Merge branch 'x86/core' into cpus4096

author: Ingo Molnar <mingo@elte.hu> 2009-03-11 05:49:34 -0400
committer: Ingo Molnar <mingo@elte.hu> 2009-03-11 05:49:34 -0400
commit: d95c3578120e5bc4784069439f00ccb1b5f87717 (patch)
tree: c819de31de3983f3d69f223ede07667ff23bf7da /net
parent: ba1d755a36f66101aa88ac9ebb54694def6ec38d (diff)
parent: 78b020d035074fc3aa4d017353bb2c32e2aff56f (diff)
81 files changed, 1121 insertions, 559 deletions
diff --git a/net/802/tr.c b/net/802/tr.c
index 158150fee462..f47ae289d83b 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -668,3 +668,5 @@ module_init(rif_init);
 EXPORT_SYMBOL(tr_type_trans);
 EXPORT_SYMBOL(alloc_trdev);
+MODULE_LICENSE("GPL");
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 6c1323940263..2886d2fb9ab5 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -1,12 +1,16 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/if_vlan.h>
+#include <linux/netpoll.h>
 #include "vlan.h"
 /* VLAN rx hw acceleration helper.  This acts like netif_{rx,receive_skb}(). */
 int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                      u16 vlan_tci, int polling)
 {
+        if (netpoll_rx(skb))
+                return NET_RX_DROP;
        if (skb_bond_should_drop(skb))
                goto drop;
@@ -62,13 +66,13 @@ struct net_device *vlan_dev_real_dev(const struct net_device *dev)
 {
        return vlan_dev_info(dev)->real_dev;
 }
-EXPORT_SYMBOL_GPL(vlan_dev_real_dev);
+EXPORT_SYMBOL(vlan_dev_real_dev);
 u16 vlan_dev_vlan_id(const struct net_device *dev)
 {
        return vlan_dev_info(dev)->vlan_id;
 }
-EXPORT_SYMBOL_GPL(vlan_dev_vlan_id);
+EXPORT_SYMBOL(vlan_dev_vlan_id);
 static int vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
                           unsigned int vlan_tci, struct sk_buff *skb)
@@ -100,6 +104,9 @@ int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
 {
        int err = NET_RX_SUCCESS;
+        if (netpoll_receive_skb(skb))
+                return NET_RX_DROP;
        switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
        case -1:
                return netif_receive_skb(skb);
@@ -126,6 +133,9 @@ int vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
        if (!skb)
                goto out;
+        if (netpoll_receive_skb(skb))
+                goto out;
        err = NET_RX_SUCCESS;
        switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4a19acd3a32b..1b34135cf990 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -553,7 +553,7 @@ static int vlan_dev_neigh_setup(struct net_device *dev, struct neigh_parms *pa)
        int err = 0;
        if (netif_device_present(real_dev) && ops->ndo_neigh_setup)
-                err = ops->ndo_neigh_setup(dev, pa);
+                err = ops->ndo_neigh_setup(real_dev, pa);
        return err;
 }
@@ -639,6 +639,7 @@ static int vlan_dev_init(struct net_device *dev)
                dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
                dev->netdev_ops         = &vlan_netdev_ops;
        }
+        netdev_resync_ops(dev);
        if (is_vlan_dev(real_dev))
                subclass = 1;
diff --git a/net/9p/Kconfig b/net/9p/Kconfig
index 0663f99e977a..7ed75c7bd5d1 100644
--- a/net/9p/Kconfig
+++ b/net/9p/Kconfig
@@ -23,7 +23,7 @@ config NET_9P_VIRTIO
          guest partitions and a host partition.
 config NET_9P_RDMA
-        depends on INET && INFINIBAND && EXPERIMENTAL
+        depends on INET && INFINIBAND && INFINIBAND_ADDR_TRANS && EXPERIMENTAL
        tristate "9P RDMA Transport (Experimental)"
        help
          This builds support for an RDMA transport.
diff --git a/net/9p/client.c b/net/9p/client.c
index 821f1ec0b2c3..1eb580c38fbb 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -618,7 +618,7 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt)
                return ERR_PTR(-ENOMEM);
        ret = p9_idpool_get(clnt->fidpool);
-        if (fid->fid < 0) {
+        if (ret < 0) {
                ret = -ENOSPC;
                goto error;
        }
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index dcd7666824ba..fc70147c771e 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -29,6 +29,7 @@
 #include <linux/errno.h>
 #include <linux/uaccess.h>
 #include <linux/sched.h>
+#include <linux/types.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include "protocol.h"
@@ -160,29 +161,32 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                        break;
                case 'w':{
                                int16_t *val = va_arg(ap, int16_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le16 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                        errcode = -EFAULT;
                                        break;
                                }
-                                *val = cpu_to_le16(*val);
+                                *val = le16_to_cpu(le_val);
                        }
                        break;
                case 'd':{
                                int32_t *val = va_arg(ap, int32_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                        errcode = -EFAULT;
                                        break;
                                }
-                                *val = cpu_to_le32(*val);
+                                *val = le32_to_cpu(le_val);
                        }
                        break;
                case 'q':{
                                int64_t *val = va_arg(ap, int64_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le64 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                        errcode = -EFAULT;
                                        break;
                                }
-                                *val = cpu_to_le64(*val);
+                                *val = le64_to_cpu(le_val);
                        }
                        break;
                case 's':{
@@ -362,19 +366,19 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                        }
                        break;
                case 'w':{
-                                int16_t val = va_arg(ap, int);
+                                __le16 val = cpu_to_le16(va_arg(ap, int));
                                if (pdu_write(pdu, &val, sizeof(val)))
                                        errcode = -EFAULT;
                        }
                        break;
                case 'd':{
-                                int32_t val = va_arg(ap, int32_t);
+                                __le32 val = cpu_to_le32(va_arg(ap, int32_t));
                                if (pdu_write(pdu, &val, sizeof(val)))
                                        errcode = -EFAULT;
                        }
                        break;
                case 'q':{
-                                int64_t val = va_arg(ap, int64_t);
+                                __le64 val = cpu_to_le64(va_arg(ap, int64_t));
                                if (pdu_write(pdu, &val, sizeof(val)))
                                        errcode = -EFAULT;
                        }
diff --git a/net/Kconfig b/net/Kconfig
index bf2776018f71..cdb8fdef6c4a 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -24,14 +24,6 @@ if NET
 menu "Networking options"
-config NET_NS
-        bool "Network namespace support"
-        default n
-        depends on EXPERIMENTAL && NAMESPACES
-        help
-          Allow user space to create what appear to be multiple instances
-          of the network stack.
 config COMPAT_NET_DEV_OPS
       def_bool y
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index bdd9ccea17ce..d2c27c808d3b 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -67,6 +67,11 @@ static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
 {
        struct net_device *indev;
+        if (skb_warn_if_lro(skb)) {
+                kfree_skb(skb);
+                return;
+        }
        indev = skb->dev;
        skb->dev = to->dev;
        skb_forward_csum(skb);
@@ -89,7 +94,7 @@ void br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 /* called with rcu_read_lock */
 void br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
 {
-        if (!skb_warn_if_lro(skb) && should_deliver(to, skb)) {
+        if (should_deliver(to, skb)) {
                __br_forward(to, skb);
                return;
        }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index a65e43a17fbb..cf754ace0b75 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -58,11 +58,11 @@ static struct ctl_table_header *brnf_sysctl_header;
 static int brnf_call_iptables __read_mostly = 1;
 static int brnf_call_ip6tables __read_mostly = 1;
 static int brnf_call_arptables __read_mostly = 1;
-static int brnf_filter_vlan_tagged __read_mostly = 1;
+static int brnf_filter_vlan_tagged __read_mostly = 0;
-static int brnf_filter_pppoe_tagged __read_mostly = 1;
+static int brnf_filter_pppoe_tagged __read_mostly = 0;
 #else
-#define brnf_filter_vlan_tagged 1
+#define brnf_filter_vlan_tagged 0
-#define brnf_filter_pppoe_tagged 1
+#define brnf_filter_pppoe_tagged 0
 #endif
 static inline __be16 vlan_proto(const struct sk_buff *skb)
@@ -686,8 +686,11 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
        if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
            IS_PPPOE_IP(skb))
                pf = PF_INET;
-        else
+        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
+                 IS_PPPOE_IPV6(skb))
                pf = PF_INET6;
+        else
+                return NF_ACCEPT;
        nf_bridge_pull_encap_header(skb);
@@ -828,8 +831,11 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
        if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
            IS_PPPOE_IP(skb))
                pf = PF_INET;
-        else
+        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
+                 IS_PPPOE_IPV6(skb))
                pf = PF_INET6;
+        else
+                return NF_ACCEPT;
 #ifdef CONFIG_NETFILTER_DEBUG
        if (skb->dst == NULL) {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 8a8743d7d6e7..820252aee81f 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -79,7 +79,7 @@ static inline int ebt_do_match (struct ebt_entry_match *m,
 {
        par->match     = m->u.match;
        par->matchinfo = m->data;
-        return m->u.match->match(skb, par);
+        return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 }
 static inline int ebt_dev_check(char *entry, const struct net_device *device)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 1649c8ab2c2f..b7c7d4651136 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -347,51 +347,54 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
        struct bcm_op *op = (struct bcm_op *)data;
        struct bcm_msg_head msg_head;
-        /* create notification to user */
-        msg_head.opcode  = TX_EXPIRED;
-        msg_head.flags   = op->flags;
-        msg_head.count   = op->count;
-        msg_head.ival1   = op->ival1;
-        msg_head.ival2   = op->ival2;
-        msg_head.can_id  = op->can_id;
-        msg_head.nframes = 0;
-        bcm_send_to_user(op, &msg_head, NULL, 0);
-}
-/*
- * bcm_tx_timeout_handler - performes cyclic CAN frame transmissions
- */
-static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
-{
-        struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
-        enum hrtimer_restart ret = HRTIMER_NORESTART;
        if (op->kt_ival1.tv64 && (op->count > 0)) {
                op->count--;
-                if (!op->count && (op->flags & TX_COUNTEVT))
+                if (!op->count && (op->flags & TX_COUNTEVT)) {
-                        tasklet_schedule(&op->tsklet);
+                        /* create notification to user */
+                        msg_head.opcode  = TX_EXPIRED;
+                        msg_head.flags   = op->flags;
+                        msg_head.count   = op->count;
+                        msg_head.ival1   = op->ival1;
+                        msg_head.ival2   = op->ival2;
+                        msg_head.can_id  = op->can_id;
+                        msg_head.nframes = 0;
+                        bcm_send_to_user(op, &msg_head, NULL, 0);
+                }
        }
        if (op->kt_ival1.tv64 && (op->count > 0)) {
                /* send (next) frame */
                bcm_can_tx(op);
-                hrtimer_forward(hrtimer, ktime_get(), op->kt_ival1);
+                hrtimer_start(&op->timer,
-                ret = HRTIMER_RESTART;
+                              ktime_add(ktime_get(), op->kt_ival1),
+                              HRTIMER_MODE_ABS);
        } else {
                if (op->kt_ival2.tv64) {
                        /* send (next) frame */
                        bcm_can_tx(op);
-                        hrtimer_forward(hrtimer, ktime_get(), op->kt_ival2);
+                        hrtimer_start(&op->timer,
-                        ret = HRTIMER_RESTART;
+                                      ktime_add(ktime_get(), op->kt_ival2),
+                                      HRTIMER_MODE_ABS);
                }
        }
+}
-        return ret;
+/*
+ * bcm_tx_timeout_handler - performes cyclic CAN frame transmissions
+ */
+static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
+{
+        struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
+        tasklet_schedule(&op->tsklet);
+        return HRTIMER_NORESTART;
 }
 /*
diff --git a/net/core/dev.c b/net/core/dev.c
index b715a55cccc4..f1129706ce7b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1090,7 +1090,7 @@ int dev_open(struct net_device *dev)
                /*
                 *      Enable NET_DMA
                 */
-                dmaengine_get();
+                net_dmaengine_get();
                /*
                 *      Initialize multicasting status
@@ -1172,7 +1172,7 @@ int dev_close(struct net_device *dev)
        /*
         *      Shutdown NET_DMA
         */
-        dmaengine_put();
+        net_dmaengine_put();
        return 0;
 }
@@ -1534,7 +1534,19 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, int features)
        skb->mac_len = skb->network_header - skb->mac_header;
        __skb_pull(skb, skb->mac_len);
-        if (WARN_ON(skb->ip_summed != CHECKSUM_PARTIAL)) {
+        if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
+                struct net_device *dev = skb->dev;
+                struct ethtool_drvinfo info = {};
+                if (dev && dev->ethtool_ops && dev->ethtool_ops->get_drvinfo)
+                        dev->ethtool_ops->get_drvinfo(dev, &info);
+                WARN(1, "%s: caps=(0x%lx, 0x%lx) len=%d data_len=%d "
+                        "ip_summed=%d",
+                     info.driver, dev ? dev->features : 0L,
+                     skb->sk ? skb->sk->sk_route_caps : 0L,
+                     skb->len, skb->data_len, skb->ip_summed);
                if (skb_header_cloned(skb) &&
                    (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
                        return ERR_PTR(err);
@@ -2255,12 +2267,6 @@ int netif_receive_skb(struct sk_buff *skb)
        rcu_read_lock();
-        /* Don't receive packets in an exiting network namespace */
-        if (!net_alive(dev_net(skb->dev))) {
-                kfree_skb(skb);
-                goto out;
-        }
 #ifdef CONFIG_NET_CLS_ACT
        if (skb->tc_verd & TC_NCLS) {
                skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
@@ -2392,6 +2398,9 @@ int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
        if (!(skb->dev->features & NETIF_F_GRO))
                goto normal;
+        if (skb_is_gso(skb) || skb_shinfo(skb)->frag_list)
+                goto normal;
        rcu_read_lock();
        list_for_each_entry_rcu(ptype, head, list) {
                struct sk_buff *p;
@@ -2473,6 +2482,9 @@ static int __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 int napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
+        if (netpoll_receive_skb(skb))
+                return NET_RX_DROP;
        switch (__napi_gro_receive(napi, skb)) {
        case -1:
                return netif_receive_skb(skb);
@@ -2488,12 +2500,6 @@ EXPORT_SYMBOL(napi_gro_receive);
 void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 {
-        skb_shinfo(skb)->nr_frags = 0;
-        skb->len -= skb->data_len;
-        skb->truesize -= skb->data_len;
-        skb->data_len = 0;
        __skb_pull(skb, skb_headlen(skb));
        skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
@@ -2527,6 +2533,7 @@ struct sk_buff *napi_fraginfo_skb(struct napi_struct *napi,
        if (!pskb_may_pull(skb, ETH_HLEN)) {
                napi_reuse_skb(napi, skb);
+                skb = NULL;
                goto out;
        }
@@ -2548,6 +2555,9 @@ int napi_gro_frags(struct napi_struct *napi, struct napi_gro_fraginfo *info)
        if (!skb)
                goto out;
+        if (netpoll_receive_skb(skb))
+                goto out;
        err = NET_RX_SUCCESS;
        switch (__napi_gro_receive(napi, skb)) {
@@ -4272,6 +4282,39 @@ unsigned long netdev_fix_features(unsigned long features, const char *name)
 }
 EXPORT_SYMBOL(netdev_fix_features);
+/* Some devices need to (re-)set their netdev_ops inside
+ * ->init() or similar.  If that happens, we have to setup
+ * the compat pointers again.
+ */
+void netdev_resync_ops(struct net_device *dev)
+{
+#ifdef CONFIG_COMPAT_NET_DEV_OPS
+        const struct net_device_ops *ops = dev->netdev_ops;
+        dev->init = ops->ndo_init;
+        dev->uninit = ops->ndo_uninit;
+        dev->open = ops->ndo_open;
+        dev->change_rx_flags = ops->ndo_change_rx_flags;
+        dev->set_rx_mode = ops->ndo_set_rx_mode;
+        dev->set_multicast_list = ops->ndo_set_multicast_list;
+        dev->set_mac_address = ops->ndo_set_mac_address;
+        dev->validate_addr = ops->ndo_validate_addr;
+        dev->do_ioctl = ops->ndo_do_ioctl;
+        dev->set_config = ops->ndo_set_config;
+        dev->change_mtu = ops->ndo_change_mtu;
+        dev->neigh_setup = ops->ndo_neigh_setup;
+        dev->tx_timeout = ops->ndo_tx_timeout;
+        dev->get_stats = ops->ndo_get_stats;
+        dev->vlan_rx_register = ops->ndo_vlan_rx_register;
+        dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
+        dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        dev->poll_controller = ops->ndo_poll_controller;
+#endif
+#endif
+}
+EXPORT_SYMBOL(netdev_resync_ops);
 /**
 *      register_netdevice      - register a network device
 *      @dev: device to register
@@ -4316,27 +4359,7 @@ int register_netdevice(struct net_device *dev)
         * This is temporary until all network devices are converted.
         */
        if (dev->netdev_ops) {
-                const struct net_device_ops *ops = dev->netdev_ops;
+                netdev_resync_ops(dev);
-                dev->init = ops->ndo_init;
-                dev->uninit = ops->ndo_uninit;
-                dev->open = ops->ndo_open;
-                dev->change_rx_flags = ops->ndo_change_rx_flags;
-                dev->set_rx_mode = ops->ndo_set_rx_mode;
-                dev->set_multicast_list = ops->ndo_set_multicast_list;
-                dev->set_mac_address = ops->ndo_set_mac_address;
-                dev->validate_addr = ops->ndo_validate_addr;
-                dev->do_ioctl = ops->ndo_do_ioctl;
-                dev->set_config = ops->ndo_set_config;
-                dev->change_mtu = ops->ndo_change_mtu;
-                dev->tx_timeout = ops->ndo_tx_timeout;
-                dev->get_stats = ops->ndo_get_stats;
-                dev->vlan_rx_register = ops->ndo_vlan_rx_register;
-                dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
-                dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-                dev->poll_controller = ops->ndo_poll_controller;
-#endif
        } else {
                char drivername[64];
                pr_info("%s (%s): not using net_device_ops yet\n",
@@ -4434,6 +4457,45 @@ err_uninit:
 }
 /**
+ *      init_dummy_netdev       - init a dummy network device for NAPI
+ *      @dev: device to init
+ *
+ *      This takes a network device structure and initialize the minimum
+ *      amount of fields so it can be used to schedule NAPI polls without
+ *      registering a full blown interface. This is to be used by drivers
+ *      that need to tie several hardware interfaces to a single NAPI
+ *      poll scheduler due to HW limitations.
+ */
+int init_dummy_netdev(struct net_device *dev)
+{
+        /* Clear everything. Note we don't initialize spinlocks
+         * are they aren't supposed to be taken by any of the
+         * NAPI code and this dummy netdev is supposed to be
+         * only ever used for NAPI polls
+         */
+        memset(dev, 0, sizeof(struct net_device));
+        /* make sure we BUG if trying to hit standard
+         * register/unregister code path
+         */
+        dev->reg_state = NETREG_DUMMY;
+        /* initialize the ref count */
+        atomic_set(&dev->refcnt, 1);
+        /* NAPI wants this */
+        INIT_LIST_HEAD(&dev->napi_list);
+        /* a dummy interface is started by default */
+        set_bit(__LINK_STATE_PRESENT, &dev->state);
+        set_bit(__LINK_STATE_START, &dev->state);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(init_dummy_netdev);
+/**
 *      register_netdev - register a network device
 *      @dev: device to register
 *
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f66c58df8953..278a142d1047 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1994,8 +1994,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                        if (!net_eq(neigh_parms_net(p), net))
                                continue;
-                        if (nidx++ < neigh_skip)
+                        if (nidx < neigh_skip)
-                                continue;
+                                goto next;
                        if (neightbl_fill_param_info(skb, tbl, p,
                                                     NETLINK_CB(cb->skb).pid,
@@ -2003,6 +2003,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                                                     RTM_NEWNEIGHTBL,
                                                     NLM_F_MULTI) <= 0)
                                goto out;
+                next:
+                        nidx++;
                }
                neigh_skip = 0;
@@ -2082,12 +2084,10 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                if (h > s_h)
                        s_idx = 0;
                for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next) {
-                        int lidx;
                        if (dev_net(n->dev) != net)
                                continue;
-                        lidx = idx++;
+                        if (idx < s_idx)
-                        if (lidx < s_idx)
+                                goto next;
-                                continue;
                        if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
                                            cb->nlh->nlmsg_seq,
                                            RTM_NEWNEIGH,
@@ -2096,6 +2096,8 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                                rc = -1;
                                goto out;
                        }
+                next:
+                        idx++;
                }
        }
        read_unlock_bh(&tbl->lock);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 6ac29a46e23e..484f58750eba 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -77,7 +77,9 @@ static ssize_t netdev_store(struct device *dev, struct device_attribute *attr,
        if (endp == buf)
                goto err;
-        rtnl_lock();
+        if (!rtnl_trylock())
+                return -ERESTARTSYS;
        if (dev_isalive(net)) {
                if ((ret = (*set)(net, new)) == 0)
                        ret = len;
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 55cffad2f328..e3bebd36f053 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -32,24 +32,14 @@ static __net_init int setup_net(struct net *net)
 {
        /* Must be called with net_mutex held */
        struct pernet_operations *ops;
-        int error;
+        int error = 0;
-        struct net_generic *ng;
        atomic_set(&net->count, 1);
 #ifdef NETNS_REFCNT_DEBUG
        atomic_set(&net->use_count, 0);
 #endif
-        error = -ENOMEM;
-        ng = kzalloc(sizeof(struct net_generic) +
-                        INITIAL_NET_GEN_PTRS * sizeof(void *), GFP_KERNEL);
-        if (ng == NULL)
-                goto out;
-        ng->len = INITIAL_NET_GEN_PTRS;
-        rcu_assign_pointer(net->gen, ng);
-        error = 0;
        list_for_each_entry(ops, &pernet_list, list) {
                if (ops->init) {
                        error = ops->init(net);
@@ -70,24 +60,50 @@ out_undo:
        }
        rcu_barrier();
-        kfree(ng);
        goto out;
 }
+static struct net_generic *net_alloc_generic(void)
+{
+        struct net_generic *ng;
+        size_t generic_size = sizeof(struct net_generic) +
+                INITIAL_NET_GEN_PTRS * sizeof(void *);
+        ng = kzalloc(generic_size, GFP_KERNEL);
+        if (ng)
+                ng->len = INITIAL_NET_GEN_PTRS;
+        return ng;
+}
 #ifdef CONFIG_NET_NS
 static struct kmem_cache *net_cachep;
 static struct workqueue_struct *netns_wq;
 static struct net *net_alloc(void)
 {
-        return kmem_cache_zalloc(net_cachep, GFP_KERNEL);
+        struct net *net = NULL;
+        struct net_generic *ng;
+        ng = net_alloc_generic();
+        if (!ng)
+                goto out;
+        net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
+        if (!net)
+                goto out_free;
+        rcu_assign_pointer(net->gen, ng);
+out:
+        return net;
+out_free:
+        kfree(ng);
+        goto out;
 }
 static void net_free(struct net *net)
 {
-        if (!net)
-                return;
 #ifdef NETNS_REFCNT_DEBUG
        if (unlikely(atomic_read(&net->use_count) != 0)) {
                printk(KERN_EMERG "network namespace not free! Usage: %d\n",
@@ -112,27 +128,28 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
        err = -ENOMEM;
        new_net = net_alloc();
        if (!new_net)
-                goto out;
+                goto out_err;
        mutex_lock(&net_mutex);
        err = setup_net(new_net);
-        if (err)
+        if (!err) {
-                goto out_unlock;
+                rtnl_lock();
+                list_add_tail(&new_net->list, &net_namespace_list);
-        rtnl_lock();
+                rtnl_unlock();
-        list_add_tail(&new_net->list, &net_namespace_list);
+        }
-        rtnl_unlock();
-out_unlock:
        mutex_unlock(&net_mutex);
+        if (err)
+                goto out_free;
 out:
        put_net(old_net);
-        if (err) {
-                net_free(new_net);
-                new_net = ERR_PTR(err);
-        }
        return new_net;
+out_free:
+        net_free(new_net);
+out_err:
+        new_net = ERR_PTR(err);
+        goto out;
 }
 static void cleanup_net(struct work_struct *work)
@@ -140,9 +157,6 @@ static void cleanup_net(struct work_struct *work)
        struct pernet_operations *ops;
        struct net *net;
-        /* Be very certain incoming network packets will not find us */
-        rcu_barrier();
        net = container_of(work, struct net, work);
        mutex_lock(&net_mutex);
@@ -188,6 +202,7 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
 static int __init net_ns_init(void)
 {
+        struct net_generic *ng;
        int err;
        printk(KERN_INFO "net_namespace: %zd bytes\n", sizeof(struct net));
@@ -202,6 +217,12 @@ static int __init net_ns_init(void)
                panic("Could not create netns workq");
 #endif
+        ng = net_alloc_generic();
+        if (!ng)
+                panic("Could not allocate generic netns");
+        rcu_assign_pointer(init_net.gen, ng);
        mutex_lock(&net_mutex);
        err = setup_net(&init_net);
@@ -341,8 +362,8 @@ again:
        rv = register_pernet_operations(first_device, ops);
        if (rv < 0)
                ida_remove(&net_generic_ids, *id);
-        mutex_unlock(&net_mutex);
 out:
+        mutex_unlock(&net_mutex);
        return rv;
 }
 EXPORT_SYMBOL_GPL(register_pernet_gen_subsys);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5110b359c758..c6a6b166f8d6 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -73,17 +73,13 @@ static struct kmem_cache *skbuff_fclone_cache __read_mostly;
 static void sock_pipe_buf_release(struct pipe_inode_info *pipe,
                                  struct pipe_buffer *buf)
 {
-        struct sk_buff *skb = (struct sk_buff *) buf->private;
+        put_page(buf->page);
-        kfree_skb(skb);
 }
 static void sock_pipe_buf_get(struct pipe_inode_info *pipe,
                                struct pipe_buffer *buf)
 {
-        struct sk_buff *skb = (struct sk_buff *) buf->private;
+        get_page(buf->page);
-        skb_get(skb);
 }
 static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
@@ -147,14 +143,6 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
        BUG();
 }
-void skb_truesize_bug(struct sk_buff *skb)
-{
-        WARN(net_ratelimit(), KERN_ERR "SKB BUG: Invalid truesize (%u) "
-               "len=%u, sizeof(sk_buff)=%Zd\n",
-               skb->truesize, skb->len, sizeof(struct sk_buff));
-}
-EXPORT_SYMBOL(skb_truesize_bug);
 /*      Allocate a new skbuff. We do this ourselves so we can fill in a few
 *      'private' fields and also do memory statistics to find all the
 *      [BEEP] leaks.
@@ -1334,9 +1322,19 @@ fault:
 */
 static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
 {
-        struct sk_buff *skb = (struct sk_buff *) spd->partial[i].private;
+        put_page(spd->pages[i]);
+}
-        kfree_skb(skb);
+static inline struct page *linear_to_page(struct page *page, unsigned int len,
+                                          unsigned int offset)
+{
+        struct page *p = alloc_pages(GFP_KERNEL, 0);
+        if (!p)
+                return NULL;
+        memcpy(page_address(p) + offset, page_address(page) + offset, len);
+        return p;
 }
 /*
@@ -1344,16 +1342,23 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
 */
 static inline int spd_fill_page(struct splice_pipe_desc *spd, struct page *page,
                                unsigned int len, unsigned int offset,
-                                struct sk_buff *skb)
+                                struct sk_buff *skb, int linear)
 {
        if (unlikely(spd->nr_pages == PIPE_BUFFERS))
                return 1;
+        if (linear) {
+                page = linear_to_page(page, len, offset);
+                if (!page)
+                        return 1;
+        } else
+                get_page(page);
        spd->pages[spd->nr_pages] = page;
        spd->partial[spd->nr_pages].len = len;
        spd->partial[spd->nr_pages].offset = offset;
-        spd->partial[spd->nr_pages].private = (unsigned long) skb_get(skb);
        spd->nr_pages++;
        return 0;
 }
@@ -1369,7 +1374,7 @@ static inline void __segment_seek(struct page **page, unsigned int *poff,
 static inline int __splice_segment(struct page *page, unsigned int poff,
                                   unsigned int plen, unsigned int *off,
                                   unsigned int *len, struct sk_buff *skb,
-                                   struct splice_pipe_desc *spd)
+                                   struct splice_pipe_desc *spd, int linear)
 {
        if (!*len)
                return 1;
@@ -1392,7 +1397,7 @@ static inline int __splice_segment(struct page *page, unsigned int poff,
                /* the linear region may spread across several pages  */
                flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
-                if (spd_fill_page(spd, page, flen, poff, skb))
+                if (spd_fill_page(spd, page, flen, poff, skb, linear))
                        return 1;
                __segment_seek(&page, &poff, &plen, flen);
@@ -1419,7 +1424,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
        if (__splice_segment(virt_to_page(skb->data),
                             (unsigned long) skb->data & (PAGE_SIZE - 1),
                             skb_headlen(skb),
-                             offset, len, skb, spd))
+                             offset, len, skb, spd, 1))
                return 1;
        /*
@@ -1429,7 +1434,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
                const skb_frag_t *f = &skb_shinfo(skb)->frags[seg];
                if (__splice_segment(f->page, f->page_offset, f->size,
-                                     offset, len, skb, spd))
+                                     offset, len, skb, spd, 0))
                        return 1;
        }
@@ -1442,7 +1447,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
 * the frag list, if such a thing exists. We'd probably need to recurse to
 * handle that cleanly.
 */
-int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
+int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
                    struct pipe_inode_info *pipe, unsigned int tlen,
                    unsigned int flags)
 {
@@ -1455,16 +1460,6 @@ int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
                .ops = &sock_pipe_buf_ops,
                .spd_release = sock_spd_release,
        };
-        struct sk_buff *skb;
-        /*
-         * I'd love to avoid the clone here, but tcp_read_sock()
-         * ignores reference counts and unconditonally kills the sk_buff
-         * on return from the actor.
-         */
-        skb = skb_clone(__skb, GFP_KERNEL);
-        if (unlikely(!skb))
-                return -ENOMEM;
        /*
         * __skb_splice_bits() only fails if the output has no room left,
@@ -1488,15 +1483,9 @@ int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
        }
 done:
-        /*
-         * drop our reference to the clone, the pipe consumption will
-         * drop the rest.
-         */
-        kfree_skb(skb);
        if (spd.nr_pages) {
+                struct sock *sk = skb->sk;
                int ret;
-                struct sock *sk = __skb->sk;
                /*
                 * Drop the socket lock, otherwise we have reverse
@@ -2215,10 +2204,10 @@ unsigned int skb_seq_read(unsigned int consumed, const u8 **data,
                return 0;
 next_skb:
-        block_limit = skb_headlen(st->cur_skb);
+        block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
        if (abs_offset < block_limit) {
-                *data = st->cur_skb->data + abs_offset;
+                *data = st->cur_skb->data + (abs_offset - st->stepped_offset);
                return block_limit - abs_offset;
        }
@@ -2253,13 +2242,14 @@ next_skb:
                st->frag_data = NULL;
        }
-        if (st->cur_skb->next) {
+        if (st->root_skb == st->cur_skb &&
-                st->cur_skb = st->cur_skb->next;
+            skb_shinfo(st->root_skb)->frag_list) {
+                st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
                st->frag_idx = 0;
                goto next_skb;
-        } else if (st->root_skb == st->cur_skb &&
+        } else if (st->cur_skb->next) {
-                   skb_shinfo(st->root_skb)->frag_list) {
+                st->cur_skb = st->cur_skb->next;
-                st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
+                st->frag_idx = 0;
                goto next_skb;
        }
@@ -2588,8 +2578,9 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
        struct sk_buff *nskb;
        unsigned int headroom;
        unsigned int hlen = p->data - skb_mac_header(p);
+        unsigned int len = skb->len;
-        if (hlen + p->len + skb->len >= 65536)
+        if (hlen + p->len + len >= 65536)
                return -E2BIG;
        if (skb_shinfo(p)->frag_list)
@@ -2602,6 +2593,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
                       skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
                skb_shinfo(p)->nr_frags += skb_shinfo(skb)->nr_frags;
+                skb_shinfo(skb)->nr_frags = 0;
+                skb->truesize -= skb->data_len;
+                skb->len -= skb->data_len;
+                skb->data_len = 0;
                NAPI_GRO_CB(skb)->free = 1;
                goto done;
        }
@@ -2645,9 +2642,9 @@ merge:
 done:
        NAPI_GRO_CB(p)->count++;
-        p->data_len += skb->len;
+        p->data_len += len;
-        p->truesize += skb->len;
+        p->truesize += len;
-        p->len += skb->len;
+        p->len += len;
        NAPI_GRO_CB(skb)->same_flow = 1;
        return 0;
diff --git a/net/core/sock.c b/net/core/sock.c
index f3a0d08cbb48..5f97caa158e8 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -696,6 +696,8 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
        if (len < 0)
                return -EINVAL;
+        memset(&v, 0, sizeof(v));
        switch(optname) {
        case SO_DEBUG:
                v.val = sock_flag(sk, SOCK_DBG);
@@ -1135,7 +1137,6 @@ void sock_rfree(struct sk_buff *skb)
 {
        struct sock *sk = skb->sk;
-        skb_truesize_check(skb);
        atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
        sk_mem_uncharge(skb->sk, skb->truesize);
 }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 743f5542d65a..3a3dad801354 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1375,10 +1375,10 @@ EXPORT_SYMBOL_GPL(snmp_fold_field);
 int snmp_mib_init(void *ptr[2], size_t mibsize)
 {
        BUG_ON(ptr == NULL);
-        ptr[0] = __alloc_percpu(mibsize);
+        ptr[0] = __alloc_percpu(mibsize, __alignof__(unsigned long long));
        if (!ptr[0])
                goto err0;
-        ptr[1] = __alloc_percpu(mibsize);
+        ptr[1] = __alloc_percpu(mibsize, __alignof__(unsigned long long));
        if (!ptr[1])
                goto err1;
        return 0;
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 6bb2635b5ded..7bc992976d29 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -3,11 +3,16 @@
 *
 * This is an implementation of the CIPSO 2.2 protocol as specified in
 * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
- * FIPS-188, copies of both documents can be found in the Documentation
+ * FIPS-188.  While CIPSO never became a full IETF RFC standard many vendors
- * directory.  While CIPSO never became a full IETF RFC standard many vendors
 * have chosen to adopt the protocol and over the years it has become a
 * de-facto standard for labeled networking.
 *
+ * The CIPSO draft specification can be found in the kernel's Documentation
+ * directory as well as the following URL:
+ *   http://netlabel.sourceforge.net/files/draft-ietf-cipso-ipsecurity-01.txt
+ * The FIPS-188 specification can be found at the following URL:
+ *   http://www.itl.nist.gov/fipspubs/fip188.htm
+ *
 * Author: Paul Moore <paul.moore@hp.com>
 *
 */
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 705b33b184a3..fc562d29cc46 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1205,7 +1205,7 @@ static struct pernet_operations __net_initdata icmp_sk_ops = {
 int __init icmp_init(void)
 {
-        return register_pernet_device(&icmp_sk_ops);
+        return register_pernet_subsys(&icmp_sk_ops);
 }
 EXPORT_SYMBOL(icmp_err_convert);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 42a0f3dd3fd6..d722013c1cae 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1268,6 +1268,9 @@ __be32 __init root_nfs_parse_addr(char *name)
 static int __init ip_auto_config(void)
 {
        __be32 addr;
+#ifdef IPCONFIG_DYNAMIC
+        int retries = CONF_OPEN_RETRIES;
+#endif
 #ifdef CONFIG_PROC_FS
        proc_net_fops_create(&init_net, "pnp", S_IRUGO, &pnp_seq_fops);
@@ -1304,9 +1307,6 @@ static int __init ip_auto_config(void)
 #endif
            ic_first_dev->next) {
 #ifdef IPCONFIG_DYNAMIC
-                int retries = CONF_OPEN_RETRIES;
                if (ic_dynamic() < 0) {
                        ic_close_devs();
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index c9224310ebae..52cb6939d093 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -93,13 +93,8 @@ ipt_local_out_hook(unsigned int hook,
 {
        /* root is playing with raw sockets. */
        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr)) {
+            ip_hdrlen(skb) < sizeof(struct iphdr))
-                if (net_ratelimit())
-                        printk("iptable_filter: ignoring short SOCK_RAW "
-                               "packet.\n");
                return NF_ACCEPT;
-        }
        return ipt_do_table(skb, hook, in, out,
                            dev_net(out)->ipv4.iptable_filter);
 }
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 69f2c4287146..3929d20b9e45 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -132,12 +132,8 @@ ipt_local_hook(unsigned int hook,
        /* root is playing with raw sockets. */
        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
+            || ip_hdrlen(skb) < sizeof(struct iphdr))
-                if (net_ratelimit())
-                        printk("iptable_mangle: ignoring short SOCK_RAW "
-                               "packet.\n");
                return NF_ACCEPT;
-        }
        /* Save things which could affect route */
        mark = skb->mark;
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 8faebfe638f1..7f65d18333e3 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -65,12 +65,8 @@ ipt_local_hook(unsigned int hook,
 {
        /* root is playing with raw sockets. */
        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr)) {
+            ip_hdrlen(skb) < sizeof(struct iphdr))
-                if (net_ratelimit())
-                        printk("iptable_raw: ignoring short SOCK_RAW "
-                               "packet.\n");
                return NF_ACCEPT;
-        }
        return ipt_do_table(skb, hook, in, out,
                            dev_net(out)->ipv4.iptable_raw);
 }
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 36f3be3cc428..a52a35f4a584 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -96,12 +96,8 @@ ipt_local_out_hook(unsigned int hook,
 {
        /* Somebody is playing with raw sockets. */
        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
+            || ip_hdrlen(skb) < sizeof(struct iphdr))
-                if (net_ratelimit())
-                        printk(KERN_INFO "iptable_security: ignoring short "
-                               "SOCK_RAW packet.\n");
                return NF_ACCEPT;
-        }
        return ipt_do_table(skb, hook, in, out,
                            dev_net(out)->ipv4.iptable_security);
 }
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index b2141e11575e..4beb04fac588 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -145,11 +145,8 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum,
 {
        /* root is playing with raw sockets. */
        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr)) {
+            ip_hdrlen(skb) < sizeof(struct iphdr))
-                if (net_ratelimit())
-                        printk("ipt_hook: happy cracking.\n");
                return NF_ACCEPT;
-        }
        return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
 }
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 1fd3ef7718b6..2a8bee26f43d 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -20,7 +20,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_log.h>
-static unsigned long nf_ct_icmp_timeout __read_mostly = 30*HZ;
+static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ;
 static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
                              struct nf_conntrack_tuple *tuple)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 97f71153584f..bf895401218f 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3376,7 +3376,7 @@ int __init ip_rt_init(void)
        int rc = 0;
 #ifdef CONFIG_NET_CLS_ROUTE
-        ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct));
+        ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
        if (!ip_rt_acct)
                panic("IP: failed to allocate ip_rt_acct\n");
 #endif
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ce572f9dff02..76b148bcb0dc 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -522,8 +522,13 @@ static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
                                unsigned int offset, size_t len)
 {
        struct tcp_splice_state *tss = rd_desc->arg.data;
+        int ret;
-        return skb_splice_bits(skb, offset, tss->pipe, tss->len, tss->flags);
+        ret = skb_splice_bits(skb, offset, tss->pipe, min(rd_desc->count, len),
+                              tss->flags);
+        if (ret > 0)
+                rd_desc->count -= ret;
+        return ret;
 }
 static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
@@ -531,6 +536,7 @@ static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
        /* Store TCP splice context information in read_descriptor_t. */
        read_descriptor_t rd_desc = {
                .arg.data = tss,
+                .count    = tss->len,
        };
        return tcp_read_sock(sk, &rd_desc, tcp_splice_data_recv);
@@ -611,11 +617,13 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
                tss.len -= ret;
                spliced += ret;
+                if (!timeo)
+                        break;
                release_sock(sk);
                lock_sock(sk);
                if (sk->sk_err || sk->sk_state == TCP_CLOSE ||
-                    (sk->sk_shutdown & RCV_SHUTDOWN) || !timeo ||
+                    (sk->sk_shutdown & RCV_SHUTDOWN) ||
                    signal_pending(current))
                        break;
        }
@@ -2382,7 +2390,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
        unsigned int seq;
        __be32 delta;
        unsigned int oldlen;
-        unsigned int len;
+        unsigned int mss;
        if (!pskb_may_pull(skb, sizeof(*th)))
                goto out;
@@ -2398,10 +2406,13 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
        oldlen = (u16)~skb->len;
        __skb_pull(skb, thlen);
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
                /* Packet is from an untrusted source, reset gso_segs. */
                int type = skb_shinfo(skb)->gso_type;
-                int mss;
                if (unlikely(type &
                             ~(SKB_GSO_TCPV4 |
@@ -2412,7 +2423,6 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                             !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))
                        goto out;
-                mss = skb_shinfo(skb)->gso_size;
                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
                segs = NULL;
@@ -2423,8 +2433,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
        if (IS_ERR(segs))
                goto out;
-        len = skb_shinfo(skb)->gso_size;
+        delta = htonl(oldlen + (thlen + mss));
-        delta = htonl(oldlen + (thlen + len));
        skb = segs;
        th = tcp_hdr(skb);
@@ -2440,7 +2449,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                             csum_fold(csum_partial(skb_transport_header(skb),
                                                    thlen, skb->csum));
-                seq += len;
+                seq += mss;
                skb = skb->next;
                th = tcp_hdr(skb);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a6961d75c7ea..c28976a7e596 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1374,7 +1374,8 @@ static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
 static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                           struct tcp_sacktag_state *state,
-                           unsigned int pcount, int shifted, int mss)
+                           unsigned int pcount, int shifted, int mss,
+                           int dup_sack)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
@@ -1410,7 +1411,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
        }
        /* We discard results */
-        tcp_sacktag_one(skb, sk, state, 0, pcount);
+        tcp_sacktag_one(skb, sk, state, dup_sack, pcount);
        /* Difference in this won't matter, both ACKed by the same cumul. ACK */
        TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
@@ -1561,7 +1562,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
        if (!skb_shift(prev, skb, len))
                goto fallback;
-        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss))
+        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
                goto out;
        /* Hole filled allows collapsing with the next as well, this is very
@@ -1580,7 +1581,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
        len = skb->len;
        if (skb_shift(prev, skb, len)) {
                pcount += tcp_skb_pcount(skb);
-                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss);
+                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss, 0);
        }
 out:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 19d7b429a262..cf74c416831a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2443,7 +2443,7 @@ static struct pernet_operations __net_initdata tcp_sk_ops = {
 void __init tcp_v4_init(void)
 {
        inet_hashinfo_init(&tcp_hashinfo);
-        if (register_pernet_device(&tcp_sk_ops))
+        if (register_pernet_subsys(&tcp_sk_ops))
                panic("Failed to create the TCP control socket.\n");
 }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 557fe16cbfb0..da2c3b8794f2 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -663,14 +663,10 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
        th->urg_ptr             = 0;
        /* The urg_mode check is necessary during a below snd_una win probe */
-        if (unlikely(tcp_urg_mode(tp))) {
+        if (unlikely(tcp_urg_mode(tp) &&
-                if (between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF)) {
+                     between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF))) {
-                        th->urg_ptr = htons(tp->snd_up - tcb->seq);
+                th->urg_ptr             = htons(tp->snd_up - tcb->seq);
-                        th->urg = 1;
+                th->urg                 = 1;
-                } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
-                        th->urg_ptr = 0xFFFF;
-                        th->urg = 1;
-                }
        }
        tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
@@ -2027,7 +2023,6 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
                last_lost = tp->snd_una;
        }
-        /* First pass: retransmit lost packets. */
        tcp_for_write_queue_from(skb, sk) {
                __u8 sacked = TCP_SKB_CB(skb)->sacked;
diff --git a/net/ipv4/tcp_scalable.c b/net/ipv4/tcp_scalable.c
index 2747ec7bfb63..4660b088a8ce 100644
--- a/net/ipv4/tcp_scalable.c
+++ b/net/ipv4/tcp_scalable.c
@@ -1,6 +1,6 @@
 /* Tom Kelly's Scalable TCP
 *
- * See htt://www-lce.eng.cam.ac.uk/~ctk21/scalable/
+ * See http://www.deneholme.net/tom/scalable/
 *
 * John Heffner <jheffner@sc.edu>
 */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cf5ab0581eba..c47c989cb1fb 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -120,8 +120,11 @@ EXPORT_SYMBOL(sysctl_udp_wmem_min);
 atomic_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
+#define PORTS_PER_CHAIN (65536 / UDP_HTABLE_SIZE)
 static int udp_lib_lport_inuse(struct net *net, __u16 num,
                               const struct udp_hslot *hslot,
+                               unsigned long *bitmap,
                               struct sock *sk,
                               int (*saddr_comp)(const struct sock *sk1,
                                                 const struct sock *sk2))
@@ -132,12 +135,17 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
        sk_nulls_for_each(sk2, node, &hslot->head)
                if (net_eq(sock_net(sk2), net)                  &&
                    sk2 != sk                                   &&
-                    sk2->sk_hash == num                         &&
+                    (bitmap || sk2->sk_hash == num)             &&
                    (!sk2->sk_reuse || !sk->sk_reuse)           &&
                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
                        || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
-                    (*saddr_comp)(sk, sk2))
+                    (*saddr_comp)(sk, sk2)) {
-                        return 1;
+                        if (bitmap)
+                                __set_bit(sk2->sk_hash / UDP_HTABLE_SIZE,
+                                          bitmap);
+                        else
+                                return 1;
+                }
        return 0;
 }
@@ -160,32 +168,47 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
        if (!snum) {
                int low, high, remaining;
                unsigned rand;
-                unsigned short first;
+                unsigned short first, last;
+                DECLARE_BITMAP(bitmap, PORTS_PER_CHAIN);
                inet_get_local_port_range(&low, &high);
                remaining = (high - low) + 1;
                rand = net_random();
-                snum = first = rand % remaining + low;
+                first = (((u64)rand * remaining) >> 32) + low;
-                rand |= 1;
+                /*
-                for (;;) {
+                 * force rand to be an odd multiple of UDP_HTABLE_SIZE
-                        hslot = &udptable->hash[udp_hashfn(net, snum)];
+                 */
+                rand = (rand | 1) * UDP_HTABLE_SIZE;
+                for (last = first + UDP_HTABLE_SIZE; first != last; first++) {
+                        hslot = &udptable->hash[udp_hashfn(net, first)];
+                        bitmap_zero(bitmap, PORTS_PER_CHAIN);
                        spin_lock_bh(&hslot->lock);
-                        if (!udp_lib_lport_inuse(net, snum, hslot, sk, saddr_comp))
+                        udp_lib_lport_inuse(net, snum, hslot, bitmap, sk,
-                                break;
+                                            saddr_comp);
-                        spin_unlock_bh(&hslot->lock);
+                        snum = first;
+                        /*
+                         * Iterate on all possible values of snum for this hash.
+                         * Using steps of an odd multiple of UDP_HTABLE_SIZE
+                         * give us randomization and full range coverage.
+                         */
                        do {
-                                snum = snum + rand;
+                                if (low <= snum && snum <= high &&
-                        } while (snum < low || snum > high);
+                                    !test_bit(snum / UDP_HTABLE_SIZE, bitmap))
-                        if (snum == first)
+                                        goto found;
-                                goto fail;
+                                snum += rand;
+                        } while (snum != first);
+                        spin_unlock_bh(&hslot->lock);
                }
+                goto fail;
        } else {
                hslot = &udptable->hash[udp_hashfn(net, snum)];
                spin_lock_bh(&hslot->lock);
-                if (udp_lib_lport_inuse(net, snum, hslot, sk, saddr_comp))
+                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk, saddr_comp))
                        goto fail_unlock;
        }
+found:
        inet_sk(sk)->num = snum;
        sk->sk_hash = snum;
        if (sk_unhashed(sk)) {
@@ -992,9 +1015,11 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM)
+                if (rc == -ENOMEM) {
                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
                                         is_udplite);
+                        atomic_inc(&sk->sk_drops);
+                }
                goto drop;
        }
@@ -1206,11 +1231,10 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                   int proto)
 {
        struct sock *sk;
-        struct udphdr *uh = udp_hdr(skb);
+        struct udphdr *uh;
        unsigned short ulen;
        struct rtable *rt = (struct rtable*)skb->dst;
-        __be32 saddr = ip_hdr(skb)->saddr;
+        __be32 saddr, daddr;
-        __be32 daddr = ip_hdr(skb)->daddr;
        struct net *net = dev_net(skb->dev);
        /*
@@ -1219,6 +1243,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                goto drop;              /* No space for header. */
+        uh   = udp_hdr(skb);
        ulen = ntohs(uh->len);
        if (ulen > skb->len)
                goto short_packet;
@@ -1233,6 +1258,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        if (udp4_csum_init(skb, uh, proto))
                goto csum_error;
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
        if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                return __udp4_lib_mcast_deliver(net, skb, uh,
                                saddr, daddr, udptable);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e92ad8455c63..1220e2c7831e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -493,15 +493,17 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
        read_unlock(&dev_base_lock);
 }
-static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
+static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 {
        struct net *net;
        net = (struct net *)table->extra2;
        if (p == &net->ipv6.devconf_dflt->forwarding)
-                return;
+                return 0;
+        if (!rtnl_trylock())
+                return -ERESTARTSYS;
-        rtnl_lock();
        if (p == &net->ipv6.devconf_all->forwarding) {
                __s32 newf = net->ipv6.devconf_all->forwarding;
                net->ipv6.devconf_dflt->forwarding = newf;
@@ -512,6 +514,7 @@ static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
        if (*p)
                rt6_purge_dflt_routers(net);
+        return 1;
 }
 #endif
@@ -2608,9 +2611,6 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        ASSERT_RTNL();
-        if ((dev->flags & IFF_LOOPBACK) && how == 1)
-                how = 0;
        rt6_ifdown(net, dev);
        neigh_ifdown(&nd_tbl, dev);
@@ -3983,7 +3983,7 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
        ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
        if (write)
-                addrconf_fixup_forwarding(ctl, valp, val);
+                ret = addrconf_fixup_forwarding(ctl, valp, val);
        return ret;
 }
@@ -4019,8 +4019,7 @@ static int addrconf_sysctl_forward_strategy(ctl_table *table,
        }
        *valp = new;
-        addrconf_fixup_forwarding(table, valp, val);
+        return addrconf_fixup_forwarding(table, valp, val);
-        return 1;
 }
 static struct addrconf_sysctl_table
@@ -4250,7 +4249,7 @@ static struct addrconf_sysctl_table
                        .procname       =       "mc_forwarding",
                        .data           =       &ipv6_devconf.mc_forwarding,
                        .maxlen         =       sizeof(int),
-                        .mode           =       0644,
+                        .mode           =       0444,
                        .proc_handler   =       proc_dointvec,
                },
 #endif
@@ -4446,25 +4445,6 @@ int unregister_inet6addr_notifier(struct notifier_block *nb)
 EXPORT_SYMBOL(unregister_inet6addr_notifier);
-static void addrconf_net_exit(struct net *net)
-{
-        struct net_device *dev;
-        rtnl_lock();
-        /* clean dev list */
-        for_each_netdev(net, dev) {
-                if (__in6_dev_get(dev) == NULL)
-                        continue;
-                addrconf_ifdown(dev, 1);
-        }
-        addrconf_ifdown(net->loopback_dev, 2);
-        rtnl_unlock();
-}
-static struct pernet_operations addrconf_net_ops = {
-        .exit = addrconf_net_exit,
-};
 /*
 *      Init / cleanup code
 */
@@ -4506,10 +4486,6 @@ int __init addrconf_init(void)
        if (err)
                goto errlo;
-        err = register_pernet_device(&addrconf_net_ops);
-        if (err)
-                return err;
        register_netdevice_notifier(&ipv6_dev_notf);
        addrconf_verify(0);
@@ -4539,15 +4515,22 @@ errlo:
 void addrconf_cleanup(void)
 {
        struct inet6_ifaddr *ifa;
+        struct net_device *dev;
        int i;
        unregister_netdevice_notifier(&ipv6_dev_notf);
-        unregister_pernet_device(&addrconf_net_ops);
        unregister_pernet_subsys(&addrconf_ops);
        rtnl_lock();
+        /* clean dev list */
+        for_each_netdev(&init_net, dev) {
+                if (__in6_dev_get(dev) == NULL)
+                        continue;
+                addrconf_ifdown(dev, 1);
+        }
+        addrconf_ifdown(init_net.loopback_dev, 2);
        /*
         *      Check hash table.
         */
@@ -4568,6 +4551,4 @@ void addrconf_cleanup(void)
        del_timer(&addr_chk_timer);
        rtnl_unlock();
-        unregister_pernet_subsys(&addrconf_net_ops);
 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 94f74f5b0cbf..da944eca2ca6 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -72,6 +72,10 @@ MODULE_LICENSE("GPL");
 static struct list_head inetsw6[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw6_lock);
+static int disable_ipv6 = 0;
+module_param_named(disable, disable_ipv6, int, 0);
+MODULE_PARM_DESC(disable, "Disable IPv6 such that it is non-functional");
 static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
 {
        const int offset = sk->sk_prot->obj_size - sizeof(struct ipv6_pinfo);
@@ -797,6 +801,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
        unsigned int nlen;
        int flush = 1;
        int proto;
+        __wsum csum;
        if (unlikely(!pskb_may_pull(skb, sizeof(*iph))))
                goto out;
@@ -808,6 +813,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
        rcu_read_lock();
        proto = ipv6_gso_pull_exthdrs(skb, iph->nexthdr);
+        iph = ipv6_hdr(skb);
        IPV6_GRO_CB(skb)->proto = proto;
        ops = rcu_dereference(inet6_protos[proto]);
        if (!ops || !ops->gro_receive)
@@ -839,8 +845,13 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
        NAPI_GRO_CB(skb)->flush |= flush;
+        csum = skb->csum;
+        skb_postpull_rcsum(skb, iph, skb_network_header_len(skb));
        pp = ops->gro_receive(head, skb);
+        skb->csum = csum;
 out_unlock:
        rcu_read_unlock();
@@ -984,10 +995,21 @@ static int __init inet6_init(void)
 {
        struct sk_buff *dummy_skb;
        struct list_head *r;
-        int err;
+        int err = 0;
        BUILD_BUG_ON(sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb));
+        /* Register the socket-side information for inet6_create.  */
+        for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
+                INIT_LIST_HEAD(r);
+        if (disable_ipv6) {
+                printk(KERN_INFO
+                       "IPv6: Loaded, but administratively disabled, "
+                       "reboot required to enable\n");
+                goto out;
+        }
        err = proto_register(&tcpv6_prot, 1);
        if (err)
                goto out;
@@ -1005,10 +1027,6 @@ static int __init inet6_init(void)
                goto out_unregister_udplite_proto;
-        /* Register the socket-side information for inet6_create.  */
-        for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
-                INIT_LIST_HEAD(r);
        /* We MUST register RAW sockets before we create the ICMP6,
         * IGMP6, or NDISC control sockets.
         */
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 4f433847d95f..36dff8807183 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -443,10 +443,10 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
        if (xfrm_decode_session_reverse(skb, &fl2, AF_INET6))
                goto relookup_failed;
-        if (ip6_dst_lookup(sk, &dst2, &fl))
+        if (ip6_dst_lookup(sk, &dst2, &fl2))
                goto relookup_failed;
-        err = xfrm_lookup(net, &dst2, &fl, sk, XFRM_LOOKUP_ICMP);
+        err = xfrm_lookup(net, &dst2, &fl2, sk, XFRM_LOOKUP_ICMP);
        switch (err) {
        case 0:
                dst_release(dst);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 8fe267feb81e..1bcc3431859e 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -258,11 +258,11 @@ unique:
        if (twp != NULL) {
                *twp = tw;
-                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
        } else if (tw != NULL) {
                /* Silly. Should hash-dance instead... */
                inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
                inet_twsk_put(tw);
        }
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 29c7c99e69f7..52ee1dced2ff 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -298,6 +298,10 @@ static void fib6_dump_end(struct netlink_callback *cb)
        struct fib6_walker_t *w = (void*)cb->args[2];
        if (w) {
+                if (cb->args[4]) {
+                        cb->args[4] = 0;
+                        fib6_walker_unlink(w);
+                }
                cb->args[2] = 0;
                kfree(w);
        }
@@ -330,15 +334,12 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
                read_lock_bh(&table->tb6_lock);
                res = fib6_walk_continue(w);
                read_unlock_bh(&table->tb6_lock);
-                if (res != 0) {
+                if (res <= 0) {
-                        if (res < 0)
+                        fib6_walker_unlink(w);
-                                fib6_walker_unlink(w);
+                        cb->args[4] = 0;
-                        goto end;
                }
-                fib6_walker_unlink(w);
-                cb->args[4] = 0;
        }
-end:
        return res;
 }
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index c62dd247774f..7712578bdc66 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -323,17 +323,21 @@ static struct ip6_flowlabel *
 fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
          int optlen, int *err_p)
 {
-        struct ip6_flowlabel *fl;
+        struct ip6_flowlabel *fl = NULL;
        int olen;
        int addr_type;
        int err;
+        olen = optlen - CMSG_ALIGN(sizeof(*freq));
+        err = -EINVAL;
+        if (olen > 64 * 1024)
+                goto done;
        err = -ENOMEM;
        fl = kzalloc(sizeof(*fl), GFP_KERNEL);
        if (fl == NULL)
                goto done;
-        olen = optlen - CMSG_ALIGN(sizeof(*freq));
        if (olen > 0) {
                struct msghdr msg;
                struct flowi flowi;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 936f48946e20..f171e8dbac91 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -255,6 +255,7 @@ int ip6_mc_input(struct sk_buff *skb)
         *      IPv6 multicast router mode is now supported ;)
         */
        if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding &&
+            !(ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) &&
            likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) {
                /*
                 * Okay, we try to forward - split and duplicate
@@ -316,7 +317,6 @@ int ip6_mc_input(struct sk_buff *skb)
                }
                if (skb2) {
-                        skb2->dev = skb2->dst->dev;
                        ip6_mr_input(skb2);
                }
        }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4b15938bef4d..9fb49c3b518a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1105,6 +1105,18 @@ static inline int ip6_ufo_append_data(struct sock *sk,
        return err;
 }
+static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
+                                               gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
+static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
+                                                gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        int offset, int len, int odd, struct sk_buff *skb),
        void *from, int length, int transhdrlen,
@@ -1130,17 +1142,37 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 * setup for corking
                 */
                if (opt) {
-                        if (np->cork.opt == NULL) {
+                        if (WARN_ON(np->cork.opt))
-                                np->cork.opt = kmalloc(opt->tot_len,
-                                                       sk->sk_allocation);
-                                if (unlikely(np->cork.opt == NULL))
-                                        return -ENOBUFS;
-                        } else if (np->cork.opt->tot_len < opt->tot_len) {
-                                printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
                                return -EINVAL;
-                        }
-                        memcpy(np->cork.opt, opt, opt->tot_len);
+                        np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
-                        inet->cork.flags |= IPCORK_OPT;
+                        if (unlikely(np->cork.opt == NULL))
+                                return -ENOBUFS;
+                        np->cork.opt->tot_len = opt->tot_len;
+                        np->cork.opt->opt_flen = opt->opt_flen;
+                        np->cork.opt->opt_nflen = opt->opt_nflen;
+                        np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst0opt && !np->cork.opt->dst0opt)
+                                return -ENOBUFS;
+                        np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst1opt && !np->cork.opt->dst1opt)
+                                return -ENOBUFS;
+                        np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
+                                                           sk->sk_allocation);
+                        if (opt->hopopt && !np->cork.opt->hopopt)
+                                return -ENOBUFS;
+                        np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
+                                                            sk->sk_allocation);
+                        if (opt->srcrt && !np->cork.opt->srcrt)
+                                return -ENOBUFS;
                        /* need source address above miyazawa*/
                }
                dst_hold(&rt->u.dst);
@@ -1167,8 +1199,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        } else {
                rt = (struct rt6_info *)inet->cork.dst;
                fl = &inet->cork.fl;
-                if (inet->cork.flags & IPCORK_OPT)
+                opt = np->cork.opt;
-                        opt = np->cork.opt;
                transhdrlen = 0;
                exthdrlen = 0;
                mtu = inet->cork.fragsize;
@@ -1407,9 +1438,15 @@ error:
 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
 {
-        inet->cork.flags &= ~IPCORK_OPT;
+        if (np->cork.opt) {
-        kfree(np->cork.opt);
+                kfree(np->cork.opt->dst0opt);
-        np->cork.opt = NULL;
+                kfree(np->cork.opt->dst1opt);
+                kfree(np->cork.opt->hopopt);
+                kfree(np->cork.opt->srcrt);
+                kfree(np->cork.opt);
+                np->cork.opt = NULL;
+        }
        if (inet->cork.dst) {
                dst_release(inet->cork.dst);
                inet->cork.dst = NULL;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 58e2b0d93758..d994c55a5b16 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -249,8 +249,8 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
        }
        t = netdev_priv(dev);
-        ip6_tnl_dev_init(dev);
        t->parms = *p;
+        ip6_tnl_dev_init(dev);
        if ((err = register_netdevice(dev)) < 0)
                goto failed_free;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 3c51b2d827f4..228be551e9c1 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -48,6 +48,7 @@
 #include <linux/pim.h>
 #include <net/addrconf.h>
 #include <linux/netfilter_ipv6.h>
+#include <net/ip6_checksum.h>
 /* Big lock, protecting vif table, mrt cache and mroute socket state.
   Note that the changes are semaphored via rtnl_lock.
@@ -365,7 +366,9 @@ static int pim6_rcv(struct sk_buff *skb)
        pim = (struct pimreghdr *)skb_transport_header(skb);
        if (pim->type != ((PIM_VERSION << 4) | PIM_REGISTER) ||
            (pim->flags & PIM_NULL_REGISTER) ||
-            (ip_compute_csum((void *)pim, sizeof(*pim)) != 0 &&
+            (csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
+                             sizeof(*pim), IPPROTO_PIM,
+                             csum_partial((void *)pim, sizeof(*pim), 0)) &&
             csum_fold(skb_checksum(skb, 0, skb->len, 0))))
                goto drop;
@@ -392,7 +395,7 @@ static int pim6_rcv(struct sk_buff *skb)
        skb_pull(skb, (u8 *)encap - skb->data);
        skb_reset_network_header(skb);
        skb->dev = reg_dev;
-        skb->protocol = htons(ETH_P_IP);
+        skb->protocol = htons(ETH_P_IPV6);
        skb->ip_summed = 0;
        skb->pkt_type = PACKET_HOST;
        dst_release(skb->dst);
@@ -481,6 +484,7 @@ static int mif6_delete(struct net *net, int vifi)
 {
        struct mif_device *v;
        struct net_device *dev;
+        struct inet6_dev *in6_dev;
        if (vifi < 0 || vifi >= net->ipv6.maxvif)
                return -EADDRNOTAVAIL;
@@ -513,6 +517,10 @@ static int mif6_delete(struct net *net, int vifi)
        dev_set_allmulti(dev, -1);
+        in6_dev = __in6_dev_get(dev);
+        if (in6_dev)
+                in6_dev->cnf.mc_forwarding--;
        if (v->flags & MIFF_REGISTER)
                unregister_netdevice(dev);
@@ -622,6 +630,7 @@ static int mif6_add(struct net *net, struct mif6ctl *vifc, int mrtsock)
        int vifi = vifc->mif6c_mifi;
        struct mif_device *v = &net->ipv6.vif6_table[vifi];
        struct net_device *dev;
+        struct inet6_dev *in6_dev;
        int err;
        /* Is vif busy ? */
@@ -662,6 +671,10 @@ static int mif6_add(struct net *net, struct mif6ctl *vifc, int mrtsock)
                return -EINVAL;
        }
+        in6_dev = __in6_dev_get(dev);
+        if (in6_dev)
+                in6_dev->cnf.mc_forwarding++;
        /*
         *      Fill in the VIF structures
         */
@@ -838,8 +851,6 @@ static int ip6mr_cache_report(struct net *net, struct sk_buff *pkt, mifi_t mifi,
        skb->dst = dst_clone(pkt->dst);
        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        skb_pull(skb, sizeof(struct ipv6hdr));
        }
        if (net->ipv6.mroute6_sk == NULL) {
@@ -1222,8 +1233,10 @@ static int ip6mr_sk_init(struct sock *sk)
        rtnl_lock();
        write_lock_bh(&mrt_lock);
-        if (likely(net->ipv6.mroute6_sk == NULL))
+        if (likely(net->ipv6.mroute6_sk == NULL)) {
                net->ipv6.mroute6_sk = sk;
+                net->ipv6.devconf_all->mc_forwarding++;
+        }
        else
                err = -EADDRINUSE;
        write_unlock_bh(&mrt_lock);
@@ -1242,6 +1255,7 @@ int ip6mr_sk_done(struct sock *sk)
        if (sk == net->ipv6.mroute6_sk) {
                write_lock_bh(&mrt_lock);
                net->ipv6.mroute6_sk = NULL;
+                net->ipv6.devconf_all->mc_forwarding--;
                write_unlock_bh(&mrt_lock);
                mroute_clean_tables(net);
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index bd52151d31e9..72dbb6d1a6b3 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -26,7 +26,7 @@
 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
 #include <net/netfilter/nf_log.h>
-static unsigned long nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
+static unsigned int nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
 static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
                                unsigned int dataoff,
@@ -49,8 +49,19 @@ static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
 static const u_int8_t invmap[] = {
        [ICMPV6_ECHO_REQUEST - 128]     = ICMPV6_ECHO_REPLY + 1,
        [ICMPV6_ECHO_REPLY - 128]       = ICMPV6_ECHO_REQUEST + 1,
-        [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_QUERY + 1,
+        [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_REPLY + 1,
-        [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_REPLY +1
+        [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_QUERY +1
+};
+static const u_int8_t noct_valid_new[] = {
+        [ICMPV6_MGM_QUERY - 130] = 1,
+        [ICMPV6_MGM_REPORT -130] = 1,
+        [ICMPV6_MGM_REDUCTION - 130] = 1,
+        [NDISC_ROUTER_SOLICITATION - 130] = 1,
+        [NDISC_ROUTER_ADVERTISEMENT - 130] = 1,
+        [NDISC_NEIGHBOUR_SOLICITATION - 130] = 1,
+        [NDISC_NEIGHBOUR_ADVERTISEMENT - 130] = 1,
+        [ICMPV6_MLD2_REPORT - 130] = 1
 };
 static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
@@ -178,6 +189,7 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
 {
        const struct icmp6hdr *icmp6h;
        struct icmp6hdr _ih;
+        int type;
        icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
        if (icmp6h == NULL) {
@@ -189,11 +201,21 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
            nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
-                nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
+                if (LOG_INVALID(net, IPPROTO_ICMPV6))
-                              "nf_ct_icmpv6: ICMPv6 checksum failed\n");
+                        nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
+                                      "nf_ct_icmpv6: ICMPv6 checksum failed ");
                return -NF_ACCEPT;
        }
+        type = icmp6h->icmp6_type - 130;
+        if (type >= 0 && type < sizeof(noct_valid_new) &&
+            noct_valid_new[type]) {
+                skb->nfct = &nf_conntrack_untracked.ct_general;
+                skb->nfctinfo = IP_CT_NEW;
+                nf_conntrack_get(skb->nfct);
+                return NF_ACCEPT;
+        }
        /* is not error message ? */
        if (icmp6h->icmp6_type >= 128)
                return NF_ACCEPT;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c4a59824ac2c..9c574235c905 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -794,7 +794,7 @@ void ip6_route_input(struct sk_buff *skb)
                .proto = iph->nexthdr,
        };
-        if (rt6_need_strict(&iph->daddr))
+        if (rt6_need_strict(&iph->daddr) && skb->dev->type != ARPHRD_PIMREG)
                flags |= RT6_LOOKUP_F_IFACE;
        skb->dst = fib6_rule_lookup(net, &fl, flags, ip6_pol_route_input);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index f8bd8df5e257..7dcbde3ea7d9 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1285,6 +1285,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                                ext_hdrs[SADB_X_EXT_NAT_T_DPORT-1];
                        natt->encap_dport = n_port->sadb_x_nat_t_port_port;
                }
+                memset(&natt->encap_oa, 0, sizeof(natt->encap_oa));
        }
        err = xfrm_init_state(x);
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 5f510a13b9f0..c5c0c5271096 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -469,7 +469,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
        struct ieee80211_sub_if_data *sdata;
        u16 start_seq_num;
        u8 *state;
-        int ret;
+        int ret = 0;
        if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
                return -EINVAL;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 5abbc3f07dd6..b9074824862a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -699,7 +699,8 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                return 0;
        /* Setting ad-hoc mode on non-IBSS channel is not supported. */
-        if (sdata->local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS)
+        if (sdata->local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS &&
+            type == NL80211_IFTYPE_ADHOC)
                return -EOPNOTSUPP;
        /*
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 929ba542fd72..1159bdb4119c 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -107,6 +107,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
        sta->flags = WLAN_STA_AUTHORIZED;
        sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
+        rate_control_rate_init(sta);
        return sta;
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 5ba721b6a399..2b890af01ba4 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -620,8 +620,8 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
        if (use_short_slot != bss_conf->use_short_slot) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: switched to %s slot"
+                        printk(KERN_DEBUG "%s: switched to %s slot time"
-                               " (BSSID=%s)\n",
+                               " (BSSID=%pM)\n",
                               sdata->dev->name,
                               use_short_slot ? "short" : "long",
                               ifsta->bssid);
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 2b3b490a6073..3824990d340b 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -395,13 +395,15 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 {
        struct minstrel_sta_info *mi = priv_sta;
        struct minstrel_priv *mp = priv;
-        struct minstrel_rate *mr_ctl;
+        struct ieee80211_local *local = hw_to_local(mp->hw);
+        struct ieee80211_rate *ctl_rate;
        unsigned int i, n = 0;
        unsigned int t_slot = 9; /* FIXME: get real slot time */
        mi->lowest_rix = rate_lowest_index(sband, sta);
-        mr_ctl = &mi->r[rix_to_ndx(mi, mi->lowest_rix)];
+        ctl_rate = &sband->bitrates[mi->lowest_rix];
-        mi->sp_ack_dur = mr_ctl->ack_time;
+        mi->sp_ack_dur = ieee80211_frame_duration(local, 10, ctl_rate->bitrate,
+                                !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
        for (i = 0; i < sband->n_bitrates; i++) {
                struct minstrel_rate *mr = &mi->r[n];
@@ -416,7 +418,7 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
                mr->rix = i;
                mr->bitrate = sband->bitrates[i].bitrate / 5;
-                calc_rate_durations(mi, hw_to_local(mp->hw), mr,
+                calc_rate_durations(mi, local, mr,
                                &sband->bitrates[i]);
                /* calculate maximum number of retransmissions before
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index dc2606d0ae77..e49a5b99cf10 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -195,7 +195,6 @@ struct sta_ampdu_mlme {
 * @tx_packets: number of RX/TX MSDUs
 * @tx_bytes: number of bytes transmitted to this STA
 * @tx_fragments: number of transmitted MPDUs
- * @last_txrate: description of the last used transmit rate
 * @tid_seq: per-TID sequence numbers for sending to this STA
 * @ampdu_mlme: A-MPDU state machine state
 * @timer_to_tid: identity mapping to ID timers
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index a4af3a124cce..94de5033f0b6 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1307,8 +1307,10 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                if (is_multicast_ether_addr(hdr->addr3))
                        memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
                else
-                        if (mesh_nexthop_lookup(skb, osdata))
+                        if (mesh_nexthop_lookup(skb, osdata)) {
-                                return  0;
+                                dev_put(odev);
+                                return 0;
+                        }
                if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
                        IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.mesh,
                                                            fwded_frames);
@@ -1341,6 +1343,8 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                                list) {
                                if (!netif_running(sdata->dev))
                                        continue;
+                                if (sdata->vif.type != NL80211_IFTYPE_AP)
+                                        continue;
                                if (compare_ether_addr(sdata->dev->dev_addr,
                                                       hdr->addr2)) {
                                        dev_hold(sdata->dev);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7e83f74cd5de..90ce9ddb9451 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -469,7 +469,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
                                   const struct nf_conntrack_tuple *repl,
                                   gfp_t gfp)
 {
-        struct nf_conn *ct = NULL;
+        struct nf_conn *ct;
        if (unlikely(!nf_conntrack_hash_rnd_initted)) {
                get_random_bytes(&nf_conntrack_hash_rnd, 4);
@@ -551,7 +551,7 @@ init_conntrack(struct net *net,
        }
        ct = nf_conntrack_alloc(net, tuple, &repl_tuple, GFP_ATOMIC);
-        if (ct == NULL || IS_ERR(ct)) {
+        if (IS_ERR(ct)) {
                pr_debug("Can't allocate conntrack.\n");
                return (struct nf_conntrack_tuple_hash *)ct;
        }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 00e8c27130ff..cb78aa00399e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -434,7 +434,7 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
        } else
                return NOTIFY_DONE;
-        if (!nfnetlink_has_listeners(group))
+        if (!item->report && !nfnetlink_has_listeners(group))
                return NOTIFY_DONE;
        skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
@@ -831,13 +831,16 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct,
        if (!parse_nat_setup) {
 #ifdef CONFIG_MODULES
                rcu_read_unlock();
+                spin_unlock_bh(&nf_conntrack_lock);
                nfnl_unlock();
                if (request_module("nf-nat-ipv4") < 0) {
                        nfnl_lock();
+                        spin_lock_bh(&nf_conntrack_lock);
                        rcu_read_lock();
                        return -EOPNOTSUPP;
                }
                nfnl_lock();
+                spin_lock_bh(&nf_conntrack_lock);
                rcu_read_lock();
                if (nfnetlink_parse_nat_setup_hook)
                        return -EAGAIN;
@@ -1134,7 +1137,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
        struct nf_conntrack_helper *helper;
        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
-        if (ct == NULL || IS_ERR(ct))
+        if (IS_ERR(ct))
                return -ENOMEM;
        if (!cda[CTA_TIMEOUT])
@@ -1212,6 +1215,16 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                }
        }
+#ifdef CONFIG_NF_NAT_NEEDED
+        if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
+                err = ctnetlink_change_nat_seq_adj(ct, cda);
+                if (err < 0) {
+                        rcu_read_unlock();
+                        goto err;
+                }
+        }
+#endif
        if (cda[CTA_PROTOINFO]) {
                err = ctnetlink_change_protoinfo(ct, cda);
                if (err < 0) {
@@ -1489,7 +1502,8 @@ static int ctnetlink_expect_event(struct notifier_block *this,
        } else
                return NOTIFY_DONE;
-        if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
+        if (!item->report &&
+            !nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
                return NOTIFY_DONE;
        skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index fa49dc7fe100..c712e9fc6bba 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -39,7 +39,7 @@
 #endif
 #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
-#define NFULNL_TIMEOUT_DEFAULT  HZ      /* every second */
+#define NFULNL_TIMEOUT_DEFAULT  100     /* every second */
 #define NFULNL_QTHRESH_DEFAULT  100     /* 100 packets */
 #define NFULNL_COPY_RANGE_MAX   0xFFFF  /* max packet size is limited by 16-bit struct nfattr nfa_len field */
@@ -590,8 +590,10 @@ nfulnl_log_packet(u_int8_t pf,
        qthreshold = inst->qthreshold;
        /* per-rule qthreshold overrides per-instance */
-        if (qthreshold > li->u.ulog.qthreshold)
+        if (li->u.ulog.qthreshold)
-                qthreshold = li->u.ulog.qthreshold;
+                if (qthreshold > li->u.ulog.qthreshold)
+                        qthreshold = li->u.ulog.qthreshold;
        switch (inst->copy_mode) {
        case NFULNL_COPY_META:
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 89837a4eef76..5baccfa5a0de 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -273,6 +273,10 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
                                have_rev = 1;
                }
        }
+        if (af != NFPROTO_UNSPEC && !have_rev)
+                return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
        return have_rev;
 }
@@ -289,6 +293,10 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
                                have_rev = 1;
                }
        }
+        if (af != NFPROTO_UNSPEC && !have_rev)
+                return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
        return have_rev;
 }
@@ -819,59 +827,143 @@ static const struct file_operations xt_table_ops = {
        .release = seq_release_net,
 };
-static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
+/*
+ * Traverse state for ip{,6}_{tables,matches} for helping crossing
+ * the multi-AF mutexes.
+ */
+struct nf_mttg_trav {
+        struct list_head *head, *curr;
+        uint8_t class, nfproto;
+};
+enum {
+        MTTG_TRAV_INIT,
+        MTTG_TRAV_NFP_UNSPEC,
+        MTTG_TRAV_NFP_SPEC,
+        MTTG_TRAV_DONE,
+};
+static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
+    bool is_target)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+        static const uint8_t next_class[] = {
-        u_int16_t af = (unsigned long)pde->data;
+                [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,
+                [MTTG_TRAV_NFP_SPEC]   = MTTG_TRAV_DONE,
+        };
+        struct nf_mttg_trav *trav = seq->private;
+        switch (trav->class) {
+        case MTTG_TRAV_INIT:
+                trav->class = MTTG_TRAV_NFP_UNSPEC;
+                mutex_lock(&xt[NFPROTO_UNSPEC].mutex);
+                trav->head = trav->curr = is_target ?
+                        &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;
+                break;
+        case MTTG_TRAV_NFP_UNSPEC:
+                trav->curr = trav->curr->next;
+                if (trav->curr != trav->head)
+                        break;
+                mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
+                mutex_lock(&xt[trav->nfproto].mutex);
+                trav->head = trav->curr = is_target ?
+                        &xt[trav->nfproto].target : &xt[trav->nfproto].match;
+                trav->class = next_class[trav->class];
+                break;
+        case MTTG_TRAV_NFP_SPEC:
+                trav->curr = trav->curr->next;
+                if (trav->curr != trav->head)
+                        break;
+                /* fallthru, _stop will unlock */
+        default:
+                return NULL;
+        }
-        mutex_lock(&xt[af].mutex);
+        if (ppos != NULL)
-        return seq_list_start(&xt[af].match, *pos);
+                ++*ppos;
+        return trav;
 }
-static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos,
+    bool is_target)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+        struct nf_mttg_trav *trav = seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        unsigned int j;
-        return seq_list_next(v, &xt[af].match, pos);
+        trav->class = MTTG_TRAV_INIT;
+        for (j = 0; j < *pos; ++j)
+                if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)
+                        return NULL;
+        return trav;
 }
-static void xt_match_seq_stop(struct seq_file *seq, void *v)
+static void xt_mttg_seq_stop(struct seq_file *seq, void *v)
 {
-        struct proc_dir_entry *pde = seq->private;
+        struct nf_mttg_trav *trav = seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+                mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
+                break;
+        case MTTG_TRAV_NFP_SPEC:
+                mutex_unlock(&xt[trav->nfproto].mutex);
+                break;
+        }
+}
-        mutex_unlock(&xt[af].mutex);
+static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        return xt_mttg_seq_start(seq, pos, false);
 }
-static int xt_match_seq_show(struct seq_file *seq, void *v)
+static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct xt_match *match = list_entry(v, struct xt_match, list);
+        return xt_mttg_seq_next(seq, v, ppos, false);
+}
-        if (strlen(match->name))
+static int xt_match_seq_show(struct seq_file *seq, void *v)
-                return seq_printf(seq, "%s\n", match->name);
+{
-        else
+        const struct nf_mttg_trav *trav = seq->private;
-                return 0;
+        const struct xt_match *match;
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+        case MTTG_TRAV_NFP_SPEC:
+                if (trav->curr == trav->head)
+                        return 0;
+                match = list_entry(trav->curr, struct xt_match, list);
+                return (*match->name == '\0') ? 0 :
+                       seq_printf(seq, "%s\n", match->name);
+        }
+        return 0;
 }
 static const struct seq_operations xt_match_seq_ops = {
        .start  = xt_match_seq_start,
        .next   = xt_match_seq_next,
-        .stop   = xt_match_seq_stop,
+        .stop   = xt_mttg_seq_stop,
        .show   = xt_match_seq_show,
 };
 static int xt_match_open(struct inode *inode, struct file *file)
 {
+        struct seq_file *seq;
+        struct nf_mttg_trav *trav;
        int ret;
-        ret = seq_open(file, &xt_match_seq_ops);
+        trav = kmalloc(sizeof(*trav), GFP_KERNEL);
-        if (!ret) {
+        if (trav == NULL)
-                struct seq_file *seq = file->private_data;
+                return -ENOMEM;
-                seq->private = PDE(inode);
+        ret = seq_open(file, &xt_match_seq_ops);
+        if (ret < 0) {
+                kfree(trav);
+                return ret;
        }
-        return ret;
+        seq = file->private_data;
+        seq->private = trav;
+        trav->nfproto = (unsigned long)PDE(inode)->data;
+        return 0;
 }
 static const struct file_operations xt_match_ops = {
@@ -879,62 +971,63 @@ static const struct file_operations xt_match_ops = {
        .open    = xt_match_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+        return xt_mttg_seq_start(seq, pos, true);
-        u_int16_t af = (unsigned long)pde->data;
-        mutex_lock(&xt[af].mutex);
-        return seq_list_start(&xt[af].target, *pos);
 }
-static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+        return xt_mttg_seq_next(seq, v, ppos, true);
-        u_int16_t af = (unsigned long)pde->data;
-        return seq_list_next(v, &xt[af].target, pos);
-}
-static void xt_target_seq_stop(struct seq_file *seq, void *v)
-{
-        struct proc_dir_entry *pde = seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-        mutex_unlock(&xt[af].mutex);
 }
 static int xt_target_seq_show(struct seq_file *seq, void *v)
 {
-        struct xt_target *target = list_entry(v, struct xt_target, list);
+        const struct nf_mttg_trav *trav = seq->private;
+        const struct xt_target *target;
-        if (strlen(target->name))
-                return seq_printf(seq, "%s\n", target->name);
+        switch (trav->class) {
-        else
+        case MTTG_TRAV_NFP_UNSPEC:
-                return 0;
+        case MTTG_TRAV_NFP_SPEC:
+                if (trav->curr == trav->head)
+                        return 0;
+                target = list_entry(trav->curr, struct xt_target, list);
+                return (*target->name == '\0') ? 0 :
+                       seq_printf(seq, "%s\n", target->name);
+        }
+        return 0;
 }
 static const struct seq_operations xt_target_seq_ops = {
        .start  = xt_target_seq_start,
        .next   = xt_target_seq_next,
-        .stop   = xt_target_seq_stop,
+        .stop   = xt_mttg_seq_stop,
        .show   = xt_target_seq_show,
 };
 static int xt_target_open(struct inode *inode, struct file *file)
 {
+        struct seq_file *seq;
+        struct nf_mttg_trav *trav;
        int ret;
-        ret = seq_open(file, &xt_target_seq_ops);
+        trav = kmalloc(sizeof(*trav), GFP_KERNEL);
-        if (!ret) {
+        if (trav == NULL)
-                struct seq_file *seq = file->private_data;
+                return -ENOMEM;
-                seq->private = PDE(inode);
+        ret = seq_open(file, &xt_target_seq_ops);
+        if (ret < 0) {
+                kfree(trav);
+                return ret;
        }
-        return ret;
+        seq = file->private_data;
+        seq->private = trav;
+        trav->nfproto = (unsigned long)PDE(inode)->data;
+        return 0;
 }
 static const struct file_operations xt_target_ops = {
@@ -942,7 +1035,7 @@ static const struct file_operations xt_target_ops = {
        .open    = xt_target_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 #define FORMAT_TABLES   "_tables_names"
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index fe80b614a400..791e030ea903 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -542,7 +542,7 @@ recent_mt_proc_write(struct file *file, const char __user *input,
        struct recent_entry *e;
        char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")];
        const char *c = buf;
-        union nf_inet_addr addr;
+        union nf_inet_addr addr = {};
        u_int16_t family;
        bool add, succ;
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index e223cb43ae8e..a189ada9128f 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -105,7 +105,7 @@ match_packet(const struct sk_buff *skb,
        switch (chunk_match_type) {
        case SCTP_CHUNK_MATCH_ALL:
-                return SCTP_CHUNKMAP_IS_CLEAR(info->chunkmap);
+                return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
        case SCTP_CHUNK_MATCH_ANY:
                return false;
        case SCTP_CHUNK_MATCH_ONLY:
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index 29375ba8db73..93acaa59d108 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -243,6 +243,17 @@ static struct xt_match xt_time_mt_reg __read_mostly = {
 static int __init time_mt_init(void)
 {
+        int minutes = sys_tz.tz_minuteswest;
+        if (minutes < 0) /* east of Greenwich */
+                printk(KERN_INFO KBUILD_MODNAME
+                       ": kernel timezone is +%02d%02d\n",
+                       -minutes / 60, -minutes % 60);
+        else /* west of Greenwich */
+                printk(KERN_INFO KBUILD_MODNAME
+                       ": kernel timezone is -%02d%02d\n",
+                       minutes / 60, minutes % 60);
        return xt_register_match(&xt_time_mt_reg);
 }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 9eb895c7a2a9..3ae3cb816563 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1084,6 +1084,13 @@ out:
        return 0;
 }
+/**
+ * netlink_set_err - report error to broadcast listeners
+ * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
+ * @pid: the PID of a process that we want to skip (if any)
+ * @groups: the broadcast group that will notice the error
+ * @code: error code, must be negative (as usual in kernelspace)
+ */
 void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
 {
        struct netlink_set_err_data info;
@@ -1093,7 +1100,8 @@ void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
        info.exclude_sk = ssk;
        info.pid = pid;
        info.group = group;
-        info.code = code;
+        /* sk->sk_err wants a positive error value */
+        info.code = -code;
        read_lock(&nl_table_lock);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 5f94db2f3e9e..1fc4a7885c41 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -77,6 +77,7 @@
 #include <linux/poll.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/mutex.h>
 #ifdef CONFIG_INET
 #include <net/inet_common.h>
@@ -175,6 +176,7 @@ struct packet_sock {
 #endif
        struct packet_type      prot_hook;
        spinlock_t              bind_lock;
+        struct mutex            pg_vec_lock;
        unsigned int            running:1,      /* prot_hook is attached*/
                                auxdata:1,
                                origdev:1;
@@ -220,13 +222,13 @@ static void *packet_lookup_frame(struct packet_sock *po, unsigned int position,
        h.raw = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
        switch (po->tp_version) {
        case TPACKET_V1:
-                if (status != h.h1->tp_status ? TP_STATUS_USER :
+                if (status != (h.h1->tp_status ? TP_STATUS_USER :
-                                                TP_STATUS_KERNEL)
+                                                TP_STATUS_KERNEL))
                        return NULL;
                break;
        case TPACKET_V2:
-                if (status != h.h2->tp_status ? TP_STATUS_USER :
+                if (status != (h.h2->tp_status ? TP_STATUS_USER :
-                                                TP_STATUS_KERNEL)
+                                                TP_STATUS_KERNEL))
                        return NULL;
                break;
        }
@@ -1069,6 +1071,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
         */
        spin_lock_init(&po->bind_lock);
+        mutex_init(&po->pg_vec_lock);
        po->prot_hook.func = packet_rcv;
        if (sock->type == SOCK_PACKET)
@@ -1865,6 +1868,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
        synchronize_net();
        err = -EBUSY;
+        mutex_lock(&po->pg_vec_lock);
        if (closing || atomic_read(&po->mapped) == 0) {
                err = 0;
 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
@@ -1886,6 +1890,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
                if (atomic_read(&po->mapped))
                        printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
        }
+        mutex_unlock(&po->pg_vec_lock);
        spin_lock(&po->bind_lock);
        if (was_running && !po->running) {
@@ -1918,7 +1923,7 @@ static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_st
        size = vma->vm_end - vma->vm_start;
-        lock_sock(sk);
+        mutex_lock(&po->pg_vec_lock);
        if (po->pg_vec == NULL)
                goto out;
        if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
@@ -1941,7 +1946,7 @@ static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_st
        err = 0;
 out:
-        release_sock(sk);
+        mutex_unlock(&po->pg_vec_lock);
        return err;
 }
 #endif
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 6a91a32a80c1..4aa888584d20 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -207,7 +207,6 @@ static int gprs_xmit(struct sk_buff *skb, struct net_device *dev)
                                dev->name, err);
                dev->stats.tx_aborted_errors++;
                dev->stats.tx_errors++;
-                dev_kfree_skb(skb);
        } else {
                dev->stats.tx_packets++;
                dev->stats.tx_bytes += len;
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index bb3e67849b38..8ad2b5333881 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -553,7 +553,7 @@ static int pep_do_rcv(struct sock *sk, struct sk_buff *skb)
 {
        struct pep_sock *pn = pep_sk(sk);
        struct sock *sknode;
-        struct pnpipehdr *hdr = pnp_hdr(skb);
+        struct pnpipehdr *hdr;
        struct sockaddr_pn dst;
        int err = NET_RX_SUCCESS;
        u8 pipe_handle;
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d7d2bed7a699..eac5e7bb7365 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -284,13 +284,13 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
                if (IS_ERR(trans)) {
                        call = ERR_CAST(trans);
                        trans = NULL;
-                        goto out;
+                        goto out_notrans;
                }
        } else {
                trans = rx->trans;
                if (!trans) {
                        call = ERR_PTR(-ENOTCONN);
-                        goto out;
+                        goto out_notrans;
                }
                atomic_inc(&trans->usage);
        }
@@ -315,6 +315,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
        rxrpc_put_bundle(trans, bundle);
 out:
        rxrpc_put_transport(trans);
+out_notrans:
        release_sock(&rx->sk);
        _leave(" = %p", call);
        return call;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 5c72a116b1a4..f8f047b61245 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -183,13 +183,6 @@ override:
                if (R_tab == NULL)
                        goto failure;
-                if (!est && (ret == ACT_P_CREATED ||
-                             !gen_estimator_active(&police->tcf_bstats,
-                                                   &police->tcf_rate_est))) {
-                        err = -EINVAL;
-                        goto failure;
-                }
                if (parm->peakrate.rate) {
                        P_tab = qdisc_get_rtab(&parm->peakrate,
                                               tb[TCA_POLICE_PEAKRATE]);
@@ -205,6 +198,12 @@ override:
                                            &police->tcf_lock, est);
                if (err)
                        goto failure_unlock;
+        } else if (tb[TCA_POLICE_AVRATE] &&
+                   (ret == ACT_P_CREATED ||
+                    !gen_estimator_active(&police->tcf_bstats,
+                                          &police->tcf_rate_est))) {
+                err = -EINVAL;
+                goto failure_unlock;
        }
        /* No failure allowed after this point */
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index f6b4fa97df70..e36e94ab4e10 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -66,11 +66,15 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 {
        struct drr_sched *q = qdisc_priv(sch);
        struct drr_class *cl = (struct drr_class *)*arg;
+        struct nlattr *opt = tca[TCA_OPTIONS];
        struct nlattr *tb[TCA_DRR_MAX + 1];
        u32 quantum;
        int err;
-        err = nla_parse_nested(tb, TCA_DRR_MAX, tca[TCA_OPTIONS], drr_policy);
+        if (!opt)
+                return -EINVAL;
+        err = nla_parse_nested(tb, TCA_DRR_MAX, opt, drr_policy);
        if (err < 0)
                return err;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 5070643ce534..2f0f0b04d3fb 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -661,12 +661,13 @@ static void htb_charge_class(struct htb_sched *q, struct htb_class *cl,
 * next pending event (0 for no event in pq).
 * Note: Applied are events whose have cl->pq_key <= q->now.
 */
-static psched_time_t htb_do_events(struct htb_sched *q, int level)
+static psched_time_t htb_do_events(struct htb_sched *q, int level,
+                                   unsigned long start)
 {
        /* don't run for longer than 2 jiffies; 2 is used instead of
           1 to simplify things when jiffy is going to be incremented
           too soon */
-        unsigned long stop_at = jiffies + 2;
+        unsigned long stop_at = start + 2;
        while (time_before(jiffies, stop_at)) {
                struct htb_class *cl;
                long diff;
@@ -685,8 +686,8 @@ static psched_time_t htb_do_events(struct htb_sched *q, int level)
                if (cl->cmode != HTB_CAN_SEND)
                        htb_add_to_wait_tree(q, cl, diff);
        }
-        /* too much load - let's continue on next jiffie */
+        /* too much load - let's continue on next jiffie (including above) */
-        return q->now + PSCHED_TICKS_PER_SEC / HZ;
+        return q->now + 2 * PSCHED_TICKS_PER_SEC / HZ;
 }
 /* Returns class->node+prio from id-tree where classe's id is >= id. NULL
@@ -845,6 +846,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
        struct htb_sched *q = qdisc_priv(sch);
        int level;
        psched_time_t next_event;
+        unsigned long start_at;
        /* try to dequeue direct packets as high prio (!) to minimize cpu work */
        skb = __skb_dequeue(&q->direct_queue);
@@ -857,6 +859,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
        if (!sch->q.qlen)
                goto fin;
        q->now = psched_get_time();
+        start_at = jiffies;
        next_event = q->now + 5 * PSCHED_TICKS_PER_SEC;
@@ -866,14 +869,14 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
                psched_time_t event;
                if (q->now >= q->near_ev_cache[level]) {
-                        event = htb_do_events(q, level);
+                        event = htb_do_events(q, level, start_at);
                        if (!event)
                                event = q->now + PSCHED_TICKS_PER_SEC;
                        q->near_ev_cache[level] = event;
                } else
                        event = q->near_ev_cache[level];
-                if (event && next_event > event)
+                if (next_event > event)
                        next_event = event;
                m = ~q->row_mask[level];
diff --git a/net/sctp/input.c b/net/sctp/input.c
index bf612d954d41..2e4a8646dbc3 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -249,6 +249,19 @@ int sctp_rcv(struct sk_buff *skb)
         */
        sctp_bh_lock_sock(sk);
+        if (sk != rcvr->sk) {
+                /* Our cached sk is different from the rcvr->sk.  This is
+                 * because migrate()/accept() may have moved the association
+                 * to a new socket and released all the sockets.  So now we
+                 * are holding a lock on the old socket while the user may
+                 * be doing something with the new socket.  Switch our veiw
+                 * of the current sk.
+                 */
+                sctp_bh_unlock_sock(sk);
+                sk = rcvr->sk;
+                sctp_bh_lock_sock(sk);
+        }
        if (sock_owned_by_user(sk)) {
                SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG);
                sctp_add_backlog(sk, skb);
diff --git a/net/sctp/output.c b/net/sctp/output.c
index c3f417f7ec6e..73639355157e 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -324,14 +324,16 @@ append:
        switch (chunk->chunk_hdr->type) {
            case SCTP_CID_DATA:
                retval = sctp_packet_append_data(packet, chunk);
+                if (SCTP_XMIT_OK != retval)
+                        goto finish;
                /* Disallow SACK bundling after DATA. */
                packet->has_sack = 1;
                /* Disallow AUTH bundling after DATA */
                packet->has_auth = 1;
                /* Let it be knows that packet has DATA in it */
                packet->has_data = 1;
-                if (SCTP_XMIT_OK != retval)
+                /* timestamp the chunk for rtx purposes */
-                        goto finish;
+                chunk->sent_at = jiffies;
                break;
            case SCTP_CID_COOKIE_ECHO:
                packet->has_cookie_echo = 1;
@@ -470,7 +472,6 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                        } else
                                chunk->resent = 1;
-                        chunk->sent_at = jiffies;
                        has_data = 1;
                }
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 247ebc95c1e5..bc411c896216 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -929,7 +929,6 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                }
                /* Finally, transmit new packets.  */
-                start_timer = 0;
                while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
                        /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
                         * stream identifier.
@@ -1028,7 +1027,7 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                        list_add_tail(&chunk->transmitted_list,
                                      &transport->transmitted);
-                        sctp_transport_reset_timers(transport, start_timer-1);
+                        sctp_transport_reset_timers(transport, 0);
                        q->empty = 0;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b78e3be69013..c4986d0f7419 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -717,15 +717,20 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
 static int sctp_ctl_sock_init(void)
 {
        int err;
-        sa_family_t family;
+        sa_family_t family = PF_INET;
        if (sctp_get_pf_specific(PF_INET6))
                family = PF_INET6;
-        else
-                family = PF_INET;
        err = inet_ctl_sock_create(&sctp_ctl_sock, family,
                                   SOCK_SEQPACKET, IPPROTO_SCTP, &init_net);
+        /* If IPv6 socket could not be created, try the IPv4 socket */
+        if (err < 0 && family == PF_INET6)
+                err = inet_ctl_sock_create(&sctp_ctl_sock, AF_INET,
+                                           SOCK_SEQPACKET, IPPROTO_SCTP,
+                                           &init_net);
        if (err < 0) {
                printk(KERN_ERR
                       "SCTP: Failed to create the SCTP control socket.\n");
@@ -1322,9 +1327,8 @@ SCTP_STATIC __init int sctp_init(void)
 out:
        return status;
 err_v6_add_protocol:
-        sctp_v6_del_protocol();
-err_add_protocol:
        sctp_v4_del_protocol();
+err_add_protocol:
        inet_ctl_sock_destroy(sctp_ctl_sock);
 err_ctl_sock_init:
        sctp_v6_protosw_exit();
@@ -1335,7 +1339,6 @@ err_protosw_init:
        sctp_v4_pf_exit();
        sctp_v6_pf_exit();
        sctp_sysctl_unregister();
-        list_del(&sctp_af_inet.list);
        free_pages((unsigned long)sctp_port_hashtable,
                   get_order(sctp_port_hashsize *
                             sizeof(struct sctp_bind_hashbucket)));
@@ -1383,7 +1386,6 @@ SCTP_STATIC __exit void sctp_exit(void)
        sctp_v4_pf_exit();
        sctp_sysctl_unregister();
-        list_del(&sctp_af_inet.list);
        free_pages((unsigned long)sctp_assoc_hashtable,
                   get_order(sctp_assoc_hashsize *
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index e1d6076b4f59..b5495aecab60 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -787,36 +787,48 @@ static void sctp_cmd_process_operr(sctp_cmd_seq_t *cmds,
                                   struct sctp_association *asoc,
                                   struct sctp_chunk *chunk)
 {
-        struct sctp_operr_chunk *operr_chunk;
        struct sctp_errhdr *err_hdr;
+        struct sctp_ulpevent *ev;
-        operr_chunk = (struct sctp_operr_chunk *)chunk->chunk_hdr;
+        while (chunk->chunk_end > chunk->skb->data) {
-        err_hdr = &operr_chunk->err_hdr;
+                err_hdr = (struct sctp_errhdr *)(chunk->skb->data);
-        switch (err_hdr->cause) {
+                ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
-        case SCTP_ERROR_UNKNOWN_CHUNK:
+                                                     GFP_ATOMIC);
-        {
+                if (!ev)
-                struct sctp_chunkhdr *unk_chunk_hdr;
+                        return;
-                unk_chunk_hdr = (struct sctp_chunkhdr *)err_hdr->variable;
+                sctp_ulpq_tail_event(&asoc->ulpq, ev);
-                switch (unk_chunk_hdr->type) {
-                /* ADDIP 4.1 A9) If the peer responds to an ASCONF with an
+                switch (err_hdr->cause) {
-                 * ERROR chunk reporting that it did not recognized the ASCONF
+                case SCTP_ERROR_UNKNOWN_CHUNK:
-                 * chunk type, the sender of the ASCONF MUST NOT send any
+                {
-                 * further ASCONF chunks and MUST stop its T-4 timer.
+                        sctp_chunkhdr_t *unk_chunk_hdr;
-                 */
-                case SCTP_CID_ASCONF:
+                        unk_chunk_hdr = (sctp_chunkhdr_t *)err_hdr->variable;
-                        asoc->peer.asconf_capable = 0;
+                        switch (unk_chunk_hdr->type) {
-                        sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
+                        /* ADDIP 4.1 A9) If the peer responds to an ASCONF with
+                         * an ERROR chunk reporting that it did not recognized
+                         * the ASCONF chunk type, the sender of the ASCONF MUST
+                         * NOT send any further ASCONF chunks and MUST stop its
+                         * T-4 timer.
+                         */
+                        case SCTP_CID_ASCONF:
+                                if (asoc->peer.asconf_capable == 0)
+                                        break;
+                                asoc->peer.asconf_capable = 0;
+                                sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
                                        SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
+                                break;
+                        default:
+                                break;
+                        }
                        break;
+                }
                default:
                        break;
                }
-                break;
-        }
-        default:
-                break;
        }
 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 3a0cd075914f..f88dfded0e3a 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3163,7 +3163,6 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
                                        sctp_cmd_seq_t *commands)
 {
        struct sctp_chunk *chunk = arg;
-        struct sctp_ulpevent *ev;
        if (!sctp_vtag_verify(chunk, asoc))
                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -3173,21 +3172,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
                                                  commands);
-        while (chunk->chunk_end > chunk->skb->data) {
+        sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
-                ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
+                        SCTP_CHUNK(chunk));
-                                                     GFP_ATOMIC);
-                if (!ev)
-                        goto nomem;
-                sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
-                                SCTP_ULPEVENT(ev));
-                sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
-                                SCTP_CHUNK(chunk));
-        }
        return SCTP_DISPOSITION_CONSUME;
-nomem:
-        return SCTP_DISPOSITION_NOMEM;
 }
 /*
diff --git a/net/socket.c b/net/socket.c
index 06603d73c411..35dd7371752a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1214,7 +1214,7 @@ int sock_create_kern(int family, int type, int protocol, struct socket **res)
        return __sock_create(&init_net, family, type, protocol, res, 1);
 }
-asmlinkage long sys_socket(int family, int type, int protocol)
+SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
 {
        int retval;
        struct socket *sock;
@@ -1255,8 +1255,8 @@ out_release:
 *      Create a pair of connected sockets.
 */
-asmlinkage long sys_socketpair(int family, int type, int protocol,
+SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
-                               int __user *usockvec)
+                int __user *, usockvec)
 {
        struct socket *sock1, *sock2;
        int fd1, fd2, err;
@@ -1356,7 +1356,7 @@ out_fd1:
 *      the protocol layer (having also checked the address is ok).
 */
-asmlinkage long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
+SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
 {
        struct socket *sock;
        struct sockaddr_storage address;
@@ -1385,7 +1385,7 @@ asmlinkage long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
 *      ready for listening.
 */
-asmlinkage long sys_listen(int fd, int backlog)
+SYSCALL_DEFINE2(listen, int, fd, int, backlog)
 {
        struct socket *sock;
        int err, fput_needed;
@@ -1418,8 +1418,8 @@ asmlinkage long sys_listen(int fd, int backlog)
 *      clean when we restucture accept also.
 */
-asmlinkage long sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
+SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
-                            int __user *upeer_addrlen, int flags)
+                int __user *, upeer_addrlen, int, flags)
 {
        struct socket *sock, *newsock;
        struct file *newfile;
@@ -1502,8 +1502,8 @@ out_fd:
        goto out_put;
 }
-asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
+SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
-                           int __user *upeer_addrlen)
+                int __user *, upeer_addrlen)
 {
        return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
 }
@@ -1520,8 +1520,8 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
 *      include the -EINPROGRESS status for such sockets.
 */
-asmlinkage long sys_connect(int fd, struct sockaddr __user *uservaddr,
+SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
-                            int addrlen)
+                int, addrlen)
 {
        struct socket *sock;
        struct sockaddr_storage address;
@@ -1552,8 +1552,8 @@ out:
 *      name to user space.
 */
-asmlinkage long sys_getsockname(int fd, struct sockaddr __user *usockaddr,
+SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
-                                int __user *usockaddr_len)
+                int __user *, usockaddr_len)
 {
        struct socket *sock;
        struct sockaddr_storage address;
@@ -1583,8 +1583,8 @@ out:
 *      name to user space.
 */
-asmlinkage long sys_getpeername(int fd, struct sockaddr __user *usockaddr,
+SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
-                                int __user *usockaddr_len)
+                int __user *, usockaddr_len)
 {
        struct socket *sock;
        struct sockaddr_storage address;
@@ -1615,9 +1615,9 @@ asmlinkage long sys_getpeername(int fd, struct sockaddr __user *usockaddr,
 *      the protocol.
 */
-asmlinkage long sys_sendto(int fd, void __user *buff, size_t len,
+SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
-                           unsigned flags, struct sockaddr __user *addr,
+                unsigned, flags, struct sockaddr __user *, addr,
-                           int addr_len)
+                int, addr_len)
 {
        struct socket *sock;
        struct sockaddr_storage address;
@@ -1660,7 +1660,8 @@ out:
 *      Send a datagram down a socket.
 */
-asmlinkage long sys_send(int fd, void __user *buff, size_t len, unsigned flags)
+SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
+                unsigned, flags)
 {
        return sys_sendto(fd, buff, len, flags, NULL, 0);
 }
@@ -1671,9 +1672,9 @@ asmlinkage long sys_send(int fd, void __user *buff, size_t len, unsigned flags)
 *      sender address from kernel to user space.
 */
-asmlinkage long sys_recvfrom(int fd, void __user *ubuf, size_t size,
+SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
-                             unsigned flags, struct sockaddr __user *addr,
+                unsigned, flags, struct sockaddr __user *, addr,
-                             int __user *addr_len)
+                int __user *, addr_len)
 {
        struct socket *sock;
        struct iovec iov;
@@ -1725,8 +1726,8 @@ asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
 *      to pass the user mode parameter for the protocols to sort out.
 */
-asmlinkage long sys_setsockopt(int fd, int level, int optname,
+SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
-                               char __user *optval, int optlen)
+                char __user *, optval, int, optlen)
 {
        int err, fput_needed;
        struct socket *sock;
@@ -1759,8 +1760,8 @@ out_put:
 *      to pass a user mode parameter for the protocols to sort out.
 */
-asmlinkage long sys_getsockopt(int fd, int level, int optname,
+SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
-                               char __user *optval, int __user *optlen)
+                char __user *, optval, int __user *, optlen)
 {
        int err, fput_needed;
        struct socket *sock;
@@ -1789,7 +1790,7 @@ out_put:
 *      Shutdown a socket.
 */
-asmlinkage long sys_shutdown(int fd, int how)
+SYSCALL_DEFINE2(shutdown, int, fd, int, how)
 {
        int err, fput_needed;
        struct socket *sock;
@@ -1815,7 +1816,7 @@ asmlinkage long sys_shutdown(int fd, int how)
 *      BSD sendmsg interface
 */
-asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
+SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
 {
        struct compat_msghdr __user *msg_compat =
            (struct compat_msghdr __user *)msg;
@@ -1921,8 +1922,8 @@ out:
 *      BSD recvmsg interface
 */
-asmlinkage long sys_recvmsg(int fd, struct msghdr __user *msg,
+SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
-                            unsigned int flags)
+                unsigned int, flags)
 {
        struct compat_msghdr __user *msg_compat =
            (struct compat_msghdr __user *)msg;
@@ -2045,7 +2046,7 @@ static const unsigned char nargs[19]={
 *  it is set by the callees.
 */
-asmlinkage long sys_socketcall(int call, unsigned long __user *args)
+SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 {
        unsigned long a[6];
        unsigned long a0, a1;
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
new file mode 100644
index 000000000000..5592883e1e4a
--- /dev/null
+++ b/net/sunrpc/Kconfig
@@ -0,0 +1,78 @@
+config SUNRPC
+        tristate
+config SUNRPC_GSS
+        tristate
+config SUNRPC_XPRT_RDMA
+        tristate
+        depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS && EXPERIMENTAL
+        default SUNRPC && INFINIBAND
+        help
+          This option allows the NFS client and server to support
+          an RDMA-enabled transport.
+          To compile RPC client RDMA transport support as a module,
+          choose M here: the module will be called xprtrdma.
+          If unsure, say N.
+config SUNRPC_REGISTER_V4
+        bool "Register local RPC services via rpcbind v4 (EXPERIMENTAL)"
+        depends on SUNRPC && EXPERIMENTAL
+        default n
+        help
+          Sun added support for registering RPC services at an IPv6
+          address by creating two new versions of the rpcbind protocol
+          (RFC 1833).
+          This option enables support in the kernel RPC server for
+          registering kernel RPC services via version 4 of the rpcbind
+          protocol.  If you enable this option, you must run a portmapper
+          daemon that supports rpcbind protocol version 4.
+          Serving NFS over IPv6 from knfsd (the kernel's NFS server)
+          requires that you enable this option and use a portmapper that
+          supports rpcbind version 4.
+          If unsure, say N to get traditional behavior (register kernel
+          RPC services using only rpcbind version 2).  Distributions
+          using the legacy Linux portmapper daemon must say N here.
+config RPCSEC_GSS_KRB5
+        tristate "Secure RPC: Kerberos V mechanism (EXPERIMENTAL)"
+        depends on SUNRPC && EXPERIMENTAL
+        select SUNRPC_GSS
+        select CRYPTO
+        select CRYPTO_MD5
+        select CRYPTO_DES
+        select CRYPTO_CBC
+        help
+          Choose Y here to enable Secure RPC using the Kerberos version 5
+          GSS-API mechanism (RFC 1964).
+          Secure RPC calls with Kerberos require an auxiliary user-space
+          daemon which may be found in the Linux nfs-utils package
+          available from http://linux-nfs.org/.  In addition, user-space
+          Kerberos support should be installed.
+          If unsure, say N.
+config RPCSEC_GSS_SPKM3
+        tristate "Secure RPC: SPKM3 mechanism (EXPERIMENTAL)"
+        depends on SUNRPC && EXPERIMENTAL
+        select SUNRPC_GSS
+        select CRYPTO
+        select CRYPTO_MD5
+        select CRYPTO_DES
+        select CRYPTO_CAST5
+        select CRYPTO_CBC
+        help
+          Choose Y here to enable Secure RPC using the SPKM3 public key
+          GSS-API mechansim (RFC 2025).
+          Secure RPC calls with SPKM3 require an auxiliary userspace
+          daemon which may be found in the Linux nfs-utils package
+          available from http://linux-nfs.org/.
+          If unsure, say N.
diff --git a/net/wimax/debugfs.c b/net/wimax/debugfs.c
index 87cf4430079c..94d216a46407 100644
--- a/net/wimax/debugfs.c
+++ b/net/wimax/debugfs.c
@@ -28,17 +28,6 @@
 #include "debug-levels.h"
-/* Debug framework control of debug levels */
-struct d_level D_LEVEL[] = {
-        D_SUBMODULE_DEFINE(debugfs),
-        D_SUBMODULE_DEFINE(id_table),
-        D_SUBMODULE_DEFINE(op_msg),
-        D_SUBMODULE_DEFINE(op_reset),
-        D_SUBMODULE_DEFINE(op_rfkill),
-        D_SUBMODULE_DEFINE(stack),
-};
-size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
 #define __debugfs_register(prefix, name, parent)                        \
 do {                                                                    \
        result = d_level_register_debugfs(prefix, name, parent);        \
diff --git a/net/wimax/id-table.c b/net/wimax/id-table.c
index 5e685f7eda90..72273abfcb16 100644
--- a/net/wimax/id-table.c
+++ b/net/wimax/id-table.c
@@ -94,12 +94,13 @@ struct wimax_dev *wimax_dev_get_by_genl_info(
        list_for_each_entry(wimax_dev, &wimax_id_table, id_table_node) {
                if (wimax_dev->net_dev->ifindex == ifindex) {
                        dev_hold(wimax_dev->net_dev);
-                        break;
+                        goto found;
                }
        }
-        if (wimax_dev == NULL)
+        wimax_dev = NULL;
-                d_printf(1, NULL, "wimax: no devices found with ifindex %d\n",
+        d_printf(1, NULL, "wimax: no devices found with ifindex %d\n",
-                         ifindex);
+                 ifindex);
+found:
        spin_unlock(&wimax_id_table_lock);
        d_fnend(3, NULL, "(info %p ifindex %d) = %p\n",
                info, ifindex, wimax_dev);
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index d4da92f8981a..3869c0327882 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -516,6 +516,19 @@ void wimax_dev_rm(struct wimax_dev *wimax_dev)
 }
 EXPORT_SYMBOL_GPL(wimax_dev_rm);
+/* Debug framework control of debug levels */
+struct d_level D_LEVEL[] = {
+        D_SUBMODULE_DEFINE(debugfs),
+        D_SUBMODULE_DEFINE(id_table),
+        D_SUBMODULE_DEFINE(op_msg),
+        D_SUBMODULE_DEFINE(op_reset),
+        D_SUBMODULE_DEFINE(op_rfkill),
+        D_SUBMODULE_DEFINE(stack),
+};
+size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
 struct genl_family wimax_gnl_family = {
        .id = GENL_ID_GENERATE,
        .name = "WiMAX",
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4f877535e666..bd0a16c3de5e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -380,7 +380,8 @@ static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
        freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
-        if (freq_diff <= 0 || freq_range->max_bandwidth_khz > freq_diff)
+        if (freq_range->end_freq_khz <= freq_range->start_freq_khz ||
+                        freq_range->max_bandwidth_khz > freq_diff)
                return false;
        return true;
@@ -421,6 +422,31 @@ static u32 freq_max_bandwidth(const struct ieee80211_freq_range *freq_range,
        return 0;
 }
+/**
+ * freq_in_rule_band - tells us if a frequency is in a frequency band
+ * @freq_range: frequency rule we want to query
+ * @freq_khz: frequency we are inquiring about
+ *
+ * This lets us know if a specific frequency rule is or is not relevant to
+ * a specific frequency's band. Bands are device specific and artificial
+ * definitions (the "2.4 GHz band" and the "5 GHz band"), however it is
+ * safe for now to assume that a frequency rule should not be part of a
+ * frequency's band if the start freq or end freq are off by more than 2 GHz.
+ * This resolution can be lowered and should be considered as we add
+ * regulatory rule support for other "bands".
+ **/
+static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
+        u32 freq_khz)
+{
+#define ONE_GHZ_IN_KHZ  1000000
+        if (abs(freq_khz - freq_range->start_freq_khz) <= (2 * ONE_GHZ_IN_KHZ))
+                return true;
+        if (abs(freq_khz - freq_range->end_freq_khz) <= (2 * ONE_GHZ_IN_KHZ))
+                return true;
+        return false;
+#undef ONE_GHZ_IN_KHZ
+}
 /* Converts a country IE to a regulatory domain. A regulatory domain
 * structure has a lot of information which the IE doesn't yet have,
 * so for the other values we use upper max values as we will intersect
@@ -473,6 +499,7 @@ static struct ieee80211_regdomain *country_ie_2_rd(
         * calculate the number of reg rules we will need. We will need one
         * for each channel subband */
        while (country_ie_len >= 3) {
+                int end_channel = 0;
                struct ieee80211_country_ie_triplet *triplet =
                        (struct ieee80211_country_ie_triplet *) country_ie;
                int cur_sub_max_channel = 0, cur_channel = 0;
@@ -484,9 +511,25 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                        continue;
                }
+                /* 2 GHz */
+                if (triplet->chans.first_channel <= 14)
+                        end_channel = triplet->chans.first_channel +
+                                triplet->chans.num_channels;
+                else
+                        /*
+                         * 5 GHz -- For example in country IEs if the first
+                         * channel given is 36 and the number of channels is 4
+                         * then the individual channel numbers defined for the
+                         * 5 GHz PHY by these parameters are: 36, 40, 44, and 48
+                         * and not 36, 37, 38, 39.
+                         *
+                         * See: http://tinyurl.com/11d-clarification
+                         */
+                        end_channel =  triplet->chans.first_channel +
+                                (4 * (triplet->chans.num_channels - 1));
                cur_channel = triplet->chans.first_channel;
-                cur_sub_max_channel = ieee80211_channel_to_frequency(
+                cur_sub_max_channel = end_channel;
-                        cur_channel + triplet->chans.num_channels);
                /* Basic sanity check */
                if (cur_sub_max_channel < cur_channel)
@@ -538,6 +581,7 @@ static struct ieee80211_regdomain *country_ie_2_rd(
        /* This time around we fill in the rd */
        while (country_ie_len >= 3) {
+                int end_channel = 0;
                struct ieee80211_country_ie_triplet *triplet =
                        (struct ieee80211_country_ie_triplet *) country_ie;
                struct ieee80211_reg_rule *reg_rule = NULL;
@@ -559,6 +603,14 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                reg_rule->flags = flags;
+                /* 2 GHz */
+                if (triplet->chans.first_channel <= 14)
+                        end_channel = triplet->chans.first_channel +
+                                triplet->chans.num_channels;
+                else
+                        end_channel =  triplet->chans.first_channel +
+                                (4 * (triplet->chans.num_channels - 1));
                /* The +10 is since the regulatory domain expects
                 * the actual band edge, not the center of freq for
                 * its start and end freqs, assuming 20 MHz bandwidth on
@@ -568,8 +620,7 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                                triplet->chans.first_channel) - 10);
                freq_range->end_freq_khz =
                        MHZ_TO_KHZ(ieee80211_channel_to_frequency(
-                                triplet->chans.first_channel +
+                                end_channel) + 10);
-                                        triplet->chans.num_channels) + 10);
                /* Large arbitrary values, we intersect later */
                /* Increment this if we ever support >= 40 MHz channels
@@ -748,12 +799,23 @@ static u32 map_regdom_flags(u32 rd_flags)
 *      this value to the maximum allowed bandwidth.
 * @reg_rule: the regulatory rule which we have for this frequency
 *
- * Use this function to get the regulatory rule for a specific frequency.
+ * Use this function to get the regulatory rule for a specific frequency on
+ * a given wireless device. If the device has a specific regulatory domain
+ * it wants to follow we respect that unless a country IE has been received
+ * and processed already.
+ *
+ * Returns 0 if it was able to find a valid regulatory rule which does
+ * apply to the given center_freq otherwise it returns non-zero. It will
+ * also return -ERANGE if we determine the given center_freq does not even have
+ * a regulatory rule for a frequency range in the center_freq's band. See
+ * freq_in_rule_band() for our current definition of a band -- this is purely
+ * subjective and right now its 802.11 specific.
 */
 static int freq_reg_info(u32 center_freq, u32 *bandwidth,
                         const struct ieee80211_reg_rule **reg_rule)
 {
        int i;
+        bool band_rule_found = false;
        u32 max_bandwidth = 0;
        if (!cfg80211_regdomain)
@@ -767,7 +829,15 @@ static int freq_reg_info(u32 center_freq, u32 *bandwidth,
                rr = &cfg80211_regdomain->reg_rules[i];
                fr = &rr->freq_range;
                pr = &rr->power_rule;
+                /* We only need to know if one frequency rule was
+                 * was in center_freq's band, that's enough, so lets
+                 * not overwrite it once found */
+                if (!band_rule_found)
+                        band_rule_found = freq_in_rule_band(fr, center_freq);
                max_bandwidth = freq_max_bandwidth(fr, center_freq);
                if (max_bandwidth && *bandwidth <= max_bandwidth) {
                        *reg_rule = rr;
                        *bandwidth = max_bandwidth;
@@ -775,23 +845,64 @@ static int freq_reg_info(u32 center_freq, u32 *bandwidth,
                }
        }
+        if (!band_rule_found)
+                return -ERANGE;
        return !max_bandwidth;
 }
-static void handle_channel(struct ieee80211_channel *chan)
+static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
+                           unsigned int chan_idx)
 {
        int r;
-        u32 flags = chan->orig_flags;
+        u32 flags;
        u32 max_bandwidth = 0;
        const struct ieee80211_reg_rule *reg_rule = NULL;
        const struct ieee80211_power_rule *power_rule = NULL;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *chan;
+        sband = wiphy->bands[band];
+        BUG_ON(chan_idx >= sband->n_channels);
+        chan = &sband->channels[chan_idx];
+        flags = chan->orig_flags;
        r = freq_reg_info(MHZ_TO_KHZ(chan->center_freq),
                &max_bandwidth, &reg_rule);
        if (r) {
-                flags |= IEEE80211_CHAN_DISABLED;
+                /* This means no regulatory rule was found in the country IE
-                chan->flags = flags;
+                 * with a frequency range on the center_freq's band, since
+                 * IEEE-802.11 allows for a country IE to have a subset of the
+                 * regulatory information provided in a country we ignore
+                 * disabling the channel unless at least one reg rule was
+                 * found on the center_freq's band. For details see this
+                 * clarification:
+                 *
+                 * http://tinyurl.com/11d-clarification
+                 */
+                if (r == -ERANGE &&
+                    last_request->initiator == REGDOM_SET_BY_COUNTRY_IE) {
+#ifdef CONFIG_CFG80211_REG_DEBUG
+                        printk(KERN_DEBUG "cfg80211: Leaving channel %d MHz "
+                                "intact on %s - no rule found in band on "
+                                "Country IE\n",
+                                chan->center_freq, wiphy_name(wiphy));
+#endif
+                } else {
+                /* In this case we know the country IE has at least one reg rule
+                 * for the band so we respect its band definitions */
+#ifdef CONFIG_CFG80211_REG_DEBUG
+                        if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
+                                printk(KERN_DEBUG "cfg80211: Disabling "
+                                        "channel %d MHz on %s due to "
+                                        "Country IE\n",
+                                        chan->center_freq, wiphy_name(wiphy));
+#endif
+                        flags |= IEEE80211_CHAN_DISABLED;
+                        chan->flags = flags;
+                }
                return;
        }
@@ -808,12 +919,16 @@ static void handle_channel(struct ieee80211_channel *chan)
                chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
-static void handle_band(struct ieee80211_supported_band *sband)
+static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
 {
-        int i;
+        unsigned int i;
+        struct ieee80211_supported_band *sband;
+        BUG_ON(!wiphy->bands[band]);
+        sband = wiphy->bands[band];
        for (i = 0; i < sband->n_channels; i++)
-                handle_channel(&sband->channels[i]);
+                handle_channel(wiphy, band, i);
 }
 static bool ignore_reg_update(struct wiphy *wiphy, enum reg_set_by setby)
@@ -840,7 +955,7 @@ void wiphy_update_regulatory(struct wiphy *wiphy, enum reg_set_by setby)
        enum ieee80211_band band;
        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                if (wiphy->bands[band])
-                        handle_band(wiphy->bands[band]);
+                        handle_band(wiphy, band);
                if (wiphy->reg_notifier)
                        wiphy->reg_notifier(wiphy, setby);
        }
@@ -1170,7 +1285,7 @@ static void reg_country_ie_process_debug(
        if (intersected_rd) {
                printk(KERN_DEBUG "cfg80211: We intersect both of these "
                        "and get:\n");
-                print_regdomain_info(rd);
+                print_regdomain_info(intersected_rd);
                return;
        }
        printk(KERN_DEBUG "cfg80211: Intersection between both failed\n");
author	Ingo Molnar <mingo@elte.hu>	2009-03-11 05:49:34 -0400
committer	Ingo Molnar <mingo@elte.hu>	2009-03-11 05:49:34 -0400
commit	d95c3578120e5bc4784069439f00ccb1b5f87717 (patch)
tree	c819de31de3983f3d69f223ede07667ff23bf7da /net
parent	ba1d755a36f66101aa88ac9ebb54694def6ec38d (diff)
parent	78b020d035074fc3aa4d017353bb2c32e2aff56f (diff)