_mac_len(skb);
         return skb;
 }
 
@@ -161,7 +167,7 @@ struct sk_buff *vlan_untag(struct sk_buff *skb)
         skb_pull_rcsum(skb, VLAN_HLEN);
         vlan_set_encap_proto(skb, vhdr);
 
-        skb = vlan_check_reorder_header(skb);
+        skb = vlan_reorder_header(skb);
         if (unlikely(!skb))
                 goto err_free;
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 3fa123185e89..56149ec36d7f 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -104,10 +104,16 @@ static void fake_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
 
+static u32 *fake_cow_metrics(struct dst_entry *dst, unsigned long old)
+{
+        return NULL;
+}
+
 static struct dst_ops fake_dst_ops = {
         .family =               AF_INET,
         .protocol =             cpu_to_be16(ETH_P_IP),
         .update_pmtu =          fake_update_pmtu,
+        .cow_metrics =          fake_cow_metrics,
 };
 
 /*
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 6ea2b892f44b..9cb627a4073a 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1144,6 +1144,13 @@ static void handle_osds_timeout(struct work_struct *work)
                               round_jiffies_relative(delay));
 }
 
+static void complete_request(struct ceph_osd_request *req)
+{
+        if (req->r_safe_callback)
+                req->r_safe_callback(req, NULL);
+        complete_all(&req->r_safe_completion);  /* fsync waiter */
+}
+
 /*
  * handle osd op reply.  either call the callback if it is specified,
  * or do the completion to wake up the waiting thread.
@@ -1226,11 +1233,8 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
         else
                 complete_all(&req->r_completion);
 
-        if (flags & CEPH_OSD_FLAG_ONDISK) {
-                if (req->r_safe_callback)
-                        req->r_safe_callback(req, msg);
-                complete_all(&req->r_safe_completion);  /* fsync waiter */
-        }
+        if (flags & CEPH_OSD_FLAG_ONDISK)
+                complete_request(req);
 
 done:
         dout("req=%p req->r_linger=%d\n", req, req->r_linger);
@@ -1732,6 +1736,7 @@ int ceph_osdc_wait_request(struct ceph_osd_client *osdc,
                 __cancel_request(req);
                 __unregister_request(osdc, req);
                 mutex_unlock(&osdc->request_mutex);
+                complete_request(req);
                 dout("wait_request tid %llu canceled/timed out\n", req->r_tid);
                 return rc;
         }
diff --git a/net/core/dev.c b/net/core/dev.c
index 939307891e71..9c58c1ec41a9 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3114,7 +3114,7 @@ static int __netif_receive_skb(struct sk_buff *skb)
 
         skb_reset_network_header(skb);
         skb_reset_transport_header(skb);
-        skb->mac_len = skb->network_header - skb->mac_header;
+        skb_reset_mac_len(skb);
 
         pt_prev = NULL;
 
@@ -6178,6 +6178,11 @@ static int dev_cpu_callback(struct notifier_block *nfb,
                 oldsd->output_queue = NULL;
                 oldsd->output_queue_tailp = &oldsd->output_queue;
         }
+        /* Append NAPI poll list from offline CPU. */
+        if (!list_empty(&oldsd->poll_list)) {
+                list_splice_init(&oldsd->poll_list, &sd->poll_list);
+                raise_softirq_irqoff(NET_RX_SOFTIRQ);
+        }
 
         raise_softirq_irqoff(NET_TX_SOFTIRQ);
         local_irq_enable();
@@ -6264,29 +6269,23 @@ err_name:
 /**
  *      netdev_drivername - network driver for the device
  *      @dev: network device
- *      @buffer: buffer for resulting name
- *      @len: size of buffer
  *
  *      Determine network driver for device.
  */
-char *netdev_drivername(const struct net_device *dev, char *buffer, int len)
+const char *netdev_drivername(const struct net_device *dev)
 {
         const struct device_driver *driver;
         const struct device *parent;
-
-        if (len <= 0 || !buffer)
-                return buffer;
-        buffer[0] = 0;
+        const char *empty = "";
 
         parent = dev->dev.parent;
-
         if (!parent)
-                return buffer;
+                return empty;
 
         driver = parent->driver;
         if (driver && driver->name)
-                strlcpy(buffer, driver->name, len);
-        return buffer;
+                return driver->name;
+        return empty;
 }
 
 static int __netdev_printk(const char *level, const struct net_device *dev,
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 6c6b86d0da15..e41e5110c65c 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -310,19 +310,17 @@ struct net *get_net_ns_by_fd(int fd)
         struct file *file;
         struct net *net;
 
-        net = ERR_PTR(-EINVAL);
         file = proc_ns_fget(fd);
-        if (!file)
-                goto out;
+        if (IS_ERR(file))
+                return ERR_CAST(file);
 
         ei = PROC_I(file->f_dentry->d_inode);
-        if (ei->ns_ops != &netns_operations)
-                goto out;
+        if (ei->ns_ops == &netns_operations)
+                net = get_net(ei->ns);
+        else
+                net = ERR_PTR(-EINVAL);
 
-        net = get_net(ei->ns);
-out:
-        if (file)
-                fput(file);
+        fput(file);
         return net;
 }
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 2d7d6d473781..18d9cbda3a39 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -792,6 +792,13 @@ int netpoll_setup(struct netpoll *np)
                 return -ENODEV;
         }
 
+        if (ndev->master) {
+                printk(KERN_ERR "%s: %s is a slave device, aborting.\n",
+                       np->name, np->dev_name);
+                err = -EBUSY;
+                goto put;
+        }
+
         if (!netif_running(ndev)) {
                 unsigned long atmost, atleast;
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 98af3697c718..a8024eaa0e87 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -799,7 +799,9 @@ static int __ip_append_data(struct sock *sk,
         int csummode = CHECKSUM_NONE;
         struct rtable *rt = (struct rtable *)cork->dst;
 
-        exthdrlen = transhdrlen ? rt->dst.header_len : 0;
+        skb = skb_peek_tail(queue);
+
+        exthdrlen = !skb ? rt->dst.header_len : 0;
         length += exthdrlen;
         transhdrlen += exthdrlen;
         mtu = cork->fragsize;
@@ -825,8 +827,6 @@ static int __ip_append_data(struct sock *sk,
             !exthdrlen)
                 csummode = CHECKSUM_PARTIAL;
 
-        skb = skb_peek_tail(queue);
-
         cork->length += length;
         if (((length > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index d2c1311cb28d..f7f9bd7ba12d 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -402,7 +402,8 @@ ipq_dev_drop(int ifindex)
 static inline void
 __ipq_rcv_skb(struct sk_buff *skb)
 {
-        int status, type, pid, flags, nlmsglen, skblen;
+        int status, type, pid, flags;
+        unsigned int nlmsglen, skblen;
         struct nlmsghdr *nlh;
 
         skblen = skb->len;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index d609ac3cb9a4..5c9e97c79017 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -307,7 +307,7 @@ clusterip_tg(struct sk_buff *skb, const struct xt_action_param *par)
          * error messages (RELATED) and information requests (see below) */
         if (ip_hdr(skb)->protocol == IPPROTO_ICMP &&
             (ctinfo == IP_CT_RELATED ||
-             ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY))
+             ctinfo == IP_CT_RELATED_REPLY))
                 return XT_CONTINUE;
 
         /* ip_conntrack_icmp guarantees us that we only have ICMP_ECHO,
@@ -321,12 +321,12 @@ clusterip_tg(struct sk_buff *skb, const struct xt_action_param *par)
                         ct->mark = hash;
                         break;
                 case IP_CT_RELATED:
-                case IP_CT_RELATED+IP_CT_IS_REPLY:
+                case IP_CT_RELATED_REPLY:
                         /* FIXME: we don't handle expectations at the
                          * moment.  they can arrive on a different node than
                          * the master connection (e.g. FTP passive mode) */
                 case IP_CT_ESTABLISHED:
-                case IP_CT_ESTABLISHED+IP_CT_IS_REPLY:
+                case IP_CT_ESTABLISHED_REPLY:
                         break;
                 default:
                         break;
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index d2ed9dc74ebc..9931152a78b5 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -60,7 +60,7 @@ masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par)
         nat = nfct_nat(ct);
 
         NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
-                            ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
+                            ctinfo == IP_CT_RELATED_REPLY));
 
         /* Source address is 0.0.0.0 - locally generated packet that is
          * probably not supposed to be masqueraded.
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 5a03c02af999..db10075dd88e 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -101,7 +101,7 @@ static unsigned int ipv4_confirm(unsigned int hooknum,
 
         /* This is where we call the helper: as the packet goes out. */
         ct = nf_ct_get(skb, &ctinfo);
-        if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
+        if (!ct || ctinfo == IP_CT_RELATED_REPLY)
                 goto out;
 
         help = nfct_help(ct);
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 7404bde95994..ab5b27a2916f 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -160,7 +160,7 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
         /* Update skb to refer to this connection */
         skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
         skb->nfctinfo = *ctinfo;
-        return -NF_ACCEPT;
+        return NF_ACCEPT;
 }
 
 /* Small and modified version of icmp_rcv */
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 9c71b2755ce3..3346de5d94d0 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -433,7 +433,7 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
 
         /* Must be RELATED */
         NF_CT_ASSERT(skb->nfctinfo == IP_CT_RELATED ||
-                     skb->nfctinfo == IP_CT_RELATED+IP_CT_IS_REPLY);
+                     skb->nfctinfo == IP_CT_RELATED_REPLY);
 
         /* Redirects on non-null nats must be dropped, else they'll
            start talking to each other without our translation, and be
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 99cfa28b6d38..ebc5f8894f99 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -160,7 +160,7 @@ static void nf_nat_csum(struct sk_buff *skb, const struct iphdr *iph, void *data
 
         if (skb->ip_summed != CHECKSUM_PARTIAL) {
                 if (!(rt->rt_flags & RTCF_LOCAL) &&
-                    skb->dev->features & NETIF_F_V4_CSUM) {
+                    (!skb->dev || skb->dev->features & NETIF_F_V4_CSUM)) {
                         skb->ip_summed = CHECKSUM_PARTIAL;
                         skb->csum_start = skb_headroom(skb) +
                                           skb_network_offset(skb) +
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 21c30426480b..733c9abc1cbd 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -53,7 +53,7 @@ ipt_snat_target(struct sk_buff *skb, const struct xt_action_param *par)
 
         /* Connection must be valid and new. */
         NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
-                            ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
+                            ctinfo == IP_CT_RELATED_REPLY));
         NF_CT_ASSERT(par->out != NULL);
 
         return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_SRC);
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 7317bdf1d457..483b76d042da 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -116,7 +116,7 @@ nf_nat_fn(unsigned int hooknum,
 
         switch (ctinfo) {
         case IP_CT_RELATED:
-        case IP_CT_RELATED+IP_CT_IS_REPLY:
+        case IP_CT_RELATED_REPLY:
                 if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
                         if (!nf_nat_icmp_reply_translation(ct, ctinfo,
                                                            hooknum, skb))
@@ -144,7 +144,7 @@ nf_nat_fn(unsigned int hooknum,
         default:
                 /* ESTABLISHED */
                 NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
-                             ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
+                             ctinfo == IP_CT_ESTABLISHED_REPLY);
         }
 
         return nf_nat_packet(ct, ctinfo, hooknum, skb);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 52b0b956508b..045f0ec6a4a0 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1316,6 +1316,23 @@ reject_redirect:
         ;
 }
 
+static bool peer_pmtu_expired(struct inet_peer *peer)
+{
+        unsigned long orig = ACCESS_ONCE(peer->pmtu_expires);
+
+        return orig &&
+               time_after_eq(jiffies, orig) &&
+               cmpxchg(&peer->pmtu_expires, orig, 0) == orig;
+}
+
+static bool peer_pmtu_cleaned(struct inet_peer *peer)
+{
+        unsigned long orig = ACCESS_ONCE(peer->pmtu_expires);
+
+        return orig &&
+               cmpxchg(&peer->pmtu_expires, orig, 0) == orig;
+}
+
 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
 {
         struct rtable *rt = (struct rtable *)dst;
@@ -1331,14 +1348,8 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
                                                 rt_genid(dev_net(dst->dev)));
                         rt_del(hash, rt);
                         ret = NULL;
-                } else if (rt->peer &&
-                           rt->peer->pmtu_expires &&
-                           time_after_eq(jiffies, rt->peer->pmtu_expires)) {
-                        unsigned long orig = rt->peer->pmtu_expires;
-
-                        if (cmpxchg(&rt->peer->pmtu_expires, orig, 0) == orig)
-                                dst_metric_set(dst, RTAX_MTU,
-                                               rt->peer->pmtu_orig);
+                } else if (rt->peer && peer_pmtu_expired(rt->peer)) {
+                        dst_metric_set(dst, RTAX_MTU, rt->peer->pmtu_orig);
                 }
         }
         return ret;
@@ -1531,8 +1542,10 @@ unsigned short ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
 
 static void check_peer_pmtu(struct dst_entry *dst, struct inet_peer *peer)
 {
-        unsigned long expires = peer->pmtu_expires;
+        unsigned long expires = ACCESS_ONCE(peer->pmtu_expires);
 
+        if (!expires)
+                return;
         if (time_before(jiffies, expires)) {
                 u32 orig_dst_mtu = dst_mtu(dst);
                 if (peer->pmtu_learned < orig_dst_mtu) {
@@ -1555,10 +1568,11 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
                 rt_bind_peer(rt, rt->rt_dst, 1);
         peer = rt->peer;
         if (peer) {
+                unsigned long pmtu_expires = ACCESS_ONCE(peer->pmtu_expires);
+
                 if (mtu < ip_rt_min_pmtu)
                         mtu = ip_rt_min_pmtu;
-                if (!peer->pmtu_expires || mtu < peer->pmtu_learned) {
-                        unsigned long pmtu_expires;
+                if (!pmtu_expires || mtu < peer->pmtu_learned) {
 
                         pmtu_expires = jiffies + ip_rt_mtu_expires;
                         if (!pmtu_expires)
@@ -1612,13 +1626,14 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
                         rt_bind_peer(rt, rt->rt_dst, 0);
 
                 peer = rt->peer;
-                if (peer && peer->pmtu_expires)
+                if (peer) {
                         check_peer_pmtu(dst, peer);
 
-                if (peer && peer->redirect_learned.a4 &&
-                    peer->redirect_learned.a4 != rt->rt_gateway) {
-                        if (check_peer_redir(dst, peer))
-                                return NULL;
+                        if (peer->redirect_learned.a4 &&
+                            peer->redirect_learned.a4 != rt->rt_gateway) {
+                                if (check_peer_redir(dst, peer))
+                                        return NULL;
+                        }
                 }
 
                 rt->rt_peer_genid = rt_peer_genid();
@@ -1649,14 +1664,8 @@ static void ipv4_link_failure(struct sk_buff *skb)
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
 
         rt = skb_rtable(skb);
-        if (rt &&
-            rt->peer &&
-            rt->peer->pmtu_expires) {
-                unsigned long orig = rt->peer->pmtu_expires;
-
-                if (cmpxchg(&rt->peer->pmtu_expires, orig, 0) == orig)
-                        dst_metric_set(&rt->dst, RTAX_MTU, rt->peer->pmtu_orig);
-        }
+        if (rt && rt->peer && peer_pmtu_cleaned(rt->peer))
+                dst_metric_set(&rt->dst, RTAX_MTU, rt->peer->pmtu_orig);
 }
 
 static int ip_rt_bug(struct sk_buff *skb)
@@ -1770,8 +1779,7 @@ static void rt_init_metrics(struct rtable *rt, const struct flowi4 *fl4,
                                sizeof(u32) * RTAX_MAX);
                 dst_init_metrics(&rt->dst, peer->metrics, false);
 
-                if (peer->pmtu_expires)
-                        check_peer_pmtu(&rt->dst, peer);
+                check_peer_pmtu(&rt->dst, peer);
                 if (peer->redirect_learned.a4 &&
                     peer->redirect_learned.a4 != rt->rt_gateway) {
                         rt->rt_gateway = peer->redirect_learned.a4;
@@ -2775,7 +2783,8 @@ static int rt_fill_info(struct net *net,
         struct rtable *rt = skb_rtable(skb);
         struct rtmsg *r;
         struct nlmsghdr *nlh;
-        long expires;
+        long expires = 0;
+        const struct inet_peer *peer = rt->peer;
         u32 id = 0, ts = 0, tsage = 0, error;
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*r), flags);
@@ -2823,15 +2832,16 @@ static int rt_fill_info(struct net *net,
                 NLA_PUT_BE32(skb, RTA_MARK, rt->rt_mark);
 
         error = rt->dst.error;
-        expires = (rt->peer && rt->peer->pmtu_expires) ?
-                rt->peer->pmtu_expires - jiffies : 0;
-        if (rt->peer) {
+        if (peer) {
                 inet_peer_refcheck(rt->peer);
-                id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
-                if (rt->peer->tcp_ts_stamp) {
-                        ts = rt->peer->tcp_ts;
-                        tsage = get_seconds() - rt->peer->tcp_ts_stamp;
+                id = atomic_read(&peer->ip_id_count) & 0xffff;
+                if (peer->tcp_ts_stamp) {
+                        ts = peer->tcp_ts;
+                        tsage = get_seconds() - peer->tcp_ts_stamp;
                 }
+                expires = ACCESS_ONCE(peer->pmtu_expires);
+                if (expires)
+                        expires -= jiffies;
         }
 
         if (rt_is_input_route(rt)) {
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index b7919f901fbf..d450a2f9fc06 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -272,6 +272,10 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         if (addr_len < SIN6_LEN_RFC2133)
                 return -EINVAL;
+
+        if (addr->sin6_family != AF_INET6)
+                return -EINVAL;
+
         addr_type = ipv6_addr_type(&addr->sin6_addr);
         if ((addr_type & IPV6_ADDR_MULTICAST) && sock->type == SOCK_STREAM)
                 return -EINVAL;
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 413ab0754e1f..065fe405fb58 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -403,7 +403,8 @@ ipq_dev_drop(int ifindex)
 static inline void
 __ipq_rcv_skb(struct sk_buff *skb)
 {
-        int status, type, pid, flags, nlmsglen, skblen;
+        int status, type, pid, flags;
+        unsigned int nlmsglen, skblen;
         struct nlmsghdr *nlh;
 
         skblen = skb->len;
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index c8af58b22562..4111050a9fc5 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -160,7 +160,7 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
 
         /* This is where we call the helper: as the packet goes out. */
         ct = nf_ct_get(skb, &ctinfo);
-        if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
+        if (!ct || ctinfo == IP_CT_RELATED_REPLY)
                 goto out;
 
         help = nfct_help(ct);
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 1df3c8b6bf47..7c05e7eacbc6 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -177,7 +177,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
         /* Update skb to refer to this connection */
         skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
         skb->nfctinfo = *ctinfo;
-        return -NF_ACCEPT;
+        return NF_ACCEPT;
 }
 
 static int
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 36477538cea8..f876eed7d4aa 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -87,6 +87,8 @@ static inline void iriap_start_watchdog_timer(struct iriap_cb *self,
                          iriap_watchdog_timer_expired);
 }
 
+static struct lock_class_key irias_objects_key;
+
 /*
  * Function iriap_init (void)
  *
@@ -114,6 +116,9 @@ int __init iriap_init(void)
                 return -ENOMEM;
         }
 
+        lockdep_set_class_and_name(&irias_objects->hb_spinlock, &irias_objects_key,
+                                   "irias_objects");
+
         /*
          *  Register some default services for IrLMP
          */
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index b8dbae82fab8..76130134bfa6 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -258,7 +258,7 @@ static int l2tp_dfs_seq_open(struct inode *inode, struct file *file)
          */
         pd->net = get_net_ns_by_pid(current->pid);
         if (IS_ERR(pd->net)) {
-                rc = -PTR_ERR(pd->net);
+                rc = PTR_ERR(pd->net);
                 goto err_free_pd;
         }
 
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 421eaa6b0c2b..56c24cabf26d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -965,6 +965,10 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         mutex_lock(&sdata->u.ibss.mtx);
 
+        sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
+        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
+        sdata->u.ibss.ssid_len = 0;
+
         active_ibss = ieee80211_sta_active_ibss(sdata);
 
         if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
@@ -999,8 +1003,6 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         kfree_skb(skb);
 
         skb_queue_purge(&sdata->skb_queue);
-        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
-        sdata->u.ibss.ssid_len = 0;
 
         del_timer_sync(&sdata->u.ibss.timer);
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 2025af52b195..090b0ec1e056 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -775,9 +775,6 @@ struct ieee80211_local {
 
         int tx_headroom; /* required headroom for hardware/radiotap */
 
-        /* count for keys needing tailroom space allocation */
-        int crypto_tx_tailroom_needed_cnt;
-
         /* Tasklet and skb queue to process calls from IRQ mode. All frames
          * added to skb_queue will be processed, but frames in
          * skb_queue_unreliable may be dropped if the total length of these
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 49d4f869e0bc..dee30aea9ab3 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1145,6 +1145,10 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                                 + IEEE80211_ENCRYPT_HEADROOM;
         ndev->needed_tailroom = IEEE80211_ENCRYPT_TAILROOM;
 
+        ret = dev_alloc_name(ndev, ndev->name);
+        if (ret < 0)
+                goto fail;
+
         ieee80211_assign_perm_addr(local, ndev, type);
         memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 31afd712930d..f825e2f0a57e 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -101,11 +101,6 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         if (!ret) {
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-
-                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
-                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)))
-                        key->local->crypto_tx_tailroom_needed_cnt--;
-
                 return 0;
         }
 
@@ -161,10 +156,6 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                           key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-
-        if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
-              (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)))
-                key->local->crypto_tx_tailroom_needed_cnt++;
 }
 
 void ieee80211_key_removed(struct ieee80211_key_conf *key_conf)
@@ -403,10 +394,8 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
                 ieee80211_aes_key_free(key->u.ccmp.tfm);
         if (key->conf.cipher == WLAN_CIPHER_SUITE_AES_CMAC)
                 ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
-        if (key->local) {
+        if (key->local)
                 ieee80211_debugfs_key_remove(key);
-                key->local->crypto_tx_tailroom_needed_cnt--;
-        }
 
         kfree(key);
 }
@@ -468,8 +457,6 @@ int ieee80211_key_link(struct ieee80211_key *key,
 
         ieee80211_debugfs_key_add(key);
 
-        key->local->crypto_tx_tailroom_needed_cnt++;
-
         ret = ieee80211_key_enable_hw_accel(key);
 
         mutex_unlock(&sdata->local->key_mtx);
@@ -511,12 +498,8 @@ void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 
         mutex_lock(&sdata->local->key_mtx);
 
-        sdata->local->crypto_tx_tailroom_needed_cnt = 0;
-
-        list_for_each_entry(key, &sdata->key_list, list) {
-                sdata->local->crypto_tx_tailroom_needed_cnt++;
+        list_for_each_entry(key, &sdata->key_list, list)
                 ieee80211_key_enable_hw_accel(key);
-        }
 
         mutex_unlock(&sdata->local->key_mtx);
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 456cccf26b51..d595265d6c22 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -232,9 +232,6 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 WARN_ON(!ieee80211_set_channel_type(local, sdata, channel_type));
         }
 
-        ieee80211_stop_queues_by_reason(&sdata->local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_CSA);
-
         /* channel_type change automatically detected */
         ieee80211_hw_config(local, 0);
 
@@ -248,9 +245,6 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 rcu_read_unlock();
         }
 
-        ieee80211_wake_queues_by_reason(&sdata->local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_CSA);
-
         ht_opmode = le16_to_cpu(hti->operation_mode);
 
         /* if bss configuration changed store the new one */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 64e0f7587e6d..3104c844b544 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1480,7 +1480,12 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
 {
         int tail_need = 0;
 
-        if (may_encrypt && local->crypto_tx_tailroom_needed_cnt) {
+        /*
+         * This could be optimised, devices that do full hardware
+         * crypto (including TKIP MMIC) need no tailroom... But we
+         * have no drivers for such devices currently.
+         */
+        if (may_encrypt) {
                 tail_need = IEEE80211_ENCRYPT_TAILROOM;
                 tail_need -= skb_tailroom(skb);
                 tail_need = max_t(int, tail_need, 0);
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 8041befc6555..42aa64b6b0b1 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -767,7 +767,7 @@ ip_set_destroy(struct sock *ctnl, struct sk_buff *skb,
         if (!attr[IPSET_ATTR_SETNAME]) {
                 for (i = 0; i < ip_set_max; i++) {
                         if (ip_set_list[i] != NULL && ip_set_list[i]->ref) {
-                                ret = IPSET_ERR_BUSY;
+                                ret = -IPSET_ERR_BUSY;
                                 goto out;
                         }
                 }
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 4743e5402522..565a7c5b8818 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -146,8 +146,9 @@ hash_ipportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
 {
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
-        struct hash_ipportnet4_elem data =
-                { .cidr = h->nets[0].cidr || HOST_MASK };
+        struct hash_ipportnet4_elem data = {
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+        };
 
         if (data.cidr == 0)
                 return -EINVAL;
@@ -394,8 +395,9 @@ hash_ipportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
 {
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
-        struct hash_ipportnet6_elem data =
-                { .cidr = h->nets[0].cidr || HOST_MASK };
+        struct hash_ipportnet6_elem data = {
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+        };
 
         if (data.cidr == 0)
                 return -EINVAL;
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index c4db202b7da4..2aeeabcd5a21 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -131,7 +131,9 @@ hash_net4_kadt(struct ip_set *set, const struct sk_buff *skb,
 {
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
-        struct hash_net4_elem data = { .cidr = h->nets[0].cidr || HOST_MASK };
+        struct hash_net4_elem data = {
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+        };
 
         if (data.cidr == 0)
                 return -EINVAL;
@@ -296,7 +298,9 @@ hash_net6_kadt(struct ip_set *set, const struct sk_buff *skb,
 {
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
-        struct hash_net6_elem data = { .cidr = h->nets[0].cidr || HOST_MASK };
+        struct hash_net6_elem data = {
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+        };
 
         if (data.cidr == 0)
                 return -EINVAL;
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index d2a40362dd3a..e50d9bb8820b 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -144,7 +144,8 @@ hash_netport4_kadt(struct ip_set *set, const struct sk_buff *skb,
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
         struct hash_netport4_elem data = {
-                .cidr = h->nets[0].cidr || HOST_MASK };
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+        };
 
         if (data.cidr == 0)
                 return -EINVAL;
@@ -357,7 +358,8 @@ hash_netport6_kadt(struct ip_set *set, const struct sk_buff *skb,
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
         struct hash_netport6_elem data = {
-                .cidr = h->nets[0].cidr || HOST_MASK };
+                .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+        };
 
         if (data.cidr == 0)
                 return -EINVAL;
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index bfa808f4da13..55af2242bccd 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1772,7 +1772,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET,
                 .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = 99,
+                .priority       = NF_IP_PRI_NAT_SRC - 2,
         },
         /* After packet filtering, forward packet through VS/DR, VS/TUN,
          * or VS/NAT(change destination), so that filtering rules can be
@@ -1782,7 +1782,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET,
                 .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = 101,
+                .priority       = NF_IP_PRI_NAT_SRC - 1,
         },
         /* Before ip_vs_in, change source only for VS/NAT */
         {
@@ -1790,7 +1790,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET,
                 .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = -99,
+                .priority       = NF_IP_PRI_NAT_DST + 1,
         },
         /* After mangle, schedule and forward local requests */
         {
@@ -1798,7 +1798,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET,
                 .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = -98,
+                .priority       = NF_IP_PRI_NAT_DST + 2,
         },
         /* After packet filtering (but before ip_vs_out_icmp), catch icmp
          * destined for 0.0.0.0/0, which is for incoming IPVS connections */
@@ -1824,7 +1824,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = 99,
+                .priority       = NF_IP6_PRI_NAT_SRC - 2,
         },
         /* After packet filtering, forward packet through VS/DR, VS/TUN,
          * or VS/NAT(change destination), so that filtering rules can be
@@ -1834,7 +1834,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = 101,
+                .priority       = NF_IP6_PRI_NAT_SRC - 1,
         },
         /* Before ip_vs_in, change source only for VS/NAT */
         {
@@ -1842,7 +1842,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET,
                 .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = -99,
+                .priority       = NF_IP6_PRI_NAT_DST + 1,
         },
         /* After mangle, schedule and forward local requests */
         {
@@ -1850,7 +1850,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = -98,
+                .priority       = NF_IP6_PRI_NAT_DST + 2,
         },
         /* After packet filtering (but before ip_vs_out_icmp), catch icmp
          * destined for 0.0.0.0/0, which is for incoming IPVS connections */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 2e1c11f78419..f7af8b866017 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -850,7 +850,7 @@ resolve_normal_ct(struct net *net, struct nf_conn *tmpl,
 
         /* It exists; we have (non-exclusive) reference. */
         if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) {
-                *ctinfo = IP_CT_ESTABLISHED + IP_CT_IS_REPLY;
+                *ctinfo = IP_CT_ESTABLISHED_REPLY;
                 /* Please set reply bit if this packet OK */
                 *set_reply = 1;
         } else {
@@ -922,6 +922,9 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
                         ret = -ret;
                         goto out;
                 }
+                /* ICMP[v6] protocol trackers may assign one conntrack. */
+                if (skb->nfct)
+                        goto out;
         }
 
         ct = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum,
@@ -1143,7 +1146,7 @@ static void nf_conntrack_attach(struct sk_buff *nskb, struct sk_buff *skb)
         /* This ICMP is in reverse direction to the packet which caused it */
         ct = nf_ct_get(skb, &ctinfo);
         if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
-                ctinfo = IP_CT_RELATED + IP_CT_IS_REPLY;
+                ctinfo = IP_CT_RELATED_REPLY;
         else
                 ctinfo = IP_CT_RELATED;
 
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index e17cb7c7dd8f..6f5801eac999 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -368,7 +368,7 @@ static int help(struct sk_buff *skb,
 
         /* Until there's been traffic both ways, don't look in packets. */
         if (ctinfo != IP_CT_ESTABLISHED &&
-            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
+            ctinfo != IP_CT_ESTABLISHED_REPLY) {
                 pr_debug("ftp: Conntrackinfo = %u\n", ctinfo);
                 return NF_ACCEPT;
         }
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 18b2ce5c8ced..f03c2d4539f6 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -571,10 +571,9 @@ static int h245_help(struct sk_buff *skb, unsigned int protoff,
         int ret;
 
         /* Until there's been traffic both ways, don't look in packets. */
-        if (ctinfo != IP_CT_ESTABLISHED &&
-            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
+        if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
                 return NF_ACCEPT;
-        }
+
         pr_debug("nf_ct_h245: skblen = %u\n", skb->len);
 
         spin_lock_bh(&nf_h323_lock);
@@ -1125,10 +1124,9 @@ static int q931_help(struct sk_buff *skb, unsigned int protoff,
         int ret;
 
         /* Until there's been traffic both ways, don't look in packets. */
-        if (ctinfo != IP_CT_ESTABLISHED &&
-            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
+        if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
                 return NF_ACCEPT;
-        }
+
         pr_debug("nf_ct_q931: skblen = %u\n", skb->len);
 
         spin_lock_bh(&nf_h323_lock);
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index b394aa318776..4f9390b98697 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -125,8 +125,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
                 return NF_ACCEPT;
 
         /* Until there's been traffic both ways, don't look in packets. */
-        if (ctinfo != IP_CT_ESTABLISHED &&
-            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)
+        if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
                 return NF_ACCEPT;
 
         /* Not a full tcp header? */
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 088944824e13..2fd4565144de 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -519,8 +519,7 @@ conntrack_pptp_help(struct sk_buff *skb, unsigned int protoff,
         u_int16_t msg;
 
         /* don't do any tracking before tcp handshake complete */
-        if (ctinfo != IP_CT_ESTABLISHED &&
-            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)
+        if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
                 return NF_ACCEPT;
 
         nexthdr_off = protoff;
diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index d9e27734b2a2..8501823b3f9b 100644
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -78,7 +78,7 @@ static int help(struct sk_buff *skb,
         ct_sane_info = &nfct_help(ct)->help.ct_sane_info;
         /* Until there's been traffic both ways, don't look in packets. */
         if (ctinfo != IP_CT_ESTABLISHED &&
-            ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY)
+            ctinfo != IP_CT_ESTABLISHED_REPLY)
                 return NF_ACCEPT;
 
         /* Not a full tcp header? */
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index cb5a28581782..93faf6a3a637 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1423,7 +1423,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
         typeof(nf_nat_sip_seq_adjust_hook) nf_nat_sip_seq_adjust;
 
         if (ctinfo != IP_CT_ESTABLISHED &&
-            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)
+            ctinfo != IP_CT_ESTABLISHED_REPLY)
                 return NF_ACCEPT;
 
         /* No Data ? */
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 9cc46356b577..fe39f7e913df 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -143,9 +143,9 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
         ct = nf_ct_get(skb, &ctinfo);
         if (ct && !nf_ct_is_untracked(ct) &&
             ((iph->protocol != IPPROTO_ICMP &&
-              ctinfo == IP_CT_IS_REPLY + IP_CT_ESTABLISHED) ||
+              ctinfo == IP_CT_ESTABLISHED_REPLY) ||
              (iph->protocol == IPPROTO_ICMP &&
-              ctinfo == IP_CT_IS_REPLY + IP_CT_RELATED)) &&
+              ctinfo == IP_CT_RELATED_REPLY)) &&
             (ct->status & IPS_SRC_NAT_DONE)) {
 
                 daddr = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ba248d93399a..c0c3cda19712 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -804,6 +804,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                 } else {
                         h.h2->tp_vlan_tci = 0;
                 }
+                h.h2->tp_padding = 0;
                 hdrlen = sizeof(*h.h2);
                 break;
         default:
@@ -1736,6 +1737,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                 } else {
                         aux.tp_vlan_tci = 0;
                 }
+                aux.tp_padding = 0;
                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
         }
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index b1721d71c27c..b4c680900d7a 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -251,9 +251,8 @@ static void dev_watchdog(unsigned long arg)
                         }
 
                         if (some_queue_timedout) {
-                                char drivername[64];
                                 WARN_ONCE(1, KERN_INFO "NETDEV WATCHDOG: %s (%s): transmit queue %u timed out\n",
-                                       dev->name, netdev_drivername(dev, drivername, 64), i);
+                                       dev->name, netdev_drivername(dev), i);
                                 dev->netdev_ops->ndo_tx_timeout(dev);
                         }
                         if (!mod_timer(&dev->watchdog_timer,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 88a565f130a5..98fa8eb6cc4b 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3406,11 +3406,11 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         i = 0;
         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
-                        request->ssids[i].ssid_len = nla_len(attr);
-                        if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
+                        if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
                                 err = -EINVAL;
                                 goto out_free;
                         }
+                        request->ssids[i].ssid_len = nla_len(attr);
                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
                         i++;
                 }
@@ -3572,12 +3572,11 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
                                     tmp) {
-                        request->ssids[i].ssid_len = nla_len(attr);
-                        if (request->ssids[i].ssid_len >
-                            IEEE80211_MAX_SSID_LEN) {
+                        if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
                                 err = -EINVAL;
                                 goto out_free;
                         }
+                        request->ssids[i].ssid_len = nla_len(attr);
                         memcpy(request->ssids[i].ssid, nla_data(attr),
                                nla_len(attr));
                         i++;
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 47f1b8638df9..b11ea692bd7d 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -265,7 +265,7 @@ static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
                         bitnr = bitnr & 0x1F;
                         replay_esn->bmp[nr] |= (1U << bitnr);
                 } else {
-                        nr = replay_esn->replay_window >> 5;
+                        nr = (replay_esn->replay_window - 1) >> 5;
                         for (i = 0; i <= nr; i++)
                                 replay_esn->bmp[i] = 0;
 
@@ -471,7 +471,7 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
                         bitnr = bitnr & 0x1F;
                         replay_esn->bmp[nr] |= (1U << bitnr);
                 } else {
-                        nr = replay_esn->replay_window >> 5;
+                        nr = (replay_esn->replay_window - 1) >> 5;
                         for (i = 0; i <= nr; i++)
                                 replay_esn->bmp[i] = 0;